@opengeni/runtime 3.2.2 → 3.4.0

package/dist/chunk-ETTCGPBT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sandbox/index.ts","../src/sandbox/host-archive-temporary.ts","../src/sandbox/providers/modal-command-raw-page.ts","../src/sandbox/providers/modal-legacy-command-control.ts","../src/sandbox/providers/modal-command-argv.ts","../src/sandbox/host-archive-spool.ts","../src/sandbox/workspace-archive.ts","../src/sandbox/providers/index.ts","../src/sandbox/capabilities.ts","../src/sandbox/providers/types.ts","../src/sandbox/providers/blaxel.ts","../src/sandbox/providers/cloudflare.ts","../src/sandbox/providers/daytona.ts","../src/sandbox/providers/docker.ts","../src/sandbox/providers/docker-workspace-drain.ts","../src/sandbox/providers/e2b.ts","../src/sandbox/providers/local.ts","../../../node_modules/.bun/@openai+agents-extensions@0.14.3+2947a48661dbc659/node_modules/@openai/agents-extensions/src/sandbox/modal/sandbox.ts","../../../node_modules/.bun/@openai+agents-extensions@0.14.3+2947a48661dbc659/node_modules/@openai/agents-extensions/src/sandbox/modal/mounts.ts","../src/sandbox/providers/modal.ts","../src/sandbox/providers/modal-command-session.ts","../src/sandbox/provider-errors.ts","../src/sandbox/providers/modal-materialization-verification.ts","../src/sandbox/providers/modal-command-control.ts","../src/sandbox/providers/modal-command-observation-errors.ts","../src/sandbox/providers/modal-create-session.ts","../src/sandbox/providers/modal-create-boundary.ts","../src/sandbox/providers/none.ts","../src/sandbox/providers/opensandbox-adapter.ts","../src/sandbox/stream-port.ts","../src/sandbox/stream-token.ts","../src/sandbox/providers/opensandbox-command-stream.ts","../src/sandbox/providers/opensandbox.ts","../src/sandbox/providers/runloop.ts","../src/sandbox/selfhosted/session.ts","../src/sandbox/selfhosted/file-transfer.ts","../src/sandbox/browser-control-http.ts","../src/sandbox/selfhosted/retry-policy.ts","../src/sandbox/selfhosted/op-stream.ts","../src/sandbox/selfhosted/op-transport.ts","../src/sandbox/providers/selfhosted.ts","../src/sandbox/providers/vercel.ts","../src/sandbox/select.ts","../src/sandbox/command-result.ts","../src/sandbox/run-state-compat.ts","../src/sandbox/tool-call-command-not-started.ts","../src/sandbox/providers/modal-native-create-preparation.ts","../src/sandbox/display-stack.ts","../src/sandbox/terminal-server.ts","../src/sandbox/browser-control-server.ts","../src/sandbox/browser-control-client.ts","../src/sandbox/browser-control-stream.ts","../src/sandbox/run-credentials.ts","../src/sandbox/codemode-token.ts","../src/sandbox/codemode-client.ts","../src/sandbox/codemode-authority.ts","../src/sandbox/recording.ts","../src/sandbox/selfhosted/capabilities.ts","../src/sandbox/selfhosted/testing.ts","../src/sandbox/selfhosted/op-testing.ts","../src/sandbox/routing/backend-resolver.ts"],"sourcesContent":["export type {\n  ProviderCommandPersistence,\n  ProviderCommandSession,\n} from \"./provider-command-session\";\nexport {\n  ProviderCommandStartOutcomeUnknownError,\n  ProviderCommandInputOutcomeUnknownError,\n  ProviderCommandObservationUnavailableError,\n  isProviderCommandObservationUnavailableError,\n} from \"./provider-command-session\";\n// @opengeni/runtime/sandbox — the agent-loop-free sandbox leaf.\n//\n// This module is the load-bearing pre-req for the API-direct control plane\n// (docs/connected-machines.md). It exposes the sandbox client factory plus\n// the resume / recovery-envelope helpers that the API needs to touch a box by\n// id (resume-by-id, file/exec/port ops) WITHOUT importing the @openai/agents\n// agent-loop graph.\n//\n// IMPORT DISCIPLINE (enforced by packages/runtime/test/sandbox-leaf-no-agent-loop.test.ts):\n//   - ALLOWED: the per-provider sandbox SDK build imports\n//       `@openai/agents/sandbox`, `@openai/agents/sandbox/local`,\n//       `@openai/agents-extensions/sandbox/modal`\n//     and the workspace `@opengeni/config` / `@opengeni/contracts` packages.\n//   - FORBIDDEN: the agent-loop entrypoints — the bare `@openai/agents`,\n//       `@openai/agents-extensions`, or `@openai/agents-core` roots, and the\n//       loop symbols (`Agent`, `run`, `Runner`, `RunState`).\n// The barrel `packages/runtime/src/index.ts` re-exports everything here via\n// `export * from \"./sandbox\"`, so existing consumers (apps/worker) are\n// unchanged.\n\nimport type { Settings } from \"@opengeni/config\";\nimport { collectSandboxEnvironment, parseExposedPorts } from \"@opengeni/config\";\nexport type { WorkspaceArchiveSpool, VerifiedHostWorkspaceArchive } from \"./archive-spool\";\nexport {\n  sweepOrphanedHostArchiveTemporaryDirectoriesOnce,\n  workspaceArchiveDownloadTemporaryDirectory,\n} from \"./host-archive-temporary\";\nexport type { DockerHostWorkspaceRelease } from \"./providers/docker-workspace-drain\";\nexport { reduceModalRawOutputPage } from \"./providers/modal-command-raw-page\";\nexport type {\n  ModalRawOutputPage,\n  ModalRawOutputStreams,\n  ModalRawOutputExit,\n} from \"./providers/modal-command-raw-page\";\nimport type { WorkspaceArchiveSpool } from \"./archive-spool\";\nimport {\n  convertHostWorkspaceArchiveToTar,\n  restoreHostWorkspaceArchive,\n  type PortableWorkspaceTar,\n} from \"./host-archive-spool\";\nexport {\n  captureWorkspaceArchiveForStorage,\n  disposeWorkspaceArchive,\n  type VerifiedWorkspaceArchivePayload,\n} from \"./workspace-archive\";\n\nimport {\n  BROWSER_CONTROL_PORT,\n  DESKTOP_STREAM_PORT,\n  OPENGENI_SANDBOX_PROVIDER_INSTANCE_ID_FIELD,\n  TERMINAL_STREAM_PORT,\n  omitInlineWorkspaceArchiveWhenObjectRefPresent,\n  parseWorkspaceArchiveObjectRef,\n  parseWorkspaceArchiveDescriptor,\n  type WorkspaceArchiveObjectRef,\n  type TarWorkspaceArchiveDescriptor,\n  type SandboxBackend,\n  type SandboxProviderContinuityRecovery,\n} from \"@opengeni/contracts\";\nimport type {\n  Manifest,\n  SandboxClient,\n  SandboxSessionLike,\n  SandboxSessionState,\n} from \"@openai/agents/sandbox\";\nimport { serializeManifestRecord } from \"@openai/agents-core/sandbox/internal\";\nimport { isProviderApiThrottleError, PROVIDER_REGISTRY } from \"./providers\";\nimport { ensureModalRegistryImage } from \"./providers/modal\";\nimport type { ModalCreateIntent } from \"./providers/modal-create-boundary\";\nimport type { ProviderRegistration } from \"./providers/types\";\nimport { sandboxBackendForSdkBackendId } from \"./select\";\nimport {\n  SandboxConfigError,\n  SandboxExactResumeReplacedError,\n  SandboxProviderContinuityUnavailableError,\n  SandboxResumeIdentityMismatchError,\n  SandboxResumeIdentityUnavailableError,\n  SandboxResumeStateUnavailableError,\n} from \"./errors\";\nimport { isProviderSandboxNotFoundError } from \"./provider-errors\";\nimport {\n  decodeNativeSnapshotRef,\n  readVerifiedWorkspaceArchive,\n  verifyRestoredWorkspace,\n  verifyRestoredWorkspaceContents,\n  workspaceArchiveExcludedPaths,\n  WorkspaceArchiveIntegrityError,\n  type VerifiedWorkspaceArchive,\n  type WorkspaceArchiveDescriptor,\n} from \"./workspace-archive\";\nimport type { RuntimeMetricsHooks } from \"../metrics\";\nimport { normalizeProtocolJsonValue } from \"../protocol-json\";\nimport { sandboxCommandExitCode, sandboxCommandStillRunning } from \"./command-result\";\nimport { parseExecBannerSessionId } from \"./exec-banner\";\nimport { runStateCompatibilityProvider, runStateExposedPortsRecord } from \"./run-state-compat\";\nimport type { ExposedPortEndpoint } from \"./stream-port\";\n\n// Re-export the config-owned environment/port helpers from the leaf so the\n// API-direct control plane can pull its full sandbox-construction surface from\n// a single agent-loop-free entrypoint. They physically live in @opengeni/config\n// (moving them into runtime would create a config→runtime cycle — ledger CR8).\nexport { collectSandboxEnvironment, parseExposedPorts } from \"@opengeni/config\";\nexport {\n  SandboxMaterializationVerificationError,\n  materializationVerificationDiagnostic,\n  type MaterializationFailureReason,\n  type MaterializationVerificationDiagnostic,\n} from \"./materialization-verification-error\";\nexport { sendCommandInput, type CommandInputSession } from \"./command-input\";\nexport { OpStreamExecClient, type OpStreamOutputFrame } from \"./selfhosted/op-stream\";\n\nexport {\n  repairSerializedRunStateExposedPorts,\n  runStateCompatibilityProvider,\n  runStateExposedPortsRecord,\n  type RunStateExposedPortsCompatibilityRepair,\n  type RunStateExposedPortsCompatibilityResult,\n} from \"./run-state-compat\";\n\n// The provider registry surface — the descriptor table self-test, the per-\n// provider registrations, selection + capability negotiation, and the typed\n// construction errors. All agent-loop-free, so the API-direct control plane\n// imports them from this one leaf.\nexport {\n  CAPABILITY_DESCRIPTORS,\n  DESKTOP_STREAM_PORT,\n  assertDescriptorRegistryInvariants,\n  type CapabilityDescriptor,\n} from \"./capabilities\";\nexport {\n  SandboxConfigError,\n  SandboxExactResumeInstanceUnavailableError,\n  SandboxExactResumeReplacedError,\n  SandboxProviderContinuityUnavailableError,\n  SandboxProviderUnavailableError,\n  SandboxResumeIdentityMismatchError,\n  SandboxResumeIdentityUnavailableError,\n  SandboxResumeStateUnavailableError,\n} from \"./errors\";\nexport {\n  PROVIDER_REGISTRY,\n  assertProviderRegistryInvariants,\n  buildImmutableProviderImage,\n  isProviderApiThrottleError,\n  prepareProviderForTeardownAfterCapture,\n  providerSupportsImmutableImageBuild,\n  renewSandboxProviderExpiration,\n  providerWorkspaceCapturePolicy,\n  providerWorkspaceCaptureIsPointInTime,\n  type ProviderRegistration,\n  type ProviderConstructionContext,\n  type ProviderExactResumeMode,\n  type ProviderImmutableImageBuildInput,\n  type ProviderImmutableImageBuildResult,\n  type ProviderExpirationRenewalInput,\n  type ProviderWorkspaceCapturePolicy,\n  type ProviderWorkspaceCaptureTakeover,\n} from \"./providers\";\nexport {\n  classifyProviderSandboxFailure,\n  isProviderSandboxGoneDuringRoutedOperation,\n  isProviderSandboxNotFoundError,\n  isProviderSandboxTransientError,\n  type ProviderSandboxFailure,\n  type ProviderSandboxFailureKind,\n} from \"./provider-errors\";\nexport {\n  WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION,\n  WorkspaceArchiveIntegrityError,\n  captureVerifiedWorkspaceArchive,\n  decodeNativeSnapshotRef,\n  encodeNativeSnapshotRef,\n  describeLegacyNativeSnapshotArchive,\n  describeNativeSnapshotArchive,\n  fingerprintSandboxWorkspace,\n  inlineWorkspaceArchiveForRestore,\n  parseWorkspaceArchiveDescriptor,\n  readVerifiedWorkspaceArchive,\n  verifyRestoredWorkspace,\n  type NativeSnapshotDescriptor,\n  type NativeSnapshotProvider,\n  type NativeSnapshotRef,\n  type TarWorkspaceArchiveDescriptor,\n  type VerifiedWorkspaceArchive,\n  type WorkspaceArchiveDescriptor,\n  type WorkspaceArchiveIntegrityCode,\n  type WorkspaceTreeFingerprint,\n} from \"./workspace-archive\";\nexport {\n  ToolCallCommandNotStartedError,\n  toolCallCommandNotStartedCallIds,\n  withCommandNotStartedCallProof,\n} from \"./tool-call-command-not-started\";\nexport {\n  ensureModalRegistryImage,\n  deleteModalCheckpointSnapshot,\n  inspectModalSandboxLifecycle,\n  isModalTaskExecStartPreDispatchUnavailableError,\n  isModalCommandStartOutcomeUnknownError,\n  modalSessionMatchesCheckpointProviderBinding,\n  modalSandboxAttributionEnvironment,\n  modalSandboxAttributionTags,\n  resolveModalCheckpointProviderBinding,\n  findModalProviderCreateReceipt,\n  resolveModalCheckpointProviderBindingForLiveSandbox,\n  resolveModalCheckpointProviderBindingForSession,\n  modalAppHasRunningSandboxes,\n  sweepModalOrphanSandboxes,\n  tagModalSandbox,\n  terminateModalSandboxById,\n  type LiveModalSandboxLeaseAttribution,\n  type ModalModuleLoader,\n  type ModalCheckpointProviderBinding,\n  type ModalOrphanSweepResult,\n  type ModalOrphanSweepTermination,\n  type ModalSandboxAttribution,\n  type RevalidateModalOrphanTermination,\n} from \"./providers/modal\";\nexport {\n  getModalCommandStartInvocation,\n  withModalCommandStartSignal,\n  type ModalCommandStartInvocation,\n} from \"./providers/modal-command-start-errors\";\n// Pure correlation only: these passive exports grant no dispatch authority.\nexport {\n  compileNativeFreshCreate,\n  describeNativeFreshCreate,\n  type NativeFreshCreateSpec,\n  type NativeFreshCreatePreparation,\n  type NativeFreshCreateCompilation,\n} from \"./providers/modal-native-create-preparation\";\nexport {\n  OpenSandboxClient,\n  OpenSandboxSession,\n  setOpenSandboxApplyDiff,\n  type OpenSandboxApplyDiff,\n  type OpenSandboxClientOptions,\n  type OpenSandboxEditor,\n  type OpenSandboxSessionState,\n} from \"./providers/opensandbox-adapter\";\nexport {\n  selectBackend,\n  sdkBackendIdForSandboxBackend,\n  sandboxBackendForSdkBackendId,\n  backendSupportsOs,\n  desktopCapableBackend,\n  negotiateCapabilities,\n  type NegotiationContext,\n} from \"./select\";\n\n// Scoped data-plane stream-token mint/verify (P3.1). Agent-loop-free; the API\n// pulls these from this leaf to authorize the desktop pixel plane.\nexport {\n  STREAM_TOKEN_DEFAULT_TTL_SECONDS,\n  mintStreamToken,\n  verifyStreamToken,\n  StreamTokenPayload,\n  type MintStreamTokenInput,\n  type StreamTokenPayloadType,\n} from \"./stream-token\";\n\n// The Channel-B desktop display-stack launcher (P4.1). Exec-launched,\n// flock-idempotent; the worker (per-turn) and the API (per viewer op) both drive\n// it from this leaf to bring up Xvfb -> XFCE -> x11vnc -viewonly -> websockify:6080.\nexport {\n  STREAM_PORT,\n  DISPLAY_STACK_TIMEOUT_MS,\n  DEFAULT_DESKTOP_GEOMETRY,\n  DisplayStackError,\n  DisplayStackUnsupportedError,\n  buildDisplayStackScript,\n  ensureDisplayStack,\n  tearDownDisplayStack,\n  type DesktopGeometry,\n  type DisplayStackCallerKind,\n  type DisplayStackClassification,\n  type DisplayStackTelemetryContext,\n  type DisplayStackTelemetryEvent,\n  type DisplayStackTelemetryStatus,\n  type EnsureDisplayStackOptions,\n  type EnsureDisplayStackResult,\n} from \"./display-stack\";\n\nexport {\n  sandboxCommandExitCode,\n  sandboxCommandOutput,\n  sandboxCommandStdout,\n  sandboxCommandStillRunning,\n} from \"./command-result\";\n\nexport {\n  createTurnToolCancellationController,\n  TurnSandboxCommandCancelledError,\n} from \"./turn-tool-cancellation\";\nexport type {\n  TurnSandboxCommandArgs,\n  TurnSandboxCommandSession,\n  TurnToolCancellationController,\n  TurnToolCancellationFence,\n} from \"./turn-tool-cancellation\";\n\n// The Channel-B REAL PTY terminal-server launcher (P5.t). Exec-launched,\n// flock-idempotent twin of ensureDisplayStack; brings up ttyd PTY-over-websocket\n// (bash -l per ws client) on 7681 over the SAME tunnel the desktop noVNC uses.\nexport {\n  TERMINAL_STREAM_PORT,\n  TERMINAL_SERVER_TIMEOUT_MS,\n  TerminalServerError,\n  TerminalServerUnsupportedError,\n  buildTerminalServerScript,\n  ensureTerminalServer,\n  tearDownTerminalServer,\n  type EnsureTerminalServerOptions,\n  type EnsureTerminalServerResult,\n} from \"./terminal-server\";\n\nexport {\n  BROWSER_CONTROL_PORT,\n  BROWSER_CONTROL_SERVER_TIMEOUT_MS,\n  BrowserControlServerError,\n  BrowserControlServerUnsupportedError,\n  buildBrowserControlServerScript,\n  ensureBrowserControlServer,\n  tearDownBrowserControlServer,\n  type EnsureBrowserControlServerOptions,\n  type EnsureBrowserControlServerResult,\n} from \"./browser-control-server\";\n\nexport {\n  BROWSER_CONTROL_ADMIN_TOKEN_FILE,\n  BrowserControlClient,\n  BrowserControlProtocolError,\n  BrowserControlRequestError,\n  BrowserControlSessionClient,\n  BrowserControlTransportError,\n  BrowserControlUnsupportedError,\n  ComputerFrameEvidenceMismatchError,\n  decodeComputerControlFrameMetadataHeader,\n  provisionBrowserControlClient,\n  validateComputerControlFrameEvidence,\n  type BrowserControlPlacementSession,\n  type BrowserControlScreenshotOptions,\n  type BrowserControlFrame,\n  type BrowserStateDownloadGrant,\n  type BrowserStateUploadGrant,\n  type BrowserViewGrant,\n  type CapturePlacementBrowserStateInput,\n  type CreatePlacementBrowserSessionInput,\n  type PlacementBrowserSession,\n  type PlacementBrowserSessionReference,\n  type PlacementBrowserNetworkRoute,\n  type PlacementBrowserTransport,\n  type PlacementBrowserStateCaptureReceipt,\n  type PlacementBrowserWorkingCopyAdoption,\n  type PlacementBrowserWorkingCopyAuthority,\n  type PlacementBrowserWorkingCopyInspection,\n  type PlacementBrowserWorkingCopyRefusal,\n  type ComputerControlFrame,\n  type ComputerControlFrameMetadata,\n  type ComputerFrameEvidenceMismatchReason,\n  type ExpectedComputerFrameEvidence,\n  type ProvisionBrowserControlClientInput,\n  type ProvisionBrowserControlClientResult,\n  type RestorePlacementBrowserStateInput,\n} from \"./browser-control-client\";\n\n// Host-owned rotating run credentials. Material lives outside the persisted\n// workspace/manifest and is activated atomically per session generation.\nexport {\n  RunCredentialValidationError,\n  normalizeRunCredentialsResolution,\n  runCredentialRoot,\n  runCredentialPointerFile,\n  materializeRunCredentials,\n  clearRunCredentials,\n  clearRunCredentialsForAttempt,\n  withRunCredentialEnvironment,\n  withRunCredentialsSession,\n  withRunCredentialsClient,\n  type RunCredentialExpectedScope,\n  type NormalizedRunCredentialMaterial,\n  type RunCredentialCommandSession,\n  type RunCredentialCommandRunner,\n  type RunCredentialSessionReady,\n  type MaterializeRunCredentialsOptions,\n} from \"./run-credentials\";\n\n// Secret references delivered at the physical exec boundary (W1). Values ride\n// an in-memory carry to the provider call; recorders keep references.\nexport {\n  SECRET_ENV_TOTAL_MAX_BYTES,\n  SECRET_ENV_VALUE_MAX_BYTES,\n  SECRET_FILE_ROOT,\n  clearSecretFilesCommand,\n  prepareSecretExec,\n  prepareSecretStdin,\n  resolveSecretImagePath,\n  resolveSecretLiteralText,\n  resolveSecretPatchText,\n  runWithSecretCarry,\n  secretExecCarryFor,\n  secretFilePath,\n  secretScopeFor,\n  type SecretCarry,\n  type SecretExecCarry,\n  type SecretStdinCarry,\n} from \"./secret-delivery\";\n\n// Session-specific Codemode token routing. The manifest retains one stable\n// legacy pointer for warm-box env parity; every session command selects its own\n// hashed token file off-manifest.\nexport {\n  CodemodeTokenPathError,\n  codemodeTokenFileForSession,\n  codemodeTokenFileFromEnvironment,\n  withCodemodeTokenEnvironment,\n  withCodemodeTokenSession,\n  withCodemodeTokenClient,\n} from \"./codemode-token\";\n\n// Exact-attempt Codemode authority. Shared by ordinary turn execution and\n// one-off Connected Machine execution so neither surface can drift into a\n// second token shape or lifetime.\nexport {\n  CODEMODE_TOKEN_TTL_SECONDS,\n  mintSandboxCodemodeToken,\n  type CodemodeAuthorityScope,\n  type SandboxCodemodeAuthority,\n  type MintedSandboxCodemodeToken,\n} from \"./codemode-authority\";\n\n// The Channel-B pixel DATA PLANE (P4.2). Resolves the provider's scoped tunnel\n// for port 6080 (client → provider-tunnel direct), assembles the WS URL, and\n// mints the scoped stream token. Called API-direct on the resumed handle.\nexport {\n  exposeStreamPort,\n  buildStreamUrl,\n  exposedPortAllowsHostFetch,\n  exposedPortEndpointFromUrl,\n  isOpenSandboxLifecycleProxyPath,\n  joinExposedPortPath,\n  parseOpenSandboxSignedUriPath,\n  redactOpenSandboxSignedUriPath,\n  signedEndpointExpiresAtMs,\n  signedEndpointNeedsRefresh,\n  StreamPortUnavailableError,\n  type ExposedPortEndpoint,\n  type ExposeStreamPortInput,\n  type ExposeStreamPortResult,\n  type OpenSandboxSignedUriPath,\n} from \"./stream-port\";\n\n// P4.3 recording loop — plain functions over a live session handle (no agent\n// loop); finalize uploads box -> object storage without buffering in the worker.\nexport {\n  startRecording,\n  stopRecording,\n  inspectRecordingArtifact,\n  uploadRecordingArtifact,\n  deleteRecordingArtifacts,\n  recordingStorageKey,\n  contentTypeForCodec,\n  extForCodec,\n  RecordingUnavailableError,\n  RecordingError,\n  type RecordingCodec,\n  type RecordingContentType,\n  type StartRecordingInput,\n  type RecordingProcess,\n  type RecordingArtifactMetadata,\n} from \"./recording\";\n\n// P4.4 Channel-A structured services — the provider-agnostic SandboxChannelAService\n// (FileSystem + Git + Terminal) over a live, resumed-by-id session handle. The\n// API constructs one per request around the box it just resumed; no ownership.\n// Agent-loop-free, so the API-direct control plane imports it from this leaf.\nexport { SynchronousCommandOutcomeUnknownError } from \"./synchronous-command\";\nexport {\n  SandboxChannelAService,\n  ChannelAPartialMutationError,\n  ChannelAValidationError,\n  ChannelAUnavailableError,\n  ChannelAConflictError,\n  ChannelAFileSystemRouteChangedError,\n  ChannelANotFoundError,\n  ChannelAUnsupportedError,\n  stripExecBanner,\n  parseExecBannerSessionId,\n  parseExecBannerExitCode,\n  isExecSessionLostBanner,\n  assertSafeRelPath,\n  parsePorcelainV2,\n  parseNumstatZ,\n  parseUnifiedPatch,\n  REPOSITORY_DISCOVERY_LIMIT,\n  CODE_SEARCH_RG_MAX_BYTES,\n  validateCodeSearchRipgrepArgs,\n  type CodeSearchRipgrepOutcome,\n  type ChannelASession,\n  type ChannelAExecArgs,\n  type ChannelAExecResult,\n  type ChannelAEmitter,\n  type SandboxChannelAServiceOptions,\n  type FsWriteFilesRequest,\n  type FsWriteFilesResponse,\n  type RepositoryDiscoveryDegradedReason,\n  type RepositoryDiscoveryResult,\n  type NumstatEntry,\n} from \"./channel-a\";\n\n// The selfhosted (bring-your-own-compute) control surface (M3). The NATS-backed\n// `SelfhostedSession` presents the SAME structural exec/fs/git surface as Modal\n// over a `ControlRpc` seam (request/reply on the exact claimed process subject, encoded via\n// `@opengeni/agent-proto`). agent-offline is NEVER a NotFound — the lease never\n// cold-creates a rival for a user's real machine. The real NATS transport +\n// Accounts land in M4 behind the SAME `ControlRpc`.\nexport {\n  type ControlRpc,\n  NatsControlRpc,\n  SelfhostedControlError,\n  agentErrorToControlError,\n  subjectFor,\n  offlineControlResponse,\n  timeoutControlResponse,\n  offlineAgentError,\n  timeoutAgentError,\n  drainingExhaustedError,\n  payloadTooLargeMessage,\n  drainingMessage,\n  execDeadlineHint,\n  NEVER_SENT_DETAIL_KEY,\n  type NatsRequestConnection,\n  type SelfhostedUnavailableReason,\n} from \"./selfhosted/control-rpc\";\n// The transport-agnostic per-op observation seam (out-of-band telemetry — metrics\n// + machine.* events; the op-engine's op-stream client emits through this too).\nexport type { SelfhostedOpObserver, SelfhostedOpObservation } from \"./selfhosted/op-observer\";\n// The four-field in-band fault renderer (the failure-visibility doctrine).\nexport {\n  selfhostedFaultClass,\n  SELFHOSTED_INFRASTRUCTURE_FAULT_CLASSES,\n  renderSelfhostedFault,\n  FAULT_FIELD_WHAT_HAPPENED,\n  FAULT_FIELD_WHICH_LAYER,\n  FAULT_FIELD_WHAT_PRESERVED,\n  FAULT_FIELD_WHAT_TO_TRY,\n} from \"./selfhosted/fault-rendering\";\n// The selfhosted control-op retry policy (the pure decision + the injected clock).\nexport {\n  decideSelfhostedRetry,\n  selfhostedRetryBackoffMs,\n  defaultSelfhostedRetryClock,\n  SELFHOSTED_IDEMPOTENT_READONLY_OPS,\n  SELFHOSTED_DRAINING_MAX_RETRIES,\n  SELFHOSTED_EXEC_DRAINING_MAX_RETRIES,\n  SELFHOSTED_TIMEOUT_MAX_RETRIES,\n  SELFHOSTED_NEVER_SENT_MAX_RETRIES,\n  SELFHOSTED_RETRY_BACKOFF_BASE_MS,\n  SELFHOSTED_RETRY_BACKOFF_FACTOR,\n  SELFHOSTED_RETRY_BACKOFF_CAP_MS,\n  type SelfhostedRetryClock,\n  type SelfhostedRetryDecision,\n} from \"./selfhosted/retry-policy\";\nexport {\n  SelfhostedSession,\n  SelfhostedWorkspaceRootChangedError,\n  SelfhostedSandboxClient,\n  buildSelfhostedBackendSession,\n  isSelfhostedProviderNotFoundError,\n  setSelfhostedApplyDiff,\n  SELFHOSTED_DEFAULT_TIMEOUT_MS,\n  SELFHOSTED_RELAY_STREAM_PATH,\n  type SelfhostedSessionState,\n  type SelfhostedSessionDeps,\n  type SelfhostedSessionBuild,\n  type SelfhostedOperationResourcePolicy,\n  type SelfhostedOperationAdmission,\n  type SelfhostedRelayConfig,\n  type SelfhostedExecArgs,\n  type SelfhostedExecResult,\n  type SelfhostedApplyDiff,\n  type SelfhostedEditor,\n  type SelfhostedImageOutput,\n  type SelfhostedOpStreamDeps,\n} from \"./selfhosted/session\";\nexport {\n  connectedMachinePathWithinRoot,\n  connectedMachineWorkspaceRootsEqual,\n  isConnectedMachineAbsolutePath,\n  isWindowsConnectedMachinePath,\n  normalizeConnectedMachineWorkspaceRoot,\n  relativeConnectedMachinePath,\n  resolveConnectedMachinePath,\n  resolveConnectedMachineWorkspaceRoot,\n  type ConnectedMachineOs,\n} from \"./selfhosted/workspace-path\";\nexport type { SelfhostedConnectionBinding } from \"./routing/backend-resolver\";\n// The op-stream exec transport (op-stream protocol v1.1 — streaming exec to a\n// Connected Machine runner). The worker injects `NatsOpStreamTransport` (over\n// the same bus connection as the control rpc) plus an `OpStreamJournal`\n// adapted onto Temporal. Connected Machine exec requires this injection and\n// fails closed when it is absent or unsupported.\nexport {\n  NatsOpStreamTransport,\n  OpStreamUnavailableError,\n  opAckSubject,\n  opFrameSubject,\n  type NatsOpStreamConnection,\n  type OpStreamSubscription,\n  type OpStreamTransport,\n} from \"./selfhosted/op-transport\";\nexport {\n  cancelSelfhostedOp,\n  OP_STREAM_ACK_INTERVAL_MS,\n  OP_STREAM_DEFAULT_WINDOW_BYTES,\n  OP_STREAM_RECONNECT_HOLD_MS,\n  OP_STREAM_SILENCE_TIMEOUT_MS,\n  querySelfhostedOp,\n  type ExactSelfhostedOpControlInput,\n  type OpStreamExecOutcome,\n  type OpStreamJournal,\n} from \"./selfhosted/op-stream\";\n// The durable op-id correlation seam (B1): the runtime barrel BINDS it around\n// the SDK shell tool; the sandbox leaf READS it when minting op ids.\nexport { nextDurableOpId, runWithToolCallCorrelation, sanitizeOpIdToken } from \"./op-correlation\";\nexport {\n  negotiateSelfhostedCapabilities,\n  selfhostedLiveness,\n  selfhostedHeartbeatLiveness,\n  SELFHOSTED_RECONNECT_WINDOW_MS,\n  type SelfhostedNegotiationInput,\n  type SelfhostedLivenessState,\n  type SelfhostedEnrollment,\n} from \"./selfhosted/capabilities\";\nexport {\n  MockAgentResponder,\n  type MockAgentResponderOptions,\n  type MockExecHandler,\n} from \"./selfhosted/testing\";\nexport {\n  createMockSelfhostedOpStream,\n  FakeOpRunner,\n  type FakeOpScript,\n  InMemoryOpStreamTransport,\n} from \"./selfhosted/op-testing\";\n\n// The hot-swap routing proxy (M7): ONE stable session-shaped object the SDK binds\n// to, which re-reads the per-session active pointer per op and dispatches to the\n// currently-active backend (Modal or selfhosted) — flippable mid-turn, single\n// active at a time, fence-retrying on a swap race.\nexport {\n  isRoutingMutationOutcomeUnknownError,\n  isRoutingMutationOutputRejectedError,\n  RoutingMutationOutputRejectedError,\n  withRoutingMutationOutputRejectionFence,\n  RoutingBackendRecoveryRequiredError,\n  RoutingMutationOutcomeUnknownError,\n  renderRoutingMutationOutcomeUnknownToolResult,\n  RoutingRetainedProcessNotFoundError,\n  RoutingSandboxSession,\n  RoutingWorkspaceRootChangedError,\n  RoutingActiveRouteChangedError,\n  RoutingUnsupportedError,\n  type ActivePointer,\n  type DefaultBackendLossResult,\n  type RoutableBackendSession,\n  type ResolvedActiveBackend,\n  type RoutingMutationSettlementResult,\n  type RoutingSandboxFirstOperationObservation,\n  type RoutingSandboxFirstOperationObserver,\n  type RoutingSandboxFirstOperationPhase,\n  type RoutingSandboxFirstOperationPhaseObservation,\n  type RoutingSandboxOperationObservation,\n  type RoutingSandboxOperationObserver,\n  type RoutingSandboxCaptureWaitObserver,\n  type RoutingSandboxPhaseOutcome,\n  type RoutingSandboxWaitObservation,\n  type RoutingRetainedProcess,\n  type RoutingRetainedProcessAdoption,\n  type RoutingRetainedProcessTerminalProof,\n  type RoutingSandboxSessionDeps,\n  type RoutingTransitionEvent,\n} from \"./routing/routing-session\";\nexport {\n  makeActiveBackendResolver,\n  ActiveBackendUnresolvableError,\n  swapTargetEstablishability,\n  type ActiveBackendResolverDeps,\n  type RoutableSandbox,\n  type BackendUnresolvableCode,\n  type SwapTargetEstablishability,\n} from \"./routing/backend-resolver\";\n\n/**\n * Construct the raw provider SandboxClient for the configured backend. Registry-\n * driven (the old flat if/else is gone): the backend's ProviderRegistration owns\n * validateCredentials + build, with per-provider units/field-names. Returns\n * undefined for \"none\".\n *\n * The desktop stream port (6080) is merged into exposedPorts for every desktop-\n * capable (backend, os) when desktop is enabled AND the provider cannot expose\n * ports on demand (modal/runloop/e2b pre-declare; blaxel resolves on demand).\n * Existing modal/docker/local construction is behavior-preserved.\n */\nexport function createSandboxClient(\n  settings: Settings,\n  environment = collectSandboxEnvironment(settings),\n): unknown {\n  return createSandboxClientForBackend(\n    settings.sandboxBackend as SandboxBackend,\n    settings,\n    environment,\n  );\n}\n\n/**\n * Construct the raw provider SandboxClient for an EXPLICIT backend, independent\n * of settings.sandboxBackend. This is the resume-by-id builder the per-turn\n * resume path (and the API-direct control plane) call: a lease's box was created\n * on a specific backend (the envelope's backendId / the lease's\n * resume_backend_id), and the client that reattaches to it must be built for\n * THAT backend, not the process's currently-configured default. When the backend\n * equals settings.sandboxBackend this is identical to createSandboxClient\n * (behavior-preserved). Returns undefined for \"none\".\n */\nexport function createSandboxClientForBackend(\n  backend: SandboxBackend,\n  settings: Settings,\n  environment = collectSandboxEnvironment(settings),\n  metrics?: RuntimeMetricsHooks,\n): unknown {\n  const registration = PROVIDER_REGISTRY[backend];\n  if (!registration) {\n    throw new SandboxConfigError(backend, `Unknown sandbox backend \"${backend}\"`);\n  }\n  if (registration.backend === \"none\") {\n    return undefined;\n  }\n  registration.validateCredentials(settings); // fail-fast, typed\n\n  const exposedPorts = parseExposedPorts(settings.dockerExposedPorts);\n  // 6080 port-merge: a desktop-capable backend that pre-declares ports (not\n  // on-demand) must carry the desktop port at construction so resolveExposedPort\n  // (6080) succeeds later. runloop is included (it is desktop-capable but NOT\n  // on-demand → must pre-declare). blaxel is on-demand → skipped here.\n  const desktop = registration.descriptor.capabilities.DesktopStream;\n  if (\n    desktop.available &&\n    settings.sandboxDesktopEnabled &&\n    !registration.descriptor.portExposure.supportsOnDemandPorts &&\n    !exposedPorts.includes(DESKTOP_STREAM_PORT)\n  ) {\n    exposedPorts.push(DESKTOP_STREAM_PORT);\n  }\n  // 7681 port-merge: the REAL PTY terminal (ttyd) rides the SAME tunnel as the\n  // desktop, so a desktop-capable pre-declared-port backend must ALSO carry 7681\n  // at construction for resolveExposedPort(7681) to succeed later on a fresh box.\n  // Same condition as the 6080 merge (a desktop-capable image bakes ttyd too).\n  if (\n    desktop.available &&\n    settings.sandboxTerminalEnabled &&\n    !registration.descriptor.portExposure.supportsOnDemandPorts &&\n    !exposedPorts.includes(TERMINAL_STREAM_PORT)\n  ) {\n    exposedPorts.push(TERMINAL_STREAM_PORT);\n  }\n  // The browser controller is a placement service baked into both canonical\n  // images. Providers that require port declaration must receive its fixed\n  // port when the box is created; on-demand providers resolve it lazily.\n  if (\n    !registration.descriptor.portExposure.supportsOnDemandPorts &&\n    !exposedPorts.includes(BROWSER_CONTROL_PORT)\n  ) {\n    exposedPorts.push(BROWSER_CONTROL_PORT);\n  }\n\n  const raw = withProviderExactResumeContract(\n    registration,\n    registration.build({\n      settings,\n      environment,\n      exposedPorts,\n      ...(metrics ? { metrics } : {}),\n    }),\n  );\n  // Docker network decoration stays backend-specific (only docker).\n  return registration.backend === \"docker\"\n    ? withDockerNetwork(raw as SandboxClient, settings.dockerNetwork)\n    : raw;\n}\n\nfunction withProviderExactResumeContract(\n  registration: ProviderRegistration,\n  raw: unknown,\n): unknown {\n  if (!raw || typeof raw !== \"object\") {\n    throw new SandboxConfigError(\n      registration.backend,\n      `Sandbox backend \"${registration.backend}\" returned no client`,\n    );\n  }\n  const client = raw as {\n    resume?: (state: unknown, options?: unknown) => Promise<unknown>;\n    resumeExact?: (state: unknown) => Promise<unknown>;\n  };\n  if (typeof client.resume !== \"function\") {\n    throw new SandboxConfigError(\n      registration.backend,\n      `Sandbox backend \"${registration.backend}\" does not support resume()`,\n    );\n  }\n  if (registration.exactResumeMode === \"custom\") {\n    if (typeof client.resumeExact !== \"function\") {\n      throw new SandboxConfigError(\n        registration.backend,\n        `Sandbox backend \"${registration.backend}\" has no non-replacing resumeExact()`,\n      );\n    }\n    return client;\n  }\n  if (registration.exactResumeMode !== \"ordinary\") {\n    throw new SandboxConfigError(\n      registration.backend,\n      `Sandbox backend \"${registration.backend}\" has an invalid exact-resume contract`,\n    );\n  }\n  const resume = client.resume;\n  Object.defineProperty(client, \"resumeExact\", {\n    configurable: false,\n    enumerable: false,\n    writable: false,\n    value: async (state: unknown) => await resume.call(client, state),\n  });\n  return client;\n}\n\nfunction withDockerNetwork(client: SandboxClient, network: string | undefined): SandboxClient {\n  const trimmed = network?.trim();\n  if (!trimmed) {\n    return client;\n  }\n  const exactResume = (\n    client as SandboxClient & {\n      resumeExact?: (state: SandboxSessionState) => Promise<SandboxSessionLike>;\n    }\n  ).resumeExact;\n  const wrapSession = async <T extends SandboxSessionLike>(session: T): Promise<T> => {\n    const containerId = (session as { state?: { containerId?: unknown } }).state?.containerId;\n    if (typeof containerId === \"string\" && containerId.length > 0) {\n      await connectDockerNetwork(trimmed, containerId);\n      const portResolver = (\n        session as T & {\n          resolveExposedPort?: (port: number) => Promise<ExposedPortEndpoint>;\n        }\n      ).resolveExposedPort;\n      if (typeof portResolver === \"function\") {\n        Object.defineProperty(session, \"resolveExposedPort\", {\n          configurable: true,\n          enumerable: true,\n          writable: true,\n          value: async (port: number) =>\n            dockerNetworkExposedPortEndpoint(\n              containerId,\n              port,\n              await portResolver.call(session, port),\n            ),\n        });\n      }\n    }\n    return session;\n  };\n  return {\n    backendId: client.backendId,\n    ...(client.supportsDefaultOptions !== undefined\n      ? { supportsDefaultOptions: client.supportsDefaultOptions }\n      : {}),\n    ...(client.create\n      ? {\n          create: async (...args: any[]) =>\n            await wrapSession(await (client.create as any)(...args)),\n        }\n      : {}),\n    ...(client.resume\n      ? {\n          resume: async (state: SandboxSessionState) =>\n            await wrapSession(await client.resume!(state)),\n        }\n      : {}),\n    ...(exactResume\n      ? {\n          // Docker's ordinary SDK resume creates a replacement when the exact\n          // container is absent. Preserve Opengeni's non-replacing attach path\n          // through the network decorator; dropping it would turn an exact\n          // recovery probe into a provider mutation.\n          resumeExact: async (state: SandboxSessionState) =>\n            await wrapSession(await exactResume.call(client, state)),\n        }\n      : {}),\n    ...(\"attachWorkspaceForDrain\" in client && typeof client.attachWorkspaceForDrain === \"function\"\n      ? {\n          // A drain handle has no networking or normal execution capability.\n          attachWorkspaceForDrain: client.attachWorkspaceForDrain.bind(client),\n        }\n      : {}),\n    ...(client.delete\n      ? {\n          delete: async (state: SandboxSessionState) => await client.delete!(state),\n        }\n      : {}),\n    ...(client.serializeSessionState\n      ? {\n          serializeSessionState: async (state: SandboxSessionState, options) =>\n            await client.serializeSessionState!(state, options),\n        }\n      : {}),\n    ...(client.canPersistOwnedSessionState\n      ? {\n          canPersistOwnedSessionState: async (state: SandboxSessionState) =>\n            await client.canPersistOwnedSessionState!(state),\n        }\n      : {}),\n    ...(client.canReusePreservedOwnedSession\n      ? {\n          canReusePreservedOwnedSession: async (state: SandboxSessionState) =>\n            await client.canReusePreservedOwnedSession!(state),\n        }\n      : {}),\n    ...(client.deserializeSessionState\n      ? {\n          deserializeSessionState: async (state: Record<string, unknown>) =>\n            await client.deserializeSessionState!(state),\n        }\n      : {}),\n  };\n}\n\n/**\n * Once a Docker sandbox joins the API's network, server-side traffic must use\n * the container's network identity and original port. The SDK's published\n * 127.0.0.1 host port is meaningful only to the Docker host, not to an API\n * process running in another container. Calling the provider resolver first\n * preserves its exposed-port validation.\n */\nexport function dockerNetworkExposedPortEndpoint(\n  containerId: string,\n  containerPort: number,\n  endpoint: ExposedPortEndpoint,\n): ExposedPortEndpoint {\n  const host = /^[a-f0-9]{64}$/i.test(containerId) ? containerId.slice(0, 12) : containerId;\n  return {\n    ...endpoint,\n    host,\n    port: containerPort,\n  };\n}\n\nasync function connectDockerNetwork(network: string, containerId: string): Promise<void> {\n  const { spawnSync } = await import(\"node:child_process\");\n  const result = spawnSync(\"docker\", [\"network\", \"connect\", network, containerId], {\n    encoding: \"utf8\",\n  });\n  if (result.status === 0) {\n    return;\n  }\n  const stderr = result.stderr ?? result.error?.message ?? \"\";\n  if (stderr.includes(\"already exists\")) {\n    return;\n  }\n  throw new Error(\n    `Failed to connect Docker sandbox container to network ${network}: ${stderr.trim()}`,\n  );\n}\n\n/**\n * Extract the sandbox recovery entry from a run state as a plain JSON record,\n * for storage decoupled from the RunState blob (issue #35). Encapsulates the\n * underscore-internal `_sandbox` read in exactly one place.\n */\nexport function sandboxStateEntryFromRunState(\n  state: unknown,\n  options: {\n    /** W1 defensive strip: when set, persisted manifest/state env keeps only\n     *  names this predicate accepts (deployment constants), so a legacy box\n     *  whose live state still carries user values never re-persists them. */\n    keepEnvironmentName?: (name: string) => boolean;\n  } = {},\n): Record<string, unknown> | null {\n  const sandboxState = (state as any)?._sandbox;\n  if (!sandboxState) {\n    return null;\n  }\n  const entry =\n    sandboxState.sessionsByAgent?.[sandboxState.currentAgentKey] ??\n    (sandboxState.currentAgentKey && sandboxState.sessionState\n      ? {\n          backendId: sandboxState.backendId,\n          currentAgentKey: sandboxState.currentAgentKey,\n          currentAgentName: sandboxState.currentAgentName,\n          sessionState: sandboxState.sessionState,\n        }\n      : null);\n  if (!entry || !entry.sessionState) {\n    return null;\n  }\n  const persisted = sandboxEntryForPersistence(entry as Record<string, unknown>);\n  return normalizeProtocolJsonValue(\n    options.keepEnvironmentName\n      ? sandboxEntryWithConstantEnvironment(persisted, options.keepEnvironmentName)\n      : persisted,\n    '$[\"sandboxSessionEnvelope\"]',\n  ) as Record<string, unknown>;\n}\n\nfunction filterEnvironmentRecord(value: unknown, keep: (name: string) => boolean): unknown {\n  if (!isObjectRecord(value)) return value;\n  return Object.fromEntries(Object.entries(value).filter(([name]) => keep(name)));\n}\n\n/** Copy of a persisted entry whose `sessionState.manifest.environment`,\n *  `sessionState.environment` and `sessionState.providerState.environment` keep\n *  only accepted names. Values are never inspected. */\nexport function sandboxEntryWithConstantEnvironment(\n  entry: Record<string, unknown>,\n  keep: (name: string) => boolean,\n): Record<string, unknown> {\n  const sessionState = entry.sessionState;\n  if (!isObjectRecord(sessionState)) return entry;\n  const next: Record<string, unknown> = { ...sessionState };\n  const manifest = sessionState.manifest;\n  if (isObjectRecord(manifest) && Object.hasOwn(manifest, \"environment\")) {\n    const plain =\n      Object.getPrototypeOf(manifest) === Object.prototype ||\n      Object.getPrototypeOf(manifest) === null\n        ? manifest\n        : (serializeSdkManifestForEnvelope(manifest) as Record<string, unknown>);\n    next.manifest = { ...plain, environment: filterEnvironmentRecord(plain.environment, keep) };\n  }\n  if (Object.hasOwn(sessionState, \"environment\")) {\n    next.environment = filterEnvironmentRecord(sessionState.environment, keep);\n  }\n  const providerState = sessionState.providerState;\n  if (isObjectRecord(providerState) && Object.hasOwn(providerState, \"environment\")) {\n    next.providerState = {\n      ...providerState,\n      environment: filterEnvironmentRecord(providerState.environment, keep),\n    };\n  }\n  return { ...entry, sessionState: next };\n}\n\n/**\n * The Agents SDK session envelope carries its canonical serialized manifest at\n * `sessionState.manifest`. Some provider serializers also repeat a hydrated\n * `Manifest` instance at `sessionState.providerState.manifest`; the SDK restore\n * path always overlays the canonical outer value, so the duplicate is neither\n * read nor JSON-protocol-safe. Remove only that known redundant field before the\n * envelope crosses Opengeni's durable canonical-JSON boundary.\n */\nfunction sandboxEntryForPersistence(entry: Record<string, unknown>): Record<string, unknown> {\n  const sessionState = entry.sessionState;\n  if (!isObjectRecord(sessionState) || !Object.hasOwn(sessionState, \"manifest\")) {\n    return entry;\n  }\n  const providerState = sessionState.providerState;\n  if (!isObjectRecord(providerState) || !Object.hasOwn(providerState, \"manifest\")) {\n    return entry;\n  }\n  const { manifest: _redundantManifest, ...canonicalProviderState } = providerState;\n  return {\n    ...entry,\n    sessionState: {\n      ...sessionState,\n      providerState: canonicalProviderState,\n    },\n  };\n}\n\nfunction isObjectRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction providerStateWithoutDuplicateManifest(value: object): Record<string, unknown> {\n  const { manifest: _manifest, ...providerState } = value as Record<string, unknown>;\n  return providerState;\n}\n\nfunction serializeSdkManifestForEnvelope(value: unknown): unknown {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return value;\n  const prototype = Object.getPrototypeOf(value);\n  if (prototype === Object.prototype || prototype === null) return value;\n  return serializeManifestRecord(value as Manifest);\n}\n\n/**\n * Items-mode counterpart of restoredSandboxSessionState: rebuild the live\n * sandbox session state from a stored entry (as produced by\n * sandboxStateEntryFromRunState) instead of from a RunState blob.\n */\nexport async function restoredSandboxSessionStateFromEntry(\n  entry: Record<string, unknown>,\n  client: unknown,\n): Promise<SandboxSessionState | undefined> {\n  if (!client || !entry || typeof entry !== \"object\" || !(\"sessionState\" in entry)) {\n    return undefined;\n  }\n  if (entry.backendId && (client as SandboxClient).backendId !== entry.backendId) {\n    throw new Error(\"Stored sandbox envelope backend does not match the configured sandbox client\");\n  }\n  return await deserializeSandboxSessionStateEnvelope(client as SandboxClient, entry.sessionState);\n}\n\n/**\n * Read the persisted /workspace snapshot archive off a lease envelope's\n * `sessionState` (sandbox-file-persistence). The reaper (persistDrainSnapshot)\n * folds the base64 archive — a Modal native snapshot-ref or a tar archive, the\n * exact bytes `session.persistWorkspace()` returned — at\n * `sessionState.workspaceArchive`. Cold-restore decodes it and replays it via\n * `session.hydrateWorkspace(archive)` on the freshly-created box so /workspace is\n * restored. Returns undefined when the envelope carries no archive (a box that\n * was never drain-persisted, or a non-persistence config that stored none).\n *\n * It is deliberately read SEPARATELY from deserializeSandboxSessionStateEnvelope:\n * the archive does NOT ride serializeSessionState (it originates at reaper time),\n * and the SDK's deserializeSessionState must NOT receive it (it is an opaque\n * runtime-level field, not provider state).\n */\nexport function readWorkspaceArchiveFromEnvelopeSessionState(\n  sessionState: unknown,\n): Uint8Array | undefined {\n  if (!sessionState || typeof sessionState !== \"object\") {\n    return undefined;\n  }\n  const b64 = (sessionState as { workspaceArchive?: unknown }).workspaceArchive;\n  if (typeof b64 !== \"string\" || b64.length === 0) {\n    return undefined;\n  }\n  try {\n    return Uint8Array.from(Buffer.from(b64, \"base64\"));\n  } catch {\n    return undefined;\n  }\n}\n\n/** Decode the Modal snapshot id out of a persisted base64 archive ref, or\n *  undefined when the archive is a tar payload or is unparseable. */\nexport function decodeModalSnapshotId(archive: Uint8Array): string | undefined {\n  const ref = decodeNativeSnapshotRef(archive);\n  return ref?.provider === \"modal_snapshot_filesystem\" ||\n    ref?.provider === \"modal_snapshot_directory\"\n    ? ref.snapshotId\n    : undefined;\n}\n\nexport async function deserializeSandboxSessionStateEnvelope(\n  client: SandboxClient,\n  envelope: unknown,\n  expectedInstanceId?: string,\n): Promise<SandboxSessionState | undefined> {\n  if (!envelope || typeof envelope !== \"object\") {\n    return undefined;\n  }\n  if (!client.deserializeSessionState) {\n    throw new Error(\n      \"Sandbox client must implement deserializeSessionState() to resume RunState sandbox state\",\n    );\n  }\n  const state = envelope as {\n    providerState?: Record<string, unknown>;\n    manifest?: unknown;\n    snapshot?: unknown;\n    snapshotFingerprint?: unknown;\n    snapshotFingerprintVersion?: unknown;\n    workspaceReady?: unknown;\n    exposedPorts?: unknown;\n  };\n  const providerState = { ...(state.providerState ?? {}) };\n  if (expectedInstanceId) {\n    const backend = sandboxBackendForSdkBackendId(client.backendId) ?? client.backendId;\n    const observedInstanceId = liveProviderInstanceIdFromState(backend, providerState);\n    if (observedInstanceId && observedInstanceId !== expectedInstanceId) {\n      throw new SandboxResumeIdentityMismatchError(backend, expectedInstanceId, observedInstanceId);\n    }\n    if (!observedInstanceId) {\n      const instanceIdField = PROVIDER_REGISTRY[backend as SandboxBackend]?.instanceIdFields[0];\n      if (instanceIdField) {\n        // New envelopes persist one provider-neutral Opengeni identity. SDK\n        // deserializers still require their legacy provider-specific address,\n        // so materialize it into a cloned payload at this adapter boundary.\n        // The live resumed handle is independently identity-checked before use.\n        providerState[instanceIdField] = expectedInstanceId;\n      }\n    }\n  }\n  const exposedPorts = runStateExposedPortsRecord(state.exposedPorts);\n  if (state.exposedPorts !== undefined && exposedPorts === undefined) {\n    console.warn(\"[sandbox] ignored incompatible RunState exposedPorts\", {\n      provider: runStateCompatibilityProvider(client.backendId),\n      sessionClass: \"root\",\n      path: \"sessionState.exposedPorts\",\n    });\n  }\n  return await client.deserializeSessionState({\n    ...providerState,\n    manifest: state.manifest,\n    ...(state.snapshot !== undefined ? { snapshot: state.snapshot } : {}),\n    ...(state.snapshotFingerprint !== undefined\n      ? { snapshotFingerprint: state.snapshotFingerprint }\n      : {}),\n    ...(state.snapshotFingerprintVersion !== undefined\n      ? { snapshotFingerprintVersion: state.snapshotFingerprintVersion }\n      : {}),\n    workspaceReady: state.workspaceReady,\n    ...(exposedPorts !== undefined ? { exposedPorts } : {}),\n  });\n}\n\n// ============================================================================\n// The ONE resume / recovery primitive (P1.2).\n//\n// establishSandboxSessionFromEnvelope is the single re-establish-from-envelope\n// path the stateless model leans on. Creation authority is explicit:\n//\n//   - `create-or-restore` is reserved for the caller that won the durable\n//     cold->warming lease transition. It may create a cold box, or replace a\n//     resumable box that the provider proves is gone.\n//   - `resume-only` is for attached turns and API-direct operations. It may\n//     resume the leased box by id, but a provider NotFound propagates to the\n//     caller so the lease can be atomically marked cold. It NEVER creates.\n//\n// This ownership boundary is the double-spawn guard. A provider NotFound alone\n// is not creation authority: many attached callers can observe the same dead id\n// concurrently, while only one caller may own cold->warming.\n// ============================================================================\n\n/** A live, externally-owned sandbox session re-established from the group lease\n *  envelope. The caller injects `{client, session, sessionState}` NON-OWNED into\n *  the run (or drives session.exec/readFile/resolveExposedPort directly) and\n *  drops the handle when done — the lease, not this handle, owns the box. */\nexport type EstablishedSandboxSession = {\n  client: unknown;\n  session: unknown;\n  sessionState: unknown;\n  instanceId: string;\n  backendId: string;\n  /** How this establish reached a live box: warm reattach by id (\"resumed\"),\n   *  fresh create (\"created\"), or fresh create + archive hydration\n   *  (\"restored\"). Callers use it to emit the durable sandbox.box.* lifecycle\n   *  events — box transitions were previously unrecorded, which made both\n   *  2026-07-06 incidents near-unattributable. Optional so external/legacy\n   *  constructors of this shape stay valid. */\n  origin?: \"resumed\" | \"created\" | \"restored\";\n  /** Set when a create-authorized reattach found the envelope's box GONE\n   *  (provider NotFound) and fell through to cold-restore. */\n  lostInstanceId?: string;\n  /** Durable authorization used when an elected recovery owner adopted a new\n   * execution wrapper over the same provider-owned workspace. Unpublished\n   * failure cleanup must preserve that workspace for the next recovery owner. */\n  providerContinuity?: SandboxProviderContinuityRecovery;\n  /** Exact durable archive revision verified byte-for-byte after hydration. */\n  restoredArchive?: WorkspaceArchiveDescriptor;\n};\n\n/**\n * Terminate an SDK-managed provider session through the declared sandbox\n * lifecycle surface. The reaper must never guess non-standard `kill` or\n * `terminate` method names: every supported SDK provider exposes one of these\n * standard operations, while provider-specific by-id rescue stays in its\n * adapter.\n */\nexport async function terminateManagedSandboxSession(\n  client: unknown,\n  sessionState: unknown,\n  session: unknown,\n): Promise<void> {\n  const lifecycleClient = client as {\n    backendId?: unknown;\n    delete?: (state: never) => Promise<void>;\n  };\n  const lifecycleSession = session as Partial<SandboxSessionLike>;\n  const options = { reason: \"cleanup\" };\n  let firstError: unknown;\n  const attempt = async (operation: (() => Promise<void>) | undefined): Promise<void> => {\n    if (!operation) return;\n    try {\n      await operation();\n    } catch (error) {\n      firstError ??= error;\n    }\n  };\n  const runPreStopHooks =\n    typeof lifecycleSession.runPreStopHooks === \"function\"\n      ? lifecycleSession.runPreStopHooks.bind(lifecycleSession)\n      : undefined;\n  const preStop =\n    typeof lifecycleSession.preStop === \"function\"\n      ? lifecycleSession.preStop.bind(lifecycleSession)\n      : undefined;\n  const stop =\n    typeof lifecycleSession.stop === \"function\"\n      ? lifecycleSession.stop.bind(lifecycleSession)\n      : undefined;\n  const shutdown =\n    typeof lifecycleSession.shutdown === \"function\"\n      ? lifecycleSession.shutdown.bind(lifecycleSession)\n      : undefined;\n  const deleteSession =\n    typeof lifecycleSession.delete === \"function\"\n      ? lifecycleSession.delete.bind(lifecycleSession)\n      : undefined;\n  const close =\n    typeof lifecycleSession.close === \"function\"\n      ? lifecycleSession.close.bind(lifecycleSession)\n      : undefined;\n\n  // Mirror the Agents SDK's provider-neutral cleanupSandboxSession contract.\n  // Agents SDK 0.14.3 does not publicly export that helper, so this agent-loop-free leaf\n  // keeps the same small sequence locally. Prefer the live session lifecycle:\n  // it owns registered pre-stop hooks and provider cleanup semantics. The\n  // state-only client.delete contract is a fallback when no session teardown\n  // operation exists.\n  await attempt(runPreStopHooks);\n  await attempt(preStop ? async () => await preStop(options) : undefined);\n  await attempt(stop ? async () => await stop(options) : undefined);\n  await attempt(shutdown ? async () => await shutdown(options) : undefined);\n  await attempt(deleteSession ? async () => await deleteSession(options) : undefined);\n  const hasProviderTeardown = Boolean(stop || shutdown || deleteSession);\n  if (!hasProviderTeardown && close) {\n    await attempt(close);\n  } else if (\n    !hasProviderTeardown &&\n    !close &&\n    typeof lifecycleClient.delete === \"function\" &&\n    sessionState !== undefined &&\n    sessionState !== null\n  ) {\n    await attempt(async () => await lifecycleClient.delete!(sessionState as never));\n  }\n  if (firstError) throw firstError;\n  if (\n    hasProviderTeardown ||\n    close ||\n    (typeof lifecycleClient.delete === \"function\" &&\n      sessionState !== undefined &&\n      sessionState !== null)\n  ) {\n    return;\n  }\n\n  const backendId =\n    typeof lifecycleClient.backendId === \"string\" ? lifecycleClient.backendId : \"unknown\";\n  throw new Error(`Sandbox backend ${backendId} exposes no teardown lifecycle operation`);\n}\n\nexport class SandboxExecReadinessError extends Error {\n  readonly name = \"SandboxExecReadinessError\";\n\n  constructor(\n    public readonly backend: string,\n    public readonly code: \"exec_probe_unavailable\" | \"exec_probe_timeout\" | \"exec_probe_failed\",\n    public readonly timeoutMs: number,\n    public readonly exitCode: number | null = null,\n    public readonly instanceId: string | null = null,\n  ) {\n    const target = instanceId ? `${backend} sandbox ${instanceId}` : `${backend} sandbox`;\n    super(\n      code === \"exec_probe_timeout\"\n        ? `${target} timed out waiting for command readiness after ${timeoutMs}ms`\n        : code === \"exec_probe_unavailable\"\n          ? `${target} session does not expose an exec readiness probe`\n          : exitCode === null\n            ? `${target} exec readiness probe did not return a command exit code`\n            : `${target} exec readiness probe failed with exit code ${exitCode}`,\n    );\n  }\n}\n\n/** A remote provider may return a sandbox handle before its command router\n * accepts exec. Allow cold restores to absorb provider tail latency without\n * publishing the lease warm before command execution is possible. */\nexport const MODAL_EXEC_READINESS_TIMEOUT_MS = 60_000;\n\nfunction sandboxExecProbeSessionId(result: unknown): number | null {\n  if (typeof result === \"string\") return parseExecBannerSessionId(result);\n  if (!result || typeof result !== \"object\") return null;\n  const candidate = result as { sessionId?: unknown; session_id?: unknown };\n  for (const value of [candidate.sessionId, candidate.session_id]) {\n    if (typeof value === \"number\" && Number.isSafeInteger(value) && value >= 0) return value;\n  }\n  return null;\n}\n\n/** A provider handle is not workspace readiness. Providers with asynchronous\n * startup must pass this bounded command probe before a caller publishes the\n * lease warm/ready. */\nexport async function verifySandboxExecReadiness(\n  established: EstablishedSandboxSession,\n  timeoutMs = MODAL_EXEC_READINESS_TIMEOUT_MS,\n  signal?: AbortSignal,\n): Promise<void> {\n  signal?.throwIfAborted();\n  if (established.backendId !== \"modal\" && established.backendId !== \"opensandbox\") return;\n  const session = established.session as {\n    verifyExecReadiness?: (signal: AbortSignal) => Promise<number>;\n    exec?: (args: {\n      cmd: string;\n      yieldTimeMs?: number;\n      maxOutputTokens?: number;\n    }) => Promise<unknown>;\n    execCommand?: (args: {\n      cmd: string;\n      yieldTimeMs?: number;\n      maxOutputTokens?: number;\n    }) => Promise<unknown>;\n    writeStdin?: (args: {\n      sessionId: number;\n      chars?: string;\n      yieldTimeMs?: number;\n      maxOutputTokens?: number;\n    }) => Promise<unknown>;\n  };\n  const run = session.exec ?? session.execCommand;\n  const nativeModalProbe =\n    established.backendId === \"modal\" ? session.verifyExecReadiness : undefined;\n  if (!run && !nativeModalProbe) {\n    throw new SandboxExecReadinessError(\n      established.backendId,\n      \"exec_probe_unavailable\",\n      timeoutMs,\n      null,\n      established.instanceId,\n    );\n  }\n  const timeoutError = () =>\n    new SandboxExecReadinessError(\n      established.backendId,\n      \"exec_probe_timeout\",\n      timeoutMs,\n      null,\n      established.instanceId,\n    );\n  const deadline = Date.now() + timeoutMs;\n  const withinDeadline = async <T>(operation: () => Promise<T>): Promise<T> => {\n    signal?.throwIfAborted();\n    const remainingMs = deadline - Date.now();\n    if (remainingMs <= 0) throw timeoutError();\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    let abort: (() => void) | undefined;\n    try {\n      const interrupted = new Promise<never>((_, reject) => {\n        abort = () => reject(signal?.reason);\n        signal?.addEventListener(\"abort\", abort, { once: true });\n        if (signal?.aborted) abort();\n        timer = setTimeout(() => reject(timeoutError()), remainingMs);\n        if (timer && \"unref\" in timer && typeof timer.unref === \"function\") timer.unref();\n      });\n      const result = await Promise.race([operation(), interrupted]);\n      signal?.throwIfAborted();\n      return result;\n    } finally {\n      if (timer) clearTimeout(timer);\n      if (abort) signal?.removeEventListener(\"abort\", abort);\n    }\n  };\n  if (nativeModalProbe) {\n    const cancellation = new AbortController();\n    const abort = () => cancellation.abort(signal?.reason);\n    signal?.addEventListener(\"abort\", abort, { once: true });\n    if (signal?.aborted) abort();\n    try {\n      const exitCode = await withinDeadline(() =>\n        nativeModalProbe.call(session, cancellation.signal),\n      );\n      if (exitCode !== 0)\n        throw new SandboxExecReadinessError(\n          established.backendId,\n          \"exec_probe_failed\",\n          timeoutMs,\n          exitCode,\n          established.instanceId,\n        );\n      return;\n    } finally {\n      signal?.removeEventListener(\"abort\", abort);\n      cancellation.abort(new Error(\"Sandbox readiness observation finished\"));\n    }\n  }\n  const execProbe = () =>\n    withinDeadline(() =>\n      run!.call(session, {\n        cmd: \"true\",\n        yieldTimeMs: Math.min(1_000, Math.max(1, deadline - Date.now())),\n        maxOutputTokens: 1_000,\n      }),\n    );\n\n  let result = await execProbe();\n  while (true) {\n    const exitCode = sandboxCommandExitCode(result);\n    if (exitCode !== null) {\n      if (exitCode === 0) return;\n      throw new SandboxExecReadinessError(\n        established.backendId,\n        \"exec_probe_failed\",\n        timeoutMs,\n        exitCode,\n        established.instanceId,\n      );\n    }\n\n    const sessionId = sandboxCommandStillRunning(result) ? sandboxExecProbeSessionId(result) : null;\n    const writeStdin = session.writeStdin;\n    if (sessionId !== null && writeStdin) {\n      result = await withinDeadline(() =>\n        writeStdin.call(session, {\n          sessionId,\n          chars: \"\",\n          yieldTimeMs: Math.min(1_000, Math.max(1, deadline - Date.now())),\n          maxOutputTokens: 1_000,\n        }),\n      );\n      continue;\n    }\n\n    const remainingMs = deadline - Date.now();\n    if (remainingMs <= 0) throw timeoutError();\n    await new Promise((resolve) => setTimeout(resolve, Math.min(100, remainingMs)));\n    result = await execProbe();\n  }\n}\n\nexport type SandboxCreatedCallback = (established: EstablishedSandboxSession) => Promise<void>;\n\n// The structural slice we need from a provider SandboxClient to resume by id and\n// cold-restore. Narrowed (not the full agent-loop SandboxClient) so the leaf\n// stays agent-loop-free.\ntype ResumeCapableClient = {\n  backendId: string;\n  deserializeSessionState?: (state: Record<string, unknown>) => Promise<unknown>;\n  resume?: (state: unknown, options?: unknown) => Promise<unknown>;\n  /** Opengeni extension implemented by providers whose ordinary SDK resume may\n   * create a replacement. This method must either return the addressed wrapper\n   * or prove it unavailable without creating anything. */\n  resumeExact?: (state: unknown) => Promise<unknown>;\n  create?: (manifest?: unknown, options?: unknown) => Promise<unknown>;\n  createWithLifecycle?: (\n    args: { manifest: unknown },\n    lifecycle: {\n      beforeDispatch: (intent: ModalCreateIntent, providerContext: unknown) => Promise<void>;\n      onCreated: (session: unknown, intent: ModalCreateIntent) => Promise<void>;\n    },\n  ) => Promise<unknown>;\n};\n\n/**\n * Per-provider NotFound discriminator. The @openai/agents-extensions\n * `isProviderSandboxNotFoundError` / `assertResumeRecreateAllowed` helpers live\n * under `@openai/agents-extensions/sandbox/shared`, which is NOT an exported\n * subpath (the package `exports` map only exposes `./sandbox/<provider>`), so we\n * re-implement the discrimination here by inspecting the thrown error shape.\n *\n * \"Box no longer running\" (the box was reaped / idled out / 24h-ceiling) is the\n * ONLY error that licenses a cold-restore via create(). Every other resume\n * failure (transient provider error, auth, network) must propagate so the caller\n * backs off — never spawns a rival box. We err on the side of NOT recreating:\n * an unrecognized error is treated as \"not NotFound\" (propagate), because a\n * false-positive recreate is the dangerous direction (double-spawn).\n */\nfunction liveProviderInstanceIdFromState(\n  backend: SandboxBackend | string,\n  state: unknown,\n): string | null {\n  if (!state || typeof state !== \"object\" || Array.isArray(state)) return null;\n  const registration = PROVIDER_REGISTRY[backend as SandboxBackend];\n  if (!registration || registration.backend !== backend) return null;\n  const record = state as Record<string, unknown>;\n  for (const field of registration.instanceIdFields) {\n    const value = record[field];\n    if (typeof value === \"string\" && value.length > 0) return value;\n  }\n  return null;\n}\n\nfunction legacySandboxProviderInstanceIdFromEnvelope(\n  envelope: Record<string, unknown> | null | undefined,\n  backend?: SandboxBackend | string,\n): string | null {\n  const sessionState =\n    envelope?.sessionState && typeof envelope.sessionState === \"object\"\n      ? (envelope.sessionState as Record<string, unknown>)\n      : null;\n  const providerState =\n    sessionState?.providerState && typeof sessionState.providerState === \"object\"\n      ? sessionState.providerState\n      : envelope?.providerState;\n  const envelopeBackendId =\n    typeof envelope?.backendId === \"string\" && envelope.backendId.length > 0\n      ? envelope.backendId\n      : null;\n  const resolvedBackend =\n    backend ??\n    (envelopeBackendId\n      ? (sandboxBackendForSdkBackendId(envelopeBackendId) ?? envelopeBackendId)\n      : null);\n  return resolvedBackend ? liveProviderInstanceIdFromState(resolvedBackend, providerState) : null;\n}\n\n/** Resolve the stable Opengeni identity first, then legacy SDK provider keys.\n * The fallback is compatibility-only: new envelopes always persist the stable\n * top-level identity, so downstream lease/reaper code remains provider-neutral. */\nexport function sandboxProviderInstanceIdFromEnvelope(\n  envelope: Record<string, unknown> | null | undefined,\n  backend?: SandboxBackend | string,\n): string | null {\n  const declared = envelope?.[OPENGENI_SANDBOX_PROVIDER_INSTANCE_ID_FIELD];\n  if (typeof declared === \"string\" && declared.length > 0) return declared;\n  return legacySandboxProviderInstanceIdFromEnvelope(envelope, backend);\n}\n\n/** Validate rolling-format envelopes before addressing a provider. The stable\n * Opengeni identity is authoritative, but a disagreeing legacy SDK address is\n * corruption/staleness—not evidence that the provider disappeared. */\nexport function assertConsistentSandboxProviderIdentity(\n  backend: SandboxBackend | string,\n  envelope: Record<string, unknown> | null | undefined,\n): string | null {\n  const declared = envelope?.[OPENGENI_SANDBOX_PROVIDER_INSTANCE_ID_FIELD];\n  const stable = typeof declared === \"string\" && declared.length > 0 ? declared : null;\n  const legacy = legacySandboxProviderInstanceIdFromEnvelope(envelope, backend);\n  if (stable && legacy && stable !== legacy) {\n    throw new SandboxResumeIdentityMismatchError(backend, stable, legacy);\n  }\n  return stable ?? legacy;\n}\n\nfunction exactResumeStateForBackend(backend: string, state: unknown): unknown {\n  if (backend !== \"vercel\" || !state || typeof state !== \"object\" || Array.isArray(state)) {\n    return state;\n  }\n  // Vercel's ordinary resume intentionally creates a replacement whenever the\n  // serialized state carries a fresh snapshot. Exact attach/reaper recovery\n  // must address sandboxId instead; clearing only this freshness marker makes\n  // the SDK use Sandbox.get while retaining the snapshot as recovery data.\n  const exactState = { ...(state as Record<string, unknown>) };\n  delete exactState.snapshotSandboxId;\n  return exactState;\n}\n\nfunction providerContinuityRegistration(backend: SandboxBackend | string) {\n  const registration = PROVIDER_REGISTRY[backend as SandboxBackend];\n  return registration?.backend === backend ? registration.continuity : undefined;\n}\n\nexport function sandboxProviderContinuityForState(\n  backend: SandboxBackend | string,\n  state: unknown,\n  sourceInstanceId: string,\n): SandboxProviderContinuityRecovery | null {\n  const continuity = providerContinuityRegistration(backend);\n  const continuityKey = continuity?.keyFromState(state) ?? null;\n  if (!continuity || !continuityKey || sourceInstanceId.length === 0) return null;\n  return {\n    version: 1,\n    backend: backend as SandboxBackend,\n    kind: continuity.kind,\n    sourceInstanceId,\n    continuityKey,\n  };\n}\n\nfunction parsedEnvelopeContinuity(\n  backend: SandboxBackend | string,\n  envelope: Record<string, unknown> | null,\n  state: unknown,\n  expectedInstanceId: string,\n): SandboxProviderContinuityRecovery | null {\n  const recovery =\n    envelope?.opengeniRecovery && typeof envelope.opengeniRecovery === \"object\"\n      ? (envelope.opengeniRecovery as { continuity?: unknown })\n      : null;\n  const value = recovery?.continuity;\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return null;\n  const candidate = value as Partial<SandboxProviderContinuityRecovery>;\n  const derived = sandboxProviderContinuityForState(backend, state, expectedInstanceId);\n  return derived &&\n    candidate.version === derived.version &&\n    candidate.backend === derived.backend &&\n    candidate.kind === derived.kind &&\n    candidate.sourceInstanceId === derived.sourceInstanceId &&\n    candidate.continuityKey === derived.continuityKey\n    ? derived\n    : null;\n}\n\nfunction continuityMatchesState(\n  receipt: SandboxProviderContinuityRecovery,\n  state: unknown,\n): boolean {\n  const continuity = providerContinuityRegistration(receipt.backend);\n  return (\n    continuity?.kind === receipt.kind && continuity.keyFromState(state) === receipt.continuityKey\n  );\n}\n\nfunction preserveContinuityWorkspaceForDiscard(\n  backend: SandboxBackend | string,\n  requestedState: unknown,\n  session: unknown,\n  sessionState: unknown,\n): boolean {\n  const continuity = providerContinuityRegistration(backend);\n  if (!continuity) return false;\n  const requestedKey = continuity.keyFromState(requestedState);\n  const replacementKey = continuity.keyFromState(sessionState);\n  if (!requestedKey || requestedKey !== replacementKey) return false;\n  continuity.preserveWorkspaceForDiscard(session, sessionState);\n  return true;\n}\n\nexport async function resumeExactSandboxSession(\n  clientInput: unknown,\n  backend: SandboxBackend | string,\n  state: unknown,\n  expectedInstanceId: string,\n  options?: { continuity?: SandboxProviderContinuityRecovery },\n): Promise<{\n  session: unknown;\n  sessionState: unknown;\n  instanceId: string;\n  providerContinuity?: SandboxProviderContinuityRecovery;\n}> {\n  const client = clientInput as ResumeCapableClient;\n  if (!client.resume) {\n    throw new SandboxConfigError(backend, `Sandbox backend \"${backend}\" does not support resume()`);\n  }\n  const exactState = exactResumeStateForBackend(client.backendId, state);\n  const continuity = options?.continuity;\n  if (\n    continuity &&\n    (continuity.backend !== backend ||\n      continuity.sourceInstanceId !== expectedInstanceId ||\n      !continuityMatchesState(continuity, exactState))\n  ) {\n    throw new SandboxResumeIdentityMismatchError(\n      backend,\n      expectedInstanceId,\n      continuity.sourceInstanceId,\n    );\n  }\n  if (!continuity && !client.resumeExact) {\n    throw new SandboxConfigError(\n      backend,\n      `Sandbox backend \"${backend}\" has no non-replacing resumeExact()`,\n    );\n  }\n  // A durable continuity receipt is creation authority owned by either the\n  // unique cold->warming winner or a durable teardown claim. Ordinary attached\n  // callers use resumeExact so an SDK cannot silently create a rival wrapper.\n  const session = continuity\n    ? await client.resume(exactState)\n    : await client.resumeExact!(exactState);\n  const actualInstanceId = readInstanceId(backend, session);\n  if (!actualInstanceId) {\n    // Do not tear down an unidentifiable handle: it may be the requested live\n    // provider. The adapter must expose a stable identity before Opengeni can\n    // safely command, publish, snapshot, or delete it.\n    throw new SandboxResumeIdentityUnavailableError(backend, expectedInstanceId);\n  }\n  if (actualInstanceId !== expectedInstanceId) {\n    const replacementState = (session as { state?: unknown }).state ?? exactState;\n    if (continuity && continuityMatchesState(continuity, replacementState)) {\n      return {\n        session,\n        sessionState: replacementState,\n        instanceId: actualInstanceId,\n        providerContinuity: continuity,\n      };\n    }\n    // A provider may race from running to absent between an exact preflight and\n    // its SDK resume. If that produced a same-workspace wrapper, discard only\n    // the wrapper; deleting the shared workspace would destroy recovery truth.\n    preserveContinuityWorkspaceForDiscard(backend, exactState, session, replacementState);\n    try {\n      await terminateManagedSandboxSession(client, replacementState, session);\n    } catch (cleanupError) {\n      throw new SandboxResumeIdentityMismatchError(backend, expectedInstanceId, actualInstanceId, {\n        cause: cleanupError,\n      });\n    }\n    throw new SandboxExactResumeReplacedError(backend, expectedInstanceId, actualInstanceId);\n  }\n  return {\n    session,\n    sessionState: (session as { state?: unknown }).state ?? exactState,\n    instanceId: actualInstanceId,\n    ...(continuity ? { providerContinuity: continuity } : {}),\n  };\n}\n\n/** Terminate a provider handle that never became durable warm ownership. A\n * continuity-adopted Docker wrapper is removed while its durable host\n * workspace remains available to the next elected recovery owner. */\nexport async function terminateUnpublishedSandboxSession(\n  established: EstablishedSandboxSession,\n): Promise<void> {\n  if (established.providerContinuity) {\n    const continuity = providerContinuityRegistration(established.providerContinuity.backend);\n    if (\n      continuity?.kind === established.providerContinuity.kind &&\n      continuity.keyFromState(established.sessionState) ===\n        established.providerContinuity.continuityKey\n    ) {\n      continuity.preserveWorkspaceForDiscard(established.session, established.sessionState);\n    }\n  }\n  await terminateManagedSandboxSession(\n    established.client,\n    established.sessionState,\n    established.session,\n  );\n}\n\n/** Remove every live-provider address while retaining backend-independent\n * archive/config state for a safe cold rematerialization. */\nexport function withoutSandboxProviderIdentity(\n  envelope: Record<string, unknown> | null,\n): Record<string, unknown> | null {\n  if (!envelope) return null;\n  const providerIndependentEnvelope = { ...envelope };\n  delete providerIndependentEnvelope[OPENGENI_SANDBOX_PROVIDER_INSTANCE_ID_FIELD];\n  // Some rolling/legacy envelopes contain both a top-level providerState and\n  // the newer nested sessionState. Strip both representations; retaining the\n  // top-level fallback would make the compatibility reader rediscover a dead\n  // provider after we deliberately converted the envelope to archive-only.\n  delete providerIndependentEnvelope.providerState;\n  const sessionState =\n    envelope.sessionState && typeof envelope.sessionState === \"object\"\n      ? (envelope.sessionState as Record<string, unknown>)\n      : null;\n  if (!sessionState) {\n    return providerIndependentEnvelope;\n  }\n  const { providerState: _providerState, ...providerIndependentState } = sessionState;\n  return {\n    ...providerIndependentEnvelope,\n    sessionState: providerIndependentState,\n  };\n}\n\nfunction readInstanceId(backend: SandboxBackend | string, session: unknown): string {\n  return liveProviderInstanceIdFromState(backend, (session as { state?: unknown }).state) ?? \"\";\n}\n\nasync function terminateCreatedSandbox(\n  client: ResumeCapableClient,\n  session: unknown,\n  sessionState: unknown,\n): Promise<void> {\n  try {\n    await terminateManagedSandboxSession(client, sessionState, session);\n  } catch {\n    /* best-effort */\n  }\n}\n\ntype ModalNativeWorkspacePersistence = \"snapshot_filesystem\" | \"snapshot_directory\";\ntype RestoreWorkspaceArchive =\n  | VerifiedWorkspaceArchive\n  | {\n      kind: \"host_spool\";\n      descriptor: TarWorkspaceArchiveDescriptor;\n      ref: WorkspaceArchiveObjectRef;\n    };\n\nfunction modalWorkspacePersistenceForRestore(\n  archive: RestoreWorkspaceArchive | null,\n): ModalNativeWorkspacePersistence | null {\n  if (archive?.kind !== \"provider_snapshot\") return null;\n  const snapshot = archive.nativeSnapshot;\n  if (!snapshot) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"native_snapshot_reference_invalid\",\n      `selected native snapshot archive revision ${archive.descriptor.revision} has no decoded provider receipt`,\n    );\n  }\n  const expected =\n    snapshot.provider === \"modal_snapshot_filesystem\"\n      ? \"snapshot_filesystem\"\n      : snapshot.provider === \"modal_snapshot_directory\"\n        ? \"snapshot_directory\"\n        : null;\n  if (!expected) return null;\n  if (snapshot.workspacePersistence !== undefined && snapshot.workspacePersistence !== expected) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"native_snapshot_reference_invalid\",\n      `selected Modal snapshot archive revision ${archive.descriptor.revision} has inconsistent persistence metadata`,\n    );\n  }\n  return expected;\n}\n\nfunction settingsForWorkspaceArchiveRestore(\n  backend: SandboxBackend,\n  settings: Settings,\n  archive: RestoreWorkspaceArchive | null,\n): Settings {\n  if (backend !== \"modal\") return settings;\n  const workspacePersistence = modalWorkspacePersistenceForRestore(archive);\n  if (workspacePersistence === \"snapshot_filesystem\" && archive?.kind === \"provider_snapshot\") {\n    // Boot the selected filesystem image directly. SDK hydrateWorkspace would\n    // create a second box and expose its identity only after old-box teardown.\n    // The ordinary create callback must own the only destination before verify.\n    return {\n      ...settings,\n      modalWorkspacePersistence: workspacePersistence,\n      modalImageId: archive.nativeSnapshot!.snapshotId,\n    };\n  }\n  return workspacePersistence && settings.modalWorkspacePersistence !== workspacePersistence\n    ? { ...settings, modalWorkspacePersistence: workspacePersistence }\n    : settings;\n}\n\n/**\n * Establish from one recovery envelope under an explicit creation policy. The\n * envelope is the lease's box-identity descriptor (the same per-turn `_sandbox`\n * envelope upserted by the turn activity).\n *\n *  - `opts.backendOverride ?? envelope.backendId ?? settings.sandboxBackend`\n *    selects the backend; the client is built for THAT backend (resume-by-id is\n *    fenced to the original provider).\n *  - warm reattach: deserialize the envelope sessionState → client.resume(state)\n *    (no lock; R4-safe). `resume-only` propagates provider NotFound.\n *  - `create-or-restore`: the elected owner may replace a missing warm instance,\n *    or create directly from a cold/null envelope.\n */\nexport async function establishSandboxSessionFromEnvelope(\n  settings: Settings,\n  envelope: Record<string, unknown> | null,\n  opts: {\n    sessionId: string;\n    recovery: \"create-or-restore\" | \"resume-only\";\n    loadHostWorkspaceArchive?: (ref: WorkspaceArchiveObjectRef) => Promise<WorkspaceArchiveSpool>;\n    backendOverride?: SandboxBackend;\n    environment?: Record<string, string>;\n    onSandboxCreated?: SandboxCreatedCallback;\n    /** Durable lease owners fence the attempt before invoking a provider create.\n     * Called for each physical attempt, including logical-image fallback. A\n     * rejected hook prevents dispatch; a lost create reply is never permission\n     * to invoke the fallback under the same unresolved operation. */\n    onBeforeSandboxCreate?: (\n      settings: Settings,\n      intent?: ModalCreateIntent,\n      providerContext?: unknown,\n    ) => Promise<void>;\n    /** Called after archive hydration but immediately before the exact workspace\n     * fingerprint probe. Lease-aware callers persist `verifying` here so a box\n     * is never observable as ready while verification is in flight. */\n    onWorkspaceRestoreVerifying?: (descriptor: WorkspaceArchiveDescriptor) => Promise<void>;\n    metrics?: RuntimeMetricsHooks;\n    /** Exact pre-optimization sandbox settings. When a provider-immutable rig\n     * image is missing, retry from this logical image identity rather than\n     * guessing from a possibly absent tag or falling through to provider\n     * defaults. */\n    logicalFallbackSettings?: Settings;\n    /** Isolated conformance-test/embedding seam. Ordinary runtime callers use\n     * the validated provider registry. */\n    clientFactory?: (\n      backend: SandboxBackend,\n      settings: Settings,\n      environment: Record<string, string>,\n    ) => unknown;\n  },\n): Promise<EstablishedSandboxSession> {\n  const envelopeBackend =\n    typeof envelope?.backendId === \"string\" ? (envelope.backendId as SandboxBackend) : undefined;\n  const backend =\n    opts.backendOverride ?? envelopeBackend ?? (settings.sandboxBackend as SandboxBackend);\n  const createImageSource =\n    backend === \"modal\" && settings.modalImageId ? \"provider_immutable\" : \"logical\";\n  const environment = opts.environment ?? collectSandboxEnvironment(settings);\n  const client = (\n    opts.clientFactory\n      ? opts.clientFactory(backend, settings, environment)\n      : createSandboxClientForBackend(backend, settings, environment, opts.metrics)\n  ) as ResumeCapableClient | undefined;\n  if (!client) {\n    throw new SandboxConfigError(\n      backend,\n      `Cannot establish a sandbox session for backend \"${backend}\" (no client; sandboxBackend=none?)`,\n    );\n  }\n  if (opts.recovery === \"create-or-restore\" && !client.create) {\n    throw new SandboxConfigError(backend, `Sandbox backend \"${backend}\" does not support create()`);\n  }\n\n  // The manifest the box is CREATED with. Its `environment` must equal the\n  // environment the agent declares for this run (buildManifest's `environment`),\n  // because the SDK injects this box NON-OWNED and then applies the agent's\n  // manifest as a provided-session delta — `applyManifestToProvidedSession`\n  // throws on ANY environment delta (validateNoEnvironmentDelta). The client's\n  // constructor `env` materializes the RUNTIME env but does NOT populate\n  // `manifest.environment` (a bare create() yields `new Manifest()` with an empty\n  // environment), so the manifest env must be set here explicitly. `root` is left\n  // to default to \"/workspace\" to match buildManifest's declared root (the\n  // root-delta guard). The caller threads `opts.environment` = the SAME object\n  // passed to runtime.buildAgent, so current==target and the delta is empty.\n  const createManifest = { environment };\n\n  // The serialized provider state the box was last persisted as. The envelope\n  // shape is the per-turn `_sandbox` entry; its `sessionState` is the provider\n  // payload deserializeSandboxSessionStateEnvelope re-hydrates.\n  const envelopeSessionState =\n    envelope && typeof envelope === \"object\"\n      ? (envelope as { sessionState?: unknown }).sessionState\n      : undefined;\n\n  // The persisted /workspace snapshot the reaper folded onto the lease envelope\n  // (sandbox-file-persistence). Present on a re-warm whose box was drain-persisted:\n  //   - WARM reattach NotFound path (box gone, full envelope still has sandboxId);\n  //   - COLD lease re-warm (confirmDrainCold preserved a MINIMAL archive-only\n  //     envelope `{ sessionState: { workspaceArchive } }` — NO sandboxId, so the\n  //     warm-reattach branch must NOT try resume()-by-id; it cold-creates+hydrates).\n  const archiveState =\n    envelopeSessionState && typeof envelopeSessionState === \"object\"\n      ? (envelopeSessionState as {\n          workspaceArchive?: unknown;\n          workspaceArchiveRef?: unknown;\n          workspaceArchiveMeta?: unknown;\n        })\n      : undefined;\n  // Exactly one selected revision is restored. A present archive without its\n  // revision/hash/tree descriptor is not recoverable truth and fails before any\n  // provider create. `workspaceArchivePrev` is retained for explicit future\n  // operator selection, never silently substituted in this attempt.\n  const workspaceArchiveBase64 = archiveState?.workspaceArchive;\n  const workspaceArchiveMetadata = archiveState?.workspaceArchiveMeta;\n\n  // Create one destination directly from a Modal filesystem snapshot; other\n  // archive protocols hydrate the fresh destination. No archive is valid only\n  // for a genuinely new workspace; callers select and verify an exact archive before\n  // entering this seam. This is the SOLE archive-replay path, shared by the\n  // NotFound warm-reattach path and the cold-restore branch (b) below.\n  const coldRestore = async (resumeFallbackState?: unknown): Promise<EstablishedSandboxSession> => {\n    // Parse/verify lazily: a warm resume-by-id does not consume its retained\n    // archive, so a legacy live box remains resumable. Creation/restoration is\n    // the boundary that requires complete durable metadata.\n    let workspaceArchive: RestoreWorkspaceArchive | null = readVerifiedWorkspaceArchive(\n      workspaceArchiveBase64,\n      workspaceArchiveMetadata,\n    );\n    const objectRef = parseWorkspaceArchiveObjectRef(archiveState?.workspaceArchiveRef);\n    const objectDescriptor = parseWorkspaceArchiveDescriptor(workspaceArchiveMetadata);\n    if (\n      process.platform === \"linux\" &&\n      objectRef &&\n      objectDescriptor?.version === 1 &&\n      objectDescriptor.workspace.projection === \"sdk_local_archive_v1\" &&\n      opts.loadHostWorkspaceArchive\n    ) {\n      // Local/Docker restore a host-backed archive natively. Any other backend\n      // hydrates a portable tar converted from it, so a deployment that changes\n      // sandbox backend can still continue chats archived before the change.\n      if (\n        objectRef.sha256 !== objectDescriptor.archiveSha256 ||\n        objectRef.bytes !== objectDescriptor.archiveBytes\n      ) {\n        throw new WorkspaceArchiveIntegrityError(\n          \"archive_metadata_invalid\",\n          \"Host archive object reference does not match its descriptor\",\n        );\n      }\n      workspaceArchive = { kind: \"host_spool\", descriptor: objectDescriptor, ref: objectRef };\n    }\n    const hostBackedBackend = backend === \"local\" || backend === \"docker\";\n    if (objectRef && !workspaceArchive) {\n      throw new WorkspaceArchiveIntegrityError(\n        \"archive_hydration_failed\",\n        \"Selected workspace archive object has no supported restore loader\",\n      );\n    }\n    let hostSpool: WorkspaceArchiveSpool | undefined;\n    try {\n      // Preserve the pre-create integrity boundary used by inline archives.\n      // A missing/corrupt object must not create a provider just to delete it.\n      if (workspaceArchive?.kind === \"host_spool\") {\n        hostSpool = await opts.loadHostWorkspaceArchive!(workspaceArchive.ref);\n        if (\n          hostSpool.sha256 !== workspaceArchive.descriptor.archiveSha256 ||\n          hostSpool.byteSize !== workspaceArchive.descriptor.archiveBytes\n        ) {\n          throw new WorkspaceArchiveIntegrityError(\n            \"archive_hash_mismatch\",\n            \"Downloaded workspace archive does not match its descriptor\",\n          );\n        }\n      }\n      // The selected native artifact is the durable authority for its restore\n      // protocol. The process setting governs new sandboxes only: a mode rollout\n      // must not make an older, verified Modal snapshot impossible to hydrate.\n      const restoreSettings = settingsForWorkspaceArchiveRestore(\n        backend,\n        settings,\n        workspaceArchive,\n      );\n      const createdFromFilesystemSnapshot =\n        backend === \"modal\" &&\n        workspaceArchive?.kind === \"provider_snapshot\" &&\n        workspaceArchive.nativeSnapshot?.provider === \"modal_snapshot_filesystem\";\n      const restoreImageSource = createdFromFilesystemSnapshot\n        ? \"provider_immutable\"\n        : createImageSource;\n      // Resolve only the image this create will use. A retained filesystem\n      // snapshot must not depend on the availability of today's registry image\n      // or its secret. Rebuild the Modal client after registry resolution so\n      // fresh/directory creates receive the resolved private-image selector.\n      if (backend === \"modal\" && !opts.clientFactory) {\n        await ensureModalRegistryImage(restoreSettings);\n      }\n      const restoreClient =\n        restoreSettings === settings && (backend !== \"modal\" || opts.clientFactory)\n          ? client\n          : ((opts.clientFactory\n              ? opts.clientFactory(backend, restoreSettings, environment)\n              : createSandboxClientForBackend(\n                  backend,\n                  restoreSettings,\n                  environment,\n                  opts.metrics,\n                )) as ResumeCapableClient | undefined);\n      if (!restoreClient?.create) {\n        throw new SandboxConfigError(\n          backend,\n          `Sandbox backend \"${backend}\" does not support fresh archive restoration`,\n        );\n      }\n      let createdClient = restoreClient;\n      let attributedDuringCreate = false;\n      let providerDispatchAttempted = false;\n      const createWithAttribution = async (\n        candidate: ResumeCapableClient,\n        createSettings: Settings,\n      ) => {\n        if (candidate.createWithLifecycle && opts.onBeforeSandboxCreate) {\n          return await candidate.createWithLifecycle(\n            { manifest: createManifest },\n            {\n              beforeDispatch: async (intent, providerContext) => {\n                providerDispatchAttempted = true;\n                await opts.onBeforeSandboxCreate!(createSettings, intent, providerContext);\n              },\n              onCreated: async (session) => {\n                const instanceId = readInstanceId(backend, session);\n                if (!instanceId) throw new Error(\"Modal provider receipt has no physical identity\");\n                await opts.onSandboxCreated?.({\n                  client: candidate,\n                  session,\n                  sessionState: (session as { state?: unknown }).state ?? resumeFallbackState,\n                  instanceId,\n                  backendId: candidate.backendId,\n                });\n                attributedDuringCreate = true;\n              },\n            },\n          );\n        }\n        // Non-Modal providers and isolated client-factory fixtures retain their\n        // ordinary admission hook. Production Modal requires the wire intent.\n        await opts.onBeforeSandboxCreate?.(createSettings);\n        return await candidate.create!({ manifest: createManifest });\n      };\n      const createStarted = Date.now();\n      let restored: Awaited<ReturnType<NonNullable<typeof restoreClient.create>>>;\n      try {\n        restored = await createWithAttribution(restoreClient, restoreSettings);\n        recordSandboxCreateMetric(\n          opts.metrics,\n          restoreClient.backendId,\n          restoreImageSource,\n          \"completed\",\n          createStarted,\n        );\n      } catch (error) {\n        recordSandboxCreateMetric(\n          opts.metrics,\n          restoreClient.backendId,\n          restoreImageSource,\n          \"failed\",\n          createStarted,\n        );\n        recordSandboxProviderApiThrottleMetric(\n          opts.metrics,\n          restoreClient.backendId,\n          \"create\",\n          error,\n        );\n        if (providerDispatchAttempted) {\n          // Preserve the actual failure (including a known cleanup/setup\n          // failure); the durable receipt decides whether outcome is unknown.\n          throw error;\n        }\n        if (\n          createdFromFilesystemSnapshot ||\n          createImageSource !== \"provider_immutable\" ||\n          backend !== \"modal\" ||\n          !isProviderSandboxNotFoundError(restoreClient.backendId, error)\n        ) {\n          throw error;\n        }\n        const fallbackBaseSettings =\n          opts.logicalFallbackSettings ??\n          (settings.modalImageRef ? { ...settings, modalImageId: undefined } : null);\n        if (!fallbackBaseSettings) {\n          // An ID-only logical base is supported. Without the exact pre-selection\n          // settings, clearing the optimized ID would silently boot Modal's\n          // default image, so fail closed instead of changing the rig base.\n          throw error;\n        }\n        const fallbackSettings = settingsForWorkspaceArchiveRestore(\n          backend,\n          fallbackBaseSettings,\n          workspaceArchive,\n        );\n        await ensureModalRegistryImage(fallbackSettings);\n        const fallbackClient = (\n          opts.clientFactory\n            ? opts.clientFactory(backend, fallbackSettings, environment)\n            : createSandboxClientForBackend(backend, fallbackSettings, environment, opts.metrics)\n        ) as ResumeCapableClient | undefined;\n        if (!fallbackClient?.create) {\n          throw new SandboxConfigError(\n            backend,\n            \"Modal logical-image fallback does not support fresh creation\",\n          );\n        }\n        const fallbackStarted = Date.now();\n        try {\n          restored = await createWithAttribution(fallbackClient, fallbackSettings);\n          recordSandboxCreateMetric(\n            opts.metrics,\n            fallbackClient.backendId,\n            \"logical\",\n            \"completed\",\n            fallbackStarted,\n          );\n          createdClient = fallbackClient;\n        } catch (fallbackError) {\n          recordSandboxCreateMetric(\n            opts.metrics,\n            fallbackClient.backendId,\n            \"logical\",\n            \"failed\",\n            fallbackStarted,\n          );\n          recordSandboxProviderApiThrottleMetric(\n            opts.metrics,\n            fallbackClient.backendId,\n            \"create\",\n            fallbackError,\n          );\n          throw fallbackError;\n        }\n      }\n      let restoredState = (restored as { state?: unknown }).state;\n      const restoredInstanceId = readInstanceId(backend, restored);\n      if (!restoredInstanceId) {\n        await terminateCreatedSandbox(createdClient, restored, restoredState);\n        throw new SandboxConfigError(\n          backend,\n          `Sandbox backend \"${backend}\" created a handle without its declared provider identity`,\n        );\n      }\n      let established: EstablishedSandboxSession = {\n        client: createdClient,\n        session: restored,\n        sessionState: restoredState ?? resumeFallbackState,\n        instanceId: restoredInstanceId,\n        backendId: createdClient.backendId,\n      };\n      if (opts.onSandboxCreated && !attributedDuringCreate) {\n        try {\n          await opts.onSandboxCreated(established);\n        } catch (createCallbackError) {\n          await terminateCreatedSandbox(createdClient, restored, restoredState);\n          throw createCallbackError;\n        }\n      }\n      let hydrationApplied = false;\n      // A host-backed archive hydrated into a remote sandbox: what the converted\n      // tar materializes, verified after hydration instead of the archive's\n      // host-only fingerprint projection.\n      let portableContents: PortableWorkspaceTar[\"contents\"] | null = null;\n      if (workspaceArchive) {\n        const hydrate = (restored as { hydrateWorkspace?: (data: Uint8Array) => Promise<void> })\n          .hydrateWorkspace;\n        if (\n          !createdFromFilesystemSnapshot &&\n          (workspaceArchive.kind !== \"host_spool\" || !hostBackedBackend) &&\n          typeof hydrate !== \"function\"\n        ) {\n          await terminateCreatedSandbox(createdClient, restored, restoredState);\n          throw new WorkspaceArchiveIntegrityError(\n            \"archive_hydration_failed\",\n            `sandbox backend ${createdClient.backendId} cannot hydrate selected archive revision ${workspaceArchive.descriptor.revision}`,\n          );\n        }\n        try {\n          if (\n            createdFromFilesystemSnapshot &&\n            (restoredState as { imageId?: unknown } | undefined)?.imageId !==\n              restoreSettings.modalImageId\n          ) {\n            throw new WorkspaceArchiveIntegrityError(\n              \"archive_hydration_failed\",\n              \"Modal destination did not boot the selected filesystem snapshot\",\n            );\n          }\n          // Directory/tar hydration operates on the attributed destination.\n          if (workspaceArchive.kind === \"host_spool\" && hostBackedBackend) {\n            // This is the exact newly-created, unpublished destination. The lease\n            // restore fence must exclude admitted writers until verification ends;\n            // descriptor-relative filesystem access alone is not writer isolation.\n            const root = (restored as { state?: { workspaceRootPath?: unknown } }).state\n              ?.workspaceRootPath;\n            if (typeof root !== \"string\")\n              throw new WorkspaceArchiveIntegrityError(\n                \"archive_hydration_failed\",\n                \"Host archive restore has no exact workspace root\",\n              );\n            await restoreHostWorkspaceArchive(root, hostSpool!, {\n              archiveLimits: Reflect.get(restored as object, \"archiveLimits\"),\n            });\n          } else if (workspaceArchive.kind === \"host_spool\") {\n            const portable = await convertHostWorkspaceArchiveToTar(hostSpool!, {\n              excludedPaths: workspaceArchiveExcludedPaths(restored),\n              mtimeSeconds: Date.parse(workspaceArchive.descriptor.capturedAt) / 1000,\n            });\n            // The descriptor was fingerprinted from the source tree when it was\n            // captured; the archive must still be exactly that tree.\n            const expected = workspaceArchive.descriptor.workspace;\n            if (\n              portable.fingerprint.sha256 !== expected.sha256 ||\n              portable.fingerprint.entryCount !== expected.entryCount ||\n              portable.fingerprint.fileCount !== expected.fileCount ||\n              portable.fingerprint.totalFileBytes !== expected.totalFileBytes\n            ) {\n              throw new WorkspaceArchiveIntegrityError(\n                \"archive_hash_mismatch\",\n                `workspace archive revision ${workspaceArchive.descriptor.revision} does not match its recorded fingerprint`,\n              );\n            }\n            await hydrate!.call(restored, portable.bytes);\n            portableContents = portable.contents;\n          } else if (!createdFromFilesystemSnapshot) {\n            await hydrate!.call(restored, workspaceArchive.bytes);\n          }\n        } catch (error) {\n          await terminateCreatedSandbox(\n            createdClient,\n            restored,\n            (restored as { state?: unknown }).state,\n          );\n          if (error instanceof WorkspaceArchiveIntegrityError) throw error;\n          throw new WorkspaceArchiveIntegrityError(\n            \"archive_hydration_failed\",\n            `failed to hydrate selected workspace archive revision ${workspaceArchive.descriptor.revision}`,\n            { retryable: true, cause: error },\n          );\n        }\n        // Defend against a backend replacing its provider during hydration.\n        // Attribute the newly-active identity immediately,\n        // before restore-state marking, fingerprint verification, or any caller\n        // can publish the box warm. The callback is the durable lease/tagging\n        // boundary; if it cannot persist the replacement, the caller fails closed\n        // and this exact replacement is terminated below.\n        const hydratedState = (restored as { state?: unknown }).state;\n        const hydratedInstanceId = readInstanceId(backend, restored);\n        if (!hydratedInstanceId) {\n          await terminateCreatedSandbox(createdClient, restored, hydratedState);\n          throw new SandboxConfigError(\n            backend,\n            `Sandbox backend \"${backend}\" hydrated a handle without its declared provider identity`,\n          );\n        }\n        if (hydratedInstanceId !== established.instanceId) {\n          established = {\n            client: createdClient,\n            session: restored,\n            sessionState: hydratedState ?? resumeFallbackState,\n            instanceId: hydratedInstanceId,\n            backendId: createdClient.backendId,\n          };\n          if (opts.onSandboxCreated) {\n            try {\n              await opts.onSandboxCreated(established);\n            } catch (createCallbackError) {\n              await terminateCreatedSandbox(createdClient, restored, hydratedState);\n              throw createCallbackError;\n            }\n          }\n        }\n        if (opts.onWorkspaceRestoreVerifying) {\n          try {\n            await opts.onWorkspaceRestoreVerifying(workspaceArchive.descriptor);\n          } catch (error) {\n            await terminateCreatedSandbox(\n              createdClient,\n              restored,\n              (restored as { state?: unknown }).state,\n            );\n            throw error;\n          }\n        }\n        // Native provider snapshots are restored by their exact opaque receipt.\n        // Opengeni verifies receipt identity/hash before hydration, but it must not\n        // impose a tar/inode equivalence contract on the provider's filesystem\n        // image. Tar archives remain content-verified after hydration.\n        if (workspaceArchive.kind === \"tar\" || workspaceArchive.kind === \"host_spool\") {\n          try {\n            if (portableContents) {\n              await verifyRestoredWorkspaceContents(\n                restored,\n                portableContents,\n                workspaceArchive.descriptor.revision,\n              );\n            } else {\n              await verifyRestoredWorkspace(restored, workspaceArchive.descriptor);\n            }\n          } catch (error) {\n            await terminateCreatedSandbox(\n              createdClient,\n              restored,\n              (restored as { state?: unknown }).state,\n            );\n            if (error instanceof WorkspaceArchiveIntegrityError) throw error;\n            throw new WorkspaceArchiveIntegrityError(\n              \"workspace_fingerprint_unavailable\",\n              `failed to verify selected workspace archive revision ${workspaceArchive.descriptor.revision}`,\n              { retryable: true },\n            );\n          }\n        }\n        hydrationApplied = true;\n        console.info(\n          `[sandbox] cold-restore applied ${workspaceArchive.kind === \"provider_snapshot\" ? \"native snapshot receipt\" : \"verified tar archive\"} revision ${workspaceArchive.descriptor.revision}`,\n        );\n      }\n      restoredState = (restored as { state?: unknown }).state;\n      const finalInstanceId = readInstanceId(backend, restored);\n      if (!finalInstanceId) {\n        await terminateCreatedSandbox(createdClient, restored, restoredState);\n        throw new SandboxConfigError(\n          backend,\n          `Sandbox backend \"${backend}\" returned a handle without its declared provider identity`,\n        );\n      }\n      return {\n        client: createdClient,\n        session: restored,\n        sessionState: restoredState ?? resumeFallbackState,\n        instanceId: finalInstanceId,\n        backendId: createdClient.backendId,\n        origin: hydrationApplied ? (\"restored\" as const) : (\"created\" as const),\n        ...(workspaceArchive ? { restoredArchive: workspaceArchive.descriptor } : {}),\n      };\n    } finally {\n      await hostSpool?.dispose().catch(() => {\n        // Cleanup must not discard a successfully established provider handle\n        // or replace the authoritative restore failure with a filesystem error.\n        console.warn(\"workspace archive download spool cleanup failed\");\n      });\n    }\n  };\n\n  // Does the envelope carry a RESUMABLE box id (warm reattach), or only a\n  // restorable archive (cold lease)? Archive-only state is not resumable: the\n  // provider's deserialize/resume path would reject it before Opengeni could\n  // cold-restore. New envelopes use the stable Opengeni identity; legacy SDK\n  // provider keys remain readable during rollout.\n  const persistedInstanceId = assertConsistentSandboxProviderIdentity(backend, envelope);\n  const hasResumableInstance = persistedInstanceId !== null;\n\n  // (a) WARM REATTACH BY ID — only when the envelope carries a resumable box id.\n  if (\n    hasResumableInstance &&\n    envelopeSessionState &&\n    client.resume &&\n    client.deserializeSessionState\n  ) {\n    let resumedState: unknown;\n    try {\n      resumedState = await deserializeSandboxSessionStateEnvelope(\n        client as unknown as SandboxClient,\n        envelopeSessionState,\n        persistedInstanceId,\n      );\n    } catch (error) {\n      throw new SandboxConfigError(\n        backend,\n        `Failed to deserialize sandbox resume envelope for backend \"${backend}\": ${error instanceof Error ? error.message : String(error)}`,\n      );\n    }\n    if (resumedState !== undefined) {\n      const providerContinuity =\n        opts.recovery === \"create-or-restore\"\n          ? parsedEnvelopeContinuity(backend, envelope, resumedState, persistedInstanceId)\n          : null;\n      try {\n        const resumed = await resumeExactSandboxSession(\n          client,\n          backend,\n          resumedState,\n          persistedInstanceId,\n          providerContinuity ? { continuity: providerContinuity } : undefined,\n        );\n        const established: EstablishedSandboxSession = {\n          client,\n          session: resumed.session,\n          sessionState: resumed.sessionState,\n          instanceId: resumed.instanceId,\n          backendId: client.backendId,\n          origin: \"resumed\",\n          ...(resumed.providerContinuity ? { providerContinuity: resumed.providerContinuity } : {}),\n          ...(resumed.instanceId !== persistedInstanceId\n            ? { lostInstanceId: persistedInstanceId }\n            : {}),\n        };\n        // A continuity resume occurs only on a lease's unique warming owner.\n        // Attribute the restarted/adopted wrapper before returning exactly as\n        // for a fresh create; failure discards the wrapper but preserves the\n        // durable workspace for the next owner.\n        if (resumed.providerContinuity && opts.onSandboxCreated) {\n          try {\n            await opts.onSandboxCreated(established);\n          } catch (error) {\n            await terminateUnpublishedSandboxSession(established).catch(() => undefined);\n            throw error;\n          }\n        }\n        return established;\n      } catch (error) {\n        // Attached callers never own replacement. Propagate the provider\n        // NotFound so their lease-aware caller can atomically mark this exact\n        // warm epoch/instance cold and re-enter normal admission. Only the\n        // cold->warming winner may replace the missing box.\n        if (\n          !isProviderSandboxNotFoundError(client.backendId, error) ||\n          opts.recovery === \"resume-only\"\n        ) {\n          throw error;\n        }\n        // COLD-RESTORE: the box is genuinely gone. Modal does NOT restore via\n        // create({ snapshot }) — passing `snapshot` to ModalSandboxClient.create()\n        // THROWS (assertCoreSnapshotUnsupported). Modal's real persistence is an\n        // OPAQUE ARCHIVE captured by session.persistWorkspace() at drain/turn-\n        // snapshot time and folded onto the lease envelope\n        // (sandbox-file-persistence). The shared coldRestore() seam creates a\n        // fresh box and replays that archive. `lostInstanceId` carries the gone\n        // box's id so the caller can emit the durable sandbox.box.lost event.\n        if (\n          providerContinuity &&\n          (typeof workspaceArchiveBase64 !== \"string\" || workspaceArchiveBase64.length === 0)\n        ) {\n          throw new SandboxProviderContinuityUnavailableError(backend, persistedInstanceId, false, {\n            cause: error,\n          });\n        }\n        let restoredSession: EstablishedSandboxSession;\n        try {\n          restoredSession = await coldRestore(resumedState);\n        } catch (restoreError) {\n          if (!providerContinuity) throw restoreError;\n          throw new SandboxProviderContinuityUnavailableError(\n            backend,\n            persistedInstanceId,\n            restoreError instanceof WorkspaceArchiveIntegrityError ? restoreError.retryable : true,\n            { cause: restoreError },\n          );\n        }\n        return persistedInstanceId\n          ? { ...restoredSession, lostInstanceId: persistedInstanceId }\n          : restoredSession;\n      }\n    }\n  }\n\n  // (b) COLD SESSION / COLD LEASE — no resumable box id. create() a fresh box, and\n  // if the envelope carries a persisted /workspace snapshot (the archive-only\n  // envelope confirmDrainCold preserves across draining->cold), replay it so\n  // /workspace survives the box churn (sandbox-file-persistence). No archive -> a\n  // clean empty box (a never-warmed session).\n  if (opts.recovery === \"resume-only\") {\n    throw new SandboxResumeStateUnavailableError(backend);\n  }\n  return await coldRestore();\n}\n\nfunction recordSandboxCreateMetric(\n  metrics: RuntimeMetricsHooks | undefined,\n  backend: string,\n  imageSource: \"logical\" | \"provider_immutable\",\n  outcome: \"completed\" | \"failed\",\n  startedMs: number,\n): void {\n  try {\n    metrics?.onSandboxCreate?.({\n      backend,\n      imageSource,\n      outcome,\n      durationSeconds: Math.max(0, (Date.now() - startedMs) / 1000),\n    });\n  } catch {\n    // Metrics emission must not affect sandbox lifecycle.\n  }\n}\n\nfunction recordSandboxProviderApiThrottleMetric(\n  metrics: RuntimeMetricsHooks | undefined,\n  backend: string,\n  operation: \"create\" | \"renew\",\n  error: unknown,\n): void {\n  if (!isProviderApiThrottleError(error)) return;\n  try {\n    metrics?.onSandboxProviderApiThrottle?.({ backend, operation });\n  } catch {\n    // Metrics emission must not affect sandbox lifecycle.\n  }\n}\n\n// A client that can SERIALIZE a live session state back to the persistable\n// envelope form (the inverse of deserializeSessionState). Narrowed so the leaf\n// stays agent-loop-free.\ntype SerializeCapableClient = {\n  backendId: string;\n  serializeSessionState?: (state: unknown, options?: unknown) => Promise<Record<string, unknown>>;\n};\n\n/**\n * Fold a freshly-established (or resumed) sandbox session into the persistable\n * `resume_state` envelope the lease stores — the SAME `{ backendId, sessionState }`\n * shape `establishSandboxSessionFromEnvelope` consumes to RESUME BY ID. The\n * API-direct control plane (viewer attach / Channel-A) MUST persist this onto the\n * lease at warm-commit time, or a later op (which reads the lease's resume_state)\n * has nothing to resume from and COLD-CREATES A RIVAL BOX — the box-churn the\n * prove-it surfaced (fs.write then fs.read 404'd on a different box; N Channel-A\n * ops leaked N boxes). Returns null when the client cannot serialize (the caller\n * stores null and the box rides the provider idle-timeout — no rival spawn, just\n * no warm-reattach).\n */\nexport async function serializeEstablishedSandboxEnvelope(\n  established: EstablishedSandboxSession,\n): Promise<Record<string, unknown> | null> {\n  const client = established.client as SerializeCapableClient | undefined;\n  if (!client || typeof client.serializeSessionState !== \"function\") {\n    return null;\n  }\n  if (established.sessionState === undefined || established.sessionState === null) {\n    return null;\n  }\n  try {\n    // serializeSessionState returns the PERSISTABLE FLAT provider state — for\n    // Modal `{ sandboxId, appName, imageTag, manifest(serialized),\n    // configuredExposedPorts, ... }` (sandboxId preserved via `...state`).\n    const serialized = await client.serializeSessionState(established.sessionState);\n\n    // deserializeSandboxSessionStateEnvelope expects the lease-envelope shape\n    // `{ providerState, manifest, snapshot?, exposedPorts?, workspaceReady }` and\n    // rehydrates `{ ...providerState, manifest, snapshot?, exposedPorts?,\n    // workspaceReady }`. So the FLAT serialized state must be nested under\n    // `providerState` (and manifest/ports lifted), or sandboxId is dropped on the\n    // round-trip and resume() throws \"requires a persisted sandboxId\". SDK-owned\n    // envelope fields are removed from providerState after lifting; providers can\n    // return live Manifest instances there, and deserialization overlays the\n    // authoritative manifest anyway. configuredExposedPorts is provider\n    // configuration/state, not the SDK's port-keyed endpoint record, so it must\n    // never be lifted.\n    const flat = serialized as Record<string, unknown>;\n    const backend = sandboxBackendForSdkBackendId(established.backendId) ?? established.backendId;\n    const serializedInstanceId = liveProviderInstanceIdFromState(backend, flat);\n    if (!serializedInstanceId || serializedInstanceId !== established.instanceId) {\n      return null;\n    }\n    const manifest = serializeSdkManifestForEnvelope(flat.manifest);\n    const exposedPorts = runStateExposedPortsRecord(flat.exposedPorts);\n    const sessionState: Record<string, unknown> = {\n      providerState: providerStateWithoutDuplicateManifest(flat),\n      ...(manifest !== undefined ? { manifest } : {}),\n      ...(exposedPorts !== undefined ? { exposedPorts } : {}),\n      workspaceReady: true,\n    };\n    return {\n      backendId: established.backendId,\n      [OPENGENI_SANDBOX_PROVIDER_INSTANCE_ID_FIELD]: established.instanceId,\n      sessionState,\n    };\n  } catch {\n    // A serialize failure must NOT fail the attach/op; we just lose warm-reattach\n    // for this box (it stays resumable-by-instance only via the next cold path).\n    return null;\n  }\n}\n\n/**\n * Whether a replacement envelope contains a provider-resumable identity. An\n * archive-only envelope is intentionally valid recovery metadata, but it is\n * never proof that the newly-created provider box can be resumed or attached.\n */\nexport function hasPersistableSandboxProviderIdentity(\n  envelope: Record<string, unknown> | null | undefined,\n  backend?: SandboxBackend | string,\n): envelope is Record<string, unknown> {\n  try {\n    const resolvedBackend =\n      backend ??\n      (typeof envelope?.backendId === \"string\"\n        ? (sandboxBackendForSdkBackendId(envelope.backendId) ?? envelope.backendId)\n        : undefined);\n    return resolvedBackend\n      ? assertConsistentSandboxProviderIdentity(resolvedBackend, envelope) !== null\n      : sandboxProviderInstanceIdFromEnvelope(envelope) !== null;\n  } catch {\n    return false;\n  }\n}\n\n/** A replacement provider may not be published warm without a resumable\n * identity. Archive-only state is retained only when the caller rolls back to\n * cold and needs the verified workspace bytes for the next attempt. */\nexport class SandboxReplacementProviderStateError extends Error {\n  readonly code = \"replacement_provider_state_unpersistable\" as const;\n\n  constructor(public readonly backend: string) {\n    super(\n      `sandbox backend \"${backend}\" replacement provider state could not be serialized; refusing to publish an attachable lease`,\n    );\n    this.name = \"SandboxReplacementProviderStateError\";\n  }\n}\n\nexport function requirePersistableReplacementSandboxEnvelope(\n  envelope: Record<string, unknown> | null,\n  backend: string,\n): Record<string, unknown> {\n  const providerInstanceId = assertConsistentSandboxProviderIdentity(backend, envelope);\n  if (!envelope || !providerInstanceId) {\n    throw new SandboxReplacementProviderStateError(backend);\n  }\n  return envelope;\n}\n\nconst DURABLE_WORKSPACE_ARCHIVE_FIELDS = [\n  \"workspaceArchive\",\n  \"workspaceArchiveMeta\",\n  \"workspaceArchiveRef\",\n  \"workspaceArchivePrev\",\n  \"workspaceArchivePrevMeta\",\n  \"workspaceArchivePrevRef\",\n  \"workspaceArchiveAt\",\n] as const;\n\nfunction durableWorkspaceArchiveFields(\n  envelope: Record<string, unknown> | null,\n): Record<string, unknown> | null {\n  const sessionState =\n    envelope?.sessionState && typeof envelope.sessionState === \"object\"\n      ? (envelope.sessionState as Record<string, unknown>)\n      : null;\n  if (!sessionState) return null;\n  const archiveRef = parseWorkspaceArchiveObjectRef(sessionState.workspaceArchiveRef);\n  const previousRef = parseWorkspaceArchiveObjectRef(sessionState.workspaceArchivePrevRef);\n  const hasInline =\n    typeof sessionState.workspaceArchive === \"string\" && sessionState.workspaceArchive.length > 0;\n  const hasPreviousInline =\n    typeof sessionState.workspaceArchivePrev === \"string\" &&\n    sessionState.workspaceArchivePrev.length > 0;\n  if (!hasInline && !archiveRef && !hasPreviousInline && !previousRef) {\n    return null;\n  }\n  const fields: Record<string, unknown> = {};\n  for (const key of DURABLE_WORKSPACE_ARCHIVE_FIELDS) {\n    if (sessionState[key] !== undefined && sessionState[key] !== null) {\n      fields[key] = sessionState[key];\n    }\n  }\n  return omitInlineWorkspaceArchiveWhenObjectRefPresent(fields);\n}\n\n/**\n * Build the only resume envelope that may be published for a newly-created\n * replacement sandbox. Historical state contributes durable archive pointers\n * only; it can never substitute for serialization of the replacement's provider\n * identity. If replacement serialization is unavailable or fails, publication\n * keeps an archive-only envelope (when one exists) or null. The new instance id\n * remains separately fenced on the lease, while later attach/resume fails closed\n * rather than targeting the dead provider that initiated rematerialization.\n */\nexport async function serializeReplacementSandboxEnvelope(\n  established: EstablishedSandboxSession,\n  archiveSource: Record<string, unknown> | null,\n): Promise<Record<string, unknown> | null> {\n  const serialized = await serializeEstablishedSandboxEnvelope(established);\n  const archiveFields = durableWorkspaceArchiveFields(archiveSource);\n  if (!serialized && !archiveFields) {\n    return null;\n  }\n  const serializedSessionState =\n    serialized?.sessionState && typeof serialized.sessionState === \"object\"\n      ? (serialized.sessionState as Record<string, unknown>)\n      : {};\n  const sessionState: Record<string, unknown> = {\n    ...serializedSessionState,\n    ...(archiveFields ?? {}),\n  };\n  // Spread cannot delete keys. Restore inlines that leaked into serialized\n  // replacement state must not survive a durable object-storage ref.\n  if (parseWorkspaceArchiveObjectRef(sessionState.workspaceArchiveRef)) {\n    delete sessionState.workspaceArchive;\n  }\n  if (parseWorkspaceArchiveObjectRef(sessionState.workspaceArchivePrevRef)) {\n    delete sessionState.workspaceArchivePrev;\n  }\n  return {\n    ...(serialized ?? {}),\n    // Never inherit a historical backend marker when the replacement could not\n    // serialize. The separately-persisted resume_backend_id and this envelope\n    // must both describe the replacement.\n    backendId: established.backendId,\n    sessionState,\n  };\n}\n","import { rmSync } from \"node:fs\";\nimport { lstat, mkdtemp, readdir, readFile, readlink, realpath, rm } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\n\n/**\n * Private host-archive spool directories are process-owned. In-process callers\n * dispose them on every success/failure path, but a worker that stops while a\n * capture, upload or restore is in flight (rolling deploy, SIGTERM drain, crash)\n * cannot run that cleanup, and each spool holds a whole workspace archive.\n *\n * The directory name therefore records its owner process identity: the PID\n * namespace, PID and kernel start time. A later process may remove a directory\n * only when that exact owner is provably gone: same PID namespace (PIDs from\n * another namespace are not comparable), and that PID either no longer exists or\n * now belongs to a different process start. Live owners, including concurrent\n * workers sharing one TMPDIR, are never touched. Unmarked legacy names are\n * never swept because their owner cannot be proven gone.\n *\n * The same ownership applies to the object-storage download spool\n * (`@opengeni/storage` `downloadWorkspaceArchiveSpool`), which cannot depend on\n * runtime and therefore receives `workspaceArchiveDownloadTemporaryDirectory`\n * from its callers.\n */\nexport const HOST_ARCHIVE_TEMPORARY_PREFIX = \"opengeni-host-archive-\";\nexport const WORKSPACE_ARCHIVE_DOWNLOAD_TEMPORARY_PREFIX = \"opengeni-workspace-archive-\";\nconst OWNER_MARKED_PREFIXES = [\n  HOST_ARCHIVE_TEMPORARY_PREFIX,\n  WORKSPACE_ARCHIVE_DOWNLOAD_TEMPORARY_PREFIX,\n] as const;\ntype OwnerMarkedPrefix = (typeof OWNER_MARKED_PREFIXES)[number];\n\nfunction ownedName(prefix: OwnerMarkedPrefix): RegExp {\n  return new RegExp(\"^\" + prefix + \"o(\\\\d+)\\\\.(\\\\d+)\\\\.(\\\\d+)-[A-Za-z0-9]{6}$\");\n}\nconst OWNED_NAMES = OWNER_MARKED_PREFIXES.map(ownedName);\n\ntype ProcessOwner = { namespace: string; pid: number; startTime: string };\n\nasync function processStartTime(pid: number | \"self\"): Promise<string | null> {\n  try {\n    const stat = await readFile(`/proc/${pid}/stat`, \"utf8\");\n    // The command name is parenthesized and may contain spaces or ')'.\n    const fields = stat.slice(stat.lastIndexOf(\")\") + 2).split(\" \");\n    // Field 22 (starttime) is the 20th field after \"pid (comm)\".\n    const startTime = fields[19];\n    return startTime && /^\\d+$/.test(startTime) ? startTime : null;\n  } catch {\n    return null;\n  }\n}\n\nasync function pidNamespace(): Promise<string | null> {\n  try {\n    return /^pid:\\[(\\d+)\\]$/.exec(await readlink(\"/proc/self/ns/pid\"))?.[1] ?? null;\n  } catch {\n    return null;\n  }\n}\n\nlet ownerIdentity: Promise<ProcessOwner | null> | undefined;\nfunction currentOwner(): Promise<ProcessOwner | null> {\n  return (ownerIdentity ??= (async () => {\n    const [namespace, startTime] = await Promise.all([pidNamespace(), processStartTime(\"self\")]);\n    return namespace && startTime ? { namespace, pid: process.pid, startTime } : null;\n  })());\n}\n\n/** Spool directories this process still owns; removed on normal process exit. */\nconst liveDirectories = new Set<string>();\nlet exitHookInstalled = false;\nfunction removeLiveDirectoriesOnExit() {\n  for (const directory of liveDirectories) {\n    try {\n      rmSync(directory, { recursive: true, force: true });\n    } catch {\n      // Exit cleanup is best effort; the next process's sweep reclaims it.\n    }\n  }\n  liveDirectories.clear();\n}\n\n/** Create a private owner-marked spool directory directly under `base`. */\nexport async function createHostArchiveTemporaryDirectory(\n  base: string,\n  kind: OwnerMarkedPrefix = HOST_ARCHIVE_TEMPORARY_PREFIX,\n): Promise<string> {\n  const owner = await currentOwner();\n  const prefix = owner ? `${kind}o${owner.namespace}.${owner.pid}.${owner.startTime}-` : kind;\n  const directory = await mkdtemp(join(base, prefix));\n  liveDirectories.add(directory);\n  if (!exitHookInstalled) {\n    exitHookInstalled = true;\n    process.once(\"exit\", removeLiveDirectoriesOnExit);\n  }\n  return directory;\n}\n\n/** Remove a spool directory created by this process. Idempotent. */\nexport async function removeHostArchiveTemporaryDirectory(directory: string): Promise<void> {\n  await rm(directory, { recursive: true, force: true });\n  liveDirectories.delete(directory);\n}\n\nasync function ownerIsGone(\n  current: ProcessOwner,\n  owner: { namespace: string; pid: number; startTime: string },\n): Promise<boolean> {\n  if (owner.namespace !== current.namespace) return false;\n  if (owner.pid === current.pid) return owner.startTime !== current.startTime;\n  if (!Number.isSafeInteger(owner.pid) || owner.pid < 1) return false;\n  const liveStartTime = await processStartTime(owner.pid);\n  return liveStartTime !== owner.startTime;\n}\n\n/**\n * Remove spool directories left behind by processes that no longer exist.\n * Returns the removed paths. Never throws: cleanup must not block startup or a\n * capture.\n */\nexport async function sweepOrphanedHostArchiveTemporaryDirectories(\n  bases: readonly string[] = hostArchiveTemporaryBases(),\n): Promise<string[]> {\n  const removed: string[] = [];\n  const current = await currentOwner();\n  const uid = typeof process.getuid === \"function\" ? process.getuid() : undefined;\n  if (!current || uid === undefined) return removed;\n  const seen = new Set<string>();\n  for (const candidate of bases) {\n    const base = await realpath(candidate).catch(() => null);\n    if (!base || seen.has(base)) continue;\n    seen.add(base);\n    const names = await readdir(base).catch(() => [] as string[]);\n    for (const name of names) {\n      const match = OWNED_NAMES.map((pattern) => pattern.exec(name)).find(Boolean);\n      if (!match) continue;\n      const owner = { namespace: match[1]!, pid: Number(match[2]), startTime: match[3]! };\n      try {\n        if (!(await ownerIsGone(current, owner))) continue;\n        const path = join(base, name);\n        const stats = await lstat(path);\n        if (!stats.isDirectory() || stats.uid !== uid) continue;\n        await rm(path, { recursive: true, force: true });\n        removed.push(path);\n      } catch {\n        // Another sweeper removed it, or it is not ours to inspect.\n      }\n    }\n  }\n  return removed;\n}\n\n/** The disk temporary locations `privateTemporaryDirectory` may choose. */\nexport function hostArchiveTemporaryBases(): string[] {\n  return [tmpdir(), \"/var/tmp\", \"/tmp\"];\n}\n\nlet processSweep: Promise<string[]> | undefined;\n/** Sweep once per process: at worker start and before the first spool or\n * download. Covers every owner-marked prefix. */\nexport function sweepOrphanedHostArchiveTemporaryDirectoriesOnce(): Promise<string[]> {\n  return (processSweep ??= sweepOrphanedHostArchiveTemporaryDirectories());\n}\n\n/** Owner-marked private directories for `downloadWorkspaceArchiveSpool`, so a\n * process killed mid-download leaves a directory a later process can prove\n * orphaned and reclaim. */\nexport const workspaceArchiveDownloadTemporaryDirectory = Object.freeze({\n  async create(): Promise<string> {\n    await sweepOrphanedHostArchiveTemporaryDirectoriesOnce();\n    return await createHostArchiveTemporaryDirectory(\n      tmpdir(),\n      WORKSPACE_ARCHIVE_DOWNLOAD_TEMPORARY_PREFIX,\n    );\n  },\n  remove: removeHostArchiveTemporaryDirectory,\n});\n","import { isDeepStrictEqual } from \"node:util\";\nimport { z } from \"zod\";\nimport { ModalRouterProviderCommand } from \"@opengeni/contracts\";\nimport type { ProviderCommandOutput } from \"../provider-command-session\";\nimport { decodePage } from \"./modal-legacy-command-control\";\nimport { MODAL_ROUTER_READ_PAGE_BYTES } from \"./modal-command-router-wire\";\n\nconst RawStream = z\n  .object({\n    bytes: z\n      .instanceof(Uint8Array)\n      .transform((bytes): Uint8Array<ArrayBufferLike> => bytes)\n      .refine(\n        (bytes) => bytes.byteLength <= MODAL_ROUTER_READ_PAGE_BYTES,\n        \"Raw page exceeded its bound\",\n      ),\n    eof: z.boolean(),\n  })\n  .strict();\nconst RawExit = z.discriminatedUnion(\"source\", [\n  z.object({ source: z.literal(\"router_poll\"), code: z.number().int().nullable() }).strict(),\n  z.object({ source: z.literal(\"retained_terminal\"), code: z.number().int() }).strict(),\n]);\nconst RawPage = z\n  .object({\n    protocol: z.literal(\"modal-router-raw-page-v1\"),\n    expected: ModalRouterProviderCommand,\n    command: ModalRouterProviderCommand,\n    streams: z.object({ stdout: RawStream, stderr: RawStream }).strict(),\n    exit: RawExit,\n  })\n  .strict();\n\n/** Bounded native RPC bytes and their exact cursor projection. The source tag\n * distinguishes a fresh poll from previously captured terminal evidence; it\n * does not authenticate an object supplied by a caller. No Start, custody,\n * database settlement or parent completion authority is conveyed. */\nexport type ModalRawOutputPage = z.infer<typeof RawPage>;\nexport type ModalRawOutputStreams = ModalRawOutputPage[\"streams\"];\nexport type ModalRawOutputExit = ModalRawOutputPage[\"exit\"];\ntype NativeOutput = ProviderCommandOutput & {\n  expected: ModalRouterProviderCommand;\n  command: ModalRouterProviderCommand;\n};\n\nfunction project(\n  expected: ModalRouterProviderCommand,\n  streams: ModalRawOutputStreams,\n  exit: ModalRawOutputExit,\n): NativeOutput {\n  const command = structuredClone(expected);\n  const chunks: ProviderCommandOutput[\"chunks\"] = [];\n  for (const stream of [\"stdout\", \"stderr\"] as const) {\n    const old = expected.streams[stream];\n    const page = streams[stream];\n    const decoded = decodePage(old.utf8Remainder, [page.bytes], page.eof);\n    const byteOffset = old.byteOffset + page.bytes.byteLength;\n    if (!Number.isSafeInteger(byteOffset)) throw new Error(\"Modal output offset exhausted\");\n    command.streams[stream] = {\n      byteOffset,\n      utf8Remainder: decoded.remainder,\n      eof: page.eof,\n      exitCode: page.eof ? exit.code : null,\n    };\n    if (decoded.text)\n      chunks.push({\n        stream,\n        chunkId: `modal-router:${expected.execId}:${stream}:${old.byteOffset}:${byteOffset}:${page.eof ? 1 : 0}`,\n        text: decoded.text,\n      });\n  }\n  return {\n    command,\n    expected: structuredClone(expected),\n    chunks,\n    exitCode: command.streams.stdout.eof && command.streams.stderr.eof ? exit.code : null,\n    providerExited: exit.code !== null,\n    streamFidelity: expected.pty ? \"merged\" : \"separate\",\n  };\n}\n\n/** Provider-private construction from joined read/poll replies. Keep the SDK\n * projection unchanged; this pure helper itself is not provider proof. */\nexport function collectModalRawOutputPage(\n  command: ModalRouterProviderCommand,\n  streams: ModalRawOutputStreams,\n  exit: ModalRawOutputExit,\n): { raw: ModalRawOutputPage; output: NativeOutput } {\n  const expected = structuredClone(command);\n  const captured = {\n    stdout: { bytes: Buffer.from(streams.stdout.bytes), eof: streams.stdout.eof },\n    stderr: { bytes: Buffer.from(streams.stderr.bytes), eof: streams.stderr.eof },\n  };\n  const output = project(expected, captured, exit);\n  return {\n    raw: {\n      protocol: \"modal-router-raw-page-v1\",\n      expected,\n      command: structuredClone(output.command),\n      streams: captured,\n      exit: { ...exit },\n    },\n    output,\n  };\n}\n\n/** Recompute decoded output from exact bytes, never caller-decoded text. The\n * current cursor must come from the caller's authoritative store. Equality\n * checks are not a database CAS; coherent bytes still need trusted acquisition\n * and atomic capture by the owner. */\nexport function reduceModalRawOutputPage(\n  input: ModalRawOutputPage,\n  current: ModalRouterProviderCommand,\n): NativeOutput {\n  const page = RawPage.parse(input);\n  const expected = ModalRouterProviderCommand.parse(current);\n  if (!isDeepStrictEqual(page.expected, expected))\n    throw new Error(\"Raw page does not match the current native cursor\");\n  for (const stream of [\"stdout\", \"stderr\"] as const) {\n    const old = expected.streams[stream];\n    const raw = page.streams[stream];\n    const remainder = Buffer.from(old.utf8Remainder, \"base64\");\n    if (\n      remainder.toString(\"base64\") !== old.utf8Remainder ||\n      remainder.length > 3 ||\n      remainder.length > old.byteOffset ||\n      (old.eof && remainder.length !== 0)\n    )\n      throw new Error(\"Raw page has an invalid saved UTF-8 remainder\");\n    if (old.eof && (!raw.eof || raw.bytes.byteLength !== 0))\n      throw new Error(\"Raw page reopened or advanced a completed stream\");\n    if (old.exitCode !== null && page.exit.code !== old.exitCode)\n      throw new Error(\"Raw page rewrote captured terminal evidence\");\n  }\n  if (\n    page.exit.source === \"retained_terminal\" &&\n    (!expected.streams.stdout.eof ||\n      !expected.streams.stderr.eof ||\n      expected.streams.stdout.exitCode !== page.exit.code ||\n      expected.streams.stderr.exitCode !== page.exit.code)\n  )\n    throw new Error(\"Raw page has no matching retained terminal evidence\");\n  const output = project(expected, page.streams, page.exit);\n  if (!isDeepStrictEqual(page.command, output.command))\n    throw new Error(\"Raw page cursor delta or remainder does not match its bytes\");\n  return output;\n}\n","import { posix } from \"node:path\";\nimport { ModalClient } from \"modal\";\nimport { ModalCommandStartOutcomeUnknownError } from \"./modal-command-start-errors\";\nimport { status } from \"@grpc/grpc-js\";\nimport { ModalCommandStartPreDispatchUnavailableError } from \"./modal-command-router-wire\";\nimport { ProviderCommandStartRejectedError } from \"../provider-command-session\";\nimport { ModalLegacyProviderCommand } from \"@opengeni/contracts\";\nimport type { ChannelAExecArgs } from \"../channel-a\";\nimport { modalCommandArgv } from \"./modal-command-argv\";\n\ntype ControlPlane = Pick<\n  ModalClient[\"cpClient\"],\n  | \"sandboxGetTaskId\"\n  | \"containerExec\"\n  | \"containerExecGetOutput\"\n  | \"containerExecPutInput\"\n  | \"taskGetCommandRouterAccess\"\n>;\n\ntype CommandClient = Pick<ModalClient, \"cpClient\" | \"version\"> &\n  Partial<Pick<ModalClient, \"profile\" | \"logger\">>;\ntype GrpcMiddleware = NonNullable<\n  NonNullable<ConstructorParameters<typeof ModalClient>[0]>[\"grpcMiddleware\"]\n>[number];\n/** This dedicated command client never retries a request behind the caller's\n * back and preserves the exact cancellation signal, including streaming RPCs. */\nexport const modalCommandAbortMiddleware: GrpcMiddleware = async function* (call, options) {\n  options.signal?.throwIfAborted();\n  return yield* call.next(call.request, options);\n};\n\n// Version-pinned compatibility boundary: 0.9.0's retryMiddleware drops signal\n// for streaming and retries=0. Its public custom middleware runs OUTSIDE that\n// branch, so cannot repair it. Override only this dedicated instance's factory\n// hook before construction; never mutate the SDK's global prototype or use\n// negative/fractional retry counts to manipulate its branch conditions.\ntype PublicModalClient = Pick<ModalClient, keyof ModalClient>;\nconst ModalClientBase: new (\n  options?: ConstructorParameters<typeof ModalClient>[0],\n) => PublicModalClient = ModalClient;\nclass ModalCommandClient extends ModalClientBase {\n  retryMiddleware(): GrpcMiddleware {\n    return modalCommandAbortMiddleware;\n  }\n}\nconst controlClients = new WeakMap<object, PublicModalClient>();\n\nexport function commandControlPlane(client: CommandClient): ControlPlane {\n  // Minimal injected control planes are used by deterministic unit tests.\n  // Production installation requires the authenticated SDK profile below.\n  if (!client.profile) return client.cpClient;\n  if (typeof Reflect.get(ModalClient.prototype, \"retryMiddleware\") !== \"function\")\n    throw new Error(\"Verified Modal command cancellation contract is unavailable\");\n  let controlled = controlClients.get(client);\n  if (!controlled) {\n    const profile = client.profile;\n    if (!profile.tokenId || !profile.tokenSecret)\n      throw new Error(\"Modal command control requires its original authenticated profile\");\n    controlled = new ModalCommandClient({\n      tokenId: profile.tokenId,\n      tokenSecret: profile.tokenSecret,\n      endpoint: profile.serverUrl,\n      environment: profile.environment ?? \"\",\n      ...(profile.maxThrottleWaitSecs !== undefined\n        ? { maxThrottleWaitSecs: profile.maxThrottleWaitSecs }\n        : {}),\n      ...(client.logger ? { logger: client.logger } : {}),\n    });\n    controlClients.set(client, controlled);\n  }\n  return controlled.cpClient;\n}\nexport type ModalCommandStream = \"stdout\" | \"stderr\";\nexport type ModalProviderCommand = ModalLegacyProviderCommand;\nexport type ModalProviderOutputPage = {\n  command: ModalProviderCommand;\n  chunks: Array<{ stream: ModalCommandStream; chunkId: string; text: string }>;\n  exitCode: number | null;\n  streamFidelity: \"separate\" | \"merged\";\n};\n\n// A provider batch may end halfway through a UTF-8 character. Keep only that\n// unfinished suffix in protected cursor state; invalid complete bytes still\n// use the usual replacement-character decoding policy.\nexport function decodePage(prior: string, input: Uint8Array[], terminal: boolean) {\n  const bytes = Buffer.concat([Buffer.from(prior, \"base64\"), ...input]);\n  let boundary = bytes.length;\n  if (!terminal) {\n    for (let start = Math.max(0, bytes.length - 3); start < bytes.length; start++) {\n      const first = bytes[start]!;\n      const width =\n        first >= 0xc2 && first <= 0xdf\n          ? 2\n          : first >= 0xe0 && first <= 0xef\n            ? 3\n            : first >= 0xf0 && first <= 0xf4\n              ? 4\n              : 0;\n      if (!width || bytes.length - start >= width) continue;\n      const suffix = bytes.subarray(start + 1);\n      if (!suffix.every((byte) => byte >= 0x80 && byte <= 0xbf)) continue;\n      const second = suffix[0];\n      if (\n        second !== undefined &&\n        ((first === 0xe0 && second < 0xa0) ||\n          (first === 0xed && second > 0x9f) ||\n          (first === 0xf0 && second < 0x90) ||\n          (first === 0xf4 && second > 0x8f))\n      )\n        continue;\n      boundary = start;\n      break;\n    }\n  }\n  return {\n    text: bytes.subarray(0, boundary).toString(\"utf8\"),\n    remainder: bytes.subarray(boundary).toString(\"base64\"),\n  };\n}\n\n/** Version-pinned Modal control-plane boundary. Execution identity, output\n * batches and exit status come from authenticated provider RPCs, never sandbox\n * files or an SDK object's in-memory process map. Callers must store the\n * returned locator/cursors outside the command's write authority. */\nexport class ModalCommandControl {\n  private constructor(\n    private readonly client: ControlPlane,\n    private readonly sandboxIdentity: string | (() => string),\n    private readonly root: string,\n    private readonly environment: Record<string, string> | (() => Record<string, string>) = {},\n  ) {}\n\n  static forSandbox(\n    client: CommandClient,\n    sandboxId: string | (() => string),\n    root: string,\n    environment: Record<string, string> | (() => Record<string, string>) = {},\n  ): ModalCommandControl {\n    if (client.version() !== \"0.9.0\")\n      throw new Error(\"Modal command control requires the verified 0.9.0 SDK contract\");\n    return new ModalCommandControl(commandControlPlane(client), sandboxId, root, environment);\n  }\n\n  private get sandboxId(): string {\n    return typeof this.sandboxIdentity === \"function\"\n      ? this.sandboxIdentity()\n      : this.sandboxIdentity;\n  }\n\n  async start(args: ChannelAExecArgs, signal?: AbortSignal): Promise<ModalProviderCommand> {\n    signal?.throwIfAborted();\n    const workdir = posix.resolve(this.root, args.workdir ?? this.root);\n    if (workdir !== this.root && !workdir.startsWith(`${this.root.replace(/\\/$/u, \"\")}/`))\n      throw new Error(\"Command workdir is outside the sandbox workspace\");\n    // Hydration replaces the SDK sandbox. Freeze its current identity for this\n    // start so an asynchronous replacement cannot relabel the returned locator.\n    const sandboxId = this.sandboxId;\n    const task = await ModalCommandStartPreDispatchUnavailableError.beforeDispatch(\n      () => this.client.sandboxGetTaskId({ sandboxId }, signal ? { signal } : undefined),\n      signal,\n    );\n    if (!task.taskId || task.taskResult) throw new Error(\"Modal command task is unavailable\");\n    if (sandboxId !== this.sandboxId)\n      throw new Error(\"Modal sandbox changed during command preparation\");\n    let command = modalCommandArgv(args);\n    const environment =\n      typeof this.environment === \"function\" ? this.environment() : this.environment;\n    if (Object.keys(environment).length) {\n      command = [\n        \"/usr/bin/env\",\n        \"--\",\n        ...Object.entries(environment).map(([key, value]) => `${key}=${value}`),\n        ...command,\n      ];\n    }\n    // Do not retry this mutating start on an ambiguous transport error: this\n    // provider API assigns the execution id in its response, not in our request.\n    const result = await this.client\n      .containerExec(\n        {\n          taskId: task.taskId,\n          command,\n          terminateContainerOnExit: false,\n          runtimeDebug: false,\n          stdoutOutput: 2,\n          stderrOutput: 2,\n          timeoutSecs: 0,\n          workdir,\n          secretIds: [],\n          ...(args.tty\n            ? {\n                ptyInfo: {\n                  enabled: true,\n                  winszRows: 24,\n                  winszCols: 80,\n                  envTerm: \"xterm\",\n                  envColorterm: \"\",\n                  envTermProgram: \"\",\n                  ptyType: 1,\n                  noTerminateOnIdleStdin: true,\n                },\n              }\n            : {}),\n        },\n        { retries: 0, ...(signal ? { signal } : {}) },\n      )\n      .catch((error: unknown) => {\n        const code = (error as { code?: unknown } | null)?.code;\n        if (\n          typeof code === \"number\" &&\n          [\n            status.INVALID_ARGUMENT,\n            status.NOT_FOUND,\n            status.PERMISSION_DENIED,\n            status.UNAUTHENTICATED,\n            status.UNIMPLEMENTED,\n          ].includes(code)\n        )\n          throw new ProviderCommandStartRejectedError(error);\n        // Legacy ContainerExec assigns its id in the lost response. There is no\n        // safe invocation locator and no authority to issue another launch.\n        throw new ModalCommandStartOutcomeUnknownError(task.taskId!, \"\", error);\n      });\n    if (!result.execId)\n      throw new ModalCommandStartOutcomeUnknownError(\n        task.taskId,\n        \"\",\n        new Error(\"Modal command start returned no execution identity\"),\n      );\n    return {\n      kind: \"modal-control-v1\",\n      sandboxId,\n      taskId: task.taskId,\n      execId: result.execId,\n      ...(args.tty ? { pty: true } : {}),\n      streams: {\n        stdout: { batchIndex: 0, utf8Remainder: \"\", exitCode: null },\n        stderr: { batchIndex: 0, utf8Remainder: \"\", exitCode: null },\n      },\n    };\n  }\n\n  async read(\n    command: ModalProviderCommand,\n    yieldTimeMs: number,\n    signal?: AbortSignal,\n  ): Promise<ModalProviderOutputPage> {\n    return this.readOutput(command, yieldTimeMs, signal);\n  }\n\n  /** Fixed internal probes own their cancellation controller and must drain\n   * both reads before relinquishing the surrounding provider-operation gate.\n   * Retained-command readers keep their existing signal/receipt contract.\n   */\n  async readProbe(\n    command: ModalProviderCommand,\n    yieldTimeMs: number,\n    cancellation: AbortController,\n  ): Promise<ModalProviderOutputPage> {\n    return this.readOutput(command, yieldTimeMs, cancellation.signal, (error) =>\n      cancellation.abort(error),\n    );\n  }\n\n  private async readOutput(\n    command: ModalProviderCommand,\n    yieldTimeMs: number,\n    signal?: AbortSignal,\n    cancelSiblings?: (error: unknown) => void,\n  ): Promise<ModalProviderOutputPage> {\n    signal?.throwIfAborted();\n    this.assertIdentity(command);\n    const next = structuredClone(command);\n    let failure: { error: unknown } | undefined;\n    const reads = ([\"stdout\", \"stderr\"] as const)\n      .map(async (stream) => {\n        const cursor = command.streams[stream];\n        if (cursor.exitCode !== null) return null;\n        const descriptor = stream === \"stdout\" ? 1 : 2;\n        for await (const batch of this.client.containerExecGetOutput(\n          {\n            execId: command.execId,\n            timeout: Math.max(0, yieldTimeMs) / 1000,\n            lastBatchIndex: cursor.batchIndex,\n            fileDescriptor: descriptor,\n            getRawBytes: true,\n          },\n          signal ? { signal } : undefined,\n        )) {\n          if (batch.batchIndex <= cursor.batchIndex) continue;\n          if (!Number.isSafeInteger(batch.batchIndex))\n            throw new Error(\"Invalid Modal output cursor\");\n          const terminal = batch.exitCode !== undefined;\n          if (terminal && !Number.isSafeInteger(batch.exitCode))\n            throw new Error(\"Invalid Modal exit status\");\n          const decoded = decodePage(\n            cursor.utf8Remainder,\n            batch.items\n              .filter((item) => item.fileDescriptor === descriptor)\n              .map((item) => item.messageBytes),\n            terminal,\n          );\n          next.streams[stream] = {\n            batchIndex: batch.batchIndex,\n            utf8Remainder: decoded.remainder,\n            exitCode: terminal ? batch.exitCode! : null,\n          };\n          return {\n            stream,\n            chunkId: `modal:${command.execId}:${stream}:${cursor.batchIndex}:${batch.batchIndex}`,\n            text: decoded.text,\n          };\n        }\n        return null;\n      })\n      .map((read) =>\n        !cancelSiblings\n          ? read\n          : read.catch((error: unknown) => {\n              // A logical read owns both output streams. Promise.all alone releases\n              // its caller on the first rejection while a sibling RPC may still be\n              // running. Cancel that sibling, retain the original error, and drain\n              // both reads before returning control to mutation/capture ownership.\n              failure ??= { error };\n              cancelSiblings(error);\n              throw error;\n            }),\n      );\n    const pages = cancelSiblings\n      ? await Promise.allSettled(reads).then((results) => {\n          if (failure) throw failure.error;\n          return results.map((result) => {\n            if (result.status === \"rejected\") throw result.reason;\n            return result.value;\n          });\n        })\n      : await Promise.all(reads);\n    const stdoutExit = next.streams.stdout.exitCode;\n    const stderrExit = next.streams.stderr.exitCode;\n    if (stdoutExit !== null && stderrExit !== null && stdoutExit !== stderrExit)\n      throw new Error(\"Modal output streams disagree about command exit status\");\n    return {\n      command: next,\n      streamFidelity: command.pty ? \"merged\" : \"separate\",\n      chunks: pages.filter((page): page is NonNullable<typeof page> => page !== null),\n      exitCode: stdoutExit !== null && stderrExit !== null ? stdoutExit : null,\n    };\n  }\n\n  async write(command: ModalProviderCommand, chars: string, messageIndex: number): Promise<void> {\n    this.assertIdentity(command);\n    if (!chars) return;\n    if (!Number.isSafeInteger(messageIndex) || messageIndex < 1)\n      throw new Error(\"Modal stdin requires a protected monotonic message index\");\n    await this.client.containerExecPutInput(\n      {\n        execId: command.execId,\n        input: { message: Buffer.from(chars), messageIndex, eof: false },\n      },\n      { retries: 0 },\n    );\n  }\n\n  private assertIdentity(command: ModalProviderCommand): void {\n    ModalLegacyProviderCommand.parse(command);\n    if (\n      command.kind !== \"modal-control-v1\" ||\n      command.sandboxId !== this.sandboxId ||\n      !command.taskId ||\n      !command.execId\n    )\n      throw new Error(\"Modal command locator does not match the original sandbox\");\n  }\n}\n","import type { ChannelAExecArgs } from \"../channel-a\";\n\n/** Keep the command payload once in argv. Embedding it in each run-as branch\n * multiplies large lifecycle scripts past the provider's aggregate limit. */\nexport function modalCommandArgv(args: ChannelAExecArgs): string[] {\n  const command = [\n    args.shell ?? \"/bin/sh\",\n    args.shell && (args.login ?? true) ? \"-lc\" : \"-c\",\n    args.cmd,\n  ];\n  if (!args.runAs) return command;\n  return [\n    \"/bin/sh\",\n    \"-c\",\n    'user=$1; shift; if [ \"$(id -u)\" = \"$user\" ] || [ \"$(id -un 2>/dev/null)\" = \"$user\" ]; then exec \"$@\"; elif [ \"$(id -u)\" = 0 ]; then exec su -s /bin/sh -c \\'exec \"$@\"\\' -- \"$user\" sh \"$@\"; else exec sudo -n -u \"$user\" -- \"$@\"; fi',\n    \"opengeni-run-as\",\n    args.runAs,\n    ...command,\n  ];\n}\n","import { createHash, type Hash } from \"node:crypto\";\nimport { constants, type BigIntStats } from \"node:fs\";\nimport {\n  lstat,\n  mkdir,\n  open,\n  readdir,\n  realpath,\n  rmdir,\n  unlink,\n  type FileHandle,\n} from \"node:fs/promises\";\nimport { isAbsolute, join, relative, resolve, sep } from \"node:path\";\nimport type { WorkspaceTreeFingerprint } from \"@opengeni/contracts\";\nimport type { WorkspaceArchiveSpool } from \"./archive-spool\";\nimport {\n  WorkspaceArchiveIntegrityError,\n  workspaceContentManifest,\n  type WorkspaceContentEntry,\n  type WorkspaceContentManifest,\n} from \"./workspace-archive\";\nimport {\n  createHostArchiveTemporaryDirectory,\n  hostArchiveTemporaryBases,\n  removeHostArchiveTemporaryDirectory,\n  sweepOrphanedHostArchiveTemporaryDirectoriesOnce,\n} from \"./host-archive-temporary\";\n\nconst CHUNK_BYTES = 64 * 1024;\n// Filesystem representability, not an archive resource quota. Check component\n// UTF-8 bytes before clearing a destination, not after open/mkdir fails.\nconst HOST_FILENAME_BYTES = 255;\nconst PROJECTION = \"sdk_local_archive_v1\" as const;\nconst READ = constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK;\nconst READ_DIRECTORY = READ | constants.O_DIRECTORY;\nconst CREATE = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW;\n\n/** Matches SDK 0.14.3 resolveSandboxArchiveLimits: absent/null means unlimited;\n * an explicit object fills undefined fields with SDK defaults, null disables a field.\n * chunkBytes controls buffering, never the amount of input accepted. */\nexport type HostWorkspaceArchiveOptions = {\n  chunkBytes?: number;\n  archiveLimits?: {\n    maxInputBytes?: number | null;\n    maxExtractedBytes?: number | null;\n    maxMembers?: number | null;\n  } | null;\n};\n\nfunction invalid(message: string): never {\n  throw new WorkspaceArchiveIntegrityError(\"archive_hydration_failed\", message);\n}\n\nfunction changed(cause?: unknown): never {\n  throw new WorkspaceArchiveIntegrityError(\n    \"workspace_changed_during_capture\",\n    \"host workspace changed during archive observation\",\n    { retryable: true, cause },\n  );\n}\n\nfunction captureError(error: unknown): never {\n  if (error instanceof WorkspaceArchiveIntegrityError) throw error;\n  const code = (error as NodeJS.ErrnoException | null)?.code;\n  if (code === \"ENOENT\" || code === \"ELOOP\" || code === \"ENOTDIR\") return changed(error);\n  // Disk exhaustion, permission failures and other operational errors are not\n  // evidence of a changing tree and must not become a retryable race diagnosis.\n  throw error;\n}\n\nfunction chunkSize(options: HostWorkspaceArchiveOptions): number {\n  const size = options.chunkBytes ?? CHUNK_BYTES;\n  if (!Number.isSafeInteger(size) || size < 1 || size > CHUNK_BYTES) {\n    throw new RangeError(`chunkBytes must be between 1 and ${CHUNK_BYTES}`);\n  }\n  return size;\n}\n\nfunction limitsFor(options: HostWorkspaceArchiveOptions) {\n  if (options.archiveLimits == null) return null;\n  const defaults = {\n    maxInputBytes: 1024 ** 3,\n    maxExtractedBytes: 4 * 1024 ** 3,\n    maxMembers: 100_000,\n  };\n  const limits = { ...defaults, ...options.archiveLimits };\n  for (const key of Object.keys(defaults) as Array<keyof typeof defaults>) {\n    if (limits[key] === undefined) limits[key] = defaults[key];\n    const value = limits[key];\n    if (value != null && (!Number.isSafeInteger(value) || value < 1)) {\n      throw new RangeError(`archiveLimits.${key} must be at least 1`);\n    }\n  }\n  return limits;\n}\n\nfunction checkLimit(actual: number, limit: number | null | undefined, label: string) {\n  if (!Number.isSafeInteger(actual)) invalid(`${label} exceeds the supported integer range`);\n  if (limit != null && actual > limit)\n    invalid(`workspace archive ${label} exceeds configured limit`);\n}\n\nfunction sameEntry(a: BigIntStats, b: BigIntStats) {\n  return a.dev === b.dev && a.ino === b.ino && a.mode === b.mode;\n}\n\nfunction sameVersion(a: BigIntStats, b: BigIntStats) {\n  return sameEntry(a, b) && a.size === b.size && a.mtimeNs === b.mtimeNs && a.ctimeNs === b.ctimeNs;\n}\n\nfunction fdPath(handle: FileHandle, name?: string) {\n  return name === undefined ? `/proc/self/fd/${handle.fd}` : `/proc/self/fd/${handle.fd}/${name}`;\n}\n\n/** Node has no openat API. Linux's descriptor namespace supplies the same pinned\n * parent resolution; O_NOFOLLOW applies to the child, never an untrusted ancestor.\n * Do not replace this with lstat(path) followed by open(path): that races. */\nexport type HostWorkspaceRootIdentity = Readonly<{\n  dev: string;\n  ino: string;\n  uid: string;\n  gid: string;\n  mode: string;\n}>;\n\nfunction rootIdentity(stats: BigIntStats): HostWorkspaceRootIdentity {\n  return Object.freeze({\n    dev: String(stats.dev),\n    ino: String(stats.ino),\n    uid: String(stats.uid),\n    gid: String(stats.gid),\n    mode: String(stats.mode),\n  });\n}\n\nasync function openRoot(\n  root: string,\n  create = false,\n  expected?: HostWorkspaceRootIdentity,\n): Promise<FileHandle> {\n  if (process.platform !== \"linux\")\n    invalid(\"host archive codec requires Linux descriptor-relative filesystem access\");\n  if (!isAbsolute(root)) invalid(\"host workspace root must be absolute\");\n  const absolute = resolve(root);\n  if (create && absolute === sep) invalid(\"cannot restore into the filesystem root\");\n  let current = await open(sep, READ_DIRECTORY);\n  try {\n    for (const segment of absolute.split(sep).filter(Boolean)) {\n      if (create) {\n        await mkdir(fdPath(current, segment), { mode: 0o777 }).catch(\n          (error: NodeJS.ErrnoException) => {\n            if (error.code !== \"EEXIST\") throw error;\n          },\n        );\n      }\n      const next = await open(fdPath(current, segment), READ_DIRECTORY);\n      await current.close();\n      current = next;\n    }\n    if (expected) {\n      const actual = rootIdentity(await current.stat({ bigint: true }));\n      if (\n        Object.keys(actual).some(\n          (key) =>\n            actual[key as keyof HostWorkspaceRootIdentity] !==\n            expected[key as keyof HostWorkspaceRootIdentity],\n        )\n      )\n        invalid(\"owned workspace root identity changed\");\n    }\n    return current;\n  } catch (error) {\n    await current.close();\n    throw error;\n  }\n}\n\n/** Metadata only. Content readers repeat this identity comparison on their\n * opened directory descriptor before inventory or file reads. */\nexport async function readHostWorkspaceRootIdentity(\n  root: string,\n  expected?: HostWorkspaceRootIdentity,\n): Promise<HostWorkspaceRootIdentity> {\n  if (process.platform !== \"linux\") {\n    if (!isAbsolute(root) || resolve(root) !== root || (await realpath(root)) !== root)\n      invalid(\"owned workspace root is not canonical\");\n    const handle = await open(root, READ_DIRECTORY);\n    try {\n      const stats = await handle.stat({ bigint: true });\n      if (!stats.isDirectory()) invalid(\"owned workspace root is not a directory\");\n      const actual = rootIdentity(stats);\n      if (\n        expected &&\n        Object.keys(actual).some(\n          (key) =>\n            actual[key as keyof HostWorkspaceRootIdentity] !==\n            expected[key as keyof HostWorkspaceRootIdentity],\n        )\n      )\n        invalid(\"owned workspace root identity changed\");\n      return actual;\n    } finally {\n      await handle.close();\n    }\n  }\n  const handle = await openRoot(root, false, expected);\n  try {\n    return rootIdentity(await handle.stat({ bigint: true }));\n  } finally {\n    await handle.close();\n  }\n}\n\ntype TreeIndex = {\n  directories: Map<string, BigIntStats>;\n  files: Map<string, BigIntStats>;\n};\n\nconst compare = (a: string, b: string) => (a < b ? -1 : a > b ? 1 : 0);\n\nasync function inventory(\n  root: FileHandle,\n  excludedPaths: readonly string[],\n  signal?: AbortSignal,\n): Promise<TreeIndex> {\n  const tree: TreeIndex = { directories: new Map(), files: new Map() };\n  const walk = async (handle: FileHandle, logical: string) => {\n    const before = await handle.stat({ bigint: true });\n    tree.directories.set(logical, before);\n    const names = await readdir(fdPath(handle));\n    for (const name of names) {\n      signal?.throwIfAborted();\n      const path = logical ? `${logical}/${name}` : name;\n      if (\n        excludedPaths.some(\n          (excluded) => excluded === \"\" || path === excluded || path.startsWith(`${excluded}/`),\n        )\n      )\n        continue;\n      const stats = await lstat(fdPath(handle, name), { bigint: true });\n      if (stats.isDirectory()) {\n        const child = await open(fdPath(handle, name), READ_DIRECTORY);\n        try {\n          if (!sameVersion(stats, await child.stat({ bigint: true }))) changed();\n          await walk(child, path);\n          if (!sameVersion(stats, await lstat(fdPath(handle, name), { bigint: true }))) changed();\n        } finally {\n          await child.close();\n        }\n      } else if (stats.isFile()) {\n        tree.files.set(path, stats);\n      }\n      // Exactly the SDK projection: symlinks, FIFOs, sockets and devices are skipped.\n    }\n    if (!sameVersion(before, await handle.stat({ bigint: true }))) changed();\n  };\n  await walk(root, \"\");\n  return tree;\n}\n\nasync function openDirectory(root: FileHandle, logical: string, tree?: TreeIndex, create = false) {\n  let current = await open(fdPath(root), READ_DIRECTORY & ~constants.O_NOFOLLOW);\n  try {\n    if (tree && !sameVersion(tree.directories.get(\"\")!, await current.stat({ bigint: true })))\n      changed();\n    let path = \"\";\n    for (const segment of logical.split(\"/\").filter(Boolean)) {\n      path = path ? `${path}/${segment}` : segment;\n      if (create) {\n        await mkdir(fdPath(current, segment), { mode: 0o777 }).catch(\n          (error: NodeJS.ErrnoException) => {\n            if (error.code !== \"EEXIST\") throw error;\n          },\n        );\n      }\n      const next = await open(fdPath(current, segment), READ_DIRECTORY);\n      await current.close();\n      current = next;\n      if (tree) {\n        const expected = tree.directories.get(path);\n        if (!expected || !sameVersion(expected, await current.stat({ bigint: true }))) changed();\n      }\n    }\n    return current;\n  } catch (error) {\n    await current.close();\n    throw error;\n  }\n}\n\nfunction parentAndName(path: string): [string, string] {\n  const slash = path.lastIndexOf(\"/\");\n  return slash < 0 ? [\"\", path] : [path.slice(0, slash), path.slice(slash + 1)];\n}\n\nasync function readTreeFile(\n  root: FileHandle,\n  tree: TreeIndex,\n  path: string,\n  consume: (bytes: Buffer) => void | Promise<void>,\n  signal?: AbortSignal,\n) {\n  const [parent, name] = parentAndName(path);\n  const directory = await openDirectory(root, parent, tree);\n  try {\n    const expected = tree.files.get(path)!;\n    const handle = await open(fdPath(directory, name), READ);\n    try {\n      if (!sameVersion(expected, await handle.stat({ bigint: true }))) changed();\n      const size = Number(expected.size);\n      checkLimit(size, null, \"file size\");\n      const buffer = Buffer.allocUnsafe(CHUNK_BYTES);\n      let offset = 0;\n      while (offset < size) {\n        signal?.throwIfAborted();\n        const { bytesRead } = await handle.read(\n          buffer,\n          0,\n          Math.min(buffer.length, size - offset),\n          offset,\n        );\n        if (bytesRead === 0) changed();\n        await consume(buffer.subarray(0, bytesRead));\n        offset += bytesRead;\n      }\n      if (\n        !sameVersion(expected, await handle.stat({ bigint: true })) ||\n        !sameVersion(expected, await lstat(fdPath(directory, name), { bigint: true }))\n      )\n        changed();\n    } finally {\n      await handle.close();\n    }\n  } finally {\n    await directory.close();\n  }\n}\n\nfunction frame(hash: Hash, label: string, value: string) {\n  hash\n    .update(label)\n    .update(\"\\0\")\n    .update(String(Buffer.byteLength(value)))\n    .update(\"\\0\")\n    .update(value)\n    .update(\"\\0\");\n}\n\nfunction projection(directories: readonly string[]) {\n  const hash = createHash(\"sha256\");\n  frame(hash, \"projection\", PROJECTION);\n  for (const path of [...directories].sort(compare)) frame(hash, \"dir\", path);\n  return hash;\n}\n\nfunction fingerprint(\n  hash: Hash,\n  directories: number,\n  files: number,\n  totalFileBytes: number,\n): WorkspaceTreeFingerprint {\n  checkLimit(totalFileBytes, null, \"extracted size\");\n  return {\n    algorithm: \"sha256\",\n    sha256: hash.digest(\"hex\"),\n    entryCount: directories + files,\n    fileCount: files,\n    totalFileBytes,\n    projection: PROJECTION,\n  };\n}\n\nasync function verifyInventory(\n  rootPath: string,\n  root: FileHandle,\n  tree: TreeIndex,\n  signal?: AbortSignal,\n) {\n  const fresh = await openRoot(rootPath);\n  try {\n    if (!sameVersion(tree.directories.get(\"\")!, await fresh.stat({ bigint: true }))) changed();\n  } finally {\n    await fresh.close();\n  }\n  for (const path of tree.directories.keys()) {\n    signal?.throwIfAborted();\n    const handle = await openDirectory(root, path, tree);\n    await handle.close();\n  }\n  for (const [path, expected] of tree.files) {\n    signal?.throwIfAborted();\n    const [parent, name] = parentAndName(path);\n    const handle = await openDirectory(root, parent, tree);\n    try {\n      if (!sameVersion(expected, await lstat(fdPath(handle, name), { bigint: true }))) changed();\n    } finally {\n      await handle.close();\n    }\n  }\n}\n\nasync function hashTree(rootPath: string, root: FileHandle, tree: TreeIndex, signal?: AbortSignal) {\n  const directories = [...tree.directories.keys()].filter(Boolean);\n  const hash = projection(directories);\n  let total = 0;\n  for (const path of [...tree.files.keys()].sort(compare)) {\n    const size = Number(tree.files.get(path)!.size);\n    frame(hash, \"file\", path);\n    frame(hash, \"bytes\", String(size));\n    signal?.throwIfAborted();\n    await readTreeFile(\n      root,\n      tree,\n      path,\n      (bytes) => {\n        hash.update(bytes);\n      },\n      signal,\n    );\n    total += size;\n  }\n  await verifyInventory(rootPath, root, tree, signal);\n  return fingerprint(hash, directories.length, tree.files.size, total);\n}\n\nexport async function fingerprintHostWorkspace(\n  root: string,\n  excludedPaths: readonly string[],\n  expectedRoot?: HostWorkspaceRootIdentity,\n): Promise<WorkspaceTreeFingerprint> {\n  const handle = await openRoot(root, false, expectedRoot);\n  try {\n    return await hashTree(root, handle, await inventory(handle, excludedPaths));\n  } catch (error) {\n    return captureError(error);\n  } finally {\n    await handle.close();\n  }\n}\n\nfunction within(root: string, candidate: string) {\n  const path = relative(root, candidate);\n  return path === \"\" || (!isAbsolute(path) && path !== \"..\" && !path.startsWith(`..${sep}`));\n}\n\nasync function privateTemporaryDirectory(root: string | null) {\n  // Resolve the actual location before creating anything: TMPDIR can itself be a\n  // symlink or live inside the source workspace. Never add spool files to it.\n  const actualRoot = root === null ? null : await realpath(root).catch(() => resolve(root));\n  // Reclaim spools whose owner process stopped mid-capture/upload/restore\n  // before adding another multi-gigabyte one. Never removes a live owner's.\n  await sweepOrphanedHostArchiveTemporaryDirectoriesOnce();\n  for (const candidate of hostArchiveTemporaryBases()) {\n    const base = await realpath(candidate).catch(() => null);\n    if (!base || (actualRoot !== null && within(actualRoot, base)) || within(\"/dev/shm\", base))\n      continue;\n    return await createHostArchiveTemporaryDirectory(base);\n  }\n  invalid(\"no private disk temporary directory exists outside the workspace\");\n}\n\nasync function writeAll(handle: FileHandle, bytes: Uint8Array) {\n  let offset = 0;\n  while (offset < bytes.byteLength) {\n    const { bytesWritten } = await handle.write(bytes, offset, bytes.byteLength - offset);\n    if (!bytesWritten) throw new Error(\"archive spool write made no progress\");\n    offset += bytesWritten;\n  }\n}\n\nclass ArchiveWriter {\n  readonly hash = createHash(\"sha256\");\n  byteSize = 0;\n  constructor(readonly handle: FileHandle) {}\n  async write(input: string | Uint8Array) {\n    const bytes = typeof input === \"string\" ? Buffer.from(input) : input;\n    for (let offset = 0; offset < bytes.length; offset += CHUNK_BYTES) {\n      const chunk = bytes.subarray(offset, offset + CHUNK_BYTES);\n      await writeAll(this.handle, chunk);\n      this.hash.update(chunk);\n      this.byteSize += chunk.length;\n      checkLimit(this.byteSize, null, \"input size\");\n    }\n  }\n}\n\n/** Native base64 conversion remains bounded to a chunk; both binary backing\n * stores are reused. In particular, never Buffer.concat the carry with every\n * source chunk or Buffer.from every encoded string: external-memory GC can lag\n * far behind those allocations even though no individual buffer is large. */\nclass Base64Encoder {\n  private readonly input = Buffer.allocUnsafe(CHUNK_BYTES + 2);\n  private readonly output = Buffer.allocUnsafe(Math.ceil((CHUNK_BYTES + 2) / 3) * 4);\n  private carry = 0;\n  constructor(private readonly writer: ArchiveWriter) {}\n  async write(bytes: Buffer) {\n    bytes.copy(this.input, this.carry);\n    const available = this.carry + bytes.length;\n    const length = available - (available % 3);\n    if (length) await this.encode(length);\n    this.carry = available - length;\n    this.input.copy(this.input, 0, length, available);\n  }\n  private async encode(length: number) {\n    const written = this.output.write(this.input.subarray(0, length).toString(\"base64\"), \"ascii\");\n    await this.writer.write(this.output.subarray(0, written));\n  }\n  async finish() {\n    if (this.carry) await this.encode(this.carry);\n  }\n}\n\nfunction ownedSpool(\n  directory: string,\n  path: string,\n  byteSize: number,\n  sha256: string,\n): WorkspaceArchiveSpool {\n  let disposal: Promise<void> | undefined;\n  return {\n    path,\n    byteSize,\n    sha256,\n    async *open() {\n      if (disposal) throw new Error(\"archive spool has been disposed\");\n      const handle = await open(path, READ);\n      try {\n        const before = await handle.stat({ bigint: true });\n        if (!before.isFile() || Number(before.size) !== byteSize) invalid(\"archive spool changed\");\n        let position = 0;\n        while (position < byteSize) {\n          const buffer = Buffer.allocUnsafe(Math.min(CHUNK_BYTES, byteSize - position));\n          const { bytesRead } = await handle.read(buffer, 0, buffer.length, position);\n          if (!bytesRead) invalid(\"archive spool was truncated\");\n          position += bytesRead;\n          yield buffer.subarray(0, bytesRead);\n        }\n        if (!sameVersion(before, await handle.stat({ bigint: true })))\n          invalid(\"archive spool changed while reading\");\n      } finally {\n        await handle.close();\n      }\n    },\n    dispose() {\n      return (disposal ??= removeHostArchiveTemporaryDirectory(directory));\n    },\n  };\n}\n\n/**\n * An aborted `signal` stops the capture at the next file chunk, removes its\n * temporary spool and rejects with the signal's reason. Every read is local\n * and owned here, so the rejection is the physical end of the capture: callers\n * may treat it as settled.\n */\nexport async function captureHostWorkspaceArchive(\n  root: string,\n  excludedPaths: readonly string[],\n  expectedRoot?: HostWorkspaceRootIdentity,\n  signal?: AbortSignal,\n): Promise<{\n  spool: WorkspaceArchiveSpool;\n  workspace: WorkspaceTreeFingerprint;\n}> {\n  signal?.throwIfAborted();\n  const handle = await openRoot(root, false, expectedRoot);\n  let temporary: string | undefined;\n  let handleClosed = false;\n  try {\n    const tree = await inventory(handle, excludedPaths, signal);\n    const before = await hashTree(root, handle, tree, signal);\n    temporary = await privateTemporaryDirectory(root);\n    const path = join(temporary, \"archive.json\");\n    const file = await open(path, CREATE, 0o600);\n    const writer = new ArchiveWriter(file);\n    const directories = [...tree.directories.keys()].filter(Boolean).sort(compare);\n    const hash = projection(directories);\n    let total = 0;\n    try {\n      await writer.write('{\"version\":1,\"directories\":[');\n      for (let index = 0; index < directories.length; index++) {\n        await writer.write(`${index ? \",\" : \"\"}${JSON.stringify(directories[index])}`);\n      }\n      await writer.write('],\"files\":[');\n      let first = true;\n      for (const logical of [...tree.files.keys()].sort(compare)) {\n        const size = Number(tree.files.get(logical)!.size);\n        frame(hash, \"file\", logical);\n        frame(hash, \"bytes\", String(size));\n        await writer.write(`${first ? \"\" : \",\"}{\"path\":${JSON.stringify(logical)},\"data\":\"`);\n        first = false;\n        const encoder = new Base64Encoder(writer);\n        await readTreeFile(\n          handle,\n          tree,\n          logical,\n          async (bytes) => {\n            hash.update(bytes);\n            await encoder.write(bytes);\n          },\n          signal,\n        );\n        await encoder.finish();\n        await writer.write('\"}');\n        total += size;\n      }\n      await writer.write(\"]}\");\n    } finally {\n      await file.close();\n    }\n    const archived = fingerprint(hash, directories.length, tree.files.size, total);\n    // Prove equivalence of the serialized bytes themselves, not just of the\n    // source chunks passed to the base64 encoder.\n    const encoded = await open(path, READ);\n    const payloadPath = join(temporary, \"capture-payload\");\n    let decoded: WorkspaceTreeFingerprint;\n    try {\n      const payload = await open(\n        payloadPath,\n        constants.O_RDWR | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW,\n        0o600,\n      );\n      try {\n        signal?.throwIfAborted();\n        const index = await indexArchive(encoded, payload, {}, signal);\n        signal?.throwIfAborted();\n        decoded = await fingerprintArchiveIndex(index, payload, signal);\n      } finally {\n        await payload.close();\n      }\n    } finally {\n      await encoded.close();\n    }\n    await unlink(payloadPath);\n    signal?.throwIfAborted();\n    await verifyInventory(root, handle, tree, signal);\n    const after = await hashTree(\n      root,\n      handle,\n      await inventory(handle, excludedPaths, signal),\n      signal,\n    );\n    if (\n      before.sha256 !== archived.sha256 ||\n      after.sha256 !== archived.sha256 ||\n      decoded.sha256 !== archived.sha256\n    )\n      changed();\n    // Close before handing over ownership: a close failure after the transfer\n    // would reject without giving the caller the spool it must dispose.\n    handleClosed = true;\n    await handle.close();\n    const spool = ownedSpool(temporary, path, writer.byteSize, writer.hash.digest(\"hex\"));\n    temporary = undefined;\n    return { spool, workspace: archived };\n  } catch (error) {\n    return captureError(error);\n  } finally {\n    try {\n      if (!handleClosed) await handle.close();\n    } finally {\n      if (temporary) await removeHostArchiveTemporaryDirectory(temporary);\n    }\n  }\n}\n\n/** Byte-oriented JSON lexer. Only metadata strings are accumulated. String\n * payloads are decoded in bounded runs, including JSON escapes and split UTF-8. */\nclass JsonReader {\n  private readonly buffer: Buffer;\n  private cursor = 0;\n  private available = 0;\n  private position = 0;\n  constructor(\n    private readonly handle: FileHandle,\n    size: number,\n    private readonly signal?: AbortSignal,\n  ) {\n    this.buffer = Buffer.allocUnsafe(size);\n  }\n  private async fill() {\n    if (this.cursor < this.available) return true;\n    // Re-reading a multi-gigabyte capture is not instantaneous: stop at the\n    // next chunk like every other capture pass.\n    this.signal?.throwIfAborted();\n    const { bytesRead } = await this.handle.read(this.buffer, 0, this.buffer.length, this.position);\n    this.position += bytesRead;\n    this.cursor = 0;\n    this.available = bytesRead;\n    return bytesRead !== 0;\n  }\n  async peek(): Promise<number> {\n    return (await this.fill()) ? this.buffer[this.cursor]! : -1;\n  }\n  async byte(): Promise<number> {\n    const byte = await this.peek();\n    if (byte === -1) invalid(\"truncated workspace archive JSON\");\n    this.cursor++;\n    return byte;\n  }\n  async whitespace() {\n    while (true) {\n      const byte = await this.peek();\n      if (byte !== 32 && byte !== 9 && byte !== 10 && byte !== 13) return;\n      this.cursor++;\n    }\n  }\n  async expect(character: string) {\n    await this.whitespace();\n    if ((await this.byte()) !== character.charCodeAt(0))\n      invalid(`expected ${character} in workspace archive JSON`);\n  }\n  async string(consume?: Base64Decoder): Promise<string> {\n    await this.expect('\"');\n    const parts: string[] = [];\n    const decoder = consume\n      ? undefined\n      : new TextDecoder(\"utf-8\", { fatal: true, ignoreBOM: true });\n    const emit = async (text: string) => {\n      if (!text) return;\n      if (consume) await consume.write(text);\n      else parts.push(text);\n    };\n    while (await this.fill()) {\n      const start = this.cursor;\n      while (this.cursor < this.available) {\n        const byte = this.buffer[this.cursor]!;\n        if (byte === 34 || byte === 92 || byte < 32) break;\n        this.cursor++;\n      }\n      if (this.cursor > start) {\n        const bytes = this.buffer.subarray(start, this.cursor);\n        // Base64's alphabet is ASCII. Its decoder validates these bytes directly,\n        // so payload runs never become UTF-8/base64 strings or fresh buffers.\n        if (consume) await consume.write(bytes);\n        else await emit(decoder!.decode(bytes, { stream: true }));\n      }\n      if (this.cursor === this.available) continue;\n      if (decoder) await emit(decoder.decode());\n      const special = await this.byte();\n      if (special === 34) return parts.join(\"\");\n      if (special !== 92) invalid(\"unescaped control character in workspace archive JSON\");\n      const escape = String.fromCharCode(await this.byte());\n      if (escape === \"u\") {\n        let digits = \"\";\n        for (let index = 0; index < 4; index++) digits += String.fromCharCode(await this.byte());\n        if (!/^[0-9a-fA-F]{4}$/.test(digits)) invalid(\"invalid JSON Unicode escape\");\n        await emit(String.fromCharCode(Number.parseInt(digits, 16)));\n      } else {\n        const escapes: Record<string, string> = {\n          '\"': '\"',\n          \"\\\\\": \"\\\\\",\n          \"/\": \"/\",\n          b: \"\\b\",\n          f: \"\\f\",\n          n: \"\\n\",\n          r: \"\\r\",\n          t: \"\\t\",\n        };\n        if (!Object.hasOwn(escapes, escape)) invalid(\"invalid JSON escape\");\n        await emit(escapes[escape]!);\n      }\n    }\n    invalid(\"unterminated workspace archive JSON string\");\n  }\n  async array(item: () => Promise<void>) {\n    await this.expect(\"[\");\n    await this.whitespace();\n    if ((await this.peek()) === 93) {\n      await this.byte();\n      return;\n    }\n    while (true) {\n      await item();\n      await this.whitespace();\n      const separator = await this.byte();\n      if (separator === 93) return;\n      if (separator !== 44) invalid(\"invalid workspace archive JSON array\");\n    }\n  }\n  async object(field: (key: string) => Promise<void>) {\n    await this.expect(\"{\");\n    const keys = new Set<string>();\n    await this.whitespace();\n    if ((await this.peek()) === 125) {\n      await this.byte();\n      return keys;\n    }\n    while (true) {\n      const key = await this.string();\n      if (keys.has(key)) invalid(\"duplicate workspace archive JSON property\");\n      keys.add(key);\n      await this.expect(\":\");\n      await field(key);\n      await this.whitespace();\n      const separator = await this.byte();\n      if (separator === 125) return keys;\n      if (separator !== 44) invalid(\"invalid workspace archive JSON object\");\n    }\n  }\n  async version() {\n    await this.whitespace();\n    // Recognize the exact numeric value 1 without accumulating a potentially\n    // archive-sized number token (1, 1.0, 0.1e1, 100e-2, etc.).\n    let digits = 0;\n    let integerDigits = 0;\n    let significant = -1;\n    let valid = true;\n    const isDigit = (byte: number) => byte >= 48 && byte <= 57;\n    const mantissaDigit = (byte: number) => {\n      if (byte !== 48) {\n        if (byte !== 49 || significant !== -1) valid = false;\n        if (significant === -1) significant = digits;\n      }\n      digits++;\n    };\n    if ((await this.peek()) === 45) {\n      valid = false;\n      await this.byte();\n    }\n    const first = await this.byte();\n    if (!isDigit(first)) invalid(\"invalid workspace archive version number\");\n    mantissaDigit(first);\n    integerDigits++;\n    if (first !== 48) {\n      while (isDigit(await this.peek())) {\n        mantissaDigit(await this.byte());\n        integerDigits++;\n      }\n    } else if (isDigit(await this.peek())) invalid(\"invalid leading zero in archive version\");\n    if ((await this.peek()) === 46) {\n      await this.byte();\n      if (!isDigit(await this.peek())) invalid(\"invalid archive version fraction\");\n      while (isDigit(await this.peek())) mantissaDigit(await this.byte());\n    }\n    let exponent = 0;\n    let sign = 1;\n    if ((await this.peek()) === 101 || (await this.peek()) === 69) {\n      await this.byte();\n      if ((await this.peek()) === 45 || (await this.peek()) === 43) {\n        if ((await this.byte()) === 45) sign = -1;\n      }\n      if (!isDigit(await this.peek())) invalid(\"invalid archive version exponent\");\n      while (isDigit(await this.peek())) {\n        // Saturation is arithmetic only: every byte is still read/validated.\n        exponent = Math.min(Number.MAX_SAFE_INTEGER, exponent * 10 + (await this.byte()) - 48);\n      }\n    }\n    if (!valid || significant === -1 || integerDigits - significant - 1 + sign * exponent !== 0)\n      invalid(\"unsupported workspace archive version\");\n  }\n}\n\nclass Base64Decoder {\n  private readonly output = Buffer.allocUnsafe(CHUNK_BYTES);\n  private outputLength = 0;\n  private bits = 0;\n  private digits = 0;\n  /** 1 requires the second '=', 2 forbids any further data. */\n  private padding = 0;\n  byteSize = 0;\n  constructor(private readonly consume: (bytes: Buffer) => Promise<void>) {}\n  private async flush() {\n    if (!this.outputLength) return;\n    await this.consume(this.output.subarray(0, this.outputLength));\n    this.byteSize += this.outputLength;\n    this.outputLength = 0;\n  }\n  async write(input: string | Uint8Array) {\n    for (let index = 0; index < input.length; index++) {\n      const code = typeof input === \"string\" ? input.charCodeAt(index) : input[index]!;\n      if (this.padding === 2) invalid(\"data follows workspace archive base64 padding\");\n      if (this.padding === 1) {\n        if (code !== 61) invalid(\"missing workspace archive base64 padding\");\n        this.padding = 2;\n        continue;\n      }\n      // Any complete quartet emits at most three bytes. Await the sink before\n      // reusing storage; there are no asynchronous operations per input byte.\n      if (this.outputLength > this.output.length - 3) await this.flush();\n      if (code === 61) {\n        if (this.digits === 2) {\n          if (this.bits & 15) invalid(\"noncanonical workspace archive base64 unused bits\");\n          this.output[this.outputLength++] = this.bits >>> 4;\n          this.padding = 1;\n        } else if (this.digits === 3) {\n          if (this.bits & 3) invalid(\"noncanonical workspace archive base64 unused bits\");\n          this.output[this.outputLength++] = this.bits >>> 10;\n          this.output[this.outputLength++] = (this.bits >>> 2) & 255;\n          this.padding = 2;\n        } else invalid(\"invalid workspace archive base64 padding\");\n        this.digits = 0;\n        continue;\n      }\n      const value =\n        code >= 65 && code <= 90\n          ? code - 65\n          : code >= 97 && code <= 122\n            ? code - 71\n            : code >= 48 && code <= 57\n              ? code + 4\n              : code === 43\n                ? 62\n                : code === 47\n                  ? 63\n                  : -1;\n      if (value < 0) invalid(\"invalid workspace archive base64 alphabet\");\n      this.bits = (this.bits << 6) | value;\n      if (++this.digits === 4) {\n        this.output[this.outputLength++] = this.bits >>> 16;\n        this.output[this.outputLength++] = (this.bits >>> 8) & 255;\n        this.output[this.outputLength++] = this.bits & 255;\n        this.bits = 0;\n        this.digits = 0;\n      }\n    }\n  }\n  async finish() {\n    if (this.digits || this.padding === 1) invalid(\"truncated workspace archive base64\");\n    await this.flush();\n  }\n}\n\ntype FileSpan = { path: string; offset: number; byteSize: number };\ntype ArchiveIndex = { directories: string[]; files: FileSpan[] };\n\nasync function fingerprintArchiveIndex(\n  index: ArchiveIndex,\n  payload: FileHandle,\n  signal?: AbortSignal,\n) {\n  const hash = projection(index.directories);\n  let total = 0;\n  const buffer = Buffer.allocUnsafe(CHUNK_BYTES);\n  for (const file of [...index.files].sort((a, b) => compare(a.path, b.path))) {\n    signal?.throwIfAborted();\n    frame(hash, \"file\", file.path);\n    frame(hash, \"bytes\", String(file.byteSize));\n    let copied = 0;\n    while (copied < file.byteSize) {\n      const { bytesRead } = await payload.read(\n        buffer,\n        0,\n        Math.min(buffer.length, file.byteSize - copied),\n        file.offset + copied,\n      );\n      if (!bytesRead) invalid(\"validated workspace payload was truncated\");\n      hash.update(buffer.subarray(0, bytesRead));\n      copied += bytesRead;\n    }\n    total += file.byteSize;\n  }\n  return fingerprint(hash, index.directories.length, index.files.length, total);\n}\n\nfunction validatePath(path: string) {\n  if (\n    !path ||\n    path.includes(\"\\0\") ||\n    Buffer.from(path).toString(\"utf8\") !== path ||\n    path\n      .split(\"/\")\n      .some(\n        (part) =>\n          !part ||\n          part === \".\" ||\n          part === \"..\" ||\n          Buffer.byteLength(part, \"utf8\") > HOST_FILENAME_BYTES,\n      )\n  )\n    invalid(\"unsafe workspace archive path\");\n}\n\nasync function indexArchive(\n  input: FileHandle,\n  payload: FileHandle,\n  options: HostWorkspaceArchiveOptions,\n  signal?: AbortSignal,\n): Promise<ArchiveIndex> {\n  const reader = new JsonReader(input, chunkSize(options), signal);\n  const limits = limitsFor(options);\n  const directories: string[] = [];\n  const files: FileSpan[] = [];\n  let extracted = 0;\n  let members = 0;\n  const member = () => {\n    checkLimit(++members, limits?.maxMembers, \"member count\");\n  };\n  const keys = await reader.object(async (key) => {\n    if (key === \"version\") return await reader.version();\n    if (key === \"directories\") {\n      return await reader.array(async () => {\n        const path = await reader.string();\n        validatePath(path);\n        directories.push(path);\n        member();\n      });\n    }\n    if (key === \"files\") {\n      return await reader.array(async () => {\n        let path: string | undefined;\n        const offset = extracted;\n        const decoder = new Base64Decoder(async (bytes) => {\n          extracted += bytes.length;\n          checkLimit(extracted, limits?.maxExtractedBytes, \"extracted size\");\n          await writeAll(payload, bytes);\n        });\n        const fields = await reader.object(async (field) => {\n          if (field === \"path\") {\n            path = await reader.string();\n            validatePath(path);\n          } else if (field === \"data\") {\n            await reader.string(decoder);\n            await decoder.finish();\n          } else invalid(\"unknown workspace archive file property\");\n        });\n        if (path === undefined || !fields.has(\"data\"))\n          invalid(\"workspace archive file is missing path or data\");\n        files.push({ path, offset, byteSize: decoder.byteSize });\n        member();\n      });\n    }\n    invalid(\"unknown workspace archive property\");\n  });\n  if (!keys.has(\"version\") || !keys.has(\"directories\") || !keys.has(\"files\"))\n    invalid(\"workspace archive is missing required properties\");\n  await reader.whitespace();\n  if ((await reader.peek()) !== -1) invalid(\"trailing data in workspace archive JSON\");\n  const paths = new Map<string, \"file\" | \"directory\">();\n  for (const [path, kind] of [\n    ...directories.map((directory) => [directory, \"directory\"] as const),\n    ...files.map((file) => [file.path, \"file\"] as const),\n  ]) {\n    if (paths.has(path)) invalid(\"duplicate workspace archive path\");\n    paths.set(path, kind);\n  }\n  for (const path of paths.keys()) {\n    let parent = parentAndName(path)[0];\n    while (parent) {\n      if (paths.get(parent) === \"file\") invalid(\"workspace archive file is also an ancestor\");\n      parent = parentAndName(parent)[0];\n    }\n  }\n  return { directories, files };\n}\n\n/** Removes directory entries through pinned parents. unlink never follows a\n * symlink; rmdir never follows a replacement symlink. No recursive rm uses an\n * attacker-controlled pathname. */\nasync function clearDirectory(handle: FileHandle) {\n  for (const name of await readdir(fdPath(handle))) {\n    const path = fdPath(handle, name);\n    const stats = await lstat(path, { bigint: true });\n    if (stats.isDirectory()) {\n      const child = await open(path, READ_DIRECTORY);\n      try {\n        if (!sameEntry(stats, await child.stat({ bigint: true })))\n          invalid(\"restore destination directory changed\");\n        await clearDirectory(child);\n        if (!sameEntry(stats, await lstat(path, { bigint: true })))\n          invalid(\"restore destination directory changed\");\n        await rmdir(path);\n      } finally {\n        await child.close();\n      }\n    } else {\n      await unlink(path);\n    }\n  }\n}\n\nasync function copySpan(payload: FileHandle, output: FileHandle, span: FileSpan) {\n  const buffer = Buffer.allocUnsafe(CHUNK_BYTES);\n  let copied = 0;\n  while (copied < span.byteSize) {\n    const { bytesRead } = await payload.read(\n      buffer,\n      0,\n      Math.min(buffer.length, span.byteSize - copied),\n      span.offset + copied,\n    );\n    if (!bytesRead) invalid(\"validated workspace payload was truncated\");\n    await writeAll(output, buffer.subarray(0, bytesRead));\n    copied += bytesRead;\n  }\n}\n\n/** Copies the untrusted spool once into a private temporary directory outside\n * `avoidRoot`, verifies its exact size and SHA-256, indexes it, and hands the\n * validated index and decoded payload to `use`. */\nasync function withValidatedHostArchive<T>(\n  avoidRoot: string | null,\n  spool: WorkspaceArchiveSpool,\n  options: HostWorkspaceArchiveOptions,\n  use: (archive: ArchiveIndex, payload: FileHandle) => Promise<T>,\n): Promise<T> {\n  // A provider callback can mutate the caller's spool/options objects. The\n  // selected expectation must remain the one supplied before any asynchronous\n  // work, not a replacement advertised while bytes are being produced.\n  const { byteSize: expectedByteSize, sha256: expectedSha256 } = spool;\n  const readChunks = spool.open.bind(spool);\n  const processingChunkBytes = chunkSize(options);\n  const limits = limitsFor(options);\n  checkLimit(expectedByteSize, limits?.maxInputBytes, \"input size\");\n  if (expectedByteSize < 0 || !/^[0-9a-f]{64}$/.test(expectedSha256))\n    invalid(\"invalid workspace archive spool metadata\");\n  const temporary = await privateTemporaryDirectory(avoidRoot);\n  const handles: FileHandle[] = [];\n  try {\n    const input = await open(\n      join(temporary, \"input.json\"),\n      constants.O_RDWR | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW,\n      0o600,\n    );\n    handles.push(input);\n    const writer = new ArchiveWriter(input);\n    // Read the untrusted source exactly once. All later work uses this private\n    // copy, so a changing/reopenable provider cannot switch bytes after validation.\n    for await (const bytes of readChunks()) {\n      if (!(bytes instanceof Uint8Array)) invalid(\"invalid workspace archive stream chunk\");\n      checkLimit(writer.byteSize + bytes.length, limits?.maxInputBytes, \"input size\");\n      if (writer.byteSize + bytes.length > expectedByteSize)\n        invalid(\"workspace archive size mismatch\");\n      await writer.write(bytes);\n    }\n    if (writer.byteSize !== expectedByteSize || writer.hash.digest(\"hex\") !== expectedSha256)\n      invalid(\"workspace archive SHA-256/size mismatch\");\n    const payload = await open(\n      join(temporary, \"payload\"),\n      constants.O_RDWR | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW,\n      0o600,\n    );\n    handles.push(payload);\n    const archive = await indexArchive(input, payload, {\n      chunkBytes: processingChunkBytes,\n      archiveLimits: limits,\n    });\n    return await use(archive, payload);\n  } finally {\n    try {\n      await Promise.all(handles.map((handle) => handle.close()));\n    } finally {\n      await removeHostArchiveTemporaryDirectory(temporary);\n    }\n  }\n}\n\nexport async function restoreHostWorkspaceArchive(\n  root: string,\n  spool: WorkspaceArchiveSpool,\n  options: HostWorkspaceArchiveOptions = {},\n): Promise<void> {\n  await withValidatedHostArchive(root, spool, options, async (archive, payload) => {\n    const handles: FileHandle[] = [];\n    try {\n      await restoreValidatedArchive(root, archive, payload, handles);\n    } finally {\n      await Promise.all(handles.map((handle) => handle.close()));\n    }\n  });\n}\n\nasync function restoreValidatedArchive(\n  root: string,\n  archive: ArchiveIndex,\n  payload: FileHandle,\n  handles: FileHandle[],\n): Promise<void> {\n  // Nothing before this creates, clears or truncates anything under root.\n  const destination = await openRoot(root, true);\n  handles.push(destination);\n  const destinationIdentity = await destination.stat({ bigint: true });\n  await clearDirectory(destination);\n  for (const path of archive.directories) {\n    const directory = await openDirectory(destination, path, undefined, true);\n    await directory.close();\n  }\n  for (const span of archive.files) {\n    const [parent, name] = parentAndName(span.path);\n    const directory = await openDirectory(destination, parent, undefined, true);\n    try {\n      const output = await open(fdPath(directory, name), CREATE, 0o666);\n      try {\n        const identity = await output.stat({ bigint: true });\n        await copySpan(payload, output, span);\n        const freshParent = await openDirectory(destination, parent);\n        try {\n          if (\n            !sameEntry(\n              await directory.stat({ bigint: true }),\n              await freshParent.stat({ bigint: true }),\n            ) ||\n            !sameEntry(identity, await lstat(fdPath(freshParent, name), { bigint: true }))\n          )\n            invalid(\"restore destination file changed\");\n        } finally {\n          await freshParent.close();\n        }\n      } finally {\n        await output.close();\n      }\n    } finally {\n      await directory.close();\n    }\n  }\n  const fresh = await openRoot(root);\n  try {\n    if (!sameEntry(destinationIdentity, await fresh.stat({ bigint: true })))\n      invalid(\"restore destination root changed\");\n  } finally {\n    await fresh.close();\n  }\n}\n\nconst TAR_BLOCK = 512;\n// Largest size a ustar header's 11 octal digits can carry. Portable sandbox\n// tar validators refuse a PAX size override, so a larger member is unportable.\nconst TAR_MAX_MEMBER_BYTES = 0o77777777777;\nconst TAR_DIRECTORY_MODE = 0o755;\nconst TAR_FILE_MODE = 0o644;\n\nfunction tarOctal(header: Buffer, offset: number, width: number, value: number) {\n  header.write(`${value.toString(8).padStart(width - 1, \"0\")}\\0`, offset, width, \"ascii\");\n}\n\nfunction tarHeader(name: string, type: \"0\" | \"5\" | \"x\", size: number, mode: number, mtime: number) {\n  const header = Buffer.alloc(TAR_BLOCK);\n  header.write(name, 0, 100, \"utf8\");\n  tarOctal(header, 100, 8, mode);\n  tarOctal(header, 108, 8, 0);\n  tarOctal(header, 116, 8, 0);\n  tarOctal(header, 124, 12, size);\n  tarOctal(header, 136, 12, mtime);\n  header.fill(0x20, 148, 156);\n  header.write(type, 156, 1, \"ascii\");\n  header.write(\"ustar\\0\", 257, 6, \"ascii\");\n  header.write(\"00\", 263, 2, \"ascii\");\n  let checksum = 0;\n  for (const byte of header) checksum += byte;\n  header.write(`${checksum.toString(8).padStart(6, \"0\")}\\0 `, 148, 8, \"ascii\");\n  return header;\n}\n\nfunction paxRecord(key: string, value: string): Buffer {\n  const body = ` ${key}=${value}\\n`;\n  const bodyBytes = Buffer.byteLength(body);\n  // The decimal length prefix counts its own digits.\n  let length = bodyBytes + String(bodyBytes).length;\n  while (bodyBytes + String(length).length !== length) length = bodyBytes + String(length).length;\n  return Buffer.from(`${length}${body}`);\n}\n\nfunction padded(bytes: number) {\n  return Math.ceil(bytes / TAR_BLOCK) * TAR_BLOCK;\n}\n\n/** Header blocks for one member; a name that does not fit ustar's 100 bytes\n * travels in a PAX `path` record, which sandbox tar validators accept. */\nfunction tarMemberHeader(name: string, type: \"0\" | \"5\", size: number, mtime: number): Buffer {\n  const mode = type === \"5\" ? TAR_DIRECTORY_MODE : TAR_FILE_MODE;\n  if (Buffer.byteLength(name) <= 100) return tarHeader(name, type, size, mode, mtime);\n  const record = paxRecord(\"path\", name);\n  const pax = Buffer.alloc(TAR_BLOCK + padded(record.length));\n  tarHeader(\"././@PaxHeader\", \"x\", record.length, 0o644, mtime).copy(pax, 0);\n  record.copy(pax, TAR_BLOCK);\n  return Buffer.concat([pax, tarHeader(\"././@LongName\", type, size, mode, mtime)]);\n}\n\nfunction excludedBy(path: string, excluded: readonly string[]) {\n  return excluded.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));\n}\n\nexport type PortableWorkspaceTar = {\n  /** A plain ustar/PAX archive of the workspace: directories and regular files. */\n  bytes: Uint8Array;\n  /** The archive's own `sdk_local_archive_v1` fingerprint over every member,\n   * comparable with the descriptor captured alongside it. */\n  fingerprint: WorkspaceTreeFingerprint;\n  /** Exactly what extracting `bytes` materializes, for verifying the result. */\n  contents: WorkspaceContentManifest;\n};\n\n/**\n * Converts a host-backed workspace archive (the portable JSON projection that\n * Local/Docker sandboxes capture) into a tar any remote sandbox can hydrate.\n * The spool is validated exactly like a host restore. `excludedPaths` are the\n * destination's ephemeral paths: they are not persisted there, so they are left\n * out of the tar and of `contents`.\n */\nexport async function convertHostWorkspaceArchiveToTar(\n  spool: WorkspaceArchiveSpool,\n  options: HostWorkspaceArchiveOptions & {\n    excludedPaths?: readonly string[];\n    mtimeSeconds?: number;\n  } = {},\n): Promise<PortableWorkspaceTar> {\n  const excluded = (options.excludedPaths ?? [])\n    .map((path) => path.replace(/^(\\.\\/)+/, \"\").replace(/\\/+$/, \"\"))\n    .filter((path) => path.length > 0);\n  const mtime =\n    options.mtimeSeconds !== undefined && Number.isFinite(options.mtimeSeconds)\n      ? Math.max(0, Math.floor(options.mtimeSeconds))\n      : 0;\n  return await withValidatedHostArchive(null, spool, options, async (archive, payload) => {\n    const archiveFingerprint = await fingerprintArchiveIndex(archive, payload);\n    // Every ancestor is a directory of the restored tree, listed or not.\n    const listed = new Set(archive.directories);\n    const directories = new Set<string>();\n    for (const path of [...archive.directories, ...archive.files.map((file) => file.path)]) {\n      let parent = listed.has(path) ? path : parentAndName(path)[0];\n      while (parent) {\n        if (!excludedBy(parent, excluded)) directories.add(parent);\n        parent = parentAndName(parent)[0];\n      }\n    }\n    const files = archive.files.filter((file) => !excludedBy(file.path, excluded));\n    const orderedDirectories = [...directories].sort((left, right) =>\n      Buffer.compare(Buffer.from(left), Buffer.from(right)),\n    );\n    const headers = new Map<string, Buffer>();\n    let total = 2 * TAR_BLOCK;\n    for (const directory of orderedDirectories) {\n      const header = tarMemberHeader(`${directory}/`, \"5\", 0, mtime);\n      headers.set(`d:${directory}`, header);\n      total += header.length;\n    }\n    for (const file of files) {\n      if (file.byteSize > TAR_MAX_MEMBER_BYTES)\n        invalid(\"workspace archive file is too large for a portable tar\");\n      const header = tarMemberHeader(file.path, \"0\", file.byteSize, mtime);\n      headers.set(`f:${file.path}`, header);\n      total += header.length + padded(file.byteSize);\n    }\n    checkLimit(total, Number.MAX_SAFE_INTEGER, \"portable tar size\");\n    const tar = Buffer.alloc(total);\n    const entries: WorkspaceContentEntry[] = [];\n    let offset = 0;\n    for (const directory of orderedDirectories) {\n      offset += headers.get(`d:${directory}`)!.copy(tar, offset);\n      entries.push({ kind: \"directory\", path: directory });\n    }\n    for (const file of files) {\n      offset += headers.get(`f:${file.path}`)!.copy(tar, offset);\n      const hash = createHash(\"sha256\");\n      let copied = 0;\n      while (copied < file.byteSize) {\n        const { bytesRead } = await payload.read(\n          tar,\n          offset + copied,\n          Math.min(CHUNK_BYTES, file.byteSize - copied),\n          file.offset + copied,\n        );\n        if (!bytesRead) invalid(\"validated workspace payload was truncated\");\n        hash.update(tar.subarray(offset + copied, offset + copied + bytesRead));\n        copied += bytesRead;\n      }\n      offset += padded(file.byteSize);\n      entries.push({\n        kind: \"file\",\n        path: file.path,\n        sha256: hash.digest(\"hex\"),\n        byteSize: file.byteSize,\n      });\n    }\n    return {\n      bytes: new Uint8Array(tar.buffer, tar.byteOffset, tar.byteLength),\n      fingerprint: archiveFingerprint,\n      contents: workspaceContentManifest(entries),\n    };\n  });\n}\n","import { createHash } from \"node:crypto\";\nimport { constants } from \"node:fs\";\nimport { lstat, open, readdir } from \"node:fs/promises\";\nimport { isAbsolute, join } from \"node:path\";\nimport {\n  WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION,\n  decodeNativeSnapshotRef,\n  parseWorkspaceArchiveDescriptor,\n  parseWorkspaceArchiveObjectRef,\n  type NativeSnapshotDescriptor,\n  type NativeSnapshotRef,\n  type TarWorkspaceArchiveDescriptor,\n  type WorkspaceArchiveDescriptor,\n  type WorkspaceTreeFingerprint,\n} from \"@opengeni/contracts\";\nimport { withSandboxProviderCapture } from \"./provider-operation-gate\";\nimport type { VerifiedHostWorkspaceArchive } from \"./archive-spool\";\nimport {\n  captureHostWorkspaceArchive,\n  fingerprintHostWorkspace,\n  type HostWorkspaceRootIdentity,\n} from \"./host-archive-spool\";\n\nexport {\n  WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION,\n  decodeNativeSnapshotRef,\n  encodeNativeSnapshotRef,\n  parseWorkspaceArchiveDescriptor,\n  type NativeSnapshotDescriptor,\n  type NativeSnapshotProvider,\n  type NativeSnapshotRef,\n  type TarWorkspaceArchiveDescriptor,\n  type WorkspaceArchiveDescriptor,\n  type WorkspaceTreeFingerprint,\n} from \"@opengeni/contracts\";\n\nexport type VerifiedWorkspaceArchive = {\n  bytes: Uint8Array;\n  base64: string;\n  descriptor: WorkspaceArchiveDescriptor;\n  kind: \"tar\" | \"provider_snapshot\";\n  nativeSnapshot?: NativeSnapshotRef;\n};\n\nexport type VerifiedWorkspaceArchivePayload =\n  | VerifiedWorkspaceArchive\n  | VerifiedHostWorkspaceArchive;\n\n/** Host-backed portable archives can go directly to object storage without an\n * intermediate whole-document string or buffer. Existing inline/provider APIs\n * retain their compatibility path when disk-backed publication is unavailable. */\nexport async function captureWorkspaceArchiveForStorage(\n  session: unknown,\n  capturedAtMs: number,\n  options: WorkspaceArchiveCaptureOptions,\n  objectStorageAvailable: boolean,\n): Promise<VerifiedWorkspaceArchivePayload> {\n  const target = session as WorkspaceSession;\n  await target.assertWorkspaceCaptureAuthority?.();\n  const root = hostBackedWorkspaceRoot(target);\n  if (\n    process.platform !== \"linux\" ||\n    !root ||\n    !objectStorageAvailable ||\n    options.strategy === \"portable_tar\"\n  ) {\n    return await captureVerifiedWorkspaceArchive(session, capturedAtMs, options);\n  }\n  return await withSandboxProviderCapture(\n    session,\n    async () => {\n      const { spool, workspace } = await captureHostWorkspaceArchive(\n        root,\n        workspaceFingerprintExcludes(target),\n        target.workspaceCaptureRootIdentity,\n        options.signal,\n      );\n      return {\n        kind: \"host_spool\" as const,\n        spool,\n        descriptor: {\n          version: 1 as const,\n          revision: `wa1:${String(capturedAtMs).padStart(13, \"0\")}:${spool.sha256}`,\n          archiveSha256: spool.sha256,\n          archiveBytes: spool.byteSize,\n          capturedAt: new Date(capturedAtMs).toISOString(),\n          workspace,\n        },\n      };\n    },\n    options.signal,\n  );\n}\n\nexport async function disposeWorkspaceArchive(\n  archive: VerifiedWorkspaceArchivePayload | undefined,\n): Promise<void> {\n  if (archive?.kind === \"host_spool\") await archive.spool.dispose();\n}\n\nexport type WorkspaceArchiveIntegrityCode =\n  | \"archive_metadata_missing\"\n  | \"archive_metadata_invalid\"\n  | \"archive_base64_invalid\"\n  | \"archive_hash_mismatch\"\n  | \"archive_hydration_failed\"\n  /** The referenced archive object does not exist (deleted, wrong bucket or\n   * account). Never proof that the checkpoint content is corrupt. */\n  | \"archive_object_missing\"\n  /** This process has no archive object storage configured. */\n  | \"archive_storage_unavailable\"\n  | \"workspace_fingerprint_unavailable\"\n  | \"workspace_changed_during_capture\"\n  | \"workspace_fingerprint_mismatch\"\n  | \"native_snapshot_reference_invalid\"\n  | \"native_snapshot_fallback_unverified\";\n\nexport class WorkspaceArchiveIntegrityError extends Error {\n  readonly name = \"WorkspaceArchiveIntegrityError\";\n  readonly retryable: boolean;\n\n  constructor(\n    public readonly code: WorkspaceArchiveIntegrityCode,\n    message: string,\n    options: { retryable?: boolean; cause?: unknown } = {},\n  ) {\n    super(message, options.cause === undefined ? undefined : { cause: options.cause });\n    this.retryable = options.retryable ?? false;\n  }\n}\n\ntype WorkspaceSession = {\n  /** Present only on the reaper's restricted Docker capture attachment. */\n  assertWorkspaceCaptureAuthority?: () => Promise<void>;\n  workspaceCaptureRootIdentity?: HostWorkspaceRootIdentity;\n  exec?: (args: {\n    cmd: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n  }) => Promise<unknown>;\n  execCommand?: (args: {\n    cmd: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n  }) => Promise<unknown>;\n  persistWorkspace?: (options?: WorkspaceArchiveCaptureOptions) => Promise<Uint8Array | undefined>;\n  /** Agents Extensions remote sessions expose this protected-at-type-level\n   * primitive on the concrete JS instance. Opengeni uses it only through an\n   * explicit provider policy to bypass replacing/unledgered native capture. */\n  persistWorkspaceTar?: () => Promise<Uint8Array | undefined>;\n  state?: {\n    workspacePersistence?: unknown;\n    workspaceRootPath?: unknown;\n    manifest?: {\n      root?: unknown;\n      ephemeralPersistencePaths?: () => Set<unknown>;\n    };\n  };\n};\n\ntype SdkLocalArchiveFile = { path: string; content: Uint8Array };\n\n/**\n * Durable correlation identity for one logical provider capture. A provider\n * adapter may place it on its wire request, but callers must not infer replay\n * idempotency unless that provider contract explicitly guarantees it.\n */\nexport type WorkspaceArchiveCaptureOptions = {\n  requestId: string;\n  strategy?: \"configured\" | \"portable_tar\";\n  /**\n   * Abandons the capture while it still waits for the provider operation gate,\n   * and stops a host-backed spool capture mid-read. A provider-native persist\n   * call that already started is not interrupted: its own settlement remains\n   * authoritative.\n   */\n  signal?: AbortSignal;\n};\n\nfunction sha256(bytes: Uint8Array): string {\n  return createHash(\"sha256\").update(bytes).digest(\"hex\");\n}\n\nfunction decodeBase64Strict(value: string): Uint8Array | null {\n  if (value.length === 0 || value.length % 4 !== 0 || !/^[A-Za-z0-9+/]+={0,2}$/.test(value)) {\n    return null;\n  }\n  const bytes = Uint8Array.from(Buffer.from(value, \"base64\"));\n  return Buffer.from(bytes).toString(\"base64\") === value ? bytes : null;\n}\n\nexport function describeNativeSnapshotArchive(\n  bytes: Uint8Array,\n  capturedAtMs = Date.now(),\n): NativeSnapshotDescriptor | null {\n  const native = decodeNativeSnapshotRef(bytes);\n  if (!native) return null;\n  const archiveSha256 = sha256(bytes);\n  return {\n    version: WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION,\n    kind: \"provider_snapshot\",\n    revision: `wa2:${String(capturedAtMs).padStart(13, \"0\")}:${archiveSha256}`,\n    archiveSha256,\n    archiveBytes: bytes.length,\n    capturedAt: new Date(capturedAtMs).toISOString(),\n    provider: native.provider,\n    snapshotId: native.snapshotId,\n    ...(native.workspacePersistence ? { workspacePersistence: native.workspacePersistence } : {}),\n  };\n}\n\nexport function describeLegacyNativeSnapshotArchive(\n  base64: unknown,\n  observedAtMs = Date.now(),\n): { archiveBase64: string; descriptor: NativeSnapshotDescriptor } | null {\n  if (typeof base64 !== \"string\") return null;\n  const bytes = decodeBase64Strict(base64);\n  if (!bytes) return null;\n  const descriptor = describeNativeSnapshotArchive(bytes, observedAtMs);\n  return descriptor ? { archiveBase64: base64, descriptor } : null;\n}\n\nexport function readVerifiedWorkspaceArchive(\n  base64: unknown,\n  metadata: unknown,\n): VerifiedWorkspaceArchive | null {\n  if (base64 === undefined || base64 === null || base64 === \"\") return null;\n  if (typeof base64 !== \"string\") {\n    throw new WorkspaceArchiveIntegrityError(\n      \"archive_base64_invalid\",\n      \"selected workspace archive is not a base64 string\",\n    );\n  }\n  if (metadata === undefined || metadata === null) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"archive_metadata_missing\",\n      \"selected workspace archive has no durable revision/fingerprint metadata\",\n    );\n  }\n  const descriptor = parseWorkspaceArchiveDescriptor(metadata);\n  if (!descriptor) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"archive_metadata_invalid\",\n      \"selected workspace archive metadata is invalid\",\n    );\n  }\n  const bytes = decodeBase64Strict(base64);\n  if (!bytes) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"archive_base64_invalid\",\n      `workspace archive revision ${descriptor.revision} has invalid base64 bytes`,\n    );\n  }\n  const actualHash = sha256(bytes);\n  if (bytes.length !== descriptor.archiveBytes || actualHash !== descriptor.archiveSha256) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"archive_hash_mismatch\",\n      `workspace archive revision ${descriptor.revision} failed SHA-256/size verification`,\n    );\n  }\n  const nativeSnapshot = decodeNativeSnapshotRef(bytes);\n  if (descriptor.version === WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION) {\n    if (\n      !nativeSnapshot ||\n      nativeSnapshot.provider !== descriptor.provider ||\n      nativeSnapshot.snapshotId !== descriptor.snapshotId ||\n      nativeSnapshot.workspacePersistence !== descriptor.workspacePersistence\n    ) {\n      throw new WorkspaceArchiveIntegrityError(\n        \"native_snapshot_reference_invalid\",\n        `native snapshot receipt does not match descriptor revision ${descriptor.revision}`,\n      );\n    }\n  } else if (nativeSnapshot) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"native_snapshot_reference_invalid\",\n      `legacy native snapshot receipt ${descriptor.revision} was not durably upgraded to a v2 provider descriptor`,\n    );\n  }\n  return {\n    bytes,\n    base64,\n    descriptor,\n    kind: descriptor.version === WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION ? \"provider_snapshot\" : \"tar\",\n    ...(descriptor.version === WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION && nativeSnapshot\n      ? { nativeSnapshot }\n      : {}),\n  };\n}\n\n/** Fetch object-storage tar bytes into the in-memory restore envelope. Legacy\n * inline base64 is left unchanged. Both payloads must agree when both exist. */\nexport async function inlineWorkspaceArchiveForRestore(\n  sessionState: Record<string, unknown>,\n  getObjectBytes: (key: string) => Promise<{ bytes: Uint8Array } | null>,\n): Promise<Record<string, unknown>> {\n  const ref = parseWorkspaceArchiveObjectRef(sessionState.workspaceArchiveRef);\n  if (!ref) return sessionState;\n  const object = await getObjectBytes(ref.key);\n  if (!object) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"archive_object_missing\",\n      `workspace archive object ${ref.key} is missing`,\n    );\n  }\n  const actualHash = sha256(object.bytes);\n  if (object.bytes.length !== ref.bytes || actualHash !== ref.sha256) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"archive_hash_mismatch\",\n      `workspace archive object ${ref.key} failed SHA-256/size verification`,\n    );\n  }\n  const base64 = Buffer.from(object.bytes).toString(\"base64\");\n  const inline = sessionState.workspaceArchive;\n  if (typeof inline === \"string\" && inline.length > 0 && inline !== base64) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"archive_hash_mismatch\",\n      \"inline workspace archive and object-storage ref disagree\",\n    );\n  }\n  readVerifiedWorkspaceArchive(base64, sessionState.workspaceArchiveMeta);\n  return { ...sessionState, workspaceArchive: base64 };\n}\n\nfunction stdoutFromExecResult(value: unknown): string {\n  if (typeof value === \"string\") {\n    const delimiter = /\\r?\\nOutput:\\r?\\n/u.exec(value);\n    return delimiter ? value.slice(delimiter.index + delimiter[0].length) : value;\n  }\n  if (!value || typeof value !== \"object\") return \"\";\n  const output = value as { stdout?: unknown; output?: unknown };\n  return typeof output.stdout === \"string\"\n    ? output.stdout\n    : typeof output.output === \"string\"\n      ? output.output\n      : \"\";\n}\n\nfunction execFailureDiagnostic(value: unknown): string {\n  if (!value || typeof value !== \"object\") return \"result=unstructured\";\n  const result = value as {\n    exitCode?: unknown;\n    status?: unknown;\n    stderr?: unknown;\n  };\n  const status =\n    typeof result.exitCode === \"number\"\n      ? `exitCode=${result.exitCode}`\n      : typeof result.status === \"number\"\n        ? `status=${result.status}`\n        : \"exitCode=unknown\";\n  const stderr =\n    typeof result.stderr === \"string\"\n      ? result.stderr.replace(/\\s+/g, \" \").trim().slice(0, 240)\n      : \"\";\n  return stderr.length > 0 ? `${status}, stderr=${stderr}` : status;\n}\n\nfunction isTransientRootDirectoryFingerprintRace(value: unknown): boolean {\n  if (!value || typeof value !== \"object\") return false;\n  const result = value as {\n    exitCode?: unknown;\n    status?: unknown;\n    stderr?: unknown;\n  };\n  const exitCode =\n    typeof result.exitCode === \"number\"\n      ? result.exitCode\n      : typeof result.status === \"number\"\n        ? result.status\n        : null;\n  if (exitCode !== 1 || typeof result.stderr !== \"string\") return false;\n  return result.stderr\n    .split(/\\r?\\n/)\n    .map((line) => line.trim())\n    .some((line) => line === \"tar: .: file changed as we read it\");\n}\n\nfunction shellQuote(value: string): string {\n  return `'${value.replaceAll(\"'\", `'\"'\"'`)}'`;\n}\n\nfunction workspaceFingerprintExcludes(session: WorkspaceSession): string[] {\n  return [...(session.state?.manifest?.ephemeralPersistencePaths?.() ?? [])]\n    .filter((path): path is string => typeof path === \"string\" && path.length > 0)\n    .sort((left, right) => left.localeCompare(right));\n}\n\n/** Workspace-relative paths a session never persists (its manifest's\n * ephemeral paths). Archives and fingerprints leave them out. */\nexport function workspaceArchiveExcludedPaths(session: unknown): string[] {\n  return workspaceFingerprintExcludes(session as WorkspaceSession);\n}\n\nfunction findPruneExpression(excludedPaths: readonly string[]): string {\n  const findExcludes = excludedPaths.flatMap((path) => [\n    `-path ${shellQuote(`./${path}`)}`,\n    `-path ${shellQuote(`./${path}/*`)}`,\n  ]);\n  return findExcludes.length === 0 ? \"\" : `\\\\( ${findExcludes.join(\" -o \")} \\\\) -prune -o `;\n}\n\nfunction workspaceFingerprintCommand(excludedPaths: readonly string[]): string {\n  const tarExcludes = excludedPaths.flatMap((path) => [\n    shellQuote(`--exclude=${path}`),\n    shellQuote(`--exclude=./${path}`),\n  ]);\n  const findPrefix = findPruneExpression(excludedPaths);\n  const script = String.raw`set -eu\ncd /workspace\ndigest=$(LC_ALL=C tar ${tarExcludes.join(\" \")} --sort=name --mtime=\"@0\" --owner=0 --group=0 --numeric-owner --hard-dereference --format=gnu -cf - . | sha256sum | awk \"{print \\$1}\")\nentries=$(find . -xdev -mindepth 1 ${findPrefix}! \\( -type s -o -type p -o -type b -o -type c \\) -printf x | wc -c | tr -d \" \")\nfiles=$(find . -xdev ${findPrefix}-type f -printf x | wc -c | tr -d \" \")\nbytes=$(find . -xdev ${findPrefix}-type f -printf \"%s\\n\" | awk \"{s+=\\$1} END {printf \\\"%.0f\\\", s+0}\")\nprintf \"OPENGENI_WORKSPACE_FINGERPRINT_V1 %s %s %s %s\\n\" \"$digest\" \"$entries\" \"$files\" \"$bytes\"`;\n  return `bash -o pipefail -c ${shellQuote(script)}`;\n}\n\nconst SDK_LOCAL_ARCHIVE_PROJECTION = \"sdk_local_archive_v1\" as const;\nconst HOST_FINGERPRINT_READ_FLAGS = constants.O_RDONLY | constants.O_NOFOLLOW;\n\nfunction hostBackedWorkspaceRoot(session: WorkspaceSession): string | null {\n  const root = session.state?.workspaceRootPath;\n  return typeof root === \"string\" && isAbsolute(root) ? root : null;\n}\n\nfunction appendFingerprintFrame(\n  hash: ReturnType<typeof createHash>,\n  label: string,\n  value: string,\n): void {\n  hash.update(label);\n  hash.update(\"\\0\");\n  hash.update(String(Buffer.byteLength(value)));\n  hash.update(\"\\0\");\n  hash.update(value);\n  hash.update(\"\\0\");\n}\n\nfunction stableLogicalPathCompare(left: string, right: string): number {\n  return left < right ? -1 : left > right ? 1 : 0;\n}\n\nfunction fingerprintSdkLocalProjection(\n  directoryInput: readonly string[],\n  fileInput: readonly SdkLocalArchiveFile[],\n): WorkspaceTreeFingerprint {\n  const directories = [...directoryInput].sort(stableLogicalPathCompare);\n  const files = [...fileInput].sort((left, right) =>\n    stableLogicalPathCompare(left.path, right.path),\n  );\n  const paths = new Set<string>();\n  const hash = createHash(\"sha256\");\n  appendFingerprintFrame(hash, \"projection\", SDK_LOCAL_ARCHIVE_PROJECTION);\n  for (const directory of directories) {\n    if (paths.has(directory)) {\n      throw new WorkspaceArchiveIntegrityError(\n        \"workspace_fingerprint_unavailable\",\n        \"host-backed sandbox archive contains a duplicate logical path\",\n        { retryable: true },\n      );\n    }\n    paths.add(directory);\n    appendFingerprintFrame(hash, \"dir\", directory);\n  }\n  let totalFileBytes = 0;\n  for (const file of files) {\n    if (paths.has(file.path)) {\n      throw new WorkspaceArchiveIntegrityError(\n        \"workspace_fingerprint_unavailable\",\n        \"host-backed sandbox archive contains a duplicate logical path\",\n        { retryable: true },\n      );\n    }\n    paths.add(file.path);\n    totalFileBytes += file.content.byteLength;\n    if (!Number.isSafeInteger(totalFileBytes)) {\n      throw new WorkspaceArchiveIntegrityError(\n        \"workspace_fingerprint_unavailable\",\n        \"host-backed sandbox workspace exceeds the supported fingerprint byte range\",\n      );\n    }\n    appendFingerprintFrame(hash, \"file\", file.path);\n    appendFingerprintFrame(hash, \"bytes\", String(file.content.byteLength));\n    hash.update(file.content);\n  }\n  return {\n    algorithm: \"sha256\",\n    sha256: hash.digest(\"hex\"),\n    entryCount: directories.length + files.length,\n    fileCount: files.length,\n    totalFileBytes,\n    projection: SDK_LOCAL_ARCHIVE_PROJECTION,\n  };\n}\n\nfunction sdkArchivePath(value: unknown): value is string {\n  return (\n    typeof value === \"string\" &&\n    value.length > 0 &&\n    !value.startsWith(\"/\") &&\n    !value.includes(\"\\0\") &&\n    value.split(\"/\").every((segment) => segment.length > 0 && segment !== \".\" && segment !== \"..\")\n  );\n}\n\nfunction decodeSdkArchiveFile(value: unknown): Uint8Array | null {\n  if (value === \"\") return new Uint8Array();\n  return typeof value === \"string\" ? decodeBase64Strict(value) : null;\n}\n\n/** Parse only the portable JSON shape emitted by Agents SDK Local/Docker\n * persistWorkspace(). This lets capture prove that the bytes themselves—not\n * merely two live-directory observations—contain the exact fenced projection. */\nfunction fingerprintSdkLocalArchive(bytes: Uint8Array): WorkspaceTreeFingerprint {\n  let decoded: unknown;\n  try {\n    decoded = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes));\n  } catch {\n    throw new WorkspaceArchiveIntegrityError(\n      \"workspace_fingerprint_unavailable\",\n      \"host-backed sandbox persistence returned an invalid SDK archive\",\n      { retryable: true },\n    );\n  }\n  if (!decoded || typeof decoded !== \"object\" || Array.isArray(decoded)) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"workspace_fingerprint_unavailable\",\n      \"host-backed sandbox persistence returned an invalid SDK archive\",\n      { retryable: true },\n    );\n  }\n  const archive = decoded as {\n    version?: unknown;\n    directories?: unknown;\n    files?: unknown;\n  };\n  if (\n    archive.version !== 1 ||\n    !Array.isArray(archive.directories) ||\n    !archive.directories.every(sdkArchivePath) ||\n    !Array.isArray(archive.files)\n  ) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"workspace_fingerprint_unavailable\",\n      \"host-backed sandbox persistence returned an invalid SDK archive\",\n      { retryable: true },\n    );\n  }\n  const files: SdkLocalArchiveFile[] = [];\n  for (const candidate of archive.files) {\n    if (!candidate || typeof candidate !== \"object\" || Array.isArray(candidate)) {\n      throw new WorkspaceArchiveIntegrityError(\n        \"workspace_fingerprint_unavailable\",\n        \"host-backed sandbox persistence returned an invalid SDK archive\",\n        { retryable: true },\n      );\n    }\n    const file = candidate as { path?: unknown; data?: unknown };\n    const content = decodeSdkArchiveFile(file.data);\n    if (!sdkArchivePath(file.path) || !content) {\n      throw new WorkspaceArchiveIntegrityError(\n        \"workspace_fingerprint_unavailable\",\n        \"host-backed sandbox persistence returned an invalid SDK archive\",\n        { retryable: true },\n      );\n    }\n    files.push({ path: file.path, content });\n  }\n  return fingerprintSdkLocalProjection(archive.directories, files);\n}\n\nfunction sameFilesystemEntry(\n  left: Awaited<ReturnType<typeof lstat>>,\n  right: Awaited<ReturnType<typeof lstat>>,\n): boolean {\n  return left.dev === right.dev && left.ino === right.ino;\n}\n\nfunction hostPathChanged(): WorkspaceArchiveIntegrityError {\n  return new WorkspaceArchiveIntegrityError(\n    \"workspace_fingerprint_unavailable\",\n    \"host-backed sandbox workspace changed while fingerprinting\",\n    { retryable: true },\n  );\n}\n\nasync function readStableHostFile(\n  path: string,\n  expected: Awaited<ReturnType<typeof lstat>>,\n): Promise<Buffer> {\n  const before = await lstat(path).catch(() => {\n    throw hostPathChanged();\n  });\n  if (!before.isFile() || !sameFilesystemEntry(before, expected)) {\n    throw hostPathChanged();\n  }\n  let handle: Awaited<ReturnType<typeof open>>;\n  try {\n    handle = await open(path, HOST_FINGERPRINT_READ_FLAGS);\n  } catch {\n    throw hostPathChanged();\n  }\n  try {\n    const opened = await handle.stat();\n    if (!opened.isFile() || !sameFilesystemEntry(opened, before)) {\n      throw hostPathChanged();\n    }\n    const content = await handle.readFile();\n    const after = await handle.stat();\n    if (\n      !after.isFile() ||\n      !sameFilesystemEntry(after, opened) ||\n      after.size !== opened.size ||\n      after.mtimeMs !== opened.mtimeMs ||\n      after.ctimeMs !== opened.ctimeMs\n    ) {\n      throw hostPathChanged();\n    }\n    return content;\n  } finally {\n    await handle.close();\n  }\n}\n\nfunction shouldSkipHostArchivePath(path: string, excludedPaths: ReadonlySet<string>): boolean {\n  for (const excluded of excludedPaths) {\n    if (excluded === \"\" || path === excluded || path.startsWith(`${excluded}/`)) return true;\n  }\n  return false;\n}\n\n/** Mirrors Agents SDK 0.13.x createWorkspaceArchive(): its Local/Docker\n * persistence is a provider-agnostic JSON archive containing directories and\n * regular files, not an in-container tar stream. Fingerprinting the same host\n * projection removes all image-tool dependencies (including Alpine's lack of\n * bash) and makes the descriptor match what cold restore can actually rebuild. */\nasync function fingerprintHostBackedWorkspace(\n  root: string,\n  excludedPaths: readonly string[],\n): Promise<WorkspaceTreeFingerprint> {\n  const excluded = new Set(excludedPaths);\n  const directories: string[] = [];\n  const files: SdkLocalArchiveFile[] = [];\n\n  const walk = async (\n    currentRoot: string,\n    relativeRoot = \"\",\n    expected?: Awaited<ReturnType<typeof lstat>>,\n  ): Promise<void> => {\n    const before = await lstat(currentRoot).catch(() => {\n      throw hostPathChanged();\n    });\n    if (!before.isDirectory() || (expected && !sameFilesystemEntry(before, expected))) {\n      throw hostPathChanged();\n    }\n    const entries = await readdir(currentRoot, { withFileTypes: true });\n    const afterRead = await lstat(currentRoot).catch(() => {\n      throw hostPathChanged();\n    });\n    if (!afterRead.isDirectory() || !sameFilesystemEntry(afterRead, before)) {\n      throw hostPathChanged();\n    }\n    entries.sort((left, right) => left.name.localeCompare(right.name));\n    for (const entry of entries) {\n      const relativePath = relativeRoot ? `${relativeRoot}/${entry.name}` : entry.name;\n      if (shouldSkipHostArchivePath(relativePath, excluded)) continue;\n      const entryPath = join(currentRoot, entry.name);\n      const stats = await lstat(entryPath).catch(() => {\n        throw hostPathChanged();\n      });\n      if (stats.isDirectory()) {\n        directories.push(relativePath);\n        await walk(entryPath, relativePath, stats);\n        continue;\n      }\n      // This is deliberately identical to the SDK archive projection: symlinks,\n      // sockets, devices and FIFOs are not serialized and therefore must not\n      // influence the restore fingerprint either.\n      if (!stats.isFile()) continue;\n      const content = await readStableHostFile(entryPath, stats);\n      files.push({ path: relativePath, content });\n    }\n    const afterWalk = await lstat(currentRoot).catch(() => {\n      throw hostPathChanged();\n    });\n    if (!afterWalk.isDirectory() || !sameFilesystemEntry(afterWalk, before)) {\n      throw hostPathChanged();\n    }\n  };\n\n  await walk(root);\n  return fingerprintSdkLocalProjection(directories, files);\n}\n\nasync function fingerprintRemoteWorkspace(\n  target: WorkspaceSession,\n): Promise<WorkspaceTreeFingerprint> {\n  const run = target.exec ?? target.execCommand;\n  if (!run) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"workspace_fingerprint_unavailable\",\n      \"sandbox session cannot execute the workspace fingerprint probe\",\n    );\n  }\n  const cmd = workspaceFingerprintCommand(workspaceFingerprintExcludes(target));\n  let result: unknown;\n  let match: RegExpMatchArray | null = null;\n  for (let attempt = 1; attempt <= 3; attempt += 1) {\n    result = await run.call(target, {\n      cmd,\n      yieldTimeMs: 120_000,\n      maxOutputTokens: 1_000,\n    });\n    match = stdoutFromExecResult(result)\n      .trim()\n      .match(/^OPENGENI_WORKSPACE_FINGERPRINT_V1 ([a-f0-9]{64}) ([0-9]+) ([0-9]+) ([0-9]+)$/);\n    if (match || !isTransientRootDirectoryFingerprintRace(result) || attempt === 3) break;\n    await new Promise((resolve) => setTimeout(resolve, attempt * 25));\n  }\n  if (!match) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"workspace_fingerprint_unavailable\",\n      `sandbox workspace fingerprint probe returned no valid digest (${execFailureDiagnostic(result)})`,\n      { retryable: true },\n    );\n  }\n  const entryCount = Number(match[2]);\n  const fileCount = Number(match[3]);\n  const totalFileBytes = Number(match[4]);\n  if (![entryCount, fileCount, totalFileBytes].every(Number.isSafeInteger)) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"workspace_fingerprint_unavailable\",\n      \"sandbox workspace fingerprint counters exceeded the supported range\",\n    );\n  }\n  return {\n    algorithm: \"sha256\",\n    sha256: match[1]!,\n    entryCount,\n    fileCount,\n    totalFileBytes,\n  };\n}\n\n/**\n * A projection-independent description of a workspace tree: every directory by\n * path and every regular file by path and content SHA-256. It verifies an\n * archive restored by a provider whose native fingerprint is not the archive's\n * own (for example a host-backed archive hydrated into a remote sandbox).\n */\nexport type WorkspaceContentManifest = {\n  sha256: string;\n  directoryCount: number;\n  fileCount: number;\n  totalFileBytes: number;\n};\n\nexport type WorkspaceContentEntry =\n  | { kind: \"directory\"; path: string }\n  | { kind: \"file\"; path: string; sha256: string; byteSize: number };\n\n/** Records are `d  <path>` or `<sha256>  <path>` (the `sha256sum` line shape),\n * NUL-terminated and ordered by their bytes, so a remote shell computes the\n * identical digest with find, sha256sum -z and `LC_ALL=C sort -z`. */\nexport function workspaceContentManifest(\n  entries: Iterable<WorkspaceContentEntry>,\n): WorkspaceContentManifest {\n  const records: Buffer[] = [];\n  let directoryCount = 0;\n  let fileCount = 0;\n  let totalFileBytes = 0;\n  for (const entry of entries) {\n    if (entry.kind === \"directory\") {\n      directoryCount += 1;\n      records.push(Buffer.from(`d  ${entry.path}`));\n    } else {\n      fileCount += 1;\n      totalFileBytes += entry.byteSize;\n      records.push(Buffer.from(`${entry.sha256}  ${entry.path}`));\n    }\n  }\n  records.sort(Buffer.compare);\n  const hash = createHash(\"sha256\");\n  for (const record of records) hash.update(record).update(\"\\0\");\n  return { sha256: hash.digest(\"hex\"), directoryCount, fileCount, totalFileBytes };\n}\n\nfunction workspaceRoot(target: WorkspaceSession): string {\n  const root = target.state?.manifest?.root;\n  return typeof root === \"string\" && isAbsolute(root) ? root : \"/workspace\";\n}\n\nfunction workspaceContentManifestCommand(root: string, excludedPaths: readonly string[]): string {\n  const prune = findPruneExpression(excludedPaths);\n  const script = String.raw`set -eu\ncd ${shellQuote(root)}\ndigest=$( { find . -xdev -mindepth 1 ${prune}-type d -printf \"d  %P\\0\"; find . -xdev -mindepth 1 ${prune}-type f -printf \"%P\\0\" | xargs -0 -r sha256sum -z --; } | LC_ALL=C sort -z | sha256sum | awk \"{print \\$1}\")\ndirs=$(find . -xdev -mindepth 1 ${prune}-type d -printf x | wc -c | tr -d \" \")\nfiles=$(find . -xdev -mindepth 1 ${prune}-type f -printf x | wc -c | tr -d \" \")\nbytes=$(find . -xdev -mindepth 1 ${prune}-type f -printf \"%s\\n\" | awk \"{s+=\\$1} END {printf \\\"%.0f\\\", s+0}\")\nprintf \"OPENGENI_WORKSPACE_CONTENTS_V1 %s %s %s %s\\n\" \"$digest\" \"$dirs\" \"$files\" \"$bytes\"`;\n  return `bash -o pipefail -c ${shellQuote(script)}`;\n}\n\n/** Reads the content manifest of a remote session's persistent workspace,\n * excluding its manifest-declared ephemeral paths. */\nexport async function readRemoteWorkspaceContentManifest(\n  session: unknown,\n): Promise<WorkspaceContentManifest> {\n  const target = session as WorkspaceSession;\n  const run = target.exec ?? target.execCommand;\n  if (!run) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"workspace_fingerprint_unavailable\",\n      \"sandbox session cannot execute the workspace content probe\",\n    );\n  }\n  const result = await run.call(target, {\n    cmd: workspaceContentManifestCommand(\n      workspaceRoot(target),\n      workspaceFingerprintExcludes(target),\n    ),\n    yieldTimeMs: 300_000,\n    maxOutputTokens: 1_000,\n  });\n  const match = stdoutFromExecResult(result)\n    .trim()\n    .match(/^OPENGENI_WORKSPACE_CONTENTS_V1 ([a-f0-9]{64}) ([0-9]+) ([0-9]+) ([0-9]+)$/);\n  if (!match) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"workspace_fingerprint_unavailable\",\n      `sandbox workspace content probe returned no valid digest (${execFailureDiagnostic(result)})`,\n      { retryable: true },\n    );\n  }\n  const directoryCount = Number(match[2]);\n  const fileCount = Number(match[3]);\n  const totalFileBytes = Number(match[4]);\n  if (![directoryCount, fileCount, totalFileBytes].every(Number.isSafeInteger)) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"workspace_fingerprint_unavailable\",\n      \"sandbox workspace content counters exceeded the supported range\",\n    );\n  }\n  return { sha256: match[1]!, directoryCount, fileCount, totalFileBytes };\n}\n\n/** Verifies that a remote session's workspace holds exactly `expected`. */\nexport async function verifyRestoredWorkspaceContents(\n  session: unknown,\n  expected: WorkspaceContentManifest,\n  revision: string,\n): Promise<void> {\n  const actual = await readRemoteWorkspaceContentManifest(session);\n  if (\n    actual.sha256 !== expected.sha256 ||\n    actual.directoryCount !== expected.directoryCount ||\n    actual.fileCount !== expected.fileCount ||\n    actual.totalFileBytes !== expected.totalFileBytes\n  ) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"workspace_fingerprint_mismatch\",\n      `restored workspace does not match selected archive revision ${revision}`,\n    );\n  }\n}\n\n/** Fingerprints the provider's exact persistent projection. Local/Docker use\n * the SDK's host-backed portable archive projection; remote tar providers use a\n * deterministic GNU-tar stream. Manifest-declared ephemeral paths are excluded\n * in both cases. Only the aggregate enters logs or durable metadata. */\nexport async function fingerprintSandboxWorkspace(\n  session: unknown,\n): Promise<WorkspaceTreeFingerprint> {\n  const target = session as WorkspaceSession;\n  await target.assertWorkspaceCaptureAuthority?.();\n  const hostRoot = hostBackedWorkspaceRoot(target);\n  return hostRoot\n    ? target.workspaceCaptureRootIdentity && process.platform === \"linux\"\n      ? await fingerprintHostWorkspace(\n          hostRoot,\n          workspaceFingerprintExcludes(target),\n          target.workspaceCaptureRootIdentity,\n        )\n      : await fingerprintHostBackedWorkspace(hostRoot, workspaceFingerprintExcludes(target))\n    : await fingerprintRemoteWorkspace(target);\n}\n\nfunction fingerprintsEqual(a: WorkspaceTreeFingerprint, b: WorkspaceTreeFingerprint): boolean {\n  return (\n    (a.projection ?? \"gnu_tar_v1\") === (b.projection ?? \"gnu_tar_v1\") &&\n    a.sha256 === b.sha256 &&\n    a.entryCount === b.entryCount &&\n    a.fileCount === b.fileCount &&\n    a.totalFileBytes === b.totalFileBytes\n  );\n}\n\n/** Provider-native persistence returns an opaque receipt and is accepted under\n * the provider/artifact publication fence. A real tar capture is accepted only\n * when the complete persistent tree is byte-identical immediately before and\n * after serialization; a concurrent mutation makes that candidate unusable. */\nexport async function captureVerifiedWorkspaceArchive(\n  session: unknown,\n  capturedAtMs = Date.now(),\n  options?: WorkspaceArchiveCaptureOptions,\n): Promise<VerifiedWorkspaceArchive> {\n  return await withSandboxProviderCapture(\n    session,\n    async () => await captureVerifiedWorkspaceArchiveExclusive(session, capturedAtMs, options),\n    options?.signal,\n  );\n}\n\nasync function captureVerifiedWorkspaceArchiveExclusive(\n  session: unknown,\n  capturedAtMs: number,\n  options?: WorkspaceArchiveCaptureOptions,\n): Promise<VerifiedWorkspaceArchive> {\n  const target = session as WorkspaceSession;\n  await target.assertWorkspaceCaptureAuthority?.();\n  const portableTar = options?.strategy === \"portable_tar\";\n  const persist = portableTar ? target.persistWorkspaceTar : target.persistWorkspace;\n  if (typeof persist !== \"function\") {\n    throw new WorkspaceArchiveIntegrityError(\n      \"workspace_fingerprint_unavailable\",\n      portableTar\n        ? \"sandbox provider policy requires portable tar capture but the session exposes no tar primitive\"\n        : \"sandbox session does not support workspace persistence\",\n    );\n  }\n  const configuredPersistence = target.state?.workspacePersistence;\n  const configuredTarFallback = workspaceFingerprintExcludes(target).length > 0;\n  const expectsNativeSnapshot =\n    !portableTar &&\n    typeof configuredPersistence === \"string\" &&\n    configuredPersistence !== \"tar\" &&\n    !configuredTarFallback;\n  const before = expectsNativeSnapshot ? null : await fingerprintSandboxWorkspace(target);\n  const bytes = portableTar\n    ? await target.persistWorkspaceTar!()\n    : await target.persistWorkspace!(options);\n  if (!bytes || bytes.length === 0) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"archive_base64_invalid\",\n      \"sandbox workspace persistence returned an empty archive\",\n      { retryable: true },\n    );\n  }\n  const nativeSnapshot = decodeNativeSnapshotRef(bytes);\n  if (nativeSnapshot) {\n    const descriptor = describeNativeSnapshotArchive(bytes, capturedAtMs)!;\n    return {\n      bytes,\n      base64: Buffer.from(bytes).toString(\"base64\"),\n      descriptor,\n      kind: \"provider_snapshot\",\n      nativeSnapshot,\n    };\n  }\n  if (expectsNativeSnapshot) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"native_snapshot_fallback_unverified\",\n      `sandbox configured for ${String(configuredPersistence)} returned a tar archive instead of a native snapshot receipt`,\n    );\n  }\n  const after = await fingerprintSandboxWorkspace(target);\n  const capturedProjection =\n    before?.projection === SDK_LOCAL_ARCHIVE_PROJECTION ? fingerprintSdkLocalArchive(bytes) : null;\n  if (\n    !before ||\n    !fingerprintsEqual(before, after) ||\n    (capturedProjection !== null && !fingerprintsEqual(before, capturedProjection))\n  ) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"workspace_changed_during_capture\",\n      \"workspace changed while its durable archive was being captured\",\n      { retryable: true },\n    );\n  }\n  const archiveSha256 = sha256(bytes);\n  const descriptor: TarWorkspaceArchiveDescriptor = {\n    version: 1,\n    revision: `wa1:${String(capturedAtMs).padStart(13, \"0\")}:${archiveSha256}`,\n    archiveSha256,\n    archiveBytes: bytes.length,\n    capturedAt: new Date(capturedAtMs).toISOString(),\n    workspace: before,\n  };\n  return {\n    bytes,\n    base64: Buffer.from(bytes).toString(\"base64\"),\n    descriptor,\n    kind: \"tar\",\n  };\n}\n\nexport async function verifyRestoredWorkspace(\n  session: unknown,\n  descriptor: WorkspaceArchiveDescriptor,\n): Promise<WorkspaceTreeFingerprint | null> {\n  if (descriptor.version === WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION) {\n    return null;\n  }\n  const target = session as WorkspaceSession;\n  // Descriptors written before the projection discriminator always used the\n  // in-sandbox GNU-tar probe, even for Local/Docker. Preserve that exact legacy\n  // behavior; new host-backed descriptors remain independent of image tools.\n  const actual =\n    descriptor.workspace.projection === SDK_LOCAL_ARCHIVE_PROJECTION\n      ? await (() => {\n          const root = hostBackedWorkspaceRoot(target);\n          if (!root) {\n            throw new WorkspaceArchiveIntegrityError(\n              \"workspace_fingerprint_unavailable\",\n              \"selected host-backed workspace archive was restored by a non-host-backed provider\",\n            );\n          }\n          return process.platform === \"linux\"\n            ? fingerprintHostWorkspace(root, workspaceFingerprintExcludes(target))\n            : fingerprintHostBackedWorkspace(root, workspaceFingerprintExcludes(target));\n        })()\n      : await fingerprintRemoteWorkspace(target);\n  if (!fingerprintsEqual(actual, descriptor.workspace)) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"workspace_fingerprint_mismatch\",\n      `restored workspace does not match selected archive revision ${descriptor.revision}`,\n    );\n  }\n  return actual;\n}\n","// The provider registry — PROVIDER_REGISTRY maps each SandboxBackend to its\n// ProviderRegistration. This is the data structure createSandboxClient drives\n// (replacing the old flat if/else chain). The module also owns the\n// descriptor.backendId === SDK client.backendId assertion (deferred from P0.1):\n// it must construct the real SDK clients, so it lives here rather than in the\n// contracts-only capabilities self-test.\n\nimport type { Settings } from \"@opengeni/config\";\nimport {\n  LEGACY_SANDBOX_PROVIDER_INSTANCE_ID_FIELDS,\n  SANDBOX_PROVIDER_INSTANCE_ID_FIELDS_BY_BACKEND,\n  SandboxBackend,\n} from \"@opengeni/contracts\";\nimport type { RuntimeMetricsHooks } from \"../../metrics\";\nimport { assertDescriptorRegistryInvariants } from \"../capabilities\";\nimport { blaxelProvider } from \"./blaxel\";\nimport { cloudflareProvider } from \"./cloudflare\";\nimport { daytonaProvider } from \"./daytona\";\nimport { dockerProvider } from \"./docker\";\nimport { e2bProvider } from \"./e2b\";\nimport { localProvider } from \"./local\";\nimport { modalProvider } from \"./modal\";\nimport { noneProvider } from \"./none\";\nimport { opensandboxProvider } from \"./opensandbox\";\nimport { runloopProvider } from \"./runloop\";\nimport { selfhostedProvider } from \"./selfhosted\";\nimport {\n  providerWorkspacePersistence,\n  type ProviderImmutableImageBuildResult,\n  type ProviderRegistration,\n  type ProviderWorkspaceCapturePolicy,\n} from \"./types\";\nimport { vercelProvider } from \"./vercel\";\n\nexport const PROVIDER_REGISTRY: Record<SandboxBackend, ProviderRegistration> = {\n  docker: dockerProvider,\n  modal: modalProvider,\n  local: localProvider,\n  none: noneProvider,\n  daytona: daytonaProvider,\n  runloop: runloopProvider,\n  e2b: e2bProvider,\n  blaxel: blaxelProvider,\n  cloudflare: cloudflareProvider,\n  vercel: vercelProvider,\n  selfhosted: selfhostedProvider,\n  opensandbox: opensandboxProvider,\n};\n\n// Stub settings carrying every per-provider credential, used ONLY by the\n// boot-time backendId assertion to construct each client without tripping\n// validateCredentials. The SDK client constructors are pure option-stores (the\n// underlying provider SDK is required lazily at create()/resume() time, never at\n// construction — verified against the pinned @openai/agents-extensions 0.14.3), so this is\n// safe with no provider peer dep installed and no network.\nconst ASSERTION_STUB_SETTINGS = {\n  dockerImage: \"opengeni-sandbox:local\",\n  modalAppName: \"opengeni-sandbox\",\n  modalTimeoutSeconds: 900,\n  daytonaApiKey: \"stub\",\n  runloopApiKey: \"stub\",\n  runloopTunnel: true,\n  e2bApiKey: \"stub\",\n  blaxelApiKey: \"stub\",\n  cloudflareWorkerUrl: \"https://stub.example.com\",\n  vercelToken: \"stub\",\n  vercelProjectId: \"stub\",\n  openSandboxBaseUrl: \"https://opensandbox.example.test\",\n  openSandboxApiKey: \"stub\",\n  openSandboxImage:\n    \"ghcr.io/cloudgeni-ai/opengeni-sandbox@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\n} as unknown as Settings;\n\n/**\n * Assert the descriptor table AND that each registered provider's SDK client\n * reports the backendId its descriptor claims. The latter is the\n * deferred-from-P0.1 invariant — it can only run here because it constructs the\n * real clients. Called once at registry build (and from a unit test).\n */\nexport function assertProviderRegistryInvariants(): void {\n  assertDescriptorRegistryInvariants();\n  const knownIdentityFields = new Set<string>(LEGACY_SANDBOX_PROVIDER_INSTANCE_ID_FIELDS);\n  for (const backend of SandboxBackend.options) {\n    const registration = PROVIDER_REGISTRY[backend];\n    if (registration.backend !== backend) {\n      throw new Error(\n        `PROVIDER_REGISTRY[\"${backend}\"].backend mismatch (got \"${registration.backend}\")`,\n      );\n    }\n    if (registration.descriptor.backend !== backend) {\n      throw new Error(\n        `PROVIDER_REGISTRY[\"${backend}\"].descriptor.backend mismatch (got \"${registration.descriptor.backend}\")`,\n      );\n    }\n    const identityFields = [...registration.instanceIdFields];\n    const contractIdentityFields = [...SANDBOX_PROVIDER_INSTANCE_ID_FIELDS_BY_BACKEND[backend]];\n    if (\n      new Set(identityFields).size !== identityFields.length ||\n      identityFields.some((field) => !knownIdentityFields.has(field)) ||\n      identityFields.length !== contractIdentityFields.length ||\n      identityFields.some((field, index) => field !== contractIdentityFields[index])\n    ) {\n      throw new Error(`Provider \"${backend}\" has an invalid live instance identity declaration`);\n    }\n    if (backend === \"none\") {\n      // \"none\" has no SDK client (build returns undefined); the descriptor\n      // backendId \"none\" is self-consistent.\n      if (registration.descriptor.backendId !== \"none\") {\n        throw new Error(\n          `\"none\" descriptor.backendId must be \"none\" (got \"${registration.descriptor.backendId}\")`,\n        );\n      }\n      if (registration.exactResumeMode !== \"none\") {\n        throw new Error('Provider \"none\" must declare exactResumeMode=\"none\"');\n      }\n      continue;\n    }\n    if (registration.exactResumeMode === \"none\") {\n      throw new Error(`Provider \"${backend}\" cannot declare exactResumeMode=\"none\"`);\n    }\n    const client = registration.build({\n      settings: ASSERTION_STUB_SETTINGS,\n      environment: {},\n      exposedPorts: [],\n    });\n    const sdkBackendId = (client as { backendId?: unknown } | undefined)?.backendId;\n    if (typeof sdkBackendId !== \"string\") {\n      throw new Error(`Provider \"${backend}\" SDK client has no string backendId`);\n    }\n    if (sdkBackendId !== registration.descriptor.backendId) {\n      throw new Error(\n        `Provider \"${backend}\" backendId mismatch: descriptor.backendId=\"${registration.descriptor.backendId}\" but SDK client.backendId=\"${sdkBackendId}\"`,\n      );\n    }\n    if (typeof (client as { resume?: unknown }).resume !== \"function\") {\n      throw new Error(`Provider \"${backend}\" SDK client exposes no resume()`);\n    }\n    if (\n      registration.exactResumeMode === \"custom\" &&\n      typeof (client as { resumeExact?: unknown }).resumeExact !== \"function\"\n    ) {\n      throw new Error(`Provider \"${backend}\" requires but exposes no non-replacing resumeExact()`);\n    }\n    if (registration.continuity && registration.exactResumeMode !== \"custom\") {\n      throw new Error(`Provider \"${backend}\" continuity requires custom exact resume`);\n    }\n    const capturePolicy = registration.workspaceCapturePolicy({});\n    if ((backend === \"selfhosted\") !== (capturePolicy === null)) {\n      throw new Error(\n        `Provider \"${backend}\" must explicitly ${\n          backend === \"selfhosted\" ? \"omit\" : \"declare\"\n        } workspace capture`,\n      );\n    }\n    if (capturePolicy?.strategy === \"portable_tar\" && capturePolicy.liveInstance !== \"preserved\") {\n      throw new Error(`Provider \"${backend}\" portable tar capture must preserve its instance`);\n    }\n  }\n}\n\nexport function providerWorkspaceCapturePolicy(\n  backend: string,\n  state: unknown,\n): ProviderWorkspaceCapturePolicy | null {\n  const registration = PROVIDER_REGISTRY[backend as SandboxBackend];\n  return registration?.workspaceCapturePolicy(state) ?? null;\n}\n\n/** True when the provider's workspace capture images the paused box at one\n * instant (Modal native filesystem/directory snapshots), so a command still\n * running cannot tear the captured state across files the way a file-by-file\n * tar read of a running box can. */\nexport function providerWorkspaceCaptureIsPointInTime(backend: string, state: unknown): boolean {\n  if (backend !== \"modal\") return false;\n  const persistence = providerWorkspacePersistence(state);\n  return persistence === \"snapshot_filesystem\" || persistence === \"snapshot_directory\";\n}\n\nexport function prepareProviderForTeardownAfterCapture(backend: string, session: unknown): void {\n  PROVIDER_REGISTRY[backend as SandboxBackend]?.prepareForTeardownAfterCapture?.(session);\n}\n\nexport function providerSupportsImmutableImageBuild(backend: SandboxBackend): boolean {\n  return typeof PROVIDER_REGISTRY[backend].buildImmutableImage === \"function\";\n}\n\nexport async function renewSandboxProviderExpiration(input: {\n  backend: SandboxBackend;\n  settings: Settings;\n  instanceId: string;\n  metrics?: RuntimeMetricsHooks;\n}): Promise<boolean> {\n  const registration = PROVIDER_REGISTRY[input.backend];\n  const renew = registration.renewExpiration;\n  if (!renew) return false;\n  registration.validateCredentials(input.settings);\n  try {\n    await renew({ settings: input.settings, instanceId: input.instanceId });\n    recordProviderRenewalMetric(input.metrics, input.backend, \"completed\");\n    return true;\n  } catch (error) {\n    recordProviderRenewalMetric(input.metrics, input.backend, \"failed\");\n    if (isProviderApiThrottleError(error)) {\n      try {\n        input.metrics?.onSandboxProviderApiThrottle?.({\n          backend: input.backend,\n          operation: \"renew\",\n        });\n      } catch {\n        // Metrics emission must not affect provider lifecycle.\n      }\n    }\n    throw error;\n  }\n}\n\nexport function isProviderApiThrottleError(error: unknown): boolean {\n  if (!error || typeof error !== \"object\") return false;\n  const candidate = error as {\n    status?: unknown;\n    statusCode?: unknown;\n    response?: { status?: unknown };\n  };\n  return (\n    candidate.status === 429 || candidate.statusCode === 429 || candidate.response?.status === 429\n  );\n}\n\nfunction recordProviderRenewalMetric(\n  metrics: RuntimeMetricsHooks | undefined,\n  backend: SandboxBackend,\n  outcome: \"completed\" | \"failed\",\n): void {\n  try {\n    metrics?.onSandboxTtlRenewal?.({ backend, outcome });\n  } catch {\n    // Metrics emission must not affect provider lifecycle.\n  }\n}\n\nexport async function buildImmutableProviderImage(input: {\n  backend: SandboxBackend;\n  settings: Settings;\n  session: unknown;\n  requestId: string;\n  timeoutMs: number;\n}): Promise<ProviderImmutableImageBuildResult | null> {\n  const build = PROVIDER_REGISTRY[input.backend].buildImmutableImage;\n  if (!build) return null;\n  return await build({\n    settings: input.settings,\n    session: input.session,\n    requestId: input.requestId,\n    timeoutMs: input.timeoutMs,\n  });\n}\n\n// Boot-validate the registry once at module load: the descriptor-table self-\n// test PLUS the descriptor.backendId === SDK client.backendId assertion (the\n// deferred-from-P0.1 invariant). The SDK client constructors are pure option-\n// stores (no network, no peer-dep require at construction), so this is a cheap,\n// side-effect-free guard that fails fast on any drift between the static matrix\n// and the installed @openai/agents-extensions.\nassertProviderRegistryInvariants();\n\nexport type {\n  ProviderRegistration,\n  ProviderConstructionContext,\n  ProviderExactResumeMode,\n  ProviderImmutableImageBuildInput,\n  ProviderImmutableImageBuildResult,\n  ProviderExpirationRenewalInput,\n  ProviderWorkspaceCapturePolicy,\n  ProviderWorkspaceCaptureTakeover,\n} from \"./types\";\n","// Capability-descriptor access + boot-time registry invariants (module 03 §2.3).\n//\n// The CapabilityDescriptor type and the CAPABILITY_DESCRIPTORS table-as-data\n// live in @opengeni/contracts (NOT here) so config can read them without an\n// import cycle through runtime (ledger CR8). This module re-exports them for the\n// registry's convenience and owns the boot-time self-test that keeps the table\n// honest as providers are added.\n\nimport {\n  CAPABILITY_DESCRIPTORS,\n  DESKTOP_STREAM_PORT,\n  SandboxBackend,\n  type CapabilityDescriptor,\n} from \"@opengeni/contracts\";\n\nexport { CAPABILITY_DESCRIPTORS, DESKTOP_STREAM_PORT };\nexport type { CapabilityDescriptor };\n\n/**\n * Descriptor-table invariants, asserted once at registry build (and from a unit\n * test). This is the guardrail that keeps the static matrix internally coherent.\n * It validates the descriptor data only; the descriptor.backendId === SDK\n * client.backendId assertion (the deferred-from-P0.1 check) lives in\n * providers/index.ts because it must construct the real SDK clients.\n */\nexport function assertDescriptorRegistryInvariants(): void {\n  for (const backend of SandboxBackend.options) {\n    const descriptor = CAPABILITY_DESCRIPTORS[backend];\n    if (!descriptor) {\n      throw new Error(`No CapabilityDescriptor for backend \"${backend}\"`);\n    }\n    if (descriptor.backend !== backend) {\n      throw new Error(`Descriptor.backend mismatch for \"${backend}\" (got \"${descriptor.backend}\")`);\n    }\n\n    // DesktopStream implies a non-\"none\" port-exposure mechanism (split-plane B\n    // needs a way to surface 6080 to a viewer).\n    if (\n      descriptor.capabilities.DesktopStream.available &&\n      descriptor.portExposure.kind === \"none\"\n    ) {\n      throw new Error(`\"${backend}\" claims DesktopStream but portExposure.kind=none`);\n    }\n\n    // DesktopStream implies a transport, and a desktop transport implies the\n    // capability is available (no half-declared desktop rows).\n    if (\n      descriptor.capabilities.DesktopStream.available &&\n      descriptor.capabilities.DesktopStream.transport === null\n    ) {\n      throw new Error(`\"${backend}\" claims DesktopStream but transport is null`);\n    }\n\n    // Recording feasibility is the same Xvfb display as DesktopStream: a desktop\n    // backend MUST be able to x11grab; a non-desktop backend MUST NOT claim it\n    // (Recording.available == DesktopStream.available && os==linux — Part D).\n    if (\n      descriptor.capabilities.DesktopStream.available !==\n      descriptor.capabilities.Recording.available\n    ) {\n      throw new Error(\n        `\"${backend}\" Recording.available (${descriptor.capabilities.Recording.available}) must equal DesktopStream.available (${descriptor.capabilities.DesktopStream.available})`,\n      );\n    }\n\n    // Persistable backends are the only ones the lease can re-establish from an\n    // envelope — they must carry a real snapshot mechanism.\n    if (descriptor.persistable && descriptor.snapshot.kind === \"none\") {\n      throw new Error(`\"${backend}\" persistable but snapshot.kind=none`);\n    }\n\n    // A nativeBucketMount backend must be desktop/headless-tier real (modal):\n    // a dev/none tier cannot own a provider bucket mount.\n    if (descriptor.nativeBucketMount && (descriptor.tier === \"dev\" || descriptor.tier === \"none\")) {\n      throw new Error(`\"${backend}\" claims nativeBucketMount on tier=${descriptor.tier}`);\n    }\n  }\n}\n","// The uniform per-provider registration shape (module 03 §3.1).\n//\n// One file per provider implements ProviderRegistration; PROVIDER_REGISTRY maps\n// each SandboxBackend to its registration. This replaces the flat if/else chain\n// that createSandboxClient used to be.\n\nimport type { Settings } from \"@opengeni/config\";\nimport type { CapabilityDescriptor, SandboxBackend } from \"@opengeni/contracts\";\nimport type { RuntimeMetricsHooks } from \"../../metrics\";\n\nexport interface ProviderConstructionContext {\n  settings: Settings;\n  /** The env map for the box (collectSandboxEnvironment / per-run environment). */\n  environment: Record<string, string>;\n  /**\n   * Parsed exposed ports (config string -> number[]); already includes the\n   * desktop stream port (6080) when this is a desktop tier with desktop enabled\n   * and the provider cannot expose ports on demand (the merge happens in\n   * createSandboxClient before build()).\n   */\n  exposedPorts: number[];\n  metrics?: RuntimeMetricsHooks;\n}\n\nexport type ProviderImmutableImageBuildResult = {\n  provider: string;\n  backend: SandboxBackend;\n  imageId: string | null;\n  imageDigest: string | null;\n  /** Exact provider account/workspace binding. Persist only a hash publicly. */\n  providerBindingKey: string | null;\n  /** Non-secret canonical binding retained only for durable provider artifact ownership. */\n  providerBinding: Record<string, unknown> | null;\n};\n\nexport type ProviderImmutableImageBuildInput = {\n  settings: Settings;\n  session: unknown;\n  requestId: string;\n  timeoutMs: number;\n};\n\nexport type ProviderExpirationRenewalInput = {\n  settings: Settings;\n  instanceId: string;\n};\n\n/**\n * Crash-recovery contract for one provider's /workspace capture path.\n *\n * - `same_request`: retrying with the durable request id resumes/returns the\n *   same provider operation.\n * - `parallel_read`: the adapter deliberately uses an independently repeatable,\n *   read-only capture (normally a uniquely-named tar); overlapping a predecessor\n *   after worker loss cannot replace or mutate the live sandbox.\n * - `exclusive`: neither property is proven, so an ambiguous predecessor may\n *   never be overlapped while the provider instance is still live.\n */\nexport type ProviderWorkspaceCaptureTakeover = \"same_request\" | \"parallel_read\" | \"exclusive\";\n\nexport type ProviderWorkspaceCapturePolicy = {\n  takeover: ProviderWorkspaceCaptureTakeover;\n  /** `portable_tar` bypasses a provider-native persistence mode whose capture\n   * replaces the live instance or creates an unledgered native artifact. */\n  strategy: \"configured\" | \"portable_tar\";\n  /** Warm checkpoints are legal only when capture preserves the addressed\n   * physical instance. A replacing capture must never run behind a lease whose\n   * provider identity cannot be atomically republished with it. */\n  liveInstance: \"preserved\" | \"replaced\";\n};\n\n/**\n * How Opengeni obtains a non-replacing attachment to the exact persisted\n * provider instance.\n *\n * - `ordinary`: SDK `resume()` is already a pure re-address operation; the\n *   factory exposes it through the explicit `resumeExact()` contract.\n * - `custom`: ordinary resume may restore/recreate, so the adapter itself must\n *   implement `resumeExact()` and fail when the addressed instance is absent.\n * - `none`: the backend has no provider session.\n */\nexport type ProviderExactResumeMode = \"ordinary\" | \"custom\" | \"none\";\n\nexport const REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE = Object.freeze({\n  takeover: \"parallel_read\",\n  strategy: \"configured\",\n  liveInstance: \"preserved\",\n} satisfies ProviderWorkspaceCapturePolicy);\n\nexport const REPEATABLE_PORTABLE_TAR_WORKSPACE_CAPTURE = Object.freeze({\n  takeover: \"parallel_read\",\n  strategy: \"portable_tar\",\n  liveInstance: \"preserved\",\n} satisfies ProviderWorkspaceCapturePolicy);\n\n/** Read SDK workspace persistence without coupling callers to the three shapes\n * used across live sessions, serialized provider state, and lease envelopes. */\nexport function providerWorkspacePersistence(state: unknown): unknown {\n  if (!state || typeof state !== \"object\" || Array.isArray(state)) return undefined;\n  const outer = state as Record<string, unknown>;\n  const liveState =\n    outer.state && typeof outer.state === \"object\" && !Array.isArray(outer.state)\n      ? (outer.state as Record<string, unknown>)\n      : outer;\n  const sessionState =\n    liveState.sessionState &&\n    typeof liveState.sessionState === \"object\" &&\n    !Array.isArray(liveState.sessionState)\n      ? (liveState.sessionState as Record<string, unknown>)\n      : liveState;\n  const providerState =\n    sessionState.providerState &&\n    typeof sessionState.providerState === \"object\" &&\n    !Array.isArray(sessionState.providerState)\n      ? (sessionState.providerState as Record<string, unknown>)\n      : null;\n  return providerState?.workspacePersistence ?? sessionState.workspacePersistence;\n}\n\nexport interface ProviderRegistration {\n  backend: SandboxBackend;\n  exactResumeMode: ProviderExactResumeMode;\n  /** Exact live-session state fields that address this provider. New providers\n   * must declare this explicitly; generic `id` guessing is forbidden. */\n  instanceIdFields: readonly string[];\n  /** Optional identity below the disposable provider execution wrapper. A\n   * matching key licenses a replacement only when the caller supplies a\n   * durable continuity receipt; ordinary attached resumes remain exact. */\n  continuity?: {\n    kind: \"docker_workspace\";\n    keyFromState(state: unknown): string | null;\n    /** Make discarding an unpublished replacement preserve the shared durable\n     * workspace named by the continuity key. */\n    preserveWorkspaceForDiscard(session: unknown, sessionState: unknown): void;\n  };\n  /** Resolve capture semantics from either a live session, a serialized SDK\n   * session state, or Opengeni's outer session envelope. Required for every\n   * provider so new backends cannot silently inherit unsafe teardown behavior.\n   * `null` means the backend has no provider workspace to capture. */\n  workspaceCapturePolicy(state: unknown): ProviderWorkspaceCapturePolicy | null;\n  /** Optional provider preparation after a verified archive is durable and\n   * immediately before generic SDK teardown. This may only suppress redundant\n   * provider persistence; it must not alter durable identity or workspace data. */\n  prepareForTeardownAfterCapture?(session: unknown): void;\n  /**\n   * Build one provider-native immutable image from an already verified clean\n   * sandbox. Omission is the truthful unsupported-provider signal; callers\n   * must retain runtime setup as the fallback.\n   */\n  buildImmutableImage?(\n    input: ProviderImmutableImageBuildInput,\n  ): Promise<ProviderImmutableImageBuildResult>;\n  /** Refresh a renewable provider expiration for one exact live instance.\n   * Omission means the provider has no renewable TTL contract. */\n  renewExpiration?(input: ProviderExpirationRenewalInput): Promise<void>;\n  descriptor: CapabilityDescriptor;\n  /**\n   * Validate that the settings carry the credentials/config this provider\n   * REQUIRES. Throw SandboxConfigError on any missing/contradictory field.\n   * Pure — no network. Called by both the factory and a deploy-time preflight.\n   * The factory calls this before build(), so build() may assume valid settings.\n   */\n  validateCredentials(settings: Settings): void;\n  /**\n   * Build the raw SDK SandboxClient. Returns undefined ONLY for \"none\".\n   * The factory calls validateCredentials() first, so build() can assume valid.\n   */\n  build(ctx: ProviderConstructionContext): unknown;\n}\n","import { BlaxelSandboxClient } from \"@openai/agents-extensions/sandbox/blaxel\";\nimport { CAPABILITY_DESCRIPTORS } from \"../capabilities\";\nimport { SandboxConfigError } from \"../errors\";\nimport { REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE, type ProviderRegistration } from \"./types\";\n\nexport const blaxelProvider: ProviderRegistration = {\n  backend: \"blaxel\",\n  exactResumeMode: \"custom\",\n  instanceIdFields: [\"sandboxIdentity\"],\n  workspaceCapturePolicy: () => REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE,\n  descriptor: CAPABILITY_DESCRIPTORS.blaxel,\n  validateCredentials(settings) {\n    if (!settings.blaxelApiKey) {\n      throw new SandboxConfigError(\"blaxel\", \"OPENGENI_BLAXEL_API_KEY is required\");\n    }\n  },\n  build({ settings, environment }) {\n    // Blaxel exposes ports ON DEMAND (the only such backend) — its options take\n    // no `exposedPorts: number[]` list; 6080 is resolved at handshake time, so\n    // we do NOT pre-declare it here (this is why the factory's 6080-merge is\n    // gated on !supportsOnDemandPorts).\n    const options: NonNullable<ConstructorParameters<typeof BlaxelSandboxClient>[0]> = {\n      apiKey: settings.blaxelApiKey!,\n      env: environment,\n      // persistWorkspace() creates a remote tarball. Bound that provider-native\n      // operation by the same immutable deadline as the durable capture claim;\n      // Opengeni's outer timeout still protects every provider uniformly.\n      timeouts: { workspaceTarTimeoutMs: settings.sandboxSnapshotTimeoutMs },\n    };\n    if (settings.blaxelImage) options.image = settings.blaxelImage;\n    if (settings.blaxelRegion) options.region = settings.blaxelRegion;\n    if (settings.blaxelExposedPortPublic !== undefined) {\n      options.exposedPortPublic = settings.blaxelExposedPortPublic;\n    }\n    if (settings.blaxelExposedPortUrlTtlSeconds) {\n      options.exposedPortUrlTtlS = settings.blaxelExposedPortUrlTtlSeconds;\n    }\n    if (settings.blaxelMemoryMb) options.memory = settings.blaxelMemoryMb;\n    if (settings.blaxelTtl) options.ttl = settings.blaxelTtl;\n    return new BlaxelSandboxClient(options);\n  },\n};\n","import { CloudflareSandboxClient } from \"@openai/agents-extensions/sandbox/cloudflare\";\nimport { CAPABILITY_DESCRIPTORS } from \"../capabilities\";\nimport { SandboxConfigError } from \"../errors\";\nimport { REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE, type ProviderRegistration } from \"./types\";\n\nexport const cloudflareProvider: ProviderRegistration = {\n  backend: \"cloudflare\",\n  exactResumeMode: \"ordinary\",\n  instanceIdFields: [\"sandboxId\"],\n  workspaceCapturePolicy: () => REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE,\n  descriptor: CAPABILITY_DESCRIPTORS.cloudflare,\n  validateCredentials(settings) {\n    // workerUrl is the addressing root for the Cloudflare Sandbox Worker — there\n    // is no construction without it (it is the one non-optional client option).\n    if (!settings.cloudflareWorkerUrl) {\n      throw new SandboxConfigError(\"cloudflare\", \"OPENGENI_CLOUDFLARE_WORKER_URL is required\");\n    }\n  },\n  build({ settings, exposedPorts }) {\n    const options: NonNullable<ConstructorParameters<typeof CloudflareSandboxClient>[0]> = {\n      workerUrl: settings.cloudflareWorkerUrl!,\n      exposedPorts,\n      // `/persist` is an HTTP request rather than the shared remote-tar helper.\n      // Abort its provider transport at the same immutable budget as the\n      // durable capture claim; the outer lifecycle fence still owns settlement.\n      timeouts: { requestTimeoutMs: settings.sandboxSnapshotTimeoutMs },\n    };\n    if (settings.cloudflareApiKey) options.apiKey = settings.cloudflareApiKey;\n    return new CloudflareSandboxClient(options);\n  },\n};\n","import { DaytonaSandboxClient } from \"@openai/agents-extensions/sandbox/daytona\";\nimport { CAPABILITY_DESCRIPTORS } from \"../capabilities\";\nimport { SandboxConfigError } from \"../errors\";\nimport { REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE, type ProviderRegistration } from \"./types\";\nimport { withDaytonaCommandBinding } from \"./daytona-command-binding\";\n\nexport const daytonaProvider: ProviderRegistration = {\n  backend: \"daytona\",\n  exactResumeMode: \"custom\",\n  instanceIdFields: [\"sandboxId\"],\n  workspaceCapturePolicy: () => REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE,\n  descriptor: CAPABILITY_DESCRIPTORS.daytona,\n  validateCredentials(settings) {\n    if (!settings.daytonaApiKey) {\n      throw new SandboxConfigError(\"daytona\", \"OPENGENI_DAYTONA_API_KEY is required\");\n    }\n  },\n  build({ settings, environment, exposedPorts }) {\n    const options: NonNullable<ConstructorParameters<typeof DaytonaSandboxClient>[0]> = {\n      apiKey: settings.daytonaApiKey!,\n      env: environment,\n      exposedPorts,\n    };\n    if (settings.daytonaApiUrl) options.apiUrl = settings.daytonaApiUrl;\n    if (settings.daytonaTarget) options.target = settings.daytonaTarget;\n    if (settings.daytonaImage) options.image = settings.daytonaImage;\n    if (settings.daytonaSnapshotName) options.sandboxSnapshotName = settings.daytonaSnapshotName;\n    // autoStopInterval=0 disables the idle-kill, so forward 0 explicitly.\n    if (settings.daytonaAutoStopInterval !== undefined) {\n      options.autoStopInterval = settings.daytonaAutoStopInterval;\n    }\n    if (settings.daytonaTimeoutSeconds) options.timeoutSec = settings.daytonaTimeoutSeconds;\n    if (settings.daytonaExposedPortUrlTtlSeconds) {\n      options.exposedPortUrlTtlS = settings.daytonaExposedPortUrlTtlSeconds;\n    }\n    return withDaytonaCommandBinding(new DaytonaSandboxClient(options), options);\n  },\n};\n","import {\n  DockerSandboxClient,\n  DockerSandboxSession,\n  type DockerSandboxClientOptions,\n} from \"@openai/agents/sandbox/local\";\nimport { NoopSnapshotSpec } from \"@openai/agents/sandbox\";\nimport { execFile } from \"node:child_process\";\nimport { isAbsolute } from \"node:path\";\nimport { promisify } from \"node:util\";\nimport { CAPABILITY_DESCRIPTORS } from \"../capabilities\";\nimport { SandboxConfigError, SandboxExactResumeInstanceUnavailableError } from \"../errors\";\nimport { REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE, type ProviderRegistration } from \"./types\";\n\nimport {\n  attachDockerWorkspaceForDrain,\n  rememberOwnedDockerSdkState,\n  rememberSerializedDockerOwnership,\n  serializeDockerOwnership,\n} from \"./docker-workspace-drain\";\n\nconst execFileAsync = promisify(execFile);\nconst DOCKER_EXACT_INSPECT_TIMEOUT_MS = 10_000;\nconst DOCKER_INSTANCE_ID = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;\n\ntype DockerResumeState = {\n  containerId?: unknown;\n  image?: unknown;\n  workspaceRootPath?: unknown;\n  workspaceRootOwned?: unknown;\n  snapshot?: unknown;\n};\n\n/** A cold continuity owner is the only caller allowed to replace a missing\n * Docker execution wrapper while preserving its host workspace. The durable\n * provider state carries the image of the missing container; prefer the\n * currently configured image for the replacement so a deployment upgrade\n * cannot publish a new lease image while silently restarting the old one. */\nexport function dockerContinuityResumeStateForImage<T>(\n  state: T,\n  configuredImage: string | undefined,\n): T {\n  const image = configuredImage?.trim();\n  if (!image || !state || typeof state !== \"object\" || Array.isArray(state)) return state;\n  return { ...state, image };\n}\n\nfunction dockerContinuityKey(state: unknown): string | null {\n  if (!state || typeof state !== \"object\" || Array.isArray(state)) return null;\n  const value = state as DockerResumeState;\n  // Opengeni explicitly disables the SDK's local snapshot facility. Requiring\n  // that invariant prevents the SDK from restoring an older local snapshot\n  // over a newer host workspace before restarting the container.\n  return typeof value.workspaceRootPath === \"string\" &&\n    isAbsolute(value.workspaceRootPath) &&\n    value.workspaceRootOwned === true &&\n    (value.snapshot === null || value.snapshot === undefined)\n    ? value.workspaceRootPath\n    : null;\n}\n\nfunction preserveDockerWorkspaceForDiscard(session: unknown, sessionState: unknown): void {\n  for (const candidate of [(session as { state?: unknown } | null)?.state, sessionState]) {\n    if (!candidate || typeof candidate !== \"object\" || Array.isArray(candidate)) continue;\n    (candidate as { workspaceRootOwned?: boolean }).workspaceRootOwned = false;\n  }\n}\n\nfunction dockerInspectMessage(error: unknown): string {\n  if (!error || typeof error !== \"object\") return \"\";\n  const stderr = Reflect.get(error, \"stderr\");\n  return typeof stderr === \"string\" ? stderr.trim() : \"\";\n}\n\nexport function dockerInspectProvesMissing(error: unknown, containerId: string): boolean {\n  const escaped = containerId.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n  return new RegExp(\n    `^(?:Error|Error response from daemon): No such (?:object|container): ${escaped}$`,\n  ).test(dockerInspectMessage(error));\n}\n\nclass OpenGeniDockerSandboxClient extends DockerSandboxClient {\n  readonly #openGeniOptions: DockerSandboxClientOptions;\n\n  constructor(options: DockerSandboxClientOptions = {}) {\n    super(options);\n    this.#openGeniOptions = options;\n  }\n\n  override async create(...args: Parameters<DockerSandboxClient[\"create\"]>) {\n    const session = await super.create(...args);\n    rememberOwnedDockerSdkState(session.state);\n    return session;\n  }\n\n  override async deserializeSessionState(\n    state: Parameters<DockerSandboxClient[\"deserializeSessionState\"]>[0],\n  ) {\n    const restored = await super.deserializeSessionState(state);\n    rememberSerializedDockerOwnership(restored, state);\n    return restored;\n  }\n\n  override async serializeSessionState(\n    state: Parameters<DockerSandboxClient[\"serializeSessionState\"]>[0],\n    options?: Parameters<DockerSandboxClient[\"serializeSessionState\"]>[1],\n  ) {\n    const ownership = await serializeDockerOwnership(this, state);\n    return { ...(await super.serializeSessionState(state, options)), ...ownership };\n  }\n\n  /** Only the server reaper uses this capture-only surface. The network\n   * decorator forwards it without setup, connect or ordinary resume. */\n  async attachWorkspaceForDrain(\n    state: Parameters<DockerSandboxClient[\"resume\"]>[0],\n    assertCurrentCapture: () => Promise<{ archivePublished: boolean }>,\n    options?: Parameters<DockerSandboxClient[\"resume\"]>[1],\n  ) {\n    const archiveLimits =\n      options?.archiveLimits === undefined\n        ? this.#openGeniOptions.archiveLimits\n        : options.archiveLimits;\n    return await attachDockerWorkspaceForDrain(\n      this,\n      state,\n      assertCurrentCapture,\n      undefined,\n      archiveLimits,\n    );\n  }\n\n  /** Ordinary resume is reserved by Opengeni for the elected cold continuity\n   * owner. Exact live attachment uses resumeExact() below and never reimages. */\n  override async resume(\n    state: Parameters<DockerSandboxClient[\"resume\"]>[0],\n    options?: Parameters<DockerSandboxClient[\"resume\"]>[1],\n  ) {\n    const session = await super.resume(\n      dockerContinuityResumeStateForImage(state, this.#openGeniOptions.image),\n      options,\n    );\n    rememberOwnedDockerSdkState(session.state);\n    return session;\n  }\n\n  /** Exact attach must not call the SDK's ordinary resume when the persisted\n   * container is absent: ordinary resume intentionally starts a new container.\n   * The elected recovery owner calls ordinary resume through the shared\n   * continuity protocol instead. */\n  async resumeExact(\n    state: Parameters<DockerSandboxClient[\"resume\"]>[0],\n    options?: Parameters<DockerSandboxClient[\"resume\"]>[1],\n  ) {\n    const containerId = (state as DockerResumeState).containerId;\n    if (typeof containerId !== \"string\" || !DOCKER_INSTANCE_ID.test(containerId)) {\n      throw new SandboxConfigError(\"docker\", \"persisted Docker container identity is invalid\");\n    }\n    try {\n      const result = await execFileAsync(\n        \"docker\",\n        [\"inspect\", \"--type\", \"container\", \"--format\", \"{{.State.Running}}\", containerId],\n        { timeout: DOCKER_EXACT_INSPECT_TIMEOUT_MS, maxBuffer: 64 * 1024 },\n      );\n      if (result.stdout.trim() !== \"true\") {\n        throw new SandboxExactResumeInstanceUnavailableError(\"docker\", containerId);\n      }\n    } catch (error) {\n      if (\n        error instanceof SandboxExactResumeInstanceUnavailableError ||\n        dockerInspectProvesMissing(error, containerId)\n      ) {\n        throw new SandboxExactResumeInstanceUnavailableError(\"docker\", containerId);\n      }\n      throw error;\n    }\n    // Do not call super.resume() after the preflight. The container can vanish\n    // between those operations and the SDK then restores/restarts a replacement.\n    // A direct session wrapper is non-mutating; a later command may fail if the\n    // container stopped after inspect, which is the correct fenced outcome.\n    const archiveLimits =\n      options?.archiveLimits === undefined\n        ? this.#openGeniOptions.archiveLimits\n        : options.archiveLimits;\n    const session = new DockerSandboxSession({\n      state,\n      ...(archiveLimits !== undefined ? { archiveLimits } : {}),\n    });\n    rememberOwnedDockerSdkState(session.state);\n    return session;\n  }\n}\n\nexport const dockerProvider: ProviderRegistration = {\n  backend: \"docker\",\n  exactResumeMode: \"custom\",\n  instanceIdFields: [\"containerId\"],\n  workspaceCapturePolicy: () => REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE,\n  continuity: {\n    kind: \"docker_workspace\",\n    keyFromState: dockerContinuityKey,\n    preserveWorkspaceForDiscard: preserveDockerWorkspaceForDiscard,\n  },\n  descriptor: CAPABILITY_DESCRIPTORS.docker,\n  // Local dev container — no credentials. (The dockerNetwork decoration is\n  // applied by the factory, not here: it wraps the constructed client.)\n  validateCredentials(settings) {\n    const workspaceBaseDir = settings.dockerWorkspaceBaseDir?.trim();\n    if (workspaceBaseDir && !isAbsolute(workspaceBaseDir)) {\n      throw new SandboxConfigError(\n        \"docker\",\n        \"OPENGENI_DOCKER_WORKSPACE_BASE_DIR must be an absolute path\",\n      );\n    }\n  },\n  build({ settings, exposedPorts }) {\n    const workspaceBaseDir = settings.dockerWorkspaceBaseDir?.trim();\n    return new OpenGeniDockerSandboxClient({\n      image: settings.dockerImage,\n      exposedPorts,\n      // The Opengeni archive ledger is the recovery authority. SDK-local\n      // snapshots are process-host artifacts and, more importantly, ordinary\n      // Docker resume may overwrite a newer live host workspace from them.\n      snapshot: new NoopSnapshotSpec(),\n      ...(workspaceBaseDir ? { workspaceBaseDir } : {}),\n    });\n  },\n};\n","import { execFile } from \"node:child_process\";\nimport { isAbsolute, join, resolve } from \"node:path\";\nimport { constants } from \"node:fs\";\nimport { chmod, lstat, open, readdir, realpath, rm } from \"node:fs/promises\";\nimport { promisify } from \"node:util\";\nimport { DockerSandboxSession, type DockerSandboxClient } from \"@openai/agents/sandbox/local\";\nimport type { SandboxArchiveLimits } from \"@openai/agents/sandbox\";\nimport {\n  captureHostWorkspaceArchive,\n  readHostWorkspaceRootIdentity,\n  type HostWorkspaceRootIdentity,\n} from \"../host-archive-spool\";\nimport { SandboxConfigError } from \"../errors\";\n\nconst execFileAsync = promisify(execFile);\ntype NativeProbe = (\n  args: readonly string[],\n  timeout: number,\n) => Promise<{ stdout: string; stderr: string }>;\nconst nativeProbe: NativeProbe = async (args, timeout) =>\n  await execFileAsync(\"docker\", [...args], { timeout, maxBuffer: 1024 * 1024 });\nconst FIELD = \"opengeniDockerWorkspaceOwnership\";\nconst ID = /^[a-f0-9]{64}$/;\nconst UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;\nconst SHA = /^[a-f0-9]{64}$/;\ntype State = Parameters<DockerSandboxClient[\"resume\"]>[0];\ntype Ownership = {\n  version: 1;\n  containerId: string;\n  sessionIdentity: string;\n  daemonId: string;\n  mountFingerprint: string;\n  root: string;\n  sourceRoot: string;\n  identity: HostWorkspaceRootIdentity;\n};\nconst receipts = new WeakMap<object, Ownership>();\nconst ownedSdkStates = new WeakSet<object>();\n\n/** Internal SDK producer identity, not caller metadata or a filesystem grant. */\nexport function rememberOwnedDockerSdkState(state: State): void {\n  ownedSdkStates.add(state);\n}\n\nfunction invalid(message: string): never {\n  throw new SandboxConfigError(\"docker\", \"Docker drain workspace authority: \" + message);\n}\n\nfunction shape(state: State) {\n  if (\n    !ID.test(state.containerId) ||\n    !UUID.test(state.sessionIdentity ?? \"\") ||\n    state.workspaceRootOwned !== true ||\n    !isAbsolute(state.workspaceRootPath) ||\n    resolve(state.workspaceRootPath) !== state.workspaceRootPath ||\n    state.workspaceRootPath === \"/\" ||\n    (state.snapshot !== null && state.snapshot !== undefined)\n  )\n    invalid(\"owned SDK state is unavailable\");\n  return {\n    containerId: state.containerId,\n    sessionIdentity: state.sessionIdentity!,\n    root: state.workspaceRootPath,\n  };\n}\n\nfunction parsedReceipt(value: unknown, state: State): Ownership | null {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return null;\n  const v = value as Ownership;\n  const s = shape(state);\n  if (\n    v.version !== 1 ||\n    v.containerId !== s.containerId ||\n    v.sessionIdentity !== s.sessionIdentity ||\n    v.sourceRoot !== s.root ||\n    typeof v.root !== \"string\" ||\n    !isAbsolute(v.root) ||\n    resolve(v.root) !== v.root ||\n    v.root === \"/\" ||\n    typeof v.daemonId !== \"string\" ||\n    !/^[A-Za-z0-9:_.-]{1,200}$/.test(v.daemonId) ||\n    !SHA.test(v.mountFingerprint) ||\n    !v.identity ||\n    typeof v.identity !== \"object\" ||\n    ![\"dev\", \"ino\", \"uid\", \"gid\", \"mode\"].every(\n      (key) =>\n        typeof v.identity[key as keyof HostWorkspaceRootIdentity] === \"string\" &&\n        /^(?:0|[1-9][0-9]*)$/.test(v.identity[key as keyof HostWorkspaceRootIdentity]),\n    )\n  )\n    invalid(\"protected ownership receipt differs\");\n  return Object.freeze({ ...v, identity: Object.freeze({ ...v.identity }) });\n}\n\n/** Called only for the protected provider-state envelope deserialized by the\n * server lifecycle. This receipt is evidence, not authorization: drain must\n * independently pass the current scoped lease/epoch/capture fence. */\nexport function rememberSerializedDockerOwnership(state: State, serialized: unknown): void {\n  const value =\n    serialized && typeof serialized === \"object\" ? Reflect.get(serialized, FIELD) : undefined;\n  if (value !== undefined) {\n    if (\n      !serialized ||\n      typeof serialized !== \"object\" ||\n      Reflect.get(serialized, \"workspaceRootOwned\") !== true ||\n      Reflect.get(serialized, \"containerId\") !== state.containerId ||\n      Reflect.get(serialized, \"sessionIdentity\") !== state.sessionIdentity ||\n      Reflect.get(serialized, \"workspaceRootPath\") !== state.workspaceRootPath\n    )\n      invalid(\"protected SDK producer state differs\");\n    const receipt = parsedReceipt(value, state);\n    if (!receipt) invalid(\"protected ownership receipt is invalid\");\n    receipts.set(state, receipt);\n  }\n}\n\ntype Observation = {\n  id: string;\n  running: boolean;\n  labels: Record<string, string>;\n  mounts: Array<{ Source: string; Destination: string; Type: string; RW: boolean }>;\n};\n\nasync function daemon(probe: NativeProbe): Promise<string> {\n  const result = await probe([\"info\", \"--format\", \"{{.ID}}\"], 10_000);\n  const id = result.stdout.trim();\n  if (!/^[A-Za-z0-9:_.-]{1,200}$/.test(id) || result.stderr.trim())\n    invalid(\"native daemon observation failed\");\n  return id;\n}\n\nasync function observe(containerId: string, probe: NativeProbe): Promise<Observation | null> {\n  try {\n    const result = await probe(\n      [\n        \"inspect\",\n        \"--type\",\n        \"container\",\n        \"--format\",\n        '{\"id\":{{json .Id}},\"running\":{{json .State.Running}},\"labels\":{{json .Config.Labels}},\"mounts\":{{json .Mounts}}}',\n        containerId,\n      ],\n      10_000,\n    );\n    if (result.stderr.trim()) invalid(\"native container observation failed\");\n    const value = JSON.parse(result.stdout) as Observation;\n    if (\n      value.id !== containerId ||\n      typeof value.running !== \"boolean\" ||\n      !value.labels ||\n      !Array.isArray(value.mounts)\n    )\n      invalid(\"native container identity differs\");\n    return value;\n  } catch (error) {\n    const stderr = error && typeof error === \"object\" ? Reflect.get(error, \"stderr\") : null;\n    if (\n      typeof stderr === \"string\" &&\n      Reflect.get(error as object, \"code\") === 1 &&\n      !Reflect.get(error as object, \"signal\") &&\n      !Reflect.get(error as object, \"killed\") &&\n      new RegExp(\n        \"^(?:Error|Error response from daemon): No such (?:object|container): \" + containerId + \"$\",\n      ).test(stderr.trim())\n    )\n      return null;\n    throw error;\n  }\n}\n\nasync function ownedMount(\n  observation: Observation,\n  state: State,\n  receipt?: Ownership,\n): Promise<{ fingerprint: string; root: string }> {\n  const s = shape(state);\n  const fingerprint = observation.labels[\"openai-agents-sandbox.mount-authority-fingerprint\"];\n  if (\n    observation.labels[\"openai-agents-sandbox\"] !== \"true\" ||\n    observation.labels[\"openai-agents-sandbox.session-identity\"] !== s.sessionIdentity ||\n    !SHA.test(fingerprint ?? \"\") ||\n    (receipt && fingerprint !== receipt.mountFingerprint)\n  )\n    invalid(\"native SDK mount ownership differs\");\n  // The SDK records an actual canonical bind source. Preserve that authority,\n  // including platform-owned aliases such as macOS /var -> /private/var;\n  // content access always uses the recorded canonical source, never the alias.\n  const root = await realpath(s.root);\n  if (\n    (receipt && root !== receipt.root) ||\n    !observation.mounts.some(\n      (m) =>\n        m.Type === \"bind\" &&\n        m.Source === root &&\n        m.Destination === state.manifest.root &&\n        m.RW === true,\n    )\n  )\n    invalid(\"native SDK mount ownership differs\");\n  return { fingerprint: fingerprint!, root };\n}\n\n/** Mint only for a returned SDK producer state or an authenticated exact-live\n * attachment. SDK native reuse validation checks the complete mount authority\n * fingerprint, including inode identity; names and caller shapes do not mint. */\nexport async function serializeDockerOwnership(\n  client: DockerSandboxClient,\n  state: State,\n  probe: NativeProbe = nativeProbe,\n): Promise<Record<string, unknown>> {\n  if (!ownedSdkStates.has(state)) return {};\n  const s = shape(state);\n  const daemonId = await daemon(probe);\n  const native = await observe(s.containerId, probe);\n  if (!native?.running) invalid(\"live SDK ownership could not be verified\");\n  const mount = await ownedMount(native, state);\n  const identity = await readHostWorkspaceRootIdentity(mount.root);\n  if (!(await client.canReusePreservedOwnedSession(state)))\n    invalid(\"live SDK ownership could not be verified\");\n  await readHostWorkspaceRootIdentity(mount.root, identity);\n  if ((await daemon(probe)) !== daemonId) invalid(\"native daemon identity changed\");\n  const receipt = Object.freeze({\n    version: 1 as const,\n    containerId: s.containerId,\n    sessionIdentity: s.sessionIdentity,\n    sourceRoot: s.root,\n    root: mount.root,\n    daemonId,\n    mountFingerprint: mount.fingerprint,\n    identity,\n  });\n  receipts.set(state, receipt);\n  return { [FIELD]: receipt };\n}\n\n/** What happened to the drained host workspace directory after exact\n * container teardown. `retained` is never an error for the drain: the archive\n * is already durably published, so the lease still goes cold. */\nexport type DockerHostWorkspaceRelease =\n  | { status: \"released\" }\n  | { status: \"already_released\" }\n  | { status: \"retained\"; reason: string };\n\nexport type DockerWorkspaceDrainCapture = {\n  state: { workspaceRootPath: string; manifest: State[\"manifest\"] };\n  workspaceCaptureRootIdentity: HostWorkspaceRootIdentity;\n  assertWorkspaceCaptureAuthority: () => Promise<void>;\n  persistWorkspace: () => Promise<Uint8Array>;\n  delete: () => Promise<void>;\n  /** Set by `delete()`; null until teardown ran. */\n  readonly hostWorkspaceRelease: DockerHostWorkspaceRelease | null;\n};\n\nfunction errorCode(error: unknown): unknown {\n  return error && typeof error === \"object\" ? Reflect.get(error, \"code\") : undefined;\n}\n\nfunction reasonOf(error: unknown): string {\n  return (error instanceof Error ? error.message : String(error)).slice(0, 300);\n}\n\n/** True only when both the recorded SDK path and its canonical receipt root\n * are definitively absent. Any other failure keeps the ordinary fence. */\nasync function rootIsAbsent(sourceRoot: string, canonicalRoot: string): Promise<boolean> {\n  for (const path of [sourceRoot, canonicalRoot]) {\n    try {\n      await lstat(path);\n      return false;\n    } catch (error) {\n      if (errorCode(error) !== \"ENOENT\") return false;\n    }\n  }\n  return true;\n}\n\n/** Grants the owner u+rwx on every real descendant directory so read-only\n * trees (the Go module cache is written 0555) can be unlinked. Symlinks are\n * never followed or chmodded, and the root itself is left untouched so its\n * receipt identity (which includes the mode) still authenticates a retry. */\nasync function makeDescendantsRemovable(root: string): Promise<void> {\n  const pending = [root];\n  while (pending.length > 0) {\n    const directory = pending.pop()!;\n    for (const entry of await readdir(directory, { withFileTypes: true })) {\n      if (!entry.isDirectory()) continue;\n      const path = join(directory, entry.name);\n      const stats = await lstat(path);\n      if (!stats.isDirectory()) continue;\n      if ((stats.mode & 0o700) !== 0o700) await grantOwnerAccess(path, stats);\n      pending.push(path);\n    }\n  }\n}\n\n/** chmod through a no-follow directory handle pinned to the inode just\n * lstat'ed, so a path swapped for a symlink or another directory in between\n * is left alone. A directory without read permission cannot be opened; it\n * falls back to a path chmod of the same lstat'ed directory. */\nasync function grantOwnerAccess(\n  path: string,\n  stats: { dev: number; ino: number; mode: number },\n): Promise<void> {\n  const mode = (stats.mode & 0o7777) | 0o700;\n  let handle;\n  try {\n    handle = await open(path, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);\n  } catch (error) {\n    if (errorCode(error) !== \"EACCES\") throw error;\n    await chmod(path, mode);\n    return;\n  }\n  try {\n    const pinned = await handle.stat();\n    if (pinned.dev !== stats.dev || pinned.ino !== stats.ino) {\n      throw new Error(`workspace directory changed during release: ${path}`);\n    }\n    await handle.chmod(mode);\n  } finally {\n    await handle.close();\n  }\n}\n\nasync function removeOwnedTree(root: string): Promise<void> {\n  try {\n    await rm(root, { recursive: true, force: true });\n  } catch (error) {\n    const code = errorCode(error);\n    if (code !== \"EACCES\" && code !== \"EPERM\") throw error;\n    await makeDescendantsRemovable(root);\n    await rm(root, { recursive: true, force: true });\n  }\n}\n\n/** Capture-only attachment: no SDK resume/create, exec, viewer, hydration or\n * close capability. Its root comes from the protected SDK receipt and the\n * current scoped capture fence, never from a path/ownership flag alone. */\nexport async function attachDockerWorkspaceForDrain(\n  client: DockerSandboxClient,\n  state: State,\n  assertCurrentCapture: () => Promise<{ archivePublished: boolean }>,\n  probe: NativeProbe = nativeProbe,\n  archiveLimits?: SandboxArchiveLimits | null,\n): Promise<DockerWorkspaceDrainCapture> {\n  await assertCurrentCapture();\n  const s = shape(state);\n  let receipt = receipts.get(state);\n  if (!receipt) {\n    const native = await observe(s.containerId, probe);\n    // Legacy stopped/missing state has no independent inode/owner receipt.\n    // Preserve its data and lease; neither NotFound nor siblings grant custody.\n    if (!native?.running) invalid(\"legacy stopped/missing workspace has no owned-root receipt\");\n    await ownedMount(native, state);\n    if (!(await client.canReusePreservedOwnedSession(state)))\n      invalid(\"live SDK ownership could not be verified\");\n    rememberOwnedDockerSdkState(state);\n    await serializeDockerOwnership(client, state, probe);\n    receipt = receipts.get(state)!;\n  }\n  const granted = receipt;\n  if (await rootIsAbsent(s.root, granted.root)) {\n    // A previous attempt of this same published drain already tore the\n    // container down and released the host workspace, then died before the\n    // cold commit. Only that exact state may skip the root fence: the archive\n    // is durably published (so no re-arm or continuity can claim this root),\n    // the daemon is unchanged and the exact container is gone.\n    const assertReleased = async () => {\n      if (!(await assertCurrentCapture()).archivePublished)\n        invalid(\"recorded SDK root is missing before durable publication\");\n      if ((await daemon(probe)) !== granted.daemonId) invalid(\"native daemon identity changed\");\n      if (await observe(s.containerId, probe))\n        invalid(\"recorded SDK root is missing while its exact container exists\");\n    };\n    await assertReleased();\n    let release: DockerHostWorkspaceRelease | null = null;\n    const released = () => invalid(\"host workspace was already released after publication\");\n    return {\n      state: { workspaceRootPath: granted.root, manifest: state.manifest },\n      workspaceCaptureRootIdentity: granted.identity,\n      assertWorkspaceCaptureAuthority: async () => released(),\n      persistWorkspace: async () => released(),\n      async delete() {\n        await assertReleased();\n        release = { status: \"already_released\" };\n      },\n      get hostWorkspaceRelease() {\n        return release;\n      },\n    };\n  }\n  const assertAuthority = async () => {\n    await assertCurrentCapture();\n    if ((await daemon(probe)) !== granted.daemonId) invalid(\"native daemon identity changed\");\n    const native = await observe(s.containerId, probe);\n    if ((await realpath(s.root)) !== granted.root) invalid(\"recorded SDK root changed\");\n    if (native) await ownedMount(native, state, granted);\n    await readHostWorkspaceRootIdentity(granted.root, granted.identity);\n  };\n  /** Best effort and never throws: the archive is already durable, and a\n   * throw here would keep the lease draining with a released container. */\n  const releaseHostWorkspace = async (): Promise<DockerHostWorkspaceRelease> => {\n    try {\n      // Re-prove every fence immediately before removal: the same published\n      // capture, the same daemon, the exact container gone (nothing can write\n      // or re-attach through it), and the recorded canonical root still the\n      // receipt's inode/owner/mode. The cold commit that follows is\n      // archive-only and never keeps docker continuity for this root.\n      if (!(await assertCurrentCapture()).archivePublished)\n        return {\n          status: \"retained\",\n          reason: \"capture is no longer durably published\",\n        };\n      if ((await daemon(probe)) !== granted.daemonId)\n        return {\n          status: \"retained\",\n          reason: \"native daemon identity changed\",\n        };\n      if (await observe(s.containerId, probe))\n        return { status: \"retained\", reason: \"exact container still exists\" };\n      if ((await realpath(s.root)) !== granted.root)\n        return { status: \"retained\", reason: \"recorded SDK root changed\" };\n      await readHostWorkspaceRootIdentity(granted.root, granted.identity);\n      await removeOwnedTree(granted.root);\n      return { status: \"released\" };\n    } catch (error) {\n      return { status: \"retained\", reason: reasonOf(error) };\n    }\n  };\n  let release: DockerHostWorkspaceRelease | null = null;\n  await assertAuthority();\n  return {\n    state: { workspaceRootPath: granted.root, manifest: state.manifest },\n    workspaceCaptureRootIdentity: granted.identity,\n    assertWorkspaceCaptureAuthority: assertAuthority,\n    async persistWorkspace() {\n      await assertAuthority();\n      if (process.platform !== \"linux\") {\n        // Preserve the SDK's existing non-Linux archive format/limits. The\n        // borrowed object remains private and exposes no execution or close.\n        const borrowed = new DockerSandboxSession({\n          state: { ...state, workspaceRootPath: granted.root },\n          ...(archiveLimits !== undefined ? { archiveLimits } : {}),\n        });\n        const bytes = await borrowed.persistWorkspace();\n        await assertAuthority();\n        return bytes;\n      }\n      const archive = await captureHostWorkspaceArchive(\n        granted.root,\n        [...state.manifest.ephemeralPersistencePaths()],\n        granted.identity,\n      );\n      try {\n        const chunks: Uint8Array[] = [];\n        for await (const chunk of archive.spool.open()) chunks.push(chunk);\n        return Buffer.concat(chunks);\n      } finally {\n        await archive.spool.dispose();\n      }\n    },\n    async delete() {\n      if (!(await assertCurrentCapture()).archivePublished)\n        invalid(\"exact capture is not durably published\");\n      await assertAuthority();\n      if (await observe(s.containerId, probe)) {\n        // Exact-container teardown, without SDK close (which would also remove\n        // unrelated volumes and skips every fence below).\n        const result = await probe([\"rm\", \"-f\", s.containerId], 30_000);\n        if (result.stderr.trim() || result.stdout.trim() !== s.containerId)\n          invalid(\"exact-container teardown outcome is unknown\");\n      }\n      // Once the published capture's container is gone, nothing references\n      // this host workspace: the lease can only commit cold from an archive.\n      release = await releaseHostWorkspace();\n    },\n    get hostWorkspaceRelease() {\n      return release;\n    },\n  };\n}\n","import { E2BSandboxClient } from \"@openai/agents-extensions/sandbox/e2b\";\nimport { CAPABILITY_DESCRIPTORS } from \"../capabilities\";\nimport { SandboxConfigError } from \"../errors\";\nimport {\n  REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE,\n  REPEATABLE_PORTABLE_TAR_WORKSPACE_CAPTURE,\n  providerWorkspacePersistence,\n  type ProviderRegistration,\n} from \"./types\";\n\nexport const e2bProvider: ProviderRegistration = {\n  backend: \"e2b\",\n  exactResumeMode: \"custom\",\n  instanceIdFields: [\"sandboxId\"],\n  workspaceCapturePolicy: (state) =>\n    providerWorkspacePersistence(state) === \"snapshot\"\n      ? REPEATABLE_PORTABLE_TAR_WORKSPACE_CAPTURE\n      : REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE,\n  descriptor: CAPABILITY_DESCRIPTORS.e2b,\n  validateCredentials(settings) {\n    // The underlying e2b SDK reads E2B_API_KEY from process.env; we mirror it to\n    // settings so a misconfigured deployment fails fast here instead of deep in\n    // the SDK at create() time.\n    if (!settings.e2bApiKey) {\n      throw new SandboxConfigError(\"e2b\", \"OPENGENI_E2B_API_KEY is required\");\n    }\n  },\n  build({ settings, environment, exposedPorts }) {\n    const options: NonNullable<ConstructorParameters<typeof E2BSandboxClient>[0]> = {\n      env: environment,\n      exposedPorts,\n    };\n    if (settings.e2bTemplate) options.template = settings.e2bTemplate;\n    // e2b's `timeout` is in SECONDS (the SDK multiplies by 1000 internally) —\n    // a different unit from Modal's `timeoutMs`.\n    if (settings.e2bTimeoutSeconds) options.timeout = settings.e2bTimeoutSeconds;\n    if (settings.e2bTimeoutAction) options.timeoutAction = settings.e2bTimeoutAction;\n    if (settings.e2bAllowInternetAccess !== undefined) {\n      options.allowInternetAccess = settings.e2bAllowInternetAccess;\n    }\n    if (settings.e2bAutoResume !== undefined) options.autoResume = settings.e2bAutoResume;\n    if (settings.e2bWorkspacePersistence) {\n      options.workspacePersistence = settings.e2bWorkspacePersistence;\n    }\n    return new E2BSandboxClient(options);\n  },\n};\n","import {\n  UnixLocalSandboxClient,\n  UnixLocalSandboxSession,\n  type UnixLocalSandboxClientOptions,\n  type UnixLocalSandboxSessionState,\n} from \"@openai/agents/sandbox/local\";\nimport { NoopSnapshotSpec } from \"@openai/agents/sandbox\";\nimport { lstat } from \"node:fs/promises\";\nimport { isAbsolute } from \"node:path\";\nimport { CAPABILITY_DESCRIPTORS } from \"../capabilities\";\nimport { SandboxConfigError, SandboxExactResumeInstanceUnavailableError } from \"../errors\";\nimport { REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE, type ProviderRegistration } from \"./types\";\n\nfunction isMissingLocalWorkspaceError(error: unknown): boolean {\n  if (!error || typeof error !== \"object\") return false;\n  const code = Reflect.get(error, \"code\");\n  return code === \"ENOENT\" || code === \"ENOTDIR\";\n}\n\nclass OpenGeniUnixLocalSandboxClient extends UnixLocalSandboxClient {\n  readonly #openGeniOptions: UnixLocalSandboxClientOptions;\n\n  constructor(options: UnixLocalSandboxClientOptions = {}) {\n    super(options);\n    this.#openGeniOptions = options;\n  }\n\n  /** The SDK's ordinary resume may restore an older snapshot, including into a\n   * newly-created temporary directory. Exact attachment only re-opens the live\n   * workspace path and therefore never writes or creates provider state. */\n  async resumeExact(\n    state: UnixLocalSandboxSessionState,\n    options: Parameters<UnixLocalSandboxClient[\"resume\"]>[1] = {},\n  ): Promise<UnixLocalSandboxSession> {\n    if (!isAbsolute(state.workspaceRootPath)) {\n      throw new SandboxConfigError(\"local\", \"persisted local workspace path is invalid\");\n    }\n    let entry: Awaited<ReturnType<typeof lstat>>;\n    try {\n      entry = await lstat(state.workspaceRootPath);\n    } catch (error) {\n      if (isMissingLocalWorkspaceError(error)) {\n        throw new SandboxExactResumeInstanceUnavailableError(\"local\", state.workspaceRootPath);\n      }\n      throw error;\n    }\n    // A workspace created by this client is a real directory. Following a\n    // replacement symlink would silently rebind the persisted identity.\n    if (!entry.isDirectory()) {\n      throw new SandboxExactResumeInstanceUnavailableError(\"local\", state.workspaceRootPath);\n    }\n    const archiveLimits =\n      options?.archiveLimits === undefined\n        ? this.#openGeniOptions.archiveLimits\n        : options.archiveLimits;\n    return new UnixLocalSandboxSession({\n      state,\n      ...(this.#openGeniOptions.defaultShell !== undefined\n        ? { defaultShell: this.#openGeniOptions.defaultShell }\n        : {}),\n      ...(archiveLimits !== undefined ? { archiveLimits } : {}),\n    });\n  }\n}\n\nexport const localProvider: ProviderRegistration = {\n  backend: \"local\",\n  exactResumeMode: \"custom\",\n  instanceIdFields: [\"workspaceRootPath\"],\n  workspaceCapturePolicy: () => REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE,\n  descriptor: CAPABILITY_DESCRIPTORS.local,\n  // UnixLocalSandboxClient runs in-process — no credentials, no options.\n  validateCredentials() {},\n  build() {\n    // The durable Opengeni archive ledger owns restoration. A process-local SDK\n    // snapshot is neither portable nor independently governed and can be older\n    // than the still-live workspace path.\n    return new OpenGeniUnixLocalSandboxClient({ snapshot: new NoopSnapshotSpec() });\n  },\n};\n",null,null,"import {\n  ModalImageSelector,\n  ModalSandboxClient,\n  type ModalSandboxSession,\n  type ModalSandboxSessionState,\n} from \"@openai/agents-extensions/sandbox/modal\";\nimport { effectiveModalIdleTimeoutSeconds } from \"@opengeni/config\";\nimport type { Settings } from \"@opengeni/config\";\nimport {\n  canonicalModalCheckpointProviderBinding,\n  type ModalCheckpointProviderBinding,\n} from \"@opengeni/contracts\";\nimport { CAPABILITY_DESCRIPTORS } from \"../capabilities\";\nimport { SandboxChannelAService, type ChannelASession } from \"../channel-a\";\nimport { installModalCommandSession } from \"./modal-command-session\";\nimport {\n  installModalSynchronousCommandCollection,\n  withNativeSynchronousCommandCollection,\n} from \"../native-synchronous-collection\";\nimport { ModalCommandControl } from \"./modal-command-control\";\nimport {\n  ModalCommandStartPreDispatchUnavailableError,\n  ModalCommandStartNotDispatchedError,\n} from \"./modal-command-router-wire\";\nimport { createModalSessionWithLifecycle, type ModalCreateLifecycle } from \"./modal-create-session\";\nimport { isRoutingMutationOutcomeUnknownError } from \"../routing/routing-session\";\nimport type { ModalClient } from \"modal\";\nimport {\n  hasModalCommandStartBoundary,\n  hasModalCommandStartOutcomeUnknownBoundary,\n  installModalCommandStartContext,\n  installModalCommandStartRetention,\n  modalCommandStartHasOwnAccessor,\n  modalCommandStartOwnData,\n} from \"./modal-command-start-errors\";\nimport { ModalProcessObservationUnavailableError, SandboxConfigError } from \"../errors\";\nexport { ModalProcessObservationUnavailableError } from \"../errors\";\nimport { markTypedExecHandleLoss } from \"../exec-banner\";\nimport {\n  REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE,\n  providerWorkspacePersistence,\n  type ProviderRegistration,\n} from \"./types\";\n\nexport type { ModalCheckpointProviderBinding } from \"@opengeni/contracts\";\n\nconst MODAL_ORPHAN_SWEEP_LIMIT = 50;\nconst OPENGENI_MODAL_SDK_VERSION = \"0.9.0\";\nconst MODAL_LIST_DIR_MAX_ENTRIES = 20_000;\n// A provider box is invisible to the lease until Modal create + manifest\n// materialization returns and the creation callback records its instance id.\n// Production baseline (2026-07-15, all 8 turn workers): 155/155 completed creates\n// finished under 10s (154 under 2.5s). Two minutes is a 12x observed-max buffer,\n// while avoiding the former 30-minute retention of boxes abandoned by a rolling\n// worker restart. The live-instance guard below remains authoritative: once a box\n// is recorded by any lease, age and missing/stale tags can never terminate it.\nconst MODAL_UNATTRIBUTED_ORPHAN_GRACE_MS = 2 * 60_000;\n\nexport type ModalSandboxAttribution = {\n  leaseId: string;\n  workspaceId: string;\n  sandboxGroupId: string;\n};\n\nexport type LiveModalSandboxLeaseAttribution = ModalSandboxAttribution & {\n  instanceId: string | null;\n  liveness?: string;\n};\n\nexport type ModalOrphanSweepTermination = {\n  sandboxId: string;\n  reason: \"stale_attribution\" | \"unattributed\";\n  tags: Record<string, string>;\n};\n\nexport type ModalOrphanSweepResult = {\n  examined: number;\n  terminated: ModalOrphanSweepTermination[];\n  skipped: number;\n  /**\n   * Provider/lease reconciliation observed by this pass, judged against the\n   * live-lease snapshot passed in (read before the listing). `unterminated`\n   * holds orphan candidates still running after the pass (termination skipped,\n   * postponed, or failed); `missingLiveLeaseInstanceIds` names live-lease\n   * instances absent from the listing. Both can include a lease transition that\n   * raced the listing, so a caller re-reads durable ownership before reporting\n   * them. Only meaningful when `complete` (the whole app listing was read; the\n   * termination budget can cut a pass short).\n   */\n  inventory: {\n    complete: boolean;\n    running: number;\n    unterminated: ModalOrphanSweepTermination[];\n    missingLiveLeaseInstanceIds: string[];\n  };\n};\n\nexport type RevalidateModalOrphanTermination = (\n  candidate: ModalOrphanSweepTermination,\n) => Promise<boolean>;\n\nexport function modalSandboxAttributionEnvironment(\n  input: ModalSandboxAttribution,\n): Record<string, string> {\n  return {\n    OPENGENI_SANDBOX_LEASE_ID: input.leaseId,\n    OPENGENI_SANDBOX_GROUP_ID: input.sandboxGroupId,\n    OPENGENI_WORKSPACE_ID: input.workspaceId,\n  };\n}\n\nexport function modalSandboxAttributionTags(\n  input: ModalSandboxAttribution,\n): Record<string, string> {\n  return {\n    opengeni: \"true\",\n    opengeni_lease_id: input.leaseId,\n    opengeni_workspace_id: input.workspaceId,\n    opengeni_sandbox_group_id: input.sandboxGroupId,\n  };\n}\n\ntype MutableModalSnapshotSandbox = {\n  exec?: ConstructorParameters<typeof ModalSandboxSession>[0][\"sandbox\"][\"exec\"];\n  terminate?: (options?: { wait?: boolean }) => Promise<unknown>;\n  detach?: () => void;\n  snapshotFilesystem?: (...args: unknown[]) => Promise<unknown>;\n  snapshotDirectory?: (...args: unknown[]) => Promise<unknown>;\n};\n\ntype ModalWorkspaceCaptureOptions = {\n  requestId: string;\n};\n\ntype MutableModalSandboxSession = {\n  close?: () => Promise<void>;\n  // Pinned Agents Extensions 0.14.3 uses this synchronous adapter-local map.\n  activeProcesses?: unknown;\n  modal?: {\n    cpClient?: ModalClient[\"cpClient\"];\n    profile?: ModalClient[\"profile\"];\n    logger?: ModalClient[\"logger\"];\n    version?: () => string;\n    sandboxes?: {\n      fromId?: (sandboxId: string) => Promise<MutableModalSnapshotSandbox>;\n    };\n  };\n  sandbox?: MutableModalSnapshotSandbox;\n  state?: {\n    sandboxId?: string;\n    environment?: Record<string, string>;\n    manifest?: { root?: string };\n    workspacePersistence?: string;\n    snapshotFilesystemTimeoutMs?: number;\n  };\n  execCommand?: ChannelASession[\"execCommand\"];\n  getSynchronousCommandOutput?: ChannelASession[\"getSynchronousCommandOutput\"];\n  cancelPendingExecCommand?: () => Promise<void>;\n  readFile?: ChannelASession[\"readFile\"];\n  listDir?: ChannelASession[\"listDir\"];\n  persistWorkspace?: (options?: ModalWorkspaceCaptureOptions) => Promise<Uint8Array>;\n  writeStdin?: (args: {\n    sessionId: number;\n    chars?: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n  }) => Promise<string>;\n};\n\nconst modalRetentionWrappedSessions = new WeakSet<object>();\nconst modalTerminationWrappedSandboxes = new WeakSet<object>();\nconst modalFilesystemRetentionWrappedSandboxes = new WeakSet<object>();\nconst modalDirectoryRetentionWrappedSandboxes = new WeakSet<object>();\nconst modalSnapshotRequestIds = new WeakMap<object, string>();\nconst modalDirectorySnapshotTimeouts = new WeakMap<object, number | undefined>();\nconst MODAL_TURN_SHELL_MARKER = \"/tmp/opengeni-turn-shell/\";\n\ntype ModalPendingExecStart = {\n  sandbox: MutableModalSnapshotSandbox | null;\n  cancellationRequested: boolean;\n};\n\ntype ModalExecCancellationState = {\n  pending: Set<ModalPendingExecStart>;\n  cancellation: Promise<void> | null;\n};\n\nfunction modalWorkspaceRelativePath(path: string, workspaceRoot: string): string {\n  if (!path.startsWith(\"/\")) return path;\n  const root = workspaceRoot.replace(/\\/+$/, \"\") || \"/\";\n  const normalized = path.replace(/\\/+$/, \"\") || \"/\";\n  if (normalized === root) return \"\";\n  if (root === \"/\") return normalized.slice(1);\n  if (normalized.startsWith(`${root}/`)) return normalized.slice(root.length + 1);\n  throw new Error(`Modal listDir path is outside the workspace root: ${path}`);\n}\n\nfunction modalWorkspaceAbsolutePath(path: string, workspaceRoot: string): string {\n  const root = workspaceRoot.replace(/\\/+$/, \"\") || \"/\";\n  if (!path) return root;\n  return root === \"/\" ? `/${path}` : `${root}/${path}`;\n}\n\nfunction installModalListDirCompatibility(session: MutableModalSandboxSession): void {\n  if (typeof session.listDir === \"function\") return;\n  const execCommand = session.execCommand;\n  const writeStdin = session.writeStdin?.bind(session);\n  const getOutput = session.getSynchronousCommandOutput?.bind(session);\n  if (typeof execCommand !== \"function\" || typeof session.readFile !== \"function\") return;\n  const workspaceRoot = session.state?.manifest?.root;\n  if (!workspaceRoot) {\n    throw new Error(\"Modal listDir compatibility requires a manifest workspace root\");\n  }\n  session.listDir = async (args, commandRunner) => {\n    const absoluteResultPaths = args.path.startsWith(\"/\");\n    const relativePath = modalWorkspaceRelativePath(args.path, workspaceRoot);\n    // This function is the provider's listDir compatibility surface. Do not\n    // pass it back into Channel A as a native accelerator or fsList() recurses\n    // into this shim instead of using Modal's command data plane.\n    const service = new SandboxChannelAService({\n      session: {\n        execCommand: execCommand.bind(session),\n        ...(writeStdin ? { writeStdin } : {}),\n        ...(getOutput ? { getSynchronousCommandOutput: getOutput } : {}),\n        ...(session.cancelPendingExecCommand\n          ? { cancelPendingExecCommand: session.cancelPendingExecCommand.bind(session) }\n          : {}),\n      },\n      ...(commandRunner ? { commandRunner } : {}),\n      workspaceRoot,\n      ...(args.runAs ? { runAs: args.runAs } : {}),\n    });\n    const listed = await withNativeSynchronousCommandCollection(session as ChannelASession, () =>\n      service.fsList({\n        path: relativePath,\n        depth: 1,\n        maxEntries: MODAL_LIST_DIR_MAX_ENTRIES,\n        includeHidden: true,\n      }),\n    );\n    if (listed.truncated || listed.root.truncated) {\n      throw new Error(\n        `Modal listDir exceeded the ${MODAL_LIST_DIR_MAX_ENTRIES}-entry safety bound`,\n      );\n    }\n    return (listed.root.children ?? []).map((entry) => ({\n      name: entry.name,\n      path: absoluteResultPaths\n        ? modalWorkspaceAbsolutePath(entry.path, workspaceRoot)\n        : entry.path,\n      type: entry.type === \"file\" || entry.type === \"dir\" ? entry.type : \"other\",\n    }));\n  };\n}\n\nconst MODAL_EXEC_STDIN_WRITE_PATH =\n  \"/modal.task_command_router.TaskCommandRouter/TaskExecStdinWrite\";\nconst MODAL_EXEC_ALREADY_COMPLETED_DETAILS =\n  /^Exec has already completed; stdin is no longer accepting writes(?: \\(Error code: [A-Z0-9]+\\))?$/;\nconst MODAL_TASK_EXEC_START_ERROR_MAX_DEPTH = 8;\nconst MODAL_TASK_EXEC_START_ERROR_MAX_NODES = 64;\nconst MODAL_TASK_EXEC_START_ERROR_MAX_AGGREGATE_ERRORS = 32;\n\nfunction modalHttpStatus(value: unknown): number | null {\n  if (typeof value !== \"number\" && typeof value !== \"string\") return null;\n  const status = Number(value);\n  return Number.isInteger(status) && status >= 100 && status <= 599 ? status : null;\n}\n\nfunction hasContradictoryModalHttpStatus(record: Record<string, unknown>): boolean {\n  const keys = [\"status\", \"statusCode\", \"httpStatus\", \"httpStatusCode\"];\n  const values = keys.map((key) => modalCommandStartOwnData(record, key));\n  const response = modalCommandStartOwnData(record, \"response\");\n  if (response && typeof response === \"object\") {\n    values.push(...keys.map((key) => modalCommandStartOwnData(response, key)));\n  }\n  return values.some((value) => modalHttpStatus(value) !== null);\n}\n\n/**\n * Only the native client's pre-dispatch readiness gate proves Start was not\n * sent. Server-controlled gRPC/SDK status and DNS-looking details prove nothing.\n * Any retained or outcome-unknown routing boundary vetoes recovery even when\n * it contains a genuine pre-dispatch error among its causes.\n */\nexport function isModalTaskExecStartPreDispatchUnavailableError(error: unknown): boolean {\n  const pending: Array<{ depth: number; value: unknown }> = [{ depth: 0, value: error }];\n  const seen = new WeakSet<object>();\n  let inspected = 0;\n  let matchingLeaves = 0;\n\n  while (pending.length > 0) {\n    if (inspected >= MODAL_TASK_EXEC_START_ERROR_MAX_NODES) return false;\n    const current = pending.shift()!;\n    inspected += 1;\n    if (!current.value || typeof current.value !== \"object\" || seen.has(current.value)) {\n      return false;\n    }\n    if (current.depth > MODAL_TASK_EXEC_START_ERROR_MAX_DEPTH) return false;\n    seen.add(current.value);\n\n    let nested: unknown[];\n    try {\n      const record = current.value as Record<string, unknown>;\n      if (\n        [\n          \"cause\",\n          \"error\",\n          \"errors\",\n          \"response\",\n          \"status\",\n          \"statusCode\",\n          \"httpStatus\",\n          \"httpStatusCode\",\n        ].some((key) => modalCommandStartHasOwnAccessor(record, key))\n      )\n        return false;\n      if (isRoutingMutationOutcomeUnknownError(current.value)) return false;\n      if (hasModalCommandStartBoundary(current.value, \"outcome-unknown\")) return false;\n      if (current.value instanceof ModalCommandStartNotDispatchedError) return false;\n      if (hasContradictoryModalHttpStatus(record)) return false;\n\n      // This instance is created only by the client's readiness gate before\n      // Start dispatch; an RPC's own status or details never enters this path.\n      if (\n        current.value instanceof ModalCommandStartPreDispatchUnavailableError ||\n        hasModalCommandStartBoundary(current.value, \"pre-dispatch-unavailable\")\n      ) {\n        matchingLeaves += 1;\n        continue;\n      }\n\n      nested = [];\n      for (const key of [\"cause\", \"error\"] as const) {\n        const value = modalCommandStartOwnData(record, key);\n        if (value !== undefined) nested.push(value);\n      }\n\n      const errors = modalCommandStartOwnData(record, \"errors\");\n      if (errors !== undefined) {\n        if (\n          !Array.isArray(errors) ||\n          errors.length === 0 ||\n          errors.length > MODAL_TASK_EXEC_START_ERROR_MAX_AGGREGATE_ERRORS\n        ) {\n          return false;\n        }\n        for (let index = 0; index < errors.length; index++)\n          nested.push(modalCommandStartOwnData(errors, String(index)));\n      }\n\n      if (nested.length === 0) return false;\n    } catch {\n      return false;\n    }\n\n    if (current.depth >= MODAL_TASK_EXEC_START_ERROR_MAX_DEPTH) return false;\n    for (const value of nested) {\n      pending.push({ depth: current.depth + 1, value });\n    }\n  }\n\n  return matchingLeaves > 0;\n}\n\n/** Any typed ambiguous Start in a bounded wrapper graph vetoes generic provider\n * retries. Its original IDs are observation authority, never replay authority. */\nexport function isModalCommandStartOutcomeUnknownError(error: unknown): boolean {\n  return hasModalCommandStartOutcomeUnknownBoundary(error);\n}\n\n/**\n * Modal proves that the exact exec has already terminated with a typed\n * FAILED_PRECONDITION from its stdin-write RPC. Keep this deliberately\n * structural and exact: other FAILED_PRECONDITION errors are not process\n * lifetime authority.\n */\nexport function isModalExecAlreadyCompletedError(error: unknown): boolean {\n  if (!error || typeof error !== \"object\") return false;\n  const record = error as {\n    name?: unknown;\n    path?: unknown;\n    code?: unknown;\n    details?: unknown;\n  };\n  return (\n    record.name === \"ClientError\" &&\n    record.path === MODAL_EXEC_STDIN_WRITE_PATH &&\n    record.code === 9 &&\n    typeof record.details === \"string\" &&\n    MODAL_EXEC_ALREADY_COMPLETED_DETAILS.test(record.details)\n  );\n}\n\nfunction assertPinnedModalSdk(session: MutableModalSandboxSession): void {\n  const actualVersion = session.modal?.version?.();\n  if (actualVersion !== OPENGENI_MODAL_SDK_VERSION) {\n    throw new Error(\n      `Opengeni Modal snapshot compatibility requires modal@${OPENGENI_MODAL_SDK_VERSION}; ` +\n        `the active session reported ${actualVersion ?? \"no version\"}`,\n    );\n  }\n}\n\nasync function confirmModalTermination(\n  terminate: (options: { wait: true }) => Promise<unknown>,\n): Promise<number> {\n  // Modal 0.9 resolves terminate() once the stop request is accepted. Only\n  // wait:true observes the provider's terminal result before releasing a lease.\n  const exitCode = await terminate({ wait: true });\n  if (typeof exitCode !== \"number\" || !Number.isInteger(exitCode)) {\n    throw new Error(\"Modal termination did not confirm a terminal exit\");\n  }\n  return exitCode;\n}\n\nfunction installModalTerminationConfirmation(session: MutableModalSandboxSession): void {\n  if (typeof session.close !== \"function\") return;\n  const close = session.close.bind(session);\n  session.close = async () => {\n    // Hydration/cancellation may replace this handle. Install at close time,\n    // retaining the SDK's ownsSandbox check and process/hook cleanup ordering.\n    const sandbox = session.sandbox;\n    if (!sandbox || typeof sandbox.terminate !== \"function\") {\n      throw new Error(\"Modal session does not expose provider termination\");\n    }\n    if (!modalTerminationWrappedSandboxes.has(sandbox)) {\n      const terminate = sandbox.terminate.bind(sandbox);\n      sandbox.terminate = async () => confirmModalTermination(terminate);\n      modalTerminationWrappedSandboxes.add(sandbox);\n    }\n    await close();\n  };\n}\n\nfunction installModalNativeSnapshotRetention(session: MutableModalSandboxSession): void {\n  const persistence = session.state?.workspacePersistence;\n  if (persistence !== \"snapshot_filesystem\" && persistence !== \"snapshot_directory\") {\n    return;\n  }\n  const sandbox = session.sandbox;\n  if (!sandbox || typeof sandbox !== \"object\") {\n    throw new Error(`Modal ${persistence} persistence has no active provider sandbox`);\n  }\n\n  if (persistence === \"snapshot_filesystem\") {\n    if (modalFilesystemRetentionWrappedSandboxes.has(sandbox)) return;\n    const snapshotFilesystem = sandbox.snapshotFilesystem;\n    if (typeof snapshotFilesystem !== \"function\") {\n      throw new Error(\"Modal snapshot_filesystem persistence is unavailable\");\n    }\n    // Agents Extensions 0.13.x still invokes the Modal 0.7 positional timeout\n    // signature. Modal 0.9 moved timeout into an options object and changed the\n    // default Image retention from indefinite to 30 days. Translate at the\n    // provider boundary and retain the Image until Opengeni's artifact ledger\n    // proves it unreferenced and garbage-collects its exact provider id.\n    sandbox.snapshotFilesystem = async (legacyParams?: unknown) => {\n      if (legacyParams !== undefined && typeof legacyParams !== \"number\") {\n        throw new Error(\"Unexpected Modal snapshot_filesystem adapter call shape\");\n      }\n      const requestId = modalSnapshotRequestIds.get(session);\n      if (!requestId) {\n        throw new Error(\"Modal native workspace capture requires a durable request id\");\n      }\n      return await snapshotFilesystem.call(sandbox, {\n        ...(legacyParams === undefined ? {} : { timeoutMs: legacyParams }),\n        ttlMs: null,\n        snapshotId: requestId,\n      });\n    };\n    modalFilesystemRetentionWrappedSandboxes.add(sandbox);\n    return;\n  }\n\n  if (modalDirectoryRetentionWrappedSandboxes.has(sandbox)) return;\n  const snapshotDirectory = sandbox.snapshotDirectory;\n  if (typeof snapshotDirectory !== \"function\") {\n    throw new Error(\"Modal snapshot_directory persistence is unavailable\");\n  }\n  sandbox.snapshotDirectory = async (path?: unknown, legacyParams?: unknown) => {\n    if (typeof path !== \"string\" || legacyParams !== undefined) {\n      throw new Error(\"Unexpected Modal snapshot_directory adapter call shape\");\n    }\n    const requestId = modalSnapshotRequestIds.get(session);\n    if (!requestId) {\n      throw new Error(\"Modal native workspace capture requires a durable request id\");\n    }\n    // Own both timeout and caller id at the provider boundary. The wrapper\n    // around persistWorkspace temporarily disables Agents SDK 0.14.3's second,\n    // outer timeout; otherwise an old timed-out caller can later delete the same\n    // idempotent Image after a recovered caller has already published it.\n    const timeoutMs = modalDirectorySnapshotTimeouts.get(session);\n    return await snapshotDirectory.call(sandbox, path, {\n      ...(timeoutMs === undefined ? {} : { timeoutMs }),\n      ttlMs: null,\n      snapshotId: requestId,\n    });\n  };\n  modalDirectoryRetentionWrappedSandboxes.add(sandbox);\n}\n\nfunction installModalExecCompletionRecovery(session: MutableModalSandboxSession): void {\n  const writeStdin = session.writeStdin;\n  if (typeof writeStdin !== \"function\") return;\n  const observe = async (args: Parameters<typeof writeStdin>[0]) => {\n    // The pinned SDK looks up this map before its first await. Check the same\n    // handle synchronously, with no await before calling it: a missing entry\n    // is observer-state loss, while a real command may print the exact missing\n    // handle banner at ANY exit code. Never classify its output as authority.\n    // An SDK shape change must fail closed rather than reintroduce that guess.\n    if (!(session.activeProcesses instanceof Map)) {\n      throw new ModalProcessObservationUnavailableError(args.sessionId, {\n        reason: \"unsupported_handle_map\",\n      });\n    }\n    if (!session.activeProcesses.has(args.sessionId)) {\n      throw new ModalProcessObservationUnavailableError(args.sessionId, {\n        reason: \"missing_handle\",\n      });\n    }\n    return await writeStdin.call(session, args);\n  };\n  markTypedExecHandleLoss(session);\n  session.writeStdin = async (args) => {\n    try {\n      return await observe(args);\n    } catch (error) {\n      if (\n        !isModalExecAlreadyCompletedError(error) ||\n        !Number.isSafeInteger(args.sessionId) ||\n        args.sessionId <= 0\n      ) {\n        throw error;\n      }\n      // The process can finish between the SDK lookup and the provider stdin\n      // write. An empty poll may recover its exact terminal result; never replay\n      // stdin, and never turn failure to observe that result into loss proof.\n      try {\n        return await observe({ ...args, chars: \"\" });\n      } catch (cause) {\n        throw new ModalProcessObservationUnavailableError(args.sessionId, { cause });\n      }\n    }\n  };\n}\n\nfunction installModalPendingExecCancellation(session: MutableModalSandboxSession): void {\n  if (session.cancelPendingExecCommand) return;\n  if (\n    typeof session.execCommand !== \"function\" ||\n    typeof session.sandbox?.detach !== \"function\" ||\n    typeof session.modal?.sandboxes?.fromId !== \"function\" ||\n    !session.state?.sandboxId\n  ) {\n    return;\n  }\n  const state: ModalExecCancellationState = {\n    pending: new Set(),\n    cancellation: null,\n  };\n  const execCommand = session.execCommand.bind(session);\n  session.execCommand = async (args) => {\n    const command =\n      args && typeof args === \"object\" && typeof (args as { cmd?: unknown }).cmd === \"string\"\n        ? (args as { cmd: string }).cmd\n        : null;\n    if (!command?.includes(MODAL_TURN_SHELL_MARKER)) {\n      return await execCommand(args);\n    }\n\n    // A yielded ContainerProcess owns its command-router connection. Give each\n    // turn-owned start a separate handle so aborting a stuck TaskExecStart can\n    // never break stdin/control for an older, already-yielded command.\n    const pending: ModalPendingExecStart = {\n      sandbox: null,\n      cancellationRequested: false,\n    };\n    state.pending.add(pending);\n    try {\n      const sandbox = await session.modal!.sandboxes!.fromId!(session.state!.sandboxId!);\n      pending.sandbox = sandbox;\n      if (pending.cancellationRequested) {\n        sandbox.detach?.();\n        throw new Error(\"Modal exec start was cancelled before provider yield\");\n      }\n      session.sandbox = sandbox;\n      return await execCommand(args);\n    } finally {\n      state.pending.delete(pending);\n    }\n  };\n\n  session.cancelPendingExecCommand = async () => {\n    if (!state.cancellation) {\n      state.cancellation = (async () => {\n        const pendingStarts = [...state.pending];\n        const detached = new Set<MutableModalSnapshotSandbox>();\n        for (const start of pendingStarts) {\n          start.cancellationRequested = true;\n          if (start.sandbox) {\n            start.sandbox.detach?.();\n            detached.add(start.sandbox);\n          }\n        }\n        // Keep the session usable for the token/PGID proof helper. Handles for\n        // already-yielded commands were removed from `pending` and stay open.\n        if (session.sandbox && detached.has(session.sandbox)) {\n          const replacement = await session.modal!.sandboxes!.fromId!(session.state!.sandboxId!);\n          if (session.sandbox && detached.has(session.sandbox)) {\n            session.sandbox = replacement;\n            installModalNativeSnapshotRetention(session);\n          } else {\n            replacement.detach?.();\n          }\n        }\n      })().finally(() => {\n        state.cancellation = null;\n      });\n    }\n    await state.cancellation;\n  };\n}\n\n/**\n * Bridge the pinned Agents Extensions Modal adapter to Modal 0.9's provider\n * contracts. The wrapper re-checks the private provider sandbox on every\n * capture because snapshot_filesystem hydration replaces that object.\n */\nexport function installOpenGeniModalSnapshotPolicy<T extends object>(session: T): T {\n  const mutable = session as MutableModalSandboxSession;\n  if (modalRetentionWrappedSessions.has(session)) return session;\n  if (typeof mutable.persistWorkspace !== \"function\") {\n    throw new Error(\"Modal session does not expose workspace persistence\");\n  }\n  assertPinnedModalSdk(mutable);\n  if (mutable.modal) installModalCommandStartContext(mutable.modal);\n  installModalTerminationConfirmation(mutable);\n  installModalNativeSnapshotRetention(mutable);\n  installModalExecCompletionRecovery(mutable);\n  installModalPendingExecCancellation(mutable);\n  installModalSynchronousCommandCollection(mutable, () => mutable.sandbox);\n  installModalListDirCompatibility(mutable);\n  if (\n    mutable.modal?.cpClient &&\n    mutable.modal.version &&\n    mutable.state?.sandboxId &&\n    mutable.state.manifest?.root\n  ) {\n    if (!mutable.modal.profile)\n      throw new Error(\"Modal command control requires its original authenticated SDK profile\");\n    installModalCommandSession(\n      mutable,\n      ModalCommandControl.forSandbox(\n        {\n          cpClient: mutable.modal.cpClient,\n          version: mutable.modal.version.bind(mutable.modal),\n          profile: mutable.modal.profile,\n          ...(mutable.modal.logger ? { logger: mutable.modal.logger } : {}),\n        },\n        () => {\n          const sandboxId = mutable.state?.sandboxId;\n          if (!sandboxId) throw new Error(\"Modal session sandbox identity is unavailable\");\n          return sandboxId;\n        },\n        mutable.state.manifest.root,\n        () => mutable.state?.environment ?? {},\n      ),\n    );\n  }\n  const persistWorkspace = mutable.persistWorkspace.bind(session);\n  mutable.persistWorkspace = async (options?: ModalWorkspaceCaptureOptions) => {\n    assertPinnedModalSdk(mutable);\n    installModalNativeSnapshotRetention(mutable);\n    if (\n      (mutable.state?.workspacePersistence === \"snapshot_filesystem\" ||\n        mutable.state?.workspacePersistence === \"snapshot_directory\") &&\n      (!options ||\n        !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(\n          options.requestId,\n        ))\n    ) {\n      throw new Error(\"Modal native workspace capture requires a valid UUID request id\");\n    }\n    const nativePersistence =\n      mutable.state?.workspacePersistence === \"snapshot_filesystem\" ||\n      mutable.state?.workspacePersistence === \"snapshot_directory\";\n    if (options && nativePersistence) {\n      modalSnapshotRequestIds.set(session, options.requestId);\n    }\n    const directoryTimeout =\n      mutable.state?.workspacePersistence === \"snapshot_directory\"\n        ? mutable.state.snapshotFilesystemTimeoutMs\n        : undefined;\n    const directoryTimeoutWasPresent =\n      mutable.state?.workspacePersistence === \"snapshot_directory\" &&\n      Object.hasOwn(mutable.state, \"snapshotFilesystemTimeoutMs\");\n    if (mutable.state?.workspacePersistence === \"snapshot_directory\") {\n      modalDirectorySnapshotTimeouts.set(session, directoryTimeout);\n      // The wrapped provider call above owns this exact timeout. Disable the\n      // SDK's lossy late-result deletion race for the duration of this exclusive\n      // capture, then restore the serialized session field byte-for-byte.\n      delete mutable.state.snapshotFilesystemTimeoutMs;\n    }\n    try {\n      return await persistWorkspace();\n    } finally {\n      modalSnapshotRequestIds.delete(session);\n      if (mutable.state?.workspacePersistence === \"snapshot_directory\") {\n        if (directoryTimeoutWasPresent) {\n          Reflect.set(mutable.state, \"snapshotFilesystemTimeoutMs\", directoryTimeout);\n        } else {\n          delete mutable.state.snapshotFilesystemTimeoutMs;\n        }\n        modalDirectorySnapshotTimeouts.delete(session);\n      }\n    }\n  };\n  modalRetentionWrappedSessions.add(session);\n  installModalCommandStartRetention(session);\n  return session;\n}\n\nexport class OpenGeniModalSandboxClient extends ModalSandboxClient {\n  readonly #snapshotFilesystemTimeoutMs: number | undefined;\n  readonly #createOptions: NonNullable<ConstructorParameters<typeof ModalSandboxClient>[0]>;\n\n  constructor(...args: ConstructorParameters<typeof ModalSandboxClient>) {\n    super(...args);\n    this.#snapshotFilesystemTimeoutMs = args[0]?.snapshotFilesystemTimeoutMs;\n    this.#createOptions = { ...args[0] };\n  }\n\n  override async create(\n    args?: Parameters<ModalSandboxClient[\"create\"]>[0],\n    manifestOptions?: Parameters<ModalSandboxClient[\"create\"]>[1],\n  ): Promise<ModalSandboxSession> {\n    const session = await super.create(args, manifestOptions);\n    return installOpenGeniModalSnapshotPolicy(session);\n  }\n\n  async createWithLifecycle(\n    args: Parameters<ModalSandboxClient[\"create\"]>[0],\n    lifecycle: ModalCreateLifecycle,\n  ): Promise<ModalSandboxSession> {\n    return await createModalSessionWithLifecycle(\n      this.#createOptions,\n      args,\n      lifecycle,\n      installOpenGeniModalSnapshotPolicy,\n    );\n  }\n\n  override async resume(state: ModalSandboxSessionState): Promise<ModalSandboxSession> {\n    // Snapshot timeout is an operator-controlled execution budget, not durable\n    // provider identity. Older resume envelopes legitimately retain the value\n    // that was current when the box was created; letting that stale value win\n    // makes a later production increase ineffective exactly when a large\n    // workspace needs it. Rebind only this operational field while preserving\n    // every provider-identity and filesystem field byte-for-byte.\n    const effectiveState =\n      this.#snapshotFilesystemTimeoutMs === undefined ||\n      state.snapshotFilesystemTimeoutMs === this.#snapshotFilesystemTimeoutMs\n        ? state\n        : {\n            ...state,\n            snapshotFilesystemTimeoutMs: this.#snapshotFilesystemTimeoutMs,\n          };\n    const session = await super.resume(effectiveState);\n    return installOpenGeniModalSnapshotPolicy(session);\n  }\n}\n\nexport const modalProvider: ProviderRegistration = {\n  backend: \"modal\",\n  exactResumeMode: \"ordinary\",\n  instanceIdFields: [\"sandboxId\"],\n  workspaceCapturePolicy(state) {\n    const persistence = providerWorkspacePersistence(state);\n    if (persistence === \"snapshot_filesystem\" || persistence === \"snapshot_directory\") {\n      return {\n        takeover: \"same_request\",\n        strategy: \"configured\",\n        liveInstance: \"preserved\",\n      };\n    }\n    return REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE;\n  },\n  async buildImmutableImage({ settings, session, requestId, timeoutMs }) {\n    const mutable = session as MutableModalSandboxSession;\n    const sandboxId = mutable.state?.sandboxId;\n    const sandboxes = mutable.modal?.sandboxes;\n    if (!sandboxId || typeof sandboxes?.fromId !== \"function\") {\n      throw new Error(\"Modal provider image build requires an exact live sandbox identity\");\n    }\n    const snapshotHandle = await sandboxes.fromId(sandboxId);\n    try {\n      if (typeof snapshotHandle.snapshotFilesystem !== \"function\") {\n        throw new Error(\"Modal provider image build requires snapshotFilesystem support\");\n      }\n      const image = (await snapshotHandle.snapshotFilesystem({\n        snapshotId: requestId,\n        timeoutMs,\n        ttlMs: null,\n      })) as { imageId?: unknown; objectId?: unknown };\n      const imageId =\n        typeof image.imageId === \"string\"\n          ? image.imageId\n          : typeof image.objectId === \"string\"\n            ? image.objectId\n            : null;\n      if (!imageId) {\n        throw new Error(\"Modal provider image snapshot returned no immutable image id\");\n      }\n      const binding = await resolveModalCheckpointProviderBindingForSession(settings, session);\n      return {\n        provider: \"modal\",\n        backend: \"modal\",\n        imageId,\n        imageDigest: null,\n        providerBindingKey: binding.key,\n        providerBinding: binding.binding,\n      };\n    } finally {\n      snapshotHandle.detach?.();\n    }\n  },\n  descriptor: CAPABILITY_DESCRIPTORS.modal,\n  validateCredentials(settings) {\n    // both-or-neither (preserves existing validation at config validateSettings).\n    if (Boolean(settings.modalTokenId) !== Boolean(settings.modalTokenSecret)) {\n      throw new SandboxConfigError(\n        \"modal\",\n        \"OPENGENI_MODAL_TOKEN_ID and OPENGENI_MODAL_TOKEN_SECRET must both be set or both omitted\",\n      );\n    }\n    if (!settings.modalAppName) {\n      throw new SandboxConfigError(\"modal\", \"OPENGENI_MODAL_APP_NAME is required\");\n    }\n  },\n  build({ settings, environment, exposedPorts }) {\n    const options: NonNullable<ConstructorParameters<typeof ModalSandboxClient>[0]> = {\n      appName: settings.modalAppName,\n      timeoutMs: settings.modalTimeoutSeconds * 1000,\n      sandboxCreateTimeoutS: Math.ceil(settings.sandboxWarmingTimeoutMs / 1000),\n      // The Agents Extensions session persists this value in its provider\n      // state and passes it to persistWorkspace(). Keep it aligned with the\n      // same current setting that bounds Opengeni's outer capture operation.\n      snapshotFilesystemTimeoutMs: settings.sandboxSnapshotTimeoutMs,\n      exposedPorts,\n      env: environment,\n      // A registry image's own CMD is not a sandbox keepalive contract (for\n      // example, python:3.12-slim can exit immediately). Keep the provider's\n      // control process alive so exec/resume remains available; Modal's hard\n      // timeout and explicit Opengeni teardown still own the box lifetime.\n      useSleepCmd: true,\n    };\n    // gap-fill (module 03 §4.1): these SDK options were previously unmapped.\n    // ALWAYS pin idleTimeoutMs (sandbox-file-persistence): an UNSET idle timeout\n    // lets the SDK send idleTimeoutSecs=undefined, so Modal applies its short\n    // server-default idle-reap and kills an idle (between-turns) box LONG before\n    // Opengeni's reaper can resume+snapshot it. effectiveModalIdleTimeoutSeconds\n    // defaults this to the hard lifetime so the box survives its full warm window\n    // and the reaper — not Modal's idle-reap — governs teardown (and snapshots\n    // /workspace first).\n    options.idleTimeoutMs = effectiveModalIdleTimeoutSeconds(settings) * 1000;\n    if (settings.modalSandboxCpu !== undefined) {\n      options.cpu = settings.modalSandboxCpu;\n    }\n    if (settings.modalSandboxMemoryMiB !== undefined) {\n      options.memoryMiB = settings.modalSandboxMemoryMiB;\n    }\n    if (settings.modalWorkspacePersistence) {\n      options.workspacePersistence = settings.modalWorkspacePersistence;\n    }\n    const imageSelector = resolveModalImageSelector(settings);\n    if (imageSelector) {\n      options.image = imageSelector;\n    }\n    if (settings.modalTokenId) {\n      options.tokenId = settings.modalTokenId;\n    }\n    if (settings.modalTokenSecret) {\n      options.tokenSecret = settings.modalTokenSecret;\n    }\n    if (settings.modalEnvironment) {\n      options.environment = settings.modalEnvironment;\n    }\n    return new OpenGeniModalSandboxClient(options);\n  },\n};\n\ntype ModalModule = typeof import(\"modal\");\ntype ModalClientLike = InstanceType<ModalModule[\"ModalClient\"]>;\n\n// --- Modal provider-native / private-registry image resolution --------------------\n//\n// OPENGENI_MODAL_IMAGE_ID is the preferred immutable provider-native path. The\n// Agents extension resolves it with ModalImageSelector.fromId and serializes the\n// actual imageId into the session state, while modalImageRef remains the logical\n// digest persisted on the Opengeni lease.\n//\n// The Agents-extension Modal backend resolves `modalImageRef` via\n// `Image.fromRegistry(tag)` with NO secret, so it can only pull PUBLIC images. To run\n// a PRIVATE image we resolve the named Modal Secret and pre-build the authenticated\n// `fromRegistry(tag, secret)` image ONCE per process, then hand the provider `build`\n// a `ModalImageSelector.fromImage(...)`. `build` is synchronous and modal is imported\n// lazily (never loaded for non-modal backends), so resolution can't happen inside\n// `build`; the worker awaits `ensureModalRegistryImage` at boot for global refs and\n\n// images are lazy, workspace-scoped definitions, so an image built by this module's\n// client is usable by the ModalSandboxClient's own client.\n\n/** Loader seam so unit tests can inject a fake modal module. */\nexport type ModalModuleLoader = () => Promise<Pick<ModalModule, \"ModalClient\">>;\n\nconst defaultModalLoader: ModalModuleLoader = () => import(\"modal\");\n\n/** Settled, synchronously-readable resolved images, keyed per config. */\nconst resolvedRegistryImages = new Map<string, unknown>();\n/** In-flight resolutions, for cross-call de-duplication. */\nconst inFlightRegistryImages = new Map<string, Promise<void>>();\nconst MODAL_AUTHENTICATED_REGISTRY_LABEL = \"LABEL io.opengeni.registry-import=authenticated\";\n\nfunction registryImageCacheKey(settings: Settings): string {\n  return [\n    settings.modalImageRef ?? \"\",\n    settings.modalImageRegistrySecret ?? \"\",\n    settings.modalEnvironment ?? \"\",\n  ].join(\"|\");\n}\n\nexport async function ensureModalRegistryImage(\n  settings: Settings,\n  loadModal: ModalModuleLoader = defaultModalLoader,\n): Promise<void> {\n  // A provider-native immutable image ID bypasses registry import entirely.\n  // ModalImageSelector.fromId resolves it during sandbox creation and the\n  // provider session state records that exact ID.\n  if (settings.modalImageId) {\n    return;\n  }\n  if (!settings.modalImageRegistrySecret || !settings.modalImageRef) {\n    return;\n  }\n  const key = registryImageCacheKey(settings);\n  if (resolvedRegistryImages.has(key)) {\n    return;\n  }\n  let pending = inFlightRegistryImages.get(key);\n  if (!pending) {\n    pending = (async () => {\n      const modal = await loadModal();\n      const client = new modal.ModalClient(modalClientOptions(settings));\n      // Resolve the Secret via the AUTHENTICATED client (client.secrets.fromName),\n      // NOT the static `modal.Secret.fromName`, which resolves against\n      // `getDefaultClient()` — i.e. the standard MODAL_TOKEN_ID/MODAL_TOKEN_SECRET env\n      // or ~/.modal.toml — and so would throw \"Profile is missing token_id\" in any host\n      // that supplies the token only through Opengeni settings (OPENGENI_MODAL_TOKEN_ID).\n      const secret = await client.secrets.fromName(\n        settings.modalImageRegistrySecret!,\n        settings.modalEnvironment ? { environment: settings.modalEnvironment } : undefined,\n      );\n      // fromRegistry is synchronous and returns a lazy image definition. Build it\n      // here with the same authenticated client that resolved the registry Secret.\n      // Passing the lazy definition into ModalSandboxClient crosses a ModalClient\n      // boundary and makes every sandbox creation hydrate/import it again; registry\n      // auth can then be lost and failed imports become sticky image builds. A built\n      // provider-native Image is immutable, reusable, and contains no registry\n      // credential boundary for the sandbox client to reconstruct.\n      const app = await client.apps.fromName(settings.modalAppName, {\n        ...(settings.modalEnvironment ? { environment: settings.modalEnvironment } : {}),\n        createIfMissing: true,\n      });\n      const registryImage = (forceBuild: boolean) =>\n        client.images\n          .fromRegistry(settings.modalImageRef!, secret)\n          .dockerfileCommands([MODAL_AUTHENTICATED_REGISTRY_LABEL], {\n            ...(forceBuild ? { forceBuild: true } : {}),\n          });\n      let builtImage;\n      try {\n        builtImage = await registryImage(false).build(app);\n      } catch {\n        // Modal memoizes registry-import failures by image definition. A\n        // corrected/rotated Secret would otherwise receive the same stale\n        // failed Image forever. Retry exactly once with the same deterministic\n        // definition and Modal's explicit force-build bit; successful imports\n        // remain cached normally on later worker starts.\n        builtImage = await registryImage(true).build(app);\n      }\n      resolvedRegistryImages.set(key, builtImage);\n    })().finally(() => {\n      inFlightRegistryImages.delete(key);\n    });\n    inFlightRegistryImages.set(key, pending);\n  }\n  await pending;\n}\n\n/** The resolved private-registry image for these settings, or undefined if none. */\nfunction cachedModalRegistryImage(settings: Settings): unknown | undefined {\n  if (!settings.modalImageRegistrySecret || !settings.modalImageRef) {\n    return undefined;\n  }\n  return resolvedRegistryImages.get(registryImageCacheKey(settings));\n}\n\n/**\n * Choose the image selector for a Modal sandbox client from settings. Returns:\n *  - `fromId(modalImageId)` when a provider-native immutable ID is configured;\n *  - `fromImage(resolved)` when a private-registry secret is configured AND the\n *    image has been resolved (ensureModalRegistryImage ran before create);\n *  - `fromTag(modalImageRef)` for the public path (no secret, or cold cache — the\n *    resume/attach paths never pull an image so the tag branch is harmless there);\n *  - `undefined` when no image ref is set (Modal uses its default image).\n * Exported for unit tests.\n */\nexport function resolveModalImageSelector(settings: Settings): ModalImageSelector | undefined {\n  if (settings.modalImageId) {\n    return ModalImageSelector.fromId(settings.modalImageId);\n  }\n  if (!settings.modalImageRef) {\n    return undefined;\n  }\n  const registryImage = cachedModalRegistryImage(settings);\n  return registryImage\n    ? ModalImageSelector.fromImage(\n        registryImage as Parameters<typeof ModalImageSelector.fromImage>[0],\n      )\n    : ModalImageSelector.fromTag(settings.modalImageRef);\n}\n\n/** Test-only: clear the resolved/in-flight image caches. */\nexport function __resetModalRegistryImageCacheForTest(): void {\n  resolvedRegistryImages.clear();\n  inFlightRegistryImages.clear();\n}\n\nfunction modalClientOptions(\n  settings: Settings,\n): ConstructorParameters<ModalModule[\"ModalClient\"]>[0] {\n  return {\n    ...(settings.modalTokenId ? { tokenId: settings.modalTokenId } : {}),\n    ...(settings.modalTokenSecret ? { tokenSecret: settings.modalTokenSecret } : {}),\n    ...(settings.modalEnvironment ? { environment: settings.modalEnvironment } : {}),\n  };\n}\n\nasync function createModalClient(settings: Settings): Promise<ModalClientLike> {\n  const modal = await import(\"modal\");\n  return new modal.ModalClient(modalClientOptions(settings));\n}\n\nfunction isModalNotFoundError(error: unknown): boolean {\n  const candidate = error as {\n    name?: unknown;\n    code?: unknown;\n  };\n  // The pinned Modal SDK normalizes image/sandbox NOT_FOUND and its documented\n  // FAILED_PRECONDITION alias to NotFoundError. Numeric gRPC code 5 is retained\n  // for narrow adapter/fake compatibility. Never classify message text: an auth,\n  // workspace, DNS, or proxy error containing \"not found\" is not deletion proof.\n  return candidate?.name === \"NotFoundError\" || candidate?.code === 5;\n}\n\nasync function modalCheckpointProviderBindingForClient(\n  settings: Settings,\n  modal: ModalClientLike,\n): Promise<ModalCheckpointProviderBinding> {\n  const identity = await modal.cpClient.workspaceNameLookup({});\n  const workspaceName = identity.workspaceName || identity.username;\n  if (!workspaceName) {\n    throw new Error(\"Modal credential resolved no workspace identity\");\n  }\n  const resolved = canonicalModalCheckpointProviderBinding({\n    version: 1,\n    serverUrl: modal.profile.serverUrl,\n    workspaceName,\n    // Resolve through the authenticated client, not the optional Opengeni\n    // override alone. When the override is absent Modal may select a profile\n    // environment; persisting \"\" would fail to fence a later profile change.\n    environment: modal.environmentName(settings.modalEnvironment),\n  });\n  if (!resolved) {\n    throw new Error(\"Modal credential resolved an invalid checkpoint provider identity\");\n  }\n  return resolved.binding;\n}\n\nconst modalSessionCheckpointBindings = new WeakMap<\n  object,\n  Promise<{ key: string; binding: ModalCheckpointProviderBinding }>\n>();\n\n/**\n * Resolve checkpoint ownership through the exact authenticated Modal client\n * embedded in the session that creates the snapshot. The field is private in\n * the pinned Agents extension, so this adapter is intentionally fail-closed:\n * an upstream shape change disables native publication instead of guessing\n * ownership from a newly-resolved ambient profile.\n */\nexport async function resolveModalCheckpointProviderBindingForSession(\n  settings: Settings,\n  session: unknown,\n): Promise<{ key: string; binding: ModalCheckpointProviderBinding }> {\n  if (!session || typeof session !== \"object\") {\n    throw new Error(\"Modal checkpoint session identity is unavailable\");\n  }\n  const cached = modalSessionCheckpointBindings.get(session);\n  if (cached) return await cached;\n  const modal = (session as { modal?: unknown }).modal as ModalClientLike | undefined;\n  if (\n    !modal ||\n    typeof modal.cpClient?.workspaceNameLookup !== \"function\" ||\n    typeof modal.profile?.serverUrl !== \"string\" ||\n    typeof modal.environmentName !== \"function\"\n  ) {\n    throw new Error(\"Pinned Modal session no longer exposes its authenticated checkpoint identity\");\n  }\n  const pending = modalCheckpointProviderBindingForClient(settings, modal).then(\n    (binding) => canonicalModalCheckpointProviderBinding(binding)!,\n  );\n  modalSessionCheckpointBindings.set(session, pending);\n  try {\n    return await pending;\n  } catch (error) {\n    modalSessionCheckpointBindings.delete(session);\n    throw error;\n  }\n}\n\n/** Compare a restore receipt against the exact authenticated Modal client\n * embedded in the created session. This deliberately does not resolve a second\n * ambient client: the session that will consume the snapshot is the authority. */\nexport async function modalSessionMatchesCheckpointProviderBinding(\n  settings: Settings,\n  session: unknown,\n  expectedBindingKey: string,\n): Promise<boolean> {\n  const identity = await resolveModalCheckpointProviderBindingForSession(settings, session);\n  return identity.key === expectedBindingKey;\n}\n\n/** Resolve the authoritative Modal workspace behind the configured credential.\n * Snapshot ids are workspace-scoped; persisting this non-secret binding lets GC\n * reject a credential rotation that points at a different workspace instead of\n * issuing a destructive call under ambient credentials. */\nexport async function resolveModalCheckpointProviderBinding(\n  settings: Settings,\n  createClient: (settings: Settings) => Promise<ModalClientLike> = createModalClient,\n): Promise<{ key: string; binding: ModalCheckpointProviderBinding }> {\n  const modal = await createClient(settings);\n  try {\n    const binding = await modalCheckpointProviderBindingForClient(settings, modal);\n    return canonicalModalCheckpointProviderBinding(binding)!;\n  } finally {\n    modal.close();\n  }\n}\n\n/** Positive discovery only. A missing/expired provider listing never proves\n * that a dispatched create did not happen, and never authorizes a retry. */\nexport async function findModalProviderCreateReceipt(\n  settings: Settings,\n  attempt: {\n    operationId: string;\n    providerBindingKey: string;\n    appId: string;\n    providerName: string;\n    imageId: string | null;\n  },\n  createClient: (settings: Settings) => Promise<ModalClientLike> = createModalClient,\n): Promise<string | null> {\n  if (\n    !attempt.imageId ||\n    !attempt.appId ||\n    attempt.providerName !== `opengeni-create-${attempt.operationId}`\n  )\n    throw new Error(\"Modal create recovery requires exact persisted provider identity\");\n  const modal = await createClient(settings);\n  try {\n    const binding = canonicalModalCheckpointProviderBinding(\n      await modalCheckpointProviderBindingForClient(settings, modal),\n    );\n    if (binding?.key !== attempt.providerBindingKey)\n      throw new Error(\"Modal create recovery refused a different authenticated namespace\");\n    let beforeTimestamp: number | undefined;\n    const found = new Set<string>();\n    // An operation normally has one result. Bound malformed/ambiguous provider\n    // inventory without treating partial pagination as a unique receipt.\n    for (let page = 0; page < 16; page++) {\n      const response = await modal.cpClient.sandboxList({\n        appId: attempt.appId,\n        environmentName: modal.environmentName(settings.modalEnvironment),\n        includeFinished: true,\n        tags: [{ tagName: \"opengeni_provider_create_operation_id\", tagValue: attempt.operationId }],\n        ...(beforeTimestamp === undefined ? {} : { beforeTimestamp }),\n      });\n      if (!response.sandboxes.length) return found.size === 1 ? [...found][0]! : null;\n      for (const info of response.sandboxes) {\n        if (\n          !info.id.startsWith(\"sb-\") ||\n          info.appId !== attempt.appId ||\n          info.name !== attempt.providerName ||\n          info.imageId !== attempt.imageId ||\n          info.tags.filter((tag) => tag.tagName === \"opengeni_provider_create_operation_id\")\n            .length !== 1 ||\n          !info.tags.some(\n            (tag) =>\n              tag.tagName === \"opengeni_provider_create_operation_id\" &&\n              tag.tagValue === attempt.operationId,\n          )\n        )\n          throw new Error(\"Modal create discovery returned inconsistent operation identity\");\n        found.add(info.id);\n        if (found.size > 1) throw new Error(\"Modal create discovery is ambiguous; preserve fence\");\n      }\n      const oldest = Math.min(...response.sandboxes.map((info) => info.createdAt));\n      if (\n        !Number.isFinite(oldest) ||\n        oldest <= 0 ||\n        (beforeTimestamp !== undefined && oldest >= beforeTimestamp)\n      )\n        throw new Error(\"Modal create discovery pagination did not advance\");\n      beforeTimestamp = oldest;\n    }\n    throw new Error(\"Modal create discovery exceeded its bounded inventory\");\n  } finally {\n    modal.close();\n  }\n}\n\n/** Prove a legacy lease's live sandbox is visible in the same Modal namespace\n * whose identity will own the adopted checkpoint row. */\nexport async function resolveModalCheckpointProviderBindingForLiveSandbox(\n  settings: Settings,\n  sandboxId: string,\n  createClient: (settings: Settings) => Promise<ModalClientLike> = createModalClient,\n): Promise<{ key: string; binding: ModalCheckpointProviderBinding }> {\n  if (!sandboxId) throw new Error(\"Modal live-sandbox identity requires a sandbox id\");\n  const modal = await createClient(settings);\n  try {\n    const binding = await modalCheckpointProviderBindingForClient(settings, modal);\n    const sandbox = await modal.sandboxes.fromId(sandboxId);\n    const exitCode = await sandbox.poll();\n    if (exitCode !== null) {\n      throw new Error(`Modal sandbox ${sandboxId} is no longer running`);\n    }\n    return canonicalModalCheckpointProviderBinding(binding)!;\n  } finally {\n    modal.close();\n  }\n}\n\n/**\n * Observe one exact historical Modal sandbox without consulting the current\n * lease or its (possibly successor-owned) resume envelope. This is deliberately\n * lifecycle-only: a running sandbox does not prove whether an individual\n * retained process is still running, while a terminal/missing sandbox proves\n * that none of its processes can still execute.\n */\nexport async function inspectModalSandboxLifecycle(\n  settings: Settings,\n  sandboxId: string,\n  expectedBindingKey?: string | null,\n  createClient: (settings: Settings) => Promise<ModalClientLike> = createModalClient,\n): Promise<\n  | {\n      status: \"running\";\n      providerBindingKey: string;\n      providerBinding: ModalCheckpointProviderBinding;\n    }\n  | {\n      status: \"terminated\";\n      exitCode: number;\n      providerBindingKey: string;\n      providerBinding: ModalCheckpointProviderBinding;\n    }\n  | {\n      status: \"not_found\";\n      providerBindingKey: string;\n      providerBinding: ModalCheckpointProviderBinding;\n    }\n> {\n  if (!sandboxId) throw new Error(\"Modal lifecycle inspection requires a sandbox id\");\n  const modal = await createClient(settings);\n  try {\n    const binding = canonicalModalCheckpointProviderBinding(\n      await modalCheckpointProviderBindingForClient(settings, modal),\n    )!;\n    if (expectedBindingKey && binding.key !== expectedBindingKey) {\n      throw new Error(\n        \"Modal lifecycle inspection refused because the configured credential workspace changed\",\n      );\n    }\n    try {\n      const sandbox = await modal.sandboxes.fromId(sandboxId);\n      const exitCode = await sandbox.poll();\n      return exitCode === null\n        ? {\n            status: \"running\",\n            providerBindingKey: binding.key,\n            providerBinding: binding.binding,\n          }\n        : {\n            status: \"terminated\",\n            exitCode,\n            providerBindingKey: binding.key,\n            providerBinding: binding.binding,\n          };\n    } catch (error) {\n      if (isModalNotFoundError(error)) {\n        return {\n          status: \"not_found\",\n          providerBindingKey: binding.key,\n          providerBinding: binding.binding,\n        };\n      }\n      throw error;\n    }\n  } finally {\n    modal.close();\n  }\n}\n\nexport async function deleteModalCheckpointSnapshot(\n  settings: Settings,\n  expectedBindingKey: string,\n  snapshotId: string,\n  createClient: (settings: Settings) => Promise<ModalClientLike> = createModalClient,\n): Promise<\"deleted\" | \"not_found\"> {\n  if (!snapshotId) throw new Error(\"Modal checkpoint deletion requires a snapshot id\");\n  // Resolve identity and delete through the same authenticated client. A cached\n  // or separately-created identity probe could approve workspace A and then\n  // issue the destructive call through a rotated ambient profile for workspace B.\n  const modal = await createClient(settings);\n  try {\n    const binding = await modalCheckpointProviderBindingForClient(settings, modal);\n    const identity = canonicalModalCheckpointProviderBinding(binding)!;\n    if (expectedBindingKey !== identity.key) {\n      throw new Error(\n        \"Modal checkpoint deletion refused because the configured credential workspace changed\",\n      );\n    }\n    try {\n      await modal.images.delete(snapshotId);\n      return \"deleted\";\n    } catch (error) {\n      if (isModalNotFoundError(error)) return \"not_found\";\n      throw error;\n    }\n  } finally {\n    modal.close();\n  }\n}\n\nexport async function tagModalSandbox(\n  settings: Settings,\n  sandboxId: string,\n  attribution: ModalSandboxAttribution,\n): Promise<boolean> {\n  if (!sandboxId) {\n    return false;\n  }\n  const modal = await createModalClient(settings);\n  try {\n    const sandbox = await modal.sandboxes.fromId(sandboxId);\n    await sandbox.setTags(modalSandboxAttributionTags(attribution));\n    return true;\n  } finally {\n    modal.close();\n  }\n}\n\nexport async function terminateModalSandboxById(\n  settings: Settings,\n  sandboxId: string,\n  createClient: (settings: Settings) => Promise<ModalClientLike> = createModalClient,\n  expectedProviderBindingKey?: string,\n): Promise<boolean> {\n  if (!sandboxId) {\n    return true;\n  }\n  const modal = await createClient(settings);\n  try {\n    if (expectedProviderBindingKey) {\n      const binding = canonicalModalCheckpointProviderBinding(\n        await modalCheckpointProviderBindingForClient(settings, modal),\n      );\n      if (binding?.key !== expectedProviderBindingKey)\n        throw new Error(\"Modal create cleanup refused a different authenticated namespace\");\n    }\n    const sandbox = await modal.sandboxes.fromId(sandboxId);\n    await confirmModalTermination(sandbox.terminate.bind(sandbox));\n    return true;\n  } finally {\n    modal.close();\n  }\n}\n\ntype ModalSandboxInfo = {\n  id: string;\n  createdAt?: number;\n  tags?: Array<{ tagName?: string; tagValue?: string }>;\n};\n\ntype ModalCpListClient = ModalClientLike & {\n  cpClient: {\n    sandboxList(input: {\n      appId?: string;\n      beforeTimestamp?: number;\n      environmentName?: string;\n      includeFinished?: boolean;\n      tags?: Array<{ tagName: string; tagValue: string }>;\n    }): Promise<{ sandboxes?: ModalSandboxInfo[] }>;\n  };\n};\n\nfunction tagsFromInfo(info: ModalSandboxInfo): Record<string, string> {\n  const tags: Record<string, string> = {};\n  for (const tag of info.tags ?? []) {\n    if (typeof tag.tagName === \"string\" && typeof tag.tagValue === \"string\") {\n      tags[tag.tagName] = tag.tagValue;\n    }\n  }\n  return tags;\n}\n\nfunction sandboxCreatedAtMs(info: ModalSandboxInfo): number | null {\n  if (\n    typeof info.createdAt !== \"number\" ||\n    !Number.isFinite(info.createdAt) ||\n    info.createdAt <= 0\n  ) {\n    return null;\n  }\n  // Modal protobuf timestamps in this SDK are seconds as doubles.\n  return info.createdAt < 10_000_000_000\n    ? Math.floor(info.createdAt * 1000)\n    : Math.floor(info.createdAt);\n}\n\nfunction attributionKey(\n  input: Pick<ModalSandboxAttribution, \"leaseId\" | \"workspaceId\" | \"sandboxGroupId\">,\n): string {\n  return `${input.workspaceId}:${input.sandboxGroupId}:${input.leaseId}`;\n}\n\n/**\n * Whether the deployment's Modal app has any unfinished sandbox: the first\n * page of exactly the listing the orphan sweep walks. When it has none, the\n * sweep has nothing to terminate or attribute, and its inventory is empty. A\n * missing app is an empty inventory, as in the sweep.\n */\nexport async function modalAppHasRunningSandboxes(\n  settings: Settings,\n  options: { client?: ModalClientLike } = {},\n): Promise<boolean> {\n  const ownedClient = options.client ? null : await createModalClient(settings);\n  const modal = (options.client ?? ownedClient)! as ModalCpListClient;\n  try {\n    let appId: string | undefined;\n    try {\n      appId = (\n        await modal.apps.fromName(settings.modalAppName, {\n          createIfMissing: false,\n          ...(settings.modalEnvironment ? { environment: settings.modalEnvironment } : {}),\n        })\n      ).appId;\n    } catch (error) {\n      if (isModalNotFoundError(error)) return false;\n      throw error;\n    }\n    if (!appId) return false;\n    const response = await modal.cpClient.sandboxList({\n      appId,\n      includeFinished: false,\n      ...(settings.modalEnvironment ? { environmentName: settings.modalEnvironment } : {}),\n      tags: [],\n    });\n    return (response.sandboxes ?? []).length > 0;\n  } finally {\n    ownedClient?.close();\n  }\n}\n\nexport async function sweepModalOrphanSandboxes(\n  settings: Settings,\n  liveLeases: LiveModalSandboxLeaseAttribution[],\n  options: {\n    now?: Date;\n    maxTerminations?: number;\n    unattributedGraceMs?: number;\n    client?: ModalClientLike;\n    /** Re-read durable ownership immediately before provider termination. A\n     * false result or callback failure skips the destructive action. */\n    revalidateTermination?: RevalidateModalOrphanTermination;\n  } = {},\n): Promise<ModalOrphanSweepResult> {\n  const nowMs = options.now?.getTime() ?? Date.now();\n  const maxTerminations = options.maxTerminations ?? MODAL_ORPHAN_SWEEP_LIMIT;\n  const unattributedGraceMs = options.unattributedGraceMs ?? MODAL_UNATTRIBUTED_ORPHAN_GRACE_MS;\n  const liveByAttribution = new Map(liveLeases.map((lease) => [attributionKey(lease), lease]));\n  // LIVE-INSTANCE GUARD: a box that any live lease's envelope points at is NEVER\n  // an orphan, whatever its tags say. Tags are best-effort attribution (setTags\n  // is a separate call after create and can fail or lag); the lease envelope is\n  // the source of truth the turn path actually resumes by. Judging by tags alone\n  // terminated a LIVE box mid-turn at exactly creation+30min (staging session\n  // e644e8a8, 2026-07-06) — the box's unpushed work was unrecoverable because\n  // nothing outside the reaper drain persists /workspace.\n  const liveByInstanceId = new Map(\n    liveLeases\n      .filter((lease) => lease.instanceId)\n      .map((lease) => [lease.instanceId as string, lease]),\n  );\n  const ownedClient = options.client ? null : await createModalClient(settings);\n  const modal = (options.client ?? ownedClient)! as ModalCpListClient;\n  try {\n    let app: Awaited<ReturnType<typeof modal.apps.fromName>>;\n    try {\n      app = await modal.apps.fromName(settings.modalAppName, {\n        createIfMissing: false,\n        ...(settings.modalEnvironment ? { environment: settings.modalEnvironment } : {}),\n      });\n    } catch (error) {\n      // A new deployment has no Modal app until its first sandbox is created.\n      // That is an empty provider inventory, not a failed orphan sweep.\n      if (isModalNotFoundError(error)) {\n        return emptyModalOrphanSweepResult(liveLeases);\n      }\n      throw error;\n    }\n    const appId = app.appId;\n    if (!appId) {\n      return emptyModalOrphanSweepResult(liveLeases);\n    }\n\n    let examined = 0;\n    let skipped = 0;\n    const unterminated: ModalOrphanSweepTermination[] = [];\n    let complete = false;\n    const seenInstanceIds = new Set<string>();\n    const terminated: ModalOrphanSweepTermination[] = [];\n    let beforeTimestamp: number | undefined;\n    while (terminated.length < maxTerminations) {\n      const response = await modal.cpClient.sandboxList({\n        appId,\n        ...(beforeTimestamp !== undefined ? { beforeTimestamp } : {}),\n        includeFinished: false,\n        ...(settings.modalEnvironment ? { environmentName: settings.modalEnvironment } : {}),\n        tags: [],\n      });\n      const sandboxes = response.sandboxes ?? [];\n      if (sandboxes.length === 0) {\n        complete = true;\n        break;\n      }\n      for (const info of sandboxes) {\n        examined += 1;\n        if (info.id) {\n          seenInstanceIds.add(info.id);\n        }\n        const tags = tagsFromInfo(info);\n        const leaseId = tags.opengeni_lease_id;\n        const workspaceId = tags.opengeni_workspace_id;\n        const sandboxGroupId = tags.opengeni_sandbox_group_id;\n        const liveByInstance = info.id ? liveByInstanceId.get(info.id) : undefined;\n        if (liveByInstance) {\n          // Live-instance guard (see above): a live lease resumes this exact box\n          // by id — hard-skip it, and HEAL its attribution tags when they are\n          // missing/stale so it stops looking sweep-eligible. Best-effort: a\n          // failed re-tag must never fail the sweep (the guard, not the tags,\n          // is what protects the box now).\n          if (\n            leaseId !== liveByInstance.leaseId ||\n            workspaceId !== liveByInstance.workspaceId ||\n            sandboxGroupId !== liveByInstance.sandboxGroupId\n          ) {\n            try {\n              const sandbox = await modal.sandboxes.fromId(info.id);\n              await sandbox.setTags(\n                modalSandboxAttributionTags({\n                  leaseId: liveByInstance.leaseId,\n                  workspaceId: liveByInstance.workspaceId,\n                  sandboxGroupId: liveByInstance.sandboxGroupId,\n                }),\n              );\n            } catch {\n              // Tag healing is opportunistic; the instance guard already\n              // protects this box on every future sweep pass.\n            }\n          }\n          skipped += 1;\n          continue;\n        }\n        let reason: ModalOrphanSweepTermination[\"reason\"] | null = null;\n        if (leaseId && workspaceId && sandboxGroupId) {\n          const live = liveByAttribution.get(\n            attributionKey({ leaseId, workspaceId, sandboxGroupId }),\n          );\n          if (!live || (live.instanceId && live.instanceId !== info.id)) {\n            reason = \"stale_attribution\";\n          }\n        } else {\n          const createdAtMs = sandboxCreatedAtMs(info);\n          if (createdAtMs !== null && nowMs - createdAtMs >= unattributedGraceMs) {\n            reason = \"unattributed\";\n          }\n        }\n\n        if (!reason) {\n          skipped += 1;\n          continue;\n        }\n        const candidate = { sandboxId: info.id, reason, tags };\n        let sandbox: Awaited<ReturnType<typeof modal.sandboxes.fromId>>;\n        try {\n          sandbox = await modal.sandboxes.fromId(info.id);\n        } catch {\n          skipped += 1;\n          unterminated.push(candidate);\n          continue;\n        }\n        if (options.revalidateTermination) {\n          try {\n            if (!(await options.revalidateTermination(candidate))) {\n              skipped += 1;\n              unterminated.push(candidate);\n              continue;\n            }\n          } catch {\n            // Destructive provider cleanup fails closed when the fresh durable\n            // ownership read is unavailable or otherwise inconclusive.\n            skipped += 1;\n            unterminated.push(candidate);\n            continue;\n          }\n        }\n        try {\n          await confirmModalTermination(sandbox.terminate.bind(sandbox));\n          terminated.push(candidate);\n        } catch {\n          skipped += 1;\n          unterminated.push(candidate);\n        }\n        if (terminated.length >= maxTerminations) {\n          break;\n        }\n      }\n      beforeTimestamp = sandboxes[sandboxes.length - 1]?.createdAt;\n      if (beforeTimestamp === undefined) {\n        complete = true;\n        break;\n      }\n    }\n    return {\n      examined,\n      terminated,\n      skipped,\n      inventory: {\n        complete,\n        running: examined,\n        unterminated,\n        // The live-lease snapshot was read before the listing began, so an\n        // instance id it names already existed and a complete listing of\n        // running boxes contains it unless that box has stopped.\n        missingLiveLeaseInstanceIds: complete\n          ? liveLeases.flatMap((lease) =>\n              lease.instanceId && !seenInstanceIds.has(lease.instanceId) ? [lease.instanceId] : [],\n            )\n          : [],\n      },\n    };\n  } finally {\n    ownedClient?.close();\n  }\n}\n\nfunction emptyModalOrphanSweepResult(\n  liveLeases: LiveModalSandboxLeaseAttribution[],\n): ModalOrphanSweepResult {\n  return {\n    examined: 0,\n    terminated: [],\n    skipped: 0,\n    inventory: {\n      complete: true,\n      running: 0,\n      unterminated: [],\n      missingLiveLeaseInstanceIds: liveLeases.flatMap((lease) =>\n        lease.instanceId ? [lease.instanceId] : [],\n      ),\n    },\n  };\n}\n","import { randomUUID } from \"node:crypto\";\nimport { isDeepStrictEqual } from \"node:util\";\nimport { truncateOutput } from \"@openai/agents-core/sandbox/internal\";\nimport type { ChannelASession } from \"../channel-a\";\nimport {\n  aliasNativeSynchronousCommandOutput,\n  retainSynchronousTerminalProviderPage,\n  synchronousTerminalProviderPage,\n} from \"../native-synchronous-collection\";\nimport { ModalProcessObservationUnavailableError } from \"../errors\";\nimport { classifyProviderSandboxFailure } from \"../provider-errors\";\nimport { markTypedExecHandleLoss, parseExecResponseBanner } from \"../exec-banner\";\nimport {\n  MAX_PROVIDER_COMMAND_HANDLE,\n  type ProviderCommandOutput,\n  type ProviderCommandPersistence,\n  type ProviderCommandSession,\n  admittedProviderCommandHandle,\n  ProviderCommandStartOutcomeUnknownError,\n  ProviderCommandInputOutcomeUnknownError,\n} from \"../provider-command-session\";\nimport type { ModalCommandControl, ModalProviderCommand } from \"./modal-command-control\";\nimport { verifyModalMaterializedPath } from \"./modal-materialization-verification\";\n\ntype Entry = {\n  command: ModalProviderCommand;\n  persistence?: ProviderCommandPersistence;\n};\n\nfunction sameExecution(a: ModalProviderCommand, b: ModalProviderCommand): boolean {\n  return (\n    a.kind === b.kind &&\n    a.sandboxId === b.sandboxId &&\n    a.taskId === b.taskId &&\n    a.execId === b.execId &&\n    isDeepStrictEqual(\n      \"supervision\" in a ? a.supervision : undefined,\n      \"supervision\" in b ? b.supervision : undefined,\n    ) &&\n    Boolean(a.pty) === Boolean(b.pty)\n  );\n}\n\n/** Bridges the SDK's numeric/banner surface to provider-owned execution\n * locators. The local maps are only caches: a fresh adapter can adopt the same\n * handle from protected persistence and replay any unacknowledged page. */\nexport function installModalCommandSession(\n  session: ProviderCommandSession & {\n    execCommand?: ChannelASession[\"execCommand\"];\n    writeStdin?: ChannelASession[\"writeStdin\"];\n    verifyMaterializedPath?: (path: string, workdir: string) => Promise<void>;\n    verifyExecReadiness?: (signal: AbortSignal) => Promise<number>;\n  },\n  control: Pick<ModalCommandControl, \"start\" | \"read\" | \"readProbe\" | \"write\"> &\n    Partial<\n      Pick<\n        ModalCommandControl,\n        \"supervisionControl\" | \"verifySupervisionCapability\" | \"verifyExecReadiness\"\n      >\n    >,\n): void {\n  markTypedExecHandleLoss(session);\n  const originalExec = session.execCommand?.bind(session);\n  const originalWrite = session.writeStdin?.bind(session);\n  const cancelLegacyStart = session.cancelPendingExecCommand?.bind(session);\n  const pendingStarts = new Set<AbortController>();\n  if (control.verifyExecReadiness) {\n    const verify = control.verifyExecReadiness.bind(control);\n    session.verifyExecReadiness = async (signal: AbortSignal) => {\n      const cancellation = new AbortController();\n      const abort = () => cancellation.abort(signal.reason);\n      signal.addEventListener(\"abort\", abort, { once: true });\n      if (signal.aborted) abort();\n      pendingStarts.add(cancellation);\n      try {\n        const exit = await verify(cancellation.signal);\n        cancellation.signal.throwIfAborted();\n        return exit;\n      } finally {\n        signal.removeEventListener(\"abort\", abort);\n        pendingStarts.delete(cancellation);\n      }\n    };\n  }\n  session.verifyCommandSupervisionCapability = async () => {\n    if (!control.verifySupervisionCapability)\n      throw new Error(\"Modal instance lacks supervised command capability verification\");\n    return await control.verifySupervisionCapability();\n  };\n  session.verifyMaterializedPath = (path, workdir) =>\n    verifyModalMaterializedPath(control, path, workdir, pendingStarts);\n  const entries = new Map<number, Entry>();\n  // Current SDK setup commands are not retained/admitted commands. Give their\n  // live observer handles a disjoint, adapter-local range; never use a missing\n  // retained alias as permission to poll an unrelated SDK process with that id.\n  const setupHandles = new Map<number, number>();\n  let nextSetupHandle = MAX_PROVIDER_COMMAND_HANDLE + 1;\n  const receipts = new Map<string, { handle: number; page: ProviderCommandOutput }>();\n  const atomicallyCaptured = new WeakSet<ProviderCommandOutput>();\n\n  const supervise = async (entry: Entry, release = false): Promise<void> => {\n    if (entry.command.kind !== \"modal-router-v1\" || !entry.command.supervision) return;\n    const persistence = entry.persistence;\n    if (\n      !persistence?.recordSupervisionReceipt ||\n      !persistence.loadSupervisionReceipt ||\n      !persistence.cancellationRequested ||\n      !control.supervisionControl\n    )\n      throw new Error(\"Supervised command requires durable control persistence\");\n    let receipt = await persistence.loadSupervisionReceipt();\n    if (!receipt) {\n      const action = (await persistence.cancellationRequested())\n        ? \"cancel\"\n        : release\n          ? \"release\"\n          : \"status\";\n      const observation = await control.supervisionControl(entry.command, action);\n      receipt = observation.receipt ?? null;\n      if (receipt) await persistence.recordSupervisionReceipt(receipt);\n    }\n    if (receipt) {\n      // Lost ACK responses are safe to retry. A dead control socket is not\n      // terminal proof: the subsequent authenticated provider read still must\n      // prove exit and commit every output byte.\n      await control\n        .supervisionControl(entry.command, \"ack\", receipt.receiptId)\n        .catch(() => undefined);\n    }\n  };\n\n  const captureRouterPage = async (entry: Entry, page: ProviderCommandOutput): Promise<boolean> => {\n    if (\n      page.command.kind !== \"modal-router-v1\" ||\n      !page.expected ||\n      !entry.persistence?.captureRouterPage\n    )\n      throw new Error(\"Modal byte-offset output requires atomic retained capture\");\n    const result = await entry.persistence.captureRouterPage({\n      expected: page.expected,\n      command: page.command,\n      stdout: page.chunks\n        .filter((chunk) => chunk.stream === \"stdout\")\n        .map((chunk) => chunk.text)\n        .join(\"\"),\n      stderr: page.chunks\n        .filter((chunk) => chunk.stream === \"stderr\")\n        .map((chunk) => chunk.text)\n        .join(\"\"),\n    });\n    if (!sameExecution(entry.command, result.command))\n      throw new Error(\"Modal output capture changed execution identity\");\n    entry.command = result.command;\n    if (result.captured) atomicallyCaptured.add(page);\n    return result.captured;\n  };\n\n  const setupPage = (raw: string, handle: number, sdkHandle: number): string => {\n    const banner = parseExecResponseBanner(raw);\n    if (banner.kind === \"exited\") {\n      setupHandles.delete(handle);\n      return raw;\n    }\n    if (banner.kind !== \"running\" || banner.sessionId !== sdkHandle)\n      throw new ModalProcessObservationUnavailableError(handle);\n    // The parser validated the unique status in the metadata header, before\n    // command-controlled Output. Replace only that first trusted status line.\n    const aliased = raw.replace(\n      /^Process running with session ID \\d+(?=\\r?$)/mu,\n      `Process running with session ID ${handle}`,\n    );\n    aliasNativeSynchronousCommandOutput(session, raw, aliased, handle);\n    return aliased;\n  };\n\n  const formatPage = (\n    handle: number,\n    page: ProviderCommandOutput,\n    maxOutputTokens?: number,\n  ): string => {\n    const result = [\n      `Provider output receipt: ${randomUUID()}`,\n      page.exitCode === null\n        ? `Process running with session ID ${handle}`\n        : `Process exited with code ${page.exitCode}`,\n      \"Output:\",\n      truncateOutput(page.chunks.map((chunk) => chunk.text).join(\"\"), maxOutputTokens).text,\n    ].join(\"\\n\");\n    if (page.exitCode === null || entries.get(handle)?.persistence) {\n      receipts.set(result, { handle, page });\n    } else {\n      retainSynchronousTerminalProviderPage(session, result, page);\n      entries.delete(handle);\n    }\n    return result;\n  };\n  const read = async (\n    handle: number,\n    entry: Entry,\n    yieldTimeMs: number,\n    maxOutputTokens?: number,\n    signal?: AbortSignal,\n  ): Promise<string> => {\n    if (entry.persistence) {\n      const retained = await entry.persistence.load();\n      if (!retained || !sameExecution(entry.command, retained))\n        throw new Error(\"Original Modal command identity is unavailable\");\n      entry.command = retained;\n      // Output observation stays available when control/proof persistence is\n      // unavailable. Terminal exposure below remains fenced by durable proof.\n      await supervise(entry).catch(() => undefined);\n    }\n    let page = await control.read(entry.command, yieldTimeMs, signal);\n    if (entry.persistence && page.command.kind === \"modal-router-v1\") {\n      // A stale concurrent observer must reread from the committed cursor before\n      // exposing a terminal receipt; its uncommitted tail is not settlement proof.\n      let captured = false;\n      for (let attempt = 0; attempt < 3; attempt++) {\n        if (await captureRouterPage(entry, page)) {\n          captured = true;\n          break;\n        }\n        if (attempt < 2) page = await control.read(entry.command, yieldTimeMs, signal);\n      }\n      if (!captured) throw new Error(\"Modal command output cursor changed during bounded capture\");\n    }\n    if (page.command.kind === \"modal-router-v1\" && page.command.supervision) {\n      const receipt = await entry.persistence?.loadSupervisionReceipt?.();\n      // The supervisor exits 0 after ACK; that is provider terminal evidence,\n      // not the original shell result. Retain both without conflating them.\n      page = { ...page, exitCode: receipt && page.exitCode === 0 ? receipt.leaderExitCode : null };\n    }\n    // The receipt is generated here, not parsed from command output. Its only\n    // purpose is correlating this return value with a trusted in-memory page.\n    return formatPage(handle, page, maxOutputTokens);\n  };\n\n  session.execCommand = async (args) => {\n    const handle = admittedProviderCommandHandle();\n    // Setup/readiness may yield too. Retain only its original local observer,\n    // without publishing a durable locator or replaying its command.\n    if (handle === undefined) {\n      if (!originalExec) throw new Error(\"Modal command requires mutation admission\");\n      if (!Number.isSafeInteger(nextSetupHandle)) throw new Error(\"Modal setup handles exhausted\");\n      const setupHandle = nextSetupHandle++;\n      const raw = await originalExec(args);\n      const banner = parseExecResponseBanner(raw);\n      if (banner.kind !== \"running\") return raw;\n      setupHandles.set(setupHandle, banner.sessionId);\n      return setupPage(raw, setupHandle, banner.sessionId);\n    }\n    if (entries.has(handle)) throw new Error(\"Modal command handle is already bound\");\n    const cancellation = new AbortController();\n    pendingStarts.add(cancellation);\n    try {\n      const command = await control.start(args, cancellation.signal);\n      // Pre-dispatch reservation can already bind protected persistence.\n      const entry = entries.get(handle) ?? { command };\n      if (!sameExecution(entry.command, command))\n        throw new Error(\"Reserved Modal command changed during dispatch\");\n      entries.set(handle, entry);\n      if (entry.command.kind === \"modal-router-v1\" && entry.command.supervision) {\n        // The launch cannot run user code until the routing layer commits\n        // initial retention and calls releaseSupervisedCommand.\n        return formatPage(handle, { command: entry.command, chunks: [], exitCode: null });\n      }\n      try {\n        return await read(\n          handle,\n          entry,\n          args.yieldTimeMs ?? 10000,\n          args.maxOutputTokens,\n          cancellation.signal,\n        );\n      } catch {\n        // Start succeeded. A failed/cancelled first observation must still\n        // publish the known locator for durable retention and exact cleanup.\n        return formatPage(handle, {\n          command: entry.command,\n          chunks: [],\n          exitCode: null,\n        });\n      }\n    } catch (error) {\n      if (error instanceof ProviderCommandStartOutcomeUnknownError) {\n        const entry = entries.get(handle);\n        if (entry && !sameExecution(entry.command, error.command))\n          throw new Error(\"Reserved Modal command changed during failed dispatch\", {\n            cause: error,\n          });\n        entries.set(handle, entry ?? { command: error.command });\n      }\n      throw error;\n    } finally {\n      pendingStarts.delete(cancellation);\n    }\n  };\n\n  session.cancelPendingExecCommand = async () => {\n    for (const start of pendingStarts)\n      start.abort(\n        new Error(\"Modal command start observation cancelled; provider outcome is unknown\"),\n      );\n    // SDK-internal foreground commands retain their separate legacy transport\n    // cancellation. Neither path closes an already-yielded command's locator.\n    await cancelLegacyStart?.();\n  };\n\n  session.getProviderCommand = (handle) => {\n    const entry = entries.get(handle);\n    return entry ? structuredClone(entry.command) : null;\n  };\n  session.releaseSupervisedCommand = async (handle) => {\n    const entry = entries.get(handle);\n    if (!entry || entry.command.kind !== \"modal-router-v1\" || !entry.command.supervision) return;\n    const retained = await entry.persistence?.load();\n    if (!retained || !sameExecution(entry.command, retained))\n      throw new Error(\"Supervisor release requires committed initial retention\");\n    entry.command = retained;\n    await supervise(entry, true);\n  };\n  session.cancelSupervisedCommand = async (handle, reason) => {\n    const entry = entries.get(handle);\n    if (!entry || entry.command.kind !== \"modal-router-v1\" || !entry.command.supervision)\n      return false;\n    if (!entry.persistence?.requestCancellation)\n      throw new Error(\"Supervisor cancellation requires durable intent\");\n    await entry.persistence.requestCancellation(reason);\n    await supervise(entry);\n    return true;\n  };\n  session.bindProviderCommand = (handle, command, persistence) => {\n    if (!Number.isSafeInteger(handle) || handle <= 0 || handle > MAX_PROVIDER_COMMAND_HANDLE)\n      throw new Error(\"Invalid retained Modal command handle\");\n    const existing = entries.get(handle);\n    if (existing && !sameExecution(existing.command, command))\n      throw new Error(\"Modal command handle cannot be rebound to another execution\");\n    entries.set(handle, { command: structuredClone(command), persistence });\n  };\n  session.getProviderCommandOutput = (result) =>\n    typeof result === \"string\"\n      ? (receipts.get(result)?.page ?? synchronousTerminalProviderPage(session, result))\n      : null;\n  session.captureCommandOutput = async (result) => {\n    const receipt = receipts.get(result);\n    if (!receipt || receipt.page.command.kind !== \"modal-router-v1\") return false;\n    if (\n      !receipt.page.expected &&\n      receipt.page.exitCode === null &&\n      receipt.page.chunks.length === 0\n    ) {\n      // Both a supervised idle launch and an unavailable first observation\n      // carry identity only. Retention already owns this command; there are\n      // no observed bytes or terminal evidence to ACK.\n      receipts.delete(result);\n      return true;\n    }\n    if (atomicallyCaptured.has(receipt.page)) {\n      receipts.delete(result);\n      return true;\n    }\n    const entry = entries.get(receipt.handle);\n    if (!entry?.persistence?.captureRouterPage || !receipt.page.expected)\n      throw new Error(\"Modal byte-offset output requires atomic retained capture\");\n    if (!(await captureRouterPage(entry, receipt.page))) {\n      const target = receipt.page.command;\n      const covered = () =>\n        entry.command.kind === \"modal-router-v1\" &&\n        ([\"stdout\", \"stderr\"] as const).every((stream) => {\n          const current = entry.command.streams[stream];\n          // This narrowing stays inside the discriminator's synchronous scope.\n          if (!(\"byteOffset\" in current)) return false;\n          const wanted = target.streams[stream];\n          return (\n            current.byteOffset >= wanted.byteOffset &&\n            (!wanted.eof || current.eof) &&\n            (wanted.exitCode === null || current.exitCode === wanted.exitCode)\n          );\n        });\n      for (let attempt = 0; !covered() && attempt < 3; attempt++) {\n        // Initial promotion can race reconciliation before background adoption.\n        // Re-read, never re-execute; only a committed cursor covering the original\n        // page makes that page's terminal proof eligible for settlement.\n        const refreshedReceipt = await read(receipt.handle, entry, 250);\n        const refreshed = receipts.get(refreshedReceipt);\n        if (refreshed && atomicallyCaptured.has(refreshed.page)) receipts.delete(refreshedReceipt);\n      }\n      if (!covered())\n        throw new Error(\"Initial Modal output tail remains uncommitted after bounded capture\");\n    }\n    receipts.delete(result);\n    return true;\n  };\n  session.acknowledgeCommandOutput = async (result) => {\n    const receipt = receipts.get(result);\n    if (!receipt) return;\n    const entry = entries.get(receipt.handle);\n    if (!entry?.persistence)\n      throw new Error(\"Modal output cannot advance before durable command retention\");\n    const saved = await entry.persistence.acknowledge(receipt.page.command);\n    if (!sameExecution(entry.command, saved))\n      throw new Error(\"Modal output acknowledgment changed execution identity\");\n    entry.command = saved;\n    receipts.delete(result);\n  };\n  session.writeStdin = async (args) => {\n    const sdkHandle = setupHandles.get(args.sessionId);\n    if (sdkHandle !== undefined && originalWrite) {\n      const raw = await originalWrite({ ...args, sessionId: sdkHandle });\n      return setupPage(raw, args.sessionId, sdkHandle);\n    }\n    const entry = entries.get(args.sessionId);\n    if (!entry?.persistence)\n      throw new ModalProcessObservationUnavailableError(args.sessionId, {\n        reason: \"missing_handle\",\n      });\n    if (args.chars) {\n      const retained = await entry.persistence.load();\n      if (!retained || !sameExecution(entry.command, retained))\n        throw new Error(\"Original Modal command identity is unavailable\");\n      const index = await entry.persistence.reserveInput(Buffer.byteLength(args.chars));\n      try {\n        await control.write(retained, args.chars, index);\n      } catch (error) {\n        // Native gRPC transport failure does not establish whether this reserved\n        // range reached stdin. Never resend it or recommend another input write.\n        if (\n          retained.kind === \"modal-router-v1\" &&\n          // Contain supported transport graphs, including mixed failures. This\n          // grants no read/write retry permission; the locator and byte range\n          // come only from the retained command and its one input reservation.\n          classifyProviderSandboxFailure(\"modal\", error).kind === \"transient_transport\"\n        )\n          throw new ProviderCommandInputOutcomeUnknownError(\n            retained,\n            index,\n            Buffer.byteLength(args.chars),\n            error,\n          );\n        throw error;\n      }\n    }\n    return read(args.sessionId, entry, args.yieldTimeMs ?? 250, args.maxOutputTokens, args.signal);\n  };\n}\n","/**\n * Provider sandbox failure classification.\n *\n * This is deliberately structural and fail-closed. DNS failures often contain\n * the word \"not found\" (`ENOTFOUND`) while gRPC status values are also used by\n * unrelated SDKs and command routers. A bare numeric status (including gRPC's\n * numeric 5) is therefore not enough to retire a provider instance. Only\n * authoritative, non-transient evidence may retire a provider instance and\n * license lease recovery.\n */\nexport type ProviderSandboxFailureKind = \"not_found\" | \"transient_transport\" | \"other\";\n\nexport type ProviderSandboxFailure = {\n  kind: ProviderSandboxFailureKind;\n  /** Bounded, non-secret diagnostic suitable for logs and lifecycle events. */\n  diagnostic: string;\n};\n\nconst GRPC_TRANSIENT = new Set([1, 2, 4, 13, 14]);\nconst TRANSIENT_CODES = new Set([\n  \"1\",\n  \"2\",\n  \"4\",\n  \"13\",\n  \"14\",\n  \"CANCELLED\",\n  \"UNKNOWN\",\n  \"DEADLINE_EXCEEDED\",\n  \"INTERNAL\",\n  \"UNAVAILABLE\",\n  \"ECONNRESET\",\n  \"ECONNREFUSED\",\n  \"ETIMEDOUT\",\n  \"EAI_AGAIN\",\n  \"ENOTFOUND\",\n]);\nconst NOT_FOUND_CODES = new Set([\"404\", \"NOT_FOUND\", \"RESOURCE_NOT_FOUND\", \"SANDBOX_NOT_FOUND\"]);\nconst SAFE_CODE = /^[A-Z0-9._:-]{1,64}$/;\n\ntype ErrorSignals = {\n  numbers: number[];\n  codes: string[];\n  messages: string[];\n  incomplete: boolean;\n};\n\nconst UNREADABLE_ERROR_SIGNAL = Symbol(\"unreadable-error-signal\");\n\nfunction safeRead(record: object, key: string): unknown {\n  try {\n    const descriptor = Object.getOwnPropertyDescriptor(record, key);\n    return descriptor\n      ? \"value\" in descriptor\n        ? descriptor.value\n        : UNREADABLE_ERROR_SIGNAL\n      : undefined;\n  } catch {\n    return UNREADABLE_ERROR_SIGNAL;\n  }\n}\n\nfunction collectSignals(value: unknown): ErrorSignals {\n  const out: ErrorSignals = { numbers: [], codes: [], messages: [], incomplete: false };\n  const seen = new Set<object>();\n  const read = (record: object, key: string): unknown => {\n    const signal = safeRead(record, key);\n    if (signal !== UNREADABLE_ERROR_SIGNAL) return signal;\n    out.incomplete = true;\n    return undefined;\n  };\n  const visit = (current: unknown, depth: number): void => {\n    if (current === null || current === undefined) return;\n    if (depth > 6 || seen.size >= 64) {\n      out.incomplete = true;\n      return;\n    }\n    if (typeof current === \"string\") {\n      if (current.length <= 512) out.messages.push(current);\n      return;\n    }\n    if (typeof current !== \"object\" || seen.has(current)) return;\n    seen.add(current);\n    for (const key of [\n      \"status\",\n      \"statusCode\",\n      \"httpStatus\",\n      \"httpStatusCode\",\n      \"responseStatus\",\n      \"errorCode\",\n      \"code\",\n    ]) {\n      const signal = read(current, key);\n      if (typeof signal === \"number\" && Number.isFinite(signal)) out.numbers.push(signal);\n      if (typeof signal === \"string\") {\n        const code = signal.trim().toUpperCase();\n        if (SAFE_CODE.test(code)) out.codes.push(code);\n      }\n    }\n    for (const key of [\"name\", \"message\", \"details\", \"cause\"]) {\n      const signal = read(current, key);\n      if (typeof signal === \"string\" && signal.length <= 512) out.messages.push(signal);\n      else visit(signal, depth + 1);\n    }\n    visit(read(current, \"response\"), depth + 1);\n    visit(read(current, \"error\"), depth + 1);\n    const errors = read(current, \"errors\");\n    if (errors !== undefined) {\n      if (!Array.isArray(errors) || !errors.length || errors.length > 16) out.incomplete = true;\n      else\n        for (let index = 0; index < errors.length; index++) {\n          const nested = read(errors, String(index));\n          if (!nested || typeof nested !== \"object\") out.incomplete = true;\n          visit(nested, depth + 1);\n        }\n    }\n  };\n  visit(value, 0);\n  return out;\n}\n\nfunction safeDiagnostic(signals: ErrorSignals): string {\n  const code = signals.codes.find(Boolean);\n  const numeric = signals.numbers.find((value) => Number.isFinite(value));\n  return [code ? `code=${code}` : \"\", numeric !== undefined ? `status=${numeric}` : \"\"]\n    .filter(Boolean)\n    .join(\" \");\n}\n\nfunction hasTransientSignal(signals: ErrorSignals): boolean {\n  return (\n    signals.codes.some((code) => TRANSIENT_CODES.has(code)) ||\n    signals.numbers.some((status) => GRPC_TRANSIENT.has(status))\n  );\n}\n\nfunction hasModalTerminalSandboxMessage(signals: ErrorSignals): boolean {\n  return signals.messages.some(\n    (message) =>\n      /^Modal sandbox [A-Za-z0-9_-]+ is no longer running\\.$/.test(message) ||\n      /^Modal sandbox [A-Za-z0-9_-]+ not found \\(has been terminated\\)$/.test(message),\n  );\n}\n\nfunction hasUnixLocalTerminalWorkspaceMessage(signals: ErrorSignals): boolean {\n  return signals.messages.includes(\n    \"UnixLocal sandbox workspace is unavailable and no local snapshot could be restored.\",\n  );\n}\n\nfunction hasDockerTerminalWorkspaceMessage(signals: ErrorSignals): boolean {\n  return signals.messages.includes(\n    \"Docker sandbox resources are unavailable and no local snapshot could be restored.\",\n  );\n}\n\nfunction hasCloudflareTerminalSandboxMessage(signals: ErrorSignals): boolean {\n  return signals.messages.some((message) =>\n    /^Cloudflare sandbox [A-Za-z0-9._:-]+ is no longer running\\.$/.test(message),\n  );\n}\n\n/** Typed transport evidence always dominates nested/string NotFound text. */\nexport function classifyProviderSandboxFailure(\n  backendId: string,\n  error: unknown,\n): ProviderSandboxFailure {\n  if (backendId === \"selfhosted\" || !error) {\n    return { kind: \"other\", diagnostic: \"selfhosted-or-empty\" };\n  }\n  const signals = collectSignals(error);\n  const diagnostic = safeDiagnostic(signals) || \"unclassified_provider_failure\";\n\n  if (hasTransientSignal(signals)) {\n    return { kind: \"transient_transport\", diagnostic };\n  }\n  if (signals.incomplete) return { kind: \"other\", diagnostic };\n  if (\n    signals.numbers.some((status) => status === 404) ||\n    signals.codes.some((code) => NOT_FOUND_CODES.has(code))\n  ) {\n    return { kind: \"not_found\", diagnostic };\n  }\n\n  // Modal's SDK emits these exact terminal grammars after resolving one exact\n  // sandbox id. Generic \"not found\" prose is intentionally not authoritative.\n  if (backendId === \"modal\" && hasModalTerminalSandboxMessage(signals)) {\n    return {\n      kind: \"not_found\",\n      diagnostic:\n        diagnostic === \"unclassified_provider_failure\"\n          ? \"modal_terminal_message\"\n          : `${diagnostic} modal_terminal_message`,\n    };\n  }\n\n  // Cloudflare's resume() performs its sandbox-scoped running probe itself and\n  // emits this exact UserError only after that probe returns false. It carries\n  // no HTTP/code field, so omitting the provider grammar would strand a dead\n  // lease in warm/draining forever. Arbitrary Cloudflare path 404s do not match.\n  if (backendId === \"cloudflare\" && hasCloudflareTerminalSandboxMessage(signals)) {\n    return {\n      kind: \"not_found\",\n      diagnostic:\n        diagnostic === \"unclassified_provider_failure\"\n          ? \"cloudflare_terminal_message\"\n          : `${diagnostic} cloudflare_terminal_message`,\n    };\n  }\n\n  // The SDK emits this exact UserError only after resolving one serialized\n  // unix_local session and proving that both its process-local workspace and\n  // its persisted fallback are absent. That is authoritative provider loss:\n  // on resume it licenses a fresh local workspace, and on drain it licenses\n  // the lease's provider-missing cold transition. Generic \"unavailable\" prose\n  // remains fail-closed.\n  if (\n    (backendId === \"local\" || backendId === \"unix_local\") &&\n    hasUnixLocalTerminalWorkspaceMessage(signals)\n  ) {\n    return {\n      kind: \"not_found\",\n      diagnostic:\n        diagnostic === \"unclassified_provider_failure\"\n          ? \"unix_local_workspace_missing\"\n          : `${diagnostic} unix_local_workspace_missing`,\n    };\n  }\n\n  // Docker's ordinary resume is used only by a durable same-workspace recovery\n  // owner. This exact SDK error is emitted after it has checked both the\n  // serialized container and its host workspace (plus any configured local\n  // snapshot) and proved that none can be resumed. Treating it as transient\n  // would preserve an unusable continuity receipt forever. Routed operations\n  // use the stricter discriminator below, so an arbitrary command error cannot\n  // retire a live container through this message rule.\n  if (backendId === \"docker\" && hasDockerTerminalWorkspaceMessage(signals)) {\n    return {\n      kind: \"not_found\",\n      diagnostic:\n        diagnostic === \"unclassified_provider_failure\"\n          ? \"docker_resources_missing\"\n          : `${diagnostic} docker_resources_missing`,\n    };\n  }\n\n  return { kind: \"other\", diagnostic };\n}\n\nexport function isProviderSandboxNotFoundError(backendId: string, error: unknown): boolean {\n  return classifyProviderSandboxFailure(backendId, error).kind === \"not_found\";\n}\n\n/**\n * Whether a failure from an operation routed through an already-established\n * sandbox proves that exact provider sandbox disappeared.\n *\n * Routed operations can legitimately return HTTP 404 / `NOT_FOUND` for paths,\n * files, ports, processes, and other subresources. Those generic signals are\n * sufficient for provider create/resume APIs, but they must never retire the\n * live sandbox identity after an arbitrary operation. Only an explicit\n * sandbox-scoped provider code or Modal's exact terminal sandbox grammar is\n * authoritative on this path. Transient transport evidence still dominates.\n */\nexport function isProviderSandboxGoneDuringRoutedOperation(\n  backendId: string,\n  error: unknown,\n): boolean {\n  if (backendId === \"selfhosted\" || !error) return false;\n  const signals = collectSignals(error);\n  if (hasTransientSignal(signals) || signals.incomplete) return false;\n  if (signals.codes.includes(\"SANDBOX_NOT_FOUND\")) return true;\n  return backendId === \"modal\" && hasModalTerminalSandboxMessage(signals);\n}\n\nexport function isProviderSandboxTransientError(backendId: string, error: unknown): boolean {\n  return classifyProviderSandboxFailure(backendId, error).kind === \"transient_transport\";\n}\n","import { isDeepStrictEqual } from \"node:util\";\nimport { setTimeout as delay } from \"node:timers/promises\";\nimport {\n  SandboxMaterializationVerificationError,\n  retainMaterializationVerificationDiagnostic,\n  type MaterializationVerificationDiagnostic,\n} from \"../materialization-verification-error\";\nimport type { ModalCommandControl, ModalProviderCommand } from \"./modal-command-control\";\nimport {\n  ProviderCommandObservationUnavailableError,\n  ProviderCommandStartOutcomeUnknownError,\n  type ProviderCommandOutput,\n} from \"../provider-command-session\";\n\nconst MARKER = \"__OPENGENI_MATERIALIZED_PATH_VISIBLE__\";\nconst OUTPUT_LIMIT = 16 * 1024;\n\n/** A fixed read-only probe, not an admitted user command. Advance its private\n * provider cursor locally; never borrow the surrounding mutation's retained\n * handle or relax retained-command persistence requirements. The caller keeps\n * the original backend and provider-operation gate for the entire observation.\n */\nexport async function verifyModalMaterializedPath(\n  control: Pick<ModalCommandControl, \"start\" | \"readProbe\">,\n  path: string,\n  workdir: string,\n  pending: Set<AbortController>,\n  observationTimeoutMs = 30_000,\n): Promise<void> {\n  const quote = (value: string) => `'${value.replaceAll(\"'\", `'\"'\"'`)}'`;\n  const command = `test -e ${quote(path)} && printf %s ${quote(MARKER)}`;\n  const cancellation = new AbortController();\n  const deadlineReason = new Error(\"Materialization visibility observation deadline exceeded\");\n  let providerCommand: ModalProviderCommand | undefined;\n  let startUnknown: ProviderCommandStartOutcomeUnknownError | undefined;\n  let stdout = \"\";\n  let stderr = \"\";\n  const diagnostic = (\n    reason: MaterializationVerificationDiagnostic[\"reason\"],\n    exitCode: number | null = null,\n  ): MaterializationVerificationDiagnostic => ({\n    reason,\n    path,\n    workdir,\n    command,\n    output: (stdout + stderr).slice(0, OUTPUT_LIMIT),\n    exitCode,\n    providerSessionId: null,\n    ...(providerCommand\n      ? {\n          providerExecution: {\n            sandboxId: providerCommand.sandboxId,\n            taskId: providerCommand.taskId,\n            execId: providerCommand.execId,\n          },\n        }\n      : {}),\n  });\n  const timer = setTimeout(() => {\n    cancellation.abort(deadlineReason);\n  }, observationTimeoutMs);\n  timer.unref();\n  pending.add(cancellation);\n  try {\n    try {\n      providerCommand = await control.start(\n        { cmd: command, workdir, shell: \"sh\", login: false, tty: false },\n        cancellation.signal,\n      );\n    } catch (error) {\n      // A possibly dispatched fixed visibility probe has one original locator.\n      // Observe that invocation; never replay it or the surrounding mutation.\n      if (!(error instanceof ProviderCommandStartOutcomeUnknownError)) throw error;\n      providerCommand = structuredClone(error.command);\n      startUnknown = error;\n    }\n    for (;;) {\n      cancellation.signal.throwIfAborted();\n      let page: ProviderCommandOutput;\n      try {\n        page = await control.readProbe(providerCommand, 1_000, cancellation);\n      } catch (error) {\n        cancellation.signal.throwIfAborted();\n        if (\n          !(error instanceof ProviderCommandObservationUnavailableError) ||\n          !error.readRetryAllowed\n        ) {\n          if (!startUnknown) throw error;\n          // A missing/denied read cannot disprove the original Start. Preserve\n          // its exact invocation without granting any further read retry.\n          throw new ProviderCommandObservationUnavailableError(\n            structuredClone(providerCommand),\n            new AggregateError(\n              [startUnknown, error],\n              \"Original visibility Start and observation remain uncertain\",\n            ),\n            false,\n          );\n        }\n        // Unavailable reads do not advance any cursor. A contradictory locator\n        // is an invariant failure, never authority to inspect another process.\n        if (!isDeepStrictEqual(error.command, providerCommand))\n          throw new SandboxMaterializationVerificationError(diagnostic(\"invalid_response\"), {\n            cause: error,\n          });\n        // Read retries remain inside this probe's original thirty-second\n        // deadline, including outages longer than a single bounded read.\n        try {\n          await delay(100, undefined, { signal: cancellation.signal });\n        } catch (interrupted) {\n          cancellation.signal.throwIfAborted();\n          throw interrupted;\n        }\n        continue;\n      }\n      // Cancellation ends observation, not the process. Never accept a late\n      // success after the attempt requested cancellation.\n      cancellation.signal.throwIfAborted();\n      if (\n        page.command.sandboxId !== providerCommand.sandboxId ||\n        page.command.taskId !== providerCommand.taskId ||\n        page.command.execId !== providerCommand.execId\n      ) {\n        throw new SandboxMaterializationVerificationError(diagnostic(\"invalid_response\"));\n      }\n      providerCommand = page.command;\n      for (const chunk of page.chunks) {\n        if (chunk.stream === \"stdout\") stdout += chunk.text;\n        else stderr += chunk.text;\n      }\n      if (stdout.length + stderr.length > OUTPUT_LIMIT) {\n        throw new SandboxMaterializationVerificationError(diagnostic(\"invalid_response\"));\n      }\n      if (page.exitCode === null) {\n        // An empty provider page may return immediately. Yield to cancellation\n        // and the deadline instead of starving timers with resolved promises.\n        await new Promise<void>((resolve) => setImmediate(resolve));\n        continue;\n      }\n      if (page.exitCode === 0 && stdout === MARKER) return;\n      throw new SandboxMaterializationVerificationError(\n        diagnostic(\n          page.exitCode === 1\n            ? \"path_not_visible\"\n            : page.exitCode === 0\n              ? \"invalid_response\"\n              : \"command_failed\",\n          page.exitCode,\n        ),\n      );\n    }\n  } catch (error) {\n    if (cancellation.signal.reason === deadlineReason) {\n      throw new SandboxMaterializationVerificationError(\n        {\n          ...diagnostic(\"command_pending\"),\n          causeMessage: \"Observation deadline exceeded; provider process completion is unconfirmed\",\n        },\n        {\n          cause: providerCommand\n            ? new ProviderCommandObservationUnavailableError(\n                providerCommand,\n                startUnknown\n                  ? new AggregateError(\n                      [startUnknown, error],\n                      \"Original visibility Start and observation deadline remain uncertain\",\n                    )\n                  : error,\n              )\n            : error,\n        },\n      );\n    }\n    if (!(error instanceof SandboxMaterializationVerificationError)) {\n      retainMaterializationVerificationDiagnostic(error, {\n        ...diagnostic(\"command_error\"),\n        causeMessage: error instanceof Error ? error.message : String(error),\n      });\n    }\n    throw error;\n  } finally {\n    cancellation.abort(new Error(\"Materialization visibility observation finished\"));\n    clearTimeout(timer);\n    pending.delete(cancellation);\n  }\n}\n","import { randomUUID, randomBytes } from \"node:crypto\";\nimport { posix } from \"node:path\";\nimport { status } from \"@grpc/grpc-js\";\nimport { setTimeout as delay } from \"node:timers/promises\";\nimport { modalCommandArgv } from \"./modal-command-argv\";\nimport {\n  SandboxProviderCommand,\n  CommandSupervisionReceipt,\n  ModalRouterProviderCommand,\n} from \"@opengeni/contracts\";\nimport type { ChannelAExecArgs } from \"../channel-a\";\nimport type { ProviderCommandOutput } from \"../provider-command-session\";\nimport {\n  admittedCommandSupervisionReady,\n  markPendingCommandSupervised,\n  reserveSupervisedLaunch,\n  ProviderCommandStartOutcomeUnknownError,\n  ProviderCommandObservationUnavailableError,\n} from \"../provider-command-session\";\nimport { isModalCommandObservationTransportError } from \"./modal-command-observation-errors\";\nimport { ModalCommandStartOutcomeUnknownError } from \"./modal-command-start-errors\";\nimport { classifyProviderSandboxFailure } from \"../provider-errors\";\nimport {\n  ModalCommandControl as LegacyControl,\n  commandControlPlane,\n} from \"./modal-legacy-command-control\";\nimport {\n  ModalCommandRouterWire,\n  ModalCommandStartPreDispatchUnavailableError,\n  ModalCommandStartRejectedError,\n  ModalCommandStartNotDispatchedError,\n} from \"./modal-command-router-wire\";\nimport { collectModalRawOutputPage, type ModalRawOutputPage } from \"./modal-command-raw-page\";\n\nexport { modalCommandAbortMiddleware } from \"./modal-legacy-command-control\";\nexport type ModalProviderCommand = SandboxProviderCommand;\nexport type ModalProviderOutputPage = ProviderCommandOutput;\n\ntype Client = Parameters<typeof commandControlPlane>[0];\ntype RouterEntry = {\n  router: ModalCommandRouterWire;\n  users: number;\n  refreshAt: number;\n  idle?: ReturnType<typeof setTimeout>;\n};\ntype RouterLookup = { controller: AbortController; waiters: number; settled: boolean };\n/** A post-EOF exit re-poll may finish this long after the read deadline. */\nconst REPOLL_GRACE_MS = 250;\ntype ControlObservation = { command: ModalRouterProviderCommand; output: string };\ntype SupervisionControlResult = {\n  state: \"idle\" | \"running\" | \"quiescent\";\n  receipt?: CommandSupervisionReceipt;\n};\ntype ControlHelper = ControlObservation & {\n  startPending: boolean;\n  startUnknown?: unknown;\n  inFlight?: Promise<SupervisionControlResult>;\n};\n\n/** Cancels this waiter, not the shared provider operation. The rejection\n * handler remains attached even when an uncooperative provider settles late. */\nfunction awaitRouterAccess<T>(pending: Promise<T>, signal?: AbortSignal): Promise<T> {\n  if (!signal) return pending;\n  signal.throwIfAborted();\n  return new Promise<T>((resolve, reject) => {\n    const abort = () => {\n      signal.removeEventListener(\"abort\", abort);\n      reject(signal.reason);\n    };\n    signal.addEventListener(\"abort\", abort, { once: true });\n    void pending.then(resolve, reject).finally(() => signal.removeEventListener(\"abort\", abort));\n  });\n}\n\n/** New commands use replayable task-router byte offsets. Legacy identifiers\n * never cross that protocol boundary and are never used for new starts. */\nexport class ModalCommandControl {\n  private readonly routers = new Map<string, Promise<RouterEntry>>();\n  private readonly routerLookups = new Map<Promise<RouterEntry>, RouterLookup>();\n  private readonly controlHelpers = new Map<string, ControlHelper>();\n  private readonly client: ReturnType<typeof commandControlPlane>;\n  private readonly legacy: LegacyControl;\n  private closed = false;\n\n  private constructor(\n    client: Client,\n    private readonly sandboxIdentity: string | (() => string),\n    private readonly root: string,\n    private readonly environment: Record<string, string> | (() => Record<string, string>),\n  ) {\n    this.client = commandControlPlane(client);\n    this.legacy = LegacyControl.forSandbox(client, sandboxIdentity, root, environment);\n  }\n\n  static forSandbox(\n    client: Client,\n    sandboxId: string | (() => string),\n    root: string,\n    environment: Record<string, string> | (() => Record<string, string>) = {},\n  ): ModalCommandControl {\n    if (client.version() !== \"0.9.0\")\n      throw new Error(\"Modal command control requires the verified 0.9.0 SDK contract\");\n    return new ModalCommandControl(client, sandboxId, root, environment);\n  }\n\n  private get sandboxId(): string {\n    return typeof this.sandboxIdentity === \"function\"\n      ? this.sandboxIdentity()\n      : this.sandboxIdentity;\n  }\n\n  private async withRouter<T>(\n    taskId: string,\n    signal: AbortSignal | undefined,\n    run: (router: ModalCommandRouterWire) => Promise<T>,\n  ): Promise<T> {\n    signal?.throwIfAborted();\n    if (this.closed) throw new Error(\"Modal command control is closed\");\n    let pending = this.routers.get(taskId);\n    const reused = Boolean(pending);\n    if (!pending) {\n      const lookup: RouterLookup = {\n        controller: new AbortController(),\n        waiters: 0,\n        settled: false,\n      };\n      pending = (async () => {\n        const access = await awaitRouterAccess(\n          this.client.taskGetCommandRouterAccess({ taskId }, { signal: lookup.controller.signal }),\n          lookup.controller.signal,\n        );\n        let refreshAt = Date.now() + 60_000;\n        try {\n          // Expiry only shortens cache lifetime; it never authenticates access.\n          const payload = JSON.parse(\n            Buffer.from(access.jwt.split(\".\")[1] ?? \"\", \"base64url\").toString(),\n          );\n          if (typeof payload.exp === \"number\" && Number.isFinite(payload.exp))\n            refreshAt = Math.min(refreshAt, payload.exp * 1000 - 15_000);\n        } catch {\n          /* Authentication remains the provider's responsibility. */\n        }\n        return { router: new ModalCommandRouterWire(access), users: 0, refreshAt };\n      })();\n      this.routers.set(taskId, pending);\n      this.routerLookups.set(pending, lookup);\n      const settled = () => {\n        lookup.settled = true;\n        this.routerLookups.delete(pending!);\n      };\n      void pending.then(settled, () => {\n        settled();\n        if (this.routers.get(taskId) === pending) this.routers.delete(taskId);\n      });\n    }\n    const lookup = this.routerLookups.get(pending);\n    if (lookup) lookup.waiters++;\n    let entry: RouterEntry;\n    try {\n      entry = await awaitRouterAccess(pending, signal);\n    } finally {\n      if (lookup && --lookup.waiters === 0 && !lookup.settled) {\n        // No interested callers remain. Never cancel a sibling's lookup, and\n        // retire only this exact promise if a replacement has already won.\n        if (this.routers.get(taskId) === pending) this.routers.delete(taskId);\n        lookup.controller.abort(new Error(\"Modal router access has no remaining waiters\"));\n      }\n    }\n    // Refresh credentials between operations, never close another active read.\n    if (reused && !entry.users && Date.now() > entry.refreshAt) {\n      // Another continuation may already have installed fresh access. Retire\n      // only the captured cache entry, then join its replacement rather than\n      // deleting or closing the newer transport.\n      if (this.routers.get(taskId) === pending) {\n        this.routers.delete(taskId);\n        clearTimeout(entry.idle);\n        entry.router.close();\n      }\n      return await this.withRouter(taskId, signal, run);\n    }\n    clearTimeout(entry.idle);\n    entry.users++;\n    try {\n      signal?.throwIfAborted();\n      return await run(entry.router);\n    } finally {\n      entry.users--;\n      if (!entry.users) {\n        entry.idle = setTimeout(() => {\n          if (this.routers.get(taskId) === pending && !entry.users) {\n            this.routers.delete(taskId);\n            entry.router.close();\n          }\n        }, 30_000);\n        entry.idle.unref?.();\n      }\n    }\n  }\n\n  async close(): Promise<void> {\n    this.closed = true;\n    for (const lookup of this.routerLookups.values())\n      lookup.controller.abort(new Error(\"Modal command control is closed\"));\n    const entries = await Promise.allSettled(this.routers.values());\n    this.routers.clear();\n    for (const entry of entries)\n      if (entry.status === \"fulfilled\") {\n        clearTimeout(entry.value.idle);\n        entry.value.router.close();\n      }\n  }\n\n  /** Access lookup may retry safely, but once the callback enters the Start\n   * boundary only the wire's own dispatch proof can authorize recovery. */\n  private async withStartRouter<T>(\n    taskId: string,\n    signal: AbortSignal | undefined,\n    run: (router: ModalCommandRouterWire) => Promise<T>,\n  ): Promise<T> {\n    let entered = false;\n    try {\n      return await this.withRouter(taskId, signal, async (router) => {\n        entered = true;\n        return await run(router);\n      });\n    } catch (error) {\n      if (entered) throw error;\n      return await ModalCommandStartPreDispatchUnavailableError.beforeDispatch(async () => {\n        throw error;\n      }, signal);\n    }\n  }\n\n  async start(args: ChannelAExecArgs, signal?: AbortSignal): Promise<ModalRouterProviderCommand> {\n    signal?.throwIfAborted();\n    const supervised = admittedCommandSupervisionReady() && !args.tty && !args.runAs;\n    if (supervised) markPendingCommandSupervised();\n    const sandboxId = this.sandboxId;\n    const workdir = posix.resolve(this.root, args.workdir ?? this.root);\n    if (workdir !== this.root && !workdir.startsWith(`${this.root.replace(/\\/$/u, \"\")}/`))\n      throw new Error(\"Command workdir is outside the sandbox workspace\");\n    const task = await ModalCommandStartPreDispatchUnavailableError.beforeDispatch(\n      () => this.client.sandboxGetTaskId({ sandboxId }, signal ? { signal } : undefined),\n      signal,\n    );\n    if (!task.taskId || task.taskResult) throw new Error(\"Modal command task is unavailable\");\n    const taskId = task.taskId;\n    if (this.sandboxId !== sandboxId)\n      throw new Error(\"Modal sandbox changed during command preparation\");\n    const execId = randomUUID();\n    // PTY and runAs retain their existing explicit unsupported supervision\n    // semantics. Never attach a fabricated descriptor to either path.\n    const invocationId = randomUUID();\n    const supervision = supervised\n      ? {\n          protocol: \"native-subreaper-v1\" as const,\n          invocationId,\n          nonce: randomBytes(32).toString(\"hex\"),\n          controlPath: `/tmp/opengeni-supervision/${invocationId}.sock`,\n        }\n      : undefined;\n    let commandArgs = modalCommandArgv(args);\n    const env = typeof this.environment === \"function\" ? this.environment() : this.environment;\n    if (supervision)\n      commandArgs = [\n        \"/usr/local/bin/opengeni-command-supervisor\",\n        \"launch\",\n        \"--invocation\",\n        supervision.invocationId,\n        \"--nonce\",\n        supervision.nonce,\n        \"--socket\",\n        supervision.controlPath,\n        \"--\",\n        ...commandArgs,\n      ];\n    const command: ModalRouterProviderCommand = {\n      kind: \"modal-router-v1\",\n      sandboxId,\n      taskId,\n      execId,\n      ...(args.tty ? { pty: true } : {}),\n      ...(supervision ? { supervision } : {}),\n      streams: {\n        stdout: { byteOffset: 0, utf8Remainder: \"\", eof: false, exitCode: null },\n        stderr: { byteOffset: 0, utf8Remainder: \"\", eof: false, exitCode: null },\n      },\n    };\n    if (supervision) await reserveSupervisedLaunch(command);\n    let startAttempted = false;\n    try {\n      await this.withStartRouter(taskId, signal, async (router) => {\n        startAttempted = true;\n        await router.start(\n          {\n            taskId,\n            execId,\n            commandArgs,\n            workdir,\n            env,\n            ...(args.tty\n              ? {\n                  ptyInfo: {\n                    enabled: true,\n                    winszRows: 24,\n                    winszCols: 80,\n                    envTerm: \"xterm\",\n                    ptyType: 1,\n                    noTerminateOnIdleStdin: true,\n                  },\n                }\n              : {}),\n          },\n          signal,\n        );\n      });\n    } catch (error) {\n      // A client-chosen router id remains the only possible invocation. Retain\n      // it even for PTY/runAs/unsupervised starts: a rejected acknowledgement\n      // does not prove that the provider rejected the launch.\n      if (\n        !startAttempted ||\n        error instanceof ModalCommandStartNotDispatchedError ||\n        error instanceof ModalCommandStartRejectedError ||\n        error instanceof ModalCommandStartPreDispatchUnavailableError\n      )\n        throw error;\n      throw new ProviderCommandStartOutcomeUnknownError(command, error);\n    }\n    return command;\n  }\n\n  /** Read-only, authenticated control execution on this exact instance. Never\n   * inferred from a fleet image selector or user command stdout. No cache: warm\n   * instances and route/task replacement must each pass before admission. */\n  async verifySupervisionCapability(): Promise<{ sandboxId: string; taskId: string }> {\n    const sandboxId = this.sandboxId;\n    const signal = AbortSignal.timeout(5_000);\n    const task = await ModalCommandStartPreDispatchUnavailableError.beforeDispatch(\n      () => this.client.sandboxGetTaskId({ sandboxId }, { signal }),\n      signal,\n    );\n    if (!task.taskId || task.taskResult) throw new Error(\"Modal command task is unavailable\");\n    await this.withStartRouter(task.taskId, signal, async (router) => {\n      const identity = { taskId: task.taskId!, execId: randomUUID() };\n      const observation: ControlObservation = {\n        command: {\n          kind: \"modal-router-v1\",\n          sandboxId,\n          ...identity,\n          streams: {\n            stdout: { byteOffset: 0, utf8Remainder: \"\", eof: false, exitCode: null },\n            stderr: { byteOffset: 0, utf8Remainder: \"\", eof: false, exitCode: null },\n          },\n        },\n        output: \"\",\n      };\n      let startUnknown: ModalCommandStartOutcomeUnknownError | undefined;\n      try {\n        await router.start(\n          {\n            ...identity,\n            commandArgs: [\"/usr/local/bin/opengeni-command-supervisor\", \"capabilities\"],\n            workdir: \"/tmp\",\n            env: {},\n          },\n          signal,\n        );\n      } catch (error) {\n        // A lost acknowledgement does not authorize another Start. This fixed\n        // read-only probe can still prove capability by observing its original\n        // invocation inside the same five-second budget.\n        if (!(error instanceof ModalCommandStartOutcomeUnknownError)) throw error;\n        if (error.taskId !== identity.taskId || error.execId !== identity.execId) throw error;\n        startUnknown = error;\n      }\n      let result: { output: string; exit: number };\n      try {\n        result = await this.readControlOutput(identity, 128, signal, observation);\n      } catch (error) {\n        if (!startUnknown) throw error;\n        // Missing/denied observation cannot erase a genuine unknown Start or\n        // turn it into sandbox-loss or replay authority.\n        throw new ProviderCommandObservationUnavailableError(\n          structuredClone(observation.command),\n          new AggregateError(\n            [startUnknown, error],\n            \"Original capability Start and observation remain uncertain\",\n          ),\n          error instanceof ProviderCommandObservationUnavailableError && error.readRetryAllowed,\n        );\n      }\n      signal.throwIfAborted();\n      const { output, exit } = result;\n      if (exit !== 0 || output !== \"native-subreaper-v1\")\n        throw new Error(\n          \"Exact Modal instance lacks compatible native supervision; command not admitted\",\n        );\n    });\n    if (sandboxId !== this.sandboxId)\n      throw new Error(\"Modal instance changed during supervision capability verification\");\n    return { sandboxId, taskId: task.taskId };\n  }\n\n  /** Fixed provider readiness probe. No shell, user environment, admission or\n   * SDK Start retries. Once Start may have been sent, only observe that exact\n   * invocation; DNS-shaped server replies never authorize another Start. */\n  async verifyExecReadiness(signal: AbortSignal): Promise<number> {\n    signal.throwIfAborted();\n    const sandboxId = this.sandboxId;\n    const task = await ModalCommandStartPreDispatchUnavailableError.beforeDispatch(\n      () => this.client.sandboxGetTaskId({ sandboxId }, { signal }),\n      signal,\n    );\n    if (!task.taskId || task.taskResult) throw new Error(\"Modal command task is unavailable\");\n    if (sandboxId !== this.sandboxId)\n      throw new Error(\"Modal sandbox changed during readiness preparation\");\n    const identity = { taskId: task.taskId, execId: randomUUID() };\n    const transientObservation = (error: unknown) =>\n      [status.UNAVAILABLE, status.DEADLINE_EXCEEDED].includes(\n        (error as { code?: number } | null)?.code ?? -1,\n      );\n    const pause = () => delay(100, undefined, { signal });\n    return await this.withStartRouter(task.taskId, signal, async (router) => {\n      for (;;) {\n        signal.throwIfAborted();\n        try {\n          await router.start(\n            { ...identity, commandArgs: [\"/bin/true\"], workdir: \"/tmp\", env: {} },\n            signal,\n          );\n          break;\n        } catch (error) {\n          signal.throwIfAborted();\n          if (error instanceof ModalCommandStartPreDispatchUnavailableError) {\n            await pause();\n            continue;\n          }\n          // A lost Start acknowledgement is not replay permission. The probe\n          // may already exist, so keep this identity even if observation later\n          // exhausts the caller's readiness budget.\n          if (\n            error instanceof ModalCommandStartRejectedError ||\n            error instanceof ModalCommandStartNotDispatchedError\n          )\n            throw error;\n          break;\n        }\n      }\n      const streams = {\n        stdout: { offset: 0, eof: false },\n        stderr: { offset: 0, eof: false },\n      };\n      for (;;) {\n        signal.throwIfAborted();\n        try {\n          for (const stream of [\"stdout\", \"stderr\"] as const) {\n            const cursor = streams[stream];\n            if (cursor.eof) continue;\n            const page = await router.read(identity, stream, cursor.offset, 1_000, signal);\n            cursor.offset += page.bytes.length;\n            cursor.eof = page.eof;\n          }\n          const exit = await router.poll(identity, signal);\n          signal.throwIfAborted();\n          if (exit !== null && streams.stdout.eof && streams.stderr.eof) return exit;\n        } catch (error) {\n          signal.throwIfAborted();\n          if (!transientObservation(error)) throw error;\n        }\n        await pause();\n      }\n    });\n  }\n\n  /** Separate authenticated provider execution of the installed control helper.\n   * User command streams are never inspected for control evidence. */\n  async supervisionControl(\n    command: ModalRouterProviderCommand,\n    action: \"release\" | \"cancel\" | \"status\" | \"ack\",\n    receiptId?: string,\n  ): Promise<SupervisionControlResult> {\n    SandboxProviderCommand.parse(command);\n    const descriptor = command.supervision;\n    if (!descriptor || command.sandboxId !== this.sandboxId)\n      throw new Error(\"Supervised command identity is unavailable\");\n    const key = JSON.stringify([\n      command.sandboxId,\n      command.taskId,\n      command.execId,\n      descriptor.invocationId,\n      descriptor.nonce,\n      descriptor.controlPath,\n      action,\n      receiptId ?? null,\n    ]);\n    let helper = this.controlHelpers.get(key);\n    if (!helper) {\n      helper = {\n        startPending: true,\n        output: \"\",\n        command: {\n          kind: \"modal-router-v1\",\n          sandboxId: command.sandboxId,\n          taskId: command.taskId,\n          execId: randomUUID(),\n          streams: {\n            stdout: { byteOffset: 0, utf8Remainder: \"\", eof: false, exitCode: null },\n            stderr: { byteOffset: 0, utf8Remainder: \"\", eof: false, exitCode: null },\n          },\n        },\n      };\n      this.controlHelpers.set(key, helper);\n    }\n    const observation = helper;\n    const run = async (): Promise<SupervisionControlResult> => {\n      const signal = AbortSignal.timeout(5_000);\n      if (observation.startPending) {\n        try {\n          await this.withStartRouter(command.taskId, signal, async (router) => {\n            // Once the wire may dispatch, neither a failed acknowledgement nor\n            // a later drain may create another helper invocation.\n            observation.startPending = false;\n            await router.start(\n              {\n                taskId: observation.command.taskId,\n                execId: observation.command.execId,\n                commandArgs: [\n                  \"/usr/local/bin/opengeni-command-supervisor\",\n                  \"control\",\n                  \"--invocation\",\n                  descriptor.invocationId,\n                  \"--nonce\",\n                  descriptor.nonce,\n                  \"--socket\",\n                  descriptor.controlPath,\n                  \"--action\",\n                  action,\n                  ...(receiptId ? [\"--receipt\", receiptId] : []),\n                ],\n                workdir: \"/tmp\",\n                env: {},\n              },\n              signal,\n            );\n          });\n        } catch (error) {\n          if (\n            observation.startPending ||\n            error instanceof ModalCommandStartNotDispatchedError ||\n            error instanceof ModalCommandStartRejectedError ||\n            error instanceof ModalCommandStartPreDispatchUnavailableError\n          ) {\n            this.controlHelpers.delete(key);\n            throw error;\n          }\n          // Preserve the genuine original Start boundary. A later drain reads\n          // this same helper; it never repeats a possibly dispatched Start.\n          observation.startUnknown = error;\n          throw error;\n        }\n      }\n      let response: { output: string; exit: number };\n      try {\n        response = await this.readControlOutput(observation.command, 4096, signal, observation);\n      } catch (error) {\n        if (\n          observation.startUnknown !== undefined &&\n          error instanceof ProviderCommandObservationUnavailableError\n        )\n          throw new ProviderCommandObservationUnavailableError(\n            error.command,\n            new AggregateError(\n              [observation.startUnknown, error],\n              \"Original helper Start and observation remain uncertain\",\n            ),\n            error.readRetryAllowed,\n          );\n        throw error;\n      }\n      const { output, exit } = response;\n      // Only a complete authenticated helper response retires its private\n      // cursor/output cache. Uncertainty keeps the same action and UUID.\n      this.controlHelpers.delete(key);\n      if (exit !== 0) throw new Error(\"Supervisor control is unavailable\");\n      const result = JSON.parse(output);\n      if (!result || ![\"idle\", \"running\", \"quiescent\"].includes(result.state))\n        throw new Error(\"Invalid supervisor control response\");\n      if (result.receipt !== undefined) {\n        result.receipt = CommandSupervisionReceipt.parse(result.receipt);\n        if (result.receipt.invocationId !== descriptor.invocationId)\n          throw new Error(\"Supervisor receipt invocation mismatch\");\n      }\n      if ((result.state === \"quiescent\") !== Boolean(result.receipt))\n        throw new Error(\"Supervisor quiescence response lacks its receipt\");\n      return result;\n    };\n    observation.inFlight ??= run().finally(() => {\n      delete observation.inFlight;\n    });\n    return await observation.inFlight;\n  }\n\n  /** These fixed helpers already started once. Observe only their original\n   * invocation within the caller's existing five-second budget. */\n  private async readControlOutput(\n    identity: { taskId: string; execId: string },\n    limit: number,\n    signal: AbortSignal,\n    observation?: ControlObservation,\n  ): Promise<{ output: string; exit: number }> {\n    const state: ControlObservation = observation ?? {\n      command: {\n        kind: \"modal-router-v1\",\n        sandboxId: this.sandboxId,\n        ...identity,\n        streams: {\n          stdout: { byteOffset: 0, utf8Remainder: \"\", eof: false, exitCode: null },\n          stderr: { byteOffset: 0, utf8Remainder: \"\", eof: false, exitCode: null },\n        },\n      },\n      output: \"\",\n    };\n    for (;;) {\n      try {\n        signal.throwIfAborted();\n        const page = await this.read(state.command, 250, signal);\n        state.command = page.command as ModalRouterProviderCommand;\n        if (\n          state.command.streams.stdout.byteOffset + state.command.streams.stderr.byteOffset >\n          limit\n        )\n          throw new Error(\"Supervisor control response exceeds its bound\");\n        state.output += page.chunks\n          .filter((chunk) => chunk.stream === \"stdout\")\n          .map((chunk) => chunk.text)\n          .join(\"\");\n        if (page.exitCode !== null) return { output: state.output, exit: page.exitCode };\n      } catch (error) {\n        if (signal.aborted)\n          throw new ProviderCommandObservationUnavailableError(\n            structuredClone(state.command),\n            error,\n          );\n        if (\n          !(error instanceof ProviderCommandObservationUnavailableError) ||\n          !error.readRetryAllowed\n        )\n          throw error;\n      }\n      try {\n        await delay(100, undefined, { signal });\n      } catch (error) {\n        throw new ProviderCommandObservationUnavailableError(structuredClone(state.command), error);\n      }\n    }\n  }\n\n  async read(\n    command: ModalProviderCommand,\n    waitMs: number,\n    signal?: AbortSignal,\n  ): Promise<ModalProviderOutputPage> {\n    SandboxProviderCommand.parse(command);\n    if (command.sandboxId !== this.sandboxId)\n      throw new Error(\"Modal command does not belong to this sandbox\");\n    if (command.kind === \"modal-control-v1\") return await this.legacy.read(command, waitMs, signal);\n    return (await this.readNative(command, waitMs, signal)).output;\n  }\n\n  /** Native capture plumbing only. Raw bytes are acquired by the same joined\n   * read/poll path as read(); no legacy locator or new command is admitted. */\n  async readRaw(\n    command: ModalRouterProviderCommand,\n    waitMs: number,\n    signal?: AbortSignal,\n  ): Promise<ModalRawOutputPage> {\n    return (await this.readNative(command, waitMs, signal)).raw;\n  }\n\n  private async readNative(\n    input: ModalRouterProviderCommand,\n    waitMs: number,\n    signal?: AbortSignal,\n  ): Promise<ReturnType<typeof collectModalRawOutputPage>> {\n    const command = structuredClone(ModalRouterProviderCommand.parse(input));\n    if (command.sandboxId !== this.sandboxId)\n      throw new Error(\"Modal command does not belong to this sandbox\");\n    if (!Number.isFinite(waitMs) || waitMs < 0 || waitMs > 50_000)\n      throw new Error(\"Invalid Modal output read bounds\");\n    signal?.throwIfAborted();\n    const stdout = command.streams.stdout;\n    const stderr = command.streams.stderr;\n    if (\n      stdout.eof &&\n      stderr.eof &&\n      stdout.utf8Remainder === \"\" &&\n      stderr.utf8Remainder === \"\" &&\n      stdout.exitCode !== null &&\n      stdout.exitCode === stderr.exitCode\n    ) {\n      // Both complete streams and their matching terminal observation were\n      // already captured. An expired provider handle cannot revoke that exact\n      // evidence; the session still atomically verifies the retained cursor.\n      return collectModalRawOutputPage(\n        command,\n        {\n          stdout: { bytes: Buffer.alloc(0), eof: true },\n          stderr: { bytes: Buffer.alloc(0), eof: true },\n        },\n        { source: \"retained_terminal\", code: stdout.exitCode },\n      );\n    }\n    const budget = new AbortController();\n    const abort = () => budget.abort(signal?.reason);\n    signal?.addEventListener(\"abort\", abort, { once: true });\n    if (signal?.aborted) abort();\n    // The router deliberately ends a quiet stream at its read deadline with\n    // a partial page. Let that deadline settle before outer containment aborts\n    // the whole page, including bytes already read from the other stream.\n    // Caller cancellation still bounds this allowance independently.\n    const deadline = performance.now() + Math.max(1, waitMs);\n    const timeout = setTimeout(\n      () => budget.abort(new Error(\"Modal command read budget exhausted\")),\n      Math.max(1, waitMs) + 5_000,\n    );\n    let lastError: unknown;\n    try {\n      for (let attempt = 0; attempt < 5; attempt++) {\n        signal?.throwIfAborted();\n        if (attempt > 0 && performance.now() >= deadline) break;\n        try {\n          return await this.readRouterPage(\n            command,\n            Math.min(Math.max(1, waitMs), Math.max(1, deadline - performance.now())),\n            budget.signal,\n            deadline,\n          );\n        } catch (error) {\n          signal?.throwIfAborted();\n          if (!budget.signal.aborted && !isModalCommandObservationTransportError(error)) {\n            // Containment is not retry permission. A structural provider fault\n            // dominates nested missing-handle prose, but mixed/unreadable\n            // graphs do not acquire the strict safe-read retry authority.\n            if (classifyProviderSandboxFailure(\"modal\", error).kind === \"transient_transport\")\n              throw new ProviderCommandObservationUnavailableError(\n                structuredClone(command),\n                error,\n                false,\n              );\n            throw error;\n          }\n          lastError = error;\n          if (budget.signal.aborted || performance.now() >= deadline || attempt === 4) break;\n          try {\n            await delay(Math.min(100, Math.max(1, deadline - performance.now())), undefined, {\n              signal: budget.signal,\n            });\n          } catch {\n            signal?.throwIfAborted();\n            break;\n          }\n        }\n      }\n      throw new ProviderCommandObservationUnavailableError(structuredClone(command), lastError);\n    } finally {\n      clearTimeout(timeout);\n      signal?.removeEventListener(\"abort\", abort);\n    }\n  }\n\n  private async readRouterPage(\n    command: ModalRouterProviderCommand,\n    waitMs: number,\n    signal: AbortSignal,\n    deadline: number,\n  ): Promise<ReturnType<typeof collectModalRawOutputPage>> {\n    const cancellation = new AbortController();\n    const lookupCancellation = new AbortController();\n    const abort = () => {\n      cancellation.abort(signal.reason);\n      lookupCancellation.abort(signal.reason);\n    };\n    signal?.addEventListener(\"abort\", abort, { once: true });\n    if (signal?.aborted) abort();\n    const lookupTimeout = setTimeout(\n      () =>\n        lookupCancellation.abort(\n          new ProviderCommandObservationUnavailableError(\n            structuredClone(command),\n            new Error(\"Modal command read access budget exhausted\"),\n          ),\n        ),\n      Math.max(1, deadline - performance.now()),\n    );\n    try {\n      return await this.withRouter(command.taskId, lookupCancellation.signal, async (router) => {\n        clearTimeout(lookupTimeout);\n        lookupCancellation.signal.throwIfAborted();\n        signal.throwIfAborted();\n        if (performance.now() >= deadline)\n          throw new ProviderCommandObservationUnavailableError(\n            structuredClone(command),\n            new Error(\"Modal command read budget exhausted\"),\n          );\n        const remainingWait = Math.max(1, Math.min(waitMs, deadline - performance.now()));\n        const operations = [\n          ...([\"stdout\", \"stderr\"] as const).map(async (stream) =>\n            command.streams[stream].eof\n              ? { bytes: Buffer.alloc(0), eof: true }\n              : await router.read(\n                  command,\n                  stream,\n                  command.streams[stream].byteOffset,\n                  remainingWait,\n                  cancellation.signal,\n                ),\n          ),\n          router.poll(command, cancellation.signal),\n        ] as const;\n        const results = await Promise.allSettled(\n          operations.map((operation) =>\n            operation.catch((error) => {\n              cancellation.abort(error);\n              throw error;\n            }),\n          ),\n        );\n        const failed = results.find((result) => result.status === \"rejected\");\n        // Abort-induced sibling rejections may sort before the failing poll.\n        // Preserve the first actual provider fault rather than array order.\n        if (failed?.status === \"rejected\") throw cancellation.signal.reason ?? failed.reason;\n        const stdout = (results[0] as PromiseFulfilledResult<{ bytes: Buffer; eof: boolean }>)\n          .value;\n        const stderr = (results[1] as PromiseFulfilledResult<{ bytes: Buffer; eof: boolean }>)\n          .value;\n        let exit = (results[2] as PromiseFulfilledResult<number | null>).value;\n        if (exit === null && stdout.eof && stderr.eof)\n          exit = await this.pollAfterEof(router, command, cancellation.signal, deadline);\n        return collectModalRawOutputPage(\n          command,\n          { stdout, stderr },\n          { source: \"router_poll\", code: exit },\n        );\n      });\n    } finally {\n      clearTimeout(lookupTimeout);\n      signal?.removeEventListener(\"abort\", abort);\n    }\n  }\n\n  /** TaskExecPoll is a point-in-time status, issued concurrently with stream\n   * reads that may wait for EOF. A poll answered before the command exited\n   * reports \"running\" even when both streams then finish, and callers that\n   * read once (internal Channel-A commands) would treat a finished command as\n   * still running. After both streams reach EOF, poll again within this read's\n   * existing budget. EOF is not exit proof: a re-poll fault or an exhausted\n   * budget keeps the observed bytes and reports the exit as still unknown, and\n   * only caller cancellation propagates. Re-poll faults are deliberately not\n   * classified here; the next page's concurrent poll classifies the same\n   * provider state. Each re-poll is bounded by the read deadline so a slow\n   * poll cannot exhaust the outer budget and discard the page. */\n  private async pollAfterEof(\n    router: ModalCommandRouterWire,\n    command: ModalRouterProviderCommand,\n    signal: AbortSignal,\n    deadline: number,\n  ): Promise<number | null> {\n    let pause = 10;\n    for (;;) {\n      signal.throwIfAborted();\n      const budget = deadline - performance.now();\n      if (budget <= 0) return null;\n      let exit: number | null;\n      try {\n        exit = await router.poll(\n          command,\n          AbortSignal.any([signal, AbortSignal.timeout(Math.ceil(budget) + REPOLL_GRACE_MS)]),\n        );\n      } catch {\n        signal.throwIfAborted();\n        return null;\n      }\n      if (exit !== null) return exit;\n      const remaining = deadline - performance.now();\n      if (remaining <= 0) return null;\n      try {\n        await delay(Math.min(pause, remaining), undefined, { signal });\n      } catch {\n        signal.throwIfAborted();\n        return null;\n      }\n      pause = Math.min(pause * 2, 250);\n    }\n  }\n\n  async readProbe(\n    command: ModalProviderCommand,\n    waitMs: number,\n    cancellation: AbortController,\n  ): Promise<ModalProviderOutputPage> {\n    return await this.read(command, waitMs, cancellation.signal);\n  }\n\n  async write(command: ModalProviderCommand, chars: string, index: number): Promise<void> {\n    SandboxProviderCommand.parse(command);\n    if (command.sandboxId !== this.sandboxId)\n      throw new Error(\"Modal command does not belong to this sandbox\");\n    if (command.kind === \"modal-control-v1\") return await this.legacy.write(command, chars, index);\n    await this.withRouter(command.taskId, undefined, (router) =>\n      router.write(command, index, Buffer.from(chars)),\n    );\n  }\n}\n","/** Only used inside a read-only provider RPC boundary. This is deliberately\n * not a Start classifier: remote DNS prose never proves non-dispatch. */\nexport function isModalCommandObservationTransportError(error: unknown): boolean {\n  const seen = new Map<object, boolean>();\n  let nodes = 0;\n  const own = (value: object, key: string): unknown => {\n    const descriptor = Object.getOwnPropertyDescriptor(value, key);\n    if (descriptor && !(\"value\" in descriptor)) throw new Error(\"Unreadable provider error graph\");\n    return descriptor && \"value\" in descriptor ? descriptor.value : undefined;\n  };\n  const visit = (value: unknown, depth: number): boolean => {\n    if (!value || typeof value !== \"object\" || depth > 6 || ++nodes > 32) return false;\n    if (seen.has(value)) return seen.get(value)!;\n    // A cycle sees false until this bounded branch has been fully evaluated.\n    seen.set(value, false);\n    try {\n      const code = own(value, \"code\");\n      const nested: unknown[] = [own(value, \"cause\"), own(value, \"error\")].filter(\n        (item) => item !== undefined,\n      );\n      const errors = own(value, \"errors\");\n      if (errors !== undefined) {\n        if (!Array.isArray(errors) || !errors.length || errors.length > 16) return false;\n        for (let index = 0; index < errors.length; index++) nested.push(own(errors, String(index)));\n      }\n      if (code !== undefined) {\n        const normalized = typeof code === \"string\" ? code.trim().toUpperCase() : code;\n        if (\n          ![\n            1,\n            2,\n            4,\n            13,\n            14,\n            \"1\",\n            \"2\",\n            \"4\",\n            \"13\",\n            \"14\",\n            \"CANCELLED\",\n            \"UNKNOWN\",\n            \"DEADLINE_EXCEEDED\",\n            \"INTERNAL\",\n            \"UNAVAILABLE\",\n            \"ECONNRESET\",\n            \"ECONNREFUSED\",\n            \"ETIMEDOUT\",\n            \"EAI_AGAIN\",\n            \"ENOTFOUND\",\n          ].includes(normalized as never)\n        )\n          return false;\n        const result = nested.length === 0 || nested.every((item) => visit(item, depth + 1));\n        seen.set(value, result);\n        return result;\n      }\n      const result = nested.length > 0 && nested.every((item) => visit(item, depth + 1));\n      seen.set(value, result);\n      return result;\n    } catch {\n      return false;\n    }\n  };\n  return visit(error, 0);\n}\n","import {\n  ModalImageSelector,\n  ModalSandboxSession,\n  buildModalCloudBucketMountConfig,\n  isModalCloudBucketMountEntry,\n  type ModalSandboxClient,\n  type ModalSandboxClientOptions,\n  type ModalSandboxSessionState,\n} from \"@openai/agents-extensions/sandbox/modal\";\nimport {\n  Manifest,\n  isMount,\n  normalizeSandboxClientCreateArgs,\n  SandboxUnsupportedFeatureError,\n  type Entry,\n} from \"@openai/agents/sandbox\";\nimport { materializeEnvironment, readOptionalString } from \"@openai/agents-core/sandbox/internal\";\nimport { ModalClient, Sandbox, type Image, type CloudBucketMount } from \"modal\";\nimport { createModalProviderCreateBoundary, type ModalCreateIntent } from \"./modal-create-boundary\";\nimport { modalCommandStartCleanupIsSafe } from \"./modal-command-start-errors\";\n\nexport type ModalCreateLifecycle = {\n  beforeDispatch: (intent: ModalCreateIntent, providerContext: unknown) => Promise<void>;\n  onCreated: (session: ModalSandboxSession, intent: ModalCreateIntent) => Promise<void>;\n};\n\n/** Release local transport after a failed create, but never stop a box whose\n * original setup invocation may still be writing behind its durable fence. */\nexport async function releaseModalCreateFailure(\n  session: Pick<ModalSandboxSession, \"close\"> | undefined,\n  modal: Pick<ModalClient, \"close\">,\n  error: unknown,\n): Promise<never> {\n  try {\n    if (session && modalCommandStartCleanupIsSafe(error)) {\n      try {\n        await session.close();\n      } catch (cleanupError) {\n        // eslint-disable-next-line preserve-caught-error -- Both failures remain exact AggregateError causes.\n        throw new AggregateError(\n          [error, cleanupError],\n          \"Modal create failed and cleanup needs reconciliation\",\n          { cause: cleanupError },\n        );\n      }\n    }\n  } finally {\n    modal.close();\n  }\n  throw error;\n}\n\nfunction defined<T extends object>(\n  value: T,\n): {\n  [K in keyof T]?: Exclude<T[K], undefined>;\n} {\n  return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined)) as {\n    [K in keyof T]?: Exclude<T[K], undefined>;\n  };\n}\n\nfunction unsupported(feature: string): never {\n  throw new SandboxUnsupportedFeatureError(`Modal create does not support ${feature}`, {\n    provider: \"modal\",\n    feature,\n  });\n}\n\nfunction validateManifest(manifest: Manifest): void {\n  if (manifest.users.length) unsupported(\"manifest.users\");\n  if (manifest.groups.length) unsupported(\"manifest.groups\");\n  if (manifest.extraPathGrants.length) unsupported(\"manifest.extraPathGrants\");\n  for (const { entry } of manifest.iterEntries()) {\n    if (entry.permissions !== undefined) unsupported(\"entry.permissions\");\n    if (entry.group !== undefined) unsupported(\"entry.group\");\n    if (isMount(entry) && !isModalCloudBucketMountEntry(entry)) unsupported(\"entry.mountStrategy\");\n  }\n}\n\nfunction withoutMounts(manifest: Manifest): Manifest {\n  const entries = (source: Record<string, Entry>): Record<string, Entry> =>\n    Object.fromEntries(\n      Object.entries(source)\n        .filter(([, entry]) => !isMount(entry))\n        .map(([path, entry]) => [\n          path,\n          entry.type === \"dir\" && entry.children\n            ? { ...structuredClone(entry), children: entries(entry.children) }\n            : structuredClone(entry),\n        ]),\n    );\n  return new Manifest({\n    version: manifest.version,\n    root: manifest.root,\n    entries: entries(manifest.entries),\n    environment: Object.fromEntries(\n      Object.entries(manifest.environment).map(([key, value]) => [key, value.init()]),\n    ),\n    users: structuredClone(manifest.users),\n    groups: structuredClone(manifest.groups),\n    extraPathGrants: structuredClone(manifest.extraPathGrants),\n    remoteMountCommandAllowlist: [...manifest.remoteMountCommandAllowlist],\n  });\n}\n\n/** Own physical creation while retaining the pinned SDK's public session API.\n * Its ordinary create() applies the manifest before exposing the instance ID,\n * which is too late for a durable worker lease. No global SDK monkey-patching.\n */\nexport async function createModalSessionWithLifecycle(\n  defaults: Partial<ModalSandboxClientOptions>,\n  args: Parameters<ModalSandboxClient[\"create\"]>[0],\n  lifecycle: ModalCreateLifecycle,\n  installPolicy: (session: ModalSandboxSession) => ModalSandboxSession,\n): Promise<ModalSandboxSession> {\n  const create = normalizeSandboxClientCreateArgs(args);\n  if (create.snapshot !== undefined) unsupported(\"snapshot\");\n  const overrides = create.options as Partial<ModalSandboxClientOptions> | undefined;\n  const options = { ...defaults };\n  for (const [key, value] of Object.entries(overrides ?? {})) {\n    if (value !== null && value !== undefined) Object.assign(options, { [key]: value });\n  }\n  options.env = { ...defaults.env, ...overrides?.env };\n  if (options.sandbox) unsupported(\"existing sandbox selector in physical create\");\n  if (!options.appName?.trim()) throw new Error(\"Modal create requires a non-empty appName\");\n  if (\n    options.nativeCloudBucketSecretName !== undefined &&\n    !options.nativeCloudBucketSecretName.trim()\n  ) {\n    throw new Error(\"Modal nativeCloudBucketSecretName must be non-empty\");\n  }\n  const workspacePersistence = options.workspacePersistence ?? \"tar\";\n  if (![\"tar\", \"snapshot_filesystem\", \"snapshot_directory\"].includes(workspacePersistence))\n    unsupported(\"workspacePersistence\");\n  for (const key of [\n    \"sandboxCreateTimeoutS\",\n    \"snapshotFilesystemTimeoutMs\",\n    \"snapshotFilesystemRestoreTimeoutMs\",\n    \"timeoutMs\",\n    \"idleTimeoutMs\",\n    \"cpu\",\n    \"memoryMiB\",\n  ] as const) {\n    const value = options[key];\n    if (value !== undefined && (!Number.isFinite(value) || value <= 0))\n      throw new Error(`Modal ${key} must be positive`);\n  }\n  const manifest = create.manifest;\n  validateManifest(manifest);\n  // Validate mount configuration before any provider resource is requested.\n  for (const { entry } of manifest.mountTargets()) {\n    buildModalCloudBucketMountConfig(\n      entry,\n      defined({\n        secretName:\n          readOptionalString(entry.mountStrategy, \"secretName\") ??\n          options.nativeCloudBucketSecretName,\n        secretEnvironmentName: readOptionalString(entry.mountStrategy, \"secretEnvironmentName\"),\n      }),\n    );\n  }\n  let session: ModalSandboxSession | undefined;\n  let timedOut = false;\n  let cloudBucketMounts: Record<string, CloudBucketMount> | undefined;\n  let state: Omit<ModalSandboxSessionState, \"sandboxId\">;\n  let app: Awaited<ReturnType<ModalClient[\"apps\"][\"fromName\"]>>;\n  const modal = new ModalClient(\n    defined({\n      tokenId: options.tokenId,\n      tokenSecret: options.tokenSecret,\n      environment: options.environment,\n      endpoint: options.endpoint,\n      grpcMiddleware: [\n        createModalProviderCreateBoundary({\n          operationId: crypto.randomUUID(),\n          beforeDispatch: async (intent) => {\n            if (timedOut) throw new Error(\"Modal create expired before provider dispatch\");\n            await lifecycle.beforeDispatch(intent, { modal });\n          },\n          onReceipt: async (receipt) => {\n            const constructorArgs = {\n              modal,\n              app,\n              sandbox: new Sandbox(modal, receipt.instanceId),\n              ownsSandbox: true,\n              state: { ...state, sandboxId: receipt.instanceId, imageId: receipt.imageId },\n              cloudBucketMounts,\n              cloudBucketMountsProvider: async () =>\n                await resolveMounts(session?.state.manifest ?? manifest),\n              concurrencyLimits: create.concurrencyLimits,\n              archiveLimits: create.archiveLimits,\n            };\n            // Agents Extensions 0.14.3's structural Modal types predate Modal 0.9's\n            // snapshot options. Runtime policy adapts that pinned interface.\n            session = installPolicy(\n              new ModalSandboxSession(\n                constructorArgs as unknown as ConstructorParameters<typeof ModalSandboxSession>[0],\n              ),\n            );\n            // The pinned SDK closes processes/the box, but not its Modal\n            // transport. This adapter owns a dedicated client per create.\n            const closeSession = session.close.bind(session);\n            session.close = async () => {\n              await closeSession();\n              modal.close();\n            };\n            await lifecycle.onCreated(session, receipt);\n          },\n        }),\n      ],\n    }),\n  );\n  const resolveMounts = async (source: Manifest) => {\n    const result: Record<string, CloudBucketMount> = {};\n    for (const { entry, mountPath } of source.mountTargets()) {\n      if (!isModalCloudBucketMountEntry(entry)) unsupported(\"entry.mountStrategy\");\n      const config = buildModalCloudBucketMountConfig(\n        entry,\n        defined({\n          secretName:\n            readOptionalString(entry.mountStrategy, \"secretName\") ??\n            options.nativeCloudBucketSecretName,\n          secretEnvironmentName: readOptionalString(entry.mountStrategy, \"secretEnvironmentName\"),\n        }),\n      );\n      const secret = config.secretName\n        ? await modal.secrets.fromName(\n            config.secretName,\n            defined({\n              environment: config.secretEnvironmentName,\n            }),\n          )\n        : config.credentials\n          ? await modal.secrets.fromObject(config.credentials)\n          : undefined;\n      result[mountPath] = modal.cloudBucketMounts.create(\n        config.bucketName,\n        defined({\n          bucketEndpointUrl: config.bucketEndpointUrl,\n          keyPrefix: config.keyPrefix,\n          readOnly: config.readOnly,\n          secret,\n        }),\n      );\n    }\n    return Object.keys(result).length ? result : undefined;\n  };\n  try {\n    app = await modal.apps.fromName(\n      options.appName,\n      defined({\n        createIfMissing: true,\n        environment: options.environment,\n      }),\n    );\n    const environment = await materializeEnvironment(manifest, options.env);\n    const selector =\n      options.image ?? ModalImageSelector.fromTag(options.imageTag ?? \"debian:bookworm-slim\");\n    let image: Image;\n    if (selector.kind === \"image\") image = selector.value as Image;\n    else if (typeof selector.value !== \"string\" || !selector.value.trim())\n      throw new Error(\"Modal image identity must be non-empty\");\n    else if (selector.kind === \"id\") image = await modal.images.fromId(selector.value);\n    else if (selector.kind === \"tag\") image = modal.images.fromRegistry(selector.value);\n    else throw new Error(\"Unsupported Modal image selector\");\n    if (typeof image?.build !== \"function\")\n      throw new Error(\"Modal image selector requires a native Image\");\n    cloudBucketMounts = await resolveMounts(manifest);\n    state = {\n      manifest,\n      ownsSandbox: true,\n      appName: options.appName,\n      imageTag:\n        selector.kind === \"tag\"\n          ? (selector.value as string)\n          : (options.imageTag ?? \"debian:bookworm-slim\"),\n      sandboxCreateTimeoutS: options.sandboxCreateTimeoutS,\n      workspacePersistence,\n      snapshotFilesystemTimeoutMs: options.snapshotFilesystemTimeoutMs,\n      snapshotFilesystemRestoreTimeoutMs: options.snapshotFilesystemRestoreTimeoutMs,\n      environment,\n      timeoutMs: options.timeoutMs,\n      idleTimeoutMs: options.idleTimeoutMs,\n      cpu: options.cpu,\n      memoryMiB: options.memoryMiB,\n      gpu: options.gpu,\n      configuredExposedPorts: options.exposedPorts,\n      modalEnvironment: options.environment,\n      endpoint: options.endpoint,\n      imageBuilderVersion: options.imageBuilderVersion,\n      nativeCloudBucketSecretName: options.nativeCloudBucketSecretName,\n      useSleepCmd: options.useSleepCmd ?? true,\n    };\n    const physicalCreate = modal.sandboxes.create(\n      app,\n      image,\n      defined({\n        workdir: manifest.root,\n        env: environment,\n        command: state.useSleepCmd ? [\"sleep\", \"infinity\"] : undefined,\n        timeoutMs: options.timeoutMs,\n        idleTimeoutMs: options.idleTimeoutMs,\n        cpu: options.cpu,\n        memoryMiB: options.memoryMiB,\n        gpu: options.gpu,\n        encryptedPorts: options.exposedPorts,\n        cloudBucketMounts,\n      }),\n    );\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    try {\n      await (options.sandboxCreateTimeoutS === undefined\n        ? physicalCreate\n        : Promise.race([\n            physicalCreate,\n            new Promise<never>((_, reject) => {\n              timer = setTimeout(() => {\n                timedOut = true;\n                reject(\n                  new Error(\"Modal sandbox creation timed out; provider receipt remains fenced\"),\n                );\n              }, options.sandboxCreateTimeoutS! * 1000);\n            }),\n          ]));\n    } finally {\n      if (timer) clearTimeout(timer);\n      // A late callback still persists its ID. Cleanup cannot license another\n      // create until the durable lease has that identity and terminal proof.\n      if (timedOut)\n        void physicalCreate\n          .then(\n            async () => {\n              await session?.close();\n            },\n            async () => {\n              await session?.close();\n            },\n          )\n          .catch(() => {\n            modal.logger.warn(\n              \"Late Modal create cleanup failed; durable lease requires reconciliation\",\n            );\n          })\n          .finally(() => modal.close());\n    }\n    if (!session) throw new Error(\"Modal create bypassed the required physical receipt boundary\");\n    await session.applyManifest(withoutMounts(manifest));\n    return session;\n  } catch (error) {\n    // Timed-out work still owns its transport until its late receipt settles.\n    // Every synchronous failure releases the transport even if stopping the\n    // provider fails; durable reconciliation uses a separate authenticated client.\n    if (!timedOut) {\n      return await releaseModalCreateFailure(session, modal, error);\n    }\n    throw error;\n  }\n}\n","import { createHash } from \"node:crypto\";\nimport type { ModalClient } from \"modal\";\n\ntype ModalMiddleware = NonNullable<\n  NonNullable<ConstructorParameters<typeof ModalClient>[0]>[\"grpcMiddleware\"]\n>[number];\n\nconst CREATE_PATH = \"/modal.client.ModalClient/SandboxCreate\";\nconst OPERATION_TAG = \"opengeni_provider_create_operation_id\";\n\nexport type ModalCreateIntent = {\n  operationId: string;\n  name: string;\n  appId: string;\n  imageId: string;\n  requestSha256: string;\n};\n\nexport function modalCreateOperationName(operationId: string): string {\n  if (!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/u.test(operationId)) {\n    throw new Error(\"Modal create requires a UUID operation identity\");\n  }\n  return `opengeni-create-${operationId}`;\n}\n\n/** One controller per attempted physical create, on a dedicated Modal client.\n *\n * Modal 0.9.0 runs this middleware outside its retry middleware. Disable retries\n * for this RPC: the SDK otherwise invents a new, unpersisted idempotency key.\n * Preparation (image builds, secret hydration) runs before this boundary. Once\n * beforeDispatch starts, even an interrupted database acknowledgement is an\n * uncertain attempt. Neither an exception nor named lookup absence licenses a\n * second dispatch. The durable lease, not this in-memory latch, owns recovery.\n *\n * Names/tags are atomic positive-discovery aids, never a quiescence guarantee.\n * No raw request, environment, or secret material leaves this adapter.\n */\nexport function createModalProviderCreateBoundary(input: {\n  operationId: string;\n  beforeDispatch: (intent: ModalCreateIntent) => Promise<void>;\n  onReceipt: (receipt: ModalCreateIntent & { instanceId: string }) => Promise<void>;\n}): ModalMiddleware {\n  const name = modalCreateOperationName(input.operationId);\n  let attempted = false;\n  return async function* modalProviderCreateBoundary(call, options) {\n    if (call.method.path !== CREATE_PATH) return yield* call.next(call.request, options);\n    if (call.requestStream || call.responseStream) {\n      throw new Error(\"Modal SandboxCreate unexpectedly became a streaming RPC\");\n    }\n    if (attempted)\n      throw new Error(\"Modal provider create was already attempted; reconcile its receipt\");\n    const request = call.request as {\n      appId?: unknown;\n      definition?: { imageId?: unknown; name?: unknown; [key: string]: unknown };\n      tags?: Array<{ tagName: string; tagValue: string }>;\n    };\n    if (\n      typeof request.appId !== \"string\" ||\n      !request.appId ||\n      typeof request.definition?.imageId !== \"string\" ||\n      !request.definition.imageId ||\n      (request.definition.name && request.definition.name !== name) ||\n      !Array.isArray(request.tags) ||\n      request.tags.some(\n        (tag) => tag.tagName === OPERATION_TAG && tag.tagValue !== input.operationId,\n      )\n    ) {\n      throw new Error(\"Modal SandboxCreate wire identity does not match the owned operation\");\n    }\n    const wireRequest = {\n      ...request,\n      definition: { ...request.definition, name },\n      tags: [\n        ...request.tags.filter((tag) => tag.tagName !== OPERATION_TAG),\n        { tagName: OPERATION_TAG, tagValue: input.operationId },\n      ],\n    };\n    const intent: ModalCreateIntent = {\n      operationId: input.operationId,\n      name,\n      appId: request.appId,\n      imageId: request.definition.imageId,\n      requestSha256: createHash(\"sha256\").update(JSON.stringify(wireRequest)).digest(\"hex\"),\n    };\n    attempted = true;\n    await input.beforeDispatch(intent);\n    // Middleware is generic over every Modal RPC. The exact method/path and\n    // validated request above narrow this one operation's protobuf boundary.\n    const dispatchOptions = { ...options, retries: 0 };\n    const response = yield* call.next(wireRequest as typeof call.request, dispatchOptions);\n    const instanceId = (response as { sandboxId?: unknown } | null)?.sandboxId;\n    if (typeof instanceId !== \"string\" || !instanceId.startsWith(\"sb-\")) {\n      throw new Error(\n        \"Modal create returned no physical sandbox identity; operation remains uncertain\",\n      );\n    }\n    // Persist even if the caller has since cancelled. Cancellation cannot erase\n    // an already-created provider instance or turn it into a never-sent request.\n    await input.onReceipt({ ...intent, instanceId });\n    return response;\n  };\n}\n","import { CAPABILITY_DESCRIPTORS } from \"../capabilities\";\nimport type { ProviderRegistration } from \"./types\";\n\nexport const noneProvider: ProviderRegistration = {\n  backend: \"none\",\n  exactResumeMode: \"none\",\n  instanceIdFields: [],\n  workspaceCapturePolicy: () => null,\n  descriptor: CAPABILITY_DESCRIPTORS.none,\n  // No sandbox: nothing to validate, and build() returns undefined. The factory\n  // short-circuits on \"none\" before calling build, but we keep build honest.\n  validateCredentials() {},\n  build() {\n    return undefined;\n  },\n};\n","import {\n  ConnectionConfig,\n  Sandbox as ProviderSandbox,\n  SandboxApiException,\n  createDefaultAdapterFactory,\n  type AdapterFactory,\n  type ConnectionConfigOptions,\n  type CreateSandboxRequest,\n  type Endpoint,\n  type Sandboxes,\n} from \"@alibaba-group/opensandbox\";\nimport { confinedFileReadCommand, parseConfinedFileRead } from \"../confined-file-read\";\nimport {\n  Manifest,\n  Permissions,\n  SandboxArchiveError,\n  SandboxConfigurationError,\n  SandboxExposedPortUnavailableError,\n  SandboxProviderError,\n  SandboxUnsupportedFeatureError,\n  SandboxWorkspaceReadNotFoundError,\n  normalizeRelativePath,\n  normalizeSandboxClientCreateArgs,\n  recordExposedPortEndpoint,\n  resolveSandboxArchiveLimits,\n  validateSandboxArchiveLimits,\n  type Entry,\n  type ExecCommandArgs,\n  type ExposedPortEndpoint,\n  type MaterializeEntryArgs,\n  type SandboxArchiveLimits,\n  type SandboxClientCreateArgs,\n  type SandboxClientResumeOptions,\n  type SandboxDirectoryEntry,\n  type SandboxExecResult,\n  type SandboxSessionState,\n  type ViewImageArgs,\n  type WorkspaceArchiveData,\n  type WorkspaceArchiveOptions,\n  type WriteStdinArgs,\n} from \"@openai/agents/sandbox\";\nimport {\n  deserializeManifest,\n  elapsedSeconds,\n  formatExecResponse,\n  imageOutputFromBytes,\n  mergeManifestDelta,\n  mergeManifestEntryDelta,\n  mergeMaterializedEnvironment,\n  rehydratePersistedEnvironmentForRuntime,\n  serializeManifestRecord,\n  serializeRuntimeEnvironmentForPersistence,\n  shellQuote,\n  toUint8Array,\n  truncateOutput,\n} from \"@openai/agents-core/sandbox/internal\";\nimport { createHash, randomUUID } from \"node:crypto\";\nimport { lstat, readFile as readLocalFile, readdir } from \"node:fs/promises\";\nimport { posix } from \"node:path\";\nimport { SandboxConfigError, SandboxExactResumeInstanceUnavailableError } from \"../errors\";\nimport {\n  nextDurableOpId,\n  notifyRemoteOperationNotDispatched,\n  notifyRemoteOperationTransportSelected,\n  type RemoteOperationObservation,\n} from \"../op-correlation\";\nimport { parseOpenSandboxSignedUriPath, redactOpenSandboxSignedUriPath } from \"../stream-port\";\nimport type { RuntimeMetricsHooks } from \"../../metrics\";\nimport {\n  SynchronousCommandOutcomeUnknownError,\n  type SynchronousCommandPage,\n} from \"../synchronous-command\";\nimport {\n  OpenSandboxCommandStreamError,\n  OpenSandboxCommandDispatchError,\n  withOpenSandboxCommandDispatchProof,\n  withOpenSandboxCommandStreamProof,\n} from \"./opensandbox-command-stream\";\n\nconst WORKSPACE_ROOT = \"/workspace\";\nconst PRIVATE_ROOT = \"/tmp/opengeni-private\";\nconst BROWSERD_ROOT = \"/tmp/opengeni-browserd\";\nconst ALLOWED_PRIVATE_ROOTS = [PRIVATE_ROOT, BROWSERD_ROOT] as const;\nconst DEFAULT_EXEC_YIELD_TIME_MS = 10_000;\n/** Lifecycle `commands.run` often spends ~10s on the control plane even for\n * `echo`. Channel-A file/git reads use a 10–20s yield and must not be\n * classified as retained processes just because that round-trip is slow. */\nconst COMMAND_API_SETTLE_GRACE_MS = 30_000;\nconst DEFAULT_WRITE_STDIN_YIELD_TIME_MS = 250;\nconst OPENSANDBOX_STATE_VERSION = 1;\n\nexport type OpenSandboxApplyDiff = (\n  input: string,\n  diff: string,\n  mode?: \"default\" | \"create\",\n) => string;\nlet injectedApplyDiff: OpenSandboxApplyDiff | undefined;\n\nexport function setOpenSandboxApplyDiff(fn: OpenSandboxApplyDiff): void {\n  injectedApplyDiff = fn;\n}\n\nexport interface OpenSandboxEditor {\n  createFile(\n    operation: { path: string; diff: string },\n    context?: unknown,\n  ): Promise<{ output?: string } | void>;\n  updateFile(\n    operation: { path: string; diff: string; moveTo?: string },\n    context?: unknown,\n  ): Promise<{ output?: string } | void>;\n  deleteFile(operation: { path: string }, context?: unknown): Promise<{ output?: string } | void>;\n}\n\nexport type OpenSandboxClientOptions = {\n  baseUrl: string;\n  apiKey: string;\n  image: string;\n  ttlSeconds: number;\n  useServerProxy: boolean;\n  /** OSEP-0011 signed URI-mode Channel B. Independent of `useServerProxy`. */\n  signedEndpoints?: boolean;\n  signedEndpointTtlSeconds?: number;\n  /** Laptop/port-forward rewrite for Channel B only. Preserves the signed path. */\n  channelBPublicBaseUrl?: string;\n  poolRef?: string;\n  readyTimeoutSeconds: number;\n  resourceLimits: Record<string, string>;\n  resourceRequests: Record<string, string>;\n  environment?: Record<string, string>;\n  exposedPorts?: number[];\n  adapterFactory?: AdapterFactory;\n  metrics?: RuntimeMetricsHooks;\n};\n\nexport interface OpenSandboxSessionState extends SandboxSessionState {\n  stateVersion: typeof OPENSANDBOX_STATE_VERSION;\n  sandboxId: string;\n  manifest: Manifest;\n  environment: Record<string, string>;\n  image: string;\n  poolRef: string | null;\n  providerBindingHash: string;\n  workspacePersistence: \"tar\";\n  configuredExposedPorts: number[];\n  workspaceReady: boolean;\n  expiresAt: string | null;\n}\n\ntype ProcessEvent = { stream: \"stdout\" | \"stderr\"; text: string; commandOutput?: false };\ntype ProcessOutcome = {\n  exitCode: number | null;\n  error?: unknown;\n  uncertain?: boolean;\n};\ntype RetainedProcess = {\n  opId: string;\n  sessionId: number | null;\n  /** The launch client, never a later reconnect or active route. */\n  provider: ProviderSandbox | null;\n  /** Physical terminal proof survives native alias retirement. It neither\n   * consumes output nor proves that the event stream was complete. */\n  physicalOutcome: { exitCode: number; error?: unknown } | null;\n  failureCause?: unknown;\n  startedAt: number;\n  events: ProcessEvent[];\n  cursor: number;\n  executionId: string | null;\n  executionIdReady: Promise<string | null>;\n  resolveExecutionId: (value: string | null) => void;\n  completed: Promise<ProcessOutcome>;\n  settled: boolean;\n  transportUncertain: boolean;\n  /** Status can prove physical exit, never reconstruct a lost event stream. */\n  outputUnavailable: boolean;\n  outputCursor: { stdout: number; stderr: number };\n};\n\nfunction canonicalBaseUrl(value: string): string {\n  const url = new URL(value);\n  url.hash = \"\";\n  url.search = \"\";\n  url.pathname = url.pathname.replace(/\\/+$/u, \"\");\n  return url.toString().replace(/\\/$/u, \"\");\n}\n\nfunction providerBindingHash(baseUrl: string): string {\n  return createHash(\"sha256\").update(canonicalBaseUrl(baseUrl)).digest(\"hex\");\n}\n\nfunction connectionOptions(input: OpenSandboxClientOptions): ConnectionConfigOptions {\n  return {\n    domain: canonicalBaseUrl(input.baseUrl),\n    apiKey: input.apiKey,\n    requestTimeoutSeconds: input.readyTimeoutSeconds,\n    useServerProxy: input.useServerProxy,\n    disableMetrics: true,\n  };\n}\n\nasync function withLifecycle<T>(\n  options: OpenSandboxClientOptions,\n  fn: (sandboxes: Sandboxes) => Promise<T>,\n): Promise<T> {\n  const connection = new ConnectionConfig(connectionOptions(options)).withTransportIfMissing();\n  try {\n    const factory = options.adapterFactory ?? createDefaultAdapterFactory();\n    const stack = factory.createLifecycleStack({\n      connectionConfig: connection,\n      lifecycleBaseUrl: connection.getBaseUrl(),\n    });\n    return await fn(stack.sandboxes);\n  } finally {\n    await connection.closeTransport();\n  }\n}\n\nfunction isNotFound(error: unknown): boolean {\n  return error instanceof SandboxApiException && error.statusCode === 404;\n}\n\nfunction assertSupportedProviderState(\n  info: { status?: { state?: unknown } },\n  sandboxId: string,\n): void {\n  const state = info.status?.state;\n  if (state !== \"Running\" && state !== \"Creating\") {\n    throw new SandboxExactResumeInstanceUnavailableError(\"opensandbox\", sandboxId);\n  }\n}\n\nfunction normalizeConfiguredPorts(ports: readonly number[] | undefined): number[] {\n  return [\n    ...new Set(\n      (ports ?? []).filter((port) => Number.isInteger(port) && port > 0 && port <= 65_535),\n    ),\n  ].sort((left, right) => left - right);\n}\n\nfunction assertNoSnapshot(args: ReturnType<typeof normalizeSandboxClientCreateArgs>): void {\n  if (args.snapshot && (args.snapshot as { type?: unknown }).type !== \"noop\") {\n    throw new SandboxUnsupportedFeatureError(\n      \"OpenSandbox v1 uses Opengeni portable workspace archives and does not accept SDK snapshot specs.\",\n    );\n  }\n}\n\nfunction recordSignedEndpointMetric(\n  metrics: RuntimeMetricsHooks | undefined,\n  input: { outcome: \"minted\" | \"mint_failed\" | \"host_fetch_unauthorized\"; port: number },\n): void {\n  try {\n    metrics?.onOpenSandboxSignedEndpoint?.(input);\n  } catch {\n    /* metrics must not affect Channel B */\n  }\n}\n\nfunction createRequest(\n  options: OpenSandboxClientOptions,\n  environment: Record<string, string>,\n): CreateSandboxRequest {\n  const common: CreateSandboxRequest = {\n    timeout: options.ttlSeconds,\n    env: environment,\n    metadata: { opengeni: \"true\", backend: \"opensandbox\" },\n    resourceLimits: options.resourceLimits,\n    resourceRequests: options.resourceRequests,\n    ...(options.signedEndpoints ? { secureAccess: true } : {}),\n  };\n  if (options.poolRef) {\n    return {\n      ...common,\n      extensions: { poolRef: options.poolRef },\n    };\n  }\n  return {\n    ...common,\n    image: { uri: options.image },\n    entrypoint: [\"tail\", \"-f\", \"/dev/null\"],\n  };\n}\n\nfunction parseStateString(value: unknown, field: string): string {\n  if (typeof value !== \"string\" || value.trim().length === 0) {\n    throw new SandboxConfigError(\"opensandbox\", `persisted OpenSandbox ${field} is invalid`);\n  }\n  return value;\n}\n\nfunction parseOptionalString(value: unknown, field: string): string | null {\n  if (value === null || value === undefined) return null;\n  return parseStateString(value, field);\n}\n\nfunction assertStateMatchesOptions(\n  state: OpenSandboxSessionState,\n  options: OpenSandboxClientOptions,\n): void {\n  if (state.providerBindingHash !== providerBindingHash(options.baseUrl)) {\n    throw new SandboxConfigError(\n      \"opensandbox\",\n      \"persisted OpenSandbox provider binding does not match the configured base URL\",\n    );\n  }\n  if (state.image !== options.image) {\n    throw new SandboxConfigError(\n      \"opensandbox\",\n      \"persisted OpenSandbox image does not match OPENGENI_OPENSANDBOX_IMAGE\",\n    );\n  }\n  if (state.poolRef !== (options.poolRef ?? null)) {\n    throw new SandboxConfigError(\n      \"opensandbox\",\n      \"persisted OpenSandbox pool does not match OPENGENI_OPENSANDBOX_POOL_REF\",\n    );\n  }\n}\n\nfunction isAllowedPrivatePath(absolute: string): boolean {\n  return ALLOWED_PRIVATE_ROOTS.some((root) => absolute === root || absolute.startsWith(`${root}/`));\n}\n\nfunction workspacePath(path: string, options: { allowPrivate?: boolean } = {}): string {\n  const raw = path.trim();\n  if (raw.includes(\"\\0\") || raw.includes(\"\\\\\")) {\n    throw new SandboxConfigurationError(`Invalid OpenSandbox path: ${path}`);\n  }\n  const absolute = raw.startsWith(\"/\") ? posix.normalize(raw) : posix.join(WORKSPACE_ROOT, raw);\n  const allowed =\n    absolute === WORKSPACE_ROOT ||\n    absolute.startsWith(`${WORKSPACE_ROOT}/`) ||\n    (options.allowPrivate === true && isAllowedPrivatePath(absolute));\n  if (!allowed) {\n    throw new SandboxConfigurationError(\n      `OpenSandbox path must stay within ${WORKSPACE_ROOT}${options.allowPrivate ? ` or ${ALLOWED_PRIVATE_ROOTS.join(\" or \")}` : \"\"}: ${path}`,\n    );\n  }\n  return absolute;\n}\n\nfunction logicalWorkspacePath(path: string): string {\n  const absolute = workspacePath(path);\n  return absolute === WORKSPACE_ROOT ? \"\" : absolute.slice(WORKSPACE_ROOT.length + 1);\n}\n\nfunction assertRunAsUnsupported(runAs: string | undefined): void {\n  if (runAs?.trim()) {\n    throw new SandboxUnsupportedFeatureError(\n      `OpenSandbox v1 cannot prove the uid/gid mapping for runAs=\"${runAs.trim()}\"; the operation was not run.`,\n    );\n  }\n}\n\nfunction commandForArgs(args: ExecCommandArgs): string {\n  const requestedShell = args.shell?.trim();\n  if (!requestedShell) return args.cmd;\n  return `${shellQuote(requestedShell)}${args.login === false ? \"\" : \" -l\"} -c ${shellQuote(args.cmd)}`;\n}\n\nfunction delay(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));\n}\n\nfunction consumeProcessOutput(process: RetainedProcess): {\n  output: string;\n  stdout: string;\n  stderr: string;\n  commandStdout: string;\n  commandStderr: string;\n  outputCursor: {\n    expected: { stdout: number; stderr: number };\n    next: { stdout: number; stderr: number };\n  };\n} {\n  const events = process.events.slice(process.cursor);\n  process.cursor = process.events.length;\n  const commandStdout = events\n    .filter((entry) => entry.stream === \"stdout\" && entry.commandOutput !== false)\n    .map((entry) => entry.text)\n    .join(\"\");\n  const commandStderr = events\n    .filter((entry) => entry.stream === \"stderr\" && entry.commandOutput !== false)\n    .map((entry) => entry.text)\n    .join(\"\");\n  const expected = { ...process.outputCursor };\n  process.outputCursor.stdout += Buffer.byteLength(commandStdout);\n  process.outputCursor.stderr += Buffer.byteLength(commandStderr);\n  return {\n    output: events.map((entry) => entry.text).join(\"\"),\n    stdout: events\n      .filter((entry) => entry.stream === \"stdout\")\n      .map((entry) => entry.text)\n      .join(\"\"),\n    stderr: events\n      .filter((entry) => entry.stream === \"stderr\")\n      .map((entry) => entry.text)\n      .join(\"\"),\n    commandStdout,\n    commandStderr,\n    outputCursor: { expected, next: { ...process.outputCursor } },\n  };\n}\n\nfunction archiveLimitArg(value: number | null): string {\n  return value === null ? \"-1\" : String(value);\n}\n\nexport function archiveRestoreScript(): string {\n  return String.raw`\nimport os, shutil, sys, tarfile\narchive, root, staging, backup, max_members, max_bytes, excluded_raw = sys.argv[1:]\nmax_members = int(max_members)\nmax_bytes = int(max_bytes)\nexcluded = [p for p in excluded_raw.split(\"\\n\") if p]\nreserved_prefixes = (\".opengeni-restore-\", \".opengeni-old-\")\n\ndef logical(name):\n    name = name.replace(\"\\\\\", \"/\")\n    while name.startswith(\"./\"):\n        name = name[2:]\n    if name in (\"\", \".\"):\n        return \"\"\n    if name.startswith(\"/\"):\n        raise ValueError(\"absolute archive member\")\n    normalized = os.path.normpath(name).replace(\"\\\\\", \"/\")\n    if normalized == \"..\" or normalized.startswith(\"../\"):\n        raise ValueError(\"escaping archive member\")\n    return normalized\n\ndef protected(name):\n    return any(name == p or name.startswith(p + \"/\") for p in excluded)\n\ndef reserved(name):\n    first = name.split(\"/\", 1)[0]\n    return any(first.startswith(prefix) for prefix in reserved_prefixes)\n\ndef workspace_child(path, prefix):\n    root_abs = os.path.abspath(root)\n    path_abs = os.path.abspath(path)\n    if os.path.dirname(path_abs) != root_abs:\n        raise ValueError(\"restore workspace path escaped root\")\n    if not os.path.basename(path_abs).startswith(prefix):\n        raise ValueError(\"restore workspace path has an invalid prefix\")\n    return path_abs\n\ndef exists(path):\n    return os.path.lexists(path)\n\nwith tarfile.open(archive, \"r:*\") as tf:\n    members = tf.getmembers()\n    if max_members >= 0 and len(members) > max_members:\n        raise ValueError(\"archive member limit exceeded\")\n    total = 0\n    checked = []\n    for member in members:\n        name = logical(member.name)\n        if protected(name):\n            raise ValueError(\"archive contains an ephemeral path\")\n        if reserved(name):\n            raise ValueError(\"archive contains a reserved restore path\")\n        if not (member.isdir() or member.isreg()):\n            raise ValueError(\"archive contains a non-file member\")\n        if member.isreg():\n            total += member.size\n            if max_bytes >= 0 and total > max_bytes:\n                raise ValueError(\"archive extracted-byte limit exceeded\")\n        checked.append((member, name))\n    shutil.rmtree(staging, ignore_errors=True)\n    os.makedirs(staging, mode=0o700, exist_ok=False)\n    for member, name in checked:\n        target = os.path.join(staging, name)\n        if member.isdir():\n            os.makedirs(target, exist_ok=True)\n            os.chmod(target, member.mode & 0o777)\n            continue\n        os.makedirs(os.path.dirname(target), exist_ok=True)\n        source = tf.extractfile(member)\n        if source is None:\n            raise ValueError(\"archive file has no content\")\n        with source, open(target, \"wb\") as dest:\n            shutil.copyfileobj(source, dest)\n        os.chmod(target, member.mode & 0o777)\n\nif not os.path.isdir(root):\n    raise ValueError(\"workspace root does not exist\")\nstaging = workspace_child(staging, \".opengeni-restore-\")\nbackup = workspace_child(backup, \".opengeni-old-\")\nshutil.rmtree(backup, ignore_errors=True)\nos.makedirs(backup, mode=0o700, exist_ok=False)\nmoved_old = []\nmoved_new = []\ntry:\n    for name in sorted(os.listdir(root)):\n        if name in (os.path.basename(staging), os.path.basename(backup)):\n            continue\n        os.replace(os.path.join(root, name), os.path.join(backup, name))\n        moved_old.append(name)\n    for name in sorted(os.listdir(staging)):\n        os.replace(os.path.join(staging, name), os.path.join(root, name))\n        moved_new.append(name)\nexcept Exception as swap_error:\n    rollback_errors = []\n    for name in reversed(moved_new):\n        current = os.path.join(root, name)\n        restored = os.path.join(staging, name)\n        try:\n            if exists(current):\n                os.replace(current, restored)\n        except Exception as error:\n            rollback_errors.append(str(error))\n    for name in reversed(moved_old):\n        saved = os.path.join(backup, name)\n        current = os.path.join(root, name)\n        try:\n            if exists(saved):\n                os.replace(saved, current)\n        except Exception as error:\n            rollback_errors.append(str(error))\n    if rollback_errors:\n        raise RuntimeError(\"workspace restore rollback failed: \" + \"; \".join(rollback_errors)) from swap_error\n    raise\nshutil.rmtree(backup)\nshutil.rmtree(staging)\n`;\n}\n\nexport class OpenSandboxSession {\n  readonly backendId = \"opensandbox\" as const;\n  readonly state: OpenSandboxSessionState;\n  private readonly options: OpenSandboxClientOptions;\n  get requireHostFetchController(): boolean {\n    return this.options.signedEndpoints === true;\n  }\n  get runtimeMetrics(): RuntimeMetricsHooks | undefined {\n    return this.options.metrics;\n  }\n  private provider: ProviderSandbox | null = null;\n  private startPromise: Promise<ProviderSandbox> | null = null;\n  private archiveLimits: SandboxArchiveLimits | null | undefined;\n  private nextSessionId = 1;\n  private readonly processesBySession = new Map<number, RetainedProcess>();\n  private readonly processesByOpId = new Map<string, RetainedProcess>();\n  private readonly synchronousResults = new WeakMap<object, SynchronousCommandPage>();\n  private readonly commandFailureCauses = new WeakMap<object, unknown>();\n  private readonly synchronousBanners = new Map<string, SynchronousCommandPage>();\n\n  constructor(args: {\n    state: OpenSandboxSessionState;\n    options: OpenSandboxClientOptions;\n    archiveLimits?: SandboxArchiveLimits | null;\n  }) {\n    this.state = args.state;\n    this.options = args.options;\n    this.setArchiveLimits(args.archiveLimits);\n  }\n\n  setArchiveLimits(limits?: SandboxArchiveLimits | null): void {\n    validateSandboxArchiveLimits(limits);\n    this.archiveLimits = limits;\n  }\n\n  private async ensureStarted(): Promise<ProviderSandbox> {\n    if (this.provider) return this.provider;\n    if (!this.startPromise) {\n      this.startPromise = ProviderSandbox.connect({\n        connectionConfig: connectionOptions(this.options),\n        sandboxId: this.state.sandboxId,\n        readyTimeoutSeconds: this.options.readyTimeoutSeconds,\n        adapterFactory: withOpenSandboxCommandStreamProof(\n          this.options.adapterFactory ?? createDefaultAdapterFactory(),\n        ),\n      })\n        .then(async (provider) => {\n          const info = await provider.getInfo();\n          assertSupportedProviderState(info, this.state.sandboxId);\n          if (info.id !== this.state.sandboxId) {\n            await provider.close().catch(() => undefined);\n            throw new SandboxProviderError(\"OpenSandbox connected to an unexpected sandbox ID\", {\n              expectedSandboxId: this.state.sandboxId,\n              actualSandboxId: info.id,\n            });\n          }\n          const image = info.image?.uri;\n          // Pool-backed BatchSandbox GET responses use \"unknown\" because the CR records a\n          // poolRef instead of an inline Pod template. Keep direct-image verification strict.\n          const providerReportedImage =\n            image && (this.state.poolRef === null || image !== \"unknown\") ? image : null;\n          if (providerReportedImage && providerReportedImage !== this.state.image) {\n            await provider.close().catch(() => undefined);\n            throw new SandboxProviderError(\"OpenSandbox image changed for the persisted sandbox\", {\n              sandboxId: this.state.sandboxId,\n            });\n          }\n          const poolRef =\n            info.extensions && typeof info.extensions.poolRef === \"string\"\n              ? info.extensions.poolRef\n              : null;\n          if (poolRef !== null && poolRef !== this.state.poolRef) {\n            await provider.close().catch(() => undefined);\n            throw new SandboxProviderError(\"OpenSandbox pool changed for the persisted sandbox\", {\n              sandboxId: this.state.sandboxId,\n            });\n          }\n          this.provider = provider;\n          this.state.expiresAt = info.expiresAt?.toISOString() ?? this.state.expiresAt;\n          return provider;\n        })\n        .catch((error) => {\n          this.startPromise = null;\n          if (isNotFound(error)) {\n            throw new SandboxExactResumeInstanceUnavailableError(\n              \"opensandbox\",\n              this.state.sandboxId,\n            );\n          }\n          throw error;\n        });\n    }\n    return await this.startPromise;\n  }\n\n  async start(): Promise<void> {\n    await this.ensureInitialManifestMaterialized();\n  }\n\n  async running(): Promise<boolean> {\n    try {\n      return await withLifecycle(this.options, async (sandboxes) => {\n        const info = await sandboxes.getSandbox(this.state.sandboxId);\n        return this.state.workspaceReady && info.status.state === \"Running\";\n      });\n    } catch (error) {\n      if (isNotFound(error)) return false;\n      throw error;\n    }\n  }\n\n  async renewExpiration(): Promise<string | null> {\n    const expiresAt = new Date(Date.now() + this.options.ttlSeconds * 1000).toISOString();\n    const response = await withLifecycle(\n      this.options,\n      async (sandboxes) =>\n        await sandboxes.renewSandboxExpiration(this.state.sandboxId, {\n          expiresAt,\n        }),\n    );\n    this.state.expiresAt = response.expiresAt?.toISOString() ?? expiresAt;\n    return this.state.expiresAt;\n  }\n\n  async delete(): Promise<void> {\n    try {\n      await withLifecycle(this.options, async (sandboxes) => {\n        await sandboxes.deleteSandbox(this.state.sandboxId);\n      });\n    } catch (error) {\n      if (!isNotFound(error)) throw error;\n    } finally {\n      await this.close();\n    }\n  }\n\n  async close(): Promise<void> {\n    const provider = this.provider;\n    this.provider = null;\n    this.startPromise = null;\n    if (provider) await provider.close();\n  }\n\n  supportsPty(): boolean {\n    return false;\n  }\n\n  async commandCancellationTransport(): Promise<\"remote_operation\"> {\n    return \"remote_operation\";\n  }\n\n  /** Adapter-owned event pages, never projections of the presentation banner.\n   * Reading a receipt does not acknowledge or release its output custody. */\n  getSynchronousCommandOutput(result: unknown): SynchronousCommandPage | null {\n    return typeof result === \"string\"\n      ? (this.synchronousBanners.get(result) ?? null)\n      : result && typeof result === \"object\"\n        ? (this.synchronousResults.get(result) ?? null)\n        : null;\n  }\n\n  async acknowledgeCommandOutput(result: string): Promise<void> {\n    const page = this.synchronousBanners.get(result);\n    if (page && !page.collectionUnavailable) this.synchronousBanners.delete(result);\n  }\n\n  private commandResult(\n    process: RetainedProcess,\n    consumed: ReturnType<typeof consumeProcessOutput>,\n    result: SandboxExecResult,\n  ): SandboxExecResult {\n    if (\"failureCause\" in process) this.commandFailureCauses.set(result, process.failureCause);\n    this.synchronousResults.set(result, {\n      stdout: consumed.commandStdout,\n      stderr: consumed.commandStderr,\n      exitCode: Number.isSafeInteger(result.exitCode) ? result.exitCode! : null,\n      ...(result.sessionId !== undefined ? { sessionId: result.sessionId } : {}),\n      wallTimeSeconds: result.wallTimeSeconds,\n      ...(process.outputUnavailable ? { collectionUnavailable: true } : {}),\n      outputCursor: {\n        identity: JSON.stringify([this.state.sandboxId, process.opId]),\n        ...consumed.outputCursor,\n      },\n    });\n    return result;\n  }\n\n  private commandBanner(result: SandboxExecResult): string {\n    let banner = formatExecResponse(result);\n    const page = this.synchronousResults.get(result);\n    if (page) {\n      // The SDK chooses the opaque Chunk ID. Do not rebind a still-owned\n      // receipt on a collision; formatting again performs no provider action.\n      while (this.synchronousBanners.has(banner)) banner = formatExecResponse(result);\n      this.synchronousBanners.set(banner, page);\n    }\n    return banner;\n  }\n\n  private async ensureInitialManifestMaterialized(): Promise<void> {\n    const provider = await this.ensureStarted();\n    if (this.state.workspaceReady) return;\n    await provider.files.createDirectories([{ path: WORKSPACE_ROOT }]);\n    for (const [path, entry] of Object.entries(this.state.manifest.entries)) {\n      await this.materialize(path, entry);\n    }\n    this.state.workspaceReady = true;\n  }\n  private beginCommand(args: ExecCommandArgs): RetainedProcess {\n    const opId = nextDurableOpId() ?? `anon_${randomUUID()}`;\n    let resolveExecutionId!: (value: string | null) => void;\n    const executionIdReady = new Promise<string | null>((resolve) => {\n      resolveExecutionId = resolve;\n    });\n    const process: RetainedProcess = {\n      opId,\n      sessionId: null,\n      provider: null,\n      physicalOutcome: null,\n      startedAt: Date.now(),\n      events: [],\n      cursor: 0,\n      executionId: null,\n      executionIdReady,\n      resolveExecutionId,\n      completed: Promise.resolve({ exitCode: 1 }),\n      settled: false,\n      transportUncertain: false,\n      outputUnavailable: false,\n      outputCursor: { stdout: 0, stderr: 0 },\n    };\n    let commandInvoked = false;\n    this.processesByOpId.set(opId, process);\n    // Joined turn cleanup outlives provider/routing alias retirement. Capture\n    // this exact process and its launch transport, not a mutable map lookup.\n    notifyRemoteOperationTransportSelected({\n      cancelExecCommand: async (requestedOpId) => {\n        this.assertOperationIdentity(process, requestedOpId);\n        return await this.cancelRetainedProcess(process);\n      },\n      observeExecCommand: async (requestedOpId) => {\n        this.assertOperationIdentity(process, requestedOpId);\n        return await this.observeRetainedProcess(process);\n      },\n    });\n    process.completed = this.ensureInitialManifestMaterialized()\n      .then(async () => {\n        const provider = await this.ensureStarted();\n        process.provider = provider;\n        commandInvoked = true;\n        const execution = await withOpenSandboxCommandDispatchProof(provider.commands, () =>\n          provider.commands.run(\n            commandForArgs(args),\n            {\n              workingDirectory: args.workdir ? workspacePath(args.workdir) : WORKSPACE_ROOT,\n              envs: this.state.environment,\n            },\n            {\n              onInit: (init) => {\n                this.bindExecutionIdentity(process, init.id);\n              },\n              onEvent: (event) => {\n                if (!event || typeof event !== \"object\") return;\n                const fields = event as Record<string, unknown>;\n                if (fields.type === \"init\") this.bindExecutionIdentity(process, fields.text);\n                for (const field of [\"id\", \"execution_id\", \"executionId\"] as const) {\n                  if (fields[field] !== undefined && fields[field] !== process.executionId)\n                    throw new SandboxProviderError(\"OpenSandbox command event identity mismatch\");\n                }\n              },\n              onStdout: (message) => {\n                process.events.push({ stream: \"stdout\", text: message.text });\n              },\n              onStderr: (message) => {\n                process.events.push({ stream: \"stderr\", text: message.text });\n              },\n            },\n          ),\n        );\n        this.bindExecutionIdentity(process, execution.id);\n        const exitCode = execution.exitCode;\n        if (!execution.complete || !Number.isSafeInteger(exitCode)) {\n          // A resolved transport without its completion envelope is not stream\n          // EOF or exit proof. Keep the original execution for status/control.\n          process.outputUnavailable = true;\n          process.transportUncertain = true;\n          return { exitCode: null, uncertain: true };\n        }\n        const outcome = {\n          exitCode: exitCode!,\n          ...(execution.error ? { error: execution.error } : {}),\n        };\n        process.physicalOutcome = outcome;\n        return outcome;\n      })\n      .catch((error) => {\n        const notDispatched =\n          error instanceof OpenSandboxCommandDispatchError && error.notDispatched;\n        const cause = error instanceof OpenSandboxCommandDispatchError ? error.cause : error;\n        process.failureCause = cause;\n        process.events.push({\n          stream: \"stderr\",\n          text: `${cause instanceof Error ? cause.message : String(cause)}\\n`,\n          commandOutput: false,\n        });\n        if (\n          process.executionId ||\n          cause instanceof OpenSandboxCommandStreamError ||\n          (commandInvoked && !notDispatched)\n        ) {\n          process.transportUncertain = true;\n          process.outputUnavailable = true;\n          process.resolveExecutionId(process.executionId);\n          // Keep the genuine original transport/SDK cause with the retained\n          // invocation. No first authenticated ID means control stays unknown.\n          return { exitCode: null, error: cause, uncertain: true };\n        }\n        if (notDispatched) notifyRemoteOperationNotDispatched(opId);\n        process.resolveExecutionId(null);\n        return { exitCode: 1, error: cause };\n      })\n      .finally(() => {\n        if (!process.transportUncertain) {\n          process.settled = true;\n          this.processesByOpId.delete(opId);\n        }\n      });\n    return process;\n  }\n\n  private bindExecutionIdentity(process: RetainedProcess, id: unknown): void {\n    if (typeof id !== \"string\" || !id.trim())\n      throw new OpenSandboxCommandStreamError(\"command execution identity is missing\");\n    if (process.executionId !== null && process.executionId !== id)\n      throw new OpenSandboxCommandStreamError(\"command execution identity mismatch\");\n    if (process.executionId === null) {\n      process.executionId = id;\n      process.resolveExecutionId(id);\n    }\n  }\n\n  private assertStatusIdentity(statusId: unknown, executionId: string): void {\n    if (statusId !== executionId)\n      throw new SandboxProviderError(\"OpenSandbox command status identity mismatch\");\n  }\n\n  private assertOperationIdentity(process: RetainedProcess, opId: string): void {\n    if (opId !== process.opId)\n      throw new SandboxProviderError(\"OpenSandbox operation identity mismatch\");\n  }\n\n  private launchProvider(process: RetainedProcess): ProviderSandbox {\n    if (!process.provider)\n      throw new SandboxProviderError(\"OpenSandbox command launch transport is unavailable\");\n    return process.provider;\n  }\n\n  private async cancelRetainedProcess(process: RetainedProcess): Promise<boolean> {\n    if (process.physicalOutcome) return true;\n    const executionId = process.executionId ?? (await process.executionIdReady);\n    if (!executionId) return process.settled;\n    await this.launchProvider(process).commands.interrupt(executionId);\n    // Request delivery is advisory; only observeRetainedProcess proves exit.\n    return true;\n  }\n\n  private async observeRetainedProcess(\n    process: RetainedProcess,\n  ): Promise<RemoteOperationObservation> {\n    if (!process.physicalOutcome) {\n      const executionId = process.executionId;\n      if (!executionId) return { status: \"running\" };\n      const status = await this.launchProvider(process).commands.getCommandStatus(executionId);\n      this.assertStatusIdentity(status.id, executionId);\n      if (status.running !== false || !Number.isSafeInteger(status.exitCode))\n        return { status: \"running\" };\n      process.physicalOutcome = { exitCode: status.exitCode! };\n    }\n    return {\n      status: \"completed\",\n      result: { exitCode: process.physicalOutcome.exitCode },\n      // This control-only observer deliberately cannot recover command output.\n      // Never substitute its proof for a lossless FS/model result, acknowledge\n      // a receipt, advance cursors, or remove the native/routed output holder.\n      failure: new SynchronousCommandOutcomeUnknownError(\n        process.sessionId,\n        { stdout: \"\", stderr: \"\" },\n        new Error(\"Physical completion observed without consuming retained command output\"),\n      ),\n    };\n  }\n\n  async observeExecCommand(opId: string): Promise<RemoteOperationObservation> {\n    const process = this.processesByOpId.get(opId);\n    if (!process) throw new SandboxProviderError(\"OpenSandbox operation is not retained\");\n    return await this.observeRetainedProcess(process);\n  }\n\n  private async settleTransportUncertainProcess(process: RetainedProcess): Promise<ProcessOutcome> {\n    const executionId = process.executionId ?? (await process.executionIdReady);\n    if (!executionId) {\n      throw new SandboxProviderError(\n        \"OpenSandbox internal command lost its provider execution identity\",\n      );\n    }\n    const provider = this.launchProvider(process);\n    while (true) {\n      try {\n        const status = await provider.commands.getCommandStatus(executionId);\n        this.assertStatusIdentity(status.id, executionId);\n        if (status.running === false && Number.isSafeInteger(status.exitCode)) {\n          if (status.error) {\n            process.events.push({\n              stream: \"stderr\",\n              text: `${status.error}\\n`,\n              commandOutput: false,\n            });\n          }\n          process.settled = true;\n          process.transportUncertain = false;\n          process.physicalOutcome = {\n            exitCode: status.exitCode!,\n            ...(status.error ? { error: status.error } : {}),\n          };\n          this.processesByOpId.delete(process.opId);\n          return process.physicalOutcome;\n        }\n      } catch {\n        // The provider accepted this exact execution before transport loss. Keep\n        // polling its immutable execution ID instead of replaying or cleaning\n        // paths that the still-running command may be mutating.\n      }\n      await delay(DEFAULT_WRITE_STDIN_YIELD_TIME_MS);\n    }\n  }\n\n  private async execToCompletion(args: ExecCommandArgs): Promise<SandboxExecResult> {\n    if (args.tty) {\n      throw new SandboxUnsupportedFeatureError(\n        \"OpenSandbox v1 does not expose a bidirectional PTY; run the command with tty=false.\",\n      );\n    }\n    assertRunAsUnsupported(args.runAs);\n    if (args.workdir) workspacePath(args.workdir);\n    const process = this.beginCommand(args);\n    let outcome = await process.completed;\n    if (outcome.uncertain) {\n      outcome = await this.settleTransportUncertainProcess(process);\n    }\n    const consumed = consumeProcessOutput(process);\n    const output = truncateOutput(consumed.output, args.maxOutputTokens);\n    if (outcome.error && !process.executionId) throw outcome.error;\n    return this.commandResult(process, consumed, {\n      output: output.text,\n      stdout: consumed.stdout,\n      stderr: consumed.stderr,\n      wallTimeSeconds: elapsedSeconds(process.startedAt),\n      exitCode: outcome.exitCode,\n      ...(output.originalTokenCount !== undefined\n        ? { originalTokenCount: output.originalTokenCount }\n        : {}),\n    });\n  }\n\n  async exec(args: ExecCommandArgs): Promise<SandboxExecResult> {\n    if (args.tty) {\n      throw new SandboxUnsupportedFeatureError(\n        \"OpenSandbox v1 does not expose a bidirectional PTY; run the command with tty=false.\",\n      );\n    }\n    assertRunAsUnsupported(args.runAs);\n    if (args.workdir) workspacePath(args.workdir);\n    const process = this.beginCommand(args);\n    const requestedYieldMs = args.yieldTimeMs ?? DEFAULT_EXEC_YIELD_TIME_MS;\n    const yieldTimeMs =\n      requestedYieldMs >= DEFAULT_EXEC_YIELD_TIME_MS\n        ? requestedYieldMs + COMMAND_API_SETTLE_GRACE_MS\n        : requestedYieldMs;\n    const outcome = await Promise.race([\n      process.completed.then((value) => ({ done: true as const, value })),\n      delay(yieldTimeMs).then(() => ({ done: false as const })),\n    ]);\n    const consumed = consumeProcessOutput(process);\n    const output = truncateOutput(consumed.output, args.maxOutputTokens);\n    if (outcome.done) {\n      if (outcome.value.uncertain) {\n        const sessionId = this.nextSessionId++;\n        process.sessionId = sessionId;\n        this.processesBySession.set(sessionId, process);\n        return this.commandResult(process, consumed, {\n          output: output.text,\n          stdout: consumed.stdout,\n          stderr: consumed.stderr,\n          wallTimeSeconds: elapsedSeconds(process.startedAt),\n          sessionId,\n          ...(output.originalTokenCount !== undefined\n            ? { originalTokenCount: output.originalTokenCount }\n            : {}),\n        });\n      }\n      if (outcome.value.error && !process.executionId) throw outcome.value.error;\n      return this.commandResult(process, consumed, {\n        output: output.text,\n        stdout: consumed.stdout,\n        stderr: consumed.stderr,\n        wallTimeSeconds: elapsedSeconds(process.startedAt),\n        exitCode: outcome.value.exitCode,\n        ...(output.originalTokenCount !== undefined\n          ? { originalTokenCount: output.originalTokenCount }\n          : {}),\n      });\n    }\n    const sessionId = this.nextSessionId++;\n    process.sessionId = sessionId;\n    this.processesBySession.set(sessionId, process);\n    return this.commandResult(process, consumed, {\n      output: output.text,\n      stdout: consumed.stdout,\n      stderr: consumed.stderr,\n      wallTimeSeconds: elapsedSeconds(process.startedAt),\n      sessionId,\n      ...(output.originalTokenCount !== undefined\n        ? { originalTokenCount: output.originalTokenCount }\n        : {}),\n    });\n  }\n\n  async execCommand(args: ExecCommandArgs): Promise<string> {\n    return this.commandBanner(await this.exec(args));\n  }\n\n  hasRetainedProcess(providerSessionId: number): boolean {\n    return this.processesBySession.has(providerSessionId);\n  }\n\n  async cancelExecCommand(opId: string): Promise<boolean> {\n    const process = this.processesByOpId.get(opId);\n    if (!process) return false;\n    return await this.cancelRetainedProcess(process);\n  }\n\n  async writeStdin(args: WriteStdinArgs): Promise<string> {\n    const process = this.processesBySession.get(args.sessionId);\n    if (!process) {\n      return formatExecResponse({\n        output: `write_stdin failed: session not found: ${args.sessionId}`,\n        wallTimeSeconds: 0,\n        exitCode: 1,\n      });\n    }\n    const chars = args.chars ?? \"\";\n    const unsupportedChars = chars.replaceAll(\"\\u0003\", \"\");\n    if (unsupportedChars.length > 0) {\n      throw new SandboxUnsupportedFeatureError(\n        \"OpenSandbox v1 retained commands support polling and Ctrl-C interrupt, not arbitrary stdin.\",\n      );\n    }\n    const startedAt = Date.now();\n    if (chars.includes(\"\\u0003\")) {\n      const executionId = process.executionId ?? (await process.executionIdReady);\n      if (executionId) {\n        const provider = this.launchProvider(process);\n        await provider.commands.interrupt(executionId);\n      }\n    }\n    if (process.transportUncertain) {\n      const executionId = process.executionId;\n      if (!executionId) {\n        throw new SandboxProviderError(\n          \"OpenSandbox retained command lost its provider execution identity\",\n        );\n      }\n      const provider = this.launchProvider(process);\n      const status = await provider.commands.getCommandStatus(executionId);\n      this.assertStatusIdentity(status.id, executionId);\n      if (status.error) {\n        process.events.push({ stream: \"stderr\", text: `${status.error}\\n`, commandOutput: false });\n      }\n      const consumed = consumeProcessOutput(process);\n      const output = truncateOutput(consumed.output, args.maxOutputTokens);\n      if (status.running !== false || !Number.isSafeInteger(status.exitCode)) {\n        return this.commandBanner(\n          this.commandResult(process, consumed, {\n            output: output.text,\n            stdout: consumed.stdout,\n            stderr: consumed.stderr,\n            wallTimeSeconds: elapsedSeconds(startedAt),\n            sessionId: args.sessionId,\n            ...(output.originalTokenCount !== undefined\n              ? { originalTokenCount: output.originalTokenCount }\n              : {}),\n          }),\n        );\n      }\n      process.settled = true;\n      process.physicalOutcome = { exitCode: status.exitCode! };\n      this.processesBySession.delete(args.sessionId);\n      this.processesByOpId.delete(process.opId);\n      return this.commandBanner(\n        this.commandResult(process, consumed, {\n          output: output.text,\n          stdout: consumed.stdout,\n          stderr: consumed.stderr,\n          wallTimeSeconds: elapsedSeconds(startedAt),\n          exitCode: status.exitCode!,\n          ...(output.originalTokenCount !== undefined\n            ? { originalTokenCount: output.originalTokenCount }\n            : {}),\n        }),\n      );\n    }\n    const outcome = await Promise.race([\n      process.completed.then((value) => ({ done: true as const, value })),\n      delay(args.yieldTimeMs ?? DEFAULT_WRITE_STDIN_YIELD_TIME_MS).then(() => ({\n        done: false as const,\n      })),\n    ]);\n    const consumed = consumeProcessOutput(process);\n    const output = truncateOutput(consumed.output, args.maxOutputTokens);\n    if (outcome.done) {\n      // Loss can arrive while this read awaits completion, not only before it.\n      // The same alias remains available for exact status/control observation.\n      if (!outcome.value.uncertain) this.processesBySession.delete(args.sessionId);\n      return this.commandBanner(\n        this.commandResult(process, consumed, {\n          output: output.text,\n          stdout: consumed.stdout,\n          stderr: consumed.stderr,\n          wallTimeSeconds: elapsedSeconds(startedAt),\n          ...(outcome.value.uncertain\n            ? { sessionId: args.sessionId }\n            : { exitCode: outcome.value.exitCode }),\n          ...(output.originalTokenCount !== undefined\n            ? { originalTokenCount: output.originalTokenCount }\n            : {}),\n        }),\n      );\n    }\n    return this.commandBanner(\n      this.commandResult(process, consumed, {\n        output: output.text,\n        stdout: consumed.stdout,\n        stderr: consumed.stderr,\n        wallTimeSeconds: elapsedSeconds(startedAt),\n        sessionId: args.sessionId,\n        ...(output.originalTokenCount !== undefined\n          ? { originalTokenCount: output.originalTokenCount }\n          : {}),\n      }),\n    );\n  }\n\n  async writeStdinForProcessControl(args: WriteStdinArgs): Promise<string> {\n    return await this.writeStdin(args);\n  }\n\n  async readFile(args: { path: string; runAs?: string; maxBytes?: number }): Promise<Uint8Array> {\n    assertRunAsUnsupported(args.runAs);\n    const absolute = workspacePath(args.path, { allowPrivate: true });\n    const root = [WORKSPACE_ROOT, ...ALLOWED_PRIVATE_ROOTS].find(\n      (candidate) => absolute === candidate || absolute.startsWith(`${candidate}/`),\n    )!;\n    const maxBytes = args.maxBytes ?? 512 * 1024 * 1024;\n    if (!Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > 512 * 1024 * 1024) {\n      throw new SandboxConfigurationError(\"Invalid OpenSandbox read byte limit\");\n    }\n    const result = await this.exec({\n      cmd: confinedFileReadCommand(root, absolute.slice(root.length + 1), maxBytes),\n      login: false,\n      yieldTimeMs: 30_000,\n      maxOutputTokens: Math.ceil((maxBytes * 4) / 3) + 1024,\n    });\n    if (result.exitCode === 66) {\n      throw new SandboxWorkspaceReadNotFoundError(\"OpenSandbox workspace path not found\");\n    }\n    if (result.exitCode === 67) {\n      throw new SandboxConfigurationError(\"path resolves outside workspace or contains a symlink\");\n    }\n    const bytes =\n      result.sessionId === undefined && result.exitCode === 0\n        ? parseConfinedFileRead(result.stdout, maxBytes)\n        : null;\n    if (!bytes) {\n      // Preserve the native cause without treating it as terminal/no-dispatch\n      // proof. The original uncertain command and output remain retained.\n      if (this.commandFailureCauses.has(result)) throw this.commandFailureCauses.get(result);\n      throw new SandboxProviderError(\"OpenSandbox confined file read unavailable\");\n    }\n    return bytes;\n  }\n\n  private async rethrowFilesystemReadError(\n    provider: ProviderSandbox,\n    error: unknown,\n  ): Promise<never> {\n    if (isNotFound(error)) {\n      // A filesystem 404 is optional-path absence only while the exact provider\n      // still exists. Provider loss and lifecycle failures must reach recovery.\n      const info = await provider.getInfo();\n      assertSupportedProviderState(info, this.state.sandboxId);\n      if (info.id === this.state.sandboxId) {\n        throw new SandboxWorkspaceReadNotFoundError(\"OpenSandbox workspace path not found\");\n      }\n    }\n    throw error;\n  }\n\n  async writeFile(args: {\n    path: string;\n    content: string | Uint8Array;\n    createParents?: boolean;\n    append?: boolean;\n  }): Promise<number> {\n    if (args.append) {\n      throw new SandboxUnsupportedFeatureError(\n        \"OpenSandbox v1 raw file writes do not support append; use a shell command for append semantics.\",\n      );\n    }\n    const provider = await this.ensureStarted();\n    const target = workspacePath(args.path, { allowPrivate: true });\n    if (args.createParents ?? true) {\n      await provider.files.createDirectories([{ path: posix.dirname(target) }]);\n    }\n    await provider.files.writeFiles([{ path: target, data: args.content }]);\n    return typeof args.content === \"string\"\n      ? new TextEncoder().encode(args.content).byteLength\n      : args.content.byteLength;\n  }\n\n  async pathExists(path: string, runAs?: string): Promise<boolean> {\n    assertRunAsUnsupported(runAs);\n    const provider = await this.ensureStarted();\n    const target = workspacePath(path, { allowPrivate: true });\n    try {\n      const info = await provider.files.getFileInfo([target]);\n      return Boolean(info[target]);\n    } catch (error) {\n      if (isNotFound(error)) return false;\n      throw error;\n    }\n  }\n\n  async listDir(args: { path: string; runAs?: string }): Promise<SandboxDirectoryEntry[]> {\n    assertRunAsUnsupported(args.runAs);\n    const provider = await this.ensureStarted();\n    const absolute = workspacePath(args.path);\n    const absoluteOutput = args.path.trim().startsWith(\"/\");\n    const entries = await provider.files\n      .listDirectory({\n        path: absolute,\n        depth: 1,\n      })\n      .catch((error) => this.rethrowFilesystemReadError(provider, error));\n    return entries.map((entry) => {\n      const entryPath = workspacePath(entry.path);\n      return {\n        name: posix.basename(entryPath),\n        path: absoluteOutput\n          ? entryPath\n          : entryPath === WORKSPACE_ROOT\n            ? \"\"\n            : entryPath.slice(WORKSPACE_ROOT.length + 1),\n        type: entry.type === \"directory\" ? \"dir\" : entry.type === \"file\" ? \"file\" : \"other\",\n      };\n    });\n  }\n\n  async viewImage(args: ViewImageArgs) {\n    assertRunAsUnsupported(args.runAs);\n    const bytes = await this.readFile({ path: args.path });\n    return imageOutputFromBytes(args.path, bytes);\n  }\n\n  private async deletePath(path: string): Promise<void> {\n    const provider = await this.ensureStarted();\n    const target = workspacePath(path, { allowPrivate: true });\n    const info = await provider.files.getFileInfo([target]);\n    const entry = info[target];\n    if (!entry) return;\n    if (entry.type === \"directory\") await provider.files.deleteDirectories([target]);\n    else await provider.files.deleteFiles([target]);\n  }\n\n  createEditor(runAs?: string): OpenSandboxEditor {\n    assertRunAsUnsupported(runAs);\n    const applyDiff = injectedApplyDiff;\n    if (!applyDiff) {\n      throw new Error(\n        \"opensandbox createEditor: applyDiff not injected (the runtime barrel must call setOpenSandboxApplyDiff before an agent turn binds the filesystem capability)\",\n      );\n    }\n    const readText = async (path: string): Promise<string> =>\n      new TextDecoder().decode(await this.readFile({ path }));\n    return {\n      createFile: async (operation) => {\n        if (await this.pathExists(operation.path)) {\n          throw new Error(`opensandbox createFile: file already exists: ${operation.path}`);\n        }\n        await this.writeFile({\n          path: operation.path,\n          content: applyDiff(\"\", operation.diff, \"create\"),\n          createParents: true,\n        });\n        return {};\n      },\n      updateFile: async (operation) => {\n        const next = applyDiff(await readText(operation.path), operation.diff);\n        const destination = operation.moveTo ?? operation.path;\n        await this.writeFile({\n          path: destination,\n          content: next,\n          createParents: true,\n        });\n        if (operation.moveTo && operation.moveTo !== operation.path) {\n          await this.deletePath(operation.path);\n        }\n        return {};\n      },\n      deleteFile: async (operation) => {\n        await this.deletePath(operation.path);\n        return {};\n      },\n    };\n  }\n\n  private async applyPermissions(path: string, entry: Entry): Promise<void> {\n    if (entry.group !== undefined) {\n      throw new SandboxUnsupportedFeatureError(\n        \"OpenSandbox v1 does not materialize named manifest groups.\",\n      );\n    }\n    if (entry.permissions === undefined) return;\n    const provider = await this.ensureStarted();\n    await provider.files.setPermissions([\n      { path, mode: new Permissions(entry.permissions).toMode() & 0o777 },\n    ]);\n  }\n\n  private async copyLocalDirectory(source: string, destination: string): Promise<void> {\n    const stats = await lstat(source);\n    if (stats.isSymbolicLink()) {\n      throw new SandboxUnsupportedFeatureError(\n        `OpenSandbox local_dir source contains a symbolic link: ${source}`,\n      );\n    }\n    if (!stats.isDirectory()) {\n      throw new SandboxConfigurationError(\n        `OpenSandbox local_dir source is not a directory: ${source}`,\n      );\n    }\n    const provider = await this.ensureStarted();\n    await provider.files.createDirectories([{ path: destination }]);\n    const entries = await readdir(source, { withFileTypes: true });\n    for (const entry of entries) {\n      const sourcePath = `${source.replace(/\\/$/u, \"\")}/${entry.name}`;\n      const destinationPath = posix.join(destination, entry.name);\n      if (entry.isSymbolicLink()) {\n        throw new SandboxUnsupportedFeatureError(\n          `OpenSandbox local_dir source contains a symbolic link: ${sourcePath}`,\n        );\n      }\n      if (entry.isDirectory()) {\n        await this.copyLocalDirectory(sourcePath, destinationPath);\n      } else if (entry.isFile()) {\n        await provider.files.writeFiles([\n          {\n            path: destinationPath,\n            data: new Uint8Array(await readLocalFile(sourcePath)),\n          },\n        ]);\n      } else {\n        throw new SandboxUnsupportedFeatureError(\n          `OpenSandbox local_dir source contains an unsupported file type: ${sourcePath}`,\n        );\n      }\n    }\n  }\n\n  private async materialize(path: string, entry: Entry): Promise<void> {\n    const target = workspacePath(path);\n    const provider = await this.ensureStarted();\n    if (entry.type === \"dir\") {\n      await provider.files.createDirectories([{ path: target }]);\n      for (const [childPath, child] of Object.entries(entry.children ?? {})) {\n        await this.materialize(posix.join(path, childPath), child);\n      }\n      await this.applyPermissions(target, entry);\n      return;\n    }\n    if (entry.type === \"file\") {\n      await provider.files.createDirectories([{ path: posix.dirname(target) }]);\n      await provider.files.writeFiles([{ path: target, data: entry.content }]);\n      await this.applyPermissions(target, entry);\n      return;\n    }\n    if (entry.type === \"local_file\") {\n      const stats = await lstat(entry.src);\n      if (!stats.isFile() || stats.isSymbolicLink()) {\n        throw new SandboxUnsupportedFeatureError(\n          `OpenSandbox local_file source must be a regular non-symlink file: ${entry.src}`,\n        );\n      }\n      await provider.files.createDirectories([{ path: posix.dirname(target) }]);\n      await provider.files.writeFiles([\n        { path: target, data: new Uint8Array(await readLocalFile(entry.src)) },\n      ]);\n      await this.applyPermissions(target, entry);\n      return;\n    }\n    if (entry.type === \"local_dir\") {\n      await this.copyLocalDirectory(entry.src, target);\n      await this.applyPermissions(target, entry);\n      return;\n    }\n    if (entry.type === \"git_repo\") {\n      const temp = `/tmp/opengeni-git-${randomUUID()}`;\n      const subpath = entry.subpath ? normalizeRelativePath(entry.subpath) : null;\n      const script = [\n        \"set -eu\",\n        `rm -rf -- ${shellQuote(temp)} ${shellQuote(target)}`,\n        `git clone --no-checkout --depth=1 ${shellQuote(entry.repo)} ${shellQuote(temp)}`,\n        ...(entry.ref\n          ? [\n              `git -C ${shellQuote(temp)} fetch --depth=1 origin ${shellQuote(entry.ref)}`,\n              `git -C ${shellQuote(temp)} checkout --detach FETCH_HEAD`,\n            ]\n          : [`git -C ${shellQuote(temp)} checkout --detach HEAD`]),\n        subpath\n          ? `mkdir -p -- ${shellQuote(target)} && cp -a -- ${shellQuote(`${temp}/${subpath}/.`)} ${shellQuote(target)}`\n          : `mv -- ${shellQuote(temp)} ${shellQuote(target)}`,\n        subpath ? `rm -rf -- ${shellQuote(temp)}` : \":\",\n      ].join(\"\\n\");\n      const result = await this.execToCompletion({\n        cmd: script,\n        maxOutputTokens: 2_000,\n      });\n      if (typeof result.exitCode !== \"number\" || result.exitCode !== 0) {\n        throw new SandboxProviderError(\"OpenSandbox git repository materialization failed\", {\n          path,\n          exitCode: result.exitCode ?? null,\n        });\n      }\n      await this.applyPermissions(target, entry);\n      return;\n    }\n    throw new SandboxUnsupportedFeatureError(\n      `OpenSandbox v1 does not support manifest mount entry type \"${entry.type}\".`,\n    );\n  }\n\n  async materializeEntry(args: MaterializeEntryArgs): Promise<void> {\n    assertRunAsUnsupported(args.runAs);\n    const logicalPath = logicalWorkspacePath(args.path);\n    await this.materialize(logicalPath, args.entry);\n    this.state.manifest = mergeManifestEntryDelta(this.state.manifest, logicalPath, args.entry);\n  }\n\n  async applyManifest(manifest: Manifest, runAs?: string): Promise<void> {\n    assertRunAsUnsupported(runAs);\n    await this.ensureInitialManifestMaterialized();\n    if (manifest.root !== this.state.manifest.root) {\n      throw new SandboxConfigurationError(\n        `OpenSandbox manifest root must remain ${this.state.manifest.root}.`,\n      );\n    }\n    if (\n      manifest.users.length > 0 ||\n      manifest.groups.length > 0 ||\n      manifest.extraPathGrants.length > 0\n    ) {\n      throw new SandboxUnsupportedFeatureError(\n        \"OpenSandbox v1 does not support manifest users, groups, or host path grants.\",\n      );\n    }\n    for (const [path, entry] of Object.entries(manifest.entries)) {\n      await this.materialize(path, entry);\n    }\n    const nextManifest = mergeManifestDelta(this.state.manifest, manifest);\n    this.state.environment = await mergeMaterializedEnvironment(\n      this.state.manifest,\n      nextManifest,\n      this.state.environment,\n    );\n    this.state.manifest = nextManifest;\n  }\n\n  private resolvedArchiveLimits(options?: WorkspaceArchiveOptions) {\n    return resolveSandboxArchiveLimits(\n      options?.archiveLimits === undefined ? this.archiveLimits : options.archiveLimits,\n    );\n  }\n\n  async persistWorkspaceTar(): Promise<Uint8Array> {\n    const archivePath = `${PRIVATE_ROOT}/capture-${randomUUID()}.tar`;\n    const excludes = [\n      ...this.state.manifest.ephemeralPersistencePaths(),\n      \".opengeni-old-*\",\n      \".opengeni-restore-*\",\n    ].sort();\n    const excludeArgs = excludes.flatMap((path) => [\n      shellQuote(`--exclude=${path}`),\n      shellQuote(`--exclude=./${path}`),\n    ]);\n    const script = String.raw`set -eu\nmkdir -p ${shellQuote(PRIVATE_ROOT)}\ncd ${shellQuote(WORKSPACE_ROOT)}\n# Sockets (gpg-agent) and symlinks are normal in a live /workspace. GNU tar\n# ignores sockets (exit 0) and --hard-dereference stores symlink targets as\n# files. Fifos/devices are not portable archive members and can hang tar.\nif find . -xdev -mindepth 1 \\( -type p -o -type b -o -type c \\) -print -quit | grep -q .; then\n  printf 'workspace contains a non-portable fifo or device\\n' >&2\n  exit 65\nfi\ntar ${excludeArgs.join(\" \")} --sort=name --mtime='@0' --owner=0 --group=0 --numeric-owner --hard-dereference --format=gnu -cf ${shellQuote(archivePath)} .`;\n    try {\n      const result = await this.execToCompletion({\n        cmd: script,\n        maxOutputTokens: 1_000,\n      });\n      if (result.exitCode !== 0) {\n        throw new SandboxArchiveError(\"OpenSandbox workspace archive capture failed\", {\n          sandboxId: this.state.sandboxId,\n          exitCode: result.exitCode ?? null,\n        });\n      }\n      const bytes = await this.readFile({ path: archivePath });\n      const limits = this.resolvedArchiveLimits();\n      if (limits && limits.maxInputBytes !== null && bytes.byteLength > limits.maxInputBytes) {\n        throw new SandboxArchiveError(\"OpenSandbox workspace archive exceeds maxInputBytes\", {\n          archiveBytes: bytes.byteLength,\n          maxInputBytes: limits.maxInputBytes,\n        });\n      }\n      return bytes;\n    } finally {\n      await this.deletePath(archivePath).catch(() => undefined);\n    }\n  }\n\n  async persistWorkspace(): Promise<Uint8Array> {\n    return await this.persistWorkspaceTar();\n  }\n\n  async hydrateWorkspace(\n    data: WorkspaceArchiveData,\n    options: WorkspaceArchiveOptions = {},\n  ): Promise<void> {\n    const bytes = await toUint8Array(data);\n    const limits = this.resolvedArchiveLimits(options);\n    if (limits && limits.maxInputBytes !== null && bytes.byteLength > limits.maxInputBytes) {\n      throw new SandboxArchiveError(\"OpenSandbox workspace archive exceeds maxInputBytes\", {\n        archiveBytes: bytes.byteLength,\n        maxInputBytes: limits.maxInputBytes,\n      });\n    }\n    const archivePath = `${PRIVATE_ROOT}/restore-${randomUUID()}.tar`;\n    const stagingPath = `${WORKSPACE_ROOT}/.opengeni-restore-${randomUUID()}`;\n    const backupPath = `${WORKSPACE_ROOT}/.opengeni-old-${randomUUID()}`;\n    await this.writeFile({\n      path: archivePath,\n      content: bytes,\n      createParents: true,\n    });\n    const excluded = [...this.state.manifest.ephemeralPersistencePaths()].sort().join(\"\\n\");\n    const command = [\n      \"python3\",\n      \"-c\",\n      shellQuote(archiveRestoreScript()),\n      shellQuote(archivePath),\n      shellQuote(WORKSPACE_ROOT),\n      shellQuote(stagingPath),\n      shellQuote(backupPath),\n      shellQuote(archiveLimitArg(limits?.maxMembers ?? null)),\n      shellQuote(archiveLimitArg(limits?.maxExtractedBytes ?? null)),\n      shellQuote(excluded),\n    ].join(\" \");\n    try {\n      const result = await this.execToCompletion({\n        cmd: command,\n        maxOutputTokens: 2_000,\n      });\n      if (result.exitCode !== 0) {\n        throw new SandboxArchiveError(\"OpenSandbox workspace archive restore failed\", {\n          sandboxId: this.state.sandboxId,\n          exitCode: result.exitCode ?? null,\n          stderr: result.stderr.slice(-1_000),\n        });\n      }\n      this.state.workspaceReady = true;\n    } finally {\n      await this.deletePath(archivePath).catch(() => undefined);\n      await this.deletePath(stagingPath).catch(() => undefined);\n      await this.deletePath(backupPath).catch(() => undefined);\n    }\n  }\n\n  async resolveExposedPort(port: number): Promise<ExposedPortEndpoint> {\n    if (!Number.isInteger(port) || port <= 0 || port > 65_535) {\n      throw new SandboxExposedPortUnavailableError(`Invalid OpenSandbox port: ${port}`);\n    }\n    const signed = this.options.signedEndpoints === true;\n    try {\n      const endpoint = await withLifecycle(this.options, async (sandboxes) => {\n        if (signed) {\n          const expires =\n            Math.floor(Date.now() / 1000) + (this.options.signedEndpointTtlSeconds ?? 600);\n          return await sandboxes.getSignedEndpoint(this.state.sandboxId, port, expires);\n        }\n        return await sandboxes.getSandboxEndpoint(\n          this.state.sandboxId,\n          port,\n          this.options.useServerProxy,\n        );\n      });\n      const rewrite = channelBRewriteTarget(this.options);\n      const resolved = recordExposedPortEndpoint(\n        this.state,\n        withOpenSandboxDesktopViewerPath(\n          endpointToExposedPort(endpoint, rewrite.baseUrl, rewrite.rewriteToBaseUrl),\n          port,\n          signed,\n        ),\n        port,\n      );\n      const parsed = signed\n        ? parseOpenSandboxSignedUriPath(typeof resolved.path === \"string\" ? resolved.path : \"\")\n        : null;\n      console.info(\"opensandbox channel-b resolve\", {\n        mode: signed ? \"signed\" : \"server-proxy\",\n        sandboxId: this.state.sandboxId,\n        port,\n        expiresAtSeconds: parsed?.expiresAtSeconds ?? null,\n        path:\n          typeof resolved.path === \"string\" ? redactOpenSandboxSignedUriPath(resolved.path) : null,\n      });\n      if (signed) {\n        recordSignedEndpointMetric(this.options.metrics, { outcome: \"minted\", port });\n      }\n      return resolved;\n    } catch (error) {\n      if (signed) {\n        recordSignedEndpointMetric(this.options.metrics, { outcome: \"mint_failed\", port });\n      }\n      throw error;\n    }\n  }\n}\n\n/** noVNC on the OpenSandbox lifecycle proxy serves HTML at the port root\n * (`…/proxy/6080`). The RFB socket is `…/websockify`. Mint `vnc.html` so the\n * existing SDK `desktopSocketUrl` rewrite dials that socket. Signed URI-mode\n * ingress is a reverse proxy to the box port and does not need that HTML\n * viewer path. Modal/Daytona edges at `/` stay untouched. */\nconst OPENSANDBOX_DESKTOP_STREAM_PORT = 6080;\n\nfunction channelBRewriteTarget(options: OpenSandboxClientOptions): {\n  baseUrl: string;\n  rewriteToBaseUrl: boolean;\n} {\n  if (options.signedEndpoints) {\n    if (options.channelBPublicBaseUrl) {\n      return { baseUrl: options.channelBPublicBaseUrl, rewriteToBaseUrl: true };\n    }\n    return { baseUrl: options.baseUrl, rewriteToBaseUrl: false };\n  }\n  return { baseUrl: options.baseUrl, rewriteToBaseUrl: options.useServerProxy };\n}\n\nfunction withOpenSandboxDesktopViewerPath(\n  endpoint: ExposedPortEndpoint,\n  port: number,\n  signedEndpoints: boolean,\n): ExposedPortEndpoint {\n  if (signedEndpoints) return endpoint;\n  if (port !== OPENSANDBOX_DESKTOP_STREAM_PORT) return endpoint;\n  const rawPath =\n    typeof endpoint.path === \"string\" && endpoint.path.length > 0 ? endpoint.path : \"/\";\n  const prefix = (rawPath.startsWith(\"/\") ? rawPath : `/${rawPath}`).replace(/\\/+$/u, \"\");\n  if (prefix.length === 0) return endpoint;\n  if (/\\/vnc(_lite)?\\.html$/u.test(prefix) || prefix.endsWith(\"/websockify\")) {\n    return endpoint;\n  }\n  const path = `${prefix}/vnc.html`;\n  const url =\n    typeof endpoint.url === \"string\" && endpoint.url.length > 0\n      ? `${endpoint.url.replace(/\\/+$/u, \"\")}/vnc.html`\n      : endpoint.url;\n  return { ...endpoint, path, ...(url ? { url } : {}) };\n}\n\nfunction endpointToExposedPort(\n  endpoint: Endpoint,\n  baseUrl: string,\n  rewriteToBaseUrl: boolean,\n): ExposedPortEndpoint {\n  const base = new URL(baseUrl);\n  const reported = new URL(`${base.protocol}//${endpoint.endpoint}`);\n  // Channel B is browser → provider-tunnel direct. When we use the lifecycle\n  // server proxy, rewrite the advertised host to the configured base URL so a\n  // local port-forward (or in-cluster DNS) is what the viewer actually opens.\n  const url = rewriteToBaseUrl ? new URL(`${reported.pathname}${reported.search}`, base) : reported;\n  const tls = url.protocol === \"https:\" || url.protocol === \"wss:\";\n  return {\n    host: url.hostname,\n    port: url.port ? Number(url.port) : tls ? 443 : 80,\n    tls,\n    ...(url.pathname && url.pathname !== \"/\" ? { path: url.pathname } : {}),\n    ...(url.search.length > 1 ? { query: url.search.slice(1) } : {}),\n    protocol: url.protocol.replace(/:$/u, \"\"),\n    url: url.toString(),\n    ...(endpoint.headers ? { headers: { ...endpoint.headers } } : {}),\n  };\n}\n\nexport class OpenSandboxClient {\n  readonly backendId = \"opensandbox\" as const;\n  readonly supportsDefaultOptions = false;\n  private readonly options: OpenSandboxClientOptions;\n\n  constructor(options: OpenSandboxClientOptions) {\n    this.options = {\n      ...options,\n      baseUrl: canonicalBaseUrl(options.baseUrl),\n      environment: { ...(options.environment ?? {}) },\n      exposedPorts: normalizeConfiguredPorts(options.exposedPorts),\n      resourceLimits: { ...options.resourceLimits },\n      resourceRequests: { ...options.resourceRequests },\n    };\n  }\n\n  async create(\n    args?: SandboxClientCreateArgs,\n    manifestOptions?: Record<string, unknown>,\n  ): Promise<OpenSandboxSession> {\n    const normalized = normalizeSandboxClientCreateArgs(args as never, manifestOptions);\n    assertNoSnapshot(normalized);\n    const manifest = normalized.manifest;\n    if (manifest.root !== WORKSPACE_ROOT) {\n      throw new SandboxConfigurationError(`OpenSandbox manifest root must be ${WORKSPACE_ROOT}.`);\n    }\n    if (\n      manifest.users.length > 0 ||\n      manifest.groups.length > 0 ||\n      manifest.extraPathGrants.length > 0\n    ) {\n      throw new SandboxUnsupportedFeatureError(\n        \"OpenSandbox v1 does not support manifest users, groups, or host path grants.\",\n      );\n    }\n    const environment = {\n      ...(this.options.environment ?? {}),\n      ...(await manifest.resolveEnvironment()),\n    };\n    const created = await withLifecycle(\n      this.options,\n      async (sandboxes) => await sandboxes.createSandbox(createRequest(this.options, environment)),\n    );\n    const state: OpenSandboxSessionState = {\n      stateVersion: OPENSANDBOX_STATE_VERSION,\n      sandboxId: created.id,\n      manifest,\n      environment,\n      image: this.options.image,\n      poolRef: this.options.poolRef ?? null,\n      providerBindingHash: providerBindingHash(this.options.baseUrl),\n      workspacePersistence: \"tar\",\n      configuredExposedPorts: normalizeConfiguredPorts(this.options.exposedPorts),\n      workspaceReady: false,\n      expiresAt: created.expiresAt?.toISOString() ?? null,\n    };\n    return new OpenSandboxSession({\n      state,\n      options: this.options,\n      ...(normalized.archiveLimits !== undefined\n        ? { archiveLimits: normalized.archiveLimits }\n        : {}),\n    });\n  }\n\n  async resume(\n    state: OpenSandboxSessionState,\n    options: SandboxClientResumeOptions = {},\n  ): Promise<OpenSandboxSession> {\n    return await this.resumeExact(state, options);\n  }\n\n  async resumeExact(\n    state: OpenSandboxSessionState,\n    options: SandboxClientResumeOptions = {},\n  ): Promise<OpenSandboxSession> {\n    assertStateMatchesOptions(state, this.options);\n    try {\n      await withLifecycle(this.options, async (sandboxes) => {\n        const info = await sandboxes.getSandbox(state.sandboxId);\n        assertSupportedProviderState(info, state.sandboxId);\n      });\n    } catch (error) {\n      if (error instanceof SandboxExactResumeInstanceUnavailableError || isNotFound(error)) {\n        throw new SandboxExactResumeInstanceUnavailableError(\"opensandbox\", state.sandboxId);\n      }\n      throw error;\n    }\n    return new OpenSandboxSession({\n      state,\n      options: this.options,\n      ...(options.archiveLimits !== undefined ? { archiveLimits: options.archiveLimits } : {}),\n    });\n  }\n\n  async delete(state: OpenSandboxSessionState): Promise<void> {\n    assertStateMatchesOptions(state, this.options);\n    try {\n      await withLifecycle(this.options, async (sandboxes) => {\n        await sandboxes.deleteSandbox(state.sandboxId);\n      });\n    } catch (error) {\n      if (!isNotFound(error)) throw error;\n    }\n  }\n\n  async renewExpiration(sandboxId: string): Promise<string> {\n    const expiresAt = new Date(Date.now() + this.options.ttlSeconds * 1000).toISOString();\n    const response = await withLifecycle(\n      this.options,\n      async (sandboxes) => await sandboxes.renewSandboxExpiration(sandboxId, { expiresAt }),\n    );\n    return response.expiresAt?.toISOString() ?? expiresAt;\n  }\n\n  async canPersistOwnedSessionState(): Promise<boolean> {\n    return true;\n  }\n\n  async canReusePreservedOwnedSession(): Promise<boolean> {\n    return false;\n  }\n\n  async serializeSessionState(state: OpenSandboxSessionState): Promise<Record<string, unknown>> {\n    assertStateMatchesOptions(state, this.options);\n    return {\n      stateVersion: OPENSANDBOX_STATE_VERSION,\n      sandboxId: state.sandboxId,\n      manifest: serializeManifestRecord(state.manifest),\n      environment: serializeRuntimeEnvironmentForPersistence(state.manifest, state.environment),\n      image: state.image,\n      poolRef: state.poolRef,\n      providerBindingHash: state.providerBindingHash,\n      workspacePersistence: \"tar\",\n      configuredExposedPorts: [...state.configuredExposedPorts],\n      workspaceReady: state.workspaceReady,\n      expiresAt: state.expiresAt,\n      ...(this.options.signedEndpoints\n        ? {}\n        : state.exposedPorts\n          ? { exposedPorts: structuredClone(state.exposedPorts) }\n          : {}),\n    };\n  }\n\n  async deserializeSessionState(value: Record<string, unknown>): Promise<OpenSandboxSessionState> {\n    if (value.stateVersion !== OPENSANDBOX_STATE_VERSION) {\n      throw new SandboxConfigError(\n        \"opensandbox\",\n        `unsupported persisted OpenSandbox state version: ${String(value.stateVersion)}`,\n      );\n    }\n    const manifest = deserializeManifest(\n      value.manifest && typeof value.manifest === \"object\" && !Array.isArray(value.manifest)\n        ? (value.manifest as Record<string, unknown>)\n        : undefined,\n    );\n    if (manifest.root !== WORKSPACE_ROOT) {\n      throw new SandboxConfigError(\n        \"opensandbox\",\n        `persisted manifest root must be ${WORKSPACE_ROOT}`,\n      );\n    }\n    const state: OpenSandboxSessionState = {\n      stateVersion: OPENSANDBOX_STATE_VERSION,\n      sandboxId: parseStateString(value.sandboxId, \"sandboxId\"),\n      manifest,\n      environment: await rehydratePersistedEnvironmentForRuntime(\n        manifest,\n        value.environment &&\n          typeof value.environment === \"object\" &&\n          !Array.isArray(value.environment)\n          ? (value.environment as Record<string, string>)\n          : undefined,\n        this.options.environment,\n      ),\n      image: parseStateString(value.image, \"image\"),\n      poolRef: parseOptionalString(value.poolRef, \"poolRef\"),\n      providerBindingHash: parseStateString(value.providerBindingHash, \"providerBindingHash\"),\n      workspacePersistence: \"tar\",\n      configuredExposedPorts: Array.isArray(value.configuredExposedPorts)\n        ? normalizeConfiguredPorts(\n            value.configuredExposedPorts.filter(\n              (entry): entry is number => typeof entry === \"number\",\n            ),\n          )\n        : [],\n      workspaceReady: value.workspaceReady === true,\n      expiresAt: parseOptionalString(value.expiresAt, \"expiresAt\"),\n      ...(value.exposedPorts &&\n      typeof value.exposedPorts === \"object\" &&\n      !Array.isArray(value.exposedPorts)\n        ? {\n            exposedPorts: structuredClone(\n              value.exposedPorts as Record<string, ExposedPortEndpoint>,\n            ),\n          }\n        : {}),\n    };\n    assertStateMatchesOptions(state, this.options);\n    return state;\n  }\n}\n","// @opengeni/runtime/sandbox — the pixel DATA PLANE: exposeStreamPort (P4.2).\n//\n// This is the heart of Channel B's data plane. exposeStreamPort resolves the\n// provider's scoped tunnel for the ONE exposed stream port (6080), assembles the\n// direct-to-provider WS URL (client → provider-tunnel direct; the pixel socket\n// never traverses Opengeni), and mints the scoped Opengeni stream token. It is a\n// plain function over a live, externally-owned `{session}` handle — NO Temporal,\n// NO worker RPC, NO actor. The API-direct handshake handler (apps/api) calls it\n// in-process on a freshly-resumed-by-id box and returns the result as the HTTP\n// response; the worker's per-turn resume path calls the same function when a turn\n// is the first to bring the box up. Both pull it from this single agent-loop-free\n// leaf (@opengeni/runtime/sandbox).\n//\n// THE TOKEN IS NOT A URL QUERY PARAM. The provider's own scoped tunnel URL\n// (Modal raw-TLS host:port, Daytona signed preview, Blaxel preview-token query)\n// carries the reach-the-port boundary; the Opengeni stream token is RECORDED\n// against the viewer holder and is the in-box websockify edge boundary (P3/P5).\n// Per the sandbox contract ruling, exposeStreamPort returns the token alongside the\n// URL so the caller records it; it does NOT append it to `url`.\n\nimport { DESKTOP_STREAM_PORT } from \"@opengeni/contracts\";\nimport { mintStreamToken, STREAM_TOKEN_DEFAULT_TTL_SECONDS } from \"./stream-token\";\n\n/** The provider-resolved endpoint for an exposed port. Mirrors the SDK's\n *  `ExposedPortEndpoint` (host/port/tls/query/...) WITHOUT importing the\n *  agent-loop barrel — the leaf stays agent-loop-free. */\nexport type ExposedPortEndpoint = {\n  host: string;\n  port: number;\n  tls?: boolean;\n  query?: string;\n  protocol?: string;\n  url?: string;\n  /** The URL path the socket connects on. Modal/Daytona/Blaxel serve the edge at\n   *  the root (`/`, the default); the selfhosted relay serves it at `/stream`\n   *  (M8b). When set, buildStreamUrl uses it instead of the root. */\n  path?: string;\n  [key: string]: unknown;\n};\n\n/** The structural slice of a provider session we need to resolve a tunnel. */\ntype PortResolvableSession = {\n  resolveExposedPort?: (port: number) => Promise<ExposedPortEndpoint>;\n};\n\n/** Thrown when the provider cannot expose the stream port (no resolveExposedPort,\n *  or the provider tunnel lookup failed). The caller degrades the desktop cell to\n *  `transport:null` (a value, never a crash) — a headless-only provider or a\n *  transient tunnel failure must not fail the whole handshake. */\nexport class StreamPortUnavailableError extends Error {\n  constructor(\n    message: string,\n    readonly cause?: unknown,\n  ) {\n    super(message);\n    this.name = \"StreamPortUnavailableError\";\n  }\n}\n\nexport type ExposeStreamPortInput = {\n  workspaceId: string;\n  sessionId: string;\n  /** The sandbox_lease_holders viewer row id the token is scoped to. */\n  viewerId: string;\n  /** The live lease epoch — the fence the token is pinned to. */\n  leaseEpoch: number;\n  /** The HMAC secret for the scoped stream token (resolveStreamTokenSecret). */\n  streamTokenSecret: string;\n  /** The exposed stream port; defaults to 6080. */\n  port?: number;\n  /** Token TTL in seconds; defaults to STREAM_TOKEN_DEFAULT_TTL_SECONDS. */\n  ttlSeconds?: number;\n  /** The framebuffer geometry to echo back to the client. */\n  resolution?: [number, number];\n  /** Override the issue clock (tests). Seconds since the epoch. */\n  nowSeconds?: number;\n  /** The authenticated viewer subject the token is minted for (0281). */\n  subjectId?: string;\n  /** The session authority epoch observed at mint (0281). */\n  authorityEpoch?: number;\n};\n\nexport type ExposeStreamPortResult = {\n  /** The direct-to-provider WS URL the viewer connects to (provider-scoped; the\n   *  Opengeni token is NOT appended). */\n  url: string;\n  /** The scoped Opengeni stream token — recorded against the holder, NEVER a URL\n   *  query param. */\n  token: string;\n  /** ISO absolute expiry of the token (the rotation hot-swap window backstop). */\n  expiresAt: string;\n  /** The pixel transport the client speaks. */\n  transport: \"vnc-ws\";\n  /** The reference noVNC client the SDK helper mounts. */\n  client: \"novnc\";\n  resolution: [number, number];\n  leaseEpoch: number;\n};\n\nconst DEFAULT_RESOLUTION: [number, number] = [1280, 800];\n\n/**\n * Assemble the direct-to-provider WS URL from a resolved endpoint. The SDK's\n * `urlForExposedPort(endpoint,'ws')` is the canonical tls-aware, IPv6-bracketing,\n * provider-query-preserving assembler — we reimplement its exact logic here so\n * the leaf stays agent-loop-free (the helper lives behind the bare\n * `@openai/agents-core` root, which the import-discipline test forbids). The\n * provider's own `endpoint.query` (Blaxel `bl_preview_token`, Daytona signed\n * token) is preserved; the Opengeni token is NOT appended (it is recorded against\n * the holder + validated at the in-box websockify edge).\n */\nexport function buildStreamUrl(endpoint: ExposedPortEndpoint): string {\n  if (\n    typeof endpoint.host !== \"string\" ||\n    endpoint.host.length === 0 ||\n    typeof endpoint.port !== \"number\"\n  ) {\n    throw new StreamPortUnavailableError(\n      `provider returned a malformed exposed-port endpoint (host=${String(endpoint.host)}, port=${String(endpoint.port)})`,\n    );\n  }\n  const tls = endpoint.tls ?? false;\n  const scheme = tls ? \"wss\" : \"ws\";\n  const defaultPort = tls ? 443 : 80;\n  // Bracket a bare IPv6 host (urlForExposedPort parity).\n  const host =\n    endpoint.host.includes(\":\") && !endpoint.host.startsWith(\"[\")\n      ? `[${endpoint.host}]`\n      : endpoint.host;\n  // The path: default the root `/` (Modal/Daytona/Blaxel edge), or the\n  // provider-supplied path (the selfhosted relay's `/stream` route, M8b). Always\n  // leading-slash-normalized.\n  const rawPath =\n    typeof endpoint.path === \"string\" && endpoint.path.length > 0 ? endpoint.path : \"/\";\n  const path = rawPath.startsWith(\"/\") ? rawPath : `/${rawPath}`;\n  const origin =\n    endpoint.port === defaultPort ? `${scheme}://${host}` : `${scheme}://${host}:${endpoint.port}`;\n  const authority = `${origin}${path}`;\n  const query = endpoint.query ?? \"\";\n  return query ? `${authority}?${query}` : authority;\n}\n\n/**\n * Join a provider tunnel prefix with a controller/API path. Modal/Daytona/Blaxel\n * serve the edge at `/`; OpenSandbox's lifecycle proxy serves it at\n * `/v1/sandboxes/<id>/proxy/<port>`. The request path (`/v1/browser-sessions/...`)\n * must keep that prefix so Channel B hits browserd, not the lifecycle API root.\n */\nexport function joinExposedPortPath(endpointPath: string | undefined, requestPath: string): string {\n  if (\n    typeof requestPath !== \"string\" ||\n    !requestPath.startsWith(\"/\") ||\n    requestPath.includes(\"\\0\") ||\n    requestPath.includes(\"#\") ||\n    requestPath.includes(\"?\")\n  ) {\n    throw new StreamPortUnavailableError(\"exposed-port request path is invalid\");\n  }\n  const raw = typeof endpointPath === \"string\" && endpointPath.length > 0 ? endpointPath : \"/\";\n  const prefix = (raw.startsWith(\"/\") ? raw : `/${raw}`).replace(/\\/+$/u, \"\") || \"\";\n  return `${prefix}${requestPath}`;\n}\n\nconst OPENSANDBOX_LIFECYCLE_PROXY_PATH = /\\/v1\\/sandboxes\\/[^/]+\\/proxy\\/\\d+(?:\\/|$)/u;\n/** OSEP-0011 URI mode: `/{sandbox_id}/{port}/{expires_b36}/{signature}/…`. */\nconst OPENSANDBOX_SIGNED_URI_PATH =\n  /^\\/([^/]{1,128})\\/(\\d{1,5})\\/([0-9a-z]{1,13})\\/([0-9a-z]{8,64})(?:\\/|$)/iu;\nconst SIGNED_ENDPOINT_REFRESH_SKEW_MS = 30_000;\n\nexport type OpenSandboxSignedUriPath = {\n  sandboxId: string;\n  port: number;\n  expiresAtSeconds: number;\n  signature: string;\n};\n\nexport function isOpenSandboxLifecycleProxyPath(path: string): boolean {\n  return OPENSANDBOX_LIFECYCLE_PROXY_PATH.test(path);\n}\n\nexport function parseOpenSandboxSignedUriPath(path: string): OpenSandboxSignedUriPath | null {\n  const normalized = path.startsWith(\"/\") ? path : `/${path}`;\n  const match = OPENSANDBOX_SIGNED_URI_PATH.exec(normalized);\n  if (!match) return null;\n  const port = Number(match[2]);\n  if (!Number.isInteger(port) || port < 1 || port > 65_535) return null;\n  const expiresAtSeconds = Number.parseInt(match[3]!, 36);\n  if (!Number.isSafeInteger(expiresAtSeconds) || expiresAtSeconds < 0) return null;\n  return {\n    sandboxId: match[1]!,\n    port,\n    expiresAtSeconds,\n    signature: match[4]!,\n  };\n}\n\nfunction pathnameFromExposedPort(endpoint: ExposedPortEndpoint | string): string | null {\n  if (typeof endpoint === \"string\") {\n    try {\n      return new URL(endpoint).pathname;\n    } catch {\n      return null;\n    }\n  }\n  return typeof endpoint.path === \"string\" && endpoint.path.length > 0 ? endpoint.path : \"/\";\n}\n\n/**\n * Host-side JSON/WebSocket may send the browserd Bearer only when the edge does\n * not rewrite `Authorization`. Lifecycle `/v1/sandboxes/<id>/proxy/<port>` does;\n * native `/` tunnels and OSEP-0011 signed URIs do not.\n */\nexport function exposedPortAllowsHostFetch(endpoint: ExposedPortEndpoint | string): boolean {\n  const path = pathnameFromExposedPort(endpoint);\n  if (path === null) return false;\n  if (isOpenSandboxLifecycleProxyPath(path)) return false;\n  if (path === \"/\" || path === \"\") return true;\n  return parseOpenSandboxSignedUriPath(path) !== null;\n}\n\nexport function signedEndpointExpiresAtMs(path: string): number | null {\n  const parsed = parseOpenSandboxSignedUriPath(path);\n  return parsed ? parsed.expiresAtSeconds * 1000 : null;\n}\n\nexport function signedEndpointNeedsRefresh(\n  path: string,\n  nowMs = Date.now(),\n  skewMs = SIGNED_ENDPOINT_REFRESH_SKEW_MS,\n): boolean {\n  const expiresAt = signedEndpointExpiresAtMs(path);\n  if (expiresAt === null) return false;\n  return nowMs + skewMs >= expiresAt;\n}\n\n/** Logs and artifacts may keep the signed path shape, never the signature. */\nexport function redactOpenSandboxSignedUriPath(path: string): string {\n  return path.replace(/^(\\/[^/]+\\/\\d+\\/[0-9a-z]+)\\/[0-9a-z]+/iu, \"$1/[redacted]\");\n}\n\n/** Rehydrate a persisted provider tunnel URL without contacting the provider.\n * Only the exact ws/wss shape emitted by buildStreamUrl is accepted. */\nexport function exposedPortEndpointFromUrl(value: string): ExposedPortEndpoint {\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    throw new StreamPortUnavailableError(\"cached provider endpoint is not a valid URL\");\n  }\n  if (\n    (parsed.protocol !== \"ws:\" && parsed.protocol !== \"wss:\") ||\n    parsed.username !== \"\" ||\n    parsed.password !== \"\" ||\n    parsed.hash !== \"\" ||\n    parsed.hostname === \"\"\n  ) {\n    throw new StreamPortUnavailableError(\"cached provider endpoint has an invalid authority\");\n  }\n  const tls = parsed.protocol === \"wss:\";\n  const port = parsed.port === \"\" ? (tls ? 443 : 80) : Number(parsed.port);\n  if (!Number.isInteger(port) || port < 1 || port > 65_535) {\n    throw new StreamPortUnavailableError(\"cached provider endpoint has an invalid port\");\n  }\n  return {\n    host: parsed.hostname,\n    port,\n    tls,\n    path: parsed.pathname || \"/\",\n    query: parsed.search.startsWith(\"?\") ? parsed.search.slice(1) : parsed.search,\n  };\n}\n\n/**\n * Resolve the provider's scoped tunnel for the stream port and mint the scoped\n * Opengeni stream token. Returns a coherent `{url, token, expiresAt, transport,\n * client, resolution}` cell the caller records on the lease (data_plane_url) and\n * returns in the DesktopStream handshake.\n *\n * Throws `StreamPortUnavailableError` when the provider session cannot resolve\n * the port (no `resolveExposedPort`, or the tunnel lookup failed) — the caller\n * maps this to a `transport:null` degradation (a value, never a crash).\n */\nexport async function exposeStreamPort(\n  session: unknown,\n  input: ExposeStreamPortInput,\n): Promise<ExposeStreamPortResult> {\n  const s = session as PortResolvableSession;\n  const port = input.port ?? DESKTOP_STREAM_PORT;\n  if (typeof s?.resolveExposedPort !== \"function\") {\n    throw new StreamPortUnavailableError(\n      \"provider session cannot resolve exposed ports (no resolveExposedPort) — desktop stream unavailable\",\n    );\n  }\n\n  let endpoint: ExposedPortEndpoint;\n  try {\n    // (I7/OD-7) per-provider URL re-resolution folds in here: a provider with a\n    // preview/signed token (Daytona/Blaxel) re-resolves its own short-TTL token\n    // on every call, so a rotation re-mints both planes' freshness in one place.\n    endpoint = await s.resolveExposedPort(port);\n  } catch (error) {\n    throw new StreamPortUnavailableError(\n      `provider failed to resolve the stream port ${port}: ${error instanceof Error ? error.message : String(error)}`,\n      error,\n    );\n  }\n\n  const url = buildStreamUrl(endpoint);\n  const ttlSeconds = input.ttlSeconds ?? STREAM_TOKEN_DEFAULT_TTL_SECONDS;\n  const nowSeconds = input.nowSeconds ?? Math.floor(Date.now() / 1000);\n  const token = await mintStreamToken(input.streamTokenSecret, {\n    workspaceId: input.workspaceId,\n    sessionId: input.sessionId,\n    viewerId: input.viewerId,\n    leaseEpoch: input.leaseEpoch,\n    mode: \"view\",\n    port,\n    ttlSeconds,\n    nowSeconds,\n    ...(input.subjectId ? { subjectId: input.subjectId } : {}),\n    ...(input.authorityEpoch ? { authorityEpoch: input.authorityEpoch } : {}),\n  });\n\n  return {\n    url,\n    token,\n    expiresAt: new Date((nowSeconds + ttlSeconds) * 1000).toISOString(),\n    transport: \"vnc-ws\",\n    client: \"novnc\",\n    resolution: input.resolution ?? DEFAULT_RESOLUTION,\n    leaseEpoch: input.leaseEpoch,\n  };\n}\n","// @opengeni/runtime/sandbox — scoped stream-token mint/verify (P3.1).\n//\n// The agent-loop-free home for the scoped data-plane stream token used by the\n// desktop pixel plane (Channel B, sandbox contract §C.3 / crosscut PART 1.3). It is\n// a THIN wrapper over the contracts HMAC envelope (signStreamToken /\n// verifyStreamToken) — NOT a second crypto: it REUSES the exact base64Url +\n// hmacSha256 construction that backs signDelegatedAccessToken, with the distinct\n// `ogs_` prefix and the hard-narrow StreamTokenPayload claim set.\n//\n// It lives under @opengeni/runtime/sandbox so the API-direct control plane\n// (apps/api) can mint + verify stream tokens from the same single agent-loop-free\n// leaf it already pulls createSandboxClient / resume-by-id from.\n\nimport {\n  DESKTOP_STREAM_PORT,\n  StreamTokenPayload,\n  signStreamToken,\n  verifyStreamToken as verifyStreamTokenEnvelope,\n  type StreamTokenPayload as StreamTokenPayloadType,\n} from \"@opengeni/contracts\";\n\n// The default stream-token TTL (seconds). The token is short-lived by design:\n// URL rotation is event-driven under the epoch fence (re-resolve recorded on the\n// lease), not on a keepalive clock — so the token never needs a long life.\nexport const STREAM_TOKEN_DEFAULT_TTL_SECONDS = 120;\n\nexport type MintStreamTokenInput = {\n  workspaceId: string;\n  sessionId: string;\n  /** The sandbox_lease_holders viewer row id. */\n  viewerId: string;\n  /** The epoch the token is fenced to. For a Modal box this is the live LEASE\n   *  epoch (re-minted on box rollover). For a SELFHOSTED relay stream (M8b) this is\n   *  the session's swap `active_epoch`: the relay tracks the highest epoch any\n   *  viewer presented per channel and REJECTS a token with a lower epoch, so a\n   *  viewer whose token predates a swap-away cannot reach the machine the session\n   *  swapped off of. One field, two fences — the relay/in-box edge reads it as the\n   *  stale-viewer floor either way. */\n  leaseEpoch: number;\n  /** v1 is always \"view\"; \"control\" is the never-granted raw-input plane. */\n  mode?: \"view\" | \"control\";\n  /** The exposed stream port (noVNC); defaults to 6080. */\n  port?: number;\n  /** TTL in seconds; defaults to STREAM_TOKEN_DEFAULT_TTL_SECONDS. */\n  ttlSeconds?: number;\n  /** Override the issue clock (tests). Seconds since the epoch. */\n  nowSeconds?: number;\n  /** The authenticated viewer subject the token is minted for (0281). */\n  subjectId?: string;\n  /** The session authority epoch observed at mint (0281). */\n  authorityEpoch?: number;\n};\n\n/**\n * Mint a scoped stream token for one viewer holder. Builds the hard-narrow\n * StreamTokenPayload (the claim set the in-box edge / control plane validates)\n * and signs it with the resolved stream-token secret via the contracts HMAC\n * envelope (`ogs_` prefix). The token is RECORDED against the holder row by the\n * caller and is NEVER appended to the data-plane URL as a query param.\n */\nexport async function mintStreamToken(\n  secret: string,\n  input: MintStreamTokenInput,\n): Promise<string> {\n  const nowSeconds = input.nowSeconds ?? Math.floor(Date.now() / 1000);\n  const ttlSeconds = input.ttlSeconds ?? STREAM_TOKEN_DEFAULT_TTL_SECONDS;\n  const payload: StreamTokenPayloadType = StreamTokenPayload.parse({\n    workspaceId: input.workspaceId,\n    sessionId: input.sessionId,\n    viewerId: input.viewerId,\n    leaseEpoch: input.leaseEpoch,\n    mode: input.mode ?? \"view\",\n    port: input.port ?? DESKTOP_STREAM_PORT,\n    exp: nowSeconds + ttlSeconds,\n    ...(input.subjectId ? { subjectId: input.subjectId } : {}),\n    ...(input.authorityEpoch ? { authorityEpoch: input.authorityEpoch } : {}),\n  });\n  return signStreamToken(secret, payload);\n}\n\n/**\n * Verify a scoped stream token. Returns the parsed claims on success, or null on\n * a bad prefix / malformed envelope / bad HMAC signature / schema-invalid claims\n * / expiry. Re-exports the contracts verify; the leaf is the agent-loop-free\n * import surface the API uses.\n *\n * The epoch fence (claim.leaseEpoch vs the LIVE lease epoch) and the\n * workspace+session scope are enforced at USE by the caller against the live\n * lease + route params — verify proves authenticity + freshness only.\n */\nexport async function verifyStreamToken(\n  secret: string,\n  token: string,\n  nowSeconds = Math.floor(Date.now() / 1000),\n): Promise<StreamTokenPayloadType | null> {\n  return verifyStreamTokenEnvelope(secret, token, nowSeconds);\n}\n\nexport {\n  StreamTokenPayload,\n  type StreamTokenPayload as StreamTokenPayloadType,\n} from \"@opengeni/contracts\";\n","import { DefaultAdapterFactory, type AdapterFactory } from \"@alibaba-group/opensandbox\";\nimport { AsyncLocalStorage } from \"node:async_hooks\";\n\ntype Commands = ReturnType<AdapterFactory[\"createExecdStack\"]>[\"commands\"];\nconst defaultCreateExecdStack = DefaultAdapterFactory.prototype.createExecdStack;\nconst boundDefaultCommands = new WeakMap<Commands, Pick<Commands, \"run\" | \"runStream\">>();\nconst commandDispatch = new AsyncLocalStorage<{ attempted: boolean }>();\n\n/** Local proof from the actual command invocation and its bound wire seam,\n * never inferred from provider status codes, error text or a missing init. */\nexport class OpenSandboxCommandDispatchError extends Error {\n  constructor(\n    readonly notDispatched: boolean,\n    cause: unknown,\n  ) {\n    super(\n      notDispatched\n        ? \"OpenSandbox command was not dispatched\"\n        : \"OpenSandbox command dispatch is uncertain\",\n      { cause },\n    );\n    this.name = \"OpenSandboxCommandDispatchError\";\n  }\n}\n\nexport async function withOpenSandboxCommandDispatchProof<T>(\n  commands: Commands,\n  invoke: () => Promise<T>,\n): Promise<T> {\n  const bound = boundDefaultCommands.get(commands);\n  const trusted =\n    bound !== undefined && bound.run === commands.run && bound.runStream === commands.runStream;\n  const state = { attempted: false };\n  return await commandDispatch.run(state, async () => {\n    try {\n      return await invoke();\n    } catch (cause) {\n      // A custom adapter can bypass this fetch entirely. Its absence is never\n      // no-dispatch proof; only an unchanged, genuinely bound default SDK path\n      // that failed before invoking the command transport can grant that proof.\n      throw new OpenSandboxCommandDispatchError(trusted && !state.attempted, cause);\n    }\n  });\n}\n\n/** A successful command HTTP response was accepted, but its event stream no\n * longer proves complete output or exit. It is not proof of an unstarted op. */\nexport class OpenSandboxCommandStreamError extends Error {\n  constructor(message: string, cause?: unknown) {\n    super(`OpenSandbox command stream is uncertain: ${message}`, { cause });\n    this.name = \"OpenSandboxCommandStreamError\";\n  }\n}\n\n/** Decode complete wire lines, not whole transport chunks: a corrupt later\n * line must not erase an earlier authenticated init in the same HTTP chunk. */\nasync function* wireLines(reader: ReadableStreamDefaultReader<Uint8Array>) {\n  const decoder = new TextDecoder(\"utf-8\", { fatal: true, ignoreBOM: true });\n  let parts: Uint8Array[] = [];\n  let skipLf = false;\n  let first = true;\n  const decode = () => {\n    let line = decoder.decode(Buffer.concat(parts));\n    parts = [];\n    if (first) line = line.replace(/^\\uFEFF/u, \"\");\n    first = false;\n    return line;\n  };\n  while (true) {\n    const { done, value } = await reader.read();\n    if (done) break;\n    let start = 0;\n    for (let index = 0; index < value.length; index++) {\n      const byte = value[index];\n      if (skipLf) {\n        skipLf = false;\n        if (byte === 10) {\n          start = index + 1;\n          continue;\n        }\n      }\n      if (byte !== 10 && byte !== 13) continue;\n      parts.push(value.subarray(start, index));\n      yield { line: decode(), terminated: true };\n      skipLf = byte === 13;\n      start = index + 1;\n    }\n    if (start < value.length) parts.push(value.subarray(start));\n  }\n  if (parts.length) yield { line: decode(), terminated: false };\n}\n\n/** The SDK coerces these fields with String(), which can turn an array value\n * into a successful exit code. Validate the wire DTO before that conversion.\n * Fields are optional in the provider schema; supplied aliases must agree. */\nfunction assertCommandError(value: unknown): void {\n  if (!value || typeof value !== \"object\" || Array.isArray(value))\n    throw new Error(\"invalid command error envelope\");\n  const error = value as Record<string, unknown>;\n  let recognized = false;\n  for (const [primary, alias] of [\n    [\"ename\", \"name\"],\n    [\"evalue\", \"value\"],\n  ] as const) {\n    for (const field of [primary, alias]) {\n      if (error[field] === undefined) continue;\n      recognized = true;\n      if (typeof error[field] !== \"string\") throw new Error(\"invalid command error field\");\n    }\n    if (\n      error[primary] !== undefined &&\n      error[alias] !== undefined &&\n      error[primary] !== error[alias]\n    )\n      throw new Error(\"contradictory command error aliases\");\n  }\n  if (error.traceback !== undefined) {\n    recognized = true;\n    if (!Array.isArray(error.traceback) || error.traceback.some((line) => typeof line !== \"string\"))\n      throw new Error(\"invalid command error traceback\");\n  }\n  if (!recognized) throw new Error(\"empty command error DTO\");\n}\n\nasync function* commandFrames(response: Response): AsyncGenerator<Uint8Array> {\n  if (!response.body) throw new OpenSandboxCommandStreamError(\"missing response body\");\n  const reader = response.body.getReader();\n  const encoder = new TextEncoder();\n  let data: string[] = [];\n  let executionId: string | null = null;\n  let completed = false;\n  let eof = false;\n  // The SDK supports SSE and NDJSON independently of the response MIME type.\n  let mode: \"sse\" | \"ndjson\" | null = null;\n  const frame = (json: string) => {\n    const value: unknown = JSON.parse(json);\n    if (!value || typeof value !== \"object\" || Array.isArray(value))\n      throw new Error(\"invalid command event envelope\");\n    const event = value as Record<string, unknown>;\n    if (typeof event.type !== \"string\") throw new Error(\"missing command event type\");\n    if (event.type === \"init\") {\n      if (typeof event.text !== \"string\" || !event.text.trim())\n        throw new Error(\"missing execution identity\");\n      if (executionId !== null && event.text !== executionId)\n        throw new Error(\"contradictory execution identity\");\n      executionId = event.text;\n    }\n    for (const field of [\"id\", \"execution_id\", \"executionId\"] as const) {\n      if (event[field] !== undefined && event[field] !== executionId)\n        throw new Error(\"contradictory event identity\");\n    }\n    if ((event.type === \"stdout\" || event.type === \"stderr\") && typeof event.text !== \"string\")\n      throw new Error(\"invalid command output\");\n    if (event.type === \"error\") assertCommandError(event.error);\n    if (event.type === \"execution_complete\") {\n      if (executionId === null) throw new Error(\"completion without execution identity\");\n      completed = true;\n    }\n    // The pinned SDK accepts one JSON value per data line, but not legal SSE\n    // multiline JSON. Canonicalizing only framing preserves every text value.\n    return encoder.encode(`data: ${JSON.stringify(event)}\\n\\n`);\n  };\n  try {\n    for await (const { line, terminated } of wireLines(reader)) {\n      if (mode === null && line && !line.startsWith(\":\"))\n        mode = line.trimStart().startsWith(\"{\") ? \"ndjson\" : \"sse\";\n      if (mode === \"ndjson\") {\n        if (line.trim()) yield frame(line);\n        continue;\n      }\n      if (!terminated && line && !line.startsWith(\":\")) throw new Error(\"truncated SSE line\");\n      if (line === \"\") {\n        if (data.length) {\n          const json = data.join(\"\\n\");\n          data = [];\n          yield frame(json);\n        }\n        continue;\n      }\n      if (line.startsWith(\":\")) continue;\n      const colon = line.indexOf(\":\");\n      const field = colon === -1 ? line : line.slice(0, colon);\n      const value = colon === -1 ? \"\" : line.slice(colon + 1).replace(/^ /u, \"\");\n      if (field === \"data\") data.push(value);\n      // Other legal SSE fields (event/id/retry/extensions) do not alter data.\n    }\n    eof = true;\n    if (data.length) throw new Error(\"truncated SSE frame\");\n    if (!completed) throw new Error(\"EOF without command completion\");\n  } catch (error) {\n    throw error instanceof OpenSandboxCommandStreamError\n      ? error\n      : new OpenSandboxCommandStreamError(\"invalid or incomplete events\", error);\n  } finally {\n    if (!eof) await reader.cancel().catch(() => undefined);\n    reader.releaseLock();\n  }\n}\n\nfunction strictCommandFetch(original: typeof fetch): typeof fetch {\n  const wrapped = (async (input, init) => {\n    const url = input instanceof Request ? input.url : String(input);\n    const isCommand =\n      (init?.method ?? (input instanceof Request ? input.method : \"GET\")).toUpperCase() ===\n        \"POST\" && new URL(url).pathname.endsWith(\"/command\");\n    // Mark BEFORE the original transport. Header loss and a non-2xx response\n    // do not prove that the provider refused the original mutation.\n    const dispatch = commandDispatch.getStore();\n    if (isCommand && dispatch) dispatch.attempted = true;\n    const response = await original(input, init);\n    if (!response.ok || !isCommand) return response;\n    if (!response.body) throw new OpenSandboxCommandStreamError(\"missing response body\");\n    const frames = commandFrames(response);\n    const body = new ReadableStream<Uint8Array>(\n      {\n        async pull(controller) {\n          try {\n            const next = await frames.next();\n            if (next.done) controller.close();\n            else controller.enqueue(next.value);\n          } catch (error) {\n            controller.error(error);\n          }\n        },\n        async cancel() {\n          await frames.return(undefined);\n        },\n      },\n      // Do not observe later errors ahead of the SDK consuming a valid page.\n      { highWaterMark: 0 },\n    );\n    const headers = new Headers(response.headers);\n    headers.delete(\"content-length\");\n    headers.delete(\"content-encoding\");\n    headers.set(\"content-type\", \"text/event-stream\");\n    return new Response(body, {\n      status: response.status,\n      statusText: response.statusText,\n      headers,\n    });\n  }) as typeof fetch;\n  return wrapped;\n}\n\n/** Public factory/config seams only. The SDK still owns request construction,\n * headers, dispatch, HTTP errors and event callbacks. No start is repeated. */\nexport function withOpenSandboxCommandStreamProof(factory: AdapterFactory): AdapterFactory {\n  return {\n    createLifecycleStack: (options) => factory.createLifecycleStack(options),\n    createEgressStack: (options) => factory.createEgressStack(options),\n    createExecdStack(options) {\n      const sseFetch = strictCommandFetch(options.connectionConfig.sseFetch);\n      const createExecdStack = factory.createExecdStack;\n      const stack = createExecdStack.call(factory, {\n        ...options,\n        connectionConfig: new Proxy(options.connectionConfig, {\n          get(target, property) {\n            return property === \"sseFetch\" ? sseFetch : Reflect.get(target, property, target);\n          },\n        }),\n      });\n      if (createExecdStack === defaultCreateExecdStack) {\n        // The public default constructor binds THIS sseFetch to its commands.\n        // Delegating/custom factory methods are not assumed to do the same.\n        boundDefaultCommands.set(stack.commands, {\n          run: stack.commands.run,\n          runStream: stack.commands.runStream,\n        });\n      }\n      return stack;\n    },\n  };\n}\n","import { CAPABILITY_DESCRIPTORS } from \"../capabilities\";\nimport { SandboxConfigError } from \"../errors\";\nimport { OpenSandboxClient } from \"./opensandbox-adapter\";\nimport { REPEATABLE_PORTABLE_TAR_WORKSPACE_CAPTURE, type ProviderRegistration } from \"./types\";\n\nconst IMMUTABLE_OCI_IMAGE = /@sha256:[0-9a-f]{64}$/iu;\n/** Desktop-class box: Chromium + XFCE + ttyd will OOM in 1Gi. Two such boxes still fit a D4s_v3. */\nexport const OPENSANDBOX_DIRECT_RESOURCE_LIMITS = Object.freeze({ cpu: \"2\", memory: \"4Gi\" });\nexport const OPENSANDBOX_DIRECT_RESOURCE_REQUESTS = Object.freeze({\n  cpu: \"500m\",\n  memory: \"2Gi\",\n});\n\nfunction clientOptions(\n  settings: Parameters<ProviderRegistration[\"validateCredentials\"]>[0],\n  environment: Record<string, string> = {},\n  exposedPorts: number[] = [],\n  metrics?: import(\"../../metrics\").RuntimeMetricsHooks,\n) {\n  return {\n    baseUrl: settings.openSandboxBaseUrl!,\n    apiKey: settings.openSandboxApiKey!,\n    image: settings.openSandboxImage!,\n    ttlSeconds: settings.openSandboxTtlSeconds,\n    useServerProxy: settings.openSandboxUseServerProxy,\n    signedEndpoints: settings.openSandboxSignedEndpoints,\n    signedEndpointTtlSeconds: settings.openSandboxSignedEndpointTtlSeconds,\n    ...(settings.openSandboxChannelBPublicBaseUrl\n      ? { channelBPublicBaseUrl: settings.openSandboxChannelBPublicBaseUrl }\n      : {}),\n    readyTimeoutSeconds: Math.ceil(settings.sandboxWarmingTimeoutMs / 1000),\n    resourceLimits: OPENSANDBOX_DIRECT_RESOURCE_LIMITS,\n    resourceRequests: OPENSANDBOX_DIRECT_RESOURCE_REQUESTS,\n    environment,\n    exposedPorts,\n    ...(settings.openSandboxPoolRef ? { poolRef: settings.openSandboxPoolRef } : {}),\n    ...(metrics ? { metrics } : {}),\n  };\n}\n\nexport const opensandboxProvider: ProviderRegistration = {\n  backend: \"opensandbox\",\n  exactResumeMode: \"custom\",\n  instanceIdFields: [\"sandboxId\"],\n  workspaceCapturePolicy: () => REPEATABLE_PORTABLE_TAR_WORKSPACE_CAPTURE,\n  descriptor: CAPABILITY_DESCRIPTORS.opensandbox,\n  validateCredentials(settings) {\n    if (!settings.openSandboxBaseUrl) {\n      throw new SandboxConfigError(\"opensandbox\", \"OPENGENI_OPENSANDBOX_BASE_URL is required\");\n    }\n    if (!settings.openSandboxApiKey) {\n      throw new SandboxConfigError(\"opensandbox\", \"OPENGENI_OPENSANDBOX_API_KEY is required\");\n    }\n    if (!settings.openSandboxImage || !IMMUTABLE_OCI_IMAGE.test(settings.openSandboxImage)) {\n      throw new SandboxConfigError(\n        \"opensandbox\",\n        \"OPENGENI_OPENSANDBOX_IMAGE must be an immutable OCI digest\",\n      );\n    }\n  },\n  async renewExpiration({ settings, instanceId }) {\n    await new OpenSandboxClient(clientOptions(settings)).renewExpiration(instanceId);\n  },\n  build({ settings, environment, exposedPorts, metrics }) {\n    return new OpenSandboxClient(clientOptions(settings, environment, exposedPorts, metrics));\n  },\n};\n","import { RunloopSandboxClient } from \"@openai/agents-extensions/sandbox/runloop\";\nimport { CAPABILITY_DESCRIPTORS } from \"../capabilities\";\nimport { SandboxConfigError } from \"../errors\";\nimport { REPEATABLE_PORTABLE_TAR_WORKSPACE_CAPTURE, type ProviderRegistration } from \"./types\";\n\nexport const runloopProvider: ProviderRegistration = {\n  backend: \"runloop\",\n  exactResumeMode: \"custom\",\n  instanceIdFields: [\"devboxId\"],\n  // The SDK otherwise creates a non-idempotent native disk snapshot whose\n  // provider artifact has no Opengeni outcome ledger. Lifecycle capture uses\n  // the inherited unique-path tar primitive instead.\n  workspaceCapturePolicy: () => REPEATABLE_PORTABLE_TAR_WORKSPACE_CAPTURE,\n  descriptor: CAPABILITY_DESCRIPTORS.runloop,\n  validateCredentials(settings) {\n    if (!settings.runloopApiKey) {\n      throw new SandboxConfigError(\"runloop\", \"OPENGENI_RUNLOOP_API_KEY is required\");\n    }\n  },\n  build({ settings, environment, exposedPorts }) {\n    const options: NonNullable<ConstructorParameters<typeof RunloopSandboxClient>[0]> = {\n      apiKey: settings.runloopApiKey!,\n      env: environment,\n      exposedPorts,\n      // Tunnel v2: one tunnel for all ports. Defaults to true in our config.\n      tunnel: settings.runloopTunnel,\n    };\n    if (settings.runloopBaseUrl) options.baseUrl = settings.runloopBaseUrl;\n    if (settings.runloopBlueprintName) options.blueprintName = settings.runloopBlueprintName;\n    if (settings.runloopBlueprintId) options.blueprintId = settings.runloopBlueprintId;\n    // Keep the provider-native snapshot request inside the same immutable\n    // budget as Opengeni's durable capture claim. The outer lifecycle timeout\n    // remains the final fence; this prevents an abandoned SDK request from\n    // needlessly running past it when Runloop supports an exact operation knob.\n    // Runloop keep-alive also lives in this bag (ms), not at Modal's top level.\n    options.timeouts = {\n      snapshotTimeoutMs: settings.sandboxSnapshotTimeoutMs,\n      ...(settings.runloopKeepAliveSeconds\n        ? { keepAliveTimeoutMs: settings.runloopKeepAliveSeconds * 1000 }\n        : {}),\n    };\n    return new RunloopSandboxClient(options);\n  },\n};\n","// `SelfhostedSession` + `SelfhostedSandboxClient` — the NATS-backed structural\n// sandbox surface for the `selfhosted` backend (bring-your-own-compute).\n//\n// The insight: every existing seam (Channel-A exec/fs/git, the\n// viewer's `resolveExposedPort`) consumes a provider session\n// STRUCTURALLY — `session.exec ?? session.execCommand`, `session.readFile`,\n// `session.resolveExposedPort`, `session.serializeSessionState`. If the\n// selfhosted client's `create()`/`resume()` return a session presenting that\n// EXACT surface — but backed by `ControlRpc` (request/reply to the agent over\n// the exact claimed process subject, encoded via `@opengeni/agent-proto`) instead of a\n// provider SDK — then those seams work UNCHANGED. The agent IS the box.\n//\n// The session depends ONLY on `ControlRpc` + `{workspaceId, agentId}` (+ the\n// relay config for the stream-URL SHAPE). It knows nothing about NATS directly\n// (the M3/M4 seam). `serializeSessionState`/`deserializeSessionState` round-trip\n// `{agentId}` ONLY — resume = re-address the live subject, NO provider state.\n\nimport {\n  ControlRequest,\n  ControlResponse,\n  ErrorCode,\n  FsEntryKind,\n  StreamKind,\n  type BrowserControlEnsureRequest,\n  type BrowserControlEnsureResponse,\n  type BrowserFramesOpenRequest,\n  type ComputerFramesOpenRequest,\n  type ExecRequest,\n  type ExecResponse,\n  type OperationResourcePolicy,\n  type StreamChannel,\n} from \"@opengeni/agent-proto\";\nimport { DESKTOP_STREAM_PORT } from \"@opengeni/contracts\";\nimport {\n  SELFHOSTED_FILE_CHUNK_BYTES,\n  fileContentDigest,\n  transferEditorFile,\n} from \"./file-transfer\";\n// `Manifest` from the ALLOWED sandbox-leaf entrypoint (`@openai/agents/sandbox`\n// re-exports `@openai/agents-core/sandbox`, which exports the Manifest class) —\n// NOT the agent-loop `@openai/agents` root the sandbox leaf forbids. The live\n// `state.manifest` slice the @openai/agents SDK reads per turn must be a real\n// Manifest (see the `state` field below); selfhosted exec routes over NATS and\n// does not use the manifest, but the SDK requires it present + well-formed.\nimport { Manifest } from \"@openai/agents/sandbox\";\nimport { formatExecResponse } from \"@openai/agents-core/sandbox/internal\";\nimport type { ExposedPortEndpoint } from \"../stream-port\";\nimport {\n  BROWSER_CONTROL_HTTP_REPLY_GRACE_MS,\n  type BrowserControlHttpCall,\n  type BrowserControlHttpOutcome,\n} from \"../browser-control-http\";\nimport {\n  agentErrorToControlError,\n  drainingExhaustedError,\n  execDeadlineHint,\n  SelfhostedControlError,\n  subjectFor,\n  type ControlRpc,\n} from \"./control-rpc\";\nimport {\n  decideSelfhostedRetry,\n  defaultSelfhostedRetryClock,\n  type SelfhostedRetryClock,\n} from \"./retry-policy\";\nimport type { SelfhostedOpObservation, SelfhostedOpObserver } from \"./op-observer\";\nimport { selfhostedFaultClass } from \"./fault-rendering\";\nimport {\n  nextDurableOpId,\n  notifyRemoteOperationTransportSelected,\n  notifyDurableOpOwnershipTransferStarted,\n  notifyDurableOpOwnershipTransferFailed,\n  notifyDurableOpOwnershipTransferred,\n  notifyRemoteOperationNotDispatched,\n  type RemoteOperationControl,\n  type RemoteOperationObservation,\n} from \"../op-correlation\";\nimport {\n  OpStreamExecClient,\n  runnerFailureToControlError,\n  type OpStreamJournal,\n  type OpStreamOutputFrame,\n  type OpStreamOutputReceipt,\n} from \"./op-stream\";\nimport { OpStreamUnavailableError, type OpStreamTransport } from \"./op-transport\";\nimport { connectedMachineWorkspaceRootsEqual, resolveConnectedMachinePath } from \"./workspace-path\";\nimport type { ShellDialect } from \"@opengeni/vaults\";\nimport {\n  secretExecCarryFor,\n  secretExecEnvironment,\n  secretScopeDirectory,\n  shellDialectFor,\n  spliceCarry,\n} from \"../secret-delivery\";\n\nconst decoder = new TextDecoder();\nconst encoder = new TextEncoder();\n// Keep one RPC reply comfortably below the agent's negotiated 1 MiB payload\n// ceiling. `fsRead` is ranged, so larger logical reads are assembled here.\nconst SELFHOSTED_FS_READ_CHUNK_BYTES = 512 * 1024;\nconst SELFHOSTED_PLACEMENT_PRIVATE_PREFIX = \"/tmp/opengeni-private/\";\nconst SELFHOSTED_PLACEMENT_PRIVATE_MAX_BYTES = 128 * 1024;\n// Private files (secretfile values up to the vault's 256 KiB file limit) stay\n// well below the 1 MiB RPC payload ceiling.\nconst SELFHOSTED_PLACEMENT_PRIVATE_FILE_MAX_BYTES = 512 * 1024;\n\n/**\n * Builds the exact argv for an explicitly selected shell.\n *\n * The self-hosted wire already supports direct argv (`ExecRequest.shell=false`),\n * which is the compatibility-safe way to honor the SDK shell tool's `shell` and\n * `login` arguments: every enrolled agent version understands this shape. Sending\n * `{ command: [cmd], shell: true }` instead delegates shell selection to the\n * machine's ambient `$SHELL`/`ComSpec` and silently discards the caller's choice.\n *\n * `login` maps to profile/login semantics where the shell family exposes them.\n * Windows `cmd.exe` has no login-shell mode. PowerShell profile loading is the\n * closest equivalent, so non-login calls use `-NoProfile` while login calls do\n * not. Other shells use the common POSIX `-l -c` / `-c` contract.\n */\nfunction explicitShellArgv(shell: string, command: string, login: boolean): string[] {\n  const leaf = shell.replaceAll(\"\\\\\", \"/\").split(\"/\").at(-1)?.toLowerCase() ?? \"\";\n  if (leaf === \"cmd\" || leaf === \"cmd.exe\") {\n    return [shell, \"/D\", \"/S\", \"/C\", command];\n  }\n  if (\n    leaf === \"powershell\" ||\n    leaf === \"powershell.exe\" ||\n    leaf === \"pwsh\" ||\n    leaf === \"pwsh.exe\"\n  ) {\n    return [\n      shell,\n      \"-NoLogo\",\n      ...(!login ? [\"-NoProfile\"] : []),\n      \"-NonInteractive\",\n      \"-Command\",\n      command,\n    ];\n  }\n  return [shell, ...(login ? [\"-l\"] : []), \"-c\", command];\n}\n\n// ── The agent-turn provided-session contract (@openai/agents-core) ──────────\n// When the routing proxy resolves a selfhosted ACTIVE backend, the @openai/agents\n// agent loop binds its filesystem/shell/skills capabilities to THIS session and\n// calls a richer method set than the Channel-A structural surface: `createEditor`\n// + `viewImage` (filesystem), `execCommand` + `supportsPty` (shell), `pathExists`\n// + `listDir` + `materializeEntry` + `readFile` (skills). The session must present\n// all of them or the turn crashes (e.g. \"Filesystem sandbox sessions must provide\n// createEditor()\"). These run over the SAME NATS exec/fs primitives; the machine\n// owns its filesystem so source materialization is a no-op.\n\n/** The V4A-diff applier the SDK's apply_patch editor uses. The leaf cannot import\n *  `@openai/agents`'s `applyDiff` (the agent-loop root the leaf forbids), so the\n *  runtime barrel (`packages/runtime/src/index.ts`, which DOES import that root)\n *  injects it via `setSelfhostedApplyDiff` at module load. Until injected,\n *  `createEditor()` surfaces a clear error rather than a silent wrong-edit. */\nexport type SelfhostedApplyDiff = (\n  input: string,\n  diff: string,\n  mode?: \"default\" | \"create\",\n) => string;\nlet injectedApplyDiff: SelfhostedApplyDiff | undefined;\n\n/** Register the SDK's `applyDiff` so `SelfhostedSession.createEditor()` can apply\n *  V4A diffs over the NATS fs ops. Called once by the runtime barrel. */\nexport function setSelfhostedApplyDiff(fn: SelfhostedApplyDiff): void {\n  injectedApplyDiff = fn;\n}\n\n/** The structural Editor surface the SDK's filesystem capability consumes (the\n *  three apply_patch operations). Mirrors `@openai/agents-core`'s `Editor`. */\nexport interface SelfhostedEditor {\n  createFile(\n    operation: { path: string; diff: string },\n    context?: unknown,\n  ): Promise<{ output?: string } | void>;\n  updateFile(\n    operation: { path: string; diff: string; moveTo?: string },\n    context?: unknown,\n  ): Promise<{ output?: string } | void>;\n  deleteFile(operation: { path: string }, context?: unknown): Promise<{ output?: string } | void>;\n}\n\n/** The image tool-output shape the SDK's view_image tool expects (mirror of\n *  `ToolOutputImage` — not re-exported by `@openai/agents/sandbox`, so structural). */\nexport interface SelfhostedImageOutput {\n  type: \"image\";\n  image: { data: Uint8Array; mediaType: string };\n}\n\n/** Default control-op timeout. A transient miss surfaces as `agent_reconnecting`\n *  (the turn pauses + retries); it is NOT a hard failure. */\nexport const SELFHOSTED_DEFAULT_TIMEOUT_MS = 30_000;\n/** Reply grace after an agent-side exec deadline. The child is terminated at\n *  `ExecRequest.timeoutMs`; this outer window lets the typed `timedOut` response\n *  cross NATS before request/reply gives up. */\nconst SELFHOSTED_EXEC_REPLY_GRACE_MS = 5_000;\n/** nats.js ultimately schedules a JS timer; stay inside the signed 32-bit timer\n *  range while also fitting the reply grace. */\nconst SELFHOSTED_MAX_EXEC_TIMEOUT_MS = 2_147_483_647 - SELFHOSTED_EXEC_REPLY_GRACE_MS;\nconst SELFHOSTED_BACKGROUND_DEFAULT_YIELD_MS = 10_000;\nconst SELFHOSTED_BACKGROUND_MAX_YIELD_MS = 30_000;\n\nfunction normalizeOperationResourcePolicy(\n  policy: SelfhostedOperationResourcePolicy | undefined,\n): OperationResourcePolicy | undefined {\n  const memoryMaxBytes = policy?.memoryMaxBytes ?? null;\n  const memoryHighBytes = policy?.memoryHighBytes ?? null;\n  const cpuMaxMillicores = policy?.cpuMaxMillicores ?? null;\n  for (const [name, value] of [\n    [\"memoryMaxBytes\", memoryMaxBytes],\n    [\"memoryHighBytes\", memoryHighBytes],\n  ] as const) {\n    if (value !== null && (!Number.isSafeInteger(value) || value <= 0)) {\n      throw new Error(`${name} must be a positive safe-integer byte count or null`);\n    }\n  }\n  if (memoryMaxBytes !== null && memoryHighBytes !== null && memoryHighBytes > memoryMaxBytes) {\n    throw new Error(\"memoryHighBytes cannot exceed memoryMaxBytes\");\n  }\n  if (\n    cpuMaxMillicores !== null &&\n    (!Number.isInteger(cpuMaxMillicores) || cpuMaxMillicores <= 0 || cpuMaxMillicores > 0xffff_ffff)\n  ) {\n    throw new Error(\"cpuMaxMillicores must be a positive uint32 value or null\");\n  }\n  if (memoryMaxBytes === null && memoryHighBytes === null && cpuMaxMillicores === null) {\n    return undefined;\n  }\n  return {\n    ...(memoryMaxBytes !== null ? { memoryMaxBytes: String(memoryMaxBytes) } : {}),\n    ...(memoryHighBytes !== null ? { memoryHighBytes: String(memoryHighBytes) } : {}),\n    ...(cpuMaxMillicores !== null ? { cpuMaxMillicores } : {}),\n  };\n}\n\n/** The relay-URL shape config the session needs to build a stream endpoint. M8b\n *  wires the real relay deployment behind THIS seam so `buildStreamUrl` works\n *  unchanged behind `resolveExposedPort`. */\nexport interface SelfhostedRelayConfig {\n  /** The relay edge host (no scheme), e.g. \"relay.opengeni.ai\". */\n  host: string;\n  /** The relay port. Defaults to 443 (the relay terminates TLS). */\n  port?: number;\n  /** Whether the relay endpoint is TLS (wss/https). Defaults true. */\n  tls?: boolean;\n  /** The relay's stream-dial path (the `opengeni-relay` wss route). Defaults to\n   *  \"/stream\" — the route the relay listens on (M8b). */\n  path?: string;\n}\n\n/** The relay's default wss dial path (the `opengeni-relay` server route). */\nexport const SELFHOSTED_RELAY_STREAM_PATH = \"/stream\";\n\n/**\n * The op-stream injection (op-stream protocol v1.1 — see op-stream.ts). PRESENT\n * = the streaming exec transport is enabled for this session (the worker\n * injects it only when the runner advertised `Capabilities.op_stream` AND the\n * server flag is on — the leaf carries no flag logic). ABSENT = the legacy\n * monolithic exec, byte-identical to before. The timing knobs exist for tests.\n */\nexport interface SelfhostedOpStreamDeps {\n  transport: OpStreamTransport;\n  /** The durable-resume journal (attach generation + settled-frontier persist).\n   *  Absent (tests, non-activity callers) ⇒ generation \"1\", no persistence. */\n  journal?: OpStreamJournal;\n  windowBytes?: number;\n  ackIntervalMs?: number;\n  silenceTimeoutMs?: number;\n  reconnectHoldMs?: number;\n}\n\nexport interface SelfhostedOperationResourcePolicy {\n  memoryMaxBytes?: number | null;\n  memoryHighBytes?: number | null;\n  cpuMaxMillicores?: number | null;\n}\n\nexport interface SelfhostedBackgroundCommandAdoption {\n  controlWorkspaceId: string;\n  enrollmentId: string;\n  connectionInstanceId: string;\n  opId: string;\n  command: string;\n  /** The exec already failed because the machine stopped answering. Record it\n   * with a stop request instead of as a running background command. */\n  abandoned?: boolean;\n}\n\n/** Exact command-admission snapshot. A worker resolves this immediately before\n * every exec/Git admission; retries and already-started operations retain it. */\nexport interface SelfhostedOperationAdmission {\n  transactionalFsWriteSupported?: boolean;\n  /** The live runner serves in-process browser/computer controller requests. */\n  browserControlHttpSupported?: boolean;\n  /** Workspace segment of the physical agent/relay route. Personal machines may\n   * originate in a different same-organization workspace than the session. */\n  workspaceId?: string;\n  connectionInstanceId: string;\n  /** Effective absolute workspace root for this exact live connection and\n   * session configuration. A reconnect that changes it cannot continue inside\n   * the current turn attempt. */\n  workspaceRoot: string;\n  opStream?: SelfhostedOpStreamDeps;\n  operationResourcePolicy: {\n    memoryMaxBytes: number | null;\n    memoryHighBytes: number | null;\n    cpuMaxMillicores: number | null;\n    /** Optimistic-control revision identifies the coherent admission truth; it\n     * is not itself an enforcement setting. */\n    revision: number;\n  };\n  operationResourcePolicySupported: boolean;\n  operationCpuQuotaSupported: boolean;\n}\n\nexport interface SelfhostedSessionDeps {\n  /** Exact live daemon capability; absent preserves legacy small-file writes. */\n  transactionalFsWriteSupported?: boolean;\n  /** Exact live daemon capability; absent keeps controller requests on the\n   * command transport. */\n  browserControlHttpSupported?: boolean;\n  /** Authorization/session workspace. */\n  workspaceId: string;\n  /** Physical control-plane workspace. Defaults to workspaceId for legacy and\n   * workspace-owned routes. */\n  controlWorkspaceId?: string;\n  agentId: string;\n  /** Exact live daemon process claimed for this enrollment. */\n  connectionInstanceId: string;\n  controlRpc: ControlRpc;\n  relay: SelfhostedRelayConfig;\n  /** Effective absolute host-native workspace root. This is the persisted Hello\n   * root, optionally resolved with the session's configured relative cwd. */\n  workspaceRoot: string;\n  /** Stable identity for the session's interactive terminal. Repeated stream\n   *  capability mints carrying this value reattach the existing PTY/channel\n   *  instead of spawning a replacement shell. Omitted preserves explicit\n   *  create-new semantics for non-viewer callers. */\n  terminalScopeId?: string;\n  /** Op-stream exec transport (present = enabled; see SelfhostedOpStreamDeps). */\n  opStream?: SelfhostedOpStreamDeps;\n  /** The lease/active epoch this session is fenced under (echoed on every\n   *  ControlRequest so the agent can reject a stale op with ERROR_CODE_FENCED).\n   *  Defaults to 0 (no fence) for the negotiation-only / test path. */\n  epoch?: number;\n  /** The CONTROL-op timeout (ping/fs/desktop/pty and op-stream control RPCs). The\n   *  agent's own control liveness must stay responsive, so this is short (the 30s\n   *  default). Override for tests or per-deployment tuning. */\n  timeoutMs?: number;\n  /**\n   * The EXEC process deadline — distinct from `timeoutMs`. A real command\n   * (compile, test run, install) routinely outlives the short control timeout, so\n   * a positive value asks the agent to kill the child at that wall; 0 means no\n   * duration deadline over op-stream. Omitted preserves the `timeoutMs` value\n   * fallback for older embedding callers; production settings always thread this\n   * field explicitly.\n   */\n  execTimeoutMs?: number;\n  /** Optional per-connection command memory policy. Missing/null values are\n   * unrestricted. The runner's local and ancestor policy may only tighten it. */\n  operationResourcePolicy?: SelfhostedOperationResourcePolicy;\n  /** Exact live Hello capability paired with this connection snapshot. */\n  operationResourcePolicySupported?: boolean;\n  /** Exact live CPU enforcement capability paired with the same snapshot. */\n  operationCpuQuotaSupported?: boolean;\n  /** Re-read immediately before every provider operation. It must return\n   * connection identity, effective workspace root, policy revision,\n   * capabilities, op-stream state, and any caller-owned live authority from one\n   * authoritative snapshot. */\n  resolveOperationAdmission?: () => Promise<SelfhostedOperationAdmission | null>;\n  /** Durable session ownership transfer for model-facing exec that outlives its\n   * bounded wait. Omitted for one-off/Channel-A callers, which remain terminal. */\n  adoptBackgroundCommand?: (\n    input: SelfhostedBackgroundCommandAdoption,\n  ) => Promise<{ commandId: string }>;\n  captureBackgroundCommandOutput?: (\n    commandId: string,\n    frames: OpStreamOutputFrame[],\n  ) => Promise<void>;\n  /** Best-effort fast settlement for the race where an adopted op exits while\n   * the adoption transaction is committing. The reconciler remains authority. */\n  settleBackgroundCommand?: (input: {\n    commandId: string;\n    controlWorkspaceId: string;\n    enrollmentId: string;\n    connectionInstanceId: string;\n    opId: string;\n    outcome: \"exited\" | \"lost\";\n    exitCode: number | null;\n    reason: string;\n    failure?: import(\"@opengeni/contracts\").SessionCommandFailure;\n    outputReceipt?: OpStreamOutputReceipt;\n  }) => void | Promise<void>;\n  /** The clock the bounded control-op retry loop drives (sleep + jitter). Injected\n   *  so tests are deterministic; defaults to a real timer + `Math.random()`. */\n  retryClock?: SelfhostedRetryClock;\n  /** A fire-and-forget observer invoked once per completed control op (out-of-band\n   *  telemetry — metrics + `machine.*` events). The worker/api wire it to the sinks;\n   *  the leaf only invokes it (guarded so it can never break an op). Omitted ⇒ no-op. */\n  onOp?: SelfhostedOpObserver;\n  /**\n   * The run's declared sandbox environment — the SAME `Record<string,string>` the\n   * worker turn passes to `runtime.buildAgent`'s `sandboxEnvironment` (and that the\n   * agent's TARGET manifest, `buildManifest`, carries). The SDK injects this\n   * selfhosted session NON-OWNED and applies the agent's manifest as a provided-\n   * session delta; `validateNoEnvironmentDelta` throws \"Live sandbox sessions cannot\n   * change manifest environment variables\" on ANY env mismatch. So `state.manifest`'s\n   * `environment` MUST EQUAL the turn's environment for the delta to be empty. The\n   * selfhosted exec routes over NATS and does NOT consume this env (the machine\n   * owns its own shell and credentials). The manifest carries the full env only\n   * for provided-session parity. Omitted → `{}` (the negotiation-only\n   * / test path, which never applies a turn manifest, so there is no delta).\n   */\n  environment?: Record<string, string>;\n  /**\n   * Attempt-local values projected onto each newly launched child process.\n   * They are deliberately absent from `state`, the manifest, serialized session\n   * envelopes, argv, and the machine filesystem. The callback is reread for\n   * every exec so worker-side bearer renewal is visible without reconnecting.\n   */\n  transientExecEnvironment?: () => Readonly<Record<string, string>>;\n}\n\n/** A live reconnect changed the effective host root after this session was\n * bound. No filesystem operation is dispatched under stale path authority. */\nexport class SelfhostedWorkspaceRootChangedError extends Error {\n  readonly name = \"SelfhostedWorkspaceRootChangedError\";\n  readonly retryable = true;\n\n  constructor(\n    public readonly expectedWorkspaceRoot: string,\n    public readonly actualWorkspaceRoot: string,\n  ) {\n    super(\n      `Connected Machine workspace root changed from \"${expectedWorkspaceRoot}\" to \"${actualWorkspaceRoot}\"; continue in a fresh turn attempt`,\n    );\n  }\n}\n\n/** The Channel-A `exec` result shape (a structural superset of the SDK's). */\nexport interface SelfhostedExecResult {\n  output: string;\n  stdout: string;\n  stderr: string;\n  exitCode: number | null;\n  /** True when the agent killed the child at the exec deadline. Additive to the\n   *  Channel-A superset (consumers that don't read it are unaffected); `exec()`\n   *  places the deadline hint on stderr so Channel-A stdout stays byte-exact. */\n  timedOut?: boolean;\n  /** Present only for a model-facing command durably transferred to its session. */\n  backgroundCommandId?: string;\n  backgroundOpId?: string;\n}\n\n/** The `exec` args the structural surface accepts (mirrors ChannelAExecArgs). */\nexport interface SelfhostedExecArgs {\n  cmd: string;\n  workdir?: string | undefined;\n  shell?: string | undefined;\n  login?: boolean | undefined;\n  tty?: boolean | undefined;\n  yieldTimeMs?: number | undefined;\n  maxOutputTokens?: number | undefined;\n  runAs?: string | undefined;\n}\n\n/**\n * The persistable session state. For selfhosted this is `{agentId}` ONLY — there\n * is NO provider box id, no snapshot, no manifest. Resume re-addresses the live\n * subject; the machine itself is the persistence (`persistable:false`).\n */\nexport interface SelfhostedSessionState {\n  agentId: string;\n}\n\n/**\n * A live selfhosted session — the structural `SandboxSessionLike` surface over a\n * `ControlRpc`. Mirrors Modal's session shape so Channel-A and viewer surfaces\n * consume it unchanged.\n */\nexport class SelfhostedSession {\n  readonly backendId = \"selfhosted\" as const;\n  readonly workspaceId: string;\n  readonly controlWorkspaceId: string;\n  readonly agentId: string;\n  private readonly controlRpc: ControlRpc;\n  /** Attempt scopes this session wrote `{{secretfile:…}}` files under. */\n  private readonly secretScopes = new Set<string>();\n  private readonly relay: SelfhostedRelayConfig;\n  private readonly terminalScopeId: string;\n  private readonly epoch: number;\n  private readonly timeoutMs: number;\n  /** The exec process deadline (0 = none; omission is legacy embedding behavior). */\n  private readonly execTimeoutMs: number | undefined;\n  private readonly retryClock: SelfhostedRetryClock;\n  private readonly onOp: SelfhostedOpObserver | undefined;\n  private readonly subject: string;\n  /** Command clients are admission-snapshot-bound. Keep them through the turn-end\n   * durability hook; never retarget an already-admitted operation on reconnect. */\n  private readonly opStreamClients = new Map<string, OpStreamExecClient>();\n  private readonly inFlightOpStreamClients = new Map<string, OpStreamExecClient>();\n  private readonly inFlightOpStreamOutput = new Map<\n    string,\n    { stdout: string[]; stderr: string[]; completed?: RemoteOperationObservation }\n  >();\n  private readonly ownedCommandReaders = new Map<string, () => Promise<void>>();\n  private readonly commandRefreshes = new Map<string, Promise<void>>();\n\n  /** Attach only to operations adopted by this exact live session. Output and\n   * terminal settlement are durable control work, never model observation. */\n  async refreshOwnedCommand(commandId: string): Promise<boolean> {\n    const read = this.ownedCommandReaders.get(commandId);\n    if (!read) return false;\n    let pending = this.commandRefreshes.get(commandId);\n    if (!pending) {\n      pending = read();\n      this.commandRefreshes.set(commandId, pending);\n    }\n    try {\n      await pending;\n    } finally {\n      if (this.commandRefreshes.get(commandId) === pending) this.commandRefreshes.delete(commandId);\n    }\n    return true;\n  }\n  private readonly defaultOpStreamClient: OpStreamExecClient | undefined;\n  /** Exact host-native root bound for this session/attempt. */\n  readonly workspaceRoot: string;\n  private readonly transientExecEnvironment: (() => Readonly<Record<string, string>>) | undefined;\n  private readonly resourcePolicy: OperationResourcePolicy | undefined;\n  private readonly resourcePolicySupported: boolean;\n  private readonly operationCpuQuotaSupported: boolean;\n  private readonly transactionalFsWriteSupported: boolean;\n  private readonly browserControlHttpSupported: boolean;\n  private readonly defaultOpStream: SelfhostedOpStreamDeps | undefined;\n  private readonly connectionInstanceId: string;\n  private readonly resolveOperationAdmission:\n    | (() => Promise<SelfhostedOperationAdmission | null>)\n    | undefined;\n  private readonly adoptBackgroundCommand:\n    | SelfhostedSessionDeps[\"adoptBackgroundCommand\"]\n    | undefined;\n  private readonly settleBackgroundCommand:\n    | SelfhostedSessionDeps[\"settleBackgroundCommand\"]\n    | undefined;\n  private readonly captureBackgroundCommandOutput: SelfhostedSessionDeps[\"captureBackgroundCommandOutput\"];\n\n  /**\n   * The structural `state` slice consumers read. `agentId`/`instanceId` serve the\n   * channel-a `readInstanceId` + docker-network decoration (the agentId IS the\n   * identity). `manifest` is the slice the @openai/agents SDK reads AND writes per\n   * turn (serializeManifestEnvironment / validateProvidedSessionManifestUpdate read\n   * `manifest.root` + iterate `manifest.environment`; providedSessionManifest WRITES\n   * `state.manifest = next`). It must be a real, MUTABLE Manifest field — when the\n   * RoutingSandboxSession proxy resolves THIS as the active backend it returns\n   * `session.state` BY REFERENCE, so the SDK's read and write must both land on a\n   * well-formed Manifest here (defined `root`, object `environment`). Without it the\n   * SDK crashes with `undefined is not an object (evaluating 'current.root')`.\n   *\n   * `manifest` is intentionally a plain mutable field (not `readonly`) so the SDK's\n   * `state.manifest = next` write succeeds. It is NOT part of the persistable state\n   * (`serializeSessionState` round-trips `{agentId}` only).\n   *\n   * `environment` is the SDK `SandboxSessionState.environment` (a `Record<string,\n   * string>`). It MUST be present because the GROUP box's client serializes THIS\n   * (the active backend's) state at end-of-turn — the non-owned injected session is\n   * serialized via the CONFIGURED client (modal in prod), NOT the selfhosted client.\n   * Modal's `serializeRemoteSandboxSessionState` does `Object.entries(state.environment)`;\n   * an absent field crashes the post-turn RunState serialize with \"Object.entries\n   * requires that input parameter not be null or undefined\". It carries the run's\n   * threaded environment (or `{}`). The resulting modal-tagged envelope is inert for\n   * selfhosted (resume re-addresses the machine by agentId via the lease pointer,\n   * never from this SDK envelope), so its only job is to not crash the serialize.\n   */\n  readonly state: {\n    agentId: string;\n    instanceId: string;\n    manifest: Manifest;\n    environment: Record<string, string>;\n  };\n\n  constructor(deps: SelfhostedSessionDeps) {\n    if (typeof deps.workspaceRoot !== \"string\" || deps.workspaceRoot.length === 0) {\n      throw new TypeError(\"Connected Machine workspaceRoot is required\");\n    }\n    const workspaceRoot = resolveConnectedMachinePath(deps.workspaceRoot, undefined);\n    if (workspaceRoot !== deps.workspaceRoot) {\n      throw new TypeError(\"Connected Machine workspaceRoot must be a normalized absolute path\");\n    }\n    this.workspaceId = deps.workspaceId;\n    this.controlWorkspaceId = deps.controlWorkspaceId ?? deps.workspaceId;\n    this.agentId = deps.agentId;\n    this.controlRpc = deps.controlRpc;\n    this.relay = deps.relay;\n    this.terminalScopeId = deps.terminalScopeId ?? \"\";\n    this.epoch = deps.epoch ?? 0;\n    this.timeoutMs = deps.timeoutMs ?? SELFHOSTED_DEFAULT_TIMEOUT_MS;\n    this.execTimeoutMs = deps.execTimeoutMs;\n    this.retryClock = deps.retryClock ?? defaultSelfhostedRetryClock;\n    this.onOp = deps.onOp;\n    this.subject = subjectFor(this.controlWorkspaceId, deps.agentId, deps.connectionInstanceId);\n    this.workspaceRoot = workspaceRoot;\n    this.transientExecEnvironment = deps.transientExecEnvironment;\n    this.resourcePolicy = normalizeOperationResourcePolicy(deps.operationResourcePolicy);\n    this.resourcePolicySupported = deps.operationResourcePolicySupported === true;\n    this.operationCpuQuotaSupported = deps.operationCpuQuotaSupported === true;\n    this.transactionalFsWriteSupported = deps.transactionalFsWriteSupported === true;\n    this.browserControlHttpSupported = deps.browserControlHttpSupported === true;\n    this.defaultOpStream = deps.opStream;\n    this.connectionInstanceId = deps.connectionInstanceId;\n    this.resolveOperationAdmission = deps.resolveOperationAdmission;\n    this.adoptBackgroundCommand = deps.adoptBackgroundCommand;\n    this.settleBackgroundCommand = deps.settleBackgroundCommand;\n    this.captureBackgroundCommandOutput = deps.captureBackgroundCommandOutput;\n    // A pre-admission tombstone is safe only for a static connection. Dynamic\n    // sessions must never route an unknown op id through their constructor's\n    // potentially stale connection after a reconnect.\n    this.defaultOpStreamClient =\n      deps.opStream && !deps.resolveOperationAdmission\n        ? this.opStreamClientFor({\n            controlWorkspaceId: this.controlWorkspaceId,\n            connectionInstanceId: deps.connectionInstanceId,\n            subject: this.subject,\n            resourcePolicy: this.resourcePolicy,\n            opStream: deps.opStream,\n            transactionalFsWriteSupported: this.transactionalFsWriteSupported,\n            browserControlHttpSupported: this.browserControlHttpSupported,\n          })\n        : undefined;\n    // A valid Manifest whose root is the machine's actual effective root. There\n    // is no virtual /workspace alias and no path translation layer. `environment`\n    // is the run's declared\n    // sandbox environment — the SAME object the worker turn threads into the agent's\n    // TARGET manifest — so the SDK's per-turn provided-session delta\n    // (validateNoEnvironmentDelta) finds NO mismatch. `entries: {}` because the\n    // selfhosted machine already owns its filesystem (no SDK materialization; exec\n    // routes over NATS). Omitted env (the negotiation-only / test path) defaults to\n    // `{}` — no turn manifest is applied there, so there is no delta to validate.\n    this.state = {\n      agentId: deps.agentId,\n      instanceId: deps.agentId,\n      manifest: new Manifest({\n        root: deps.workspaceRoot,\n        entries: {},\n        environment: deps.environment ?? {},\n      }),\n      // The SDK `SandboxSessionState.environment` — the run's threaded env (or `{}`).\n      // The group client's end-of-turn serialize reads `state.environment` directly\n      // (Object.entries), so it must be a defined object, not absent.\n      environment: deps.environment ?? {},\n    };\n  }\n\n  /** Invoke the injected per-op observer, guarded: a telemetry tap must NEVER break\n   *  an op (a throwing sink is swallowed). No-op when no observer is wired. */\n  private emitOp(observation: SelfhostedOpObservation): void {\n    if (!this.onOp) {\n      return;\n    }\n    try {\n      this.onOp(observation);\n    } catch {\n      // A telemetry sink must never surface into the op path.\n    }\n  }\n\n  private assertResourcePolicySupported(\n    policy: OperationResourcePolicy | undefined,\n    memorySupported: boolean,\n    cpuSupported: boolean,\n  ): void {\n    const memoryConfigured =\n      policy?.memoryMaxBytes !== undefined || policy?.memoryHighBytes !== undefined;\n    if (memoryConfigured && !memorySupported) {\n      throw new SelfhostedControlError({\n        message:\n          \"This Connected Machine has an operation memory policy, but its current runner, OS, or service configuration cannot enforce it. Update or reconfigure the installation, or clear the memory policy before executing commands.\",\n        code: ErrorCode.ERROR_CODE_UNSUPPORTED,\n        reason: null,\n        retryable: false,\n      });\n    }\n    if (policy?.cpuMaxMillicores !== undefined && (!memorySupported || !cpuSupported)) {\n      throw new SelfhostedControlError({\n        message:\n          \"This Connected Machine has an operation CPU policy, but its current runner, OS, or service configuration cannot enforce CPU quotas. Update or reconfigure the installation, or clear the CPU policy before executing commands.\",\n        code: ErrorCode.ERROR_CODE_UNSUPPORTED,\n        reason: null,\n        retryable: false,\n      });\n    }\n  }\n\n  private async admitOperation(commandPolicy: boolean): Promise<{\n    transactionalFsWriteSupported: boolean;\n    browserControlHttpSupported: boolean;\n    controlWorkspaceId: string;\n    connectionInstanceId: string;\n    subject: string;\n    resourcePolicy: OperationResourcePolicy | undefined;\n    opStream: SelfhostedOpStreamDeps | undefined;\n  }> {\n    if (!this.resolveOperationAdmission) {\n      if (commandPolicy) {\n        this.assertResourcePolicySupported(\n          this.resourcePolicy,\n          this.resourcePolicySupported,\n          this.operationCpuQuotaSupported,\n        );\n      }\n      return {\n        controlWorkspaceId: this.controlWorkspaceId,\n        connectionInstanceId: this.connectionInstanceId,\n        subject: this.subject,\n        resourcePolicy: commandPolicy ? this.resourcePolicy : undefined,\n        opStream: this.defaultOpStream,\n        transactionalFsWriteSupported: this.transactionalFsWriteSupported,\n        browserControlHttpSupported: this.browserControlHttpSupported,\n      };\n    }\n\n    const resolved = await this.resolveOperationAdmission();\n    if (!resolved) {\n      throw new SelfhostedControlError({\n        message: \"The Connected Machine has no authoritative live runner connection.\",\n        code: ErrorCode.ERROR_CODE_AGENT_OFFLINE,\n        reason: \"agent_offline\",\n        retryable: false,\n        agentOffline: true,\n      });\n    }\n    if (!connectedMachineWorkspaceRootsEqual(resolved.workspaceRoot, this.workspaceRoot)) {\n      throw new SelfhostedWorkspaceRootChangedError(this.workspaceRoot, resolved.workspaceRoot);\n    }\n    const resourcePolicy = normalizeOperationResourcePolicy(resolved.operationResourcePolicy);\n    if (commandPolicy) {\n      this.assertResourcePolicySupported(\n        resourcePolicy,\n        resolved.operationResourcePolicySupported,\n        resolved.operationCpuQuotaSupported,\n      );\n    }\n    return {\n      controlWorkspaceId: resolved.workspaceId ?? this.controlWorkspaceId,\n      connectionInstanceId: resolved.connectionInstanceId,\n      subject: subjectFor(\n        resolved.workspaceId ?? this.controlWorkspaceId,\n        this.agentId,\n        resolved.connectionInstanceId,\n      ),\n      resourcePolicy: commandPolicy ? resourcePolicy : undefined,\n      opStream: resolved.opStream,\n      transactionalFsWriteSupported: resolved.transactionalFsWriteSupported === true,\n      browserControlHttpSupported: resolved.browserControlHttpSupported === true,\n    };\n  }\n\n  private async admitCommand(): Promise<Awaited<ReturnType<SelfhostedSession[\"admitOperation\"]>>> {\n    return await this.admitOperation(true);\n  }\n\n  /** A proven-unstarted op-stream retry may reuse its stable op id, but it must\n   * not reuse mutable authorization or silently retarget the command. Require a\n   * fresh admission for the exact same physical route and effective policy;\n   * callers can start a later operation against a newly resolved route. */\n  private async revalidateCommandAdmission(\n    expected: Awaited<ReturnType<SelfhostedSession[\"admitCommand\"]>>,\n  ): Promise<void> {\n    const current = await this.admitCommand();\n    const samePolicy =\n      current.resourcePolicy?.memoryMaxBytes === expected.resourcePolicy?.memoryMaxBytes &&\n      current.resourcePolicy?.memoryHighBytes === expected.resourcePolicy?.memoryHighBytes &&\n      current.resourcePolicy?.cpuMaxMillicores === expected.resourcePolicy?.cpuMaxMillicores;\n    if (\n      current.subject !== expected.subject ||\n      current.connectionInstanceId !== expected.connectionInstanceId ||\n      Boolean(current.opStream) !== Boolean(expected.opStream) ||\n      !samePolicy\n    ) {\n      throw new SelfhostedControlError({\n        message: \"The Connected Machine route or operation policy changed before dispatch.\",\n        code: ErrorCode.ERROR_CODE_FENCED,\n        reason: null,\n        retryable: true,\n        fenced: true,\n      });\n    }\n  }\n\n  private opStreamClientFor(\n    admission: Awaited<ReturnType<SelfhostedSession[\"admitCommand\"]>>,\n  ): OpStreamExecClient | undefined {\n    const stream = admission.opStream;\n    if (!stream) return undefined;\n    const key = JSON.stringify([\n      admission.controlWorkspaceId,\n      admission.connectionInstanceId,\n      admission.resourcePolicy?.memoryMaxBytes ?? null,\n      admission.resourcePolicy?.memoryHighBytes ?? null,\n      admission.resourcePolicy?.cpuMaxMillicores ?? null,\n    ]);\n    const existing = this.opStreamClients.get(key);\n    if (existing) return existing;\n    const client = new OpStreamExecClient({\n      workspaceId: admission.controlWorkspaceId,\n      agentId: this.agentId,\n      connectionInstanceId: admission.connectionInstanceId,\n      epoch: this.epoch,\n      controlRpc: this.controlRpc,\n      rpcSubject: admission.subject,\n      transport: stream.transport,\n      controlTimeoutMs: this.timeoutMs,\n      retryClock: this.retryClock,\n      ...(admission.resourcePolicy !== undefined\n        ? { resourcePolicy: admission.resourcePolicy }\n        : {}),\n      ...(this.resolveOperationAdmission !== undefined\n        ? {\n            revalidateBeforeStartRetry: async () =>\n              await this.revalidateCommandAdmission(admission),\n          }\n        : {}),\n      ...(stream.journal !== undefined ? { journal: stream.journal } : {}),\n      ...(stream.windowBytes !== undefined ? { windowBytes: stream.windowBytes } : {}),\n      ...(stream.ackIntervalMs !== undefined ? { ackIntervalMs: stream.ackIntervalMs } : {}),\n      ...(stream.silenceTimeoutMs !== undefined\n        ? { silenceTimeoutMs: stream.silenceTimeoutMs }\n        : {}),\n      ...(stream.reconnectHoldMs !== undefined ? { reconnectHoldMs: stream.reconnectHoldMs } : {}),\n    });\n    this.opStreamClients.set(key, client);\n    return client;\n  }\n\n  /**\n   * Issue a control op, decoding the agent's reply or throwing the mapped\n   * `SelfhostedControlError` on an AgentError (incl. a synthesized offline /\n   * timeout error from the transport).\n   *\n   * Two failure modes are retried in-place (the decision is the pure\n   * `decideSelfhostedRetry` policy):\n   *   - DRAINING — a pre-admission host-work backpressure rejection; the op never\n   *     started, so it is safe to re-issue for ANY op kind (bounded).\n   *   - a TIMEOUT / `agent_reconnecting` blip — re-issued ONCE, and ONLY for a\n   *     read-only idempotent-safe op. A timed-out MUTATION is NEVER re-issued: it\n   *     may already have executed on the machine (at-least-once), which would\n   *     duplicate the write/command. FENCED is intentionally NOT retried here — the\n   *     routing proxy retries it against a re-resolved backend under a fresh epoch.\n   * Each attempt carries a FRESH `requestId` (a retry is a distinct request).\n   */\n  private async call(\n    op: NonNullable<ControlRequest[\"op\"]>,\n    timeoutMs = this.timeoutMs,\n    admittedCommand?: Awaited<ReturnType<SelfhostedSession[\"admitCommand\"]>>,\n  ): Promise<NonNullable<ControlResponse[\"result\"]>> {\n    const opKind = op.$case;\n    // This is the last shared boundary before every request/reply provider\n    // operation. Even a cached routed or pinned session must re-resolve its live\n    // authority here; an already-admitted Git operation threads its exact\n    // snapshot. Exec uses the op-stream client and never enters this helper.\n    const commandOperation = opKind === \"git\";\n    let operationAdmission = admittedCommand ?? (await this.admitOperation(commandOperation));\n    const startedAt = Date.now();\n    let drainingRetries = 0;\n    let timeoutRetries = 0;\n    let neverSentRetries = 0;\n    for (;;) {\n      const commandAdmission = opKind === \"git\" ? operationAdmission : undefined;\n      const resourcePolicy = commandAdmission?.resourcePolicy;\n      const req: ControlRequest = {\n        requestId: crypto.randomUUID(),\n        epoch: this.epoch,\n        resourcePolicy,\n        op,\n      };\n      const res = await this.controlRpc.request(operationAdmission.subject, req, {\n        timeoutMs,\n      });\n      if (!res.error && res.result) {\n        const retries = drainingRetries + timeoutRetries + neverSentRetries;\n        this.emitOp({\n          op: opKind,\n          outcome: \"ok\",\n          healed: retries > 0,\n          retries,\n          durationMs: Date.now() - startedAt,\n          machineId: this.agentId,\n          // A healed op's class is whichever retry budget it recovered from.\n          ...(retries > 0\n            ? {\n                faultClass:\n                  neverSentRetries > 0\n                    ? \"offline\"\n                    : drainingRetries > 0\n                      ? \"draining\"\n                      : \"reconnecting\",\n              }\n            : {}),\n        });\n        return res.result;\n      }\n      const error = res.error\n        ? agentErrorToControlError(res.error, req.requestId)\n        : agentErrorToControlError(\n            {\n              code: 7, // ERROR_CODE_PROTOCOL — an empty result is a protocol violation\n              message: \"agent returned an empty control response\",\n              retryable: false,\n              detail: {},\n            },\n            req.requestId,\n          );\n      const decision = decideSelfhostedRetry({\n        opKind,\n        error,\n        drainingRetries,\n        timeoutRetries,\n        neverSentRetries,\n        jitter: this.retryClock.jitter(),\n      });\n      if (decision.action === \"fail\") {\n        const retries = drainingRetries + timeoutRetries + neverSentRetries;\n        const encoded = Number(error.detail.encoded_bytes);\n        this.emitOp({\n          op: opKind,\n          outcome: \"failed\",\n          healed: false,\n          retries,\n          durationMs: Date.now() - startedAt,\n          code: error.code,\n          reason: error.reason,\n          neverSent: error.neverSent,\n          machineId: this.agentId,\n          faultClass: selfhostedFaultClass(error),\n          // Known only on a PAYLOAD_TOO_LARGE fault (the agent's encoded_bytes detail).\n          ...(Number.isFinite(encoded) && error.detail.direction !== \"request\"\n            ? { replyBytes: encoded }\n            : {}),\n        });\n        // Fold the retry count into the DRAINING copy when we actually retried, so\n        // the surfaced message reads \"…retried N times first…\".\n        if (error.draining && drainingRetries > 0) {\n          throw drainingExhaustedError(error, drainingRetries);\n        }\n        throw error;\n      }\n      await this.retryClock.sleep(decision.delayMs);\n      // Every physical retry is a new provider dispatch. The retry policy has\n      // already proven it safe (never-sent/draining, or read-only timeout), so\n      // revalidate live authority without ever replaying an ambiguous mutation.\n      operationAdmission = await this.admitOperation(commandOperation);\n      // Advance the counter for the class that was retried (separate budgets).\n      if (error.neverSent) {\n        neverSentRetries += 1;\n      } else if (error.draining) {\n        drainingRetries += 1;\n      } else {\n        timeoutRetries += 1;\n      }\n    }\n  }\n\n  /** The effective clamped exec process deadline (ms). 0 means no process\n   *  deadline; positive configured values are clamped to the wire-safe range.\n   *  Public so adapters that project a\n   *  structured command receipt can report the exact deadline the agent enforces\n   *  instead of repeating (and potentially drifting from) this normalization. */\n  get effectiveExecDeadlineMs(): number {\n    // Production always threads the setting explicitly (default 0). Preserve the\n    // short control timeout only for structural/test callers that omit the newer\n    // exec field entirely, so those callers remain safely bounded.\n    const configured = Math.trunc(this.execTimeoutMs ?? this.timeoutMs);\n    if (configured <= 0) return 0;\n    return Math.min(configured, SELFHOSTED_MAX_EXEC_TIMEOUT_MS);\n  }\n\n  /** Host OS family, from the Hello workspace root (drive letter / UNC => Windows). */\n  private hostOs(): \"linux\" | \"windows\" | \"unknown\" {\n    const root = this.workspaceRoot;\n    if (/^[A-Za-z]:[\\\\/]/.test(root) || root.startsWith(\"\\\\\\\\\")) return \"windows\";\n    if (root.startsWith(\"/\")) return \"linux\";\n    return \"unknown\";\n  }\n\n  /** The splice dialect a command run through `shell` (or the default) uses here. */\n  describeShellDialect(shell?: string): ShellDialect {\n    return shellDialectFor(shell?.trim() || null, this.hostOs());\n  }\n\n  /** Host family for the browser/computer controller transport. */\n  controllerHostOs(): \"posix\" | \"windows\" {\n    return this.hostOs() === \"windows\" ? \"windows\" : \"posix\";\n  }\n\n  private async prepareSecretExec(\n    args: SelfhostedExecArgs,\n    requestedShell: string | undefined,\n  ): Promise<{ command: string; shell: string; env: Record<string, string> } | null> {\n    const carry = secretExecCarryFor(args.cmd);\n    if (!carry) return null;\n    const dialect = carry.spliced ? \"posix\" : this.describeShellDialect(requestedShell);\n    const spliced = spliceCarry(carry, dialect);\n    const command = carry.spliced ? args.cmd : args.cmd.split(carry.command).join(spliced.text);\n    const env = await secretExecEnvironment(carry, spliced, async (file) => {\n      await this.writePlacementPrivate({ ...file, createParents: true });\n      this.secretScopes.add(carry.scope);\n    });\n    const shell = requestedShell || (dialect === \"powershell\" ? \"powershell\" : \"/bin/sh\");\n    return { command, shell, env };\n  }\n\n  /**\n   * Remove this attempt's secret files from the machine (attempt end). Uses the\n   * recursive filesystem control op, not a shell, so it works on any host OS\n   * and runs even when the consuming command never started.\n   */\n  async clearSecretFilesForAttempt(scope?: string): Promise<void> {\n    const scopes = scope === undefined ? [...this.secretScopes] : [scope];\n    for (const entry of scopes) {\n      const path = selfhostedPlacementPrivatePath(secretScopeDirectory(entry));\n      try {\n        const result = await this.call({\n          $case: \"fsRemove\",\n          fsRemove: { path, recursive: true },\n        });\n        if (result.$case !== \"fsRemove\") {\n          throw new Error(`selfhosted clearSecretFiles: unexpected result ${result.$case}`);\n        }\n      } catch (error) {\n        if (!(error instanceof SelfhostedControlError && error.osNotFound)) throw error;\n      }\n      this.secretScopes.delete(entry);\n    }\n  }\n\n  /** Channel-A `exec`: run a command on the machine and return its output. */\n  async exec(args: SelfhostedExecArgs): Promise<SelfhostedExecResult> {\n    return await this.execInternal(args, false);\n  }\n\n  /** Internal controller transport: stream private request bytes over the\n   * existing command channel, never through argv, environment or host files. */\n  async execWithInput(\n    args: SelfhostedExecArgs & { stdin: Uint8Array },\n  ): Promise<SelfhostedExecResult> {\n    if (args.stdin.byteLength > SELFHOSTED_PLACEMENT_PRIVATE_MAX_BYTES) {\n      throw new RangeError(\"controller command input is too large\");\n    }\n    return await this.execInternal(args, false, args.stdin.slice());\n  }\n\n  private async execInternal(\n    args: SelfhostedExecArgs,\n    allowBackground: boolean,\n    stdin: Uint8Array = new Uint8Array(0),\n  ): Promise<SelfhostedExecResult> {\n    // Mint once before local preflight so a proven refusal can settle exactly\n    // this command's turn registration, including SDK-rendered error paths.\n    const opId = nextDurableOpId() ?? `anon_${crypto.randomUUID()}`;\n    let admission: Awaited<ReturnType<SelfhostedSession[\"admitCommand\"]>>;\n    let execReq: ExecRequest;\n    let opStreamClient: OpStreamExecClient | undefined;\n    // 0 deliberately means no process deadline. That contract is safe only over\n    // op-stream: its liveness probes, replay, and cancellation do not depend on a\n    // request/reply timer or a monolithic response.\n    const executionTimeoutMs = this.effectiveExecDeadlineMs;\n    try {\n      // Admission is the only mutable-policy read. Everything below retains\n      // its exact connection/capability/policy snapshot through completion.\n      admission = await this.admitCommand();\n      const requestedShell = args.shell?.trim();\n      // Secret references (design §10.3, connected machines): splice in the\n      // machine's dialect and deliver the values natively in ExecRequest.env.\n      // With no explicit shell the command is forced through a known one\n      // (`/bin/sh -c` on POSIX, `powershell -NoProfile -NonInteractive\n      // -Command` on Windows) so the splice matches the parser. `args.cmd`\n      // (references) remains the command recorded for background adoption.\n      const secret = await this.prepareSecretExec(args, requestedShell);\n      const commandText = secret?.command ?? args.cmd;\n      const shell = secret?.shell ?? requestedShell;\n      execReq = {\n        // An explicit shell is encoded as direct argv so every agent version honors\n        // it. With no explicit shell, preserve the existing machine-owned default\n        // shell behavior byte-for-byte.\n        command: shell\n          ? explicitShellArgv(shell, commandText, secret ? false : args.login === true)\n          : [commandText],\n        shell: !shell,\n        // Relative paths resolve from the exact host root, while absolute paths\n        // retain their literal machine meaning. In particular, \"/workspace\" is\n        // sent as the real absolute path \"/workspace\".\n        cwd: resolveConnectedMachinePath(this.workspaceRoot, args.workdir),\n        // The machine owns its ambient shell environment and ordinary credentials.\n        // Only attempt-local values explicitly supplied by the worker cross here;\n        // snapshot now so a later renewal cannot mutate an in-flight request.\n        env: { ...(this.transientExecEnvironment?.() ?? {}), ...(secret?.env ?? {}) },\n        stdin,\n        timeoutMs: executionTimeoutMs,\n      };\n      opStreamClient = this.opStreamClientFor(admission);\n      if (!opStreamClient) throw execRequiresOpStream();\n    } catch (error) {\n      // This region has issued no command RPC and registered no live consumer.\n      // This local fact, not the error's code/shape, proves non-dispatch.\n      notifyRemoteOperationNotDispatched(opId);\n      throw error;\n    }\n    try {\n      return await this.execViaOpStream(\n        opStreamClient,\n        admission,\n        execReq,\n        executionTimeoutMs,\n        allowBackground\n          ? Math.min(\n              SELFHOSTED_BACKGROUND_MAX_YIELD_MS,\n              Math.max(1, Math.trunc(args.yieldTimeMs ?? SELFHOSTED_BACKGROUND_DEFAULT_YIELD_MS)),\n            )\n          : 0,\n        args.cmd,\n        opId,\n      );\n    } catch (error) {\n      if (error instanceof OpStreamUnavailableError) {\n        throw execRequiresOpStream(error);\n      }\n      throw error;\n    }\n  }\n\n  /**\n   * The op-stream exec path: the SAME `ExecRequest`, streamed (see\n   * op-stream.ts). The durable op id comes from the tool-call correlation\n   * context (`{callId}:{ordinal}` — B1) when this exec runs inside an SDK tool\n   * invocation; a non-tool caller falls back to a random unique id (never\n   * collides, merely not stable across a turn re-dispatch). Emits the standard\n   * per-op observation, with `replyBytes` filled from the reassembled stream\n   * (the field the framed transport was designed to own).\n   */\n  private async execViaOpStream(\n    client: OpStreamExecClient,\n    admission: Awaited<ReturnType<SelfhostedSession[\"admitCommand\"]>>,\n    execReq: ExecRequest,\n    executionTimeoutMs: number,\n    backgroundYieldMs: number,\n    command: string,\n    opId: string,\n  ): Promise<SelfhostedExecResult> {\n    const startedAt = Date.now();\n    let adoptedCommandId: string | null = null;\n    let ownershipTransferPending = false;\n    let terminalProof = false;\n    const retainedOutput: {\n      stdout: string[];\n      stderr: string[];\n      completed?: RemoteOperationObservation;\n    } = {\n      stdout: [],\n      stderr: [],\n    };\n    this.inFlightOpStreamClients.set(opId, client);\n    this.inFlightOpStreamOutput.set(opId, retainedOutput);\n    const remoteControl: RemoteOperationControl = {\n      cancelExecCommand: async (requestedOpId) => {\n        if (requestedOpId !== opId) return false;\n        await client.cancel(opId);\n        return true;\n      },\n      observeExecCommand: async (requestedOpId) => {\n        if (requestedOpId !== opId) {\n          throw new Error(\"Remote operation observer received a different operation id\");\n        }\n        return await this.observeExecCommandWithClient(opId, client, retainedOutput);\n      },\n    };\n    notifyRemoteOperationTransportSelected(remoteControl);\n    try {\n      const wallMs =\n        executionTimeoutMs > 0 ? executionTimeoutMs + SELFHOSTED_EXEC_REPLY_GRACE_MS : 0;\n      const result =\n        backgroundYieldMs > 0 && this.adoptBackgroundCommand\n          ? await client.execWithYield(opId, execReq, executionTimeoutMs, wallMs, {\n              yieldMs: backgroundYieldMs,\n              captureOutput: async (frames) => {\n                if (adoptedCommandId)\n                  await this.captureBackgroundCommandOutput?.(adoptedCommandId, frames);\n              },\n              onYield: async () => {\n                ownershipTransferPending = true;\n                notifyDurableOpOwnershipTransferStarted(opId);\n                const adopted = await this.adoptBackgroundCommand!({\n                  controlWorkspaceId: admission.controlWorkspaceId,\n                  enrollmentId: this.agentId,\n                  connectionInstanceId: admission.connectionInstanceId,\n                  opId,\n                  command,\n                });\n                adoptedCommandId = adopted.commandId;\n                this.ownedCommandReaders.set(adopted.commandId, async () => {\n                  const replay = await client.readExisting(opId, 250, async (frames) => {\n                    await this.captureBackgroundCommandOutput?.(adopted.commandId, frames);\n                  });\n                  const terminal = replay.status === \"completed\" ? replay : replay.terminal;\n                  const outputReceipt =\n                    replay.outputReceipt ??\n                    (replay.status === \"running\" ? replay.terminal?.outputReceipt : undefined);\n                  if (terminal) {\n                    await this.settleBackgroundCommand?.({\n                      commandId: adopted.commandId,\n                      controlWorkspaceId: admission.controlWorkspaceId,\n                      enrollmentId: this.agentId,\n                      connectionInstanceId: admission.connectionInstanceId,\n                      opId,\n                      outcome: \"exited\",\n                      ...(this.captureBackgroundCommandOutput && outputReceipt\n                        ? { outputReceipt }\n                        : {}),\n                      exitCode: terminal.outcome.response.exitCode,\n                      reason: terminal.outcome.failure\n                        ? `op_failure_${terminal.outcome.failure.failureCode.replace(/[^A-Za-z0-9_-]/g, \"_\").slice(0, 128)}`\n                        : \"op_exit\",\n                      ...(terminal.outcome.failure\n                        ? {\n                            failure: {\n                              code: terminal.outcome.failure.failureCode\n                                .replace(/[^A-Za-z0-9_-]/g, \"_\")\n                                .slice(0, 128),\n                              detail: terminal.outcome.failure.failureDetail,\n                              retryable: false as const,\n                            },\n                          }\n                        : {}),\n                    });\n                    this.ownedCommandReaders.delete(adopted.commandId);\n                    if (terminal.outcome.failure)\n                      throw runnerFailureToControlError(terminal.outcome.failure);\n                  }\n                });\n                ownershipTransferPending = false;\n                notifyDurableOpOwnershipTransferred(opId);\n              },\n            })\n          : {\n              status: \"completed\" as const,\n              outcome: await client.exec(opId, execReq, executionTimeoutMs, wallMs),\n            };\n      if (result.status === \"running\") {\n        terminalProof = result.terminal !== undefined;\n        if (result.terminal && adoptedCommandId) {\n          await Promise.resolve(\n            this.settleBackgroundCommand?.({\n              commandId: adoptedCommandId,\n              controlWorkspaceId: admission.controlWorkspaceId,\n              enrollmentId: this.agentId,\n              connectionInstanceId: admission.connectionInstanceId,\n              opId,\n              outcome: \"exited\",\n              ...(this.captureBackgroundCommandOutput && result.terminal.outputReceipt\n                ? { outputReceipt: result.terminal.outputReceipt }\n                : {}),\n              exitCode: result.terminal.outcome.response.exitCode,\n              reason: result.terminal.outcome.failure\n                ? `op_failure_${result.terminal.outcome.failure.failureCode.replace(/[^A-Za-z0-9_-]/g, \"_\").slice(0, 128)}`\n                : \"op_exit\",\n              ...(result.terminal.outcome.failure\n                ? {\n                    failure: {\n                      code: result.terminal.outcome.failure.failureCode\n                        .replace(/[^A-Za-z0-9_-]/g, \"_\")\n                        .slice(0, 128),\n                      detail: result.terminal.outcome.failure.failureDetail,\n                      retryable: false as const,\n                    },\n                  }\n                : {}),\n            }),\n          ).catch(() => undefined);\n        }\n        const retries = result.heals + result.startRetries;\n        this.emitOp({\n          op: \"exec\",\n          outcome: \"ok\",\n          healed: retries > 0,\n          retries,\n          durationMs: Date.now() - startedAt,\n          machineId: this.agentId,\n          replyBytes: result.replyBytes,\n          ...(retries > 0 ? { faultClass: result.heals > 0 ? \"reconnecting\" : \"draining\" } : {}),\n        });\n        const stdout = decoder.decode(result.stdout);\n        const stderr = decoder.decode(result.stderr);\n        return {\n          output: stdout,\n          stdout,\n          stderr,\n          exitCode: null,\n          timedOut: false,\n          backgroundCommandId: adoptedCommandId!,\n          backgroundOpId: result.opId,\n        };\n      }\n      terminalProof = true;\n      const outcome = result.outcome;\n      if (adoptedCommandId) {\n        await Promise.resolve(\n          this.settleBackgroundCommand?.({\n            commandId: adoptedCommandId,\n            controlWorkspaceId: admission.controlWorkspaceId,\n            enrollmentId: this.agentId,\n            connectionInstanceId: admission.connectionInstanceId,\n            opId,\n            outcome: \"exited\",\n            exitCode: outcome.response.exitCode,\n            reason: outcome.failure\n              ? `op_failure_${outcome.failure.failureCode.replace(/[^A-Za-z0-9_-]/g, \"_\").slice(0, 128)}`\n              : \"op_exit\",\n            ...(outcome.failure\n              ? {\n                  failure: {\n                    code: outcome.failure.failureCode.replace(/[^A-Za-z0-9_-]/g, \"_\").slice(0, 128),\n                    detail: outcome.failure.failureDetail,\n                    retryable: false as const,\n                  },\n                }\n              : {}),\n          }),\n        ).catch(() => undefined);\n      }\n      const retries = outcome.heals + outcome.startRetries;\n      this.emitOp({\n        op: \"exec\",\n        outcome: \"ok\",\n        healed: retries > 0,\n        retries,\n        durationMs: Date.now() - startedAt,\n        machineId: this.agentId,\n        replyBytes: outcome.replyBytes,\n        // A healed op's class: attach heals are link blips (reconnecting);\n        // start retries without heals were admission backpressure (draining).\n        ...(retries > 0 ? { faultClass: outcome.heals > 0 ? \"reconnecting\" : \"draining\" } : {}),\n      });\n      const nativeResult = execResultToChannelA(outcome.response, executionTimeoutMs);\n      retainedOutput.completed = { status: \"completed\", result: nativeResult };\n      return nativeResult;\n    } catch (error) {\n      if (ownershipTransferPending && !adoptedCommandId) {\n        // The live consumer's failed-adoption cleanup has also rejected. Its\n        // exact client remains retained below, so turn cleanup must rejoin it.\n        ownershipTransferPending = false;\n        notifyDurableOpOwnershipTransferFailed(opId);\n      }\n      if (error instanceof OpStreamUnavailableError) throw error;\n      const controlError =\n        error instanceof SelfhostedControlError\n          ? error\n          : new SelfhostedControlError({\n              message: error instanceof Error ? error.message : String(error),\n              code: ErrorCode.ERROR_CODE_PROTOCOL,\n              reason: null,\n              retryable: false,\n            });\n      if (\n        !terminalProof &&\n        !adoptedCommandId &&\n        !controlError.neverSent &&\n        machineStoppedAnswering(controlError) &&\n        this.adoptBackgroundCommand\n      ) {\n        // The machine went away mid-operation. The command may still run there,\n        // but only the machine can stop or report it, so this turn must not wait\n        // for it. Hand it to the session's command ledger with a stop request;\n        // the reconciler stops or settles it once the machine returns or its\n        // runner is retired. If recording fails, turn cleanup keeps ownership.\n        try {\n          notifyDurableOpOwnershipTransferStarted(opId);\n          const abandoned = await this.adoptBackgroundCommand({\n            controlWorkspaceId: admission.controlWorkspaceId,\n            enrollmentId: this.agentId,\n            connectionInstanceId: admission.connectionInstanceId,\n            opId,\n            command,\n            abandoned: true,\n          });\n          adoptedCommandId = abandoned.commandId;\n          notifyDurableOpOwnershipTransferred(opId);\n        } catch {\n          notifyDurableOpOwnershipTransferFailed(opId);\n        }\n      }\n      this.emitOp({\n        op: \"exec\",\n        outcome: \"failed\",\n        healed: false,\n        retries: 0,\n        durationMs: Date.now() - startedAt,\n        code: controlError.code,\n        reason: controlError.reason,\n        neverSent: controlError.neverSent,\n        machineId: this.agentId,\n        faultClass: selfhostedFaultClass(controlError),\n      });\n      throw controlError;\n    } finally {\n      // An observer failure does not prove that the exact provider operation\n      // stopped. Keep its launch client available for cancellation and\n      // readExisting recovery; only terminal proof or durable adoption releases\n      // this process-local custody entry.\n      if (terminalProof || adoptedCommandId) {\n        this.inFlightOpStreamClients.delete(opId);\n        this.inFlightOpStreamOutput.delete(opId);\n      }\n    }\n  }\n\n  /**\n   * The result/turn-end durability hook: persists each settled op's frontier\n   * to the journal, then final-acks it on the wire (licensing the runner to GC\n   * its retained frames). A tool-scoped call releases only that tool's output\n   * after its result is durably recorded. Omit scope only once every settled\n   * result has been accepted at the complete turn or one-off API boundary.\n   * A no-op for sessions without the op-stream transport.\n   */\n  async finalizeOpStreamOps(toolCallIds?: readonly string[]): Promise<void> {\n    for (const client of this.opStreamClients.values()) {\n      await client.finalizeSettledOps(toolCallIds);\n    }\n  }\n\n  // ── The agent-turn provided-session contract (over the SAME NATS primitives) ──\n  // These are what the @openai/agents shell/filesystem/skills capabilities call on\n  // the ACTIVE session once the routing proxy resolves selfhosted. They reuse the\n  // exec/fs ops above; the machine owns its filesystem (materialization is a no-op).\n\n  /** SDK shell capability `execCommand`: the `exec_command` tool. Selfhosted exec\n   *  is non-interactive (no PTY) — `tty` is ignored; `supportsPty()` is false so\n   *  the SDK never offers a stdin session.\n   *\n   *  Docker/unix-local return `formatExecResponse` (exit code + combined\n   *  stdout/stderr). This path must match that contract: returning raw stdout\n   *  made `ls` ENOENT and `npx --help` look like success with empty output.\n   *  The structured `exec()` result stays split for Channel-A parsers; the\n   *  deadline hint already lands on stderr there and is included in this body. */\n  async execCommand(args: SelfhostedExecArgs): Promise<string> {\n    const startedAt = Date.now();\n    const result = await this.execInternal(args, true);\n    if (result.backgroundCommandId && result.backgroundOpId) {\n      const output = joinExecCommandOutput(result.stdout, result.stderr);\n      return [\n        `Command running in background with command ID ${result.backgroundCommandId}.`,\n        `Connected Machine operation ${result.backgroundOpId} remains pinned to its launch daemon.`,\n        ...(output ? [\"\", \"Output:\", output] : []),\n      ].join(\"\\n\");\n    }\n    const exitCode =\n      typeof result.exitCode === \"number\" && Number.isSafeInteger(result.exitCode)\n        ? result.exitCode\n        : 1;\n    return formatExecResponse({\n      output: joinExecCommandOutput(result.stdout, result.stderr),\n      wallTimeSeconds: Math.max(0, Date.now() - startedAt) / 1000,\n      exitCode,\n    });\n  }\n\n  /**\n   * Physical turn-cancellation seam used by the runtime tool fence. Only the\n   * op-stream transport has a process-tree cancellation protocol; a legacy\n   * runner returns false and the caller remains fail-closed until its exec\n   * deadline rather than claiming the machine is quiescent.\n   */\n  async cancelExecCommand(opId: string): Promise<boolean> {\n    const client = this.inFlightOpStreamClients.get(opId) ?? this.defaultOpStreamClient;\n    if (!client) return false;\n    await client.cancel(opId);\n    return true;\n  }\n\n  /** Reconcile the exact retained foreground exec without OpStart or final ACK.\n   * Running/unobservable results keep the pinned client for another attempt. */\n  async observeExecCommand(opId: string): Promise<RemoteOperationObservation> {\n    const client = this.inFlightOpStreamClients.get(opId);\n    if (!client) throw new Error(\"No retained observer is available for this operation\");\n    const output = this.inFlightOpStreamOutput.get(opId);\n    if (!output) throw new Error(\"No retained output custody is available for this operation\");\n    return await this.observeExecCommandWithClient(opId, client, output);\n  }\n\n  private async observeExecCommandWithClient(\n    opId: string,\n    client: OpStreamExecClient,\n    output: { stdout: string[]; stderr: string[]; completed?: RemoteOperationObservation },\n  ): Promise<RemoteOperationObservation> {\n    if (output.completed?.status === \"completed\") return output.completed;\n    const observed = await client.readExisting(opId, 250, async (frames) => {\n      for (const frame of frames) output[frame.stream].push(frame.chunk);\n    });\n    if (observed.status === \"running\") {\n      return {\n        status: \"running\",\n        result: {\n          stdout: output.stdout.join(\"\"),\n          stderr: output.stderr.join(\"\"),\n          exitCode: null,\n        },\n      };\n    }\n    const result = execResultToChannelA(observed.outcome.response, this.effectiveExecDeadlineMs);\n    const completed: RemoteOperationObservation = {\n      status: \"completed\",\n      result: {\n        ...result,\n        stdout: output.stdout.join(\"\"),\n        stderr: output.stderr.join(\"\"),\n        output: output.stdout.join(\"\"),\n      },\n      ...(observed.outcome.failure\n        ? { failure: runnerFailureToControlError(observed.outcome.failure) }\n        : {}),\n    };\n    output.completed = completed;\n    if (this.inFlightOpStreamClients.get(opId) === client) {\n      this.inFlightOpStreamClients.delete(opId);\n      this.inFlightOpStreamOutput.delete(opId);\n    }\n    return completed;\n  }\n\n  /** SDK shell capability never calls this (gated on `supportsPty()` which is\n   *  false), but the surface advertises it. Selfhosted exec has no interactive PTY\n   *  session over the structured RPC, so a stdin write is unsupported. */\n  supportsPty(): boolean {\n    return false;\n  }\n\n  /** SDK filesystem capability `view_image`: read the image bytes off the machine\n   *  and wrap them in the tool-output image shape (magic-byte sniff + path fallback,\n   *  mirroring the SDK's `imageOutputFromBytes`). */\n  async viewImage(args: { path: string; runAs?: string }): Promise<SelfhostedImageOutput> {\n    const bytes = await this.readFile({\n      path: args.path,\n      ...(args.runAs ? { runAs: args.runAs } : {}),\n    });\n    const mediaType = sniffImageMediaType(bytes, args.path);\n    if (!mediaType) {\n      throw new Error(`selfhosted view_image: unsupported image format for ${args.path}`);\n    }\n    return {\n      type: \"image\",\n      image: { data: Uint8Array.from(bytes), mediaType },\n    };\n  }\n\n  /** SDK skills/filesystem `pathExists`: whether a path exists on the machine. */\n  async pathExists(path: string, _runAs?: string): Promise<boolean> {\n    const { exists } = await this.statFile({ path });\n    return exists;\n  }\n\n  /** SDK skills `listDir`: list a directory as `{name, path, type}[]`. */\n  async listDir(args: {\n    path: string;\n    runAs?: string;\n  }): Promise<Array<{ name: string; path: string; type: \"file\" | \"dir\" | \"other\" }>> {\n    const result = await this.listFiles({ path: args.path });\n    return result.fsList.entries.map((entry) => ({\n      name: entry.name,\n      path: entry.path,\n      type:\n        entry.kind === FsEntryKind.FS_ENTRY_KIND_DIRECTORY\n          ? (\"dir\" as const)\n          : entry.kind === FsEntryKind.FS_ENTRY_KIND_FILE\n            ? (\"file\" as const)\n            : (\"other\" as const),\n    }));\n  }\n\n  /** SDK manifest-delta `materializeEntry`: a NO-OP for selfhosted. Source\n   *  materialization (cloning repos / staging files into the box) is how cloud\n   *  providers prepare a fresh box; a bring-your-own machine already owns its\n   *  filesystem and is prepared by the agent itself, so there is nothing to stage.\n   *  Present (not absent) so the SDK's provided-session manifest apply path — which\n   *  requires `applyManifest()` OR `materializeEntry()` when the agent declares\n   *  entries — is satisfied without error. A session swapped from a managed\n   *  sandbox can still present managed-only manifest entries here; they remain\n   *  intentionally unstaged on the user-owned machine. */\n  async materializeEntry(_args: { path: string; entry: unknown; runAs?: string }): Promise<void> {\n    // There is deliberately no provider write for BYO compute, but the model's\n    // materialization operation must still fail closed when a cached personal\n    // route lost its exact-attempt authority.\n    await this.admitOperation(false);\n    return;\n  }\n\n  /** SDK filesystem capability `createEditor`: the apply_patch host. Applies V4A\n   *  diffs over the NATS fs ops (read → applyDiff → write). `applyDiff` is the SDK's\n   *  own parser, injected by the runtime barrel (the leaf cannot import it). */\n  createEditor(runAs?: string): SelfhostedEditor {\n    const applyDiff = injectedApplyDiff;\n    if (!applyDiff) {\n      throw new Error(\n        \"selfhosted createEditor: applyDiff not injected (the runtime barrel must call setSelfhostedApplyDiff before an agent turn binds the filesystem capability)\",\n      );\n    }\n    const pathExists = (path: string): Promise<boolean> => this.pathExists(path, runAs);\n    const readText = async (path: string): Promise<string> =>\n      decoder.decode(await this.readFile({ path, ...(runAs ? { runAs } : {}) }));\n    const writeText = async (\n      path: string,\n      content: string,\n      base?: string | (() => Promise<string | undefined>),\n    ): Promise<((source: string, sourceBase: string) => Promise<void>) | undefined> => {\n      const bytes = encoder.encode(content);\n      // Atomic publication and exact base checks matter for small edits too:\n      // a direct fsWrite can be interrupted after truncating the destination.\n      // Preserve legacy small moves into write-only destinations: their lazy\n      // base reader would introduce a new destination-read requirement.\n      if (bytes.byteLength <= SELFHOSTED_FILE_CHUNK_BYTES && typeof base === \"function\") {\n        await this.writeFile({ path, content, createParents: true });\n        return;\n      }\n      const initial = await this.admitOperation(false);\n      if (!initial.transactionalFsWriteSupported) {\n        // Older agents may have a larger negotiated message budget. Preserve\n        // their existing writes; a real size rejection remains a typed fault.\n        await this.writeFile({ path, content, createParents: true });\n        return;\n      }\n      if (runAs) {\n        throw new SelfhostedControlError({\n          code: ErrorCode.ERROR_CODE_UNSUPPORTED,\n          message:\n            \"Transactional file editing does not support runAs impersonation; no file was written.\",\n          reason: null,\n          retryable: false,\n        });\n      }\n      const requestTransfer = this.fileTransferRequest(initial);\n      const resolvedBase = typeof base === \"function\" ? await base() : base;\n      const transferStartedAt = Date.now();\n      try {\n        const result = await transferEditorFile({\n          path: resolveConnectedMachinePath(this.workspaceRoot, path),\n          content: bytes,\n          ...(resolvedBase === undefined ? {} : { baseContent: encoder.encode(resolvedBase) }),\n          request: requestTransfer,\n        });\n        // Unlike physical request observations, this is a verified file outcome.\n        this.emitOp({\n          op: \"fsWrite\",\n          outcome: \"ok\",\n          healed: result.recovered,\n          retries: 0,\n          durationMs: Date.now() - transferStartedAt,\n          machineId: this.agentId,\n        });\n      } catch (error) {\n        this.emitOp({\n          op: \"fsWrite\",\n          outcome: \"failed\",\n          healed: false,\n          retries: 0,\n          durationMs: Date.now() - transferStartedAt,\n          machineId: this.agentId,\n        });\n        throw error;\n      }\n      return async (source, sourceBase) => {\n        // A move is verified destination replacement followed by source cleanup,\n        // not an atomic rename. Never retarget cleanup after a runner change.\n        // The source check and deletion are not CAS against unrelated writers.\n        try {\n          const sourcePath = resolveConnectedMachinePath(this.workspaceRoot, source);\n          const sourceBytes: Uint8Array[] = [];\n          let offset = 0;\n          let total = Infinity;\n          while (offset < total) {\n            const reply = await requestTransfer(crypto.randomUUID(), {\n              $case: \"fsRead\",\n              fsRead: {\n                path: sourcePath,\n                offset: String(offset),\n                length: String(SELFHOSTED_FILE_CHUNK_BYTES),\n              },\n            });\n            if (reply.error) throw agentErrorToControlError(reply.error);\n            if (reply.result?.$case !== \"fsRead\")\n              throw new Error(\"Source verification response missing\");\n            const part = reply.result.fsRead;\n            total = safeWireSize(part.totalSize, \"source file size\");\n            if (!part.content.length && offset < total)\n              throw new Error(\"Source verification was incomplete\");\n            sourceBytes.push(part.content);\n            offset += part.content.length;\n          }\n          const actual = new Uint8Array(offset);\n          let cursor = 0;\n          for (const chunk of sourceBytes) {\n            actual.set(chunk, cursor);\n            cursor += chunk.length;\n          }\n          if (fileContentDigest(actual) !== fileContentDigest(encoder.encode(sourceBase)))\n            throw new Error(\"Source changed before move cleanup\");\n          const reply = await requestTransfer(crypto.randomUUID(), {\n            $case: \"fsRemove\",\n            fsRemove: { path: sourcePath, recursive: false },\n          });\n          if (reply.error) throw agentErrorToControlError(reply.error);\n          if (reply.result?.$case !== \"fsRemove\")\n            throw new Error(\"Source cleanup response missing\");\n        } catch (cause) {\n          throw new Error(\n            \"The destination edit was verified, but source cleanup was not verified. The move was not replayed; inspect both paths.\",\n            { cause },\n          );\n        }\n      };\n    };\n    const deletePath = async (path: string): Promise<void> => {\n      const result = await this.call({\n        $case: \"fsRemove\",\n        fsRemove: {\n          path: resolveConnectedMachinePath(this.workspaceRoot, path),\n          recursive: true,\n        },\n      });\n      if (result.$case !== \"fsRemove\") {\n        throw new Error(`selfhosted deleteFile: unexpected result ${result.$case}`);\n      }\n    };\n    return {\n      async createFile(operation) {\n        if (await pathExists(operation.path)) {\n          throw new Error(`selfhosted createFile: file already exists: ${operation.path}`);\n        }\n        await writeText(operation.path, applyDiff(\"\", operation.diff, \"create\"));\n        return {};\n      },\n      async updateFile(operation) {\n        const current = await readText(operation.path);\n        const next = applyDiff(current, operation.diff);\n        const destination = operation.moveTo ?? operation.path;\n        const destinationBase =\n          destination === operation.path\n            ? current\n            : async () =>\n                (await pathExists(destination)) ? await readText(destination) : undefined;\n        const cleanup = await writeText(destination, next, destinationBase);\n        if (operation.moveTo && destination !== operation.path) {\n          if (cleanup) await cleanup(operation.path, current);\n          else await deletePath(operation.path);\n        }\n        return {};\n      },\n      async deleteFile(operation) {\n        await deletePath(operation.path);\n        return {};\n      },\n    };\n  }\n\n  /** Channel-A `readFile`: read a file off the machine (binary-safe). */\n  async readFile(args: { path: string; runAs?: string; maxBytes?: number }): Promise<Uint8Array> {\n    const path = resolveConnectedMachinePath(this.workspaceRoot, args.path);\n    const requestedBytes = args.maxBytes ?? Number.POSITIVE_INFINITY;\n    const chunks: Uint8Array[] = [];\n    let offset = 0;\n    let totalSize = Number.POSITIVE_INFINITY;\n\n    while (offset < requestedBytes && offset < totalSize) {\n      const remaining = Math.min(requestedBytes - offset, SELFHOSTED_FS_READ_CHUNK_BYTES);\n      const result = await this.call({\n        $case: \"fsRead\",\n        fsRead: {\n          path,\n          offset: String(offset),\n          length: String(remaining),\n        },\n      });\n      if (result.$case !== \"fsRead\") {\n        throw new Error(`selfhosted readFile: unexpected result ${result.$case}`);\n      }\n      totalSize = safeWireSize(result.fsRead.totalSize, \"selfhosted file size\");\n      if (result.fsRead.content.byteLength === 0) break;\n      chunks.push(result.fsRead.content);\n      offset += result.fsRead.content.byteLength;\n    }\n\n    const content = new Uint8Array(offset);\n    let cursor = 0;\n    for (const chunk of chunks) {\n      content.set(chunk, cursor);\n      cursor += chunk.byteLength;\n    }\n    return content;\n  }\n\n  private fileTransferRequest(initial: Awaited<ReturnType<SelfhostedSession[\"admitOperation\"]>>) {\n    return async (\n      requestId: string,\n      op: NonNullable<ControlRequest[\"op\"]>,\n    ): Promise<ControlResponse> => {\n      const startedAt = Date.now();\n      try {\n        const current = await this.admitOperation(false);\n        if (\n          !current.transactionalFsWriteSupported ||\n          current.subject !== initial.subject ||\n          current.connectionInstanceId !== initial.connectionInstanceId\n        ) {\n          throw new Error(\n            \"The authorized machine connection changed during the file transfer; the operation was not replayed.\",\n          );\n        }\n        const response = await this.controlRpc.request(\n          current.subject,\n          {\n            requestId,\n            epoch: this.epoch,\n            op,\n            resourcePolicy: undefined,\n          },\n          { timeoutMs: this.timeoutMs },\n        );\n        if (response.requestId !== requestId)\n          throw new Error(\"The machine returned a mismatched file-transfer response identity.\");\n        const error = response.error\n          ? agentErrorToControlError(response.error, requestId)\n          : undefined;\n        this.emitOp({\n          op: op.$case,\n          outcome: error || !response.result ? \"failed\" : \"ok\",\n          healed: false,\n          retries: 0,\n          durationMs: Date.now() - startedAt,\n          machineId: this.agentId,\n          ...(error\n            ? { code: error.code, reason: error.reason, faultClass: selfhostedFaultClass(error) }\n            : {}),\n        });\n        return response;\n      } catch (error) {\n        this.emitOp({\n          op: op.$case,\n          outcome: \"failed\",\n          healed: false,\n          retries: 0,\n          durationMs: Date.now() - startedAt,\n          machineId: this.agentId,\n          ...(error instanceof SelfhostedControlError\n            ? { code: error.code, reason: error.reason, faultClass: selfhostedFaultClass(error) }\n            : {}),\n        });\n        throw error;\n      }\n    };\n  }\n\n  /** Write a file onto the machine (the fs surface the descriptor advertises). */\n  async writeFile(args: {\n    path: string;\n    content: string | Uint8Array;\n    createParents?: boolean;\n    append?: boolean;\n    runAs?: string;\n  }): Promise<number> {\n    const content = typeof args.content === \"string\" ? encoder.encode(args.content) : args.content;\n    if (args.runAs) {\n      throw new SelfhostedControlError({\n        code: ErrorCode.ERROR_CODE_UNSUPPORTED,\n        message: \"Native file writes do not support runAs impersonation; no file was written.\",\n        reason: null,\n        retryable: false,\n      });\n    }\n    if (content.byteLength > SELFHOSTED_FILE_CHUNK_BYTES && !args.append) {\n      const initial = await this.admitOperation(false);\n      if (initial.transactionalFsWriteSupported) {\n        const baseContent = (await this.pathExists(args.path))\n          ? await this.readFile({ path: args.path })\n          : undefined;\n        await transferEditorFile({\n          path: resolveConnectedMachinePath(this.workspaceRoot, args.path),\n          content,\n          ...(baseContent === undefined ? {} : { baseContent }),\n          createParents: args.createParents ?? true,\n          request: this.fileTransferRequest(initial),\n        });\n        return content.byteLength;\n      }\n    }\n    const result = await this.call({\n      $case: \"fsWrite\",\n      fsWrite: {\n        path: resolveConnectedMachinePath(this.workspaceRoot, args.path),\n        content,\n        createParents: args.createParents ?? true,\n        append: args.append ?? false,\n        mode: 0,\n      },\n    });\n    if (result.$case !== \"fsWrite\") {\n      throw new Error(`selfhosted writeFile: unexpected result ${result.$case}`);\n    }\n    return Number(result.fsWrite.bytesWritten);\n  }\n\n  /** Stage one bounded controller-owned authority file outside the workspace.\n   * The exact private path is deliberately narrower than the ordinary fs\n   * surface, and the explicit wire mode keeps the file private even when the\n   * Connected Machine agent was launched under a permissive umask. */\n  async writePlacementPrivate(args: {\n    path: string;\n    content: string | Uint8Array;\n    createParents?: boolean;\n    runAs?: string;\n  }): Promise<number> {\n    const path = selfhostedPlacementPrivatePath(args.path);\n    const content = typeof args.content === \"string\" ? encoder.encode(args.content) : args.content;\n    if (content.byteLength > SELFHOSTED_PLACEMENT_PRIVATE_FILE_MAX_BYTES) {\n      throw new TypeError(\"selfhosted placement-private content is invalid\");\n    }\n    const result = await this.call({\n      $case: \"fsWrite\",\n      fsWrite: {\n        path,\n        content,\n        createParents: args.createParents ?? true,\n        append: false,\n        mode: 0o600,\n      },\n    });\n    if (result.$case !== \"fsWrite\") {\n      throw new Error(`selfhosted writePlacementPrivate: unexpected result ${result.$case}`);\n    }\n    return Number(result.fsWrite.bytesWritten);\n  }\n\n  /** Idempotently remove only an Opengeni placement-private authority file.\n   * This uses the filesystem control op rather than exec, so cleanup still\n   * runs when the consuming command fails before a child process starts. */\n  async deletePlacementPrivate(path: string, _runAs?: string): Promise<void> {\n    const privatePath = selfhostedPlacementPrivatePath(path);\n    try {\n      const result = await this.call({\n        $case: \"fsRemove\",\n        fsRemove: { path: privatePath, recursive: false },\n      });\n      if (result.$case !== \"fsRemove\") {\n        throw new Error(`selfhosted deletePlacementPrivate: unexpected result ${result.$case}`);\n      }\n    } catch (error) {\n      if (error instanceof SelfhostedControlError && error.osNotFound) return;\n      throw error;\n    }\n  }\n\n  /** List a directory on the machine. */\n  async listFiles(args: {\n    path: string;\n    recursive?: boolean;\n  }): Promise<NonNullable<ControlResponse[\"result\"]> & { $case: \"fsList\" }> {\n    const result = await this.call({\n      $case: \"fsList\",\n      fsList: {\n        path: resolveConnectedMachinePath(this.workspaceRoot, args.path),\n        recursive: args.recursive ?? false,\n      },\n    });\n    if (result.$case !== \"fsList\") {\n      throw new Error(`selfhosted listFiles: unexpected result ${result.$case}`);\n    }\n    return result;\n  }\n\n  /** Stat a path on the machine. */\n  async statFile(args: { path: string }): Promise<{ exists: boolean }> {\n    const result = await this.call({\n      $case: \"fsStat\",\n      fsStat: { path: resolveConnectedMachinePath(this.workspaceRoot, args.path) },\n    });\n    if (result.$case !== \"fsStat\") {\n      throw new Error(`selfhosted statFile: unexpected result ${result.$case}`);\n    }\n    return { exists: result.fsStat.exists };\n  }\n\n  /** Ensure the loopback browser controller sidecar owned by this connected\n   * machine. The authority scope is supplied by the caller and remains local. */\n  async ensureBrowserControl(\n    request: BrowserControlEnsureRequest,\n  ): Promise<BrowserControlEnsureResponse> {\n    const result = await this.call({\n      $case: \"browserControlEnsure\",\n      browserControlEnsure: request,\n    });\n    if (result.$case !== \"browserControlEnsure\") {\n      throw new Error(`selfhosted ensureBrowserControl: unexpected result ${result.$case}`);\n    }\n    return result.browserControlEnsure;\n  }\n\n  /** Send one request to the agent-owned controller of an exact authority\n   * scope, served inside the runner over loopback without starting a process.\n   * `unsupported` means this connection's runner does not serve it and nothing\n   * was sent. `controller_absent` means no controller for that scope and\n   * generation accepted the request, so it was not delivered and the caller may\n   * ensure the controller and send again. A body too large for one reply is\n   * drained from the runner's spool; the request is never repeated. */\n  async browserControlHttp(request: BrowserControlHttpCall): Promise<BrowserControlHttpOutcome> {\n    const admission = await this.admitOperation(false);\n    if (!admission.browserControlHttpSupported) return { kind: \"unsupported\" };\n    // The runner bounds the request by timeoutMs; allow the reply to arrive.\n    const rpcTimeoutMs = request.timeoutMs + BROWSER_CONTROL_HTTP_REPLY_GRACE_MS;\n    let result: NonNullable<ControlResponse[\"result\"]>;\n    try {\n      result = await this.call(\n        {\n          $case: \"browserControlHttp\",\n          browserControlHttp: {\n            scopeId: request.scopeId,\n            scopeGeneration: request.scopeGeneration,\n            method: request.method,\n            path: request.path,\n            bearerToken: request.bearerToken,\n            body: request.body ?? new Uint8Array(),\n            hasBody: request.body !== undefined,\n            timeoutMs: request.timeoutMs,\n            maxResponseBytes: String(request.maxResponseBytes),\n          },\n        },\n        rpcTimeoutMs,\n        admission,\n      );\n    } catch (error) {\n      if (\n        error instanceof SelfhostedControlError &&\n        error.code === ErrorCode.ERROR_CODE_NOT_FOUND\n      ) {\n        return { kind: \"controller_absent\" };\n      }\n      throw error;\n    }\n    if (result.$case !== \"browserControlHttp\") {\n      throw new Error(`selfhosted browserControlHttp: unexpected result ${result.$case}`);\n    }\n    const response = result.browserControlHttp;\n    const totalBytes = Number(response.totalBytes);\n    if (\n      !Number.isSafeInteger(totalBytes) ||\n      totalBytes < response.body.byteLength ||\n      totalBytes > request.maxResponseBytes\n    ) {\n      throw new Error(\"selfhosted browserControlHttp: response length is invalid\");\n    }\n    let body = response.body;\n    if (response.spoolId) {\n      const complete = new Uint8Array(totalBytes);\n      complete.set(response.body, 0);\n      let offset = response.body.byteLength;\n      for (;;) {\n        const read = await this.call(\n          {\n            $case: \"browserControlHttpRead\",\n            browserControlHttpRead: { spoolId: response.spoolId, offset: String(offset) },\n          },\n          this.timeoutMs,\n          admission,\n        );\n        if (read.$case !== \"browserControlHttpRead\") {\n          throw new Error(`selfhosted browserControlHttpRead: unexpected result ${read.$case}`);\n        }\n        const part = read.browserControlHttpRead;\n        if (offset + part.data.byteLength > totalBytes) {\n          throw new Error(\"selfhosted browserControlHttpRead: response exceeds its length\");\n        }\n        complete.set(part.data, offset);\n        offset += part.data.byteLength;\n        if (part.done) break;\n        if (part.data.byteLength === 0) {\n          throw new Error(\"selfhosted browserControlHttpRead: spool made no progress\");\n        }\n      }\n      if (offset !== totalBytes) {\n        throw new Error(\"selfhosted browserControlHttpRead: response is incomplete\");\n      }\n      body = complete;\n    } else if (response.body.byteLength !== totalBytes) {\n      throw new Error(\"selfhosted browserControlHttp: response is incomplete\");\n    }\n    const headers = new Map<string, string>();\n    for (const header of response.headers) headers.set(header.name.toLowerCase(), header.value);\n    return { kind: \"response\", status: response.status, headers, body };\n  }\n\n  /** Open one browser-native frame producer and return its canonical relay\n   * endpoint. This does not route through `resolveExposedPort`: that legacy\n   * method allocates PTY/desktop resources based on fixed ports, while this op\n   * returns the exact fresh browser StreamChannel allocated by the agent. */\n  async openBrowserFrames(\n    request: BrowserFramesOpenRequest,\n  ): Promise<{ channel: StreamChannel; endpoint: ExposedPortEndpoint }> {\n    const result = await this.call({\n      $case: \"browserFramesOpen\",\n      browserFramesOpen: request,\n    });\n    if (result.$case !== \"browserFramesOpen\" || !result.browserFramesOpen.channel) {\n      throw new Error(`selfhosted openBrowserFrames: unexpected result ${result.$case}`);\n    }\n    const channel = result.browserFramesOpen.channel;\n    return { channel, endpoint: this.relayEndpoint(channel) };\n  }\n\n  /** Open one ComputerSession frame producer through the same relay fabric. */\n  async openComputerFrames(\n    request: ComputerFramesOpenRequest,\n  ): Promise<{ channel: StreamChannel; endpoint: ExposedPortEndpoint }> {\n    const result = await this.call({\n      $case: \"computerFramesOpen\",\n      computerFramesOpen: request,\n    });\n    if (result.$case !== \"computerFramesOpen\" || !result.computerFramesOpen.channel) {\n      throw new Error(`selfhosted openComputerFrames: unexpected result ${result.$case}`);\n    }\n    const channel = result.computerFramesOpen.channel;\n    return { channel, endpoint: this.relayEndpoint(channel) };\n  }\n\n  /** A cheap liveness probe — request a Ping on the subject; returns true iff a\n   *  responder answered (no AgentError). Used by `negotiateSelfhostedCapabilities`.\n   *  The wire `nonce` is a uint64 (a numeric string), so the default is a random\n   *  numeric value — NOT a UUID (which would fail proto uint64 encoding). */\n  async ping(nonce = randomNonce()): Promise<boolean> {\n    const admission = await this.admitOperation(false);\n    const req: ControlRequest = {\n      requestId: crypto.randomUUID(),\n      epoch: this.epoch,\n      resourcePolicy: undefined,\n      op: { $case: \"ping\", ping: { nonce } },\n    };\n    const res = await this.controlRpc.request(admission.subject, req, {\n      timeoutMs: this.timeoutMs,\n    });\n    return !res.error && res.result?.$case === \"ping\";\n  }\n\n  /**\n   * Resolve an exposed port to a relay stream endpoint (the viewer/pty plane).\n   * Returns the relay URL SHAPE — `{host:relay, port, tls, query:channel-key}` —\n   * after asking the agent to ensure a stream channel for the port. M8b wires the\n   * real relay tier (the byte pump) behind THIS seam.\n   *\n   * THE CHANNEL-KEY QUERY (the M8b relay-dial contract): the relay\n   * routes by `{workspaceId, agentId, port, channelId}` — the EXACT `ChannelKey::query` the\n   * agent's relay client (`opengeni-agent-stream`) appends when it registers the\n   * producer side: `ws=<workspaceId>&agent=<agentId>&port=<port>&channel=<channelId>`.\n   * Channel id is routing identity, not a correlation hint, so concurrent PTYs\n   * on one connected machine never replace one another. The viewer\n   * dials `wss://<relay>/stream?ws=&agent=&port=&channel=` and presents the minted\n   * `ogs_` token in-band (NEVER as a URL param) — the relay pairs it with the\n   * producer by the routing key.\n   */\n  async resolveExposedPort(port: number): Promise<ExposedPortEndpoint> {\n    // Ask the agent to ensure a relay PRODUCER channel exists for the port, using the\n    // PORT-APPROPRIATE op. The PTY plane (7681) is INDEPENDENT of the desktop display:\n    // route it through `ptyOpen` (which spawns/attaches a PTY and NEVER touches X11),\n    // and ONLY the desktop framebuffer plane (6080) through `desktopEnsure` (which\n    // hard-requires a live virtual display). Earlier M8b used `desktopEnsure` for\n    // EVERY port — that wrongly coupled the terminal to the desktop probe, so a\n    // headless (or display-degraded) machine could never get a terminal even though\n    // `ptyOpen` would have succeeded. The returned channelId is the relay\n    // routing identity; both ops carry a `StreamChannel` on their response.\n    let channel: StreamChannel | undefined;\n    if (port === DESKTOP_STREAM_PORT) {\n      const result = await this.call({\n        $case: \"desktopEnsure\",\n        desktopEnsure: { width: 0, height: 0 },\n      });\n      if (result.$case !== \"desktopEnsure\") {\n        throw new Error(\n          `selfhosted resolveExposedPort(${port}): unexpected result ${result.$case}`,\n        );\n      }\n      channel = result.desktopEnsure.channel;\n    } else {\n      // The PTY plane (7681) + any non-desktop stream port. `command: []` => the\n      // user's default login shell; the agent's pty_pump bridges the PTY master to\n      // the relay channel. Display-INDEPENDENT — works on a headless machine.\n      const result = await this.call({\n        $case: \"ptyOpen\",\n        // Open the terminal in the exact host-native root bound to this session.\n        ptyOpen: {\n          command: [],\n          cwd: this.workspaceRoot,\n          env: {},\n          cols: 0,\n          rows: 0,\n          term: \"xterm-256color\",\n          scopeId: this.terminalScopeId,\n        },\n      });\n      if (result.$case !== \"ptyOpen\") {\n        throw new Error(\n          `selfhosted resolveExposedPort(${port}): unexpected result ${result.$case}`,\n        );\n      }\n      channel = result.ptyOpen.channel;\n    }\n    if (channel) return this.relayEndpoint(channel);\n    const channelId = channelKey(this.controlWorkspaceId, this.agentId, port);\n    const tls = this.relay.tls ?? true;\n    // The routing key the relay pairs producer↔consumer by — IDENTICAL to the\n    // agent's `ChannelKey::query`, including the stream-instance channel id.\n    const routingQuery =\n      `ws=${encodeURIComponent(this.controlWorkspaceId)}` +\n      `&agent=${encodeURIComponent(this.agentId)}` +\n      `&port=${port}` +\n      `&channel=${encodeURIComponent(channelId)}`;\n    return {\n      host: this.relay.host,\n      port: this.relay.port ?? (tls ? 443 : 80),\n      tls,\n      // The relay's wss route (`/stream`); buildStreamUrl honors `path`.\n      path: this.relay.path ?? SELFHOSTED_RELAY_STREAM_PATH,\n      query: routingQuery,\n    };\n  }\n\n  private relayEndpoint(channel: StreamChannel): ExposedPortEndpoint {\n    const tls = this.relay.tls ?? true;\n    const routingQuery =\n      `ws=${encodeURIComponent(channel.workspaceId)}` +\n      `&agent=${encodeURIComponent(channel.agentId)}` +\n      `&port=${channel.port}` +\n      `&channel=${encodeURIComponent(channel.channelId)}`;\n    return {\n      host: this.relay.host,\n      port: this.relay.port ?? (tls ? 443 : 80),\n      tls,\n      path: this.relay.path ?? SELFHOSTED_RELAY_STREAM_PATH,\n      query: routingQuery,\n      protocol: kindToProtocol(channel.kind),\n    };\n  }\n\n  /** Round-trip the persistable state — `{agentId}` ONLY (resume = re-address). */\n  async serializeSessionState(): Promise<SelfhostedSessionState> {\n    return { agentId: this.agentId };\n  }\n}\n\n/**\n * The selfhosted SDK-client surface the registry builds. `backendId:\"selfhosted\"`\n * (the resume-fence field asserted against the descriptor). `create()`/`resume()`\n * return a `SelfhostedSession` bound to `{workspaceId, agentId, controlRpc}`.\n *\n * `create()` and `resume()` are IDENTICAL for selfhosted — there is no box to\n * provision (the machine already exists); both just bind a session to the live\n * subject. `serializeSessionState`/`deserializeSessionState` round-trip\n * `{agentId}` only.\n *\n * The `controlRpc` is constructed LAZILY via an injected factory (defaulting to\n * `NatsControlRpc`); a session built before NATS is configured surfaces\n * `agent_offline` on its first op rather than failing at construction.\n */\nexport class SelfhostedSandboxClient {\n  readonly backendId = \"selfhosted\" as const;\n  readonly supportsDefaultOptions = false;\n  private readonly workspaceId: string;\n  private readonly controlWorkspaceId: string | undefined;\n  private readonly relay: SelfhostedRelayConfig;\n  private readonly controlRpcFactory: () => ControlRpc;\n  private readonly defaultAgentId: string | undefined;\n  private readonly connectionInstanceId: string | undefined;\n  private readonly terminalScopeId: string | undefined;\n  private readonly epoch: number | undefined;\n  private readonly timeoutMs: number | undefined;\n  private readonly execTimeoutMs: number | undefined;\n  private readonly environment: Record<string, string> | undefined;\n  private readonly transientExecEnvironment: (() => Readonly<Record<string, string>>) | undefined;\n  private readonly workspaceRoot: string;\n  private readonly operationResourcePolicy: SelfhostedOperationResourcePolicy | undefined;\n  private readonly operationResourcePolicySupported: boolean | undefined;\n  private readonly operationCpuQuotaSupported: boolean | undefined;\n  private readonly transactionalFsWriteSupported: boolean | undefined;\n  private readonly browserControlHttpSupported: boolean | undefined;\n  private readonly resolveOperationAdmission:\n    | (() => Promise<SelfhostedOperationAdmission | null>)\n    | undefined;\n  private readonly adoptBackgroundCommand:\n    | SelfhostedSessionDeps[\"adoptBackgroundCommand\"]\n    | undefined;\n  private readonly settleBackgroundCommand:\n    | SelfhostedSessionDeps[\"settleBackgroundCommand\"]\n    | undefined;\n  private readonly captureBackgroundCommandOutput: SelfhostedSessionDeps[\"captureBackgroundCommandOutput\"];\n  private readonly onOp: SelfhostedOpObserver | undefined;\n  private readonly opStream: SelfhostedOpStreamDeps | undefined;\n  private controlRpcMemo: ControlRpc | undefined;\n\n  constructor(opts: {\n    workspaceId: string;\n    controlWorkspaceId?: string;\n    relay: SelfhostedRelayConfig;\n    /** Lazily build the ControlRpc (defaults to NatsControlRpc in the provider). */\n    controlRpcFactory: () => ControlRpc;\n    /** Exact effective host-native root threaded into every bound session. */\n    workspaceRoot: string;\n    /** The agentId a bare create()/resume() (no state) binds to. Optional: the\n     *  resume path supplies it via deserializeSessionState. */\n    agentId?: string;\n    /** Exact live daemon process. Optional only for the inert registry client;\n     *  any live create()/resume() fails closed until one is bound. */\n    connectionInstanceId?: string;\n    /** Stable terminal identity (normally the durable Opengeni session id). */\n    terminalScopeId?: string;\n    epoch?: number;\n    /** The control-op timeout threaded into every bound session. */\n    timeoutMs?: number;\n    /** The exec process deadline threaded into every bound session (distinct from\n     *  `timeoutMs`; 0 means no duration deadline, while omission preserves the\n     *  historical control-timeout value fallback for embedding callers). */\n    execTimeoutMs?: number;\n    operationResourcePolicy?: SelfhostedOperationResourcePolicy;\n    operationResourcePolicySupported?: boolean;\n    operationCpuQuotaSupported?: boolean;\n    transactionalFsWriteSupported?: boolean;\n    browserControlHttpSupported?: boolean;\n    resolveOperationAdmission?: () => Promise<SelfhostedOperationAdmission | null>;\n    adoptBackgroundCommand?: SelfhostedSessionDeps[\"adoptBackgroundCommand\"];\n    settleBackgroundCommand?: SelfhostedSessionDeps[\"settleBackgroundCommand\"];\n    captureBackgroundCommandOutput?: SelfhostedSessionDeps[\"captureBackgroundCommandOutput\"];\n    /** The run's declared sandbox environment, threaded into every bound session's\n     *  `state.manifest.environment` so the SDK's per-turn manifest-env delta is\n     *  empty (validateNoEnvironmentDelta). See SelfhostedSessionDeps.environment.\n     *  Omitted → `{}` (the negotiation-only path; no turn manifest is applied). */\n    environment?: Record<string, string>;\n    /** Attempt-local child-process environment; never persisted or manifested. */\n    transientExecEnvironment?: () => Readonly<Record<string, string>>;\n    /** The per-op observer threaded into every bound session (out-of-band telemetry). */\n    onOp?: SelfhostedOpObserver;\n    /** The op-stream exec transport threaded into every bound session (present\n     *  = enabled; see SelfhostedOpStreamDeps). */\n    opStream?: SelfhostedOpStreamDeps;\n  }) {\n    this.workspaceId = opts.workspaceId;\n    this.controlWorkspaceId = opts.controlWorkspaceId;\n    this.relay = opts.relay;\n    this.controlRpcFactory = opts.controlRpcFactory;\n    this.workspaceRoot = opts.workspaceRoot;\n    this.defaultAgentId = opts.agentId;\n    this.connectionInstanceId = opts.connectionInstanceId;\n    this.terminalScopeId = opts.terminalScopeId;\n    this.epoch = opts.epoch;\n    this.timeoutMs = opts.timeoutMs;\n    this.execTimeoutMs = opts.execTimeoutMs;\n    this.operationResourcePolicy = opts.operationResourcePolicy;\n    this.operationResourcePolicySupported = opts.operationResourcePolicySupported;\n    this.operationCpuQuotaSupported = opts.operationCpuQuotaSupported;\n    this.transactionalFsWriteSupported = opts.transactionalFsWriteSupported;\n    this.browserControlHttpSupported = opts.browserControlHttpSupported;\n    this.resolveOperationAdmission = opts.resolveOperationAdmission;\n    this.adoptBackgroundCommand = opts.adoptBackgroundCommand;\n    this.settleBackgroundCommand = opts.settleBackgroundCommand;\n    this.captureBackgroundCommandOutput = opts.captureBackgroundCommandOutput;\n    this.environment = opts.environment;\n    this.transientExecEnvironment = opts.transientExecEnvironment;\n    this.onOp = opts.onOp;\n    this.opStream = opts.opStream;\n  }\n\n  private controlRpc(): ControlRpc {\n    if (!this.controlRpcMemo) {\n      this.controlRpcMemo = this.controlRpcFactory();\n    }\n    return this.controlRpcMemo;\n  }\n\n  private bind(agentId: string): SelfhostedSession {\n    return new SelfhostedSession({\n      workspaceId: this.workspaceId,\n      ...(this.controlWorkspaceId !== undefined\n        ? { controlWorkspaceId: this.controlWorkspaceId }\n        : {}),\n      agentId,\n      connectionInstanceId: this.requireConnectionInstanceId(),\n      controlRpc: this.controlRpc(),\n      relay: this.relay,\n      workspaceRoot: this.workspaceRoot,\n      ...(this.terminalScopeId !== undefined ? { terminalScopeId: this.terminalScopeId } : {}),\n      ...(this.epoch !== undefined ? { epoch: this.epoch } : {}),\n      ...(this.timeoutMs !== undefined ? { timeoutMs: this.timeoutMs } : {}),\n      ...(this.execTimeoutMs !== undefined ? { execTimeoutMs: this.execTimeoutMs } : {}),\n      ...(this.operationResourcePolicy !== undefined\n        ? { operationResourcePolicy: this.operationResourcePolicy }\n        : {}),\n      ...(this.operationResourcePolicySupported !== undefined\n        ? {\n            operationResourcePolicySupported: this.operationResourcePolicySupported,\n          }\n        : {}),\n      ...(this.operationCpuQuotaSupported !== undefined\n        ? { operationCpuQuotaSupported: this.operationCpuQuotaSupported }\n        : {}),\n      transactionalFsWriteSupported: this.transactionalFsWriteSupported === true,\n      browserControlHttpSupported: this.browserControlHttpSupported === true,\n      ...(this.resolveOperationAdmission !== undefined\n        ? { resolveOperationAdmission: this.resolveOperationAdmission }\n        : {}),\n      ...(this.adoptBackgroundCommand !== undefined\n        ? { adoptBackgroundCommand: this.adoptBackgroundCommand }\n        : {}),\n      ...(this.settleBackgroundCommand !== undefined\n        ? { settleBackgroundCommand: this.settleBackgroundCommand }\n        : {}),\n      ...(this.captureBackgroundCommandOutput\n        ? { captureBackgroundCommandOutput: this.captureBackgroundCommandOutput }\n        : {}),\n      ...(this.environment !== undefined ? { environment: this.environment } : {}),\n      ...(this.transientExecEnvironment !== undefined\n        ? { transientExecEnvironment: this.transientExecEnvironment }\n        : {}),\n      ...(this.onOp !== undefined ? { onOp: this.onOp } : {}),\n      ...(this.opStream !== undefined ? { opStream: this.opStream } : {}),\n    });\n  }\n\n  /** Bind a session to the live agent subject. There is no box to provision. */\n  async create(_manifest?: unknown, _options?: unknown): Promise<SelfhostedSession> {\n    const agentId = this.requireAgentId();\n    return this.bind(agentId);\n  }\n\n  /** Resume = re-address the subject. Identical to create — no provider state. */\n  async resume(\n    state: SelfhostedSessionState | Record<string, unknown>,\n    _options?: unknown,\n  ): Promise<SelfhostedSession> {\n    const agentId = readAgentId(state) ?? this.requireAgentId();\n    return this.bind(agentId);\n  }\n\n  /** Serialize a live session's state → `{agentId}` ONLY. */\n  async serializeSessionState(\n    state: SelfhostedSessionState | { agentId?: string } | unknown,\n  ): Promise<SelfhostedSessionState> {\n    const agentId = readAgentId(state) ?? this.requireAgentId();\n    return { agentId };\n  }\n\n  /** Deserialize `{agentId}` from the persisted envelope. */\n  async deserializeSessionState(state: Record<string, unknown>): Promise<SelfhostedSessionState> {\n    const agentId = readAgentId(state) ?? this.requireAgentId();\n    return { agentId };\n  }\n\n  /** selfhosted is NOT persistable — there is no owned session state to preserve\n   *  (the machine is the persistence). The lease never snapshots it. */\n  async canPersistOwnedSessionState(): Promise<boolean> {\n    return false;\n  }\n\n  private requireAgentId(): string {\n    if (!this.defaultAgentId) {\n      throw new Error(\n        \"selfhosted sandbox client: no agentId bound (create()/resume() need a session state carrying agentId)\",\n      );\n    }\n    return this.defaultAgentId;\n  }\n\n  private requireConnectionInstanceId(): string {\n    if (!this.connectionInstanceId) {\n      throw new Error(\n        \"selfhosted sandbox client: no connectionInstanceId bound (live create()/resume() requires an exact claimed daemon instance)\",\n      );\n    }\n    return this.connectionInstanceId;\n  }\n}\n\n/**\n * The dependency shape `buildSelfhostedBackendSession` needs to bind a live\n * selfhosted session to a target machine. A structural superset of the fields the\n * routing resolver (backend-resolver.ts) reads off its deps + pointer, and the\n * fields the WORKER turn's machine-primary establish branch threads in — so a\n * SINGLE build shape is shared by both (never two divergent constructions of the\n * same SelfhostedSandboxClient/resume pair).\n */\nexport interface SelfhostedSessionBuild {\n  /** Authorization/session workspace. */\n  workspaceId: string;\n  /** Physical machine-origin workspace used in agent and relay routes. */\n  controlWorkspaceId?: string;\n  /** The enrollment id == the agent id the exact process subject addresses. */\n  agentId: string;\n  /** Exact daemon instance holding the enrollment's live connection lease. */\n  connectionInstanceId: string;\n  /** The relay-URL shape for stream endpoints. */\n  relay: SelfhostedRelayConfig;\n  /** Stable terminal identity; normally the durable Opengeni session id. */\n  terminalScopeId?: string;\n  /** Lazily build the live ControlRpc (the request-scoped NATS connection). */\n  controlRpcFactory: () => ControlRpc;\n  /** Exact effective host-native root for this session. */\n  workspaceRoot: string;\n  /** The lease/active epoch the session is fenced under (echoed on every op). */\n  epoch: number;\n  /** The run's declared sandbox environment → the session manifest.environment\n   *  (env-parity; see SelfhostedSessionDeps.environment). */\n  environment?: Record<string, string>;\n  /** Attempt-local child-process values; see SelfhostedSessionDeps. */\n  transientExecEnvironment?: () => Readonly<Record<string, string>>;\n  /** The control-op timeout (ping/fs/desktop/pty). Absent ⇒ the 30s default. */\n  timeoutMs?: number;\n  /** The exec process deadline, distinct from `timeoutMs`. 0 = none; absence\n   *  preserves the historical control-timeout value fallback for embedding callers. */\n  execTimeoutMs?: number;\n  /** Per-enrollment optional command policy resolved from the same database\n   * snapshot as the exact connection identity. */\n  operationResourcePolicy?: SelfhostedOperationResourcePolicy;\n  /** Exact live runner capability paired with that snapshot. */\n  operationResourcePolicySupported?: boolean;\n  /** Exact live CPU enforcement capability paired with the initial snapshot. */\n  operationCpuQuotaSupported?: boolean;\n  transactionalFsWriteSupported?: boolean;\n  /** Exact live runner capability for in-process controller requests. */\n  browserControlHttpSupported?: boolean;\n  /** Live last-boundary operation admission resolver; see SelfhostedSessionDeps. */\n  resolveOperationAdmission?: () => Promise<SelfhostedOperationAdmission | null>;\n  adoptBackgroundCommand?: SelfhostedSessionDeps[\"adoptBackgroundCommand\"];\n  settleBackgroundCommand?: SelfhostedSessionDeps[\"settleBackgroundCommand\"];\n  captureBackgroundCommandOutput?: SelfhostedSessionDeps[\"captureBackgroundCommandOutput\"];\n  /** The per-op observer (out-of-band telemetry). Absent ⇒ no-op. */\n  onOp?: SelfhostedOpObserver;\n  /** The op-stream exec transport (present when the runner advertises it and the\n   *  server flag is on). Required for every Connected Machine exec command. */\n  opStream?: SelfhostedOpStreamDeps;\n}\n\n/**\n * Build a live selfhosted session bound to a target machine: construct a request-\n * scoped `SelfhostedSandboxClient` (fenced under `epoch`, carrying the run's env +\n * working dir) and `resume()` it (= re-address the live subject — no provider box\n * is created). Returns BOTH the client (the OWNED-sandbox client the turn injects,\n * whose `serializeSessionState` round-trips `{agentId}`) and the live session.\n *\n * Shared by:\n *   - the routing resolver (backend-resolver.ts) — a swap target, where only the\n *     session is needed; and\n *   - the worker turn's machine-primary establish branch — where the client is the\n *     owned-sandbox client AND the session is the pinned routing default.\n * Factoring it here keeps the two builds identical (no divergence in the fence\n * epoch, env threading, or working-dir base).\n */\nexport async function buildSelfhostedBackendSession(\n  deps: SelfhostedSessionBuild,\n): Promise<{ client: SelfhostedSandboxClient; session: SelfhostedSession }> {\n  const client = new SelfhostedSandboxClient({\n    workspaceId: deps.workspaceId,\n    ...(deps.controlWorkspaceId !== undefined\n      ? { controlWorkspaceId: deps.controlWorkspaceId }\n      : {}),\n    relay: deps.relay,\n    controlRpcFactory: deps.controlRpcFactory,\n    workspaceRoot: deps.workspaceRoot,\n    agentId: deps.agentId,\n    connectionInstanceId: deps.connectionInstanceId,\n    epoch: deps.epoch,\n    ...(deps.terminalScopeId !== undefined ? { terminalScopeId: deps.terminalScopeId } : {}),\n    ...(deps.timeoutMs !== undefined ? { timeoutMs: deps.timeoutMs } : {}),\n    ...(deps.execTimeoutMs !== undefined ? { execTimeoutMs: deps.execTimeoutMs } : {}),\n    ...(deps.operationResourcePolicy !== undefined\n      ? { operationResourcePolicy: deps.operationResourcePolicy }\n      : {}),\n    ...(deps.operationResourcePolicySupported !== undefined\n      ? {\n          operationResourcePolicySupported: deps.operationResourcePolicySupported,\n        }\n      : {}),\n    ...(deps.operationCpuQuotaSupported !== undefined\n      ? { operationCpuQuotaSupported: deps.operationCpuQuotaSupported }\n      : {}),\n    transactionalFsWriteSupported: deps.transactionalFsWriteSupported === true,\n    browserControlHttpSupported: deps.browserControlHttpSupported === true,\n    ...(deps.resolveOperationAdmission !== undefined\n      ? { resolveOperationAdmission: deps.resolveOperationAdmission }\n      : {}),\n    ...(deps.adoptBackgroundCommand !== undefined\n      ? { adoptBackgroundCommand: deps.adoptBackgroundCommand }\n      : {}),\n    ...(deps.settleBackgroundCommand !== undefined\n      ? { settleBackgroundCommand: deps.settleBackgroundCommand }\n      : {}),\n    ...(deps.captureBackgroundCommandOutput\n      ? { captureBackgroundCommandOutput: deps.captureBackgroundCommandOutput }\n      : {}),\n    ...(deps.onOp !== undefined ? { onOp: deps.onOp } : {}),\n    ...(deps.environment !== undefined ? { environment: deps.environment } : {}),\n    ...(deps.transientExecEnvironment !== undefined\n      ? { transientExecEnvironment: deps.transientExecEnvironment }\n      : {}),\n    ...(deps.opStream !== undefined ? { opStream: deps.opStream } : {}),\n  });\n  const session = await client.resume({ agentId: deps.agentId });\n  return { client, session };\n}\n\nfunction readAgentId(state: unknown): string | undefined {\n  if (state && typeof state === \"object\") {\n    const candidate =\n      (state as { agentId?: unknown }).agentId ??\n      (state as { providerState?: { agentId?: unknown } }).providerState?.agentId;\n    if (typeof candidate === \"string\" && candidate.length > 0) {\n      return candidate;\n    }\n  }\n  return undefined;\n}\n\nfunction safeWireSize(value: string, label: string): number {\n  const parsed = Number(value);\n  if (!Number.isSafeInteger(parsed) || parsed < 0) {\n    throw new Error(`${label} is outside the supported range`);\n  }\n  return parsed;\n}\n\nfunction selfhostedPlacementPrivatePath(value: unknown): string {\n  if (\n    typeof value !== \"string\" ||\n    value.length < `${SELFHOSTED_PLACEMENT_PRIVATE_PREFIX}x`.length ||\n    value.length > 4_096 ||\n    !value.startsWith(SELFHOSTED_PLACEMENT_PRIVATE_PREFIX) ||\n    /[\\u0000-\\u001f\\u007f]/u.test(value) ||\n    value.split(\"/\").some((segment) => segment === \".\" || segment === \"..\")\n  ) {\n    throw new TypeError(\"selfhosted placement-private path is invalid\");\n  }\n  return value;\n}\n\nfunction joinExecCommandOutput(stdout: string, stderr: string): string {\n  return [stdout, stderr].filter((value) => value.trim().length > 0).join(\"\\n\");\n}\n\nfunction execResultToChannelA(res: ExecResponse, execDeadlineMs: number): SelfhostedExecResult {\n  const stdout = decoder.decode(res.stdout);\n  let stderr = decoder.decode(res.stderr);\n  if (res.timedOut && execDeadlineMs > 0) {\n    // The agent killed the child at the exec deadline. Surface an actionable hint\n    // on STDERR ONLY — stdout is left byte-exact because the structural Channel-A\n    // surface parses command stdout (find/stat/git listings); a hint injected there\n    // would corrupt those parsers.\n    const hint = execDeadlineHint(Math.round(execDeadlineMs / 1000));\n    stderr = stderr ? `${stderr}\\n${hint}` : hint;\n  }\n  return {\n    output: stdout,\n    stdout,\n    stderr,\n    exitCode: res.exitCode,\n    timedOut: res.timedOut,\n  };\n}\n\nfunction execRequiresOpStream(cause?: OpStreamUnavailableError): SelfhostedControlError {\n  const runnerUpgrade = cause?.unavailableKind === \"runner\" || cause === undefined;\n  return new SelfhostedControlError({\n    message: runnerUpgrade\n      ? \"This Connected Machine does not advertise the streaming command protocol required for exec. Update and reconnect the Opengeni agent. The command was not started.\"\n      : \"The Connected Machine streaming channel is temporarily unavailable. Opengeni did not downgrade to an ambiguous request/reply command; the command was not started. Retry after the machine reconnects.\",\n    code: runnerUpgrade ? ErrorCode.ERROR_CODE_UNSUPPORTED : ErrorCode.ERROR_CODE_STREAM,\n    reason: runnerUpgrade ? null : \"agent_reconnecting\",\n    retryable: !runnerUpgrade,\n  });\n}\n\nfunction channelKey(workspaceId: string, agentId: string, port: number): string {\n  return `${workspaceId}:${agentId}:${port}`;\n}\n\n/** Detect an image media type from magic bytes (with a path-extension fallback),\n *  mirroring @openai/agents-core's `sniffImageMediaType` so `viewImage` returns the\n *  SAME media types the SDK would. Returns undefined for an unrecognized format. */\nfunction sniffImageMediaType(bytes: Uint8Array, path: string): string | undefined {\n  if (bytes[0] === 0x89 && bytes[1] === 0x50 && bytes[2] === 0x4e && bytes[3] === 0x47)\n    return \"image/png\";\n  if (bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff) return \"image/jpeg\";\n  if (bytes[0] === 0x47 && bytes[1] === 0x49 && bytes[2] === 0x46 && bytes[3] === 0x38)\n    return \"image/gif\";\n  if (\n    bytes[0] === 0x52 &&\n    bytes[1] === 0x49 &&\n    bytes[2] === 0x46 &&\n    bytes[3] === 0x46 &&\n    bytes[8] === 0x57 &&\n    bytes[9] === 0x45 &&\n    bytes[10] === 0x42 &&\n    bytes[11] === 0x50\n  )\n    return \"image/webp\";\n  if (bytes[0] === 0x42 && bytes[1] === 0x4d) return \"image/bmp\";\n  if (\n    (bytes[0] === 0x49 && bytes[1] === 0x49 && bytes[2] === 0x2a && bytes[3] === 0x00) ||\n    (bytes[0] === 0x4d && bytes[1] === 0x4d && bytes[2] === 0x00 && bytes[3] === 0x2a)\n  )\n    return \"image/tiff\";\n  if (looksLikeSvg(bytes)) return \"image/svg+xml\";\n  return mediaTypeFromPath(path);\n}\n\nfunction looksLikeSvg(bytes: Uint8Array): boolean {\n  const prefix = decoder\n    .decode(bytes.subarray(0, Math.min(bytes.byteLength, 512)))\n    .trimStart()\n    .toLowerCase();\n  return prefix.startsWith(\"<svg\") || /^<\\?xml[\\s\\S]*<svg/u.test(prefix);\n}\n\nfunction mediaTypeFromPath(path: string): string | undefined {\n  const p = path?.trim().toLowerCase() ?? \"\";\n  if (p.endsWith(\".png\")) return \"image/png\";\n  if (p.endsWith(\".jpg\") || p.endsWith(\".jpeg\")) return \"image/jpeg\";\n  if (p.endsWith(\".gif\")) return \"image/gif\";\n  if (p.endsWith(\".webp\")) return \"image/webp\";\n  if (p.endsWith(\".bmp\")) return \"image/bmp\";\n  if (p.endsWith(\".tif\") || p.endsWith(\".tiff\")) return \"image/tiff\";\n  if (p.endsWith(\".svg\") || p.endsWith(\".svgz\")) return \"image/svg+xml\";\n  return undefined;\n}\n\n/** A random uint64-safe numeric nonce (the wire `PingRequest.nonce` is a uint64,\n *  represented as a numeric string by ts-proto). */\n/** The machine itself stopped answering (offline, reconnecting past the hold\n * window, or draining), as opposed to an answer that the operation failed. */\nfunction machineStoppedAnswering(error: SelfhostedControlError): boolean {\n  const faultClass = selfhostedFaultClass(error);\n  return faultClass === \"offline\" || faultClass === \"reconnecting\" || faultClass === \"draining\";\n}\n\nfunction randomNonce(): string {\n  // 2^53-safe random integer as a decimal string.\n  return String(Math.floor(Math.random() * Number.MAX_SAFE_INTEGER));\n}\n\nfunction kindToProtocol(kind: StreamKind | undefined): string {\n  switch (kind) {\n    case StreamKind.STREAM_KIND_PTY:\n      return \"pty\";\n    case StreamKind.STREAM_KIND_DESKTOP:\n      return \"vnc\";\n    default:\n      return \"raw\";\n  }\n}\n\n/**\n * The selfhosted NotFound discriminator — THE load-bearing safety property\n *: for selfhosted, `agent-offline` (no responder) is NEVER a\n * provider NotFound. A user's real machine is not recreatable; if the lease saw\n * agent-offline as NotFound it would cold-create a RIVAL box (a Modal box) for\n * the user's machine. So this ALWAYS returns FALSE for selfhosted — there is no\n * \"box gone, recreate it\" condition. An OS-level file NotFound is an op-level\n * error the fs layer 404s; it is likewise NOT a session-recreate condition.\n *\n * `establishSandboxSessionFromEnvelope` cold-restores ONLY when the per-backend\n * NotFound discriminator returns true; returning false here guarantees the\n * selfhosted path never cold-creates a rival — the op surfaces agent_offline and\n * the caller backs off / retries.\n */\nexport function isSelfhostedProviderNotFoundError(_error: unknown): false {\n  return false;\n}\n","import { blake3 } from \"@noble/hashes/blake3\";\nimport { bytesToHex } from \"@noble/hashes/utils\";\nimport { ControlRequest, ControlResponse, OpState } from \"@opengeni/agent-proto\";\nimport { agentErrorToControlError } from \"./control-rpc\";\n\n// Below the protocol's 512 KiB chunk maximum, leaving control-envelope headroom.\nexport const SELFHOSTED_FILE_CHUNK_BYTES = 256 * 1024;\n\nexport function fileContentDigest(content: Uint8Array): string {\n  return bytesToHex(blake3(content));\n}\n\nexport class FileTransferOutcomeError extends Error {\n  readonly retryable = false;\n  constructor(\n    readonly operationId: string,\n    readonly phase: \"begin\" | \"upload\" | \"verify\",\n    cause: unknown,\n    readonly observationError?: unknown,\n  ) {\n    const detail = cause instanceof Error ? cause.message : \"unknown failure\";\n    const observation =\n      observationError instanceof Error ? ` Outcome check: ${observationError.message}` : \"\";\n    super(\n      `File transfer ${operationId} ${phase} failed: ${detail}.${observation} No mutation was replayed; inspect the destination before another edit.`,\n      { cause },\n    );\n    this.name = \"FileTransferOutcomeError\";\n  }\n}\n\n/** The caller must reauthorize every request and keep the exact physical route.\n * No mutation is automatically replayed, including after an ambiguous reply. */\nexport async function transferEditorFile(input: {\n  path: string;\n  content: Uint8Array;\n  baseContent?: Uint8Array;\n  createParents?: boolean;\n  request: (requestId: string, op: NonNullable<ControlRequest[\"op\"]>) => Promise<ControlResponse>;\n}): Promise<{ recovered: boolean }> {\n  const opId = `fsw-${crypto.randomUUID()}`;\n  const digest = fileContentDigest(input.content);\n  const checked = (reply: ControlResponse) => {\n    if (reply.error) throw agentErrorToControlError(reply.error, reply.requestId);\n    if (!reply.result) throw new Error(\"The machine omitted the file-transfer result.\");\n    return reply.result;\n  };\n  const send = async (requestId: string, op: NonNullable<ControlRequest[\"op\"]>) => {\n    const reply = await input.request(requestId, op);\n    if (reply.requestId !== requestId)\n      throw new Error(\"The machine returned a mismatched file-transfer response identity.\");\n    return checked(reply);\n  };\n  const isVerified = (observed: NonNullable<ControlResponse[\"result\"]>): boolean =>\n    !(\n      observed.$case !== \"opStatus\" ||\n      observed.opStatus.opId !== opId ||\n      observed.opStatus.state !== OpState.OP_STATE_COMPLETE ||\n      observed.opStatus.exit?.exitCode !== 0 ||\n      observed.opStatus.exit.cancelled ||\n      observed.opStatus.exit.timedOut ||\n      observed.opStatus.exit.failureCode ||\n      observed.opStatus.exit.digests.content !== digest ||\n      observed.opStatus.exit.totals.content !== String(input.content.byteLength)\n    );\n  const verifyOutcome = async (cancelRunning = false): Promise<void> => {\n    const observed = await send(crypto.randomUUID(), { $case: \"opQuery\", opQuery: { opId } });\n    if (isVerified(observed)) return;\n    if (\n      cancelRunning &&\n      observed.$case === \"opStatus\" &&\n      observed.opStatus.opId === opId &&\n      observed.opStatus.state === OpState.OP_STATE_RUNNING\n    ) {\n      // This explicit transfer is being abandoned. Cancel only its known live\n      // identity through the same reauthorized callback; never sweep or expire\n      // other work. A commit racing cancellation must retain its real receipt.\n      const cancelled = await send(crypto.randomUUID(), { $case: \"opCancel\", opCancel: { opId } });\n      if (isVerified(cancelled)) return;\n      if (\n        cancelled.$case === \"opStatus\" &&\n        cancelled.opStatus.opId === opId &&\n        cancelled.opStatus.state === OpState.OP_STATE_COMPLETE &&\n        cancelled.opStatus.exit?.cancelled\n      ) {\n        throw new Error(\"Cancellation of the abandoned transfer's private staging was verified.\");\n      }\n    }\n    throw new Error(\n      \"The file-transfer outcome is not verified; the operation was not replayed. Inspect the destination before another edit.\",\n    );\n  };\n  let phase: \"begin\" | \"upload\" | \"verify\" = \"begin\";\n  try {\n    const begun = await send(opId, {\n      $case: \"opStart\",\n      opStart: {\n        op: {\n          $case: \"fsWrite\",\n          fsWrite: {\n            path: input.path,\n            createParents: input.createParents ?? true,\n            mode: 0,\n            expectedBaseDigest:\n              input.baseContent === undefined ? \"\" : fileContentDigest(input.baseContent),\n            expectedAbsent: input.baseContent === undefined,\n            contentDigest: digest,\n            contentSize: String(input.content.byteLength),\n          },\n        },\n        windowBytes: \"0\",\n        deadlineMs: \"0\",\n        originId: \"\",\n      },\n    });\n    if (\n      begun.$case !== \"opStart\" ||\n      !begun.opStart.accepted ||\n      begun.opStart.status?.opId !== opId\n    ) {\n      throw new Error(\"The machine did not accept the exact file-transfer operation.\");\n    }\n\n    phase = \"upload\";\n    let offset = 0;\n    let seq = 0;\n    do {\n      const end = Math.min(input.content.byteLength, offset + SELFHOSTED_FILE_CHUNK_BYTES);\n      const reply = await send(crypto.randomUUID(), {\n        $case: \"writeChunk\",\n        writeChunk: {\n          opId,\n          seq: String(seq),\n          offset: String(offset),\n          bytes: input.content.subarray(offset, end),\n          last: end === input.content.byteLength,\n        },\n      });\n      if (reply.$case !== \"writeChunk\" || reply.writeChunk.seq !== String(seq)) {\n        throw new Error(\n          \"The machine returned a mismatched file-transfer acknowledgment; no chunk was replayed.\",\n        );\n      }\n      offset = end;\n      seq += 1;\n    } while (offset < input.content.byteLength);\n    phase = \"verify\";\n    await verifyOutcome();\n  } catch (error) {\n    if (phase === \"verify\") throw new FileTransferOutcomeError(opId, phase, error);\n    // An acknowledgment can be lost after commit. Observe this exact operation\n    // once under current authority; never restart it or resend a chunk.\n    try {\n      await verifyOutcome(true);\n      return { recovered: true };\n    } catch (observationError) {\n      throw new FileTransferOutcomeError(opId, phase, error, observationError);\n    }\n  }\n  return { recovered: false };\n}\n","/** One request to an agent-owned browser/computer controller, addressed by its\n * exact authority scope rather than a local port. */\nexport type BrowserControlHttpCall = {\n  scopeId: string;\n  scopeGeneration: string;\n  method: \"GET\" | \"POST\" | \"PUT\" | \"DELETE\";\n  /** Absolute controller path with optional query. */\n  path: string;\n  bearerToken: string;\n  /** JSON request body bytes, when the request has a body. */\n  body?: Uint8Array;\n  timeoutMs: number;\n  maxResponseBytes: number;\n};\n\n/** What a placement transport did with one controller request. */\nexport type BrowserControlHttpOutcome =\n  /** The placement cannot serve it natively; nothing was sent. */\n  | { kind: \"unsupported\" }\n  /** No controller for that scope and generation accepted it; nothing was\n   * delivered, so the caller may ensure the controller and send again. */\n  | { kind: \"controller_absent\" }\n  | {\n      kind: \"response\";\n      status: number;\n      /** Lowercase header names. */\n      headers: Map<string, string>;\n      body: Uint8Array;\n    };\n\n/** Extra time beyond the request's own deadline for the reply to arrive. */\nexport const BROWSER_CONTROL_HTTP_REPLY_GRACE_MS = 5_000;\n","// The selfhosted control-op RETRY POLICY — a small, PURE decision function the\n// `SelfhostedSession.call()` loop consults after each control-plane reply.\n//\n// Before this, a typed AgentError surfaced straight to the model as a failed tool\n// call: a `DRAINING` backpressure rejection (the machine was momentarily at its\n// concurrent-work capacity) and a transient `TIMEOUT` / `agent_reconnecting` blip\n// both looked like hard failures even though the op never ran (DRAINING) or was a\n// pure read that is safe to re-issue (a read that timed out). This policy retries\n// exactly those two, with a hard safety line around anything that MUTATES state.\n//\n// It is intentionally a pure function (op kind + error + prior-retry counts +\n// injected jitter → a decision) so the whole retry matrix is unit-testable with no\n// clock, no transport, and no session. The sleep + jitter side effects live behind\n// the injected `SelfhostedRetryClock` so tests are deterministic.\n\nimport type { SelfhostedControlError } from \"./control-rpc\";\n\n/**\n * The read-only, idempotent-safe control ops that MAY be retried after a TIMEOUT\n * / `agent_reconnecting` blip.\n *\n * A timed-out request is AT-LEAST-ONCE on the wire: the agent may have RECEIVED\n * and fully EXECUTED the op before its reply was lost, so re-issuing it is only\n * safe when a second execution is observably identical to one — i.e. a pure read.\n * Every MUTATING op (`exec`, `git`, `fsWrite`/`fsMove`/`fsMkdir`/`fsRemove`, and\n * the pty/desktop input ops) is DELIBERATELY EXCLUDED: re-running a mutation that\n * already ran on the machine is a real correctness hazard (a duplicated write, a\n * second `git push`, a re-applied command). Only DRAINING (a pre-admission\n * rejection — see `decideSelfhostedRetry`) is safe to retry for those.\n */\nexport const SELFHOSTED_IDEMPOTENT_READONLY_OPS: ReadonlySet<string> = new Set([\n  \"ping\",\n  \"metrics\",\n  \"fsStat\",\n  \"fsList\",\n  \"fsRead\",\n]);\n\n/**\n * DRAINING is a pre-admission backpressure rejection (the op never started), so it\n * is safe to retry for ANY op kind. The budget is split by op class:\n *\n *  - NON-EXEC control ops (fs/git/desktop/pty) keep a SHORT budget — 3 retries,\n *    worst-case backoff 500+1000+2000 = 3.5s (≤5s). Their start latency matters\n *    (fs/git ops gate the model's next step), so a saturated machine should surface\n *    quickly rather than stall.\n *  - EXEC gets a LONG, patient budget — 10 retries, worst-case ≈55.5s (<60s). exec\n *    start is not latency-critical, and the agent-side admission pool is (until a\n *    later agent release) a FLAT 8 permits with no per-class split: a burst of slow\n *    execs can hold every permit and blanket-DRAIN all fs/git ops. A patient exec\n *    retry converts those DRAINING storms into mild queueing instead of a wall of\n *    failed tool calls, and pairs with the deliberately modest exec deadline (which,\n *    for the same 8-permit reason, defaults to 2min, not 5).\n */\nexport const SELFHOSTED_DRAINING_MAX_RETRIES = 3;\nexport const SELFHOSTED_EXEC_DRAINING_MAX_RETRIES = 10;\n/** A read-only op that timed out is retried at most once (see the at-least-once\n *  note above — even a read gets a single re-issue, not an unbounded loop). */\nexport const SELFHOSTED_TIMEOUT_MAX_RETRIES = 1;\n/** A fault the transport synthesized PRE-SEND (no connection / no responder) — the\n *  op provably never reached the machine, so it is safe to re-issue for ANY op kind.\n *  Short bounded budget (≈3.5s summed): enough to ride out a NATS reconnect blip\n *  quietly, not so long it stalls the model on a machine that is genuinely down. */\nexport const SELFHOSTED_NEVER_SENT_MAX_RETRIES = 3;\n\n/** Full-jitter backoff base (ms). Delay N is sampled in `[0, base * factor^N)`. */\nexport const SELFHOSTED_RETRY_BACKOFF_BASE_MS = 500;\nexport const SELFHOSTED_RETRY_BACKOFF_FACTOR = 2;\n/** Per-delay ceiling: 500 → 1s → 2s → 4s → 8s, then flat at 8s. Bounds the summed\n *  backoff — non-exec (3 retries) ≈3.5s ≤5s; exec (10 retries) ≈55.5s <60s. */\nexport const SELFHOSTED_RETRY_BACKOFF_CAP_MS = 8_000;\n\nexport type SelfhostedRetryDecision =\n  | { readonly action: \"fail\" }\n  | { readonly action: \"retry\"; readonly delayMs: number };\n\n/**\n * Full-jitter exponential backoff. Returns a delay in\n * `[0, min(cap, base * factor^attempt))`. `jitter` is an injected sample in\n * `[0, 1)` so the delay is fully deterministic under test.\n */\nexport function selfhostedRetryBackoffMs(attempt: number, jitter: number): number {\n  const uncapped = SELFHOSTED_RETRY_BACKOFF_BASE_MS * SELFHOSTED_RETRY_BACKOFF_FACTOR ** attempt;\n  const ceiling = Math.min(SELFHOSTED_RETRY_BACKOFF_CAP_MS, uncapped);\n  const clampedJitter = Math.min(0.999_999, Math.max(0, jitter));\n  return Math.floor(clampedJitter * ceiling);\n}\n\n/**\n * PURE retry policy for one selfhosted control-op reply.\n *\n *  - `error.draining` (DRAINING — pre-admission host-work backpressure; the op was\n *    rejected at the pool gate and NEVER started) → retry for ANY op kind, since\n *    nothing executed. exec gets the long `SELFHOSTED_EXEC_DRAINING_MAX_RETRIES`\n *    budget (≈60s of patient queueing under the flat 8-permit pool); every other op\n *    keeps the short `SELFHOSTED_DRAINING_MAX_RETRIES` budget (≤5s).\n *  - `error.neverSent` (a pre-send AGENT_OFFLINE synthesis — no connection / no\n *    responder; the op provably never reached the machine) → retry for ANY op kind\n *    up to `SELFHOSTED_NEVER_SENT_MAX_RETRIES`. At-least-once does NOT apply (nothing\n *    executed), so even a mutation is safe to re-issue; this heals a NATS reconnect\n *    blip quietly. A truly-offline machine surfaces honestly after the short budget.\n *  - `error.reason === \"agent_reconnecting\"` (a TIMEOUT / transient blip AFTER send)\n *    → retry at most `SELFHOSTED_TIMEOUT_MAX_RETRIES`, and ONLY for a read-only\n *    idempotent-safe op (`SELFHOSTED_IDEMPOTENT_READONLY_OPS`). A timed-out\n *    MUTATION is never retried here — it may already have run (at-least-once).\n *  - Everything else → no retry at this layer:\n *      · FENCED is retried by the routing proxy against a RE-RESOLVED backend\n *        (retrying here under the same stale epoch would just re-fence);\n *      · AGENT_OFFLINE / OS / PROTOCOL / PAYLOAD_TOO_LARGE / CONSENT_REQUIRED are\n *        not transient and must surface to the caller.\n *\n * The draining and timeout budgets are SEPARATE counters so a read that first hit\n * backpressure still keeps its single timeout re-issue (and vice versa); both are\n * bounded, so the total number of attempts — and the summed backoff — is bounded.\n */\nexport function decideSelfhostedRetry(input: {\n  opKind: string;\n  error: SelfhostedControlError;\n  drainingRetries: number;\n  timeoutRetries: number;\n  /** Prior never-sent retries. Optional (default 0) — only the pre-send AGENT_OFFLINE\n   *  branch reads it, so callers that cannot hit that class may omit it. */\n  neverSentRetries?: number;\n  jitter: number;\n}): SelfhostedRetryDecision {\n  const { opKind, error, drainingRetries, timeoutRetries, neverSentRetries = 0, jitter } = input;\n\n  if (error.neverSent) {\n    // Provably not executed (the request never reached the machine) → safe to\n    // re-issue for ANY op kind. Bounded so a genuinely-offline machine surfaces\n    // honestly rather than hanging the turn.\n    if (neverSentRetries >= SELFHOSTED_NEVER_SENT_MAX_RETRIES) {\n      return { action: \"fail\" };\n    }\n    return { action: \"retry\", delayMs: selfhostedRetryBackoffMs(neverSentRetries, jitter) };\n  }\n\n  if (error.draining) {\n    // exec is patient (the flat 8-permit pool needs longer than 5s to free a slot);\n    // every other op keeps the short budget so fs/git latency stays snappy.\n    const maxDrainingRetries =\n      opKind === \"exec\" ? SELFHOSTED_EXEC_DRAINING_MAX_RETRIES : SELFHOSTED_DRAINING_MAX_RETRIES;\n    if (drainingRetries >= maxDrainingRetries) {\n      return { action: \"fail\" };\n    }\n    return { action: \"retry\", delayMs: selfhostedRetryBackoffMs(drainingRetries, jitter) };\n  }\n\n  if (error.reason === \"agent_reconnecting\") {\n    if (!SELFHOSTED_IDEMPOTENT_READONLY_OPS.has(opKind)) {\n      // A timed-out mutation may already have executed on the machine — never\n      // re-issue it (at-least-once). Surface the reconnecting error instead.\n      return { action: \"fail\" };\n    }\n    if (timeoutRetries >= SELFHOSTED_TIMEOUT_MAX_RETRIES) {\n      return { action: \"fail\" };\n    }\n    return { action: \"retry\", delayMs: selfhostedRetryBackoffMs(timeoutRetries, jitter) };\n  }\n\n  return { action: \"fail\" };\n}\n\n/**\n * The injected clock the retry loop drives — real in production, a deterministic\n * fake in tests. `jitter()` returns a full-jitter sample in `[0, 1)`.\n */\nexport interface SelfhostedRetryClock {\n  sleep(ms: number): Promise<void>;\n  jitter(): number;\n}\n\n/** The production clock: a real timer + `Math.random()` jitter. */\nexport const defaultSelfhostedRetryClock: SelfhostedRetryClock = {\n  sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),\n  jitter: () => Math.random(),\n};\n","// The op-stream EXEC client (op-stream protocol v1.1, server half; PROTOCOL.md\n// + ENGINE-INTEGRATION.md step 6 in .agent/).\n//\n// Replaces monolithic exec request/reply with sequenced, acked,\n// credit-flowed frames when the runner advertises `Capabilities.op_stream` AND\n// the server flag is on. What it buys, in order of importance:\n//\n//   * ATTACH-NOT-RERUN (B1/B2): the op id is durable (`{tool_call_id}:{ordinal}`)\n//     and OpStart is idempotent by it — a re-dispatched turn that re-executes the\n//     same function_call COLLECTS the already-running/completed op instead of\n//     re-running the command. The at-least-once re-run hazard dies here.\n//   * No reply-size wall: output streams in ≤128 KiB frames; the runner retains\n//     ring→spool for replay, and a too-big stream fails TYPED (OP_OVERFLOW with\n//     exact counters), never silently truncated.\n//   * Blip tolerance: a connection loss detaches, never kills; frames resume via\n//     OpAttach replay (gap-triggered attach is a ROUTINE heal, incl. seq-0 loss).\n//\n// ACK POLICY (design delta Δ2, DESIGN-OPSTREAM-CLIENT.md): mid-op acks are\n// CREDIT-ONLY — `OpAck{acked_seq: 0, credit_bytes: received_total + window}`.\n// The runner FREES retained frames at acked_seq, and a re-dispatched consumer\n// must reassemble from seq 0 (its predecessor's buffered bytes died with it),\n// so no mid-op acked_seq > 0 is ever durably backed. Credit is an ABSOLUTE\n// window replacement on the wire, so growing it keeps the child flowing while\n// the runner retains everything (bounded by its ring+spool quotas — the honest\n// output ceiling, typed when hit). The acked frontier advances exactly once,\n// at the FINAL ack, after the consumed result is durable (the hard gate's\n// ordering: result durable → journal persist → wire final ack — see\n// `finalizeSettledOps`).\n//\n// Everything above the transport is unchanged: the caller builds the same\n// `ExecRequest`, receives the same `ExecResponse` shape, and every failure is a\n// `SelfhostedControlError` in the existing taxonomy so the fault renderer and\n// the op observer behave identically across the transport swap.\n\nimport { blake3 } from \"@noble/hashes/blake3\";\nimport { bytesToHex } from \"@noble/hashes/utils\";\nimport { currentOpToolCallId } from \"../op-correlation\";\nimport {\n  ControlRequest,\n  ErrorCode,\n  OpAck,\n  OpChannel,\n  OpFrame,\n  OpLostReason,\n  OpState,\n  type ExecRequest,\n  type ExecResponse,\n  type OperationResourcePolicy,\n  type OpExit,\n  type OpStatus,\n} from \"@opengeni/agent-proto\";\nimport {\n  agentErrorToControlError,\n  SelfhostedControlError,\n  timeoutAgentError,\n  type ControlRpc,\n} from \"./control-rpc\";\nimport { selfhostedRetryBackoffMs, type SelfhostedRetryClock } from \"./retry-policy\";\nimport {\n  opAckSubject,\n  opFrameSubject,\n  OpStreamUnavailableError,\n  type OpStreamSubscription,\n  type OpStreamTransport,\n} from \"./op-transport\";\n\n/** Initial send-credit window (bytes) when the caller does not size it. Matches\n *  the wire default OpStart advertises (~4 MiB). */\nexport const OP_STREAM_DEFAULT_WINDOW_BYTES = 4 * 1024 * 1024;\n/** Cumulative-ack repetition cadence while an op is live (ruling M1: acks are\n *  best-effort and healed by repetition). */\nexport const OP_STREAM_ACK_INTERVAL_MS = 5_000;\n/** Frame-silence threshold before the client starts probing with OpQuery. The\n *  runner emits Progress every 5s while an op is alive and quiet, so 30s of\n *  TOTAL silence means frames are not reaching us (or the op is gone). */\nexport const OP_STREAM_SILENCE_TIMEOUT_MS = 30_000;\n/** How long a silent op is held open across a machine reconnect window before\n *  the client fails it typed (PROTOCOL liveness rule: hold ≤120s, then only a\n *  definitive answer fails the op). */\nexport const OP_STREAM_RECONNECT_HOLD_MS = 120_000;\n/** A detached background consumer grants the runner the complete uint64 credit\n * range. Retention remains bounded by the runner's ring/spool quotas, so a noisy\n * command reaches the existing typed OP_OVERFLOW terminal instead of stalling\n * forever merely because the turn that launched it finished. */\nconst OP_STREAM_BACKGROUND_CREDIT_BYTES = \"18446744073709551615\";\n/** The out-of-order stash is a disposable replay optimization, never retained\n *  command output. Bound it in bytes to two live-flow windows per op: a gap that\n *  outgrows that cache drops the cache and heals from the runner's authoritative\n *  retention log. This scales with the negotiated stream window and cannot turn\n *  100 concurrent quiet gaps into a multi-gigabyte frame-count allocation. */\nconst OP_STREAM_STASH_WINDOW_MULTIPLIER = 2;\n/** OpStart DRAINING retry budget (retry-policy.ts): op start is not\n *  latency-critical and a saturated machine should queue, not fail. OpStart\n *  is idempotent by op id, so pre-dispatch timeout blips are also safe to\n *  re-issue with the same small bounded budget. */\nconst OP_START_DRAINING_MAX_RETRIES = 10;\nconst OP_START_BLIP_MAX_RETRIES = 3;\n\n/**\n * The durable-resume journal the worker adapts onto Temporal (design delta Δ1:\n * the attach generation is `Info.currentAttemptScheduledTimestampMs` — strictly\n * monotonic across worker-death redispatches, which `Info.attempt` is NOT under\n * `maximumAttempts: 1`). `persistSettled` folds the op's settled frontier into\n * the activity heartbeat details and MUST complete before the wire final ack\n * (the durable-before-wire-ack gate); the default no-journal client (tests,\n * non-activity callers) uses generation \"1\" and skips persistence.\n */\nexport interface OpStreamJournal {\n  /** The consumer's attach generation (u64 decimal string). */\n  attachGeneration(): string;\n  /** Durably record `opId` as settled at `exitSeq` BEFORE its final ack. */\n  persistSettled(opId: string, exitSeq: string): void | Promise<void>;\n}\n\nexport interface OpStreamExecClientDeps {\n  workspaceId: string;\n  agentId: string;\n  /** Exact live daemon instance pinned at operation admission. */\n  connectionInstanceId: string;\n  /** The lease/active epoch every ControlRequest is fenced under. */\n  epoch: number;\n  /** The rpc request/reply seam (OpStart/OpQuery/OpAttach ride here). */\n  controlRpc: ControlRpc;\n  /** The exact claimed process RPC subject. */\n  rpcSubject: string;\n  /** The frame/ack seam (subscribe + publish). */\n  transport: OpStreamTransport;\n  journal?: OpStreamJournal;\n  windowBytes?: number;\n  /** Control-op round-trip timeout for OpStart/OpQuery/OpAttach (the SHORT\n   *  control budget, not the exec deadline). */\n  controlTimeoutMs: number;\n  /** The retry clock (sleep + jitter), injected for deterministic tests. */\n  retryClock: SelfhostedRetryClock;\n  ackIntervalMs?: number;\n  silenceTimeoutMs?: number;\n  reconnectHoldMs?: number;\n  /** Per-connection policy snapshot attached only to OpStart. Lifecycle controls\n   * identify an already-admitted operation and must not imply a policy change. */\n  resourcePolicy?: OperationResourcePolicy;\n  /** Revalidate the exact live route/authority immediately before every\n   * physical OpStart dispatch. An already-accepted or outcome-ambiguous\n   * operation never calls this hook again. */\n  revalidateBeforeStartRetry?: () => void | Promise<void>;\n}\n\n/** A completed op-stream exec: the SDK-facing response plus the healing\n *  telemetry the session folds into its op observation. */\nexport interface OpStreamExecOutcome {\n  response: ExecResponse;\n  /** Runner transport failure is independent of the process exit code. */\n  failure?: Pick<OpExit, \"failureCode\" | \"failureDetail\">;\n  /** Attach/query heals that occurred after streaming began (gap replays,\n   *  silence probes that re-attached). >0 marks the op `healed`. */\n  heals: number;\n  /** OpStart-level retries (draining/blip) before the op was accepted. */\n  startRetries: number;\n  /** Total reassembled Data payload bytes (the observer's replyBytes). */\n  replyBytes: number;\n}\n\nexport type OpStreamExecResult =\n  | { status: \"completed\"; outcome: OpStreamExecOutcome }\n  | {\n      status: \"running\";\n      opId: string;\n      stdout: Uint8Array;\n      stderr: Uint8Array;\n      heals: number;\n      startRetries: number;\n      replyBytes: number;\n      /** Terminal proof may race durable adoption. The caller must settle the\n       * adopted command but still return only its background receipt. */\n      terminal?: {\n        outcome: OpStreamExecOutcome;\n        exitSeq: string;\n        outputReceipt?: OpStreamOutputReceipt;\n      };\n    };\n\n/** Produced only after contiguous replay, byte verification and awaited capture.\n * The caller must persist this under its exact command before releasing output. */\nexport type OpStreamOutputReceipt = { exitSeq: string; attachGeneration: string };\n\nexport type OpStreamYieldOptions = {\n  yieldMs: number;\n  /** Durable ownership transfer. It runs while the exact consumer is still\n   * attached; returning a running result is forbidden until this resolves. */\n  onYield: () => void | Promise<void>;\n  captureOutput?: (frames: OpStreamOutputFrame[]) => Promise<void>;\n};\n\nexport type OpStreamOutputFrame = { sequence: string; stream: \"stdout\" | \"stderr\"; chunk: string };\n\nexport type ExactSelfhostedOpControlInput = {\n  controlRpc: ControlRpc;\n  rpcSubject: string;\n  opId: string;\n  controlTimeoutMs: number;\n};\n\nasync function exactSelfhostedOpControl(\n  input: ExactSelfhostedOpControlInput,\n  operation: \"query\" | \"cancel\",\n): Promise<OpStatus> {\n  const requestId = crypto.randomUUID();\n  const response = await input.controlRpc.request(\n    input.rpcSubject,\n    {\n      requestId,\n      // Exact lifecycle control is pinned by subject + op id. It deliberately\n      // bypasses the mutable session-route epoch so a later machine swap cannot\n      // fence observation/cancellation of an already-adopted command.\n      epoch: 0,\n      resourcePolicy: undefined,\n      op:\n        operation === \"query\"\n          ? { $case: \"opQuery\", opQuery: { opId: input.opId } }\n          : { $case: \"opCancel\", opCancel: { opId: input.opId } },\n    },\n    { timeoutMs: input.controlTimeoutMs },\n  );\n  if (response.error || !response.result) {\n    throw agentErrorToControlError(\n      response.error ?? {\n        code: ErrorCode.ERROR_CODE_PROTOCOL,\n        message: `op-stream ${operation} returned an empty result`,\n        retryable: false,\n        detail: {},\n      },\n      requestId,\n    );\n  }\n  if (response.result.$case !== \"opStatus\") {\n    throw protocolError(`op-stream ${operation}: unexpected result ${response.result.$case}`);\n  }\n  if (response.result.opStatus.opId !== input.opId) {\n    throw protocolError(`op-stream ${operation}: status identity mismatch for ${input.opId}`);\n  }\n  return response.result.opStatus;\n}\n\n/** Query one durably adopted operation at its immutable physical locator. */\nexport async function querySelfhostedOp(input: ExactSelfhostedOpControlInput): Promise<OpStatus> {\n  return await exactSelfhostedOpControl(input, \"query\");\n}\n\n/** Cancel one durably adopted operation at its immutable physical locator. */\nexport async function cancelSelfhostedOp(input: ExactSelfhostedOpControlInput): Promise<OpStatus> {\n  return await exactSelfhostedOpControl(input, \"cancel\");\n}\n\n/** One op settled but not yet final-acked (awaiting its result's durable point). */\ninterface SettledOp {\n  opId: string;\n  exitSeq: string;\n  generation: string;\n  toolCallId: string | null;\n}\n\nconst OP_CHANNEL_NAMES: Partial<Record<OpChannel, \"stdout\" | \"stderr\">> = {\n  [OpChannel.OP_CHANNEL_STDOUT]: \"stdout\",\n  [OpChannel.OP_CHANNEL_STDERR]: \"stderr\",\n};\n\n/**\n * The per-session op-stream exec client. One instance per `SelfhostedSession`;\n * `exec()` runs one op end-to-end; `finalizeSettledOps()` is the durability hook\n * that advances the acked frontier durably (journal) and then on the wire.\n */\nexport class OpStreamExecClient {\n  private readonly deps: OpStreamExecClientDeps;\n  private readonly settled: SettledOp[] = [];\n  private readonly inFlight = new Set<string>();\n  private readonly readCheckpoints = new Map<string, OpReadCheckpoint>();\n  private finalization: Promise<void> = Promise.resolve();\n  private lastReadGeneration = 0n;\n\n  constructor(deps: OpStreamExecClientDeps) {\n    this.deps = deps;\n  }\n\n  private generation(): string {\n    return this.deps.journal?.attachGeneration() ?? \"1\";\n  }\n\n  /** Adopted-command reads are new consumers, not recovery of the launching\n   * activity. Use the same epoch-millisecond generation domain as reconciliation\n   * so a later owning-runtime read can follow a reaper attach. Execution and\n   * its recovery continue to use the immutable journal generation. Equal\n   * generations are accepted by the runner; never decrease within this client. */\n  private readGeneration(): string {\n    const journal = BigInt(this.generation());\n    const now = BigInt(Date.now());\n    this.lastReadGeneration = [this.lastReadGeneration, journal, now].reduce(\n      (highest, generation) => (generation > highest ? generation : highest),\n      1n,\n    );\n    return this.lastReadGeneration.toString();\n  }\n\n  /**\n   * Cancel an exec by its durable op id. OpCancel is idempotent and also acts\n   * as a cancel-before-start tombstone, so calling this while OpStart is still\n   * racing is safe: the runner either kills the accepted process tree or\n   * refuses the later start without spawning it.\n   */\n  async cancel(opId: string): Promise<void> {\n    const response = await this.deps.controlRpc.request(\n      this.deps.rpcSubject,\n      {\n        requestId: crypto.randomUUID(),\n        epoch: this.deps.epoch,\n        resourcePolicy: undefined,\n        op: { $case: \"opCancel\", opCancel: { opId } },\n      },\n      { timeoutMs: this.deps.controlTimeoutMs },\n    );\n    if (response.error || !response.result) {\n      throw agentErrorToControlError(\n        response.error ?? {\n          code: ErrorCode.ERROR_CODE_PROTOCOL,\n          message: \"op-stream cancel returned an empty result\",\n          retryable: false,\n          detail: {},\n        },\n      );\n    }\n    if (response.result.$case !== \"opStatus\") {\n      throw protocolError(`op-stream cancel: unexpected result ${response.result.$case}`);\n    }\n  }\n\n  /**\n   * Run one exec over the op stream. `opId` is the durable id (B1) — a re-issue\n   * with the same id attaches instead of re-running. `deadlineMs` is the exec\n   * process budget (relative); the runner's enforcement is authoritative.\n   * `wallMs` is the client-side give-up wall (deadline + reply grace); 0 means\n   * no duration wall. Liveness probing and explicit cancellation still apply.\n   */\n  async exec(\n    opId: string,\n    exec: ExecRequest,\n    deadlineMs: number,\n    wallMs: number,\n  ): Promise<OpStreamExecOutcome> {\n    const result = await this.execWithYield(opId, exec, deadlineMs, wallMs, null);\n    if (result.status !== \"completed\") {\n      throw protocolError(\"op-stream terminal exec unexpectedly yielded\");\n    }\n    return result.outcome;\n  }\n\n  /** Run an exec that may transfer to durable session ownership after one\n   * bounded model-facing wait. Adoption is inside the live consumer boundary:\n   * a failure cancels the exact op and waits for terminal proof before throwing,\n   * so an outcome-unknown command is never forgotten or replayed. */\n  async execWithYield(\n    opId: string,\n    exec: ExecRequest,\n    deadlineMs: number,\n    wallMs: number,\n    yieldOptions: OpStreamYieldOptions | null,\n  ): Promise<OpStreamExecResult> {\n    if (this.inFlight.has(opId)) {\n      throw new SelfhostedControlError({\n        message: `op-stream exec: duplicate concurrent op id ${opId}`,\n        code: ErrorCode.ERROR_CODE_PROTOCOL,\n        reason: null,\n        retryable: false,\n      });\n    }\n    this.inFlight.add(opId);\n    const toolCallId = currentOpToolCallId();\n    try {\n      const consumer = new OpConsumer(this.deps, opId, this.generation());\n      try {\n        const result = await consumer.run(exec, deadlineMs, wallMs, yieldOptions);\n        if (result.status === \"completed\") {\n          this.settled.push({\n            opId,\n            exitSeq: result.exitSeq,\n            generation: consumer.generation,\n            toolCallId,\n          });\n          return { status: \"completed\", outcome: result.outcome };\n        }\n        return result;\n      } finally {\n        consumer.teardown();\n      }\n    } finally {\n      this.inFlight.delete(opId);\n    }\n  }\n\n  /** Observe an already-adopted operation. Never issues OpStart, cancellation,\n   * final ACK, or terminal model-observation acknowledgment. Output is delivered\n   * through captureOutput, not accumulated in response stdout/stderr. Successful\n   * running reads reuse local integrity state; a new client replays from zero. */\n  async readExisting(\n    opId: string,\n    yieldMs: number,\n    captureOutput: (frames: OpStreamOutputFrame[]) => Promise<void>,\n  ): Promise<\n    OpStreamExecResult & { replaySequence: string; outputReceipt?: OpStreamOutputReceipt }\n  > {\n    if (this.inFlight.has(opId)) throw protocolError(\"op-stream read: duplicate concurrent op id\");\n    const consumer = new OpConsumer(\n      this.deps,\n      opId,\n      this.readGeneration(),\n      this.readCheckpoints.get(opId),\n    );\n    this.inFlight.add(opId);\n    this.readCheckpoints.delete(opId);\n    try {\n      const result = await consumer.run(\n        null,\n        0,\n        Math.max(yieldMs + this.deps.controlTimeoutMs, 1000),\n        {\n          yieldMs: Math.max(1, yieldMs),\n          onYield: () => {},\n          captureOutput,\n        },\n      );\n      // Only a successful capture may advance this local replay optimization.\n      // A fresh client or failed persistence always replays retained truth.\n      consumer.teardown();\n      if (result.status === \"running\" && !result.terminal) {\n        this.readCheckpoints.set(opId, consumer.readCheckpoint());\n      }\n      // Progress/partial UTF-8 frames can advance verified replay without\n      // producing a decoded output chunk. Expose the contiguous protocol\n      // frontier only after capture succeeds, never the provider high watermark.\n      const replaySequence = consumer.readCheckpoint().lastApplied.toString();\n      return result.status === \"completed\"\n        ? {\n            status: \"completed\",\n            outcome: result.outcome,\n            replaySequence,\n            outputReceipt: { exitSeq: result.exitSeq, attachGeneration: consumer.generation },\n          }\n        : { ...result, replaySequence };\n    } finally {\n      consumer.teardown();\n      this.inFlight.delete(opId);\n    }\n  }\n\n  /** Release only an independently persisted, fully captured background exit.\n   * Re-attach under a fresh generation before ACK so an intervening reader cannot\n   * strand a stale ACK. Never starts, cancels, replays output or observes a model\n   * result. A publish is not native delivery proof: retry until an exact control\n   * observation establishes that the operation is no longer retained. */\n  async releaseCapturedOutput(\n    opId: string,\n    receipt: OpStreamOutputReceipt,\n  ): Promise<\"published\" | \"not_retained\"> {\n    const u64 = (value: string): bigint => {\n      if (!/^[1-9][0-9]{0,19}$/.test(value) || BigInt(value) > 18446744073709551615n)\n        throw protocolError(\"op-stream output release: invalid retained frontier\");\n      return BigInt(value);\n    };\n    const exitSeq = u64(receipt.exitSeq);\n    const previousGeneration = u64(receipt.attachGeneration);\n    const currentGeneration = u64(this.readGeneration());\n    const generation = (\n      currentGeneration > previousGeneration ? currentGeneration : previousGeneration + 1n\n    ).toString();\n    u64(generation);\n    const requestId = crypto.randomUUID();\n    const response = await this.deps.controlRpc.request(\n      this.deps.rpcSubject,\n      {\n        requestId,\n        epoch: 0,\n        resourcePolicy: undefined,\n        op: {\n          $case: \"opAttach\",\n          opAttach: {\n            opId,\n            fromSeq: receipt.exitSeq,\n            attachGeneration: generation,\n            windowBytes: \"1\",\n          },\n        },\n      },\n      { timeoutMs: this.deps.controlTimeoutMs },\n    );\n    if (response.error || !response.result)\n      throw agentErrorToControlError(\n        response.error ?? {\n          code: ErrorCode.ERROR_CODE_PROTOCOL,\n          message: \"op-stream output release returned an empty result\",\n          retryable: false,\n          detail: {},\n        },\n      );\n    if (response.result.$case !== \"opStatus\" || response.result.opStatus.opId !== opId)\n      throw protocolError(\"op-stream output release: status identity mismatch\");\n    const status = response.result.opStatus;\n    if (status.state === OpState.OP_STATE_LOST) return \"not_retained\";\n    if (\n      status.state !== OpState.OP_STATE_COMPLETE ||\n      !status.exit ||\n      !/^[0-9]+$/.test(status.nextSeq) ||\n      BigInt(status.nextSeq) !== exitSeq + 1n\n    )\n      throw protocolError(\"op-stream output release: durable exit frontier disagrees with runner\");\n    await this.deps.transport.publish(\n      opAckSubject(this.deps.workspaceId, this.deps.agentId, this.deps.connectionInstanceId),\n      OpAck.encode({\n        opId,\n        ackedSeq: receipt.exitSeq,\n        creditBytes: \"0\",\n        final: true,\n        attachGeneration: generation,\n      }).finish(),\n    );\n    return \"published\";\n  }\n\n  /**\n   * The result durability hook (the hard gate's ordering): for every op whose\n   * result the caller has durably consumed — (1) already true when this runs —\n   * (2) persist the settled frontier to the journal, then (3) publish the wire\n   * final ack (`acked_seq = exit_seq, final = true`), which licenses the runner\n   * to GC the op. A kill between (2) and (3) is safe: the re-dispatched turn\n   * does not re-execute a durably-recorded call, and the runner's retention TTL\n   * reaps the never-final-acked op — no loss, bounded residue. A supplied call\n   * list selects only those exact result owners; omitted means the complete\n   * turn/API boundary. Snapshot before I/O so later completions cannot become\n   * eligible accidentally. Failed persistence/publish leaves the op retryable.\n   */\n  async finalizeSettledOps(toolCallIds?: readonly string[]): Promise<void> {\n    const selected = toolCallIds === undefined ? null : new Set(toolCallIds);\n    const eligible = this.settled.filter(\n      (op) => selected === null || (op.toolCallId !== null && selected.has(op.toolCallId)),\n    );\n    const finalization = this.finalization.then(() => this.finalizeOps(eligible));\n    // Serialize overlapping durability hooks without letting one failed\n    // journal poison later attempts to finalize the same retained frontier.\n    this.finalization = finalization.catch(() => undefined);\n    await finalization;\n  }\n\n  private async finalizeOps(eligible: readonly SettledOp[]): Promise<void> {\n    const ackSubject = opAckSubject(\n      this.deps.workspaceId,\n      this.deps.agentId,\n      this.deps.connectionInstanceId,\n    );\n    for (const op of eligible) {\n      // A preceding queued hook may already have acknowledged this object.\n      if (!this.settled.includes(op)) continue;\n      await this.deps.journal?.persistSettled(op.opId, op.exitSeq);\n      const ack = OpAck.encode({\n        opId: op.opId,\n        ackedSeq: op.exitSeq,\n        creditBytes: \"0\",\n        final: true,\n        attachGeneration: op.generation,\n      }).finish();\n      try {\n        await this.deps.transport.publish(ackSubject, ack);\n      } catch {\n        // Retry at a later durability hook; the runner's TTL is the backstop.\n        continue;\n      }\n      this.settled.splice(this.settled.indexOf(op), 1);\n    }\n  }\n}\n\n/** In-memory only: never licenses runner GC or substitutes for durable output. */\ntype OpReadCheckpoint = {\n  lastApplied: bigint;\n  hashes: { stdout: ReturnType<typeof blake3.create>; stderr: ReturnType<typeof blake3.create> };\n  totals: { stdout: bigint; stderr: bigint };\n  decoders: { stdout: TextDecoder; stderr: TextDecoder };\n};\n\n/** Internal per-op consumer: subscription, reassembly, flow, liveness. */\nclass OpConsumer {\n  private readonly deps: OpStreamExecClientDeps;\n  private readonly opId: string;\n  readonly generation: string;\n  private readonly windowBytes: number;\n\n  /** Highest contiguously APPLIED seq (frames start at 1; 0 = none yet). */\n  private lastApplied = 0n;\n  private readonly stash = new Map<bigint, { frame: OpFrame; wireBytes: number }>();\n  private stashedWireBytes = 0;\n  private readonly chunks: { stdout: Uint8Array[]; stderr: Uint8Array[] } = {\n    stdout: [],\n    stderr: [],\n  };\n  private readonly outputFrames: OpStreamOutputFrame[] = [];\n  private readonly outputDecoders = { stdout: new TextDecoder(), stderr: new TextDecoder() };\n  private readonly hashes = { stdout: blake3.create(), stderr: blake3.create() };\n  private readonly totals = { stdout: 0n, stderr: 0n };\n  private captureOnly = false;\n  private receivedPayloadBytes = 0n;\n  private creditAtLastAck = 0n;\n  private exit: OpExit | undefined;\n  private exitSeq: bigint | undefined;\n  private heals = 0;\n  private lastFrameAt: number;\n  private silenceSince: number | undefined;\n  private attachInFlight = false;\n  private subscription: OpStreamSubscription | undefined;\n  private ackTimer: ReturnType<typeof setInterval> | undefined;\n  private settleResolve: (() => void) | undefined;\n  private settleReject: ((error: unknown) => void) | undefined;\n  private torn = false;\n\n  constructor(\n    deps: OpStreamExecClientDeps,\n    opId: string,\n    generation: string,\n    checkpoint?: OpReadCheckpoint,\n  ) {\n    this.deps = deps;\n    this.opId = opId;\n    this.generation = generation;\n    this.windowBytes = deps.windowBytes ?? OP_STREAM_DEFAULT_WINDOW_BYTES;\n    this.lastFrameAt = Date.now();\n    if (checkpoint) {\n      this.lastApplied = checkpoint.lastApplied;\n      this.hashes = checkpoint.hashes;\n      this.totals = checkpoint.totals;\n      this.outputDecoders = checkpoint.decoders;\n    }\n  }\n\n  readCheckpoint(): OpReadCheckpoint {\n    return {\n      lastApplied: this.lastApplied,\n      hashes: this.hashes,\n      totals: this.totals,\n      decoders: this.outputDecoders,\n    };\n  }\n\n  private get ackIntervalMs(): number {\n    return this.deps.ackIntervalMs ?? OP_STREAM_ACK_INTERVAL_MS;\n  }\n  private get silenceTimeoutMs(): number {\n    return this.deps.silenceTimeoutMs ?? OP_STREAM_SILENCE_TIMEOUT_MS;\n  }\n  private get reconnectHoldMs(): number {\n    return this.deps.reconnectHoldMs ?? OP_STREAM_RECONNECT_HOLD_MS;\n  }\n\n  teardown(): void {\n    this.torn = true;\n    if (this.ackTimer) {\n      clearInterval(this.ackTimer);\n      this.ackTimer = undefined;\n    }\n    this.subscription?.unsubscribe();\n    this.subscription = undefined;\n  }\n\n  async run(\n    exec: ExecRequest | null,\n    deadlineMs: number,\n    wallMs: number,\n    yieldOptions: OpStreamYieldOptions | null,\n  ): Promise<\n    | {\n        status: \"completed\";\n        outcome: OpStreamExecOutcome;\n        exitSeq: string;\n      }\n    | Extract<OpStreamExecResult, { status: \"running\" }>\n  > {\n    this.captureOnly = exec === null;\n    // Arm the settle promise FIRST: frames can start applying the moment the\n    // attach below returns (replay is asynchronous), and a completion that\n    // fires before the resolver exists would strand the op on its wall.\n    const settled = new Promise<void>((resolve, reject) => {\n      this.settleResolve = resolve;\n      this.settleReject = reject;\n    });\n\n    // Subscription BEFORE OpStart (protocol invariant): no frame can be\n    // published before the consumer exists on a healthy path.\n    this.subscription = await this.deps.transport.subscribe(\n      opFrameSubject(\n        this.deps.workspaceId,\n        this.deps.agentId,\n        this.opId,\n        this.deps.connectionInstanceId,\n      ),\n      (payload) => this.onFramePayload(payload),\n    );\n\n    const startRetries = exec === null ? 0 : await this.startOp(exec, deadlineMs);\n\n    // The universal begin (B2): attach from our contiguous frontier under the\n    // initial window — for a FRESH op that is seq 0 (replay nothing, start live\n    // flow); for a KNOWN op (re-dispatch) it replays everything we do not hold.\n    await this.attach(this.windowBytes);\n\n    // Cumulative-ack repetition (M1) — the periodic leg.\n    this.ackTimer = setInterval(() => {\n      void this.sendAck();\n    }, this.ackIntervalMs);\n    const liveness = this.watchLiveness(wallMs);\n    let yieldTimer: ReturnType<typeof setTimeout> | undefined;\n    let adopted = false;\n    try {\n      if (yieldOptions && yieldOptions.yieldMs > 0) {\n        const phase = await Promise.race([\n          settled.then(() => \"settled\" as const),\n          liveness.wall,\n          new Promise<\"yield\">((resolve) => {\n            yieldTimer = setTimeout(() => resolve(\"yield\"), yieldOptions.yieldMs);\n          }),\n        ]);\n        if (phase === \"yield\" && this.exitSeq === undefined) {\n          try {\n            await yieldOptions.onYield();\n            adopted = true;\n          } catch (adoptionError) {\n            // The command has started, so the failed durable transfer is an\n            // outcome-unknown mutation. Cancel only this exact idempotent op and\n            // retain the consumer until its terminal frame is physically proven;\n            // never return a live locator and never replay the start.\n            await this.cancelAfterFailedAdoption();\n            await Promise.race([settled, liveness.wall]);\n            throw adoptionError;\n          }\n          // Once adoption commits, this invocation owns only the background\n          // receipt. A completion racing the transaction is handled below as\n          // terminal proof for the adopted command, never returned inline too.\n          if (this.exitSeq === undefined) {\n            // Freeze a read's exact local frontier before persistence can block.\n            // The runner retains later output; do not accumulate it while the\n            // database is slow. Foreground/adoption receipt behavior is unchanged.\n            if (this.captureOnly) this.teardown();\n            await this.sendBackgroundCredit();\n            const partial = this.snapshotOutput();\n            await yieldOptions.captureOutput?.(this.outputFrames.splice(0));\n            return {\n              status: \"running\",\n              opId: this.opId,\n              stdout: partial.stdout,\n              stderr: partial.stderr,\n              heals: this.heals,\n              startRetries,\n              replyBytes: partial.stdout.byteLength + partial.stderr.byteLength,\n            };\n          }\n        }\n      } else {\n        await Promise.race([settled, liveness.wall]);\n      }\n    } finally {\n      if (yieldTimer) {\n        clearTimeout(yieldTimer);\n      }\n      liveness.stop();\n    }\n\n    // Settled: the exit frame and every frame before it are applied.\n    const exit = this.exit as OpExit;\n    const exitSeq = this.exitSeq as bigint;\n    if (exit.failureCode && exec !== null && !adopted) {\n      throw runnerFailureToControlError(exit);\n    }\n    const { stdout, stderr } = this.assembleAndVerify(exit);\n    if (adopted || exec === null) await yieldOptions?.captureOutput?.(this.outputFrames.splice(0));\n    const outcome: OpStreamExecOutcome = {\n      ...(exit.failureCode\n        ? { failure: { failureCode: exit.failureCode, failureDetail: exit.failureDetail } }\n        : {}),\n      response: {\n        exitCode: exit.exitCode,\n        stdout,\n        stderr,\n        timedOut: exit.timedOut,\n        durationMs: exit.durationMs,\n      },\n      heals: this.heals,\n      startRetries,\n      replyBytes: stdout.byteLength + stderr.byteLength,\n    };\n    if (adopted) {\n      return {\n        status: \"running\",\n        opId: this.opId,\n        stdout,\n        stderr,\n        heals: this.heals,\n        startRetries,\n        replyBytes: outcome.replyBytes,\n        terminal: {\n          outcome,\n          exitSeq: exitSeq.toString(),\n          ...(yieldOptions?.captureOutput\n            ? {\n                outputReceipt: { exitSeq: exitSeq.toString(), attachGeneration: this.generation },\n              }\n            : {}),\n        },\n      };\n    }\n    return {\n      status: \"completed\",\n      outcome,\n      exitSeq: exitSeq.toString(),\n    };\n  }\n\n  private async cancelAfterFailedAdoption(): Promise<void> {\n    for (;;) {\n      try {\n        const result = await this.controlOp({\n          $case: \"opCancel\",\n          opCancel: { opId: this.opId },\n        });\n        if (result.$case !== \"opStatus\") {\n          throw protocolError(`op-stream cancel: unexpected result ${result.$case}`);\n        }\n        if (result.opStatus.state === OpState.OP_STATE_LOST) {\n          throw lostToControlError(result.opStatus);\n        }\n        await this.attach(0);\n        return;\n      } catch (error) {\n        if (\n          error instanceof SelfhostedControlError &&\n          (error.retryable || error.agentOffline || error.reason === \"agent_reconnecting\")\n        ) {\n          await this.deps.retryClock.sleep(\n            selfhostedRetryBackoffMs(0, this.deps.retryClock.jitter()),\n          );\n          continue;\n        }\n        throw error;\n      }\n    }\n  }\n\n  private async sendBackgroundCredit(): Promise<void> {\n    const ack = OpAck.encode({\n      opId: this.opId,\n      ackedSeq: \"0\",\n      creditBytes: OP_STREAM_BACKGROUND_CREDIT_BYTES,\n      final: false,\n      attachGeneration: this.generation,\n    }).finish();\n    try {\n      await this.deps.transport.publish(\n        opAckSubject(this.deps.workspaceId, this.deps.agentId, this.deps.connectionInstanceId),\n        ack,\n      );\n    } catch {\n      // Ownership is already durable. Credit is an optimization repeated by a\n      // later attach/query path; a publish blip must not turn an adopted command\n      // back into an outcome-unknown turn failure.\n    }\n  }\n\n  private snapshotOutput(): { stdout: Uint8Array; stderr: Uint8Array } {\n    return {\n      stdout: concatChunks(this.chunks.stdout),\n      stderr: concatChunks(this.chunks.stderr),\n    };\n  }\n\n  /** OpStart with the patient DRAINING budget and a small blip budget. OpStart\n   *  is IDEMPOTENT BY OP ID (the request id), so a timed-out/never-sent start\n   *  is safe to re-issue even though exec mutates — the runner either never saw\n   *  it or answers the SAME op. The stable request id is what makes that true. */\n  private async startOp(exec: ExecRequest, deadlineMs: number): Promise<number> {\n    let drainingRetries = 0;\n    let blipRetries = 0;\n    for (;;) {\n      // Subscription setup can yield after the caller's initial admission.\n      // Close that window, and the equivalent proven-unstarted retry windows,\n      // at the last boundary before bytes can reach the provider.\n      await this.deps.revalidateBeforeStartRetry?.();\n      try {\n        const result = await this.controlOp(\n          {\n            $case: \"opStart\",\n            opStart: {\n              op: { $case: \"exec\", exec },\n              windowBytes: String(this.windowBytes),\n              // Absolute epoch deadline (the runner's clock decides the actual\n              // budget; host clock skew shifts it — a known wire caveat).\n              deadlineMs: deadlineMs > 0 ? String(Date.now() + deadlineMs) : \"0\",\n              originId: this.deps.rpcSubject,\n            },\n          },\n          this.opId,\n        );\n        if (result.$case !== \"opStart\") {\n          throw protocolError(`op-stream start: unexpected result ${result.$case}`);\n        }\n        const status = result.opStart.status;\n        if (!result.opStart.accepted) {\n          throw this.refusedStart(status);\n        }\n        if (status?.state === OpState.OP_STATE_LOST) {\n          throw lostToControlError(status);\n        }\n        return drainingRetries + blipRetries;\n      } catch (error) {\n        if (!(error instanceof SelfhostedControlError)) {\n          throw error;\n        }\n        // A PROTOCOL/UNSUPPORTED refusal of the START ITSELF means the runner\n        // does not speak the required op-stream protocol. The op provably\n        // never started, so surface a typed availability error without trying\n        // another wire form.\n        if (\n          error.code === ErrorCode.ERROR_CODE_PROTOCOL ||\n          error.code === ErrorCode.ERROR_CODE_UNSUPPORTED\n        ) {\n          throw new OpStreamUnavailableError(\n            `the runner refused OpStart (${error.message})`,\n            \"runner\",\n          );\n        }\n        const blip = error.reason === \"agent_reconnecting\" || error.neverSent;\n        if (error.draining && drainingRetries < OP_START_DRAINING_MAX_RETRIES) {\n          await this.deps.retryClock.sleep(\n            selfhostedRetryBackoffMs(drainingRetries, this.deps.retryClock.jitter()),\n          );\n          drainingRetries += 1;\n          continue;\n        }\n        if (blip && blipRetries < OP_START_BLIP_MAX_RETRIES) {\n          await this.deps.retryClock.sleep(\n            selfhostedRetryBackoffMs(blipRetries, this.deps.retryClock.jitter()),\n          );\n          blipRetries += 1;\n          continue;\n        }\n        throw error;\n      }\n    }\n  }\n\n  private refusedStart(status: OpStatus | undefined): SelfhostedControlError {\n    if (status?.exit?.cancelled) {\n      return new SelfhostedControlError({\n        message: \"The command was cancelled before the machine admitted it.\",\n        code: ErrorCode.ERROR_CODE_TIMEOUT,\n        reason: null,\n        retryable: false,\n        detail: { cancelled: \"true\" },\n      });\n    }\n    if (status?.state === OpState.OP_STATE_LOST) {\n      return lostToControlError(status);\n    }\n    return protocolError(\"op-stream start: the runner refused the op without a typed reason\");\n  }\n\n  /** One control op on the rpc subject; throws the mapped\n   *  `SelfhostedControlError` on any AgentError. `requestId` is overridable\n   *  because OpStart's REQUEST ID IS THE OP ID (its idempotency key) and must\n   *  be STABLE across retries — every other op uses a fresh UUID per attempt. */\n  private async controlOp(\n    op: NonNullable<ControlRequest[\"op\"]>,\n    requestId: string = crypto.randomUUID(),\n  ) {\n    const resourcePolicy = op.$case === \"opStart\" ? this.deps.resourcePolicy : undefined;\n    const res = await this.deps.controlRpc.request(\n      this.deps.rpcSubject,\n      {\n        requestId,\n        epoch: this.deps.epoch,\n        resourcePolicy,\n        op,\n      },\n      { timeoutMs: this.deps.controlTimeoutMs },\n    );\n    if (res.error || !res.result) {\n      throw agentErrorToControlError(\n        res.error ?? {\n          code: ErrorCode.ERROR_CODE_PROTOCOL,\n          message: \"agent returned an empty control response\",\n          retryable: false,\n          detail: {},\n        },\n      );\n    }\n    return res.result;\n  }\n\n  /** OpAttach from the contiguous frontier. `windowBytes` sizes the fresh\n   *  replay window; 0 = reuse the OpStart grant (the gap-heal path). */\n  private async attach(windowBytes: number): Promise<OpStatus> {\n    const result = await this.controlOp({\n      $case: \"opAttach\",\n      opAttach: {\n        opId: this.opId,\n        fromSeq: this.lastApplied.toString(),\n        attachGeneration: this.generation,\n        windowBytes: String(windowBytes),\n      },\n    });\n    if (result.$case !== \"opStatus\") {\n      throw protocolError(`op-stream attach: unexpected result ${result.$case}`);\n    }\n    if (result.opStatus.state === OpState.OP_STATE_LOST) {\n      throw lostToControlError(result.opStatus);\n    }\n    return result.opStatus;\n  }\n\n  /** Gap/silence heal: one re-attach in flight at a time; each success counts\n   *  as a heal (the observer's `healed` breadcrumb). Failures are left to the\n   *  liveness watcher — a dead link fails typed there, not here. */\n  private requestAttachHeal(): void {\n    if (this.attachInFlight || this.torn) {\n      return;\n    }\n    this.attachInFlight = true;\n    void this.attach(0)\n      .then(() => {\n        this.heals += 1;\n      })\n      .catch((error) => {\n        if (error instanceof SelfhostedControlError && !error.retryable && !error.agentOffline) {\n          this.settleReject?.(error);\n        }\n      })\n      .finally(() => {\n        this.attachInFlight = false;\n      });\n  }\n\n  private onFramePayload(payload: Uint8Array): void {\n    if (this.torn) return;\n    let frame: OpFrame;\n    try {\n      frame = OpFrame.decode(payload);\n    } catch {\n      // A torn frame never kills the subscription; the seq gap it leaves is\n      // healed by attach-replay.\n      return;\n    }\n    if (frame.opId !== this.opId) {\n      return;\n    }\n    this.lastFrameAt = Date.now();\n    this.silenceSince = undefined;\n    const seq = BigInt(frame.seq);\n    if (seq <= this.lastApplied) {\n      return; // Duplicate (re-delivery / replay overlap) — reassembly is seq-idempotent.\n    }\n    if (seq !== this.lastApplied + 1n) {\n      // Out of order: stash and ask for the gap. Replay heals from the frontier,\n      // so an overgrown stash is dropped, not grown without bound.\n      const wireBytes = payload.byteLength;\n      const stashMaxBytes = this.windowBytes * OP_STREAM_STASH_WINDOW_MULTIPLIER;\n      if (!this.stash.has(seq)) {\n        if (this.stashedWireBytes + wireBytes <= stashMaxBytes) {\n          this.stash.set(seq, { frame, wireBytes });\n          this.stashedWireBytes += wireBytes;\n        } else {\n          this.stash.clear();\n          this.stashedWireBytes = 0;\n        }\n      }\n      this.requestAttachHeal();\n      return;\n    }\n    this.applyFrame(frame);\n    // Drain any stashed continuation.\n    for (;;) {\n      const stashed = this.stash.get(this.lastApplied + 1n);\n      if (!stashed) {\n        break;\n      }\n      this.stash.delete(this.lastApplied + 1n);\n      this.stashedWireBytes -= stashed.wireBytes;\n      this.applyFrame(stashed.frame);\n    }\n    this.maybeSettle();\n    this.maybeGrantCredit();\n  }\n\n  private applyFrame(frame: OpFrame): void {\n    this.lastApplied = BigInt(frame.seq);\n    const body = frame.body;\n    if (!body) {\n      return;\n    }\n    switch (body.$case) {\n      case \"data\": {\n        const channel = OP_CHANNEL_NAMES[body.data.channel];\n        if (channel) {\n          if (this.captureOnly) {\n            this.hashes[channel].update(body.data.bytes);\n            this.totals[channel] += BigInt(body.data.bytes.byteLength);\n          } else {\n            this.chunks[channel].push(body.data.bytes);\n          }\n          const chunk = this.outputDecoders[channel].decode(body.data.bytes, { stream: true });\n          if (chunk) this.outputFrames.push({ sequence: frame.seq, stream: channel, chunk });\n        }\n        this.receivedPayloadBytes += BigInt(body.data.bytes.byteLength);\n        break;\n      }\n      case \"progress\":\n        // A liveness tick; echo our cumulative ack (M1's on-progress leg).\n        void this.sendAck();\n        break;\n      case \"exit\":\n        for (const stream of [\"stdout\", \"stderr\"] as const) {\n          const chunk = this.outputDecoders[stream].decode();\n          if (chunk) this.outputFrames.push({ sequence: frame.seq, stream, chunk });\n        }\n        this.exit = body.exit;\n        this.exitSeq = BigInt(frame.seq);\n        break;\n    }\n  }\n\n  private maybeSettle(): void {\n    if (this.exitSeq !== undefined && this.lastApplied >= this.exitSeq) {\n      this.settleResolve?.();\n    }\n  }\n\n  /** Prompt credit replenishment: the periodic ack alone would stall a fast\n   *  child for up to the ack interval each window; grant as soon as half the\n   *  window has been consumed since the last grant. */\n  private maybeGrantCredit(): void {\n    if (this.receivedPayloadBytes - this.creditAtLastAck >= BigInt(this.windowBytes) / 2n) {\n      void this.sendAck();\n    }\n  }\n\n  /** The mid-op cumulative ack: CREDIT-ONLY (Δ2 — acked_seq stays 0 so the\n   *  runner retains every frame for a possible successor consumer; the credit\n   *  is an absolute replacement sized to keep ~one window of live headroom). */\n  private async sendAck(): Promise<void> {\n    if (this.torn) {\n      return;\n    }\n    this.creditAtLastAck = this.receivedPayloadBytes;\n    const ack = OpAck.encode({\n      opId: this.opId,\n      ackedSeq: \"0\",\n      creditBytes: (this.receivedPayloadBytes + BigInt(this.windowBytes)).toString(),\n      final: false,\n      attachGeneration: this.generation,\n    }).finish();\n    try {\n      await this.deps.transport.publish(\n        opAckSubject(this.deps.workspaceId, this.deps.agentId, this.deps.connectionInstanceId),\n        ack,\n      );\n    } catch {\n      // Acks are best-effort and healed by repetition (M1).\n    }\n  }\n\n  /**\n   * The liveness watcher: probes a silent op with OpQuery, re-attaches when the\n   * runner is ahead of us (frames lost in flight), holds a quiet-but-alive op\n   * open through the reconnect window, and enforces an explicit client-side wall.\n   * Resolves only by rejection (typed failure) or by `stop()` at settle.\n   */\n  private watchLiveness(wallMs: number): { wall: Promise<never>; stop: () => void } {\n    let stopped = false;\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    const wall = new Promise<never>((_, reject) => {\n      const startedAt = Date.now();\n      const tick = async () => {\n        if (stopped) {\n          return;\n        }\n        try {\n          if (wallMs > 0 && Date.now() - startedAt >= wallMs) {\n            // The runner enforces the exec deadline and emits Exit{timed_out};\n            // reaching OUR wall means even that terminal frame never arrived —\n            // the same ambiguity as a legacy reply timeout, surfaced the same.\n            reject(agentErrorToControlError(timeoutAgentError()));\n            return;\n          }\n          if (Date.now() - this.lastFrameAt >= this.silenceTimeoutMs) {\n            await this.probeSilence(reject);\n          }\n        } catch (error) {\n          reject(error);\n          return;\n        }\n        timer = setTimeout(tick, Math.min(this.silenceTimeoutMs / 3, 2_500));\n      };\n      timer = setTimeout(tick, Math.min(this.silenceTimeoutMs / 3, 2_500));\n    });\n    return {\n      wall,\n      stop: () => {\n        stopped = true;\n        if (timer) {\n          clearTimeout(timer);\n        }\n      },\n    };\n  }\n\n  /** One silence probe: OpQuery the op; a definitive answer acts, an offline /\n   *  blip answer holds through the reconnect window, then fails typed. */\n  private async probeSilence(reject: (error: unknown) => void): Promise<void> {\n    this.silenceSince ??= Date.now();\n    try {\n      const result = await this.controlOp({ $case: \"opQuery\", opQuery: { opId: this.opId } });\n      if (result.$case !== \"opStatus\") {\n        throw protocolError(`op-stream query: unexpected result ${result.$case}`);\n      }\n      const status = result.opStatus;\n      if (status.state === OpState.OP_STATE_LOST) {\n        reject(lostToControlError(status));\n        return;\n      }\n      // Alive on the runner. If it is ahead of our frontier, frames were lost\n      // in flight — re-attach to replay them (this also restores live flow\n      // after a reconnect). A quiet-but-current op just keeps holding.\n      if (BigInt(status.nextSeq) > this.lastApplied + 1n) {\n        this.requestAttachHeal();\n      }\n    } catch (error) {\n      if (!(error instanceof SelfhostedControlError)) {\n        throw error;\n      }\n      const transient =\n        error.agentOffline || error.reason === \"agent_reconnecting\" || error.draining;\n      if (!transient) {\n        throw error;\n      }\n      const heldFor = Date.now() - (this.silenceSince ?? Date.now());\n      if (heldFor >= this.reconnectHoldMs) {\n        // The hold window expired without the machine coming back — surface\n        // the LAST probe's typed error (offline/reconnecting), same taxonomy\n        // as the legacy path.\n        reject(error);\n      }\n      // Otherwise: keep holding — op ⊥ connection (the runner keeps the child\n      // running and retains its output through the blip).\n    }\n  }\n\n  /** Assemble each channel once and prove byte exactness. Clearing the chunk\n   *  arrays after assembly avoids keeping both every source frame and the final\n   *  contiguous result live while a large response crosses the caller boundary. */\n  private assembleAndVerify(exit: OpExit): { stdout: Uint8Array; stderr: Uint8Array } {\n    const assembled = {\n      stdout: concatChunks(this.chunks.stdout),\n      stderr: concatChunks(this.chunks.stderr),\n    };\n    for (const channel of [\"stdout\", \"stderr\"] as const) {\n      const bytes = assembled[channel];\n      // A terminal result can license collection of retained native output.\n      // Both channels, including empty ones, must carry verifiable metadata.\n      const declaredTotal = exit.totals?.[channel];\n      if (typeof declaredTotal !== \"string\" || !/^[0-9]+$/.test(declaredTotal)) {\n        throw protocolError(`op-stream reassembly: ${channel} total missing or invalid`);\n      }\n      const total = this.captureOnly ? this.totals[channel] : BigInt(bytes.byteLength);\n      if (BigInt(declaredTotal) !== total) {\n        throw protocolError(\n          `op-stream reassembly: ${channel} total mismatch (got ${total}, ` +\n            `runner declared ${declaredTotal})`,\n        );\n      }\n      const declaredDigest = exit.digests?.[channel];\n      if (typeof declaredDigest !== \"string\" || declaredDigest.length === 0) {\n        throw protocolError(`op-stream reassembly: ${channel} digest missing`);\n      }\n      const digest = bytesToHex(\n        this.captureOnly ? this.hashes[channel].clone().digest() : blake3(bytes),\n      );\n      if (digest !== declaredDigest) {\n        throw protocolError(\n          `op-stream reassembly: ${channel} digest mismatch (got ${digest}, ` +\n            `runner declared ${declaredDigest})`,\n        );\n      }\n      this.chunks[channel].length = 0;\n    }\n    return assembled;\n  }\n}\n\nfunction concatChunks(chunks: Uint8Array[]): Uint8Array {\n  const total = chunks.reduce((sum, chunk) => sum + chunk.byteLength, 0);\n  const out = new Uint8Array(total);\n  let offset = 0;\n  for (const chunk of chunks) {\n    out.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return out;\n}\n\nfunction protocolError(message: string): SelfhostedControlError {\n  return new SelfhostedControlError({\n    message,\n    code: ErrorCode.ERROR_CODE_PROTOCOL,\n    reason: null,\n    retryable: false,\n  });\n}\n\n/** A definitive `lost` status → a typed op-level failure. The result was\n *  bounded-retention collateral (LRU eviction / a runner restart predating the\n *  persistence milestone) — honest, never silent. */\nfunction lostToControlError(status: OpStatus): SelfhostedControlError {\n  const reason =\n    status.lostReason === OpLostReason.OP_LOST_REASON_EVICTED\n      ? \"its retained result was evicted before collection\"\n      : status.lostReason === OpLostReason.OP_LOST_REASON_AGENT_RESTARTED\n        ? \"the machine agent restarted and the op did not survive\"\n        : \"the runner reported it lost\";\n  return new SelfhostedControlError({\n    message:\n      `The command's result is no longer available on the machine (${reason}). ` +\n      \"Check whether its effects already took place before re-running it.\",\n    code: ErrorCode.ERROR_CODE_STREAM,\n    reason: null,\n    retryable: false,\n    detail: { lost_reason: String(status.lostReason) },\n  });\n}\n\n/**\n * A runner-typed terminal failure (OpExit.failure_code — OP_OVERFLOW /\n * OP_SPOOL_IO / OP_PIPE_IO; never an exit-code sentinel). OP_OVERFLOW maps to\n * the PAYLOAD_TOO_LARGE taxonomy: the semantics differ (retention quota vs\n * reply size) but the model's correct next action is identical — bound the\n * output, redirect to a file, read it back in ranges — so it gets the same\n * actionable rendering, with the runner's exact counters in the detail.\n */\nexport function runnerFailureToControlError(\n  exit: Pick<OpExit, \"failureCode\" | \"failureDetail\">,\n): SelfhostedControlError {\n  if (exit.failureCode === \"OP_OVERFLOW\") {\n    return new SelfhostedControlError({\n      message:\n        \"The command produced more output than the machine link can retain for delivery. \" +\n        \"Redirect the command's output to a file (for example `<command> > /tmp/out.log 2>&1`) \" +\n        \"and then read that file back in ranges or chunks instead of returning it all at once.\",\n      code: ErrorCode.ERROR_CODE_PAYLOAD_TOO_LARGE,\n      reason: null,\n      retryable: false,\n      payloadTooLarge: true,\n      // failure_code lets the fault renderer distinguish the retention-ceiling\n      // overflow (command TERMINATED at the ceiling) from the legacy reply-size\n      // wall (command ran to completion) — the four fields must tell the truth.\n      detail: { ...exit.failureDetail, failure_code: exit.failureCode },\n    });\n  }\n  return new SelfhostedControlError({\n    message:\n      `The command failed on the machine's streaming transport (${exit.failureCode}). ` +\n      \"The machine kept running it, but its output could not be captured intact.\",\n    code: ErrorCode.ERROR_CODE_STREAM,\n    reason: null,\n    retryable: false,\n    detail: { ...exit.failureDetail, failure_code: exit.failureCode },\n  });\n}\n","// The op-stream TRANSPORT seam (op-stream protocol v1.1, server half).\n//\n// The op-stream client needs two primitives the request/reply `ControlRpc`\n// cannot express: a plain SUBSCRIPTION (runner→server op frames on\n// `agent.<ws>.<id>.connection.<instance>.op.<op_id>`, fire-and-forget publishes)\n// and a plain PUBLISH (server→runner acks on the exact instance's `.ack`).\n// exactly like control-rpc.ts defines `ControlRpc`: the session leaf speaks\n// ONLY `OpStreamTransport`; the worker/api inject a live NATS-backed\n// implementation (the same lazy-factory discipline — boot never requires a\n// live NATS), and tests inject an in-memory one.\n//\n// The control ops that START/steer an op (OpStart/OpCancel/OpQuery/OpAttach)\n// deliberately do NOT ride this seam — they are ordinary `ControlRequest`s on\n// the existing rpc subject through the existing `ControlRpc`, with its typed\n// offline/timeout synthesis and retry taxonomy.\n\n/** The per-op frame subject for one exact runner generation. */\nexport function opFrameSubject(\n  workspaceId: string,\n  agentId: string,\n  opId: string,\n  connectionInstanceId: string,\n): string {\n  if (typeof connectionInstanceId !== \"string\" || connectionInstanceId.trim().length === 0) {\n    throw new Error(\"Connected Machine op frames require an exact connection instance\");\n  }\n  return `agent.${workspaceId}.${agentId}.connection.${connectionInstanceId}.op.${opId}`;\n}\n\n/** The per-agent ack subject (server→runner, fire-and-forget). Mirrors the\n *  runner's exact generation-fenced ack subject. */\nexport function opAckSubject(\n  workspaceId: string,\n  agentId: string,\n  connectionInstanceId: string,\n): string {\n  if (typeof connectionInstanceId !== \"string\" || connectionInstanceId.trim().length === 0) {\n    throw new Error(\"Connected Machine op acknowledgements require an exact connection instance\");\n  }\n  return `agent.${workspaceId}.${agentId}.connection.${connectionInstanceId}.ack`;\n}\n\n/** A live subscription handle. `unsubscribe` is idempotent and never throws. */\nexport interface OpStreamSubscription {\n  unsubscribe(): void;\n}\n\n/**\n * The op-stream transport seam. `subscribe` MUST be established before the\n * OpStart that makes frames flow (subscription-before-start is a protocol\n * invariant: no frame is published before the consumer exists on a healthy\n * path; a missed frame is healed via OpAttach replay regardless). `onMessage`\n * is invoked in arrival order; a decode failure inside the handler must be\n * contained by the caller (a torn frame must never kill the subscription).\n */\nexport interface OpStreamTransport {\n  subscribe(\n    subject: string,\n    onMessage: (payload: Uint8Array) => void,\n  ): Promise<OpStreamSubscription>;\n  publish(subject: string, payload: Uint8Array): Promise<void>;\n}\n\n/** Thrown before OpStart when the stream transport is unavailable or the runner\n *  does not support the required protocol. Exec fails before dispatch and never\n *  retries through a request/reply wire form. */\nexport class OpStreamUnavailableError extends Error {\n  readonly name = \"OpStreamUnavailableError\";\n\n  constructor(\n    message: string,\n    readonly unavailableKind: \"transport\" | \"runner\" = \"transport\",\n  ) {\n    super(message);\n  }\n}\n\n/**\n * The minimal NATS surface the transport needs — mirrors the `nats`\n * `NatsConnection` subscribe/publish WITHOUT importing `nats` into the\n * agent-loop-free runtime leaf (the worker injects the live `@opengeni/events`\n * bus connection, exactly like `NatsRequestConnection` in control-rpc.ts).\n * `subscribe` returns the nats.js Subscription shape: an async iterable of\n * messages plus `unsubscribe()`.\n */\nexport interface NatsOpStreamConnection {\n  subscribe(subject: string): AsyncIterable<{ data: Uint8Array }> & { unsubscribe(): void };\n  publish(subject: string, payload: Uint8Array): void;\n}\n\n/**\n * The NATS-backed transport. Lazy memoized factory (identical discipline to\n * `NatsControlRpc`): the connection resolves on first use; a null factory\n * result or a dial failure surfaces `OpStreamUnavailableError` — the caller\n * (the session) fails before dispatch; exec has no request/reply downgrade.\n */\nexport class NatsOpStreamTransport implements OpStreamTransport {\n  private readonly connect: () => Promise<NatsOpStreamConnection | null>;\n  private connection: NatsOpStreamConnection | undefined;\n  private connecting: Promise<NatsOpStreamConnection | null> | undefined;\n\n  constructor(connect: () => Promise<NatsOpStreamConnection | null>) {\n    this.connect = connect;\n  }\n\n  private async resolveConnection(): Promise<NatsOpStreamConnection | null> {\n    if (this.connection) {\n      return this.connection;\n    }\n    // Share one in-flight dial; cache only a real connection (a transient\n    // null/throw must be retried by the next call — see NatsControlRpc).\n    this.connecting ??= this.connect()\n      .then((connection) => {\n        if (connection) {\n          this.connection = connection;\n        }\n        return connection;\n      })\n      .catch(() => null)\n      .finally(() => {\n        this.connecting = undefined;\n      });\n    return this.connecting;\n  }\n\n  async subscribe(\n    subject: string,\n    onMessage: (payload: Uint8Array) => void,\n  ): Promise<OpStreamSubscription> {\n    const conn = await this.resolveConnection();\n    if (!conn) {\n      throw new OpStreamUnavailableError(\"op-stream transport has no live connection\");\n    }\n    const subscription = conn.subscribe(subject);\n    // Pump the async iterator into the callback. The iterator ends when\n    // `unsubscribe()` is called (nats.js closes the iterator); a pump error\n    // (torn connection) simply ends delivery — the op-stream client's silence\n    // handling (OpQuery + re-attach) owns recovery, not the transport.\n    void (async () => {\n      try {\n        for await (const message of subscription) {\n          onMessage(message.data);\n        }\n      } catch {\n        // Delivery ended with the connection; recovery is the client's job.\n      }\n    })();\n    let unsubscribed = false;\n    return {\n      unsubscribe: () => {\n        if (unsubscribed) {\n          return;\n        }\n        unsubscribed = true;\n        try {\n          subscription.unsubscribe();\n        } catch {\n          // Idempotent teardown: a torn connection already unsubscribed us.\n        }\n      },\n    };\n  }\n\n  async publish(subject: string, payload: Uint8Array): Promise<void> {\n    const conn = await this.resolveConnection();\n    if (!conn) {\n      throw new OpStreamUnavailableError(\"op-stream transport has no live connection\");\n    }\n    conn.publish(subject, payload);\n  }\n}\n","// Bring-your-own-compute: the user's own machine, enrolled via the Rust agent,\n// is reached over the NATS request/reply control plane. Postgres resolves the\n// exact claimed runner instance and NATS addresses\n// `agent.<workspace>.<agentId>.connection.<instanceId>.rpc`. There is NO provider\n// SDK and NO per-box credential — \"the agent is the box\".\n//\n// M3 ships the REAL `SelfhostedSandboxClient`: its `create()`/`resume()` return a\n// `SelfhostedSession` presenting the structural surface (`exec`/`readFile`/\n// `writeFile`/`resolveExposedPort`/`serializeSessionState`) that Channel-A and the\n// viewer consume unchanged — backed by a `ControlRpc` seam\n// (request/reply encoded via `@opengeni/agent-proto`) instead of a provider SDK.\n// `serializeSessionState`/`deserializeSessionState` round-trip `{agentId}` ONLY:\n// resume = re-address the live subject, never a cold re-create (the machine is\n// not recreatable). The live NATS request/reply transport + Accounts land in M4\n// behind the SAME `ControlRpc`.\n\nimport type { Settings } from \"@opengeni/config\";\nimport { CAPABILITY_DESCRIPTORS } from \"../capabilities\";\nimport {\n  NatsControlRpc,\n  type ControlRpc,\n  type NatsRequestConnection,\n} from \"../selfhosted/control-rpc\";\nimport { SelfhostedSandboxClient, type SelfhostedRelayConfig } from \"../selfhosted/session\";\nimport type { ProviderRegistration } from \"./types\";\n\n/**\n * Resolve the relay-URL shape config from settings. M8b threads the real relay\n * deployment URL (`OPENGENI_SELFHOSTED_RELAY_URL`, ops-repo IaC) behind this seam:\n * `resolveExposedPort` returns `{host, port, tls, path, query}` so `buildStreamUrl`\n * assembles the relay dial URL. A path-less URL defaults to the relay's `/stream`\n * route; an unconfigured deployment falls back to a placeholder host (the URL shape\n * is still well-formed; the relay is simply unreachable until configured).\n */\nfunction resolveRelayConfig(settings: Settings): SelfhostedRelayConfig {\n  const raw = settings.selfhostedRelayUrl?.trim();\n  if (!raw) {\n    return { host: \"relay.opengeni.local\", port: 443, tls: true, path: \"/stream\" };\n  }\n  try {\n    const url = new URL(raw.includes(\"://\") ? raw : `wss://${raw}`);\n    const tls = url.protocol === \"wss:\" || url.protocol === \"https:\";\n    const port = url.port ? Number(url.port) : tls ? 443 : 80;\n    const path = url.pathname && url.pathname !== \"/\" ? url.pathname : \"/stream\";\n    return { host: url.hostname, port, tls, path };\n  } catch {\n    return { host: raw, port: 443, tls: true, path: \"/stream\" };\n  }\n}\n\n/**\n * The default `ControlRpc` factory for a registry-built client: a\n * `NatsControlRpc` whose connection factory returns null — there is NO live NATS\n * connection wired into the agent-loop-free runtime leaf at build() time (the\n * API/worker inject the live `@opengeni/events` connection per request in M4).\n * A null connection surfaces `agent_offline` on every op rather than throwing at\n * construction, so boot never requires a live NATS — exactly the M3 ruling.\n */\nfunction defaultControlRpcFactory(): ControlRpc {\n  return new NatsControlRpc(async (): Promise<NatsRequestConnection | null> => null);\n}\n\nexport const selfhostedProvider: ProviderRegistration = {\n  backend: \"selfhosted\",\n  exactResumeMode: \"ordinary\",\n  instanceIdFields: [\"agentId\"],\n  workspaceCapturePolicy: () => null,\n  descriptor: CAPABILITY_DESCRIPTORS.selfhosted,\n  /**\n   * No per-box credentials: the machine is reached over the agent's own\n   * enrollment. The enrollment-signing + relay-token secrets are deployment-level\n   * config that lands with the connectivity/enrollment milestones (M4/M5) — and\n   * the whole feature is gated by a `sandboxSelfhostedEnabled` flag (default off)\n   * that does not yet exist in Settings. So validation is LENIENT (no-op) in M3:\n   * boot must never break, and there is nothing per-box to validate. M4/M5 add\n   * the (flag-gated) signing/relay presence checks here behind the same seam.\n   */\n  validateCredentials() {},\n  /**\n   * Build the registry client. `create()`/`resume()` bind a `SelfhostedSession`\n   * to the agent subject; the per-request `{workspaceId, agentId, controlRpc}`\n   * are supplied by the resume path (the lease's enrollment) — the registry\n   * client carries the relay config + the default (offline-until-M4) ControlRpc\n   * factory and a backendId-correct surface for `assertProviderRegistryInvariants`.\n   */\n  build({ settings }) {\n    return new SelfhostedSandboxClient({\n      // The workspaceId is bound per-request by the resume path (the API/worker\n      // construct a request-scoped client with the lease's workspace + a live\n      // ControlRpc). The registry-built client is the boot/assertion shape; an\n      // empty workspaceId is fine until a session is bound with a real one.\n      workspaceId: \"\",\n      // Inert registry shape only; request-scoped production clients replace\n      // this with the persisted machine Hello root before any operation.\n      workspaceRoot: \"/workspace\",\n      relay: resolveRelayConfig(settings),\n      controlRpcFactory: defaultControlRpcFactory,\n    });\n  },\n};\n","import { VercelSandboxClient } from \"@openai/agents-extensions/sandbox/vercel\";\nimport { CAPABILITY_DESCRIPTORS } from \"../capabilities\";\nimport { SandboxConfigError } from \"../errors\";\nimport {\n  REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE,\n  REPEATABLE_PORTABLE_TAR_WORKSPACE_CAPTURE,\n  providerWorkspacePersistence,\n  type ProviderRegistration,\n} from \"./types\";\n\nexport const vercelProvider: ProviderRegistration = {\n  backend: \"vercel\",\n  exactResumeMode: \"ordinary\",\n  instanceIdFields: [\"sandboxId\"],\n  workspaceCapturePolicy: (state) =>\n    providerWorkspacePersistence(state) === \"snapshot\"\n      ? REPEATABLE_PORTABLE_TAR_WORKSPACE_CAPTURE\n      : REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE,\n  prepareForTeardownAfterCapture(session) {\n    const state = (session as { state?: { workspacePersistence?: unknown } } | null)?.state;\n    if (state?.workspacePersistence === \"snapshot\") {\n      // Vercel close() otherwise takes a second native snapshot before stop.\n      // The portable tar is already durable, so suppress that unledgered,\n      // identity-adjacent side effect on this disposable resumed handle only.\n      state.workspacePersistence = \"tar\";\n    }\n  },\n  descriptor: CAPABILITY_DESCRIPTORS.vercel,\n  validateCredentials(settings) {\n    // Vercel needs the access token + the project/team it scopes to.\n    if (!settings.vercelToken) {\n      throw new SandboxConfigError(\"vercel\", \"OPENGENI_VERCEL_TOKEN is required\");\n    }\n    if (!settings.vercelProjectId) {\n      throw new SandboxConfigError(\"vercel\", \"OPENGENI_VERCEL_PROJECT_ID is required\");\n    }\n  },\n  build({ settings, environment, exposedPorts }) {\n    const options: NonNullable<ConstructorParameters<typeof VercelSandboxClient>[0]> = {\n      token: settings.vercelToken!,\n      projectId: settings.vercelProjectId!,\n      env: environment,\n      exposedPorts,\n    };\n    if (settings.vercelTeamId) options.teamId = settings.vercelTeamId;\n    if (settings.vercelRuntime) options.runtime = settings.vercelRuntime;\n    return new VercelSandboxClient(options);\n  },\n};\n","// Backend selection + capability negotiation/degradation (module 03 §0, §5).\n//\n// negotiateCapabilities() turns a static CapabilityDescriptor + runtime context\n// (the selected OS, the lease liveness/epoch, and the deployment's desktop\n// policy) into a coherent SessionCapabilities document. The load-bearing rule\n// (sandbox contract Part D): a capability cell is ALWAYS present — when unavailable\n// it is `available:false` + a typed `reason`, NEVER absent. Degradation is a\n// value, not a silent drop.\n\nimport {\n  CAPABILITY_DESCRIPTORS,\n  type CapabilityDescriptor,\n  type CapabilityUnavailableReason,\n  type SandboxBackend,\n  type SandboxOs,\n  type SessionCapabilities,\n} from \"@opengeni/contracts\";\n\nexport interface NegotiationContext {\n  sessionId: string;\n  backend: SandboxBackend;\n  os: SandboxOs;\n  /** Current lease liveness; only warm proves a holder-backed live provider. */\n  liveness: \"cold\" | \"warming\" | \"warm\" | \"draining\";\n  /** The lease epoch echoed on viewer heartbeats (the split-brain fence). */\n  leaseEpoch: number;\n  /** Numeric/boolean archive completeness truth. Non-persistable targets use\n   * null/null/false; archive locations and provider details are never exposed. */\n  workspaceGeneration?: number | null;\n  archiveGeneration?: number | null;\n  archiveComplete?: boolean;\n  /** The deployment desktop toggle (settings.sandboxDesktopEnabled). */\n  desktopEnabled: boolean;\n  /**\n   * The HUMAN take-control toggle (settings.sandboxDesktopInteractive). When true\n   * (default) and the desktop cell is available, the negotiated DesktopStream.mode\n   * is \"interactive\" — the noVNC viewer can drive mouse+keyboard into :0 (the box's\n   * x11vnc runs without -viewonly). When false the cell reports mode \"read-only\"\n   * and the client disables the \"Take control\" affordance (a genuinely read-only\n   * deployment). Agent interaction is authorized separately through managed\n   * ComputerSession tools. Defaults to true so a caller that never threads it\n   * (e.g. headless tests) still gets the interactive plane when the desktop is\n   * available.\n   */\n  desktopInteractive?: boolean;\n  /**\n   * Whether a scoped-stream-token secret is resolvable (stream-token availability contract). When desktop\n   * is enabled but this is false (no streamTokenSecret AND no delegationSecret),\n   * the desktop plane GRACEFULLY DEGRADES to transport:null — the deployment\n   * boots, but the pixel plane cannot mint scoped tokens. Defaults to true so a\n   * caller that never threads it (e.g. headless tests) is unaffected.\n   */\n  streamTokenSecretAvailable?: boolean;\n  /** Whether the calling principal has acknowledged the un-redacted desktop\n   *  pixels (and, for a shared box, the shared-exposure disclosure). When the\n   *  box is shared this must be the SHARED acknowledgment; a bare un-redacted ack\n   *  does not satisfy a shared box. */\n  desktopAcknowledged?: boolean;\n  /** True when the box's group has >1 session: watching this desktop also shows\n   *  the sibling sessions' agents on the one :0 framebuffer (addendum E.1). */\n  shared?: boolean;\n  /** The OTHER sessions whose agents may appear on the shared desktop — IDS\n   *  ONLY, never their conversation/metadata (stress g). Empty for a solo box. */\n  sharedSessionIds?: string[];\n  /**\n   * The minted pixel-plane endpoint (P4.2): the direct-to-provider WS URL + the\n   * scoped stream token + its expiry + the framebuffer geometry. Threaded only by\n   * the explicit viewer grant AFTER it has resumed the box, ensured the display\n   * stack, and resolved the provider tunnel. When ABSENT (the descriptor read, a\n   * cold lease, or a degraded desktop) the DesktopStream cell reports url/token/\n   * expiresAt as null — the capability is advertised, the live address is not yet\n   * minted (the caller POSTs to /viewers to mint it). Presence does NOT override\n   * the gates: a degraded/cold/unacked desktop still reports transport:null and\n   * the minted endpoint is dropped.\n   */\n  desktopStream?: {\n    url: string;\n    token: string;\n    expiresAt: string;\n    resolution: [number, number];\n  };\n  /** The deployment terminal toggle (settings.sandboxTerminalEnabled). The REAL\n   *  PTY (ttyd pty-ws) is gated on this + a real-PTY backend; when off the\n   *  Terminal cell still advertises the read-only sse-events firehose. Defaults to\n   *  true so a caller that never threads it is unaffected. */\n  terminalEnabled?: boolean;\n  /**\n   * The minted terminal-plane endpoint (P5.t): the direct-to-provider ttyd\n   * PTY-over-websocket URL + the scoped stream token + its expiry. Threaded by the\n   * explicit viewer grant AFTER it has resumed the box, ensured the terminal\n   * server, and resolved the provider tunnel (mintTerminalStream) — SYMMETRIC with\n   * `desktopStream`. When ABSENT (the negotiation-only read, a cold lease, or a\n   * degraded terminal) the Terminal cell reports url/token/expiresAt as null and\n   * falls back to transport \"sse-events\" (the read-only firehose) — the caller\n   * POSTs to /viewers to mint the live pty-ws address.\n   */\n  terminalStream?: {\n    url: string;\n    token: string;\n    expiresAt: string;\n    transport?: \"pty-ws\" | \"relay-pty\";\n  };\n  /** Override the negotiation clock (tests). */\n  now?: Date;\n}\n\n/**\n * Resolve the descriptor for a backend. Throws on an unknown backend rather than\n * returning a half-formed default (the registry is the single source of truth).\n */\nexport function selectBackend(backend: SandboxBackend): CapabilityDescriptor {\n  const descriptor = CAPABILITY_DESCRIPTORS[backend];\n  if (!descriptor) {\n    throw new Error(`Unknown sandbox backend \"${backend}\"`);\n  }\n  return descriptor;\n}\n\n/**\n * Return the Agents SDK wire identifier for a product sandbox backend.\n *\n * Durable envelopes use the SDK identifier, which differs from the product\n * registry key for the local provider (`unix_local` versus `local`). Keep that\n * translation here so persistence, routing, and provider construction cannot\n * drift into near-identical private mappings.\n */\nexport function sdkBackendIdForSandboxBackend(backend: SandboxBackend): string {\n  return selectBackend(backend).backendId;\n}\n\n/**\n * Resolve either a product registry key or an Agents SDK wire identifier to the\n * canonical product backend. Unknown identifiers stay unknown instead of being\n * coerced to the deployment default.\n */\nexport function sandboxBackendForSdkBackendId(backendId: string): SandboxBackend | null {\n  if (Object.hasOwn(CAPABILITY_DESCRIPTORS, backendId)) {\n    return backendId as SandboxBackend;\n  }\n  for (const backend of Object.keys(CAPABILITY_DESCRIPTORS) as SandboxBackend[]) {\n    if (CAPABILITY_DESCRIPTORS[backend].backendId === backendId) {\n      return backend;\n    }\n  }\n  return null;\n}\n\n/** True iff the descriptor lists the requested OS as supported. */\nexport function backendSupportsOs(descriptor: CapabilityDescriptor, os: SandboxOs): boolean {\n  return descriptor.os.supported.includes(os);\n}\n\n/**\n * True iff the backend can serve the Channel-B desktop pixel plane at all — i.e.\n * its static descriptor advertises DesktopStream as available. The gate the\n * worker / API use before launching the display stack (so a headless-only\n * backend like cloudflare/vercel/none never tries). This is the STATIC\n * feasibility only; the runtime `sandboxDesktopEnabled` policy toggle and the\n * stream-token-secret gate are layered on by the caller / negotiateCapabilities.\n *\n * Accepts EITHER the SandboxBackend enum value (e.g. \"local\") OR the SDK\n * client backendId (e.g. \"unix_local\") — they diverge for the local backend —\n * so a caller holding only `established.backendId` resolves correctly.\n */\nexport function desktopCapableBackend(backend: SandboxBackend | string): boolean {\n  const direct = CAPABILITY_DESCRIPTORS[backend as SandboxBackend];\n  if (direct) {\n    return direct.capabilities.DesktopStream.available === true;\n  }\n  // Fall back to a backendId lookup (the SDK client id, which differs from the\n  // enum key for `local`/`unix_local`).\n  for (const descriptor of Object.values(CAPABILITY_DESCRIPTORS)) {\n    if (descriptor.backendId === backend) {\n      return descriptor.capabilities.DesktopStream.available === true;\n    }\n  }\n  return false;\n}\n\n/**\n * Negotiate a coherent SessionCapabilities document for (backend, os). Every\n * capability is reported with availability + a reason-when-unavailable; nothing\n * is ever absent. The reason precedence is: os_unsupported (the OS axis can't be\n * served at all) > the per-capability static feasibility > policy/liveness gates.\n */\nexport function negotiateCapabilities(ctx: NegotiationContext): SessionCapabilities {\n  const descriptor = selectBackend(ctx.backend);\n  const osSupported = backendSupportsOs(descriptor, ctx.os);\n  const negotiatedAt = (ctx.now ?? new Date()).toISOString();\n\n  // The dominant degrade: an unsupported OS knocks out every capability with a\n  // single coherent reason.\n  const osReason: CapabilityUnavailableReason | null = osSupported ? null : \"os_unsupported\";\n\n  const fileSystem = (() => {\n    if (osReason) {\n      return {\n        available: false,\n        readOnly: true,\n        root: descriptor.workspaceRoot,\n        pathSep: \"/\" as const,\n        treeMode: \"lazy\" as const,\n        reason: osReason,\n      };\n    }\n    const cap = descriptor.capabilities.FileSystem;\n    return {\n      available: cap.available,\n      readOnly: cap.readOnly,\n      root: descriptor.workspaceRoot,\n      pathSep: \"/\" as const,\n      treeMode: \"lazy\" as const,\n      reason: cap.available ? null : (\"backend_unsupported\" as const),\n    };\n  })();\n\n  const terminal = (() => {\n    const cap = descriptor.capabilities.Terminal;\n    if (osReason) {\n      return {\n        transport: null,\n        ptyCapable: false,\n        shell: \"/bin/bash\",\n        url: null,\n        token: null,\n        expiresAt: null,\n        reason: osReason,\n      };\n    }\n    if (!cap.available) {\n      return {\n        transport: null,\n        ptyCapable: false,\n        shell: \"/bin/bash\",\n        url: null,\n        token: null,\n        expiresAt: null,\n        reason: \"backend_unsupported\" as const,\n      };\n    }\n    // The REAL PTY (ttyd pty-ws) rides the SAME tunnel as the desktop, so it is\n    // gated identically: a real-PTY backend (cap.pty), the terminal policy toggle\n    // ON, and a live box. Until those hold the cell advertises the read-only\n    // sse-events firehose (Channel-A command.output still works) with a typed\n    // reason — degradation is a value, never an absent capability.\n    //   - terminal off         -> sse-events + disabled_by_policy.\n    //   - cold lease + NO mint  -> sse-events + lease_cold (no live pty-ws address;\n    //                             the caller mints it via mintTerminalStream at\n    //                             viewer attach).\n    //   - not a real-PTY backend-> sse-events (no reason; the firehose IS the cap).\n    // A PRESENT minted pty-ws url (ctx.terminalStream) is ITSELF proof of liveness:\n    // the box (Modal-warm OR selfhosted-online) actually served the ttyd port, so a\n    // cold MODAL-GROUP lease liveness must NOT degrade it. lease_cold only fires\n    // when nothing was minted. A selfhosted-active session has no warm Modal lease\n    // (liveness \"cold\") yet mints a valid RELAY pty-ws cell — honour it.\n    const ptyCapable = cap.pty;\n    let transport: \"pty-ws\" | \"relay-pty\" | \"sse-events\" = ptyCapable\n      ? (ctx.terminalStream?.transport ?? (cap.transport === \"relay-pty\" ? \"relay-pty\" : \"pty-ws\"))\n      : \"sse-events\";\n    let reason: CapabilityUnavailableReason | null = null;\n    if (ptyCapable && (ctx.terminalEnabled === false || ctx.streamTokenSecretAvailable === false)) {\n      transport = \"sse-events\";\n      reason = \"disabled_by_policy\";\n    } else if (ptyCapable && ctx.liveness !== \"warm\" && !ctx.terminalStream) {\n      transport = \"sse-events\";\n      reason = \"lease_cold\";\n    }\n    // The minted pty-ws endpoint is folded in ONLY when the terminal is actually\n    // serving pty-ws (the gates passed). When absent the cell advertises the\n    // capability with a null live address — the caller mints it via POST /viewers.\n    const minted =\n      transport === \"pty-ws\" || transport === \"relay-pty\" ? ctx.terminalStream : undefined;\n    return {\n      transport,\n      ptyCapable,\n      shell: \"/bin/bash\",\n      url: minted?.url ?? null,\n      token: minted?.token ?? null,\n      expiresAt: minted?.expiresAt ?? null,\n      reason,\n    };\n  })();\n\n  const git = (() => {\n    const cap = descriptor.capabilities.Git;\n    if (osReason) {\n      return { available: false, repos: [], reason: osReason };\n    }\n    return {\n      available: cap.available,\n      repos: [],\n      reason: cap.available ? null : (\"backend_unsupported\" as const),\n    };\n  })();\n\n  const desktop = (() => {\n    const cap = descriptor.capabilities.DesktopStream;\n    // Reason precedence: OS > backend-tier feasibility > policy disable >\n    // stream-token-secret > cold lease WITHOUT a mint.\n    let reason: CapabilityUnavailableReason | null = null;\n    let available = cap.available;\n    if (osReason) {\n      available = false;\n      reason = osReason;\n    } else if (!cap.available) {\n      available = false;\n      // Headless tiers expose the typed tier_headless reason; dev/none are\n      // backend_unsupported for desktop.\n      reason = descriptor.tier === \"headless\" ? \"tier_headless\" : \"backend_unsupported\";\n    } else if (!ctx.desktopEnabled) {\n      available = false;\n      reason = \"disabled_by_policy\";\n    } else if (ctx.streamTokenSecretAvailable === false) {\n      // Graceful degrade (stream-token availability contract): desktop is enabled + backend-capable, but no\n      // stream-token secret is resolvable, so no scoped token can be minted. The\n      // deployment boots; the desktop cell reports transport:null + a typed\n      // reason rather than crashing the API.\n      available = false;\n      reason = \"disabled_by_policy\";\n    } else if (ctx.liveness !== \"warm\" && !ctx.desktopStream) {\n      // A PRESENT minted pixel url (ctx.desktopStream) is ITSELF proof of liveness:\n      // the box (Modal-warm OR selfhosted-online) actually served the noVNC port,\n      // so a cold MODAL-GROUP lease liveness must NOT degrade it. lease_cold only\n      // fires when nothing was minted. A selfhosted-active session has no warm\n      // Modal lease (liveness \"cold\") yet mints a valid RELAY framebuffer cell —\n      // honour it (the un-redacted-pixel ack gate below still applies).\n      available = false;\n      reason = \"lease_cold\";\n    }\n    const shared = available ? Boolean(ctx.shared) : false;\n    // The minted pixel endpoint is handed out ONLY when the desktop is actually\n    // available (the gates passed) AND acknowledged: an unacked/cold/degraded\n    // desktop never leaks a live URL (the un-redacted-pixel consent gate). When\n    // absent the cell advertises the capability with a null live address — the\n    // caller mints it via POST /viewers.\n    const acknowledged = available ? Boolean(ctx.desktopAcknowledged) : false;\n    const minted = available && acknowledged ? ctx.desktopStream : undefined;\n    // Human take-control: the cell is \"interactive\" when the desktop is actually\n    // available AND the deployment's take-control policy is on (default true). The\n    // box's x11vnc runs without -viewonly, so a viewer driving input reaches :0;\n    // this mode bit is the CLIENT gate (the \"Take control\" affordance). A\n    // deployment that wants a genuinely read-only desktop sets\n    // sandboxDesktopInteractive=false → mode \"read-only\" and the client disables\n    // take-control. An unavailable cell is always \"read-only\" (nothing to drive).\n    // Selfhosted desktop is the RELAY framebuffer: PNG-per-frame protobuf datagrams\n    // spliced over the relay, rendered by the \"frames\" canvas client — NOT noVNC/RFB\n    // (that x11vnc path exists only for Modal boxes). It is VIEW-ONLY in v1 (the\n    // frame client does not forward input yet), so its mode is always read-only\n    // regardless of the take-control policy.\n    const selfhostedFrames = ctx.backend === \"selfhosted\";\n    const interactive = available && !selfhostedFrames && ctx.desktopInteractive !== false;\n    const mode = interactive ? (\"interactive\" as const) : (\"read-only\" as const);\n    return {\n      transport: available ? (selfhostedFrames ? (\"relay-frames\" as const) : cap.transport) : null,\n      client: available ? (selfhostedFrames ? (\"frames\" as const) : (\"novnc\" as const)) : null,\n      mode,\n      url: minted?.url ?? null,\n      token: minted?.token ?? null,\n      expiresAt: minted?.expiresAt ?? null,\n      resolution: minted?.resolution ?? ([1024, 768] as [number, number]),\n      // Desktop pixels are ALWAYS un-redacted when present (the literal\n      // framebuffer); the acknowledgment gate rests on this.\n      unredacted: true,\n      requiresAcknowledgment: available,\n      acknowledged: available ? Boolean(ctx.desktopAcknowledged) : false,\n      // Shared-exposure disclosure (addendum E.1): `shared` when the group has\n      // >1 session; `sharedSessionIds` is the OTHER sessions' ids ONLY (never\n      // their conversation/metadata). Empty/false for a solo box or when the\n      // desktop cell is unavailable.\n      shared,\n      sharedSessionIds: shared ? (ctx.sharedSessionIds ?? []) : [],\n      reason,\n    };\n  })();\n\n  const recording = (() => {\n    const cap = descriptor.capabilities.Recording;\n    if (osReason) {\n      return {\n        available: false,\n        modes: [] as (\"manual\" | \"on-verify\")[],\n        codecs: [] as (\"h264-mp4\" | \"vp9-webm\")[],\n        reason: osReason,\n      };\n    }\n    if (!cap.available) {\n      return {\n        available: false,\n        modes: [] as (\"manual\" | \"on-verify\")[],\n        codecs: [] as (\"h264-mp4\" | \"vp9-webm\")[],\n        reason:\n          descriptor.tier === \"headless\"\n            ? (\"tier_headless\" as const)\n            : (\"backend_unsupported\" as const),\n      };\n    }\n    // Recording feasibility tracks desktop; policy-gate it the same way.\n    if (!ctx.desktopEnabled) {\n      return {\n        available: false,\n        modes: [] as (\"manual\" | \"on-verify\")[],\n        codecs: [] as (\"h264-mp4\" | \"vp9-webm\")[],\n        reason: \"disabled_by_policy\" as const,\n      };\n    }\n    return {\n      available: true,\n      modes: [\"manual\", \"on-verify\"] as (\"manual\" | \"on-verify\")[],\n      codecs: [\"h264-mp4\", \"vp9-webm\"] as (\"h264-mp4\" | \"vp9-webm\")[],\n      reason: null,\n    };\n  })();\n\n  // Compatibility cell only. New agent interaction is exposed through the\n  // managed ComputerSession tool family, never this legacy capability flag.\n  const computerUse = {\n    available: false,\n    readOnly: true,\n    reason: \"disabled_by_policy\" as const,\n  };\n\n  return {\n    sessionId: ctx.sessionId,\n    backend: ctx.backend,\n    os: ctx.os,\n    liveness: ctx.liveness,\n    leaseEpoch: ctx.leaseEpoch,\n    workspaceGeneration: ctx.workspaceGeneration ?? null,\n    archiveGeneration: ctx.archiveGeneration ?? null,\n    archiveComplete: ctx.archiveComplete ?? false,\n    viewerHeartbeatIntervalMs: 30_000,\n    FileSystem: fileSystem,\n    Terminal: terminal,\n    Git: git,\n    DesktopStream: desktop,\n    Recording: recording,\n    ComputerUse: computerUse,\n    negotiatedAt,\n  };\n}\n","/** Provider-neutral helpers for normalizing sandbox command results. */\nexport function sandboxCommandExitCode(result: unknown): number | null {\n  if (typeof result === \"string\") {\n    const match = result.match(/Process exited with code (-?\\d+)/);\n    return match ? Number(match[1]) : null;\n  }\n  if (!result || typeof result !== \"object\") return null;\n  const candidate = result as {\n    exitCode?: unknown;\n    exit_code?: unknown;\n    code?: unknown;\n    status?: unknown;\n  };\n  for (const value of [candidate.exitCode, candidate.exit_code, candidate.code, candidate.status]) {\n    if (typeof value === \"number\") return value;\n  }\n  return null;\n}\n\nexport function sandboxCommandOutput(result: unknown): string {\n  if (typeof result === \"string\") {\n    const outputIndex = result.indexOf(\"Output:\");\n    return outputIndex >= 0 ? result.slice(outputIndex + \"Output:\".length).trim() : result.trim();\n  }\n  if (!result || typeof result !== \"object\") return \"\";\n  const candidate = result as { output?: unknown; stdout?: unknown; stderr?: unknown };\n  return [candidate.output, candidate.stderr, candidate.stdout]\n    .filter((value): value is string => typeof value === \"string\" && value.length > 0)\n    .join(\"\\n\");\n}\n\n/** Return stdout exactly once for machine parsing. */\nexport function sandboxCommandStdout(result: unknown): string {\n  if (typeof result === \"string\") return sandboxCommandOutput(result);\n  if (!result || typeof result !== \"object\") return \"\";\n  const candidate = result as { output?: unknown; stdout?: unknown };\n  if (typeof candidate.stdout === \"string\" && candidate.stdout.length > 0) {\n    return candidate.stdout;\n  }\n  return typeof candidate.output === \"string\" ? candidate.output : \"\";\n}\n\nexport function sandboxCommandStillRunning(result: unknown): boolean {\n  if (typeof result === \"string\") return /Process running with session ID \\d+/u.test(result);\n  if (!result || typeof result !== \"object\") return false;\n  const candidate = result as { sessionId?: unknown; session_id?: unknown };\n  return typeof candidate.sessionId === \"number\" || typeof candidate.session_id === \"number\";\n}\n","const RUN_STATE_SANDBOX_PROVIDERS = new Set([\n  \"blaxel\",\n  \"cloudflare\",\n  \"daytona\",\n  \"docker\",\n  \"e2b\",\n  \"local\",\n  \"modal\",\n  \"none\",\n  \"runloop\",\n  \"selfhosted\",\n  \"vercel\",\n]);\n\nexport type RunStateExposedPortsCompatibilityRepair = {\n  provider: string;\n  sessionClass: \"root\" | \"agent\";\n  path:\n    | \"sandbox.sessionState.exposedPorts\"\n    | \"sandbox.sessionsByAgent[*].sessionState.exposedPorts\";\n};\n\nexport type RunStateExposedPortsCompatibilityResult = {\n  serializedRunState: string;\n  repairs: RunStateExposedPortsCompatibilityRepair[];\n};\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  if (value === null || typeof value !== \"object\" || Array.isArray(value)) {\n    return false;\n  }\n  const prototype = Object.getPrototypeOf(value);\n  return prototype === Object.prototype || prototype === null;\n}\n\n/**\n * RunState owns `exposedPorts` as a port-keyed endpoint record. Provider clients\n * separately own configured/predeclared port arrays in their provider state.\n */\nexport function runStateExposedPortsRecord(value: unknown): Record<string, unknown> | undefined {\n  return isRecord(value) ? structuredClone(value) : undefined;\n}\n\nexport function runStateCompatibilityProvider(value: unknown): string {\n  return typeof value === \"string\" && RUN_STATE_SANDBOX_PROVIDERS.has(value) ? value : \"unknown\";\n}\n\nfunction runStateCompatibilityProviderFromEntry(\n  sessionState: unknown,\n  enclosingBackendId: unknown,\n): string {\n  const sessionProvider = runStateCompatibilityProvider(\n    isRecord(sessionState) ? sessionState.backendId : undefined,\n  );\n  return sessionProvider === \"unknown\"\n    ? runStateCompatibilityProvider(enclosingBackendId)\n    : sessionProvider;\n}\n\nfunction removeInvalidExposedPorts(\n  sessionState: unknown,\n  repair: RunStateExposedPortsCompatibilityRepair,\n  observations: Map<string, RunStateExposedPortsCompatibilityRepair>,\n): boolean {\n  if (!isRecord(sessionState) || !(\"exposedPorts\" in sessionState)) {\n    return false;\n  }\n  if (runStateExposedPortsRecord(sessionState.exposedPorts)) {\n    return false;\n  }\n  delete sessionState.exposedPorts;\n  observations.set(`${repair.provider}:${repair.sessionClass}:${repair.path}`, repair);\n  return true;\n}\n\n/**\n * Repair only the two SDK-owned RunState sandbox envelope locations. This is a\n * deterministic, path-bounded compatibility transform for historical blobs;\n * providerState (including configuredExposedPorts arrays) and every unrelated\n * RunState field remain untouched.\n */\nexport function repairSerializedRunStateExposedPorts(\n  serializedRunState: string,\n): RunStateExposedPortsCompatibilityResult {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(serializedRunState);\n  } catch {\n    return { serializedRunState, repairs: [] };\n  }\n  if (!isRecord(parsed) || !isRecord(parsed.sandbox)) {\n    return { serializedRunState, repairs: [] };\n  }\n\n  const sandbox = parsed.sandbox;\n  const observations = new Map<string, RunStateExposedPortsCompatibilityRepair>();\n  let changed = removeInvalidExposedPorts(\n    sandbox.sessionState,\n    {\n      provider: runStateCompatibilityProviderFromEntry(sandbox.sessionState, sandbox.backendId),\n      sessionClass: \"root\",\n      path: \"sandbox.sessionState.exposedPorts\",\n    },\n    observations,\n  );\n\n  if (isRecord(sandbox.sessionsByAgent)) {\n    for (const entry of Object.values(sandbox.sessionsByAgent)) {\n      if (!isRecord(entry)) continue;\n      changed =\n        removeInvalidExposedPorts(\n          entry.sessionState,\n          {\n            provider: runStateCompatibilityProviderFromEntry(entry.sessionState, entry.backendId),\n            sessionClass: \"agent\",\n            path: \"sandbox.sessionsByAgent[*].sessionState.exposedPorts\",\n          },\n          observations,\n        ) || changed;\n    }\n  }\n\n  return changed\n    ? { serializedRunState: JSON.stringify(parsed), repairs: [...observations.values()] }\n    : { serializedRunState, repairs: [] };\n}\n","import { isModalTaskExecStartPreDispatchUnavailableError } from \"./providers/modal\";\n\n/** The function tool whose one invocation starts exactly one sandbox command. */\nexport const COMMAND_START_TOOL_NAME = \"exec_command\";\n\nconst MAX_DEPTH = 8;\nconst MAX_NODES = 64;\n\n/**\n * Call-scoped proof that one `exec_command` invocation never dispatched its\n * command. Only the runtime's own invocation wrapper creates it, and only around\n * the provider's typed pre-dispatch readiness proof, so the worker can settle\n * exactly this call as not started instead of unknown.\n */\nexport class ToolCallCommandNotStartedError extends Error {\n  readonly callId: string;\n\n  constructor(callId: string, cause: unknown) {\n    super(\"The sandbox command was not started\", { cause });\n    this.name = \"ToolCallCommandNotStartedError\";\n    this.callId = callId;\n  }\n}\n\ntype InvokableTool = {\n  type: string;\n  name: string;\n  invoke?: (context: never, input: string, details?: never) => Promise<unknown>;\n};\n\n/**\n * Wrap `exec_command` so a proven pre-dispatch command-start failure carries\n * the exact call it belongs to. Every other outcome, including a rendered\n * error string or an ambiguous start, passes through unchanged.\n */\nexport function withCommandNotStartedCallProof<T extends InvokableTool>(tool: T): T {\n  if (tool.type !== \"function\" || tool.name !== COMMAND_START_TOOL_NAME || !tool.invoke) {\n    return tool;\n  }\n  const invoke = tool.invoke;\n  return {\n    ...tool,\n    invoke: async (context: never, input: string, details?: never) => {\n      try {\n        return await invoke(context, input, details);\n      } catch (error) {\n        const callId = (details as { toolCall?: { callId?: unknown } } | undefined)?.toolCall\n          ?.callId;\n        if (\n          typeof callId === \"string\" &&\n          callId.length > 0 &&\n          isModalTaskExecStartPreDispatchUnavailableError(error)\n        ) {\n          throw new ToolCallCommandNotStartedError(callId, error);\n        }\n        throw error;\n      }\n    },\n  };\n}\n\n/**\n * The call ids an error proves were never started. The whole error must still\n * satisfy the pre-dispatch proof: any retained or outcome-unknown boundary in\n * the same chain vetoes every call, and lookalike names never qualify.\n */\nexport function toolCallCommandNotStartedCallIds(error: unknown): string[] {\n  if (!isModalTaskExecStartPreDispatchUnavailableError(error)) return [];\n  const callIds = new Set<string>();\n  const pending: Array<{ depth: number; value: unknown }> = [{ depth: 0, value: error }];\n  const seen = new WeakSet<object>();\n  let inspected = 0;\n  while (pending.length > 0 && inspected < MAX_NODES) {\n    const current = pending.shift()!;\n    inspected += 1;\n    if (!current.value || typeof current.value !== \"object\" || seen.has(current.value)) continue;\n    if (current.depth > MAX_DEPTH) continue;\n    seen.add(current.value);\n    if (current.value instanceof ToolCallCommandNotStartedError) {\n      if (isModalTaskExecStartPreDispatchUnavailableError(current.value.cause)) {\n        callIds.add(current.value.callId);\n      }\n      continue;\n    }\n    const record = current.value as Record<string, unknown>;\n    for (const key of [\"cause\", \"error\"] as const) {\n      const descriptor = Object.getOwnPropertyDescriptor(record, key);\n      if (descriptor && \"value\" in descriptor) {\n        pending.push({ depth: current.depth + 1, value: descriptor.value });\n      }\n    }\n    const errors = Object.getOwnPropertyDescriptor(record, \"errors\");\n    if (errors && \"value\" in errors && Array.isArray(errors.value)) {\n      for (const nested of errors.value.slice(0, 32)) {\n        pending.push({ depth: current.depth + 1, value: nested });\n      }\n    }\n  }\n  return [...callIds];\n}\n","import { createHash } from \"node:crypto\";\nimport { types } from \"node:util\";\nimport { z } from \"zod\";\nimport { canonicalModalCheckpointProviderBinding } from \"@opengeni/contracts\";\n\nconst uuid = z.string().regex(/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/u);\nconst empty = z.object({}).strict();\nconst binding = z\n  .object({\n    version: z.literal(1),\n    serverUrl: z.string().max(2048),\n    workspaceName: z.string().min(1).max(200),\n    environment: z.string().max(200),\n  })\n  .strict();\nconst blueprint = z\n  .object({\n    version: z.literal(1),\n    adapterId: z.literal(\"modal-native-fresh-creator-reservation-v1\"),\n    create: z\n      .object({\n        operationId: uuid,\n        appId: z.string().regex(/^ap-[A-Za-z0-9_-]{1,200}$/u),\n        imageId: z.string().regex(/^im-[A-Za-z0-9_-]{1,200}$/u),\n        cpu: z\n          .number()\n          .positive()\n          .max(128)\n          .refine((value) => {\n            const milli = Math.trunc(1000 * value);\n            return Number.isSafeInteger(milli) && milli >= 1 && milli / 1000 === value;\n          }),\n        memoryMiB: z.number().int().safe().min(128).max(1_048_576),\n        timeoutSeconds: z.number().int().safe().min(1).max(86_400),\n        env: empty,\n        mounts: z.tuple([]),\n      })\n      .strict(),\n    restore: z.null(),\n    readiness: z\n      .object({\n        operationId: uuid,\n        execId: uuid,\n        commandArgs: z.tuple([z.literal(\"/bin/true\")]),\n        workdir: z.literal(\"/tmp\"),\n        env: empty,\n      })\n      .strict(),\n    publishOperationId: uuid,\n    cleanup: z\n      .object({ operationId: uuid, requires: z.literal(\"physical-terminal-proof\") })\n      .strict(),\n  })\n  .strict();\n\n/** A new wrapper around the unchanged reservation vocabulary. These additional\n * fields MUST NOT be passed as extra keys to the reservation-v1 DB API. */\nconst specSchema = z\n  .object({\n    version: z.literal(1),\n    recipeId: z.literal(\"modal-native-fresh-v1\"),\n    recipeRevision: z.literal(1),\n    createWorkdir: z.literal(\"/tmp\"),\n    entrypoint: z.tuple([z.literal(\"sleep\"), z.literal(\"infinity\")]),\n    origin: z\n      .object({\n        version: z.literal(1),\n        planId: uuid,\n        creatorId: uuid,\n        accountId: uuid,\n        workspaceId: uuid,\n        sessionId: uuid,\n        turnId: uuid,\n        attemptId: uuid,\n        executionGeneration: z.number().int().positive().safe(),\n        triggerEventId: uuid,\n        sandboxGroupId: uuid,\n        routeKind: z.literal(\"home\"),\n        routeTargetId: z.null(),\n        routeEpoch: z.number().int().nonnegative().safe(),\n        providerBindingKey: z.string().min(1).max(4096),\n        providerBinding: binding,\n      })\n      .strict(),\n    blueprint,\n  })\n  .strict();\nexport type NativeFreshCreateSpec = z.infer<typeof specSchema>;\n\ntype Immutable<T> = T extends readonly unknown[]\n  ? { readonly [K in keyof T]: Immutable<T[K]> }\n  : T extends object\n    ? { readonly [K in keyof T]: Immutable<T[K]> }\n    : T;\n\nconst normalization = {\n  recipeId: \"modal-native-fresh-v1\",\n  recipeRevision: 1,\n  schema: \"modal.client.ModalClient/SandboxCreate\",\n  encoding: \"modal-create-json-v1\",\n  sdkVersion: \"0.9.0\",\n  // Reviewed installed source; this is a pinned normalization fingerprint,\n  // not a runtime file read or an attestation of transmitted protobuf bytes.\n  sdkSourceSha256: \"bb830ded1925e1d927d1fc221b2329d961f9a57eafdd9a85bf13fb7cfc982599\",\n  entrypoint: [\"sleep\", \"infinity\"],\n  createWorkdir: \"/tmp\",\n  env: {},\n  mounts: [],\n  restore: null,\n  idleTimeout: \"unset\",\n  gpu: \"unset\",\n  gpuProto: { type: 0, count: 0, gpuType: \"\" },\n  cpuLimit: \"unset\",\n  memoryLimit: \"unset\",\n  pty: \"unset\",\n  regions: \"unset\",\n  proxy: \"unset\",\n  readinessProbe: \"unset\",\n  environmentVariables: \"unset\",\n  network: {\n    access: \"OPEN\",\n    outboundCidrs: [],\n    outboundDomains: [],\n    inboundCidrs: [],\n    i6pn: false,\n  },\n  volumes: [],\n  cloudBucketMounts: [],\n  secrets: [],\n  ports: [],\n  cloud: \"\",\n  verbose: false,\n  includeOidcIdentityToken: false,\n  experimentalOptions: {},\n  experimentalOptionsV2: {},\n  customDomain: \"\",\n} as const;\nconst sha256 = (value: string) => createHash(\"sha256\").update(value).digest(\"hex\");\nconst compilerFingerprint = sha256(JSON.stringify(normalization));\n\nfunction freeze<T>(value: T): Immutable<T> {\n  if (value !== null && typeof value === \"object\") {\n    for (const child of Object.values(value)) freeze(child);\n    Object.freeze(value);\n  }\n  return value as Immutable<T>;\n}\nfreeze(normalization);\n\n/** Inspect descriptors before parsing/cloning: no getter, callback, class,\n * sparse array, hidden key or non-JSON input may provide a specification. */\nfunction ownData(value: unknown, depth = 0): void {\n  if (depth > 12) throw new Error(\"Unsupported native fresh-create specification\");\n  if (value === null || typeof value === \"string\" || typeof value === \"boolean\") return;\n  if (typeof value === \"number\") {\n    if (Number.isFinite(value) && !Object.is(value, -0)) return;\n    throw new Error(\"Unsupported native fresh-create specification\");\n  }\n  // Native detection must precede reflection, including for revoked Proxies.\n  if (typeof value !== \"object\" || types.isProxy(value))\n    throw new Error(\"Unsupported native fresh-create specification\");\n  const array = Array.isArray(value);\n  const prototype = Object.getPrototypeOf(value);\n  if (array ? prototype !== Array.prototype : prototype !== Object.prototype && prototype !== null)\n    throw new Error(\"Unsupported native fresh-create specification\");\n  const descriptors = Object.getOwnPropertyDescriptors(value);\n  const keys = Reflect.ownKeys(descriptors).filter((key) => !(array && key === \"length\"));\n  if (array && keys.length !== (value as unknown[]).length)\n    throw new Error(\"Unsupported native fresh-create specification\");\n  for (const key of keys) {\n    if (typeof key !== \"string\" || (array && !/^(0|[1-9][0-9]*)$/u.test(key)))\n      throw new Error(\"Unsupported native fresh-create specification\");\n    const descriptor = descriptors[key]!;\n    if (!descriptor.enumerable || !(\"value\" in descriptor))\n      throw new Error(\"Unsupported native fresh-create specification\");\n    ownData(descriptor.value, depth + 1);\n  }\n}\n\n/** Modal 0.9.0 buildSandboxCreateRequestProto + generated fromPartial defaults,\n * followed by the atomic name/tag injection of modal-create-boundary. Property\n * order and intentionally undefined fields are part of this JSON correlation\n * recipe. Pinned-SDK parity tests, not generic SDK reentry, guard this mirror. */\nfunction normalizedRequest(spec: NativeFreshCreateSpec) {\n  const create = spec.blueprint.create;\n  return {\n    appId: create.appId,\n    definition: {\n      entrypointArgs: [...spec.entrypoint],\n      mountIds: [],\n      imageId: create.imageId,\n      secretIds: [],\n      resources: {\n        memoryMb: create.memoryMiB,\n        milliCpu: Math.trunc(1000 * create.cpu),\n        gpuConfig: { type: 0, count: 0, gpuType: \"\" },\n        memoryMbMax: 0,\n        ephemeralDiskMb: 0,\n        milliCpuMax: 0,\n        rdma: false,\n      },\n      cloudProvider: 0,\n      timeoutSecs: (create.timeoutSeconds * 1000) / 1000,\n      workdir: spec.createWorkdir,\n      nfsMounts: [],\n      runtimeDebug: false,\n      blockNetwork: false,\n      s3Mounts: [],\n      cloudBucketMounts: [],\n      volumeMounts: [],\n      ptyInfo: undefined,\n      schedulerPlacement: undefined,\n      workerId: \"\",\n      openPorts: { ports: [] },\n      i6pnEnabled: false,\n      networkAccess: { networkAccessType: 1, allowedCidrs: [], allowedDomains: [] },\n      proxyId: undefined,\n      enableSnapshot: false,\n      snapshotVersion: undefined,\n      cloudProviderStr: \"\",\n      runscRuntimeVersion: undefined,\n      runtime: undefined,\n      verbose: false,\n      name: `opengeni-create-${create.operationId}`,\n      experimentalOptions: {},\n      experimentalOptionsV2: {},\n      preloadPathPrefixes: [],\n      idleTimeoutSecs: undefined,\n      directSandboxCommandsEnabled: false,\n      RestoreInstanceType: \"\",\n      customDomain: \"\",\n      includeOidcIdentityToken: false,\n      readinessProbe: undefined,\n      inboundCidrAllowlist: [],\n      environmentVariables: undefined,\n    },\n    environmentName: \"\",\n    tags: [{ tagName: \"opengeni_provider_create_operation_id\", tagValue: create.operationId }],\n  };\n}\n\nexport type NativeFreshCreateCompilation = Immutable<{\n  version: 1;\n  recipeId: \"modal-native-fresh-v1\";\n  recipeRevision: 1;\n  compilerFingerprint: string;\n  normalization: typeof normalization;\n  spec: NativeFreshCreateSpec;\n  normalizedRequest: ReturnType<typeof normalizedRequest>;\n  requestJson: string;\n  request: {\n    encoding: \"modal-create-json-v1\";\n    sha256: string;\n    byteLength: number;\n    encoderFingerprint: string;\n  };\n}>;\n\n/** Opaque local compilation handle. It is correlation data, never an accepted\n * operation, authenticated principal, reservation or fresh dispatch grant. */\nexport type NativeFreshCreatePreparation = Readonly<object>;\nconst prepared = new WeakMap<object, NativeFreshCreateCompilation>();\n\n/** Synchronous, credentials-free and zero provider/DB/config I/O. Requires all\n * IDs and the complete known fresh recipe before election. Never creates IDs,\n * resolves apps/images, invokes SDK helpers or consumes dispatch authority. */\nexport function compileNativeFreshCreate(\n  input: NativeFreshCreateSpec,\n): NativeFreshCreatePreparation {\n  try {\n    ownData(input);\n    const copied: unknown = structuredClone(input);\n    if (Buffer.byteLength(JSON.stringify(copied)) > 32_768)\n      throw new Error(\"Unsupported native fresh-create specification\");\n    const spec = specSchema.parse(copied);\n    const { origin, blueprint: plan } = spec;\n    const canonical = canonicalModalCheckpointProviderBinding(origin.providerBinding);\n    const serverUrl = new URL(origin.providerBinding.serverUrl);\n    if (\n      !canonical ||\n      canonical.key !== origin.providerBindingKey ||\n      ([\"serverUrl\", \"workspaceName\", \"environment\"] as const).some(\n        (field) => canonical.binding[field] !== origin.providerBinding[field],\n      ) ||\n      ![\"https:\", \"http:\"].includes(serverUrl.protocol) ||\n      serverUrl.username ||\n      serverUrl.password ||\n      serverUrl.search ||\n      serverUrl.hash ||\n      origin.creatorId === origin.attemptId\n    )\n      throw new Error(\"Unsupported native fresh-create specification\");\n    const ids = [\n      origin.planId,\n      origin.creatorId,\n      plan.create.operationId,\n      plan.readiness.operationId,\n      plan.readiness.execId,\n      plan.publishOperationId,\n      plan.cleanup.operationId,\n    ];\n    if (new Set(ids).size !== 7) throw new Error(\"Unsupported native fresh-create specification\");\n    const request = normalizedRequest(spec);\n    const requestJson = JSON.stringify(request);\n    const compilation: NativeFreshCreateCompilation = freeze({\n      version: 1,\n      recipeId: \"modal-native-fresh-v1\",\n      recipeRevision: 1,\n      compilerFingerprint,\n      normalization,\n      spec,\n      normalizedRequest: request,\n      requestJson,\n      request: {\n        encoding: \"modal-create-json-v1\",\n        sha256: sha256(requestJson),\n        byteLength: Buffer.byteLength(requestJson),\n        encoderFingerprint: compilerFingerprint,\n      },\n    });\n    const handle = Object.freeze({});\n    prepared.set(handle, compilation);\n    return handle;\n  } catch {\n    // Do not echo arbitrary input, provider tokens or schema diagnostics.\n    throw new Error(\"Unsupported native fresh-create specification\");\n  }\n}\n\n/** Authenticates ONLY local compiler issuance. The full frozen record contains\n * no credential/JWT, grant, DB receipt or transmitted-byte attestation. */\nexport function describeNativeFreshCreate(\n  handle: NativeFreshCreatePreparation,\n): NativeFreshCreateCompilation {\n  const compilation = prepared.get(handle);\n  if (!compilation) throw new Error(\"Unknown native fresh-create preparation\");\n  return compilation;\n}\n","// @opengeni/runtime/sandbox — the desktop display-stack launcher (P4.1).\n//\n// The agent-loop-free home for `ensureDisplayStack`: the exec-launched,\n// flock-idempotent procedure that brings up the Channel-B pixel stack\n// (Xvfb :0 -> XFCE -> x11vnc -> websockify:6080 -> noVNC) on a live,\n// externally-owned box. It is driven over the box's `exec`/`execCommand` channel\n// (NOT a container CMD) so it re-establishes after a snapshot rollover / box\n// re-election, and it is safe to call from the API on a viewer op OR from the\n// agent turn — a second concurrent call serializes on the in-box flock and\n// no-ops when the stack is already up.\n//\n// It lives under @opengeni/runtime/sandbox so the API-direct control plane\n// (apps/api) and the worker (apps/worker) both pull it from the same single\n// agent-loop-free leaf.\n//\n// Productionized from the PROVEN spike (spikes/desktop-stack PASSED locally:\n// noVNC 200, WS 101 + RFB banner, OCR'd a secret off the framebuffer) + the\n// gVisor harness (V2 PASSED live on Modal: XTEST input read-back under runsc).\n\nimport {\n  DESKTOP_STREAM_PORT,\n  LEGACY_SANDBOX_PROVIDER_INSTANCE_ID_FIELDS,\n  OPENGENI_SANDBOX_PROVIDER_INSTANCE_ID_FIELD,\n} from \"@opengeni/contracts\";\nimport { parseExecResponseBanner } from \"./exec-banner\";\n\n// Re-export under the canonical name the module spec uses (STREAM_PORT) while\n// keeping DESKTOP_STREAM_PORT as the single source of truth (contracts).\nexport { DESKTOP_STREAM_PORT };\nexport const STREAM_PORT = DESKTOP_STREAM_PORT;\n\n// The whole-stack launch is bounded by the readiness gates inside the up-script\n// (four loops of 50 * 0.1s = ~5s each, ~20s worst case) PLUS the PAINTABLE-FRAME\n// gate we append (up to ~30s of scrot probing) PLUS first-boot XFCE/dbus + font-cache\n// warm-up on a cold gVisor box. 90s gives headroom over the spike's observed ~5-10s\n// warm path AND the cold-box paint warm-up without masking a genuine wedge.\nexport const DISPLAY_STACK_TIMEOUT_MS = 90_000;\n\n// Provider exec APIs use `yieldTimeMs` as an output-yield window, not a process\n// deadline. Poll often enough to surface stage telemetry while the command keeps\n// running, but let the in-box `timeout(1)` own termination (see\n// `boundedDisplayStackCommand`).\nconst DISPLAY_STACK_PROVIDER_YIELD_MS = 15_000;\nconst DISPLAY_STACK_PROVIDER_POLL_MS = 5_000;\nconst DISPLAY_STACK_TERMINATION_GRACE_MS = 5_000;\n// Provider cancellation is transport-level and may never settle. Keep the\n// JavaScript-side cleanup/drain bounded as well; a later caller either gets a\n// positive in-box quiescence proof or remains fail-closed, but it must never\n// wait forever on a provider promise.\nconst DISPLAY_STACK_CLEANUP_CALL_MS = 250;\nconst DISPLAY_STACK_DRAIN_GRACE_MS = 100;\n\n// PAINTABLE-FRAME gate: poll scrot up to this many times, this many seconds apart,\n// waiting for an actually-PAINTED frame before declaring the stack \"up\" (~30s worst case).\nconst PAINT_PROBE_ATTEMPTS = 150;\nconst PAINT_PROBE_INTERVAL_S = 0.2;\n\n// The paint FLOOR (bytes): a scrot at/above this size is a real painted desktop; below\n// it, the root is still unpainted and the frame would read as \"blank\" to the model.\n//\n// WHY A SIZE FLOOR, NOT NON-EMPTINESS (the bug this fixes): the old gate only checked\n// `[ -s frame.png ]` (non-empty). But an UNPAINTED root is never zero-byte — a fresh\n// Xvfb draws either the `-retro` weave stipple or (with `-retro` dropped) solid black,\n// and scrot happily encodes that as a small-but-non-empty PNG. So the old gate passed\n// the instant the VNC ports bound — MEASURED at ~1.4s (fast runc host) to several\n// seconds (cold gVisor) BEFORE xfdesktop finishes its first wallpaper paint — handing\n// the model the pre-paint frame. That pre-paint frame is exactly the \"blank/black\"\n// screenshot that 400s the model and blanks the human viewer.\n//\n// The sizes are unambiguous and were measured on the canonical desktop image (1280x800)\n// under runc — both the current staging image and a fresh local build:\n//   painted XFCE desktop (blue-gradient wallpaper + panel + icons): ~210-222 KB\n//   `-retro` stipple root (unpainted, current image):                ~17 KB\n//   solid-black root (unpainted, after we drop `-retro`):            ~13.5 KB\n// 60 KB sits ~3.5x above every unpainted state and ~3.5x below a real paint — a wide,\n// unambiguous margin. It holds against BOTH the currently-deployed `-retro` image and\n// the `-retro`-dropped image this change ships, so the runtime gate is correct before\n// AND after the image rebuild lands. (Assumes the default ~1280x800 geometry; a larger\n// framebuffer only scales the painted frame further above the floor.)\nconst PAINT_MIN_BYTES = 60_000;\n\n// SETTLE gate (the gVisor staged-paint fix): crossing the 60 KB floor is necessary but\n// NOT sufficient. On a fast runc host the paint is atomic (black 13.5 KB -> full 209 KB\n// in one step, panel + icons included). On a STONE-COLD gVisor Modal box it is STAGED:\n// the wallpaper gradient paints and crosses 60 KB a beat BEFORE xfdesktop draws the\n// panel / launcher icons / logo. A screenshot in that window shows a bare teal wallpaper\n// with no panel — which the model correctly reports as \"graphical, but the desktop\n// hasn't fully loaded\" (VERIFIED live on staging: a cold-box turn's first agent\n// screenshot caught exactly this). So the gate additionally waits for the frame to\n// SETTLE: two consecutive probes both above the floor whose byte-sizes agree within\n// PAINT_SETTLE_DELTA_BYTES. A still-painting desktop grows between probes; a fully\n// rendered, static one is byte-stable (scrot -o omits the cursor, and the clock is\n// minute-precision, so consecutive captures of a settled desktop are near-identical).\n// This makes ensureDisplayStack block until the FULL desktop is up, so the turn's first\n// screenshot — which runs AFTER this gate — sees the panel, not a bare wallpaper.\nconst PAINT_SETTLE_DELTA_BYTES = 2_000;\n\n/** Desktop geometry for the framebuffer. v1 has no live RANDR: a resolution\n *  change is a full down -> up restart (a separate op). */\nexport type DesktopGeometry = {\n  width: number; // default 1280\n  height: number; // default 800\n  dpi: number; // default 96\n};\n\nexport const DEFAULT_DESKTOP_GEOMETRY: DesktopGeometry = { width: 1280, height: 800, dpi: 96 };\n\n/** Thrown when a stage of the launch script failed. exitCode 11/12/13 map to\n *  Xvfb / x11vnc / websockify respectively (the stage that died); 14 is the\n *  PAINTABLE-FRAME gate (ports listening but scrot still yields an empty frame —\n *  the display is up but not actually painting). Degradation is surfaced as a\n *  value to viewers by the caller; this error is for diagnostics. */\nexport class DisplayStackError extends Error {\n  readonly exitCode: number;\n  readonly stage: \"xvfb\" | \"x11vnc\" | \"websockify\" | \"paint\" | \"lock\" | \"timeout\" | \"unknown\";\n\n  constructor(exitCode: number, output: string) {\n    const stage =\n      exitCode === 11\n        ? \"xvfb\"\n        : exitCode === 12\n          ? \"x11vnc\"\n          : exitCode === 13\n            ? \"websockify\"\n            : exitCode === 14\n              ? \"paint\"\n              : exitCode === 15\n                ? \"lock\"\n                : exitCode === 124 || /OPENGENI_DISPLAY_TIMEOUT/u.test(output)\n                  ? \"timeout\"\n                  : \"unknown\";\n    super(\n      `desktop display stack failed at stage \"${stage}\" (exit ${exitCode})${output ? `:\\n${output}` : \"\"}`,\n    );\n    this.name = \"DisplayStackError\";\n    this.exitCode = exitCode;\n    this.stage = stage;\n  }\n}\n\n/** Thrown when the provider session cannot run commands (a headless-only\n *  backend with neither `exec` nor `execCommand`). The desktop tier degrades to\n *  Channel-A-only — the caller maps this to `DesktopStream.transport: null`. */\nexport class DisplayStackUnsupportedError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"DisplayStackUnsupportedError\";\n  }\n}\n\n// The structural slice of a provider session we need: run a command (preferring\n// `exec` for the structured exit code, falling back to `execCommand`).\ntype ExecResultLike = {\n  output?: string;\n  stdout?: string;\n  stderr?: string;\n  exitCode?: number | null;\n  sessionId?: number;\n  session_id?: number;\n};\ntype ExecCapableSession = {\n  state?: unknown;\n  exec?: (args: {\n    cmd: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n    signal?: AbortSignal;\n  }) => Promise<ExecResultLike>;\n  execCommand?: (args: {\n    cmd: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n    signal?: AbortSignal;\n  }) => Promise<string>;\n  writeStdin?: (args: {\n    sessionId: number;\n    chars: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n    signal?: AbortSignal;\n  }) => Promise<ExecResultLike | string>;\n};\n\nexport type DisplayStackCallerKind = \"viewer\" | \"computer\" | \"unknown\";\nexport type DisplayStackClassification = \"cold\" | \"already_ready\" | \"contention\" | \"unknown\";\nexport type DisplayStackTelemetryStatus = \"started\" | \"waiting\" | \"completed\" | \"failed\";\n\n/** Secret-free, bounded-cardinality stage observation. Provider/sandbox IDs are\n * log correlation fields, never metric labels. */\nexport type DisplayStackTelemetryEvent = {\n  type: \"display_stack.stage\";\n  requestId: string;\n  stage: string;\n  status: DisplayStackTelemetryStatus;\n  elapsedMs: number;\n  source: \"host\" | \"sandbox\";\n  classification: DisplayStackClassification;\n  callerKind: DisplayStackCallerKind;\n  sandboxId?: string;\n  leaseEpoch?: number;\n  providerSessionId?: number;\n};\n\nexport type DisplayStackTelemetryContext = {\n  callerKind: DisplayStackCallerKind;\n  sandboxId?: string;\n  leaseEpoch?: number;\n};\n\nexport type EnsureDisplayStackOptions = {\n  geometry?: DesktopGeometry;\n  /** The exposed stream port; defaults to 6080. */\n  port?: number;\n  /** Whole-operation wall-clock timeout; defaults to DISPLAY_STACK_TIMEOUT_MS. */\n  timeoutMs?: number;\n  /** Caller correlation. Supplying it enables the default structured log sink. */\n  telemetryContext?: DisplayStackTelemetryContext;\n  /** Optional non-blocking telemetry sink (tests/embedders may replace logging). */\n  onTelemetry?: (event: DisplayStackTelemetryEvent) => void | Promise<void>;\n};\n\nexport type EnsureDisplayStackResult = {\n  /** The exposed port the stack listens on (websockify/noVNC). */\n  port: number;\n  geometry: DesktopGeometry;\n  /** The raw `OPENGENI_DESKTOP_UP …` marker line, for diagnostics. Never\n   *  surfaced to viewers. */\n  marker: string;\n};\n\n/**\n * Build the shell command that runs the idempotent up-script under an in-box\n * `flock`. The script is shipped in the image at /usr/local/bin/opengeni-desktop-up\n * (the canonical desktop image); we set the geometry/port env and wrap the call\n * in `flock` so two concurrent ensureDisplayStack callers (the API viewer op +\n * the agent turn, both racing after a rollover) serialize without a double\n * launch. The up-script's own per-stage PID guards make the second call a no-op.\n *\n * Exported (pure, side-effect-free) so the ensureDisplayStack unit test can\n * assert the exact command sequence without a live box.\n */\nexport function buildDisplayStackScript(options: EnsureDisplayStackOptions = {}): string {\n  const geometry = options.geometry ?? DEFAULT_DESKTOP_GEOMETRY;\n  const port = options.port ?? DESKTOP_STREAM_PORT;\n  const env =\n    `DESKTOP_W=${geometry.width} DESKTOP_H=${geometry.height} ` +\n    `DESKTOP_DPI=${geometry.dpi} STREAM_PORT=${port}`;\n  // FAST PRE-CHECK (lock-free) before the outer flock: if the exposed port and\n  // x11vnc are ALREADY listening, the stack is up — print the marker and short-\n  // circuit, so a no-op caller (the agent turn re-ensuring after a viewer attach\n  // already brought the stack up) never serializes behind a lock holder and never\n  // burns the 45s flock -w timeout. `nc -z` to the two loopback ports is the cheap\n  // (sub-millisecond) \"already up?\" signal; on a miss we fall through to the\n  // flock-wrapped up-script (which ALSO pre-checks under its own lock).\n  //\n  // flock -w bounds the wait so a wedged holder can't deadlock the caller; the\n  // up-script itself ALSO takes the same lock (belt + braces) so this works even\n  // against an older image that predates the wrapper.\n  //\n  // PAINTABLE-FRAME GATE (the completion criterion): the up-script's readiness gates\n  // only assert that Xvfb answers xdpyinfo and that x11vnc:5900 + websockify:PORT are\n  // LISTENING — NOT that the display actually PAINTS. On a stone-cold gVisor box (the\n  // machine→sandbox swap-recovery turn always hits one), Xvfb answers and the VNC ports\n  // bind ~1.4s (fast host) to several seconds BEFORE xfdesktop finishes its first\n  // wallpaper paint. In that window a scrot yields a small UNPAINTED frame (the -retro\n  // stipple or a solid-black root) — never zero-byte — which is exactly the \"blank/black\"\n  // screenshot that 400s the model and blanks the human viewer. (VERIFIED locally: the\n  // real xfdesktop backdrop window maps at full 1280x800 the whole time; the render is\n  // never structurally broken — it is purely this pre-paint capture race.)\n  //\n  // We therefore chain a real scrot probe as the completion gate: after the up-script\n  // reports success, poll scrot until it produces an actually-PAINTED frame — a PNG at or\n  // above PAINT_MIN_BYTES, not merely NON-EMPTY (the old `[ -s ]` check passed on the\n  // ~17 KB pre-paint stipple immediately; that WAS the bug) — bounded ~30s, and only THEN\n  // let the command exit 0. If it never paints we exit 14 so the caller sees a typed\n  // DisplayStackError(\"paint\") — an HONEST failure the worker can degrade + log, rather\n  // than a false \"up\" that hands the model an unpainted image. `-ac` on Xvfb disables\n  // access control so this root-side scrot reaches :0. Runs on a pre-check hit too (cheap\n  // — an already-up display paints on the first probe). Lives in the runtime-built script\n  // (not the baked image up-script) so it ships with the worker/api, no image rebuild —\n  // and its size floor holds against the currently-deployed image too.\n  const lockedLauncher =\n    `ds_started=$1; fw=$2; ds_class=cold; ` +\n    `ds_stage() { ds_now=$(date +%s%3N); echo \"OPENGENI_DISPLAY_STAGE stage=$1 elapsed_ms=$((ds_now-ds_started)) classification=$ds_class\"; }; ` +\n    `fa=$(date +%s%3N); fd=$((fa-fw)); [ \"$fd\" -ge 50 ] && ds_class=contention; ` +\n    `ds_stage outer_flock_acquired; ds_stage launcher_issued; ` +\n    `env ${env} opengeni-desktop-up; urc=$?; ds_stage launcher_complete; exit \"$urc\"`;\n  const bringUp =\n    `if nc -z 127.0.0.1 ${port} >/dev/null 2>&1 && nc -z 127.0.0.1 5900 >/dev/null 2>&1; then ` +\n    `ds_class=already_ready; ds_stage precheck_ready; ` +\n    `echo \"OPENGENI_DESKTOP_UP port=${port} geometry=${geometry.width}x${geometry.height} dpi=${geometry.dpi} (precheck)\"; ` +\n    `else ` +\n    `ds_class=cold; ds_stage precheck_miss; ` +\n    `mkdir -p /tmp/opengeni-desktop; ` +\n    `ds_stage outer_flock_wait; fw=$(date +%s%3N); ` +\n    // Command-mode flock is the supervisor: it retains the lock until the launcher\n    // exits, while --close prevents Xvfb/XFCE/x11vnc/websockify from inheriting the\n    // lock descriptor when the launcher intentionally detaches them.\n    `flock --close --conflict-exit-code 75 --wait 45 /tmp/opengeni-desktop/up.outer.lock ` +\n    `bash -c ${shellQuote(lockedLauncher)} _ \"$ds_started\" \"$fw\"; frc=$?; ` +\n    `if [ \"$frc\" -eq 75 ]; then ds_stage outer_flock_timeout; echo \"OPENGENI_DESKTOP_LOCK_TIMEOUT\"; exit 15; fi; ` +\n    `if [ \"$frc\" -ne 0 ]; then exit \"$frc\"; fi; ` +\n    `fi`;\n  // A fresh /workspace HOME has no xfce4-desktop xfconf. xfdesktop then keeps a\n  // 10x10 manager window and never maps the 1280x800 Desktop child, so scrot\n  // stays ~21 KB (panel on black) and this gate fails forever. Seed the\n  // canonical xfce-blue.jpg backdrop (measured ~365 KB scrot) and start\n  // xfdesktop when the session autostart did not. $mon/$candidate/$WALL are\n  // shell — no ${} braces.\n  const paintSeed =\n    `ds_stage paint_backdrop_seed; ` +\n    `WALL=\"\"; ` +\n    `for candidate in /usr/share/backgrounds/xfce/xfce-blue.jpg /usr/share/backgrounds/xfce/*.jpg /usr/share/backgrounds/xfce/*.png; do ` +\n    `[ -f \"$candidate\" ] && WALL=\"$candidate\" && break; ` +\n    `done; ` +\n    `if [ -n \"$WALL\" ] && command -v xfconf-query >/dev/null 2>&1; then ` +\n    `for mon in monitor0 monitor1 monitorscreen monitorScreen monitorXvfb; do ` +\n    `xfconf-query -c xfce4-desktop -p /backdrop/screen0/$mon/workspace0/last-image --create -t string -s \"$WALL\" >/dev/null 2>&1 || true; ` +\n    `xfconf-query -c xfce4-desktop -p /backdrop/screen0/$mon/workspace0/image-style --create -t int -s 5 >/dev/null 2>&1 || true; ` +\n    `done; ` +\n    `fi; ` +\n    `if command -v xfdesktop >/dev/null 2>&1 && ! pgrep -x xfdesktop >/dev/null 2>&1; then ` +\n    `DISPLAY=:0 xfdesktop --disable-wm-check >/tmp/opengeni-desktop/xfdesktop.log 2>&1 & ` +\n    `fi; `;\n  const paintProbe =\n    `${paintSeed}` +\n    `ds_stage paint_probe_started; p=/tmp/opengeni-desktop/paint-probe.png; prev=0; ` +\n    `for i in $(seq 1 ${PAINT_PROBE_ATTEMPTS}); do ` +\n    // Capture, then measure the PNG byte-size. `wc -c < \"$p\"` yields a bare integer; a\n    // failed scrot leaves sz=0. A frame at/above PAINT_MIN_BYTES is a real painted desktop.\n    `if DISPLAY=:0 scrot -o \"$p\" >/dev/null 2>&1; then sz=$(wc -c < \"$p\" 2>/dev/null || echo 0); else sz=0; fi; ` +\n    `rm -f \"$p\"; ` +\n    // SETTLE: accept only when THIS probe AND the PREVIOUS one are both above the floor\n    // and their sizes agree within PAINT_SETTLE_DELTA_BYTES — i.e., the paint has stopped\n    // growing (the full desktop, panel + icons included, is up), not merely crossed the\n    // floor mid-paint on a staged gVisor boot. ($sz/$prev/$d are bare shell — no ${}\n    // braces — so JS leaves them for bash; ${PAINT_*} ARE JS constants and interpolate.)\n    `if [ \"$sz\" -ge ${PAINT_MIN_BYTES} ] && [ \"$prev\" -ge ${PAINT_MIN_BYTES} ]; then d=$((sz-prev)); [ \"$d\" -lt 0 ] && d=$((0-d)); if [ \"$d\" -le ${PAINT_SETTLE_DELTA_BYTES} ]; then ds_stage paint_ready; break; fi; fi; ` +\n    `prev=$sz; ` +\n    // NOTE: NOT_PAINTING goes to STDOUT (not stderr): Modal is execCommand-only, so the\n    // caller infers the outcome by string-matching the output — stdout is always captured.\n    `if [ \"$i\" = \"${PAINT_PROBE_ATTEMPTS}\" ]; then ds_stage paint_failed; echo \"OPENGENI_DESKTOP_NOT_PAINTING scrot below ${PAINT_MIN_BYTES}B or unsettled after warmup (last=$sz)\"; exit 14; fi; ` +\n    `sleep ${PAINT_PROBE_INTERVAL_S}; ` +\n    `done`;\n  const trace =\n    `ds_started=$(date +%s%3N); ds_class=unknown; ` +\n    `ds_stage() { ds_now=$(date +%s%3N); echo \"OPENGENI_DISPLAY_STAGE stage=$1 elapsed_ms=$((ds_now-ds_started)) classification=$ds_class\"; }; ` +\n    `ds_stage script_entry`;\n  return `${trace}; mkdir -p /tmp/opengeni-desktop; { ${bringUp} ; } && { ${paintProbe} ; }`;\n}\n\nfunction execResultOutput(result: ExecResultLike | string): string {\n  if (typeof result === \"string\") {\n    return result;\n  }\n  return [result.output, result.stderr, result.stdout]\n    .filter((v): v is string => typeof v === \"string\" && v.length > 0)\n    .join(\"\\n\");\n}\n\nfunction execResultExitCode(result: ExecResultLike | string): number | null {\n  if (typeof result === \"string\") {\n    const banner = parseExecResponseBanner(result);\n    if (banner.kind === \"exited\") return banner.exitCode;\n    // A malformed/truncated SDK response must not fall through to command-body\n    // marker inference, because its real terminal status is unknowable.\n    return banner.kind === \"invalid\" ? -1 : null;\n  }\n  return typeof result.exitCode === \"number\" ? result.exitCode : null;\n}\n\nfunction execResultSessionId(result: ExecResultLike | string): number | null {\n  if (typeof result === \"string\") {\n    const banner = parseExecResponseBanner(result);\n    return banner.kind === \"running\" ? banner.sessionId : null;\n  }\n  const value = result.sessionId ?? result.session_id;\n  return typeof value === \"number\" ? value : null;\n}\n\nfunction shellQuote(value: string): string {\n  return `'${value.replaceAll(\"'\", `'\"'\"'`)}'`;\n}\n\n/** The provider yield is not a deadline. Bound the actual lock-owning process in\n * the box, leaving time for TERM/KILL cleanup and the final exit result to reach\n * the caller before the outer JavaScript deadline. */\nfunction boundedDisplayStackCommand(\n  command: string,\n  timeoutMs: number,\n  markerPath: string,\n  markerToken: string,\n): string {\n  const graceMs = Math.min(\n    DISPLAY_STACK_TERMINATION_GRACE_MS,\n    Math.max(20, Math.floor(timeoutMs / 4)),\n  );\n  const commandTimeoutMs = Math.max(1, timeoutMs - graceMs);\n  const killAfterMs = Math.max(1, Math.floor(graceMs / 2));\n  const commandTimeoutSeconds = (commandTimeoutMs / 1_000).toFixed(3);\n  const killAfterSeconds = (killAfterMs / 1_000).toFixed(3);\n  const managedCommand =\n    `marker=${shellQuote(markerPath)}; token=${shellQuote(markerToken)}; ` +\n    `cancel=\"$marker.cancelled\"; ` +\n    `if [ -e \"$cancel\" ]; then echo \"OPENGENI_DISPLAY_CANCELLED\"; exit 124; fi; ` +\n    `pid=$$; pgid=$(ps -o pgid= -p \"$pid\" 2>/dev/null | tr -d ' '); ` +\n    `start=$(awk '{print $22}' \"/proc/$pid/stat\" 2>/dev/null || true); ` +\n    `printf '%s %s %s %s\\\\n' \"$pid\" \"$pgid\" \"$start\" \"$token\" >\"$marker\"; ` +\n    `if [ -e \"$cancel\" ]; then rm -f \"$marker\"; echo \"OPENGENI_DISPLAY_CANCELLED\"; exit 124; fi; ` +\n    // Do not install an EXIT trap: GNU timeout may terminate this supervisor\n    // while descendants survive. The marker must remain for the independent\n    // cleanup command to find and kill that orphaned process group.\n    `bash -c ${shellQuote(command)}; rc=$?; rm -f \"$marker\"; exit \"$rc\"`;\n  return (\n    // Do not use timeout --foreground here. The display command contains flock\n    // supervisors and launcher children; default process-group mode is required\n    // so a deadline cannot leave a waiter alive to acquire the lock and launch\n    // after the caller has already failed.\n    `timeout --signal=TERM --kill-after=${killAfterSeconds}s ${commandTimeoutSeconds}s ` +\n    `bash -c ${shellQuote(managedCommand)}; rc=$?; ` +\n    // Exit 137 is also a normal SIGKILL/OOM/provider-termination result. Only\n    // attach timeout attribution to the exit code that this wrapper positively\n    // knows GNU timeout emitted for its own deadline. A kill-after escalation\n    // may still be reported as 137, but it is not safe to infer that here.\n    `if [ \"$rc\" -eq 124 ]; then ` +\n    `echo \"OPENGENI_DISPLAY_TIMEOUT elapsed_ms=${commandTimeoutMs}\"; fi; exit \"$rc\"`\n  );\n}\n\nclass DisplayStackWallTimeoutError extends Error {}\nclass DisplayStackOperationFencedError extends Error {}\n\ntype PendingDisplayStackCleanup = {\n  markerPath: string;\n  markerToken: string;\n};\n\ntype DisplayStackOperationWaiter = {\n  epoch: number;\n  settled: boolean;\n  resolve: () => void;\n  reject: (error: unknown) => void;\n  timer?: ReturnType<typeof setTimeout>;\n};\n\ntype DisplayStackOperationState = {\n  /** Incremented before a timed-out operation is reported to its caller. */\n  epoch: number;\n  /** One provider operation at a time for each physical sandbox. */\n  owner: DisplayStackOperationWaiter | null;\n  /** Calls that started in the current epoch but are waiting for admission. */\n  waiters: DisplayStackOperationWaiter[];\n  /** Raw provider calls from fenced operations; only the in-box proof gates retries. */\n  inFlight: Set<Promise<unknown>>;\n  /** A bounded advisory drain for provider calls that may never settle. */\n  drain: Promise<void> | null;\n  /** Timed-out in-box processes that still need an independent kill/verify. */\n  pendingCleanup: Map<string, PendingDisplayStackCleanup>;\n  /** True only after every timed-out process has a positive quiescence proof. */\n  physicallyQuiescent: boolean;\n};\n\nconst stableDisplayStackOperationStates = new Map<string, DisplayStackOperationState>();\nconst stableSessionStateOperationStates = new WeakMap<object, DisplayStackOperationState>();\nconst displayStackOperationStates = new WeakMap<object, DisplayStackOperationState>();\n\nfunction asRecord(value: unknown): Record<string, unknown> | null {\n  return value !== null && typeof value === \"object\" ? (value as Record<string, unknown>) : null;\n}\n\nfunction nonEmptyString(value: unknown): string | null {\n  return typeof value === \"string\" && value.length > 0 ? value : null;\n}\n\nfunction readSessionState(session: unknown): unknown {\n  try {\n    return asRecord(session)?.state;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction stableSandboxIdentity(\n  session: unknown,\n  options: EnsureDisplayStackOptions,\n): string | null {\n  const explicit = nonEmptyString(options.telemetryContext?.sandboxId);\n  if (explicit) return `sandbox:${explicit}`;\n\n  const sessionRecord = asRecord(session);\n  const state = asRecord(readSessionState(session));\n  const providerState = state ? asRecord(state.providerState) : null;\n  const candidates = [sessionRecord, state, providerState];\n  // Use the same provider-neutral identity vocabulary as durable envelopes and\n  // the reaper. This keeps display-stack serialization stable for providers\n  // whose SDK identity is not named `sandboxId` (for example Runloop devboxId\n  // and Blaxel sandboxName) while retaining compatibility with existing SDKs.\n  const fields = [\n    OPENGENI_SANDBOX_PROVIDER_INSTANCE_ID_FIELD,\n    ...LEGACY_SANDBOX_PROVIDER_INSTANCE_ID_FIELDS,\n  ];\n  for (const candidate of candidates) {\n    if (!candidate) continue;\n    for (const field of fields) {\n      const value = nonEmptyString(candidate[field]);\n      if (value) return `sandbox:${value}`;\n    }\n  }\n  return null;\n}\n\nfunction newOperationState(): DisplayStackOperationState {\n  return {\n    epoch: 0,\n    owner: null,\n    waiters: [],\n    inFlight: new Set(),\n    drain: null,\n    pendingCleanup: new Map(),\n    physicallyQuiescent: true,\n  };\n}\n\nfunction operationState(\n  session: unknown,\n  options: EnsureDisplayStackOptions,\n): DisplayStackOperationState | null {\n  if ((typeof session !== \"object\" || session === null) && typeof session !== \"function\") {\n    return null;\n  }\n  const stableKey = stableSandboxIdentity(session, options);\n  if (stableKey) {\n    let state = stableDisplayStackOperationStates.get(stableKey);\n    if (!state) {\n      state = newOperationState();\n      stableDisplayStackOperationStates.set(stableKey, state);\n    }\n    return state;\n  }\n\n  // Modal resumed wrappers share their provider `state` object even when the\n  // wrapper instance is reconstructed. This is a useful stable fallback when\n  // an older/provider-specific state shape has no named identity field.\n  const providerState = readSessionState(session);\n  if (providerState && (typeof providerState === \"object\" || typeof providerState === \"function\")) {\n    const stateKey = providerState as object;\n    let state = stableSessionStateOperationStates.get(stateKey);\n    if (!state) {\n      state = newOperationState();\n      stableSessionStateOperationStates.set(stateKey, state);\n    }\n    return state;\n  }\n\n  const key = session as object;\n  let state = displayStackOperationStates.get(key);\n  if (!state) {\n    state = newOperationState();\n    displayStackOperationStates.set(key, state);\n  }\n  return state;\n}\n\nfunction settleOperationWaiter(waiter: DisplayStackOperationWaiter, error?: unknown): void {\n  if (waiter.settled) return;\n  waiter.settled = true;\n  if (waiter.timer) clearTimeout(waiter.timer);\n  if (error === undefined) waiter.resolve();\n  else waiter.reject(error);\n}\n\nfunction pumpOperationWaiters(state: DisplayStackOperationState): void {\n  if (state.owner) return;\n  while (state.waiters.length > 0) {\n    const waiter = state.waiters.shift()!;\n    if (waiter.settled) continue;\n    if (waiter.epoch !== state.epoch) {\n      settleOperationWaiter(waiter, new DisplayStackOperationFencedError());\n      continue;\n    }\n    state.owner = waiter;\n    settleOperationWaiter(waiter);\n    return;\n  }\n}\n\nfunction acquireOperation(\n  state: DisplayStackOperationState,\n  deadline: number,\n): Promise<() => void> {\n  return new Promise<() => void>((resolve, reject) => {\n    const waiter: DisplayStackOperationWaiter = {\n      epoch: state.epoch,\n      settled: false,\n      resolve: () => {\n        resolve(() => {\n          if (state.owner !== waiter) return;\n          state.owner = null;\n          pumpOperationWaiters(state);\n        });\n      },\n      reject,\n    };\n    state.waiters.push(waiter);\n    const remainingMs = deadline - monotonicNow();\n    if (remainingMs <= 0) {\n      waiter.settled = true;\n      state.waiters = state.waiters.filter((candidate) => candidate !== waiter);\n      reject(new DisplayStackWallTimeoutError());\n      return;\n    }\n    waiter.timer = setTimeout(() => {\n      if (waiter.settled) return;\n      waiter.settled = true;\n      state.waiters = state.waiters.filter((candidate) => candidate !== waiter);\n      reject(new DisplayStackWallTimeoutError());\n    }, remainingMs);\n    waiter.timer.unref?.();\n    pumpOperationWaiters(state);\n  });\n}\n\nfunction invalidateQueuedOperations(state: DisplayStackOperationState, epoch: number): void {\n  const retained: DisplayStackOperationWaiter[] = [];\n  for (const waiter of state.waiters) {\n    if (waiter.epoch === epoch)\n      settleOperationWaiter(waiter, new DisplayStackOperationFencedError());\n    else retained.push(waiter);\n  }\n  state.waiters = retained;\n}\n\nfunction monotonicNow(): number {\n  return performance.now();\n}\n\nasync function waitForFencedOperation(\n  state: DisplayStackOperationState,\n  deadline: number,\n): Promise<boolean> {\n  const drain = state.drain;\n  if (!drain) return true;\n  try {\n    await beforeDeadline(drain, deadline);\n  } catch {\n    return false;\n  }\n  if (state.drain === drain) state.drain = null;\n  return true;\n}\n\nfunction trackProviderCall<T>(\n  state: DisplayStackOperationState | null,\n  promise: Promise<T>,\n): Promise<T> {\n  if (!state) return promise;\n  state.inFlight.add(promise);\n  void promise.then(\n    () => state.inFlight.delete(promise),\n    () => state.inFlight.delete(promise),\n  );\n  return promise;\n}\n\nfunction boundedProviderDrain(pending: Promise<unknown>[]): Promise<void> {\n  if (pending.length === 0) return Promise.resolve();\n  return new Promise<void>((resolve) => {\n    let remaining = pending.length;\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    const finish = () => {\n      if (timer) clearTimeout(timer);\n      resolve();\n    };\n    timer = setTimeout(finish, DISPLAY_STACK_DRAIN_GRACE_MS);\n    timer.unref?.();\n    for (const promise of pending) {\n      void promise.then(\n        () => {\n          remaining -= 1;\n          if (remaining === 0) finish();\n        },\n        () => {\n          remaining -= 1;\n          if (remaining === 0) finish();\n        },\n      );\n    }\n  });\n}\n\nfunction fenceOperation(\n  state: DisplayStackOperationState | null,\n  epoch: number,\n  abortController: AbortController,\n  cleanup: PendingDisplayStackCleanup,\n): void {\n  abortController.abort(new DisplayStackWallTimeoutError());\n  if (!state) return;\n\n  if (state.epoch !== epoch) return;\n\n  state.pendingCleanup.set(cleanup.markerToken, cleanup);\n  state.physicallyQuiescent = false;\n  invalidateQueuedOperations(state, epoch);\n\n  // Advance the ownership epoch BEFORE the timeout error is surfaced. Any\n  // completion from this operation is now stale. A retry is gated by the\n  // independent in-box cleanup proof, not by an SDK promise that may hang.\n  state.epoch += 1;\n  const pending = [...state.inFlight];\n  const drain = boundedProviderDrain(pending);\n  state.drain = state.drain ? Promise.all([state.drain, drain]).then(() => undefined) : drain;\n  // A provider transport can retain an unresolved promise forever. Once the\n  // bounded advisory window ends, release those promises from the registry;\n  // the tombstone and in-box process-group proof remain the authoritative fence.\n  void drain.then(() => {\n    for (const promise of pending) state.inFlight.delete(promise);\n  });\n}\n\nfunction assertCurrentOperation(state: DisplayStackOperationState | null, epoch: number): void {\n  if (state && state.epoch !== epoch) throw new DisplayStackOperationFencedError();\n}\n\nasync function beforeDeadline<T>(\n  promise: Promise<T>,\n  deadline: number,\n  now: () => number = monotonicNow,\n): Promise<T> {\n  const remainingMs = deadline - now();\n  if (remainingMs <= 0) throw new DisplayStackWallTimeoutError();\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  try {\n    return await Promise.race([\n      promise,\n      new Promise<T>((_resolve, reject) => {\n        timer = setTimeout(() => reject(new DisplayStackWallTimeoutError()), remainingMs);\n        timer.unref?.();\n      }),\n    ]);\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n}\n\nfunction displayStackCleanupCommand(markerPath: string, markerToken: string): string {\n  const marker = shellQuote(markerPath);\n  const token = shellQuote(markerToken);\n  // The launcher writes pid, process-group id, /proc start time, and a random\n  // token before it starts the lock-owning command. The start-time check keeps\n  // a stale marker from killing an unrelated process after PID reuse. The\n  // process group is the authority: a provider session can disappear while\n  // descendants of the shell continue to hold the display lock.\n  const script =\n    `marker=${marker}; token=${token}; ` +\n    `cancel=\"$marker.cancelled\"; ` +\n    `: >\"$cancel\" || { echo \"OPENGENI_DISPLAY_CLEANUP status=invalid\"; exit 75; }; ` +\n    `if [ ! -r \"$marker\" ]; then echo \"OPENGENI_DISPLAY_CLEANUP status=stopped\"; exit 0; fi; ` +\n    `read -r pid pgid start actual <\"$marker\" || { echo \"OPENGENI_DISPLAY_CLEANUP status=invalid\"; exit 75; }; ` +\n    `[ \"$actual\" = \"$token\" ] || { echo \"OPENGENI_DISPLAY_CLEANUP status=invalid\"; exit 75; }; ` +\n    `case \"$pid\" in ''|*[!0-9]*) echo \"OPENGENI_DISPLAY_CLEANUP status=invalid\"; exit 75;; esac; ` +\n    `case \"$pgid\" in ''|*[!0-9]*) echo \"OPENGENI_DISPLAY_CLEANUP status=invalid\"; exit 75;; esac; ` +\n    `case \"$start\" in ''|*[!0-9]*) echo \"OPENGENI_DISPLAY_CLEANUP status=invalid\"; exit 75;; esac; ` +\n    `current=$(awk '{print $22}' \"/proc/$pid/stat\" 2>/dev/null || true); ` +\n    `if [ -z \"$current\" ] || [ \"$current\" != \"$start\" ]; then rm -f \"$marker\"; echo \"OPENGENI_DISPLAY_CLEANUP status=stopped\"; exit 0; fi; ` +\n    `kill -TERM -- \"-$pgid\" 2>/dev/null || true; ` +\n    `for i in $(seq 1 10); do ` +\n    `if ! kill -0 -- \"-$pgid\" 2>/dev/null; then rm -f \"$marker\"; echo \"OPENGENI_DISPLAY_CLEANUP status=stopped\"; exit 0; fi; ` +\n    `sleep 0.05; done; ` +\n    `kill -KILL -- \"-$pgid\" 2>/dev/null || true; ` +\n    `for i in $(seq 1 20); do ` +\n    `if ! kill -0 -- \"-$pgid\" 2>/dev/null; then rm -f \"$marker\"; echo \"OPENGENI_DISPLAY_CLEANUP status=stopped\"; exit 0; fi; ` +\n    `sleep 0.05; done; ` +\n    `echo \"OPENGENI_DISPLAY_CLEANUP status=alive\"; exit 75`;\n  return `timeout --signal=TERM --kill-after=0.2s 1.5s bash -c ${shellQuote(script)}`;\n}\n\nasync function runProviderCommandToDeadline(\n  session: ExecCapableSession,\n  command: string,\n  deadline: number,\n): Promise<ExecResultLike | string> {\n  const controller = new AbortController();\n  let result: ExecResultLike | string = await beforeDeadline(\n    Promise.resolve(\n      typeof session.exec === \"function\"\n        ? session.exec({\n            cmd: command,\n            yieldTimeMs: Math.min(500, DISPLAY_STACK_CLEANUP_CALL_MS),\n            maxOutputTokens: 4_000,\n            signal: controller.signal,\n          })\n        : session.execCommand!({\n            cmd: command,\n            yieldTimeMs: Math.min(500, DISPLAY_STACK_CLEANUP_CALL_MS),\n            maxOutputTokens: 4_000,\n            signal: controller.signal,\n          }),\n    ),\n    deadline,\n  );\n\n  let providerSessionId = execResultSessionId(result);\n  while (providerSessionId !== null) {\n    if (typeof session.writeStdin !== \"function\") {\n      throw new Error(\"display cleanup provider yielded without writeStdin\");\n    }\n    const remainingMs = deadline - monotonicNow();\n    if (remainingMs <= 1) throw new DisplayStackWallTimeoutError();\n    result = await beforeDeadline(\n      session.writeStdin({\n        sessionId: providerSessionId,\n        chars: \"\",\n        yieldTimeMs: Math.max(1, Math.min(250, remainingMs - 1)),\n        maxOutputTokens: 4_000,\n        signal: controller.signal,\n      }),\n      deadline,\n    );\n    providerSessionId = execResultSessionId(result);\n  }\n  return result;\n}\n\nasync function interruptProviderProcess(\n  session: ExecCapableSession,\n  providerSessionId: number | null,\n  deadline: number,\n): Promise<void> {\n  if (providerSessionId === null || typeof session.writeStdin !== \"function\") return;\n  try {\n    // This is an advisory provider-level interrupt. The marker/PGID cleanup\n    // below remains authoritative because the Agents SDK 0.14.3 Modal adapter ignores AbortSignal.\n    await beforeDeadline(\n      session.writeStdin({\n        sessionId: providerSessionId,\n        chars: \"\\u0003\",\n        yieldTimeMs: 100,\n        maxOutputTokens: 256,\n      }),\n      deadline,\n    );\n  } catch {\n    // A hung provider write is not evidence either way; in-box cleanup decides.\n  }\n}\n\nasync function cleanupDisplayStackProcess(\n  session: ExecCapableSession,\n  pending: PendingDisplayStackCleanup,\n  deadline: number,\n): Promise<boolean> {\n  try {\n    const result = await runProviderCommandToDeadline(\n      session,\n      displayStackCleanupCommand(pending.markerPath, pending.markerToken),\n      deadline,\n    );\n    const output = execResultOutput(result);\n    const status = /OPENGENI_DISPLAY_CLEANUP status=(stopped|absent|alive|invalid)/u.exec(\n      output,\n    )?.[1];\n    return status === \"stopped\";\n  } catch {\n    return false;\n  }\n}\n\nasync function reconcilePendingCleanup(\n  session: ExecCapableSession,\n  state: DisplayStackOperationState,\n  deadline: number,\n): Promise<boolean> {\n  const entries = [...state.pendingCleanup.values()];\n  if (entries.length === 0) {\n    state.physicallyQuiescent = true;\n    return true;\n  }\n  const results = await Promise.all(\n    entries.map(async (pending) => ({\n      pending,\n      stopped: await cleanupDisplayStackProcess(session, pending, deadline),\n    })),\n  );\n  for (const { pending, stopped } of results) {\n    if (stopped) state.pendingCleanup.delete(pending.markerToken);\n  }\n  state.physicallyQuiescent = state.pendingCleanup.size === 0;\n  return state.physicallyQuiescent;\n}\n\nfunction requestId(): string {\n  return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;\n}\n\nfunction telemetryReporter(\n  options: EnsureDisplayStackOptions,\n  started: number,\n  now: () => number = monotonicNow,\n) {\n  const id = requestId();\n  const context = options.telemetryContext;\n  const sink =\n    options.onTelemetry ??\n    (context\n      ? (event: DisplayStackTelemetryEvent) =>\n          console.info(`[display-stack] ${JSON.stringify(event)}`)\n      : undefined);\n  const emittedSandboxStages = new Set<string>();\n\n  const emit = (\n    stage: string,\n    status: DisplayStackTelemetryStatus,\n    fields: {\n      source?: \"host\" | \"sandbox\";\n      elapsedMs?: number;\n      classification?: DisplayStackClassification;\n      providerSessionId?: number;\n    } = {},\n  ) => {\n    if (!sink) return;\n    const event: DisplayStackTelemetryEvent = {\n      type: \"display_stack.stage\",\n      requestId: id,\n      stage,\n      status,\n      elapsedMs: fields.elapsedMs ?? now() - started,\n      source: fields.source ?? \"host\",\n      classification: fields.classification ?? \"unknown\",\n      callerKind: context?.callerKind ?? \"unknown\",\n      ...(context?.sandboxId ? { sandboxId: context.sandboxId } : {}),\n      ...(context?.leaseEpoch !== undefined ? { leaseEpoch: context.leaseEpoch } : {}),\n      ...(fields.providerSessionId !== undefined\n        ? { providerSessionId: fields.providerSessionId }\n        : {}),\n    };\n    try {\n      void Promise.resolve(sink(event)).catch(() => undefined);\n    } catch {\n      // Telemetry must never affect display readiness.\n    }\n  };\n\n  const emitSandboxStages = (output: string) => {\n    for (const match of output.matchAll(\n      /OPENGENI_(?:DISPLAY|DESKTOP)_STAGE stage=([a-z0-9_]+) elapsed_ms=(\\d+)(?: classification=(cold|already_ready|contention|unknown))?/gu,\n    )) {\n      const [line, stage, elapsed, classification] = match;\n      if (!stage || !elapsed || emittedSandboxStages.has(line)) continue;\n      emittedSandboxStages.add(line);\n      emit(stage, \"completed\", {\n        source: \"sandbox\",\n        elapsedMs: Number(elapsed),\n        classification: (classification as DisplayStackClassification | undefined) ?? \"unknown\",\n      });\n    }\n  };\n\n  return { emit, emitSandboxStages };\n}\n\n// Parse the exit code the up-script signals via its trailing marker. When we ran\n// through `exec` we have the real exitCode; when we only had `execCommand` (a\n// bare string), we infer success from the OPENGENI_DESKTOP_UP marker and infer\n// the failing stage from the stage-failure message the script prints to stderr.\nfunction inferExitFromOutput(output: string): number {\n  if (/OPENGENI_DISPLAY_TIMEOUT/.test(output)) {\n    return 124;\n  }\n  if (/OPENGENI_DESKTOP_LOCK_TIMEOUT/.test(output)) {\n    return 15;\n  }\n  // Check the PAINTABLE-FRAME failure FIRST: on that path the up-script already\n  // printed OPENGENI_DESKTOP_UP (bring-up succeeded) and THEN the paint gate failed,\n  // so both markers are present — the NOT_PAINTING one is the authoritative outcome.\n  // (Modal is execCommand-only, so this string-inference path is the live one.)\n  if (/OPENGENI_DESKTOP_NOT_PAINTING/.test(output)) {\n    return 14;\n  }\n  if (/OPENGENI_DESKTOP_UP\\b/.test(output)) {\n    return 0;\n  }\n  if (/Xvfb failed to come up/.test(output)) {\n    return 11;\n  }\n  if (/x11vnc failed on/.test(output)) {\n    return 12;\n  }\n  if (/websockify failed on/.test(output)) {\n    return 13;\n  }\n  return -1;\n}\n\n/**\n * Idempotently bring up the desktop display stack on the live box. Safe to call\n * N times (the in-box flock + the up-script's PID guards make a second call a\n * no-op). Resolves with the exposed port + geometry on success; throws\n * `DisplayStackError` on a stage failure and `DisplayStackUnsupportedError` when\n * the session cannot run commands.\n *\n * `session` is the externally-owned provider session (the `established.session`\n * from establishSandboxSessionFromEnvelope, or any SandboxSessionLike). We\n * prefer `session.exec` (structured `{exitCode}`) and fall back to\n * `session.execCommand` (bare string), inferring success from the up-script's\n * marker line in the fallback case.\n */\nexport async function ensureDisplayStack(\n  session: unknown,\n  options: EnsureDisplayStackOptions = {},\n): Promise<EnsureDisplayStackResult> {\n  const s = session as ExecCapableSession;\n  if (typeof s?.exec !== \"function\" && typeof s?.execCommand !== \"function\") {\n    throw new DisplayStackUnsupportedError(\n      \"provider session cannot run commands (no exec/execCommand) — desktop tier unavailable\",\n    );\n  }\n\n  const geometry = options.geometry ?? DEFAULT_DESKTOP_GEOMETRY;\n  const port = options.port ?? DESKTOP_STREAM_PORT;\n  const timeoutMs = options.timeoutMs ?? DISPLAY_STACK_TIMEOUT_MS;\n  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {\n    throw new RangeError(\"ensureDisplayStack timeoutMs must be a positive finite number\");\n  }\n  const started = monotonicNow();\n  const deadline = started + timeoutMs;\n  const telemetry = telemetryReporter(options, started, monotonicNow);\n  const operationToken = requestId();\n  const markerPath = `/tmp/opengeni-desktop/display-stack-${operationToken}.pid`;\n  const cmd = boundedDisplayStackCommand(\n    buildDisplayStackScript({ geometry, port }),\n    timeoutMs,\n    markerPath,\n    operationToken,\n  );\n  const outputParts: string[] = [];\n  const state = operationState(session, options);\n  let release: (() => void) | undefined;\n  if (state) {\n    try {\n      release = await acquireOperation(state, deadline);\n    } catch (error) {\n      if (\n        error instanceof DisplayStackWallTimeoutError ||\n        error instanceof DisplayStackOperationFencedError\n      ) {\n        throw new DisplayStackError(\n          124,\n          \"OPENGENI_DISPLAY_TIMEOUT display operation admission was fenced\",\n        );\n      }\n      throw error;\n    }\n  }\n\n  try {\n    if (state && !state.physicallyQuiescent) {\n      const cleanupDeadline = monotonicNow() + DISPLAY_STACK_CLEANUP_CALL_MS;\n      const quiesced = await reconcilePendingCleanup(s, state, cleanupDeadline);\n      if (!quiesced) {\n        // Fail closed. A new session wrapper may share this physical sandbox,\n        // but without a positive marker/PGID proof it must not issue overlapping\n        // display work merely because the old SDK promise remains unresolved.\n        throw new DisplayStackError(\n          124,\n          \"OPENGENI_DISPLAY_TIMEOUT physical cleanup is still pending; retry is fenced\",\n        );\n      }\n    }\n    const epoch = state?.epoch ?? 0;\n    const abortController = new AbortController();\n    let activeProviderSessionId: number | null = null;\n    telemetry.emit(\"request_entry\", \"started\");\n    telemetry.emit(\"exec_issued\", \"started\");\n\n    try {\n      const initialYieldMs = Math.max(1, Math.min(DISPLAY_STACK_PROVIDER_YIELD_MS, timeoutMs - 1));\n      const initialExec: Promise<ExecResultLike | string> = trackProviderCall<\n        ExecResultLike | string\n      >(\n        state,\n        Promise.resolve(\n          typeof s.exec === \"function\"\n            ? s.exec({\n                cmd,\n                yieldTimeMs: initialYieldMs,\n                maxOutputTokens: 20_000,\n                signal: abortController.signal,\n              })\n            : s.execCommand!({\n                cmd,\n                yieldTimeMs: initialYieldMs,\n                maxOutputTokens: 20_000,\n                signal: abortController.signal,\n              }),\n        ),\n      );\n      let result: ExecResultLike | string = await beforeDeadline(\n        initialExec,\n        deadline,\n        monotonicNow,\n      );\n      assertCurrentOperation(state, epoch);\n      let chunk = execResultOutput(result);\n      outputParts.push(chunk);\n      telemetry.emitSandboxStages(chunk);\n      telemetry.emit(\"provider_first_result\", \"completed\");\n\n      let providerSessionId = execResultSessionId(result);\n      activeProviderSessionId = providerSessionId;\n      while (providerSessionId !== null) {\n        telemetry.emit(\"provider_yield\", \"waiting\", { providerSessionId });\n        if (typeof s.writeStdin !== \"function\") {\n          throw new DisplayStackError(\n            -1,\n            `${outputParts.join(\"\\n\")}\\nprovider yielded process ${providerSessionId} but exposes no writeStdin poll surface`,\n          );\n        }\n        assertCurrentOperation(state, epoch);\n        const remainingMs = deadline - monotonicNow();\n        if (remainingMs <= 1) throw new DisplayStackWallTimeoutError();\n        const pollYieldMs = Math.max(1, Math.min(DISPLAY_STACK_PROVIDER_POLL_MS, remainingMs - 1));\n        result = await beforeDeadline(\n          trackProviderCall(\n            state,\n            s.writeStdin({\n              sessionId: providerSessionId,\n              chars: \"\",\n              yieldTimeMs: pollYieldMs,\n              maxOutputTokens: 20_000,\n              signal: abortController.signal,\n            }),\n          ),\n          deadline,\n          monotonicNow,\n        );\n        assertCurrentOperation(state, epoch);\n        chunk = execResultOutput(result);\n        outputParts.push(chunk);\n        telemetry.emitSandboxStages(chunk);\n        providerSessionId = execResultSessionId(result);\n        activeProviderSessionId = providerSessionId;\n      }\n\n      const output = outputParts.join(\"\\n\");\n      const exitCode = execResultExitCode(result) ?? inferExitFromOutput(output);\n      telemetry.emit(\"process_complete\", exitCode === 0 ? \"completed\" : \"failed\");\n      if (exitCode !== 0) {\n        throw new DisplayStackError(exitCode, output);\n      }\n\n      const marker = (output.match(/OPENGENI_DESKTOP_UP[^\\n]*/) ?? [\"\"])[0];\n      telemetry.emit(\"readiness_complete\", \"completed\");\n      return { port, geometry, marker };\n    } catch (error) {\n      if (\n        error instanceof DisplayStackWallTimeoutError ||\n        error instanceof DisplayStackOperationFencedError\n      ) {\n        const pendingCleanup: PendingDisplayStackCleanup = {\n          markerPath,\n          markerToken: operationToken,\n        };\n        fenceOperation(state, epoch, abortController, pendingCleanup);\n        const cleanupDeadline = monotonicNow() + DISPLAY_STACK_CLEANUP_CALL_MS;\n        telemetry.emit(\"process_cleanup\", \"started\");\n        await interruptProviderProcess(\n          s,\n          activeProviderSessionId,\n          Math.min(cleanupDeadline, monotonicNow() + 50),\n        );\n        let quiesced = false;\n        if (state) {\n          quiesced = await reconcilePendingCleanup(s, state, cleanupDeadline);\n          if (!quiesced) {\n            await waitForFencedOperation(\n              state,\n              Math.min(cleanupDeadline, monotonicNow() + DISPLAY_STACK_DRAIN_GRACE_MS),\n            );\n          }\n        } else {\n          quiesced = await cleanupDisplayStackProcess(s, pendingCleanup, cleanupDeadline);\n        }\n        telemetry.emit(\"process_cleanup\", quiesced ? \"completed\" : \"failed\");\n        const output = `${outputParts.join(\"\\n\")}\\nOPENGENI_DISPLAY_TIMEOUT wall_ms=${timeoutMs}`;\n        telemetry.emit(\"wall_deadline\", \"failed\");\n        throw new DisplayStackError(124, output);\n      }\n      telemetry.emit(\"request_failed\", \"failed\");\n      throw error;\n    }\n  } finally {\n    release?.();\n  }\n}\n\n/** Tear the stack down (down-script). Best-effort; never throws on a missing\n *  process. Used by the geometry-change restart and cold/drain. */\nexport async function tearDownDisplayStack(session: unknown): Promise<void> {\n  const s = session as ExecCapableSession;\n  if (typeof s?.exec === \"function\") {\n    await s.exec({ cmd: \"opengeni-desktop-down\", yieldTimeMs: 10_000, maxOutputTokens: 4_000 });\n    return;\n  }\n  if (typeof s?.execCommand === \"function\") {\n    await s.execCommand({\n      cmd: \"opengeni-desktop-down\",\n      yieldTimeMs: 10_000,\n      maxOutputTokens: 4_000,\n    });\n  }\n}\n","// @opengeni/runtime/sandbox — the REAL PTY terminal-server launcher (P5.t).\n//\n// The agent-loop-free home for `ensureTerminalServer`: the exec-launched,\n// flock-idempotent procedure that brings up the ttyd PTY-over-websocket server\n// (a live PTY-backed `bash -l` per ws client, listening on 7681) on a live,\n// externally-owned box. It is the SYMMETRIC TWIN of ensureDisplayStack (the\n// Channel-B pixel stack) — same exec/execCommand channel (NOT a container CMD)\n// so it re-establishes after a snapshot rollover / box re-election, same flock\n// idempotency so a second concurrent caller (the API viewer op + the agent turn,\n// both racing after a rollover) serializes and no-ops when ttyd is already up.\n//\n// WHY A REAL PTY OVER THE TUNNEL (not the old ptyWrite-over-HTTP): the stateless\n// HTTP plane builds a fresh provider session per call, so the in-memory live-PTY\n// process handle (Modal's per-call activeProcesses Map) is gone by the next\n// write (\"session not found: 1\"). ttyd holds the live PTY in-box and streams it\n// over the SAME Modal raw-TLS tunnel the desktop noVNC already uses, gated by the\n// SAME scoped stream-token mechanism (the server records the token; the boundary\n// is the unguessable short-TTL tunnel URL + the recorded token — no in-box gate).\n//\n// It lives under @opengeni/runtime/sandbox so the API-direct control plane\n// (apps/api) and the worker (apps/worker) both pull it from the same single\n// agent-loop-free leaf.\n\nimport { TERMINAL_STREAM_PORT } from \"@opengeni/contracts\";\n\n// Re-export the canonical terminal port so callers (exposeStreamPort, the API\n// mint) pull the single source of truth (contracts) from this leaf.\nexport { TERMINAL_STREAM_PORT };\n\n// The ttyd launch is bounded by the readiness gate inside the up-script (50 *\n// 0.1s = ~5s) PLUS first-boot warm-up on a cold gVisor box. 60s gives headroom\n// over the observed warm path (~1-2s; ttyd is a single static binary) without\n// masking a genuine wedge. Symmetric with DISPLAY_STACK_TIMEOUT_MS.\nexport const TERMINAL_SERVER_TIMEOUT_MS = 60_000;\n\n/** Thrown when the ttyd launch failed inside the box. exitCode 14 maps to the\n *  up-script's \"ttyd failed to come up\" stage; any other non-zero is unknown.\n *  Degradation is surfaced as a value to clients by the caller (Terminal\n *  transport falls back to sse-events / null); this error is for diagnostics. */\nexport class TerminalServerError extends Error {\n  readonly exitCode: number;\n  readonly stage: \"ttyd\" | \"unknown\";\n\n  constructor(exitCode: number, output: string) {\n    const stage = exitCode === 14 ? \"ttyd\" : \"unknown\";\n    super(\n      `terminal server failed at stage \"${stage}\" (exit ${exitCode})${output ? `:\\n${output}` : \"\"}`,\n    );\n    this.name = \"TerminalServerError\";\n    this.exitCode = exitCode;\n    this.stage = stage;\n  }\n}\n\n/** Thrown when the provider session cannot run commands (a headless-only backend\n *  with neither `exec` nor `execCommand`). The terminal tier degrades to the\n *  Channel-A sse-events firehose — the caller maps this to a `transport:null`\n *  pty-ws (the read-only firehose still works). */\nexport class TerminalServerUnsupportedError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"TerminalServerUnsupportedError\";\n  }\n}\n\n// The structural slice of a provider session we need: run a command (preferring\n// `exec` for the structured exit code, falling back to `execCommand`).\ntype ExecResultLike = {\n  output?: string;\n  stdout?: string;\n  stderr?: string;\n  exitCode?: number | null;\n};\ntype ExecCapableSession = {\n  exec?: (args: {\n    cmd: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n  }) => Promise<ExecResultLike>;\n  execCommand?: (args: {\n    cmd: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n  }) => Promise<string>;\n};\n\nexport type EnsureTerminalServerOptions = {\n  /** The exposed terminal port; defaults to 7681 (ttyd default). */\n  port?: number;\n  /** Per-exec timeout; defaults to TERMINAL_SERVER_TIMEOUT_MS. */\n  timeoutMs?: number;\n};\n\nexport type EnsureTerminalServerResult = {\n  /** The exposed port ttyd listens on (PTY-over-websocket). */\n  port: number;\n  /** The raw `OPENGENI_TERMINAL_UP …` marker line, for diagnostics. Never\n   *  surfaced to clients. */\n  marker: string;\n};\n\n/**\n * Build the shell command that runs the idempotent up-script under an in-box\n * `flock`. The script is shipped in the image at /usr/local/bin/opengeni-terminal-up\n * (the canonical desktop image, alongside opengeni-desktop-up); we set the port\n * env and wrap the call in `flock` so two concurrent ensureTerminalServer callers\n * (the API viewer op + the agent turn, both racing after a rollover) serialize\n * without a double launch. The up-script's own curl readiness probe makes the\n * second call a no-op.\n *\n * Exported (pure, side-effect-free) so the ensureTerminalServer unit test can\n * assert the exact command sequence without a live box. Mirrors\n * buildDisplayStackScript. A ttyd process is sandbox-group-global, not\n * Opengeni-session-specific, so it must never inherit the box-global legacy\n * Codemode pointer. Session-scoped interactive exec/PTY uses Channel A; the\n * shared ttyd shell fails closed for Codemode until that stream plane itself is\n * session-isolated.\n */\nexport function buildTerminalServerScript(options: EnsureTerminalServerOptions = {}): string {\n  const port = options.port ?? TERMINAL_STREAM_PORT;\n  // flock -w bounds the wait so a wedged holder can't deadlock the caller; the\n  // up-script's curl probe ALSO makes the launch idempotent (belt + braces) so\n  // this works even against an older image that predates the wrapper.\n  return (\n    `mkdir -p /tmp/opengeni-terminal && ` +\n    // --close prevents the detached ttyd child from inheriting the lock fd and\n    // pinning this lock for its entire lifetime. The flock parent still holds\n    // the lock until opengeni-terminal-up exits.\n    `flock -w 30 --close /tmp/opengeni-terminal/up.outer.lock ` +\n    `env TERMINAL_PORT=${port} OPENGENI_CODEMODE_TOKEN_FILE=/dev/null opengeni-terminal-up`\n  );\n}\n\nfunction execResultOutput(result: ExecResultLike | string): string {\n  if (typeof result === \"string\") {\n    return result;\n  }\n  return [result.output, result.stderr, result.stdout]\n    .filter((v): v is string => typeof v === \"string\" && v.length > 0)\n    .join(\"\\n\");\n}\n\nfunction execResultExitCode(result: ExecResultLike | string): number | null {\n  if (typeof result === \"string\") {\n    return null; // execCommand returns a bare string — no exit code available.\n  }\n  return typeof result.exitCode === \"number\" ? result.exitCode : null;\n}\n\n// Parse the exit code the up-script signals via its trailing marker. When we ran\n// through `exec` we have the real exitCode; when we only had `execCommand` (a\n// bare string), we infer success from the OPENGENI_TERMINAL_UP marker and infer\n// the failing stage from the stage-failure message the script prints to stderr.\n// Mirrors inferExitFromOutput (display-stack).\nfunction inferExitFromOutput(output: string): number {\n  if (/OPENGENI_TERMINAL_UP\\b/.test(output)) {\n    return 0;\n  }\n  if (/ttyd failed to come up/.test(output)) {\n    return 14;\n  }\n  return -1;\n}\n\n/**\n * Idempotently bring up the ttyd PTY-over-websocket server on the live box. Safe\n * to call N times (the in-box flock + the up-script's curl readiness probe make a\n * second call a no-op). Resolves with the exposed port on success; throws\n * `TerminalServerError` on a launch failure and `TerminalServerUnsupportedError`\n * when the session cannot run commands.\n *\n * `session` is the externally-owned provider session (the `established.session`\n * from establishSandboxSessionFromEnvelope, or any SandboxSessionLike). We prefer\n * `session.exec` (structured `{exitCode}`) and fall back to `session.execCommand`\n * (bare string), inferring success from the up-script's marker line in the\n * fallback case. Mirrors ensureDisplayStack exactly.\n */\nexport async function ensureTerminalServer(\n  session: unknown,\n  options: EnsureTerminalServerOptions = {},\n): Promise<EnsureTerminalServerResult> {\n  const s = session as ExecCapableSession;\n  if (typeof s?.exec !== \"function\" && typeof s?.execCommand !== \"function\") {\n    throw new TerminalServerUnsupportedError(\n      \"provider session cannot run commands (no exec/execCommand) — terminal pty-ws unavailable\",\n    );\n  }\n\n  const port = options.port ?? TERMINAL_STREAM_PORT;\n  const timeoutMs = options.timeoutMs ?? TERMINAL_SERVER_TIMEOUT_MS;\n  const cmd = buildTerminalServerScript({ port });\n\n  const result =\n    typeof s.exec === \"function\"\n      ? await s.exec({ cmd, yieldTimeMs: timeoutMs, maxOutputTokens: 20_000 })\n      : await s.execCommand!({ cmd, yieldTimeMs: timeoutMs, maxOutputTokens: 20_000 });\n\n  const output = execResultOutput(result);\n  const exitCode = execResultExitCode(result) ?? inferExitFromOutput(output);\n\n  if (exitCode !== 0) {\n    throw new TerminalServerError(exitCode, output);\n  }\n\n  const marker = (output.match(/OPENGENI_TERMINAL_UP[^\\n]*/) ?? [\"\"])[0];\n  return { port, marker };\n}\n\n/** Tear the terminal server down (down-script). Best-effort; never throws on a\n *  missing process. Mirrors tearDownDisplayStack. */\nexport async function tearDownTerminalServer(session: unknown): Promise<void> {\n  const s = session as ExecCapableSession;\n  if (typeof s?.exec === \"function\") {\n    await s.exec({ cmd: \"opengeni-terminal-down\", yieldTimeMs: 10_000, maxOutputTokens: 4_000 });\n    return;\n  }\n  if (typeof s?.execCommand === \"function\") {\n    await s.execCommand({\n      cmd: \"opengeni-terminal-down\",\n      yieldTimeMs: 10_000,\n      maxOutputTokens: 4_000,\n    });\n  }\n}\n","import { posix as posixPath } from \"node:path\";\nimport { BROWSER_CONTROL_PORT } from \"@opengeni/contracts\";\n\nexport { BROWSER_CONTROL_PORT };\n\nexport const BROWSER_CONTROL_SERVER_TIMEOUT_MS = 60_000;\nexport const BROWSER_CONTROL_STATE_DIRECTORY = \"/tmp/opengeni-browserd/state\";\nexport const BROWSER_CONTROL_SERVER_BIN = \"/usr/local/bin/opengeni-browserd-up\";\nexport const BROWSER_CONTROL_SERVER_DOWN_BIN = \"/usr/local/bin/opengeni-browserd-down\";\n\nexport class BrowserControlServerError extends Error {\n  readonly exitCode: number;\n  readonly stage: \"startup\" | \"port_conflict\" | \"engine_unavailable\" | \"unknown\";\n\n  constructor(exitCode: number, output: string) {\n    const stage = classifyBrowserControlStage(exitCode, output);\n    super(\n      `browser control server failed at stage \"${stage}\" (exit ${exitCode})${output ? `:\\n${output}` : \"\"}`,\n    );\n    this.name = \"BrowserControlServerError\";\n    this.exitCode = exitCode;\n    this.stage = stage;\n  }\n}\n\nexport class BrowserControlServerUnsupportedError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"BrowserControlServerUnsupportedError\";\n  }\n}\n\ntype ExecResultLike = {\n  output?: string;\n  stdout?: string;\n  stderr?: string;\n  exitCode?: number | null;\n};\n\ntype ExecCapableSession = {\n  exec?: (args: {\n    cmd: string;\n    workdir?: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n  }) => Promise<ExecResultLike>;\n  execCommand?: (args: {\n    cmd: string;\n    workdir?: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n  }) => Promise<string>;\n};\n\n// Image-backed controller commands use absolute private paths under /tmp, but\n// managed sandbox exec confines `workdir` to the canonical workspace root.\n// Keep the cwd stable without asking the provider to validate /tmp as a\n// workspace path.\nconst PLACEMENT_CONTROLLER_WORKDIR = \"/workspace\";\n\nexport type EnsureBrowserControlServerOptions = {\n  port?: number;\n  timeoutMs?: number;\n  adminTokenFile: string;\n  allowedOrigins?: readonly string[];\n};\n\nexport type EnsureBrowserControlServerResult = {\n  port: number;\n  marker: string;\n};\n\nexport function buildBrowserControlServerScript(\n  options: Pick<EnsureBrowserControlServerOptions, \"adminTokenFile\"> &\n    Partial<Pick<EnsureBrowserControlServerOptions, \"port\" | \"allowedOrigins\">>,\n): string {\n  const port = boundedPort(options.port ?? BROWSER_CONTROL_PORT);\n  const tokenFile = absolutePath(options.adminTokenFile, \"browser controller admin token file\");\n  const allowedOrigins = normalizeOrigins(options.allowedOrigins ?? []);\n  return [\n    \"mkdir -p /tmp/opengeni-browserd &&\",\n    `if ! test -x ${BROWSER_CONTROL_SERVER_BIN}; then echo 'opengeni-browserd-up is not installed on this sandbox image' >&2; exit 16; fi &&`,\n    \"flock -w 30 --close /tmp/opengeni-browserd/up.outer.lock\",\n    `env OPENGENI_BROWSERD_PORT=${port}`,\n    `OPENGENI_BROWSERD_ROOT=${shellQuote(BROWSER_CONTROL_STATE_DIRECTORY)}`,\n    `OPENGENI_BROWSERD_ADMIN_TOKEN_FILE=${shellQuote(tokenFile)}`,\n    `OPENGENI_BROWSERD_ALLOWED_ORIGINS=${shellQuote(allowedOrigins.join(\",\"))}`,\n    \"OPENGENI_CODEMODE_TOKEN_FILE=/dev/null\",\n    BROWSER_CONTROL_SERVER_BIN,\n  ].join(\" \");\n}\n\nexport async function ensureBrowserControlServer(\n  session: unknown,\n  options: EnsureBrowserControlServerOptions,\n): Promise<EnsureBrowserControlServerResult> {\n  const target = session as ExecCapableSession;\n  if (typeof target?.exec !== \"function\" && typeof target?.execCommand !== \"function\") {\n    throw new BrowserControlServerUnsupportedError(\n      \"provider session cannot run commands (no exec/execCommand) — browser control unavailable\",\n    );\n  }\n  const port = boundedPort(options.port ?? BROWSER_CONTROL_PORT);\n  const timeoutMs = boundedTimeout(options.timeoutMs ?? BROWSER_CONTROL_SERVER_TIMEOUT_MS);\n  const cmd = buildBrowserControlServerScript({\n    port,\n    adminTokenFile: options.adminTokenFile,\n    ...(options.allowedOrigins ? { allowedOrigins: options.allowedOrigins } : {}),\n  });\n  const result = target.exec\n    ? await target.exec({\n        cmd,\n        workdir: PLACEMENT_CONTROLLER_WORKDIR,\n        yieldTimeMs: timeoutMs,\n        maxOutputTokens: 4_000,\n      })\n    : await target.execCommand!({\n        cmd,\n        workdir: PLACEMENT_CONTROLLER_WORKDIR,\n        yieldTimeMs: timeoutMs,\n        maxOutputTokens: 4_000,\n      });\n  const output = outputOf(result);\n  const exitCode = exitCodeOf(result) ?? inferExitCode(output);\n  if (exitCode !== 0) throw new BrowserControlServerError(exitCode, output);\n  const marker = (output.match(/OPENGENI_BROWSERD_UP[^\\n]*/) ?? [\"\"])[0];\n  if (!marker) {\n    throw new BrowserControlServerError(\n      14,\n      output || \"browser controller did not emit its readiness marker\",\n    );\n  }\n  return { port, marker };\n}\n\nexport async function tearDownBrowserControlServer(session: unknown): Promise<void> {\n  const target = session as ExecCapableSession;\n  if (target?.exec) {\n    await target.exec({\n      cmd: BROWSER_CONTROL_SERVER_DOWN_BIN,\n      workdir: PLACEMENT_CONTROLLER_WORKDIR,\n      yieldTimeMs: 15_000,\n      maxOutputTokens: 4_000,\n    });\n  } else if (target?.execCommand) {\n    await target.execCommand({\n      cmd: BROWSER_CONTROL_SERVER_DOWN_BIN,\n      workdir: PLACEMENT_CONTROLLER_WORKDIR,\n      yieldTimeMs: 15_000,\n      maxOutputTokens: 4_000,\n    });\n  }\n}\n\nfunction outputOf(result: ExecResultLike | string): string {\n  if (typeof result === \"string\") return result;\n  return [result.output, result.stderr, result.stdout]\n    .filter((value): value is string => typeof value === \"string\" && value.length > 0)\n    .join(\"\\n\");\n}\n\nfunction exitCodeOf(result: ExecResultLike | string): number | null {\n  return typeof result === \"string\" || typeof result.exitCode !== \"number\" ? null : result.exitCode;\n}\n\nfunction classifyBrowserControlStage(\n  exitCode: number,\n  output: string,\n): BrowserControlServerError[\"stage\"] {\n  if (exitCode === 14) return \"startup\";\n  if (exitCode === 15) return \"port_conflict\";\n  if (exitCode === 16 || isMissingBrowserControlServer(exitCode, output)) {\n    return \"engine_unavailable\";\n  }\n  return \"unknown\";\n}\n\nfunction isMissingBrowserControlServer(exitCode: number, output: string): boolean {\n  if (exitCode === 127) return true;\n  return /opengeni-browserd-up[^\\n]*No such file or directory|opengeni-browserd-up is not installed on this sandbox image/u.test(\n    output,\n  );\n}\n\nfunction inferExitCode(output: string): number {\n  if (/OPENGENI_BROWSERD_UP\\b/u.test(output)) return 0;\n  if (/occupied by an unmanaged process/u.test(output)) return 15;\n  if (/no supported Chromium engine/u.test(output) || isMissingBrowserControlServer(-1, output)) {\n    return 16;\n  }\n  if (/exited during startup|failed to become ready/u.test(output)) return 14;\n  return -1;\n}\n\nfunction boundedPort(value: number): number {\n  if (!Number.isSafeInteger(value) || value < 1 || value > 65_535) {\n    throw new RangeError(\"browser controller port is invalid\");\n  }\n  return value;\n}\n\nfunction boundedTimeout(value: number): number {\n  if (!Number.isSafeInteger(value) || value < 1 || value > 10 * 60_000) {\n    throw new RangeError(\"browser controller timeout is invalid\");\n  }\n  return value;\n}\n\nfunction absolutePath(value: string, label: string): string {\n  if (!value || value.includes(\"\\0\") || !posixPath.isAbsolute(value)) {\n    throw new Error(`${label} must be absolute`);\n  }\n  return posixPath.normalize(value);\n}\n\nfunction normalizeOrigins(values: readonly string[]): string[] {\n  if (values.length > 64) throw new Error(\"too many browser controller origins\");\n  return values.map((value) => {\n    const url = new URL(value);\n    if (url.origin === \"null\" || url.pathname !== \"/\" || url.search || url.hash) {\n      throw new Error(\"browser controller origin must be an absolute origin\");\n    }\n    return url.origin;\n  });\n}\n\nfunction shellQuote(value: string): string {\n  return `'${value.replaceAll(\"'\", `'\\\\''`)}'`;\n}\n","import {\n  ComputerNativeCommand,\n  ComputerNativeReceipt,\n  ComputerOperationReceipt,\n} from \"@opengeni/contracts\";\nimport { createHash, randomUUID } from \"node:crypto\";\nimport { posix as posixPath } from \"node:path\";\nimport { parseBrowserFrameMetadata, type BrowserFrameMetadata } from \"@opengeni/sdk\";\nimport {\n  BROWSER_ACTION_RECEIPT_TARGETS_PARAMETER,\n  BROWSER_CONTROL_MAX_JSON_BYTES,\n  BROWSER_CONTROL_PORT,\n  BROWSER_CONTROL_PROTOCOL_VERSION,\n  BROWSER_PROFILE_ARTIFACT_FORMAT,\n  BROWSER_STATE_ARTIFACT_CONTENT_TYPE,\n  BrowserActionCommand,\n  BrowserActionReceipt,\n  BrowserClipboard,\n  BrowserDiagnosticBatch,\n  BrowserDownload,\n  BrowserDownloadExportReceipt,\n  BrowserDownloadExportRequest,\n  BrowserDownloadListResponse,\n  BrowserDomReadRequest,\n  BrowserDomReadResponse,\n  BrowserExternalAuthCommand,\n  BrowserExternalAuthResult,\n  BrowserObservation,\n  BrowserRevisionMaterialization,\n  BrowserTarget,\n  BrowserTargetListResponse,\n  BrowserTargetState,\n  BrowserWorkspaceFileStageRequest,\n  BrowserWorkspaceFileStageResponse,\n  BrowserPasskeySyncRequest,\n  BrowserPasskeySyncResponse,\n  ComputerActionCommand,\n  ComputerActionReceipt,\n  ComputerClipboard,\n  ComputerObservation,\n  COMPUTER_SCREENSHOT_MAX_BYTES,\n  ComputerSessionCapabilities,\n  ComputerTarget,\n  InteractionError,\n  NetworkRouteConsistency,\n  type BrowserActionCommand as BrowserActionCommandValue,\n  type BrowserActionReceipt as BrowserActionReceiptValue,\n  type BrowserClipboard as BrowserClipboardValue,\n  type BrowserDiagnosticBatch as BrowserDiagnosticBatchValue,\n  type BrowserDownload as BrowserDownloadValue,\n  type BrowserDownloadExportReceipt as BrowserDownloadExportReceiptValue,\n  type BrowserDownloadExportRequest as BrowserDownloadExportRequestValue,\n  type BrowserDownloadListResponse as BrowserDownloadListResponseValue,\n  type BrowserDomReadRequest as BrowserDomReadRequestValue,\n  type BrowserDomReadResponse as BrowserDomReadResponseValue,\n  type BrowserExternalAuthCommand as BrowserExternalAuthCommandValue,\n  type BrowserExternalAuthResult as BrowserExternalAuthResultValue,\n  type BrowserDiagnosticKind,\n  type BrowserTargetListResponse as BrowserTargetListResponseValue,\n  type BrowserObservation as BrowserObservationValue,\n  type BrowserRevisionMaterialization as BrowserRevisionMaterializationValue,\n  type BrowserTarget as BrowserTargetValue,\n  type BrowserTargetState as BrowserTargetStateValue,\n  type BrowserWorkspaceFileStageRequest as BrowserWorkspaceFileStageRequestValue,\n  type BrowserWorkspaceFileStageResponse as BrowserWorkspaceFileStageResponseValue,\n  type BrowserPasskeySyncRequest as BrowserPasskeySyncRequestValue,\n  type BrowserPasskeySyncResponse as BrowserPasskeySyncResponseValue,\n  type ComputerActionCommand as ComputerActionCommandValue,\n  type ComputerActionReceipt as ComputerActionReceiptValue,\n  type ComputerClipboard as ComputerClipboardValue,\n  type ComputerObservation as ComputerObservationValue,\n  type ComputerSessionCapabilities as ComputerSessionCapabilitiesValue,\n  type ComputerTarget as ComputerTargetValue,\n  type InteractionError as InteractionErrorValue,\n  type NetworkRouteConsistency as NetworkRouteConsistencyValue,\n} from \"@opengeni/contracts\";\nimport type {\n  BrowserControlEnsureRequest,\n  BrowserControlEnsureResponse,\n  BrowserFramesOpenRequest,\n  ComputerFramesOpenRequest,\n  StreamChannel,\n} from \"@opengeni/agent-proto\";\nimport {\n  ensureBrowserControlServer,\n  type EnsureBrowserControlServerResult,\n} from \"./browser-control-server\";\nimport { parseExecResponseBanner } from \"./exec-banner\";\nimport { controllerStreamRequest, parseControllerStreamResponse } from \"./browser-control-stream\";\nimport type { BrowserControlHttpCall, BrowserControlHttpOutcome } from \"./browser-control-http\";\nimport {\n  buildStreamUrl,\n  exposedPortAllowsHostFetch,\n  joinExposedPortPath,\n  parseOpenSandboxSignedUriPath,\n  StreamPortUnavailableError,\n  type ExposedPortEndpoint,\n} from \"./stream-port\";\n\nconst CLIENT_ROOT = \"/tmp/opengeni-private/browser-control-client\";\nconst MANAGED_PLACEMENT_CONTROLLER_WORKDIR = \"/workspace\";\nconst NATIVE_PLACEMENT_CONTROLLER_WORKDIR = \"/tmp\";\nexport const BROWSER_CONTROL_ADMIN_TOKEN_FILE = \"/tmp/opengeni-browserd/authority/admin-token\";\nconst COMMAND_OK = \"OPENGENI_BROWSER_CONTROL_CLIENT_OK\";\nconst TOKEN_PATTERN = /^[A-Za-z0-9._~-]{32,2048}$/u;\nconst MAX_REQUEST_TIMEOUT_MS = 20 * 60_000;\nconst BROWSER_STATE_TRANSFER_TIMEOUT_MS = 20 * 60_000;\nconst PRIVATE_READ_CHUNK_BYTES = 512 * 1024;\nconst SHA256_PATTERN = /^[0-9a-f]{64}$/u;\n\n// Connected-machine browserd binds an OS-assigned loopback port. The agent\n// owns that endpoint, so the API must never fall back to the image port merely\n// because a fresh request constructed a fresh client. Cache the negotiated\n// endpoint by its physical authority fence; a transport failure invalidates it\n// and performs one idempotent ensure/retry below.\nconst nativeControllerPorts = new Map<string, number>();\n\ntype ExecResultLike = {\n  output?: string;\n  stdout?: string;\n  stderr?: string;\n  exitCode?: number | null;\n  sessionId?: number;\n};\n\nexport type BrowserControlPlacementSession = {\n  /** Connected Machine command stdin is byte-exact and private. Optional so\n   * older placement adapters retain their existing file-based transport. */\n  execWithInput?: (args: {\n    cmd: string;\n    stdin: Uint8Array;\n    shell: string;\n    login: boolean;\n    workdir: string;\n  }) => Promise<ExecResultLike>;\n  /** Host family of a Connected Machine. Windows hosts have no POSIX shell,\n   * /tmp or base64, so the controller transport uses its Windows form there. */\n  controllerHostOs?: () => \"posix\" | \"windows\";\n  exec?: (args: {\n    cmd: string;\n    workdir?: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n  }) => Promise<ExecResultLike | string>;\n  execCommand?: (args: {\n    cmd: string;\n    workdir?: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n  }) => Promise<string>;\n  readFile?: (args: { path: string; maxBytes?: number }) => Promise<string | Uint8Array>;\n  writeFile?: (args: {\n    path: string;\n    content: string | Uint8Array;\n    createParents?: boolean;\n  }) => Promise<unknown>;\n  writePlacementPrivate?: (args: {\n    path: string;\n    content: string | Uint8Array;\n    createParents?: boolean;\n  }) => Promise<unknown>;\n  deletePlacementPrivate?: (path: string) => Promise<void>;\n  writeStdin?: (args: {\n    sessionId: number;\n    chars?: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n  }) => Promise<string>;\n  resolveExposedPort?: (port: number) => Promise<ExposedPortEndpoint>;\n  /** Signed OpenSandbox Channel B must host-fetch. Never fall through to in-box curl. */\n  requireHostFetchController?: boolean;\n  runtimeMetrics?: {\n    onOpenSandboxSignedEndpoint?: (input: {\n      outcome: \"minted\" | \"mint_failed\" | \"host_fetch_unauthorized\";\n      port: number;\n    }) => void;\n  };\n  ensureBrowserControl?: (\n    request: BrowserControlEnsureRequest,\n  ) => Promise<BrowserControlEnsureResponse>;\n  /** Agent-native controller transport, addressed by authority scope. */\n  browserControlHttp?: (request: BrowserControlHttpCall) => Promise<BrowserControlHttpOutcome>;\n  openBrowserFrames?: (\n    request: BrowserFramesOpenRequest,\n  ) => Promise<{ channel: StreamChannel; endpoint: ExposedPortEndpoint }>;\n  openComputerFrames?: (\n    request: ComputerFramesOpenRequest,\n  ) => Promise<{ channel: StreamChannel; endpoint: ExposedPortEndpoint }>;\n  finalizeOpStreamOps?: () => Promise<void>;\n};\n\nexport type ComputerControlFrame = {\n  data: Uint8Array;\n  mediaType: \"image/jpeg\" | \"image/png\";\n  metadataHeader: string;\n  metadata: ComputerControlFrameMetadata;\n};\n\nexport type BrowserControlFrame = {\n  data: Uint8Array;\n  mediaType: \"image/jpeg\" | \"image/png\";\n  metadataHeader: string;\n  metadata: BrowserFrameMetadata;\n};\n\nexport type BrowserControlScreenshotOptions = {\n  fullPage?: boolean;\n  format?: \"jpeg\" | \"png\";\n  quality?: number;\n};\n\ntype ExpectedBrowserFrameEvidence = {\n  browserSessionId: string;\n  controllerGeneration: string;\n  targetId: string;\n};\n\ntype FrameRequest = {\n  method: \"GET\";\n  path: string;\n  token: string;\n  timeoutMs?: number;\n} & (\n  | { surface: \"browser\"; expectedFrameEvidence: ExpectedBrowserFrameEvidence }\n  | { surface: \"computer\"; expectedFrameEvidence: ExpectedComputerFrameEvidence }\n);\n\nexport type ComputerControlFrameMetadata = {\n  frameId: string;\n  computerSessionId: string;\n  controllerGeneration: string;\n  targetId: string;\n  targetGeneration: string;\n  sequence: number;\n  mediaType: \"image/jpeg\" | \"image/png\";\n  width: number;\n  height: number;\n  capturedAt: string;\n  sha256: string;\n};\n\nexport type ComputerFrameEvidenceMismatchReason =\n  | \"frame_session_mismatch\"\n  | \"frame_target_mismatch\"\n  | \"frame_controller_mismatch\"\n  | \"frame_media_mismatch\"\n  | \"frame_digest_mismatch\";\n\nexport type ExpectedComputerFrameEvidence = {\n  computerSessionId: string;\n  controllerGeneration: string;\n  targetId: string;\n};\n\n/** Controller I/O uses absolute private paths under /tmp, so its cwd carries\n * no data authority. Connected Machines need a native /tmp cwd because their\n * session directory may disappear; managed sandboxes must use /workspace\n * because provider exec confines workdir to the workspace root. */\nfunction placementControllerWorkdir(session: BrowserControlPlacementSession): string {\n  if (!session.ensureBrowserControl) return MANAGED_PLACEMENT_CONTROLLER_WORKDIR;\n  // A Windows machine has no /tmp. The relative \".\" resolves to its reported\n  // workspace root, which exists for the connection's lifetime.\n  return session.controllerHostOs?.() === \"windows\" ? \".\" : NATIVE_PLACEMENT_CONTROLLER_WORKDIR;\n}\n\nexport type PlacementBrowserSessionReference = {\n  browserSessionId: string;\n  controllerGeneration: string;\n};\n\nexport type PlacementBrowserSession = PlacementBrowserSessionReference & {\n  observation: BrowserObservationValue;\n  /** The tab inventory at creation, when the controller reports it. */\n  targets?: BrowserTargetValue[];\n};\n\nexport type PlacementComputerSessionReference = {\n  computerSessionId: string;\n  controllerGeneration: string;\n};\n\nexport type PlacementComputerSession = PlacementComputerSessionReference & {\n  platform: \"linux\" | \"macos\" | \"windows\";\n  adapter: string;\n  seatId: string;\n  displayId: string;\n  capabilities: ComputerSessionCapabilitiesValue;\n  targets: ComputerTargetValue[];\n};\n\nexport type CreatePlacementComputerSessionInput = PlacementComputerSessionReference & {\n  tokenGeneration: number;\n  controlToken: string;\n  viewToken: string;\n};\n\nexport type CreatePlacementBrowserSessionInput = PlacementBrowserSessionReference & {\n  tokenGeneration: number;\n  controlToken: string;\n  viewToken: string;\n  headed: boolean;\n  initialUrl?: string;\n  /** Private same-runtime recovery intent; never restores a saved revision. */\n  recoverExistingWorkingDirectory?: true;\n  restore?: RestorePlacementBrowserStateInput;\n  transport?: PlacementBrowserTransport;\n  linkedComputer?: PlacementComputerSessionReference;\n  networkRoute?: PlacementBrowserNetworkRoute;\n};\n\nexport type PlacementBrowserNetworkRoute = {\n  routeId: string;\n  routeVersion: number;\n  authorityDigest: string;\n  kind: \"direct\" | \"proxy\" | \"managed\" | \"tunnel\";\n  consistency: NetworkRouteConsistencyValue;\n  /** Present for an initial authenticated-proxy launch; omitted only when\n   * replaying an already-live controller after the referenced credential was\n   * rotated. Never persisted or returned by the controller. */\n  proxyUrl?: string;\n  /** Provider-native egress selector. Provider API authority remains on the\n   * external transport and is never duplicated into this route material. */\n  providerRoute?: {\n    providerId: \"browserbase\" | \"kernel\";\n    routeId: string;\n    egressClass: \"datacenter\" | \"residential\" | \"isp\";\n    region: string | null;\n  };\n};\n\nexport type PlacementBrowserTransport =\n  | { kind: \"managed\"; engine?: \"chromium\" | \"lightpanda\"; ephemeralPartition?: string }\n  | {\n      kind: \"external_provider\";\n      providerId: \"browserbase\" | \"kernel\";\n      placementId: string;\n      /** Private launch authority. Browserd never returns or journals it. */\n      authority: {\n        apiKey: string;\n        endpoint?: string;\n      };\n      timeoutSeconds?: number;\n      stealth?: boolean;\n    }\n  | {\n      kind: \"attached_chrome\";\n      deviceId: string;\n      connectionGeneration: string;\n      browserName: string;\n      browserVersion: string;\n    };\n\nexport type BrowserViewGrant = {\n  fencedInputBatches?: true;\n  focusedInputObservations?: true;\n  grantId: string;\n  expiresAt: string;\n};\n\nexport type ComputerViewGrant = BrowserViewGrant & { scopedRfbInput: boolean };\n\nexport type BrowserStateUploadGrant = {\n  url: string;\n  requiredHeaders: Readonly<Record<string, string>>;\n  expiresAt: string;\n};\n\nexport type BrowserStateDownloadGrant = {\n  url: string;\n  expiresAt: string;\n};\n\nexport type RestorePlacementBrowserStateInput = {\n  objectKey: string;\n  format: typeof BROWSER_PROFILE_ARTIFACT_FORMAT;\n  artifactDigest: string;\n  contentDigest: string;\n  manifestDigest: string;\n  sizeBytes: number;\n  dataKey: Uint8Array;\n  aad: Uint8Array;\n  materialization: BrowserRevisionMaterializationValue;\n  download: BrowserStateDownloadGrant;\n};\n\nexport type CapturePlacementBrowserStateInput = PlacementBrowserSessionReference & {\n  operationId: string;\n  objectKey: string;\n  afterCapture: \"restart\" | \"stop\";\n  dataKey: Uint8Array;\n  aad: Uint8Array;\n  upload: BrowserStateUploadGrant;\n};\n\nexport type PlacementBrowserStateCaptureReceipt = PlacementBrowserSessionReference & {\n  operationId: string;\n  objectKey: string;\n  format: typeof BROWSER_PROFILE_ARTIFACT_FORMAT;\n  artifactDigest: string;\n  contentDigest: string;\n  sizeBytes: number;\n  fileCount: number;\n  profileBytes: number;\n  manifest: {\n    schemaVersion: 1;\n    browserSessionId: string;\n    controllerGeneration: string;\n    capturedAt: string;\n    engine: \"chromium\" | \"chrome\";\n    engineVersion: string | null;\n    driverId: string;\n    driverSchemaVersion: number;\n    profileCrypto: \"chromium_basic\" | \"chromium_mock_keychain\" | \"platform_bound\";\n    platform: \"linux\" | \"macos\" | \"windows\";\n    architecture: \"x64\" | \"arm64\";\n    tabs: Array<{ url: string; selected: boolean }>;\n  };\n};\n\n/** The exact controller authority a preserved working copy was launched\n * under; the controller refuses any other. */\nexport type PlacementBrowserWorkingCopyAuthority = PlacementBrowserSessionReference & {\n  tokenGeneration: number;\n  controlToken: string;\n  viewToken: string;\n};\n\nexport const BROWSER_WORKING_COPY_REFUSALS = [\n  \"unsupported_platform\",\n  \"browser_running\",\n  \"working_copy_invalid\",\n  \"receipt_not_adoptable\",\n  \"authority_changed\",\n  \"process_state_unknown\",\n  \"adoption_not_needed\",\n  \"adoption_unresolved\",\n] as const;\nexport type PlacementBrowserWorkingCopyRefusal = (typeof BROWSER_WORKING_COPY_REFUSALS)[number];\n\nexport const BROWSER_WORKING_COPY_ADOPTION_PHASES = [\n  \"intent\",\n  \"copied\",\n  \"receipt\",\n  \"source_preserved\",\n  \"adopted\",\n  \"interrupted\",\n  \"failed\",\n  \"collision\",\n  \"reverting\",\n  \"reverted\",\n] as const;\nexport type PlacementBrowserWorkingCopyAdoptionPhase =\n  (typeof BROWSER_WORKING_COPY_ADOPTION_PHASES)[number];\n\nexport type PlacementBrowserWorkingCopyAdoption = PlacementBrowserSessionReference & {\n  operationId: string;\n  manifestDigest: string;\n  phase: PlacementBrowserWorkingCopyAdoptionPhase;\n  failureCode: string | null;\n  /** Directories this adoption kept beside the browser's own, by name. */\n  retainedDirectories: string[];\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type PlacementBrowserWorkingCopyInspection = PlacementBrowserSessionReference & {\n  platformSupported: boolean;\n  refusal: PlacementBrowserWorkingCopyRefusal | null;\n  /** Exact digest of the bytes an adoption would take; null when refused. */\n  manifest: { digest: string; entries: number; bytes: number; excluded: string[] } | null;\n  profileIdentityMatches: boolean;\n  /** false only when no process provably uses the profile. */\n  profileInUse: boolean | null;\n  receipt: {\n    operationId: string;\n    intent: \"launch\" | \"suspend\" | \"retire\" | \"adopt\";\n    state: string;\n    directoryLaunchAllowed: boolean;\n    authorityMatches: boolean;\n    /** True when this working copy was first launched from a saved checkpoint. */\n    launchedFromCheckpoint: boolean;\n    adoption: { operationId: string; manifestDigest: string } | null;\n  } | null;\n  activeAdoption: PlacementBrowserWorkingCopyAdoption | null;\n};\n\nexport type ProvisionBrowserControlClientInput = {\n  adminToken: string;\n  adminTokenFile?: string;\n  allowedOrigins?: readonly string[];\n  port?: number;\n  timeoutMs?: number;\n  /** Native connected-machine sidecar authority. Ignored by image-backed\n   * placements, whose browserd is already supervised inside the sandbox image. */\n  nativeAuthority?: {\n    scopeId: string;\n    scopeGeneration: string;\n  };\n};\n\nexport type ProvisionBrowserControlClientResult = {\n  client: BrowserControlClient;\n  server: EnsureBrowserControlServerResult;\n};\n\nexport class BrowserControlTransportError extends Error {\n  readonly name = \"BrowserControlTransportError\";\n  readonly retryable = true;\n}\n\nexport class BrowserControlProtocolError extends Error {\n  readonly name = \"BrowserControlProtocolError\";\n  readonly retryable = false;\n}\n\nexport class ComputerFrameEvidenceMismatchError extends BrowserControlProtocolError {\n  constructor(readonly reason: ComputerFrameEvidenceMismatchReason) {\n    super(\"computer frame evidence does not match its request\");\n  }\n}\n\nexport class BrowserControlRequestError extends Error {\n  readonly name = \"BrowserControlRequestError\";\n  readonly retryable: boolean;\n\n  constructor(\n    readonly status: number,\n    readonly error: InteractionErrorValue,\n  ) {\n    super(error.message);\n    this.retryable = error.retryable;\n  }\n}\n\nexport class BrowserControlUnsupportedError extends Error {\n  readonly name = \"BrowserControlUnsupportedError\";\n}\n\nfunction browserControllerCompatibilityError(feature: string): BrowserControlRequestError {\n  return new BrowserControlRequestError(409, {\n    code: \"unsupported\",\n    message: `browser controller does not support ${feature}; update the placement's controller image to match this Opengeni release`,\n    retryable: false,\n  });\n}\n\n/** Install one placement-stable admin credential and start the pinned controller. */\nexport async function provisionBrowserControlClient(\n  session: BrowserControlPlacementSession,\n  input: ProvisionBrowserControlClientInput,\n): Promise<ProvisionBrowserControlClientResult> {\n  requirePlacementProvisioningSurface(session);\n  const adminToken = requireToken(input.adminToken, \"browser controller admin token\");\n  if (session.ensureBrowserControl) {\n    if (!input.nativeAuthority) {\n      throw new BrowserControlProtocolError(\n        \"connected browser placement is missing its controller authority scope\",\n      );\n    }\n    const ensured = await session.ensureBrowserControl({\n      scopeId: input.nativeAuthority.scopeId,\n      scopeGeneration: input.nativeAuthority.scopeGeneration,\n      adminToken,\n      allowedOrigins: [...(input.allowedOrigins ?? [])],\n    });\n    const port = boundedPort(ensured.port);\n    nativeControllerPorts.set(nativeControllerKey(input.nativeAuthority), port);\n    return {\n      client: new BrowserControlClient(session, {\n        adminToken,\n        port,\n        nativeAuthority: input.nativeAuthority,\n        ...(input.timeoutMs === undefined ? {} : { timeoutMs: input.timeoutMs }),\n      }),\n      server: { port, marker: `agent:${ensured.sidecarGeneration}` },\n    };\n  }\n  const adminTokenFile = absolutePrivatePath(\n    input.adminTokenFile ?? BROWSER_CONTROL_ADMIN_TOKEN_FILE,\n    \"browser controller admin token file\",\n  );\n  const temporaryTokenFile = `${adminTokenFile}.new.${randomUUID()}`;\n  const parent = adminTokenFile.slice(0, adminTokenFile.lastIndexOf(\"/\")) || \"/\";\n  try {\n    await runChecked(\n      session,\n      `umask 077; install -d -m 0700 -- ${shellQuote(parent)}; printf '%s\\\\n' ${shellQuote(COMMAND_OK)}`,\n      input.timeoutMs,\n    );\n    await writePrivateFile(\n      session,\n      {\n        path: temporaryTokenFile,\n        content: `${adminToken}\\n`,\n        createParents: false,\n      },\n      input.timeoutMs,\n    );\n    await runChecked(\n      session,\n      `chmod 0600 -- ${shellQuote(temporaryTokenFile)}; mv -f -- ${shellQuote(temporaryTokenFile)} ${shellQuote(adminTokenFile)}; printf '%s\\\\n' ${shellQuote(COMMAND_OK)}`,\n      input.timeoutMs,\n    );\n    const server = await ensureBrowserControlServer(session, {\n      adminTokenFile,\n      ...(input.allowedOrigins ? { allowedOrigins: input.allowedOrigins } : {}),\n      ...(input.port === undefined ? {} : { port: input.port }),\n      ...(input.timeoutMs === undefined ? {} : { timeoutMs: input.timeoutMs }),\n    });\n    const client = new BrowserControlClient(session, {\n      adminToken,\n      port: server.port,\n      ...(input.nativeAuthority ? { nativeAuthority: input.nativeAuthority } : {}),\n      ...(input.timeoutMs === undefined ? {} : { timeoutMs: input.timeoutMs }),\n    });\n    if (input.allowedOrigins && input.allowedOrigins.length > 0) {\n      await client.addAllowedOrigins(input.allowedOrigins);\n    }\n    return { client, server };\n  } finally {\n    await runBestEffort(session, `rm -f -- ${shellQuote(temporaryTokenFile)}`);\n    await session.finalizeOpStreamOps?.().catch(() => undefined);\n  }\n}\n\nexport class BrowserControlClient {\n  readonly port: number;\n  private readonly session: BrowserControlPlacementSession;\n  private readonly adminToken: string;\n  private readonly timeoutMs: number;\n  private readonly nativeAuthority: { scopeId: string; scopeGeneration: string } | undefined;\n\n  constructor(\n    session: BrowserControlPlacementSession,\n    options: {\n      adminToken: string;\n      port?: number;\n      timeoutMs?: number;\n      nativeAuthority?: { scopeId: string; scopeGeneration: string };\n    },\n  ) {\n    requirePlacementRequestSurface(session);\n    this.session = session;\n    this.adminToken = requireToken(options.adminToken, \"browser controller admin token\");\n    this.port = boundedPort(options.port ?? BROWSER_CONTROL_PORT);\n    this.timeoutMs = boundedTimeout(options.timeoutMs ?? 60_000);\n    this.nativeAuthority = options.nativeAuthority;\n  }\n\n  async addAllowedOrigins(origins: readonly string[]): Promise<readonly string[]> {\n    if (origins.length === 0 || origins.length > 64) {\n      throw new RangeError(\"browser controller origin list size is invalid\");\n    }\n    const normalized = origins.map(normalizeOrigin);\n    const data = await this.requestJson({\n      method: \"PUT\",\n      path: \"/v1/origins\",\n      token: this.adminToken,\n      body: { origins: normalized },\n    });\n    if (!isRecord(data) || !Array.isArray(data.origins)) {\n      throw new BrowserControlProtocolError(\"browser controller returned malformed origins\");\n    }\n    return data.origins.map((origin) => normalizeOrigin(origin));\n  }\n\n  async createSession(input: CreatePlacementBrowserSessionInput): Promise<PlacementBrowserSession> {\n    const reference = parseReference(input);\n    if (\n      input.recoverExistingWorkingDirectory !== undefined &&\n      (input.recoverExistingWorkingDirectory !== true ||\n        input.restore ||\n        input.initialUrl !== undefined)\n    ) {\n      throw new BrowserControlProtocolError(\n        \"working directory recovery cannot restore or navigate\",\n      );\n    }\n    const restore = input.restore ? browserStateRestoreRequest(input.restore) : null;\n    let data: unknown;\n    try {\n      data = await this.requestJson({\n        method: \"POST\",\n        path: \"/v1/browser-sessions\",\n        token: this.adminToken,\n        body: {\n          ...reference,\n          tokenGeneration: positiveSafeInteger(input.tokenGeneration, \"token generation\"),\n          controlToken: requireToken(input.controlToken, \"browser control token\"),\n          viewToken: requireToken(input.viewToken, \"browser view token\"),\n          headed: input.headed,\n          ...(input.recoverExistingWorkingDirectory\n            ? { recoverExistingWorkingDirectory: true }\n            : {}),\n          ...(input.initialUrl === undefined ? {} : { initialUrl: boundedUrl(input.initialUrl) }),\n          ...(input.transport ? { transport: placementBrowserTransport(input.transport) } : {}),\n          ...(input.linkedComputer\n            ? { linkedComputer: parseComputerReference(input.linkedComputer) }\n            : {}),\n          ...(input.networkRoute\n            ? { networkRoute: placementBrowserNetworkRoute(input.networkRoute) }\n            : {}),\n          ...(restore ? { restore: restore.wire } : {}),\n        },\n        ...(restore ? { timeoutMs: BROWSER_STATE_TRANSFER_TIMEOUT_MS } : {}),\n      });\n    } finally {\n      restore?.dataKey.fill(0);\n      restore?.aad.fill(0);\n    }\n    if (!isRecord(data)) {\n      throw new BrowserControlProtocolError(\"browser controller returned malformed session data\");\n    }\n    const returnedReference = parseReference(data);\n    if (\n      returnedReference.browserSessionId !== reference.browserSessionId ||\n      returnedReference.controllerGeneration !== reference.controllerGeneration\n    ) {\n      throw new BrowserControlProtocolError(\"browser controller returned another session binding\");\n    }\n    return {\n      ...returnedReference,\n      observation: BrowserObservation.parse(data.observation),\n      ...creationTargets(data.targets, returnedReference),\n    };\n  }\n\n  async createComputerSession(\n    input: CreatePlacementComputerSessionInput,\n  ): Promise<PlacementComputerSession> {\n    const reference = parseComputerReference(input);\n    const data = await this.requestJson({\n      method: \"POST\",\n      path: \"/v1/computer-sessions\",\n      token: this.adminToken,\n      body: {\n        ...reference,\n        tokenGeneration: positiveSafeInteger(input.tokenGeneration, \"token generation\"),\n        controlToken: requireToken(input.controlToken, \"computer control token\"),\n        viewToken: requireToken(input.viewToken, \"computer view token\"),\n      },\n    });\n    if (!isRecord(data) || !Array.isArray(data.targets)) {\n      throw new BrowserControlProtocolError(\n        \"interaction controller returned malformed computer session data\",\n      );\n    }\n    const returned = parseComputerReference(data);\n    if (\n      returned.computerSessionId !== reference.computerSessionId ||\n      returned.controllerGeneration !== reference.controllerGeneration\n    ) {\n      throw new BrowserControlProtocolError(\n        \"interaction controller returned another computer session binding\",\n      );\n    }\n    const platform = data.platform;\n    if (platform !== \"linux\" && platform !== \"macos\" && platform !== \"windows\") {\n      throw new BrowserControlProtocolError(\n        \"interaction controller returned an invalid computer platform\",\n      );\n    }\n    return {\n      ...returned,\n      platform,\n      adapter: requireOpaqueId(data.adapter, \"computer adapter\"),\n      seatId: requireOpaqueId(data.seatId, \"computer seat id\"),\n      displayId: requireOpaqueId(data.displayId, \"computer display id\"),\n      capabilities: ComputerSessionCapabilities.parse(data.capabilities),\n      targets: data.targets.map((target) => ComputerTarget.parse(target)),\n    };\n  }\n\n  async endSession(\n    reference: PlacementBrowserSessionReference,\n    options: {\n      removeState: boolean;\n      discardWorkingRuntime?: boolean;\n      setAsideInterruptedLaunch?: boolean;\n    },\n  ): Promise<void> {\n    const binding = parseReference(reference);\n    const data = await this.requestJson({\n      method: \"POST\",\n      path: `/v1/browser-sessions/${binding.browserSessionId}/end`,\n      token: this.adminToken,\n      body: {\n        controllerGeneration: binding.controllerGeneration,\n        removeState: options.removeState,\n        // Older controllers reject unknown keys, so send it only when set.\n        ...(options.discardWorkingRuntime ? { discardWorkingRuntime: true } : {}),\n        ...(options.setAsideInterruptedLaunch ? { setAsideInterruptedLaunch: true } : {}),\n      },\n    });\n    if (!isRecord(data) || data.ended !== true) {\n      throw new BrowserControlProtocolError(\"browser controller returned malformed end receipt\");\n    }\n  }\n\n  async endComputerSession(\n    reference: PlacementComputerSessionReference,\n    options: { removeState: boolean },\n  ): Promise<void> {\n    const binding = parseComputerReference(reference);\n    const data = await this.requestJson({\n      method: \"POST\",\n      path: `/v1/computer-sessions/${binding.computerSessionId}/end`,\n      token: this.adminToken,\n      body: {\n        controllerGeneration: binding.controllerGeneration,\n        removeState: options.removeState,\n      },\n    });\n    if (!isRecord(data) || data.ended !== true) {\n      throw new BrowserControlProtocolError(\n        \"interaction controller returned malformed computer end receipt\",\n      );\n    }\n  }\n\n  async createViewGrant(\n    reference: PlacementBrowserSessionReference,\n    input: { grantId: string; token: string; expiresAt: string },\n  ): Promise<BrowserViewGrant> {\n    const binding = parseReference(reference);\n    const grantId = requireUuid(input.grantId, \"view grant id\");\n    const expiresAt = timestamp(input.expiresAt, \"view grant expiry\");\n    const data = await this.requestJson({\n      method: \"POST\",\n      path: `/v1/browser-sessions/${binding.browserSessionId}/view-grants`,\n      token: this.adminToken,\n      body: {\n        grantId,\n        controllerGeneration: binding.controllerGeneration,\n        token: requireToken(input.token, \"view grant token\"),\n        expiresAt,\n      },\n    });\n    if (!isRecord(data) || data.grantId !== grantId || data.expiresAt !== expiresAt) {\n      throw new BrowserControlProtocolError(\"browser controller returned malformed view grant\");\n    }\n    if (data.fencedInputBatches !== undefined && data.fencedInputBatches !== true) {\n      throw new BrowserControlProtocolError(\n        \"browser controller returned invalid input batching capability\",\n      );\n    }\n    if (data.focusedInputObservations !== undefined && data.focusedInputObservations !== true) {\n      throw new BrowserControlProtocolError(\n        \"browser controller returned invalid focused input capability\",\n      );\n    }\n    return {\n      grantId,\n      expiresAt,\n      ...(data.fencedInputBatches === true ? { fencedInputBatches: true } : {}),\n      ...(data.focusedInputObservations === true ? { focusedInputObservations: true } : {}),\n    };\n  }\n\n  async createComputerViewGrant(\n    reference: PlacementComputerSessionReference,\n    input: {\n      grantId: string;\n      token: string;\n      expiresAt: string;\n      rfbScope?: { targetId: string; targetGeneration: string; inputAllowed: boolean };\n    },\n  ): Promise<ComputerViewGrant> {\n    const binding = parseComputerReference(reference);\n    const grantId = requireUuid(input.grantId, \"computer view grant id\");\n    const expiresAt = timestamp(input.expiresAt, \"computer view grant expiry\");\n    const data = await this.requestJson({\n      method: \"POST\",\n      path: `/v1/computer-sessions/${binding.computerSessionId}/view-grants`,\n      token: this.adminToken,\n      body: {\n        grantId,\n        controllerGeneration: binding.controllerGeneration,\n        token: requireToken(input.token, \"computer view grant token\"),\n        expiresAt,\n        ...(input.rfbScope\n          ? {\n              targetId: requireOpaqueId(input.rfbScope.targetId, \"RFB target id\"),\n              targetGeneration: requireGeneration(input.rfbScope.targetGeneration),\n              inputAllowed: input.rfbScope.inputAllowed,\n            }\n          : {}),\n      },\n    });\n    if (!isRecord(data) || data.grantId !== grantId || data.expiresAt !== expiresAt) {\n      throw new BrowserControlProtocolError(\n        \"interaction controller returned malformed computer view grant\",\n      );\n    }\n    if (data.scopedRfbInput !== undefined && typeof data.scopedRfbInput !== \"boolean\") {\n      throw new BrowserControlProtocolError(\n        \"interaction controller returned invalid RFB scope capability\",\n      );\n    }\n    if (\n      input.rfbScope &&\n      (data.scopedRfbInput !== true ||\n        data.targetId !== input.rfbScope.targetId ||\n        data.targetGeneration !== input.rfbScope.targetGeneration ||\n        data.inputAllowed !== input.rfbScope.inputAllowed)\n    ) {\n      throw new BrowserControlProtocolError(\n        \"interaction controller did not bind the requested RFB scope\",\n      );\n    }\n    return { grantId, expiresAt, scopedRfbInput: data.scopedRfbInput === true };\n  }\n\n  /** Quiesce one exact controller, upload its encrypted working profile, and\n   * return only integrity/compatibility metadata. Secret authority is carried\n   * in a private placement request file and never returned by browserd. */\n  async captureState(\n    input: CapturePlacementBrowserStateInput,\n  ): Promise<PlacementBrowserStateCaptureReceipt> {\n    const reference = parseReference(input);\n    const operationId = requireUuid(input.operationId, \"browser state operation id\");\n    const objectKey = browserStateObjectKey(input.objectKey);\n    const dataKey = exactBytes(input.dataKey, 32, \"browser state data key\");\n    const aad = boundedBytes(input.aad, 1, 16 * 1024, \"browser state associated data\");\n    const upload = browserStateUploadGrant(input.upload);\n    const data = await this.requestJson({\n      method: \"POST\",\n      path: `/v1/browser-sessions/${reference.browserSessionId}/state-captures`,\n      token: this.adminToken,\n      body: {\n        operationId,\n        controllerGeneration: reference.controllerGeneration,\n        objectKey,\n        afterCapture: input.afterCapture,\n        dataKeyBase64: Buffer.from(dataKey).toString(\"base64\"),\n        aadBase64: Buffer.from(aad).toString(\"base64\"),\n        upload,\n      },\n      timeoutMs: BROWSER_STATE_TRANSFER_TIMEOUT_MS,\n    });\n    const receipt = parseStateCaptureReceipt(data);\n    if (\n      receipt.operationId !== operationId ||\n      receipt.browserSessionId !== reference.browserSessionId ||\n      receipt.controllerGeneration !== reference.controllerGeneration ||\n      receipt.objectKey !== objectKey\n    ) {\n      throw new BrowserControlProtocolError(\n        \"browser controller returned another state-capture binding\",\n      );\n    }\n    return receipt;\n  }\n\n  /** Read-only evidence about a preserved working copy whose controller\n   * memory was lost: the exact digest of its bytes and whether it can be\n   * adopted. Hashing a large profile can take minutes. */\n  async inspectWorkingCopy(\n    input: PlacementBrowserWorkingCopyAuthority,\n  ): Promise<PlacementBrowserWorkingCopyInspection> {\n    const reference = parseReference(input);\n    const data = await this.requestJson({\n      method: \"POST\",\n      path: `/v1/browser-sessions/${reference.browserSessionId}/working-copy/inspection`,\n      token: this.adminToken,\n      body: workingCopyAuthorityBody(reference, input),\n      timeoutMs: BROWSER_STATE_TRANSFER_TIMEOUT_MS,\n    });\n    return parseWorkingCopyInspection(data, reference);\n  }\n\n  /** Adopt the exact inspected bytes of a preserved working copy. A lost reply\n   * is checked with {@link workingCopyAdoption}. Sending the same operation id\n   * again never repeats a side effect: it only settles what that operation\n   * already did, under the authority that approved it. */\n  async adoptWorkingCopy(\n    input: PlacementBrowserWorkingCopyAuthority & { operationId: string; manifestDigest: string },\n  ): Promise<PlacementBrowserWorkingCopyAdoption> {\n    const reference = parseReference(input);\n    const operationId = requireUuid(input.operationId, \"working copy adoption id\");\n    const data = await this.requestJson({\n      method: \"POST\",\n      path: `/v1/browser-sessions/${reference.browserSessionId}/working-copy/adoptions`,\n      token: this.adminToken,\n      body: {\n        ...workingCopyAuthorityBody(reference, input),\n        operationId,\n        manifestDigest: sha256(input.manifestDigest, \"working copy manifest digest\"),\n      },\n      timeoutMs: BROWSER_STATE_TRANSFER_TIMEOUT_MS,\n    });\n    const adoption = parseWorkingCopyAdoption(data, reference, \"current\");\n    if (adoption.operationId !== operationId) {\n      throw new BrowserControlProtocolError(\"browser controller returned another adoption\");\n    }\n    return adoption;\n  }\n\n  /** The recorded state of one adoption, read without changing it. */\n  async workingCopyAdoption(\n    reference: PlacementBrowserSessionReference,\n    operationId: string,\n  ): Promise<{ inFlight: boolean; adoption: PlacementBrowserWorkingCopyAdoption | null }> {\n    const binding = parseReference(reference);\n    const id = requireUuid(operationId, \"working copy adoption id\");\n    const data = await this.requestJson({\n      method: \"GET\",\n      path: `/v1/browser-sessions/${binding.browserSessionId}/working-copy/adoptions/${id}`,\n      token: this.adminToken,\n    });\n    if (!isRecord(data) || typeof data.inFlight !== \"boolean\") {\n      throw new BrowserControlProtocolError(\n        \"browser controller returned malformed adoption status\",\n      );\n    }\n    const adoption =\n      data.adoption === null ? null : parseWorkingCopyAdoption(data.adoption, binding, \"recorded\");\n    if (adoption && adoption.operationId !== id) {\n      throw new BrowserControlProtocolError(\"browser controller returned another adoption\");\n    }\n    return { inFlight: data.inFlight, adoption };\n  }\n\n  /** Revert one unfinished adoption under the browser's current authority:\n   * its own directory goes back to the live path and the staged copy is\n   * kept. Retrying the same revert finishes one that stopped part way. */\n  async revertWorkingCopyAdoption(\n    input: PlacementBrowserWorkingCopyAuthority & { operationId: string },\n  ): Promise<{ inFlight: boolean; adoption: PlacementBrowserWorkingCopyAdoption | null }> {\n    const reference = parseReference(input);\n    const id = requireUuid(input.operationId, \"working copy adoption id\");\n    const data = await this.requestJson({\n      method: \"POST\",\n      path: `/v1/browser-sessions/${reference.browserSessionId}/working-copy/adoptions/${id}/revert`,\n      token: this.adminToken,\n      body: workingCopyAuthorityBody(reference, input),\n      timeoutMs: BROWSER_STATE_TRANSFER_TIMEOUT_MS,\n    });\n    if (!isRecord(data) || typeof data.inFlight !== \"boolean\") {\n      throw new BrowserControlProtocolError(\"browser controller returned malformed revert status\");\n    }\n    const adoption =\n      data.adoption === null\n        ? null\n        : parseWorkingCopyAdoption(data.adoption, reference, \"recorded\");\n    if (adoption && adoption.operationId !== id) {\n      throw new BrowserControlProtocolError(\"browser controller returned another adoption\");\n    }\n    return { inFlight: data.inFlight, adoption };\n  }\n\n  sessionClient(input: {\n    reference: PlacementBrowserSessionReference;\n    controlToken: string;\n    viewToken: string;\n  }): BrowserControlSessionClient {\n    return new BrowserControlSessionClient(this, input);\n  }\n\n  computerSessionClient(input: {\n    reference: PlacementComputerSessionReference;\n    controlToken: string;\n    viewToken: string;\n  }): ComputerControlSessionClient {\n    return new ComputerControlSessionClient(this, input);\n  }\n\n  async frameStreamUrl(\n    reference: PlacementBrowserSessionReference,\n    targetId: string,\n    stream: {\n      format?: \"jpeg\" | \"png\" | undefined;\n      quality?: number | undefined;\n      maxWidth?: number | undefined;\n      maxHeight?: number | undefined;\n      everyNthFrame?: number | undefined;\n    } = {},\n  ): Promise<string> {\n    const binding = parseReference(reference);\n    if (!this.session.resolveExposedPort) {\n      throw new BrowserControlUnsupportedError(\n        \"browser placement cannot expose its live-frame port\",\n      );\n    }\n    const endpoint = await this.session.resolveExposedPort(this.port);\n    const path = joinControllerPath(\n      endpoint.path,\n      `/v1/browser-sessions/${binding.browserSessionId}/targets/${encodeURIComponent(requireOpaqueId(targetId, \"target id\"))}/frames`,\n    );\n    return frameStreamUrlWithOptions(buildStreamUrl({ ...endpoint, path }), stream);\n  }\n\n  async computerFrameStreamUrl(\n    reference: PlacementComputerSessionReference,\n    targetId: string,\n    stream: {\n      format?: \"jpeg\" | \"png\" | undefined;\n      quality?: number | undefined;\n      maxWidth?: number | undefined;\n      maxHeight?: number | undefined;\n      everyNthFrame?: number | undefined;\n    } = {},\n  ): Promise<string> {\n    const binding = parseComputerReference(reference);\n    if (!this.session.resolveExposedPort) {\n      throw new BrowserControlUnsupportedError(\n        \"computer placement cannot expose its live-frame port\",\n      );\n    }\n    const endpoint = await this.session.resolveExposedPort(this.port);\n    const path = joinControllerPath(\n      endpoint.path,\n      `/v1/computer-sessions/${binding.computerSessionId}/targets/${encodeURIComponent(requireOpaqueId(targetId, \"computer target id\"))}/frames`,\n    );\n    return frameStreamUrlWithOptions(buildStreamUrl({ ...endpoint, path }), stream);\n  }\n\n  async computerRfbStreamUrl(\n    reference: PlacementComputerSessionReference,\n    targetId: string,\n  ): Promise<string> {\n    const binding = parseComputerReference(reference);\n    if (!this.session.resolveExposedPort) {\n      throw new BrowserControlUnsupportedError(\n        \"computer placement cannot expose its live RFB port\",\n      );\n    }\n    const endpoint = await this.session.resolveExposedPort(this.port);\n    const path = joinControllerPath(\n      endpoint.path,\n      `/v1/computer-sessions/${binding.computerSessionId}/targets/${encodeURIComponent(requireOpaqueId(targetId, \"computer target id\"))}/rfb`,\n    );\n    return buildStreamUrl({ ...endpoint, path });\n  }\n\n  /** Open the browser frame source through the connected-machine relay adapter.\n   * Returns null on image-backed placements, which expose browserd directly. */\n  async openRelayedFrameStream(input: {\n    reference: PlacementBrowserSessionReference;\n    targetId: string;\n    viewToken: string;\n    expiresAt: string;\n    stream?: {\n      format?: \"jpeg\" | \"png\" | undefined;\n      quality?: number | undefined;\n      maxWidth?: number | undefined;\n      maxHeight?: number | undefined;\n      everyNthFrame?: number | undefined;\n    };\n  }): Promise<{\n    channel: StreamChannel;\n    endpoint: ExposedPortEndpoint;\n  } | null> {\n    if (!this.session.openBrowserFrames) return null;\n    if (!this.nativeAuthority) {\n      throw new BrowserControlProtocolError(\n        \"connected browser placement is missing its controller authority scope\",\n      );\n    }\n    const reference = parseReference(input.reference);\n    const expiresAtMs = Date.parse(input.expiresAt);\n    if (!Number.isSafeInteger(expiresAtMs)) {\n      throw new BrowserControlProtocolError(\"browser view grant expiry is invalid\");\n    }\n    const stream = input.stream ?? {};\n    return await this.session.openBrowserFrames({\n      scopeId: this.nativeAuthority.scopeId,\n      scopeGeneration: this.nativeAuthority.scopeGeneration,\n      browserSessionId: reference.browserSessionId,\n      controllerGeneration: reference.controllerGeneration,\n      targetId: requireOpaqueId(input.targetId, \"target id\"),\n      viewToken: requireToken(input.viewToken, \"browser view grant\"),\n      expiresAtMs: String(expiresAtMs),\n      format: stream.format ?? \"jpeg\",\n      quality: boundedInteger(stream.quality ?? 70, 1, 100, \"browser frame quality\"),\n      maxWidth: boundedInteger(stream.maxWidth ?? 1_440, 1, 4_096, \"browser frame width\"),\n      maxHeight: boundedInteger(stream.maxHeight ?? 900, 1, 4_096, \"browser frame height\"),\n      everyNthFrame: boundedInteger(\n        stream.everyNthFrame ?? 1,\n        1,\n        60,\n        \"browser frame sampling interval\",\n      ),\n    });\n  }\n\n  /** Open a ComputerSession frame source through the connected-machine relay.\n   * Image-backed placements return null and expose browserd directly. */\n  async openRelayedComputerFrameStream(input: {\n    reference: PlacementComputerSessionReference;\n    targetId: string;\n    viewToken: string;\n    expiresAt: string;\n    stream?: {\n      format?: \"jpeg\" | \"png\" | undefined;\n      quality?: number | undefined;\n      maxWidth?: number | undefined;\n      maxHeight?: number | undefined;\n      everyNthFrame?: number | undefined;\n    };\n  }): Promise<{\n    channel: StreamChannel;\n    endpoint: ExposedPortEndpoint;\n  } | null> {\n    if (!this.session.openComputerFrames) return null;\n    if (!this.nativeAuthority) {\n      throw new BrowserControlProtocolError(\n        \"connected computer placement is missing its controller authority scope\",\n      );\n    }\n    const reference = parseComputerReference(input.reference);\n    const expiresAtMs = Date.parse(input.expiresAt);\n    if (!Number.isSafeInteger(expiresAtMs)) {\n      throw new BrowserControlProtocolError(\"computer view grant expiry is invalid\");\n    }\n    const stream = input.stream ?? {};\n    return await this.session.openComputerFrames({\n      scopeId: this.nativeAuthority.scopeId,\n      scopeGeneration: this.nativeAuthority.scopeGeneration,\n      computerSessionId: reference.computerSessionId,\n      controllerGeneration: reference.controllerGeneration,\n      targetId: requireOpaqueId(input.targetId, \"computer target id\"),\n      viewToken: requireToken(input.viewToken, \"computer view grant\"),\n      expiresAtMs: String(expiresAtMs),\n      format: stream.format ?? \"jpeg\",\n      quality: boundedInteger(stream.quality ?? 70, 1, 100, \"computer frame quality\"),\n      maxWidth: boundedInteger(stream.maxWidth ?? 4_096, 1, 4_096, \"computer frame width\"),\n      maxHeight: boundedInteger(stream.maxHeight ?? 4_096, 1, 4_096, \"computer frame height\"),\n      everyNthFrame: boundedInteger(\n        stream.everyNthFrame ?? 1,\n        1,\n        60,\n        \"computer frame sampling interval\",\n      ),\n    });\n  }\n\n  async requestForSession(input: {\n    method: \"GET\" | \"POST\" | \"DELETE\";\n    path: string;\n    token: string;\n    body?: unknown;\n    timeoutMs?: number;\n  }): Promise<unknown> {\n    return await this.requestJson(input);\n  }\n\n  async requestBytesForSession(input: {\n    method: \"GET\";\n    path: string;\n    token: string;\n    expectedFrameEvidence: ExpectedComputerFrameEvidence;\n    timeoutMs?: number;\n  }): Promise<ComputerControlFrame> {\n    return (await this.requestBytes({ ...input, surface: \"computer\" })) as ComputerControlFrame;\n  }\n\n  async requestBrowserBytesForSession(input: {\n    method: \"GET\";\n    path: string;\n    token: string;\n    expectedFrameEvidence: ExpectedBrowserFrameEvidence;\n    timeoutMs?: number;\n  }): Promise<BrowserControlFrame> {\n    return (await this.requestBytes({ ...input, surface: \"browser\" })) as BrowserControlFrame;\n  }\n\n  private async requestJson(\n    input: {\n      method: \"GET\" | \"POST\" | \"PUT\" | \"DELETE\";\n      path: string;\n      token: string;\n      body?: unknown;\n      timeoutMs?: number;\n    },\n    retryNativeEndpoint = true,\n  ): Promise<unknown> {\n    // Image-backed placements expose browserd through the provider tunnel. Use\n    // that actual data plane for control too: one authenticated HTTP request,\n    // instead of materializing files and starting curl through the sandbox exec\n    // API for every click or key. Connected machines keep their agent transport.\n    const requireHostFetch = this.session.requireHostFetchController === true;\n    if (this.session.resolveExposedPort && !this.session.ensureBrowserControl) {\n      try {\n        const endpoint = await this.session.resolveExposedPort(this.port);\n        // Lifecycle proxies rewrite Authorization, so a host-side Bearer cannot\n        // be both the proxy key and the browserd admin token. Native `/` tunnels\n        // and OSEP-0011 signed URIs host-fetch. Unsigned OpenSandbox still uses\n        // in-box loopback curl on the lifecycle prefix. Signed Channel B never\n        // takes that path. A cached controller-only session has no exec, so\n        // host-fetching a lifecycle prefix would 401; throw a retryable\n        // transport error so the caller invalidates and provisions.\n        const hostFetchAllowed = exposedPortAllowsHostFetch(endpoint);\n        const canExec = Boolean(this.session.exec || this.session.execCommand);\n        if (!hostFetchAllowed && (requireHostFetch || !canExec)) {\n          throw new BrowserControlTransportError(\n            requireHostFetch\n              ? \"signed Channel B cannot use the lifecycle proxy\"\n              : \"cached browser controller endpoint cannot host-fetch a prefixed proxy\",\n          );\n        }\n        if (hostFetchAllowed) {\n          try {\n            return await requestExposedController(\n              endpoint,\n              input,\n              this.timeoutMs,\n              this.session.runtimeMetrics,\n            );\n          } catch (error) {\n            if (\n              retryNativeEndpoint &&\n              !requireHostFetch &&\n              input.method === \"GET\" &&\n              error instanceof BrowserControlTransportError\n            ) {\n              return await this.requestJson(input, false);\n            }\n            throw error;\n          }\n        }\n      } catch (error) {\n        if (\n          error instanceof BrowserControlRequestError ||\n          error instanceof BrowserControlProtocolError ||\n          error instanceof BrowserControlTransportError ||\n          error instanceof RangeError\n        ) {\n          throw error;\n        }\n        if (requireHostFetch || (!this.session.exec && !this.session.execCommand)) {\n          throw new BrowserControlTransportError(\n            requireHostFetch\n              ? \"signed Channel B host-fetch failed\"\n              : \"cached browser controller endpoint is temporarily unavailable\",\n            { cause: error },\n          );\n        }\n        // Unsigned lifecycle placements may fall back to in-box curl when port\n        // discovery fails. Signed Channel B must not; that would restore the\n        // Authorization-rewriting proxy path the signed edge exists to avoid.\n      }\n    } else if (requireHostFetch) {\n      throw new BrowserControlTransportError(\n        \"signed Channel B requires a host-fetch controller endpoint\",\n      );\n    }\n\n    const native = await this.requestNative(input, BROWSER_CONTROL_MAX_JSON_BYTES);\n    if (native) {\n      let text: string;\n      try {\n        text = new TextDecoder(\"utf-8\", { fatal: true }).decode(native.body);\n      } catch (error) {\n        throw new BrowserControlProtocolError(\"browser controller response is not UTF-8\", {\n          cause: error,\n        });\n      }\n      return parseEnvelope(text, native.status);\n    }\n\n    if (\n      this.session.execWithInput &&\n      (input.body === undefined || Buffer.byteLength(JSON.stringify(input.body)) <= 32 * 1024)\n    ) {\n      try {\n        const response = await this.requestStream(input, BROWSER_CONTROL_MAX_JSON_BYTES);\n        return parseEnvelope(\n          new TextDecoder(\"utf-8\", { fatal: true }).decode(response.data),\n          response.status,\n        );\n      } catch (error) {\n        if (\n          retryNativeEndpoint &&\n          input.method === \"GET\" &&\n          this.nativeAuthority &&\n          this.session.ensureBrowserControl &&\n          error instanceof BrowserControlTransportError\n        ) {\n          nativeControllerPorts.delete(nativeControllerKey(this.nativeAuthority));\n          await this.controllerPort();\n          return await this.requestJson(input, false);\n        }\n        throw error;\n      } finally {\n        await this.session.finalizeOpStreamOps?.().catch(() => undefined);\n      }\n    }\n\n    const controllerPort = await this.controllerPort();\n    const directory = `${CLIENT_ROOT}/${randomUUID()}`;\n    const configPath = `${directory}/curl.conf`;\n    const requestPath = `${directory}/request.json`;\n    const responsePath = `${directory}/response.json`;\n    const statusPath = `${directory}/status`;\n    const exitPath = `${directory}/curl-exit`;\n    const token = requireToken(input.token, \"browser controller token\");\n    const timeoutMs = boundedTimeout(input.timeoutMs ?? this.timeoutMs);\n    const url = localControllerUrl(controllerPort, input.path);\n    const body = input.body === undefined ? undefined : JSON.stringify(input.body);\n    try {\n      await runChecked(\n        this.session,\n        `umask 077; install -d -m 0700 -- ${shellQuote(directory)}; printf '%s\\\\n' ${shellQuote(COMMAND_OK)}`,\n        timeoutMs,\n      );\n      if (body !== undefined) {\n        if (Buffer.byteLength(body) > BROWSER_CONTROL_MAX_JSON_BYTES) {\n          throw new RangeError(\"browser controller request body is too large\");\n        }\n        await writePrivateFile(\n          this.session,\n          { path: requestPath, content: body, createParents: false },\n          timeoutMs,\n        );\n      }\n      await writePrivateFile(\n        this.session,\n        {\n          path: configPath,\n          content: curlConfig({\n            method: input.method,\n            url,\n            token,\n            responsePath,\n            ...(body === undefined ? {} : { requestPath }),\n            timeoutMs,\n          }),\n          createParents: false,\n        },\n        timeoutMs,\n      );\n      await runChecked(\n        this.session,\n        `chmod 0600 -- ${shellQuote(configPath)}${body === undefined ? \"\" : ` ${shellQuote(requestPath)}`}; : > ${shellQuote(statusPath)}; curl --disable --config ${shellQuote(configPath)} > ${shellQuote(statusPath)}; curl_exit=$?; printf '%s' \"$curl_exit\" > ${shellQuote(exitPath)}; printf '%s\\\\n' ${shellQuote(COMMAND_OK)}`,\n        timeoutMs,\n      );\n      const curlExit = parseUnsignedInteger(\n        await readText(this.session, exitPath, 32, timeoutMs),\n        \"curl exit\",\n      );\n      if (curlExit !== 0) {\n        throw new BrowserControlTransportError(\n          `browser controller transport failed (curl exit ${curlExit})`,\n        );\n      }\n      const status = parseHttpStatus(await readText(this.session, statusPath, 32, timeoutMs));\n      const responseText = await readText(\n        this.session,\n        responsePath,\n        BROWSER_CONTROL_MAX_JSON_BYTES + 1,\n        timeoutMs,\n      );\n      if (Buffer.byteLength(responseText) > BROWSER_CONTROL_MAX_JSON_BYTES) {\n        throw new BrowserControlProtocolError(\"browser controller response is too large\");\n      }\n      return parseEnvelope(responseText, status);\n    } catch (error) {\n      if (\n        error instanceof BrowserControlRequestError ||\n        error instanceof BrowserControlProtocolError ||\n        error instanceof RangeError\n      ) {\n        throw error;\n      }\n      if (error instanceof BrowserControlTransportError) {\n        if (\n          retryNativeEndpoint &&\n          input.method === \"GET\" &&\n          this.nativeAuthority &&\n          this.session.ensureBrowserControl\n        ) {\n          nativeControllerPorts.delete(nativeControllerKey(this.nativeAuthority));\n          await this.controllerPort();\n          return await this.requestJson(input, false);\n        }\n        throw error;\n      }\n      throw new BrowserControlTransportError(\"browser controller request transport failed\", {\n        cause: error,\n      });\n    } finally {\n      await runBestEffort(this.session, `rm -rf -- ${shellQuote(directory)}`);\n      await this.session.finalizeOpStreamOps?.().catch(() => undefined);\n    }\n  }\n\n  private async requestBytes(\n    input: FrameRequest,\n    retryNativeEndpoint = true,\n  ): Promise<ComputerControlFrame | BrowserControlFrame> {\n    const requireHostFetch = this.session.requireHostFetchController === true;\n    if (this.session.resolveExposedPort && !this.session.ensureBrowserControl) {\n      try {\n        const endpoint = await this.session.resolveExposedPort(this.port);\n        const hostFetchAllowed = exposedPortAllowsHostFetch(endpoint);\n        const canExec = Boolean(this.session.exec || this.session.execCommand);\n        if (!hostFetchAllowed && (requireHostFetch || !canExec)) {\n          throw new BrowserControlTransportError(\n            requireHostFetch\n              ? \"signed Channel B cannot use the lifecycle proxy\"\n              : \"cached browser controller endpoint cannot host-fetch a prefixed proxy\",\n          );\n        }\n        if (hostFetchAllowed) {\n          try {\n            return await requestExposedControllerBytes(endpoint, input, this.timeoutMs);\n          } catch (error) {\n            if (\n              retryNativeEndpoint &&\n              !requireHostFetch &&\n              error instanceof BrowserControlTransportError\n            ) {\n              return await this.requestBytes(input, false);\n            }\n            throw error;\n          }\n        }\n      } catch (error) {\n        if (\n          error instanceof BrowserControlRequestError ||\n          error instanceof BrowserControlProtocolError ||\n          error instanceof BrowserControlTransportError ||\n          error instanceof RangeError\n        ) {\n          throw error;\n        }\n        if (requireHostFetch || (!this.session.exec && !this.session.execCommand)) {\n          throw new BrowserControlTransportError(\n            requireHostFetch\n              ? \"signed Channel B host-fetch failed\"\n              : \"cached browser controller endpoint is temporarily unavailable\",\n            { cause: error },\n          );\n        }\n      }\n    } else if (requireHostFetch) {\n      throw new BrowserControlTransportError(\n        \"signed Channel B requires a host-fetch controller endpoint\",\n      );\n    }\n\n    const nativeFrame = await this.requestNative(\n      input,\n      input.surface === \"browser\" ? 24 * 1024 * 1024 : COMPUTER_SCREENSHOT_MAX_BYTES,\n    );\n    if (nativeFrame) {\n      if (nativeFrame.status < 200 || nativeFrame.status >= 300) {\n        parseEnvelope(new TextDecoder().decode(nativeFrame.body), nativeFrame.status);\n        throw new BrowserControlProtocolError(\"browser controller image response is invalid\");\n      }\n      return controllerImageFrame(nativeFrame.body, nativeFrame.headers, input);\n    }\n\n    if (this.session.execWithInput) {\n      try {\n        const response = await this.requestStream(\n          input,\n          input.surface === \"browser\" ? 24 * 1024 * 1024 : COMPUTER_SCREENSHOT_MAX_BYTES,\n        );\n        if (response.status < 200 || response.status >= 300) {\n          parseEnvelope(new TextDecoder().decode(response.data), response.status);\n          throw new BrowserControlProtocolError(\"browser controller image response is invalid\");\n        }\n        return controllerImageFrame(response.data, response.headers, input);\n      } catch (error) {\n        if (\n          retryNativeEndpoint &&\n          this.nativeAuthority &&\n          this.session.ensureBrowserControl &&\n          error instanceof BrowserControlTransportError\n        ) {\n          nativeControllerPorts.delete(nativeControllerKey(this.nativeAuthority));\n          await this.controllerPort();\n          return await this.requestBytes(input, false);\n        }\n        throw error;\n      } finally {\n        await this.session.finalizeOpStreamOps?.().catch(() => undefined);\n      }\n    }\n\n    const controllerPort = await this.controllerPort();\n    const directory = `${CLIENT_ROOT}/${randomUUID()}`;\n    const configPath = `${directory}/curl.conf`;\n    const responsePath = `${directory}/response.bin`;\n    const responseHeadersPath = `${directory}/response.headers`;\n    const statusPath = `${directory}/status`;\n    const exitPath = `${directory}/curl-exit`;\n    const token = requireToken(input.token, \"browser controller token\");\n    const timeoutMs = boundedTimeout(input.timeoutMs ?? this.timeoutMs);\n    const url = localControllerUrl(controllerPort, input.path);\n    try {\n      await runChecked(\n        this.session,\n        `umask 077; install -d -m 0700 -- ${shellQuote(directory)}; printf '%s\\n' ${shellQuote(COMMAND_OK)}`,\n        timeoutMs,\n      );\n      await writePrivateFile(\n        this.session,\n        {\n          path: configPath,\n          content: curlConfig({\n            method: input.method,\n            url,\n            token,\n            responsePath,\n            responseHeadersPath,\n            timeoutMs,\n          }),\n          createParents: false,\n        },\n        timeoutMs,\n      );\n      await runChecked(\n        this.session,\n        `chmod 0600 -- ${shellQuote(configPath)}; : > ${shellQuote(statusPath)}; curl --disable --config ${shellQuote(configPath)} > ${shellQuote(statusPath)}; curl_exit=$?; printf '%s' \"$curl_exit\" > ${shellQuote(exitPath)}; printf '%s\\n' ${shellQuote(COMMAND_OK)}`,\n        timeoutMs,\n      );\n      const curlExit = parseUnsignedInteger(\n        await readText(this.session, exitPath, 32, timeoutMs),\n        \"curl exit\",\n      );\n      if (curlExit !== 0) {\n        throw new BrowserControlTransportError(\n          `browser controller transport failed (curl exit ${curlExit})`,\n        );\n      }\n      const status = parseHttpStatus(await readText(this.session, statusPath, 32, timeoutMs));\n      if (status < 200 || status >= 300) {\n        const responseText = await readText(\n          this.session,\n          responsePath,\n          BROWSER_CONTROL_MAX_JSON_BYTES + 1,\n          timeoutMs,\n        );\n        parseEnvelope(responseText, status);\n        throw new BrowserControlProtocolError(\"browser controller image response is invalid\");\n      }\n      const headers = parseCurlResponseHeaders(\n        await readText(this.session, responseHeadersPath, 64 * 1024, timeoutMs),\n      );\n      const data = await readBytes(\n        this.session,\n        responsePath,\n        input.surface === \"browser\" ? 24 * 1024 * 1024 : COMPUTER_SCREENSHOT_MAX_BYTES,\n        timeoutMs,\n      );\n      return controllerImageFrame(data, headers, input);\n    } catch (error) {\n      if (\n        error instanceof BrowserControlRequestError ||\n        error instanceof BrowserControlProtocolError ||\n        error instanceof RangeError\n      ) {\n        throw error;\n      }\n      if (error instanceof BrowserControlTransportError) {\n        if (retryNativeEndpoint && this.nativeAuthority && this.session.ensureBrowserControl) {\n          nativeControllerPorts.delete(nativeControllerKey(this.nativeAuthority));\n          await this.controllerPort();\n          return await this.requestBytes(input, false);\n        }\n        throw error;\n      }\n      throw new BrowserControlTransportError(\"browser controller image transport failed\", {\n        cause: error,\n      });\n    } finally {\n      await runBestEffort(this.session, `rm -rf -- ${shellQuote(directory)}`);\n      await this.session.finalizeOpStreamOps?.().catch(() => undefined);\n    }\n  }\n\n  private async requestStream(\n    input: { method: string; path: string; token: string; body?: unknown; timeoutMs?: number },\n    maxBytes: number,\n  ): Promise<ReturnType<typeof parseControllerStreamResponse>> {\n    const port = await this.controllerPort();\n    const request = controllerStreamRequest({\n      method: input.method,\n      url: localControllerUrl(port, input.path),\n      token: requireToken(input.token, \"browser controller token\"),\n      ...(input.body === undefined ? {} : { body: JSON.stringify(input.body) }),\n      timeoutMs: boundedTimeout(input.timeoutMs ?? this.timeoutMs),\n      maxBytes,\n      host: this.session.controllerHostOs?.() ?? \"posix\",\n    });\n    try {\n      const result = await this.session.execWithInput!({\n        cmd: request.cmd,\n        stdin: request.stdin,\n        shell: request.shell,\n        login: false,\n        workdir: placementControllerWorkdir(this.session),\n      });\n      if (result.exitCode !== 0 || result.stdout === undefined) {\n        throw new BrowserControlTransportError(\"browser controller command failed\");\n      }\n      return parseControllerStreamResponse(result.stdout, request.marker, maxBytes);\n    } catch (error) {\n      if (error instanceof RangeError || error instanceof BrowserControlTransportError) throw error;\n      throw new BrowserControlTransportError(\"browser controller request transport failed\", {\n        cause: error,\n      });\n    }\n  }\n\n  private async controllerPort(): Promise<number> {\n    if (!this.nativeAuthority || !this.session.ensureBrowserControl) return this.port;\n    return await this.ensureControllerPort(false);\n  }\n\n  /** The agent-native transport: one in-process loopback request on the\n   * Connected Machine, addressed by authority scope, with no process started.\n   * Null when the placement does not serve it; the caller then keeps its\n   * command transport. A controller that is not running receives nothing, so\n   * it is ensured and the request sent once more whatever its method. */\n  private async requestNative(\n    input: { method: string; path: string; token: string; body?: unknown; timeoutMs?: number },\n    maxResponseBytes: number,\n    retry = true,\n  ): Promise<{ status: number; headers: Map<string, string>; body: Uint8Array } | null> {\n    const authority = this.nativeAuthority;\n    if (!authority || !this.session.browserControlHttp || !this.session.ensureBrowserControl) {\n      return null;\n    }\n    const method = input.method;\n    if (method !== \"GET\" && method !== \"POST\" && method !== \"PUT\" && method !== \"DELETE\") {\n      throw new BrowserControlProtocolError(\"browser controller request method is invalid\");\n    }\n    // Validates the path exactly as the command transport does.\n    localControllerUrl(this.port, input.path);\n    const body =\n      input.body === undefined ? undefined : new TextEncoder().encode(JSON.stringify(input.body));\n    if (body !== undefined && body.byteLength > BROWSER_CONTROL_MAX_JSON_BYTES) {\n      throw new RangeError(\"browser controller request body is too large\");\n    }\n    let outcome: BrowserControlHttpOutcome;\n    try {\n      outcome = await this.session.browserControlHttp({\n        scopeId: authority.scopeId,\n        scopeGeneration: authority.scopeGeneration,\n        method,\n        path: input.path,\n        bearerToken: requireToken(input.token, \"browser controller token\"),\n        ...(body === undefined ? {} : { body }),\n        timeoutMs: boundedTimeout(input.timeoutMs ?? this.timeoutMs),\n        maxResponseBytes,\n      });\n    } catch (error) {\n      if (retry && method === \"GET\") {\n        await this.ensureControllerPort(true);\n        return await this.requestNative(input, maxResponseBytes, false);\n      }\n      throw new BrowserControlTransportError(\"browser controller request transport failed\", {\n        cause: error,\n      });\n    }\n    if (outcome.kind === \"unsupported\") return null;\n    if (outcome.kind === \"controller_absent\") {\n      if (!retry) throw new BrowserControlTransportError(\"browser controller is not running\");\n      await this.ensureControllerPort(true);\n      return await this.requestNative(input, maxResponseBytes, false);\n    }\n    return outcome;\n  }\n\n  private async ensureControllerPort(replace: boolean): Promise<number> {\n    if (!this.nativeAuthority || !this.session.ensureBrowserControl) return this.port;\n    const key = nativeControllerKey(this.nativeAuthority);\n    if (replace) nativeControllerPorts.delete(key);\n    const cached = nativeControllerPorts.get(key);\n    if (cached !== undefined) return cached;\n    const ensured = await this.session.ensureBrowserControl({\n      scopeId: this.nativeAuthority.scopeId,\n      scopeGeneration: this.nativeAuthority.scopeGeneration,\n      adminToken: this.adminToken,\n      allowedOrigins: [],\n    });\n    const port = boundedPort(ensured.port);\n    nativeControllerPorts.set(key, port);\n    return port;\n  }\n}\n\nfunction nativeControllerKey(authority: { scopeId: string; scopeGeneration: string }): string {\n  return `${authority.scopeId}\\u0000${authority.scopeGeneration}`;\n}\n\nexport class BrowserControlSessionClient {\n  readonly reference: PlacementBrowserSessionReference;\n  private readonly parent: BrowserControlClient;\n  private readonly controlToken: string;\n  private readonly viewToken: string;\n\n  constructor(\n    parent: BrowserControlClient,\n    input: {\n      reference: PlacementBrowserSessionReference;\n      controlToken: string;\n      viewToken: string;\n    },\n  ) {\n    this.parent = parent;\n    this.reference = parseReference(input.reference);\n    this.controlToken = requireToken(input.controlToken, \"browser control token\");\n    this.viewToken = requireToken(input.viewToken, \"browser view token\");\n  }\n\n  async listTargets(): Promise<BrowserTargetValue[]> {\n    const data = await this.parent.requestForSession({\n      method: \"GET\",\n      path: this.path(\"targets\"),\n      token: this.viewToken,\n    });\n    if (!Array.isArray(data)) {\n      throw new BrowserControlProtocolError(\"browser controller returned malformed targets\");\n    }\n    return data.map((target) => BrowserTarget.parse(target));\n  }\n\n  async listDownloads(): Promise<BrowserDownloadListResponseValue> {\n    const data = await this.parent.requestForSession({\n      method: \"GET\",\n      path: this.path(\"downloads\"),\n      token: this.viewToken,\n    });\n    const response = BrowserDownloadListResponse.parse(data);\n    if (\n      response.browserSessionId !== this.reference.browserSessionId ||\n      response.controllerGeneration !== this.reference.controllerGeneration\n    ) {\n      throw new BrowserControlProtocolError(\n        \"browser controller returned downloads for another session binding\",\n      );\n    }\n    return response;\n  }\n\n  async download(downloadId: string): Promise<BrowserDownloadValue> {\n    const id = requireUuid(downloadId, \"download id\");\n    const data = await this.parent.requestForSession({\n      method: \"GET\",\n      path: this.path(`downloads/${id}`),\n      token: this.viewToken,\n    });\n    const download = BrowserDownload.parse(data);\n    if (\n      download.id !== id ||\n      download.browserSessionId !== this.reference.browserSessionId ||\n      download.controllerGeneration !== this.reference.controllerGeneration\n    ) {\n      throw new BrowserControlProtocolError(\"browser controller returned another download binding\");\n    }\n    return download;\n  }\n\n  async exportDownload(\n    downloadId: string,\n    requestInput: BrowserDownloadExportRequestValue,\n  ): Promise<BrowserDownloadExportReceiptValue> {\n    const id = requireUuid(downloadId, \"download id\");\n    const request = BrowserDownloadExportRequest.parse(requestInput);\n    if (request.downloadId !== id) {\n      throw new BrowserControlProtocolError(\"download export targets another resource\");\n    }\n    const receipt = BrowserDownloadExportReceipt.parse(\n      await this.parent.requestForSession({\n        method: \"POST\",\n        path: this.path(`downloads/${id}/exports`),\n        token: this.controlToken,\n        body: request,\n      }),\n    );\n    if (receipt.operationId !== request.operationId || receipt.downloadId !== id) {\n      throw new BrowserControlProtocolError(\"browser controller returned another export receipt\");\n    }\n    return receipt;\n  }\n\n  async openTarget(url?: string): Promise<BrowserObservationValue> {\n    return BrowserObservation.parse(\n      await this.parent.requestForSession({\n        method: \"POST\",\n        path: this.path(\"targets\"),\n        token: this.controlToken,\n        body: url === undefined ? {} : { url: boundedUrl(url) },\n      }),\n    );\n  }\n\n  async openTargetWithInventory(url?: string): Promise<BrowserTargetListResponseValue> {\n    let response: BrowserTargetListResponseValue;\n    try {\n      response = BrowserTargetListResponse.parse(\n        await this.parent.requestForSession({\n          method: \"POST\",\n          path: this.path(\"targets/open-with-inventory\"),\n          token: this.controlToken,\n          body: url === undefined ? {} : { url: boundedUrl(url) },\n        }),\n      );\n    } catch (error) {\n      // An older controller can refuse the new route before dispatch. Never\n      // fall back to another mutation after an uncertain open outcome.\n      if (\n        error instanceof BrowserControlRequestError &&\n        error.status === 404 &&\n        error.error.code === \"resource_not_found\" &&\n        error.error.message === \"route not found\"\n      ) {\n        throw browserControllerCompatibilityError(\"metadata-only tab opening\");\n      }\n      throw error;\n    }\n    if (\n      response.browserSessionId !== this.reference.browserSessionId ||\n      response.controllerGeneration !== this.reference.controllerGeneration ||\n      response.targets.some(\n        (target) =>\n          target.browserSessionId !== this.reference.browserSessionId ||\n          target.controllerGeneration !== this.reference.controllerGeneration,\n      )\n    ) {\n      throw new BrowserControlProtocolError(\n        \"browser controller returned inventory for another session binding\",\n      );\n    }\n    return response;\n  }\n\n  async selectTarget(targetId: string): Promise<BrowserObservationValue> {\n    return BrowserObservation.parse(\n      await this.parent.requestForSession({\n        method: \"POST\",\n        path: this.targetPath(targetId, \"select\"),\n        token: this.controlToken,\n        body: {},\n      }),\n    );\n  }\n\n  async closeTarget(targetId: string): Promise<BrowserTargetValue[]> {\n    const data = await this.parent.requestForSession({\n      method: \"DELETE\",\n      path: this.targetPath(targetId),\n      token: this.controlToken,\n    });\n    if (!Array.isArray(data)) {\n      throw new BrowserControlProtocolError(\"browser controller returned malformed targets\");\n    }\n    return data.map((target) => BrowserTarget.parse(target));\n  }\n\n  async observe(targetId: string): Promise<BrowserObservationValue> {\n    return BrowserObservation.parse(\n      await this.parent.requestForSession({\n        method: \"GET\",\n        path: this.targetPath(targetId, \"observation\"),\n        token: this.viewToken,\n      }),\n    );\n  }\n\n  async targetState(targetId: string): Promise<BrowserTargetStateValue> {\n    let state: BrowserTargetStateValue;\n    try {\n      state = BrowserTargetState.parse(\n        await this.parent.requestForSession({\n          method: \"GET\",\n          path: this.targetPath(targetId, \"state\"),\n          token: this.viewToken,\n        }),\n      );\n    } catch (error) {\n      // Active Connected Machines can run an older browserd during an API rollout.\n      // Only its exact unknown-route response permits the existing observation path.\n      // A missing session or target must keep its original error.\n      if (\n        !(error instanceof BrowserControlRequestError) ||\n        error.status !== 404 ||\n        error.error.code !== \"resource_not_found\" ||\n        error.error.message !== \"route not found\"\n      ) {\n        throw error;\n      }\n      const observation = await this.observe(targetId);\n      state = BrowserTargetState.parse({\n        browserSessionId: observation.browserSessionId,\n        controllerGeneration: observation.target.controllerGeneration,\n        targetId: observation.target.id,\n        targetGeneration: observation.target.targetGeneration,\n        documentGeneration: observation.target.documentGeneration,\n        frameId: observation.frameId,\n      });\n    }\n    if (\n      state.browserSessionId !== this.reference.browserSessionId ||\n      state.controllerGeneration !== this.reference.controllerGeneration ||\n      state.targetId !== targetId\n    ) {\n      throw new BrowserControlProtocolError(\"browser target state belongs to another binding\");\n    }\n    return state;\n  }\n\n  async readDom(\n    targetId: string,\n    requestInput: BrowserDomReadRequestValue,\n  ): Promise<BrowserDomReadResponseValue> {\n    const request = BrowserDomReadRequest.parse(requestInput);\n    let data: unknown;\n    try {\n      data = await this.parent.requestForSession({\n        method: \"POST\",\n        path: this.targetPath(targetId, \"dom-read\"),\n        token: this.viewToken,\n        body: request,\n      });\n    } catch (error) {\n      // Protocol v1 predates focused DOM reads. Distinguish that exact legacy\n      // route response from a missing target/session; neither is safe to retry.\n      if (\n        error instanceof BrowserControlRequestError &&\n        error.status === 404 &&\n        error.error.code === \"resource_not_found\" &&\n        error.error.message === \"route not found\"\n      ) {\n        throw browserControllerCompatibilityError(\"focused DOM reads\");\n      }\n      throw error;\n    }\n    const result = BrowserDomReadResponse.parse(data);\n    if (\n      result.browserSessionId !== this.reference.browserSessionId ||\n      result.controllerGeneration !== this.reference.controllerGeneration ||\n      result.targetId !== targetId ||\n      result.targetGeneration !== request.expectedTargetGeneration ||\n      result.documentGeneration !== request.expectedDocumentGeneration ||\n      result.frameId !== request.expectedFrameId ||\n      result.kind !== request.kind\n    ) {\n      throw new BrowserControlProtocolError(\"browser DOM read belongs to another binding\");\n    }\n    return result;\n  }\n\n  async capture(\n    targetId: string,\n    options: BrowserControlScreenshotOptions = {},\n  ): Promise<BrowserControlFrame> {\n    const query = new URLSearchParams({\n      format: options.format ?? \"jpeg\",\n      quality: String(boundedInteger(options.quality ?? 55, 1, 100, \"browser screenshot quality\")),\n    });\n    if (options.format !== undefined && options.format !== \"jpeg\" && options.format !== \"png\") {\n      throw new RangeError(\"browser screenshot format is invalid\");\n    }\n    if (options.fullPage !== undefined) {\n      if (typeof options.fullPage !== \"boolean\") {\n        throw new RangeError(\"browser screenshot fullPage is invalid\");\n      }\n      query.set(\"fullPage\", String(options.fullPage));\n    }\n    return await this.parent.requestBrowserBytesForSession({\n      method: \"GET\",\n      path: this.targetPath(targetId, `screenshot?${query}`),\n      token: this.viewToken,\n      expectedFrameEvidence: {\n        browserSessionId: this.reference.browserSessionId,\n        controllerGeneration: this.reference.controllerGeneration,\n        targetId: requireOpaqueId(targetId, \"browser target id\"),\n      },\n    });\n  }\n\n  async readClipboard(): Promise<BrowserClipboardValue> {\n    return BrowserClipboard.parse(\n      await this.parent.requestForSession({\n        method: \"GET\",\n        path: this.path(\"clipboard\"),\n        token: this.viewToken,\n      }),\n    );\n  }\n\n  async action(command: BrowserActionCommandValue): Promise<BrowserActionReceiptValue> {\n    const parsed = BrowserActionCommand.parse(command);\n    if (\n      parsed.browserSessionId !== this.reference.browserSessionId ||\n      parsed.controllerGeneration !== this.reference.controllerGeneration\n    ) {\n      throw new BrowserControlProtocolError(\"browser action targets another controller binding\");\n    }\n    let data: unknown;\n    try {\n      data = await this.parent.requestForSession({\n        method: \"POST\",\n        // Controllers that predate resolved targets ignore this parameter.\n        path: `${this.path(\"actions\")}?${BROWSER_ACTION_RECEIPT_TARGETS_PARAMETER}=1`,\n        token: this.controlToken,\n        body: parsed,\n      });\n    } catch (error) {\n      // This command already passed the release's schema. The controller's\n      // exact parser rejection proves a schema mismatch, not invalid tool use.\n      // Do not replay the action, restart the controller, or lose live tabs.\n      if (\n        error instanceof BrowserControlRequestError &&\n        error.status === 400 &&\n        error.error.code === \"invalid_action\" &&\n        error.error.message === \"browser action is invalid\"\n      ) {\n        throw browserControllerCompatibilityError(\"this browser action\");\n      }\n      throw error;\n    }\n    return BrowserActionReceipt.parse(data);\n  }\n\n  /** API-broker-only file authority path. Signed read URLs are materialized by\n   * browserd and never become part of the public action or durable receipt. */\n  async stageWorkspaceFiles(\n    request: BrowserWorkspaceFileStageRequestValue,\n  ): Promise<BrowserWorkspaceFileStageResponseValue> {\n    const parsed = BrowserWorkspaceFileStageRequest.parse(request);\n    return BrowserWorkspaceFileStageResponse.parse(\n      await this.parent.requestForSession({\n        method: \"POST\",\n        path: this.path(`operations/${parsed.operationId}/workspace-files`),\n        token: this.controlToken,\n        body: parsed,\n        timeoutMs: BROWSER_STATE_TRANSFER_TIMEOUT_MS,\n      }),\n    );\n  }\n\n  async receipt(operationId: string): Promise<BrowserActionReceiptValue> {\n    return BrowserActionReceipt.parse(\n      await this.parent.requestForSession({\n        method: \"GET\",\n        path: this.path(`operations/${requireUuid(operationId, \"operation id\")}`),\n        token: this.viewToken,\n      }),\n    );\n  }\n\n  /** Controller-private passkey exchange (design §10B.4): load the\n   * principal's passkeys into every authenticator and pull registration and\n   * assertion events. Controllers that predate it answer 404. */\n  async passkeySync(\n    request: BrowserPasskeySyncRequestValue,\n  ): Promise<BrowserPasskeySyncResponseValue> {\n    const parsed = BrowserPasskeySyncRequest.parse(request);\n    if (\n      parsed.browserSessionId !== this.reference.browserSessionId ||\n      parsed.controllerGeneration !== this.reference.controllerGeneration\n    ) {\n      throw new BrowserControlProtocolError(\"passkey sync targets another controller binding\");\n    }\n    return BrowserPasskeySyncResponse.parse(\n      await this.parent.requestForSession({\n        method: \"POST\",\n        path: this.path(\"passkeys/sync\"),\n        token: this.controlToken,\n        body: parsed,\n      }),\n    );\n  }\n\n  /** API-broker-only provider-auth path. The interactive URL response is\n   * deliberately not exposed by any model-facing SDK or Codemode facade. */\n  async externalAuth(\n    commandInput: BrowserExternalAuthCommandValue,\n  ): Promise<BrowserExternalAuthResultValue> {\n    const command = BrowserExternalAuthCommand.parse(commandInput);\n    if (\n      command.browserSessionId !== this.reference.browserSessionId ||\n      command.controllerGeneration !== this.reference.controllerGeneration\n    ) {\n      throw new BrowserControlProtocolError(\n        \"external authentication targets another browser controller binding\",\n      );\n    }\n    return BrowserExternalAuthResult.parse(\n      await this.parent.requestForSession({\n        method: \"POST\",\n        path: this.path(\"external-auth\"),\n        token: this.controlToken,\n        body: command,\n      }),\n    );\n  }\n\n  async diagnostics(\n    targetId: string,\n    options: {\n      kinds?: readonly BrowserDiagnosticKind[];\n      afterSequence?: number;\n      limit?: number;\n    } = {},\n  ): Promise<BrowserDiagnosticBatchValue> {\n    const query = new URLSearchParams();\n    if (options.kinds) query.set(\"kinds\", [...new Set(options.kinds)].join(\",\"));\n    if (options.afterSequence !== undefined) {\n      query.set(\n        \"after\",\n        nonnegativeSafeInteger(options.afterSequence, \"diagnostic cursor\").toString(),\n      );\n    }\n    if (options.limit !== undefined) {\n      const limit = positiveSafeInteger(options.limit, \"diagnostic limit\");\n      if (limit > 1_000) throw new RangeError(\"diagnostic limit is too large\");\n      query.set(\"limit\", limit.toString());\n    }\n    const suffix = query.size === 0 ? \"\" : `?${query.toString()}`;\n    return BrowserDiagnosticBatch.parse(\n      await this.parent.requestForSession({\n        method: \"GET\",\n        path: `${this.targetPath(targetId, \"diagnostics\")}${suffix}`,\n        token: this.viewToken,\n      }),\n    );\n  }\n\n  private path(suffix: string): string {\n    return `/v1/browser-sessions/${this.reference.browserSessionId}/${suffix}`;\n  }\n\n  private targetPath(targetId: string, suffix?: string): string {\n    const base = this.path(`targets/${encodeURIComponent(requireOpaqueId(targetId, \"target id\"))}`);\n    return suffix ? `${base}/${suffix}` : base;\n  }\n}\n\nexport class ComputerControlSessionClient {\n  readonly reference: PlacementComputerSessionReference;\n  private readonly parent: BrowserControlClient;\n  private readonly controlToken: string;\n  private readonly viewToken: string;\n\n  constructor(\n    parent: BrowserControlClient,\n    input: {\n      reference: PlacementComputerSessionReference;\n      controlToken: string;\n      viewToken: string;\n    },\n  ) {\n    this.parent = parent;\n    this.reference = parseComputerReference(input.reference);\n    this.controlToken = requireToken(input.controlToken, \"computer control token\");\n    this.viewToken = requireToken(input.viewToken, \"computer view token\");\n  }\n\n  async listTargets(): Promise<ComputerTargetValue[]> {\n    const data = await this.parent.requestForSession({\n      method: \"GET\",\n      path: this.path(\"targets\"),\n      token: this.viewToken,\n    });\n    if (!Array.isArray(data)) {\n      throw new BrowserControlProtocolError(\n        \"interaction controller returned malformed computer targets\",\n      );\n    }\n    return data.map((target) => ComputerTarget.parse(target));\n  }\n\n  async observe(targetId: string): Promise<ComputerObservationValue> {\n    return ComputerObservation.parse(\n      await this.parent.requestForSession({\n        method: \"GET\",\n        path: this.targetPath(targetId, \"observation\"),\n        token: this.viewToken,\n      }),\n    );\n  }\n\n  async capture(\n    targetId: string,\n    options: {\n      format?: \"jpeg\" | \"png\";\n      quality?: number;\n      maxWidth?: number;\n      maxHeight?: number;\n    } = {},\n  ): Promise<ComputerControlFrame> {\n    const query = new URLSearchParams();\n    if (options.format !== undefined) query.set(\"format\", options.format);\n    if (options.quality !== undefined) query.set(\"quality\", String(options.quality));\n    if (options.maxWidth !== undefined) query.set(\"maxWidth\", String(options.maxWidth));\n    if (options.maxHeight !== undefined) query.set(\"maxHeight\", String(options.maxHeight));\n    const suffix = query.size > 0 ? `screenshot?${query}` : \"screenshot\";\n    return await this.parent.requestBytesForSession({\n      method: \"GET\",\n      path: this.targetPath(targetId, suffix),\n      token: this.viewToken,\n      expectedFrameEvidence: {\n        computerSessionId: this.reference.computerSessionId,\n        controllerGeneration: this.reference.controllerGeneration,\n        targetId: requireOpaqueId(targetId, \"computer target id\"),\n      },\n    });\n  }\n\n  async readClipboard(): Promise<ComputerClipboardValue> {\n    return ComputerClipboard.parse(\n      await this.parent.requestForSession({\n        method: \"GET\",\n        path: this.path(\"clipboard\"),\n        token: this.viewToken,\n      }),\n    );\n  }\n\n  async nativeCall(command: ComputerNativeCommand): Promise<ComputerNativeReceipt> {\n    const parsed = ComputerNativeCommand.parse(command);\n    if (\n      parsed.computerSessionId !== this.reference.computerSessionId ||\n      parsed.controllerGeneration !== this.reference.controllerGeneration\n    )\n      throw new BrowserControlProtocolError(\"native call targets another controller binding\");\n    return ComputerNativeReceipt.parse(\n      await this.parent.requestForSession({\n        method: \"POST\",\n        path: this.path(\"native-calls\"),\n        token: this.controlToken,\n        body: parsed,\n      }),\n    );\n  }\n\n  async action(command: ComputerActionCommandValue): Promise<ComputerActionReceiptValue> {\n    const parsed = ComputerActionCommand.parse(command);\n    if (\n      parsed.computerSessionId !== this.reference.computerSessionId ||\n      parsed.controllerGeneration !== this.reference.controllerGeneration\n    ) {\n      throw new BrowserControlProtocolError(\"computer action targets another controller binding\");\n    }\n    return ComputerActionReceipt.parse(\n      await this.parent.requestForSession({\n        method: \"POST\",\n        path: this.path(\"actions\"),\n        token: this.controlToken,\n        body: parsed,\n      }),\n    );\n  }\n\n  async receipt(operationId: string): Promise<ComputerOperationReceipt> {\n    return ComputerOperationReceipt.parse(\n      await this.parent.requestForSession({\n        method: \"GET\",\n        path: this.path(`operations/${requireUuid(operationId, \"operation id\")}`),\n        token: this.viewToken,\n      }),\n    );\n  }\n\n  async heartbeat(): Promise<void> {\n    const data = await this.parent.requestForSession({\n      method: \"POST\",\n      path: this.path(\"heartbeat\"),\n      token: this.controlToken,\n      body: {},\n    });\n    if (!isRecord(data) || data.alive !== true) {\n      throw new BrowserControlProtocolError(\n        \"interaction controller returned malformed computer heartbeat\",\n      );\n    }\n  }\n\n  private path(suffix: string): string {\n    return `/v1/computer-sessions/${this.reference.computerSessionId}/${suffix}`;\n  }\n\n  private targetPath(targetId: string, suffix?: string): string {\n    const base = this.path(\n      `targets/${encodeURIComponent(requireOpaqueId(targetId, \"computer target id\"))}`,\n    );\n    return suffix ? `${base}/${suffix}` : base;\n  }\n}\n\nfunction curlConfig(input: {\n  method: string;\n  url: string;\n  token: string;\n  responsePath: string;\n  responseHeadersPath?: string;\n  requestPath?: string;\n  timeoutMs: number;\n}): string {\n  const seconds = Math.max(1, Math.ceil(input.timeoutMs / 1_000));\n  return [\n    \"silent\",\n    \"show-error\",\n    `noproxy = ${curlConfigQuote(\"*\")}`,\n    `connect-timeout = ${Math.min(seconds, 15)}`,\n    `max-time = ${seconds}`,\n    `request = ${curlConfigQuote(input.method)}`,\n    `url = ${curlConfigQuote(input.url)}`,\n    `header = ${curlConfigQuote(`Authorization: Bearer ${input.token}`)}`,\n    ...(input.requestPath\n      ? [\n          `header = ${curlConfigQuote(\"Content-Type: application/json\")}`,\n          `data-binary = ${curlConfigQuote(`@${input.requestPath}`)}`,\n        ]\n      : []),\n    `output = ${curlConfigQuote(input.responsePath)}`,\n    ...(input.responseHeadersPath\n      ? [`dump-header = ${curlConfigQuote(input.responseHeadersPath)}`]\n      : []),\n    `write-out = ${curlConfigQuote(\"%{http_code}\")}`,\n    \"\",\n  ].join(\"\\n\");\n}\n\nfunction joinControllerPath(endpointPath: string | undefined, requestPath: string): string {\n  try {\n    return joinExposedPortPath(endpointPath, requestPath);\n  } catch (error) {\n    if (error instanceof StreamPortUnavailableError) {\n      throw new BrowserControlProtocolError(error.message);\n    }\n    throw error;\n  }\n}\n\nfunction exposedPortHeaders(endpoint: ExposedPortEndpoint): Record<string, string> {\n  const raw = endpoint.headers;\n  if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return {};\n  const headers: Record<string, string> = {};\n  for (const [key, value] of Object.entries(raw as Record<string, unknown>)) {\n    if (typeof key !== \"string\" || typeof value !== \"string\") continue;\n    if (key.toLowerCase() === \"authorization\") continue;\n    headers[key] = value;\n  }\n  return headers;\n}\n\nasync function requestExposedController(\n  endpoint: ExposedPortEndpoint,\n  input: {\n    method: \"GET\" | \"POST\" | \"PUT\" | \"DELETE\";\n    path: string;\n    token: string;\n    body?: unknown;\n    timeoutMs?: number;\n  },\n  defaultTimeoutMs: number,\n  metrics?: {\n    onOpenSandboxSignedEndpoint?: (input: {\n      outcome: \"minted\" | \"mint_failed\" | \"host_fetch_unauthorized\";\n      port: number;\n    }) => void;\n  },\n): Promise<unknown> {\n  const token = requireToken(input.token, \"browser controller token\");\n  const timeoutMs = boundedTimeout(input.timeoutMs ?? defaultTimeoutMs);\n  const streamUrl = exposedControllerUrl(endpoint, input.path);\n  streamUrl.protocol = streamUrl.protocol === \"wss:\" ? \"https:\" : \"http:\";\n  const body = input.body === undefined ? undefined : JSON.stringify(input.body);\n  if (body !== undefined && Buffer.byteLength(body) > BROWSER_CONTROL_MAX_JSON_BYTES) {\n    throw new RangeError(\"browser controller request body is too large\");\n  }\n  const response = await controllerTransport(\n    async () =>\n      await fetch(streamUrl, {\n        method: input.method,\n        headers: {\n          ...exposedPortHeaders(endpoint),\n          authorization: `Bearer ${token}`,\n          ...(body === undefined ? {} : { \"content-type\": \"application/json\" }),\n        },\n        ...(body === undefined ? {} : { body }),\n        redirect: \"manual\",\n        signal: AbortSignal.timeout(timeoutMs),\n      }),\n  );\n  const responseText = await controllerTransport(async () => await response.text());\n  if (Buffer.byteLength(responseText) > BROWSER_CONTROL_MAX_JSON_BYTES) {\n    throw new BrowserControlProtocolError(\"browser controller response is too large\");\n  }\n  rejectProviderGatewayResponse(responseText, response.status);\n  if (\n    (response.status === 401 || response.status === 403) &&\n    !looksLikeBrowserControlEnvelope(responseText)\n  ) {\n    const signed = parseOpenSandboxSignedUriPath(endpoint.path ?? \"\");\n    if (signed) {\n      try {\n        metrics?.onOpenSandboxSignedEndpoint?.({\n          outcome: \"host_fetch_unauthorized\",\n          port: signed.port,\n        });\n      } catch {\n        /* metrics must not affect Channel B */\n      }\n    }\n    throw new BrowserControlTransportError(`browser controller returned HTTP ${response.status}`);\n  }\n  return parseEnvelope(responseText, response.status);\n}\n\nasync function requestExposedControllerBytes(\n  endpoint: ExposedPortEndpoint,\n  input: FrameRequest,\n  defaultTimeoutMs: number,\n): Promise<ComputerControlFrame | BrowserControlFrame> {\n  const token = requireToken(input.token, \"browser controller token\");\n  const timeoutMs = boundedTimeout(input.timeoutMs ?? defaultTimeoutMs);\n  const streamUrl = exposedControllerUrl(endpoint, input.path);\n  streamUrl.protocol = streamUrl.protocol === \"wss:\" ? \"https:\" : \"http:\";\n  const response = await controllerTransport(\n    async () =>\n      await fetch(streamUrl, {\n        method: input.method,\n        headers: {\n          ...exposedPortHeaders(endpoint),\n          authorization: `Bearer ${token}`,\n          accept: \"image/jpeg, image/png\",\n        },\n        redirect: \"manual\",\n        signal: AbortSignal.timeout(timeoutMs),\n      }),\n  );\n  if (!response.ok) {\n    const responseText = await controllerTransport(async () => await response.text());\n    if (Buffer.byteLength(responseText) > BROWSER_CONTROL_MAX_JSON_BYTES) {\n      throw new BrowserControlProtocolError(\"browser controller response is too large\");\n    }\n    rejectProviderGatewayResponse(responseText, response.status);\n    parseEnvelope(responseText, response.status);\n    throw new BrowserControlProtocolError(\"browser controller image response is invalid\");\n  }\n  const declaredLength = Number(response.headers.get(\"content-length\"));\n  const maxBytes = input.surface === \"browser\" ? 24 * 1024 * 1024 : COMPUTER_SCREENSHOT_MAX_BYTES;\n  if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {\n    await response.body?.cancel(\"frame exceeds its byte bound\").catch(() => undefined);\n    throw new RangeError(\"frame exceeds its byte bound\");\n  }\n  const data = await controllerTransport(\n    async () => await readBoundedFrameResponse(response, maxBytes),\n  );\n  return controllerImageFrame(data, response.headers, input);\n}\n\nasync function controllerTransport<T>(readOrDispatch: () => Promise<T>): Promise<T> {\n  try {\n    return await readOrDispatch();\n  } catch (error) {\n    if (\n      error instanceof BrowserControlProtocolError ||\n      error instanceof BrowserControlTransportError ||\n      error instanceof RangeError\n    ) {\n      throw error;\n    }\n    // Fetch or response-body failure cannot prove the controller did not\n    // execute a mutation. Keep it typed so endpoint discovery's in-box fallback\n    // cannot replay an already-dispatched request.\n    throw new BrowserControlTransportError(\"browser controller host-fetch failed\", {\n      cause: error,\n    });\n  }\n}\n\nasync function readBoundedFrameResponse(response: Response, maxBytes: number): Promise<Uint8Array> {\n  if (!response.body) throw new BrowserControlProtocolError(\"browser controller image is empty\");\n  const reader = response.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let size = 0;\n  try {\n    for (;;) {\n      const { done, value } = await reader.read();\n      if (done) break;\n      size += value.byteLength;\n      if (size > maxBytes) {\n        await reader.cancel(\"frame exceeds its byte bound\").catch(() => undefined);\n        throw new RangeError(\"frame exceeds its byte bound\");\n      }\n      chunks.push(value);\n    }\n  } finally {\n    reader.releaseLock();\n  }\n  const data = new Uint8Array(size);\n  let offset = 0;\n  for (const chunk of chunks) {\n    data.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return data;\n}\n\nfunction controllerImageFrame(\n  data: Uint8Array,\n  headers: { get(name: string): string | null | undefined },\n  input: FrameRequest,\n): ComputerControlFrame | BrowserControlFrame {\n  return input.surface === \"browser\"\n    ? browserControlFrame(data, headers, input.expectedFrameEvidence)\n    : computerControlFrame(data, headers, input.expectedFrameEvidence);\n}\n\nfunction browserControlFrame(\n  data: Uint8Array,\n  headers: { get(name: string): string | null | undefined },\n  expected: ExpectedBrowserFrameEvidence,\n): BrowserControlFrame {\n  if (data.byteLength < 1 || data.byteLength > 24 * 1024 * 1024) {\n    throw new RangeError(\"browser frame exceeds its byte bound\");\n  }\n  const get = (name: string): string | null => headers.get(name.toLowerCase()) ?? null;\n  const mediaType = get(\"content-type\")?.split(\";\", 1)[0]?.trim().toLowerCase();\n  if (mediaType !== \"image/jpeg\" && mediaType !== \"image/png\") {\n    throw new BrowserControlProtocolError(\"browser frame media type is invalid\");\n  }\n  const metadataHeader = get(\"x-opengeni-browser-frame\");\n  if (\n    !metadataHeader ||\n    metadataHeader.length > 64 * 1024 ||\n    !/^[A-Za-z0-9_-]+$/u.test(metadataHeader)\n  ) {\n    throw new BrowserControlProtocolError(\"browser frame metadata is invalid\");\n  }\n  let metadata: BrowserFrameMetadata;\n  try {\n    metadata = parseBrowserFrameMetadata(\n      JSON.parse(Buffer.from(metadataHeader, \"base64url\").toString(\"utf8\")),\n    );\n  } catch {\n    throw new BrowserControlProtocolError(\"browser frame metadata is invalid\");\n  }\n  if (\n    metadata.browserSessionId !== expected.browserSessionId ||\n    metadata.controllerGeneration !== expected.controllerGeneration ||\n    metadata.targetId !== expected.targetId ||\n    metadata.mediaType !== mediaType\n  ) {\n    throw new BrowserControlProtocolError(\"browser frame evidence does not match its request\");\n  }\n  return { data, mediaType, metadataHeader, metadata };\n}\n\nfunction computerControlFrame(\n  data: Uint8Array,\n  headers: { get(name: string): string | null | undefined },\n  expected: ExpectedComputerFrameEvidence,\n): ComputerControlFrame {\n  if (data.byteLength < 1 || data.byteLength > COMPUTER_SCREENSHOT_MAX_BYTES) {\n    throw new RangeError(\"computer frame exceeds its byte bound\");\n  }\n  const get = (name: string): string | null => headers.get(name.toLowerCase()) ?? null;\n  const mediaType = get(\"content-type\")?.split(\";\", 1)[0]?.trim().toLowerCase();\n  if (mediaType !== \"image/jpeg\" && mediaType !== \"image/png\") {\n    throw new BrowserControlProtocolError(\"computer frame media type is invalid\");\n  }\n  const metadataHeader = get(\"x-opengeni-computer-frame\");\n  if (\n    !metadataHeader ||\n    metadataHeader.length > 32 * 1024 ||\n    !/^[A-Za-z0-9_-]+$/u.test(metadataHeader)\n  ) {\n    throw new BrowserControlProtocolError(\"computer frame metadata is invalid\");\n  }\n  return validateComputerControlFrameEvidence({ data, mediaType, metadataHeader }, expected);\n}\n\nexport function validateComputerControlFrameEvidence(\n  frame: Pick<ComputerControlFrame, \"data\" | \"mediaType\" | \"metadataHeader\">,\n  expected: ExpectedComputerFrameEvidence,\n): ComputerControlFrame {\n  const metadata = decodeComputerControlFrameMetadataHeader(frame.metadataHeader);\n  if (metadata.computerSessionId !== expected.computerSessionId) {\n    throw new ComputerFrameEvidenceMismatchError(\"frame_session_mismatch\");\n  }\n  if (metadata.targetId !== expected.targetId) {\n    throw new ComputerFrameEvidenceMismatchError(\"frame_target_mismatch\");\n  }\n  if (metadata.controllerGeneration !== expected.controllerGeneration) {\n    throw new ComputerFrameEvidenceMismatchError(\"frame_controller_mismatch\");\n  }\n  if (metadata.mediaType !== frame.mediaType) {\n    throw new ComputerFrameEvidenceMismatchError(\"frame_media_mismatch\");\n  }\n  const digest = createHash(\"sha256\").update(frame.data).digest(\"hex\");\n  if (metadata.sha256 !== digest) {\n    throw new ComputerFrameEvidenceMismatchError(\"frame_digest_mismatch\");\n  }\n  return { ...frame, metadata };\n}\n\nexport function decodeComputerControlFrameMetadataHeader(\n  value: string,\n): ComputerControlFrameMetadata {\n  if (!value || value.length > 32 * 1024 || !/^[A-Za-z0-9_-]+$/u.test(value)) {\n    throw new BrowserControlProtocolError(\"computer frame metadata is invalid\");\n  }\n  let decoded: unknown;\n  try {\n    decoded = JSON.parse(Buffer.from(value, \"base64url\").toString(\"utf8\"));\n  } catch {\n    throw new BrowserControlProtocolError(\"computer frame metadata is invalid\");\n  }\n  if (!isRecord(decoded)) {\n    throw new BrowserControlProtocolError(\"computer frame metadata is invalid\");\n  }\n  const allowed = new Set([\n    \"frameId\",\n    \"computerSessionId\",\n    \"controllerGeneration\",\n    \"targetId\",\n    \"targetGeneration\",\n    \"sequence\",\n    \"mediaType\",\n    \"width\",\n    \"height\",\n    \"capturedAt\",\n    \"sha256\",\n  ]);\n  if (Object.keys(decoded).some((key) => !allowed.has(key))) {\n    throw new BrowserControlProtocolError(\"computer frame metadata is invalid\");\n  }\n  for (const key of [\n    \"frameId\",\n    \"computerSessionId\",\n    \"controllerGeneration\",\n    \"targetId\",\n    \"targetGeneration\",\n    \"mediaType\",\n    \"capturedAt\",\n  ] as const) {\n    const item = decoded[key];\n    const maxBytes = key === \"targetId\" ? 512 : key === \"capturedAt\" ? 128 : 256;\n    if (typeof item !== \"string\" || item.length < 1 || Buffer.byteLength(item) > maxBytes) {\n      throw new BrowserControlProtocolError(\"computer frame metadata is invalid\");\n    }\n  }\n  if (typeof decoded.sha256 !== \"string\" || !SHA256_PATTERN.test(decoded.sha256)) {\n    throw new ComputerFrameEvidenceMismatchError(\"frame_digest_mismatch\");\n  }\n  if (\n    !Number.isSafeInteger(decoded.sequence) ||\n    Number(decoded.sequence) < 0 ||\n    !boundedComputerFrameDimension(decoded.width, decoded.height)\n  ) {\n    throw new BrowserControlProtocolError(\"computer frame metadata is invalid\");\n  }\n  if (decoded.mediaType !== \"image/jpeg\" && decoded.mediaType !== \"image/png\") {\n    throw new BrowserControlProtocolError(\"computer frame metadata is invalid\");\n  }\n  if (!isUuidString(decoded.computerSessionId)) {\n    throw new BrowserControlProtocolError(\"computer frame metadata is invalid\");\n  }\n  const controllerGeneration = decoded.controllerGeneration;\n  if (\n    typeof controllerGeneration !== \"string\" ||\n    !/^[A-Za-z0-9][A-Za-z0-9._:-]*$/u.test(controllerGeneration)\n  ) {\n    throw new BrowserControlProtocolError(\"computer frame metadata is invalid\");\n  }\n  const capturedAt = decoded.capturedAt;\n  if (typeof capturedAt !== \"string\" || !Number.isFinite(new Date(capturedAt).valueOf())) {\n    throw new BrowserControlProtocolError(\"computer frame metadata is invalid\");\n  }\n  return decoded as ComputerControlFrameMetadata;\n}\n\nfunction boundedComputerFrameDimension(width: unknown, height: unknown): boolean {\n  return (\n    Number.isSafeInteger(width) &&\n    Number.isSafeInteger(height) &&\n    Number(width) > 0 &&\n    Number(height) > 0 &&\n    Number(width) <= 32_768 &&\n    Number(height) <= 32_768 &&\n    Number(width) * Number(height) <= 100_000_000\n  );\n}\n\nfunction isUuidString(value: unknown): value is string {\n  return (\n    typeof value === \"string\" &&\n    /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(value)\n  );\n}\n\nfunction exposedControllerUrl(endpoint: ExposedPortEndpoint, requestPath: string): URL {\n  const separator = requestPath.indexOf(\"?\");\n  const path = separator === -1 ? requestPath : requestPath.slice(0, separator);\n  const requestQuery = separator === -1 ? \"\" : requestPath.slice(separator + 1);\n  const url = new URL(\n    buildStreamUrl({ ...endpoint, path: joinControllerPath(endpoint.path, path) }),\n  );\n  for (const [name, value] of new URLSearchParams(requestQuery)) {\n    url.searchParams.append(name, value);\n  }\n  return url;\n}\n\nfunction parseCurlResponseHeaders(value: string): Map<string, string> {\n  const headers = new Map<string, string>();\n  for (const line of value.split(/\\r?\\n/u)) {\n    if (/^HTTP\\//u.test(line)) {\n      headers.clear();\n      continue;\n    }\n    const separator = line.indexOf(\":\");\n    if (separator <= 0) continue;\n    const name = line.slice(0, separator).trim().toLowerCase();\n    const headerValue = line.slice(separator + 1).trim();\n    if (name && headerValue) headers.set(name, headerValue);\n  }\n  return headers;\n}\n\nfunction looksLikeBrowserControlEnvelope(body: string): boolean {\n  try {\n    const value: unknown = JSON.parse(body);\n    return isRecord(value) && value.protocolVersion === BROWSER_CONTROL_PROTOCOL_VERSION;\n  } catch {\n    return false;\n  }\n}\n\nfunction rejectProviderGatewayResponse(body: string, status: number): void {\n  // A tunnel's transient upstream failure is not a browserd protocol response.\n  // Preserve browserd envelopes, including their semantic retry policy. This\n  // transport classification cannot prove that a mutation was not dispatched.\n  if ([502, 503, 504].includes(status) && !looksLikeBrowserControlEnvelope(body)) {\n    throw new BrowserControlTransportError(`browser controller returned HTTP ${status}`);\n  }\n}\n\nfunction parseEnvelope(body: string, status: number): unknown {\n  let value: unknown;\n  try {\n    value = JSON.parse(body);\n  } catch {\n    throw new BrowserControlProtocolError(\"browser controller response is invalid JSON\");\n  }\n  if (!isRecord(value) || value.protocolVersion !== BROWSER_CONTROL_PROTOCOL_VERSION) {\n    throw new BrowserControlProtocolError(\"browser controller protocol version is invalid\");\n  }\n  if (value.ok === true && status >= 200 && status < 300 && \"data\" in value) return value.data;\n  if (value.ok === false && status >= 400 && status <= 599) {\n    const parsed = InteractionError.safeParse(value.error);\n    if (parsed.success) throw new BrowserControlRequestError(status, parsed.data);\n  }\n  throw new BrowserControlProtocolError(\"browser controller response envelope is invalid\");\n}\n\nfunction localControllerUrl(port: number, path: string): string {\n  if (!path.startsWith(\"/\") || path.includes(\"\\0\") || path.includes(\"#\")) {\n    throw new BrowserControlProtocolError(\"browser controller request path is invalid\");\n  }\n  return `http://127.0.0.1:${port}${path}`;\n}\n\nfunction parseReference(value: unknown): PlacementBrowserSessionReference {\n  if (!isRecord(value)) throw new BrowserControlProtocolError(\"browser session binding is invalid\");\n  return {\n    browserSessionId: requireUuid(value.browserSessionId, \"browser session id\"),\n    controllerGeneration: requireGeneration(value.controllerGeneration),\n  };\n}\n\n/** A create's tab inventory is a convenience: an older controller omits it,\n * and an inventory that does not validate, or that belongs to another\n * binding, is dropped rather than failing a browser that did launch. */\nfunction creationTargets(\n  value: unknown,\n  reference: PlacementBrowserSessionReference,\n): { targets?: BrowserTargetValue[] } {\n  if (!Array.isArray(value) || value.length > 10_000) return {};\n  const targets: BrowserTargetValue[] = [];\n  for (const entry of value) {\n    const parsed = BrowserTarget.safeParse(entry);\n    if (\n      !parsed.success ||\n      parsed.data.browserSessionId !== reference.browserSessionId ||\n      parsed.data.controllerGeneration !== reference.controllerGeneration\n    )\n      return {};\n    targets.push(parsed.data);\n  }\n  return { targets };\n}\n\nfunction parseComputerReference(value: unknown): PlacementComputerSessionReference {\n  if (!isRecord(value)) {\n    throw new BrowserControlProtocolError(\"computer session binding is invalid\");\n  }\n  return {\n    computerSessionId: requireUuid(value.computerSessionId, \"computer session id\"),\n    controllerGeneration: requireGeneration(value.controllerGeneration),\n  };\n}\n\nfunction placementBrowserTransport(input: PlacementBrowserTransport): PlacementBrowserTransport {\n  if (input.kind === \"managed\") {\n    if (\n      input.engine !== undefined &&\n      input.engine !== \"chromium\" &&\n      input.engine !== \"lightpanda\"\n    ) {\n      throw new BrowserControlProtocolError(\"managed browser engine is invalid\");\n    }\n    if (input.ephemeralPartition !== undefined && !SHA256_PATTERN.test(input.ephemeralPartition))\n      throw new Error(\"ephemeral browser partition is invalid\");\n    return {\n      kind: \"managed\",\n      engine: input.engine ?? \"chromium\",\n      ...(input.ephemeralPartition ? { ephemeralPartition: input.ephemeralPartition } : {}),\n    };\n  }\n  if (input.kind === \"external_provider\") {\n    if (input.providerId !== \"browserbase\" && input.providerId !== \"kernel\") {\n      throw new BrowserControlProtocolError(\"external browser provider is unsupported\");\n    }\n    const endpoint = input.authority.endpoint\n      ? boundedHttpUrl(input.authority.endpoint, \"external browser provider endpoint\")\n      : undefined;\n    return {\n      kind: \"external_provider\",\n      providerId: input.providerId,\n      placementId: requireOpaqueId(input.placementId, \"external browser placement id\"),\n      authority: {\n        apiKey: requireBoundedText(\n          input.authority.apiKey,\n          1,\n          8_192,\n          \"external browser provider credential\",\n        ),\n        ...(endpoint ? { endpoint } : {}),\n      },\n      ...(input.timeoutSeconds === undefined\n        ? {}\n        : {\n            timeoutSeconds: boundedExternalBrowserTimeout(input.timeoutSeconds),\n          }),\n      ...(input.stealth === undefined ? {} : { stealth: input.stealth }),\n    };\n  }\n  return {\n    kind: \"attached_chrome\",\n    deviceId: requireUuid(input.deviceId, \"attached browser id\"),\n    connectionGeneration: requireBridgeGeneration(input.connectionGeneration),\n    browserName: requireBoundedText(input.browserName, 1, 100, \"attached browser name\"),\n    browserVersion: requireBoundedText(input.browserVersion, 1, 256, \"attached browser version\"),\n  };\n}\n\nfunction boundedExternalBrowserTimeout(value: number): number {\n  const timeout = positiveSafeInteger(value, \"external browser timeout\");\n  if (timeout > 86_400) {\n    throw new BrowserControlProtocolError(\"external browser timeout is invalid\");\n  }\n  return timeout;\n}\n\nfunction boundedHttpUrl(value: string, label: string): string {\n  if (Buffer.byteLength(value) > 16_384) {\n    throw new BrowserControlProtocolError(`${label} is invalid`);\n  }\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    throw new BrowserControlProtocolError(`${label} is invalid`);\n  }\n  if (\n    (parsed.protocol !== \"https:\" && parsed.protocol !== \"http:\") ||\n    parsed.username ||\n    parsed.password ||\n    parsed.hash\n  ) {\n    throw new BrowserControlProtocolError(`${label} is invalid`);\n  }\n  return parsed.toString().replace(/\\/$/u, \"\");\n}\n\nfunction placementBrowserNetworkRoute(\n  input: PlacementBrowserNetworkRoute,\n): PlacementBrowserNetworkRoute {\n  const kind = input.kind;\n  if (kind !== \"direct\" && kind !== \"proxy\" && kind !== \"managed\" && kind !== \"tunnel\") {\n    throw new BrowserControlProtocolError(\"browser network route kind is invalid\");\n  }\n  if (!/^[A-Za-z0-9._~-]{16,256}$/u.test(input.authorityDigest)) {\n    throw new BrowserControlProtocolError(\"browser network route authority is invalid\");\n  }\n  const proxyUrl = input.proxyUrl === undefined ? undefined : boundedProxyUrl(input.proxyUrl);\n  if (kind !== \"proxy\" && proxyUrl !== undefined) {\n    throw new BrowserControlProtocolError(\"non-proxy browser route contains proxy authority\");\n  }\n  const providerRoute =\n    input.providerRoute === undefined ? undefined : placementProviderRoute(input.providerRoute);\n  if (kind !== \"managed\" && providerRoute !== undefined) {\n    throw new BrowserControlProtocolError(\n      \"non-managed browser route contains provider route material\",\n    );\n  }\n  if (kind === \"managed\" && providerRoute === undefined) {\n    throw new BrowserControlProtocolError(\"managed browser route omits provider route material\");\n  }\n  return {\n    routeId: requireUuid(input.routeId, \"network route id\"),\n    routeVersion: positiveSafeInteger(input.routeVersion, \"network route version\"),\n    authorityDigest: input.authorityDigest,\n    kind,\n    consistency: NetworkRouteConsistency.parse(input.consistency),\n    ...(proxyUrl === undefined ? {} : { proxyUrl }),\n    ...(providerRoute === undefined ? {} : { providerRoute }),\n  };\n}\n\nfunction placementProviderRoute(\n  input: NonNullable<PlacementBrowserNetworkRoute[\"providerRoute\"]>,\n): NonNullable<PlacementBrowserNetworkRoute[\"providerRoute\"]> {\n  if (input.providerId !== \"browserbase\" && input.providerId !== \"kernel\") {\n    throw new BrowserControlProtocolError(\"managed browser route provider is unsupported\");\n  }\n  if (\n    input.egressClass !== \"datacenter\" &&\n    input.egressClass !== \"residential\" &&\n    input.egressClass !== \"isp\"\n  ) {\n    throw new BrowserControlProtocolError(\"managed browser route egress class is invalid\");\n  }\n  return {\n    providerId: input.providerId,\n    routeId: requireOpaqueId(input.routeId, \"managed browser provider route id\"),\n    egressClass: input.egressClass,\n    region:\n      input.region === null\n        ? null\n        : requireBoundedText(input.region, 1, 128, \"managed browser route region\"),\n  };\n}\n\nfunction boundedProxyUrl(value: string): string {\n  if (Buffer.byteLength(value) > 16_384) {\n    throw new BrowserControlProtocolError(\"browser proxy authority is too large\");\n  }\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new BrowserControlProtocolError(\"browser proxy authority is invalid\");\n  }\n  if (\n    ![\"http:\", \"https:\", \"socks5:\"].includes(url.protocol) ||\n    !url.hostname ||\n    (!url.port && url.protocol !== \"http:\" && url.protocol !== \"https:\") ||\n    (url.pathname !== \"\" && url.pathname !== \"/\") ||\n    url.search ||\n    url.hash\n  ) {\n    throw new BrowserControlProtocolError(\"browser proxy authority is invalid\");\n  }\n  return url.toString();\n}\n\nfunction workingCopyAuthorityBody(\n  reference: PlacementBrowserSessionReference,\n  input: PlacementBrowserWorkingCopyAuthority,\n) {\n  return {\n    controllerGeneration: reference.controllerGeneration,\n    tokenGeneration: positiveSafeInteger(input.tokenGeneration, \"token generation\"),\n    controlToken: requireToken(input.controlToken, \"control token\"),\n    viewToken: requireToken(input.viewToken, \"view token\"),\n  };\n}\n\n/**\n * An adoption record. `generation: \"current\"` (a new adoption) requires the\n * record to belong to the requesting controller generation. `\"recorded\"`\n * (status, revert, inspection) keeps the generation the adoption was recorded\n * under: recovering an unfinished adoption after a controller restart means\n * reading and reverting a record made by an earlier generation, under the\n * browser's legitimate current control. The browser and operation always\n * have to match exactly.\n */\nfunction parseWorkingCopyAdoption(\n  value: unknown,\n  reference: PlacementBrowserSessionReference,\n  generation: \"current\" | \"recorded\",\n): PlacementBrowserWorkingCopyAdoption {\n  if (\n    !isRecord(value) ||\n    value.browserSessionId !== reference.browserSessionId ||\n    (generation === \"current\" && value.controllerGeneration !== reference.controllerGeneration) ||\n    !BROWSER_WORKING_COPY_ADOPTION_PHASES.includes(\n      value.phase as PlacementBrowserWorkingCopyAdoptionPhase,\n    ) ||\n    !(value.failureCode === null || typeof value.failureCode === \"string\") ||\n    !Array.isArray(value.retainedDirectories) ||\n    value.retainedDirectories.length > 64 ||\n    !value.retainedDirectories.every(\n      (name) => typeof name === \"string\" && /^[A-Za-z0-9][A-Za-z0-9._-]{0,255}$/u.test(name),\n    )\n  ) {\n    throw new BrowserControlProtocolError(\"browser controller returned a malformed adoption\");\n  }\n  return {\n    browserSessionId: reference.browserSessionId,\n    controllerGeneration:\n      generation === \"current\"\n        ? reference.controllerGeneration\n        : requireGeneration(value.controllerGeneration),\n    operationId: requireUuid(value.operationId, \"working copy adoption id\"),\n    manifestDigest: sha256(value.manifestDigest, \"working copy manifest digest\"),\n    phase: value.phase as PlacementBrowserWorkingCopyAdoptionPhase,\n    failureCode:\n      value.failureCode === null ? null : requireOpaqueId(value.failureCode, \"failure code\"),\n    retainedDirectories: value.retainedDirectories as string[],\n    createdAt: timestamp(value.createdAt, \"adoption created at\"),\n    updatedAt: timestamp(value.updatedAt, \"adoption updated at\"),\n  };\n}\n\nfunction parseWorkingCopyInspection(\n  value: unknown,\n  reference: PlacementBrowserSessionReference,\n): PlacementBrowserWorkingCopyInspection {\n  if (\n    !isRecord(value) ||\n    value.browserSessionId !== reference.browserSessionId ||\n    value.controllerGeneration !== reference.controllerGeneration ||\n    typeof value.platformSupported !== \"boolean\" ||\n    typeof value.profileIdentityMatches !== \"boolean\" ||\n    !(value.profileInUse === null || typeof value.profileInUse === \"boolean\") ||\n    !(\n      value.refusal === null ||\n      BROWSER_WORKING_COPY_REFUSALS.includes(value.refusal as PlacementBrowserWorkingCopyRefusal)\n    )\n  ) {\n    throw new BrowserControlProtocolError(\"browser controller returned a malformed inspection\");\n  }\n  let manifest: PlacementBrowserWorkingCopyInspection[\"manifest\"] = null;\n  if (value.manifest !== null) {\n    if (!isRecord(value.manifest)) {\n      throw new BrowserControlProtocolError(\"browser controller returned a malformed manifest\");\n    }\n    manifest = {\n      digest: sha256(value.manifest.digest, \"working copy manifest digest\"),\n      entries: nonnegativeSafeInteger(value.manifest.entries, \"working copy entries\"),\n      bytes: nonnegativeSafeInteger(value.manifest.bytes, \"working copy bytes\"),\n      excluded: excludedWorkingCopyEntries(value.manifest.excluded),\n    };\n  }\n  let receipt: PlacementBrowserWorkingCopyInspection[\"receipt\"] = null;\n  if (value.receipt !== null) {\n    const raw = value.receipt;\n    if (\n      !isRecord(raw) ||\n      ![\"launch\", \"suspend\", \"retire\", \"adopt\"].includes(raw.intent as string) ||\n      typeof raw.state !== \"string\" ||\n      typeof raw.directoryLaunchAllowed !== \"boolean\" ||\n      typeof raw.authorityMatches !== \"boolean\" ||\n      !(raw.restoreAuthorityDigest === null || typeof raw.restoreAuthorityDigest === \"string\") ||\n      !(raw.adoption === null || isRecord(raw.adoption))\n    ) {\n      throw new BrowserControlProtocolError(\"browser controller returned a malformed receipt\");\n    }\n    receipt = {\n      operationId: requireUuid(raw.operationId, \"working runtime receipt id\"),\n      intent: raw.intent as \"launch\" | \"suspend\" | \"retire\" | \"adopt\",\n      state: requireOpaqueId(raw.state, \"working runtime receipt state\"),\n      directoryLaunchAllowed: raw.directoryLaunchAllowed,\n      authorityMatches: raw.authorityMatches,\n      launchedFromCheckpoint: raw.restoreAuthorityDigest !== null,\n      adoption: isRecord(raw.adoption)\n        ? {\n            operationId: requireUuid(raw.adoption.operationId, \"working copy adoption id\"),\n            manifestDigest: sha256(raw.adoption.manifestDigest, \"working copy manifest digest\"),\n          }\n        : null,\n    };\n  }\n  return {\n    browserSessionId: reference.browserSessionId,\n    controllerGeneration: reference.controllerGeneration,\n    platformSupported: value.platformSupported,\n    refusal: value.refusal as PlacementBrowserWorkingCopyRefusal | null,\n    manifest,\n    profileIdentityMatches: value.profileIdentityMatches,\n    profileInUse: value.profileInUse,\n    receipt,\n    activeAdoption:\n      value.activeAdoption === null || value.activeAdoption === undefined\n        ? null\n        : parseWorkingCopyAdoption(value.activeAdoption, reference, \"recorded\"),\n  };\n}\n\nfunction parseStateCaptureReceipt(value: unknown): PlacementBrowserStateCaptureReceipt {\n  if (!isRecord(value) || !isRecord(value.manifest)) {\n    throw new BrowserControlProtocolError(\n      \"browser controller returned malformed state-capture data\",\n    );\n  }\n  const manifest = value.manifest;\n  if (!Array.isArray(manifest.tabs)) {\n    throw new BrowserControlProtocolError(\n      \"browser controller returned malformed state-capture manifest\",\n    );\n  }\n  const browserSessionId = requireUuid(value.browserSessionId, \"browser session id\");\n  const controllerGeneration = requireGeneration(value.controllerGeneration);\n  const manifestSessionId = requireUuid(\n    manifest.browserSessionId,\n    \"browser state manifest session id\",\n  );\n  const manifestControllerGeneration = requireGeneration(manifest.controllerGeneration);\n  if (\n    manifestSessionId !== browserSessionId ||\n    manifestControllerGeneration !== controllerGeneration\n  ) {\n    throw new BrowserControlProtocolError(\n      \"browser controller returned inconsistent state-capture metadata\",\n    );\n  }\n  if (\n    value.format !== BROWSER_PROFILE_ARTIFACT_FORMAT ||\n    manifest.schemaVersion !== 1 ||\n    (manifest.engine !== \"chromium\" && manifest.engine !== \"chrome\") ||\n    (manifest.platform !== \"linux\" &&\n      manifest.platform !== \"macos\" &&\n      manifest.platform !== \"windows\") ||\n    (manifest.architecture !== \"x64\" && manifest.architecture !== \"arm64\")\n  ) {\n    throw new BrowserControlProtocolError(\n      \"browser controller returned unsupported state-capture metadata\",\n    );\n  }\n  if (\n    manifest.profileCrypto !== \"chromium_basic\" &&\n    manifest.profileCrypto !== \"chromium_mock_keychain\" &&\n    manifest.profileCrypto !== \"platform_bound\"\n  ) {\n    throw new BrowserControlProtocolError(\n      \"browser controller returned unsupported profile crypto policy\",\n    );\n  }\n  const tabs = manifest.tabs.map((tab) => {\n    if (!isRecord(tab) || typeof tab.selected !== \"boolean\") {\n      throw new BrowserControlProtocolError(\n        \"browser controller returned malformed state-capture tab\",\n      );\n    }\n    return { url: boundedUrl(tab.url), selected: tab.selected };\n  });\n  if (tabs.length > 1_000 || tabs.filter((tab) => tab.selected).length > 1) {\n    throw new BrowserControlProtocolError(\"browser controller returned invalid state-capture tabs\");\n  }\n  return {\n    operationId: requireUuid(value.operationId, \"browser state operation id\"),\n    browserSessionId,\n    controllerGeneration,\n    objectKey: browserStateObjectKey(value.objectKey),\n    format: BROWSER_PROFILE_ARTIFACT_FORMAT,\n    artifactDigest: sha256(value.artifactDigest, \"browser state artifact digest\"),\n    contentDigest: sha256(value.contentDigest, \"browser state content digest\"),\n    sizeBytes: positiveSafeInteger(value.sizeBytes, \"browser state artifact size\"),\n    fileCount: nonnegativeSafeInteger(value.fileCount, \"browser state file count\"),\n    profileBytes: nonnegativeSafeInteger(value.profileBytes, \"browser state profile size\"),\n    manifest: {\n      schemaVersion: 1,\n      browserSessionId: manifestSessionId,\n      controllerGeneration: manifestControllerGeneration,\n      capturedAt: timestamp(manifest.capturedAt, \"browser state capture time\"),\n      engine: manifest.engine,\n      engineVersion:\n        manifest.engineVersion === null\n          ? null\n          : requireOpaqueId(manifest.engineVersion, \"browser engine version\"),\n      driverId: requireOpaqueId(manifest.driverId, \"browser driver id\"),\n      driverSchemaVersion: positiveSafeInteger(\n        manifest.driverSchemaVersion,\n        \"browser driver schema version\",\n      ),\n      profileCrypto: manifest.profileCrypto,\n      platform: manifest.platform,\n      architecture: manifest.architecture,\n      tabs,\n    },\n  };\n}\n\nfunction browserStateObjectKey(value: unknown): string {\n  if (\n    typeof value !== \"string\" ||\n    Buffer.byteLength(value) > 2_048 ||\n    !/^workspaces\\/[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\\/browser-state\\/[A-Za-z0-9._=-]+(?:\\/[A-Za-z0-9._=-]+)*$/iu.test(\n      value,\n    )\n  ) {\n    throw new RangeError(\"browser state object key is invalid\");\n  }\n  return value;\n}\n\nfunction browserStateUploadGrant(value: unknown): BrowserStateUploadGrant {\n  if (!isRecord(value) || !isRecord(value.requiredHeaders)) {\n    throw new RangeError(\"browser state upload grant is invalid\");\n  }\n  const url = boundedUrl(value.url);\n  const parsed = new URL(url);\n  if (\n    (parsed.protocol !== \"https:\" && parsed.protocol !== \"http:\") ||\n    parsed.username ||\n    parsed.password ||\n    parsed.hash\n  ) {\n    throw new RangeError(\"browser state upload URL is invalid\");\n  }\n  const headers: Record<string, string> = {};\n  for (const [name, headerValue] of Object.entries(value.requiredHeaders)) {\n    if (\n      (name !== \"content-type\" && name !== \"x-ms-blob-type\") ||\n      typeof headerValue !== \"string\" ||\n      /[\\r\\n]/u.test(headerValue)\n    ) {\n      throw new RangeError(\"browser state upload header is invalid\");\n    }\n    headers[name] = headerValue;\n  }\n  if (Object.keys(headers).length < 1 || Object.keys(headers).length > 2) {\n    throw new RangeError(\"browser state upload header count is invalid\");\n  }\n  if (headers[\"content-type\"] !== BROWSER_STATE_ARTIFACT_CONTENT_TYPE) {\n    throw new RangeError(\"browser state upload content type is invalid\");\n  }\n  return {\n    url: parsed.toString(),\n    requiredHeaders: headers,\n    expiresAt: timestamp(value.expiresAt, \"browser state upload expiry\"),\n  };\n}\n\nfunction browserStateDownloadGrant(value: unknown): BrowserStateDownloadGrant {\n  if (!isRecord(value)) {\n    throw new RangeError(\"browser state download grant is invalid\");\n  }\n  const url = boundedUrl(value.url);\n  const parsed = new URL(url);\n  if (\n    (parsed.protocol !== \"https:\" && parsed.protocol !== \"http:\") ||\n    parsed.username ||\n    parsed.password ||\n    parsed.hash\n  ) {\n    throw new RangeError(\"browser state download URL is invalid\");\n  }\n  return {\n    url: parsed.toString(),\n    expiresAt: timestamp(value.expiresAt, \"browser state download expiry\"),\n  };\n}\n\nfunction browserStateRestoreRequest(input: RestorePlacementBrowserStateInput): {\n  wire: Record<string, unknown>;\n  dataKey: Buffer;\n  aad: Buffer;\n} {\n  if (input.format !== BROWSER_PROFILE_ARTIFACT_FORMAT) {\n    throw new RangeError(\"browser state restore format is unsupported\");\n  }\n  const dataKey = Buffer.from(exactBytes(input.dataKey, 32, \"browser state data key\"));\n  const aad = Buffer.from(boundedBytes(input.aad, 1, 16 * 1024, \"browser state associated data\"));\n  try {\n    return {\n      wire: {\n        objectKey: browserStateObjectKey(input.objectKey),\n        format: BROWSER_PROFILE_ARTIFACT_FORMAT,\n        artifactDigest: sha256(input.artifactDigest, \"browser state artifact digest\"),\n        contentDigest: sha256(input.contentDigest, \"browser state content digest\"),\n        manifestDigest: sha256(input.manifestDigest, \"browser state manifest digest\"),\n        sizeBytes: positiveSafeInteger(input.sizeBytes, \"browser state artifact size\"),\n        dataKeyBase64: dataKey.toString(\"base64\"),\n        aadBase64: aad.toString(\"base64\"),\n        materialization: BrowserRevisionMaterialization.parse(input.materialization),\n        download: browserStateDownloadGrant(input.download),\n      },\n      dataKey,\n      aad,\n    };\n  } catch (error) {\n    dataKey.fill(0);\n    aad.fill(0);\n    throw error;\n  }\n}\n\nfunction exactBytes(value: Uint8Array, length: number, label: string): Uint8Array {\n  return boundedBytes(value, length, length, label);\n}\n\nfunction boundedBytes(\n  value: Uint8Array,\n  minimum: number,\n  maximum: number,\n  label: string,\n): Uint8Array {\n  if (!(value instanceof Uint8Array) || value.byteLength < minimum || value.byteLength > maximum) {\n    throw new RangeError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction sha256(value: unknown, label: string): string {\n  if (typeof value !== \"string\" || !SHA256_PATTERN.test(value)) {\n    throw new BrowserControlProtocolError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction requirePlacementProvisioningSurface(session: BrowserControlPlacementSession): void {\n  const hasPrivateWrite =\n    typeof session.writePlacementPrivate === \"function\" ||\n    typeof session.writeFile === \"function\" ||\n    ((typeof session.exec === \"function\" || typeof session.execCommand === \"function\") &&\n      typeof session.writeStdin === \"function\");\n  if (\n    (typeof session.exec !== \"function\" && typeof session.execCommand !== \"function\") ||\n    !hasPrivateWrite\n  ) {\n    throw new BrowserControlUnsupportedError(\n      \"browser placement requires exec and a private file transport\",\n    );\n  }\n}\n\nfunction requirePlacementRequestSurface(session: BrowserControlPlacementSession): void {\n  const hasExec = typeof session.exec === \"function\" || typeof session.execCommand === \"function\";\n  const hasPrivateWrite =\n    typeof session.writePlacementPrivate === \"function\" ||\n    typeof session.writeFile === \"function\" ||\n    (hasExec && typeof session.writeStdin === \"function\");\n  if (\n    typeof session.execWithInput !== \"function\" &&\n    typeof session.resolveExposedPort !== \"function\" &&\n    (!hasExec || !hasPrivateWrite)\n  ) {\n    throw new BrowserControlUnsupportedError(\n      \"browser placement requires a controller endpoint or exec and a private file transport\",\n    );\n  }\n}\n\nfunction isWorkspaceConfinedWrite(error: unknown): boolean {\n  return (\n    error instanceof Error &&\n    /must stay within|confines|workspace mount|within \\/workspace|escapes? the workspace(?: root)?/iu.test(\n      error.message,\n    )\n  );\n}\n\nasync function writePrivateFile(\n  session: BrowserControlPlacementSession,\n  input: {\n    path: string;\n    content: string | Uint8Array;\n    createParents?: boolean;\n  },\n  timeoutMs = 60_000,\n): Promise<void> {\n  if (session.writePlacementPrivate) {\n    await session.writePlacementPrivate(input);\n    return;\n  }\n  if (session.writeFile) {\n    try {\n      await session.writeFile(input);\n      return;\n    } catch (error) {\n      if (\n        !isWorkspaceConfinedWrite(error) ||\n        (!session.exec && !session.execCommand) ||\n        !session.writeStdin\n      ) {\n        throw error;\n      }\n    }\n  }\n  if ((!session.exec && !session.execCommand) || !session.writeStdin) {\n    throw new BrowserControlUnsupportedError(\"browser placement has no private file transport\");\n  }\n  const path = absolutePrivatePath(input.path, \"browser private file path\");\n  const bytes = typeof input.content === \"string\" ? Buffer.from(input.content) : input.content;\n  if (bytes.byteLength > BROWSER_CONTROL_MAX_JSON_BYTES) {\n    throw new RangeError(\"browser private file is too large\");\n  }\n  const parent = posixPath.dirname(path);\n  if (input.createParents) {\n    await runChecked(\n      session,\n      `umask 077; install -d -m 0700 -- ${shellQuote(parent)}; printf '%s\\n' ${shellQuote(COMMAND_OK)}`,\n      timeoutMs,\n    );\n  }\n  if (bytes.byteLength === 0) {\n    await runChecked(\n      session,\n      `umask 077; : > ${shellQuote(path)}; chmod 0600 -- ${shellQuote(path)}; printf '%s\\n' ${shellQuote(COMMAND_OK)}`,\n      timeoutMs,\n    );\n    return;\n  }\n\n  // SandboxSession deliberately has no generic writeFile capability. Stream a\n  // bounded base64 payload over the provider's stdin channel into an exact-byte\n  // decoder. Secret material never appears in a shell command, argv, env, URL,\n  // workspace, or provider process listing.\n  const payload = Buffer.from(bytes).toString(\"base64\");\n  const command = [\n    \"umask 077;\",\n    \"if base64 --help 2>&1 | grep -q -- '--decode'; then decode_flag=--decode;\",\n    \"elif printf '' | base64 -d >/dev/null 2>&1; then decode_flag=-d;\",\n    \"elif printf '' | base64 -D >/dev/null 2>&1; then decode_flag=-D;\",\n    \"else exit 69; fi;\",\n    `dd bs=1 count=${payload.length} 2>/dev/null | base64 \"$decode_flag\" > ${shellQuote(path)};`,\n    `chmod 0600 -- ${shellQuote(path)};`,\n    `printf '%s\\n' ${shellQuote(COMMAND_OK)}`,\n  ].join(\" \");\n  const started = session.exec\n    ? await session.exec({\n        cmd: command,\n        workdir: placementControllerWorkdir(session),\n        yieldTimeMs: 250,\n        maxOutputTokens: 2_000,\n      })\n    : await session.execCommand!({\n        cmd: command,\n        workdir: placementControllerWorkdir(session),\n        yieldTimeMs: 250,\n        maxOutputTokens: 2_000,\n      });\n  const startedSessionId =\n    typeof started === \"string\"\n      ? (() => {\n          const banner = parseExecResponseBanner(started);\n          return banner.kind === \"running\" ? banner.sessionId : null;\n        })()\n      : Number.isSafeInteger(started.sessionId) && (started.sessionId ?? -1) >= 0\n        ? started.sessionId!\n        : null;\n  if (startedSessionId === null) {\n    throw new BrowserControlTransportError(\n      \"browser private file transport did not yield an input session\",\n    );\n  }\n  const output = await session.writeStdin({\n    sessionId: startedSessionId,\n    chars: payload,\n    yieldTimeMs: boundedTimeout(timeoutMs),\n    maxOutputTokens: 2_000,\n  });\n  const terminal = parseExecResponseBanner(output);\n  if (\n    terminal.kind === \"invalid\" ||\n    terminal.kind === \"running\" ||\n    (terminal.kind === \"exited\" && terminal.exitCode !== 0) ||\n    !output.includes(COMMAND_OK)\n  ) {\n    throw new BrowserControlTransportError(\"browser private file transport failed\");\n  }\n}\n\nasync function runChecked(\n  session: BrowserControlPlacementSession,\n  command: string,\n  timeoutMs = 60_000,\n): Promise<void> {\n  const bounded = boundedTimeout(timeoutMs);\n  const result = session.exec\n    ? await session.exec({\n        cmd: command,\n        workdir: placementControllerWorkdir(session),\n        yieldTimeMs: bounded,\n        maxOutputTokens: 2_000,\n      })\n    : await session.execCommand!({\n        cmd: command,\n        workdir: placementControllerWorkdir(session),\n        yieldTimeMs: bounded,\n        maxOutputTokens: 2_000,\n      });\n  const output = commandOutput(result);\n  const exitCode = typeof result === \"object\" && result ? result.exitCode : undefined;\n  if ((typeof exitCode === \"number\" && exitCode !== 0) || !output.includes(COMMAND_OK)) {\n    throw new BrowserControlTransportError(\"browser placement command failed\");\n  }\n}\n\nasync function runBestEffort(\n  session: BrowserControlPlacementSession,\n  command: string,\n): Promise<void> {\n  try {\n    if (session.exec) {\n      await session.exec({\n        cmd: command,\n        workdir: placementControllerWorkdir(session),\n        yieldTimeMs: 15_000,\n        maxOutputTokens: 100,\n      });\n    } else if (session.execCommand) {\n      await session.execCommand({\n        cmd: command,\n        workdir: placementControllerWorkdir(session),\n        yieldTimeMs: 15_000,\n        maxOutputTokens: 100,\n      });\n    }\n  } catch {\n    // UUID-scoped request directories contain no durable state.\n  }\n}\n\nasync function readText(\n  session: BrowserControlPlacementSession,\n  path: string,\n  maxBytes: number,\n  timeoutMs: number,\n): Promise<string> {\n  const privatePath = absolutePrivatePath(path, \"browser private response path\");\n  if (\n    !Number.isSafeInteger(maxBytes) ||\n    maxBytes < 1 ||\n    maxBytes > BROWSER_CONTROL_MAX_JSON_BYTES + 1\n  ) {\n    throw new RangeError(\"browser private response limit is invalid\");\n  }\n  if (session.readFile) {\n    try {\n      const value = await session.readFile({ path: privatePath, maxBytes });\n      return typeof value === \"string\"\n        ? value\n        : new TextDecoder(\"utf-8\", { fatal: true }).decode(value);\n    } catch {\n      // The standard Docker SandboxSession intentionally confines readFile to\n      // its workspace mount. Keep controller traffic out of that capturable\n      // mount and fall back to the same placement's bounded command channel.\n    }\n  }\n\n  const sizeMarker = `OPENGENI_BROWSER_PRIVATE_SIZE_${randomUUID()}`;\n  const sizeOutput = await runPrivateReadCommand(\n    session,\n    [\n      \"LC_ALL=C;\",\n      `size=$(wc -c < ${shellQuote(privatePath)}) || exit 66;`,\n      `printf '%s%s%s' ${shellQuote(sizeMarker)} \"$size\" ${shellQuote(sizeMarker)}`,\n    ].join(\" \"),\n    1_024,\n    timeoutMs,\n  );\n  const sizeText = extractMarkedValue(sizeOutput, sizeMarker);\n  const size = parseUnsignedInteger(sizeText, \"browser private response size\");\n  const requestedBytes = Math.min(size, maxBytes);\n  if (requestedBytes === 0) return \"\";\n\n  const chunks: Buffer[] = [];\n  for (let offset = 0; offset < requestedBytes; offset += PRIVATE_READ_CHUNK_BYTES) {\n    const chunkIndex = Math.floor(offset / PRIVATE_READ_CHUNK_BYTES);\n    const expectedBytes = Math.min(PRIVATE_READ_CHUNK_BYTES, requestedBytes - offset);\n    const marker = `OPENGENI_BROWSER_PRIVATE_CHUNK_${randomUUID()}`;\n    const output = await runPrivateReadCommand(\n      session,\n      [\n        \"LC_ALL=C;\",\n        `printf '%s' ${shellQuote(marker)};`,\n        `dd if=${shellQuote(privatePath)} bs=${PRIVATE_READ_CHUNK_BYTES} skip=${chunkIndex} count=1 2>/dev/null | base64 | tr -d '\\\\r\\\\n';`,\n        `printf '%s' ${shellQuote(marker)}`,\n      ].join(\" \"),\n      Math.ceil((expectedBytes * 4) / 3) + 4_096,\n      timeoutMs,\n    );\n    const encoded = extractMarkedValue(output, marker);\n    if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u.test(encoded)) {\n      throw new BrowserControlTransportError(\"browser private response encoding is invalid\");\n    }\n    const decoded = Buffer.from(encoded, \"base64\");\n    if (decoded.byteLength < expectedBytes) {\n      throw new BrowserControlTransportError(\"browser private response changed during read\");\n    }\n    chunks.push(decoded.subarray(0, expectedBytes));\n  }\n  return new TextDecoder(\"utf-8\", { fatal: true }).decode(Buffer.concat(chunks));\n}\n\nasync function readBytes(\n  session: BrowserControlPlacementSession,\n  path: string,\n  maxBytes: number,\n  timeoutMs: number,\n): Promise<Uint8Array> {\n  const privatePath = absolutePrivatePath(path, \"browser private binary response path\");\n  if (\n    !Number.isSafeInteger(maxBytes) ||\n    maxBytes < 1 ||\n    maxBytes > Math.max(24 * 1024 * 1024, COMPUTER_SCREENSHOT_MAX_BYTES)\n  ) {\n    throw new RangeError(\"browser private binary response limit is invalid\");\n  }\n  const sizeMarker = `OPENGENI_BROWSER_PRIVATE_SIZE_${randomUUID()}`;\n  const sizeOutput = await runPrivateReadCommand(\n    session,\n    [\n      \"LC_ALL=C;\",\n      `size=$(wc -c < ${shellQuote(privatePath)}) || exit 66;`,\n      `printf '%s%s%s' ${shellQuote(sizeMarker)} \"$size\" ${shellQuote(sizeMarker)}`,\n    ].join(\" \"),\n    1_024,\n    timeoutMs,\n  );\n  const size = parseUnsignedInteger(\n    extractMarkedValue(sizeOutput, sizeMarker),\n    \"browser private binary response size\",\n  );\n  if (size < 1 || size > maxBytes) {\n    throw new RangeError(\"frame exceeds its byte bound\");\n  }\n  const chunks: Buffer[] = [];\n  for (let offset = 0; offset < size; offset += PRIVATE_READ_CHUNK_BYTES) {\n    const chunkIndex = Math.floor(offset / PRIVATE_READ_CHUNK_BYTES);\n    const expectedBytes = Math.min(PRIVATE_READ_CHUNK_BYTES, size - offset);\n    const marker = `OPENGENI_BROWSER_PRIVATE_CHUNK_${randomUUID()}`;\n    const output = await runPrivateReadCommand(\n      session,\n      [\n        \"LC_ALL=C;\",\n        `printf '%s' ${shellQuote(marker)};`,\n        `dd if=${shellQuote(privatePath)} bs=${PRIVATE_READ_CHUNK_BYTES} skip=${chunkIndex} count=1 2>/dev/null | base64 | tr -d '\\\\r\\\\n';`,\n        `printf '%s' ${shellQuote(marker)}`,\n      ].join(\" \"),\n      Math.ceil((expectedBytes * 4) / 3) + 4_096,\n      timeoutMs,\n    );\n    const encoded = extractMarkedValue(output, marker);\n    if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u.test(encoded)) {\n      throw new BrowserControlTransportError(\"browser private binary response encoding is invalid\");\n    }\n    const decoded = Buffer.from(encoded, \"base64\");\n    if (decoded.byteLength !== expectedBytes) {\n      throw new BrowserControlTransportError(\"browser private binary response changed during read\");\n    }\n    chunks.push(decoded);\n  }\n  return Uint8Array.from(Buffer.concat(chunks));\n}\n\nasync function runPrivateReadCommand(\n  session: BrowserControlPlacementSession,\n  command: string,\n  maxOutputTokens: number,\n  timeoutMs: number,\n): Promise<string> {\n  const bounded = boundedTimeout(timeoutMs);\n  const result = session.exec\n    ? await session.exec({\n        cmd: command,\n        workdir: placementControllerWorkdir(session),\n        yieldTimeMs: bounded,\n        maxOutputTokens,\n      })\n    : await session.execCommand!({\n        cmd: command,\n        workdir: placementControllerWorkdir(session),\n        yieldTimeMs: bounded,\n        maxOutputTokens,\n      });\n  const exitCode = typeof result === \"object\" && result ? result.exitCode : undefined;\n  if (typeof result === \"object\" && result?.sessionId !== undefined) {\n    throw new BrowserControlTransportError(\"browser private response read failed\");\n  }\n  if (typeof result === \"string\") {\n    const terminal = parseExecResponseBanner(result);\n    if (\n      terminal.kind === \"invalid\" ||\n      terminal.kind === \"running\" ||\n      (terminal.kind === \"exited\" && terminal.exitCode !== 0)\n    ) {\n      throw new BrowserControlTransportError(\"browser private response read failed\");\n    }\n    return result;\n  }\n  if (typeof exitCode === \"number\" && exitCode !== 0) {\n    throw new BrowserControlTransportError(\"browser private response read failed\");\n  }\n  return result.stdout ?? result.output ?? \"\";\n}\n\nfunction extractMarkedValue(output: string, marker: string): string {\n  const start = output.indexOf(marker);\n  if (start < 0) {\n    throw new BrowserControlTransportError(\"browser private response marker is absent\");\n  }\n  const valueStart = start + marker.length;\n  const end = output.indexOf(marker, valueStart);\n  if (end < 0) {\n    throw new BrowserControlTransportError(\"browser private response marker is incomplete\");\n  }\n  return output.slice(valueStart, end);\n}\n\nfunction commandOutput(result: ExecResultLike | string): string {\n  if (typeof result === \"string\") return result;\n  return [result.output, result.stdout, result.stderr]\n    .filter((part): part is string => typeof part === \"string\")\n    .join(\"\\n\");\n}\n\nfunction curlConfigQuote(value: string): string {\n  if (/[\\r\\n\\0]/u.test(value)) throw new BrowserControlProtocolError(\"curl value is invalid\");\n  return `\"${value.replaceAll(\"\\\\\", \"\\\\\\\\\").replaceAll('\"', '\\\\\"')}\"`;\n}\n\nfunction shellQuote(value: string): string {\n  return `'${value.replaceAll(\"'\", `'\\\\''`)}'`;\n}\n\nfunction requireToken(value: unknown, label: string): string {\n  if (typeof value !== \"string\" || !TOKEN_PATTERN.test(value)) {\n    throw new BrowserControlProtocolError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction requireUuid(value: unknown, label: string): string {\n  if (\n    typeof value !== \"string\" ||\n    !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(value)\n  ) {\n    throw new BrowserControlProtocolError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction requireGeneration(value: unknown): string {\n  if (\n    typeof value !== \"string\" ||\n    value.length > 256 ||\n    !/^[A-Za-z0-9][A-Za-z0-9._:-]*$/u.test(value)\n  ) {\n    throw new BrowserControlProtocolError(\"controller generation is invalid\");\n  }\n  return value;\n}\n\nfunction requireOpaqueId(value: unknown, label: string): string {\n  if (\n    typeof value !== \"string\" ||\n    value.length === 0 ||\n    Buffer.byteLength(value) > 512 ||\n    /[\\u0000-\\u001f\\u007f]/u.test(value)\n  ) {\n    throw new BrowserControlProtocolError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction requireBridgeGeneration(value: unknown): string {\n  if (\n    typeof value !== \"string\" ||\n    value.length > 512 ||\n    !/^[A-Za-z0-9][A-Za-z0-9._:-]*$/u.test(value)\n  ) {\n    throw new BrowserControlProtocolError(\"attached browser connection generation is invalid\");\n  }\n  return value;\n}\n\nfunction requireBoundedText(\n  value: unknown,\n  minimum: number,\n  maximum: number,\n  label: string,\n): string {\n  if (\n    typeof value !== \"string\" ||\n    Buffer.byteLength(value) < minimum ||\n    Buffer.byteLength(value) > maximum ||\n    /[\\u0000-\\u001f\\u007f]/u.test(value)\n  ) {\n    throw new BrowserControlProtocolError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction boundedUrl(value: unknown): string {\n  if (typeof value !== \"string\" || value.length === 0 || Buffer.byteLength(value) > 16_384) {\n    throw new BrowserControlProtocolError(\"browser URL is invalid\");\n  }\n  return value;\n}\n\nfunction normalizeOrigin(value: unknown): string {\n  if (typeof value !== \"string\") throw new BrowserControlProtocolError(\"browser origin is invalid\");\n  try {\n    const url = new URL(value);\n    if (url.origin === \"null\" || url.pathname !== \"/\" || url.search || url.hash) throw new Error();\n    return url.origin;\n  } catch {\n    throw new BrowserControlProtocolError(\"browser origin must be an absolute origin\");\n  }\n}\n\nfunction timestamp(value: unknown, label: string): string {\n  if (typeof value !== \"string\" || value.length > 128 || !Number.isFinite(Date.parse(value))) {\n    throw new BrowserControlProtocolError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction absolutePrivatePath(value: string, label: string): string {\n  if (\n    !value.startsWith(\"/\") ||\n    value.includes(\"\\0\") ||\n    value.endsWith(\"/\") ||\n    posixPath.normalize(value) !== value\n  ) {\n    throw new BrowserControlProtocolError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction boundedPort(value: number): number {\n  if (!Number.isSafeInteger(value) || value < 1 || value > 65_535) {\n    throw new RangeError(\"browser controller port is invalid\");\n  }\n  return value;\n}\n\nfunction boundedInteger(value: number, minimum: number, maximum: number, label: string): number {\n  if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {\n    throw new RangeError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction frameStreamUrlWithOptions(\n  value: string,\n  stream: {\n    format?: \"jpeg\" | \"png\" | undefined;\n    quality?: number | undefined;\n    maxWidth?: number | undefined;\n    maxHeight?: number | undefined;\n    everyNthFrame?: number | undefined;\n  },\n): string {\n  const url = new URL(value);\n  if (stream.format !== undefined) url.searchParams.set(\"format\", stream.format);\n  if (stream.quality !== undefined) {\n    url.searchParams.set(\n      \"quality\",\n      String(boundedInteger(stream.quality, 1, 100, \"browser frame quality\")),\n    );\n  }\n  if (stream.maxWidth !== undefined) {\n    url.searchParams.set(\n      \"maxWidth\",\n      String(boundedInteger(stream.maxWidth, 1, 4_096, \"browser frame width\")),\n    );\n  }\n  if (stream.maxHeight !== undefined) {\n    url.searchParams.set(\n      \"maxHeight\",\n      String(boundedInteger(stream.maxHeight, 1, 4_096, \"browser frame height\")),\n    );\n  }\n  if (stream.everyNthFrame !== undefined) {\n    url.searchParams.set(\n      \"everyNthFrame\",\n      String(boundedInteger(stream.everyNthFrame, 1, 60, \"browser frame sampling interval\")),\n    );\n  }\n  return url.toString();\n}\n\nfunction boundedTimeout(value: number): number {\n  if (!Number.isSafeInteger(value) || value < 1 || value > MAX_REQUEST_TIMEOUT_MS) {\n    throw new RangeError(\"browser controller timeout is invalid\");\n  }\n  return value;\n}\n\nfunction positiveSafeInteger(value: unknown, label: string): number {\n  if (typeof value !== \"number\" || !Number.isSafeInteger(value) || value < 1) {\n    throw new RangeError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction nonnegativeSafeInteger(value: unknown, label: string): number {\n  if (typeof value !== \"number\" || !Number.isSafeInteger(value) || value < 0) {\n    throw new RangeError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction excludedWorkingCopyEntries(value: unknown): string[] {\n  if (\n    !Array.isArray(value) ||\n    value.length > 16 ||\n    !value.every((entry) => typeof entry === \"string\" && entry.length > 0 && entry.length <= 256)\n  ) {\n    throw new BrowserControlProtocolError(\n      \"browser controller returned malformed working copy exclusions\",\n    );\n  }\n  return [...value];\n}\n\nfunction parseUnsignedInteger(value: string, label: string): number {\n  const trimmed = value.trim();\n  if (!/^(0|[1-9][0-9]*)$/u.test(trimmed)) {\n    throw new BrowserControlProtocolError(`${label} is invalid`);\n  }\n  const parsed = Number(trimmed);\n  if (!Number.isSafeInteger(parsed)) {\n    throw new BrowserControlProtocolError(`${label} is invalid`);\n  }\n  return parsed;\n}\n\nfunction parseHttpStatus(value: string): number {\n  const status = parseUnsignedInteger(value, \"HTTP status\");\n  if (status < 100 || status > 599) {\n    throw new BrowserControlProtocolError(\"HTTP status is invalid\");\n  }\n  return status;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n","export const CONTROLLER_STREAM_MAX_INPUT = 128 * 1024;\nconst MAX_HEADER_BYTES = 64 * 1024;\n\n/** The machine family that runs the controller command. POSIX hosts use\n * `/bin/sh`, curl and base64. Windows has no POSIX shell or base64 utility, so\n * Windows PowerShell 5.1 (present on every supported Windows) relays the same\n * curl config to the system curl.exe and base64-encodes its exact bytes. */\nexport type ControllerStreamHost = \"posix\" | \"windows\";\n\nconst MARKER = \"OPENGENI_CONTROLLER_END_V1\";\n\n// Single quotes only: the script crosses a Windows command line as one argv\n// element, where embedded double quotes are not reliably preserved. The stdin\n// writer encoding is set without a BOM before the child pipe is created; a BOM\n// would make curl reject the first config line.\nconst WINDOWS_STREAM_SCRIPT = [\n  \"$ErrorActionPreference='Stop'\",\n  \"$i=New-Object IO.MemoryStream\",\n  \"[Console]::OpenStandardInput().CopyTo($i)\",\n  \"[Console]::InputEncoding=New-Object Text.UTF8Encoding($false)\",\n  \"$s=New-Object Diagnostics.ProcessStartInfo\",\n  \"$s.FileName=[IO.Path]::Combine([Environment]::SystemDirectory,'curl.exe')\",\n  \"$s.Arguments='--disable --config -'\",\n  \"$s.UseShellExecute=$false\",\n  \"$s.CreateNoWindow=$true\",\n  \"$s.RedirectStandardInput=$true\",\n  \"$s.RedirectStandardOutput=$true\",\n  \"$s.RedirectStandardError=$true\",\n  \"$p=[Diagnostics.Process]::Start($s)\",\n  \"$e=$p.StandardError.ReadToEndAsync()\",\n  \"$i.WriteTo($p.StandardInput.BaseStream)\",\n  \"$p.StandardInput.Close()\",\n  \"$o=New-Object IO.MemoryStream\",\n  \"$p.StandardOutput.BaseStream.CopyTo($o)\",\n  \"$p.WaitForExit()\",\n  `$t=[Text.Encoding]::ASCII.GetBytes([string][char]10+'${MARKER}'+$p.ExitCode)`,\n  \"$o.Write($t,0,$t.Length)\",\n  \"[Console]::Out.Write([Convert]::ToBase64String($o.ToArray()))\",\n].join(\";\");\n\n/** One command over the existing binary-input transport. The command is static\n * with a stable trailer so replayed command output remains readable; all\n * authority and page data stay on stdin.\n * Base64 preserves screenshot bytes across text-only command result adapters. */\nexport function controllerStreamRequest(input: {\n  method: string;\n  url: string;\n  token: string;\n  body?: string;\n  timeoutMs: number;\n  maxBytes: number;\n  host?: ControllerStreamHost;\n}): { cmd: string; shell: string; stdin: Uint8Array; marker: string } {\n  const quote = (value: string): string => {\n    if (/[\\r\\n\\0]/u.test(value)) throw new Error(\"invalid controller request value\");\n    return `\"${value.replaceAll(\"\\\\\", \"\\\\\\\\\").replaceAll('\"', '\\\\\"')}\"`;\n  };\n  const seconds = Math.max(1, Math.ceil(input.timeoutMs / 1_000));\n  const marker = MARKER;\n  const config = [\n    \"silent\",\n    \"show-error\",\n    \"include\",\n    `noproxy = \"*\"`,\n    `connect-timeout = ${Math.min(seconds, 15)}`,\n    `max-time = ${seconds}`,\n    `max-filesize = ${input.maxBytes}`,\n    `request = ${quote(input.method)}`,\n    `url = ${quote(input.url)}`,\n    `header = ${quote(`Authorization: Bearer ${input.token}`)}`,\n    ...(input.body === undefined\n      ? []\n      : [`header = \"Content-Type: application/json\"`, `data-binary = ${quote(input.body)}`]),\n    \"\",\n  ].join(\"\\n\");\n  const stdin = Buffer.from(config);\n  if (stdin.byteLength > CONTROLLER_STREAM_MAX_INPUT) {\n    throw new RangeError(\"controller command input is too large\");\n  }\n  if (input.host === \"windows\") {\n    return { cmd: WINDOWS_STREAM_SCRIPT, shell: \"powershell\", stdin, marker };\n  }\n  return {\n    cmd: `(curl --disable --config -; controller_exit=$?; printf '\\\\n${marker}%s' \"$controller_exit\") | base64`,\n    shell: \"/bin/sh\",\n    stdin,\n    marker,\n  };\n}\n\nexport function parseControllerStreamResponse(\n  output: string,\n  marker: string,\n  maxBytes: number,\n): { status: number; headers: Map<string, string>; data: Uint8Array } {\n  const maxWireBytes = maxBytes + MAX_HEADER_BYTES + marker.length + 32;\n  // Allow the standard base64 utility's line wrapping, but no arbitrary log\n  // noise or oversized allocation before validating and decoding the payload.\n  if (output.length > Math.ceil(maxWireBytes / 3) * 4 * 1.05 + 4) {\n    throw new RangeError(\"controller response exceeds its byte bound\");\n  }\n  const encoded = output.replace(/[\\r\\n]/gu, \"\");\n  if (encoded.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/u.test(encoded)) {\n    throw new Error(\"controller response encoding is invalid\");\n  }\n  const bytes = Buffer.from(encoded, \"base64\");\n  const trailer = Buffer.from(`\\n${marker}`);\n  const end = bytes.lastIndexOf(trailer);\n  if (end < 0) throw new Error(\"controller response is incomplete\");\n  const exit = bytes.subarray(end + trailer.length).toString(\"ascii\");\n  if (!/^\\d{1,3}$/u.test(exit) || exit !== \"0\") {\n    throw new Error(\"controller request did not complete successfully\");\n  }\n  let offset = 0;\n  while (offset < end) {\n    const headerEnd = bytes.indexOf(\"\\r\\n\\r\\n\", offset);\n    if (headerEnd < offset || headerEnd + 4 > end || headerEnd + 4 > MAX_HEADER_BYTES) {\n      throw new Error(\"controller response headers are invalid\");\n    }\n    const lines = bytes.subarray(offset, headerEnd).toString(\"latin1\").split(\"\\r\\n\");\n    const match = /^HTTP\\/\\d(?:\\.\\d)? (\\d{3})(?: |$)/u.exec(lines.shift() ?? \"\");\n    if (!match) throw new Error(\"controller response status is invalid\");\n    const status = Number(match[1]);\n    offset = headerEnd + 4;\n    if (status >= 100 && status < 200 && status !== 101) continue;\n    if (status < 200 || status > 599) throw new Error(\"controller response status is invalid\");\n    const headers = new Map<string, string>();\n    for (const line of lines) {\n      const separator = line.indexOf(\":\");\n      if (separator <= 0) throw new Error(\"controller response header is invalid\");\n      headers.set(line.slice(0, separator).trim().toLowerCase(), line.slice(separator + 1).trim());\n    }\n    const data = bytes.subarray(offset, end);\n    if (data.byteLength > maxBytes)\n      throw new RangeError(\"controller response exceeds its byte bound\");\n    return { status, headers, data };\n  }\n  throw new Error(\"controller response is incomplete\");\n}\n","import {\n  CredentialProviderMcpMaterial,\n  type CredentialProviderMcpMaterial as McpMaterial,\n  type RunCredentialAuthNeeded,\n  type RunCredentialFile,\n  type RunCredentialsResolution,\n} from \"@opengeni/contracts\";\nimport type {\n  ExecCommandArgs,\n  SandboxClient,\n  SandboxSessionLike,\n  SandboxSessionState,\n} from \"@openai/agents/sandbox\";\n\nconst MAX_ENVIRONMENT_ENTRIES = 256;\nconst MAX_ENVIRONMENT_VALUE_BYTES = 64 * 1024;\nconst MAX_CREDENTIAL_FILES = 64;\nconst MAX_CREDENTIAL_FILE_BYTES = 1024 * 1024;\nconst MAX_TOTAL_MATERIAL_BYTES = 4 * 1024 * 1024;\nconst MAX_AUTH_NEEDED_NOTICES = 32;\n// Encoded chunks must leave room for both the cancellation shell and the SDK\n// run-as wrapper, each of which repeats and quotes the command. Keep chunks\n// base64-aligned and bounded without dropping any credential bytes.\nconst WRITE_CHUNK_BYTES = 1536;\nconst COMMAND_OK_MARKER = \"__OPENGENI_RUN_CREDENTIAL_COMMAND_OK__\";\nconst AUTH_NEEDED_REASONS = new Set([\n  \"missing_connection\",\n  \"expired\",\n  \"insufficient_scope\",\n  \"refresh_failed\",\n]);\nconst PORTABLE_LOCK_STALE_MINUTES = 2;\n\nexport type RunCredentialExpectedScope = {\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n};\n\nexport type NormalizedRunCredentialMaterial = {\n  environment: Record<string, string>;\n  files: RunCredentialFile[];\n  fileEnvironment: Record<string, string>;\n  expiresAt: Date | null;\n  authNeeded: RunCredentialAuthNeeded[];\n  mcp?: McpMaterial;\n};\n\nexport type RunCredentialCommandSession = Pick<SandboxSessionLike, \"exec\" | \"execCommand\">;\nexport type RunCredentialCommandRunner = (\n  session: RunCredentialCommandSession,\n  args: ExecCommandArgs,\n) => Promise<unknown>;\nexport type RunCredentialSessionReady = (\n  session: RunCredentialCommandSession,\n) => Promise<void> | void;\n\nexport class RunCredentialValidationError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"RunCredentialValidationError\";\n  }\n}\n\nfunction byteLength(value: string): number {\n  return new TextEncoder().encode(value).byteLength;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return Boolean(value) && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction assertBoundedString(value: unknown, label: string, maxBytes: number): void {\n  if (value === undefined) return;\n  if (typeof value !== \"string\") {\n    throw new RunCredentialValidationError(`${label} must be a string`);\n  }\n  if (byteLength(value) > maxBytes) {\n    throw new RunCredentialValidationError(`${label} exceeds ${maxBytes} bytes`);\n  }\n  if (value?.includes(\"\\0\")) {\n    throw new RunCredentialValidationError(`${label} contains a NUL byte`);\n  }\n}\n\nfunction requiredBoundedString(value: unknown, label: string, maxBytes: number): string {\n  if (typeof value !== \"string\") {\n    throw new RunCredentialValidationError(`${label} must be a string`);\n  }\n  assertBoundedString(value, label, maxBytes);\n  return value;\n}\n\nfunction assertOptionalNonEmptyString(value: unknown, label: string, maxBytes: number): void {\n  assertBoundedString(value, label, maxBytes);\n  if (typeof value === \"string\" && !value.trim()) {\n    throw new RunCredentialValidationError(`${label} must not be empty`);\n  }\n}\n\nfunction normalizeAuthNeeded(notices: unknown, required: boolean): RunCredentialAuthNeeded[] {\n  if (notices !== undefined && !Array.isArray(notices)) {\n    throw new RunCredentialValidationError(\"authNeeded must be an array\");\n  }\n  const rawNotices = notices ?? [];\n  const normalized: RunCredentialAuthNeeded[] = [];\n  if (required && rawNotices.length === 0) {\n    throw new RunCredentialValidationError(\"auth_needed resolution must contain a notice\");\n  }\n  if (rawNotices.length > MAX_AUTH_NEEDED_NOTICES) {\n    throw new RunCredentialValidationError(\n      `auth-needed notice count exceeds ${MAX_AUTH_NEEDED_NOTICES}`,\n    );\n  }\n  for (const [index, notice] of rawNotices.entries()) {\n    if (!isRecord(notice)) {\n      throw new RunCredentialValidationError(`authNeeded[${index}] must be an object`);\n    }\n    const reason = notice.reason;\n    if (typeof reason !== \"string\" || !AUTH_NEEDED_REASONS.has(reason)) {\n      throw new RunCredentialValidationError(`authNeeded[${index}].reason is invalid`);\n    }\n    assertOptionalNonEmptyString(notice.providerDomain, `authNeeded[${index}].providerDomain`, 512);\n    assertOptionalNonEmptyString(notice.connectionId, `authNeeded[${index}].connectionId`, 512);\n    assertOptionalNonEmptyString(notice.resource, `authNeeded[${index}].resource`, 2_048);\n    assertOptionalNonEmptyString(notice.message, `authNeeded[${index}].message`, 2_048);\n    if (notice.scopes !== undefined && !Array.isArray(notice.scopes)) {\n      throw new RunCredentialValidationError(`authNeeded[${index}].scopes must be an array`);\n    }\n    const scopes = notice.scopes ?? [];\n    if (scopes.length > 128) {\n      throw new RunCredentialValidationError(`authNeeded[${index}].scopes exceeds 128 entries`);\n    }\n    for (const scope of scopes) {\n      requiredBoundedString(scope, `authNeeded[${index}].scope`, 512);\n      if (!scope.trim()) {\n        throw new RunCredentialValidationError(`authNeeded[${index}].scope must not be empty`);\n      }\n    }\n    if (notice.authorizationUrl !== undefined) {\n      const authorizationUrl = requiredBoundedString(\n        notice.authorizationUrl,\n        `authNeeded[${index}].authorizationUrl`,\n        4_096,\n      );\n      let url: URL;\n      try {\n        url = new URL(authorizationUrl);\n      } catch {\n        throw new RunCredentialValidationError(`authNeeded[${index}].authorizationUrl is invalid`);\n      }\n      if (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n        throw new RunCredentialValidationError(\n          `authNeeded[${index}].authorizationUrl must use http or https`,\n        );\n      }\n    }\n    normalized.push({\n      reason: reason as RunCredentialAuthNeeded[\"reason\"],\n      ...(typeof notice.providerDomain === \"string\"\n        ? { providerDomain: notice.providerDomain }\n        : {}),\n      ...(typeof notice.connectionId === \"string\" ? { connectionId: notice.connectionId } : {}),\n      ...(scopes.length > 0 ? { scopes: scopes as string[] } : {}),\n      ...(typeof notice.resource === \"string\" ? { resource: notice.resource } : {}),\n      ...(typeof notice.authorizationUrl === \"string\"\n        ? { authorizationUrl: notice.authorizationUrl }\n        : {}),\n      ...(typeof notice.message === \"string\" ? { message: notice.message } : {}),\n    });\n  }\n  return normalized;\n}\n\nfunction assertResolutionScope(\n  resolution: Record<string, unknown>,\n  expected: RunCredentialExpectedScope,\n): void {\n  if (\n    resolution.accountId !== expected.accountId ||\n    resolution.workspaceId !== expected.workspaceId ||\n    resolution.sessionId !== expected.sessionId\n  ) {\n    throw new RunCredentialValidationError(\"run credential provider returned a scope mismatch\");\n  }\n}\n\nfunction normalizeRelativeFilePath(path: string): string {\n  if (\n    path.length === 0 ||\n    path.length > 240 ||\n    path.startsWith(\"/\") ||\n    path.includes(\"\\\\\") ||\n    path.includes(\"\\0\")\n  ) {\n    throw new RunCredentialValidationError(`invalid run credential file path: ${path}`);\n  }\n  const segments = path.split(\"/\");\n  if (segments.some((segment) => segment.length === 0 || segment === \".\" || segment === \"..\")) {\n    throw new RunCredentialValidationError(`invalid run credential file path: ${path}`);\n  }\n  return path;\n}\n\nfunction assertEnvironmentName(name: string, label: string): void {\n  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {\n    throw new RunCredentialValidationError(`invalid ${label}: ${name}`);\n  }\n}\n\n/**\n * Validate the untrusted host-port response before any secret is written to a\n * box. The host owns credential selection; Opengeni owns scope checks, bounds,\n * path safety, and the transport lifecycle.\n */\nexport function normalizeRunCredentialsResolution(\n  resolution: Extract<RunCredentialsResolution, { status: \"not_applicable\" }>,\n  expected: RunCredentialExpectedScope,\n  now?: Date,\n): null;\nexport function normalizeRunCredentialsResolution(\n  resolution: Exclude<RunCredentialsResolution, { status: \"not_applicable\" }>,\n  expected: RunCredentialExpectedScope,\n  now?: Date,\n): NormalizedRunCredentialMaterial;\nexport function normalizeRunCredentialsResolution(\n  resolution: RunCredentialsResolution,\n  expected: RunCredentialExpectedScope,\n  now?: Date,\n): NormalizedRunCredentialMaterial | null;\nexport function normalizeRunCredentialsResolution(\n  resolution: RunCredentialsResolution,\n  expected: RunCredentialExpectedScope,\n  now: Date = new Date(),\n): NormalizedRunCredentialMaterial | null {\n  if (!isRecord(resolution)) {\n    throw new RunCredentialValidationError(\"run credential resolution must be an object\");\n  }\n  const candidate = resolution as unknown as Record<string, unknown>;\n  if (\n    candidate.status !== \"ok\" &&\n    candidate.status !== \"auth_needed\" &&\n    candidate.status !== \"not_applicable\"\n  ) {\n    throw new RunCredentialValidationError(\"run credential resolution status is invalid\");\n  }\n  assertResolutionScope(candidate, expected);\n  if (candidate.status === \"not_applicable\") return null;\n  const authNeeded = normalizeAuthNeeded(candidate.authNeeded, candidate.status === \"auth_needed\");\n  if (candidate.status === \"auth_needed\") {\n    return {\n      environment: {},\n      files: [],\n      fileEnvironment: {},\n      expiresAt: null,\n      authNeeded,\n    };\n  }\n\n  if (!isRecord(candidate.environment)) {\n    throw new RunCredentialValidationError(\"run credential environment must be an object\");\n  }\n  const environmentEntries = Object.entries(candidate.environment);\n  if (environmentEntries.length > MAX_ENVIRONMENT_ENTRIES) {\n    throw new RunCredentialValidationError(\n      `run credential environment exceeds ${MAX_ENVIRONMENT_ENTRIES} entries`,\n    );\n  }\n  let totalBytes = 0;\n  const environment: Record<string, string> = {};\n  for (const [name, rawValue] of environmentEntries) {\n    assertEnvironmentName(name, \"run credential environment name\");\n    const value = requiredBoundedString(\n      rawValue,\n      `run credential environment value: ${name}`,\n      MAX_ENVIRONMENT_VALUE_BYTES,\n    );\n    const valueBytes = byteLength(value);\n    totalBytes += valueBytes;\n    Object.defineProperty(environment, name, {\n      value,\n      enumerable: true,\n      configurable: true,\n      writable: true,\n    });\n  }\n\n  if (candidate.files !== undefined && !Array.isArray(candidate.files)) {\n    throw new RunCredentialValidationError(\"run credential files must be an array\");\n  }\n  const files = candidate.files ?? [];\n  if (files.length > MAX_CREDENTIAL_FILES) {\n    throw new RunCredentialValidationError(\n      `run credential file count exceeds ${MAX_CREDENTIAL_FILES}`,\n    );\n  }\n  const paths = new Map<string, string>();\n  const normalizedFiles = files.map((file, index) => {\n    if (!isRecord(file)) {\n      throw new RunCredentialValidationError(`run credential file ${index} must be an object`);\n    }\n    const path = normalizeRelativeFilePath(\n      requiredBoundedString(file.path, `run credential file ${index} path`, 240),\n    );\n    const folded = path.toLocaleLowerCase(\"en-US\");\n    const collision = paths.get(folded);\n    if (collision !== undefined) {\n      throw new RunCredentialValidationError(\n        `run credential file path collision: ${collision} and ${path}`,\n      );\n    }\n    paths.set(folded, path);\n    const content = requiredBoundedString(\n      file.content,\n      `run credential file content: ${path}`,\n      MAX_CREDENTIAL_FILE_BYTES,\n    );\n    const contentBytes = byteLength(content);\n    if (file.mode !== undefined && file.mode !== \"0400\" && file.mode !== \"0600\") {\n      throw new RunCredentialValidationError(`run credential file mode is invalid: ${path}`);\n    }\n    totalBytes += contentBytes;\n    return { path, content, mode: file.mode ?? \"0600\" } as RunCredentialFile;\n  });\n\n  if (candidate.fileEnvironment !== undefined && !isRecord(candidate.fileEnvironment)) {\n    throw new RunCredentialValidationError(\"run credential fileEnvironment must be an object\");\n  }\n  const fileEnvironment: Record<string, string> = {};\n  for (const [name, unresolvedPath] of Object.entries(candidate.fileEnvironment ?? {})) {\n    assertEnvironmentName(name, \"run credential file environment name\");\n    if (Object.prototype.hasOwnProperty.call(environment, name)) {\n      throw new RunCredentialValidationError(\n        `run credential environment name is declared twice: ${name}`,\n      );\n    }\n    const path = normalizeRelativeFilePath(\n      requiredBoundedString(unresolvedPath, `run credential file environment path: ${name}`, 240),\n    );\n    if (!paths.has(path.toLocaleLowerCase(\"en-US\"))) {\n      throw new RunCredentialValidationError(\n        `run credential file environment references an unknown file: ${path}`,\n      );\n    }\n    Object.defineProperty(fileEnvironment, name, {\n      value: path,\n      enumerable: true,\n      configurable: true,\n      writable: true,\n    });\n  }\n  if (environmentEntries.length + Object.keys(fileEnvironment).length > MAX_ENVIRONMENT_ENTRIES) {\n    throw new RunCredentialValidationError(\n      `combined run credential environment exceeds ${MAX_ENVIRONMENT_ENTRIES} entries`,\n    );\n  }\n  if (totalBytes > MAX_TOTAL_MATERIAL_BYTES) {\n    throw new RunCredentialValidationError(\n      `run credential material exceeds ${MAX_TOTAL_MATERIAL_BYTES} bytes`,\n    );\n  }\n\n  let expiresAt: Date | null = null;\n  if (candidate.expiresAt !== undefined && candidate.expiresAt !== null) {\n    const expiry = requiredBoundedString(candidate.expiresAt, \"run credential expiry\", 128);\n    expiresAt = new Date(expiry);\n    if (!Number.isFinite(expiresAt.getTime()) || expiresAt.getTime() <= now.getTime()) {\n      throw new RunCredentialValidationError(\"run credential expiry is invalid or already expired\");\n    }\n  }\n  const parsedMcp = CredentialProviderMcpMaterial.safeParse(\n    candidate.mcp === undefined ? [] : candidate.mcp,\n  );\n  if (!parsedMcp.success) {\n    // Zod issues can contain untrusted inputs. Never expose credential values\n    // through errors that a worker may publish or log.\n    throw new RunCredentialValidationError(\"run MCP credential material is invalid\");\n  }\n  // Per-target expiry is enforced by the attempt-local MCP controller. A\n  // stale or unselected entry must not prevent unrelated sandbox material.\n  return {\n    environment,\n    files: normalizedFiles,\n    fileEnvironment,\n    expiresAt,\n    authNeeded,\n    ...(parsedMcp.data.length ? { mcp: parsedMcp.data } : {}),\n  };\n}\n\nfunction assertPathIdentity(value: string, label: string): string {\n  if (!/^[A-Za-z0-9_-]{1,128}$/.test(value)) {\n    throw new RunCredentialValidationError(`${label} is not safe for a credential path`);\n  }\n  return value;\n}\n\nexport function runCredentialRoot(sessionId: string): string {\n  return `/tmp/opengeni-run-credentials/${assertPathIdentity(sessionId, \"sessionId\")}`;\n}\n\nexport function runCredentialPointerFile(sessionId: string): string {\n  return `${runCredentialRoot(sessionId)}/current`;\n}\n\nfunction shellQuote(value: string): string {\n  return `'${value.replace(/'/g, \"'\\\\''\")}'`;\n}\n\nfunction base64(value: string): string {\n  return Buffer.from(value, \"utf8\").toString(\"base64\");\n}\n\nfunction portableBase64DecodeCommand(): string {\n  return [\n    \"{\",\n    \"if printf %s QQ== | base64 -d >/dev/null 2>&1; then base64 -d\",\n    \"elif printf %s QQ== | base64 -D >/dev/null 2>&1; then base64 -D\",\n    \"elif command -v openssl >/dev/null 2>&1; then openssl base64 -d -A\",\n    \"else exit 69\",\n    \"fi\",\n    \"}\",\n  ].join(\"\\n\");\n}\n\n/** Prefer util-linux flock; fall back to an atomic, stale-reaped mkdir lock. */\nfunction pointerLockAcquireCommands(root: string): string[] {\n  const lockFile = shellQuote(`${root}/.pointer.lock`);\n  const lockDirectory = shellQuote(`${root}/.pointer.lockdir`);\n  return [\n    `if command -v flock >/dev/null 2>&1; then`,\n    `  exec 9>${lockFile}`,\n    \"  flock -w 30 9\",\n    \"  _opengeni_pointer_lock_kind=flock\",\n    \"else\",\n    `  _opengeni_pointer_lock_dir=${lockDirectory}`,\n    \"  _opengeni_pointer_lock_deadline=$(($(date +%s) + 30))\",\n    '  while ! mkdir \"$_opengeni_pointer_lock_dir\" 2>/dev/null; do',\n    `    if find \"$_opengeni_pointer_lock_dir\" -prune -mmin +${PORTABLE_LOCK_STALE_MINUTES} -print 2>/dev/null | grep -q .; then`,\n    '      _opengeni_stale_lock=\"${_opengeni_pointer_lock_dir}.stale.$$\"',\n    '      if mv \"$_opengeni_pointer_lock_dir\" \"$_opengeni_stale_lock\" 2>/dev/null; then',\n    '        rm -rf -- \"$_opengeni_stale_lock\"',\n    \"        continue\",\n    \"      fi\",\n    \"    fi\",\n    '    [ \"$(date +%s)\" -lt \"$_opengeni_pointer_lock_deadline\" ] || exit 73',\n    \"    sleep 0.1\",\n    \"  done\",\n    \"  _opengeni_pointer_lock_kind=directory\",\n    `  trap 'rmdir ${lockDirectory} 2>/dev/null || :' EXIT HUP INT TERM`,\n    \"fi\",\n  ];\n}\n\nfunction pointerLockReleaseCommands(): string[] {\n  return [\n    'if [ \"${_opengeni_pointer_lock_kind:-}\" = directory ]; then',\n    '  rmdir \"$_opengeni_pointer_lock_dir\" 2>/dev/null || :',\n    \"  trap - EXIT HUP INT TERM\",\n    \"fi\",\n  ];\n}\n\nfunction outputOf(result: unknown): string {\n  if (typeof result === \"string\") return result;\n  if (!result || typeof result !== \"object\") return \"\";\n  const candidate = result as {\n    output?: unknown;\n    stdout?: unknown;\n    stderr?: unknown;\n  };\n  return [candidate.output, candidate.stdout, candidate.stderr]\n    .filter((value): value is string => typeof value === \"string\")\n    .join(\"\\n\");\n}\n\nasync function runCredentialCommand(\n  session: RunCredentialCommandSession,\n  cmd: string,\n  commandRunner?: RunCredentialCommandRunner,\n): Promise<void> {\n  const marked = `set +x\\nset -eu\\n${cmd}\\nprintf '\\\\n${COMMAND_OK_MARKER}\\\\n'`;\n  const args: ExecCommandArgs = {\n    cmd: `set +x\\nenv -u BASH_ENV bash --noprofile --norc -c ${shellQuote(marked)}`,\n    yieldTimeMs: 120_000,\n    maxOutputTokens: 4_000,\n  };\n  const result = commandRunner\n    ? await commandRunner(session, args)\n    : session.exec\n      ? await session.exec(args)\n      : session.execCommand\n        ? await session.execCommand(args)\n        : undefined;\n  if (!outputOf(result).includes(COMMAND_OK_MARKER)) {\n    throw new Error(\"run credential materialization command failed\");\n  }\n}\n\nasync function writeCredentialFile(\n  session: RunCredentialCommandSession,\n  directory: string,\n  relativePath: string,\n  content: string,\n  commandRunner?: RunCredentialCommandRunner,\n): Promise<void> {\n  await runCredentialCommand(\n    session,\n    credentialFileCommand(directory, relativePath, ': > \"$_opengeni_credential_path\"'),\n    commandRunner,\n  );\n  const encoded = base64(content);\n  for (let offset = 0; offset < encoded.length; offset += WRITE_CHUNK_BYTES) {\n    const chunk = encoded.slice(offset, offset + WRITE_CHUNK_BYTES);\n    await runCredentialCommand(\n      session,\n      credentialFileCommand(\n        directory,\n        relativePath,\n        `printf %s ${shellQuote(chunk)} | ${portableBase64DecodeCommand()} >> \"$_opengeni_credential_path\"`,\n      ),\n      commandRunner,\n    );\n  }\n  await runCredentialCommand(\n    session,\n    credentialFileCommand(\n      directory,\n      relativePath,\n      `[ \"$(wc -c < \"$_opengeni_credential_path\" | tr -d '[:space:]')\" = ${shellQuote(String(byteLength(content)))} ]`,\n    ),\n    commandRunner,\n  );\n}\n\nfunction credentialFileCommand(directory: string, relativePath: string, command: string): string {\n  // Avoid multiplying accepted path quotes through nested shell wrappers. The\n  // existing outer Bash decodes only literal UTF-8 bytes, including trailing\n  // newlines, without evaluating host-provided text or invoking a path decoder.\n  const escapedPath = [...Buffer.from(relativePath, \"utf8\")]\n    .map((byte) => `\\\\x${byte.toString(16).padStart(2, \"0\")}`)\n    .join(\"\");\n  return [\n    `printf -v _opengeni_credential_path %b ${shellQuote(escapedPath)}`,\n    `_opengeni_credential_path=${shellQuote(directory)}/\"$_opengeni_credential_path\"`,\n    command,\n  ].join(\"\\n\");\n}\n\nexport type MaterializeRunCredentialsOptions = {\n  sessionId: string;\n  attemptId: string;\n  executionGeneration: number;\n  /** Initial provision after recovery may prune generations from older attempts. */\n  pruneOtherAttempts?: boolean;\n  /** An all-auth-needed replacement removes every prior readable generation. */\n  prunePreviousGenerations?: boolean;\n  /** Renewal keeps the active and immediately prior same-attempt generations. */\n  pruneSupersededGenerations?: boolean;\n  commandRunner?: RunCredentialCommandRunner;\n};\n\n/** Materialize one complete immutable generation, then atomically flip current. */\nexport async function materializeRunCredentials(\n  session: RunCredentialCommandSession,\n  material: NormalizedRunCredentialMaterial,\n  options: MaterializeRunCredentialsOptions,\n): Promise<void> {\n  const root = runCredentialRoot(options.sessionId);\n  const attemptId = assertPathIdentity(options.attemptId, \"attemptId\");\n  if (!Number.isSafeInteger(options.executionGeneration) || options.executionGeneration < 0) {\n    throw new RunCredentialValidationError(\"executionGeneration must be a non-negative integer\");\n  }\n  const nonce = crypto.randomUUID();\n  const prefix = `${attemptId}-${options.executionGeneration}-`;\n  const versionName = `${attemptId}-${options.executionGeneration}-${nonce}`;\n  const stage = `${root}/versions/.stage-${versionName}`;\n  const version = `${root}/versions/${versionName}`;\n  for (const file of material.files) {\n    const mode = file.mode ?? \"0600\";\n    if (mode !== \"0400\" && mode !== \"0600\") {\n      throw new RunCredentialValidationError(`run credential file mode is invalid: ${file.path}`);\n    }\n  }\n  await runCredentialCommand(\n    session,\n    [\n      \"umask 077\",\n      `mkdir -p -- ${shellQuote(`${root}/versions`)}`,\n      `chmod -- 0700 ${shellQuote(root)} ${shellQuote(`${root}/versions`)}`,\n      `rm -rf -- ${shellQuote(stage)}`,\n      `mkdir -p -- ${shellQuote(`${stage}/files`)}`,\n    ].join(\"\\n\"),\n    options.commandRunner,\n  );\n\n  const environmentLines = [\n    ...Object.entries(material.environment).map(\n      ([name, value]) => `export ${name}=${shellQuote(value)}`,\n    ),\n    ...Object.entries(material.fileEnvironment).map(\n      ([name, path]) => `export ${name}=${shellQuote(`${version}/files/${path}`)}`,\n    ),\n  ];\n  await writeCredentialFile(\n    session,\n    stage,\n    \"env\",\n    environmentLines.length > 0 ? `${environmentLines.join(\"\\n\")}\\n` : \"\",\n    options.commandRunner,\n  );\n  await runCredentialCommand(\n    session,\n    `chmod -- 0600 ${shellQuote(`${stage}/env`)}`,\n    options.commandRunner,\n  );\n\n  for (const file of material.files) {\n    const directory = `${stage}/files`;\n    await runCredentialCommand(\n      session,\n      credentialFileCommand(directory, file.path, 'mkdir -p -- \"${_opengeni_credential_path%/*}\"'),\n      options.commandRunner,\n    );\n    await writeCredentialFile(session, directory, file.path, file.content, options.commandRunner);\n    await runCredentialCommand(\n      session,\n      credentialFileCommand(\n        directory,\n        file.path,\n        `chmod -- ${shellQuote(file.mode ?? \"0600\")} \"$_opengeni_credential_path\"`,\n      ),\n      options.commandRunner,\n    );\n  }\n\n  await runCredentialCommand(\n    session,\n    [\n      // Bind validated identifiers once rather than repeatedly expanding long\n      // paths through cancellation and SDK run-as shell quoting.\n      `_opengeni_credential_root=${shellQuote(root)}`,\n      `_opengeni_credential_version_name=${shellQuote(versionName)}`,\n      `_opengeni_credential_prefix=${shellQuote(prefix)}`,\n      ...pointerLockAcquireCommands(root),\n      'previous=$(cat -- \"$_opengeni_credential_root/current\" 2>/dev/null || :)',\n      'mv -- \"$_opengeni_credential_root/versions/.stage-$_opengeni_credential_version_name\" \"$_opengeni_credential_root/versions/$_opengeni_credential_version_name\"',\n      'printf \\'%s\\\\n\\' \"$_opengeni_credential_version_name\" > \"$_opengeni_credential_root/.next\"',\n      'mv -f -- \"$_opengeni_credential_root/.next\" \"$_opengeni_credential_root/current\"',\n      ...(options.prunePreviousGenerations\n        ? [\n            'find \"$_opengeni_credential_root/versions\" -mindepth 1 -maxdepth 1 ! -name \"$_opengeni_credential_version_name\" -exec rm -rf -- {} +',\n          ]\n        : options.pruneOtherAttempts\n          ? [\n              'find \"$_opengeni_credential_root/versions\" -mindepth 1 -maxdepth 1 ! -name \"${_opengeni_credential_prefix}*\" -exec rm -rf -- {} +',\n            ]\n          : options.pruneSupersededGenerations\n            ? [\n                'for candidate in \"$_opengeni_credential_root/versions/$_opengeni_credential_prefix\"*; do',\n                `  [ -e \"$candidate\" ] || continue`,\n                `  name=\\${candidate##*/}`,\n                '  [ \"$name\" = \"$_opengeni_credential_version_name\" ] || [ \"$name\" = \"$previous\" ] || rm -rf -- \"$candidate\"',\n                \"done\",\n              ]\n            : []),\n      ...pointerLockReleaseCommands(),\n    ].join(\"\\n\"),\n    options.commandRunner,\n  );\n}\n\nexport async function clearRunCredentials(\n  session: RunCredentialCommandSession,\n  sessionId: string,\n  commandRunner?: RunCredentialCommandRunner,\n): Promise<void> {\n  const root = runCredentialRoot(sessionId);\n  await runCredentialCommand(\n    session,\n    [\n      `if [ -d ${shellQuote(root)} ]; then`,\n      ...pointerLockAcquireCommands(root).map((line) => `  ${line}`),\n      `  rm -f -- ${shellQuote(`${root}/current`)} ${shellQuote(`${root}/.next`)}`,\n      `  rm -rf -- ${shellQuote(`${root}/versions`)}`,\n      ...pointerLockReleaseCommands().map((line) => `  ${line}`),\n      \"fi\",\n    ].join(\"\\n\"),\n    commandRunner,\n  );\n}\n\n/**\n * Remove only generations owned by one attempt. A successor may already have\n * atomically activated its own pointer after queue admission; this cleanup must\n * never clear or overwrite that newer generation.\n */\nexport async function clearRunCredentialsForAttempt(\n  session: RunCredentialCommandSession,\n  options: Pick<\n    MaterializeRunCredentialsOptions,\n    \"sessionId\" | \"attemptId\" | \"executionGeneration\"\n  >,\n  commandRunner?: RunCredentialCommandRunner,\n): Promise<void> {\n  const root = runCredentialRoot(options.sessionId);\n  const attemptId = assertPathIdentity(options.attemptId, \"attemptId\");\n  if (!Number.isSafeInteger(options.executionGeneration) || options.executionGeneration < 0) {\n    throw new RunCredentialValidationError(\"executionGeneration must be a non-negative integer\");\n  }\n  const prefix = `${attemptId}-${options.executionGeneration}-`;\n  await runCredentialCommand(\n    session,\n    [\n      `if [ -d ${shellQuote(root)} ]; then`,\n      ...pointerLockAcquireCommands(root).map((line) => `  ${line}`),\n      `  if [ -r ${shellQuote(`${root}/current`)} ]; then`,\n      `    current=$(cat -- ${shellQuote(`${root}/current`)} 2>/dev/null || :)`,\n      `    case \"$current\" in ${shellQuote(prefix)}*) rm -f -- ${shellQuote(`${root}/current`)} ;; esac`,\n      \"  fi\",\n      `  if [ -d ${shellQuote(`${root}/versions`)} ]; then`,\n      `    find ${shellQuote(`${root}/versions`)} -mindepth 1 -maxdepth 1 -name ${shellQuote(`${prefix}*`)} -exec rm -rf -- {} +`,\n      `    find ${shellQuote(`${root}/versions`)} -mindepth 1 -maxdepth 1 -name ${shellQuote(`.stage-${prefix}*`)} -exec rm -rf -- {} +`,\n      \"  fi\",\n      ...pointerLockReleaseCommands().map((line) => `  ${line}`),\n      \"fi\",\n    ].join(\"\\n\"),\n    commandRunner,\n  );\n}\n\n/** Prefix one sandbox command so every new process observes the active generation. */\nexport function withRunCredentialEnvironment(cmd: string, sessionId: string): string {\n  const root = runCredentialRoot(sessionId);\n  const pointerFile = runCredentialPointerFile(sessionId);\n  return [\n    `if [ -r ${shellQuote(pointerFile)} ]; then`,\n    `  _opengeni_credential_version=$(cat -- ${shellQuote(pointerFile)} 2>/dev/null || :)`,\n    '  case \"$_opengeni_credential_version\" in',\n    \"    ''|*[!A-Za-z0-9_-]*) ;;\",\n    \"    *)\",\n    `      _opengeni_credential_env=${shellQuote(`${root}/versions`)}/\"$_opengeni_credential_version/env\"`,\n    '      if [ -r \"$_opengeni_credential_env\" ]; then',\n    \"        set -a\",\n    '        . \"$_opengeni_credential_env\"',\n    \"        set +a\",\n    \"      fi\",\n    \"      unset _opengeni_credential_env\",\n    \"      ;;\",\n    \"  esac\",\n    \"  unset _opengeni_credential_version\",\n    \"fi\",\n    cmd,\n  ].join(\"\\n\");\n}\n\n/**\n * Preserve the provider session identity/capabilities while decorating only\n * command creation. Trailing invocation options stay unchanged; non-command\n * methods stay bound to the original instance.\n */\nexport function withRunCredentialsSession<T extends object>(session: T, sessionId: string): T {\n  return new Proxy(session, {\n    get(target, property, receiver) {\n      if (property === \"exec\" || property === \"execCommand\") {\n        const command = Reflect.get(target, property, target) as\n          | ((args: ExecCommandArgs, ...callArgs: unknown[]) => Promise<unknown>)\n          | undefined;\n        if (!command) return undefined;\n        return async (args: ExecCommandArgs, ...callArgs: unknown[]) =>\n          await command.call(\n            target,\n            { ...args, cmd: withRunCredentialEnvironment(args.cmd, sessionId) },\n            ...callArgs,\n          );\n      }\n      const value = Reflect.get(target, property, receiver) as unknown;\n      return typeof value === \"function\" ? value.bind(target) : value;\n    },\n  });\n}\n\n/** Decorate every client-created/resumed session after the host seeds it. */\nexport function withRunCredentialsClient(\n  client: SandboxClient,\n  sessionId: string,\n  onSessionReady?: RunCredentialSessionReady,\n): SandboxClient {\n  const decorated = new WeakMap<object, SandboxSessionLike>();\n  const wrap = async <T extends SandboxSessionLike>(session: T): Promise<T> => {\n    const existing = decorated.get(session);\n    if (existing) return existing as T;\n    await onSessionReady?.(session);\n    const wrapped = withRunCredentialsSession(session, sessionId);\n    decorated.set(session, wrapped);\n    return wrapped;\n  };\n  return {\n    backendId: client.backendId,\n    ...(client.supportsDefaultOptions !== undefined\n      ? { supportsDefaultOptions: client.supportsDefaultOptions }\n      : {}),\n    ...(client.create\n      ? {\n          create: async (...args: any[]) => await wrap(await (client.create as any)(...args)),\n        }\n      : {}),\n    ...(client.resume\n      ? {\n          resume: async (...args: any[]) => await wrap(await (client.resume as any)(...args)),\n        }\n      : {}),\n    ...(client.delete\n      ? {\n          delete: async (state: SandboxSessionState) => await client.delete!(state),\n        }\n      : {}),\n    ...(client.serializeSessionState\n      ? {\n          serializeSessionState: async (state: SandboxSessionState, options) =>\n            await client.serializeSessionState!(state, options),\n        }\n      : {}),\n    ...(client.canPersistOwnedSessionState\n      ? {\n          canPersistOwnedSessionState: async (state: SandboxSessionState) =>\n            await client.canPersistOwnedSessionState!(state),\n        }\n      : {}),\n    ...(client.canReusePreservedOwnedSession\n      ? {\n          canReusePreservedOwnedSession: async (state: SandboxSessionState) =>\n            await client.canReusePreservedOwnedSession!(state),\n        }\n      : {}),\n    ...(client.deserializeSessionState\n      ? {\n          deserializeSessionState: async (state: Record<string, unknown>) =>\n            await client.deserializeSessionState!(state),\n        }\n      : {}),\n  };\n}\n","import { createHash } from \"node:crypto\";\nimport { posix as posixPath } from \"node:path\";\nimport { managedCodemodeClientEnvironment } from \"./codemode-client\";\n\nimport type {\n  ExecCommandArgs,\n  SandboxClient,\n  SandboxSessionLike,\n  SandboxSessionState,\n} from \"@openai/agents/sandbox\";\n\nconst MAX_CODEMODE_SESSION_ID_BYTES = 512;\n\nexport class CodemodeTokenPathError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"CodemodeTokenPathError\";\n  }\n}\n\nfunction shellQuote(value: string): string {\n  return `'${value.replace(/'/g, \"'\\\\''\")}'`;\n}\n\nfunction assertCodemodeSessionId(sessionId: string): string {\n  if (\n    !sessionId ||\n    sessionId.trim() !== sessionId ||\n    new TextEncoder().encode(sessionId).byteLength > MAX_CODEMODE_SESSION_ID_BYTES ||\n    sessionId.includes(\"\\0\")\n  ) {\n    throw new CodemodeTokenPathError(\"Codemode session id is invalid\");\n  }\n  return sessionId;\n}\n\nfunction assertCodemodeFilePath(value: string, label: string): string {\n  if (!value || value.includes(\"\\0\") || !posixPath.isAbsolute(value)) {\n    throw new CodemodeTokenPathError(`${label} must be absolute`);\n  }\n  return posixPath.normalize(value);\n}\n\nexport function shellCodemodePath(value: string): string {\n  return shellQuote(assertCodemodeFilePath(value, \"Codemode token file\"));\n}\n\n/**\n * Derive the per-session token file beside the legacy manifest pointer.\n *\n * The manifest pointer stays box-global so an already-warm shared sandbox does\n * not receive an illegal environment delta. Every Opengeni command overrides\n * that pointer with this deterministic path. The hash is path hygiene and\n * avoids disclosing host/session ids in filenames; filesystem paths are not an\n * authorization boundary. The delegated bearer's session claim remains the\n * authority boundary for Codemode calls.\n */\nexport function codemodeTokenFileForSession(manifestTokenFile: string, sessionId: string): string {\n  const normalizedManifestFile = assertCodemodeFilePath(\n    manifestTokenFile,\n    \"Codemode manifest token file\",\n  );\n  const digest = createHash(\"sha256\").update(assertCodemodeSessionId(sessionId)).digest(\"hex\");\n  return posixPath.join(posixPath.dirname(normalizedManifestFile), \"codemode-tokens\", digest);\n}\n\nexport function codemodeTokenFileFromEnvironment(\n  environment: Readonly<Record<string, string>>,\n  sessionId: string,\n): string {\n  const manifestTokenFile =\n    environment.OPENGENI_CODEMODE_TOKEN_FILE ??\n    `${environment.HOME ?? \"/workspace\"}/.opengeni/codemode-token`;\n  return codemodeTokenFileForSession(manifestTokenFile, sessionId);\n}\n\n/**\n * Prefix one sandbox command with its attempt-current Codemode routing.\n *\n * The token pointer is session-specific. The URL is deliberately projected on\n * every exec too: a warm managed box keeps its baked manifest environment, but\n * the externally reachable deployment/tunnel origin may change between turns.\n * Per-command export makes a resumed box use the current route without an\n * illegal live-manifest environment mutation.\n */\nexport function withCodemodeTokenEnvironment(\n  cmd: string,\n  tokenFile: string,\n  codemodeUrl?: string,\n  clientDirectory?: string,\n): string {\n  return [\n    `export OPENGENI_CODEMODE_TOKEN_FILE=${shellCodemodePath(tokenFile)}`,\n    ...(codemodeUrl ? [`export OPENGENI_CODEMODE_URL=${shellQuote(codemodeUrl)}`] : []),\n    ...(clientDirectory ? managedCodemodeClientEnvironment(clientDirectory) : []),\n    cmd,\n  ].join(\"\\n\");\n}\n\n/** Decorate command creation without changing identity, capabilities or trailing options. */\nexport function withCodemodeTokenSession<T extends object>(\n  session: T,\n  tokenFile: string,\n  codemodeUrl?: string,\n  clientDirectory?: string,\n): T {\n  return new Proxy(session, {\n    get(target, property, receiver) {\n      if (property === \"exec\" || property === \"execCommand\") {\n        const command = Reflect.get(target, property, target) as\n          | ((args: ExecCommandArgs, ...callArgs: unknown[]) => Promise<unknown>)\n          | undefined;\n        if (!command) return undefined;\n        return async (args: ExecCommandArgs, ...callArgs: unknown[]) =>\n          await command.call(\n            target,\n            {\n              ...args,\n              cmd: withCodemodeTokenEnvironment(args.cmd, tokenFile, codemodeUrl, clientDirectory),\n            },\n            ...callArgs,\n          );\n      }\n      const value = Reflect.get(target, property, receiver) as unknown;\n      return typeof value === \"function\" ? value.bind(target) : value;\n    },\n  });\n}\n\n/** Decorate every client-created/resumed session with one session pointer. */\nexport function withCodemodeTokenClient(\n  client: SandboxClient,\n  tokenFile: string,\n  codemodeUrl?: string,\n  clientDirectory?: string,\n): SandboxClient {\n  const decorated = new WeakMap<object, SandboxSessionLike>();\n  const wrap = <T extends SandboxSessionLike>(session: T): T => {\n    const existing = decorated.get(session);\n    if (existing) return existing as T;\n    const wrapped = withCodemodeTokenSession(session, tokenFile, codemodeUrl, clientDirectory);\n    decorated.set(session, wrapped);\n    return wrapped;\n  };\n  return {\n    backendId: client.backendId,\n    ...(client.supportsDefaultOptions !== undefined\n      ? { supportsDefaultOptions: client.supportsDefaultOptions }\n      : {}),\n    ...(client.create\n      ? { create: async (...args: any[]) => wrap(await (client.create as any)(...args)) }\n      : {}),\n    ...(client.resume\n      ? { resume: async (...args: any[]) => wrap(await (client.resume as any)(...args)) }\n      : {}),\n    ...(client.delete\n      ? { delete: async (state: SandboxSessionState) => await client.delete!(state) }\n      : {}),\n    ...(client.serializeSessionState\n      ? {\n          serializeSessionState: async (state: SandboxSessionState, options) =>\n            await client.serializeSessionState!(state, options),\n        }\n      : {}),\n    ...(client.canPersistOwnedSessionState\n      ? {\n          canPersistOwnedSessionState: async (state: SandboxSessionState) =>\n            await client.canPersistOwnedSessionState!(state),\n        }\n      : {}),\n    ...(client.canReusePreservedOwnedSession\n      ? {\n          canReusePreservedOwnedSession: async (state: SandboxSessionState) =>\n            await client.canReusePreservedOwnedSession!(state),\n        }\n      : {}),\n    ...(client.deserializeSessionState\n      ? {\n          deserializeSessionState: async (state: Record<string, unknown>) =>\n            await client.deserializeSessionState!(state),\n        }\n      : {}),\n  } as SandboxClient;\n}\n","import { createHash, randomUUID } from \"node:crypto\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { dirname, join, posix, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport type { SandboxSessionLike } from \"@openai/agents/sandbox\";\nimport { sandboxCommandExitCode } from \"./command-result\";\n\n/** Data shipped with the worker, never fetched from a package registry at turn time. */\nexport type ManagedCodemodeClient = {\n  version: 1;\n  files: { ogtool: string; \"client.mjs\": string; \"package.json\": string };\n};\n\nexport function managedCodemodeClientDigest(client: ManagedCodemodeClient): string {\n  return createHash(\"sha256\").update(JSON.stringify(client)).digest(\"hex\");\n}\n\nexport function managedCodemodeClientDirectory(\n  client: ManagedCodemodeClient,\n  workspaceRoot = \"/workspace\",\n): string {\n  if (!posix.isAbsolute(workspaceRoot) || workspaceRoot.includes(\"\\0\")) {\n    throw new Error(\"Managed Codemode client workspace root must be absolute\");\n  }\n  return posix.join(\n    workspaceRoot,\n    \".opengeni/codemode-clients\",\n    managedCodemodeClientDigest(client),\n  );\n}\n\nexport async function buildManagedCodemodeClient(root: string): Promise<ManagedCodemodeClient> {\n  const bundle = async (entry: string, format: \"esm\" | \"cjs\", banner?: string) => {\n    const result = await Bun.build({\n      entrypoints: [join(root, entry)],\n      target: \"node\",\n      format,\n      minify: true,\n      sourcemap: \"none\",\n      ...(banner ? { banner } : {}),\n    });\n    if (!result.success || result.outputs.length !== 1) {\n      throw new Error(`Managed Codemode client build failed: ${entry}`);\n    }\n    return await result.outputs[0]!.text();\n  };\n  return {\n    version: 1,\n    files: {\n      ogtool: await bundle(\"packages/ogtool/src/cli.ts\", \"cjs\", \"#!/usr/bin/env node\"),\n      \"client.mjs\": await bundle(\"packages/codemode/src/index.ts\", \"esm\"),\n      // The extensionless executable must not inherit a user's ESM workspace.\n      \"package.json\": '{\"type\":\"commonjs\"}\\n',\n    },\n  };\n}\n\nlet releaseClient: Promise<ManagedCodemodeClient> | undefined;\nexport function loadManagedCodemodeClient(): Promise<ManagedCodemodeClient> {\n  return (releaseClient ??= (async () => {\n    const moduleDir = dirname(fileURLToPath(import.meta.url));\n    // A checkout must not reuse stale dist assets after source changes.\n    const root = resolve(moduleDir, \"../../../..\");\n    if (\n      import.meta.url.endsWith(\"/src/sandbox/codemode-client.ts\") &&\n      existsSync(join(root, \"packages/ogtool/src/cli.ts\"))\n    ) {\n      return await buildManagedCodemodeClient(root);\n    }\n    const candidates = [\n      join(moduleDir, \"assets/codemode-client.json\"),\n      join(moduleDir, \"../assets/codemode-client.json\"),\n      join(moduleDir, \"../../dist/assets/codemode-client.json\"),\n    ];\n    for (const path of candidates) {\n      if (!existsSync(path)) continue;\n      const value = JSON.parse(readFileSync(path, \"utf8\")) as ManagedCodemodeClient;\n      if (\n        !value ||\n        typeof value !== \"object\" ||\n        value.version !== 1 ||\n        Object.keys(value).sort().join(\",\") !== \"files,version\" ||\n        typeof value.files?.ogtool !== \"string\" ||\n        typeof value.files?.[\"client.mjs\"] !== \"string\" ||\n        value.files?.[\"package.json\"] !== '{\"type\":\"commonjs\"}\\n' ||\n        Object.keys(value.files).sort().join(\",\") !== \"client.mjs,ogtool,package.json\"\n      ) {\n        throw new Error(\n          \"Invalid deployment-owned managed Codemode client asset; rebuild the worker release\",\n        );\n      }\n      return value;\n    }\n    // Published runtimes must carry their own exact bytes.\n    throw new Error(\n      \"Managed Codemode client asset missing; rebuild and deploy the matching worker/runtime package (do not install latest or replace the sandbox)\",\n    );\n  })());\n}\n\nfunction quote(value: string): string {\n  return `'${value.replace(/'/g, \"'\\\\''\")}'`;\n}\n\n/** Immutable per-release paths permit old/new workers to share a warm box. */\nexport async function installManagedCodemodeClient(\n  session: SandboxSessionLike,\n  client: ManagedCodemodeClient,\n  run: (cmd: string) => Promise<unknown>,\n  runAs?: string,\n  workspaceRoot = \"/workspace\",\n): Promise<void> {\n  const directory = managedCodemodeClientDirectory(client, workspaceRoot);\n  const digest = managedCodemodeClientDigest(client);\n  const verify = `\nconst fs = require('node:fs'), crypto = require('node:crypto');\nconst root = ${JSON.stringify(directory)};\nif (!fs.lstatSync(root).isDirectory()) process.exit(1);\nfor (const name of ['ogtool', 'client.mjs', 'package.json']) {\n  if (!fs.lstatSync(root + '/' + name).isFile()) process.exit(1);\n}\nfs.accessSync(root + '/ogtool', fs.constants.X_OK);\nconst files = {ogtool: fs.readFileSync(root + '/ogtool', 'utf8'), 'client.mjs': fs.readFileSync(root + '/client.mjs', 'utf8'), 'package.json': fs.readFileSync(root + '/package.json', 'utf8')};\nif (crypto.createHash('sha256').update(JSON.stringify({version: 1, files})).digest('hex') !== ${JSON.stringify(digest)}) process.exit(1);\n`;\n  if (sandboxCommandExitCode(await run(`node -e ${quote(verify)} 2>/dev/null`)) === 0) return;\n  const editor = session.createEditor?.(runAs);\n  if (!editor)\n    throw new Error(\n      \"Managed Codemode client delivery requires sandbox file ingress; update the sandbox provider adapter\",\n    );\n  const stage = `${posix.dirname(directory)}/stage-${randomUUID()}.json`;\n  let installationFailure: { error: unknown } | undefined;\n  try {\n    await editor.createFile({\n      type: \"create_file\",\n      path: stage,\n      diff: `+${JSON.stringify(client)}`,\n    });\n    const install = `\nconst fs = require('node:fs'), crypto = require('node:crypto');\nconst raw = fs.readFileSync(${JSON.stringify(stage)}, 'utf8').trim();\nif (crypto.createHash('sha256').update(raw).digest('hex') !== ${JSON.stringify(digest)}) throw Error('Codemode client transfer integrity failure');\nconst data = JSON.parse(raw), root = ${JSON.stringify(directory)};\nfs.mkdirSync(root, {recursive: true});\nif (!fs.lstatSync(root).isDirectory()) throw Error('Codemode client directory must not be a symlink');\nfor (const name of ['package.json', 'ogtool', 'client.mjs']) {\n  const tmp = root + '/' + name + '.' + crypto.randomUUID();\n  fs.writeFileSync(tmp, data.files[name], {mode: 0o755, flag: 'wx'});\n  fs.renameSync(tmp, root + '/' + name);\n}\n`;\n    const result = await run(`node -e ${quote(install)} && node -e ${quote(verify)}`);\n    if (sandboxCommandExitCode(result) !== 0) {\n      throw new Error(\n        \"Managed Codemode client delivery failed; verify Node and sandbox file ingress, then retry with the same worker release\",\n      );\n    }\n  } catch (error) {\n    installationFailure = { error };\n  }\n  try {\n    await editor.deleteFile({ type: \"delete_file\", path: stage });\n  } catch {\n    // A provider can support ingress but lose its delete reply. Remove only\n    // this exact attempt's staging file, through the same command fence.\n    try {\n      const cleanup = await run(\n        `node -e ${quote(`require('node:fs').rmSync(${JSON.stringify(stage)}, {force: true})`)}`,\n      );\n      if (sandboxCommandExitCode(cleanup) !== 0) {\n        throw new Error(\"Staging file removal failed\");\n      }\n    } catch {\n      // This file contains only immutable, non-secret release bytes. Failed\n      // housekeeping cannot invalidate a verified install or wrap its original\n      // delivery error (especially pre-dispatch/outcome-unknown provenance).\n      // Log one bounded identity, never provider errors, output, or client bytes.\n      try {\n        console.warn(\n          \"Managed Codemode client staging cleanup failed; installation result preserved\",\n          {\n            stageFile: posix.basename(stage),\n            installation: installationFailure ? \"failed\" : \"verified\",\n          },\n        );\n      } catch {\n        // Diagnostics must not change the installation result either.\n      }\n    }\n  }\n  if (installationFailure) throw installationFailure.error;\n}\n\nexport function managedCodemodeClientEnvironment(directory: string): string[] {\n  return [\n    // A routing proxy can switch to a Connected Machine during the attempt.\n    // Its native client is projected by the connection-bound exec transport.\n    'if [ -z \"${OPENGENI_CODEMODE_NATIVE_CLIENT:-}\" ]; then',\n    `  export PATH=${quote(directory)}:\"$PATH\"`,\n    `  export OPENGENI_CODEMODE_CLIENT_MODULE=${quote(`${directory}/client.mjs`)}`,\n    \"else\",\n    \"  unset OPENGENI_CODEMODE_CLIENT_MODULE\",\n    \"fi\",\n  ];\n}\n","import { resolveFirstPartyDelegationSecret, type Settings } from \"@opengeni/config\";\nimport { signDelegatedAccessToken } from \"@opengeni/contracts\";\n\nexport const CODEMODE_TOKEN_TTL_SECONDS = 60 * 60;\n\nexport type CodemodeAuthorityScope = {\n  accountId: string;\n  workspaceId: string;\n};\n\nexport type SandboxCodemodeAuthority = {\n  sessionId: string;\n  turnId: string;\n  attemptId: string;\n  executionGeneration: number;\n  credentialRestriction?: \"developer_setup\";\n};\n\nexport type MintedSandboxCodemodeToken = {\n  token: string;\n  expiresAt: Date;\n};\n\n/**\n * Mint the one canonical exact-attempt Codemode bearer used by every compute\n * placement. Delivery is deliberately a separate concern: managed sandboxes\n * rotate it through a private file, while Connected Machines receive it only\n * in the environment of an authorized child process.\n */\nexport async function mintSandboxCodemodeToken(\n  settings: Settings,\n  scope: CodemodeAuthorityScope,\n  authority: SandboxCodemodeAuthority,\n  nowMs = Date.now(),\n): Promise<MintedSandboxCodemodeToken | undefined> {\n  const delegationSecret = resolveFirstPartyDelegationSecret(settings);\n  if (!delegationSecret) return undefined;\n  const expiresAtSeconds = Math.floor(nowMs / 1000) + CODEMODE_TOKEN_TTL_SECONDS;\n  const token = await signDelegatedAccessToken(delegationSecret, {\n    accountId: scope.accountId,\n    workspaceId: scope.workspaceId,\n    subjectId: `sandbox:${authority.attemptId}`,\n    subjectLabel: \"sandbox Codemode\",\n    permissions: [\"codemode:call\"],\n    sessionId: authority.sessionId,\n    turnId: authority.turnId,\n    attemptId: authority.attemptId,\n    executionGeneration: authority.executionGeneration,\n    ...(authority.credentialRestriction\n      ? { credentialRestriction: authority.credentialRestriction }\n      : {}),\n    principalKind: \"agent_attempt\",\n    exp: expiresAtSeconds,\n  });\n  return { token, expiresAt: new Date(expiresAtSeconds * 1000) };\n}\n","// @opengeni/runtime/sandbox — explicit desktop recording primitives.\n//\n// ffmpeg x11grab on :0 → mp4/webm artifact on the box → direct scoped PUT to\n// object storage → recording.available. ffmpeg reads exactly the :0 framebuffer\n// watched over Channel B (zero projection).\n//\n// These are PLAIN functions over a live, externally-owned session handle — NO\n// Temporal, NO worker RPC, NO actor. They live in the agent-loop-free leaf so the\n// SAME process that already holds the resumed-by-id box for an explicit manual or\n// on-verify capture authorizes a direct box-to-storage upload. Recording bytes never\n// enter worker memory or a Temporal payload (F10).\n//\n// ── Adversarial-review fixes folded in (module 05 §Adversarial) ──────────────\n//   F1  exec is OPTIONAL on Modal (only execCommand) — every command dual-paths.\n//   F3  exec/execCommand YIELDS — the stop and direct-upload commands are bounded.\n//   F8  size is gated on the box first (stat); over-limit artifacts fail instead\n//       of being uploaded partially.\n//   FR  curl reads the absolute /tmp artifact in the box and sends it directly to\n//       the short-lived scoped URL. No workspace-root read API is involved.\n//   F9  the box file is deleted ONLY after the storage PUT confirms — never\n//       before (so a failed upload leaves the bytes recoverable for a retry).\n//   F12 ffmpeg/x11vnc backgrounding does not block the yield (nohup … & echo $!).\n//   F14 duration is computed from wall-clock (stop − start), not assumed.\n\nimport { DESKTOP_STREAM_PORT } from \"@opengeni/contracts\";\n\nexport { DESKTOP_STREAM_PORT };\n\nexport type RecordingCodec = \"h264-mp4\" | \"vp9-webm\";\nexport type RecordingContentType = \"video/mp4\" | \"video/webm\";\n\nconst DEFAULT_MAX_SECONDS = 600; // 10 min hard ceiling (the -t bound)\nconst DEFAULT_FRAMERATE = 15;\nconst DEFAULT_MAX_BYTES = 268_435_456; // 256 MB\nconst DEFAULT_DIMENSIONS: [number, number] = [1280, 800];\n// The SIGINT-and-wait loop is bounded well under the command yield window (F3).\nconst STOP_YIELD_MS = 20_000;\nconst EXEC_YIELD_MS = 15_000;\n\nexport function contentTypeForCodec(codec: RecordingCodec): RecordingContentType {\n  return codec === \"vp9-webm\" ? \"video/webm\" : \"video/mp4\";\n}\nexport function extForCodec(codec: RecordingCodec): string {\n  return codec === \"vp9-webm\" ? \"webm\" : \"mp4\";\n}\n\n/** No exec/execCommand on the session — the box cannot run ffmpeg. */\nexport class RecordingUnavailableError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"RecordingUnavailableError\";\n  }\n}\n/** ffmpeg failed, the file is missing, or the artifact is over its size limit. */\nexport class RecordingError extends Error {\n  constructor(\n    message: string,\n    readonly reason: \"ffmpeg-error\" | \"box-death\" | \"max-bytes-exceeded\" | \"display-unavailable\",\n  ) {\n    super(message);\n    this.name = \"RecordingError\";\n  }\n}\n\n// The structural slice of a provider session the recording loop drives. exec and\n// execCommand are optional (Modal has only execCommand — F1).\ntype ExecResultLike = {\n  output?: string;\n  stdout?: string;\n  stderr?: string;\n  exitCode?: number | null;\n  sessionId?: number;\n};\ntype RecordingSession = {\n  exec?: (args: {\n    cmd: string;\n    runAs?: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n  }) => Promise<ExecResultLike>;\n  execCommand?: (args: {\n    cmd: string;\n    runAs?: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n  }) => Promise<string>;\n};\n\nfunction shq(s: string): string {\n  return `'${s.replace(/'/g, `'\\\\''`)}'`;\n}\n\nfunction resultOutput(result: ExecResultLike | string): string {\n  if (typeof result === \"string\") return result;\n  return [result.output, result.stderr, result.stdout]\n    .filter((v): v is string => typeof v === \"string\" && v.length > 0)\n    .join(\"\\n\");\n}\n\n// Default per-command output cap (tokens). Recording transfer does not use stdout.\nconst DEFAULT_MAX_OUTPUT_TOKENS = 4_000;\n\nasync function run(\n  session: RecordingSession,\n  cmd: string,\n  runAs?: string,\n  yieldTimeMs = EXEC_YIELD_MS,\n  maxOutputTokens = DEFAULT_MAX_OUTPUT_TOKENS,\n): Promise<string> {\n  const args: {\n    cmd: string;\n    runAs?: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n  } = { cmd, ...(runAs ? { runAs } : {}), yieldTimeMs, maxOutputTokens };\n  if (typeof session.exec === \"function\") {\n    return resultOutput(await session.exec(args));\n  }\n  if (typeof session.execCommand === \"function\") {\n    return resultOutput(await session.execCommand(args));\n  }\n  throw new RecordingUnavailableError(\n    \"session cannot run commands (no exec/execCommand) — recording unavailable\",\n  );\n}\n\n// Extract the command body from a provider exec banner. Modal's execCommand\n// returns \"<chunk banner>\\nProcess exited…\\nOutput:\\n<body>\"; the body is what\n// follows the last \"Output:\\n\" marker. Plain exec results (no banner) pass\n// through unchanged.\nfunction stripExecBanner(raw: string): string {\n  const marker = raw.lastIndexOf(\"\\nOutput:\\n\");\n  if (marker >= 0) return raw.slice(marker + \"\\nOutput:\\n\".length);\n  if (raw.startsWith(\"Output:\\n\")) return raw.slice(\"Output:\\n\".length);\n  return raw;\n}\n\nexport type StartRecordingInput = {\n  recordingId: string;\n  codec?: RecordingCodec;\n  framerate?: number;\n  maxSeconds?: number;\n  dimensions?: [number, number];\n  display?: string; // \":0\"\n  runAs?: string;\n  tmpDir?: string; // \"/tmp\"\n};\n\nexport type RecordingProcess = {\n  recordingId: string;\n  codec: RecordingCodec;\n  boxPath: string;\n  pidFile: string;\n  dimensions: [number, number];\n  framerate: number;\n  /** epoch-ms when ffmpeg was launched (for duration computation, F14). */\n  startedAt: number;\n  display: string;\n  runAs?: string;\n};\n\n/**\n * Launch ffmpeg x11grab on :0 → an mp4/webm file on the box. Backgrounded with\n * `nohup … & echo $!` so the launch returns immediately (F12 — the exec does not\n * block on the recording). A hard `-t <maxSeconds>` ceiling bounds a runaway file\n * across a multi-day turn. Returns the handle the caller carries to stop+finalize.\n */\nexport async function startRecording(\n  session: unknown,\n  input: StartRecordingInput,\n): Promise<RecordingProcess> {\n  const s = session as RecordingSession;\n  const codec = input.codec ?? \"h264-mp4\";\n  const dimensions = input.dimensions ?? DEFAULT_DIMENSIONS;\n  const framerate = input.framerate ?? DEFAULT_FRAMERATE;\n  const maxSeconds = input.maxSeconds ?? DEFAULT_MAX_SECONDS;\n  const display = input.display ?? \":0\";\n  const tmp = input.tmpDir ?? \"/tmp\";\n  const ext = extForCodec(codec);\n  const boxPath = `${tmp}/og-rec-${input.recordingId}.${ext}`;\n  const pidFile = `${tmp}/og-rec-${input.recordingId}.pid`;\n  const logFile = `${tmp}/og-rec-${input.recordingId}.log`;\n  const [w, h] = dimensions;\n  const enc =\n    codec === \"vp9-webm\"\n      ? `-c:v libvpx-vp9 -b:v 0 -crf 32 -row-mt 1`\n      : `-c:v libx264 -preset veryfast -pix_fmt yuv420p -movflags +faststart`;\n  const ffmpeg =\n    `nohup ffmpeg -hide_banner -loglevel error -f x11grab -draw_mouse 1 -framerate ${framerate} ` +\n    `-video_size ${w}x${h} -i ${display}.0 -t ${maxSeconds} ${enc} ${boxPath} ` +\n    `</dev/null >${logFile} 2>&1 & echo $! > ${pidFile}`;\n  await run(s, `bash -lc ${shq(ffmpeg)}`, input.runAs);\n  return {\n    recordingId: input.recordingId,\n    codec,\n    boxPath,\n    pidFile,\n    dimensions,\n    framerate,\n    startedAt: Date.now(),\n    display,\n    ...(input.runAs ? { runAs: input.runAs } : {}),\n  };\n}\n\n/**\n * SIGINT ffmpeg (so it writes a clean moov atom / webm trailer) and wait for the\n * pid to exit. Bounded well under the yield window (F3). Idempotent: a missing\n * pid file is a no-op.\n */\nexport async function stopRecording(session: unknown, proc: RecordingProcess): Promise<void> {\n  const s = session as RecordingSession;\n  const wait = `kill -INT \"$(cat ${proc.pidFile})\" 2>/dev/null; for i in $(seq 1 80); do kill -0 \"$(cat ${proc.pidFile})\" 2>/dev/null || break; sleep 0.1; done`;\n  await run(s, `bash -lc ${shq(wait)}`, proc.runAs, STOP_YIELD_MS).catch(() => undefined);\n}\n\nexport type RecordingArtifactMetadata = {\n  contentType: RecordingContentType;\n  sizeBytes: number;\n  durationSeconds: number;\n};\n\n/**\n * Inspect and size-gate the finalized recording while it is still on the box.\n * No recording bytes cross into the worker process.\n */\nexport async function inspectRecordingArtifact(\n  session: unknown,\n  proc: RecordingProcess,\n  maxBytes = DEFAULT_MAX_BYTES,\n): Promise<RecordingArtifactMetadata> {\n  const s = session as RecordingSession;\n  if (typeof s.exec !== \"function\" && typeof s.execCommand !== \"function\") {\n    throw new RecordingUnavailableError(\n      \"session cannot run commands (no exec/execCommand) — recording finalize unavailable\",\n    );\n  }\n  // F8: size-gate on the box before authorizing the upload.\n  const sizeOut = (\n    await run(\n      s,\n      `bash -lc ${shq(`stat -c %s ${proc.boxPath} 2>/dev/null || echo MISSING`)}`,\n      proc.runAs,\n    )\n  ).trim();\n  const sizeLine =\n    sizeOut\n      .split(\"\\n\")\n      .map((l) => l.trim())\n      .filter(Boolean)\n      .pop() ?? \"MISSING\";\n  if (sizeLine === \"MISSING\" || sizeLine === \"\") {\n    throw new RecordingError(`recording file missing on box: ${proc.boxPath}`, \"box-death\");\n  }\n  const size = Number(sizeLine);\n  if (!Number.isFinite(size) || size <= 0) {\n    throw new RecordingError(`recording file empty on box: ${proc.boxPath}`, \"ffmpeg-error\");\n  }\n  if (size > maxBytes) {\n    throw new RecordingError(`recording ${size}B exceeds max ${maxBytes}B`, \"max-bytes-exceeded\");\n  }\n  return {\n    contentType: contentTypeForCodec(proc.codec),\n    sizeBytes: size,\n    durationSeconds: Math.max(0, Math.round((Date.now() - proc.startedAt) / 1000)),\n  };\n}\n\nconst RECORDING_UPLOAD_OK = \"OPENGENI_RECORDING_UPLOAD_OK\";\nconst RECORDING_UPLOAD_MAX_SECONDS = 300;\n\n/**\n * Upload the finalized artifact directly from the sandbox to a scoped object-\n * storage URL. The worker carries only the short URL/headers and metadata; it\n * never materializes a base64 string or Uint8Array for a recording that may be\n * hundreds of megabytes. curl's success marker makes an exec transport that\n * returns non-zero command output instead of throwing still fail closed.\n */\nexport async function uploadRecordingArtifact(\n  session: unknown,\n  proc: RecordingProcess,\n  input: {\n    url: string;\n    requiredHeaders: Record<string, string>;\n    maxBytes?: number;\n    maxSeconds?: number;\n  },\n): Promise<RecordingArtifactMetadata> {\n  const maxSeconds = input.maxSeconds ?? RECORDING_UPLOAD_MAX_SECONDS;\n  if (!Number.isSafeInteger(maxSeconds) || maxSeconds <= 0 || maxSeconds > 300) {\n    throw new Error(\"recording upload maxSeconds must be an integer between 1 and 300\");\n  }\n  const metadata = await inspectRecordingArtifact(session, proc, input.maxBytes);\n  const headers = Object.entries(input.requiredHeaders)\n    .sort(([left], [right]) => left.localeCompare(right))\n    .map(([name, value]) => `--header ${shq(`${name}: ${value}`)}`)\n    .join(\" \");\n  const upload = [\n    \"set -euo pipefail\",\n    `curl --fail --silent --show-error --connect-timeout 20 --max-time ${maxSeconds} --request PUT ${headers} --upload-file ${shq(proc.boxPath)} ${shq(input.url)}`,\n    `printf '${RECORDING_UPLOAD_OK}\\\\n'`,\n  ].join(\"; \");\n  const output = stripExecBanner(\n    await run(\n      session as RecordingSession,\n      `bash -lc ${shq(upload)}`,\n      proc.runAs,\n      (maxSeconds + 10) * 1_000,\n    ),\n  );\n  if (!output.includes(RECORDING_UPLOAD_OK)) {\n    throw new Error(\"recording upload did not confirm success\");\n  }\n  return metadata;\n}\n\n/**\n * Delete the box artifacts. F9: call this ONLY after the storage PUT confirmed\n * and the `available` row committed — never before. Best-effort; never throws.\n */\nexport async function deleteRecordingArtifacts(\n  session: unknown,\n  proc: RecordingProcess,\n): Promise<void> {\n  const s = session as RecordingSession;\n  const logFile = proc.boxPath.replace(/\\.(mp4|webm)$/, \".log\");\n  await run(s, `rm -f ${proc.boxPath} ${proc.pidFile} ${logFile}`, proc.runAs).catch(\n    () => undefined,\n  );\n}\n\n/** The storage object key for a recording artifact (parallels the file-asset layout). */\nexport function recordingStorageKey(\n  workspaceId: string,\n  sessionId: string,\n  recordingId: string,\n  codec: RecordingCodec,\n): string {\n  return `recordings/${workspaceId}/${sessionId}/${recordingId}.${extForCodec(codec)}`;\n}\n","// Selfhosted capability negotiation (M3, item 4).\n//\n// `negotiateSelfhostedCapabilities` resolves the selfhosted-specific cells from\n//   (a) the M2 enrollment row (consent / display / status / lastSeenAt), and\n//   (b) a LIVENESS PROBE (a `ControlRpc` Ping, mockable) — \"is there a responder\n//       on the subject right now?\"\n// into the right `SessionCapabilities` cells with the selfhosted reasons:\n//   - online              → responder + consented: cells available.\n//   - offline             → no enrollment / revoked / no responder: agent_offline.\n//   - reconnecting        → a transient blip (a recent lastSeenAt but the probe\n//                           missed): agent_reconnecting.\n//   - consent_required    → enrolled but whole-machine / screen-control not acked:\n//                           the interactive desktop stream becomes read-only.\n//   - display_unavailable → online but the machine has no display (headless, no\n//                           Xvfb): desktop and recording degrade with\n//                           display_unavailable.\n//\n// It REUSES `negotiateCapabilities` for the descriptor-shaped cells (so the\n// \"every cell present, degradation is a value\" rule and the FS/Terminal/Git\n// surface stay identical to Modal), then overlays the selfhosted liveness/consent\n// /display reasons. The base function stays pure + synchronous; this is the\n// selfhosted-aware entrypoint the API/worker call.\n\nimport type {\n  CapabilityUnavailableReason,\n  SandboxOs,\n  SessionCapabilities,\n} from \"@opengeni/contracts\";\nimport { negotiateCapabilities, type NegotiationContext } from \"../select\";\nimport type { SelfhostedSession } from \"./session\";\n\n/**\n * The structural slice of the M2 `@opengeni/db` `EnrollmentRecord` the selfhosted\n * negotiation reads. Defined STRUCTURALLY (not imported from `@opengeni/db`) so\n * the agent-loop-free sandbox leaf does not couple to the DB package's graph —\n * the API/worker pass an `EnrollmentRecord`, which satisfies this shape. The\n * fields: `status` (active gates reachability), `exposure` +\n * `allowScreenControl` (whole-machine + screen-control consent),`hasDisplay`\n * (the display plane), `lastSeenAt` (the reconnecting-window disambiguator).\n */\nexport interface SelfhostedEnrollment {\n  status: string;\n  exposure: string;\n  allowScreenControl: boolean;\n  hasDisplay: boolean;\n  /** Exact normalized launch root persisted from the authoritative Hello. */\n  workspaceRoot?: string | null;\n  lastSeenAt: string | null;\n  /** An un-cleared clean going-offline marker (the machine announced a typed\n   *  GoingOffline). When set, the derivation reads the machine OFFLINE immediately,\n   *  regardless of a still-fresh `lastSeenAt`. NULL ⇒ no pending goodbye. */\n  wentOfflineAt: string | null;\n  /** The typed reason string of the pending goodbye (rides alongside\n   *  `wentOfflineAt`; NULL when there is no un-cleared marker). */\n  wentOfflineReason: string | null;\n}\n\n/** The derived liveness state of a selfhosted machine (the online/offline/\n *  reconnecting/consent/display matrix). */\nexport interface SelfhostedLivenessState {\n  /** The dominant machine state. */\n  state: \"online\" | \"reconnecting\" | \"offline\";\n  /** Whole-machine + screen-control consent acknowledged (gates desktop input). */\n  consented: boolean;\n  /** A display (real or Xvfb) is present (gates the desktop pixel plane). */\n  hasDisplay: boolean;\n}\n\n/**\n * The window after `lastSeenAt` within which a missed liveness probe is read as a\n * transient BLIP (`reconnecting`) rather than a hard `offline`. Mirrors the\n * resiliency model (§10.6: reconnecting after 1 missed window, offline after\n * ~30s). A probe miss with a lastSeenAt inside this window → reconnecting.\n */\nexport const SELFHOSTED_RECONNECT_WINDOW_MS = 30_000;\n\n/**\n * Derive the selfhosted liveness state from the enrollment row + a liveness probe\n * outcome. The probe is the authoritative \"is the agent answering NOW\" signal;\n * `lastSeenAt` disambiguates a probe-miss into reconnecting (recent) vs offline\n * (stale / never seen).\n *\n *   - no enrollment / revoked         → offline (the machine isn't enrolled).\n *   - un-cleared clean goodbye        → offline (an announced GoingOffline beats\n *                                       last_seen aging AND a lingering probe).\n *   - probe responded                 → online.\n *   - probe missed, lastSeenAt recent → reconnecting (a transient blip).\n *   - probe missed, lastSeenAt stale  → offline.\n */\nexport function selfhostedLiveness(input: {\n  enrollment: SelfhostedEnrollment | null;\n  /** The ControlRpc Ping outcome: true iff a responder answered. */\n  probeResponded: boolean;\n  /** Override the clock (tests). */\n  now?: Date;\n}): SelfhostedLivenessState {\n  const { enrollment } = input;\n  if (!enrollment || enrollment.status !== \"active\") {\n    return { state: \"offline\", consented: false, hasDisplay: false };\n  }\n  const consented = enrollment.exposure === \"whole-machine\" && enrollment.allowScreenControl;\n  const hasDisplay = enrollment.hasDisplay;\n  // A CLEAN going-offline the machine announced takes precedence over BOTH\n  // last_seen aging and a lingering probe: a machine that said \"I'm stopping\" must\n  // read offline immediately (so no new work is routed at it) until a NEWER\n  // liveness signal — a reconnect Hello or a fresher heartbeat — clears the marker\n  // in the row. `status: \"revoked\"` above still trumps this (a revoked machine is\n  // offline regardless). This is the #348 lease-waits-on-dead-detect fix.\n  if (enrollment.wentOfflineAt) {\n    return { state: \"offline\", consented, hasDisplay };\n  }\n  if (input.probeResponded) {\n    return { state: \"online\", consented, hasDisplay };\n  }\n  // Probe missed → reconnecting if we saw it recently, else offline.\n  const now = (input.now ?? new Date()).getTime();\n  const lastSeen = enrollment.lastSeenAt ? new Date(enrollment.lastSeenAt).getTime() : null;\n  if (lastSeen !== null && now - lastSeen <= SELFHOSTED_RECONNECT_WINDOW_MS) {\n    return { state: \"reconnecting\", consented, hasDisplay };\n  }\n  return { state: \"offline\", consented, hasDisplay };\n}\n\n/**\n * Dashboard/list liveness: heartbeat + goodbye only. Fresh `lastSeenAt` (inside\n * the reconnect window) is online. There is no ControlRpc ping here — attach,\n * capability negotiation, and fleet tools still probe when they must know\n * whether a responder is answering now.\n */\nexport function selfhostedHeartbeatLiveness(input: {\n  enrollment: SelfhostedEnrollment | null;\n  now?: Date;\n}): SelfhostedLivenessState {\n  const { enrollment } = input;\n  if (!enrollment || enrollment.status !== \"active\") {\n    return { state: \"offline\", consented: false, hasDisplay: false };\n  }\n  const now = input.now ?? new Date();\n  const lastSeen = enrollment.lastSeenAt ? new Date(enrollment.lastSeenAt).getTime() : null;\n  const heartbeatFresh =\n    lastSeen !== null && now.getTime() - lastSeen <= SELFHOSTED_RECONNECT_WINDOW_MS;\n  return selfhostedLiveness({\n    enrollment,\n    probeResponded: heartbeatFresh,\n    now,\n  });\n}\n\nexport interface SelfhostedNegotiationInput {\n  sessionId: string;\n  os?: SandboxOs;\n  leaseEpoch: number;\n  /** The M2 enrollment row for the machine (null → never enrolled → offline). */\n  enrollment: SelfhostedEnrollment | null;\n  /** A live liveness probe — typically `session.ping()`. When a session is\n   *  provided this is called; otherwise pass `probeResponded` explicitly. */\n  session?: Pick<SelfhostedSession, \"ping\">;\n  /** Explicit probe outcome (when no session is given, e.g. a pure read). */\n  probeResponded?: boolean;\n  /** The deployment desktop/terminal policy toggles (threaded through to the\n   *  base negotiation). */\n  desktopEnabled?: boolean;\n  desktopInteractive?: boolean;\n  terminalEnabled?: boolean;\n  streamTokenSecretAvailable?: boolean;\n  /** Whether the calling principal acknowledged the un-redacted desktop. */\n  desktopAcknowledged?: boolean;\n  shared?: boolean;\n  sharedSessionIds?: string[];\n  /** Override the clock (tests). */\n  now?: Date;\n}\n\n/**\n * Negotiate the full `SessionCapabilities` document for a selfhosted machine,\n * with the online/offline/reconnecting/consent_required/display_unavailable cells\n * correctly decided. Async because it issues the liveness probe.\n */\nexport async function negotiateSelfhostedCapabilities(\n  input: SelfhostedNegotiationInput,\n): Promise<SessionCapabilities> {\n  const probeResponded =\n    input.probeResponded ?? (input.session ? await input.session.ping() : false);\n  const liveness = selfhostedLiveness({\n    enrollment: input.enrollment,\n    probeResponded,\n    ...(input.now ? { now: input.now } : {}),\n  });\n\n  // The base context: map the machine state onto the lease `liveness` axis so the\n  // descriptor-shaped cells (FS/Terminal/Git/Desktop) negotiate as on a warm box\n  // when online, and a cold box when not reachable (no live tunnel). The\n  // selfhosted overlay below then stamps the selfhosted-specific reasons.\n  const baseLiveness: NegotiationContext[\"liveness\"] =\n    liveness.state === \"online\" ? \"warm\" : \"cold\";\n  const base: NegotiationContext = {\n    sessionId: input.sessionId,\n    backend: \"selfhosted\",\n    os: input.os ?? \"linux\",\n    liveness: baseLiveness,\n    leaseEpoch: input.leaseEpoch,\n    desktopEnabled: input.desktopEnabled ?? true,\n    desktopInteractive: input.desktopInteractive ?? true,\n    terminalEnabled: input.terminalEnabled ?? true,\n    streamTokenSecretAvailable: input.streamTokenSecretAvailable ?? true,\n    ...(input.desktopAcknowledged !== undefined\n      ? { desktopAcknowledged: input.desktopAcknowledged }\n      : {}),\n    ...(input.shared !== undefined ? { shared: input.shared } : {}),\n    ...(input.sharedSessionIds !== undefined ? { sharedSessionIds: input.sharedSessionIds } : {}),\n    ...(input.now ? { now: input.now } : {}),\n  };\n  const negotiated = negotiateCapabilities(base);\n  const caps: SessionCapabilities = {\n    ...negotiated,\n    FileSystem: {\n      ...negotiated.FileSystem,\n      root: input.enrollment?.workspaceRoot ?? \".\",\n    },\n  };\n\n  // ── Overlay the selfhosted liveness/consent/display reasons ────────────────\n\n  // When the machine is not online, the Channel-A surface (FS/Terminal/Git) and\n  // the desktop plane cannot be reached — stamp the machine-liveness reason. This\n  // is the dominant degrade (like os_unsupported): an offline/reconnecting agent\n  // knocks out every reachable capability with the single coherent reason.\n  if (liveness.state !== \"online\") {\n    const reason: CapabilityUnavailableReason =\n      liveness.state === \"offline\" ? \"agent_offline\" : \"agent_reconnecting\";\n    return {\n      ...caps,\n      FileSystem: { ...caps.FileSystem, available: false, readOnly: true, reason },\n      Terminal: {\n        ...caps.Terminal,\n        transport: null,\n        url: null,\n        token: null,\n        expiresAt: null,\n        reason,\n      },\n      Git: { ...caps.Git, available: false, reason },\n      DesktopStream: {\n        ...caps.DesktopStream,\n        transport: null,\n        client: null,\n        mode: \"read-only\",\n        url: null,\n        token: null,\n        expiresAt: null,\n        requiresAcknowledgment: false,\n        acknowledged: false,\n        shared: false,\n        sharedSessionIds: [],\n        reason,\n      },\n      Recording: { ...caps.Recording, available: false, modes: [], codecs: [], reason },\n    };\n  }\n\n  // Online: FS/Terminal/Git stay as the base negotiated them (the machine is\n  // reachable). The desktop plane splits VIEW from CONTROL:\n  //  - VIEW (a read-only DesktopStream, Recording) requires a DISPLAY only. The\n  //    agent already holds whole-machine shell exec (it can `screencapture` the\n  //    screen itself), so passive viewing is within the exposure the user already\n  //    consented to; a missing display (headless, no Xvfb / no macOS Screen\n  //    Recording grant) is the only blocker.\n  //  - CONTROL — an INTERACTIVE stream — additionally requires the explicit\n  //    allowScreenControl consent (`consented`).\n  // Precedence: a headless machine blocks everything (display_unavailable); a\n  // displayed-but-unconsented machine can be VIEWED (read-only) + RECORDED but not\n  // CONTROLLED (consent_required). (If the base already degraded a cell for a\n  // policy reason — desktop disabled / no stream-token secret — that base reason\n  // wins; we only stamp a selfhosted reason on a cell the base left AVAILABLE.)\n  if (!liveness.hasDisplay) {\n    const reason: CapabilityUnavailableReason = \"display_unavailable\";\n    return {\n      ...caps,\n      DesktopStream:\n        caps.DesktopStream.transport !== null\n          ? {\n              ...caps.DesktopStream,\n              transport: null,\n              client: null,\n              mode: \"read-only\",\n              url: null,\n              token: null,\n              expiresAt: null,\n              requiresAcknowledgment: false,\n              acknowledged: false,\n              shared: false,\n              sharedSessionIds: [],\n              reason,\n            }\n          : caps.DesktopStream,\n      Recording: caps.Recording.available\n        ? { ...caps.Recording, available: false, modes: [], codecs: [], reason }\n        : caps.Recording,\n    };\n  }\n\n  if (!liveness.consented) {\n    // Displayed but no screen-CONTROL consent: VIEW (read-only) + Recording stay\n    // available; only interactive viewer CONTROL is withheld. Force the stream to read-only\n    // so no input is forwarded even if the base offered an interactive mode.\n    return {\n      ...caps,\n      DesktopStream:\n        caps.DesktopStream.transport !== null\n          ? { ...caps.DesktopStream, mode: \"read-only\" }\n          : caps.DesktopStream,\n    };\n  }\n\n  // Fully online + displayed + consented: the base negotiation already produced\n  // the correct available viewer and recording cells.\n  return caps;\n}\n","// `MockAgentResponder` — an in-process `ControlRpc` test double standing in for\n// a real enrolled agent over NATS (the live NATS transport is M4). It answers\n// the request/reply op table (ping / fs.read / fs.write / fs.list / fs.stat /\n// git / metrics / desktopEnsure) against an in-memory virtual filesystem, so\n// the non-exec `SelfhostedSession` surface and mocked-NATS\n// integration tests run with zero broker.\n//\n// It is shipped from the runtime package (a testing util, not test-only-private)\n// because the API/worker integration suites (M4+) reuse it to drive\n// `withChannelA`/viewer/swap end-to-end without a real machine.\n\nimport {\n  AgentError,\n  ControlRequest,\n  ControlResponse,\n  ErrorCode,\n  FsEntryKind,\n  type ExecRequest,\n  type ExecResponse,\n  type FsListResponse,\n  type FsReadResponse,\n  type FsStatResponse,\n  type FsWriteResponse,\n} from \"@opengeni/agent-proto\";\nimport type { ControlRpc } from \"./control-rpc\";\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\n\n/** Test-only command behavior consumed by an op-stream fake runner. */\nexport type MockExecHandler = (req: ExecRequest) => ExecResponse | Promise<ExecResponse>;\n\nexport interface MockAgentResponderOptions {\n  /** Whether a responder exists at all. When false EVERY request yields an\n   *  AGENT_OFFLINE error (the \"machine is offline\" condition) — used to drive the\n   *  agent_offline capability + the isProviderSandboxNotFoundError test. */\n  online?: boolean;\n  /** Whether the agent has acknowledged whole-machine / screen-control consent.\n   *  When false, an op gated on consent yields CONSENT_REQUIRED. Defaults true. */\n  consented?: boolean;\n  /** Force the agent into a draining posture (every op → DRAINING). */\n  draining?: boolean;\n  /** Seed files (path → string|Uint8Array) into the virtual filesystem. */\n  files?: Record<string, string | Uint8Array>;\n  /** Command behavior for an op-stream test harness. This responder never\n   *  exposes request/reply exec itself. */\n  exec?: MockExecHandler;\n  /** The hostname the mock reports (so PTY `$HOSTNAME`-style asserts work). */\n  hostname?: string;\n}\n\n/**\n * An in-process `ControlRpc` answering the agent op table against an in-memory\n * virtual filesystem. Drive a `SelfhostedSession` with this to test readFile /\n * writeFile / list / stat round-trips without any NATS. Exec tests use the\n * op-stream fake runner from `op-testing.ts`.\n */\nexport class MockAgentResponder implements ControlRpc {\n  private online: boolean;\n  private readonly consented: boolean;\n  private readonly draining: boolean;\n  private readonly files = new Map<string, Uint8Array>();\n  private readonly execHandler: MockExecHandler;\n  readonly hostname: string;\n\n  /** Every request seen, for assertion (subject + decoded ControlRequest). */\n  readonly requests: Array<{ subject: string; req: ControlRequest }> = [];\n\n  constructor(opts: MockAgentResponderOptions = {}) {\n    this.online = opts.online ?? true;\n    this.consented = opts.consented ?? true;\n    this.draining = opts.draining ?? false;\n    this.hostname = opts.hostname ?? \"mock-machine\";\n    this.execHandler = opts.exec ?? ((req) => defaultEcho(req, this.hostname));\n    for (const [path, content] of Object.entries(opts.files ?? {})) {\n      this.files.set(\n        normalize(path),\n        typeof content === \"string\" ? encoder.encode(content) : content,\n      );\n    }\n  }\n\n  /** Flip the responder offline mid-test (a deliberate stop / blip). */\n  setOnline(online: boolean): void {\n    this.online = online;\n  }\n\n  /** Read a file the session wrote (test assertion helper). */\n  fileText(path: string): string | undefined {\n    const bytes = this.files.get(normalize(path));\n    return bytes ? decoder.decode(bytes) : undefined;\n  }\n\n  /** Produce the command result used by an op-stream test runner. */\n  async runExec(req: ExecRequest): Promise<ExecResponse> {\n    return await this.execHandler(req);\n  }\n\n  async request(\n    subject: string,\n    req: ControlRequest,\n    _opts: { timeoutMs: number },\n  ): Promise<ControlResponse> {\n    this.requests.push({ subject, req });\n    if (!this.online) {\n      return errorResponse(\n        req.requestId,\n        ErrorCode.ERROR_CODE_AGENT_OFFLINE,\n        \"the enrolled agent is offline\",\n        false,\n      );\n    }\n    if (this.draining) {\n      return errorResponse(\n        req.requestId,\n        ErrorCode.ERROR_CODE_DRAINING,\n        \"the agent is draining\",\n        true,\n      );\n    }\n    const op = req.op;\n    if (!op) {\n      return errorResponse(req.requestId, ErrorCode.ERROR_CODE_PROTOCOL, \"empty op\", false);\n    }\n    const subjectParts = subject.split(\".\");\n    const workspaceId = subjectParts[1] ?? \"\";\n    const agentId = subjectParts[2] ?? \"\";\n    switch (op.$case) {\n      case \"ping\":\n        return ok(req.requestId, {\n          $case: \"ping\",\n          ping: { nonce: op.ping.nonce, agentMonotonicMs: \"0\" },\n        });\n      case \"fsRead\": {\n        const bytes = this.files.get(normalize(op.fsRead.path));\n        if (!bytes) {\n          return errorResponse(\n            req.requestId,\n            ErrorCode.ERROR_CODE_NOT_FOUND,\n            `no such file: ${op.fsRead.path}`,\n            false,\n          );\n        }\n        const res: FsReadResponse = { content: bytes, totalSize: String(bytes.length) };\n        return ok(req.requestId, { $case: \"fsRead\", fsRead: res });\n      }\n      case \"fsWrite\": {\n        const path = normalize(op.fsWrite.path);\n        const next = op.fsWrite.append\n          ? concat(this.files.get(path) ?? new Uint8Array(0), op.fsWrite.content)\n          : op.fsWrite.content;\n        this.files.set(path, next);\n        const res: FsWriteResponse = { bytesWritten: String(op.fsWrite.content.length) };\n        return ok(req.requestId, { $case: \"fsWrite\", fsWrite: res });\n      }\n      case \"fsRemove\": {\n        const path = normalize(op.fsRemove.path);\n        if (!this.files.delete(path)) {\n          return errorResponse(\n            req.requestId,\n            ErrorCode.ERROR_CODE_NOT_FOUND,\n            `no such file: ${op.fsRemove.path}`,\n            false,\n          );\n        }\n        return ok(req.requestId, { $case: \"fsRemove\", fsRemove: {} });\n      }\n      case \"fsList\": {\n        const prefix = normalize(op.fsList.path).replace(/\\/?$/, \"/\");\n        const res: FsListResponse = {\n          entries: [...this.files.keys()]\n            .filter((p) => p.startsWith(prefix))\n            .map((p) => {\n              const bytes = this.files.get(p)!;\n              const rel = p.slice(prefix.length);\n              return {\n                name: rel.split(\"/\").pop() ?? rel,\n                path: rel,\n                kind: FsEntryKind.FS_ENTRY_KIND_FILE,\n                size: String(bytes.length),\n                modifiedMs: \"0\",\n                mode: 0o644,\n              };\n            }),\n        };\n        return ok(req.requestId, { $case: \"fsList\", fsList: res });\n      }\n      case \"fsStat\": {\n        const bytes = this.files.get(normalize(op.fsStat.path));\n        const res: FsStatResponse = bytes\n          ? {\n              exists: true,\n              entry: {\n                name: normalize(op.fsStat.path).split(\"/\").pop() ?? \"\",\n                path: op.fsStat.path,\n                kind: FsEntryKind.FS_ENTRY_KIND_FILE,\n                size: String(bytes.length),\n                modifiedMs: \"0\",\n                mode: 0o644,\n              },\n            }\n          : { exists: false, entry: undefined };\n        return ok(req.requestId, { $case: \"fsStat\", fsStat: res });\n      }\n      case \"desktopEnsure\": {\n        // The desktop STREAM (view) is DISPLAY-gated, not consent-gated: the real\n        // agent registers the channel + captures frames regardless of screen-control\n        // consent (`register_desktop` in hub.rs sets `allow_input` from consent and\n        // the pump captures anyway) — only INPUT injection is gated. This stub has a\n        // (mock) display and does not model viewer input injection, so\n        // desktopEnsure always succeeds; `consented` only affects interactive control.\n        return ok(req.requestId, {\n          $case: \"desktopEnsure\",\n          desktopEnsure: {\n            channel: {\n              channelId: \"mock-desktop\",\n              workspaceId,\n              agentId,\n              kind: 1,\n              port: 6080,\n            },\n            display: { id: \":99\", width: 1024, height: 768, virtual: true },\n          },\n        });\n      }\n      case \"ptyOpen\": {\n        // The PTY plane is display-INDEPENDENT and has NO consent gate (unlike\n        // desktopEnsure) — a terminal works on a headless machine. Returns a PTY\n        // StreamChannel on the 7681 port.\n        return ok(req.requestId, {\n          $case: \"ptyOpen\",\n          ptyOpen: {\n            ptyId: \"mock-pty\",\n            channel: { channelId: \"mock-pty\", workspaceId, agentId, kind: 1, port: 7681 },\n          },\n        });\n      }\n      case \"browserControlEnsure\":\n        return ok(req.requestId, {\n          $case: \"browserControlEnsure\",\n          browserControlEnsure: { port: 17_321, sidecarGeneration: \"mock-sidecar-1\" },\n        });\n      case \"browserFramesOpen\": {\n        return ok(req.requestId, {\n          $case: \"browserFramesOpen\",\n          browserFramesOpen: {\n            channel: {\n              channelId: `mock-browser-${op.browserFramesOpen.targetId}`,\n              workspaceId,\n              agentId,\n              kind: 3,\n              port: 20_000,\n            },\n          },\n        });\n      }\n      case \"computerFramesOpen\": {\n        return ok(req.requestId, {\n          $case: \"computerFramesOpen\",\n          computerFramesOpen: {\n            channel: {\n              channelId: `mock-computer-${op.computerFramesOpen.targetId}`,\n              workspaceId,\n              agentId,\n              kind: 4,\n              port: 20_001,\n            },\n          },\n        });\n      }\n      default:\n        return errorResponse(\n          req.requestId,\n          ErrorCode.ERROR_CODE_UNSUPPORTED,\n          `mock does not implement ${op.$case}`,\n          false,\n        );\n    }\n  }\n}\n\nfunction defaultEcho(req: ExecRequest, hostname: string): ExecResponse {\n  const joined = req.command.join(\" \");\n  const stdout = /hostname|HOSTNAME/.test(joined) ? hostname : joined;\n  return {\n    exitCode: 0,\n    stdout: encoder.encode(`${stdout}\\n`),\n    stderr: new Uint8Array(0),\n    timedOut: false,\n    durationMs: \"1\",\n  };\n}\n\nfunction ok(requestId: string, result: NonNullable<ControlResponse[\"result\"]>): ControlResponse {\n  return { requestId, error: undefined, result };\n}\n\nfunction errorResponse(\n  requestId: string,\n  code: ErrorCode,\n  message: string,\n  retryable: boolean,\n): ControlResponse {\n  const error: AgentError = { code, message, retryable, detail: {} };\n  return { requestId, error, result: undefined };\n}\n\nfunction normalize(path: string): string {\n  // Collapse to a leading-slash absolute form for stable keys.\n  const trimmed = path.replace(/\\/+$/, \"\");\n  return trimmed.startsWith(\"/\") ? trimmed : `/${trimmed}`;\n}\n\nfunction concat(a: Uint8Array, b: Uint8Array): Uint8Array {\n  const out = new Uint8Array(a.length + b.length);\n  out.set(a, 0);\n  out.set(b, a.length);\n  return out;\n}\n","// Test doubles for the op-stream exec client (op-stream.ts): an in-memory\n// transport and a scripted FAKE RUNNER that emulates the Rust runner's\n// protocol behavior faithfully enough to exercise every client path —\n// idempotent OpStart (dedup by op id, never re-runs), attach replay from\n// retention, live-emission fault injection (drops / duplicates / reordering),\n// OpQuery status, typed lost states, and DRAINING admission. The runner's own\n// half is proven by its Rust harness (the E-scenarios); this double exists so\n// the CLIENT's reassembly/heal/ack logic is unit-testable with no broker and\n// no binary, deterministically.\n//\n// Emission model (mirrors the real runner): frames live in RETENTION the\n// moment they exist. With `live: false` (the default) the op is already\n// COMPLETE at start — the client's initial attach replays everything (the\n// completed-op collection path, incl. re-dispatch attach-not-rerun). With\n// `live: true` the first attach replays nothing and triggers the LIVE\n// emission with the fault filters applied (drops/dups/reordering); any LATER\n// attach is a heal and replays from retention unfiltered — exactly how the\n// runner's ring/spool heals what the wire mangled.\n\nimport { blake3 } from \"@noble/hashes/blake3\";\nimport { bytesToHex } from \"@noble/hashes/utils\";\nimport {\n  ControlRequest,\n  ControlResponse,\n  ErrorCode,\n  type ExecRequest,\n  type ExecResponse,\n  OpAck,\n  OpChannel,\n  OpFrame,\n  OpLostReason,\n  OpState,\n  type AgentError,\n  type OpExit,\n  type OpStart,\n  type OpStatus,\n} from \"@opengeni/agent-proto\";\nimport type { ControlRpc } from \"./control-rpc\";\nimport {\n  opFrameSubject,\n  OpStreamUnavailableError,\n  type OpStreamSubscription,\n  type OpStreamTransport,\n} from \"./op-transport\";\n\n/**\n * An in-memory `OpStreamTransport`: subscriptions are a subject→handler map,\n * and everything the CLIENT publishes (its acks) is recorded for assertions\n * and mirrored to `onPublish` (the fake runner's ack intake). `available =\n * false` makes both primitives throw `OpStreamUnavailableError` so callers\n * can assert that exec fails closed before dispatch.\n */\nexport class InMemoryOpStreamTransport implements OpStreamTransport {\n  available = true;\n  readonly published: Array<{ subject: string; payload: Uint8Array }> = [];\n  onPublish: ((subject: string, payload: Uint8Array) => void) | undefined;\n  private readonly handlers = new Map<string, Set<(payload: Uint8Array) => void>>();\n\n  async subscribe(\n    subject: string,\n    onMessage: (payload: Uint8Array) => void,\n  ): Promise<OpStreamSubscription> {\n    if (!this.available) {\n      throw new OpStreamUnavailableError(\"in-memory transport marked unavailable\");\n    }\n    let set = this.handlers.get(subject);\n    if (!set) {\n      set = new Set();\n      this.handlers.set(subject, set);\n    }\n    set.add(onMessage);\n    return {\n      unsubscribe: () => {\n        set.delete(onMessage);\n      },\n    };\n  }\n\n  async publish(subject: string, payload: Uint8Array): Promise<void> {\n    if (!this.available) {\n      throw new OpStreamUnavailableError(\"in-memory transport marked unavailable\");\n    }\n    this.published.push({ subject, payload });\n    this.onPublish?.(subject, payload);\n  }\n\n  /** Deliver a payload to the subject's subscribers (the runner→client leg). */\n  deliver(subject: string, payload: Uint8Array): void {\n    for (const handler of this.handlers.get(subject) ?? []) {\n      handler(payload);\n    }\n  }\n\n  /** Every OpAck the client published, decoded, in publish order. */\n  decodedAcks(): OpAck[] {\n    return this.published.map(({ payload }) => OpAck.decode(payload));\n  }\n}\n\n/** One scripted data frame (the exit frame is synthesized from `exit`). */\nexport interface FakeOpDataFrame {\n  channel: \"stdout\" | \"stderr\";\n  bytes: Uint8Array | string;\n}\n\nexport interface FakeOpScript {\n  /** Data/progress frames in emission order (seq 1..N; the exit takes N+1). */\n  frames: Array<FakeOpDataFrame | \"progress\">;\n  /** Exit overrides (exitCode/timedOut/failureCode/…). Digests and totals are\n   *  computed from the scripted data frames unless overridden. */\n  exit?: Partial<OpExit>;\n  /** LIVE mode: the first attach replays nothing and triggers the (faulty)\n   *  live emission; later attaches replay from retention unfiltered. Default\n   *  false = the op is COMPLETE at start (pure collection). */\n  live?: boolean;\n  /** Keep a live op RUNNING with no frames until OpCancel is received. */\n  holdUntilCancel?: boolean;\n  /** Seqs whose LIVE emission is dropped (retention keeps them). */\n  dropLiveSeqs?: ReadonlySet<number>;\n  /** Seqs whose LIVE emission is duplicated (delivered twice back-to-back). */\n  duplicateLiveSeqs?: ReadonlySet<number>;\n  /** Swap each adjacent live pair (1,2 → 2,1) to exercise the stash path. */\n  reorderLivePairs?: boolean;\n  /** The first N OpStarts answer a DRAINING AgentError (admission pressure). */\n  drainingStarts?: number;\n  /** Refuse every OpStart with this error (e.g. a PROTOCOL refusal from a\n   *  runner that does not speak the required op-stream protocol). */\n  startError?: AgentError;\n}\n\ninterface FakeOpRun {\n  connectionInstanceId: string;\n  script: FakeOpScript;\n  frames: OpFrame[];\n  exitSeq: bigint;\n  exit: OpExit;\n  startCount: number;\n  attachCount: number;\n  drainingRemaining: number;\n  liveEmitted: boolean;\n  finalAcked: boolean;\n  acks: OpAck[];\n  highestGeneration: bigint;\n}\n\nconst encoder = new TextEncoder();\n\n/**\n * The scripted fake runner: a `ControlRpc` that answers the op-stream control\n * ops and emits frames through an `InMemoryOpStreamTransport`.\n */\nexport class FakeOpRunner implements ControlRpc {\n  private readonly transport: InMemoryOpStreamTransport;\n  private readonly workspaceId: string;\n  private readonly agentId: string;\n  private readonly connectionInstanceId: string;\n  private readonly defaultScript:\n    | ((exec: ExecRequest, opId: string) => FakeOpScript | Promise<FakeOpScript>)\n    | undefined;\n  private readonly scripts = new Map<string, FakeOpScript>();\n  readonly runs = new Map<string, FakeOpRun>();\n  readonly starts: Array<{ opId: string; exec: ExecRequest }> = [];\n  /** Op ids that answer LOST (evicted) on query/attach — bounded-retention\n   *  collateral. */\n  readonly lostOps = new Set<string>();\n  private readonly cancelledBeforeStart = new Set<string>();\n\n  constructor(opts: {\n    transport: InMemoryOpStreamTransport;\n    workspaceId: string;\n    agentId: string;\n    connectionInstanceId: string;\n    defaultScript?: (exec: ExecRequest, opId: string) => FakeOpScript | Promise<FakeOpScript>;\n  }) {\n    this.transport = opts.transport;\n    this.workspaceId = opts.workspaceId;\n    this.agentId = opts.agentId;\n    this.connectionInstanceId = opts.connectionInstanceId;\n    this.defaultScript = opts.defaultScript;\n    this.transport.onPublish = (_subject, payload) => this.onAck(payload);\n  }\n\n  /** Script the op the NEXT OpStart with this id will run. */\n  script(opId: string, script: FakeOpScript): void {\n    this.scripts.set(opId, script);\n  }\n\n  private onAck(payload: Uint8Array): void {\n    let ack: OpAck;\n    try {\n      ack = OpAck.decode(payload);\n    } catch {\n      return;\n    }\n    const run = this.runs.get(ack.opId);\n    if (!run) {\n      return;\n    }\n    // Generation fencing exactly like the runner: only the highest generation\n    // seen has any effect; `final` is honored only when it covers the exit.\n    const generation = BigInt(ack.attachGeneration);\n    if (generation === 0n || generation !== run.highestGeneration) {\n      return;\n    }\n    run.acks.push(ack);\n    if (ack.final && BigInt(ack.ackedSeq) >= run.exitSeq) {\n      run.finalAcked = true;\n    }\n  }\n\n  async request(\n    subject: string,\n    req: ControlRequest,\n    _opts: { timeoutMs: number },\n  ): Promise<ControlResponse> {\n    const connectionInstanceId = connectionInstanceIdFromSubject(subject);\n    if (!connectionInstanceId) {\n      return errorResponse(\n        req.requestId,\n        ErrorCode.ERROR_CODE_PROTOCOL,\n        \"request did not address an exact connection instance\",\n      );\n    }\n    const op = req.op;\n    if (!op) {\n      return errorResponse(req.requestId, ErrorCode.ERROR_CODE_PROTOCOL, \"no op\");\n    }\n    switch (op.$case) {\n      case \"opStart\":\n        return await this.handleStart(req.requestId, op.opStart, connectionInstanceId);\n      case \"opAttach\":\n        return this.handleAttach(\n          req.requestId,\n          op.opAttach.opId,\n          BigInt(op.opAttach.fromSeq),\n          op.opAttach.attachGeneration,\n          connectionInstanceId,\n        );\n      case \"opQuery\":\n        return this.handleQuery(req.requestId, op.opQuery.opId, connectionInstanceId);\n      case \"opCancel\":\n        return this.handleCancel(req.requestId, op.opCancel.opId, connectionInstanceId);\n      default: {\n        return errorResponse(\n          req.requestId,\n          ErrorCode.ERROR_CODE_UNSUPPORTED,\n          `fake runner: unscripted op ${op.$case}`,\n        );\n      }\n    }\n  }\n\n  private async handleStart(\n    opId: string,\n    start: OpStart,\n    connectionInstanceId: string,\n  ): Promise<ControlResponse> {\n    if (this.cancelledBeforeStart.has(opId)) {\n      return startResponse(opId, cancelledStatus(opId), false);\n    }\n    const existing = this.runs.get(opId);\n    if (existing) {\n      if (existing.connectionInstanceId !== connectionInstanceId) {\n        return errorResponse(\n          opId,\n          ErrorCode.ERROR_CODE_FENCED,\n          \"operation belongs to a different connection instance\",\n        );\n      }\n      // IDEMPOTENT BY OP ID: a known op answers its current status and NEVER\n      // re-runs (the whole point of B1).\n      existing.startCount += 1;\n      return startResponse(opId, this.statusOf(opId, existing));\n    }\n    const exec = start.op?.$case === \"exec\" ? start.op.exec : undefined;\n    if (!exec) {\n      return errorResponse(\n        opId,\n        ErrorCode.ERROR_CODE_UNSUPPORTED,\n        \"fake runner: only exec OpStart is supported\",\n      );\n    }\n    this.starts.push({ opId, exec });\n    const scripted = this.scripts.get(opId) ?? (await this.defaultScript?.(exec, opId));\n    if (scripted && !this.scripts.has(opId)) this.scripts.set(opId, scripted);\n    const script = this.scripts.get(opId);\n    if (!script) {\n      return errorResponse(\n        opId,\n        ErrorCode.ERROR_CODE_PROTOCOL,\n        `fake runner: no script for op ${opId}`,\n      );\n    }\n    if (script.startError) {\n      return { requestId: opId, error: script.startError, result: undefined };\n    }\n    const pending = this.scripts.get(opId) as FakeOpScript;\n    if ((pending.drainingStarts ?? 0) > 0) {\n      // Admission pressure: count down across retries of the un-admitted op.\n      this.scripts.set(opId, { ...pending, drainingStarts: (pending.drainingStarts ?? 0) - 1 });\n      return {\n        requestId: opId,\n        error: {\n          code: ErrorCode.ERROR_CODE_DRAINING,\n          message: \"fake runner: admission pool full\",\n          retryable: true,\n          detail: {},\n        },\n        result: undefined,\n      };\n    }\n    const run = this.buildRun(opId, this.scripts.get(opId) as FakeOpScript, connectionInstanceId);\n    run.startCount = 1;\n    this.runs.set(opId, run);\n    return startResponse(opId, this.statusOf(opId, run));\n  }\n\n  private handleAttach(\n    requestId: string,\n    opId: string,\n    fromSeq: bigint,\n    generation: string,\n    connectionInstanceId: string,\n  ): ControlResponse {\n    if (this.lostOps.has(opId)) {\n      return statusOnly(requestId, lostStatus(opId));\n    }\n    const run = this.runs.get(opId);\n    if (!run) {\n      return statusOnly(requestId, lostStatus(opId));\n    }\n    if (run.connectionInstanceId !== connectionInstanceId) {\n      return errorResponse(\n        requestId,\n        ErrorCode.ERROR_CODE_FENCED,\n        \"operation belongs to a different connection instance\",\n      );\n    }\n    run.attachCount += 1;\n    const attachGeneration = BigInt(generation);\n    // Rust apply_attach still returns status but refuses replay for generation\n    // zero or an older consumer. Do not make stale clients appear healthy.\n    if (attachGeneration === 0n || attachGeneration < run.highestGeneration) {\n      return statusOnly(requestId, this.statusOf(opId, run));\n    }\n    if (attachGeneration > run.highestGeneration) {\n      run.highestGeneration = attachGeneration;\n    }\n    const subject = opFrameSubject(this.workspaceId, this.agentId, opId, run.connectionInstanceId);\n    if (run.script.live && !run.liveEmitted) {\n      // First attach on a live op: nothing retained yet worth replaying — the\n      // child \"runs now\" and the (faulty) live flow begins.\n      if (!run.script.holdUntilCancel) this.emitLive(opId, run, subject);\n      return statusOnly(requestId, this.statusOf(opId, run));\n    }\n    // A heal (or completed-op collection): replay from RETENTION — every frame\n    // > fromSeq, in order, NO fault injection (the runner's ring/spool holds\n    // them all under the credit-only ack policy).\n    const replay = run.frames.filter((frame) => BigInt(frame.seq) > fromSeq);\n    queueMicrotask(() => {\n      for (const frame of replay) {\n        this.transport.deliver(subject, OpFrame.encode(frame).finish());\n      }\n    });\n    return statusOnly(requestId, this.statusOf(opId, run));\n  }\n\n  private handleQuery(\n    requestId: string,\n    opId: string,\n    connectionInstanceId: string,\n  ): ControlResponse {\n    if (this.lostOps.has(opId)) {\n      return statusOnly(requestId, lostStatus(opId));\n    }\n    const run = this.runs.get(opId);\n    if (!run) {\n      return statusOnly(requestId, lostStatus(opId));\n    }\n    if (run.connectionInstanceId !== connectionInstanceId) {\n      return errorResponse(\n        requestId,\n        ErrorCode.ERROR_CODE_FENCED,\n        \"operation belongs to a different connection instance\",\n      );\n    }\n    return statusOnly(requestId, this.statusOf(opId, run));\n  }\n\n  private handleCancel(\n    requestId: string,\n    opId: string,\n    connectionInstanceId: string,\n  ): ControlResponse {\n    const run = this.runs.get(opId);\n    if (!run) {\n      this.cancelledBeforeStart.add(opId);\n      return statusOnly(requestId, cancelledStatus(opId));\n    }\n    if (run.connectionInstanceId !== connectionInstanceId) {\n      return errorResponse(\n        requestId,\n        ErrorCode.ERROR_CODE_FENCED,\n        \"operation belongs to a different connection instance\",\n      );\n    }\n    if (!run.liveEmitted && run.script.holdUntilCancel) {\n      run.exit.exitCode = -1;\n      run.exit.cancelled = true;\n      run.liveEmitted = true;\n      const subject = opFrameSubject(\n        this.workspaceId,\n        this.agentId,\n        opId,\n        run.connectionInstanceId,\n      );\n      queueMicrotask(() => {\n        for (const frame of run.frames) {\n          this.transport.deliver(subject, OpFrame.encode(frame).finish());\n        }\n      });\n    }\n    return statusOnly(requestId, this.statusOf(opId, run));\n  }\n\n  /** The LIVE flow: fault filters applied (drops, duplicates, adjacent\n   *  reordering); retention still holds every frame for the heal replay. */\n  private emitLive(opId: string, run: FakeOpRun, subject: string): void {\n    run.liveEmitted = true;\n    const { dropLiveSeqs, duplicateLiveSeqs, reorderLivePairs } = run.script;\n    let sequence = [...run.frames];\n    if (reorderLivePairs) {\n      for (let i = 0; i + 1 < sequence.length; i += 2) {\n        const a = sequence[i] as OpFrame;\n        sequence[i] = sequence[i + 1] as OpFrame;\n        sequence[i + 1] = a;\n      }\n    }\n    sequence = sequence.filter((frame) => !dropLiveSeqs?.has(Number(frame.seq)));\n    queueMicrotask(() => {\n      for (const frame of sequence) {\n        const payload = OpFrame.encode(frame).finish();\n        this.transport.deliver(subject, payload);\n        if (duplicateLiveSeqs?.has(Number(frame.seq))) {\n          this.transport.deliver(subject, payload);\n        }\n      }\n    });\n  }\n\n  private statusOf(opId: string, run: FakeOpRun): OpStatus {\n    // The fake's ops are instant: COMPLETE the moment their frames exist. A\n    // live op that has not yet emitted reads RUNNING with nothing produced;\n    // once emission ran (even if the wire dropped frames), the runner-side\n    // truth is COMPLETE with the full high watermark — exactly what a silence\n    // probe needs to see to detect \"the runner is ahead of us\".\n    const complete = !run.script.live || run.liveEmitted;\n    return {\n      opId,\n      state: complete ? OpState.OP_STATE_COMPLETE : OpState.OP_STATE_RUNNING,\n      nextSeq: complete ? (run.exitSeq + 1n).toString() : \"1\",\n      writeOffset: \"0\",\n      exit: complete ? run.exit : undefined,\n      lostReason: OpLostReason.OP_LOST_REASON_UNSPECIFIED,\n    };\n  }\n\n  private buildRun(opId: string, script: FakeOpScript, connectionInstanceId: string): FakeOpRun {\n    const frames: OpFrame[] = [];\n    const channelBytes: Record<\"stdout\" | \"stderr\", Uint8Array[]> = { stdout: [], stderr: [] };\n    let seq = 0n;\n    for (const spec of script.frames) {\n      seq += 1n;\n      if (spec === \"progress\") {\n        frames.push({ opId, seq: seq.toString(), body: { $case: \"progress\", progress: {} } });\n        continue;\n      }\n      const bytes = typeof spec.bytes === \"string\" ? encoder.encode(spec.bytes) : spec.bytes;\n      channelBytes[spec.channel].push(bytes);\n      frames.push({\n        opId,\n        seq: seq.toString(),\n        body: {\n          $case: \"data\",\n          data: {\n            channel:\n              spec.channel === \"stdout\" ? OpChannel.OP_CHANNEL_STDOUT : OpChannel.OP_CHANNEL_STDERR,\n            bytes,\n          },\n        },\n      });\n    }\n    seq += 1n;\n    const digests: Record<string, string> = {};\n    const totals: Record<string, string> = {};\n    for (const channel of [\"stdout\", \"stderr\"] as const) {\n      const joined = concat(channelBytes[channel]);\n      digests[channel] = bytesToHex(blake3(joined));\n      totals[channel] = String(joined.byteLength);\n    }\n    const exit: OpExit = {\n      exitCode: 0,\n      timedOut: false,\n      cancelled: false,\n      durationMs: \"5\",\n      digests,\n      totals,\n      failureCode: \"\",\n      failureDetail: {},\n      ...script.exit,\n    };\n    frames.push({ opId, seq: seq.toString(), body: { $case: \"exit\", exit } });\n    return {\n      connectionInstanceId,\n      script,\n      frames,\n      exitSeq: seq,\n      exit,\n      startCount: 0,\n      attachCount: 0,\n      drainingRemaining: script.drainingStarts ?? 0,\n      liveEmitted: false,\n      finalAcked: false,\n      acks: [],\n      highestGeneration: 0n,\n    };\n  }\n}\n\nexport function createMockSelfhostedOpStream(input: {\n  responder: ControlRpc & { runExec(exec: ExecRequest): Promise<ExecResponse> };\n  workspaceId: string;\n  agentId: string;\n  connectionInstanceId: string;\n}) {\n  const transport = new InMemoryOpStreamTransport();\n  const runner = new FakeOpRunner({\n    transport,\n    workspaceId: input.workspaceId,\n    agentId: input.agentId,\n    connectionInstanceId: input.connectionInstanceId,\n    defaultScript: async (exec) => {\n      const response = await input.responder.runExec(exec);\n      return {\n        frames: [\n          ...(response.stdout.length > 0\n            ? [{ channel: \"stdout\" as const, bytes: response.stdout }]\n            : []),\n          ...(response.stderr.length > 0\n            ? [{ channel: \"stderr\" as const, bytes: response.stderr }]\n            : []),\n        ],\n        exit: {\n          exitCode: response.exitCode,\n          timedOut: response.timedOut,\n          durationMs: response.durationMs,\n        },\n      };\n    },\n  });\n  const controlRpc: ControlRpc = {\n    request: async (subject, request, opts) => {\n      const gate = await input.responder.request(subject, request, opts);\n      if (gate.error?.code !== ErrorCode.ERROR_CODE_UNSUPPORTED) return gate;\n      return await runner.request(subject, request, opts);\n    },\n  };\n  return {\n    controlRpc,\n    opStream: { transport },\n    runner,\n    transport,\n  };\n}\n\nfunction concat(chunks: Uint8Array[]): Uint8Array {\n  const total = chunks.reduce((sum, c) => sum + c.byteLength, 0);\n  const out = new Uint8Array(total);\n  let offset = 0;\n  for (const chunk of chunks) {\n    out.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return out;\n}\n\nfunction connectionInstanceIdFromSubject(subject: string): string | undefined {\n  const parts = subject.split(\".\");\n  const connectionIndex = parts.indexOf(\"connection\");\n  return connectionIndex >= 0 ? parts[connectionIndex + 1] : undefined;\n}\n\nfunction errorResponse(requestId: string, code: ErrorCode, message: string): ControlResponse {\n  return {\n    requestId,\n    error: { code, message, retryable: false, detail: {} },\n    result: undefined,\n  };\n}\n\nfunction startResponse(requestId: string, status: OpStatus, accepted = true): ControlResponse {\n  return {\n    requestId,\n    error: undefined,\n    result: { $case: \"opStart\", opStart: { accepted, status } },\n  };\n}\n\nfunction statusOnly(requestId: string, status: OpStatus): ControlResponse {\n  return {\n    requestId,\n    error: undefined,\n    result: { $case: \"opStatus\", opStatus: status },\n  };\n}\n\nfunction lostStatus(opId: string): OpStatus {\n  return {\n    opId,\n    state: OpState.OP_STATE_LOST,\n    writeOffset: \"0\",\n    nextSeq: \"0\",\n    exit: undefined,\n    lostReason: OpLostReason.OP_LOST_REASON_EVICTED,\n  };\n}\n\nfunction cancelledStatus(opId: string): OpStatus {\n  return {\n    opId,\n    state: OpState.OP_STATE_COMPLETE,\n    writeOffset: \"0\",\n    nextSeq: \"1\",\n    exit: {\n      exitCode: -1,\n      timedOut: false,\n      cancelled: true,\n      durationMs: \"0\",\n      digests: {},\n      totals: {},\n      failureCode: \"\",\n      failureDetail: {},\n    },\n    lostReason: OpLostReason.OP_LOST_REASON_UNSPECIFIED,\n  };\n}\n","// `makeActiveBackendResolver` — builds the `resolveActiveBackend` closure the\n// `RoutingSandboxSession` calls to turn an active pointer into a live backend\n// session (M7). It is the heterogeneous-dispatch core: a pointer's target is\n// EITHER the session's own group sandbox (the default, `activeSandboxId === null`)\n// OR a first-class named sandbox the session swapped to — a sibling Modal box or\n// a selfhosted machine.\n//\n// This lives in the agent-loop-free leaf and depends ONLY on injected closures +\n// the selfhosted session builder, so the API/worker wire it to the real DB\n// (`getSandbox`/`getEnrollment`/`readActiveSandbox`) + the live NATS ControlRpc\n// without coupling the leaf to `@opengeni/db`.\n//\n// The DEFAULT target (the group box) is supplied as an already-established\n// session (the turn box `resumeBoxForTurn` produced, or the Channel-A established\n// handle) — the proxy does NOT re-establish it (the lease owns its lifecycle). A\n// NON-DEFAULT selfhosted target builds a `SelfhostedSession` bound to the target's\n// enrollment agentId, fenced under the swap's active_epoch. That cached session\n// re-resolves caller-owned authority and connection identity at the last boundary\n// before every provider operation. A non-default MODAL\n// target is established via the injected `establishModalTarget` resolver (the\n// API/worker pass a resume-by-id closure for the sibling box's lease).\n\nimport {\n  buildSelfhostedBackendSession,\n  type SelfhostedBackgroundCommandAdoption,\n  type SelfhostedOpStreamDeps,\n  type SelfhostedOperationAdmission,\n  type SelfhostedRelayConfig,\n} from \"../selfhosted/session\";\nimport type { SelfhostedOpObserver } from \"../selfhosted/op-observer\";\nimport type { OpStreamOutputFrame } from \"../selfhosted/op-stream\";\nimport type { ControlRpc } from \"../selfhosted/control-rpc\";\nimport { resolveConnectedMachineWorkspaceRoot } from \"../selfhosted/workspace-path\";\nimport type {\n  ActivePointer,\n  RoutableBackendSession,\n  ResolvedActiveBackend,\n} from \"./routing-session\";\n\n/** The structural slice of a first-class sandbox the resolver reads (mirror of\n *  `@opengeni/db`'s `SandboxRecord`; structural so the leaf does not import DB). */\nexport interface RoutableSandbox {\n  id: string;\n  workspaceId: string;\n  kind: \"modal\" | \"selfhosted\" | string;\n  name: string;\n  /** Authority scope projected by the DB resolver. Worker routes use this to\n   * reassert an exact attempt's personal-machine grant immediately before use. */\n  scope?: \"organization\" | \"workspace\" | \"user\";\n  /** For a selfhosted sandbox this is its enrollment id (== the agent id the\n   *  exact generation-fenced control-plane subject addresses). Null for modal. */\n  enrollmentId: string | null;\n}\n\n/** One atomically resolved live Connected Machine route. The process identity\n * and optional stream capability come from the same enrollment snapshot so a\n * build can never combine a successor's RPC subject with a predecessor's\n * capability state. */\nexport interface SelfhostedConnectionBinding {\n  /** Physical machine-origin workspace used in the control-plane subject. */\n  workspaceId?: string;\n  connectionInstanceId: string;\n  /** Absolute launch root persisted from this runner's authoritative Hello. */\n  workspaceRoot: string | null;\n  opStream?: SelfhostedOpStreamDeps;\n  operationResourcePolicy: SelfhostedOperationAdmission[\"operationResourcePolicy\"];\n  operationResourcePolicySupported: boolean;\n  operationCpuQuotaSupported: boolean;\n  transactionalFsWriteSupported?: boolean;\n  browserControlHttpSupported?: boolean;\n}\n\nexport interface ActiveBackendResolverDeps {\n  /** The workspace the session belongs to (the control-plane subject scope). */\n  workspaceId: string;\n  /** The session's own group sandbox session — the DEFAULT target\n   *  (`activeSandboxId === null`). Already established (lease-owned); the proxy\n   *  never re-establishes it. */\n  defaultBackend: RoutableBackendSession;\n  /** A label for the default backend (its backend id: \"modal\"/\"selfhosted\"/…). */\n  defaultKind: string;\n  /**\n   * Re-resolve the session's HOME backend after the route cache is fenced.\n   *\n   * The normal path returns `defaultBackend` (the turn's already-established\n   * handle), but an API-side same-target repair can rematerialize that lease\n   * while a worker turn is still alive. Such a repair advances the route epoch\n   * without changing the null pointer; callers that can resume the current\n   * lease-owned identity may provide this callback so the next epoch does not\n   * keep dispatching to the dead pre-repair object. This callback must never\n   * create a provider or replay an operation.\n   */\n  resolveDefaultBackend?: (pointer: ActivePointer) => Promise<ResolvedActiveBackend>;\n  /** Look up a first-class sandbox by id (the swap target). Returns null when the\n   *  id is unknown or not in this workspace (the caller 409s the swap). */\n  getSandbox(sandboxId: string): Promise<RoutableSandbox | null>;\n  /** Build a live `ControlRpc` for the selfhosted control plane (the request-\n   *  scoped NATS connection). Returns a ControlRpc whose offline/timeout maps to\n   *  agent_offline/agent_reconnecting (never a NotFound). */\n  controlRpcFactory(): ControlRpc;\n  /** Resolve the exact currently leased daemon instance and its optional stream\n   *  transport from one enrollment snapshot. Null means no live runner. */\n  resolveSelfhostedConnection: (\n    sandbox: RoutableSandbox,\n  ) => Promise<SelfhostedConnectionBinding | null>;\n  /** The relay-URL shape config for selfhosted stream endpoints. */\n  relay: SelfhostedRelayConfig;\n  /** Establish (resume-by-id) a NON-DEFAULT modal target's box session for a swap.\n   *  Supplied by the API/worker (a closure over the sibling sandbox's lease). When\n   *  absent, a modal swap target surfaces as unsupported (the caller validated\n   *  liveness, so this is the \"modal swap not wired in this context\" guard). */\n  establishModalTarget?: (sandbox: RoutableSandbox) => Promise<RoutableBackendSession>;\n  /** The selfhosted CONTROL-op timeout (ping/fs/desktop/pty) for a swap/pin target.\n   *  Absent ⇒ the session's 30s default. */\n  selfhostedTimeoutMs?: number;\n  /** The selfhosted EXEC process deadline for a swap/pin target, distinct from the\n   *  control timeout (a swapped-to machine runs real commands too). Absent ⇒ falls\n   *  back to the control timeout, as in the session leaf. */\n  selfhostedExecTimeoutMs?: number;\n  /** The per-op observer threaded into a selfhosted swap/pin target (out-of-band\n   *  telemetry — metrics + machine.* events). Absent ⇒ no-op. */\n  selfhostedOnOp?: SelfhostedOpObserver;\n  selfhostedAdoptBackgroundCommand?: (\n    input: SelfhostedBackgroundCommandAdoption,\n  ) => Promise<{ commandId: string }>;\n  selfhostedCaptureBackgroundCommandOutput?: (\n    commandId: string,\n    frames: OpStreamOutputFrame[],\n  ) => Promise<void>;\n  selfhostedSettleBackgroundCommand?: (input: {\n    commandId: string;\n    controlWorkspaceId: string;\n    enrollmentId: string;\n    connectionInstanceId: string;\n    opId: string;\n    outcome: \"exited\" | \"lost\";\n    exitCode: number | null;\n    reason: string;\n    failure?: import(\"@opengeni/contracts\").SessionCommandFailure;\n  }) => void | Promise<void>;\n  /**\n   * The run's declared sandbox environment — the SAME `Record<string,string>` the\n   * worker turn threads into the agent's TARGET manifest (and into the group box at\n   * create). Threaded into a selfhosted swap target's session so its\n   * `state.manifest.environment` EQUALS the turn's, making the SDK's per-turn\n   * provided-session manifest-env delta empty (validateNoEnvironmentDelta).\n   * WITHOUT this a pin-to-vm turn throws \"Live sandbox sessions cannot change\n   * manifest environment variables\". Omitted → `{}` (the test/negotiation path).\n   */\n  environment?: Record<string, string>;\n  /** Attempt-local values projected only onto selfhosted child exec requests. */\n  transientExecEnvironment?: () => Readonly<Record<string, string>>;\n  /**\n   * A pre-established selfhosted session to PIN for the STEADY-STATE machine\n   * pointer (the worker turn's machine-primary path, Stage D). When the pointer\n   * targets THIS sandbox at THIS epoch, the resolver returns this SAME instance\n   * instead of building a fresh `SelfhostedSession`. This is the instance-identity\n   * pin: the SDK reads/writes `state.manifest` at turn START via the proxy's `state`\n   * getter (which reads the default/last-resolved backend's state) and then reads it\n   * per op via this resolver — those MUST land on ONE SelfhostedSession/manifest, or\n   * a turn-start manifest write is invisible to the per-op reads (two-instance\n   * divergence). A swap AWAY (a different sandbox id, or the same id at a moved epoch)\n   * falls through to a fresh build under the new epoch. Omitted for the API/live-swap\n   * path (which always builds fresh — it has no pre-established turn session).\n   */\n  pinnedSelfhosted?: {\n    sandboxId: string;\n    epoch: number;\n    session: RoutableBackendSession;\n  };\n  /**\n   * Whether `defaultBackend` IS the session's home box — i.e. whether the null pointer\n   * (== home) may resolve to it. Defaults to TRUE (omitted): a genuine machine-HOME turn\n   * (home IS the machine) and a Modal-home turn established on its group box both pass/omit\n   * true, so null resolves to `defaultBackend` as before. Set explicitly FALSE only for a\n   * machine-primary turn of a Modal-HOME session (pinned to a machine, group box never\n   * established this turn): the null pointer then has nothing to resolve to THIS turn, so\n   * rather than silently keep serving the pinned machine as if the detach never happened,\n   * the null branch throws a typed `home_unavailable_this_turn` transition — the detach's\n   * pointer commit stands, and worker failure settlement checkpoints completed work before\n   * continuing the same logical turn in a fresh attempt. That attempt starts null and\n   * establishes the home box normally. This makes the boundary typed-and-specific, never\n   * a silent fallback to the machine.\n   */\n  defaultIsHome?: boolean;\n}\n\n/** Why a persisted pointer / swap target cannot be turned into a live backend. A\n *  typed discriminant so callers (turn-start reconcile, the swap tool, future\n *  reports) can distinguish a stale pointer from an unaddressable enrollment from a\n *  backend the turn context simply cannot establish — instead of string-matching\n *  one opaque message (issue #341: \"typed diagnostics that distinguish stale\n *  pointer, offline enrollment, unsupported backend context, transient failure\").\n *   - `stale_pointer`               — the pointed-at sandbox row is gone (deleted/orphaned).\n *   - `offline_enrollment`          — a selfhosted target carries no enrollment/agent id to address.\n *   - `unsupported_backend_context` — a target no turn routing context can establish\n *                                     (a non-group Modal sibling; an unknown kind).\n *   - `transient_establishment`     — a momentary establish failure worth a retry (reserved;\n *                                     control-plane timeouts surface as their own typed error).\n *   - `home_unavailable_this_turn`  — the pointer was cleared to the session default (home)\n *                                     mid-turn, but this attempt started pinned to a machine and\n *                                     never established the home box. The worker checkpoints the\n *                                     attempt and continues the same logical turn on home.\n *   - `workspace_root_unavailable`  — the selected runner has not reported a\n *                                     usable absolute launch root yet. */\nexport type BackendUnresolvableCode =\n  | \"stale_pointer\"\n  | \"offline_enrollment\"\n  | \"unsupported_backend_context\"\n  | \"transient_establishment\"\n  | \"home_unavailable_this_turn\"\n  | \"workspace_root_unavailable\";\n\n/** Thrown when a swap target cannot be resolved (unknown sandbox, or a modal\n *  target with no establisher in this context). The caller maps it to a 409.\n *  Carries a typed {@link BackendUnresolvableCode} in addition to the message. */\nexport class ActiveBackendUnresolvableError extends Error {\n  readonly name = \"ActiveBackendUnresolvableError\";\n  readonly code: BackendUnresolvableCode;\n  constructor(code: BackendUnresolvableCode, message: string) {\n    super(message);\n    this.code = code;\n  }\n}\n\n/** The outcome of {@link swapTargetEstablishability}. */\nexport type SwapTargetEstablishability =\n  | { ok: true }\n  | { ok: false; code: BackendUnresolvableCode; reason: string };\n\n/**\n * THE SINGLE SOURCE OF TRUTH for \"can a turn's routing context ESTABLISH this swap\n * target?\" — shared by swap/seed ADMISSION (`fleet.resolveTarget`, before the CAS\n * pointer commit) and turn-time ESTABLISHMENT (this resolver + `wrapTurnBoxWithRouting`).\n * Admission MUST reject any target this predicate calls unestablishable, so the\n * pointer is never committed to a backend no turn can resume (issue #341 Shape 1:\n * a Modal-sibling swap was admitted + epoch-bumped, then every following op\n * stranded because no context wires an establisher for it).\n *\n *  - the session's OWN group box (`isSessionGroup`) is the null/home target and is\n *    always establishable (it IS the default backend);\n *  - a `selfhosted` machine target is establishable (`buildSelfhostedBackendSession`);\n *    admission's separate liveness probe — not this predicate — gates online-ness;\n *  - a NON-group `modal` target is NOT establishable: no turn context wires\n *    `establishModalTarget` (cross-group Modal resume-by-id is a future, billing-\n *    touching feature — sandbox-routing.ts). Wiring that establisher is the ONE\n *    toggle that flips this branch; keep admission and the resolver in lockstep.\n */\nexport function swapTargetEstablishability(target: {\n  kind: string;\n  isSessionGroup: boolean;\n}): SwapTargetEstablishability {\n  if (target.isSessionGroup) {\n    return { ok: true };\n  }\n  if (target.kind === \"selfhosted\") {\n    return { ok: true };\n  }\n  if (target.kind === \"modal\") {\n    return {\n      ok: false,\n      code: \"unsupported_backend_context\",\n      reason:\n        \"a Modal sandbox other than this session's own box cannot be established by a turn yet; swap back to the session default or attach a Connected Machine\",\n    };\n  }\n  return {\n    ok: false,\n    code: \"unsupported_backend_context\",\n    reason: `a sandbox of kind \"${target.kind}\" cannot be established by a turn`,\n  };\n}\n\n/**\n * Build the `resolveActiveBackend(pointer)` closure for a `RoutingSandboxSession`.\n * The returned closure is re-invoked by the proxy whenever the active_epoch moves\n * (the per-epoch cache miss), so it must be cheap-and-correct for the steady-state\n * (default pointer → the already-established group box) and build a fresh backend\n * for a swap target.\n *\n *  - `activeSandboxId === null` → the default group backend (no re-establish).\n *  - a selfhosted target → a `SelfhostedSession` bound to the enrollment agentId,\n *    fenced under `pointer.activeEpoch` (echoed on every ControlRequest so the\n *    agent can reject a stale op with ERROR_CODE_FENCED — the swap-race fence).\n *  - a modal target → `establishModalTarget` (the resume-by-id closure), else\n *    unresolvable.\n */\nexport function makeActiveBackendResolver(\n  deps: ActiveBackendResolverDeps,\n): (pointer: ActivePointer) => Promise<ResolvedActiveBackend> {\n  return async (pointer: ActivePointer): Promise<ResolvedActiveBackend> => {\n    // NULL == the session's HOME backend (issue #341 invariant 1). `defaultBackend`\n    // is the already-established home the wiring handed us — the Modal group box for a\n    // Modal-home turn, or the machine itself for a machine-home turn. It is NEVER a\n    // swap target's SelfhostedSession: a clear-to-null must re-land on the home, never\n    // keep serving the machine a prior op swapped to. (The proxy caches by the FULL\n    // pointer tuple, so a clear-to-null — epoch-bumped OR a same-epoch FK null —\n    // invalidates the cached machine and re-enters this branch.) The lease owns the\n    // home box lifecycle; the proxy does not re-establish it.\n    if (pointer.activeSandboxId === null) {\n      // A machine-pinned turn (Modal-home session pinned to a machine) never\n      // established its home box, so a mid-turn clear-to-null has no home to resolve\n      // THIS attempt. Fail typed-and-specific — the detach was accepted and its pointer\n      // commit STANDS, allowing worker failure settlement to checkpoint and continue the\n      // same logical turn in a new home-primary attempt — instead of silently serving the\n      // pinned machine as if the clear never happened. Only an EXPLICIT `false` throws;\n      // omitted (the common path) resolves to the home default as before.\n      if (deps.defaultIsHome === false) {\n        throw new ActiveBackendUnresolvableError(\n          \"home_unavailable_this_turn\",\n          \"the active sandbox was detached to the session default (home), but this turn started pinned to a machine and established no home box; the detach is accepted and takes effect on the next turn — this turn has no active home box\",\n        );\n      }\n      if (deps.resolveDefaultBackend) {\n        return await deps.resolveDefaultBackend(pointer);\n      }\n      return {\n        session: deps.defaultBackend,\n        sandboxId: null,\n        kind: deps.defaultKind,\n      };\n    }\n\n    // INSTANCE PIN (Stage D machine-primary): the steady-state machine pointer\n    // returns the pre-established turn session BY REFERENCE — never a fresh build —\n    // so the turn-start manifest write + the per-op reads land on ONE\n    // SelfhostedSession/manifest. Matched on BOTH the sandbox id AND the epoch: a\n    // swap away (different id) or a swap-back (same id, higher epoch) falls through\n    // to a fresh build fenced under the CURRENT epoch (the stale pinned instance is\n    // fenced at the old epoch and must not be reused).\n    if (\n      deps.pinnedSelfhosted &&\n      pointer.activeSandboxId === deps.pinnedSelfhosted.sandboxId &&\n      pointer.activeEpoch === deps.pinnedSelfhosted.epoch\n    ) {\n      return {\n        session: deps.pinnedSelfhosted.session,\n        sandboxId: pointer.activeSandboxId,\n        kind: \"selfhosted\",\n      };\n    }\n\n    const sandbox = await deps.getSandbox(pointer.activeSandboxId);\n    if (!sandbox) {\n      throw new ActiveBackendUnresolvableError(\n        \"stale_pointer\",\n        `active sandbox ${pointer.activeSandboxId} not found in workspace ${deps.workspaceId}`,\n      );\n    }\n\n    if (sandbox.kind === \"selfhosted\") {\n      if (!sandbox.enrollmentId) {\n        throw new ActiveBackendUnresolvableError(\n          \"offline_enrollment\",\n          `selfhosted sandbox ${sandbox.id} has no enrollment (agent id) to address`,\n        );\n      }\n      // Build a request-scoped selfhosted client bound to the target's workspace +\n      // enrollment agentId, fenced under the swap's active_epoch. The agent echoes\n      // the epoch and rejects a stale op with ERROR_CODE_FENCED → the proxy\n      // re-resolves + retries against the new active sandbox. The SAME factory the\n      // worker turn's machine-primary establish branch uses (one build shape).\n      const connection = await deps.resolveSelfhostedConnection(sandbox);\n      if (!connection) {\n        throw new ActiveBackendUnresolvableError(\n          \"offline_enrollment\",\n          `selfhosted sandbox ${sandbox.id} has no live runner connection`,\n        );\n      }\n      if (!connection.workspaceRoot) {\n        throw new ActiveBackendUnresolvableError(\n          \"workspace_root_unavailable\",\n          `selfhosted sandbox ${sandbox.id} has not reported an absolute workspace root; reconnect it with a current agent`,\n        );\n      }\n      const workspaceRoot = resolveConnectedMachineWorkspaceRoot(\n        connection.workspaceRoot,\n        pointer.workingDir,\n      );\n      const { session } = await buildSelfhostedBackendSession({\n        workspaceId: deps.workspaceId,\n        ...(connection.workspaceId !== undefined\n          ? { controlWorkspaceId: connection.workspaceId }\n          : {}),\n        relay: deps.relay,\n        controlRpcFactory: deps.controlRpcFactory,\n        agentId: sandbox.enrollmentId,\n        connectionInstanceId: connection.connectionInstanceId,\n        workspaceRoot,\n        epoch: pointer.activeEpoch,\n        ...(deps.selfhostedTimeoutMs !== undefined ? { timeoutMs: deps.selfhostedTimeoutMs } : {}),\n        ...(deps.selfhostedExecTimeoutMs !== undefined\n          ? { execTimeoutMs: deps.selfhostedExecTimeoutMs }\n          : {}),\n        ...(deps.selfhostedOnOp !== undefined ? { onOp: deps.selfhostedOnOp } : {}),\n        ...(deps.selfhostedAdoptBackgroundCommand !== undefined\n          ? { adoptBackgroundCommand: deps.selfhostedAdoptBackgroundCommand }\n          : {}),\n        ...(deps.selfhostedSettleBackgroundCommand !== undefined\n          ? { settleBackgroundCommand: deps.selfhostedSettleBackgroundCommand }\n          : {}),\n        ...(deps.selfhostedCaptureBackgroundCommandOutput\n          ? { captureBackgroundCommandOutput: deps.selfhostedCaptureBackgroundCommandOutput }\n          : {}),\n        ...(connection.opStream !== undefined ? { opStream: connection.opStream } : {}),\n        operationResourcePolicy: connection.operationResourcePolicy,\n        operationResourcePolicySupported: connection.operationResourcePolicySupported,\n        operationCpuQuotaSupported: connection.operationCpuQuotaSupported,\n        transactionalFsWriteSupported: connection.transactionalFsWriteSupported === true,\n        browserControlHttpSupported: connection.browserControlHttpSupported === true,\n        // The routing proxy caches this session by sandbox+epoch, but command\n        // policy and runner authority are mutable. Re-read one coherent DB\n        // snapshot only when a new exec/Git is admitted.\n        resolveOperationAdmission: async () => {\n          const current = await deps.resolveSelfhostedConnection(sandbox);\n          if (!current) return null;\n          if (!current.workspaceRoot) {\n            throw new ActiveBackendUnresolvableError(\n              \"workspace_root_unavailable\",\n              `selfhosted sandbox ${sandbox.id} no longer has a reported workspace root`,\n            );\n          }\n          return {\n            ...current,\n            workspaceRoot: resolveConnectedMachineWorkspaceRoot(\n              current.workspaceRoot,\n              pointer.workingDir,\n            ),\n          };\n        },\n        // The turn's declared environment → the session's manifest.environment, so\n        // the SDK's per-turn manifest-env delta is empty (no \"cannot change manifest\n        // environment variables\" throw on a pin-to-vm turn).\n        ...(deps.environment !== undefined ? { environment: deps.environment } : {}),\n        ...(deps.transientExecEnvironment !== undefined\n          ? { transientExecEnvironment: deps.transientExecEnvironment }\n          : {}),\n      });\n      return {\n        session: session as RoutableBackendSession,\n        sandboxId: sandbox.id,\n        kind: \"selfhosted\",\n      };\n    }\n\n    if (sandbox.kind === \"modal\") {\n      if (!deps.establishModalTarget) {\n        throw new ActiveBackendUnresolvableError(\n          \"unsupported_backend_context\",\n          `modal swap target ${sandbox.id} cannot be established in this context (no establisher wired)`,\n        );\n      }\n      const session = await deps.establishModalTarget(sandbox);\n      return { session, sandboxId: sandbox.id, kind: \"modal\" };\n    }\n\n    throw new ActiveBackendUnresolvableError(\n      \"unsupported_backend_context\",\n      `unsupported swap target kind \"${sandbox.kind}\" for sandbox ${sandbox.id}`,\n    );\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,SAAS,2BAA2B,yBAAyB;;;AC/B7D,SAAS,cAAc;AACvB,SAAS,OAAO,SAAS,SAAS,UAAU,UAAU,UAAU,UAAU;AAC1E,SAAS,cAAc;AACvB,SAAS,YAAY;AAqBd,IAAM,gCAAgC;AACtC,IAAM,8CAA8C;AAC3D,IAAM,wBAAwB;AAAA,EAC5B;AAAA,EACA;AACF;AAGA,SAAS,UAAU,QAAmC;AACpD,SAAO,IAAI,OAAO,MAAM,SAAS,2CAA2C;AAC9E;AACA,IAAM,cAAc,sBAAsB,IAAI,SAAS;AAIvD,eAAe,iBAAiB,KAA8C;AAC5E,MAAI;AACF,UAAM,OAAO,MAAM,SAAS,SAAS,GAAG,SAAS,MAAM;AAEvD,UAAM,SAAS,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC,EAAE,MAAM,GAAG;AAE9D,UAAM,YAAY,OAAO,EAAE;AAC3B,WAAO,aAAa,QAAQ,KAAK,SAAS,IAAI,YAAY;AAAA,EAC5D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,eAAuC;AACpD,MAAI;AACF,WAAO,kBAAkB,KAAK,MAAM,SAAS,mBAAmB,CAAC,IAAI,CAAC,KAAK;AAAA,EAC7E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,IAAI;AACJ,SAAS,eAA6C;AACpD,SAAQ,mBAAmB,YAAY;AACrC,UAAM,CAAC,WAAW,SAAS,IAAI,MAAM,QAAQ,IAAI,CAAC,aAAa,GAAG,iBAAiB,MAAM,CAAC,CAAC;AAC3F,WAAO,aAAa,YAAY,EAAE,WAAW,KAAK,QAAQ,KAAK,UAAU,IAAI;AAAA,EAC/E,GAAG;AACL;AAGA,IAAM,kBAAkB,oBAAI,IAAY;AACxC,IAAI,oBAAoB;AACxB,SAAS,8BAA8B;AACrC,aAAW,aAAa,iBAAiB;AACvC,QAAI;AACF,aAAO,WAAW,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,IACpD,QAAQ;AAAA,IAER;AAAA,EACF;AACA,kBAAgB,MAAM;AACxB;AAGA,eAAsB,oCACpB,MACA,OAA0B,+BACT;AACjB,QAAM,QAAQ,MAAM,aAAa;AACjC,QAAM,SAAS,QAAQ,GAAG,IAAI,IAAI,MAAM,SAAS,IAAI,MAAM,GAAG,IAAI,MAAM,SAAS,MAAM;AACvF,QAAM,YAAY,MAAM,QAAQ,KAAK,MAAM,MAAM,CAAC;AAClD,kBAAgB,IAAI,SAAS;AAC7B,MAAI,CAAC,mBAAmB;AACtB,wBAAoB;AACpB,YAAQ,KAAK,QAAQ,2BAA2B;AAAA,EAClD;AACA,SAAO;AACT;AAGA,eAAsB,oCAAoC,WAAkC;AAC1F,QAAM,GAAG,WAAW,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AACpD,kBAAgB,OAAO,SAAS;AAClC;AAEA,eAAe,YACb,SACA,OACkB;AAClB,MAAI,MAAM,cAAc,QAAQ,UAAW,QAAO;AAClD,MAAI,MAAM,QAAQ,QAAQ,IAAK,QAAO,MAAM,cAAc,QAAQ;AAClE,MAAI,CAAC,OAAO,cAAc,MAAM,GAAG,KAAK,MAAM,MAAM,EAAG,QAAO;AAC9D,QAAM,gBAAgB,MAAM,iBAAiB,MAAM,GAAG;AACtD,SAAO,kBAAkB,MAAM;AACjC;AAOA,eAAsB,6CACpB,QAA2B,0BAA0B,GAClC;AACnB,QAAM,UAAoB,CAAC;AAC3B,QAAM,UAAU,MAAM,aAAa;AACnC,QAAM,MAAM,OAAO,QAAQ,WAAW,aAAa,QAAQ,OAAO,IAAI;AACtE,MAAI,CAAC,WAAW,QAAQ,OAAW,QAAO;AAC1C,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,aAAa,OAAO;AAC7B,UAAM,OAAO,MAAM,SAAS,SAAS,EAAE,MAAM,MAAM,IAAI;AACvD,QAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,EAAG;AAC7B,SAAK,IAAI,IAAI;AACb,UAAM,QAAQ,MAAM,QAAQ,IAAI,EAAE,MAAM,MAAM,CAAC,CAAa;AAC5D,eAAW,QAAQ,OAAO;AACxB,YAAM,QAAQ,YAAY,IAAI,CAAC,YAAY,QAAQ,KAAK,IAAI,CAAC,EAAE,KAAK,OAAO;AAC3E,UAAI,CAAC,MAAO;AACZ,YAAM,QAAQ,EAAE,WAAW,MAAM,CAAC,GAAI,KAAK,OAAO,MAAM,CAAC,CAAC,GAAG,WAAW,MAAM,CAAC,EAAG;AAClF,UAAI;AACF,YAAI,CAAE,MAAM,YAAY,SAAS,KAAK,EAAI;AAC1C,cAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,cAAM,QAAQ,MAAM,MAAM,IAAI;AAC9B,YAAI,CAAC,MAAM,YAAY,KAAK,MAAM,QAAQ,IAAK;AAC/C,cAAM,GAAG,MAAM,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAC/C,gBAAQ,KAAK,IAAI;AAAA,MACnB,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,4BAAsC;AACpD,SAAO,CAAC,OAAO,GAAG,YAAY,MAAM;AACtC;AAEA,IAAI;AAGG,SAAS,mDAAsE;AACpF,SAAQ,iBAAiB,6CAA6C;AACxE;AAKO,IAAM,6CAA6C,OAAO,OAAO;AAAA,EACtE,MAAM,SAA0B;AAC9B,UAAM,iDAAiD;AACvD,WAAO,MAAM;AAAA,MACX,OAAO;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AACV,CAAC;;;AChLD,SAAS,yBAAyB;AAElC,SAAS,kCAAkC;;;ACF3C,SAAS,aAAa;AACtB,SAAS,mBAAmB;AAE5B,SAAS,cAAc;AAGvB,SAAS,kCAAkC;;;ACFpC,SAAS,iBAAiB,MAAkC;AACjE,QAAM,UAAU;AAAA,IACd,KAAK,SAAS;AAAA,IACd,KAAK,UAAU,KAAK,SAAS,QAAQ,QAAQ;AAAA,IAC7C,KAAK;AAAA,EACP;AACA,MAAI,CAAC,KAAK,MAAO,QAAO;AACxB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,KAAK;AAAA,IACL,GAAG;AAAA,EACL;AACF;;;ADOO,IAAM,8BAA8C,iBAAiB,MAAM,SAAS;AACzF,UAAQ,QAAQ,eAAe;AAC/B,SAAO,OAAO,KAAK,KAAK,KAAK,SAAS,OAAO;AAC/C;AAQA,IAAM,kBAEmB;AACzB,IAAM,qBAAN,cAAiC,gBAAgB;AAAA,EAC/C,kBAAkC;AAChC,WAAO;AAAA,EACT;AACF;AACA,IAAM,iBAAiB,oBAAI,QAAmC;AAEvD,SAAS,oBAAoB,QAAqC;AAGvE,MAAI,CAAC,OAAO,QAAS,QAAO,OAAO;AACnC,MAAI,OAAO,QAAQ,IAAI,YAAY,WAAW,iBAAiB,MAAM;AACnE,UAAM,IAAI,MAAM,6DAA6D;AAC/E,MAAI,aAAa,eAAe,IAAI,MAAM;AAC1C,MAAI,CAAC,YAAY;AACf,UAAM,UAAU,OAAO;AACvB,QAAI,CAAC,QAAQ,WAAW,CAAC,QAAQ;AAC/B,YAAM,IAAI,MAAM,mEAAmE;AACrF,iBAAa,IAAI,mBAAmB;AAAA,MAClC,SAAS,QAAQ;AAAA,MACjB,aAAa,QAAQ;AAAA,MACrB,UAAU,QAAQ;AAAA,MAClB,aAAa,QAAQ,eAAe;AAAA,MACpC,GAAI,QAAQ,wBAAwB,SAChC,EAAE,qBAAqB,QAAQ,oBAAoB,IACnD,CAAC;AAAA,MACL,GAAI,OAAO,SAAS,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;AAAA,IACnD,CAAC;AACD,mBAAe,IAAI,QAAQ,UAAU;AAAA,EACvC;AACA,SAAO,WAAW;AACpB;AAaO,SAAS,WAAW,OAAe,OAAqB,UAAmB;AAChF,QAAM,QAAQ,OAAO,OAAO,CAAC,OAAO,KAAK,OAAO,QAAQ,GAAG,GAAG,KAAK,CAAC;AACpE,MAAI,WAAW,MAAM;AACrB,MAAI,CAAC,UAAU;AACb,aAAS,QAAQ,KAAK,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,QAAQ,MAAM,QAAQ,SAAS;AAC7E,YAAM,QAAQ,MAAM,KAAK;AACzB,YAAM,QACJ,SAAS,OAAQ,SAAS,MACtB,IACA,SAAS,OAAQ,SAAS,MACxB,IACA,SAAS,OAAQ,SAAS,MACxB,IACA;AACV,UAAI,CAAC,SAAS,MAAM,SAAS,SAAS,MAAO;AAC7C,YAAM,SAAS,MAAM,SAAS,QAAQ,CAAC;AACvC,UAAI,CAAC,OAAO,MAAM,CAAC,SAAS,QAAQ,OAAQ,QAAQ,GAAI,EAAG;AAC3D,YAAM,SAAS,OAAO,CAAC;AACvB,UACE,WAAW,WACT,UAAU,OAAQ,SAAS,OAC1B,UAAU,OAAQ,SAAS,OAC3B,UAAU,OAAQ,SAAS,OAC3B,UAAU,OAAQ,SAAS;AAE9B;AACF,iBAAW;AACX;AAAA,IACF;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM,MAAM,SAAS,GAAG,QAAQ,EAAE,SAAS,MAAM;AAAA,IACjD,WAAW,MAAM,SAAS,QAAQ,EAAE,SAAS,QAAQ;AAAA,EACvD;AACF;AAMO,IAAM,sBAAN,MAAM,qBAAoB;AAAA,EACvB,YACW,QACA,iBACA,MACA,cAAuE,CAAC,GACzF;AAJiB;AACA;AACA;AACA;AAAA,EAChB;AAAA,EAEH,OAAO,WACL,QACA,WACA,MACA,cAAuE,CAAC,GACnD;AACrB,QAAI,OAAO,QAAQ,MAAM;AACvB,YAAM,IAAI,MAAM,gEAAgE;AAClF,WAAO,IAAI,qBAAoB,oBAAoB,MAAM,GAAG,WAAW,MAAM,WAAW;AAAA,EAC1F;AAAA,EAEA,IAAY,YAAoB;AAC9B,WAAO,OAAO,KAAK,oBAAoB,aACnC,KAAK,gBAAgB,IACrB,KAAK;AAAA,EACX;AAAA,EAEA,MAAM,MAAM,MAAwB,QAAqD;AACvF,YAAQ,eAAe;AACvB,UAAM,UAAU,MAAM,QAAQ,KAAK,MAAM,KAAK,WAAW,KAAK,IAAI;AAClE,QAAI,YAAY,KAAK,QAAQ,CAAC,QAAQ,WAAW,GAAG,KAAK,KAAK,QAAQ,QAAQ,EAAE,CAAC,GAAG;AAClF,YAAM,IAAI,MAAM,kDAAkD;AAGpE,UAAM,YAAY,KAAK;AACvB,UAAM,OAAO,MAAM,6CAA6C;AAAA,MAC9D,MAAM,KAAK,OAAO,iBAAiB,EAAE,UAAU,GAAG,SAAS,EAAE,OAAO,IAAI,MAAS;AAAA,MACjF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,UAAU,KAAK,WAAY,OAAM,IAAI,MAAM,mCAAmC;AACxF,QAAI,cAAc,KAAK;AACrB,YAAM,IAAI,MAAM,kDAAkD;AACpE,QAAI,UAAU,iBAAiB,IAAI;AACnC,UAAM,cACJ,OAAO,KAAK,gBAAgB,aAAa,KAAK,YAAY,IAAI,KAAK;AACrE,QAAI,OAAO,KAAK,WAAW,EAAE,QAAQ;AACnC,gBAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA,GAAG,OAAO,QAAQ,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,GAAG,GAAG,IAAI,KAAK,EAAE;AAAA,QACtE,GAAG;AAAA,MACL;AAAA,IACF;AAGA,UAAM,SAAS,MAAM,KAAK,OACvB;AAAA,MACC;AAAA,QACE,QAAQ,KAAK;AAAA,QACb;AAAA,QACA,0BAA0B;AAAA,QAC1B,cAAc;AAAA,QACd,cAAc;AAAA,QACd,cAAc;AAAA,QACd,aAAa;AAAA,QACb;AAAA,QACA,WAAW,CAAC;AAAA,QACZ,GAAI,KAAK,MACL;AAAA,UACE,SAAS;AAAA,YACP,SAAS;AAAA,YACT,WAAW;AAAA,YACX,WAAW;AAAA,YACX,SAAS;AAAA,YACT,cAAc;AAAA,YACd,gBAAgB;AAAA,YAChB,SAAS;AAAA,YACT,wBAAwB;AAAA,UAC1B;AAAA,QACF,IACA,CAAC;AAAA,MACP;AAAA,MACA,EAAE,SAAS,GAAG,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC,EAAG;AAAA,IAC9C,EACC,MAAM,CAAC,UAAmB;AACzB,YAAM,OAAQ,OAAqC;AACnD,UACE,OAAO,SAAS,YAChB;AAAA,QACE,OAAO;AAAA,QACP,OAAO;AAAA,QACP,OAAO;AAAA,QACP,OAAO;AAAA,QACP,OAAO;AAAA,MACT,EAAE,SAAS,IAAI;AAEf,cAAM,IAAI,kCAAkC,KAAK;AAGnD,YAAM,IAAI,qCAAqC,KAAK,QAAS,IAAI,KAAK;AAAA,IACxE,CAAC;AACH,QAAI,CAAC,OAAO;AACV,YAAM,IAAI;AAAA,QACR,KAAK;AAAA,QACL;AAAA,QACA,IAAI,MAAM,oDAAoD;AAAA,MAChE;AACF,WAAO;AAAA,MACL,MAAM;AAAA,MACN;AAAA,MACA,QAAQ,KAAK;AAAA,MACb,QAAQ,OAAO;AAAA,MACf,GAAI,KAAK,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC;AAAA,MAChC,SAAS;AAAA,QACP,QAAQ,EAAE,YAAY,GAAG,eAAe,IAAI,UAAU,KAAK;AAAA,QAC3D,QAAQ,EAAE,YAAY,GAAG,eAAe,IAAI,UAAU,KAAK;AAAA,MAC7D;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,KACJ,SACA,aACA,QACkC;AAClC,WAAO,KAAK,WAAW,SAAS,aAAa,MAAM;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,UACJ,SACA,aACA,cACkC;AAClC,WAAO,KAAK;AAAA,MAAW;AAAA,MAAS;AAAA,MAAa,aAAa;AAAA,MAAQ,CAAC,UACjE,aAAa,MAAM,KAAK;AAAA,IAC1B;AAAA,EACF;AAAA,EAEA,MAAc,WACZ,SACA,aACA,QACA,gBACkC;AAClC,YAAQ,eAAe;AACvB,SAAK,eAAe,OAAO;AAC3B,UAAM,OAAO,gBAAgB,OAAO;AACpC,QAAI;AACJ,UAAM,QAAS,CAAC,UAAU,QAAQ,EAC/B,IAAI,OAAO,WAAW;AACrB,YAAM,SAAS,QAAQ,QAAQ,MAAM;AACrC,UAAI,OAAO,aAAa,KAAM,QAAO;AACrC,YAAM,aAAa,WAAW,WAAW,IAAI;AAC7C,uBAAiB,SAAS,KAAK,OAAO;AAAA,QACpC;AAAA,UACE,QAAQ,QAAQ;AAAA,UAChB,SAAS,KAAK,IAAI,GAAG,WAAW,IAAI;AAAA,UACpC,gBAAgB,OAAO;AAAA,UACvB,gBAAgB;AAAA,UAChB,aAAa;AAAA,QACf;AAAA,QACA,SAAS,EAAE,OAAO,IAAI;AAAA,MACxB,GAAG;AACD,YAAI,MAAM,cAAc,OAAO,WAAY;AAC3C,YAAI,CAAC,OAAO,cAAc,MAAM,UAAU;AACxC,gBAAM,IAAI,MAAM,6BAA6B;AAC/C,cAAM,WAAW,MAAM,aAAa;AACpC,YAAI,YAAY,CAAC,OAAO,cAAc,MAAM,QAAQ;AAClD,gBAAM,IAAI,MAAM,2BAA2B;AAC7C,cAAM,UAAU;AAAA,UACd,OAAO;AAAA,UACP,MAAM,MACH,OAAO,CAAC,SAAS,KAAK,mBAAmB,UAAU,EACnD,IAAI,CAAC,SAAS,KAAK,YAAY;AAAA,UAClC;AAAA,QACF;AACA,aAAK,QAAQ,MAAM,IAAI;AAAA,UACrB,YAAY,MAAM;AAAA,UAClB,eAAe,QAAQ;AAAA,UACvB,UAAU,WAAW,MAAM,WAAY;AAAA,QACzC;AACA,eAAO;AAAA,UACL;AAAA,UACA,SAAS,SAAS,QAAQ,MAAM,IAAI,MAAM,IAAI,OAAO,UAAU,IAAI,MAAM,UAAU;AAAA,UACnF,MAAM,QAAQ;AAAA,QAChB;AAAA,MACF;AACA,aAAO;AAAA,IACT,CAAC,EACA;AAAA,MAAI,CAAC,SACJ,CAAC,iBACG,OACA,KAAK,MAAM,CAAC,UAAmB;AAK7B,oBAAY,EAAE,MAAM;AACpB,uBAAe,KAAK;AACpB,cAAM;AAAA,MACR,CAAC;AAAA,IACP;AACF,UAAM,QAAQ,iBACV,MAAM,QAAQ,WAAW,KAAK,EAAE,KAAK,CAAC,YAAY;AAChD,UAAI,QAAS,OAAM,QAAQ;AAC3B,aAAO,QAAQ,IAAI,CAAC,WAAW;AAC7B,YAAI,OAAO,WAAW,WAAY,OAAM,OAAO;AAC/C,eAAO,OAAO;AAAA,MAChB,CAAC;AAAA,IACH,CAAC,IACD,MAAM,QAAQ,IAAI,KAAK;AAC3B,UAAM,aAAa,KAAK,QAAQ,OAAO;AACvC,UAAM,aAAa,KAAK,QAAQ,OAAO;AACvC,QAAI,eAAe,QAAQ,eAAe,QAAQ,eAAe;AAC/D,YAAM,IAAI,MAAM,yDAAyD;AAC3E,WAAO;AAAA,MACL,SAAS;AAAA,MACT,gBAAgB,QAAQ,MAAM,WAAW;AAAA,MACzC,QAAQ,MAAM,OAAO,CAAC,SAA2C,SAAS,IAAI;AAAA,MAC9E,UAAU,eAAe,QAAQ,eAAe,OAAO,aAAa;AAAA,IACtE;AAAA,EACF;AAAA,EAEA,MAAM,MAAM,SAA+B,OAAe,cAAqC;AAC7F,SAAK,eAAe,OAAO;AAC3B,QAAI,CAAC,MAAO;AACZ,QAAI,CAAC,OAAO,cAAc,YAAY,KAAK,eAAe;AACxD,YAAM,IAAI,MAAM,0DAA0D;AAC5E,UAAM,KAAK,OAAO;AAAA,MAChB;AAAA,QACE,QAAQ,QAAQ;AAAA,QAChB,OAAO,EAAE,SAAS,OAAO,KAAK,KAAK,GAAG,cAAc,KAAK,MAAM;AAAA,MACjE;AAAA,MACA,EAAE,SAAS,EAAE;AAAA,IACf;AAAA,EACF;AAAA,EAEQ,eAAe,SAAqC;AAC1D,+BAA2B,MAAM,OAAO;AACxC,QACE,QAAQ,SAAS,sBACjB,QAAQ,cAAc,KAAK,aAC3B,CAAC,QAAQ,UACT,CAAC,QAAQ;AAET,YAAM,IAAI,MAAM,2DAA2D;AAAA,EAC/E;AACF;;;AD9WA,IAAM,YAAY,iBACf,OAAO;AAAA,EACN,OAAO,iBACJ,WAAW,UAAU,EACrB,UAAU,CAAC,UAAuC,KAAK,EACvD;AAAA,IACC,CAAC,UAAU,MAAM,cAAc;AAAA,IAC/B;AAAA,EACF;AAAA,EACF,KAAK,iBAAE,QAAQ;AACjB,CAAC,EACA,OAAO;AACV,IAAM,UAAU,iBAAE,mBAAmB,UAAU;AAAA,EAC7C,iBAAE,OAAO,EAAE,QAAQ,iBAAE,QAAQ,aAAa,GAAG,MAAM,iBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO;AAAA,EACzF,iBAAE,OAAO,EAAE,QAAQ,iBAAE,QAAQ,mBAAmB,GAAG,MAAM,iBAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO;AACtF,CAAC;AACD,IAAM,UAAU,iBACb,OAAO;AAAA,EACN,UAAU,iBAAE,QAAQ,0BAA0B;AAAA,EAC9C,UAAU;AAAA,EACV,SAAS;AAAA,EACT,SAAS,iBAAE,OAAO,EAAE,QAAQ,WAAW,QAAQ,UAAU,CAAC,EAAE,OAAO;AAAA,EACnE,MAAM;AACR,CAAC,EACA,OAAO;AAcV,SAAS,QACP,UACA,SACA,MACc;AACd,QAAM,UAAU,gBAAgB,QAAQ;AACxC,QAAM,SAA0C,CAAC;AACjD,aAAW,UAAU,CAAC,UAAU,QAAQ,GAAY;AAClD,UAAM,MAAM,SAAS,QAAQ,MAAM;AACnC,UAAM,OAAO,QAAQ,MAAM;AAC3B,UAAM,UAAU,WAAW,IAAI,eAAe,CAAC,KAAK,KAAK,GAAG,KAAK,GAAG;AACpE,UAAM,aAAa,IAAI,aAAa,KAAK,MAAM;AAC/C,QAAI,CAAC,OAAO,cAAc,UAAU,EAAG,OAAM,IAAI,MAAM,+BAA+B;AACtF,YAAQ,QAAQ,MAAM,IAAI;AAAA,MACxB;AAAA,MACA,eAAe,QAAQ;AAAA,MACvB,KAAK,KAAK;AAAA,MACV,UAAU,KAAK,MAAM,KAAK,OAAO;AAAA,IACnC;AACA,QAAI,QAAQ;AACV,aAAO,KAAK;AAAA,QACV;AAAA,QACA,SAAS,gBAAgB,SAAS,MAAM,IAAI,MAAM,IAAI,IAAI,UAAU,IAAI,UAAU,IAAI,KAAK,MAAM,IAAI,CAAC;AAAA,QACtG,MAAM,QAAQ;AAAA,MAChB,CAAC;AAAA,EACL;AACA,SAAO;AAAA,IACL;AAAA,IACA,UAAU,gBAAgB,QAAQ;AAAA,IAClC;AAAA,IACA,UAAU,QAAQ,QAAQ,OAAO,OAAO,QAAQ,QAAQ,OAAO,MAAM,KAAK,OAAO;AAAA,IACjF,gBAAgB,KAAK,SAAS;AAAA,IAC9B,gBAAgB,SAAS,MAAM,WAAW;AAAA,EAC5C;AACF;AAIO,SAAS,0BACd,SACA,SACA,MACmD;AACnD,QAAM,WAAW,gBAAgB,OAAO;AACxC,QAAM,WAAW;AAAA,IACf,QAAQ,EAAE,OAAO,OAAO,KAAK,QAAQ,OAAO,KAAK,GAAG,KAAK,QAAQ,OAAO,IAAI;AAAA,IAC5E,QAAQ,EAAE,OAAO,OAAO,KAAK,QAAQ,OAAO,KAAK,GAAG,KAAK,QAAQ,OAAO,IAAI;AAAA,EAC9E;AACA,QAAM,SAAS,QAAQ,UAAU,UAAU,IAAI;AAC/C,SAAO;AAAA,IACL,KAAK;AAAA,MACH,UAAU;AAAA,MACV;AAAA,MACA,SAAS,gBAAgB,OAAO,OAAO;AAAA,MACvC,SAAS;AAAA,MACT,MAAM,EAAE,GAAG,KAAK;AAAA,IAClB;AAAA,IACA;AAAA,EACF;AACF;AAMO,SAAS,yBACd,OACA,SACc;AACd,QAAM,OAAO,QAAQ,MAAM,KAAK;AAChC,QAAM,WAAW,2BAA2B,MAAM,OAAO;AACzD,MAAI,CAAC,kBAAkB,KAAK,UAAU,QAAQ;AAC5C,UAAM,IAAI,MAAM,mDAAmD;AACrE,aAAW,UAAU,CAAC,UAAU,QAAQ,GAAY;AAClD,UAAM,MAAM,SAAS,QAAQ,MAAM;AACnC,UAAM,MAAM,KAAK,QAAQ,MAAM;AAC/B,UAAM,YAAY,OAAO,KAAK,IAAI,eAAe,QAAQ;AACzD,QACE,UAAU,SAAS,QAAQ,MAAM,IAAI,iBACrC,UAAU,SAAS,KACnB,UAAU,SAAS,IAAI,cACtB,IAAI,OAAO,UAAU,WAAW;AAEjC,YAAM,IAAI,MAAM,+CAA+C;AACjE,QAAI,IAAI,QAAQ,CAAC,IAAI,OAAO,IAAI,MAAM,eAAe;AACnD,YAAM,IAAI,MAAM,kDAAkD;AACpE,QAAI,IAAI,aAAa,QAAQ,KAAK,KAAK,SAAS,IAAI;AAClD,YAAM,IAAI,MAAM,6CAA6C;AAAA,EACjE;AACA,MACE,KAAK,KAAK,WAAW,wBACpB,CAAC,SAAS,QAAQ,OAAO,OACxB,CAAC,SAAS,QAAQ,OAAO,OACzB,SAAS,QAAQ,OAAO,aAAa,KAAK,KAAK,QAC/C,SAAS,QAAQ,OAAO,aAAa,KAAK,KAAK;AAEjD,UAAM,IAAI,MAAM,qDAAqD;AACvE,QAAM,SAAS,QAAQ,UAAU,KAAK,SAAS,KAAK,IAAI;AACxD,MAAI,CAAC,kBAAkB,KAAK,SAAS,OAAO,OAAO;AACjD,UAAM,IAAI,MAAM,6DAA6D;AAC/E,SAAO;AACT;;;AGlJA,SAAS,cAAAA,mBAA6B;AACtC,SAAS,aAAAC,kBAAmC;AAC5C;AAAA,EACE,SAAAC;AAAA,EACA;AAAA,EACA,QAAAC;AAAA,EACA,WAAAC;AAAA,EACA,YAAAC;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,cAAAC,aAAY,QAAAC,OAAM,UAAU,SAAS,WAAW;;;ACZzD,SAAS,kBAAkB;AAC3B,SAAS,iBAAiB;AAC1B,SAAS,SAAAC,QAAO,MAAM,WAAAC,gBAAe;AACrC,SAAS,YAAY,QAAAC,aAAY;AACjC;AAAA,EACE;AAAA,EACA,2BAAAC;AAAA,EACA;AAAA,EACA;AAAA,OAMK;AASP;AAAA,EACE,wCAAAC;AAAA,EACA,2BAAAC;AAAA,EACA,2BAAAC;AAAA,EACA,mCAAAC;AAAA,OAOK;AAiBP,eAAsB,kCACpB,SACA,cACA,SACA,wBAC0C;AAC1C,QAAM,SAAS;AACf,QAAM,OAAO,kCAAkC;AAC/C,QAAM,OAAO,wBAAwB,MAAM;AAC3C,MACE,QAAQ,aAAa,WACrB,CAAC,QACD,CAAC,0BACD,QAAQ,aAAa,gBACrB;AACA,WAAO,MAAM,gCAAgC,SAAS,cAAc,OAAO;AAAA,EAC7E;AACA,SAAO,MAAM;AAAA,IACX;AAAA,IACA,YAAY;AACV,YAAM,EAAE,OAAO,UAAU,IAAI,MAAM;AAAA,QACjC;AAAA,QACA,6BAA6B,MAAM;AAAA,QACnC,OAAO;AAAA,QACP,QAAQ;AAAA,MACV;AACA,aAAO;AAAA,QACL,MAAM;AAAA,QACN;AAAA,QACA,YAAY;AAAA,UACV,SAAS;AAAA,UACT,UAAU,OAAO,OAAO,YAAY,EAAE,SAAS,IAAI,GAAG,CAAC,IAAI,MAAM,MAAM;AAAA,UACvE,eAAe,MAAM;AAAA,UACrB,cAAc,MAAM;AAAA,UACpB,YAAY,IAAI,KAAK,YAAY,EAAE,YAAY;AAAA,UAC/C;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,EACV;AACF;AAEA,eAAsB,wBACpB,SACe;AACf,MAAI,SAAS,SAAS,aAAc,OAAM,QAAQ,MAAM,QAAQ;AAClE;AAmBO,IAAM,iCAAN,cAA6C,MAAM;AAAA,EAIxD,YACkB,MAChB,SACA,UAAoD,CAAC,GACrD;AACA,UAAM,SAAS,QAAQ,UAAU,SAAY,SAAY,EAAE,OAAO,QAAQ,MAAM,CAAC;AAJjE;AAKhB,SAAK,YAAY,QAAQ,aAAa;AAAA,EACxC;AAAA,EAVS,OAAO;AAAA,EACP;AAUX;AAkDA,SAAS,OAAO,OAA2B;AACzC,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACxD;AAEA,SAAS,mBAAmB,OAAkC;AAC5D,MAAI,MAAM,WAAW,KAAK,MAAM,SAAS,MAAM,KAAK,CAAC,yBAAyB,KAAK,KAAK,GAAG;AACzF,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,WAAW,KAAK,OAAO,KAAK,OAAO,QAAQ,CAAC;AAC1D,SAAO,OAAO,KAAK,KAAK,EAAE,SAAS,QAAQ,MAAM,QAAQ,QAAQ;AACnE;AAEO,SAAS,8BACd,OACA,eAAe,KAAK,IAAI,GACS;AACjC,QAAM,SAASF,yBAAwB,KAAK;AAC5C,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,gBAAgB,OAAO,KAAK;AAClC,SAAO;AAAA,IACL,SAAS;AAAA,IACT,MAAM;AAAA,IACN,UAAU,OAAO,OAAO,YAAY,EAAE,SAAS,IAAI,GAAG,CAAC,IAAI,aAAa;AAAA,IACxE;AAAA,IACA,cAAc,MAAM;AAAA,IACpB,YAAY,IAAI,KAAK,YAAY,EAAE,YAAY;AAAA,IAC/C,UAAU,OAAO;AAAA,IACjB,YAAY,OAAO;AAAA,IACnB,GAAI,OAAO,uBAAuB,EAAE,sBAAsB,OAAO,qBAAqB,IAAI,CAAC;AAAA,EAC7F;AACF;AAEO,SAAS,oCACdG,SACA,eAAe,KAAK,IAAI,GACgD;AACxE,MAAI,OAAOA,YAAW,SAAU,QAAO;AACvC,QAAM,QAAQ,mBAAmBA,OAAM;AACvC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,aAAa,8BAA8B,OAAO,YAAY;AACpE,SAAO,aAAa,EAAE,eAAeA,SAAQ,WAAW,IAAI;AAC9D;AAEO,SAAS,6BACdA,SACA,UACiC;AACjC,MAAIA,YAAW,UAAaA,YAAW,QAAQA,YAAW,GAAI,QAAO;AACrE,MAAI,OAAOA,YAAW,UAAU;AAC9B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,aAAa,UAAa,aAAa,MAAM;AAC/C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,aAAa,gCAAgC,QAAQ;AAC3D,MAAI,CAAC,YAAY;AACf,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAQ,mBAAmBA,OAAM;AACvC,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR;AAAA,MACA,8BAA8B,WAAW,QAAQ;AAAA,IACnD;AAAA,EACF;AACA,QAAM,aAAa,OAAO,KAAK;AAC/B,MAAI,MAAM,WAAW,WAAW,gBAAgB,eAAe,WAAW,eAAe;AACvF,UAAM,IAAI;AAAA,MACR;AAAA,MACA,8BAA8B,WAAW,QAAQ;AAAA,IACnD;AAAA,EACF;AACA,QAAM,iBAAiBH,yBAAwB,KAAK;AACpD,MAAI,WAAW,YAAY,sCAAsC;AAC/D,QACE,CAAC,kBACD,eAAe,aAAa,WAAW,YACvC,eAAe,eAAe,WAAW,cACzC,eAAe,yBAAyB,WAAW,sBACnD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA,8DAA8D,WAAW,QAAQ;AAAA,MACnF;AAAA,IACF;AAAA,EACF,WAAW,gBAAgB;AACzB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,kCAAkC,WAAW,QAAQ;AAAA,IACvD;AAAA,EACF;AACA,SAAO;AAAA,IACL;AAAA,IACA,QAAAG;AAAA,IACA;AAAA,IACA,MAAM,WAAW,YAAY,uCAAuC,sBAAsB;AAAA,IAC1F,GAAI,WAAW,YAAY,wCAAwC,iBAC/D,EAAE,eAAe,IACjB,CAAC;AAAA,EACP;AACF;AAIA,eAAsB,iCACpB,cACA,gBACkC;AAClC,QAAM,MAAM,+BAA+B,aAAa,mBAAmB;AAC3E,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,SAAS,MAAM,eAAe,IAAI,GAAG;AAC3C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,MACA,4BAA4B,IAAI,GAAG;AAAA,IACrC;AAAA,EACF;AACA,QAAM,aAAa,OAAO,OAAO,KAAK;AACtC,MAAI,OAAO,MAAM,WAAW,IAAI,SAAS,eAAe,IAAI,QAAQ;AAClE,UAAM,IAAI;AAAA,MACR;AAAA,MACA,4BAA4B,IAAI,GAAG;AAAA,IACrC;AAAA,EACF;AACA,QAAMA,UAAS,OAAO,KAAK,OAAO,KAAK,EAAE,SAAS,QAAQ;AAC1D,QAAM,SAAS,aAAa;AAC5B,MAAI,OAAO,WAAW,YAAY,OAAO,SAAS,KAAK,WAAWA,SAAQ;AACxE,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,+BAA6BA,SAAQ,aAAa,oBAAoB;AACtE,SAAO,EAAE,GAAG,cAAc,kBAAkBA,QAAO;AACrD;AAEA,SAAS,qBAAqB,OAAwB;AACpD,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,YAAY,qBAAqB,KAAK,KAAK;AACjD,WAAO,YAAY,MAAM,MAAM,UAAU,QAAQ,UAAU,CAAC,EAAE,MAAM,IAAI;AAAA,EAC1E;AACA,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,SAAS;AACf,SAAO,OAAO,OAAO,WAAW,WAC5B,OAAO,SACP,OAAO,OAAO,WAAW,WACvB,OAAO,SACP;AACR;AAEA,SAAS,sBAAsB,OAAwB;AACrD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,SAAS;AAKf,QAAMC,UACJ,OAAO,OAAO,aAAa,WACvB,YAAY,OAAO,QAAQ,KAC3B,OAAO,OAAO,WAAW,WACvB,UAAU,OAAO,MAAM,KACvB;AACR,QAAM,SACJ,OAAO,OAAO,WAAW,WACrB,OAAO,OAAO,QAAQ,QAAQ,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,GAAG,IACtD;AACN,SAAO,OAAO,SAAS,IAAI,GAAGA,OAAM,YAAY,MAAM,KAAKA;AAC7D;AAEA,SAAS,wCAAwC,OAAyB;AACxE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,SAAS;AAKf,QAAM,WACJ,OAAO,OAAO,aAAa,WACvB,OAAO,WACP,OAAO,OAAO,WAAW,WACvB,OAAO,SACP;AACR,MAAI,aAAa,KAAK,OAAO,OAAO,WAAW,SAAU,QAAO;AAChE,SAAO,OAAO,OACX,MAAM,OAAO,EACb,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,KAAK,CAAC,SAAS,SAAS,oCAAoC;AACjE;AAEA,SAASC,YAAW,OAAuB;AACzC,SAAO,IAAI,MAAM,WAAW,KAAK,OAAO,CAAC;AAC3C;AAEA,SAAS,6BAA6B,SAAqC;AACzE,SAAO,CAAC,GAAI,QAAQ,OAAO,UAAU,4BAA4B,KAAK,CAAC,CAAE,EACtE,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,SAAS,CAAC,EAC5E,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC;AACpD;AAIO,SAAS,8BAA8B,SAA4B;AACxE,SAAO,6BAA6B,OAA2B;AACjE;AAEA,SAAS,oBAAoB,eAA0C;AACrE,QAAM,eAAe,cAAc,QAAQ,CAAC,SAAS;AAAA,IACnD,SAASA,YAAW,KAAK,IAAI,EAAE,CAAC;AAAA,IAChC,SAASA,YAAW,KAAK,IAAI,IAAI,CAAC;AAAA,EACpC,CAAC;AACD,SAAO,aAAa,WAAW,IAAI,KAAK,OAAO,aAAa,KAAK,MAAM,CAAC;AAC1E;AAEA,SAAS,4BAA4B,eAA0C;AAC7E,QAAM,cAAc,cAAc,QAAQ,CAAC,SAAS;AAAA,IAClDA,YAAW,aAAa,IAAI,EAAE;AAAA,IAC9BA,YAAW,eAAe,IAAI,EAAE;AAAA,EAClC,CAAC;AACD,QAAM,aAAa,oBAAoB,aAAa;AACpD,QAAM,SAAS,OAAO;AAAA;AAAA,wBAEA,YAAY,KAAK,GAAG,CAAC;AAAA,qCACR,UAAU;AAAA,uBACxB,UAAU;AAAA,uBACV,UAAU;AAAA;AAE/B,SAAO,uBAAuBA,YAAW,MAAM,CAAC;AAClD;AAEA,IAAM,+BAA+B;AACrC,IAAM,8BAA8B,UAAU,WAAW,UAAU;AAEnE,SAAS,wBAAwB,SAA0C;AACzE,QAAM,OAAO,QAAQ,OAAO;AAC5B,SAAO,OAAO,SAAS,YAAY,WAAW,IAAI,IAAI,OAAO;AAC/D;AAEA,SAAS,uBACP,MACA,OACA,OACM;AACN,OAAK,OAAO,KAAK;AACjB,OAAK,OAAO,IAAI;AAChB,OAAK,OAAO,OAAO,OAAO,WAAW,KAAK,CAAC,CAAC;AAC5C,OAAK,OAAO,IAAI;AAChB,OAAK,OAAO,KAAK;AACjB,OAAK,OAAO,IAAI;AAClB;AAEA,SAAS,yBAAyB,MAAc,OAAuB;AACrE,SAAO,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI;AAChD;AAEA,SAAS,8BACP,gBACA,WAC0B;AAC1B,QAAM,cAAc,CAAC,GAAG,cAAc,EAAE,KAAK,wBAAwB;AACrE,QAAM,QAAQ,CAAC,GAAG,SAAS,EAAE;AAAA,IAAK,CAAC,MAAM,UACvC,yBAAyB,KAAK,MAAM,MAAM,IAAI;AAAA,EAChD;AACA,QAAM,QAAQ,oBAAI,IAAY;AAC9B,QAAM,OAAO,WAAW,QAAQ;AAChC,yBAAuB,MAAM,cAAc,4BAA4B;AACvE,aAAW,aAAa,aAAa;AACnC,QAAI,MAAM,IAAI,SAAS,GAAG;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,EAAE,WAAW,KAAK;AAAA,MACpB;AAAA,IACF;AACA,UAAM,IAAI,SAAS;AACnB,2BAAuB,MAAM,OAAO,SAAS;AAAA,EAC/C;AACA,MAAI,iBAAiB;AACrB,aAAW,QAAQ,OAAO;AACxB,QAAI,MAAM,IAAI,KAAK,IAAI,GAAG;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,EAAE,WAAW,KAAK;AAAA,MACpB;AAAA,IACF;AACA,UAAM,IAAI,KAAK,IAAI;AACnB,sBAAkB,KAAK,QAAQ;AAC/B,QAAI,CAAC,OAAO,cAAc,cAAc,GAAG;AACzC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,2BAAuB,MAAM,QAAQ,KAAK,IAAI;AAC9C,2BAAuB,MAAM,SAAS,OAAO,KAAK,QAAQ,UAAU,CAAC;AACrE,SAAK,OAAO,KAAK,OAAO;AAAA,EAC1B;AACA,SAAO;AAAA,IACL,WAAW;AAAA,IACX,QAAQ,KAAK,OAAO,KAAK;AAAA,IACzB,YAAY,YAAY,SAAS,MAAM;AAAA,IACvC,WAAW,MAAM;AAAA,IACjB;AAAA,IACA,YAAY;AAAA,EACd;AACF;AAEA,SAAS,eAAe,OAAiC;AACvD,SACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,CAAC,MAAM,WAAW,GAAG,KACrB,CAAC,MAAM,SAAS,IAAI,KACpB,MAAM,MAAM,GAAG,EAAE,MAAM,CAAC,YAAY,QAAQ,SAAS,KAAK,YAAY,OAAO,YAAY,IAAI;AAEjG;AAEA,SAAS,qBAAqB,OAAmC;AAC/D,MAAI,UAAU,GAAI,QAAO,IAAI,WAAW;AACxC,SAAO,OAAO,UAAU,WAAW,mBAAmB,KAAK,IAAI;AACjE;AAKA,SAAS,2BAA2B,OAA6C;AAC/E,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;AAAA,EAC9E,QAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,EAAE,WAAW,KAAK;AAAA,IACpB;AAAA,EACF;AACA,MAAI,CAAC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAAG;AACrE,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,EAAE,WAAW,KAAK;AAAA,IACpB;AAAA,EACF;AACA,QAAM,UAAU;AAKhB,MACE,QAAQ,YAAY,KACpB,CAAC,MAAM,QAAQ,QAAQ,WAAW,KAClC,CAAC,QAAQ,YAAY,MAAM,cAAc,KACzC,CAAC,MAAM,QAAQ,QAAQ,KAAK,GAC5B;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,EAAE,WAAW,KAAK;AAAA,IACpB;AAAA,EACF;AACA,QAAM,QAA+B,CAAC;AACtC,aAAW,aAAa,QAAQ,OAAO;AACrC,QAAI,CAAC,aAAa,OAAO,cAAc,YAAY,MAAM,QAAQ,SAAS,GAAG;AAC3E,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,EAAE,WAAW,KAAK;AAAA,MACpB;AAAA,IACF;AACA,UAAM,OAAO;AACb,UAAM,UAAU,qBAAqB,KAAK,IAAI;AAC9C,QAAI,CAAC,eAAe,KAAK,IAAI,KAAK,CAAC,SAAS;AAC1C,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,EAAE,WAAW,KAAK;AAAA,MACpB;AAAA,IACF;AACA,UAAM,KAAK,EAAE,MAAM,KAAK,MAAM,QAAQ,CAAC;AAAA,EACzC;AACA,SAAO,8BAA8B,QAAQ,aAAa,KAAK;AACjE;AAEA,SAAS,oBACP,MACA,OACS;AACT,SAAO,KAAK,QAAQ,MAAM,OAAO,KAAK,QAAQ,MAAM;AACtD;AAEA,SAAS,kBAAkD;AACzD,SAAO,IAAI;AAAA,IACT;AAAA,IACA;AAAA,IACA,EAAE,WAAW,KAAK;AAAA,EACpB;AACF;AAEA,eAAe,mBACb,MACA,UACiB;AACjB,QAAM,SAAS,MAAMC,OAAM,IAAI,EAAE,MAAM,MAAM;AAC3C,UAAM,gBAAgB;AAAA,EACxB,CAAC;AACD,MAAI,CAAC,OAAO,OAAO,KAAK,CAAC,oBAAoB,QAAQ,QAAQ,GAAG;AAC9D,UAAM,gBAAgB;AAAA,EACxB;AACA,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,KAAK,MAAM,2BAA2B;AAAA,EACvD,QAAQ;AACN,UAAM,gBAAgB;AAAA,EACxB;AACA,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,KAAK;AACjC,QAAI,CAAC,OAAO,OAAO,KAAK,CAAC,oBAAoB,QAAQ,MAAM,GAAG;AAC5D,YAAM,gBAAgB;AAAA,IACxB;AACA,UAAM,UAAU,MAAM,OAAO,SAAS;AACtC,UAAM,QAAQ,MAAM,OAAO,KAAK;AAChC,QACE,CAAC,MAAM,OAAO,KACd,CAAC,oBAAoB,OAAO,MAAM,KAClC,MAAM,SAAS,OAAO,QACtB,MAAM,YAAY,OAAO,WACzB,MAAM,YAAY,OAAO,SACzB;AACA,YAAM,gBAAgB;AAAA,IACxB;AACA,WAAO;AAAA,EACT,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAEA,SAAS,0BAA0B,MAAc,eAA6C;AAC5F,aAAW,YAAY,eAAe;AACpC,QAAI,aAAa,MAAM,SAAS,YAAY,KAAK,WAAW,GAAG,QAAQ,GAAG,EAAG,QAAO;AAAA,EACtF;AACA,SAAO;AACT;AAOA,eAAe,+BACb,MACA,eACmC;AACnC,QAAM,WAAW,IAAI,IAAI,aAAa;AACtC,QAAM,cAAwB,CAAC;AAC/B,QAAM,QAA+B,CAAC;AAEtC,QAAM,OAAO,OACX,aACA,eAAe,IACf,aACkB;AAClB,UAAM,SAAS,MAAMA,OAAM,WAAW,EAAE,MAAM,MAAM;AAClD,YAAM,gBAAgB;AAAA,IACxB,CAAC;AACD,QAAI,CAAC,OAAO,YAAY,KAAM,YAAY,CAAC,oBAAoB,QAAQ,QAAQ,GAAI;AACjF,YAAM,gBAAgB;AAAA,IACxB;AACA,UAAM,UAAU,MAAMC,SAAQ,aAAa,EAAE,eAAe,KAAK,CAAC;AAClE,UAAM,YAAY,MAAMD,OAAM,WAAW,EAAE,MAAM,MAAM;AACrD,YAAM,gBAAgB;AAAA,IACxB,CAAC;AACD,QAAI,CAAC,UAAU,YAAY,KAAK,CAAC,oBAAoB,WAAW,MAAM,GAAG;AACvE,YAAM,gBAAgB;AAAA,IACxB;AACA,YAAQ,KAAK,CAAC,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;AACjE,eAAW,SAAS,SAAS;AAC3B,YAAM,eAAe,eAAe,GAAG,YAAY,IAAI,MAAM,IAAI,KAAK,MAAM;AAC5E,UAAI,0BAA0B,cAAc,QAAQ,EAAG;AACvD,YAAM,YAAYE,MAAK,aAAa,MAAM,IAAI;AAC9C,YAAM,QAAQ,MAAMF,OAAM,SAAS,EAAE,MAAM,MAAM;AAC/C,cAAM,gBAAgB;AAAA,MACxB,CAAC;AACD,UAAI,MAAM,YAAY,GAAG;AACvB,oBAAY,KAAK,YAAY;AAC7B,cAAM,KAAK,WAAW,cAAc,KAAK;AACzC;AAAA,MACF;AAIA,UAAI,CAAC,MAAM,OAAO,EAAG;AACrB,YAAM,UAAU,MAAM,mBAAmB,WAAW,KAAK;AACzD,YAAM,KAAK,EAAE,MAAM,cAAc,QAAQ,CAAC;AAAA,IAC5C;AACA,UAAM,YAAY,MAAMA,OAAM,WAAW,EAAE,MAAM,MAAM;AACrD,YAAM,gBAAgB;AAAA,IACxB,CAAC;AACD,QAAI,CAAC,UAAU,YAAY,KAAK,CAAC,oBAAoB,WAAW,MAAM,GAAG;AACvE,YAAM,gBAAgB;AAAA,IACxB;AAAA,EACF;AAEA,QAAM,KAAK,IAAI;AACf,SAAO,8BAA8B,aAAa,KAAK;AACzD;AAEA,eAAe,2BACb,QACmC;AACnC,QAAMG,OAAM,OAAO,QAAQ,OAAO;AAClC,MAAI,CAACA,MAAK;AACR,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAM,4BAA4B,6BAA6B,MAAM,CAAC;AAC5E,MAAI;AACJ,MAAI,QAAiC;AACrC,WAAS,UAAU,GAAG,WAAW,GAAG,WAAW,GAAG;AAChD,aAAS,MAAMA,KAAI,KAAK,QAAQ;AAAA,MAC9B;AAAA,MACA,aAAa;AAAA,MACb,iBAAiB;AAAA,IACnB,CAAC;AACD,YAAQ,qBAAqB,MAAM,EAChC,KAAK,EACL,MAAM,+EAA+E;AACxF,QAAI,SAAS,CAAC,wCAAwC,MAAM,KAAK,YAAY,EAAG;AAChF,UAAM,IAAI,QAAQ,CAACC,aAAY,WAAWA,UAAS,UAAU,EAAE,CAAC;AAAA,EAClE;AACA,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iEAAiE,sBAAsB,MAAM,CAAC;AAAA,MAC9F,EAAE,WAAW,KAAK;AAAA,IACpB;AAAA,EACF;AACA,QAAM,aAAa,OAAO,MAAM,CAAC,CAAC;AAClC,QAAM,YAAY,OAAO,MAAM,CAAC,CAAC;AACjC,QAAM,iBAAiB,OAAO,MAAM,CAAC,CAAC;AACtC,MAAI,CAAC,CAAC,YAAY,WAAW,cAAc,EAAE,MAAM,OAAO,aAAa,GAAG;AACxE,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AAAA,IACL,WAAW;AAAA,IACX,QAAQ,MAAM,CAAC;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAsBO,SAAS,yBACd,SAC0B;AAC1B,QAAM,UAAoB,CAAC;AAC3B,MAAI,iBAAiB;AACrB,MAAI,YAAY;AAChB,MAAI,iBAAiB;AACrB,aAAW,SAAS,SAAS;AAC3B,QAAI,MAAM,SAAS,aAAa;AAC9B,wBAAkB;AAClB,cAAQ,KAAK,OAAO,KAAK,MAAM,MAAM,IAAI,EAAE,CAAC;AAAA,IAC9C,OAAO;AACL,mBAAa;AACb,wBAAkB,MAAM;AACxB,cAAQ,KAAK,OAAO,KAAK,GAAG,MAAM,MAAM,KAAK,MAAM,IAAI,EAAE,CAAC;AAAA,IAC5D;AAAA,EACF;AACA,UAAQ,KAAK,OAAO,OAAO;AAC3B,QAAM,OAAO,WAAW,QAAQ;AAChC,aAAW,UAAU,QAAS,MAAK,OAAO,MAAM,EAAE,OAAO,IAAI;AAC7D,SAAO,EAAE,QAAQ,KAAK,OAAO,KAAK,GAAG,gBAAgB,WAAW,eAAe;AACjF;AAEA,SAAS,cAAc,QAAkC;AACvD,QAAM,OAAO,OAAO,OAAO,UAAU;AACrC,SAAO,OAAO,SAAS,YAAY,WAAW,IAAI,IAAI,OAAO;AAC/D;AAEA,SAAS,gCAAgC,MAAc,eAA0C;AAC/F,QAAM,QAAQ,oBAAoB,aAAa;AAC/C,QAAM,SAAS,OAAO;AAAA,KACnBL,YAAW,IAAI,CAAC;AAAA,uCACkB,KAAK,uDAAuD,KAAK;AAAA,kCACtE,KAAK;AAAA,mCACJ,KAAK;AAAA,mCACL,KAAK;AAAA;AAEtC,SAAO,uBAAuBA,YAAW,MAAM,CAAC;AAClD;AAIA,eAAsB,mCACpB,SACmC;AACnC,QAAM,SAAS;AACf,QAAMI,OAAM,OAAO,QAAQ,OAAO;AAClC,MAAI,CAACA,MAAK;AACR,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,MAAMA,KAAI,KAAK,QAAQ;AAAA,IACpC,KAAK;AAAA,MACH,cAAc,MAAM;AAAA,MACpB,6BAA6B,MAAM;AAAA,IACrC;AAAA,IACA,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB,CAAC;AACD,QAAM,QAAQ,qBAAqB,MAAM,EACtC,KAAK,EACL,MAAM,4EAA4E;AACrF,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR;AAAA,MACA,6DAA6D,sBAAsB,MAAM,CAAC;AAAA,MAC1F,EAAE,WAAW,KAAK;AAAA,IACpB;AAAA,EACF;AACA,QAAM,iBAAiB,OAAO,MAAM,CAAC,CAAC;AACtC,QAAM,YAAY,OAAO,MAAM,CAAC,CAAC;AACjC,QAAM,iBAAiB,OAAO,MAAM,CAAC,CAAC;AACtC,MAAI,CAAC,CAAC,gBAAgB,WAAW,cAAc,EAAE,MAAM,OAAO,aAAa,GAAG;AAC5E,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,MAAM,CAAC,GAAI,gBAAgB,WAAW,eAAe;AACxE;AAGA,eAAsB,gCACpB,SACA,UACA,UACe;AACf,QAAM,SAAS,MAAM,mCAAmC,OAAO;AAC/D,MACE,OAAO,WAAW,SAAS,UAC3B,OAAO,mBAAmB,SAAS,kBACnC,OAAO,cAAc,SAAS,aAC9B,OAAO,mBAAmB,SAAS,gBACnC;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,+DAA+D,QAAQ;AAAA,IACzE;AAAA,EACF;AACF;AAMA,eAAsB,4BACpB,SACmC;AACnC,QAAM,SAAS;AACf,QAAM,OAAO,kCAAkC;AAC/C,QAAM,WAAW,wBAAwB,MAAM;AAC/C,SAAO,WACH,OAAO,gCAAgC,QAAQ,aAAa,UAC1D,MAAM;AAAA,IACJ;AAAA,IACA,6BAA6B,MAAM;AAAA,IACnC,OAAO;AAAA,EACT,IACA,MAAM,+BAA+B,UAAU,6BAA6B,MAAM,CAAC,IACrF,MAAM,2BAA2B,MAAM;AAC7C;AAEA,SAAS,kBAAkB,GAA6B,GAAsC;AAC5F,UACG,EAAE,cAAc,mBAAmB,EAAE,cAAc,iBACpD,EAAE,WAAW,EAAE,UACf,EAAE,eAAe,EAAE,cACnB,EAAE,cAAc,EAAE,aAClB,EAAE,mBAAmB,EAAE;AAE3B;AAMA,eAAsB,gCACpB,SACA,eAAe,KAAK,IAAI,GACxB,SACmC;AACnC,SAAO,MAAM;AAAA,IACX;AAAA,IACA,YAAY,MAAM,yCAAyC,SAAS,cAAc,OAAO;AAAA,IACzF,SAAS;AAAA,EACX;AACF;AAEA,eAAe,yCACb,SACA,cACA,SACmC;AACnC,QAAM,SAAS;AACf,QAAM,OAAO,kCAAkC;AAC/C,QAAM,cAAc,SAAS,aAAa;AAC1C,QAAM,UAAU,cAAc,OAAO,sBAAsB,OAAO;AAClE,MAAI,OAAO,YAAY,YAAY;AACjC,UAAM,IAAI;AAAA,MACR;AAAA,MACA,cACI,mGACA;AAAA,IACN;AAAA,EACF;AACA,QAAM,wBAAwB,OAAO,OAAO;AAC5C,QAAM,wBAAwB,6BAA6B,MAAM,EAAE,SAAS;AAC5E,QAAM,wBACJ,CAAC,eACD,OAAO,0BAA0B,YACjC,0BAA0B,SAC1B,CAAC;AACH,QAAM,SAAS,wBAAwB,OAAO,MAAM,4BAA4B,MAAM;AACtF,QAAM,QAAQ,cACV,MAAM,OAAO,oBAAqB,IAClC,MAAM,OAAO,iBAAkB,OAAO;AAC1C,MAAI,CAAC,SAAS,MAAM,WAAW,GAAG;AAChC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,EAAE,WAAW,KAAK;AAAA,IACpB;AAAA,EACF;AACA,QAAM,iBAAiBT,yBAAwB,KAAK;AACpD,MAAI,gBAAgB;AAClB,UAAMW,cAAa,8BAA8B,OAAO,YAAY;AACpE,WAAO;AAAA,MACL;AAAA,MACA,QAAQ,OAAO,KAAK,KAAK,EAAE,SAAS,QAAQ;AAAA,MAC5C,YAAAA;AAAA,MACA,MAAM;AAAA,MACN;AAAA,IACF;AAAA,EACF;AACA,MAAI,uBAAuB;AACzB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,0BAA0B,OAAO,qBAAqB,CAAC;AAAA,IACzD;AAAA,EACF;AACA,QAAM,QAAQ,MAAM,4BAA4B,MAAM;AACtD,QAAM,qBACJ,QAAQ,eAAe,+BAA+B,2BAA2B,KAAK,IAAI;AAC5F,MACE,CAAC,UACD,CAAC,kBAAkB,QAAQ,KAAK,KAC/B,uBAAuB,QAAQ,CAAC,kBAAkB,QAAQ,kBAAkB,GAC7E;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,EAAE,WAAW,KAAK;AAAA,IACpB;AAAA,EACF;AACA,QAAM,gBAAgB,OAAO,KAAK;AAClC,QAAM,aAA4C;AAAA,IAChD,SAAS;AAAA,IACT,UAAU,OAAO,OAAO,YAAY,EAAE,SAAS,IAAI,GAAG,CAAC,IAAI,aAAa;AAAA,IACxE;AAAA,IACA,cAAc,MAAM;AAAA,IACpB,YAAY,IAAI,KAAK,YAAY,EAAE,YAAY;AAAA,IAC/C,WAAW;AAAA,EACb;AACA,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,OAAO,KAAK,KAAK,EAAE,SAAS,QAAQ;AAAA,IAC5C;AAAA,IACA,MAAM;AAAA,EACR;AACF;AAEA,eAAsB,wBACpB,SACA,YAC0C;AAC1C,MAAI,WAAW,YAAY,sCAAsC;AAC/D,WAAO;AAAA,EACT;AACA,QAAM,SAAS;AAIf,QAAM,SACJ,WAAW,UAAU,eAAe,+BAChC,OAAO,MAAM;AACX,UAAM,OAAO,wBAAwB,MAAM;AAC3C,QAAI,CAAC,MAAM;AACT,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO,QAAQ,aAAa,UACxB,yBAAyB,MAAM,6BAA6B,MAAM,CAAC,IACnE,+BAA+B,MAAM,6BAA6B,MAAM,CAAC;AAAA,EAC/E,GAAG,IACH,MAAM,2BAA2B,MAAM;AAC7C,MAAI,CAAC,kBAAkB,QAAQ,WAAW,SAAS,GAAG;AACpD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,+DAA+D,WAAW,QAAQ;AAAA,IACpF;AAAA,EACF;AACA,SAAO;AACT;;;AD3+BA,IAAM,cAAc,KAAK;AAGzB,IAAM,sBAAsB;AAC5B,IAAM,aAAa;AACnB,IAAM,OAAOC,WAAU,WAAWA,WAAU,aAAaA,WAAU;AACnE,IAAM,iBAAiB,OAAOA,WAAU;AACxC,IAAM,SAASA,WAAU,WAAWA,WAAU,UAAUA,WAAU,SAASA,WAAU;AAcrF,SAAS,QAAQ,SAAwB;AACvC,QAAM,IAAI,+BAA+B,4BAA4B,OAAO;AAC9E;AAEA,SAAS,QAAQ,OAAwB;AACvC,QAAM,IAAI;AAAA,IACR;AAAA,IACA;AAAA,IACA,EAAE,WAAW,MAAM,MAAM;AAAA,EAC3B;AACF;AAEA,SAAS,aAAa,OAAuB;AAC3C,MAAI,iBAAiB,+BAAgC,OAAM;AAC3D,QAAM,OAAQ,OAAwC;AACtD,MAAI,SAAS,YAAY,SAAS,WAAW,SAAS,UAAW,QAAO,QAAQ,KAAK;AAGrF,QAAM;AACR;AAEA,SAAS,UAAU,SAA8C;AAC/D,QAAM,OAAO,QAAQ,cAAc;AACnC,MAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,KAAK,OAAO,aAAa;AACjE,UAAM,IAAI,WAAW,oCAAoC,WAAW,EAAE;AAAA,EACxE;AACA,SAAO;AACT;AAEA,SAAS,UAAU,SAAsC;AACvD,MAAI,QAAQ,iBAAiB,KAAM,QAAO;AAC1C,QAAM,WAAW;AAAA,IACf,eAAe,QAAQ;AAAA,IACvB,mBAAmB,IAAI,QAAQ;AAAA,IAC/B,YAAY;AAAA,EACd;AACA,QAAM,SAAS,EAAE,GAAG,UAAU,GAAG,QAAQ,cAAc;AACvD,aAAW,OAAO,OAAO,KAAK,QAAQ,GAAmC;AACvE,QAAI,OAAO,GAAG,MAAM,OAAW,QAAO,GAAG,IAAI,SAAS,GAAG;AACzD,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,SAAS,SAAS,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,IAAI;AAChE,YAAM,IAAI,WAAW,iBAAiB,GAAG,qBAAqB;AAAA,IAChE;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,WAAW,QAAgB,OAAkC,OAAe;AACnF,MAAI,CAAC,OAAO,cAAc,MAAM,EAAG,SAAQ,GAAG,KAAK,sCAAsC;AACzF,MAAI,SAAS,QAAQ,SAAS;AAC5B,YAAQ,qBAAqB,KAAK,2BAA2B;AACjE;AAEA,SAAS,UAAU,GAAgB,GAAgB;AACjD,SAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE;AAC5D;AAEA,SAAS,YAAY,GAAgB,GAAgB;AACnD,SAAO,UAAU,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE;AAC5F;AAEA,SAAS,OAAO,QAAoB,MAAe;AACjD,SAAO,SAAS,SAAY,iBAAiB,OAAO,EAAE,KAAK,iBAAiB,OAAO,EAAE,IAAI,IAAI;AAC/F;AAaA,SAAS,aAAa,OAA+C;AACnE,SAAO,OAAO,OAAO;AAAA,IACnB,KAAK,OAAO,MAAM,GAAG;AAAA,IACrB,KAAK,OAAO,MAAM,GAAG;AAAA,IACrB,KAAK,OAAO,MAAM,GAAG;AAAA,IACrB,KAAK,OAAO,MAAM,GAAG;AAAA,IACrB,MAAM,OAAO,MAAM,IAAI;AAAA,EACzB,CAAC;AACH;AAEA,eAAe,SACb,MACA,SAAS,OACT,UACqB;AACrB,MAAI,QAAQ,aAAa;AACvB,YAAQ,yEAAyE;AACnF,MAAI,CAACC,YAAW,IAAI,EAAG,SAAQ,sCAAsC;AACrE,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,UAAU,aAAa,IAAK,SAAQ,yCAAyC;AACjF,MAAI,UAAU,MAAMC,MAAK,KAAK,cAAc;AAC5C,MAAI;AACF,eAAW,WAAW,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO,GAAG;AACzD,UAAI,QAAQ;AACV,cAAM,MAAM,OAAO,SAAS,OAAO,GAAG,EAAE,MAAM,IAAM,CAAC,EAAE;AAAA,UACrD,CAAC,UAAiC;AAChC,gBAAI,MAAM,SAAS,SAAU,OAAM;AAAA,UACrC;AAAA,QACF;AAAA,MACF;AACA,YAAM,OAAO,MAAMA,MAAK,OAAO,SAAS,OAAO,GAAG,cAAc;AAChE,YAAM,QAAQ,MAAM;AACpB,gBAAU;AAAA,IACZ;AACA,QAAI,UAAU;AACZ,YAAM,SAAS,aAAa,MAAM,QAAQ,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC;AAChE,UACE,OAAO,KAAK,MAAM,EAAE;AAAA,QAClB,CAAC,QACC,OAAO,GAAsC,MAC7C,SAAS,GAAsC;AAAA,MACnD;AAEA,gBAAQ,uCAAuC;AAAA,IACnD;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,QAAQ,MAAM;AACpB,UAAM;AAAA,EACR;AACF;AAIA,eAAsB,8BACpB,MACA,UACoC;AACpC,MAAI,QAAQ,aAAa,SAAS;AAChC,QAAI,CAACD,YAAW,IAAI,KAAK,QAAQ,IAAI,MAAM,QAAS,MAAME,UAAS,IAAI,MAAO;AAC5E,cAAQ,uCAAuC;AACjD,UAAMC,UAAS,MAAMF,MAAK,MAAM,cAAc;AAC9C,QAAI;AACF,YAAM,QAAQ,MAAME,QAAO,KAAK,EAAE,QAAQ,KAAK,CAAC;AAChD,UAAI,CAAC,MAAM,YAAY,EAAG,SAAQ,yCAAyC;AAC3E,YAAM,SAAS,aAAa,KAAK;AACjC,UACE,YACA,OAAO,KAAK,MAAM,EAAE;AAAA,QAClB,CAAC,QACC,OAAO,GAAsC,MAC7C,SAAS,GAAsC;AAAA,MACnD;AAEA,gBAAQ,uCAAuC;AACjD,aAAO;AAAA,IACT,UAAE;AACA,YAAMA,QAAO,MAAM;AAAA,IACrB;AAAA,EACF;AACA,QAAM,SAAS,MAAM,SAAS,MAAM,OAAO,QAAQ;AACnD,MAAI;AACF,WAAO,aAAa,MAAM,OAAO,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC;AAAA,EACzD,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAOA,IAAM,UAAU,CAAC,GAAW,MAAe,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI;AAEpE,eAAe,UACb,MACA,eACA,QACoB;AACpB,QAAM,OAAkB,EAAE,aAAa,oBAAI,IAAI,GAAG,OAAO,oBAAI,IAAI,EAAE;AACnE,QAAM,OAAO,OAAO,QAAoB,YAAoB;AAC1D,UAAM,SAAS,MAAM,OAAO,KAAK,EAAE,QAAQ,KAAK,CAAC;AACjD,SAAK,YAAY,IAAI,SAAS,MAAM;AACpC,UAAM,QAAQ,MAAMC,SAAQ,OAAO,MAAM,CAAC;AAC1C,eAAW,QAAQ,OAAO;AACxB,cAAQ,eAAe;AACvB,YAAM,OAAO,UAAU,GAAG,OAAO,IAAI,IAAI,KAAK;AAC9C,UACE,cAAc;AAAA,QACZ,CAAC,aAAa,aAAa,MAAM,SAAS,YAAY,KAAK,WAAW,GAAG,QAAQ,GAAG;AAAA,MACtF;AAEA;AACF,YAAM,QAAQ,MAAMC,OAAM,OAAO,QAAQ,IAAI,GAAG,EAAE,QAAQ,KAAK,CAAC;AAChE,UAAI,MAAM,YAAY,GAAG;AACvB,cAAM,QAAQ,MAAMJ,MAAK,OAAO,QAAQ,IAAI,GAAG,cAAc;AAC7D,YAAI;AACF,cAAI,CAAC,YAAY,OAAO,MAAM,MAAM,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC,EAAG,SAAQ;AACrE,gBAAM,KAAK,OAAO,IAAI;AACtB,cAAI,CAAC,YAAY,OAAO,MAAMI,OAAM,OAAO,QAAQ,IAAI,GAAG,EAAE,QAAQ,KAAK,CAAC,CAAC,EAAG,SAAQ;AAAA,QACxF,UAAE;AACA,gBAAM,MAAM,MAAM;AAAA,QACpB;AAAA,MACF,WAAW,MAAM,OAAO,GAAG;AACzB,aAAK,MAAM,IAAI,MAAM,KAAK;AAAA,MAC5B;AAAA,IAEF;AACA,QAAI,CAAC,YAAY,QAAQ,MAAM,OAAO,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC,EAAG,SAAQ;AAAA,EACzE;AACA,QAAM,KAAK,MAAM,EAAE;AACnB,SAAO;AACT;AAEA,eAAe,cAAc,MAAkB,SAAiB,MAAkB,SAAS,OAAO;AAChG,MAAI,UAAU,MAAMJ,MAAK,OAAO,IAAI,GAAG,iBAAiB,CAACF,WAAU,UAAU;AAC7E,MAAI;AACF,QAAI,QAAQ,CAAC,YAAY,KAAK,YAAY,IAAI,EAAE,GAAI,MAAM,QAAQ,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC;AACtF,cAAQ;AACV,QAAI,OAAO;AACX,eAAW,WAAW,QAAQ,MAAM,GAAG,EAAE,OAAO,OAAO,GAAG;AACxD,aAAO,OAAO,GAAG,IAAI,IAAI,OAAO,KAAK;AACrC,UAAI,QAAQ;AACV,cAAM,MAAM,OAAO,SAAS,OAAO,GAAG,EAAE,MAAM,IAAM,CAAC,EAAE;AAAA,UACrD,CAAC,UAAiC;AAChC,gBAAI,MAAM,SAAS,SAAU,OAAM;AAAA,UACrC;AAAA,QACF;AAAA,MACF;AACA,YAAM,OAAO,MAAME,MAAK,OAAO,SAAS,OAAO,GAAG,cAAc;AAChE,YAAM,QAAQ,MAAM;AACpB,gBAAU;AACV,UAAI,MAAM;AACR,cAAM,WAAW,KAAK,YAAY,IAAI,IAAI;AAC1C,YAAI,CAAC,YAAY,CAAC,YAAY,UAAU,MAAM,QAAQ,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC,EAAG,SAAQ;AAAA,MACzF;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,QAAQ,MAAM;AACpB,UAAM;AAAA,EACR;AACF;AAEA,SAAS,cAAc,MAAgC;AACrD,QAAM,QAAQ,KAAK,YAAY,GAAG;AAClC,SAAO,QAAQ,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,MAAM,GAAG,KAAK,GAAG,KAAK,MAAM,QAAQ,CAAC,CAAC;AAC9E;AAEA,eAAe,aACb,MACA,MACA,MACA,SACA,QACA;AACA,QAAM,CAAC,QAAQ,IAAI,IAAI,cAAc,IAAI;AACzC,QAAM,YAAY,MAAM,cAAc,MAAM,QAAQ,IAAI;AACxD,MAAI;AACF,UAAM,WAAW,KAAK,MAAM,IAAI,IAAI;AACpC,UAAM,SAAS,MAAMA,MAAK,OAAO,WAAW,IAAI,GAAG,IAAI;AACvD,QAAI;AACF,UAAI,CAAC,YAAY,UAAU,MAAM,OAAO,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC,EAAG,SAAQ;AACzE,YAAM,OAAO,OAAO,SAAS,IAAI;AACjC,iBAAW,MAAM,MAAM,WAAW;AAClC,YAAM,SAAS,OAAO,YAAY,WAAW;AAC7C,UAAI,SAAS;AACb,aAAO,SAAS,MAAM;AACpB,gBAAQ,eAAe;AACvB,cAAM,EAAE,UAAU,IAAI,MAAM,OAAO;AAAA,UACjC;AAAA,UACA;AAAA,UACA,KAAK,IAAI,OAAO,QAAQ,OAAO,MAAM;AAAA,UACrC;AAAA,QACF;AACA,YAAI,cAAc,EAAG,SAAQ;AAC7B,cAAM,QAAQ,OAAO,SAAS,GAAG,SAAS,CAAC;AAC3C,kBAAU;AAAA,MACZ;AACA,UACE,CAAC,YAAY,UAAU,MAAM,OAAO,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC,KAC1D,CAAC,YAAY,UAAU,MAAMI,OAAM,OAAO,WAAW,IAAI,GAAG,EAAE,QAAQ,KAAK,CAAC,CAAC;AAE7E,gBAAQ;AAAA,IACZ,UAAE;AACA,YAAM,OAAO,MAAM;AAAA,IACrB;AAAA,EACF,UAAE;AACA,UAAM,UAAU,MAAM;AAAA,EACxB;AACF;AAEA,SAAS,MAAM,MAAY,OAAe,OAAe;AACvD,OACG,OAAO,KAAK,EACZ,OAAO,IAAI,EACX,OAAO,OAAO,OAAO,WAAW,KAAK,CAAC,CAAC,EACvC,OAAO,IAAI,EACX,OAAO,KAAK,EACZ,OAAO,IAAI;AAChB;AAEA,SAAS,WAAW,aAAgC;AAClD,QAAM,OAAOC,YAAW,QAAQ;AAChC,QAAM,MAAM,cAAc,UAAU;AACpC,aAAW,QAAQ,CAAC,GAAG,WAAW,EAAE,KAAK,OAAO,EAAG,OAAM,MAAM,OAAO,IAAI;AAC1E,SAAO;AACT;AAEA,SAAS,YACP,MACA,aACA,OACA,gBAC0B;AAC1B,aAAW,gBAAgB,MAAM,gBAAgB;AACjD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,QAAQ,KAAK,OAAO,KAAK;AAAA,IACzB,YAAY,cAAc;AAAA,IAC1B,WAAW;AAAA,IACX;AAAA,IACA,YAAY;AAAA,EACd;AACF;AAEA,eAAe,gBACb,UACA,MACA,MACA,QACA;AACA,QAAM,QAAQ,MAAM,SAAS,QAAQ;AACrC,MAAI;AACF,QAAI,CAAC,YAAY,KAAK,YAAY,IAAI,EAAE,GAAI,MAAM,MAAM,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC,EAAG,SAAQ;AAAA,EAC3F,UAAE;AACA,UAAM,MAAM,MAAM;AAAA,EACpB;AACA,aAAW,QAAQ,KAAK,YAAY,KAAK,GAAG;AAC1C,YAAQ,eAAe;AACvB,UAAM,SAAS,MAAM,cAAc,MAAM,MAAM,IAAI;AACnD,UAAM,OAAO,MAAM;AAAA,EACrB;AACA,aAAW,CAAC,MAAM,QAAQ,KAAK,KAAK,OAAO;AACzC,YAAQ,eAAe;AACvB,UAAM,CAAC,QAAQ,IAAI,IAAI,cAAc,IAAI;AACzC,UAAM,SAAS,MAAM,cAAc,MAAM,QAAQ,IAAI;AACrD,QAAI;AACF,UAAI,CAAC,YAAY,UAAU,MAAMD,OAAM,OAAO,QAAQ,IAAI,GAAG,EAAE,QAAQ,KAAK,CAAC,CAAC,EAAG,SAAQ;AAAA,IAC3F,UAAE;AACA,YAAM,OAAO,MAAM;AAAA,IACrB;AAAA,EACF;AACF;AAEA,eAAe,SAAS,UAAkB,MAAkB,MAAiB,QAAsB;AACjG,QAAM,cAAc,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,EAAE,OAAO,OAAO;AAC/D,QAAM,OAAO,WAAW,WAAW;AACnC,MAAI,QAAQ;AACZ,aAAW,QAAQ,CAAC,GAAG,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK,OAAO,GAAG;AACvD,UAAM,OAAO,OAAO,KAAK,MAAM,IAAI,IAAI,EAAG,IAAI;AAC9C,UAAM,MAAM,QAAQ,IAAI;AACxB,UAAM,MAAM,SAAS,OAAO,IAAI,CAAC;AACjC,YAAQ,eAAe;AACvB,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA,CAAC,UAAU;AACT,aAAK,OAAO,KAAK;AAAA,MACnB;AAAA,MACA;AAAA,IACF;AACA,aAAS;AAAA,EACX;AACA,QAAM,gBAAgB,UAAU,MAAM,MAAM,MAAM;AAClD,SAAO,YAAY,MAAM,YAAY,QAAQ,KAAK,MAAM,MAAM,KAAK;AACrE;AAEA,eAAsB,yBACpB,MACA,eACA,cACmC;AACnC,QAAM,SAAS,MAAM,SAAS,MAAM,OAAO,YAAY;AACvD,MAAI;AACF,WAAO,MAAM,SAAS,MAAM,QAAQ,MAAM,UAAU,QAAQ,aAAa,CAAC;AAAA,EAC5E,SAAS,OAAO;AACd,WAAO,aAAa,KAAK;AAAA,EAC3B,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAEA,SAAS,OAAO,MAAc,WAAmB;AAC/C,QAAM,OAAO,SAAS,MAAM,SAAS;AACrC,SAAO,SAAS,MAAO,CAACL,YAAW,IAAI,KAAK,SAAS,QAAQ,CAAC,KAAK,WAAW,KAAK,GAAG,EAAE;AAC1F;AAEA,eAAe,0BAA0B,MAAqB;AAG5D,QAAM,aAAa,SAAS,OAAO,OAAO,MAAME,UAAS,IAAI,EAAE,MAAM,MAAM,QAAQ,IAAI,CAAC;AAGxF,QAAM,iDAAiD;AACvD,aAAW,aAAa,0BAA0B,GAAG;AACnD,UAAM,OAAO,MAAMA,UAAS,SAAS,EAAE,MAAM,MAAM,IAAI;AACvD,QAAI,CAAC,QAAS,eAAe,QAAQ,OAAO,YAAY,IAAI,KAAM,OAAO,YAAY,IAAI;AACvF;AACF,WAAO,MAAM,oCAAoC,IAAI;AAAA,EACvD;AACA,UAAQ,kEAAkE;AAC5E;AAEA,eAAe,SAAS,QAAoB,OAAmB;AAC7D,MAAI,SAAS;AACb,SAAO,SAAS,MAAM,YAAY;AAChC,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,MAAM,OAAO,QAAQ,MAAM,aAAa,MAAM;AACpF,QAAI,CAAC,aAAc,OAAM,IAAI,MAAM,sCAAsC;AACzE,cAAU;AAAA,EACZ;AACF;AAEA,IAAM,gBAAN,MAAoB;AAAA,EAGlB,YAAqB,QAAoB;AAApB;AAAA,EAAqB;AAAA,EAFjC,OAAOI,YAAW,QAAQ;AAAA,EACnC,WAAW;AAAA,EAEX,MAAM,MAAM,OAA4B;AACtC,UAAM,QAAQ,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAI;AAC/D,aAAS,SAAS,GAAG,SAAS,MAAM,QAAQ,UAAU,aAAa;AACjE,YAAM,QAAQ,MAAM,SAAS,QAAQ,SAAS,WAAW;AACzD,YAAM,SAAS,KAAK,QAAQ,KAAK;AACjC,WAAK,KAAK,OAAO,KAAK;AACtB,WAAK,YAAY,MAAM;AACvB,iBAAW,KAAK,UAAU,MAAM,YAAY;AAAA,IAC9C;AAAA,EACF;AACF;AAMA,IAAM,gBAAN,MAAoB;AAAA,EAIlB,YAA6B,QAAuB;AAAvB;AAAA,EAAwB;AAAA,EAHpC,QAAQ,OAAO,YAAY,cAAc,CAAC;AAAA,EAC1C,SAAS,OAAO,YAAY,KAAK,MAAM,cAAc,KAAK,CAAC,IAAI,CAAC;AAAA,EACzE,QAAQ;AAAA,EAEhB,MAAM,MAAM,OAAe;AACzB,UAAM,KAAK,KAAK,OAAO,KAAK,KAAK;AACjC,UAAM,YAAY,KAAK,QAAQ,MAAM;AACrC,UAAM,SAAS,YAAa,YAAY;AACxC,QAAI,OAAQ,OAAM,KAAK,OAAO,MAAM;AACpC,SAAK,QAAQ,YAAY;AACzB,SAAK,MAAM,KAAK,KAAK,OAAO,GAAG,QAAQ,SAAS;AAAA,EAClD;AAAA,EACA,MAAc,OAAO,QAAgB;AACnC,UAAM,UAAU,KAAK,OAAO,MAAM,KAAK,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,QAAQ,GAAG,OAAO;AAC5F,UAAM,KAAK,OAAO,MAAM,KAAK,OAAO,SAAS,GAAG,OAAO,CAAC;AAAA,EAC1D;AAAA,EACA,MAAM,SAAS;AACb,QAAI,KAAK,MAAO,OAAM,KAAK,OAAO,KAAK,KAAK;AAAA,EAC9C;AACF;AAEA,SAAS,WACP,WACA,MACA,UACAC,SACuB;AACvB,MAAI;AACJ,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,QAAAA;AAAA,IACA,OAAO,OAAO;AACZ,UAAI,SAAU,OAAM,IAAI,MAAM,iCAAiC;AAC/D,YAAM,SAAS,MAAMN,MAAK,MAAM,IAAI;AACpC,UAAI;AACF,cAAM,SAAS,MAAM,OAAO,KAAK,EAAE,QAAQ,KAAK,CAAC;AACjD,YAAI,CAAC,OAAO,OAAO,KAAK,OAAO,OAAO,IAAI,MAAM,SAAU,SAAQ,uBAAuB;AACzF,YAAI,WAAW;AACf,eAAO,WAAW,UAAU;AAC1B,gBAAM,SAAS,OAAO,YAAY,KAAK,IAAI,aAAa,WAAW,QAAQ,CAAC;AAC5E,gBAAM,EAAE,UAAU,IAAI,MAAM,OAAO,KAAK,QAAQ,GAAG,OAAO,QAAQ,QAAQ;AAC1E,cAAI,CAAC,UAAW,SAAQ,6BAA6B;AACrD,sBAAY;AACZ,gBAAM,OAAO,SAAS,GAAG,SAAS;AAAA,QACpC;AACA,YAAI,CAAC,YAAY,QAAQ,MAAM,OAAO,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC;AAC1D,kBAAQ,qCAAqC;AAAA,MACjD,UAAE;AACA,cAAM,OAAO,MAAM;AAAA,MACrB;AAAA,IACF;AAAA,IACA,UAAU;AACR,aAAQ,aAAa,oCAAoC,SAAS;AAAA,IACpE;AAAA,EACF;AACF;AAQA,eAAsB,4BACpB,MACA,eACA,cACA,QAIC;AACD,UAAQ,eAAe;AACvB,QAAM,SAAS,MAAM,SAAS,MAAM,OAAO,YAAY;AACvD,MAAI;AACJ,MAAI,eAAe;AACnB,MAAI;AACF,UAAM,OAAO,MAAM,UAAU,QAAQ,eAAe,MAAM;AAC1D,UAAM,SAAS,MAAM,SAAS,MAAM,QAAQ,MAAM,MAAM;AACxD,gBAAY,MAAM,0BAA0B,IAAI;AAChD,UAAM,OAAOO,MAAK,WAAW,cAAc;AAC3C,UAAM,OAAO,MAAMP,MAAK,MAAM,QAAQ,GAAK;AAC3C,UAAM,SAAS,IAAI,cAAc,IAAI;AACrC,UAAM,cAAc,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,EAAE,OAAO,OAAO,EAAE,KAAK,OAAO;AAC7E,UAAM,OAAO,WAAW,WAAW;AACnC,QAAI,QAAQ;AACZ,QAAI;AACF,YAAM,OAAO,MAAM,8BAA8B;AACjD,eAAS,QAAQ,GAAG,QAAQ,YAAY,QAAQ,SAAS;AACvD,cAAM,OAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,GAAG,KAAK,UAAU,YAAY,KAAK,CAAC,CAAC,EAAE;AAAA,MAC/E;AACA,YAAM,OAAO,MAAM,aAAa;AAChC,UAAI,QAAQ;AACZ,iBAAW,WAAW,CAAC,GAAG,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK,OAAO,GAAG;AAC1D,cAAM,OAAO,OAAO,KAAK,MAAM,IAAI,OAAO,EAAG,IAAI;AACjD,cAAM,MAAM,QAAQ,OAAO;AAC3B,cAAM,MAAM,SAAS,OAAO,IAAI,CAAC;AACjC,cAAM,OAAO,MAAM,GAAG,QAAQ,KAAK,GAAG,WAAW,KAAK,UAAU,OAAO,CAAC,WAAW;AACnF,gBAAQ;AACR,cAAMQ,WAAU,IAAI,cAAc,MAAM;AACxC,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,UACA;AAAA,UACA,OAAO,UAAU;AACf,iBAAK,OAAO,KAAK;AACjB,kBAAMA,SAAQ,MAAM,KAAK;AAAA,UAC3B;AAAA,UACA;AAAA,QACF;AACA,cAAMA,SAAQ,OAAO;AACrB,cAAM,OAAO,MAAM,IAAI;AACvB,iBAAS;AAAA,MACX;AACA,YAAM,OAAO,MAAM,IAAI;AAAA,IACzB,UAAE;AACA,YAAM,KAAK,MAAM;AAAA,IACnB;AACA,UAAM,WAAW,YAAY,MAAM,YAAY,QAAQ,KAAK,MAAM,MAAM,KAAK;AAG7E,UAAM,UAAU,MAAMR,MAAK,MAAM,IAAI;AACrC,UAAM,cAAcO,MAAK,WAAW,iBAAiB;AACrD,QAAI;AACJ,QAAI;AACF,YAAM,UAAU,MAAMP;AAAA,QACpB;AAAA,QACAF,WAAU,SAASA,WAAU,UAAUA,WAAU,SAASA,WAAU;AAAA,QACpE;AAAA,MACF;AACA,UAAI;AACF,gBAAQ,eAAe;AACvB,cAAM,QAAQ,MAAM,aAAa,SAAS,SAAS,CAAC,GAAG,MAAM;AAC7D,gBAAQ,eAAe;AACvB,kBAAU,MAAM,wBAAwB,OAAO,SAAS,MAAM;AAAA,MAChE,UAAE;AACA,cAAM,QAAQ,MAAM;AAAA,MACtB;AAAA,IACF,UAAE;AACA,YAAM,QAAQ,MAAM;AAAA,IACtB;AACA,UAAM,OAAO,WAAW;AACxB,YAAQ,eAAe;AACvB,UAAM,gBAAgB,MAAM,QAAQ,MAAM,MAAM;AAChD,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,MAAM,UAAU,QAAQ,eAAe,MAAM;AAAA,MAC7C;AAAA,IACF;AACA,QACE,OAAO,WAAW,SAAS,UAC3B,MAAM,WAAW,SAAS,UAC1B,QAAQ,WAAW,SAAS;AAE5B,cAAQ;AAGV,mBAAe;AACf,UAAM,OAAO,MAAM;AACnB,UAAM,QAAQ,WAAW,WAAW,MAAM,OAAO,UAAU,OAAO,KAAK,OAAO,KAAK,CAAC;AACpF,gBAAY;AACZ,WAAO,EAAE,OAAO,WAAW,SAAS;AAAA,EACtC,SAAS,OAAO;AACd,WAAO,aAAa,KAAK;AAAA,EAC3B,UAAE;AACA,QAAI;AACF,UAAI,CAAC,aAAc,OAAM,OAAO,MAAM;AAAA,IACxC,UAAE;AACA,UAAI,UAAW,OAAM,oCAAoC,SAAS;AAAA,IACpE;AAAA,EACF;AACF;AAIA,IAAM,aAAN,MAAiB;AAAA,EAKf,YACmB,QACjB,MACiB,QACjB;AAHiB;AAEA;AAEjB,SAAK,SAAS,OAAO,YAAY,IAAI;AAAA,EACvC;AAAA,EAViB;AAAA,EACT,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,WAAW;AAAA,EAQnB,MAAc,OAAO;AACnB,QAAI,KAAK,SAAS,KAAK,UAAW,QAAO;AAGzC,SAAK,QAAQ,eAAe;AAC5B,UAAM,EAAE,UAAU,IAAI,MAAM,KAAK,OAAO,KAAK,KAAK,QAAQ,GAAG,KAAK,OAAO,QAAQ,KAAK,QAAQ;AAC9F,SAAK,YAAY;AACjB,SAAK,SAAS;AACd,SAAK,YAAY;AACjB,WAAO,cAAc;AAAA,EACvB;AAAA,EACA,MAAM,OAAwB;AAC5B,WAAQ,MAAM,KAAK,KAAK,IAAK,KAAK,OAAO,KAAK,MAAM,IAAK;AAAA,EAC3D;AAAA,EACA,MAAM,OAAwB;AAC5B,UAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,QAAI,SAAS,GAAI,SAAQ,kCAAkC;AAC3D,SAAK;AACL,WAAO;AAAA,EACT;AAAA,EACA,MAAM,aAAa;AACjB,WAAO,MAAM;AACX,YAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,UAAI,SAAS,MAAM,SAAS,KAAK,SAAS,MAAM,SAAS,GAAI;AAC7D,WAAK;AAAA,IACP;AAAA,EACF;AAAA,EACA,MAAM,OAAO,WAAmB;AAC9B,UAAM,KAAK,WAAW;AACtB,QAAK,MAAM,KAAK,KAAK,MAAO,UAAU,WAAW,CAAC;AAChD,cAAQ,YAAY,SAAS,4BAA4B;AAAA,EAC7D;AAAA,EACA,MAAM,OAAO,SAA0C;AACrD,UAAM,KAAK,OAAO,GAAG;AACrB,UAAM,QAAkB,CAAC;AACzB,UAAMW,WAAU,UACZ,SACA,IAAI,YAAY,SAAS,EAAE,OAAO,MAAM,WAAW,KAAK,CAAC;AAC7D,UAAM,OAAO,OAAO,SAAiB;AACnC,UAAI,CAAC,KAAM;AACX,UAAI,QAAS,OAAM,QAAQ,MAAM,IAAI;AAAA,UAChC,OAAM,KAAK,IAAI;AAAA,IACtB;AACA,WAAO,MAAM,KAAK,KAAK,GAAG;AACxB,YAAM,QAAQ,KAAK;AACnB,aAAO,KAAK,SAAS,KAAK,WAAW;AACnC,cAAM,OAAO,KAAK,OAAO,KAAK,MAAM;AACpC,YAAI,SAAS,MAAM,SAAS,MAAM,OAAO,GAAI;AAC7C,aAAK;AAAA,MACP;AACA,UAAI,KAAK,SAAS,OAAO;AACvB,cAAM,QAAQ,KAAK,OAAO,SAAS,OAAO,KAAK,MAAM;AAGrD,YAAI,QAAS,OAAM,QAAQ,MAAM,KAAK;AAAA,YACjC,OAAM,KAAKA,SAAS,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC,CAAC;AAAA,MAC1D;AACA,UAAI,KAAK,WAAW,KAAK,UAAW;AACpC,UAAIA,SAAS,OAAM,KAAKA,SAAQ,OAAO,CAAC;AACxC,YAAM,UAAU,MAAM,KAAK,KAAK;AAChC,UAAI,YAAY,GAAI,QAAO,MAAM,KAAK,EAAE;AACxC,UAAI,YAAY,GAAI,SAAQ,uDAAuD;AACnF,YAAM,SAAS,OAAO,aAAa,MAAM,KAAK,KAAK,CAAC;AACpD,UAAI,WAAW,KAAK;AAClB,YAAI,SAAS;AACb,iBAAS,QAAQ,GAAG,QAAQ,GAAG,QAAS,WAAU,OAAO,aAAa,MAAM,KAAK,KAAK,CAAC;AACvF,YAAI,CAAC,mBAAmB,KAAK,MAAM,EAAG,SAAQ,6BAA6B;AAC3E,cAAM,KAAK,OAAO,aAAa,OAAO,SAAS,QAAQ,EAAE,CAAC,CAAC;AAAA,MAC7D,OAAO;AACL,cAAM,UAAkC;AAAA,UACtC,KAAK;AAAA,UACL,MAAM;AAAA,UACN,KAAK;AAAA,UACL,GAAG;AAAA,UACH,GAAG;AAAA,UACH,GAAG;AAAA,UACH,GAAG;AAAA,UACH,GAAG;AAAA,QACL;AACA,YAAI,CAAC,OAAO,OAAO,SAAS,MAAM,EAAG,SAAQ,qBAAqB;AAClE,cAAM,KAAK,QAAQ,MAAM,CAAE;AAAA,MAC7B;AAAA,IACF;AACA,YAAQ,4CAA4C;AAAA,EACtD;AAAA,EACA,MAAM,MAAM,MAA2B;AACrC,UAAM,KAAK,OAAO,GAAG;AACrB,UAAM,KAAK,WAAW;AACtB,QAAK,MAAM,KAAK,KAAK,MAAO,IAAI;AAC9B,YAAM,KAAK,KAAK;AAChB;AAAA,IACF;AACA,WAAO,MAAM;AACX,YAAM,KAAK;AACX,YAAM,KAAK,WAAW;AACtB,YAAM,YAAY,MAAM,KAAK,KAAK;AAClC,UAAI,cAAc,GAAI;AACtB,UAAI,cAAc,GAAI,SAAQ,sCAAsC;AAAA,IACtE;AAAA,EACF;AAAA,EACA,MAAM,OAAO,OAAuC;AAClD,UAAM,KAAK,OAAO,GAAG;AACrB,UAAM,OAAO,oBAAI,IAAY;AAC7B,UAAM,KAAK,WAAW;AACtB,QAAK,MAAM,KAAK,KAAK,MAAO,KAAK;AAC/B,YAAM,KAAK,KAAK;AAChB,aAAO;AAAA,IACT;AACA,WAAO,MAAM;AACX,YAAM,MAAM,MAAM,KAAK,OAAO;AAC9B,UAAI,KAAK,IAAI,GAAG,EAAG,SAAQ,2CAA2C;AACtE,WAAK,IAAI,GAAG;AACZ,YAAM,KAAK,OAAO,GAAG;AACrB,YAAM,MAAM,GAAG;AACf,YAAM,KAAK,WAAW;AACtB,YAAM,YAAY,MAAM,KAAK,KAAK;AAClC,UAAI,cAAc,IAAK,QAAO;AAC9B,UAAI,cAAc,GAAI,SAAQ,uCAAuC;AAAA,IACvE;AAAA,EACF;AAAA,EACA,MAAM,UAAU;AACd,UAAM,KAAK,WAAW;AAGtB,QAAI,SAAS;AACb,QAAI,gBAAgB;AACpB,QAAI,cAAc;AAClB,QAAI,QAAQ;AACZ,UAAM,UAAU,CAAC,SAAiB,QAAQ,MAAM,QAAQ;AACxD,UAAM,gBAAgB,CAAC,SAAiB;AACtC,UAAI,SAAS,IAAI;AACf,YAAI,SAAS,MAAM,gBAAgB,GAAI,SAAQ;AAC/C,YAAI,gBAAgB,GAAI,eAAc;AAAA,MACxC;AACA;AAAA,IACF;AACA,QAAK,MAAM,KAAK,KAAK,MAAO,IAAI;AAC9B,cAAQ;AACR,YAAM,KAAK,KAAK;AAAA,IAClB;AACA,UAAM,QAAQ,MAAM,KAAK,KAAK;AAC9B,QAAI,CAAC,QAAQ,KAAK,EAAG,SAAQ,0CAA0C;AACvE,kBAAc,KAAK;AACnB;AACA,QAAI,UAAU,IAAI;AAChB,aAAO,QAAQ,MAAM,KAAK,KAAK,CAAC,GAAG;AACjC,sBAAc,MAAM,KAAK,KAAK,CAAC;AAC/B;AAAA,MACF;AAAA,IACF,WAAW,QAAQ,MAAM,KAAK,KAAK,CAAC,EAAG,SAAQ,yCAAyC;AACxF,QAAK,MAAM,KAAK,KAAK,MAAO,IAAI;AAC9B,YAAM,KAAK,KAAK;AAChB,UAAI,CAAC,QAAQ,MAAM,KAAK,KAAK,CAAC,EAAG,SAAQ,kCAAkC;AAC3E,aAAO,QAAQ,MAAM,KAAK,KAAK,CAAC,EAAG,eAAc,MAAM,KAAK,KAAK,CAAC;AAAA,IACpE;AACA,QAAI,WAAW;AACf,QAAI,OAAO;AACX,QAAK,MAAM,KAAK,KAAK,MAAO,OAAQ,MAAM,KAAK,KAAK,MAAO,IAAI;AAC7D,YAAM,KAAK,KAAK;AAChB,UAAK,MAAM,KAAK,KAAK,MAAO,MAAO,MAAM,KAAK,KAAK,MAAO,IAAI;AAC5D,YAAK,MAAM,KAAK,KAAK,MAAO,GAAI,QAAO;AAAA,MACzC;AACA,UAAI,CAAC,QAAQ,MAAM,KAAK,KAAK,CAAC,EAAG,SAAQ,kCAAkC;AAC3E,aAAO,QAAQ,MAAM,KAAK,KAAK,CAAC,GAAG;AAEjC,mBAAW,KAAK,IAAI,OAAO,kBAAkB,WAAW,KAAM,MAAM,KAAK,KAAK,IAAK,EAAE;AAAA,MACvF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,gBAAgB,MAAM,gBAAgB,cAAc,IAAI,OAAO,aAAa;AACxF,cAAQ,uCAAuC;AAAA,EACnD;AACF;AAEA,IAAM,gBAAN,MAAoB;AAAA,EAQlB,YAA6B,SAA2C;AAA3C;AAAA,EAA4C;AAAA,EAPxD,SAAS,OAAO,YAAY,WAAW;AAAA,EAChD,eAAe;AAAA,EACf,OAAO;AAAA,EACP,SAAS;AAAA;AAAA,EAET,UAAU;AAAA,EAClB,WAAW;AAAA,EAEX,MAAc,QAAQ;AACpB,QAAI,CAAC,KAAK,aAAc;AACxB,UAAM,KAAK,QAAQ,KAAK,OAAO,SAAS,GAAG,KAAK,YAAY,CAAC;AAC7D,SAAK,YAAY,KAAK;AACtB,SAAK,eAAe;AAAA,EACtB;AAAA,EACA,MAAM,MAAM,OAA4B;AACtC,aAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,YAAM,OAAO,OAAO,UAAU,WAAW,MAAM,WAAW,KAAK,IAAI,MAAM,KAAK;AAC9E,UAAI,KAAK,YAAY,EAAG,SAAQ,+CAA+C;AAC/E,UAAI,KAAK,YAAY,GAAG;AACtB,YAAI,SAAS,GAAI,SAAQ,0CAA0C;AACnE,aAAK,UAAU;AACf;AAAA,MACF;AAGA,UAAI,KAAK,eAAe,KAAK,OAAO,SAAS,EAAG,OAAM,KAAK,MAAM;AACjE,UAAI,SAAS,IAAI;AACf,YAAI,KAAK,WAAW,GAAG;AACrB,cAAI,KAAK,OAAO,GAAI,SAAQ,mDAAmD;AAC/E,eAAK,OAAO,KAAK,cAAc,IAAI,KAAK,SAAS;AACjD,eAAK,UAAU;AAAA,QACjB,WAAW,KAAK,WAAW,GAAG;AAC5B,cAAI,KAAK,OAAO,EAAG,SAAQ,mDAAmD;AAC9E,eAAK,OAAO,KAAK,cAAc,IAAI,KAAK,SAAS;AACjD,eAAK,OAAO,KAAK,cAAc,IAAK,KAAK,SAAS,IAAK;AACvD,eAAK,UAAU;AAAA,QACjB,MAAO,SAAQ,0CAA0C;AACzD,aAAK,SAAS;AACd;AAAA,MACF;AACA,YAAM,QACJ,QAAQ,MAAM,QAAQ,KAClB,OAAO,KACP,QAAQ,MAAM,QAAQ,MACpB,OAAO,KACP,QAAQ,MAAM,QAAQ,KACpB,OAAO,IACP,SAAS,KACP,KACA,SAAS,KACP,KACA;AACd,UAAI,QAAQ,EAAG,SAAQ,2CAA2C;AAClE,WAAK,OAAQ,KAAK,QAAQ,IAAK;AAC/B,UAAI,EAAE,KAAK,WAAW,GAAG;AACvB,aAAK,OAAO,KAAK,cAAc,IAAI,KAAK,SAAS;AACjD,aAAK,OAAO,KAAK,cAAc,IAAK,KAAK,SAAS,IAAK;AACvD,aAAK,OAAO,KAAK,cAAc,IAAI,KAAK,OAAO;AAC/C,aAAK,OAAO;AACZ,aAAK,SAAS;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,SAAS;AACb,QAAI,KAAK,UAAU,KAAK,YAAY,EAAG,SAAQ,oCAAoC;AACnF,UAAM,KAAK,MAAM;AAAA,EACnB;AACF;AAKA,eAAe,wBACb,OACA,SACA,QACA;AACA,QAAM,OAAO,WAAW,MAAM,WAAW;AACzC,MAAI,QAAQ;AACZ,QAAM,SAAS,OAAO,YAAY,WAAW;AAC7C,aAAW,QAAQ,CAAC,GAAG,MAAM,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG;AAC3E,YAAQ,eAAe;AACvB,UAAM,MAAM,QAAQ,KAAK,IAAI;AAC7B,UAAM,MAAM,SAAS,OAAO,KAAK,QAAQ,CAAC;AAC1C,QAAI,SAAS;AACb,WAAO,SAAS,KAAK,UAAU;AAC7B,YAAM,EAAE,UAAU,IAAI,MAAM,QAAQ;AAAA,QAClC;AAAA,QACA;AAAA,QACA,KAAK,IAAI,OAAO,QAAQ,KAAK,WAAW,MAAM;AAAA,QAC9C,KAAK,SAAS;AAAA,MAChB;AACA,UAAI,CAAC,UAAW,SAAQ,2CAA2C;AACnE,WAAK,OAAO,OAAO,SAAS,GAAG,SAAS,CAAC;AACzC,gBAAU;AAAA,IACZ;AACA,aAAS,KAAK;AAAA,EAChB;AACA,SAAO,YAAY,MAAM,MAAM,YAAY,QAAQ,MAAM,MAAM,QAAQ,KAAK;AAC9E;AAEA,SAAS,aAAa,MAAc;AAClC,MACE,CAAC,QACD,KAAK,SAAS,IAAI,KAClB,OAAO,KAAK,IAAI,EAAE,SAAS,MAAM,MAAM,QACvC,KACG,MAAM,GAAG,EACT;AAAA,IACC,CAAC,SACC,CAAC,QACD,SAAS,OACT,SAAS,QACT,OAAO,WAAW,MAAM,MAAM,IAAI;AAAA,EACtC;AAEF,YAAQ,+BAA+B;AAC3C;AAEA,eAAe,aACb,OACA,SACA,SACA,QACuB;AACvB,QAAM,SAAS,IAAI,WAAW,OAAO,UAAU,OAAO,GAAG,MAAM;AAC/D,QAAM,SAAS,UAAU,OAAO;AAChC,QAAM,cAAwB,CAAC;AAC/B,QAAM,QAAoB,CAAC;AAC3B,MAAI,YAAY;AAChB,MAAI,UAAU;AACd,QAAM,SAAS,MAAM;AACnB,eAAW,EAAE,SAAS,QAAQ,YAAY,cAAc;AAAA,EAC1D;AACA,QAAM,OAAO,MAAM,OAAO,OAAO,OAAO,QAAQ;AAC9C,QAAI,QAAQ,UAAW,QAAO,MAAM,OAAO,QAAQ;AACnD,QAAI,QAAQ,eAAe;AACzB,aAAO,MAAM,OAAO,MAAM,YAAY;AACpC,cAAM,OAAO,MAAM,OAAO,OAAO;AACjC,qBAAa,IAAI;AACjB,oBAAY,KAAK,IAAI;AACrB,eAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,QAAI,QAAQ,SAAS;AACnB,aAAO,MAAM,OAAO,MAAM,YAAY;AACpC,YAAI;AACJ,cAAM,SAAS;AACf,cAAMA,WAAU,IAAI,cAAc,OAAO,UAAU;AACjD,uBAAa,MAAM;AACnB,qBAAW,WAAW,QAAQ,mBAAmB,gBAAgB;AACjE,gBAAM,SAAS,SAAS,KAAK;AAAA,QAC/B,CAAC;AACD,cAAM,SAAS,MAAM,OAAO,OAAO,OAAO,UAAU;AAClD,cAAI,UAAU,QAAQ;AACpB,mBAAO,MAAM,OAAO,OAAO;AAC3B,yBAAa,IAAI;AAAA,UACnB,WAAW,UAAU,QAAQ;AAC3B,kBAAM,OAAO,OAAOA,QAAO;AAC3B,kBAAMA,SAAQ,OAAO;AAAA,UACvB,MAAO,SAAQ,yCAAyC;AAAA,QAC1D,CAAC;AACD,YAAI,SAAS,UAAa,CAAC,OAAO,IAAI,MAAM;AAC1C,kBAAQ,gDAAgD;AAC1D,cAAM,KAAK,EAAE,MAAM,QAAQ,UAAUA,SAAQ,SAAS,CAAC;AACvD,eAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,YAAQ,oCAAoC;AAAA,EAC9C,CAAC;AACD,MAAI,CAAC,KAAK,IAAI,SAAS,KAAK,CAAC,KAAK,IAAI,aAAa,KAAK,CAAC,KAAK,IAAI,OAAO;AACvE,YAAQ,kDAAkD;AAC5D,QAAM,OAAO,WAAW;AACxB,MAAK,MAAM,OAAO,KAAK,MAAO,GAAI,SAAQ,yCAAyC;AACnF,QAAM,QAAQ,oBAAI,IAAkC;AACpD,aAAW,CAAC,MAAM,IAAI,KAAK;AAAA,IACzB,GAAG,YAAY,IAAI,CAAC,cAAc,CAAC,WAAW,WAAW,CAAU;AAAA,IACnE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,MAAM,MAAM,CAAU;AAAA,EACrD,GAAG;AACD,QAAI,MAAM,IAAI,IAAI,EAAG,SAAQ,kCAAkC;AAC/D,UAAM,IAAI,MAAM,IAAI;AAAA,EACtB;AACA,aAAW,QAAQ,MAAM,KAAK,GAAG;AAC/B,QAAI,SAAS,cAAc,IAAI,EAAE,CAAC;AAClC,WAAO,QAAQ;AACb,UAAI,MAAM,IAAI,MAAM,MAAM,OAAQ,SAAQ,4CAA4C;AACtF,eAAS,cAAc,MAAM,EAAE,CAAC;AAAA,IAClC;AAAA,EACF;AACA,SAAO,EAAE,aAAa,MAAM;AAC9B;AAKA,eAAe,eAAe,QAAoB;AAChD,aAAW,QAAQ,MAAMN,SAAQ,OAAO,MAAM,CAAC,GAAG;AAChD,UAAM,OAAO,OAAO,QAAQ,IAAI;AAChC,UAAM,QAAQ,MAAMC,OAAM,MAAM,EAAE,QAAQ,KAAK,CAAC;AAChD,QAAI,MAAM,YAAY,GAAG;AACvB,YAAM,QAAQ,MAAMJ,MAAK,MAAM,cAAc;AAC7C,UAAI;AACF,YAAI,CAAC,UAAU,OAAO,MAAM,MAAM,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC;AACtD,kBAAQ,uCAAuC;AACjD,cAAM,eAAe,KAAK;AAC1B,YAAI,CAAC,UAAU,OAAO,MAAMI,OAAM,MAAM,EAAE,QAAQ,KAAK,CAAC,CAAC;AACvD,kBAAQ,uCAAuC;AACjD,cAAM,MAAM,IAAI;AAAA,MAClB,UAAE;AACA,cAAM,MAAM,MAAM;AAAA,MACpB;AAAA,IACF,OAAO;AACL,YAAM,OAAO,IAAI;AAAA,IACnB;AAAA,EACF;AACF;AAEA,eAAe,SAAS,SAAqB,QAAoB,MAAgB;AAC/E,QAAM,SAAS,OAAO,YAAY,WAAW;AAC7C,MAAI,SAAS;AACb,SAAO,SAAS,KAAK,UAAU;AAC7B,UAAM,EAAE,UAAU,IAAI,MAAM,QAAQ;AAAA,MAClC;AAAA,MACA;AAAA,MACA,KAAK,IAAI,OAAO,QAAQ,KAAK,WAAW,MAAM;AAAA,MAC9C,KAAK,SAAS;AAAA,IAChB;AACA,QAAI,CAAC,UAAW,SAAQ,2CAA2C;AACnE,UAAM,SAAS,QAAQ,OAAO,SAAS,GAAG,SAAS,CAAC;AACpD,cAAU;AAAA,EACZ;AACF;AAKA,eAAe,yBACb,WACA,OACA,SACA,KACY;AAIZ,QAAM,EAAE,UAAU,kBAAkB,QAAQ,eAAe,IAAI;AAC/D,QAAM,aAAa,MAAM,KAAK,KAAK,KAAK;AACxC,QAAM,uBAAuB,UAAU,OAAO;AAC9C,QAAM,SAAS,UAAU,OAAO;AAChC,aAAW,kBAAkB,QAAQ,eAAe,YAAY;AAChE,MAAI,mBAAmB,KAAK,CAAC,iBAAiB,KAAK,cAAc;AAC/D,YAAQ,0CAA0C;AACpD,QAAM,YAAY,MAAM,0BAA0B,SAAS;AAC3D,QAAM,UAAwB,CAAC;AAC/B,MAAI;AACF,UAAM,QAAQ,MAAMJ;AAAA,MAClBO,MAAK,WAAW,YAAY;AAAA,MAC5BT,WAAU,SAASA,WAAU,UAAUA,WAAU,SAASA,WAAU;AAAA,MACpE;AAAA,IACF;AACA,YAAQ,KAAK,KAAK;AAClB,UAAM,SAAS,IAAI,cAAc,KAAK;AAGtC,qBAAiB,SAAS,WAAW,GAAG;AACtC,UAAI,EAAE,iBAAiB,YAAa,SAAQ,wCAAwC;AACpF,iBAAW,OAAO,WAAW,MAAM,QAAQ,QAAQ,eAAe,YAAY;AAC9E,UAAI,OAAO,WAAW,MAAM,SAAS;AACnC,gBAAQ,iCAAiC;AAC3C,YAAM,OAAO,MAAM,KAAK;AAAA,IAC1B;AACA,QAAI,OAAO,aAAa,oBAAoB,OAAO,KAAK,OAAO,KAAK,MAAM;AACxE,cAAQ,yCAAyC;AACnD,UAAM,UAAU,MAAME;AAAA,MACpBO,MAAK,WAAW,SAAS;AAAA,MACzBT,WAAU,SAASA,WAAU,UAAUA,WAAU,SAASA,WAAU;AAAA,MACpE;AAAA,IACF;AACA,YAAQ,KAAK,OAAO;AACpB,UAAM,UAAU,MAAM,aAAa,OAAO,SAAS;AAAA,MACjD,YAAY;AAAA,MACZ,eAAe;AAAA,IACjB,CAAC;AACD,WAAO,MAAM,IAAI,SAAS,OAAO;AAAA,EACnC,UAAE;AACA,QAAI;AACF,YAAM,QAAQ,IAAI,QAAQ,IAAI,CAAC,WAAW,OAAO,MAAM,CAAC,CAAC;AAAA,IAC3D,UAAE;AACA,YAAM,oCAAoC,SAAS;AAAA,IACrD;AAAA,EACF;AACF;AAEA,eAAsB,4BACpB,MACA,OACA,UAAuC,CAAC,GACzB;AACf,QAAM,yBAAyB,MAAM,OAAO,SAAS,OAAO,SAAS,YAAY;AAC/E,UAAM,UAAwB,CAAC;AAC/B,QAAI;AACF,YAAM,wBAAwB,MAAM,SAAS,SAAS,OAAO;AAAA,IAC/D,UAAE;AACA,YAAM,QAAQ,IAAI,QAAQ,IAAI,CAAC,WAAW,OAAO,MAAM,CAAC,CAAC;AAAA,IAC3D;AAAA,EACF,CAAC;AACH;AAEA,eAAe,wBACb,MACA,SACA,SACA,SACe;AAEf,QAAM,cAAc,MAAM,SAAS,MAAM,IAAI;AAC7C,UAAQ,KAAK,WAAW;AACxB,QAAM,sBAAsB,MAAM,YAAY,KAAK,EAAE,QAAQ,KAAK,CAAC;AACnE,QAAM,eAAe,WAAW;AAChC,aAAW,QAAQ,QAAQ,aAAa;AACtC,UAAM,YAAY,MAAM,cAAc,aAAa,MAAM,QAAW,IAAI;AACxE,UAAM,UAAU,MAAM;AAAA,EACxB;AACA,aAAW,QAAQ,QAAQ,OAAO;AAChC,UAAM,CAAC,QAAQ,IAAI,IAAI,cAAc,KAAK,IAAI;AAC9C,UAAM,YAAY,MAAM,cAAc,aAAa,QAAQ,QAAW,IAAI;AAC1E,QAAI;AACF,YAAM,SAAS,MAAME,MAAK,OAAO,WAAW,IAAI,GAAG,QAAQ,GAAK;AAChE,UAAI;AACF,cAAM,WAAW,MAAM,OAAO,KAAK,EAAE,QAAQ,KAAK,CAAC;AACnD,cAAM,SAAS,SAAS,QAAQ,IAAI;AACpC,cAAM,cAAc,MAAM,cAAc,aAAa,MAAM;AAC3D,YAAI;AACF,cACE,CAAC;AAAA,YACC,MAAM,UAAU,KAAK,EAAE,QAAQ,KAAK,CAAC;AAAA,YACrC,MAAM,YAAY,KAAK,EAAE,QAAQ,KAAK,CAAC;AAAA,UACzC,KACA,CAAC,UAAU,UAAU,MAAMI,OAAM,OAAO,aAAa,IAAI,GAAG,EAAE,QAAQ,KAAK,CAAC,CAAC;AAE7E,oBAAQ,kCAAkC;AAAA,QAC9C,UAAE;AACA,gBAAM,YAAY,MAAM;AAAA,QAC1B;AAAA,MACF,UAAE;AACA,cAAM,OAAO,MAAM;AAAA,MACrB;AAAA,IACF,UAAE;AACA,YAAM,UAAU,MAAM;AAAA,IACxB;AAAA,EACF;AACA,QAAM,QAAQ,MAAM,SAAS,IAAI;AACjC,MAAI;AACF,QAAI,CAAC,UAAU,qBAAqB,MAAM,MAAM,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC;AACpE,cAAQ,kCAAkC;AAAA,EAC9C,UAAE;AACA,UAAM,MAAM,MAAM;AAAA,EACpB;AACF;AAEA,IAAM,YAAY;AAGlB,IAAM,uBAAuB;AAC7B,IAAM,qBAAqB;AAC3B,IAAM,gBAAgB;AAEtB,SAAS,SAAS,QAAgB,QAAgB,OAAe,OAAe;AAC9E,SAAO,MAAM,GAAG,MAAM,SAAS,CAAC,EAAE,SAAS,QAAQ,GAAG,GAAG,CAAC,MAAM,QAAQ,OAAO,OAAO;AACxF;AAEA,SAAS,UAAU,MAAc,MAAuB,MAAc,MAAc,OAAe;AACjG,QAAM,SAAS,OAAO,MAAM,SAAS;AACrC,SAAO,MAAM,MAAM,GAAG,KAAK,MAAM;AACjC,WAAS,QAAQ,KAAK,GAAG,IAAI;AAC7B,WAAS,QAAQ,KAAK,GAAG,CAAC;AAC1B,WAAS,QAAQ,KAAK,GAAG,CAAC;AAC1B,WAAS,QAAQ,KAAK,IAAI,IAAI;AAC9B,WAAS,QAAQ,KAAK,IAAI,KAAK;AAC/B,SAAO,KAAK,IAAM,KAAK,GAAG;AAC1B,SAAO,MAAM,MAAM,KAAK,GAAG,OAAO;AAClC,SAAO,MAAM,WAAW,KAAK,GAAG,OAAO;AACvC,SAAO,MAAM,MAAM,KAAK,GAAG,OAAO;AAClC,MAAI,WAAW;AACf,aAAW,QAAQ,OAAQ,aAAY;AACvC,SAAO,MAAM,GAAG,SAAS,SAAS,CAAC,EAAE,SAAS,GAAG,GAAG,CAAC,OAAO,KAAK,GAAG,OAAO;AAC3E,SAAO;AACT;AAEA,SAAS,UAAU,KAAa,OAAuB;AACrD,QAAM,OAAO,IAAI,GAAG,IAAI,KAAK;AAAA;AAC7B,QAAM,YAAY,OAAO,WAAW,IAAI;AAExC,MAAI,SAAS,YAAY,OAAO,SAAS,EAAE;AAC3C,SAAO,YAAY,OAAO,MAAM,EAAE,WAAW,OAAQ,UAAS,YAAY,OAAO,MAAM,EAAE;AACzF,SAAO,OAAO,KAAK,GAAG,MAAM,GAAG,IAAI,EAAE;AACvC;AAEA,SAAS,OAAO,OAAe;AAC7B,SAAO,KAAK,KAAK,QAAQ,SAAS,IAAI;AACxC;AAIA,SAAS,gBAAgB,MAAc,MAAiB,MAAc,OAAuB;AAC3F,QAAM,OAAO,SAAS,MAAM,qBAAqB;AACjD,MAAI,OAAO,WAAW,IAAI,KAAK,IAAK,QAAO,UAAU,MAAM,MAAM,MAAM,MAAM,KAAK;AAClF,QAAM,SAAS,UAAU,QAAQ,IAAI;AACrC,QAAM,MAAM,OAAO,MAAM,YAAY,OAAO,OAAO,MAAM,CAAC;AAC1D,YAAU,kBAAkB,KAAK,OAAO,QAAQ,KAAO,KAAK,EAAE,KAAK,KAAK,CAAC;AACzE,SAAO,KAAK,KAAK,SAAS;AAC1B,SAAO,OAAO,OAAO,CAAC,KAAK,UAAU,iBAAiB,MAAM,MAAM,MAAM,KAAK,CAAC,CAAC;AACjF;AAEA,SAAS,WAAW,MAAc,UAA6B;AAC7D,SAAO,SAAS,KAAK,CAAC,WAAW,SAAS,UAAU,KAAK,WAAW,GAAG,MAAM,GAAG,CAAC;AACnF;AAmBA,eAAsB,iCACpB,OACA,UAGI,CAAC,GAC0B;AAC/B,QAAM,YAAY,QAAQ,iBAAiB,CAAC,GACzC,IAAI,CAAC,SAAS,KAAK,QAAQ,YAAY,EAAE,EAAE,QAAQ,QAAQ,EAAE,CAAC,EAC9D,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;AACnC,QAAM,QACJ,QAAQ,iBAAiB,UAAa,OAAO,SAAS,QAAQ,YAAY,IACtE,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,YAAY,CAAC,IAC5C;AACN,SAAO,MAAM,yBAAyB,MAAM,OAAO,SAAS,OAAO,SAAS,YAAY;AACtF,UAAM,qBAAqB,MAAM,wBAAwB,SAAS,OAAO;AAEzE,UAAM,SAAS,IAAI,IAAI,QAAQ,WAAW;AAC1C,UAAM,cAAc,oBAAI,IAAY;AACpC,eAAW,QAAQ,CAAC,GAAG,QAAQ,aAAa,GAAG,QAAQ,MAAM,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,GAAG;AACtF,UAAI,SAAS,OAAO,IAAI,IAAI,IAAI,OAAO,cAAc,IAAI,EAAE,CAAC;AAC5D,aAAO,QAAQ;AACb,YAAI,CAAC,WAAW,QAAQ,QAAQ,EAAG,aAAY,IAAI,MAAM;AACzD,iBAAS,cAAc,MAAM,EAAE,CAAC;AAAA,MAClC;AAAA,IACF;AACA,UAAM,QAAQ,QAAQ,MAAM,OAAO,CAAC,SAAS,CAAC,WAAW,KAAK,MAAM,QAAQ,CAAC;AAC7E,UAAM,qBAAqB,CAAC,GAAG,WAAW,EAAE;AAAA,MAAK,CAAC,MAAM,UACtD,OAAO,QAAQ,OAAO,KAAK,IAAI,GAAG,OAAO,KAAK,KAAK,CAAC;AAAA,IACtD;AACA,UAAM,UAAU,oBAAI,IAAoB;AACxC,QAAI,QAAQ,IAAI;AAChB,eAAW,aAAa,oBAAoB;AAC1C,YAAM,SAAS,gBAAgB,GAAG,SAAS,KAAK,KAAK,GAAG,KAAK;AAC7D,cAAQ,IAAI,KAAK,SAAS,IAAI,MAAM;AACpC,eAAS,OAAO;AAAA,IAClB;AACA,eAAW,QAAQ,OAAO;AACxB,UAAI,KAAK,WAAW;AAClB,gBAAQ,wDAAwD;AAClE,YAAM,SAAS,gBAAgB,KAAK,MAAM,KAAK,KAAK,UAAU,KAAK;AACnE,cAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM;AACpC,eAAS,OAAO,SAAS,OAAO,KAAK,QAAQ;AAAA,IAC/C;AACA,eAAW,OAAO,OAAO,kBAAkB,mBAAmB;AAC9D,UAAM,MAAM,OAAO,MAAM,KAAK;AAC9B,UAAM,UAAmC,CAAC;AAC1C,QAAI,SAAS;AACb,eAAW,aAAa,oBAAoB;AAC1C,gBAAU,QAAQ,IAAI,KAAK,SAAS,EAAE,EAAG,KAAK,KAAK,MAAM;AACzD,cAAQ,KAAK,EAAE,MAAM,aAAa,MAAM,UAAU,CAAC;AAAA,IACrD;AACA,eAAW,QAAQ,OAAO;AACxB,gBAAU,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,EAAG,KAAK,KAAK,MAAM;AACzD,YAAM,OAAOC,YAAW,QAAQ;AAChC,UAAI,SAAS;AACb,aAAO,SAAS,KAAK,UAAU;AAC7B,cAAM,EAAE,UAAU,IAAI,MAAM,QAAQ;AAAA,UAClC;AAAA,UACA,SAAS;AAAA,UACT,KAAK,IAAI,aAAa,KAAK,WAAW,MAAM;AAAA,UAC5C,KAAK,SAAS;AAAA,QAChB;AACA,YAAI,CAAC,UAAW,SAAQ,2CAA2C;AACnE,aAAK,OAAO,IAAI,SAAS,SAAS,QAAQ,SAAS,SAAS,SAAS,CAAC;AACtE,kBAAU;AAAA,MACZ;AACA,gBAAU,OAAO,KAAK,QAAQ;AAC9B,cAAQ,KAAK;AAAA,QACX,MAAM;AAAA,QACN,MAAM,KAAK;AAAA,QACX,QAAQ,KAAK,OAAO,KAAK;AAAA,QACzB,UAAU,KAAK;AAAA,MACjB,CAAC;AAAA,IACH;AACA,WAAO;AAAA,MACL,OAAO,IAAI,WAAW,IAAI,QAAQ,IAAI,YAAY,IAAI,UAAU;AAAA,MAChE,aAAa;AAAA,MACb,UAAU,yBAAyB,OAAO;AAAA,IAC5C;AAAA,EACF,CAAC;AACH;;;ALlyCA;AAAA,EACE,wBAAAK;AAAA,EACA,uBAAAC;AAAA,EACA,+CAAAC;AAAA,EACA,wBAAAC;AAAA,EACA;AAAA,EACA,kCAAAC;AAAA,EACA,mCAAAC;AAAA,OAKK;;;AO5DP;AAAA,EACE;AAAA,EACA;AAAA,EACA,kBAAAC;AAAA,OACK;;;ACJP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAYA,SAAS,qCAA2C;AACzD,aAAW,WAAW,eAAe,SAAS;AAC5C,UAAM,aAAa,uBAAuB,OAAO;AACjD,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,MAAM,wCAAwC,OAAO,GAAG;AAAA,IACpE;AACA,QAAI,WAAW,YAAY,SAAS;AAClC,YAAM,IAAI,MAAM,oCAAoC,OAAO,WAAW,WAAW,OAAO,IAAI;AAAA,IAC9F;AAIA,QACE,WAAW,aAAa,cAAc,aACtC,WAAW,aAAa,SAAS,QACjC;AACA,YAAM,IAAI,MAAM,IAAI,OAAO,mDAAmD;AAAA,IAChF;AAIA,QACE,WAAW,aAAa,cAAc,aACtC,WAAW,aAAa,cAAc,cAAc,MACpD;AACA,YAAM,IAAI,MAAM,IAAI,OAAO,8CAA8C;AAAA,IAC3E;AAKA,QACE,WAAW,aAAa,cAAc,cACtC,WAAW,aAAa,UAAU,WAClC;AACA,YAAM,IAAI;AAAA,QACR,IAAI,OAAO,0BAA0B,WAAW,aAAa,UAAU,SAAS,yCAAyC,WAAW,aAAa,cAAc,SAAS;AAAA,MAC1K;AAAA,IACF;AAIA,QAAI,WAAW,eAAe,WAAW,SAAS,SAAS,QAAQ;AACjE,YAAM,IAAI,MAAM,IAAI,OAAO,sCAAsC;AAAA,IACnE;AAIA,QAAI,WAAW,sBAAsB,WAAW,SAAS,SAAS,WAAW,SAAS,SAAS;AAC7F,YAAM,IAAI,MAAM,IAAI,OAAO,sCAAsC,WAAW,IAAI,EAAE;AAAA,IACpF;AAAA,EACF;AACF;;;ACMO,IAAM,0CAA0C,OAAO,OAAO;AAAA,EACnE,UAAU;AAAA,EACV,UAAU;AAAA,EACV,cAAc;AAChB,CAA0C;AAEnC,IAAM,4CAA4C,OAAO,OAAO;AAAA,EACrE,UAAU;AAAA,EACV,UAAU;AAAA,EACV,cAAc;AAChB,CAA0C;AAInC,SAAS,6BAA6B,OAAyB;AACpE,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAM,QAAQ;AACd,QAAM,YACJ,MAAM,SAAS,OAAO,MAAM,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM,KAAK,IACvE,MAAM,QACP;AACN,QAAM,eACJ,UAAU,gBACV,OAAO,UAAU,iBAAiB,YAClC,CAAC,MAAM,QAAQ,UAAU,YAAY,IAChC,UAAU,eACX;AACN,QAAM,gBACJ,aAAa,iBACb,OAAO,aAAa,kBAAkB,YACtC,CAAC,MAAM,QAAQ,aAAa,aAAa,IACpC,aAAa,gBACd;AACN,SAAO,eAAe,wBAAwB,aAAa;AAC7D;;;AChHO,IAAM,iBAAuC;AAAA,EAClD,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,kBAAkB,CAAC,iBAAiB;AAAA,EACpC,wBAAwB,MAAM;AAAA,EAC9B,YAAY,uBAAuB;AAAA,EACnC,oBAAoB,UAAU;AAC5B,QAAI,CAAC,SAAS,cAAc;AAC1B,YAAM,IAAI,mBAAmB,UAAU,qCAAqC;AAAA,IAC9E;AAAA,EACF;AAAA,EACA,MAAM,EAAE,UAAU,YAAY,GAAG;AAK/B,UAAM,UAA6E;AAAA,MACjF,QAAQ,SAAS;AAAA,MACjB,KAAK;AAAA;AAAA;AAAA;AAAA,MAIL,UAAU,EAAE,uBAAuB,SAAS,yBAAyB;AAAA,IACvE;AACA,QAAI,SAAS,YAAa,SAAQ,QAAQ,SAAS;AACnD,QAAI,SAAS,aAAc,SAAQ,SAAS,SAAS;AACrD,QAAI,SAAS,4BAA4B,QAAW;AAClD,cAAQ,oBAAoB,SAAS;AAAA,IACvC;AACA,QAAI,SAAS,gCAAgC;AAC3C,cAAQ,qBAAqB,SAAS;AAAA,IACxC;AACA,QAAI,SAAS,eAAgB,SAAQ,SAAS,SAAS;AACvD,QAAI,SAAS,UAAW,SAAQ,MAAM,SAAS;AAC/C,WAAO,IAAI,oBAAoB,OAAO;AAAA,EACxC;AACF;;;ACpCO,IAAM,qBAA2C;AAAA,EACtD,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,kBAAkB,CAAC,WAAW;AAAA,EAC9B,wBAAwB,MAAM;AAAA,EAC9B,YAAY,uBAAuB;AAAA,EACnC,oBAAoB,UAAU;AAG5B,QAAI,CAAC,SAAS,qBAAqB;AACjC,YAAM,IAAI,mBAAmB,cAAc,4CAA4C;AAAA,IACzF;AAAA,EACF;AAAA,EACA,MAAM,EAAE,UAAU,aAAa,GAAG;AAChC,UAAM,UAAiF;AAAA,MACrF,WAAW,SAAS;AAAA,MACpB;AAAA;AAAA;AAAA;AAAA,MAIA,UAAU,EAAE,kBAAkB,SAAS,yBAAyB;AAAA,IAClE;AACA,QAAI,SAAS,iBAAkB,SAAQ,SAAS,SAAS;AACzD,WAAO,IAAI,wBAAwB,OAAO;AAAA,EAC5C;AACF;;;ACxBO,IAAM,kBAAwC;AAAA,EACnD,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,kBAAkB,CAAC,WAAW;AAAA,EAC9B,wBAAwB,MAAM;AAAA,EAC9B,YAAY,uBAAuB;AAAA,EACnC,oBAAoB,UAAU;AAC5B,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI,mBAAmB,WAAW,sCAAsC;AAAA,IAChF;AAAA,EACF;AAAA,EACA,MAAM,EAAE,UAAU,aAAa,aAAa,GAAG;AAC7C,UAAM,UAA8E;AAAA,MAClF,QAAQ,SAAS;AAAA,MACjB,KAAK;AAAA,MACL;AAAA,IACF;AACA,QAAI,SAAS,cAAe,SAAQ,SAAS,SAAS;AACtD,QAAI,SAAS,cAAe,SAAQ,SAAS,SAAS;AACtD,QAAI,SAAS,aAAc,SAAQ,QAAQ,SAAS;AACpD,QAAI,SAAS,oBAAqB,SAAQ,sBAAsB,SAAS;AAEzE,QAAI,SAAS,4BAA4B,QAAW;AAClD,cAAQ,mBAAmB,SAAS;AAAA,IACtC;AACA,QAAI,SAAS,sBAAuB,SAAQ,aAAa,SAAS;AAClE,QAAI,SAAS,iCAAiC;AAC5C,cAAQ,qBAAqB,SAAS;AAAA,IACxC;AACA,WAAO,0BAA0B,IAAI,qBAAqB,OAAO,GAAG,OAAO;AAAA,EAC7E;AACF;;;AC/BA,SAAS,YAAAC,iBAAgB;AACzB,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,aAAAC,kBAAiB;;;ACR1B,SAAS,gBAAgB;AACzB,SAAS,cAAAC,aAAY,QAAAC,OAAM,WAAAC,gBAAe;AAC1C,SAAS,aAAAC,kBAAiB;AAC1B,SAAS,OAAO,SAAAC,QAAO,QAAAC,OAAM,WAAAC,UAAS,YAAAC,WAAU,MAAAC,WAAU;AAC1D,SAAS,iBAAiB;AAU1B,IAAM,gBAAgB,UAAU,QAAQ;AAKxC,IAAM,cAA2B,OAAO,MAAM,YAC5C,MAAM,cAAc,UAAU,CAAC,GAAG,IAAI,GAAG,EAAE,SAAS,WAAW,OAAO,KAAK,CAAC;AAC9E,IAAM,QAAQ;AACd,IAAM,KAAK;AACX,IAAM,OAAO;AACb,IAAM,MAAM;AAYZ,IAAM,WAAW,oBAAI,QAA2B;AAChD,IAAM,iBAAiB,oBAAI,QAAgB;AAGpC,SAAS,4BAA4B,OAAoB;AAC9D,iBAAe,IAAI,KAAK;AAC1B;AAEA,SAASC,SAAQ,SAAwB;AACvC,QAAM,IAAI,mBAAmB,UAAU,uCAAuC,OAAO;AACvF;AAEA,SAAS,MAAM,OAAc;AAC3B,MACE,CAAC,GAAG,KAAK,MAAM,WAAW,KAC1B,CAAC,KAAK,KAAK,MAAM,mBAAmB,EAAE,KACtC,MAAM,uBAAuB,QAC7B,CAACC,YAAW,MAAM,iBAAiB,KACnCC,SAAQ,MAAM,iBAAiB,MAAM,MAAM,qBAC3C,MAAM,sBAAsB,OAC3B,MAAM,aAAa,QAAQ,MAAM,aAAa;AAE/C,IAAAF,SAAQ,gCAAgC;AAC1C,SAAO;AAAA,IACL,aAAa,MAAM;AAAA,IACnB,iBAAiB,MAAM;AAAA,IACvB,MAAM,MAAM;AAAA,EACd;AACF;AAEA,SAAS,cAAc,OAAgB,OAAgC;AACrE,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAM,IAAI;AACV,QAAM,IAAI,MAAM,KAAK;AACrB,MACE,EAAE,YAAY,KACd,EAAE,gBAAgB,EAAE,eACpB,EAAE,oBAAoB,EAAE,mBACxB,EAAE,eAAe,EAAE,QACnB,OAAO,EAAE,SAAS,YAClB,CAACC,YAAW,EAAE,IAAI,KAClBC,SAAQ,EAAE,IAAI,MAAM,EAAE,QACtB,EAAE,SAAS,OACX,OAAO,EAAE,aAAa,YACtB,CAAC,2BAA2B,KAAK,EAAE,QAAQ,KAC3C,CAAC,IAAI,KAAK,EAAE,gBAAgB,KAC5B,CAAC,EAAE,YACH,OAAO,EAAE,aAAa,YACtB,CAAC,CAAC,OAAO,OAAO,OAAO,OAAO,MAAM,EAAE;AAAA,IACpC,CAAC,QACC,OAAO,EAAE,SAAS,GAAsC,MAAM,YAC9D,sBAAsB,KAAK,EAAE,SAAS,GAAsC,CAAC;AAAA,EACjF;AAEA,IAAAF,SAAQ,qCAAqC;AAC/C,SAAO,OAAO,OAAO,EAAE,GAAG,GAAG,UAAU,OAAO,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;AAC3E;AAKO,SAAS,kCAAkC,OAAc,YAA2B;AACzF,QAAM,QACJ,cAAc,OAAO,eAAe,WAAW,QAAQ,IAAI,YAAY,KAAK,IAAI;AAClF,MAAI,UAAU,QAAW;AACvB,QACE,CAAC,cACD,OAAO,eAAe,YACtB,QAAQ,IAAI,YAAY,oBAAoB,MAAM,QAClD,QAAQ,IAAI,YAAY,aAAa,MAAM,MAAM,eACjD,QAAQ,IAAI,YAAY,iBAAiB,MAAM,MAAM,mBACrD,QAAQ,IAAI,YAAY,mBAAmB,MAAM,MAAM;AAEvD,MAAAA,SAAQ,sCAAsC;AAChD,UAAM,UAAU,cAAc,OAAO,KAAK;AAC1C,QAAI,CAAC,QAAS,CAAAA,SAAQ,wCAAwC;AAC9D,aAAS,IAAI,OAAO,OAAO;AAAA,EAC7B;AACF;AASA,eAAe,OAAO,OAAqC;AACzD,QAAM,SAAS,MAAM,MAAM,CAAC,QAAQ,YAAY,SAAS,GAAG,GAAM;AAClE,QAAM,KAAK,OAAO,OAAO,KAAK;AAC9B,MAAI,CAAC,2BAA2B,KAAK,EAAE,KAAK,OAAO,OAAO,KAAK;AAC7D,IAAAA,SAAQ,kCAAkC;AAC5C,SAAO;AACT;AAEA,eAAe,QAAQ,aAAqB,OAAiD;AAC3F,MAAI;AACF,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA;AAAA,IACF;AACA,QAAI,OAAO,OAAO,KAAK,EAAG,CAAAA,SAAQ,qCAAqC;AACvE,UAAM,QAAQ,KAAK,MAAM,OAAO,MAAM;AACtC,QACE,MAAM,OAAO,eACb,OAAO,MAAM,YAAY,aACzB,CAAC,MAAM,UACP,CAAC,MAAM,QAAQ,MAAM,MAAM;AAE3B,MAAAA,SAAQ,mCAAmC;AAC7C,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,SAAS,SAAS,OAAO,UAAU,WAAW,QAAQ,IAAI,OAAO,QAAQ,IAAI;AACnF,QACE,OAAO,WAAW,YAClB,QAAQ,IAAI,OAAiB,MAAM,MAAM,KACzC,CAAC,QAAQ,IAAI,OAAiB,QAAQ,KACtC,CAAC,QAAQ,IAAI,OAAiB,QAAQ,KACtC,IAAI;AAAA,MACF,0EAA0E,cAAc;AAAA,IAC1F,EAAE,KAAK,OAAO,KAAK,CAAC;AAEpB,aAAO;AACT,UAAM;AAAA,EACR;AACF;AAEA,eAAe,WACb,aACA,OACA,SACgD;AAChD,QAAM,IAAI,MAAM,KAAK;AACrB,QAAMG,eAAc,YAAY,OAAO,mDAAmD;AAC1F,MACE,YAAY,OAAO,uBAAuB,MAAM,UAChD,YAAY,OAAO,wCAAwC,MAAM,EAAE,mBACnE,CAAC,IAAI,KAAKA,gBAAe,EAAE,KAC1B,WAAWA,iBAAgB,QAAQ;AAEpC,IAAAH,SAAQ,oCAAoC;AAI9C,QAAM,OAAO,MAAMI,UAAS,EAAE,IAAI;AAClC,MACG,WAAW,SAAS,QAAQ,QAC7B,CAAC,YAAY,OAAO;AAAA,IAClB,CAAC,MACC,EAAE,SAAS,UACX,EAAE,WAAW,QACb,EAAE,gBAAgB,MAAM,SAAS,QACjC,EAAE,OAAO;AAAA,EACb;AAEA,IAAAJ,SAAQ,oCAAoC;AAC9C,SAAO,EAAE,aAAaG,cAAc,KAAK;AAC3C;AAKA,eAAsB,yBACpB,QACA,OACA,QAAqB,aACa;AAClC,MAAI,CAAC,eAAe,IAAI,KAAK,EAAG,QAAO,CAAC;AACxC,QAAM,IAAI,MAAM,KAAK;AACrB,QAAM,WAAW,MAAM,OAAO,KAAK;AACnC,QAAM,SAAS,MAAM,QAAQ,EAAE,aAAa,KAAK;AACjD,MAAI,CAAC,QAAQ,QAAS,CAAAH,SAAQ,0CAA0C;AACxE,QAAM,QAAQ,MAAM,WAAW,QAAQ,KAAK;AAC5C,QAAM,WAAW,MAAM,8BAA8B,MAAM,IAAI;AAC/D,MAAI,CAAE,MAAM,OAAO,8BAA8B,KAAK;AACpD,IAAAA,SAAQ,0CAA0C;AACpD,QAAM,8BAA8B,MAAM,MAAM,QAAQ;AACxD,MAAK,MAAM,OAAO,KAAK,MAAO,SAAU,CAAAA,SAAQ,gCAAgC;AAChF,QAAM,UAAU,OAAO,OAAO;AAAA,IAC5B,SAAS;AAAA,IACT,aAAa,EAAE;AAAA,IACf,iBAAiB,EAAE;AAAA,IACnB,YAAY,EAAE;AAAA,IACd,MAAM,MAAM;AAAA,IACZ;AAAA,IACA,kBAAkB,MAAM;AAAA,IACxB;AAAA,EACF,CAAC;AACD,WAAS,IAAI,OAAO,OAAO;AAC3B,SAAO,EAAE,CAAC,KAAK,GAAG,QAAQ;AAC5B;AAoBA,SAAS,UAAU,OAAyB;AAC1C,SAAO,SAAS,OAAO,UAAU,WAAW,QAAQ,IAAI,OAAO,MAAM,IAAI;AAC3E;AAEA,SAAS,SAAS,OAAwB;AACxC,UAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,MAAM,GAAG,GAAG;AAC9E;AAIA,eAAe,aAAa,YAAoB,eAAyC;AACvF,aAAW,QAAQ,CAAC,YAAY,aAAa,GAAG;AAC9C,QAAI;AACF,YAAMK,OAAM,IAAI;AAChB,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,UAAU,KAAK,MAAM,SAAU,QAAO;AAAA,IAC5C;AAAA,EACF;AACA,SAAO;AACT;AAMA,eAAe,yBAAyB,MAA6B;AACnE,QAAM,UAAU,CAAC,IAAI;AACrB,SAAO,QAAQ,SAAS,GAAG;AACzB,UAAM,YAAY,QAAQ,IAAI;AAC9B,eAAW,SAAS,MAAMC,SAAQ,WAAW,EAAE,eAAe,KAAK,CAAC,GAAG;AACrE,UAAI,CAAC,MAAM,YAAY,EAAG;AAC1B,YAAM,OAAOC,MAAK,WAAW,MAAM,IAAI;AACvC,YAAM,QAAQ,MAAMF,OAAM,IAAI;AAC9B,UAAI,CAAC,MAAM,YAAY,EAAG;AAC1B,WAAK,MAAM,OAAO,SAAW,IAAO,OAAM,iBAAiB,MAAM,KAAK;AACtE,cAAQ,KAAK,IAAI;AAAA,IACnB;AAAA,EACF;AACF;AAMA,eAAe,iBACb,MACA,OACe;AACf,QAAM,OAAQ,MAAM,OAAO,OAAU;AACrC,MAAI;AACJ,MAAI;AACF,aAAS,MAAMG,MAAK,MAAMC,WAAU,WAAWA,WAAU,cAAcA,WAAU,UAAU;AAAA,EAC7F,SAAS,OAAO;AACd,QAAI,UAAU,KAAK,MAAM,SAAU,OAAM;AACzC,UAAM,MAAM,MAAM,IAAI;AACtB;AAAA,EACF;AACA,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,KAAK;AACjC,QAAI,OAAO,QAAQ,MAAM,OAAO,OAAO,QAAQ,MAAM,KAAK;AACxD,YAAM,IAAI,MAAM,+CAA+C,IAAI,EAAE;AAAA,IACvE;AACA,UAAM,OAAO,MAAM,IAAI;AAAA,EACzB,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAEA,eAAe,gBAAgB,MAA6B;AAC1D,MAAI;AACF,UAAMC,IAAG,MAAM,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACjD,SAAS,OAAO;AACd,UAAM,OAAO,UAAU,KAAK;AAC5B,QAAI,SAAS,YAAY,SAAS,QAAS,OAAM;AACjD,UAAM,yBAAyB,IAAI;AACnC,UAAMA,IAAG,MAAM,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACjD;AACF;AAKA,eAAsB,8BACpB,QACA,OACA,sBACA,QAAqB,aACrB,eACsC;AACtC,QAAM,qBAAqB;AAC3B,QAAM,IAAI,MAAM,KAAK;AACrB,MAAI,UAAU,SAAS,IAAI,KAAK;AAChC,MAAI,CAAC,SAAS;AACZ,UAAM,SAAS,MAAM,QAAQ,EAAE,aAAa,KAAK;AAGjD,QAAI,CAAC,QAAQ,QAAS,CAAAV,SAAQ,4DAA4D;AAC1F,UAAM,WAAW,QAAQ,KAAK;AAC9B,QAAI,CAAE,MAAM,OAAO,8BAA8B,KAAK;AACpD,MAAAA,SAAQ,0CAA0C;AACpD,gCAA4B,KAAK;AACjC,UAAM,yBAAyB,QAAQ,OAAO,KAAK;AACnD,cAAU,SAAS,IAAI,KAAK;AAAA,EAC9B;AACA,QAAM,UAAU;AAChB,MAAI,MAAM,aAAa,EAAE,MAAM,QAAQ,IAAI,GAAG;AAM5C,UAAM,iBAAiB,YAAY;AACjC,UAAI,EAAE,MAAM,qBAAqB,GAAG;AAClC,QAAAA,SAAQ,yDAAyD;AACnE,UAAK,MAAM,OAAO,KAAK,MAAO,QAAQ,SAAU,CAAAA,SAAQ,gCAAgC;AACxF,UAAI,MAAM,QAAQ,EAAE,aAAa,KAAK;AACpC,QAAAA,SAAQ,+DAA+D;AAAA,IAC3E;AACA,UAAM,eAAe;AACrB,QAAIW,WAA6C;AACjD,UAAM,WAAW,MAAMX,SAAQ,uDAAuD;AACtF,WAAO;AAAA,MACL,OAAO,EAAE,mBAAmB,QAAQ,MAAM,UAAU,MAAM,SAAS;AAAA,MACnE,8BAA8B,QAAQ;AAAA,MACtC,iCAAiC,YAAY,SAAS;AAAA,MACtD,kBAAkB,YAAY,SAAS;AAAA,MACvC,MAAM,SAAS;AACb,cAAM,eAAe;AACrB,QAAAW,WAAU,EAAE,QAAQ,mBAAmB;AAAA,MACzC;AAAA,MACA,IAAI,uBAAuB;AACzB,eAAOA;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACA,QAAM,kBAAkB,YAAY;AAClC,UAAM,qBAAqB;AAC3B,QAAK,MAAM,OAAO,KAAK,MAAO,QAAQ,SAAU,CAAAX,SAAQ,gCAAgC;AACxF,UAAM,SAAS,MAAM,QAAQ,EAAE,aAAa,KAAK;AACjD,QAAK,MAAMI,UAAS,EAAE,IAAI,MAAO,QAAQ,KAAM,CAAAJ,SAAQ,2BAA2B;AAClF,QAAI,OAAQ,OAAM,WAAW,QAAQ,OAAO,OAAO;AACnD,UAAM,8BAA8B,QAAQ,MAAM,QAAQ,QAAQ;AAAA,EACpE;AAGA,QAAM,uBAAuB,YAAiD;AAC5E,QAAI;AAMF,UAAI,EAAE,MAAM,qBAAqB,GAAG;AAClC,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AACF,UAAK,MAAM,OAAO,KAAK,MAAO,QAAQ;AACpC,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AACF,UAAI,MAAM,QAAQ,EAAE,aAAa,KAAK;AACpC,eAAO,EAAE,QAAQ,YAAY,QAAQ,+BAA+B;AACtE,UAAK,MAAMI,UAAS,EAAE,IAAI,MAAO,QAAQ;AACvC,eAAO,EAAE,QAAQ,YAAY,QAAQ,4BAA4B;AACnE,YAAM,8BAA8B,QAAQ,MAAM,QAAQ,QAAQ;AAClE,YAAM,gBAAgB,QAAQ,IAAI;AAClC,aAAO,EAAE,QAAQ,WAAW;AAAA,IAC9B,SAAS,OAAO;AACd,aAAO,EAAE,QAAQ,YAAY,QAAQ,SAAS,KAAK,EAAE;AAAA,IACvD;AAAA,EACF;AACA,MAAI,UAA6C;AACjD,QAAM,gBAAgB;AACtB,SAAO;AAAA,IACL,OAAO,EAAE,mBAAmB,QAAQ,MAAM,UAAU,MAAM,SAAS;AAAA,IACnE,8BAA8B,QAAQ;AAAA,IACtC,iCAAiC;AAAA,IACjC,MAAM,mBAAmB;AACvB,YAAM,gBAAgB;AACtB,UAAI,QAAQ,aAAa,SAAS;AAGhC,cAAM,WAAW,IAAI,qBAAqB;AAAA,UACxC,OAAO,EAAE,GAAG,OAAO,mBAAmB,QAAQ,KAAK;AAAA,UACnD,GAAI,kBAAkB,SAAY,EAAE,cAAc,IAAI,CAAC;AAAA,QACzD,CAAC;AACD,cAAM,QAAQ,MAAM,SAAS,iBAAiB;AAC9C,cAAM,gBAAgB;AACtB,eAAO;AAAA,MACT;AACA,YAAM,UAAU,MAAM;AAAA,QACpB,QAAQ;AAAA,QACR,CAAC,GAAG,MAAM,SAAS,0BAA0B,CAAC;AAAA,QAC9C,QAAQ;AAAA,MACV;AACA,UAAI;AACF,cAAM,SAAuB,CAAC;AAC9B,yBAAiB,SAAS,QAAQ,MAAM,KAAK,EAAG,QAAO,KAAK,KAAK;AACjE,eAAO,OAAO,OAAO,MAAM;AAAA,MAC7B,UAAE;AACA,cAAM,QAAQ,MAAM,QAAQ;AAAA,MAC9B;AAAA,IACF;AAAA,IACA,MAAM,SAAS;AACb,UAAI,EAAE,MAAM,qBAAqB,GAAG;AAClC,QAAAJ,SAAQ,wCAAwC;AAClD,YAAM,gBAAgB;AACtB,UAAI,MAAM,QAAQ,EAAE,aAAa,KAAK,GAAG;AAGvC,cAAM,SAAS,MAAM,MAAM,CAAC,MAAM,MAAM,EAAE,WAAW,GAAG,GAAM;AAC9D,YAAI,OAAO,OAAO,KAAK,KAAK,OAAO,OAAO,KAAK,MAAM,EAAE;AACrD,UAAAA,SAAQ,6CAA6C;AAAA,MACzD;AAGA,gBAAU,MAAM,qBAAqB;AAAA,IACvC;AAAA,IACA,IAAI,uBAAuB;AACzB,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;AD1cA,IAAMY,iBAAgBC,WAAUC,SAAQ;AACxC,IAAM,kCAAkC;AACxC,IAAM,qBAAqB;AAepB,SAAS,oCACd,OACA,iBACG;AACH,QAAM,QAAQ,iBAAiB,KAAK;AACpC,MAAI,CAAC,SAAS,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAClF,SAAO,EAAE,GAAG,OAAO,MAAM;AAC3B;AAEA,SAAS,oBAAoB,OAA+B;AAC1D,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAM,QAAQ;AAId,SAAO,OAAO,MAAM,sBAAsB,YACxCC,YAAW,MAAM,iBAAiB,KAClC,MAAM,uBAAuB,SAC5B,MAAM,aAAa,QAAQ,MAAM,aAAa,UAC7C,MAAM,oBACN;AACN;AAEA,SAAS,kCAAkC,SAAkB,cAA6B;AACxF,aAAW,aAAa,CAAE,SAAwC,OAAO,YAAY,GAAG;AACtF,QAAI,CAAC,aAAa,OAAO,cAAc,YAAY,MAAM,QAAQ,SAAS,EAAG;AAC7E,IAAC,UAA+C,qBAAqB;AAAA,EACvE;AACF;AAEA,SAAS,qBAAqB,OAAwB;AACpD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,SAAS,QAAQ,IAAI,OAAO,QAAQ;AAC1C,SAAO,OAAO,WAAW,WAAW,OAAO,KAAK,IAAI;AACtD;AAEO,SAAS,2BAA2B,OAAgB,aAA8B;AACvF,QAAM,UAAU,YAAY,QAAQ,uBAAuB,MAAM;AACjE,SAAO,IAAI;AAAA,IACT,wEAAwE,OAAO;AAAA,EACjF,EAAE,KAAK,qBAAqB,KAAK,CAAC;AACpC;AAEA,IAAM,8BAAN,cAA0C,oBAAoB;AAAA,EACnD;AAAA,EAET,YAAY,UAAsC,CAAC,GAAG;AACpD,UAAM,OAAO;AACb,SAAK,mBAAmB;AAAA,EAC1B;AAAA,EAEA,MAAe,UAAU,MAAiD;AACxE,UAAM,UAAU,MAAM,MAAM,OAAO,GAAG,IAAI;AAC1C,gCAA4B,QAAQ,KAAK;AACzC,WAAO;AAAA,EACT;AAAA,EAEA,MAAe,wBACb,OACA;AACA,UAAM,WAAW,MAAM,MAAM,wBAAwB,KAAK;AAC1D,sCAAkC,UAAU,KAAK;AACjD,WAAO;AAAA,EACT;AAAA,EAEA,MAAe,sBACb,OACA,SACA;AACA,UAAM,YAAY,MAAM,yBAAyB,MAAM,KAAK;AAC5D,WAAO,EAAE,GAAI,MAAM,MAAM,sBAAsB,OAAO,OAAO,GAAI,GAAG,UAAU;AAAA,EAChF;AAAA;AAAA;AAAA,EAIA,MAAM,wBACJ,OACA,sBACA,SACA;AACA,UAAM,gBACJ,SAAS,kBAAkB,SACvB,KAAK,iBAAiB,gBACtB,QAAQ;AACd,WAAO,MAAM;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA,EAIA,MAAe,OACb,OACA,SACA;AACA,UAAM,UAAU,MAAM,MAAM;AAAA,MAC1B,oCAAoC,OAAO,KAAK,iBAAiB,KAAK;AAAA,MACtE;AAAA,IACF;AACA,gCAA4B,QAAQ,KAAK;AACzC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,YACJ,OACA,SACA;AACA,UAAM,cAAe,MAA4B;AACjD,QAAI,OAAO,gBAAgB,YAAY,CAAC,mBAAmB,KAAK,WAAW,GAAG;AAC5E,YAAM,IAAI,mBAAmB,UAAU,gDAAgD;AAAA,IACzF;AACA,QAAI;AACF,YAAM,SAAS,MAAMH;AAAA,QACnB;AAAA,QACA,CAAC,WAAW,UAAU,aAAa,YAAY,sBAAsB,WAAW;AAAA,QAChF,EAAE,SAAS,iCAAiC,WAAW,KAAK,KAAK;AAAA,MACnE;AACA,UAAI,OAAO,OAAO,KAAK,MAAM,QAAQ;AACnC,cAAM,IAAI,2CAA2C,UAAU,WAAW;AAAA,MAC5E;AAAA,IACF,SAAS,OAAO;AACd,UACE,iBAAiB,8CACjB,2BAA2B,OAAO,WAAW,GAC7C;AACA,cAAM,IAAI,2CAA2C,UAAU,WAAW;AAAA,MAC5E;AACA,YAAM;AAAA,IACR;AAKA,UAAM,gBACJ,SAAS,kBAAkB,SACvB,KAAK,iBAAiB,gBACtB,QAAQ;AACd,UAAM,UAAU,IAAI,qBAAqB;AAAA,MACvC;AAAA,MACA,GAAI,kBAAkB,SAAY,EAAE,cAAc,IAAI,CAAC;AAAA,IACzD,CAAC;AACD,gCAA4B,QAAQ,KAAK;AACzC,WAAO;AAAA,EACT;AACF;AAEO,IAAM,iBAAuC;AAAA,EAClD,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,kBAAkB,CAAC,aAAa;AAAA,EAChC,wBAAwB,MAAM;AAAA,EAC9B,YAAY;AAAA,IACV,MAAM;AAAA,IACN,cAAc;AAAA,IACd,6BAA6B;AAAA,EAC/B;AAAA,EACA,YAAY,uBAAuB;AAAA;AAAA;AAAA,EAGnC,oBAAoB,UAAU;AAC5B,UAAM,mBAAmB,SAAS,wBAAwB,KAAK;AAC/D,QAAI,oBAAoB,CAACG,YAAW,gBAAgB,GAAG;AACrD,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,EAAE,UAAU,aAAa,GAAG;AAChC,UAAM,mBAAmB,SAAS,wBAAwB,KAAK;AAC/D,WAAO,IAAI,4BAA4B;AAAA,MACrC,OAAO,SAAS;AAAA,MAChB;AAAA;AAAA;AAAA;AAAA,MAIA,UAAU,IAAI,iBAAiB;AAAA,MAC/B,GAAI,mBAAmB,EAAE,iBAAiB,IAAI,CAAC;AAAA,IACjD,CAAC;AAAA,EACH;AACF;;;AEvNO,IAAM,cAAoC;AAAA,EAC/C,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,kBAAkB,CAAC,WAAW;AAAA,EAC9B,wBAAwB,CAAC,UACvB,6BAA6B,KAAK,MAAM,aACpC,4CACA;AAAA,EACN,YAAY,uBAAuB;AAAA,EACnC,oBAAoB,UAAU;AAI5B,QAAI,CAAC,SAAS,WAAW;AACvB,YAAM,IAAI,mBAAmB,OAAO,kCAAkC;AAAA,IACxE;AAAA,EACF;AAAA,EACA,MAAM,EAAE,UAAU,aAAa,aAAa,GAAG;AAC7C,UAAM,UAA0E;AAAA,MAC9E,KAAK;AAAA,MACL;AAAA,IACF;AACA,QAAI,SAAS,YAAa,SAAQ,WAAW,SAAS;AAGtD,QAAI,SAAS,kBAAmB,SAAQ,UAAU,SAAS;AAC3D,QAAI,SAAS,iBAAkB,SAAQ,gBAAgB,SAAS;AAChE,QAAI,SAAS,2BAA2B,QAAW;AACjD,cAAQ,sBAAsB,SAAS;AAAA,IACzC;AACA,QAAI,SAAS,kBAAkB,OAAW,SAAQ,aAAa,SAAS;AACxE,QAAI,SAAS,yBAAyB;AACpC,cAAQ,uBAAuB,SAAS;AAAA,IAC1C;AACA,WAAO,IAAI,iBAAiB,OAAO;AAAA,EACrC;AACF;;;ACvCA,SAAS,SAAAC,cAAa;AACtB,SAAS,cAAAC,mBAAkB;AAK3B,SAAS,6BAA6B,OAAyB;AAC7D,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,OAAO,QAAQ,IAAI,OAAO,MAAM;AACtC,SAAO,SAAS,YAAY,SAAS;AACvC;AAEA,IAAM,iCAAN,cAA6C,uBAAuB;AAAA,EACzD;AAAA,EAET,YAAY,UAAyC,CAAC,GAAG;AACvD,UAAM,OAAO;AACb,SAAK,mBAAmB;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YACJ,OACA,UAA2D,CAAC,GAC1B;AAClC,QAAI,CAACC,YAAW,MAAM,iBAAiB,GAAG;AACxC,YAAM,IAAI,mBAAmB,SAAS,2CAA2C;AAAA,IACnF;AACA,QAAI;AACJ,QAAI;AACF,cAAQ,MAAMC,OAAM,MAAM,iBAAiB;AAAA,IAC7C,SAAS,OAAO;AACd,UAAI,6BAA6B,KAAK,GAAG;AACvC,cAAM,IAAI,2CAA2C,SAAS,MAAM,iBAAiB;AAAA,MACvF;AACA,YAAM;AAAA,IACR;AAGA,QAAI,CAAC,MAAM,YAAY,GAAG;AACxB,YAAM,IAAI,2CAA2C,SAAS,MAAM,iBAAiB;AAAA,IACvF;AACA,UAAM,gBACJ,SAAS,kBAAkB,SACvB,KAAK,iBAAiB,gBACtB,QAAQ;AACd,WAAO,IAAI,wBAAwB;AAAA,MACjC;AAAA,MACA,GAAI,KAAK,iBAAiB,iBAAiB,SACvC,EAAE,cAAc,KAAK,iBAAiB,aAAa,IACnD,CAAC;AAAA,MACL,GAAI,kBAAkB,SAAY,EAAE,cAAc,IAAI,CAAC;AAAA,IACzD,CAAC;AAAA,EACH;AACF;AAEO,IAAM,gBAAsC;AAAA,EACjD,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,kBAAkB,CAAC,mBAAmB;AAAA,EACtC,wBAAwB,MAAM;AAAA,EAC9B,YAAY,uBAAuB;AAAA;AAAA,EAEnC,sBAAsB;AAAA,EAAC;AAAA,EACvB,QAAQ;AAIN,WAAO,IAAI,+BAA+B,EAAE,UAAU,IAAI,iBAAiB,EAAE,CAAC;AAAA,EAChF;AACF;;;SC/CS,SAAS,iBAAiB;;;ACH7B,IAAO,gCAAP,MAAoC;EAE/B,OAAO;EACP;EACA;EAET,YAAY,UAAgD,CAAA,GAAE;AAC5D,SAAK,aAAa,QAAQ;AAC1B,SAAK,wBAAwB,QAAQ;EACvC;;AAGI,SAAU,iCACd,OACA,UAAgD,CAAA,GAAE;AAElD,wBAAsB,OAAO,OAAO;AAEpC,MAAI,UAAU,KAAK,GAAG;AACpB,UAAM,cAAc,mBAAmB,OAAO,aAAa;AAC3D,UAAM,kBAAkB,mBAAmB,OAAO,iBAAiB;AACnE,UAAM,eAAe,mBAAmB,OAAO,cAAc;AAC7D,IAAAC,wBAAuB;MACrB;MACA;MACA,WAAW,MAAM;KAClB;AACD,oCAAgC;MAC9B;MACA;MACA;MACA,WAAW,MAAM;KAClB;AACD,UAAM,cAAc,mBAAmB;MACrC,mBAAmB;MACnB,uBAAuB;MACvB,mBAAmB;KACpB;AACD,wCAAoC,OAAO,aAAa,QAAQ,UAAU;AAC1E,WAAO;MACL,YAAY,MAAM;MAClB,mBAAmB,MAAM;MACzB,WAAW,MAAM;MACjB;MACA,YAAY,QAAQ;MACpB,uBAAuB,QAAQ;MAC/B,UAAU,MAAM,YAAY;;EAEhC;AAEA,MAAI,UAAU,KAAK,GAAG;AACpB,UAAM,cAAc,mBAAmB,OAAO,aAAa;AAC3D,UAAM,kBAAkB,mBAAmB,OAAO,iBAAiB;AACnE,IAAAA,wBAAuB;MACrB;MACA;MACA,WAAW,MAAM;KAClB;AACD,UAAM,cAAc,mBAAmB;MACrC,mBAAmB;MACnB,uBAAuB;KACxB;AACD,wCAAoC,OAAO,aAAa,QAAQ,UAAU;AAC1E,UAAM,eAAe,mBAAmB,OAAO,cAAc;AAC7D,QAAI,CAAC,gBAAgB,CAAC,MAAM,WAAW;AACrC,YAAM,IAAI,kBACR,6DACA;QACE,UAAU;QACV,WAAW,MAAM;OAClB;IAEL;AACA,WAAO;MACL,YAAY,MAAM;MAClB,mBACE,gBAAgB,WAAW,MAAM,SAAS;MAC5C,WAAW,MAAM;MACjB;MACA,YAAY,QAAQ;MACpB,uBAAuB,QAAQ;MAC/B,UAAU,MAAM,YAAY;;EAEhC;AAEA,MAAI,WAAW,KAAK,GAAG;AACrB,UAAM,WAAW,mBAAmB,OAAO,UAAU;AACrD,UAAM,kBAAkB,mBAAmB,OAAO,iBAAiB;AACnE,UAAM,cAAc,mBAAmB,OAAO,aAAa;AAC3D,8BAA0B;MACxB;MACA;MACA,WAAW,MAAM;KAClB;AACD,SAAK,CAAC,YAAY,CAAC,oBAAoB,CAAC,QAAQ,YAAY;AAC1D,YAAM,IAAI,kBACR,+FACA;QACE,UAAU;QACV,WAAW,MAAM;OAClB;IAEL;AACA,UAAM,cACJ,YAAY,kBACR;MACE,sBAAsB;MACtB,0BAA0B;QAE5B;AACN,wCAAoC,OAAO,aAAa,QAAQ,UAAU;AAC1E,WAAO;MACL,YAAY,MAAM;MAClB,mBAAmB,eAAe;MAClC,WAAW,MAAM;MACjB;MACA,YAAY,QAAQ;MACpB,uBAAuB,QAAQ;MAC/B,UAAU,MAAM,YAAY;;EAEhC;AAEA,QAAM,IAAI,+BACR,oEACA;IACE,UAAU;IACV,SAAS;IACT,WAAW,OAAQ,MAA6B,QAAQ,SAAS;GAClE;AAEL;AAEM,SAAU,6BACd,OAAY;AAEZ,SACE,mBAAmB,KAAK,KACxB,MAAM,eAAe,SAAS;AAElC;AAEA,SAAS,sBACP,OACA,SAA6C;AAE7C,MAAI,QAAQ,eAAe,UAAa,QAAQ,WAAW,KAAI,MAAO,IAAI;AACxE,UAAM,IAAI,kBACR,6DACA;MACE,UAAU;MACV,WAAW,MAAM;KAClB;EAEL;AACA,MACE,QAAQ,0BAA0B,UAClC,QAAQ,sBAAsB,KAAI,MAAO,IACzC;AACA,UAAM,IAAI,kBACR,wEACA;MACE,UAAU;MACV,WAAW,MAAM;KAClB;EAEL;AACA,MAAI,QAAQ,0BAA0B,UAAa,CAAC,QAAQ,YAAY;AACtE,UAAM,IAAI,kBACR,iEACA;MACE,UAAU;MACV,WAAW,MAAM;KAClB;EAEL;AACF;AAEA,SAAS,oCACP,OACA,aACA,YAA8B;AAE9B,MAAI,cAAc,eAAe,OAAO,KAAK,WAAW,EAAE,SAAS,GAAG;AACpE,UAAM,IAAI,kBACR,oFACA;MACE,UAAU;MACV,WAAW,MAAM;KAClB;EAEL;AACF;AAEA,SAAS,mBACP,aAA+C;AAE/C,QAAM,UAAU,OAAO,YACrB,OAAO,QAAQ,WAAW,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,UAAU,MAAS,CAAC;AAExE,SAAO,OAAO,KAAK,OAAO,EAAE,SAAS,IAAI,UAAU;AACrD;AAEA,SAASA,wBAAuB,MAI/B;AACC,yBAA8B;IAC5B,aAAa,KAAK;IAClB,iBAAiB,KAAK;IACtB,SACE;IACF,SAAS;MACP,UAAU;MACV,WAAW,KAAK;;GAEnB;AACH;AAEA,SAAS,0BAA0B,MAIlC;AACC,MAAI,QAAQ,KAAK,QAAQ,MAAM,QAAQ,KAAK,eAAe,GAAG;AAC5D,UAAM,IAAI,kBACR,8FACA;MACE,UAAU;MACV,WAAW,KAAK;KACjB;EAEL;AACF;AAEA,SAAS,gCAAgC,MAKxC;AACC,MAAI,KAAK,iBAAiB,CAAC,KAAK,eAAe,CAAC,KAAK,kBAAkB;AACrE,UAAM,IAAI,kBACR,iGACA;MACE,UAAU;MACV,WAAW,KAAK;KACjB;EAEL;AACF;AAEA,SAAS,mBACP,OAAY;AAEZ,SACE,MAAM,SAAS,cACf,MAAM,SAAS,cACf,MAAM,SAAS;AAEnB;AAEA,SAAS,UAAU,OAAY;AAC7B,SAAO,MAAM,SAAS;AACxB;AAEA,SAAS,UAAU,OAAY;AAC7B,SAAO,MAAM,SAAS;AACxB;AAEA,SAAS,WAAW,OAAY;AAC9B,SAAO,MAAM,SAAS;AACxB;;;ADrNA,IAAM,0BAA0B;AAChC,IAAM,6BAA6B;AACnC,IAAM,oCAAoC;AAC1C,IAAM,kCAAkC,OAAO;AAC/C,IAAM,wCAAwC;AAqIxC,IAAO,qBAAP,MAAO,oBAAkB;EACpB;EACA;EAET,YACE,MACA,OAA8B;AAE9B,SAAK,OAAO;AACZ,SAAK,QAAQ;EACf;EAEA,OAAO,UAAU,OAAqB;AACpC,WAAO,IAAI,oBAAmB,SAAS,KAAK;EAC9C;EAEA,OAAO,OAAO,SAAe;AAC3B,WAAO,IAAI,oBAAmB,MAAM,OAAO;EAC7C;EAEA,OAAO,QAAQ,UAAgB;AAC7B,WAAO,IAAI,oBAAmB,OAAO,QAAQ;EAC/C;;AAwEI,IAAO,sBAAP,MAA0B;EACrB;EACQ;EACA;EACA;EACT;EACA,4BAA4B;EAC5B;EACA;EACA,SAAS;EACT;EACS,kBAAkB,oBAAI,IAAG;EACzB,qBAAgD,OAC/D,MACA,YACG,MAAM,KAAK,kBAAkB,MAAM,OAAO;EAC9B;EACT;EACA,gBAAgB;EAExB,YAAY,MAUX;AACC,SAAK,QAAQ,KAAK;AAClB,SAAK,QAAQ,KAAK;AAClB,SAAK,MAAM,KAAK;AAChB,SAAK,UAAU,KAAK;AACpB,SAAK,cAAc,KAAK,eAAe,KAAK,MAAM,eAAe;AACjE,SAAK,MAAM,cAAc,KAAK;AAC9B,SAAK,oBAAoB,KAAK;AAC9B,SAAK,4BAA4B,KAAK;AACtC,SAAK,oBAAoB,KAAK;AAC9B,SAAK,iBAAiB,KAAK,aAAa;AACxC,SAAK,4BACH,KAAK,sBAAsB,UAAa,CAAC,KAAK;EAClD;EAEA,iBAAiB,QAAoC;AACnD,iCAA6B,MAAM;AACnC,SAAK,gBAAgB;EACvB;EAEA,aAAa,OAAc;AACzB,QAAI,OAAO;AACT,aAAO,wBAAwB;QAC7B,cAAc;QACd,YAAY;QACZ;QACA,aAAa,KAAK;QAClB,YAAY,KAAK,mBAAmB,KAAK,IAAI;QAC7C,QAAQ,KAAK,OAAM;OACpB;IACH;AACA,WAAO,IAAI,oBAAoB;MAC7B,aAAa,KAAK;MAClB,YAAY,OAAO,SAAS,MAAM,KAAK,WAAW,IAAI;MACtD,UAAU,OAAO,SACf,IAAI,YAAW,EAAG,OAAO,MAAM,KAAK,gBAAgB,IAAI,CAAC;MAC3D,WAAW,OAAO,MAAM,YAAW;AACjC,cAAM,KAAK,iBAAiB,MAAM,OAAO;MAC3C;MACA,YAAY,OAAO,SAAQ;AACzB,cAAM,KAAK,kBAAkB,IAAI;MACnC;KACD;EACH;EAEA,cAAW;AACT,WAAO;EACT;EAEA,MAAM,YAAY,MAAqB;AACrC,UAAM,QAAQ,KAAK,IAAG;AACtB,UAAM,UAAU,kBAAkB;MAChC,GAAG;MACH,KAAK,wBAAwB,KAAK,KAAK,KAAK,KAAK;KAClD;AACD,UAAMC,WAAU,MAAM,KAAK,QAAQ,KAAK,SAAS;MAC/C,MAAM;MACN,SAAS,KAAK,eAAe,KAAK,OAAO;MACzC,KAAK,KAAK,MAAM;MAChB,KAAK,KAAK,OAAO;MACjB,QAAQ;MACR,QAAQ;KACT;AAED,UAAM,gBAAgB,oBAAoBA,QAAO;AACjD,UAAM,wBACJ,eACA,KAAK,eAAe,0BAA0B;AAGhD,QAAI,cAAc,MAAM;AACtB,YAAMC,UAAS,eACb,qBAAqB,aAAa,GAClC,KAAK,eAAe;AAEtB,aAAO,mBAAmB;QACxB,QAAQA,QAAO;QACf,iBAAiB,eAAe,KAAK;QACrC,UAAU,cAAc,YAAY;QACpC,oBAAoBA,QAAO;OAC5B;IACH;AAEA,UAAM,YAAY,KAAK;AACvB,SAAK,sBAAsB,WAAW,aAAa;AACnD,UAAM,SAAS,eACb,qBAAqB,aAAa,GAClC,KAAK,eAAe;AAEtB,WAAO,mBAAmB;MACxB,QAAQ,OAAO;MACf,iBAAiB,eAAe,KAAK;MACrC;MACA,oBAAoB,OAAO;KAC5B;EACH;EAEA,MAAM,WAAW,MAAoB;AACnC,UAAM,gBAAgB,KAAK,gBAAgB,IAAI,KAAK,SAAS;AAC7D,QAAI,CAAC,eAAe;AAClB,aAAO,mBAAmB;QACxB,QAAQ,0CAA0C,KAAK,SAAS;QAChE,iBAAiB;QACjB,UAAU;OACX;IACH;AAEA,UAAM,QAAQ,KAAK,IAAG;AACtB,UAAM,QAAQ,KAAK,SAAS;AAC5B,QAAI,MAAM,SAAS,GAAG;AACpB,UAAI,CAAC,cAAc,QAAQ,OAAO,WAAW;AAC3C,cAAM,IAAI,UACR,gEAAgE;MAEpE;AACA,YAAM,cAAc,QAAQ,MAAM,UAAU,KAAK;IACnD;AAEA,UAAM,wBACJ,eACA,KAAK,eAAe,iCAAiC;AAGvD,UAAM,SAAS,eACb,qBAAqB,aAAa,GAClC,KAAK,eAAe;AAEtB,QAAI,cAAc,MAAM;AACtB,WAAK,oBAAoB,KAAK,WAAW,aAAa;AACtD,aAAO,mBAAmB;QACxB,QAAQ,OAAO;QACf,iBAAiB,eAAe,KAAK;QACrC,UAAU,cAAc,YAAY;OACrC;IACH;AAEA,WAAO,mBAAmB;MACxB,QAAQ,OAAO;MACf,iBAAiB,eAAe,KAAK;MACrC,WAAW,KAAK;MAChB,oBAAoB,OAAO;KAC5B;EACH;EAEA,MAAM,UAAU,MAAmB;AACjC,UAAMC,gBAAe,MAAM,KAAK,kBAAkB,KAAK,IAAI;AAC3D,UAAM,QAAQ,KAAK,QACf,MAAM,oBAAoB;MACxB,cAAc;MACd,YAAY;MACZ,MAAMA;MACN,OAAO,KAAK;MACZ,YAAY,KAAK,mBAAmB,KAAK,IAAI;KAC9C,IACD,MAAM,KAAK,gBAAgBA,aAAY;AAC3C,WAAO,qBAAqB,KAAK,MAAM,KAAK;EAC9C;EAEA,MAAM,SAAS,MAAkB;AAC/B,UAAMA,gBAAe,MAAM,KAAK,kBAAkB,KAAK,IAAI;AAC3D,UAAM,QAAQ,KAAK,QACf,MAAM,oBAAoB;MACxB,cAAc;MACd,YAAY;MACZ,MAAMA;MACN,OAAO,KAAK;MACZ,YAAY,KAAK,mBAAmB,KAAK,IAAI;KAC9C,IACD,MAAM,KAAK,gBAAgBA,aAAY;AAC3C,QAAI,OAAO,KAAK,aAAa,YAAY,MAAM,aAAa,KAAK,UAAU;AACzE,aAAO,MAAM,SAAS,GAAG,KAAK,QAAQ;IACxC;AACA,WAAO;EACT;EAEA,MAAM,WAAW,MAAc,OAAc;AAC3C,UAAMA,gBAAe,MAAM,KAAK,kBAAkB,IAAI;AACtD,QAAI,CAAC,OAAO;AACV,aAAO,MAAM,6BAA6B;QACxC,cAAc;QACd,YAAY;QACZ,MAAMA;QACN,YAAY,OAAO,YAAW;AAC5B,gBAAM,OACJ,YAAY,WAAW,WAAWA,aAAY,CAAC,KAC3C,CAAC,QAAQ,MAAMA,aAAY,IAC3B,CAAC,WAAW,MAAM,OAAO;AAC/B,gBAAMF,WAAU,MAAM,KAAK,QAAQ,KAAK,MAAM;YAC5C,MAAM;YACN,SAAS,KAAK,MAAM,SAAS;YAC7B,QAAQ;YACR,QAAQ;WACT;AACD,cAAI,SAAS;AACb,gBAAM,aAAa,oBAAoBA,SAAQ,QAAQ,CAAC,UAAS;AAC/D,sBAAU;UACZ,CAAC;AACD,cAAI;AACF,kBAAMG,UAAS,MAAMH,SAAQ,KAAI;AACjC,kBAAM,WAAW;AACjB,mBAAO,EAAE,QAAAG,SAAQ,OAAM;UACzB,SAAS,OAAO;AACd,kBAAM,WAAW,OAAM;AACvB,kBAAM;UACR;QACF;OACD;IACH;AACA,WAAO,MAAM,sBACXD,eACA,OACA,KAAK,mBAAmB,KAAK,IAAI,GACjC;MACE,cAAc;MACd,YAAY;KACb;EAEL;EAEA,MAAM,UAAO;AACX,QAAI;AACF,aAAQ,MAAM,KAAK,QAAQ,KAAI,MAAQ;IACzC,QAAQ;AACN,aAAO;IACT;EACF;EAEA,MAAM,mBAAmB,MAAY;AACnC,UAAM,gBAAgB,4BAA4B;MAChD,cAAc;MACd;MACA,iBAAiB,KAAK,MAAM;KAC7B;AACD,UAAM,SAAS,6BAA6B,KAAK,OAAO,aAAa;AACrE,QAAI,QAAQ;AACV,aAAO;IACT;AACA,QAAI,CAAC,KAAK,QAAQ,SAAS;AACzB,YAAM,IAAI,qBACR,sFACA;QACE,UAAU;QACV,MAAM;OACP;IAEL;AAEA,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,KAAK,QAAQ,QAAQ,GAAM;IAC7C,SAAS,OAAO;AACd,YAAM,IAAI,qBACR,iEAAiE,aAAa,KAC9E;QACE,UAAU;QACV,MAAM;QACN,OAAO,qBAAqB,KAAK;OAClC;IAEL;AAEA,UAAM,SAAS,QAAQ,aAAa;AACpC,QACE,OAAO,QAAQ,SAAS,YACxB,OAAO,KAAK,WAAW,KACvB,OAAO,OAAO,SAAS,UACvB;AACA,YAAM,IAAI,qBACR,0CAA0C,aAAa,KACvD;QACE,UAAU;QACV,MAAM;OACP;IAEL;AAEA,WAAO,kCAAkC,KAAK,OAAO,eAAe;MAClE,MAAM,OAAO;MACb,MAAM,OAAO;MACb,KAAK;MACL,OAAO;KACR;EACH;EAEA,MAAM,iBAAiB,MAA0B;AAC/C,wCACE,sBACA,KAAK,MACL,KAAK,OACL,+BAA+B;AAEjC,0CACE,KAAK,OACL,KAAK,MACL,KAAK,MAAM,QAAQ;AAErB,UAAM,qCACJ,KAAK,OACL,KAAK,MACL,KAAK,OACL,SACA,KAAK,OAAM,GACX,KAAK,oBACL,KAAK,+BAA+B,KAAK,KAAK,CAAC;AAEjD,SAAK,4BAA2B;EAClC;EAEA,MAAM,cAAc,UAAoB,OAAc;AACpD,2CACE,sBACA,UACA,+BAA+B;AAEjC,6CAAyC,UAAU,KAAK,MAAM,QAAQ;AACtE,UAAM,gCACJ,KAAK,OACL,UACA,SACA,KAAK,OAAM,GACX,KAAK,oBACL,KAAK,+BAA+B,KAAK,CAAC;AAE5C,SAAK,4BAA2B;EAClC;EAEA,MAAM,mBAAgB;AACpB,QAAI,KAAK,MAAM,yBAAyB,uBAAuB;AAC7D,YAAM,UAAU,MAAM,KAAK,0BAAyB;AACpD,UAAI,SAAS;AACX,eAAO;MACT;IACF,WAAW,KAAK,MAAM,yBAAyB,sBAAsB;AACnE,YAAM,UAAU,MAAM,KAAK,yBAAwB;AACnD,UAAI,SAAS;AACX,eAAO;MACT;IACF,OAAO;AACL,oCACE,sBACA,KAAK,MAAM,oBAAoB;IAEnC;AAEA,sDAAkD,KAAK,MAAM,QAAQ;AACrE,WAAO,MAAM,0BAA0B;MACrC,cAAc;MACd,UAAU,KAAK,MAAM;MACrB,IAAI,KAAK,UAAS;KACnB;EACH;EAEA,MAAM,iBACJ,MACA,UAAmC,CAAA,GAAE;AAErC,UAAM,cAAc,wBAAwB,IAAI;AAChD,QAAI,aAAa,aAAa,6BAA6B;AACzD,WAAK,kCACH,YAAY,wBAAwB,uBACpC,qBAAqB;AAEvB,YAAM,KAAK,0BAA0B,YAAY,UAAU;AAC3D;IACF;AACA,QAAI,aAAa,aAAa,4BAA4B;AACxD,WAAK,kCACH,YAAY,wBAAwB,sBACpC,oBAAoB;AAEtB,YAAM,KAAK,yBAAyB,YAAY,UAAU;AAC1D;IACF;AAEA,QAAI,KAAK,MAAM,yBAAyB,OAAO;AAC7C,oCACE,sBACA,KAAK,MAAM,oBAAoB;IAEnC;AACA,sDAAkD,KAAK,MAAM,QAAQ;AACrE,UAAM,0BAA0B;MAC9B,cAAc;MACd,UAAU,KAAK,MAAM;MACrB,IAAI,KAAK,UAAS;MAClB;MACA,eACE,QAAQ,kBAAkB,SACtB,KAAK,gBACL,QAAQ;KACf;EACH;EAEQ,MAAM,4BAAyB;AACrC,QAAI,KAAK,kCAAiC,GAAI;AAC5C,aAAO;IACT;AACA,QAAI,CAAC,KAAK,QAAQ,oBAAoB;AACpC,aAAO;IACT;AAEA,UAAM,aAAa,0BACjB,MAAM,kBACJ,sBACA,SACA,+BACA,YACE,MAAM,KAAK,QAAQ,mBACjB,KAAK,MAAM,2BAA2B,GAE1C,EAAE,WAAW,KAAK,MAAM,UAAS,CAAE,CACpC;AAEH,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,qBACR,uEACA;QACE,UAAU;QACV,WAAW,KAAK,MAAM;OACvB;IAEL;AAEA,WAAO,wBAAwB;MAC7B,UAAU;MACV;MACA,sBAAsB;KACvB;EACH;EAEQ,MAAM,2BAAwB;AACpC,QAAI,KAAK,kCAAiC,GAAI;AAC5C,aAAO;IACT;AACA,QAAI,CAAC,KAAK,QAAQ,mBAAmB;AACnC,aAAO;IACT;AAEA,UAAM,aAAa,0BACjB,MAAM,kBACJ,sBACA,SACA,8BACA,YACE,MAAM,sBACJ,KAAK,QAAQ,kBAAmB,KAAK,MAAM,SAAS,IAAI,GACxD,KAAK,MAAM,6BACX,mDACA,OAAO,aAAY;AACjB,YAAM,KAAK,6BAA6B,QAAQ;IAClD,CAAC,GAEL,EAAE,WAAW,KAAK,MAAM,UAAS,CAAE,CACpC;AAEH,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,qBACR,sEACA;QACE,UAAU;QACV,WAAW,KAAK,MAAM;OACvB;IAEL;AAEA,WAAO,wBAAwB;MAC7B,UAAU;MACV;MACA,sBAAsB;KACvB;EACH;EAEQ,oCAAiC;AACvC,WAAO,KAAK,MAAM,SAAS,0BAAyB,EAAG,OAAO;EAChE;EAEQ,kCACN,QACA,UAAmC;AAEnC,QAAI,WAAW,YAAY,KAAK,MAAM,yBAAyB,UAAU;AACvE,YAAM,IAAI,qBACR,iCAAiC,MAAM,8BAA8B,KAAK,MAAM,oBAAoB,KACpG;QACE,UAAU;QACV,sBAAsB,KAAK,MAAM;QACjC,8BAA8B;OAC/B;IAEL;EACF;EAEQ,MAAM,0BAA0B,YAAkB;AACxD,UAAM,kBAAkB,KAAK;AAC7B,UAAM,oBAAoB,KAAK,MAAM;AACrC,UAAM,uBAAuB,KAAK;AAClC,UAAM,UAAU,MAAM,kBACpB,sBACA,SACA,+BACA,YACE,MAAM,uBACH,YAAW;AACV,YAAM,QAAQ,MAAM,KAAK,iBAAiB,UAAU;AACpD,aAAO,MAAM,KAAK,MAAM,UAAU,OAChC,KAAK,KACL,OACA,MAAM,KAAK,oBAAmB,CAAE;IAEpC,GAAE,GACF,KAAK,MAAM,oCACX,gDACA,iCAAiC,GAErC,EAAE,WAAW,mBAAmB,WAAU,CAAE;AAE9C,QAAI,sBAAsB;AACxB,UAAI;AACF,cAAM,gBAAgB,UAAS;MACjC,SAAS,OAAO;AACd,YAAI;AACJ,YAAI;AACF,gBAAM,QAAQ,UAAS;QACzB,SAAS,2BAA2B;AAClC,sCAA4B,qBAC1B,yBAAyB;QAE7B;AACA,cAAM,IAAI,qBACR,iHACA;UACE,UAAU;UACV,WAAW;UACX,sBAAsB,QAAQ;UAC9B,OAAO,qBAAqB,KAAK;UACjC,GAAI,4BAA4B,EAAE,0BAAyB,IAAK,CAAA;SACjE;MAEL;IACF;AACA,UAAM,KAAK,qBAAoB;AAC/B,SAAK,UAAU;AACf,SAAK,cAAc;AACnB,SAAK,MAAM,YAAY,QAAQ;AAC/B,SAAK,MAAM,cAAc;AACzB,WAAO,KAAK,MAAM;EACpB;EAEQ,MAAM,yBAAyB,YAAkB;AACvD,QAAI,CAAC,KAAK,QAAQ,YAAY;AAC5B,YAAM,IAAI,qBACR,sFACA;QACE,UAAU;QACV,WAAW,KAAK,MAAM;QACtB;OACD;IAEL;AACA,UAAM,UAAU,KAAK;AACrB,UAAM,cAAc,KAAK;AACzB,UAAM,kBACJ,sBACA,SACA,8BACA,YAAW;AACT,UAAI,CAAC,aAAa;AAChB,cAAM,QAAQ,MAAM,sBAClB,KAAK,iBAAiB,UAAU,GAChC,KAAK,MAAM,oCACX,6CAA6C;AAE/C,cAAM,QAAQ,WAAY,KAAK,MAAM,SAAS,MAAM,KAAK;AACzD;MACF;AACA,YAAM,uBACH,YAAW;AACV,cAAM,QAAQ,MAAM,KAAK,iBAAiB,UAAU;AACpD,cAAM,QAAQ,WAAY,KAAK,MAAM,SAAS,MAAM,KAAK;MAC3D,GAAE,GACF,KAAK,MAAM,oCACX,+CACA,YAAW;AACT,cAAM,kCAAkC,OAAO;MACjD,CAAC;IAEL,GACA,EAAE,WAAW,KAAK,MAAM,WAAW,WAAU,CAAE;EAEnD;EAEQ,MAAM,6BACZ,UAAuE;AAEvE,UAAM,aAAa,0BAA0B,QAAQ;AACrD,QAAI,CAAC,cAAc,CAAC,KAAK,MAAM,OAAO,QAAQ;AAC5C;IACF;AACA,UAAM,KAAK,MAAM,OAAO,OAAO,UAAU,EAAE,MAAM,MAAK;IAAE,CAAC;EAC3D;EAEQ,MAAM,iBAAiB,YAAkB;AAC/C,WAAO,KAAK,MAAM,OAAO,SACrB,MAAM,kBACJ,sBACA,SACA,iBACA,YAAY,MAAM,KAAK,MAAM,OAAO,OAAQ,UAAU,GACtD,EAAE,SAAS,WAAU,CAAE,IAEzB,EAAE,SAAS,WAAU;EAC3B;EAEQ,MAAM,sBAAmB;AAC/B,UAAM,oBAAoB,MAAM,KAAK,yBAAwB;AAC7D,WAAO;MACL,SAAS,KAAK,MAAM,SAAS;MAC7B,KAAK,KAAK,MAAM;MAChB,GAAI,KAAK,MAAM,cAAc,EAAE,SAAS,CAAC,SAAS,UAAU,EAAC,IAAK,CAAA;MAClE,GAAI,OAAO,KAAK,MAAM,cAAc,WAChC,EAAE,WAAW,KAAK,MAAM,UAAS,IACjC,CAAA;MACJ,GAAI,OAAO,KAAK,MAAM,kBAAkB,WACpC,EAAE,eAAe,KAAK,MAAM,cAAa,IACzC,CAAA;MACJ,GAAI,OAAK,KAAM,MAAM,QAAO,WAAW,EAAG,KAAK,KAAG,MAAA,IAAA,IAAA,CAAA;MAClD,GAAI,OAAK,KAAM,MAAA,cAAA,WACX,EAAE,WAAA,KAAgB,MAAK,UAAM,IAC7B,CAAA;MACJ,GAAI,KAAA,MAAA,MAAiB,EAAE,KAAG,KAAA,MAAA,IAAiB,IAAI,CAAC;MAChD,GAAA,KAAA,MAAA,yBACH,EAAA,gBAAA,KAAA,MAAA,uBAAA,IAEa,CAAA;MAGR,GAAI,oBAAC,EAAA,kBAA4B,IAAA,CAAA;;;QAGrC,2BAAyB;AACzB,QAAI,KAAC,2BAA4B;AACjC,aAAW,KAAC;IACb;AAED,SAAM,oBAAK,MAAA,KAAA,4BAAA;AACT,SAAI,4BAAc;WAChB,KAAO;;QAET,QAAS;QACP,KAAA,QAAW;AACX;IACF;AACA,QAAI,KAAC,cAAe;AAChB,YAAC,KAAA;AACH;;AAEF,SAAC,eAAA,KAAA,UAAA;;AACC,YAAK,KAAK;WACR,SAAK;cAET;AACD,UAAA,CAAA,KAAA,QAAA;AAEa,aAAS,eAAA;MACrB;IACA;;oBAKQ;sBACI,CAAA,GAAA,KAAa,gBAAe,OAAQ,CAAA;UAC3C,kBAAA,UAAA,OAAA,CAAA,kBAAA,CAAA,cAAA,IAAA;AACH,UACA,QAAA,IAAA,gBAAA,IAAA,OAAA,kBAAA;AACE,UAAI,cAAc,QAAC,OAAA,OAAA;AACrB,cAAU,cAAS,QAAY,MAAA,MAAA,EAAA,MAAA,MAAA;QAAA,CAAA;MAC/B;;QAGE,KACA,aAAA;AACH,YAAA,KAAA,QAAA,UAAA;YAAO,QAAA,IAAA,gBAAA,IAAA,OAAA,kBAAA;AACN,cAAM,cACJ,YAAgB,MAAI,MAAO;QAAA,CAAA;;WAI9B;AACD,YAAK,QAAa,IAAI,gBAAY,IAAA,OAAA,kBAAA;AAChC,cAAA,cAAA,kBAAmC,EAAA,MAAA,MAAA;QAAA,CAAA;MACpC,CAAA,CAAA;IACD;AACD,eAAAF,YAAA,WAAA;AAEa,gCAAoBA,QAAA;IAChC;AACA,SAAK,gBAAgB,MAAK;;+BAGtB;UACA,YAAK,CAAA,GAAa,KAAK,gBAAI,OAAc,CAAA;yBACjC,MAAa;UACpB,QAAA,IAAA,UAAA,IAAA,OAAA,kBAAA;AACD,gCAA0B,aAAA;UACxB,CAAA,cAAM,QAAc,cAAiB,QAAQ,OAAM,OAAK;AACzD,cAAA,cAAA,QAAA,MAAA,MAAA,EAAA,MAAA,MAAA;QAAA,CAAA;MAEH;AACH,UAAA,CAAA,cAAA,MAAA;AAEO,cAAA,cAA+B,kBAAc,EAAA,MAAA,MAAA;QAAA,CAAA;MACnD;;;iCAGO,OAAA;WACL,wCAAyC;MACzC,cAAS;kBACP;;kBAKC,KAAA,mBAAA,KAAA,IAAA;eACD;QACD,kBAAA,OAAAE,eAAA,WAAA;AACM,0CAAiC,CAAAA,aAAA,CAAA;QACvC;QACJ,mBAAA,KAAA;MAEO;MACF,SAAM;;;gCAGe;AACzB,QAAI,CAAC,KAAA,2BAA4B;AAClC;IAED;AACE,SAAA,oBAAmB;AACpB,SAAA,4BAAA;EAED;QACE,WAAW;AACZ,UAAA,KAAA,MAAA;EAEO;QAIN,SAAK;AACL,UAAA,KAAA,MAAc;;wBAEI,WAAA,eAA0B;yBAC7B,IAAA,WAAmB,aAAW;kBACrC,oBACD,MAAA;AACH,oBAAG,eAAA,WAAqC,MAAE;AAC1C,YAAA,KAAW,gBAAc,IAAA,SAAc,MAAA,eAAA;AACvC,eAAA,gBAAA,OAAA,SAAA;QACD;MACJ,GAAA,qCAAA;AAEO,iBAAmB,cAEzB,YAAiC;IAEjC,CAAA,EACI,MAAK,MAAA;IAAA,CAAA;;sBAER,WAAA,eAAA;AACF,8BAAA,aAAA;AAED,QAAA,KAAA,gBAAiC,IAAA,SAAA,MAAA,eAAA;AAC/B,WAAO,gBAAA,OAAA,SAAgC;IACxC;EAED;sBAIe,MAAA;WACX,2BAA6B,KAAA,MAAA,SAAA,MAAA,IAAA;;0BAEtB,MAAA,UAAA,CAAA,GAAA;WACP,MAAA,qCAA8B;gBACtB,KAAA,MAAU;;;kBAGd,OAAQ,YAAM;cACdF,WAAQ,MAAM,KAAA,QAAA,KAAA,CAAA,WAAA,MAAA,OAAA,GAAA;UACb,MAAA;UACH,SAAa,KAAE,MAAQ,SAAS;UAC9B,QAAA;UACA,QAAA;;cAEC,CAAA,QAAA,QAAA,QAAA,IAAA,MAAA,QAAA,IAAA;UACH,eAAiBA,SAAU,MAAM;UAClC,eAAAA,SAAA,MAAA;UACAA,SAAA,KAAA;QACJ,CAAA;AAED,eAA4B,EAAA,QAAA,UAAA,QAAA,OAAA;MAC1B;IACD,CAAA;EAED;iBACa,MAAA;AACZ,WAAA,sBAAA,KAAA,MAAA,SAAA,MAAA,IAAA;EAED;QAIE,gBAAkB,MAAC;AAIpB,UAAA,KAAA,iBAAA,CAAA,SAAA,MAAA,MAAA,IAAA,CAAA;EAED;QACE,iBAAkB,MAAK,SAAW;AACnC,UAAA,KAAA,QAAA,WAAA,WAAA,OAAA,YAAA,WAAA,IAAA,YAAA,EAAA,OAAA,OAAA,IAAA,SAAA,IAAA;EAED;QACE,gBAAW,MAAA;AACZ,WAAA,WAAA,KAAA,MAAA,KAAA,QAAA,WAAA,UAAA,IAAA,CAAA;EAEO;QAIN,kBAAgB,MAAU;UAGtB,KAAM,iBAAM,CAAA,MAAA,MAAA,MAAA,IAAA,CAAA;;2BAEI,SAAA,UAAW,CAAA,GAAA;UAC3BA,WAAQ,MAAM,KAAA,QAAA,KAAA,CAAA,WAAA,OAAA,wBAAA,SAAA,QAAA,KAAA,CAAA,GAAA;MACd,MAAM;MAER,SAAA,KAAA,MAAA,SAAA;MACF,KAAO,KAAM,MAAE;MACb,QAAA;MACA,QAAA;;UAEC,CAAA,QAAA,QAAA,QAAA,IAAA,MAAA,QAAA,IAAA;MACH,eAAOA,SAAA,MAAA;MACL,eAAQA,SAAQ,MAAA;MAChBA,SAAM,KAAA;;WAEN;MACH,QAAA;MAEa;MACZ;;;WAGG;WACD;aACE,OAAU,SAAC;AACZ,cAAA,KAAA,gBAAA,IAAA;MACD;MACH,WAAA,OAAA,MAAA,YAAA;AAEgB,cAAA,KAAA,iBAAA,MAAA,OAAA;MACf;;;;;kBAKS,OAAO,YAAM;cAChBA,WAAQ,MAAM,KAAA,QAAA,KAAA,CAAA,WAAA,MAAA,OAAA,GAAA;UACd,MAAM;UACL,SAAA,KAAA,MAAA,SAAA;UACH,KAAO,KAAM,MAAE;UACb,QAAA;UACA,QAAA;;cAEC,CAAA,QAAA,QAAA,QAAA,IAAA,MAAA,QAAA,IAAA;UACH,eAAiBA,SAAU,MAAM;UAClC,eAAAA,SAAA,MAAA;UACOA,SAAO,KAAc;QAC7B,CAAA;AACE,eAAM,EAAA,QAAK,UAAgB,QAAO,OAAQ;MAC5C;MACA,UAAO,OAAO,SAAgB,MAAA,KAAA,gBAAA,IAAA;iBACtB,OAAK,MAAA,YAAqB;AACjC,cAAA,KAAA,iBAAA,MAAA,OAAA;MACD;MACH,OAAA,OAAA,SAAA;AAEa,cAAA,KAAiB,gBAAiB,IAAA;MAC9C;;;yBAGU,SAAQ;UAChBA,WAAQ,MAAM,KAAA,QAAA,KAAA,SAAA;MACb,MAAA;MACH,SAAY,KAAG,MAAM,SAAA;MACrB,QAAM;MACF,QAAQ;;AAIZ,UAAC,SAAA,MAAA,eAAAA,SAAA,MAAA;AACF,UAAA,WAAA,MAAAA,SAAA,KAAA;AACF,QAAA,aAAA,GAAA;AAED,YAAA,IAAA,UAAA,iCAAA,QAAA,KAAA,GAAA,CAAA,MAAA,UAAA,QAAA,QAAA,EAAA,EAAA;;;;IAaS,2BAAkB;EACzB,YAAC;EAED;cAIQ,UAAU,CAAG,GAAA;AAInB,SAAA,UAAA;;QAEA,OAAM,MAAA,iBAAkB;AAIxB,UAAA,aAAgB,iCAAiB,MAAA,eAAA;AACjC,kCAAoB,sBAA+B,WAAK,QAAA;AACxD,UAAA,WAAA,WAAA;AAKA,UAAA,kBAAA,eACE,KAAQ,SACR,WAAgB,OAAA;AAElB,oBAAA,eAAA;AAKA,UAAA,cAAa,gBACX,eACA;2CAC4B,sBAAA,UAAA,+BAAA;uCAEjB,UAAA,gBAAA,2BAAA;8CACiB,UAAkB,gBAAA,OAAA;WAC5C,MAAM,gBAAQ,iBAA4B;MAC1C,YAAM,KAAA;mBAEG;YACP,cAAc,MAAA,gBAAuB;YACrC,QAAA,4BAAoB,aAAA,eAAA;YACpB,uBAAA,gBAAA,wBAAA;YACE,MAAM,sBAAe;qBACd,CAAA,gBAAA;;iBAGL,eAAkB;QAClB;QACA,SAAC,gBAAA;QACD,aAAc,gBAAM;QAIpB,iBAAa,CAAA,gBAAA;MACf,CAAA,IAEA,CAAA;AACJ,YAAI,cAAgB,MAAA,uBAAU,UAAA,gBAAA,GAAA;YAC5B,aAAU,2BACR,eACA;AAQJ,UAAC;;UACC,gBAAe,SAAS;AAIxB,kBAAU,MAAC,kBAAkB,sBAAA,SAAA,4BAAA,YAAA,MAAA,4BAAA,OAAA,gBAAA,OAAA,CAAA;aAE7B;cACE,EAAA,OAAK,SAAA,SAAA,IAAA,MAAA,kBAAA,OAAA,eAAA;mBACL,UAAQ;mBACR,WAAiB;4BAChB,MAAA,kCAAA;UACH;UACE;UACA,mBAAgB,gBAAA;;cAEhB,eAAW;mBACL,SAAS;eACZ;UACH,GAAI,cAAO,EAAA,SAAgB,CAAA,SAAA,UAAkB,EAAA,IAAQ,CAAA;aACnD,OAAI,gBAAe,cAAgB,WACjC,EAAE,WAAC,gBAAA,UAAA,IACH,CAAA;UACJ,GAAI,OAAA,gBAAgB,kBAAY,WAC5B,EAAE,eAAc,gBAAiB,cAAa,IAC9C,CAAA;UACJ,GAAI,OAAA,gBAAsB,QAAA,WAC1B,EAAA,KAAA,gBAAA,IAAA,IACQ,CAAA;UAaX,GAAA,OAAA,gBAAA,cAAA,WAEK,EAAA,WAAyC,gBAAA,UAAA,IACrC,CAAA;UACR,GAAA,gBAAmB,MAAS,EAAA,KAAA,gBAAA,IAAA,IAAA,CAAA;UAC5B,GAAA,gBAAc,eACL,EAAA,gBAAgB,gBAAO,aAAA,IACvB,CAAA;UACT,GAAQ,oBAAa,EAAQ,kBAAA,IAAA,CAAA;QAC7B;AACA,kBAAA,MAAA,oBAAoB,kBAAA,sBAAA,SAAA,kBAAA,YAAA,MAAA,MAAA,UAAA,OAAA,KAAA,OAAA,YAAA,GAAA,EAAA,SAAA,gBAAA,QAAA,CAAA,GAAA,gBAAA,uBAAA,qCAAA,iCAAA;;YAGpB,eAAA;QAEA;QACA,WAAW,QAAA;QACX,aAAa,CAAA,gBAAiB;QAC9B,SAAK,gBAAmB;QACxB,SAAA,WAAA;QACA,UAAA,WAAkB;QAClB,uBAAU,gBAAwB;QAClC;QACA,6BACE,gBAAgB;QAClB,oCAAW,gBAAA;QACX;QACF,WAAa,gBAAO;QAClB,eAAK,gBAAA;QACL,KAAG,gBAAA;QACH,WAAO,gBAAA;QACP,KAAA,gBAAc;QACd,wBAAmB,gBAAA;QACnB,kBAAiB,gBAAA;QACjB,UAAA,gBAAmB;QACnB,qBAAe,gBAAW;QAC1B,6BAA2B,gBACnB;;;sBAGJ,IAAA,oBAAmB;;QAEtB;QAEC;QACF,aAAa,CAAC,gBACZ;QAEH,OAAA;QAAC;QACA,mBAAmB,WAAW;uBACjB,WAAC;QACd,2BAAC,YAAA,MAAA,kCAAA;UACD;UACD,UAAA,aAAA;UACM,mBAAQ,gBAAA;QAEjB,CAAA;MACH,CAAA;AAEK,UAAA;AAGG,cAAA,QAAA,cAAA,iCAA0C,QAAA,CAAA;MAClD,SAED,OAAA;AACS,YAAK,gBAAC,SAAA;AACd,gBAAA;QAEK;AAGE,cAAA,kCAAkB,SAAA,SACtB,KAAK;MAGP;AACE,aAAG;;;8BAGiB,OAAO;WAC3B,mCAAmC,KAAA;;gCAGhC;;;gCAMH,OAAA;UAIA,YAAW,MAAA,yCAAsC,OAAA,KAAA,QAAA,GAAA;WACjD;MACA,GAAG;MACH,GAAA;MAGA,aAAA,MAAkB,gBAAA,QAAwB,QAAE;MAC5C,SAAQ,WAAE,OAAA,SAA0B;MACpC,SAAA,mBAA2B,OAAE,SAAA;MAI7B,UAAA,WAAqB,OAAA,YAAmB,uBAAO;MAC/C,sBACS,MAAM,wBACf;MACH,6BAAA,mBAAA,OAAA,6BAAA;MAEK,oCAAsC,mBAAA,OAAA,oCAAA;MAC1C,WAAA,mBAAA,OAAyC,WAAO;MAC5C,eAAO,mBAAY,OAAA,eAAA;MACrB,KAAA,mBACE,OAAA,KAAA;MAEH,WAAA,mBAAA,OAAA,WAAA;MACD,KAAM,mBAAkB,OAAU,KAAA;MAElC,wBAA0B,wBAAkB,MAAA,sBAAA;MAC5C,kBAAc,mBAA2B,OAAC,kBAAa;MACrD,UAAQ,mBAAO,OAAA,UAAA;MACf,6BAAsB,mBAAA,OAAA,6BAAA;MACtB,qBAAoB,mBAAA,OAAA,qBAAA;mBAChB,OAAA,MAAmB,gBAAa,YAAQ,MAAA,cAAA;;;eAG5C,OAAA;6CAC4B,KAAA;QAC5B,CAAA,MAAA,WAAA;AACA,YAAA,IAAA,UAAA,sDACQ;;UAER,YAAa,MAAO;UACpB,cAAc,MAAA,gBAAA;UACd,QAAA,4BAAoB,aAAsB;MAC1C,GAAA,KAAA;MACA,SAAQ,MAAO;MACf,OAAA,MAAA,UAEA,mBAAmB,OAAW,MAAA,OAAA,IAC7B;MACH,UAAa,MAAG;MAOhB,uBAA0B,MAAA;MAC1B,sBAAY,MAAA;MACV,6BAAW,MAAA;MACX,oCAA4B,MAAA;MAC5B,WAAA,MAAA;MACA,eAAQ,MAAA;WACJ,MAAK;iBACE,MAAE;WACT,MAAA;oBACA,MAAe;mBACf,MAAA,oBAAA,KAAA,QAAA;MACJ,UAAK,MAAA,YAAA,KAAA,QAAA;MACP,qBAAuB,MAAA,uBACrB,KAAA,QACA;MAKE,aAAa,MAAM;;AAIvB,UAAC,UAAA,MAAA,kBAAA,sBAAA,SAAA,kBAAA,YAAA,MAAA,MAAA,UAAA,OAAA,SAAA,GAAA,EAAA,UAAA,CAAA;AAED,UAAA,cAAW,MAAA,gBAAoB;UAC7B,MAAK,sBAAA;MACL;MACA,sBAAG,MAAA;SAEH,MAAA,eAAW;MACX;MAEI,SAAK,MAAA;MACL,aAAU,MAAM;MAChB,iBAAiB;SAGjB,CAAA;UACJ,WAAa,MAAM,kBAAS,sBAAa,SAAA,gBAAA,YAAA,MAAA,QAAA,KAAA,GAAA,EAAA,UAAA,CAAA;QACxC,aAAA,MAAA;AACJ,YAAA,IAAA,UAAA,iBAAA,MAAA,SAAA,wBAAA;IACF;AAEI,WAAU,IAAA,oBAAe;MACvB;MACH;MACD;MAAQ;MACP;MAGD,2BAAA,YAAA,MAAA,kCAAA;QACF;QAEc,UAAA,MAAe;QAMrB,mBACL,MAAA,+BAKI,KAAiB,QAAK;MAClB,CAAA;MAEN,eAAc,KAAO,QACvB;IACH,CAAA;EAED;;AAOA,eAAC,kBAAA;AAED,MAAA;AACE,WAAO,iBAAA,MAAA,OAAA,OAAA,CAAA;WAEL,OAAA;AACH,UAAA,IAAA,UAAA,yHAAA,MAAA,OAAA,EAAA;EAED;;eAKQ,eAAa,MAAY;SAC1B,MAAC,kBAAoB,sBAAwB,SAAQ,eAAA,YAAA,MAAA,KAAA,MAAA,KAAA,SAAA,KAAA,SAAA;IACxD,iBAAY,KAAA;IACZ,GAAI,KAAA,cAAmB,EAAE,aAAG,KAAa,YAAQ,IAAA,CAAW;MAC5D,EAAA,SAAW,KAAC,QAAW,CAAE;;SAEvB,sBAAQ,MAAmB;SAC7B,KAAM,eAAA,KAAA,yBAAqC;;SAG5C,iBAAA,OAAA;AACD,SAAO;IACR,aAAA,MAAA;EAED;;SASM,4BAA4B,aAAA,SAAA;QAC9B,EAAA,aAAAI,aAAc,IAAA;QACd,SAAO,IAAAA,aAAA;OACL,QAAK,UAAA,EAAA,SAAA,QAAA,QAAA,IAAA,CAAA;OACL,QAAO,cAAe,EAAA,aAAM,QAAA,YAAA,IAAA,CAAA;OAC5B,QAAQ,cAAU,EAAA,aAAY,QAAA,YAAuB,IAAA,CAAA;OACrD,QAAA,WAAA,EAAA,UAAA,QAAA,SAAA,IAAA,CAAA;EACJ,CAAC;AACD,MAAI,QAAQ,wBAAiB,UAAA,OAAA,qBAAA;AAC3B,UAAM,8BAAmC,OAAA,oBAAA,KAAA,MAAA;AACzC,WAAM,sBAAqB,CAAA,YAAM,4BAAA,WAAA,QAAA,mBAAA;;;;eAU/B,kBAAK,OAAA,SAAA;mBACE,8BAAA,OAAA;eACP,SAAU,SAAQ;UAClBC,SAAA,SAAA;AACH,WAAA;MACK,OAAAA;MACA,SAAQ,aAAMA,MAAA;MAOb,UAAA,QAAA,YAAA;IACL;;MAEA,SAAQ,SAAA,MAAA;AACR,UAAA,UAAA,SAAA;AACH,UAAAA,SAAA,MAAA,OAAA,SAEQ,MAAA,kBACP,sBAA8D,SAAA,iBAAA,YAAA,MAAA,MAAA,OAAA,OAAA,OAAA,GAAA,EAAA,QAAA,CAAA,IAKxD,EAAA,QAAW;AACb,WAAA;MACF,OAAAA;MACE;MACA,UAAU,QAAQ,YAAY;;EAElC;AACA,QAAI,WAAa,SAAS;QACxB,QAAO,MAAA,kBAAA,sBAAA,SAAA,iBAAA,YAAA,MAAA,OAAA,aAAA,QAAA,GAAA,EAAA,SAAA,CAAA;;;aAGL,aAAA,KAAA;IACH;EACD;;SAEE,2BAAA,SAAA;AACH,QAAA,WAAA,8BAAA,OAAA;AAED,MAAA,SAAS,SAAA,SAAA;AAGP,WACE;MACA,SAAA,aAA0B,SAAS,KAAA;MAEtC,UAAA,QAAA,YAAA;IAEI;EAIH;MACE,SAAO,SAAS,MAA0B;AAC3C,WAAA;MACM,SAAM,SAAA;MAOd,UAAA,QAAA,YAAA;IAED;EACE;AACD,SAAA;IAEI,UAAU,SAAA;EAKb;;SAEG,8BAAsB,SAAA;AACzB,SAAI,QAAY,SACd,mBAAiB,QAAA,QAAA,YAAA,uBAAA;;eAGb,4BAAkE,OAAA,UAAA;AACxE,MAAA,SAAa,SAAO,WAAW;AAC7B,WAAM,SAAS;;eAGX,kBAAK,sBAAiB,SAAA,mBAAA,YAAA,MAAA,MAAA,UAAA,OAAA,SAAA,KAAA,GAAA,EAAA,WAAA,SAAA,MAAA,CAAA;;SAKzB,aAAE,OAAA;SACH,MAAM,WAAc,MAAA;;iDAEc,MAAA;uBACzB,KAAA,sBACG,SACN,CAAA,EAAA,MAAO,MAAO,6BAAsB,KAAA,CAAA;mBAClC,WAAU,GAAA;;;QAGhB,oBAAA,CAAA;aACF,EAAA,OAAA,UAAkB,KAAa,cAAW;AAI3C,UAAA,SAAA,iCAAA,OAAA;MACM,YAAA,mBAAkB,MAAA,eAAA,YAAA,KAC1B,KAAA;MAEI,uBAAU,mBAEb,MAAmC,eAAA,uBAAA;IAE/B,CAAC;AACH,UAAA,cAAU;MACX,GAAA,OAAA,oBACK,EAAU,mBAAU,OAAW,kBAAA,IACvB,CAAA;MACZ,GAAO,OAAA,YAAA,EAAA,WAAA,OAAA,UAAA,IAAA,CAAA;MACL,GAAA,OAAQ,OAAM,aAAiB,YAMzB,EAAI,UAAO,OAAA,SAAA;eAEP,4BAAG,KAAA,OAAA,MAAA;;sBAGC,SAAS,IAAA,KAAA,MAAU,kBAAA,OAAA,OAAA,YAAA,WAAA;;;;eAKpC,4BAAA,OAAA,QAAA;AACD,MAAA,CAAA,OAAO,cAAA,CAAA,OAAA,aAAA;AACL,WAAM,CAAE;;AAQX,QAAA,aAAA,OAAA;AAED,MAAA,YAAS;AAIP,WAAW;MACT,QAAA,MAAA,kBAAoC,sBAAa,SAAkB,+BAAC,YAAA,MAAA,MAAA,QAAA,SAAA,YAAA;QACrE,GAAA,OAAA,wBACF,EAAA,aAAA,OAAA,sBAAA,IAEQ,CAAA;MAKF,CAAA,GAAA;QACG,YAAI,OAAA;QAGN;MACA,CAAA;;;;YAKF,MAAA,kBAAA,sBAAA,SAAA,8BAAA,YAAA,MAAA,MAAA,QAAA,WAAA,OAAA,eAAA,CAAA,CAAA,GAAA,EAAA,YAAA,OAAA,WAAA,CAAA;EACJ;;SAEE,mCAC0B,UAAC,mBAA4B;aACrD,EAAA,OAAA,UAAiB,KAAA,SAAA,aAAA,GAAA;AACnB,mCAAuB,OAAA,WACf,iBACN;;AAGN;AAEA,SAAS,+BAAA,OAAA,WAAiD,mBACtC;AAElB,MAAA,CAAA,6BAAmB,KAAA,GAAA;AACf,UAAA,IAAU,+BAAgB,iFAAA;MAC5B,UAAO;MACR,SAAA;MAEK,MAAI;MAGN,WAAU,MAAO;MACjB,cAAS,MAAA,eAA0B;IACnC,CAAA;;mCAGF,OAAA;IACH,YAAA,mBAAA,MAAA,eAAA,YAAA,KAEQ;IAGP,uBAAa,mBAAiC,MAAC,eAAA,uBAAA;EAC/C,CAAA;;SAGK,kDAA0C,UAAW;QACrD,aACE,yCAA8C,QAAE;AAGxD,MAAA,WAAA,WAAA,GAAA;AAED;EAIE;QACE,IAAG,+BAA+B,wGAA0B;IAC5D,UAAG;IAIF,SAAA;IACC,MAAA,SAAW;IACb;EACF,CAAC;;AAEH,SAAC,yCAAA,UAAA;AAED,QAAS,OAAA,mBAAA,SAAA,IACP;AAIA,SAAM,cAAa,SACjB,aAAG,EACH,IAAG,CAAA,EAAA,UAAA,MAAA,mBAAA,SACD,CAAA,EAGD,OAAA,CAAA,cAAA,4BAAA,MAAA,SAAA,MAAA,IAAA,CAAA,EAAA,KAAA,CAAA,MAAA,UAAA,KAAA,cAAA,KAAA,CAAA;;SAED,yCAAO,UAAA,iBAAA;AACT,QAAC,aAAA,cAAA;IACD,GAAA,SAAA,aAAA,EAA+B,IAAC,CAAA,EAAA,UAAY,MAAA,SAAA;IAC7C,GAAA,gDAAA,iBAAA,+BAAA,QAAA,CAAA;EAED,CAAA;AACE,MAAA,WAAW,WAAS,GAAA;AACrB;EAED;AAKE,kCAAoB,UAAA;;AAEtB,SAAC,sCAAA,OAAA,MAAA,iBAAA;AAED,QAAS,aAAA,cAAA;IAIH,GAAA,4BAA+B,OAAA,IAAW;IAC5C,GAAA,gDAA6C,iBAAA,uBAAA,OAAA,MAAA,gBAAA,IAAA,CAAA;EAC/C,CAAC;AACD,MAAA,WAAe,WAAA,GAAA;AACf;;AAOA,kCAAC,UAAA;;AAEH,SAAC,+BAAA,UAAA;AAED,SAAS,CAAA,GAAA,SAAA,YAA2B,CAAC,EAAA,IAAY,CAAE,EAAA,YAAY,MAAA,WAAA;;SAE3D,uBAAuB,OAAQ,MAAE,MAAA;AACnC,QAAC,cAAA,2BAAA,MAAA,IAAA;AACD,SAAI,mCAA+B,OAAW,WAAA;;SAE7C,mCAAA,OAAA,MAAA;AACD,MAAA,MAAM,SAAuB,SAAG,CAAA,MAAA,UAAA;AAChC,WAAW,CAAC,8BAA0B,IAAO,CAAA;;AAO7C,QAAC,QAAA,CAAA,8BAAA,IAAA,CAAA;AACD,aAAO,CAAA,WAAW,UAAA,KAAA,OAAA,QAAA,MAAA,QAAA,GAAA;AACnB,UAAA,KAAA,GAAA,mCAAA,YAAA,UAAA,KAAA,MAAA,SAAA,CAAA,CAAA;EAED;AAIE,SAAI;;SAEH,4BAAA,OAAA,MAAA;AACD,MAAA,QAAM,KAAA,GAAA;AACN,WAAM,CAAA,MAAU,aAAgB,IAAA;EAChC;MACE,MAAM,SAAA,SAAe,CAAA,MAAA,UAAA;WACnB,CAAA;;QAKA,aAAY,CAAkB;aAE9B,CAAA,WAAa,UAAM,KAAW,OAC5B,QAAA,MAAgB,QAAM,GAAI;eAK5B,KAAW,GAAI,4BAAmB,YAAA,UAAA,KAAA,MAAA,SAAA,CAAA,CAAA;;AAEtC,SAAC;;AAEH,SAAC,gDAAA,iBAAA,OAAA;AAED,MAAA,MAAS,WAAA,GAAA;AAIP,WAAO,CAAA;EAIR;AAED,QAAS,kBAAA,MAAA,IAA6B,6BAA2B;AAC/D,QAAM,aAAA,CAAc;AACpB,aAAM,UAAe,gBAAG,aAAA,GAA6B;AACjD,UAAA,eAAqB;MACvB,OAAW;MACZ,wCAAA,iBAAA,OAAA,SAAA;IACD,EAAA,OACE,CAAA,SAAc,SAAK,IAAA;AACnB,QAAA,aAAe,KAAA,CAAA,gBAAc,gBAAmB,KAAA,CAAA,SAAA,6BAAA,MAAA,WAAA,CAAA,CAAA,GAAA;AAChD,iBAAe,KAAC,OAAW,SAAG;IAEjC;EAED;AACE,SAAM;;AAER,SAAC,wCAAA,UAAA,WAAA;AAED,SAAS,4BAA8B,mBAAA,SAAA,IAAA,GAAA,mBAAA,SAAA,CAAA;;AAEvC,SAAC,6BAAA,MAAA,OAAA;AAED,QAAS,iBAAA,8BAAoD,IAAA;AAC3D,QAAM,kBAAI,8BACR,KAAA;MAEE,mBAAiB,MAAA,oBAAA,IAAA;AACjB,WAAO;;SAGT,mBAAA,mBACH,eAAA,WAAA,GAAA,eAAA,GAAA,KAED,gBAAS,WAAA,GAAA,cACP,GAAA;;SAIE,8BAAO,MAAA;AACT,QAAC,aAAA,mBAAA,IAAA;AAED,SAAM,eAAe,MAAA,KAAS;;SAE5B,cAAO,QAAA;AACT,SAAC,CAAA,GAAA,IAAA,IAAA,MAAA,CAAA;;SAKG,gCAAiB,YAAA;QACjB,IAAA,+BAA0B,uEAAA;IAC1B,UAAU;IAEZ,SAAA;IACH;EAED,CAAA;;SAKI,0CAAwC,UAAa,SAAA;MACrD,CAAA,SAAO;AACP;;QAEA,eAAA,SACE,aAAW;MACb,aAAA,WACE,GAAA;AACF;;QAGA,IAAA,+BACE,mFAA6C;cAC7C;IACF,SAAK;gBACC,aAAgB,IAAG,CAAA,EAAA,UAAA,MAAA,SAAA;;;SAGzB,eAAW,UAAW,WAAa;SACnC;IACA,SAAK,WAAc,WAAY,SAAI,WAAA;IACnC,OAAA,WAAc,SAAW,SAAA;IACzB,SAAA,WAAa,WAAW,SAAe;IACvC,UAAU,WAAW,YAAY,SAAS;IAC1C,uBAAoB,WAAW,yBAAgB,SAAA;IAC/C,sBAAsB,WAAE,wBAAwB,SAAW,wBAAA;IAC3D,6BACE,WAAW,+BACb,SAAA;wCAEW,WAA2B,sCACtC,SAAa;IACb,KAAA;MACH,GAAA,SAAA,OAAA,CAAA;MAEQ,GAAA,WAAgB,OAAkC,CAAA;IACrD;IACF,WAAU,WAAU,aAAA,SAAA;IACrB,eAAA,WAAA,iBAAA,SAAA;IAED,KAAM,WAAA,OAAoB,SAAU;IAElC,WAAS,WAAA,aAAuB,SAAA;IAIhC,KAAA,WAAU,OAAA,SAAA;kBAGI,WAAO,gBAAA,SAAA;iBACR,WAAA,eAAsB,SAAA;cAEjC,WAAA,YAAA,SAAA;IACH,SAAA,WAAA,WAAA,SAAA;IAGC,aAAQ,WAAA,eAA2B,SAAK;IACxC,qBAAQ,WAAA,uBACP,SAAA;IACD,6BAAU,WAA8B,+BAGpC,SAAQ;iBACC,WAAA,eAAA,SAA6B,eAAA;;;SAKxC,gBAAgB,SAAA;MAClB,CAAA,QAAA,WAAA,QAA2B,QAAQ,KAAM,EAAC,WAAA,GAAA;AAC3C,UAAA,IAAA,UAAA,kDAAA;EACD;QACE,uBAAA,QAA6B,wBAAiB;AAChD,MAAC,CAAA,CAAA,OAAA,uBAAA,oBAAA,EAAA,SAAA,oBAAA,GAAA;AACD,UAAK,IAAO,+BAAgB,0GAAA;MACzB,UAAA;MACA,SAAA;IACD,CAAA;;cAEE,gCAAQ,kBACT,4BAAA,KAAA,MAAA,IAAA;AACD,UAAC,IAAA,+BAA+B,iEAAA;MAC/B,UAAA;MACU,SAAA;IACX,CAAA;;cAIE,OAAU;AAGZ,+BAAC,QAAA,KAAA;EACH;AACD,MAAA,QAAA,SAAA;AAED,iCAAoC,QAA4B,OAAA;EAC9D;aACO,CAAA,MAAS,KAAK,KAAI;8BAEnB,QAAA,qBAAA;IAEJ,CAAC,+BAAA,QAAA,2BAAA;IACD;MACD;MAEE,QAAS;IACV;IAEA,CAAA,aAAU,QACR,SAAA;IAEH,CAAA,iBAAA,QAAA,aAAA;IACF,CAAA,OAAA,QAAA,GAAA;IAED,CAAS,aAAA,QAAA,SAA6B;EACpC,GAAA;AACE,QAAI,UAAU,WACZ,OAAM,UAAI,YACR,CAAA,OAAA,SAAA,KAAA,KAAA,SAAA,IAAA;AAEH,YAAA,IAAA,UAAA,sBAAA,IAAA,6BAAA;IACD;EACF;;SAGG,2BAA0B,UAAQ;MAEnC,SAAM,SAAI,SACR;AAEH,QAAA,CAAA,SAAA,SAAA,OAAA,SAAA,UAAA,UAAA;AACF,YAAA,IAAA,UAAA,kEAAA;IAED;AAGM;;AAEJ,OAAC,SAAA,SAAA,QAAA,SAAA,SAAA,WACD,OAAO,SAAS,UAAY,YAAS,SAAW,MAAS,KAAG,EAAA,WAAA,IAAA;AAC7D,UAAA,IAAA,UAAA,sEAAA;EAED;;SAEE,6BAAiC,UAAS;AAC1C,MAAA,SAAa,SAAQ,WAAY;AACjC,QAAQ,CAAA,SAAS,SAAQ,OAAS,SAAC,UAAA,UAAA;AACpC,YAAA,IAAA,UAAA,sEAAA;IAED;AAGE;;MAEE,SAAQ,SAAE,SACV,OAAQ,SAAE,UAAA,YAAA,SAAA,MAAA,KAAA,EAAA,WAAA,IAAA;AACV,UAAA,IAAA,UAAoB,sEAAC;;;SAGrB,0BAAc,UAAA;MACd,OAAA,aAAoB,UAAU;AAC9B,WAAA,YAAA;EAEF;SACE,SAAA,YAAA,SAA0B,WAAe,SAAO;;SAElD,kBAAmB,MAAA;QACjB,YAAA,KAAA,SAA0B;AAC5B,QAAG,QAAA,KAAA,QAAA,KAAA,SAAA,OAAA;AACH,QAAA,OAAa,QAAC,QAAe;SAC3B,CAAA,WAAc,MAAA,KAAY,GAAA;;SAG5B,oBAAyBL,UAAS;QAChC,gBAAK;;YAEH;IACF,QAAC;IAAC,oBAAe;wBACD;UACd;IACF,UAAC;iBAAU,QAAA,QAAA;YACT;;AAEJ,MAAI;AAEJ,gBAAO,iBAAc,IAAA,QAAA,CAAAM,aAAA;AACtB,oBAAAA;EAED,CAAA;AAOE,QAAM,SAAS,CAAA;AACf,QAAM,gBAAgB,CAAA,UAAM;AAC1B,WAAK,KAAA,KAAA;kBACI,SAAO;kBACN,YAAQ,OAAU,WAAY,+BAE3B,CAAA,GAAA,MAAA,GAAA,mCAAA;kBACR;;qBAEC,oBAAeN,SAAA,QAAA,CAAA,UAAA;8BAChB,eAAA,OAAA,QAAA;;QAEJ,aAAA,oBAAAA,SAAA,QAAA,CAAA,UAAA;8BAAU,eAAA,OAAA,QAAA;;AAIb,QAAA,aAAO,WAAA,QAAA,MAAA,aAAA;QACL,aAAO,WAAA,QAAA,MAAA,aAAA;gBACC,kBAAW,YAAA;UACjB,QAAM,WAAe,CAAC,WAAW,OAAK,GAAA,WAAA,OAAA,CAAA,CAAA;;gBAEvC,eAAA,YAAA;AACD,QAAA;AACH,oBAAA,WAAA,MAAAA,SAAA,KAAA;IAED,SACM,OAAc;AAChB,oBAAa,KAAA;IACb;AACD,UAAA,QAAA,IAAA,CAAA,YAAA,UAAA,CAAA;AACF,kBAAA,OAAA;EAED,GAAA;AACE,SAAM;;AAER,SAAC,oBAAA,QAAA,SAAA;AAED,QAAK,SAAU,OAAA,UACiB;AAG9B,QAAM,WAAA,YAAoB;AAC3B,QAAA;AAEI,aAAU,MAAA;AACF,cAAG,EAAA,MAAA,MAAA,IAAA,MAAA,OAAA,KAAA;AACR,YAAA,MAAe;AACX;QACP;AACS,YAAA,OAAA,UAAA,UAAA;AACb,kBAAA,KAAA;QAEc;MAIT;IACA,UACF;AACE,aAAA,YAAc;;;;;YAKb,YAAA;AACJ,YAAA,OAAA,OAAA,EAAA,MAAA,MAAA;MAAA,CAAA;AAAS,YAAC,QAAA,MAAA,MAAA;MAAA,CAAA;IACT;;;SAGD,0BAAA,eAAA;AACD,MAAI,cAAc,cAAY;AAC5B,iBAAM,cAAc,YAAmB;AACvC,kBAAU,eAAA;;;oBAKC,OAAA;QAEV,aAAC;AACJ,aAAC,QAAA;AACH;AAEA,eAAS,eAAkB,QAAc,SAAA;AACvC,QAAA,oBAAO,QAA2B,OAAC,EAAA;AACrC;AAEA,eAAS,eAAkB,QAAA;AACzB,MAAA,OAAO;QACL,eAAA,QACE,CAAA,UAAA;AAGF,YAAA;GAID;SACE;;eAEK,wBAAM,eAAA,WAAA;AACf,MAAA;AAED,MAAA;AACE,UAAM,QAAS,KAAA;MACf,cAAoB;MACpB,cAAoB;MACpB,IAAA,QAAc,CAAAM,aAAkB;AAChC,kBAAc,WAAkBA,UAAK,SAAA;AAC9B,mBAAO,OAAA;MACf,CAAA;IAID,CAAS;EAKP;AAEC,QAAA,SAAA;AAEG,mBAAW,OAAW;IACxB;;MAMA,cAAc,QAAA;AACd,UAAA,cAAO,kBAAA;AACR,UAAA,OAAA,OAAA,IAAA,qBAAA,6DAAA;MAEK,UAAS;MAKf,WAAc;MACd,OAAc,kBAAkB,cAAU,SAAa;IACxD,CAAA,GAAA,EAAA,OAAA,cAAA,UAAA,CAAA;EAED;;SAMM,kBAAc,OAAA;SAChB,qBAAO,KAAA;;2BAEO,eAAA;SACZ;IACH,wBAAA,cAAA,QAAA,cAAA,kBAAA;IAED,wBACE,cAAe,QAAU,cAAG,kBAAA;EAC9B,EACE,OAAO,CAAA,UAAA,MAAA,KAAA,EAAA,SAAA,CAAA,MACL,CAAA,UAAQ,MAAM,QAAO,CAAA,OACrB,IAAA;;SAEH,qBAAA,eAAA;AAED,QAAM,SAAA,kBAAsB,aAAA;AAC5B,gBAAO,SAAA;gBACG,SAAO;gBACf,qBAA8B;gBAC9B,qBAAA;AACH,SAAA;AAED;SACM,0BAAqB,eAAA,OAAA,QAAA;MACvB,MAAA,WAAc,GAAA;AACf;EAED;AACD,MAAA,WAAA,UAAA;AAEI,UAAA,SAAU,oBACM,cACnB,QACA,cACA,oBAAkD,KAAA;AAE9C,kBAAO,SAAc,OAAK;AAC5B,kBAAa,qBAAQ,OAAA;AACtB;EACD;AAMD,QAAA,SAAA,oBAAA,cAAA,QAAA,cAAA,oBAAA,KAAA;AAED,gBAAe,SAAA,OAAA;AAMb,gBAAW,qBAAwB,OAAC;;SAEnC,oBAAA,QAAA,cAAA,OAAA;AAED,QAAI,aAAe,OAAC,SAAA,MAAA;AACpB,MAAI,cAAqD,iCAAA;AACrD,WAAC;MACH,QAAO,SAAc;MACnB;;;2BAKqB,eAAA,aAAA;sBACV,iCAAQ;;MAEjB,QACD,MAAA,MAAA,CAAA,+BAAA;MACD,cAAiB;;;8BAGJ,kCAAA,MAAA;;mBAET,MAAO,CAAA,mBAAA,IAAA;;;;iCAIE,QAAS,cAAC;uBACnB,GAAO;;;SAGV,OAAA,YAAA;EAAA,MAAA;;eACM,oBAAA,SAAA,gBAAA,SAAA,eAAA;MACT,OAAI,mBAAY,UAAA;WACd,MAAA;;AAEJ,SAAC,MAAA,sBAAA,SAAA,iBAAA,KAAA,SAAA,aAAA;AACH;AAEA,eAAe,sBAAA,SAAA,WACY,SAAA,eAAA;AAEzB,MAAA,OAAM,cAAmB,UAAU;AACpC,WAAA,MAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AEp9ED,SAAS,wCAAwC;AAEjD;AAAA,EACE;AAAA,OAEK;;;ACXP,SAAS,kBAAkB;AAC3B,SAAS,qBAAAC,0BAAyB;;;ACiBlC,IAAM,iBAAiB,oBAAI,IAAI,CAAC,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC;AAChD,IAAM,kBAAkB,oBAAI,IAAI;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,kBAAkB,oBAAI,IAAI,CAAC,OAAO,aAAa,sBAAsB,mBAAmB,CAAC;AAC/F,IAAM,YAAY;AASlB,IAAM,0BAA0B,OAAO,yBAAyB;AAEhE,SAAS,SAAS,QAAgB,KAAsB;AACtD,MAAI;AACF,UAAM,aAAa,OAAO,yBAAyB,QAAQ,GAAG;AAC9D,WAAO,aACH,WAAW,aACT,WAAW,QACX,0BACF;AAAA,EACN,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,eAAe,OAA8B;AACpD,QAAM,MAAoB,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,GAAG,UAAU,CAAC,GAAG,YAAY,MAAM;AACpF,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,OAAO,CAAC,QAAgB,QAAyB;AACrD,UAAM,SAAS,SAAS,QAAQ,GAAG;AACnC,QAAI,WAAW,wBAAyB,QAAO;AAC/C,QAAI,aAAa;AACjB,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,CAAC,SAAkB,UAAwB;AACvD,QAAI,YAAY,QAAQ,YAAY,OAAW;AAC/C,QAAI,QAAQ,KAAK,KAAK,QAAQ,IAAI;AAChC,UAAI,aAAa;AACjB;AAAA,IACF;AACA,QAAI,OAAO,YAAY,UAAU;AAC/B,UAAI,QAAQ,UAAU,IAAK,KAAI,SAAS,KAAK,OAAO;AACpD;AAAA,IACF;AACA,QAAI,OAAO,YAAY,YAAY,KAAK,IAAI,OAAO,EAAG;AACtD,SAAK,IAAI,OAAO;AAChB,eAAW,OAAO;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,GAAG;AACD,YAAM,SAAS,KAAK,SAAS,GAAG;AAChC,UAAI,OAAO,WAAW,YAAY,OAAO,SAAS,MAAM,EAAG,KAAI,QAAQ,KAAK,MAAM;AAClF,UAAI,OAAO,WAAW,UAAU;AAC9B,cAAM,OAAO,OAAO,KAAK,EAAE,YAAY;AACvC,YAAI,UAAU,KAAK,IAAI,EAAG,KAAI,MAAM,KAAK,IAAI;AAAA,MAC/C;AAAA,IACF;AACA,eAAW,OAAO,CAAC,QAAQ,WAAW,WAAW,OAAO,GAAG;AACzD,YAAM,SAAS,KAAK,SAAS,GAAG;AAChC,UAAI,OAAO,WAAW,YAAY,OAAO,UAAU,IAAK,KAAI,SAAS,KAAK,MAAM;AAAA,UAC3E,OAAM,QAAQ,QAAQ,CAAC;AAAA,IAC9B;AACA,UAAM,KAAK,SAAS,UAAU,GAAG,QAAQ,CAAC;AAC1C,UAAM,KAAK,SAAS,OAAO,GAAG,QAAQ,CAAC;AACvC,UAAM,SAAS,KAAK,SAAS,QAAQ;AACrC,QAAI,WAAW,QAAW;AACxB,UAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,CAAC,OAAO,UAAU,OAAO,SAAS,GAAI,KAAI,aAAa;AAAA;AAEnF,iBAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;AAClD,gBAAM,SAAS,KAAK,QAAQ,OAAO,KAAK,CAAC;AACzC,cAAI,CAAC,UAAU,OAAO,WAAW,SAAU,KAAI,aAAa;AAC5D,gBAAM,QAAQ,QAAQ,CAAC;AAAA,QACzB;AAAA,IACJ;AAAA,EACF;AACA,QAAM,OAAO,CAAC;AACd,SAAO;AACT;AAEA,SAAS,eAAe,SAA+B;AACrD,QAAM,OAAO,QAAQ,MAAM,KAAK,OAAO;AACvC,QAAM,UAAU,QAAQ,QAAQ,KAAK,CAAC,UAAU,OAAO,SAAS,KAAK,CAAC;AACtE,SAAO,CAAC,OAAO,QAAQ,IAAI,KAAK,IAAI,YAAY,SAAY,UAAU,OAAO,KAAK,EAAE,EACjF,OAAO,OAAO,EACd,KAAK,GAAG;AACb;AAEA,SAAS,mBAAmB,SAAgC;AAC1D,SACE,QAAQ,MAAM,KAAK,CAAC,SAAS,gBAAgB,IAAI,IAAI,CAAC,KACtD,QAAQ,QAAQ,KAAK,CAACC,YAAW,eAAe,IAAIA,OAAM,CAAC;AAE/D;AAEA,SAAS,+BAA+B,SAAgC;AACtE,SAAO,QAAQ,SAAS;AAAA,IACtB,CAAC,YACC,wDAAwD,KAAK,OAAO,KACpE,mEAAmE,KAAK,OAAO;AAAA,EACnF;AACF;AAEA,SAAS,qCAAqC,SAAgC;AAC5E,SAAO,QAAQ,SAAS;AAAA,IACtB;AAAA,EACF;AACF;AAEA,SAAS,kCAAkC,SAAgC;AACzE,SAAO,QAAQ,SAAS;AAAA,IACtB;AAAA,EACF;AACF;AAEA,SAAS,oCAAoC,SAAgC;AAC3E,SAAO,QAAQ,SAAS;AAAA,IAAK,CAAC,YAC5B,+DAA+D,KAAK,OAAO;AAAA,EAC7E;AACF;AAGO,SAAS,+BACd,WACA,OACwB;AACxB,MAAI,cAAc,gBAAgB,CAAC,OAAO;AACxC,WAAO,EAAE,MAAM,SAAS,YAAY,sBAAsB;AAAA,EAC5D;AACA,QAAM,UAAU,eAAe,KAAK;AACpC,QAAM,aAAa,eAAe,OAAO,KAAK;AAE9C,MAAI,mBAAmB,OAAO,GAAG;AAC/B,WAAO,EAAE,MAAM,uBAAuB,WAAW;AAAA,EACnD;AACA,MAAI,QAAQ,WAAY,QAAO,EAAE,MAAM,SAAS,WAAW;AAC3D,MACE,QAAQ,QAAQ,KAAK,CAACA,YAAWA,YAAW,GAAG,KAC/C,QAAQ,MAAM,KAAK,CAAC,SAAS,gBAAgB,IAAI,IAAI,CAAC,GACtD;AACA,WAAO,EAAE,MAAM,aAAa,WAAW;AAAA,EACzC;AAIA,MAAI,cAAc,WAAW,+BAA+B,OAAO,GAAG;AACpE,WAAO;AAAA,MACL,MAAM;AAAA,MACN,YACE,eAAe,kCACX,2BACA,GAAG,UAAU;AAAA,IACrB;AAAA,EACF;AAMA,MAAI,cAAc,gBAAgB,oCAAoC,OAAO,GAAG;AAC9E,WAAO;AAAA,MACL,MAAM;AAAA,MACN,YACE,eAAe,kCACX,gCACA,GAAG,UAAU;AAAA,IACrB;AAAA,EACF;AAQA,OACG,cAAc,WAAW,cAAc,iBACxC,qCAAqC,OAAO,GAC5C;AACA,WAAO;AAAA,MACL,MAAM;AAAA,MACN,YACE,eAAe,kCACX,iCACA,GAAG,UAAU;AAAA,IACrB;AAAA,EACF;AASA,MAAI,cAAc,YAAY,kCAAkC,OAAO,GAAG;AACxE,WAAO;AAAA,MACL,MAAM;AAAA,MACN,YACE,eAAe,kCACX,6BACA,GAAG,UAAU;AAAA,IACrB;AAAA,EACF;AAEA,SAAO,EAAE,MAAM,SAAS,WAAW;AACrC;AAEO,SAAS,+BAA+B,WAAmB,OAAyB;AACzF,SAAO,+BAA+B,WAAW,KAAK,EAAE,SAAS;AACnE;AAaO,SAAS,2CACd,WACA,OACS;AACT,MAAI,cAAc,gBAAgB,CAAC,MAAO,QAAO;AACjD,QAAM,UAAU,eAAe,KAAK;AACpC,MAAI,mBAAmB,OAAO,KAAK,QAAQ,WAAY,QAAO;AAC9D,MAAI,QAAQ,MAAM,SAAS,mBAAmB,EAAG,QAAO;AACxD,SAAO,cAAc,WAAW,+BAA+B,OAAO;AACxE;AAEO,SAAS,gCAAgC,WAAmB,OAAyB;AAC1F,SAAO,+BAA+B,WAAW,KAAK,EAAE,SAAS;AACnE;;;ACpRA,SAAS,qBAAAC,0BAAyB;AAClC,SAAS,cAAc,aAAa;AAapC,IAAM,SAAS;AACf,IAAM,eAAe,KAAK;AAO1B,eAAsB,4BACpB,SACA,MACA,SACA,SACA,uBAAuB,KACR;AACf,QAAMC,SAAQ,CAAC,UAAkB,IAAI,MAAM,WAAW,KAAK,OAAO,CAAC;AACnE,QAAM,UAAU,WAAWA,OAAM,IAAI,CAAC,iBAAiBA,OAAM,MAAM,CAAC;AACpE,QAAM,eAAe,IAAI,gBAAgB;AACzC,QAAM,iBAAiB,IAAI,MAAM,0DAA0D;AAC3F,MAAI;AACJ,MAAI;AACJ,MAAI,SAAS;AACb,MAAI,SAAS;AACb,QAAM,aAAa,CACjB,QACA,WAA0B,UACiB;AAAA,IAC3C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS,SAAS,QAAQ,MAAM,GAAG,YAAY;AAAA,IAC/C;AAAA,IACA,mBAAmB;AAAA,IACnB,GAAI,kBACA;AAAA,MACE,mBAAmB;AAAA,QACjB,WAAW,gBAAgB;AAAA,QAC3B,QAAQ,gBAAgB;AAAA,QACxB,QAAQ,gBAAgB;AAAA,MAC1B;AAAA,IACF,IACA,CAAC;AAAA,EACP;AACA,QAAM,QAAQ,WAAW,MAAM;AAC7B,iBAAa,MAAM,cAAc;AAAA,EACnC,GAAG,oBAAoB;AACvB,QAAM,MAAM;AACZ,UAAQ,IAAI,YAAY;AACxB,MAAI;AACF,QAAI;AACF,wBAAkB,MAAM,QAAQ;AAAA,QAC9B,EAAE,KAAK,SAAS,SAAS,OAAO,MAAM,OAAO,OAAO,KAAK,MAAM;AAAA,QAC/D,aAAa;AAAA,MACf;AAAA,IACF,SAAS,OAAO;AAGd,UAAI,EAAE,iBAAiB,yCAA0C,OAAM;AACvE,wBAAkB,gBAAgB,MAAM,OAAO;AAC/C,qBAAe;AAAA,IACjB;AACA,eAAS;AACP,mBAAa,OAAO,eAAe;AACnC,UAAI;AACJ,UAAI;AACF,eAAO,MAAM,QAAQ,UAAU,iBAAiB,KAAO,YAAY;AAAA,MACrE,SAAS,OAAO;AACd,qBAAa,OAAO,eAAe;AACnC,YACE,EAAE,iBAAiB,+CACnB,CAAC,MAAM,kBACP;AACA,cAAI,CAAC,aAAc,OAAM;AAGzB,gBAAM,IAAI;AAAA,YACR,gBAAgB,eAAe;AAAA,YAC/B,IAAI;AAAA,cACF,CAAC,cAAc,KAAK;AAAA,cACpB;AAAA,YACF;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAGA,YAAI,CAACC,mBAAkB,MAAM,SAAS,eAAe;AACnD,gBAAM,IAAI,wCAAwC,WAAW,kBAAkB,GAAG;AAAA,YAChF,OAAO;AAAA,UACT,CAAC;AAGH,YAAI;AACF,gBAAM,MAAM,KAAK,QAAW,EAAE,QAAQ,aAAa,OAAO,CAAC;AAAA,QAC7D,SAAS,aAAa;AACpB,uBAAa,OAAO,eAAe;AACnC,gBAAM;AAAA,QACR;AACA;AAAA,MACF;AAGA,mBAAa,OAAO,eAAe;AACnC,UACE,KAAK,QAAQ,cAAc,gBAAgB,aAC3C,KAAK,QAAQ,WAAW,gBAAgB,UACxC,KAAK,QAAQ,WAAW,gBAAgB,QACxC;AACA,cAAM,IAAI,wCAAwC,WAAW,kBAAkB,CAAC;AAAA,MAClF;AACA,wBAAkB,KAAK;AACvB,iBAAW,SAAS,KAAK,QAAQ;AAC/B,YAAI,MAAM,WAAW,SAAU,WAAU,MAAM;AAAA,YAC1C,WAAU,MAAM;AAAA,MACvB;AACA,UAAI,OAAO,SAAS,OAAO,SAAS,cAAc;AAChD,cAAM,IAAI,wCAAwC,WAAW,kBAAkB,CAAC;AAAA,MAClF;AACA,UAAI,KAAK,aAAa,MAAM;AAG1B,cAAM,IAAI,QAAc,CAACC,aAAY,aAAaA,QAAO,CAAC;AAC1D;AAAA,MACF;AACA,UAAI,KAAK,aAAa,KAAK,WAAW,OAAQ;AAC9C,YAAM,IAAI;AAAA,QACR;AAAA,UACE,KAAK,aAAa,IACd,qBACA,KAAK,aAAa,IAChB,qBACA;AAAA,UACN,KAAK;AAAA,QACP;AAAA,MACF;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,QAAI,aAAa,OAAO,WAAW,gBAAgB;AACjD,YAAM,IAAI;AAAA,QACR;AAAA,UACE,GAAG,WAAW,iBAAiB;AAAA,UAC/B,cAAc;AAAA,QAChB;AAAA,QACA;AAAA,UACE,OAAO,kBACH,IAAI;AAAA,YACF;AAAA,YACA,eACI,IAAI;AAAA,cACF,CAAC,cAAc,KAAK;AAAA,cACpB;AAAA,YACF,IACA;AAAA,UACN,IACA;AAAA,QACN;AAAA,MACF;AAAA,IACF;AACA,QAAI,EAAE,iBAAiB,0CAA0C;AAC/D,kDAA4C,OAAO;AAAA,QACjD,GAAG,WAAW,eAAe;AAAA,QAC7B,cAAc,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MACrE,CAAC;AAAA,IACH;AACA,UAAM;AAAA,EACR,UAAE;AACA,iBAAa,MAAM,IAAI,MAAM,iDAAiD,CAAC;AAC/E,iBAAa,KAAK;AAClB,YAAQ,OAAO,YAAY;AAAA,EAC7B;AACF;;;AF5JA,SAAS,cAAc,GAAyB,GAAkC;AAChF,SACE,EAAE,SAAS,EAAE,QACb,EAAE,cAAc,EAAE,aAClB,EAAE,WAAW,EAAE,UACf,EAAE,WAAW,EAAE,UACfC;AAAA,IACE,iBAAiB,IAAI,EAAE,cAAc;AAAA,IACrC,iBAAiB,IAAI,EAAE,cAAc;AAAA,EACvC,KACA,QAAQ,EAAE,GAAG,MAAM,QAAQ,EAAE,GAAG;AAEpC;AAKO,SAAS,2BACd,SAMA,SAOM;AACN,0BAAwB,OAAO;AAC/B,QAAM,eAAe,QAAQ,aAAa,KAAK,OAAO;AACtD,QAAM,gBAAgB,QAAQ,YAAY,KAAK,OAAO;AACtD,QAAM,oBAAoB,QAAQ,0BAA0B,KAAK,OAAO;AACxE,QAAM,gBAAgB,oBAAI,IAAqB;AAC/C,MAAI,QAAQ,qBAAqB;AAC/B,UAAM,SAAS,QAAQ,oBAAoB,KAAK,OAAO;AACvD,YAAQ,sBAAsB,OAAO,WAAwB;AAC3D,YAAM,eAAe,IAAI,gBAAgB;AACzC,YAAM,QAAQ,MAAM,aAAa,MAAM,OAAO,MAAM;AACpD,aAAO,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AACtD,UAAI,OAAO,QAAS,OAAM;AAC1B,oBAAc,IAAI,YAAY;AAC9B,UAAI;AACF,cAAM,OAAO,MAAM,OAAO,aAAa,MAAM;AAC7C,qBAAa,OAAO,eAAe;AACnC,eAAO;AAAA,MACT,UAAE;AACA,eAAO,oBAAoB,SAAS,KAAK;AACzC,sBAAc,OAAO,YAAY;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AACA,UAAQ,qCAAqC,YAAY;AACvD,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,MAAM,iEAAiE;AACnF,WAAO,MAAM,QAAQ,4BAA4B;AAAA,EACnD;AACA,UAAQ,yBAAyB,CAAC,MAAM,YACtC,4BAA4B,SAAS,MAAM,SAAS,aAAa;AACnE,QAAM,UAAU,oBAAI,IAAmB;AAIvC,QAAM,eAAe,oBAAI,IAAoB;AAC7C,MAAI,kBAAkB,8BAA8B;AACpD,QAAMC,YAAW,oBAAI,IAA6D;AAClF,QAAM,qBAAqB,oBAAI,QAA+B;AAE9D,QAAM,YAAY,OAAO,OAAc,UAAU,UAAyB;AACxE,QAAI,MAAM,QAAQ,SAAS,qBAAqB,CAAC,MAAM,QAAQ,YAAa;AAC5E,UAAM,cAAc,MAAM;AAC1B,QACE,CAAC,aAAa,4BACd,CAAC,YAAY,0BACb,CAAC,YAAY,yBACb,CAAC,QAAQ;AAET,YAAM,IAAI,MAAM,yDAAyD;AAC3E,QAAI,UAAU,MAAM,YAAY,uBAAuB;AACvD,QAAI,CAAC,SAAS;AACZ,YAAM,SAAU,MAAM,YAAY,sBAAsB,IACpD,WACA,UACE,YACA;AACN,YAAM,cAAc,MAAM,QAAQ,mBAAmB,MAAM,SAAS,MAAM;AAC1E,gBAAU,YAAY,WAAW;AACjC,UAAI,QAAS,OAAM,YAAY,yBAAyB,OAAO;AAAA,IACjE;AACA,QAAI,SAAS;AAIX,YAAM,QACH,mBAAmB,MAAM,SAAS,OAAO,QAAQ,SAAS,EAC1D,MAAM,MAAM,MAAS;AAAA,IAC1B;AAAA,EACF;AAEA,QAAM,oBAAoB,OAAO,OAAc,SAAkD;AAC/F,QACE,KAAK,QAAQ,SAAS,qBACtB,CAAC,KAAK,YACN,CAAC,MAAM,aAAa;AAEpB,YAAM,IAAI,MAAM,2DAA2D;AAC7E,UAAM,SAAS,MAAM,MAAM,YAAY,kBAAkB;AAAA,MACvD,UAAU,KAAK;AAAA,MACf,SAAS,KAAK;AAAA,MACd,QAAQ,KAAK,OACV,OAAO,CAAC,UAAU,MAAM,WAAW,QAAQ,EAC3C,IAAI,CAAC,UAAU,MAAM,IAAI,EACzB,KAAK,EAAE;AAAA,MACV,QAAQ,KAAK,OACV,OAAO,CAAC,UAAU,MAAM,WAAW,QAAQ,EAC3C,IAAI,CAAC,UAAU,MAAM,IAAI,EACzB,KAAK,EAAE;AAAA,IACZ,CAAC;AACD,QAAI,CAAC,cAAc,MAAM,SAAS,OAAO,OAAO;AAC9C,YAAM,IAAI,MAAM,iDAAiD;AACnE,UAAM,UAAU,OAAO;AACvB,QAAI,OAAO,SAAU,oBAAmB,IAAI,IAAI;AAChD,WAAO,OAAO;AAAA,EAChB;AAEA,QAAM,YAAY,CAAC,KAAa,QAAgB,cAA8B;AAC5E,UAAM,SAAS,wBAAwB,GAAG;AAC1C,QAAI,OAAO,SAAS,UAAU;AAC5B,mBAAa,OAAO,MAAM;AAC1B,aAAO;AAAA,IACT;AACA,QAAI,OAAO,SAAS,aAAa,OAAO,cAAc;AACpD,YAAM,IAAI,wCAAwC,MAAM;AAG1D,UAAM,UAAU,IAAI;AAAA,MAClB;AAAA,MACA,mCAAmC,MAAM;AAAA,IAC3C;AACA,wCAAoC,SAAS,KAAK,SAAS,MAAM;AACjE,WAAO;AAAA,EACT;AAEA,QAAM,aAAa,CACjB,QACA,MACA,oBACW;AACX,UAAM,SAAS;AAAA,MACb,4BAA4B,WAAW,CAAC;AAAA,MACxC,KAAK,aAAa,OACd,mCAAmC,MAAM,KACzC,4BAA4B,KAAK,QAAQ;AAAA,MAC7C;AAAA,MACA,eAAe,KAAK,OAAO,IAAI,CAAC,UAAU,MAAM,IAAI,EAAE,KAAK,EAAE,GAAG,eAAe,EAAE;AAAA,IACnF,EAAE,KAAK,IAAI;AACX,QAAI,KAAK,aAAa,QAAQ,QAAQ,IAAI,MAAM,GAAG,aAAa;AAC9D,MAAAA,UAAS,IAAI,QAAQ,EAAE,QAAQ,KAAK,CAAC;AAAA,IACvC,OAAO;AACL,4CAAsC,SAAS,QAAQ,IAAI;AAC3D,cAAQ,OAAO,MAAM;AAAA,IACvB;AACA,WAAO;AAAA,EACT;AACA,QAAM,OAAO,OACX,QACA,OACA,aACA,iBACA,WACoB;AACpB,QAAI,MAAM,aAAa;AACrB,YAAM,WAAW,MAAM,MAAM,YAAY,KAAK;AAC9C,UAAI,CAAC,YAAY,CAAC,cAAc,MAAM,SAAS,QAAQ;AACrD,cAAM,IAAI,MAAM,gDAAgD;AAClE,YAAM,UAAU;AAGhB,YAAM,UAAU,KAAK,EAAE,MAAM,MAAM,MAAS;AAAA,IAC9C;AACA,QAAI,OAAO,MAAM,QAAQ,KAAK,MAAM,SAAS,aAAa,MAAM;AAChE,QAAI,MAAM,eAAe,KAAK,QAAQ,SAAS,mBAAmB;AAGhE,UAAI,WAAW;AACf,eAAS,UAAU,GAAG,UAAU,GAAG,WAAW;AAC5C,YAAI,MAAM,kBAAkB,OAAO,IAAI,GAAG;AACxC,qBAAW;AACX;AAAA,QACF;AACA,YAAI,UAAU,EAAG,QAAO,MAAM,QAAQ,KAAK,MAAM,SAAS,aAAa,MAAM;AAAA,MAC/E;AACA,UAAI,CAAC,SAAU,OAAM,IAAI,MAAM,4DAA4D;AAAA,IAC7F;AACA,QAAI,KAAK,QAAQ,SAAS,qBAAqB,KAAK,QAAQ,aAAa;AACvE,YAAM,UAAU,MAAM,MAAM,aAAa,yBAAyB;AAGlE,aAAO,EAAE,GAAG,MAAM,UAAU,WAAW,KAAK,aAAa,IAAI,QAAQ,iBAAiB,KAAK;AAAA,IAC7F;AAGA,WAAO,WAAW,QAAQ,MAAM,eAAe;AAAA,EACjD;AAEA,UAAQ,cAAc,OAAO,SAAS;AACpC,UAAM,SAAS,8BAA8B;AAG7C,QAAI,WAAW,QAAW;AACxB,UAAI,CAAC,aAAc,OAAM,IAAI,MAAM,2CAA2C;AAC9E,UAAI,CAAC,OAAO,cAAc,eAAe,EAAG,OAAM,IAAI,MAAM,+BAA+B;AAC3F,YAAM,cAAc;AACpB,YAAM,MAAM,MAAM,aAAa,IAAI;AACnC,YAAM,SAAS,wBAAwB,GAAG;AAC1C,UAAI,OAAO,SAAS,UAAW,QAAO;AACtC,mBAAa,IAAI,aAAa,OAAO,SAAS;AAC9C,aAAO,UAAU,KAAK,aAAa,OAAO,SAAS;AAAA,IACrD;AACA,QAAI,QAAQ,IAAI,MAAM,EAAG,OAAM,IAAI,MAAM,uCAAuC;AAChF,UAAM,eAAe,IAAI,gBAAgB;AACzC,kBAAc,IAAI,YAAY;AAC9B,QAAI;AACF,YAAM,UAAU,MAAM,QAAQ,MAAM,MAAM,aAAa,MAAM;AAE7D,YAAM,QAAQ,QAAQ,IAAI,MAAM,KAAK,EAAE,QAAQ;AAC/C,UAAI,CAAC,cAAc,MAAM,SAAS,OAAO;AACvC,cAAM,IAAI,MAAM,gDAAgD;AAClE,cAAQ,IAAI,QAAQ,KAAK;AACzB,UAAI,MAAM,QAAQ,SAAS,qBAAqB,MAAM,QAAQ,aAAa;AAGzE,eAAO,WAAW,QAAQ,EAAE,SAAS,MAAM,SAAS,QAAQ,CAAC,GAAG,UAAU,KAAK,CAAC;AAAA,MAClF;AACA,UAAI;AACF,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA,KAAK,eAAe;AAAA,UACpB,KAAK;AAAA,UACL,aAAa;AAAA,QACf;AAAA,MACF,QAAQ;AAGN,eAAO,WAAW,QAAQ;AAAA,UACxB,SAAS,MAAM;AAAA,UACf,QAAQ,CAAC;AAAA,UACT,UAAU;AAAA,QACZ,CAAC;AAAA,MACH;AAAA,IACF,SAAS,OAAO;AACd,UAAI,iBAAiB,yCAAyC;AAC5D,cAAM,QAAQ,QAAQ,IAAI,MAAM;AAChC,YAAI,SAAS,CAAC,cAAc,MAAM,SAAS,MAAM,OAAO;AACtD,gBAAM,IAAI,MAAM,yDAAyD;AAAA,YACvE,OAAO;AAAA,UACT,CAAC;AACH,gBAAQ,IAAI,QAAQ,SAAS,EAAE,SAAS,MAAM,QAAQ,CAAC;AAAA,MACzD;AACA,YAAM;AAAA,IACR,UAAE;AACA,oBAAc,OAAO,YAAY;AAAA,IACnC;AAAA,EACF;AAEA,UAAQ,2BAA2B,YAAY;AAC7C,eAAW,SAAS;AAClB,YAAM;AAAA,QACJ,IAAI,MAAM,wEAAwE;AAAA,MACpF;AAGF,UAAM,oBAAoB;AAAA,EAC5B;AAEA,UAAQ,qBAAqB,CAAC,WAAW;AACvC,UAAM,QAAQ,QAAQ,IAAI,MAAM;AAChC,WAAO,QAAQ,gBAAgB,MAAM,OAAO,IAAI;AAAA,EAClD;AACA,UAAQ,2BAA2B,OAAO,WAAW;AACnD,UAAM,QAAQ,QAAQ,IAAI,MAAM;AAChC,QAAI,CAAC,SAAS,MAAM,QAAQ,SAAS,qBAAqB,CAAC,MAAM,QAAQ,YAAa;AACtF,UAAM,WAAW,MAAM,MAAM,aAAa,KAAK;AAC/C,QAAI,CAAC,YAAY,CAAC,cAAc,MAAM,SAAS,QAAQ;AACrD,YAAM,IAAI,MAAM,yDAAyD;AAC3E,UAAM,UAAU;AAChB,UAAM,UAAU,OAAO,IAAI;AAAA,EAC7B;AACA,UAAQ,0BAA0B,OAAO,QAAQ,WAAW;AAC1D,UAAM,QAAQ,QAAQ,IAAI,MAAM;AAChC,QAAI,CAAC,SAAS,MAAM,QAAQ,SAAS,qBAAqB,CAAC,MAAM,QAAQ;AACvE,aAAO;AACT,QAAI,CAAC,MAAM,aAAa;AACtB,YAAM,IAAI,MAAM,iDAAiD;AACnE,UAAM,MAAM,YAAY,oBAAoB,MAAM;AAClD,UAAM,UAAU,KAAK;AACrB,WAAO;AAAA,EACT;AACA,UAAQ,sBAAsB,CAAC,QAAQ,SAAS,gBAAgB;AAC9D,QAAI,CAAC,OAAO,cAAc,MAAM,KAAK,UAAU,KAAK,SAAS;AAC3D,YAAM,IAAI,MAAM,uCAAuC;AACzD,UAAM,WAAW,QAAQ,IAAI,MAAM;AACnC,QAAI,YAAY,CAAC,cAAc,SAAS,SAAS,OAAO;AACtD,YAAM,IAAI,MAAM,6DAA6D;AAC/E,YAAQ,IAAI,QAAQ,EAAE,SAAS,gBAAgB,OAAO,GAAG,YAAY,CAAC;AAAA,EACxE;AACA,UAAQ,2BAA2B,CAAC,WAClC,OAAO,WAAW,WACbA,UAAS,IAAI,MAAM,GAAG,QAAQ,gCAAgC,SAAS,MAAM,IAC9E;AACN,UAAQ,uBAAuB,OAAO,WAAW;AAC/C,UAAM,UAAUA,UAAS,IAAI,MAAM;AACnC,QAAI,CAAC,WAAW,QAAQ,KAAK,QAAQ,SAAS,kBAAmB,QAAO;AACxE,QACE,CAAC,QAAQ,KAAK,YACd,QAAQ,KAAK,aAAa,QAC1B,QAAQ,KAAK,OAAO,WAAW,GAC/B;AAIA,MAAAA,UAAS,OAAO,MAAM;AACtB,aAAO;AAAA,IACT;AACA,QAAI,mBAAmB,IAAI,QAAQ,IAAI,GAAG;AACxC,MAAAA,UAAS,OAAO,MAAM;AACtB,aAAO;AAAA,IACT;AACA,UAAM,QAAQ,QAAQ,IAAI,QAAQ,MAAM;AACxC,QAAI,CAAC,OAAO,aAAa,qBAAqB,CAAC,QAAQ,KAAK;AAC1D,YAAM,IAAI,MAAM,2DAA2D;AAC7E,QAAI,CAAE,MAAM,kBAAkB,OAAO,QAAQ,IAAI,GAAI;AACnD,YAAM,SAAS,QAAQ,KAAK;AAC5B,YAAM,UAAU,MACd,MAAM,QAAQ,SAAS,qBACtB,CAAC,UAAU,QAAQ,EAAY,MAAM,CAAC,WAAW;AAChD,cAAM,UAAU,MAAM,QAAQ,QAAQ,MAAM;AAE5C,YAAI,EAAE,gBAAgB,SAAU,QAAO;AACvC,cAAM,SAAS,OAAO,QAAQ,MAAM;AACpC,eACE,QAAQ,cAAc,OAAO,eAC5B,CAAC,OAAO,OAAO,QAAQ,SACvB,OAAO,aAAa,QAAQ,QAAQ,aAAa,OAAO;AAAA,MAE7D,CAAC;AACH,eAAS,UAAU,GAAG,CAAC,QAAQ,KAAK,UAAU,GAAG,WAAW;AAI1D,cAAM,mBAAmB,MAAM,KAAK,QAAQ,QAAQ,OAAO,GAAG;AAC9D,cAAM,YAAYA,UAAS,IAAI,gBAAgB;AAC/C,YAAI,aAAa,mBAAmB,IAAI,UAAU,IAAI,EAAG,CAAAA,UAAS,OAAO,gBAAgB;AAAA,MAC3F;AACA,UAAI,CAAC,QAAQ;AACX,cAAM,IAAI,MAAM,qEAAqE;AAAA,IACzF;AACA,IAAAA,UAAS,OAAO,MAAM;AACtB,WAAO;AAAA,EACT;AACA,UAAQ,2BAA2B,OAAO,WAAW;AACnD,UAAM,UAAUA,UAAS,IAAI,MAAM;AACnC,QAAI,CAAC,QAAS;AACd,UAAM,QAAQ,QAAQ,IAAI,QAAQ,MAAM;AACxC,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,MAAM,8DAA8D;AAChF,UAAM,QAAQ,MAAM,MAAM,YAAY,YAAY,QAAQ,KAAK,OAAO;AACtE,QAAI,CAAC,cAAc,MAAM,SAAS,KAAK;AACrC,YAAM,IAAI,MAAM,wDAAwD;AAC1E,UAAM,UAAU;AAChB,IAAAA,UAAS,OAAO,MAAM;AAAA,EACxB;AACA,UAAQ,aAAa,OAAO,SAAS;AACnC,UAAM,YAAY,aAAa,IAAI,KAAK,SAAS;AACjD,QAAI,cAAc,UAAa,eAAe;AAC5C,YAAM,MAAM,MAAM,cAAc,EAAE,GAAG,MAAM,WAAW,UAAU,CAAC;AACjE,aAAO,UAAU,KAAK,KAAK,WAAW,SAAS;AAAA,IACjD;AACA,UAAM,QAAQ,QAAQ,IAAI,KAAK,SAAS;AACxC,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,wCAAwC,KAAK,WAAW;AAAA,QAChE,QAAQ;AAAA,MACV,CAAC;AACH,QAAI,KAAK,OAAO;AACd,YAAM,WAAW,MAAM,MAAM,YAAY,KAAK;AAC9C,UAAI,CAAC,YAAY,CAAC,cAAc,MAAM,SAAS,QAAQ;AACrD,cAAM,IAAI,MAAM,gDAAgD;AAClE,YAAM,QAAQ,MAAM,MAAM,YAAY,aAAa,OAAO,WAAW,KAAK,KAAK,CAAC;AAChF,UAAI;AACF,cAAM,QAAQ,MAAM,UAAU,KAAK,OAAO,KAAK;AAAA,MACjD,SAAS,OAAO;AAGd,YACE,SAAS,SAAS;AAAA;AAAA;AAAA,QAIlB,+BAA+B,SAAS,KAAK,EAAE,SAAS;AAExD,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,YACA,OAAO,WAAW,KAAK,KAAK;AAAA,YAC5B;AAAA,UACF;AACF,cAAM;AAAA,MACR;AAAA,IACF;AACA,WAAO,KAAK,KAAK,WAAW,OAAO,KAAK,eAAe,KAAK,KAAK,iBAAiB,KAAK,MAAM;AAAA,EAC/F;AACF;;;AG5bA,SAAS,cAAAC,aAAY,mBAAmB;AACxC,SAAS,SAAAC,cAAa;AACtB,SAAS,UAAAC,eAAc;AACvB,SAAS,cAAcC,cAAa;AAEpC;AAAA,EACE;AAAA,EACA;AAAA,EACA,8BAAAC;AAAA,OACK;;;ACPA,SAAS,wCAAwC,OAAyB;AAC/E,QAAM,OAAO,oBAAI,IAAqB;AACtC,MAAI,QAAQ;AACZ,QAAM,MAAM,CAAC,OAAe,QAAyB;AACnD,UAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,QAAI,cAAc,EAAE,WAAW,YAAa,OAAM,IAAI,MAAM,iCAAiC;AAC7F,WAAO,cAAc,WAAW,aAAa,WAAW,QAAQ;AAAA,EAClE;AACA,QAAM,QAAQ,CAAC,OAAgB,UAA2B;AACxD,QAAI,CAAC,SAAS,OAAO,UAAU,YAAY,QAAQ,KAAK,EAAE,QAAQ,GAAI,QAAO;AAC7E,QAAI,KAAK,IAAI,KAAK,EAAG,QAAO,KAAK,IAAI,KAAK;AAE1C,SAAK,IAAI,OAAO,KAAK;AACrB,QAAI;AACF,YAAM,OAAO,IAAI,OAAO,MAAM;AAC9B,YAAM,SAAoB,CAAC,IAAI,OAAO,OAAO,GAAG,IAAI,OAAO,OAAO,CAAC,EAAE;AAAA,QACnE,CAAC,SAAS,SAAS;AAAA,MACrB;AACA,YAAM,SAAS,IAAI,OAAO,QAAQ;AAClC,UAAI,WAAW,QAAW;AACxB,YAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,CAAC,OAAO,UAAU,OAAO,SAAS,GAAI,QAAO;AAC3E,iBAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,QAAS,QAAO,KAAK,IAAI,QAAQ,OAAO,KAAK,CAAC,CAAC;AAAA,MAC5F;AACA,UAAI,SAAS,QAAW;AACtB,cAAM,aAAa,OAAO,SAAS,WAAW,KAAK,KAAK,EAAE,YAAY,IAAI;AAC1E,YACE,CAAC;AAAA,UACC;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF,EAAE,SAAS,UAAmB;AAE9B,iBAAO;AACT,cAAMC,UAAS,OAAO,WAAW,KAAK,OAAO,MAAM,CAAC,SAAS,MAAM,MAAM,QAAQ,CAAC,CAAC;AACnF,aAAK,IAAI,OAAOA,OAAM;AACtB,eAAOA;AAAA,MACT;AACA,YAAM,SAAS,OAAO,SAAS,KAAK,OAAO,MAAM,CAAC,SAAS,MAAM,MAAM,QAAQ,CAAC,CAAC;AACjF,WAAK,IAAI,OAAO,MAAM;AACtB,aAAO;AAAA,IACT,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO,MAAM,OAAO,CAAC;AACvB;;;ADjBA,IAAM,kBAAkB;AAcxB,SAAS,kBAAqB,SAAqB,QAAkC;AACnF,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,eAAe;AACtB,SAAO,IAAI,QAAW,CAACC,UAAS,WAAW;AACzC,UAAM,QAAQ,MAAM;AAClB,aAAO,oBAAoB,SAAS,KAAK;AACzC,aAAO,OAAO,MAAM;AAAA,IACtB;AACA,WAAO,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AACtD,SAAK,QAAQ,KAAKA,UAAS,MAAM,EAAE,QAAQ,MAAM,OAAO,oBAAoB,SAAS,KAAK,CAAC;AAAA,EAC7F,CAAC;AACH;AAIO,IAAMC,uBAAN,MAAM,qBAAoB;AAAA,EAQvB,YACN,QACiB,iBACA,MACA,aACjB;AAHiB;AACA;AACA;AAEjB,SAAK,SAAS,oBAAoB,MAAM;AACxC,SAAK,SAAS,oBAAc,WAAW,QAAQ,iBAAiB,MAAM,WAAW;AAAA,EACnF;AAAA,EAfiB,UAAU,oBAAI,IAAkC;AAAA,EAChD,gBAAgB,oBAAI,IAAwC;AAAA,EAC5D,iBAAiB,oBAAI,IAA2B;AAAA,EAChD;AAAA,EACA;AAAA,EACT,SAAS;AAAA,EAYjB,OAAO,WACL,QACA,WACA,MACA,cAAuE,CAAC,GACnD;AACrB,QAAI,OAAO,QAAQ,MAAM;AACvB,YAAM,IAAI,MAAM,gEAAgE;AAClF,WAAO,IAAI,qBAAoB,QAAQ,WAAW,MAAM,WAAW;AAAA,EACrE;AAAA,EAEA,IAAY,YAAoB;AAC9B,WAAO,OAAO,KAAK,oBAAoB,aACnC,KAAK,gBAAgB,IACrB,KAAK;AAAA,EACX;AAAA,EAEA,MAAc,WACZ,QACA,QACAC,MACY;AACZ,YAAQ,eAAe;AACvB,QAAI,KAAK,OAAQ,OAAM,IAAI,MAAM,iCAAiC;AAClE,QAAI,UAAU,KAAK,QAAQ,IAAI,MAAM;AACrC,UAAM,SAAS,QAAQ,OAAO;AAC9B,QAAI,CAAC,SAAS;AACZ,YAAMC,UAAuB;AAAA,QAC3B,YAAY,IAAI,gBAAgB;AAAA,QAChC,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AACA,iBAAW,YAAY;AACrB,cAAM,SAAS,MAAM;AAAA,UACnB,KAAK,OAAO,2BAA2B,EAAE,OAAO,GAAG,EAAE,QAAQA,QAAO,WAAW,OAAO,CAAC;AAAA,UACvFA,QAAO,WAAW;AAAA,QACpB;AACA,YAAI,YAAY,KAAK,IAAI,IAAI;AAC7B,YAAI;AAEF,gBAAM,UAAU,KAAK;AAAA,YACnB,OAAO,KAAK,OAAO,IAAI,MAAM,GAAG,EAAE,CAAC,KAAK,IAAI,WAAW,EAAE,SAAS;AAAA,UACpE;AACA,cAAI,OAAO,QAAQ,QAAQ,YAAY,OAAO,SAAS,QAAQ,GAAG;AAChE,wBAAY,KAAK,IAAI,WAAW,QAAQ,MAAM,MAAO,IAAM;AAAA,QAC/D,QAAQ;AAAA,QAER;AACA,eAAO,EAAE,QAAQ,IAAI,uBAAuB,MAAM,GAAG,OAAO,GAAG,UAAU;AAAA,MAC3E,GAAG;AACH,WAAK,QAAQ,IAAI,QAAQ,OAAO;AAChC,WAAK,cAAc,IAAI,SAASA,OAAM;AACtC,YAAM,UAAU,MAAM;AACpB,QAAAA,QAAO,UAAU;AACjB,aAAK,cAAc,OAAO,OAAQ;AAAA,MACpC;AACA,WAAK,QAAQ,KAAK,SAAS,MAAM;AAC/B,gBAAQ;AACR,YAAI,KAAK,QAAQ,IAAI,MAAM,MAAM,QAAS,MAAK,QAAQ,OAAO,MAAM;AAAA,MACtE,CAAC;AAAA,IACH;AACA,UAAM,SAAS,KAAK,cAAc,IAAI,OAAO;AAC7C,QAAI,OAAQ,QAAO;AACnB,QAAI;AACJ,QAAI;AACF,cAAQ,MAAM,kBAAkB,SAAS,MAAM;AAAA,IACjD,UAAE;AACA,UAAI,UAAU,EAAE,OAAO,YAAY,KAAK,CAAC,OAAO,SAAS;AAGvD,YAAI,KAAK,QAAQ,IAAI,MAAM,MAAM,QAAS,MAAK,QAAQ,OAAO,MAAM;AACpE,eAAO,WAAW,MAAM,IAAI,MAAM,8CAA8C,CAAC;AAAA,MACnF;AAAA,IACF;AAEA,QAAI,UAAU,CAAC,MAAM,SAAS,KAAK,IAAI,IAAI,MAAM,WAAW;AAI1D,UAAI,KAAK,QAAQ,IAAI,MAAM,MAAM,SAAS;AACxC,aAAK,QAAQ,OAAO,MAAM;AAC1B,qBAAa,MAAM,IAAI;AACvB,cAAM,OAAO,MAAM;AAAA,MACrB;AACA,aAAO,MAAM,KAAK,WAAW,QAAQ,QAAQD,IAAG;AAAA,IAClD;AACA,iBAAa,MAAM,IAAI;AACvB,UAAM;AACN,QAAI;AACF,cAAQ,eAAe;AACvB,aAAO,MAAMA,KAAI,MAAM,MAAM;AAAA,IAC/B,UAAE;AACA,YAAM;AACN,UAAI,CAAC,MAAM,OAAO;AAChB,cAAM,OAAO,WAAW,MAAM;AAC5B,cAAI,KAAK,QAAQ,IAAI,MAAM,MAAM,WAAW,CAAC,MAAM,OAAO;AACxD,iBAAK,QAAQ,OAAO,MAAM;AAC1B,kBAAM,OAAO,MAAM;AAAA,UACrB;AAAA,QACF,GAAG,GAAM;AACT,cAAM,KAAK,QAAQ;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,QAAuB;AAC3B,SAAK,SAAS;AACd,eAAW,UAAU,KAAK,cAAc,OAAO;AAC7C,aAAO,WAAW,MAAM,IAAI,MAAM,iCAAiC,CAAC;AACtE,UAAM,UAAU,MAAM,QAAQ,WAAW,KAAK,QAAQ,OAAO,CAAC;AAC9D,SAAK,QAAQ,MAAM;AACnB,eAAW,SAAS;AAClB,UAAI,MAAM,WAAW,aAAa;AAChC,qBAAa,MAAM,MAAM,IAAI;AAC7B,cAAM,MAAM,OAAO,MAAM;AAAA,MAC3B;AAAA,EACJ;AAAA;AAAA;AAAA,EAIA,MAAc,gBACZ,QACA,QACAA,MACY;AACZ,QAAI,UAAU;AACd,QAAI;AACF,aAAO,MAAM,KAAK,WAAW,QAAQ,QAAQ,OAAO,WAAW;AAC7D,kBAAU;AACV,eAAO,MAAMA,KAAI,MAAM;AAAA,MACzB,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,QAAS,OAAM;AACnB,aAAO,MAAM,6CAA6C,eAAe,YAAY;AACnF,cAAM;AAAA,MACR,GAAG,MAAM;AAAA,IACX;AAAA,EACF;AAAA,EAEA,MAAM,MAAM,MAAwB,QAA2D;AAC7F,YAAQ,eAAe;AACvB,UAAM,aAAa,gCAAgC,KAAK,CAAC,KAAK,OAAO,CAAC,KAAK;AAC3E,QAAI,WAAY,8BAA6B;AAC7C,UAAM,YAAY,KAAK;AACvB,UAAM,UAAUE,OAAM,QAAQ,KAAK,MAAM,KAAK,WAAW,KAAK,IAAI;AAClE,QAAI,YAAY,KAAK,QAAQ,CAAC,QAAQ,WAAW,GAAG,KAAK,KAAK,QAAQ,QAAQ,EAAE,CAAC,GAAG;AAClF,YAAM,IAAI,MAAM,kDAAkD;AACpE,UAAM,OAAO,MAAM,6CAA6C;AAAA,MAC9D,MAAM,KAAK,OAAO,iBAAiB,EAAE,UAAU,GAAG,SAAS,EAAE,OAAO,IAAI,MAAS;AAAA,MACjF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,UAAU,KAAK,WAAY,OAAM,IAAI,MAAM,mCAAmC;AACxF,UAAM,SAAS,KAAK;AACpB,QAAI,KAAK,cAAc;AACrB,YAAM,IAAI,MAAM,kDAAkD;AACpE,UAAM,SAASC,YAAW;AAG1B,UAAM,eAAeA,YAAW;AAChC,UAAM,cAAc,aAChB;AAAA,MACE,UAAU;AAAA,MACV;AAAA,MACA,OAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AAAA,MACrC,aAAa,6BAA6B,YAAY;AAAA,IACxD,IACA;AACJ,QAAI,cAAc,iBAAiB,IAAI;AACvC,UAAM,MAAM,OAAO,KAAK,gBAAgB,aAAa,KAAK,YAAY,IAAI,KAAK;AAC/E,QAAI;AACF,oBAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY;AAAA,QACZ;AAAA,QACA,YAAY;AAAA,QACZ;AAAA,QACA,YAAY;AAAA,QACZ;AAAA,QACA,GAAG;AAAA,MACL;AACF,UAAM,UAAsC;AAAA,MAC1C,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAI,KAAK,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC;AAAA,MAChC,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;AAAA,MACrC,SAAS;AAAA,QACP,QAAQ,EAAE,YAAY,GAAG,eAAe,IAAI,KAAK,OAAO,UAAU,KAAK;AAAA,QACvE,QAAQ,EAAE,YAAY,GAAG,eAAe,IAAI,KAAK,OAAO,UAAU,KAAK;AAAA,MACzE;AAAA,IACF;AACA,QAAI,YAAa,OAAM,wBAAwB,OAAO;AACtD,QAAI,iBAAiB;AACrB,QAAI;AACF,YAAM,KAAK,gBAAgB,QAAQ,QAAQ,OAAO,WAAW;AAC3D,yBAAiB;AACjB,cAAM,OAAO;AAAA,UACX;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA,GAAI,KAAK,MACL;AAAA,cACE,SAAS;AAAA,gBACP,SAAS;AAAA,gBACT,WAAW;AAAA,gBACX,WAAW;AAAA,gBACX,SAAS;AAAA,gBACT,SAAS;AAAA,gBACT,wBAAwB;AAAA,cAC1B;AAAA,YACF,IACA,CAAC;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AAId,UACE,CAAC,kBACD,iBAAiB,uCACjB,iBAAiB,kCACjB,iBAAiB;AAEjB,cAAM;AACR,YAAM,IAAI,wCAAwC,SAAS,KAAK;AAAA,IAClE;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,8BAA8E;AAClF,UAAM,YAAY,KAAK;AACvB,UAAM,SAAS,YAAY,QAAQ,GAAK;AACxC,UAAM,OAAO,MAAM,6CAA6C;AAAA,MAC9D,MAAM,KAAK,OAAO,iBAAiB,EAAE,UAAU,GAAG,EAAE,OAAO,CAAC;AAAA,MAC5D;AAAA,IACF;AACA,QAAI,CAAC,KAAK,UAAU,KAAK,WAAY,OAAM,IAAI,MAAM,mCAAmC;AACxF,UAAM,KAAK,gBAAgB,KAAK,QAAQ,QAAQ,OAAO,WAAW;AAChE,YAAM,WAAW,EAAE,QAAQ,KAAK,QAAS,QAAQA,YAAW,EAAE;AAC9D,YAAM,cAAkC;AAAA,QACtC,SAAS;AAAA,UACP,MAAM;AAAA,UACN;AAAA,UACA,GAAG;AAAA,UACH,SAAS;AAAA,YACP,QAAQ,EAAE,YAAY,GAAG,eAAe,IAAI,KAAK,OAAO,UAAU,KAAK;AAAA,YACvE,QAAQ,EAAE,YAAY,GAAG,eAAe,IAAI,KAAK,OAAO,UAAU,KAAK;AAAA,UACzE;AAAA,QACF;AAAA,QACA,QAAQ;AAAA,MACV;AACA,UAAI;AACJ,UAAI;AACF,cAAM,OAAO;AAAA,UACX;AAAA,YACE,GAAG;AAAA,YACH,aAAa,CAAC,8CAA8C,cAAc;AAAA,YAC1E,SAAS;AAAA,YACT,KAAK,CAAC;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF,SAAS,OAAO;AAId,YAAI,EAAE,iBAAiB,sCAAuC,OAAM;AACpE,YAAI,MAAM,WAAW,SAAS,UAAU,MAAM,WAAW,SAAS,OAAQ,OAAM;AAChF,uBAAe;AAAA,MACjB;AACA,UAAI;AACJ,UAAI;AACF,iBAAS,MAAM,KAAK,kBAAkB,UAAU,KAAK,QAAQ,WAAW;AAAA,MAC1E,SAAS,OAAO;AACd,YAAI,CAAC,aAAc,OAAM;AAGzB,cAAM,IAAI;AAAA,UACR,gBAAgB,YAAY,OAAO;AAAA,UACnC,IAAI;AAAA,YACF,CAAC,cAAc,KAAK;AAAA,YACpB;AAAA,UACF;AAAA,UACA,iBAAiB,8CAA8C,MAAM;AAAA,QACvE;AAAA,MACF;AACA,aAAO,eAAe;AACtB,YAAM,EAAE,QAAQ,KAAK,IAAI;AACzB,UAAI,SAAS,KAAK,WAAW;AAC3B,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,IACJ,CAAC;AACD,QAAI,cAAc,KAAK;AACrB,YAAM,IAAI,MAAM,mEAAmE;AACrF,WAAO,EAAE,WAAW,QAAQ,KAAK,OAAO;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAAsC;AAC9D,WAAO,eAAe;AACtB,UAAM,YAAY,KAAK;AACvB,UAAM,OAAO,MAAM,6CAA6C;AAAA,MAC9D,MAAM,KAAK,OAAO,iBAAiB,EAAE,UAAU,GAAG,EAAE,OAAO,CAAC;AAAA,MAC5D;AAAA,IACF;AACA,QAAI,CAAC,KAAK,UAAU,KAAK,WAAY,OAAM,IAAI,MAAM,mCAAmC;AACxF,QAAI,cAAc,KAAK;AACrB,YAAM,IAAI,MAAM,oDAAoD;AACtE,UAAM,WAAW,EAAE,QAAQ,KAAK,QAAQ,QAAQA,YAAW,EAAE;AAC7D,UAAM,uBAAuB,CAAC,UAC5B,CAACC,QAAO,aAAaA,QAAO,iBAAiB,EAAE;AAAA,MAC5C,OAAoC,QAAQ;AAAA,IAC/C;AACF,UAAM,QAAQ,MAAMC,OAAM,KAAK,QAAW,EAAE,OAAO,CAAC;AACpD,WAAO,MAAM,KAAK,gBAAgB,KAAK,QAAQ,QAAQ,OAAO,WAAW;AACvE,iBAAS;AACP,eAAO,eAAe;AACtB,YAAI;AACF,gBAAM,OAAO;AAAA,YACX,EAAE,GAAG,UAAU,aAAa,CAAC,WAAW,GAAG,SAAS,QAAQ,KAAK,CAAC,EAAE;AAAA,YACpE;AAAA,UACF;AACA;AAAA,QACF,SAAS,OAAO;AACd,iBAAO,eAAe;AACtB,cAAI,iBAAiB,8CAA8C;AACjE,kBAAM,MAAM;AACZ;AAAA,UACF;AAIA,cACE,iBAAiB,kCACjB,iBAAiB;AAEjB,kBAAM;AACR;AAAA,QACF;AAAA,MACF;AACA,YAAM,UAAU;AAAA,QACd,QAAQ,EAAE,QAAQ,GAAG,KAAK,MAAM;AAAA,QAChC,QAAQ,EAAE,QAAQ,GAAG,KAAK,MAAM;AAAA,MAClC;AACA,iBAAS;AACP,eAAO,eAAe;AACtB,YAAI;AACF,qBAAW,UAAU,CAAC,UAAU,QAAQ,GAAY;AAClD,kBAAM,SAAS,QAAQ,MAAM;AAC7B,gBAAI,OAAO,IAAK;AAChB,kBAAM,OAAO,MAAM,OAAO,KAAK,UAAU,QAAQ,OAAO,QAAQ,KAAO,MAAM;AAC7E,mBAAO,UAAU,KAAK,MAAM;AAC5B,mBAAO,MAAM,KAAK;AAAA,UACpB;AACA,gBAAM,OAAO,MAAM,OAAO,KAAK,UAAU,MAAM;AAC/C,iBAAO,eAAe;AACtB,cAAI,SAAS,QAAQ,QAAQ,OAAO,OAAO,QAAQ,OAAO,IAAK,QAAO;AAAA,QACxE,SAAS,OAAO;AACd,iBAAO,eAAe;AACtB,cAAI,CAAC,qBAAqB,KAAK,EAAG,OAAM;AAAA,QAC1C;AACA,cAAM,MAAM;AAAA,MACd;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA,EAIA,MAAM,mBACJ,SACA,QACA,WACmC;AACnC,2BAAuB,MAAM,OAAO;AACpC,UAAM,aAAa,QAAQ;AAC3B,QAAI,CAAC,cAAc,QAAQ,cAAc,KAAK;AAC5C,YAAM,IAAI,MAAM,4CAA4C;AAC9D,UAAM,MAAM,KAAK,UAAU;AAAA,MACzB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,WAAW;AAAA,MACX,WAAW;AAAA,MACX;AAAA,MACA,aAAa;AAAA,IACf,CAAC;AACD,QAAI,SAAS,KAAK,eAAe,IAAI,GAAG;AACxC,QAAI,CAAC,QAAQ;AACX,eAAS;AAAA,QACP,cAAc;AAAA,QACd,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,MAAM;AAAA,UACN,WAAW,QAAQ;AAAA,UACnB,QAAQ,QAAQ;AAAA,UAChB,QAAQF,YAAW;AAAA,UACnB,SAAS;AAAA,YACP,QAAQ,EAAE,YAAY,GAAG,eAAe,IAAI,KAAK,OAAO,UAAU,KAAK;AAAA,YACvE,QAAQ,EAAE,YAAY,GAAG,eAAe,IAAI,KAAK,OAAO,UAAU,KAAK;AAAA,UACzE;AAAA,QACF;AAAA,MACF;AACA,WAAK,eAAe,IAAI,KAAK,MAAM;AAAA,IACrC;AACA,UAAM,cAAc;AACpB,UAAMH,OAAM,YAA+C;AACzD,YAAM,SAAS,YAAY,QAAQ,GAAK;AACxC,UAAI,YAAY,cAAc;AAC5B,YAAI;AACF,gBAAM,KAAK,gBAAgB,QAAQ,QAAQ,QAAQ,OAAO,WAAW;AAGnE,wBAAY,eAAe;AAC3B,kBAAM,OAAO;AAAA,cACX;AAAA,gBACE,QAAQ,YAAY,QAAQ;AAAA,gBAC5B,QAAQ,YAAY,QAAQ;AAAA,gBAC5B,aAAa;AAAA,kBACX;AAAA,kBACA;AAAA,kBACA;AAAA,kBACA,WAAW;AAAA,kBACX;AAAA,kBACA,WAAW;AAAA,kBACX;AAAA,kBACA,WAAW;AAAA,kBACX;AAAA,kBACA;AAAA,kBACA,GAAI,YAAY,CAAC,aAAa,SAAS,IAAI,CAAC;AAAA,gBAC9C;AAAA,gBACA,SAAS;AAAA,gBACT,KAAK,CAAC;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF,CAAC;AAAA,QACH,SAAS,OAAO;AACd,cACE,YAAY,gBACZ,iBAAiB,uCACjB,iBAAiB,kCACjB,iBAAiB,8CACjB;AACA,iBAAK,eAAe,OAAO,GAAG;AAC9B,kBAAM;AAAA,UACR;AAGA,sBAAY,eAAe;AAC3B,gBAAM;AAAA,QACR;AAAA,MACF;AACA,UAAI;AACJ,UAAI;AACF,mBAAW,MAAM,KAAK,kBAAkB,YAAY,SAAS,MAAM,QAAQ,WAAW;AAAA,MACxF,SAAS,OAAO;AACd,YACE,YAAY,iBAAiB,UAC7B,iBAAiB;AAEjB,gBAAM,IAAI;AAAA,YACR,MAAM;AAAA,YACN,IAAI;AAAA,cACF,CAAC,YAAY,cAAc,KAAK;AAAA,cAChC;AAAA,YACF;AAAA,YACA,MAAM;AAAA,UACR;AACF,cAAM;AAAA,MACR;AACA,YAAM,EAAE,QAAQ,KAAK,IAAI;AAGzB,WAAK,eAAe,OAAO,GAAG;AAC9B,UAAI,SAAS,EAAG,OAAM,IAAI,MAAM,mCAAmC;AACnE,YAAM,SAAS,KAAK,MAAM,MAAM;AAChC,UAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,WAAW,WAAW,EAAE,SAAS,OAAO,KAAK;AACpE,cAAM,IAAI,MAAM,qCAAqC;AACvD,UAAI,OAAO,YAAY,QAAW;AAChC,eAAO,UAAU,0BAA0B,MAAM,OAAO,OAAO;AAC/D,YAAI,OAAO,QAAQ,iBAAiB,WAAW;AAC7C,gBAAM,IAAI,MAAM,wCAAwC;AAAA,MAC5D;AACA,UAAK,OAAO,UAAU,gBAAiB,QAAQ,OAAO,OAAO;AAC3D,cAAM,IAAI,MAAM,kDAAkD;AACpE,aAAO;AAAA,IACT;AACA,gBAAY,aAAaA,KAAI,EAAE,QAAQ,MAAM;AAC3C,aAAO,YAAY;AAAA,IACrB,CAAC;AACD,WAAO,MAAM,YAAY;AAAA,EAC3B;AAAA;AAAA;AAAA,EAIA,MAAc,kBACZ,UACA,OACA,QACA,aAC2C;AAC3C,UAAM,QAA4B,eAAe;AAAA,MAC/C,SAAS;AAAA,QACP,MAAM;AAAA,QACN,WAAW,KAAK;AAAA,QAChB,GAAG;AAAA,QACH,SAAS;AAAA,UACP,QAAQ,EAAE,YAAY,GAAG,eAAe,IAAI,KAAK,OAAO,UAAU,KAAK;AAAA,UACvE,QAAQ,EAAE,YAAY,GAAG,eAAe,IAAI,KAAK,OAAO,UAAU,KAAK;AAAA,QACzE;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,IACV;AACA,eAAS;AACP,UAAI;AACF,eAAO,eAAe;AACtB,cAAM,OAAO,MAAM,KAAK,KAAK,MAAM,SAAS,KAAK,MAAM;AACvD,cAAM,UAAU,KAAK;AACrB,YACE,MAAM,QAAQ,QAAQ,OAAO,aAAa,MAAM,QAAQ,QAAQ,OAAO,aACvE;AAEA,gBAAM,IAAI,MAAM,+CAA+C;AACjE,cAAM,UAAU,KAAK,OAClB,OAAO,CAAC,UAAU,MAAM,WAAW,QAAQ,EAC3C,IAAI,CAAC,UAAU,MAAM,IAAI,EACzB,KAAK,EAAE;AACV,YAAI,KAAK,aAAa,KAAM,QAAO,EAAE,QAAQ,MAAM,QAAQ,MAAM,KAAK,SAAS;AAAA,MACjF,SAAS,OAAO;AACd,YAAI,OAAO;AACT,gBAAM,IAAI;AAAA,YACR,gBAAgB,MAAM,OAAO;AAAA,YAC7B;AAAA,UACF;AACF,YACE,EAAE,iBAAiB,+CACnB,CAAC,MAAM;AAEP,gBAAM;AAAA,MACV;AACA,UAAI;AACF,cAAMK,OAAM,KAAK,QAAW,EAAE,OAAO,CAAC;AAAA,MACxC,SAAS,OAAO;AACd,cAAM,IAAI,2CAA2C,gBAAgB,MAAM,OAAO,GAAG,KAAK;AAAA,MAC5F;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,KACJ,SACA,QACA,QACkC;AAClC,2BAAuB,MAAM,OAAO;AACpC,QAAI,QAAQ,cAAc,KAAK;AAC7B,YAAM,IAAI,MAAM,+CAA+C;AACjE,QAAI,QAAQ,SAAS,mBAAoB,QAAO,MAAM,KAAK,OAAO,KAAK,SAAS,QAAQ,MAAM;AAC9F,YAAQ,MAAM,KAAK,WAAW,SAAS,QAAQ,MAAM,GAAG;AAAA,EAC1D;AAAA;AAAA;AAAA,EAIA,MAAM,QACJ,SACA,QACA,QAC6B;AAC7B,YAAQ,MAAM,KAAK,WAAW,SAAS,QAAQ,MAAM,GAAG;AAAA,EAC1D;AAAA,EAEA,MAAc,WACZ,OACA,QACA,QACuD;AACvD,UAAM,UAAU,gBAAgBC,4BAA2B,MAAM,KAAK,CAAC;AACvE,QAAI,QAAQ,cAAc,KAAK;AAC7B,YAAM,IAAI,MAAM,+CAA+C;AACjE,QAAI,CAAC,OAAO,SAAS,MAAM,KAAK,SAAS,KAAK,SAAS;AACrD,YAAM,IAAI,MAAM,kCAAkC;AACpD,YAAQ,eAAe;AACvB,UAAM,SAAS,QAAQ,QAAQ;AAC/B,UAAM,SAAS,QAAQ,QAAQ;AAC/B,QACE,OAAO,OACP,OAAO,OACP,OAAO,kBAAkB,MACzB,OAAO,kBAAkB,MACzB,OAAO,aAAa,QACpB,OAAO,aAAa,OAAO,UAC3B;AAIA,aAAO;AAAA,QACL;AAAA,QACA;AAAA,UACE,QAAQ,EAAE,OAAO,OAAO,MAAM,CAAC,GAAG,KAAK,KAAK;AAAA,UAC5C,QAAQ,EAAE,OAAO,OAAO,MAAM,CAAC,GAAG,KAAK,KAAK;AAAA,QAC9C;AAAA,QACA,EAAE,QAAQ,qBAAqB,MAAM,OAAO,SAAS;AAAA,MACvD;AAAA,IACF;AACA,UAAM,SAAS,IAAI,gBAAgB;AACnC,UAAM,QAAQ,MAAM,OAAO,MAAM,QAAQ,MAAM;AAC/C,YAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AACvD,QAAI,QAAQ,QAAS,OAAM;AAK3B,UAAM,WAAW,YAAY,IAAI,IAAI,KAAK,IAAI,GAAG,MAAM;AACvD,UAAM,UAAU;AAAA,MACd,MAAM,OAAO,MAAM,IAAI,MAAM,qCAAqC,CAAC;AAAA,MACnE,KAAK,IAAI,GAAG,MAAM,IAAI;AAAA,IACxB;AACA,QAAI;AACJ,QAAI;AACF,eAAS,UAAU,GAAG,UAAU,GAAG,WAAW;AAC5C,gBAAQ,eAAe;AACvB,YAAI,UAAU,KAAK,YAAY,IAAI,KAAK,SAAU;AAClD,YAAI;AACF,iBAAO,MAAM,KAAK;AAAA,YAChB;AAAA,YACA,KAAK,IAAI,KAAK,IAAI,GAAG,MAAM,GAAG,KAAK,IAAI,GAAG,WAAW,YAAY,IAAI,CAAC,CAAC;AAAA,YACvE,OAAO;AAAA,YACP;AAAA,UACF;AAAA,QACF,SAAS,OAAO;AACd,kBAAQ,eAAe;AACvB,cAAI,CAAC,OAAO,OAAO,WAAW,CAAC,wCAAwC,KAAK,GAAG;AAI7E,gBAAI,+BAA+B,SAAS,KAAK,EAAE,SAAS;AAC1D,oBAAM,IAAI;AAAA,gBACR,gBAAgB,OAAO;AAAA,gBACvB;AAAA,gBACA;AAAA,cACF;AACF,kBAAM;AAAA,UACR;AACA,sBAAY;AACZ,cAAI,OAAO,OAAO,WAAW,YAAY,IAAI,KAAK,YAAY,YAAY,EAAG;AAC7E,cAAI;AACF,kBAAMD,OAAM,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG,WAAW,YAAY,IAAI,CAAC,CAAC,GAAG,QAAW;AAAA,cAC/E,QAAQ,OAAO;AAAA,YACjB,CAAC;AAAA,UACH,QAAQ;AACN,oBAAQ,eAAe;AACvB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,YAAM,IAAI,2CAA2C,gBAAgB,OAAO,GAAG,SAAS;AAAA,IAC1F,UAAE;AACA,mBAAa,OAAO;AACpB,cAAQ,oBAAoB,SAAS,KAAK;AAAA,IAC5C;AAAA,EACF;AAAA,EAEA,MAAc,eACZ,SACA,QACA,QACA,UACuD;AACvD,UAAM,eAAe,IAAI,gBAAgB;AACzC,UAAM,qBAAqB,IAAI,gBAAgB;AAC/C,UAAM,QAAQ,MAAM;AAClB,mBAAa,MAAM,OAAO,MAAM;AAChC,yBAAmB,MAAM,OAAO,MAAM;AAAA,IACxC;AACA,YAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AACvD,QAAI,QAAQ,QAAS,OAAM;AAC3B,UAAM,gBAAgB;AAAA,MACpB,MACE,mBAAmB;AAAA,QACjB,IAAI;AAAA,UACF,gBAAgB,OAAO;AAAA,UACvB,IAAI,MAAM,4CAA4C;AAAA,QACxD;AAAA,MACF;AAAA,MACF,KAAK,IAAI,GAAG,WAAW,YAAY,IAAI,CAAC;AAAA,IAC1C;AACA,QAAI;AACF,aAAO,MAAM,KAAK,WAAW,QAAQ,QAAQ,mBAAmB,QAAQ,OAAO,WAAW;AACxF,qBAAa,aAAa;AAC1B,2BAAmB,OAAO,eAAe;AACzC,eAAO,eAAe;AACtB,YAAI,YAAY,IAAI,KAAK;AACvB,gBAAM,IAAI;AAAA,YACR,gBAAgB,OAAO;AAAA,YACvB,IAAI,MAAM,qCAAqC;AAAA,UACjD;AACF,cAAM,gBAAgB,KAAK,IAAI,GAAG,KAAK,IAAI,QAAQ,WAAW,YAAY,IAAI,CAAC,CAAC;AAChF,cAAM,aAAa;AAAA,UACjB,GAAI,CAAC,UAAU,QAAQ,EAAY;AAAA,YAAI,OAAO,WAC5C,QAAQ,QAAQ,MAAM,EAAE,MACpB,EAAE,OAAO,OAAO,MAAM,CAAC,GAAG,KAAK,KAAK,IACpC,MAAM,OAAO;AAAA,cACX;AAAA,cACA;AAAA,cACA,QAAQ,QAAQ,MAAM,EAAE;AAAA,cACxB;AAAA,cACA,aAAa;AAAA,YACf;AAAA,UACN;AAAA,UACA,OAAO,KAAK,SAAS,aAAa,MAAM;AAAA,QAC1C;AACA,cAAM,UAAU,MAAM,QAAQ;AAAA,UAC5B,WAAW;AAAA,YAAI,CAAC,cACd,UAAU,MAAM,CAAC,UAAU;AACzB,2BAAa,MAAM,KAAK;AACxB,oBAAM;AAAA,YACR,CAAC;AAAA,UACH;AAAA,QACF;AACA,cAAM,SAAS,QAAQ,KAAK,CAAC,WAAW,OAAO,WAAW,UAAU;AAGpE,YAAI,QAAQ,WAAW,WAAY,OAAM,aAAa,OAAO,UAAU,OAAO;AAC9E,cAAM,SAAU,QAAQ,CAAC,EACtB;AACH,cAAM,SAAU,QAAQ,CAAC,EACtB;AACH,YAAI,OAAQ,QAAQ,CAAC,EAA4C;AACjE,YAAI,SAAS,QAAQ,OAAO,OAAO,OAAO;AACxC,iBAAO,MAAM,KAAK,aAAa,QAAQ,SAAS,aAAa,QAAQ,QAAQ;AAC/E,eAAO;AAAA,UACL;AAAA,UACA,EAAE,QAAQ,OAAO;AAAA,UACjB,EAAE,QAAQ,eAAe,MAAM,KAAK;AAAA,QACtC;AAAA,MACF,CAAC;AAAA,IACH,UAAE;AACA,mBAAa,aAAa;AAC1B,cAAQ,oBAAoB,SAAS,KAAK;AAAA,IAC5C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAc,aACZ,QACA,SACA,QACA,UACwB;AACxB,QAAI,QAAQ;AACZ,eAAS;AACP,aAAO,eAAe;AACtB,YAAM,SAAS,WAAW,YAAY,IAAI;AAC1C,UAAI,UAAU,EAAG,QAAO;AACxB,UAAI;AACJ,UAAI;AACF,eAAO,MAAM,OAAO;AAAA,UAClB;AAAA,UACA,YAAY,IAAI,CAAC,QAAQ,YAAY,QAAQ,KAAK,KAAK,MAAM,IAAI,eAAe,CAAC,CAAC;AAAA,QACpF;AAAA,MACF,QAAQ;AACN,eAAO,eAAe;AACtB,eAAO;AAAA,MACT;AACA,UAAI,SAAS,KAAM,QAAO;AAC1B,YAAM,YAAY,WAAW,YAAY,IAAI;AAC7C,UAAI,aAAa,EAAG,QAAO;AAC3B,UAAI;AACF,cAAMA,OAAM,KAAK,IAAI,OAAO,SAAS,GAAG,QAAW,EAAE,OAAO,CAAC;AAAA,MAC/D,QAAQ;AACN,eAAO,eAAe;AACtB,eAAO;AAAA,MACT;AACA,cAAQ,KAAK,IAAI,QAAQ,GAAG,GAAG;AAAA,IACjC;AAAA,EACF;AAAA,EAEA,MAAM,UACJ,SACA,QACA,cACkC;AAClC,WAAO,MAAM,KAAK,KAAK,SAAS,QAAQ,aAAa,MAAM;AAAA,EAC7D;AAAA,EAEA,MAAM,MAAM,SAA+B,OAAe,OAA8B;AACtF,2BAAuB,MAAM,OAAO;AACpC,QAAI,QAAQ,cAAc,KAAK;AAC7B,YAAM,IAAI,MAAM,+CAA+C;AACjE,QAAI,QAAQ,SAAS,mBAAoB,QAAO,MAAM,KAAK,OAAO,MAAM,SAAS,OAAO,KAAK;AAC7F,UAAM,KAAK;AAAA,MAAW,QAAQ;AAAA,MAAQ;AAAA,MAAW,CAAC,WAChD,OAAO,MAAM,SAAS,OAAO,OAAO,KAAK,KAAK,CAAC;AAAA,IACjD;AAAA,EACF;AACF;;;AEh4BA,SAAS,eAAAE,cAAa,eAAkD;;;ACjBxE,SAAS,cAAAC,mBAAkB;AAO3B,IAAM,cAAc;AACpB,IAAM,gBAAgB;AAUf,SAAS,yBAAyB,aAA6B;AACpE,MAAI,CAAC,kEAAkE,KAAK,WAAW,GAAG;AACxF,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,SAAO,mBAAmB,WAAW;AACvC;AAcO,SAAS,kCAAkC,OAI9B;AAClB,QAAM,OAAO,yBAAyB,MAAM,WAAW;AACvD,MAAI,YAAY;AAChB,SAAO,gBAAgB,4BAA4B,MAAM,SAAS;AAChE,QAAI,KAAK,OAAO,SAAS,YAAa,QAAO,OAAO,KAAK,KAAK,KAAK,SAAS,OAAO;AACnF,QAAI,KAAK,iBAAiB,KAAK,gBAAgB;AAC7C,YAAM,IAAI,MAAM,yDAAyD;AAAA,IAC3E;AACA,QAAI;AACF,YAAM,IAAI,MAAM,oEAAoE;AACtF,UAAM,UAAU,KAAK;AAKrB,QACE,OAAO,QAAQ,UAAU,YACzB,CAAC,QAAQ,SACT,OAAO,QAAQ,YAAY,YAAY,YACvC,CAAC,QAAQ,WAAW,WACnB,QAAQ,WAAW,QAAQ,QAAQ,WAAW,SAAS,QACxD,CAAC,MAAM,QAAQ,QAAQ,IAAI,KAC3B,QAAQ,KAAK;AAAA,MACX,CAAC,QAAQ,IAAI,YAAY,iBAAiB,IAAI,aAAa,MAAM;AAAA,IACnE,GACA;AACA,YAAM,IAAI,MAAM,sEAAsE;AAAA,IACxF;AACA,UAAM,cAAc;AAAA,MAClB,GAAG;AAAA,MACH,YAAY,EAAE,GAAG,QAAQ,YAAY,KAAK;AAAA,MAC1C,MAAM;AAAA,QACJ,GAAG,QAAQ,KAAK,OAAO,CAAC,QAAQ,IAAI,YAAY,aAAa;AAAA,QAC7D,EAAE,SAAS,eAAe,UAAU,MAAM,YAAY;AAAA,MACxD;AAAA,IACF;AACA,UAAM,SAA4B;AAAA,MAChC,aAAa,MAAM;AAAA,MACnB;AAAA,MACA,OAAO,QAAQ;AAAA,MACf,SAAS,QAAQ,WAAW;AAAA,MAC5B,eAAeA,YAAW,QAAQ,EAAE,OAAO,KAAK,UAAU,WAAW,CAAC,EAAE,OAAO,KAAK;AAAA,IACtF;AACA,gBAAY;AACZ,UAAM,MAAM,eAAe,MAAM;AAGjC,UAAM,kBAAkB,EAAE,GAAG,SAAS,SAAS,EAAE;AACjD,UAAM,WAAW,OAAO,KAAK,KAAK,aAAoC,eAAe;AACrF,UAAM,aAAc,UAA6C;AACjE,QAAI,OAAO,eAAe,YAAY,CAAC,WAAW,WAAW,KAAK,GAAG;AACnE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAGA,UAAM,MAAM,UAAU,EAAE,GAAG,QAAQ,WAAW,CAAC;AAC/C,WAAO;AAAA,EACT;AACF;;;ADzEA,eAAsB,0BACpB,SACA,OACA,OACgB;AAChB,MAAI;AACF,QAAI,WAAW,+BAA+B,KAAK,GAAG;AACpD,UAAI;AACF,cAAM,QAAQ,MAAM;AAAA,MACtB,SAAS,cAAc;AAErB,cAAM,IAAI;AAAA,UACR,CAAC,OAAO,YAAY;AAAA,UACpB;AAAA,UACA,EAAE,OAAO,aAAa;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAAA,EACF,UAAE;AACA,UAAM,MAAM;AAAA,EACd;AACA,QAAM;AACR;AAEA,SAAS,QACP,OAGA;AACA,SAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,UAAU,MAAS,CAAC;AAG5F;AAEA,SAAS,YAAY,SAAwB;AAC3C,QAAM,IAAI,+BAA+B,iCAAiC,OAAO,IAAI;AAAA,IACnF,UAAU;AAAA,IACV;AAAA,EACF,CAAC;AACH;AAEA,SAAS,iBAAiB,UAA0B;AAClD,MAAI,SAAS,MAAM,OAAQ,aAAY,gBAAgB;AACvD,MAAI,SAAS,OAAO,OAAQ,aAAY,iBAAiB;AACzD,MAAI,SAAS,gBAAgB,OAAQ,aAAY,0BAA0B;AAC3E,aAAW,EAAE,MAAM,KAAK,SAAS,YAAY,GAAG;AAC9C,QAAI,MAAM,gBAAgB,OAAW,aAAY,mBAAmB;AACpE,QAAI,MAAM,UAAU,OAAW,aAAY,aAAa;AACxD,QAAI,QAAQ,KAAK,KAAK,CAAC,6BAA6B,KAAK,EAAG,aAAY,qBAAqB;AAAA,EAC/F;AACF;AAEA,SAAS,cAAc,UAA8B;AACnD,QAAM,UAAU,CAAC,WACf,OAAO;AAAA,IACL,OAAO,QAAQ,MAAM,EAClB,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,QAAQ,KAAK,CAAC,EACrC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;AAAA,MACtB;AAAA,MACA,MAAM,SAAS,SAAS,MAAM,WAC1B,EAAE,GAAG,gBAAgB,KAAK,GAAG,UAAU,QAAQ,MAAM,QAAQ,EAAE,IAC/D,gBAAgB,KAAK;AAAA,IAC3B,CAAC;AAAA,EACL;AACF,SAAO,IAAI,SAAS;AAAA,IAClB,SAAS,SAAS;AAAA,IAClB,MAAM,SAAS;AAAA,IACf,SAAS,QAAQ,SAAS,OAAO;AAAA,IACjC,aAAa,OAAO;AAAA,MAClB,OAAO,QAAQ,SAAS,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,MAAM,KAAK,CAAC,CAAC;AAAA,IAChF;AAAA,IACA,OAAO,gBAAgB,SAAS,KAAK;AAAA,IACrC,QAAQ,gBAAgB,SAAS,MAAM;AAAA,IACvC,iBAAiB,gBAAgB,SAAS,eAAe;AAAA,IACzD,6BAA6B,CAAC,GAAG,SAAS,2BAA2B;AAAA,EACvE,CAAC;AACH;AAMA,eAAsB,gCACpB,UACA,MACA,WACA,eAC8B;AAC9B,QAAM,SAAS,iCAAiC,IAAI;AACpD,MAAI,OAAO,aAAa,OAAW,aAAY,UAAU;AACzD,QAAM,YAAY,OAAO;AACzB,QAAM,UAAU,EAAE,GAAG,SAAS;AAC9B,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,aAAa,CAAC,CAAC,GAAG;AAC1D,QAAI,UAAU,QAAQ,UAAU,OAAW,QAAO,OAAO,SAAS,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC;AAAA,EACpF;AACA,UAAQ,MAAM,EAAE,GAAG,SAAS,KAAK,GAAG,WAAW,IAAI;AACnD,MAAI,QAAQ,QAAS,aAAY,8CAA8C;AAC/E,MAAI,CAAC,QAAQ,SAAS,KAAK,EAAG,OAAM,IAAI,MAAM,2CAA2C;AACzF,MACE,QAAQ,gCAAgC,UACxC,CAAC,QAAQ,4BAA4B,KAAK,GAC1C;AACA,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AACA,QAAM,uBAAuB,QAAQ,wBAAwB;AAC7D,MAAI,CAAC,CAAC,OAAO,uBAAuB,oBAAoB,EAAE,SAAS,oBAAoB;AACrF,gBAAY,sBAAsB;AACpC,aAAW,OAAO;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAAY;AACV,UAAM,QAAQ,QAAQ,GAAG;AACzB,QAAI,UAAU,WAAc,CAAC,OAAO,SAAS,KAAK,KAAK,SAAS;AAC9D,YAAM,IAAI,MAAM,SAAS,GAAG,mBAAmB;AAAA,EACnD;AACA,QAAM,WAAW,OAAO;AACxB,mBAAiB,QAAQ;AAEzB,aAAW,EAAE,MAAM,KAAK,SAAS,aAAa,GAAG;AAC/C;AAAA,MACE;AAAA,MACA,QAAQ;AAAA,QACN,YACE,mBAAmB,MAAM,eAAe,YAAY,KACpD,QAAQ;AAAA,QACV,uBAAuB,mBAAmB,MAAM,eAAe,uBAAuB;AAAA,MACxF,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI;AACJ,MAAI,WAAW;AACf,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,QAAM,QAAQ,IAAIC;AAAA,IAChB,QAAQ;AAAA,MACN,SAAS,QAAQ;AAAA,MACjB,aAAa,QAAQ;AAAA,MACrB,aAAa,QAAQ;AAAA,MACrB,UAAU,QAAQ;AAAA,MAClB,gBAAgB;AAAA,QACd,kCAAkC;AAAA,UAChC,aAAa,OAAO,WAAW;AAAA,UAC/B,gBAAgB,OAAO,WAAW;AAChC,gBAAI,SAAU,OAAM,IAAI,MAAM,+CAA+C;AAC7E,kBAAM,UAAU,eAAe,QAAQ,EAAE,MAAM,CAAC;AAAA,UAClD;AAAA,UACA,WAAW,OAAO,YAAY;AAC5B,kBAAM,kBAAkB;AAAA,cACtB;AAAA,cACA;AAAA,cACA,SAAS,IAAI,QAAQ,OAAO,QAAQ,UAAU;AAAA,cAC9C,aAAa;AAAA,cACb,OAAO,EAAE,GAAG,OAAO,WAAW,QAAQ,YAAY,SAAS,QAAQ,QAAQ;AAAA,cAC3E;AAAA,cACA,2BAA2B,YACzB,MAAM,cAAc,SAAS,MAAM,YAAY,QAAQ;AAAA,cACzD,mBAAmB,OAAO;AAAA,cAC1B,eAAe,OAAO;AAAA,YACxB;AAGA,sBAAU;AAAA,cACR,IAAI;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAGA,kBAAM,eAAe,QAAQ,MAAM,KAAK,OAAO;AAC/C,oBAAQ,QAAQ,YAAY;AAC1B,oBAAM,aAAa;AACnB,oBAAM,MAAM;AAAA,YACd;AACA,kBAAM,UAAU,UAAU,SAAS,OAAO;AAAA,UAC5C;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,gBAAgB,OAAO,WAAqB;AAChD,UAAM,SAA2C,CAAC;AAClD,eAAW,EAAE,OAAO,UAAU,KAAK,OAAO,aAAa,GAAG;AACxD,UAAI,CAAC,6BAA6B,KAAK,EAAG,aAAY,qBAAqB;AAC3E,YAAM,SAAS;AAAA,QACb;AAAA,QACA,QAAQ;AAAA,UACN,YACE,mBAAmB,MAAM,eAAe,YAAY,KACpD,QAAQ;AAAA,UACV,uBAAuB,mBAAmB,MAAM,eAAe,uBAAuB;AAAA,QACxF,CAAC;AAAA,MACH;AACA,YAAM,SAAS,OAAO,aAClB,MAAM,MAAM,QAAQ;AAAA,QAClB,OAAO;AAAA,QACP,QAAQ;AAAA,UACN,aAAa,OAAO;AAAA,QACtB,CAAC;AAAA,MACH,IACA,OAAO,cACL,MAAM,MAAM,QAAQ,WAAW,OAAO,WAAW,IACjD;AACN,aAAO,SAAS,IAAI,MAAM,kBAAkB;AAAA,QAC1C,OAAO;AAAA,QACP,QAAQ;AAAA,UACN,mBAAmB,OAAO;AAAA,UAC1B,WAAW,OAAO;AAAA,UAClB,UAAU,OAAO;AAAA,UACjB;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO,OAAO,KAAK,MAAM,EAAE,SAAS,SAAS;AAAA,EAC/C;AACA,MAAI;AACF,UAAM,MAAM,MAAM,KAAK;AAAA,MACrB,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN,iBAAiB;AAAA,QACjB,aAAa,QAAQ;AAAA,MACvB,CAAC;AAAA,IACH;AACA,UAAM,cAAc,MAAM,uBAAuB,UAAU,QAAQ,GAAG;AACtE,UAAM,WACJ,QAAQ,SAAS,mBAAmB,QAAQ,QAAQ,YAAY,sBAAsB;AACxF,QAAI;AACJ,QAAI,SAAS,SAAS,QAAS,SAAQ,SAAS;AAAA,aACvC,OAAO,SAAS,UAAU,YAAY,CAAC,SAAS,MAAM,KAAK;AAClE,YAAM,IAAI,MAAM,wCAAwC;AAAA,aACjD,SAAS,SAAS,KAAM,SAAQ,MAAM,MAAM,OAAO,OAAO,SAAS,KAAK;AAAA,aACxE,SAAS,SAAS,MAAO,SAAQ,MAAM,OAAO,aAAa,SAAS,KAAK;AAAA,QAC7E,OAAM,IAAI,MAAM,kCAAkC;AACvD,QAAI,OAAO,OAAO,UAAU;AAC1B,YAAM,IAAI,MAAM,8CAA8C;AAChE,wBAAoB,MAAM,cAAc,QAAQ;AAChD,YAAQ;AAAA,MACN;AAAA,MACA,aAAa;AAAA,MACb,SAAS,QAAQ;AAAA,MACjB,UACE,SAAS,SAAS,QACb,SAAS,QACT,QAAQ,YAAY;AAAA,MAC3B,uBAAuB,QAAQ;AAAA,MAC/B;AAAA,MACA,6BAA6B,QAAQ;AAAA,MACrC,oCAAoC,QAAQ;AAAA,MAC5C;AAAA,MACA,WAAW,QAAQ;AAAA,MACnB,eAAe,QAAQ;AAAA,MACvB,KAAK,QAAQ;AAAA,MACb,WAAW,QAAQ;AAAA,MACnB,KAAK,QAAQ;AAAA,MACb,wBAAwB,QAAQ;AAAA,MAChC,kBAAkB,QAAQ;AAAA,MAC1B,UAAU,QAAQ;AAAA,MAClB,qBAAqB,QAAQ;AAAA,MAC7B,6BAA6B,QAAQ;AAAA,MACrC,aAAa,QAAQ,eAAe;AAAA,IACtC;AACA,UAAM,iBAAiB,MAAM,UAAU;AAAA,MACrC;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,QACN,SAAS,SAAS;AAAA,QAClB,KAAK;AAAA,QACL,SAAS,MAAM,cAAc,CAAC,SAAS,UAAU,IAAI;AAAA,QACrD,WAAW,QAAQ;AAAA,QACnB,eAAe,QAAQ;AAAA,QACvB,KAAK,QAAQ;AAAA,QACb,WAAW,QAAQ;AAAA,QACnB,KAAK,QAAQ;AAAA,QACb,gBAAgB,QAAQ;AAAA,QACxB;AAAA,MACF,CAAC;AAAA,IACH;AACA,QAAI;AACJ,QAAI;AACF,aAAO,QAAQ,0BAA0B,SACrC,iBACA,QAAQ,KAAK;AAAA,QACX;AAAA,QACA,IAAI,QAAe,CAAC,GAAG,WAAW;AAChC,kBAAQ,WAAW,MAAM;AACvB,uBAAW;AACX;AAAA,cACE,IAAI,MAAM,mEAAmE;AAAA,YAC/E;AAAA,UACF,GAAG,QAAQ,wBAAyB,GAAI;AAAA,QAC1C,CAAC;AAAA,MACH,CAAC;AAAA,IACP,UAAE;AACA,UAAI,MAAO,cAAa,KAAK;AAG7B,UAAI;AACF,aAAK,eACF;AAAA,UACC,YAAY;AACV,kBAAM,SAAS,MAAM;AAAA,UACvB;AAAA,UACA,YAAY;AACV,kBAAM,SAAS,MAAM;AAAA,UACvB;AAAA,QACF,EACC,MAAM,MAAM;AACX,gBAAM,OAAO;AAAA,YACX;AAAA,UACF;AAAA,QACF,CAAC,EACA,QAAQ,MAAM,MAAM,MAAM,CAAC;AAAA,IAClC;AACA,QAAI,CAAC,QAAS,OAAM,IAAI,MAAM,8DAA8D;AAC5F,UAAM,QAAQ,cAAc,cAAc,QAAQ,CAAC;AACnD,WAAO;AAAA,EACT,SAAS,OAAO;AAId,QAAI,CAAC,UAAU;AACb,aAAO,MAAM,0BAA0B,SAAS,OAAO,KAAK;AAAA,IAC9D;AACA,UAAM;AAAA,EACR;AACF;;;ANxTA,IAAM,2BAA2B;AACjC,IAAM,6BAA6B;AACnC,IAAM,6BAA6B;AAQnC,IAAM,qCAAqC,IAAI;AA6CxC,SAAS,mCACd,OACwB;AACxB,SAAO;AAAA,IACL,2BAA2B,MAAM;AAAA,IACjC,2BAA2B,MAAM;AAAA,IACjC,uBAAuB,MAAM;AAAA,EAC/B;AACF;AAEO,SAAS,4BACd,OACwB;AACxB,SAAO;AAAA,IACL,UAAU;AAAA,IACV,mBAAmB,MAAM;AAAA,IACzB,uBAAuB,MAAM;AAAA,IAC7B,2BAA2B,MAAM;AAAA,EACnC;AACF;AAiDA,IAAM,gCAAgC,oBAAI,QAAgB;AAC1D,IAAM,mCAAmC,oBAAI,QAAgB;AAC7D,IAAM,2CAA2C,oBAAI,QAAgB;AACrE,IAAM,0CAA0C,oBAAI,QAAgB;AACpE,IAAM,0BAA0B,oBAAI,QAAwB;AAC5D,IAAM,iCAAiC,oBAAI,QAAoC;AAC/E,IAAM,0BAA0B;AAYhC,SAAS,2BAA2B,MAAcC,gBAA+B;AAC/E,MAAI,CAAC,KAAK,WAAW,GAAG,EAAG,QAAO;AAClC,QAAM,OAAOA,eAAc,QAAQ,QAAQ,EAAE,KAAK;AAClD,QAAM,aAAa,KAAK,QAAQ,QAAQ,EAAE,KAAK;AAC/C,MAAI,eAAe,KAAM,QAAO;AAChC,MAAI,SAAS,IAAK,QAAO,WAAW,MAAM,CAAC;AAC3C,MAAI,WAAW,WAAW,GAAG,IAAI,GAAG,EAAG,QAAO,WAAW,MAAM,KAAK,SAAS,CAAC;AAC9E,QAAM,IAAI,MAAM,qDAAqD,IAAI,EAAE;AAC7E;AAEA,SAAS,2BAA2B,MAAcA,gBAA+B;AAC/E,QAAM,OAAOA,eAAc,QAAQ,QAAQ,EAAE,KAAK;AAClD,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,SAAS,MAAM,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,IAAI;AACpD;AAEA,SAAS,iCAAiC,SAA2C;AACnF,MAAI,OAAO,QAAQ,YAAY,WAAY;AAC3C,QAAM,cAAc,QAAQ;AAC5B,QAAM,aAAa,QAAQ,YAAY,KAAK,OAAO;AACnD,QAAM,YAAY,QAAQ,6BAA6B,KAAK,OAAO;AACnE,MAAI,OAAO,gBAAgB,cAAc,OAAO,QAAQ,aAAa,WAAY;AACjF,QAAMA,iBAAgB,QAAQ,OAAO,UAAU;AAC/C,MAAI,CAACA,gBAAe;AAClB,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACA,UAAQ,UAAU,OAAO,MAAM,kBAAkB;AAC/C,UAAM,sBAAsB,KAAK,KAAK,WAAW,GAAG;AACpD,UAAM,eAAe,2BAA2B,KAAK,MAAMA,cAAa;AAIxE,UAAM,UAAU,IAAI,uBAAuB;AAAA,MACzC,SAAS;AAAA,QACP,aAAa,YAAY,KAAK,OAAO;AAAA,QACrC,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,QACnC,GAAI,YAAY,EAAE,6BAA6B,UAAU,IAAI,CAAC;AAAA,QAC9D,GAAI,QAAQ,2BACR,EAAE,0BAA0B,QAAQ,yBAAyB,KAAK,OAAO,EAAE,IAC3E,CAAC;AAAA,MACP;AAAA,MACA,GAAI,gBAAgB,EAAE,cAAc,IAAI,CAAC;AAAA,MACzC,eAAAA;AAAA,MACA,GAAI,KAAK,QAAQ,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,IAC5C,CAAC;AACD,UAAM,SAAS,MAAM;AAAA,MAAuC;AAAA,MAA4B,MACtF,QAAQ,OAAO;AAAA,QACb,MAAM;AAAA,QACN,OAAO;AAAA,QACP,YAAY;AAAA,QACZ,eAAe;AAAA,MACjB,CAAC;AAAA,IACH;AACA,QAAI,OAAO,aAAa,OAAO,KAAK,WAAW;AAC7C,YAAM,IAAI;AAAA,QACR,8BAA8B,0BAA0B;AAAA,MAC1D;AAAA,IACF;AACA,YAAQ,OAAO,KAAK,YAAY,CAAC,GAAG,IAAI,CAAC,WAAW;AAAA,MAClD,MAAM,MAAM;AAAA,MACZ,MAAM,sBACF,2BAA2B,MAAM,MAAMA,cAAa,IACpD,MAAM;AAAA,MACV,MAAM,MAAM,SAAS,UAAU,MAAM,SAAS,QAAQ,MAAM,OAAO;AAAA,IACrE,EAAE;AAAA,EACJ;AACF;AAEA,IAAM,8BACJ;AACF,IAAM,uCACJ;AACF,IAAM,wCAAwC;AAC9C,IAAM,wCAAwC;AAC9C,IAAM,mDAAmD;AAEzD,SAAS,gBAAgB,OAA+B;AACtD,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,SAAU,QAAO;AACnE,QAAMC,UAAS,OAAO,KAAK;AAC3B,SAAO,OAAO,UAAUA,OAAM,KAAKA,WAAU,OAAOA,WAAU,MAAMA,UAAS;AAC/E;AAEA,SAAS,gCAAgC,QAA0C;AACjF,QAAM,OAAO,CAAC,UAAU,cAAc,cAAc,gBAAgB;AACpE,QAAM,SAAS,KAAK,IAAI,CAAC,QAAQ,yBAAyB,QAAQ,GAAG,CAAC;AACtE,QAAM,WAAW,yBAAyB,QAAQ,UAAU;AAC5D,MAAI,YAAY,OAAO,aAAa,UAAU;AAC5C,WAAO,KAAK,GAAG,KAAK,IAAI,CAAC,QAAQ,yBAAyB,UAAU,GAAG,CAAC,CAAC;AAAA,EAC3E;AACA,SAAO,OAAO,KAAK,CAAC,UAAU,gBAAgB,KAAK,MAAM,IAAI;AAC/D;AAQO,SAAS,gDAAgD,OAAyB;AACvF,QAAM,UAAoD,CAAC,EAAE,OAAO,GAAG,OAAO,MAAM,CAAC;AACrF,QAAM,OAAO,oBAAI,QAAgB;AACjC,MAAI,YAAY;AAChB,MAAI,iBAAiB;AAErB,SAAO,QAAQ,SAAS,GAAG;AACzB,QAAI,aAAa,sCAAuC,QAAO;AAC/D,UAAM,UAAU,QAAQ,MAAM;AAC9B,iBAAa;AACb,QAAI,CAAC,QAAQ,SAAS,OAAO,QAAQ,UAAU,YAAY,KAAK,IAAI,QAAQ,KAAK,GAAG;AAClF,aAAO;AAAA,IACT;AACA,QAAI,QAAQ,QAAQ,sCAAuC,QAAO;AAClE,SAAK,IAAI,QAAQ,KAAK;AAEtB,QAAI;AACJ,QAAI;AACF,YAAM,SAAS,QAAQ;AACvB,UACE;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,CAAC,QAAQ,gCAAgC,QAAQ,GAAG,CAAC;AAE5D,eAAO;AACT,UAAI,qCAAqC,QAAQ,KAAK,EAAG,QAAO;AAChE,UAAI,6BAA6B,QAAQ,OAAO,iBAAiB,EAAG,QAAO;AAC3E,UAAI,QAAQ,iBAAiB,oCAAqC,QAAO;AACzE,UAAI,gCAAgC,MAAM,EAAG,QAAO;AAIpD,UACE,QAAQ,iBAAiB,gDACzB,6BAA6B,QAAQ,OAAO,0BAA0B,GACtE;AACA,0BAAkB;AAClB;AAAA,MACF;AAEA,eAAS,CAAC;AACV,iBAAW,OAAO,CAAC,SAAS,OAAO,GAAY;AAC7C,cAAM,QAAQ,yBAAyB,QAAQ,GAAG;AAClD,YAAI,UAAU,OAAW,QAAO,KAAK,KAAK;AAAA,MAC5C;AAEA,YAAM,SAAS,yBAAyB,QAAQ,QAAQ;AACxD,UAAI,WAAW,QAAW;AACxB,YACE,CAAC,MAAM,QAAQ,MAAM,KACrB,OAAO,WAAW,KAClB,OAAO,SAAS,kDAChB;AACA,iBAAO;AAAA,QACT;AACA,iBAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ;AACzC,iBAAO,KAAK,yBAAyB,QAAQ,OAAO,KAAK,CAAC,CAAC;AAAA,MAC/D;AAEA,UAAI,OAAO,WAAW,EAAG,QAAO;AAAA,IAClC,QAAQ;AACN,aAAO;AAAA,IACT;AAEA,QAAI,QAAQ,SAAS,sCAAuC,QAAO;AACnE,eAAW,SAAS,QAAQ;AAC1B,cAAQ,KAAK,EAAE,OAAO,QAAQ,QAAQ,GAAG,MAAM,CAAC;AAAA,IAClD;AAAA,EACF;AAEA,SAAO,iBAAiB;AAC1B;AAIO,SAAS,uCAAuC,OAAyB;AAC9E,SAAO,2CAA2C,KAAK;AACzD;AAQO,SAAS,iCAAiC,OAAyB;AACxE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,SAAS;AAMf,SACE,OAAO,SAAS,iBAChB,OAAO,SAAS,+BAChB,OAAO,SAAS,KAChB,OAAO,OAAO,YAAY,YAC1B,qCAAqC,KAAK,OAAO,OAAO;AAE5D;AAEA,SAAS,qBAAqB,SAA2C;AACvE,QAAM,gBAAgB,QAAQ,OAAO,UAAU;AAC/C,MAAI,kBAAkB,4BAA4B;AAChD,UAAM,IAAI;AAAA,MACR,wDAAwD,0BAA0B,iCACjD,iBAAiB,YAAY;AAAA,IAChE;AAAA,EACF;AACF;AAEA,eAAe,wBACb,WACiB;AAGjB,QAAM,WAAW,MAAM,UAAU,EAAE,MAAM,KAAK,CAAC;AAC/C,MAAI,OAAO,aAAa,YAAY,CAAC,OAAO,UAAU,QAAQ,GAAG;AAC/D,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AACA,SAAO;AACT;AAEA,SAAS,oCAAoC,SAA2C;AACtF,MAAI,OAAO,QAAQ,UAAU,WAAY;AACzC,QAAM,QAAQ,QAAQ,MAAM,KAAK,OAAO;AACxC,UAAQ,QAAQ,YAAY;AAG1B,UAAM,UAAU,QAAQ;AACxB,QAAI,CAAC,WAAW,OAAO,QAAQ,cAAc,YAAY;AACvD,YAAM,IAAI,MAAM,oDAAoD;AAAA,IACtE;AACA,QAAI,CAAC,iCAAiC,IAAI,OAAO,GAAG;AAClD,YAAM,YAAY,QAAQ,UAAU,KAAK,OAAO;AAChD,cAAQ,YAAY,YAAY,wBAAwB,SAAS;AACjE,uCAAiC,IAAI,OAAO;AAAA,IAC9C;AACA,UAAM,MAAM;AAAA,EACd;AACF;AAEA,SAAS,oCAAoC,SAA2C;AACtF,QAAM,cAAc,QAAQ,OAAO;AACnC,MAAI,gBAAgB,yBAAyB,gBAAgB,sBAAsB;AACjF;AAAA,EACF;AACA,QAAM,UAAU,QAAQ;AACxB,MAAI,CAAC,WAAW,OAAO,YAAY,UAAU;AAC3C,UAAM,IAAI,MAAM,SAAS,WAAW,6CAA6C;AAAA,EACnF;AAEA,MAAI,gBAAgB,uBAAuB;AACzC,QAAI,yCAAyC,IAAI,OAAO,EAAG;AAC3D,UAAM,qBAAqB,QAAQ;AACnC,QAAI,OAAO,uBAAuB,YAAY;AAC5C,YAAM,IAAI,MAAM,sDAAsD;AAAA,IACxE;AAMA,YAAQ,qBAAqB,OAAO,iBAA2B;AAC7D,UAAI,iBAAiB,UAAa,OAAO,iBAAiB,UAAU;AAClE,cAAM,IAAI,MAAM,yDAAyD;AAAA,MAC3E;AACA,YAAMC,aAAY,wBAAwB,IAAI,OAAO;AACrD,UAAI,CAACA,YAAW;AACd,cAAM,IAAI,MAAM,8DAA8D;AAAA,MAChF;AACA,aAAO,MAAM,mBAAmB,KAAK,SAAS;AAAA,QAC5C,GAAI,iBAAiB,SAAY,CAAC,IAAI,EAAE,WAAW,aAAa;AAAA,QAChE,OAAO;AAAA,QACP,YAAYA;AAAA,MACd,CAAC;AAAA,IACH;AACA,6CAAyC,IAAI,OAAO;AACpD;AAAA,EACF;AAEA,MAAI,wCAAwC,IAAI,OAAO,EAAG;AAC1D,QAAM,oBAAoB,QAAQ;AAClC,MAAI,OAAO,sBAAsB,YAAY;AAC3C,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AACA,UAAQ,oBAAoB,OAAO,MAAgB,iBAA2B;AAC5E,QAAI,OAAO,SAAS,YAAY,iBAAiB,QAAW;AAC1D,YAAM,IAAI,MAAM,wDAAwD;AAAA,IAC1E;AACA,UAAMA,aAAY,wBAAwB,IAAI,OAAO;AACrD,QAAI,CAACA,YAAW;AACd,YAAM,IAAI,MAAM,8DAA8D;AAAA,IAChF;AAKA,UAAM,YAAY,+BAA+B,IAAI,OAAO;AAC5D,WAAO,MAAM,kBAAkB,KAAK,SAAS,MAAM;AAAA,MACjD,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,UAAU;AAAA,MAC/C,OAAO;AAAA,MACP,YAAYA;AAAA,IACd,CAAC;AAAA,EACH;AACA,0CAAwC,IAAI,OAAO;AACrD;AAEA,SAAS,mCAAmC,SAA2C;AACrF,QAAM,aAAa,QAAQ;AAC3B,MAAI,OAAO,eAAe,WAAY;AACtC,QAAMC,WAAU,OAAO,SAA2C;AAMhE,QAAI,EAAE,QAAQ,2BAA2B,MAAM;AAC7C,YAAM,IAAI,wCAAwC,KAAK,WAAW;AAAA,QAChE,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AACA,QAAI,CAAC,QAAQ,gBAAgB,IAAI,KAAK,SAAS,GAAG;AAChD,YAAM,IAAI,wCAAwC,KAAK,WAAW;AAAA,QAChE,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AACA,WAAO,MAAM,WAAW,KAAK,SAAS,IAAI;AAAA,EAC5C;AACA,0BAAwB,OAAO;AAC/B,UAAQ,aAAa,OAAO,SAAS;AACnC,QAAI;AACF,aAAO,MAAMA,SAAQ,IAAI;AAAA,IAC3B,SAAS,OAAO;AACd,UACE,CAAC,iCAAiC,KAAK,KACvC,CAAC,OAAO,cAAc,KAAK,SAAS,KACpC,KAAK,aAAa,GAClB;AACA,cAAM;AAAA,MACR;AAIA,UAAI;AACF,eAAO,MAAMA,SAAQ,EAAE,GAAG,MAAM,OAAO,GAAG,CAAC;AAAA,MAC7C,SAAS,OAAO;AACd,cAAM,IAAI,wCAAwC,KAAK,WAAW,EAAE,MAAM,CAAC;AAAA,MAC7E;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,oCAAoC,SAA2C;AACtF,MAAI,QAAQ,yBAA0B;AACtC,MACE,OAAO,QAAQ,gBAAgB,cAC/B,OAAO,QAAQ,SAAS,WAAW,cACnC,OAAO,QAAQ,OAAO,WAAW,WAAW,cAC5C,CAAC,QAAQ,OAAO,WAChB;AACA;AAAA,EACF;AACA,QAAM,QAAoC;AAAA,IACxC,SAAS,oBAAI,IAAI;AAAA,IACjB,cAAc;AAAA,EAChB;AACA,QAAM,cAAc,QAAQ,YAAY,KAAK,OAAO;AACpD,UAAQ,cAAc,OAAO,SAAS;AACpC,UAAM,UACJ,QAAQ,OAAO,SAAS,YAAY,OAAQ,KAA2B,QAAQ,WAC1E,KAAyB,MAC1B;AACN,QAAI,CAAC,SAAS,SAAS,uBAAuB,GAAG;AAC/C,aAAO,MAAM,YAAY,IAAI;AAAA,IAC/B;AAKA,UAAM,UAAiC;AAAA,MACrC,SAAS;AAAA,MACT,uBAAuB;AAAA,IACzB;AACA,UAAM,QAAQ,IAAI,OAAO;AACzB,QAAI;AACF,YAAM,UAAU,MAAM,QAAQ,MAAO,UAAW,OAAQ,QAAQ,MAAO,SAAU;AACjF,cAAQ,UAAU;AAClB,UAAI,QAAQ,uBAAuB;AACjC,gBAAQ,SAAS;AACjB,cAAM,IAAI,MAAM,sDAAsD;AAAA,MACxE;AACA,cAAQ,UAAU;AAClB,aAAO,MAAM,YAAY,IAAI;AAAA,IAC/B,UAAE;AACA,YAAM,QAAQ,OAAO,OAAO;AAAA,IAC9B;AAAA,EACF;AAEA,UAAQ,2BAA2B,YAAY;AAC7C,QAAI,CAAC,MAAM,cAAc;AACvB,YAAM,gBAAgB,YAAY;AAChC,cAAM,gBAAgB,CAAC,GAAG,MAAM,OAAO;AACvC,cAAM,WAAW,oBAAI,IAAiC;AACtD,mBAAW,SAAS,eAAe;AACjC,gBAAM,wBAAwB;AAC9B,cAAI,MAAM,SAAS;AACjB,kBAAM,QAAQ,SAAS;AACvB,qBAAS,IAAI,MAAM,OAAO;AAAA,UAC5B;AAAA,QACF;AAGA,YAAI,QAAQ,WAAW,SAAS,IAAI,QAAQ,OAAO,GAAG;AACpD,gBAAM,cAAc,MAAM,QAAQ,MAAO,UAAW,OAAQ,QAAQ,MAAO,SAAU;AACrF,cAAI,QAAQ,WAAW,SAAS,IAAI,QAAQ,OAAO,GAAG;AACpD,oBAAQ,UAAU;AAClB,gDAAoC,OAAO;AAAA,UAC7C,OAAO;AACL,wBAAY,SAAS;AAAA,UACvB;AAAA,QACF;AAAA,MACF,GAAG,EAAE,QAAQ,MAAM;AACjB,cAAM,eAAe;AAAA,MACvB,CAAC;AAAA,IACH;AACA,UAAM,MAAM;AAAA,EACd;AACF;AAOO,SAAS,mCAAqD,SAAe;AAClF,QAAM,UAAU;AAChB,MAAI,8BAA8B,IAAI,OAAO,EAAG,QAAO;AACvD,MAAI,OAAO,QAAQ,qBAAqB,YAAY;AAClD,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AACA,uBAAqB,OAAO;AAC5B,MAAI,QAAQ,MAAO,iCAAgC,QAAQ,KAAK;AAChE,sCAAoC,OAAO;AAC3C,sCAAoC,OAAO;AAC3C,qCAAmC,OAAO;AAC1C,sCAAoC,OAAO;AAC3C,2CAAyC,SAAS,MAAM,QAAQ,OAAO;AACvE,mCAAiC,OAAO;AACxC,MACE,QAAQ,OAAO,YACf,QAAQ,MAAM,WACd,QAAQ,OAAO,aACf,QAAQ,MAAM,UAAU,MACxB;AACA,QAAI,CAAC,QAAQ,MAAM;AACjB,YAAM,IAAI,MAAM,uEAAuE;AACzF;AAAA,MACE;AAAA,MACAC,qBAAoB;AAAA,QAClB;AAAA,UACE,UAAU,QAAQ,MAAM;AAAA,UACxB,SAAS,QAAQ,MAAM,QAAQ,KAAK,QAAQ,KAAK;AAAA,UACjD,SAAS,QAAQ,MAAM;AAAA,UACvB,GAAI,QAAQ,MAAM,SAAS,EAAE,QAAQ,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,QACjE;AAAA,QACA,MAAM;AACJ,gBAAM,YAAY,QAAQ,OAAO;AACjC,cAAI,CAAC,UAAW,OAAM,IAAI,MAAM,+CAA+C;AAC/E,iBAAO;AAAA,QACT;AAAA,QACA,QAAQ,MAAM,SAAS;AAAA,QACvB,MAAM,QAAQ,OAAO,eAAe,CAAC;AAAA,MACvC;AAAA,IACF;AAAA,EACF;AACA,QAAM,mBAAmB,QAAQ,iBAAiB,KAAK,OAAO;AAC9D,UAAQ,mBAAmB,OAAO,YAA2C;AAC3E,yBAAqB,OAAO;AAC5B,wCAAoC,OAAO;AAC3C,SACG,QAAQ,OAAO,yBAAyB,yBACvC,QAAQ,OAAO,yBAAyB,0BACzC,CAAC,WACA,CAAC,8EAA8E;AAAA,MAC7E,QAAQ;AAAA,IACV,IACF;AACA,YAAM,IAAI,MAAM,iEAAiE;AAAA,IACnF;AACA,UAAM,oBACJ,QAAQ,OAAO,yBAAyB,yBACxC,QAAQ,OAAO,yBAAyB;AAC1C,QAAI,WAAW,mBAAmB;AAChC,8BAAwB,IAAI,SAAS,QAAQ,SAAS;AAAA,IACxD;AACA,UAAM,mBACJ,QAAQ,OAAO,yBAAyB,uBACpC,QAAQ,MAAM,8BACd;AACN,UAAM,6BACJ,QAAQ,OAAO,yBAAyB,wBACxC,OAAO,OAAO,QAAQ,OAAO,6BAA6B;AAC5D,QAAI,QAAQ,OAAO,yBAAyB,sBAAsB;AAChE,qCAA+B,IAAI,SAAS,gBAAgB;AAI5D,aAAO,QAAQ,MAAM;AAAA,IACvB;AACA,QAAI;AACF,aAAO,MAAM,iBAAiB;AAAA,IAChC,UAAE;AACA,8BAAwB,OAAO,OAAO;AACtC,UAAI,QAAQ,OAAO,yBAAyB,sBAAsB;AAChE,YAAI,4BAA4B;AAC9B,kBAAQ,IAAI,QAAQ,OAAO,+BAA+B,gBAAgB;AAAA,QAC5E,OAAO;AACL,iBAAO,QAAQ,MAAM;AAAA,QACvB;AACA,uCAA+B,OAAO,OAAO;AAAA,MAC/C;AAAA,IACF;AAAA,EACF;AACA,gCAA8B,IAAI,OAAO;AACzC,oCAAkC,OAAO;AACzC,SAAO;AACT;AAEO,IAAM,6BAAN,cAAyC,mBAAmB;AAAA,EACxD;AAAA,EACA;AAAA,EAET,eAAe,MAAwD;AACrE,UAAM,GAAG,IAAI;AACb,SAAK,+BAA+B,KAAK,CAAC,GAAG;AAC7C,SAAK,iBAAiB,EAAE,GAAG,KAAK,CAAC,EAAE;AAAA,EACrC;AAAA,EAEA,MAAe,OACb,MACA,iBAC8B;AAC9B,UAAM,UAAU,MAAM,MAAM,OAAO,MAAM,eAAe;AACxD,WAAO,mCAAmC,OAAO;AAAA,EACnD;AAAA,EAEA,MAAM,oBACJ,MACA,WAC8B;AAC9B,WAAO,MAAM;AAAA,MACX,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAe,OAAO,OAA+D;AAOnF,UAAM,iBACJ,KAAK,iCAAiC,UACtC,MAAM,gCAAgC,KAAK,+BACvC,QACA;AAAA,MACE,GAAG;AAAA,MACH,6BAA6B,KAAK;AAAA,IACpC;AACN,UAAM,UAAU,MAAM,MAAM,OAAO,cAAc;AACjD,WAAO,mCAAmC,OAAO;AAAA,EACnD;AACF;AAEO,IAAM,gBAAsC;AAAA,EACjD,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,kBAAkB,CAAC,WAAW;AAAA,EAC9B,uBAAuB,OAAO;AAC5B,UAAM,cAAc,6BAA6B,KAAK;AACtD,QAAI,gBAAgB,yBAAyB,gBAAgB,sBAAsB;AACjF,aAAO;AAAA,QACL,UAAU;AAAA,QACV,UAAU;AAAA,QACV,cAAc;AAAA,MAChB;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EACA,MAAM,oBAAoB,EAAE,UAAU,SAAS,WAAAF,YAAW,UAAU,GAAG;AACrE,UAAM,UAAU;AAChB,UAAM,YAAY,QAAQ,OAAO;AACjC,UAAM,YAAY,QAAQ,OAAO;AACjC,QAAI,CAAC,aAAa,OAAO,WAAW,WAAW,YAAY;AACzD,YAAM,IAAI,MAAM,oEAAoE;AAAA,IACtF;AACA,UAAM,iBAAiB,MAAM,UAAU,OAAO,SAAS;AACvD,QAAI;AACF,UAAI,OAAO,eAAe,uBAAuB,YAAY;AAC3D,cAAM,IAAI,MAAM,gEAAgE;AAAA,MAClF;AACA,YAAM,QAAS,MAAM,eAAe,mBAAmB;AAAA,QACrD,YAAYA;AAAA,QACZ;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AACD,YAAM,UACJ,OAAO,MAAM,YAAY,WACrB,MAAM,UACN,OAAO,MAAM,aAAa,WACxB,MAAM,WACN;AACR,UAAI,CAAC,SAAS;AACZ,cAAM,IAAI,MAAM,8DAA8D;AAAA,MAChF;AACA,YAAMG,WAAU,MAAM,gDAAgD,UAAU,OAAO;AACvF,aAAO;AAAA,QACL,UAAU;AAAA,QACV,SAAS;AAAA,QACT;AAAA,QACA,aAAa;AAAA,QACb,oBAAoBA,SAAQ;AAAA,QAC5B,iBAAiBA,SAAQ;AAAA,MAC3B;AAAA,IACF,UAAE;AACA,qBAAe,SAAS;AAAA,IAC1B;AAAA,EACF;AAAA,EACA,YAAY,uBAAuB;AAAA,EACnC,oBAAoB,UAAU;AAE5B,QAAI,QAAQ,SAAS,YAAY,MAAM,QAAQ,SAAS,gBAAgB,GAAG;AACzE,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,cAAc;AAC1B,YAAM,IAAI,mBAAmB,SAAS,qCAAqC;AAAA,IAC7E;AAAA,EACF;AAAA,EACA,MAAM,EAAE,UAAU,aAAa,aAAa,GAAG;AAC7C,UAAM,UAA4E;AAAA,MAChF,SAAS,SAAS;AAAA,MAClB,WAAW,SAAS,sBAAsB;AAAA,MAC1C,uBAAuB,KAAK,KAAK,SAAS,0BAA0B,GAAI;AAAA;AAAA;AAAA;AAAA,MAIxE,6BAA6B,SAAS;AAAA,MACtC;AAAA,MACA,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,MAKL,aAAa;AAAA,IACf;AASA,YAAQ,gBAAgB,iCAAiC,QAAQ,IAAI;AACrE,QAAI,SAAS,oBAAoB,QAAW;AAC1C,cAAQ,MAAM,SAAS;AAAA,IACzB;AACA,QAAI,SAAS,0BAA0B,QAAW;AAChD,cAAQ,YAAY,SAAS;AAAA,IAC/B;AACA,QAAI,SAAS,2BAA2B;AACtC,cAAQ,uBAAuB,SAAS;AAAA,IAC1C;AACA,UAAM,gBAAgB,0BAA0B,QAAQ;AACxD,QAAI,eAAe;AACjB,cAAQ,QAAQ;AAAA,IAClB;AACA,QAAI,SAAS,cAAc;AACzB,cAAQ,UAAU,SAAS;AAAA,IAC7B;AACA,QAAI,SAAS,kBAAkB;AAC7B,cAAQ,cAAc,SAAS;AAAA,IACjC;AACA,QAAI,SAAS,kBAAkB;AAC7B,cAAQ,cAAc,SAAS;AAAA,IACjC;AACA,WAAO,IAAI,2BAA2B,OAAO;AAAA,EAC/C;AACF;AA0BA,IAAM,qBAAwC,MAAM,OAAO,OAAO;AAGlE,IAAM,yBAAyB,oBAAI,IAAqB;AAExD,IAAM,yBAAyB,oBAAI,IAA2B;AAC9D,IAAM,qCAAqC;AAE3C,SAAS,sBAAsB,UAA4B;AACzD,SAAO;AAAA,IACL,SAAS,iBAAiB;AAAA,IAC1B,SAAS,4BAA4B;AAAA,IACrC,SAAS,oBAAoB;AAAA,EAC/B,EAAE,KAAK,GAAG;AACZ;AAEA,eAAsB,yBACpB,UACA,YAA+B,oBAChB;AAIf,MAAI,SAAS,cAAc;AACzB;AAAA,EACF;AACA,MAAI,CAAC,SAAS,4BAA4B,CAAC,SAAS,eAAe;AACjE;AAAA,EACF;AACA,QAAM,MAAM,sBAAsB,QAAQ;AAC1C,MAAI,uBAAuB,IAAI,GAAG,GAAG;AACnC;AAAA,EACF;AACA,MAAI,UAAU,uBAAuB,IAAI,GAAG;AAC5C,MAAI,CAAC,SAAS;AACZ,eAAW,YAAY;AACrB,YAAM,QAAQ,MAAM,UAAU;AAC9B,YAAM,SAAS,IAAI,MAAM,YAAY,mBAAmB,QAAQ,CAAC;AAMjE,YAAM,SAAS,MAAM,OAAO,QAAQ;AAAA,QAClC,SAAS;AAAA,QACT,SAAS,mBAAmB,EAAE,aAAa,SAAS,iBAAiB,IAAI;AAAA,MAC3E;AAQA,YAAM,MAAM,MAAM,OAAO,KAAK,SAAS,SAAS,cAAc;AAAA,QAC5D,GAAI,SAAS,mBAAmB,EAAE,aAAa,SAAS,iBAAiB,IAAI,CAAC;AAAA,QAC9E,iBAAiB;AAAA,MACnB,CAAC;AACD,YAAM,gBAAgB,CAAC,eACrB,OAAO,OACJ,aAAa,SAAS,eAAgB,MAAM,EAC5C,mBAAmB,CAAC,kCAAkC,GAAG;AAAA,QACxD,GAAI,aAAa,EAAE,YAAY,KAAK,IAAI,CAAC;AAAA,MAC3C,CAAC;AACL,UAAI;AACJ,UAAI;AACF,qBAAa,MAAM,cAAc,KAAK,EAAE,MAAM,GAAG;AAAA,MACnD,QAAQ;AAMN,qBAAa,MAAM,cAAc,IAAI,EAAE,MAAM,GAAG;AAAA,MAClD;AACA,6BAAuB,IAAI,KAAK,UAAU;AAAA,IAC5C,GAAG,EAAE,QAAQ,MAAM;AACjB,6BAAuB,OAAO,GAAG;AAAA,IACnC,CAAC;AACD,2BAAuB,IAAI,KAAK,OAAO;AAAA,EACzC;AACA,QAAM;AACR;AAGA,SAAS,yBAAyB,UAAyC;AACzE,MAAI,CAAC,SAAS,4BAA4B,CAAC,SAAS,eAAe;AACjE,WAAO;AAAA,EACT;AACA,SAAO,uBAAuB,IAAI,sBAAsB,QAAQ,CAAC;AACnE;AAYO,SAAS,0BAA0B,UAAoD;AAC5F,MAAI,SAAS,cAAc;AACzB,WAAO,mBAAmB,OAAO,SAAS,YAAY;AAAA,EACxD;AACA,MAAI,CAAC,SAAS,eAAe;AAC3B,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,yBAAyB,QAAQ;AACvD,SAAO,gBACH,mBAAmB;AAAA,IACjB;AAAA,EACF,IACA,mBAAmB,QAAQ,SAAS,aAAa;AACvD;AAQA,SAAS,mBACP,UACsD;AACtD,SAAO;AAAA,IACL,GAAI,SAAS,eAAe,EAAE,SAAS,SAAS,aAAa,IAAI,CAAC;AAAA,IAClE,GAAI,SAAS,mBAAmB,EAAE,aAAa,SAAS,iBAAiB,IAAI,CAAC;AAAA,IAC9E,GAAI,SAAS,mBAAmB,EAAE,aAAa,SAAS,iBAAiB,IAAI,CAAC;AAAA,EAChF;AACF;AAEA,eAAe,kBAAkB,UAA8C;AAC7E,QAAM,QAAQ,MAAM,OAAO,OAAO;AAClC,SAAO,IAAI,MAAM,YAAY,mBAAmB,QAAQ,CAAC;AAC3D;AAEA,SAAS,qBAAqB,OAAyB;AACrD,QAAM,YAAY;AAQlB,SAAO,WAAW,SAAS,mBAAmB,WAAW,SAAS;AACpE;AAEA,eAAe,wCACb,UACA,OACyC;AACzC,QAAM,WAAW,MAAM,MAAM,SAAS,oBAAoB,CAAC,CAAC;AAC5D,QAAM,gBAAgB,SAAS,iBAAiB,SAAS;AACzD,MAAI,CAAC,eAAe;AAClB,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,QAAM,WAAW,wCAAwC;AAAA,IACvD,SAAS;AAAA,IACT,WAAW,MAAM,QAAQ;AAAA,IACzB;AAAA;AAAA;AAAA;AAAA,IAIA,aAAa,MAAM,gBAAgB,SAAS,gBAAgB;AAAA,EAC9D,CAAC;AACD,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AACA,SAAO,SAAS;AAClB;AAEA,IAAM,iCAAiC,oBAAI,QAGzC;AASF,eAAsB,gDACpB,UACA,SACmE;AACnE,MAAI,CAAC,WAAW,OAAO,YAAY,UAAU;AAC3C,UAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AACA,QAAM,SAAS,+BAA+B,IAAI,OAAO;AACzD,MAAI,OAAQ,QAAO,MAAM;AACzB,QAAM,QAAS,QAAgC;AAC/C,MACE,CAAC,SACD,OAAO,MAAM,UAAU,wBAAwB,cAC/C,OAAO,MAAM,SAAS,cAAc,YACpC,OAAO,MAAM,oBAAoB,YACjC;AACA,UAAM,IAAI,MAAM,8EAA8E;AAAA,EAChG;AACA,QAAM,UAAU,wCAAwC,UAAU,KAAK,EAAE;AAAA,IACvE,CAACC,aAAY,wCAAwCA,QAAO;AAAA,EAC9D;AACA,iCAA+B,IAAI,SAAS,OAAO;AACnD,MAAI;AACF,WAAO,MAAM;AAAA,EACf,SAAS,OAAO;AACd,mCAA+B,OAAO,OAAO;AAC7C,UAAM;AAAA,EACR;AACF;AAKA,eAAsB,6CACpB,UACA,SACA,oBACkB;AAClB,QAAM,WAAW,MAAM,gDAAgD,UAAU,OAAO;AACxF,SAAO,SAAS,QAAQ;AAC1B;AAMA,eAAsB,sCACpB,UACA,eAAiE,mBACE;AACnE,QAAM,QAAQ,MAAM,aAAa,QAAQ;AACzC,MAAI;AACF,UAAMA,WAAU,MAAM,wCAAwC,UAAU,KAAK;AAC7E,WAAO,wCAAwCA,QAAO;AAAA,EACxD,UAAE;AACA,UAAM,MAAM;AAAA,EACd;AACF;AAIA,eAAsB,+BACpB,UACA,SAOA,eAAiE,mBACzC;AACxB,MACE,CAAC,QAAQ,WACT,CAAC,QAAQ,SACT,QAAQ,iBAAiB,mBAAmB,QAAQ,WAAW;AAE/D,UAAM,IAAI,MAAM,kEAAkE;AACpF,QAAM,QAAQ,MAAM,aAAa,QAAQ;AACzC,MAAI;AACF,UAAMA,WAAU;AAAA,MACd,MAAM,wCAAwC,UAAU,KAAK;AAAA,IAC/D;AACA,QAAIA,UAAS,QAAQ,QAAQ;AAC3B,YAAM,IAAI,MAAM,mEAAmE;AACrF,QAAI;AACJ,UAAM,QAAQ,oBAAI,IAAY;AAG9B,aAAS,OAAO,GAAG,OAAO,IAAI,QAAQ;AACpC,YAAM,WAAW,MAAM,MAAM,SAAS,YAAY;AAAA,QAChD,OAAO,QAAQ;AAAA,QACf,iBAAiB,MAAM,gBAAgB,SAAS,gBAAgB;AAAA,QAChE,iBAAiB;AAAA,QACjB,MAAM,CAAC,EAAE,SAAS,yCAAyC,UAAU,QAAQ,YAAY,CAAC;AAAA,QAC1F,GAAI,oBAAoB,SAAY,CAAC,IAAI,EAAE,gBAAgB;AAAA,MAC7D,CAAC;AACD,UAAI,CAAC,SAAS,UAAU,OAAQ,QAAO,MAAM,SAAS,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,IAAK;AAC3E,iBAAW,QAAQ,SAAS,WAAW;AACrC,YACE,CAAC,KAAK,GAAG,WAAW,KAAK,KACzB,KAAK,UAAU,QAAQ,SACvB,KAAK,SAAS,QAAQ,gBACtB,KAAK,YAAY,QAAQ,WACzB,KAAK,KAAK,OAAO,CAAC,QAAQ,IAAI,YAAY,uCAAuC,EAC9E,WAAW,KACd,CAAC,KAAK,KAAK;AAAA,UACT,CAAC,QACC,IAAI,YAAY,2CAChB,IAAI,aAAa,QAAQ;AAAA,QAC7B;AAEA,gBAAM,IAAI,MAAM,iEAAiE;AACnF,cAAM,IAAI,KAAK,EAAE;AACjB,YAAI,MAAM,OAAO,EAAG,OAAM,IAAI,MAAM,qDAAqD;AAAA,MAC3F;AACA,YAAM,SAAS,KAAK,IAAI,GAAG,SAAS,UAAU,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC;AAC3E,UACE,CAAC,OAAO,SAAS,MAAM,KACvB,UAAU,KACT,oBAAoB,UAAa,UAAU;AAE5C,cAAM,IAAI,MAAM,mDAAmD;AACrE,wBAAkB;AAAA,IACpB;AACA,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE,UAAE;AACA,UAAM,MAAM;AAAA,EACd;AACF;AAIA,eAAsB,oDACpB,UACA,WACA,eAAiE,mBACE;AACnE,MAAI,CAAC,UAAW,OAAM,IAAI,MAAM,mDAAmD;AACnF,QAAM,QAAQ,MAAM,aAAa,QAAQ;AACzC,MAAI;AACF,UAAMA,WAAU,MAAM,wCAAwC,UAAU,KAAK;AAC7E,UAAM,UAAU,MAAM,MAAM,UAAU,OAAO,SAAS;AACtD,UAAM,WAAW,MAAM,QAAQ,KAAK;AACpC,QAAI,aAAa,MAAM;AACrB,YAAM,IAAI,MAAM,iBAAiB,SAAS,uBAAuB;AAAA,IACnE;AACA,WAAO,wCAAwCA,QAAO;AAAA,EACxD,UAAE;AACA,UAAM,MAAM;AAAA,EACd;AACF;AASA,eAAsB,6BACpB,UACA,WACA,oBACA,eAAiE,mBAkBjE;AACA,MAAI,CAAC,UAAW,OAAM,IAAI,MAAM,kDAAkD;AAClF,QAAM,QAAQ,MAAM,aAAa,QAAQ;AACzC,MAAI;AACF,UAAMA,WAAU;AAAA,MACd,MAAM,wCAAwC,UAAU,KAAK;AAAA,IAC/D;AACA,QAAI,sBAAsBA,SAAQ,QAAQ,oBAAoB;AAC5D,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI;AACF,YAAM,UAAU,MAAM,MAAM,UAAU,OAAO,SAAS;AACtD,YAAM,WAAW,MAAM,QAAQ,KAAK;AACpC,aAAO,aAAa,OAChB;AAAA,QACE,QAAQ;AAAA,QACR,oBAAoBA,SAAQ;AAAA,QAC5B,iBAAiBA,SAAQ;AAAA,MAC3B,IACA;AAAA,QACE,QAAQ;AAAA,QACR;AAAA,QACA,oBAAoBA,SAAQ;AAAA,QAC5B,iBAAiBA,SAAQ;AAAA,MAC3B;AAAA,IACN,SAAS,OAAO;AACd,UAAI,qBAAqB,KAAK,GAAG;AAC/B,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,oBAAoBA,SAAQ;AAAA,UAC5B,iBAAiBA,SAAQ;AAAA,QAC3B;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAAA,EACF,UAAE;AACA,UAAM,MAAM;AAAA,EACd;AACF;AAEA,eAAsB,8BACpB,UACA,oBACA,YACA,eAAiE,mBAC/B;AAClC,MAAI,CAAC,WAAY,OAAM,IAAI,MAAM,kDAAkD;AAInF,QAAM,QAAQ,MAAM,aAAa,QAAQ;AACzC,MAAI;AACF,UAAMA,WAAU,MAAM,wCAAwC,UAAU,KAAK;AAC7E,UAAM,WAAW,wCAAwCA,QAAO;AAChE,QAAI,uBAAuB,SAAS,KAAK;AACvC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI;AACF,YAAM,MAAM,OAAO,OAAO,UAAU;AACpC,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,qBAAqB,KAAK,EAAG,QAAO;AACxC,YAAM;AAAA,IACR;AAAA,EACF,UAAE;AACA,UAAM,MAAM;AAAA,EACd;AACF;AAEA,eAAsB,gBACpB,UACA,WACA,aACkB;AAClB,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,MAAM,kBAAkB,QAAQ;AAC9C,MAAI;AACF,UAAM,UAAU,MAAM,MAAM,UAAU,OAAO,SAAS;AACtD,UAAM,QAAQ,QAAQ,4BAA4B,WAAW,CAAC;AAC9D,WAAO;AAAA,EACT,UAAE;AACA,UAAM,MAAM;AAAA,EACd;AACF;AAEA,eAAsB,0BACpB,UACA,WACA,eAAiE,mBACjE,4BACkB;AAClB,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,MAAM,aAAa,QAAQ;AACzC,MAAI;AACF,QAAI,4BAA4B;AAC9B,YAAMA,WAAU;AAAA,QACd,MAAM,wCAAwC,UAAU,KAAK;AAAA,MAC/D;AACA,UAAIA,UAAS,QAAQ;AACnB,cAAM,IAAI,MAAM,kEAAkE;AAAA,IACtF;AACA,UAAM,UAAU,MAAM,MAAM,UAAU,OAAO,SAAS;AACtD,UAAM,wBAAwB,QAAQ,UAAU,KAAK,OAAO,CAAC;AAC7D,WAAO;AAAA,EACT,UAAE;AACA,UAAM,MAAM;AAAA,EACd;AACF;AAoBA,SAAS,aAAa,MAAgD;AACpE,QAAM,OAA+B,CAAC;AACtC,aAAW,OAAO,KAAK,QAAQ,CAAC,GAAG;AACjC,QAAI,OAAO,IAAI,YAAY,YAAY,OAAO,IAAI,aAAa,UAAU;AACvE,WAAK,IAAI,OAAO,IAAI,IAAI;AAAA,IAC1B;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,MAAuC;AACjE,MACE,OAAO,KAAK,cAAc,YAC1B,CAAC,OAAO,SAAS,KAAK,SAAS,KAC/B,KAAK,aAAa,GAClB;AACA,WAAO;AAAA,EACT;AAEA,SAAO,KAAK,YAAY,OACpB,KAAK,MAAM,KAAK,YAAY,GAAI,IAChC,KAAK,MAAM,KAAK,SAAS;AAC/B;AAEA,SAAS,eACP,OACQ;AACR,SAAO,GAAG,MAAM,WAAW,IAAI,MAAM,cAAc,IAAI,MAAM,OAAO;AACtE;AAQA,eAAsB,4BACpB,UACA,UAAwC,CAAC,GACvB;AAClB,QAAM,cAAc,QAAQ,SAAS,OAAO,MAAM,kBAAkB,QAAQ;AAC5E,QAAM,QAAS,QAAQ,UAAU;AACjC,MAAI;AACF,QAAI;AACJ,QAAI;AACF,eACE,MAAM,MAAM,KAAK,SAAS,SAAS,cAAc;AAAA,QAC/C,iBAAiB;AAAA,QACjB,GAAI,SAAS,mBAAmB,EAAE,aAAa,SAAS,iBAAiB,IAAI,CAAC;AAAA,MAChF,CAAC,GACD;AAAA,IACJ,SAAS,OAAO;AACd,UAAI,qBAAqB,KAAK,EAAG,QAAO;AACxC,YAAM;AAAA,IACR;AACA,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,WAAW,MAAM,MAAM,SAAS,YAAY;AAAA,MAChD;AAAA,MACA,iBAAiB;AAAA,MACjB,GAAI,SAAS,mBAAmB,EAAE,iBAAiB,SAAS,iBAAiB,IAAI,CAAC;AAAA,MAClF,MAAM,CAAC;AAAA,IACT,CAAC;AACD,YAAQ,SAAS,aAAa,CAAC,GAAG,SAAS;AAAA,EAC7C,UAAE;AACA,iBAAa,MAAM;AAAA,EACrB;AACF;AAEA,eAAsB,0BACpB,UACA,YACA,UAQI,CAAC,GAC4B;AACjC,QAAM,QAAQ,QAAQ,KAAK,QAAQ,KAAK,KAAK,IAAI;AACjD,QAAM,kBAAkB,QAAQ,mBAAmB;AACnD,QAAM,sBAAsB,QAAQ,uBAAuB;AAC3D,QAAM,oBAAoB,IAAI,IAAI,WAAW,IAAI,CAAC,UAAU,CAAC,eAAe,KAAK,GAAG,KAAK,CAAC,CAAC;AAQ3F,QAAM,mBAAmB,IAAI;AAAA,IAC3B,WACG,OAAO,CAAC,UAAU,MAAM,UAAU,EAClC,IAAI,CAAC,UAAU,CAAC,MAAM,YAAsB,KAAK,CAAC;AAAA,EACvD;AACA,QAAM,cAAc,QAAQ,SAAS,OAAO,MAAM,kBAAkB,QAAQ;AAC5E,QAAM,QAAS,QAAQ,UAAU;AACjC,MAAI;AACF,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,MAAM,KAAK,SAAS,SAAS,cAAc;AAAA,QACrD,iBAAiB;AAAA,QACjB,GAAI,SAAS,mBAAmB,EAAE,aAAa,SAAS,iBAAiB,IAAI,CAAC;AAAA,MAChF,CAAC;AAAA,IACH,SAAS,OAAO;AAGd,UAAI,qBAAqB,KAAK,GAAG;AAC/B,eAAO,4BAA4B,UAAU;AAAA,MAC/C;AACA,YAAM;AAAA,IACR;AACA,UAAM,QAAQ,IAAI;AAClB,QAAI,CAAC,OAAO;AACV,aAAO,4BAA4B,UAAU;AAAA,IAC/C;AAEA,QAAI,WAAW;AACf,QAAI,UAAU;AACd,UAAM,eAA8C,CAAC;AACrD,QAAI,WAAW;AACf,UAAM,kBAAkB,oBAAI,IAAY;AACxC,UAAM,aAA4C,CAAC;AACnD,QAAI;AACJ,WAAO,WAAW,SAAS,iBAAiB;AAC1C,YAAM,WAAW,MAAM,MAAM,SAAS,YAAY;AAAA,QAChD;AAAA,QACA,GAAI,oBAAoB,SAAY,EAAE,gBAAgB,IAAI,CAAC;AAAA,QAC3D,iBAAiB;AAAA,QACjB,GAAI,SAAS,mBAAmB,EAAE,iBAAiB,SAAS,iBAAiB,IAAI,CAAC;AAAA,QAClF,MAAM,CAAC;AAAA,MACT,CAAC;AACD,YAAM,YAAY,SAAS,aAAa,CAAC;AACzC,UAAI,UAAU,WAAW,GAAG;AAC1B,mBAAW;AACX;AAAA,MACF;AACA,iBAAW,QAAQ,WAAW;AAC5B,oBAAY;AACZ,YAAI,KAAK,IAAI;AACX,0BAAgB,IAAI,KAAK,EAAE;AAAA,QAC7B;AACA,cAAM,OAAO,aAAa,IAAI;AAC9B,cAAM,UAAU,KAAK;AACrB,cAAM,cAAc,KAAK;AACzB,cAAM,iBAAiB,KAAK;AAC5B,cAAM,iBAAiB,KAAK,KAAK,iBAAiB,IAAI,KAAK,EAAE,IAAI;AACjE,YAAI,gBAAgB;AAMlB,cACE,YAAY,eAAe,WAC3B,gBAAgB,eAAe,eAC/B,mBAAmB,eAAe,gBAClC;AACA,gBAAI;AACF,oBAAMC,WAAU,MAAM,MAAM,UAAU,OAAO,KAAK,EAAE;AACpD,oBAAMA,SAAQ;AAAA,gBACZ,4BAA4B;AAAA,kBAC1B,SAAS,eAAe;AAAA,kBACxB,aAAa,eAAe;AAAA,kBAC5B,gBAAgB,eAAe;AAAA,gBACjC,CAAC;AAAA,cACH;AAAA,YACF,QAAQ;AAAA,YAGR;AAAA,UACF;AACA,qBAAW;AACX;AAAA,QACF;AACA,YAAI,SAAuD;AAC3D,YAAI,WAAW,eAAe,gBAAgB;AAC5C,gBAAM,OAAO,kBAAkB;AAAA,YAC7B,eAAe,EAAE,SAAS,aAAa,eAAe,CAAC;AAAA,UACzD;AACA,cAAI,CAAC,QAAS,KAAK,cAAc,KAAK,eAAe,KAAK,IAAK;AAC7D,qBAAS;AAAA,UACX;AAAA,QACF,OAAO;AACL,gBAAM,cAAc,mBAAmB,IAAI;AAC3C,cAAI,gBAAgB,QAAQ,QAAQ,eAAe,qBAAqB;AACtE,qBAAS;AAAA,UACX;AAAA,QACF;AAEA,YAAI,CAAC,QAAQ;AACX,qBAAW;AACX;AAAA,QACF;AACA,cAAM,YAAY,EAAE,WAAW,KAAK,IAAI,QAAQ,KAAK;AACrD,YAAI;AACJ,YAAI;AACF,oBAAU,MAAM,MAAM,UAAU,OAAO,KAAK,EAAE;AAAA,QAChD,QAAQ;AACN,qBAAW;AACX,uBAAa,KAAK,SAAS;AAC3B;AAAA,QACF;AACA,YAAI,QAAQ,uBAAuB;AACjC,cAAI;AACF,gBAAI,CAAE,MAAM,QAAQ,sBAAsB,SAAS,GAAI;AACrD,yBAAW;AACX,2BAAa,KAAK,SAAS;AAC3B;AAAA,YACF;AAAA,UACF,QAAQ;AAGN,uBAAW;AACX,yBAAa,KAAK,SAAS;AAC3B;AAAA,UACF;AAAA,QACF;AACA,YAAI;AACF,gBAAM,wBAAwB,QAAQ,UAAU,KAAK,OAAO,CAAC;AAC7D,qBAAW,KAAK,SAAS;AAAA,QAC3B,QAAQ;AACN,qBAAW;AACX,uBAAa,KAAK,SAAS;AAAA,QAC7B;AACA,YAAI,WAAW,UAAU,iBAAiB;AACxC;AAAA,QACF;AAAA,MACF;AACA,wBAAkB,UAAU,UAAU,SAAS,CAAC,GAAG;AACnD,UAAI,oBAAoB,QAAW;AACjC,mBAAW;AACX;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW;AAAA,QACT;AAAA,QACA,SAAS;AAAA,QACT;AAAA;AAAA;AAAA;AAAA,QAIA,6BAA6B,WACzB,WAAW;AAAA,UAAQ,CAAC,UAClB,MAAM,cAAc,CAAC,gBAAgB,IAAI,MAAM,UAAU,IAAI,CAAC,MAAM,UAAU,IAAI,CAAC;AAAA,QACrF,IACA,CAAC;AAAA,MACP;AAAA,IACF;AAAA,EACF,UAAE;AACA,iBAAa,MAAM;AAAA,EACrB;AACF;AAEA,SAAS,4BACP,YACwB;AACxB,SAAO;AAAA,IACL,UAAU;AAAA,IACV,YAAY,CAAC;AAAA,IACb,SAAS;AAAA,IACT,WAAW;AAAA,MACT,UAAU;AAAA,MACV,SAAS;AAAA,MACT,cAAc,CAAC;AAAA,MACf,6BAA6B,WAAW;AAAA,QAAQ,CAAC,UAC/C,MAAM,aAAa,CAAC,MAAM,UAAU,IAAI,CAAC;AAAA,MAC3C;AAAA,IACF;AAAA,EACF;AACF;;;AQ3pDO,IAAM,eAAqC;AAAA,EAChD,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,kBAAkB,CAAC;AAAA,EACnB,wBAAwB,MAAM;AAAA,EAC9B,YAAY,uBAAuB;AAAA;AAAA;AAAA,EAGnC,sBAAsB;AAAA,EAAC;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACfA;AAAA,EACE;AAAA,EACA,WAAW;AAAA,EACX;AAAA,EACA;AAAA,OAMK;AA8CP,SAAS,cAAAC,aAAY,cAAAC,mBAAkB;AACvC,SAAS,SAAAC,QAAO,YAAY,eAAe,WAAAC,gBAAe;AAC1D,SAAS,SAAAC,cAAa;;;ACtCtB,SAAS,uBAAAC,4BAA2B;;;ACPpC;AAAA,EACE,uBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA,qBAAqB;AAAA,OAEhB;AA+EP;AAAA,EACE,sBAAAC;AAAA,OAEK;AA7EA,IAAM,mCAAmC;AAoChD,eAAsB,gBACpB,QACA,OACiB;AACjB,QAAM,aAAa,MAAM,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACnE,QAAM,aAAa,MAAM,cAAc;AACvC,QAAM,UAAkC,mBAAmB,MAAM;AAAA,IAC/D,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,IACjB,UAAU,MAAM;AAAA,IAChB,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM,QAAQ;AAAA,IACpB,MAAM,MAAM,QAAQD;AAAA,IACpB,KAAK,aAAa;AAAA,IAClB,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,IACxD,GAAI,MAAM,iBAAiB,EAAE,gBAAgB,MAAM,eAAe,IAAI,CAAC;AAAA,EACzE,CAAC;AACD,SAAO,gBAAgB,QAAQ,OAAO;AACxC;AAYA,eAAsB,kBACpB,QACA,OACA,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GACD;AACxC,SAAO,0BAA0B,QAAQ,OAAO,UAAU;AAC5D;;;AD/CO,IAAM,6BAAN,cAAyC,MAAM;AAAA,EACpD,YACE,SACS,OACT;AACA,UAAM,OAAO;AAFJ;AAGT,SAAK,OAAO;AAAA,EACd;AACF;AA0CA,IAAM,qBAAuC,CAAC,MAAM,GAAG;AAYhD,SAAS,eAAe,UAAuC;AACpE,MACE,OAAO,SAAS,SAAS,YACzB,SAAS,KAAK,WAAW,KACzB,OAAO,SAAS,SAAS,UACzB;AACA,UAAM,IAAI;AAAA,MACR,6DAA6D,OAAO,SAAS,IAAI,CAAC,UAAU,OAAO,SAAS,IAAI,CAAC;AAAA,IACnH;AAAA,EACF;AACA,QAAM,MAAM,SAAS,OAAO;AAC5B,QAAM,SAAS,MAAM,QAAQ;AAC7B,QAAM,cAAc,MAAM,MAAM;AAEhC,QAAM,OACJ,SAAS,KAAK,SAAS,GAAG,KAAK,CAAC,SAAS,KAAK,WAAW,GAAG,IACxD,IAAI,SAAS,IAAI,MACjB,SAAS;AAIf,QAAM,UACJ,OAAO,SAAS,SAAS,YAAY,SAAS,KAAK,SAAS,IAAI,SAAS,OAAO;AAClF,QAAM,OAAO,QAAQ,WAAW,GAAG,IAAI,UAAU,IAAI,OAAO;AAC5D,QAAM,SACJ,SAAS,SAAS,cAAc,GAAG,MAAM,MAAM,IAAI,KAAK,GAAG,MAAM,MAAM,IAAI,IAAI,SAAS,IAAI;AAC9F,QAAM,YAAY,GAAG,MAAM,GAAG,IAAI;AAClC,QAAM,QAAQ,SAAS,SAAS;AAChC,SAAO,QAAQ,GAAG,SAAS,IAAI,KAAK,KAAK;AAC3C;AAQO,SAAS,oBAAoB,cAAkC,aAA6B;AACjG,MACE,OAAO,gBAAgB,YACvB,CAAC,YAAY,WAAW,GAAG,KAC3B,YAAY,SAAS,IAAI,KACzB,YAAY,SAAS,GAAG,KACxB,YAAY,SAAS,GAAG,GACxB;AACA,UAAM,IAAI,2BAA2B,sCAAsC;AAAA,EAC7E;AACA,QAAM,MAAM,OAAO,iBAAiB,YAAY,aAAa,SAAS,IAAI,eAAe;AACzF,QAAM,UAAU,IAAI,WAAW,GAAG,IAAI,MAAM,IAAI,GAAG,IAAI,QAAQ,SAAS,EAAE,KAAK;AAC/E,SAAO,GAAG,MAAM,GAAG,WAAW;AAChC;AAEA,IAAM,mCAAmC;AAEzC,IAAM,8BACJ;AACF,IAAM,kCAAkC;AASjC,SAAS,gCAAgC,MAAuB;AACrE,SAAO,iCAAiC,KAAK,IAAI;AACnD;AAEO,SAAS,8BAA8B,MAA+C;AAC3F,QAAM,aAAa,KAAK,WAAW,GAAG,IAAI,OAAO,IAAI,IAAI;AACzD,QAAM,QAAQ,4BAA4B,KAAK,UAAU;AACzD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,OAAO,OAAO,MAAM,CAAC,CAAC;AAC5B,MAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,MAAQ,QAAO;AACjE,QAAM,mBAAmB,OAAO,SAAS,MAAM,CAAC,GAAI,EAAE;AACtD,MAAI,CAAC,OAAO,cAAc,gBAAgB,KAAK,mBAAmB,EAAG,QAAO;AAC5E,SAAO;AAAA,IACL,WAAW,MAAM,CAAC;AAAA,IAClB;AAAA,IACA;AAAA,IACA,WAAW,MAAM,CAAC;AAAA,EACpB;AACF;AAEA,SAAS,wBAAwB,UAAuD;AACtF,MAAI,OAAO,aAAa,UAAU;AAChC,QAAI;AACF,aAAO,IAAI,IAAI,QAAQ,EAAE;AAAA,IAC3B,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO,OAAO,SAAS,SAAS,YAAY,SAAS,KAAK,SAAS,IAAI,SAAS,OAAO;AACzF;AAOO,SAAS,2BAA2B,UAAiD;AAC1F,QAAM,OAAO,wBAAwB,QAAQ;AAC7C,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,gCAAgC,IAAI,EAAG,QAAO;AAClD,MAAI,SAAS,OAAO,SAAS,GAAI,QAAO;AACxC,SAAO,8BAA8B,IAAI,MAAM;AACjD;AAEO,SAAS,0BAA0B,MAA6B;AACrE,QAAM,SAAS,8BAA8B,IAAI;AACjD,SAAO,SAAS,OAAO,mBAAmB,MAAO;AACnD;AAEO,SAAS,2BACd,MACA,QAAQ,KAAK,IAAI,GACjB,SAAS,iCACA;AACT,QAAM,YAAY,0BAA0B,IAAI;AAChD,MAAI,cAAc,KAAM,QAAO;AAC/B,SAAO,QAAQ,UAAU;AAC3B;AAGO,SAAS,+BAA+B,MAAsB;AACnE,SAAO,KAAK,QAAQ,2CAA2C,eAAe;AAChF;AAIO,SAAS,2BAA2B,OAAoC;AAC7E,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,UAAM,IAAI,2BAA2B,6CAA6C;AAAA,EACpF;AACA,MACG,OAAO,aAAa,SAAS,OAAO,aAAa,UAClD,OAAO,aAAa,MACpB,OAAO,aAAa,MACpB,OAAO,SAAS,MAChB,OAAO,aAAa,IACpB;AACA,UAAM,IAAI,2BAA2B,mDAAmD;AAAA,EAC1F;AACA,QAAM,MAAM,OAAO,aAAa;AAChC,QAAM,OAAO,OAAO,SAAS,KAAM,MAAM,MAAM,KAAM,OAAO,OAAO,IAAI;AACvE,MAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,OAAQ;AACxD,UAAM,IAAI,2BAA2B,8CAA8C;AAAA,EACrF;AACA,SAAO;AAAA,IACL,MAAM,OAAO;AAAA,IACb;AAAA,IACA;AAAA,IACA,MAAM,OAAO,YAAY;AAAA,IACzB,OAAO,OAAO,OAAO,WAAW,GAAG,IAAI,OAAO,OAAO,MAAM,CAAC,IAAI,OAAO;AAAA,EACzE;AACF;AAYA,eAAsB,iBACpB,SACA,OACiC;AACjC,QAAM,IAAI;AACV,QAAM,OAAO,MAAM,QAAQE;AAC3B,MAAI,OAAO,GAAG,uBAAuB,YAAY;AAC/C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AAIF,eAAW,MAAM,EAAE,mBAAmB,IAAI;AAAA,EAC5C,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,8CAA8C,IAAI,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MAC7G;AAAA,IACF;AAAA,EACF;AAEA,QAAM,MAAM,eAAe,QAAQ;AACnC,QAAM,aAAa,MAAM,cAAc;AACvC,QAAM,aAAa,MAAM,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACnE,QAAM,QAAQ,MAAM,gBAAgB,MAAM,mBAAmB;AAAA,IAC3D,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,IACjB,UAAU,MAAM;AAAA,IAChB,YAAY,MAAM;AAAA,IAClB,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,IACxD,GAAI,MAAM,iBAAiB,EAAE,gBAAgB,MAAM,eAAe,IAAI,CAAC;AAAA,EACzE,CAAC;AAED,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,WAAW,IAAI,MAAM,aAAa,cAAc,GAAI,EAAE,YAAY;AAAA,IAClE,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,YAAY,MAAM,cAAc;AAAA,IAChC,YAAY,MAAM;AAAA,EACpB;AACF;;;AE5UA,SAAS,6BAAkD;AAC3D,SAAS,yBAAyB;AAGlC,IAAM,0BAA0B,sBAAsB,UAAU;AAChE,IAAM,uBAAuB,oBAAI,QAAuD;AACxF,IAAM,kBAAkB,IAAI,kBAA0C;AAI/D,IAAM,kCAAN,cAA8C,MAAM;AAAA,EACzD,YACW,eACT,OACA;AACA;AAAA,MACE,gBACI,2CACA;AAAA,MACJ,EAAE,MAAM;AAAA,IACV;AARS;AAST,SAAK,OAAO;AAAA,EACd;AACF;AAEA,eAAsB,oCACpB,UACA,QACY;AACZ,QAAM,QAAQ,qBAAqB,IAAI,QAAQ;AAC/C,QAAM,UACJ,UAAU,UAAa,MAAM,QAAQ,SAAS,OAAO,MAAM,cAAc,SAAS;AACpF,QAAM,QAAQ,EAAE,WAAW,MAAM;AACjC,SAAO,MAAM,gBAAgB,IAAI,OAAO,YAAY;AAClD,QAAI;AACF,aAAO,MAAM,OAAO;AAAA,IACtB,SAAS,OAAO;AAId,YAAM,IAAI,gCAAgC,WAAW,CAAC,MAAM,WAAW,KAAK;AAAA,IAC9E;AAAA,EACF,CAAC;AACH;AAIO,IAAM,gCAAN,cAA4C,MAAM;AAAA,EACvD,YAAY,SAAiB,OAAiB;AAC5C,UAAM,4CAA4C,OAAO,IAAI,EAAE,MAAM,CAAC;AACtE,SAAK,OAAO;AAAA,EACd;AACF;AAIA,gBAAgB,UAAU,QAAiD;AACzE,QAAMC,WAAU,IAAI,YAAY,SAAS,EAAE,OAAO,MAAM,WAAW,KAAK,CAAC;AACzE,MAAI,QAAsB,CAAC;AAC3B,MAAI,SAAS;AACb,MAAI,QAAQ;AACZ,QAAM,SAAS,MAAM;AACnB,QAAI,OAAOA,SAAQ,OAAO,OAAO,OAAO,KAAK,CAAC;AAC9C,YAAQ,CAAC;AACT,QAAI,MAAO,QAAO,KAAK,QAAQ,YAAY,EAAE;AAC7C,YAAQ;AACR,WAAO;AAAA,EACT;AACA,SAAO,MAAM;AACX,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,QAAI,KAAM;AACV,QAAI,QAAQ;AACZ,aAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,YAAM,OAAO,MAAM,KAAK;AACxB,UAAI,QAAQ;AACV,iBAAS;AACT,YAAI,SAAS,IAAI;AACf,kBAAQ,QAAQ;AAChB;AAAA,QACF;AAAA,MACF;AACA,UAAI,SAAS,MAAM,SAAS,GAAI;AAChC,YAAM,KAAK,MAAM,SAAS,OAAO,KAAK,CAAC;AACvC,YAAM,EAAE,MAAM,OAAO,GAAG,YAAY,KAAK;AACzC,eAAS,SAAS;AAClB,cAAQ,QAAQ;AAAA,IAClB;AACA,QAAI,QAAQ,MAAM,OAAQ,OAAM,KAAK,MAAM,SAAS,KAAK,CAAC;AAAA,EAC5D;AACA,MAAI,MAAM,OAAQ,OAAM,EAAE,MAAM,OAAO,GAAG,YAAY,MAAM;AAC9D;AAKA,SAAS,mBAAmB,OAAsB;AAChD,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK;AAC5D,UAAM,IAAI,MAAM,gCAAgC;AAClD,QAAM,QAAQ;AACd,MAAI,aAAa;AACjB,aAAW,CAAC,SAAS,KAAK,KAAK;AAAA,IAC7B,CAAC,SAAS,MAAM;AAAA,IAChB,CAAC,UAAU,OAAO;AAAA,EACpB,GAAY;AACV,eAAW,SAAS,CAAC,SAAS,KAAK,GAAG;AACpC,UAAI,MAAM,KAAK,MAAM,OAAW;AAChC,mBAAa;AACb,UAAI,OAAO,MAAM,KAAK,MAAM,SAAU,OAAM,IAAI,MAAM,6BAA6B;AAAA,IACrF;AACA,QACE,MAAM,OAAO,MAAM,UACnB,MAAM,KAAK,MAAM,UACjB,MAAM,OAAO,MAAM,MAAM,KAAK;AAE9B,YAAM,IAAI,MAAM,qCAAqC;AAAA,EACzD;AACA,MAAI,MAAM,cAAc,QAAW;AACjC,iBAAa;AACb,QAAI,CAAC,MAAM,QAAQ,MAAM,SAAS,KAAK,MAAM,UAAU,KAAK,CAAC,SAAS,OAAO,SAAS,QAAQ;AAC5F,YAAM,IAAI,MAAM,iCAAiC;AAAA,EACrD;AACA,MAAI,CAAC,WAAY,OAAM,IAAI,MAAM,yBAAyB;AAC5D;AAEA,gBAAgB,cAAc,UAAgD;AAC5E,MAAI,CAAC,SAAS,KAAM,OAAM,IAAI,8BAA8B,uBAAuB;AACnF,QAAM,SAAS,SAAS,KAAK,UAAU;AACvC,QAAMC,WAAU,IAAI,YAAY;AAChC,MAAI,OAAiB,CAAC;AACtB,MAAI,cAA6B;AACjC,MAAI,YAAY;AAChB,MAAI,MAAM;AAEV,MAAI,OAAgC;AACpC,QAAMC,SAAQ,CAAC,SAAiB;AAC9B,UAAM,QAAiB,KAAK,MAAM,IAAI;AACtC,QAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK;AAC5D,YAAM,IAAI,MAAM,gCAAgC;AAClD,UAAM,QAAQ;AACd,QAAI,OAAO,MAAM,SAAS,SAAU,OAAM,IAAI,MAAM,4BAA4B;AAChF,QAAI,MAAM,SAAS,QAAQ;AACzB,UAAI,OAAO,MAAM,SAAS,YAAY,CAAC,MAAM,KAAK,KAAK;AACrD,cAAM,IAAI,MAAM,4BAA4B;AAC9C,UAAI,gBAAgB,QAAQ,MAAM,SAAS;AACzC,cAAM,IAAI,MAAM,kCAAkC;AACpD,oBAAc,MAAM;AAAA,IACtB;AACA,eAAW,SAAS,CAAC,MAAM,gBAAgB,aAAa,GAAY;AAClE,UAAI,MAAM,KAAK,MAAM,UAAa,MAAM,KAAK,MAAM;AACjD,cAAM,IAAI,MAAM,8BAA8B;AAAA,IAClD;AACA,SAAK,MAAM,SAAS,YAAY,MAAM,SAAS,aAAa,OAAO,MAAM,SAAS;AAChF,YAAM,IAAI,MAAM,wBAAwB;AAC1C,QAAI,MAAM,SAAS,QAAS,oBAAmB,MAAM,KAAK;AAC1D,QAAI,MAAM,SAAS,sBAAsB;AACvC,UAAI,gBAAgB,KAAM,OAAM,IAAI,MAAM,uCAAuC;AACjF,kBAAY;AAAA,IACd;AAGA,WAAOD,SAAQ,OAAO,SAAS,KAAK,UAAU,KAAK,CAAC;AAAA;AAAA,CAAM;AAAA,EAC5D;AACA,MAAI;AACF,qBAAiB,EAAE,MAAM,WAAW,KAAK,UAAU,MAAM,GAAG;AAC1D,UAAI,SAAS,QAAQ,QAAQ,CAAC,KAAK,WAAW,GAAG;AAC/C,eAAO,KAAK,UAAU,EAAE,WAAW,GAAG,IAAI,WAAW;AACvD,UAAI,SAAS,UAAU;AACrB,YAAI,KAAK,KAAK,EAAG,OAAMC,OAAM,IAAI;AACjC;AAAA,MACF;AACA,UAAI,CAAC,cAAc,QAAQ,CAAC,KAAK,WAAW,GAAG,EAAG,OAAM,IAAI,MAAM,oBAAoB;AACtF,UAAI,SAAS,IAAI;AACf,YAAI,KAAK,QAAQ;AACf,gBAAM,OAAO,KAAK,KAAK,IAAI;AAC3B,iBAAO,CAAC;AACR,gBAAMA,OAAM,IAAI;AAAA,QAClB;AACA;AAAA,MACF;AACA,UAAI,KAAK,WAAW,GAAG,EAAG;AAC1B,YAAM,QAAQ,KAAK,QAAQ,GAAG;AAC9B,YAAM,QAAQ,UAAU,KAAK,OAAO,KAAK,MAAM,GAAG,KAAK;AACvD,YAAM,QAAQ,UAAU,KAAK,KAAK,KAAK,MAAM,QAAQ,CAAC,EAAE,QAAQ,OAAO,EAAE;AACzE,UAAI,UAAU,OAAQ,MAAK,KAAK,KAAK;AAAA,IAEvC;AACA,UAAM;AACN,QAAI,KAAK,OAAQ,OAAM,IAAI,MAAM,qBAAqB;AACtD,QAAI,CAAC,UAAW,OAAM,IAAI,MAAM,gCAAgC;AAAA,EAClE,SAAS,OAAO;AACd,UAAM,iBAAiB,gCACnB,QACA,IAAI,8BAA8B,gCAAgC,KAAK;AAAA,EAC7E,UAAE;AACA,QAAI,CAAC,IAAK,OAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AACrD,WAAO,YAAY;AAAA,EACrB;AACF;AAEA,SAAS,mBAAmB,UAAsC;AAChE,QAAM,UAAW,OAAO,OAAO,SAAS;AACtC,UAAM,MAAM,iBAAiB,UAAU,MAAM,MAAM,OAAO,KAAK;AAC/D,UAAM,aACH,MAAM,WAAW,iBAAiB,UAAU,MAAM,SAAS,QAAQ,YAAY,MAC9E,UAAU,IAAI,IAAI,GAAG,EAAE,SAAS,SAAS,UAAU;AAGvD,UAAM,WAAW,gBAAgB,SAAS;AAC1C,QAAI,aAAa,SAAU,UAAS,YAAY;AAChD,UAAM,WAAW,MAAM,SAAS,OAAO,IAAI;AAC3C,QAAI,CAAC,SAAS,MAAM,CAAC,UAAW,QAAO;AACvC,QAAI,CAAC,SAAS,KAAM,OAAM,IAAI,8BAA8B,uBAAuB;AACnF,UAAM,SAAS,cAAc,QAAQ;AACrC,UAAM,OAAO,IAAI;AAAA,MACf;AAAA,QACE,MAAM,KAAK,YAAY;AACrB,cAAI;AACF,kBAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,gBAAI,KAAK,KAAM,YAAW,MAAM;AAAA,gBAC3B,YAAW,QAAQ,KAAK,KAAK;AAAA,UACpC,SAAS,OAAO;AACd,uBAAW,MAAM,KAAK;AAAA,UACxB;AAAA,QACF;AAAA,QACA,MAAM,SAAS;AACb,gBAAM,OAAO,OAAO,MAAS;AAAA,QAC/B;AAAA,MACF;AAAA;AAAA,MAEA,EAAE,eAAe,EAAE;AAAA,IACrB;AACA,UAAM,UAAU,IAAI,QAAQ,SAAS,OAAO;AAC5C,YAAQ,OAAO,gBAAgB;AAC/B,YAAQ,OAAO,kBAAkB;AACjC,YAAQ,IAAI,gBAAgB,mBAAmB;AAC/C,WAAO,IAAI,SAAS,MAAM;AAAA,MACxB,QAAQ,SAAS;AAAA,MACjB,YAAY,SAAS;AAAA,MACrB;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAIO,SAAS,kCAAkC,SAAyC;AACzF,SAAO;AAAA,IACL,sBAAsB,CAAC,YAAY,QAAQ,qBAAqB,OAAO;AAAA,IACvE,mBAAmB,CAAC,YAAY,QAAQ,kBAAkB,OAAO;AAAA,IACjE,iBAAiB,SAAS;AACxB,YAAM,WAAW,mBAAmB,QAAQ,iBAAiB,QAAQ;AACrE,YAAM,mBAAmB,QAAQ;AACjC,YAAM,QAAQ,iBAAiB,KAAK,SAAS;AAAA,QAC3C,GAAG;AAAA,QACH,kBAAkB,IAAI,MAAM,QAAQ,kBAAkB;AAAA,UACpD,IAAI,QAAQ,UAAU;AACpB,mBAAO,aAAa,aAAa,WAAW,QAAQ,IAAI,QAAQ,UAAU,MAAM;AAAA,UAClF;AAAA,QACF,CAAC;AAAA,MACH,CAAC;AACD,UAAI,qBAAqB,yBAAyB;AAGhD,6BAAqB,IAAI,MAAM,UAAU;AAAA,UACvC,KAAK,MAAM,SAAS;AAAA,UACpB,WAAW,MAAM,SAAS;AAAA,QAC5B,CAAC;AAAA,MACH;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;AHjMA,IAAM,iBAAiB;AACvB,IAAM,eAAe;AACrB,IAAM,gBAAgB;AACtB,IAAM,wBAAwB,CAAC,cAAc,aAAa;AAC1D,IAAMC,8BAA6B;AAInC,IAAM,8BAA8B;AACpC,IAAMC,qCAAoC;AAC1C,IAAM,4BAA4B;AAOlC,IAAI;AAEG,SAAS,wBAAwB,IAAgC;AACtE,sBAAoB;AACtB;AA8EA,SAAS,iBAAiB,OAAuB;AAC/C,QAAM,MAAM,IAAI,IAAI,KAAK;AACzB,MAAI,OAAO;AACX,MAAI,SAAS;AACb,MAAI,WAAW,IAAI,SAAS,QAAQ,SAAS,EAAE;AAC/C,SAAO,IAAI,SAAS,EAAE,QAAQ,QAAQ,EAAE;AAC1C;AAEA,SAAS,oBAAoB,SAAyB;AACpD,SAAOC,YAAW,QAAQ,EAAE,OAAO,iBAAiB,OAAO,CAAC,EAAE,OAAO,KAAK;AAC5E;AAEA,SAAS,kBAAkB,OAA0D;AACnF,SAAO;AAAA,IACL,QAAQ,iBAAiB,MAAM,OAAO;AAAA,IACtC,QAAQ,MAAM;AAAA,IACd,uBAAuB,MAAM;AAAA,IAC7B,gBAAgB,MAAM;AAAA,IACtB,gBAAgB;AAAA,EAClB;AACF;AAEA,eAAe,cACb,SACA,IACY;AACZ,QAAM,aAAa,IAAI,iBAAiB,kBAAkB,OAAO,CAAC,EAAE,uBAAuB;AAC3F,MAAI;AACF,UAAM,UAAU,QAAQ,kBAAkB,4BAA4B;AACtE,UAAM,QAAQ,QAAQ,qBAAqB;AAAA,MACzC,kBAAkB;AAAA,MAClB,kBAAkB,WAAW,WAAW;AAAA,IAC1C,CAAC;AACD,WAAO,MAAM,GAAG,MAAM,SAAS;AAAA,EACjC,UAAE;AACA,UAAM,WAAW,eAAe;AAAA,EAClC;AACF;AAEA,SAAS,WAAW,OAAyB;AAC3C,SAAO,iBAAiB,uBAAuB,MAAM,eAAe;AACtE;AAEA,SAAS,6BACP,MACA,WACM;AACN,QAAM,QAAQ,KAAK,QAAQ;AAC3B,MAAI,UAAU,aAAa,UAAU,YAAY;AAC/C,UAAM,IAAI,2CAA2C,eAAe,SAAS;AAAA,EAC/E;AACF;AAEA,SAAS,yBAAyB,OAAgD;AAChF,SAAO;AAAA,IACL,GAAG,IAAI;AAAA,OACJ,SAAS,CAAC,GAAG,OAAO,CAAC,SAAS,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,QAAQ,KAAM;AAAA,IACrF;AAAA,EACF,EAAE,KAAK,CAAC,MAAM,UAAU,OAAO,KAAK;AACtC;AAEA,SAAS,iBAAiB,MAAiE;AACzF,MAAI,KAAK,YAAa,KAAK,SAAgC,SAAS,QAAQ;AAC1E,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,2BACP,SACA,OACM;AACN,MAAI;AACF,aAAS,8BAA8B,KAAK;AAAA,EAC9C,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,cACP,SACA,aACsB;AACtB,QAAM,SAA+B;AAAA,IACnC,SAAS,QAAQ;AAAA,IACjB,KAAK;AAAA,IACL,UAAU,EAAE,UAAU,QAAQ,SAAS,cAAc;AAAA,IACrD,gBAAgB,QAAQ;AAAA,IACxB,kBAAkB,QAAQ;AAAA,IAC1B,GAAI,QAAQ,kBAAkB,EAAE,cAAc,KAAK,IAAI,CAAC;AAAA,EAC1D;AACA,MAAI,QAAQ,SAAS;AACnB,WAAO;AAAA,MACL,GAAG;AAAA,MACH,YAAY,EAAE,SAAS,QAAQ,QAAQ;AAAA,IACzC;AAAA,EACF;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,EAAE,KAAK,QAAQ,MAAM;AAAA,IAC5B,YAAY,CAAC,QAAQ,MAAM,WAAW;AAAA,EACxC;AACF;AAEA,SAAS,iBAAiB,OAAgB,OAAuB;AAC/D,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,GAAG;AAC1D,UAAM,IAAI,mBAAmB,eAAe,yBAAyB,KAAK,aAAa;AAAA,EACzF;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,OAAgB,OAA8B;AACzE,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,SAAO,iBAAiB,OAAO,KAAK;AACtC;AAEA,SAAS,0BACP,OACA,SACM;AACN,MAAI,MAAM,wBAAwB,oBAAoB,QAAQ,OAAO,GAAG;AACtE,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,MAAM,UAAU,QAAQ,OAAO;AACjC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,MAAM,aAAa,QAAQ,WAAW,OAAO;AAC/C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,qBAAqB,UAA2B;AACvD,SAAO,sBAAsB,KAAK,CAAC,SAAS,aAAa,QAAQ,SAAS,WAAW,GAAG,IAAI,GAAG,CAAC;AAClG;AAEA,SAAS,cAAc,MAAc,UAAsC,CAAC,GAAW;AACrF,QAAM,MAAM,KAAK,KAAK;AACtB,MAAI,IAAI,SAAS,IAAI,KAAK,IAAI,SAAS,IAAI,GAAG;AAC5C,UAAM,IAAI,0BAA0B,6BAA6B,IAAI,EAAE;AAAA,EACzE;AACA,QAAM,WAAW,IAAI,WAAW,GAAG,IAAIC,OAAM,UAAU,GAAG,IAAIA,OAAM,KAAK,gBAAgB,GAAG;AAC5F,QAAM,UACJ,aAAa,kBACb,SAAS,WAAW,GAAG,cAAc,GAAG,KACvC,QAAQ,iBAAiB,QAAQ,qBAAqB,QAAQ;AACjE,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR,qCAAqC,cAAc,GAAG,QAAQ,eAAe,OAAO,sBAAsB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,IAAI;AAAA,IACxI;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,MAAsB;AAClD,QAAM,WAAW,cAAc,IAAI;AACnC,SAAO,aAAa,iBAAiB,KAAK,SAAS,MAAM,eAAe,SAAS,CAAC;AACpF;AAEA,SAAS,uBAAuB,OAAiC;AAC/D,MAAI,OAAO,KAAK,GAAG;AACjB,UAAM,IAAI;AAAA,MACR,8DAA8D,MAAM,KAAK,CAAC;AAAA,IAC5E;AAAA,EACF;AACF;AAEA,SAAS,eAAe,MAA+B;AACrD,QAAM,iBAAiB,KAAK,OAAO,KAAK;AACxC,MAAI,CAAC,eAAgB,QAAO,KAAK;AACjC,SAAO,GAAG,WAAW,cAAc,CAAC,GAAG,KAAK,UAAU,QAAQ,KAAK,KAAK,OAAO,WAAW,KAAK,GAAG,CAAC;AACrG;AAEA,SAASC,OAAM,IAA2B;AACxC,SAAO,IAAI,QAAQ,CAACC,aAAY,WAAWA,UAAS,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;AACtE;AAEA,SAAS,qBAAqBC,UAU5B;AACA,QAAM,SAASA,SAAQ,OAAO,MAAMA,SAAQ,MAAM;AAClD,EAAAA,SAAQ,SAASA,SAAQ,OAAO;AAChC,QAAM,gBAAgB,OACnB,OAAO,CAAC,UAAU,MAAM,WAAW,YAAY,MAAM,kBAAkB,KAAK,EAC5E,IAAI,CAAC,UAAU,MAAM,IAAI,EACzB,KAAK,EAAE;AACV,QAAM,gBAAgB,OACnB,OAAO,CAAC,UAAU,MAAM,WAAW,YAAY,MAAM,kBAAkB,KAAK,EAC5E,IAAI,CAAC,UAAU,MAAM,IAAI,EACzB,KAAK,EAAE;AACV,QAAM,WAAW,EAAE,GAAGA,SAAQ,aAAa;AAC3C,EAAAA,SAAQ,aAAa,UAAU,OAAO,WAAW,aAAa;AAC9D,EAAAA,SAAQ,aAAa,UAAU,OAAO,WAAW,aAAa;AAC9D,SAAO;AAAA,IACL,QAAQ,OAAO,IAAI,CAAC,UAAU,MAAM,IAAI,EAAE,KAAK,EAAE;AAAA,IACjD,QAAQ,OACL,OAAO,CAAC,UAAU,MAAM,WAAW,QAAQ,EAC3C,IAAI,CAAC,UAAU,MAAM,IAAI,EACzB,KAAK,EAAE;AAAA,IACV,QAAQ,OACL,OAAO,CAAC,UAAU,MAAM,WAAW,QAAQ,EAC3C,IAAI,CAAC,UAAU,MAAM,IAAI,EACzB,KAAK,EAAE;AAAA,IACV;AAAA,IACA;AAAA,IACA,cAAc,EAAE,UAAU,MAAM,EAAE,GAAGA,SAAQ,aAAa,EAAE;AAAA,EAC9D;AACF;AAEA,SAAS,gBAAgB,OAA8B;AACrD,SAAO,UAAU,OAAO,OAAO,OAAO,KAAK;AAC7C;AAEO,SAAS,uBAA+B;AAC7C,SAAO,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAoHhB;AAEO,IAAM,qBAAN,MAAyB;AAAA,EACrB,YAAY;AAAA,EACZ;AAAA,EACQ;AAAA,EACjB,IAAI,6BAAsC;AACxC,WAAO,KAAK,QAAQ,oBAAoB;AAAA,EAC1C;AAAA,EACA,IAAI,iBAAkD;AACpD,WAAO,KAAK,QAAQ;AAAA,EACtB;AAAA,EACQ,WAAmC;AAAA,EACnC,eAAgD;AAAA,EAChD;AAAA,EACA,gBAAgB;AAAA,EACP,qBAAqB,oBAAI,IAA6B;AAAA,EACtD,kBAAkB,oBAAI,IAA6B;AAAA,EACnD,qBAAqB,oBAAI,QAAwC;AAAA,EACjE,uBAAuB,oBAAI,QAAyB;AAAA,EACpD,qBAAqB,oBAAI,IAAoC;AAAA,EAE9E,YAAY,MAIT;AACD,SAAK,QAAQ,KAAK;AAClB,SAAK,UAAU,KAAK;AACpB,SAAK,iBAAiB,KAAK,aAAa;AAAA,EAC1C;AAAA,EAEA,iBAAiB,QAA4C;AAC3D,iCAA6B,MAAM;AACnC,SAAK,gBAAgB;AAAA,EACvB;AAAA,EAEA,MAAc,gBAA0C;AACtD,QAAI,KAAK,SAAU,QAAO,KAAK;AAC/B,QAAI,CAAC,KAAK,cAAc;AACtB,WAAK,eAAe,gBAAgB,QAAQ;AAAA,QAC1C,kBAAkB,kBAAkB,KAAK,OAAO;AAAA,QAChD,WAAW,KAAK,MAAM;AAAA,QACtB,qBAAqB,KAAK,QAAQ;AAAA,QAClC,gBAAgB;AAAA,UACd,KAAK,QAAQ,kBAAkB,4BAA4B;AAAA,QAC7D;AAAA,MACF,CAAC,EACE,KAAK,OAAO,aAAa;AACxB,cAAM,OAAO,MAAM,SAAS,QAAQ;AACpC,qCAA6B,MAAM,KAAK,MAAM,SAAS;AACvD,YAAI,KAAK,OAAO,KAAK,MAAM,WAAW;AACpC,gBAAM,SAAS,MAAM,EAAE,MAAM,MAAM,MAAS;AAC5C,gBAAM,IAAI,qBAAqB,qDAAqD;AAAA,YAClF,mBAAmB,KAAK,MAAM;AAAA,YAC9B,iBAAiB,KAAK;AAAA,UACxB,CAAC;AAAA,QACH;AACA,cAAM,QAAQ,KAAK,OAAO;AAG1B,cAAM,wBACJ,UAAU,KAAK,MAAM,YAAY,QAAQ,UAAU,aAAa,QAAQ;AAC1E,YAAI,yBAAyB,0BAA0B,KAAK,MAAM,OAAO;AACvE,gBAAM,SAAS,MAAM,EAAE,MAAM,MAAM,MAAS;AAC5C,gBAAM,IAAI,qBAAqB,uDAAuD;AAAA,YACpF,WAAW,KAAK,MAAM;AAAA,UACxB,CAAC;AAAA,QACH;AACA,cAAM,UACJ,KAAK,cAAc,OAAO,KAAK,WAAW,YAAY,WAClD,KAAK,WAAW,UAChB;AACN,YAAI,YAAY,QAAQ,YAAY,KAAK,MAAM,SAAS;AACtD,gBAAM,SAAS,MAAM,EAAE,MAAM,MAAM,MAAS;AAC5C,gBAAM,IAAI,qBAAqB,sDAAsD;AAAA,YACnF,WAAW,KAAK,MAAM;AAAA,UACxB,CAAC;AAAA,QACH;AACA,aAAK,WAAW;AAChB,aAAK,MAAM,YAAY,KAAK,WAAW,YAAY,KAAK,KAAK,MAAM;AACnE,eAAO;AAAA,MACT,CAAC,EACA,MAAM,CAAC,UAAU;AAChB,aAAK,eAAe;AACpB,YAAI,WAAW,KAAK,GAAG;AACrB,gBAAM,IAAI;AAAA,YACR;AAAA,YACA,KAAK,MAAM;AAAA,UACb;AAAA,QACF;AACA,cAAM;AAAA,MACR,CAAC;AAAA,IACL;AACA,WAAO,MAAM,KAAK;AAAA,EACpB;AAAA,EAEA,MAAM,QAAuB;AAC3B,UAAM,KAAK,kCAAkC;AAAA,EAC/C;AAAA,EAEA,MAAM,UAA4B;AAChC,QAAI;AACF,aAAO,MAAM,cAAc,KAAK,SAAS,OAAO,cAAc;AAC5D,cAAM,OAAO,MAAM,UAAU,WAAW,KAAK,MAAM,SAAS;AAC5D,eAAO,KAAK,MAAM,kBAAkB,KAAK,OAAO,UAAU;AAAA,MAC5D,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,WAAW,KAAK,EAAG,QAAO;AAC9B,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,kBAA0C;AAC9C,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,QAAQ,aAAa,GAAI,EAAE,YAAY;AACpF,UAAM,WAAW,MAAM;AAAA,MACrB,KAAK;AAAA,MACL,OAAO,cACL,MAAM,UAAU,uBAAuB,KAAK,MAAM,WAAW;AAAA,QAC3D;AAAA,MACF,CAAC;AAAA,IACL;AACA,SAAK,MAAM,YAAY,SAAS,WAAW,YAAY,KAAK;AAC5D,WAAO,KAAK,MAAM;AAAA,EACpB;AAAA,EAEA,MAAM,SAAwB;AAC5B,QAAI;AACF,YAAM,cAAc,KAAK,SAAS,OAAO,cAAc;AACrD,cAAM,UAAU,cAAc,KAAK,MAAM,SAAS;AAAA,MACpD,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,CAAC,WAAW,KAAK,EAAG,OAAM;AAAA,IAChC,UAAE;AACA,YAAM,KAAK,MAAM;AAAA,IACnB;AAAA,EACF;AAAA,EAEA,MAAM,QAAuB;AAC3B,UAAM,WAAW,KAAK;AACtB,SAAK,WAAW;AAChB,SAAK,eAAe;AACpB,QAAI,SAAU,OAAM,SAAS,MAAM;AAAA,EACrC;AAAA,EAEA,cAAuB;AACrB,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,+BAA4D;AAChE,WAAO;AAAA,EACT;AAAA;AAAA;AAAA,EAIA,4BAA4B,QAAgD;AAC1E,WAAO,OAAO,WAAW,WACpB,KAAK,mBAAmB,IAAI,MAAM,KAAK,OACxC,UAAU,OAAO,WAAW,WACzB,KAAK,mBAAmB,IAAI,MAAM,KAAK,OACxC;AAAA,EACR;AAAA,EAEA,MAAM,yBAAyB,QAA+B;AAC5D,UAAM,OAAO,KAAK,mBAAmB,IAAI,MAAM;AAC/C,QAAI,QAAQ,CAAC,KAAK,sBAAuB,MAAK,mBAAmB,OAAO,MAAM;AAAA,EAChF;AAAA,EAEQ,cACNA,UACA,UACA,QACmB;AACnB,QAAI,kBAAkBA,SAAS,MAAK,qBAAqB,IAAI,QAAQA,SAAQ,YAAY;AACzF,SAAK,mBAAmB,IAAI,QAAQ;AAAA,MAClC,QAAQ,SAAS;AAAA,MACjB,QAAQ,SAAS;AAAA,MACjB,UAAU,OAAO,cAAc,OAAO,QAAQ,IAAI,OAAO,WAAY;AAAA,MACrE,GAAI,OAAO,cAAc,SAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;AAAA,MACxE,iBAAiB,OAAO;AAAA,MACxB,GAAIA,SAAQ,oBAAoB,EAAE,uBAAuB,KAAK,IAAI,CAAC;AAAA,MACnE,cAAc;AAAA,QACZ,UAAU,KAAK,UAAU,CAAC,KAAK,MAAM,WAAWA,SAAQ,IAAI,CAAC;AAAA,QAC7D,GAAG,SAAS;AAAA,MACd;AAAA,IACF,CAAC;AACD,WAAO;AAAA,EACT;AAAA,EAEQ,cAAc,QAAmC;AACvD,QAAI,SAAS,mBAAmB,MAAM;AACtC,UAAM,OAAO,KAAK,mBAAmB,IAAI,MAAM;AAC/C,QAAI,MAAM;AAGR,aAAO,KAAK,mBAAmB,IAAI,MAAM,EAAG,UAAS,mBAAmB,MAAM;AAC9E,WAAK,mBAAmB,IAAI,QAAQ,IAAI;AAAA,IAC1C;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,oCAAmD;AAC/D,UAAM,WAAW,MAAM,KAAK,cAAc;AAC1C,QAAI,KAAK,MAAM,eAAgB;AAC/B,UAAM,SAAS,MAAM,kBAAkB,CAAC,EAAE,MAAM,eAAe,CAAC,CAAC;AACjE,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,KAAK,MAAM,SAAS,OAAO,GAAG;AACvE,YAAM,KAAK,YAAY,MAAM,KAAK;AAAA,IACpC;AACA,SAAK,MAAM,iBAAiB;AAAA,EAC9B;AAAA,EACQ,aAAa,MAAwC;AAC3D,UAAM,OAAO,gBAAgB,KAAK,QAAQC,YAAW,CAAC;AACtD,QAAI;AACJ,UAAM,mBAAmB,IAAI,QAAuB,CAACF,aAAY;AAC/D,2BAAqBA;AAAA,IACvB,CAAC;AACD,UAAMC,WAA2B;AAAA,MAC/B;AAAA,MACA,WAAW;AAAA,MACX,UAAU;AAAA,MACV,iBAAiB;AAAA,MACjB,WAAW,KAAK,IAAI;AAAA,MACpB,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,MACR,aAAa;AAAA,MACb;AAAA,MACA;AAAA,MACA,WAAW,QAAQ,QAAQ,EAAE,UAAU,EAAE,CAAC;AAAA,MAC1C,SAAS;AAAA,MACT,oBAAoB;AAAA,MACpB,mBAAmB;AAAA,MACnB,cAAc,EAAE,QAAQ,GAAG,QAAQ,EAAE;AAAA,IACvC;AACA,QAAI,iBAAiB;AACrB,SAAK,gBAAgB,IAAI,MAAMA,QAAO;AAGtC,2CAAuC;AAAA,MACrC,mBAAmB,OAAO,kBAAkB;AAC1C,aAAK,wBAAwBA,UAAS,aAAa;AACnD,eAAO,MAAM,KAAK,sBAAsBA,QAAO;AAAA,MACjD;AAAA,MACA,oBAAoB,OAAO,kBAAkB;AAC3C,aAAK,wBAAwBA,UAAS,aAAa;AACnD,eAAO,MAAM,KAAK,uBAAuBA,QAAO;AAAA,MAClD;AAAA,IACF,CAAC;AACD,IAAAA,SAAQ,YAAY,KAAK,kCAAkC,EACxD,KAAK,YAAY;AAChB,YAAM,WAAW,MAAM,KAAK,cAAc;AAC1C,MAAAA,SAAQ,WAAW;AACnB,uBAAiB;AACjB,YAAM,YAAY,MAAM;AAAA,QAAoC,SAAS;AAAA,QAAU,MAC7E,SAAS,SAAS;AAAA,UAChB,eAAe,IAAI;AAAA,UACnB;AAAA,YACE,kBAAkB,KAAK,UAAU,cAAc,KAAK,OAAO,IAAI;AAAA,YAC/D,MAAM,KAAK,MAAM;AAAA,UACnB;AAAA,UACA;AAAA,YACE,QAAQ,CAAC,SAAS;AAChB,mBAAK,sBAAsBA,UAAS,KAAK,EAAE;AAAA,YAC7C;AAAA,YACA,SAAS,CAAC,UAAU;AAClB,kBAAI,CAAC,SAAS,OAAO,UAAU,SAAU;AACzC,oBAAM,SAAS;AACf,kBAAI,OAAO,SAAS,OAAQ,MAAK,sBAAsBA,UAAS,OAAO,IAAI;AAC3E,yBAAW,SAAS,CAAC,MAAM,gBAAgB,aAAa,GAAY;AAClE,oBAAI,OAAO,KAAK,MAAM,UAAa,OAAO,KAAK,MAAMA,SAAQ;AAC3D,wBAAM,IAAI,qBAAqB,6CAA6C;AAAA,cAChF;AAAA,YACF;AAAA,YACA,UAAU,CAAC,YAAY;AACrB,cAAAA,SAAQ,OAAO,KAAK,EAAE,QAAQ,UAAU,MAAM,QAAQ,KAAK,CAAC;AAAA,YAC9D;AAAA,YACA,UAAU,CAAC,YAAY;AACrB,cAAAA,SAAQ,OAAO,KAAK,EAAE,QAAQ,UAAU,MAAM,QAAQ,KAAK,CAAC;AAAA,YAC9D;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,WAAK,sBAAsBA,UAAS,UAAU,EAAE;AAChD,YAAM,WAAW,UAAU;AAC3B,UAAI,CAAC,UAAU,YAAY,CAAC,OAAO,cAAc,QAAQ,GAAG;AAG1D,QAAAA,SAAQ,oBAAoB;AAC5B,QAAAA,SAAQ,qBAAqB;AAC7B,eAAO,EAAE,UAAU,MAAM,WAAW,KAAK;AAAA,MAC3C;AACA,YAAM,UAAU;AAAA,QACd;AAAA,QACA,GAAI,UAAU,QAAQ,EAAE,OAAO,UAAU,MAAM,IAAI,CAAC;AAAA,MACtD;AACA,MAAAA,SAAQ,kBAAkB;AAC1B,aAAO;AAAA,IACT,CAAC,EACA,MAAM,CAAC,UAAU;AAChB,YAAM,gBACJ,iBAAiB,mCAAmC,MAAM;AAC5D,YAAM,QAAQ,iBAAiB,kCAAkC,MAAM,QAAQ;AAC/E,MAAAA,SAAQ,eAAe;AACvB,MAAAA,SAAQ,OAAO,KAAK;AAAA,QAClB,QAAQ;AAAA,QACR,MAAM,GAAG,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA;AAAA,QAC/D,eAAe;AAAA,MACjB,CAAC;AACD,UACEA,SAAQ,eACR,iBAAiB,iCAChB,kBAAkB,CAAC,eACpB;AACA,QAAAA,SAAQ,qBAAqB;AAC7B,QAAAA,SAAQ,oBAAoB;AAC5B,QAAAA,SAAQ,mBAAmBA,SAAQ,WAAW;AAG9C,eAAO,EAAE,UAAU,MAAM,OAAO,OAAO,WAAW,KAAK;AAAA,MACzD;AACA,UAAI,cAAe,oCAAmC,IAAI;AAC1D,MAAAA,SAAQ,mBAAmB,IAAI;AAC/B,aAAO,EAAE,UAAU,GAAG,OAAO,MAAM;AAAA,IACrC,CAAC,EACA,QAAQ,MAAM;AACb,UAAI,CAACA,SAAQ,oBAAoB;AAC/B,QAAAA,SAAQ,UAAU;AAClB,aAAK,gBAAgB,OAAO,IAAI;AAAA,MAClC;AAAA,IACF,CAAC;AACH,WAAOA;AAAA,EACT;AAAA,EAEQ,sBAAsBA,UAA0B,IAAmB;AACzE,QAAI,OAAO,OAAO,YAAY,CAAC,GAAG,KAAK;AACrC,YAAM,IAAI,8BAA8B,uCAAuC;AACjF,QAAIA,SAAQ,gBAAgB,QAAQA,SAAQ,gBAAgB;AAC1D,YAAM,IAAI,8BAA8B,qCAAqC;AAC/E,QAAIA,SAAQ,gBAAgB,MAAM;AAChC,MAAAA,SAAQ,cAAc;AACtB,MAAAA,SAAQ,mBAAmB,EAAE;AAAA,IAC/B;AAAA,EACF;AAAA,EAEQ,qBAAqB,UAAmB,aAA2B;AACzE,QAAI,aAAa;AACf,YAAM,IAAI,qBAAqB,8CAA8C;AAAA,EACjF;AAAA,EAEQ,wBAAwBA,UAA0B,MAAoB;AAC5E,QAAI,SAASA,SAAQ;AACnB,YAAM,IAAI,qBAAqB,yCAAyC;AAAA,EAC5E;AAAA,EAEQ,eAAeA,UAA2C;AAChE,QAAI,CAACA,SAAQ;AACX,YAAM,IAAI,qBAAqB,qDAAqD;AACtF,WAAOA,SAAQ;AAAA,EACjB;AAAA,EAEA,MAAc,sBAAsBA,UAA4C;AAC9E,QAAIA,SAAQ,gBAAiB,QAAO;AACpC,UAAM,cAAcA,SAAQ,eAAgB,MAAMA,SAAQ;AAC1D,QAAI,CAAC,YAAa,QAAOA,SAAQ;AACjC,UAAM,KAAK,eAAeA,QAAO,EAAE,SAAS,UAAU,WAAW;AAEjE,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,uBACZA,UACqC;AACrC,QAAI,CAACA,SAAQ,iBAAiB;AAC5B,YAAM,cAAcA,SAAQ;AAC5B,UAAI,CAAC,YAAa,QAAO,EAAE,QAAQ,UAAU;AAC7C,YAAME,UAAS,MAAM,KAAK,eAAeF,QAAO,EAAE,SAAS,iBAAiB,WAAW;AACvF,WAAK,qBAAqBE,QAAO,IAAI,WAAW;AAChD,UAAIA,QAAO,YAAY,SAAS,CAAC,OAAO,cAAcA,QAAO,QAAQ;AACnE,eAAO,EAAE,QAAQ,UAAU;AAC7B,MAAAF,SAAQ,kBAAkB,EAAE,UAAUE,QAAO,SAAU;AAAA,IACzD;AACA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ,EAAE,UAAUF,SAAQ,gBAAgB,SAAS;AAAA;AAAA;AAAA;AAAA,MAIrD,SAAS,IAAI;AAAA,QACXA,SAAQ;AAAA,QACR,EAAE,QAAQ,IAAI,QAAQ,GAAG;AAAA,QACzB,IAAI,MAAM,wEAAwE;AAAA,MACpF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,mBAAmB,MAAmD;AAC1E,UAAMA,WAAU,KAAK,gBAAgB,IAAI,IAAI;AAC7C,QAAI,CAACA,SAAS,OAAM,IAAI,qBAAqB,uCAAuC;AACpF,WAAO,MAAM,KAAK,uBAAuBA,QAAO;AAAA,EAClD;AAAA,EAEA,MAAc,gCAAgCA,UAAmD;AAC/F,UAAM,cAAcA,SAAQ,eAAgB,MAAMA,SAAQ;AAC1D,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAW,KAAK,eAAeA,QAAO;AAC5C,WAAO,MAAM;AACX,UAAI;AACF,cAAME,UAAS,MAAM,SAAS,SAAS,iBAAiB,WAAW;AACnE,aAAK,qBAAqBA,QAAO,IAAI,WAAW;AAChD,YAAIA,QAAO,YAAY,SAAS,OAAO,cAAcA,QAAO,QAAQ,GAAG;AACrE,cAAIA,QAAO,OAAO;AAChB,YAAAF,SAAQ,OAAO,KAAK;AAAA,cAClB,QAAQ;AAAA,cACR,MAAM,GAAGE,QAAO,KAAK;AAAA;AAAA,cACrB,eAAe;AAAA,YACjB,CAAC;AAAA,UACH;AACA,UAAAF,SAAQ,UAAU;AAClB,UAAAA,SAAQ,qBAAqB;AAC7B,UAAAA,SAAQ,kBAAkB;AAAA,YACxB,UAAUE,QAAO;AAAA,YACjB,GAAIA,QAAO,QAAQ,EAAE,OAAOA,QAAO,MAAM,IAAI,CAAC;AAAA,UAChD;AACA,eAAK,gBAAgB,OAAOF,SAAQ,IAAI;AACxC,iBAAOA,SAAQ;AAAA,QACjB;AAAA,MACF,QAAQ;AAAA,MAIR;AACA,YAAMF,OAAMH,kCAAiC;AAAA,IAC/C;AAAA,EACF;AAAA,EAEA,MAAc,iBAAiB,MAAmD;AAChF,QAAI,KAAK,KAAK;AACZ,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,2BAAuB,KAAK,KAAK;AACjC,QAAI,KAAK,QAAS,eAAc,KAAK,OAAO;AAC5C,UAAMK,WAAU,KAAK,aAAa,IAAI;AACtC,QAAI,UAAU,MAAMA,SAAQ;AAC5B,QAAI,QAAQ,WAAW;AACrB,gBAAU,MAAM,KAAK,gCAAgCA,QAAO;AAAA,IAC9D;AACA,UAAM,WAAW,qBAAqBA,QAAO;AAC7C,UAAM,SAAS,eAAe,SAAS,QAAQ,KAAK,eAAe;AACnE,QAAI,QAAQ,SAAS,CAACA,SAAQ,YAAa,OAAM,QAAQ;AACzD,WAAO,KAAK,cAAcA,UAAS,UAAU;AAAA,MAC3C,QAAQ,OAAO;AAAA,MACf,QAAQ,SAAS;AAAA,MACjB,QAAQ,SAAS;AAAA,MACjB,iBAAiB,eAAeA,SAAQ,SAAS;AAAA,MACjD,UAAU,QAAQ;AAAA,MAClB,GAAI,OAAO,uBAAuB,SAC9B,EAAE,oBAAoB,OAAO,mBAAmB,IAChD,CAAC;AAAA,IACP,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,KAAK,MAAmD;AAC5D,QAAI,KAAK,KAAK;AACZ,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,2BAAuB,KAAK,KAAK;AACjC,QAAI,KAAK,QAAS,eAAc,KAAK,OAAO;AAC5C,UAAMA,WAAU,KAAK,aAAa,IAAI;AACtC,UAAM,mBAAmB,KAAK,eAAeN;AAC7C,UAAM,cACJ,oBAAoBA,8BAChB,mBAAmB,8BACnB;AACN,UAAM,UAAU,MAAM,QAAQ,KAAK;AAAA,MACjCM,SAAQ,UAAU,KAAK,CAAC,WAAW,EAAE,MAAM,MAAe,MAAM,EAAE;AAAA,MAClEF,OAAM,WAAW,EAAE,KAAK,OAAO,EAAE,MAAM,MAAe,EAAE;AAAA,IAC1D,CAAC;AACD,UAAM,WAAW,qBAAqBE,QAAO;AAC7C,UAAM,SAAS,eAAe,SAAS,QAAQ,KAAK,eAAe;AACnE,QAAI,QAAQ,MAAM;AAChB,UAAI,QAAQ,MAAM,WAAW;AAC3B,cAAMG,aAAY,KAAK;AACvB,QAAAH,SAAQ,YAAYG;AACpB,aAAK,mBAAmB,IAAIA,YAAWH,QAAO;AAC9C,eAAO,KAAK,cAAcA,UAAS,UAAU;AAAA,UAC3C,QAAQ,OAAO;AAAA,UACf,QAAQ,SAAS;AAAA,UACjB,QAAQ,SAAS;AAAA,UACjB,iBAAiB,eAAeA,SAAQ,SAAS;AAAA,UACjD,WAAAG;AAAA,UACA,GAAI,OAAO,uBAAuB,SAC9B,EAAE,oBAAoB,OAAO,mBAAmB,IAChD,CAAC;AAAA,QACP,CAAC;AAAA,MACH;AACA,UAAI,QAAQ,MAAM,SAAS,CAACH,SAAQ,YAAa,OAAM,QAAQ,MAAM;AACrE,aAAO,KAAK,cAAcA,UAAS,UAAU;AAAA,QAC3C,QAAQ,OAAO;AAAA,QACf,QAAQ,SAAS;AAAA,QACjB,QAAQ,SAAS;AAAA,QACjB,iBAAiB,eAAeA,SAAQ,SAAS;AAAA,QACjD,UAAU,QAAQ,MAAM;AAAA,QACxB,GAAI,OAAO,uBAAuB,SAC9B,EAAE,oBAAoB,OAAO,mBAAmB,IAChD,CAAC;AAAA,MACP,CAAC;AAAA,IACH;AACA,UAAM,YAAY,KAAK;AACvB,IAAAA,SAAQ,YAAY;AACpB,SAAK,mBAAmB,IAAI,WAAWA,QAAO;AAC9C,WAAO,KAAK,cAAcA,UAAS,UAAU;AAAA,MAC3C,QAAQ,OAAO;AAAA,MACf,QAAQ,SAAS;AAAA,MACjB,QAAQ,SAAS;AAAA,MACjB,iBAAiB,eAAeA,SAAQ,SAAS;AAAA,MACjD;AAAA,MACA,GAAI,OAAO,uBAAuB,SAC9B,EAAE,oBAAoB,OAAO,mBAAmB,IAChD,CAAC;AAAA,IACP,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,YAAY,MAAwC;AACxD,WAAO,KAAK,cAAc,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,EACjD;AAAA,EAEA,mBAAmB,mBAAoC;AACrD,WAAO,KAAK,mBAAmB,IAAI,iBAAiB;AAAA,EACtD;AAAA,EAEA,MAAM,kBAAkB,MAAgC;AACtD,UAAMA,WAAU,KAAK,gBAAgB,IAAI,IAAI;AAC7C,QAAI,CAACA,SAAS,QAAO;AACrB,WAAO,MAAM,KAAK,sBAAsBA,QAAO;AAAA,EACjD;AAAA,EAEA,MAAM,WAAW,MAAuC;AACtD,UAAMA,WAAU,KAAK,mBAAmB,IAAI,KAAK,SAAS;AAC1D,QAAI,CAACA,UAAS;AACZ,aAAO,mBAAmB;AAAA,QACxB,QAAQ,0CAA0C,KAAK,SAAS;AAAA,QAChE,iBAAiB;AAAA,QACjB,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AACA,UAAM,QAAQ,KAAK,SAAS;AAC5B,UAAM,mBAAmB,MAAM,WAAW,KAAU,EAAE;AACtD,QAAI,iBAAiB,SAAS,GAAG;AAC/B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,YAAY,KAAK,IAAI;AAC3B,QAAI,MAAM,SAAS,GAAQ,GAAG;AAC5B,YAAM,cAAcA,SAAQ,eAAgB,MAAMA,SAAQ;AAC1D,UAAI,aAAa;AACf,cAAM,WAAW,KAAK,eAAeA,QAAO;AAC5C,cAAM,SAAS,SAAS,UAAU,WAAW;AAAA,MAC/C;AAAA,IACF;AACA,QAAIA,SAAQ,oBAAoB;AAC9B,YAAM,cAAcA,SAAQ;AAC5B,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,YAAM,WAAW,KAAK,eAAeA,QAAO;AAC5C,YAAME,UAAS,MAAM,SAAS,SAAS,iBAAiB,WAAW;AACnE,WAAK,qBAAqBA,QAAO,IAAI,WAAW;AAChD,UAAIA,QAAO,OAAO;AAChB,QAAAF,SAAQ,OAAO,KAAK,EAAE,QAAQ,UAAU,MAAM,GAAGE,QAAO,KAAK;AAAA,GAAM,eAAe,MAAM,CAAC;AAAA,MAC3F;AACA,YAAME,YAAW,qBAAqBJ,QAAO;AAC7C,YAAMK,UAAS,eAAeD,UAAS,QAAQ,KAAK,eAAe;AACnE,UAAIF,QAAO,YAAY,SAAS,CAAC,OAAO,cAAcA,QAAO,QAAQ,GAAG;AACtE,eAAO,KAAK;AAAA,UACV,KAAK,cAAcF,UAASI,WAAU;AAAA,YACpC,QAAQC,QAAO;AAAA,YACf,QAAQD,UAAS;AAAA,YACjB,QAAQA,UAAS;AAAA,YACjB,iBAAiB,eAAe,SAAS;AAAA,YACzC,WAAW,KAAK;AAAA,YAChB,GAAIC,QAAO,uBAAuB,SAC9B,EAAE,oBAAoBA,QAAO,mBAAmB,IAChD,CAAC;AAAA,UACP,CAAC;AAAA,QACH;AAAA,MACF;AACA,MAAAL,SAAQ,UAAU;AAClB,MAAAA,SAAQ,kBAAkB,EAAE,UAAUE,QAAO,SAAU;AACvD,WAAK,mBAAmB,OAAO,KAAK,SAAS;AAC7C,WAAK,gBAAgB,OAAOF,SAAQ,IAAI;AACxC,aAAO,KAAK;AAAA,QACV,KAAK,cAAcA,UAASI,WAAU;AAAA,UACpC,QAAQC,QAAO;AAAA,UACf,QAAQD,UAAS;AAAA,UACjB,QAAQA,UAAS;AAAA,UACjB,iBAAiB,eAAe,SAAS;AAAA,UACzC,UAAUF,QAAO;AAAA,UACjB,GAAIG,QAAO,uBAAuB,SAC9B,EAAE,oBAAoBA,QAAO,mBAAmB,IAChD,CAAC;AAAA,QACP,CAAC;AAAA,MACH;AAAA,IACF;AACA,UAAM,UAAU,MAAM,QAAQ,KAAK;AAAA,MACjCL,SAAQ,UAAU,KAAK,CAAC,WAAW,EAAE,MAAM,MAAe,MAAM,EAAE;AAAA,MAClEF,OAAM,KAAK,eAAeH,kCAAiC,EAAE,KAAK,OAAO;AAAA,QACvE,MAAM;AAAA,MACR,EAAE;AAAA,IACJ,CAAC;AACD,UAAM,WAAW,qBAAqBK,QAAO;AAC7C,UAAM,SAAS,eAAe,SAAS,QAAQ,KAAK,eAAe;AACnE,QAAI,QAAQ,MAAM;AAGhB,UAAI,CAAC,QAAQ,MAAM,UAAW,MAAK,mBAAmB,OAAO,KAAK,SAAS;AAC3E,aAAO,KAAK;AAAA,QACV,KAAK,cAAcA,UAAS,UAAU;AAAA,UACpC,QAAQ,OAAO;AAAA,UACf,QAAQ,SAAS;AAAA,UACjB,QAAQ,SAAS;AAAA,UACjB,iBAAiB,eAAe,SAAS;AAAA,UACzC,GAAI,QAAQ,MAAM,YACd,EAAE,WAAW,KAAK,UAAU,IAC5B,EAAE,UAAU,QAAQ,MAAM,SAAS;AAAA,UACvC,GAAI,OAAO,uBAAuB,SAC9B,EAAE,oBAAoB,OAAO,mBAAmB,IAChD,CAAC;AAAA,QACP,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO,KAAK;AAAA,MACV,KAAK,cAAcA,UAAS,UAAU;AAAA,QACpC,QAAQ,OAAO;AAAA,QACf,QAAQ,SAAS;AAAA,QACjB,QAAQ,SAAS;AAAA,QACjB,iBAAiB,eAAe,SAAS;AAAA,QACzC,WAAW,KAAK;AAAA,QAChB,GAAI,OAAO,uBAAuB,SAC9B,EAAE,oBAAoB,OAAO,mBAAmB,IAChD,CAAC;AAAA,MACP,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,4BAA4B,MAAuC;AACvE,WAAO,MAAM,KAAK,WAAW,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,SAAS,MAAgF;AAC7F,2BAAuB,KAAK,KAAK;AACjC,UAAM,WAAW,cAAc,KAAK,MAAM,EAAE,cAAc,KAAK,CAAC;AAChE,UAAM,OAAO,CAAC,gBAAgB,GAAG,qBAAqB,EAAE;AAAA,MACtD,CAAC,cAAc,aAAa,aAAa,SAAS,WAAW,GAAG,SAAS,GAAG;AAAA,IAC9E;AACA,UAAM,WAAW,KAAK,YAAY,MAAM,OAAO;AAC/C,QAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,WAAW,KAAK,WAAW,MAAM,OAAO,MAAM;AACnF,YAAM,IAAI,0BAA0B,qCAAqC;AAAA,IAC3E;AACA,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,KAAK,wBAAwB,MAAM,SAAS,MAAM,KAAK,SAAS,CAAC,GAAG,QAAQ;AAAA,MAC5E,OAAO;AAAA,MACP,aAAa;AAAA,MACb,iBAAiB,KAAK,KAAM,WAAW,IAAK,CAAC,IAAI;AAAA,IACnD,CAAC;AACD,QAAI,OAAO,aAAa,IAAI;AAC1B,YAAM,IAAI,kCAAkC,sCAAsC;AAAA,IACpF;AACA,QAAI,OAAO,aAAa,IAAI;AAC1B,YAAM,IAAI,0BAA0B,uDAAuD;AAAA,IAC7F;AACA,UAAM,QACJ,OAAO,cAAc,UAAa,OAAO,aAAa,IAClD,sBAAsB,OAAO,QAAQ,QAAQ,IAC7C;AACN,QAAI,CAAC,OAAO;AAGV,UAAI,KAAK,qBAAqB,IAAI,MAAM,EAAG,OAAM,KAAK,qBAAqB,IAAI,MAAM;AACrF,YAAM,IAAI,qBAAqB,4CAA4C;AAAA,IAC7E;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,2BACZ,UACA,OACgB;AAChB,QAAI,WAAW,KAAK,GAAG;AAGrB,YAAM,OAAO,MAAM,SAAS,QAAQ;AACpC,mCAA6B,MAAM,KAAK,MAAM,SAAS;AACvD,UAAI,KAAK,OAAO,KAAK,MAAM,WAAW;AACpC,cAAM,IAAI,kCAAkC,sCAAsC;AAAA,MACpF;AAAA,IACF;AACA,UAAM;AAAA,EACR;AAAA,EAEA,MAAM,UAAU,MAKI;AAClB,QAAI,KAAK,QAAQ;AACf,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAW,MAAM,KAAK,cAAc;AAC1C,UAAM,SAAS,cAAc,KAAK,MAAM,EAAE,cAAc,KAAK,CAAC;AAC9D,QAAI,KAAK,iBAAiB,MAAM;AAC9B,YAAM,SAAS,MAAM,kBAAkB,CAAC,EAAE,MAAMH,OAAM,QAAQ,MAAM,EAAE,CAAC,CAAC;AAAA,IAC1E;AACA,UAAM,SAAS,MAAM,WAAW,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,QAAQ,CAAC,CAAC;AACtE,WAAO,OAAO,KAAK,YAAY,WAC3B,IAAI,YAAY,EAAE,OAAO,KAAK,OAAO,EAAE,aACvC,KAAK,QAAQ;AAAA,EACnB;AAAA,EAEA,MAAM,WAAW,MAAc,OAAkC;AAC/D,2BAAuB,KAAK;AAC5B,UAAM,WAAW,MAAM,KAAK,cAAc;AAC1C,UAAM,SAAS,cAAc,MAAM,EAAE,cAAc,KAAK,CAAC;AACzD,QAAI;AACF,YAAM,OAAO,MAAM,SAAS,MAAM,YAAY,CAAC,MAAM,CAAC;AACtD,aAAO,QAAQ,KAAK,MAAM,CAAC;AAAA,IAC7B,SAAS,OAAO;AACd,UAAI,WAAW,KAAK,EAAG,QAAO;AAC9B,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,MAA0E;AACtF,2BAAuB,KAAK,KAAK;AACjC,UAAM,WAAW,MAAM,KAAK,cAAc;AAC1C,UAAM,WAAW,cAAc,KAAK,IAAI;AACxC,UAAM,iBAAiB,KAAK,KAAK,KAAK,EAAE,WAAW,GAAG;AACtD,UAAM,UAAU,MAAM,SAAS,MAC5B,cAAc;AAAA,MACb,MAAM;AAAA,MACN,OAAO;AAAA,IACT,CAAC,EACA,MAAM,CAAC,UAAU,KAAK,2BAA2B,UAAU,KAAK,CAAC;AACpE,WAAO,QAAQ,IAAI,CAAC,UAAU;AAC5B,YAAM,YAAY,cAAc,MAAM,IAAI;AAC1C,aAAO;AAAA,QACL,MAAMA,OAAM,SAAS,SAAS;AAAA,QAC9B,MAAM,iBACF,YACA,cAAc,iBACZ,KACA,UAAU,MAAM,eAAe,SAAS,CAAC;AAAA,QAC/C,MAAM,MAAM,SAAS,cAAc,QAAQ,MAAM,SAAS,SAAS,SAAS;AAAA,MAC9E;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,UAAU,MAAqB;AACnC,2BAAuB,KAAK,KAAK;AACjC,UAAM,QAAQ,MAAM,KAAK,SAAS,EAAE,MAAM,KAAK,KAAK,CAAC;AACrD,WAAO,qBAAqB,KAAK,MAAM,KAAK;AAAA,EAC9C;AAAA,EAEA,MAAc,WAAW,MAA6B;AACpD,UAAM,WAAW,MAAM,KAAK,cAAc;AAC1C,UAAM,SAAS,cAAc,MAAM,EAAE,cAAc,KAAK,CAAC;AACzD,UAAM,OAAO,MAAM,SAAS,MAAM,YAAY,CAAC,MAAM,CAAC;AACtD,UAAM,QAAQ,KAAK,MAAM;AACzB,QAAI,CAAC,MAAO;AACZ,QAAI,MAAM,SAAS,YAAa,OAAM,SAAS,MAAM,kBAAkB,CAAC,MAAM,CAAC;AAAA,QAC1E,OAAM,SAAS,MAAM,YAAY,CAAC,MAAM,CAAC;AAAA,EAChD;AAAA,EAEA,aAAa,OAAmC;AAC9C,2BAAuB,KAAK;AAC5B,UAAM,YAAY;AAClB,QAAI,CAAC,WAAW;AACd,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAMS,YAAW,OAAO,SACtB,IAAI,YAAY,EAAE,OAAO,MAAM,KAAK,SAAS,EAAE,KAAK,CAAC,CAAC;AACxD,WAAO;AAAA,MACL,YAAY,OAAO,cAAc;AAC/B,YAAI,MAAM,KAAK,WAAW,UAAU,IAAI,GAAG;AACzC,gBAAM,IAAI,MAAM,gDAAgD,UAAU,IAAI,EAAE;AAAA,QAClF;AACA,cAAM,KAAK,UAAU;AAAA,UACnB,MAAM,UAAU;AAAA,UAChB,SAAS,UAAU,IAAI,UAAU,MAAM,QAAQ;AAAA,UAC/C,eAAe;AAAA,QACjB,CAAC;AACD,eAAO,CAAC;AAAA,MACV;AAAA,MACA,YAAY,OAAO,cAAc;AAC/B,cAAM,OAAO,UAAU,MAAMA,UAAS,UAAU,IAAI,GAAG,UAAU,IAAI;AACrE,cAAM,cAAc,UAAU,UAAU,UAAU;AAClD,cAAM,KAAK,UAAU;AAAA,UACnB,MAAM;AAAA,UACN,SAAS;AAAA,UACT,eAAe;AAAA,QACjB,CAAC;AACD,YAAI,UAAU,UAAU,UAAU,WAAW,UAAU,MAAM;AAC3D,gBAAM,KAAK,WAAW,UAAU,IAAI;AAAA,QACtC;AACA,eAAO,CAAC;AAAA,MACV;AAAA,MACA,YAAY,OAAO,cAAc;AAC/B,cAAM,KAAK,WAAW,UAAU,IAAI;AACpC,eAAO,CAAC;AAAA,MACV;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,iBAAiB,MAAc,OAA6B;AACxE,QAAI,MAAM,UAAU,QAAW;AAC7B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,MAAM,gBAAgB,OAAW;AACrC,UAAM,WAAW,MAAM,KAAK,cAAc;AAC1C,UAAM,SAAS,MAAM,eAAe;AAAA,MAClC,EAAE,MAAM,MAAM,IAAI,YAAY,MAAM,WAAW,EAAE,OAAO,IAAI,IAAM;AAAA,IACpE,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,mBAAmB,QAAgB,aAAoC;AACnF,UAAM,QAAQ,MAAMC,OAAM,MAAM;AAChC,QAAI,MAAM,eAAe,GAAG;AAC1B,YAAM,IAAI;AAAA,QACR,0DAA0D,MAAM;AAAA,MAClE;AAAA,IACF;AACA,QAAI,CAAC,MAAM,YAAY,GAAG;AACxB,YAAM,IAAI;AAAA,QACR,oDAAoD,MAAM;AAAA,MAC5D;AAAA,IACF;AACA,UAAM,WAAW,MAAM,KAAK,cAAc;AAC1C,UAAM,SAAS,MAAM,kBAAkB,CAAC,EAAE,MAAM,YAAY,CAAC,CAAC;AAC9D,UAAM,UAAU,MAAMC,SAAQ,QAAQ,EAAE,eAAe,KAAK,CAAC;AAC7D,eAAW,SAAS,SAAS;AAC3B,YAAM,aAAa,GAAG,OAAO,QAAQ,QAAQ,EAAE,CAAC,IAAI,MAAM,IAAI;AAC9D,YAAM,kBAAkBX,OAAM,KAAK,aAAa,MAAM,IAAI;AAC1D,UAAI,MAAM,eAAe,GAAG;AAC1B,cAAM,IAAI;AAAA,UACR,0DAA0D,UAAU;AAAA,QACtE;AAAA,MACF;AACA,UAAI,MAAM,YAAY,GAAG;AACvB,cAAM,KAAK,mBAAmB,YAAY,eAAe;AAAA,MAC3D,WAAW,MAAM,OAAO,GAAG;AACzB,cAAM,SAAS,MAAM,WAAW;AAAA,UAC9B;AAAA,YACE,MAAM;AAAA,YACN,MAAM,IAAI,WAAW,MAAM,cAAc,UAAU,CAAC;AAAA,UACtD;AAAA,QACF,CAAC;AAAA,MACH,OAAO;AACL,cAAM,IAAI;AAAA,UACR,mEAAmE,UAAU;AAAA,QAC/E;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,YAAY,MAAc,OAA6B;AACnE,UAAM,SAAS,cAAc,IAAI;AACjC,UAAM,WAAW,MAAM,KAAK,cAAc;AAC1C,QAAI,MAAM,SAAS,OAAO;AACxB,YAAM,SAAS,MAAM,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,CAAC;AACzD,iBAAW,CAAC,WAAW,KAAK,KAAK,OAAO,QAAQ,MAAM,YAAY,CAAC,CAAC,GAAG;AACrE,cAAM,KAAK,YAAYA,OAAM,KAAK,MAAM,SAAS,GAAG,KAAK;AAAA,MAC3D;AACA,YAAM,KAAK,iBAAiB,QAAQ,KAAK;AACzC;AAAA,IACF;AACA,QAAI,MAAM,SAAS,QAAQ;AACzB,YAAM,SAAS,MAAM,kBAAkB,CAAC,EAAE,MAAMA,OAAM,QAAQ,MAAM,EAAE,CAAC,CAAC;AACxE,YAAM,SAAS,MAAM,WAAW,CAAC,EAAE,MAAM,QAAQ,MAAM,MAAM,QAAQ,CAAC,CAAC;AACvE,YAAM,KAAK,iBAAiB,QAAQ,KAAK;AACzC;AAAA,IACF;AACA,QAAI,MAAM,SAAS,cAAc;AAC/B,YAAM,QAAQ,MAAMU,OAAM,MAAM,GAAG;AACnC,UAAI,CAAC,MAAM,OAAO,KAAK,MAAM,eAAe,GAAG;AAC7C,cAAM,IAAI;AAAA,UACR,qEAAqE,MAAM,GAAG;AAAA,QAChF;AAAA,MACF;AACA,YAAM,SAAS,MAAM,kBAAkB,CAAC,EAAE,MAAMV,OAAM,QAAQ,MAAM,EAAE,CAAC,CAAC;AACxE,YAAM,SAAS,MAAM,WAAW;AAAA,QAC9B,EAAE,MAAM,QAAQ,MAAM,IAAI,WAAW,MAAM,cAAc,MAAM,GAAG,CAAC,EAAE;AAAA,MACvE,CAAC;AACD,YAAM,KAAK,iBAAiB,QAAQ,KAAK;AACzC;AAAA,IACF;AACA,QAAI,MAAM,SAAS,aAAa;AAC9B,YAAM,KAAK,mBAAmB,MAAM,KAAK,MAAM;AAC/C,YAAM,KAAK,iBAAiB,QAAQ,KAAK;AACzC;AAAA,IACF;AACA,QAAI,MAAM,SAAS,YAAY;AAC7B,YAAM,OAAO,qBAAqBI,YAAW,CAAC;AAC9C,YAAM,UAAU,MAAM,UAAU,sBAAsB,MAAM,OAAO,IAAI;AACvE,YAAM,SAAS;AAAA,QACb;AAAA,QACA,aAAa,WAAW,IAAI,CAAC,IAAI,WAAW,MAAM,CAAC;AAAA,QACnD,qCAAqC,WAAW,MAAM,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC;AAAA,QAC/E,GAAI,MAAM,MACN;AAAA,UACE,UAAU,WAAW,IAAI,CAAC,2BAA2B,WAAW,MAAM,GAAG,CAAC;AAAA,UAC1E,UAAU,WAAW,IAAI,CAAC;AAAA,QAC5B,IACA,CAAC,UAAU,WAAW,IAAI,CAAC,yBAAyB;AAAA,QACxD,UACI,eAAe,WAAW,MAAM,CAAC,gBAAgB,WAAW,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,WAAW,MAAM,CAAC,KACzG,SAAS,WAAW,IAAI,CAAC,IAAI,WAAW,MAAM,CAAC;AAAA,QACnD,UAAU,aAAa,WAAW,IAAI,CAAC,KAAK;AAAA,MAC9C,EAAE,KAAK,IAAI;AACX,YAAM,SAAS,MAAM,KAAK,iBAAiB;AAAA,QACzC,KAAK;AAAA,QACL,iBAAiB;AAAA,MACnB,CAAC;AACD,UAAI,OAAO,OAAO,aAAa,YAAY,OAAO,aAAa,GAAG;AAChE,cAAM,IAAI,qBAAqB,qDAAqD;AAAA,UAClF;AAAA,UACA,UAAU,OAAO,YAAY;AAAA,QAC/B,CAAC;AAAA,MACH;AACA,YAAM,KAAK,iBAAiB,QAAQ,KAAK;AACzC;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,8DAA8D,MAAM,IAAI;AAAA,IAC1E;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,MAA2C;AAChE,2BAAuB,KAAK,KAAK;AACjC,UAAM,cAAc,qBAAqB,KAAK,IAAI;AAClD,UAAM,KAAK,YAAY,aAAa,KAAK,KAAK;AAC9C,SAAK,MAAM,WAAW,wBAAwB,KAAK,MAAM,UAAU,aAAa,KAAK,KAAK;AAAA,EAC5F;AAAA,EAEA,MAAM,cAAc,UAAoB,OAA+B;AACrE,2BAAuB,KAAK;AAC5B,UAAM,KAAK,kCAAkC;AAC7C,QAAI,SAAS,SAAS,KAAK,MAAM,SAAS,MAAM;AAC9C,YAAM,IAAI;AAAA,QACR,yCAAyC,KAAK,MAAM,SAAS,IAAI;AAAA,MACnE;AAAA,IACF;AACA,QACE,SAAS,MAAM,SAAS,KACxB,SAAS,OAAO,SAAS,KACzB,SAAS,gBAAgB,SAAS,GAClC;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,SAAS,OAAO,GAAG;AAC5D,YAAM,KAAK,YAAY,MAAM,KAAK;AAAA,IACpC;AACA,UAAM,eAAe,mBAAmB,KAAK,MAAM,UAAU,QAAQ;AACrE,SAAK,MAAM,cAAc,MAAM;AAAA,MAC7B,KAAK,MAAM;AAAA,MACX;AAAA,MACA,KAAK,MAAM;AAAA,IACb;AACA,SAAK,MAAM,WAAW;AAAA,EACxB;AAAA,EAEQ,sBAAsB,SAAmC;AAC/D,WAAO;AAAA,MACL,SAAS,kBAAkB,SAAY,KAAK,gBAAgB,QAAQ;AAAA,IACtE;AAAA,EACF;AAAA,EAEA,MAAM,sBAA2C;AAC/C,UAAM,cAAc,GAAG,YAAY,YAAYA,YAAW,CAAC;AAC3D,UAAM,WAAW;AAAA,MACf,GAAG,KAAK,MAAM,SAAS,0BAA0B;AAAA,MACjD;AAAA,MACA;AAAA,IACF,EAAE,KAAK;AACP,UAAM,cAAc,SAAS,QAAQ,CAAC,SAAS;AAAA,MAC7C,WAAW,aAAa,IAAI,EAAE;AAAA,MAC9B,WAAW,eAAe,IAAI,EAAE;AAAA,IAClC,CAAC;AACD,UAAM,SAAS,OAAO;AAAA,WACf,WAAW,YAAY,CAAC;AAAA,KAC9B,WAAW,cAAc,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQzB,YAAY,KAAK,GAAG,CAAC,qGAAqG,WAAW,WAAW,CAAC;AACnJ,QAAI;AACF,YAAM,SAAS,MAAM,KAAK,iBAAiB;AAAA,QACzC,KAAK;AAAA,QACL,iBAAiB;AAAA,MACnB,CAAC;AACD,UAAI,OAAO,aAAa,GAAG;AACzB,cAAM,IAAI,oBAAoB,gDAAgD;AAAA,UAC5E,WAAW,KAAK,MAAM;AAAA,UACtB,UAAU,OAAO,YAAY;AAAA,QAC/B,CAAC;AAAA,MACH;AACA,YAAM,QAAQ,MAAM,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AACvD,YAAM,SAAS,KAAK,sBAAsB;AAC1C,UAAI,UAAU,OAAO,kBAAkB,QAAQ,MAAM,aAAa,OAAO,eAAe;AACtF,cAAM,IAAI,oBAAoB,uDAAuD;AAAA,UACnF,cAAc,MAAM;AAAA,UACpB,eAAe,OAAO;AAAA,QACxB,CAAC;AAAA,MACH;AACA,aAAO;AAAA,IACT,UAAE;AACA,YAAM,KAAK,WAAW,WAAW,EAAE,MAAM,MAAM,MAAS;AAAA,IAC1D;AAAA,EACF;AAAA,EAEA,MAAM,mBAAwC;AAC5C,WAAO,MAAM,KAAK,oBAAoB;AAAA,EACxC;AAAA,EAEA,MAAM,iBACJ,MACA,UAAmC,CAAC,GACrB;AACf,UAAM,QAAQ,MAAM,aAAa,IAAI;AACrC,UAAM,SAAS,KAAK,sBAAsB,OAAO;AACjD,QAAI,UAAU,OAAO,kBAAkB,QAAQ,MAAM,aAAa,OAAO,eAAe;AACtF,YAAM,IAAI,oBAAoB,uDAAuD;AAAA,QACnF,cAAc,MAAM;AAAA,QACpB,eAAe,OAAO;AAAA,MACxB,CAAC;AAAA,IACH;AACA,UAAM,cAAc,GAAG,YAAY,YAAYA,YAAW,CAAC;AAC3D,UAAM,cAAc,GAAG,cAAc,sBAAsBA,YAAW,CAAC;AACvE,UAAM,aAAa,GAAG,cAAc,kBAAkBA,YAAW,CAAC;AAClE,UAAM,KAAK,UAAU;AAAA,MACnB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,eAAe;AAAA,IACjB,CAAC;AACD,UAAM,WAAW,CAAC,GAAG,KAAK,MAAM,SAAS,0BAA0B,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI;AACtF,UAAM,UAAU;AAAA,MACd;AAAA,MACA;AAAA,MACA,WAAW,qBAAqB,CAAC;AAAA,MACjC,WAAW,WAAW;AAAA,MACtB,WAAW,cAAc;AAAA,MACzB,WAAW,WAAW;AAAA,MACtB,WAAW,UAAU;AAAA,MACrB,WAAW,gBAAgB,QAAQ,cAAc,IAAI,CAAC;AAAA,MACtD,WAAW,gBAAgB,QAAQ,qBAAqB,IAAI,CAAC;AAAA,MAC7D,WAAW,QAAQ;AAAA,IACrB,EAAE,KAAK,GAAG;AACV,QAAI;AACF,YAAM,SAAS,MAAM,KAAK,iBAAiB;AAAA,QACzC,KAAK;AAAA,QACL,iBAAiB;AAAA,MACnB,CAAC;AACD,UAAI,OAAO,aAAa,GAAG;AACzB,cAAM,IAAI,oBAAoB,gDAAgD;AAAA,UAC5E,WAAW,KAAK,MAAM;AAAA,UACtB,UAAU,OAAO,YAAY;AAAA,UAC7B,QAAQ,OAAO,OAAO,MAAM,IAAM;AAAA,QACpC,CAAC;AAAA,MACH;AACA,WAAK,MAAM,iBAAiB;AAAA,IAC9B,UAAE;AACA,YAAM,KAAK,WAAW,WAAW,EAAE,MAAM,MAAM,MAAS;AACxD,YAAM,KAAK,WAAW,WAAW,EAAE,MAAM,MAAM,MAAS;AACxD,YAAM,KAAK,WAAW,UAAU,EAAE,MAAM,MAAM,MAAS;AAAA,IACzD;AAAA,EACF;AAAA,EAEA,MAAM,mBAAmB,MAA4C;AACnE,QAAI,CAAC,OAAO,UAAU,IAAI,KAAK,QAAQ,KAAK,OAAO,OAAQ;AACzD,YAAM,IAAI,mCAAmC,6BAA6B,IAAI,EAAE;AAAA,IAClF;AACA,UAAM,SAAS,KAAK,QAAQ,oBAAoB;AAChD,QAAI;AACF,YAAM,WAAW,MAAM,cAAc,KAAK,SAAS,OAAO,cAAc;AACtE,YAAI,QAAQ;AACV,gBAAM,UACJ,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,KAAK,KAAK,QAAQ,4BAA4B;AAC5E,iBAAO,MAAM,UAAU,kBAAkB,KAAK,MAAM,WAAW,MAAM,OAAO;AAAA,QAC9E;AACA,eAAO,MAAM,UAAU;AAAA,UACrB,KAAK,MAAM;AAAA,UACX;AAAA,UACA,KAAK,QAAQ;AAAA,QACf;AAAA,MACF,CAAC;AACD,YAAM,UAAU,sBAAsB,KAAK,OAAO;AAClD,YAAM,WAAW;AAAA,QACf,KAAK;AAAA,QACL;AAAA,UACE,sBAAsB,UAAU,QAAQ,SAAS,QAAQ,gBAAgB;AAAA,UACzE;AAAA,UACA;AAAA,QACF;AAAA,QACA;AAAA,MACF;AACA,YAAM,SAAS,SACX,8BAA8B,OAAO,SAAS,SAAS,WAAW,SAAS,OAAO,EAAE,IACpF;AACJ,cAAQ,KAAK,iCAAiC;AAAA,QAC5C,MAAM,SAAS,WAAW;AAAA,QAC1B,WAAW,KAAK,MAAM;AAAA,QACtB;AAAA,QACA,kBAAkB,QAAQ,oBAAoB;AAAA,QAC9C,MACE,OAAO,SAAS,SAAS,WAAW,+BAA+B,SAAS,IAAI,IAAI;AAAA,MACxF,CAAC;AACD,UAAI,QAAQ;AACV,mCAA2B,KAAK,QAAQ,SAAS,EAAE,SAAS,UAAU,KAAK,CAAC;AAAA,MAC9E;AACA,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,QAAQ;AACV,mCAA2B,KAAK,QAAQ,SAAS,EAAE,SAAS,eAAe,KAAK,CAAC;AAAA,MACnF;AACA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAOA,IAAM,kCAAkC;AAExC,SAAS,sBAAsB,SAG7B;AACA,MAAI,QAAQ,iBAAiB;AAC3B,QAAI,QAAQ,uBAAuB;AACjC,aAAO,EAAE,SAAS,QAAQ,uBAAuB,kBAAkB,KAAK;AAAA,IAC1E;AACA,WAAO,EAAE,SAAS,QAAQ,SAAS,kBAAkB,MAAM;AAAA,EAC7D;AACA,SAAO,EAAE,SAAS,QAAQ,SAAS,kBAAkB,QAAQ,eAAe;AAC9E;AAEA,SAAS,iCACP,UACA,MACA,iBACqB;AACrB,MAAI,gBAAiB,QAAO;AAC5B,MAAI,SAAS,gCAAiC,QAAO;AACrD,QAAM,UACJ,OAAO,SAAS,SAAS,YAAY,SAAS,KAAK,SAAS,IAAI,SAAS,OAAO;AAClF,QAAM,UAAU,QAAQ,WAAW,GAAG,IAAI,UAAU,IAAI,OAAO,IAAI,QAAQ,SAAS,EAAE;AACtF,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,MAAI,wBAAwB,KAAK,MAAM,KAAK,OAAO,SAAS,aAAa,GAAG;AAC1E,WAAO;AAAA,EACT;AACA,QAAM,OAAO,GAAG,MAAM;AACtB,QAAM,MACJ,OAAO,SAAS,QAAQ,YAAY,SAAS,IAAI,SAAS,IACtD,GAAG,SAAS,IAAI,QAAQ,SAAS,EAAE,CAAC,cACpC,SAAS;AACf,SAAO,EAAE,GAAG,UAAU,MAAM,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC,EAAG;AACtD;AAEA,SAAS,sBACP,UACA,SACA,kBACqB;AACrB,QAAM,OAAO,IAAI,IAAI,OAAO;AAC5B,QAAM,WAAW,IAAI,IAAI,GAAG,KAAK,QAAQ,KAAK,SAAS,QAAQ,EAAE;AAIjE,QAAM,MAAM,mBAAmB,IAAI,IAAI,GAAG,SAAS,QAAQ,GAAG,SAAS,MAAM,IAAI,IAAI,IAAI;AACzF,QAAM,MAAM,IAAI,aAAa,YAAY,IAAI,aAAa;AAC1D,SAAO;AAAA,IACL,MAAM,IAAI;AAAA,IACV,MAAM,IAAI,OAAO,OAAO,IAAI,IAAI,IAAI,MAAM,MAAM;AAAA,IAChD;AAAA,IACA,GAAI,IAAI,YAAY,IAAI,aAAa,MAAM,EAAE,MAAM,IAAI,SAAS,IAAI,CAAC;AAAA,IACrE,GAAI,IAAI,OAAO,SAAS,IAAI,EAAE,OAAO,IAAI,OAAO,MAAM,CAAC,EAAE,IAAI,CAAC;AAAA,IAC9D,UAAU,IAAI,SAAS,QAAQ,OAAO,EAAE;AAAA,IACxC,KAAK,IAAI,SAAS;AAAA,IAClB,GAAI,SAAS,UAAU,EAAE,SAAS,EAAE,GAAG,SAAS,QAAQ,EAAE,IAAI,CAAC;AAAA,EACjE;AACF;AAEO,IAAM,oBAAN,MAAwB;AAAA,EACpB,YAAY;AAAA,EACZ,yBAAyB;AAAA,EACjB;AAAA,EAEjB,YAAY,SAAmC;AAC7C,SAAK,UAAU;AAAA,MACb,GAAG;AAAA,MACH,SAAS,iBAAiB,QAAQ,OAAO;AAAA,MACzC,aAAa,EAAE,GAAI,QAAQ,eAAe,CAAC,EAAG;AAAA,MAC9C,cAAc,yBAAyB,QAAQ,YAAY;AAAA,MAC3D,gBAAgB,EAAE,GAAG,QAAQ,eAAe;AAAA,MAC5C,kBAAkB,EAAE,GAAG,QAAQ,iBAAiB;AAAA,IAClD;AAAA,EACF;AAAA,EAEA,MAAM,OACJ,MACA,iBAC6B;AAC7B,UAAM,aAAa,iCAAiC,MAAe,eAAe;AAClF,qBAAiB,UAAU;AAC3B,UAAM,WAAW,WAAW;AAC5B,QAAI,SAAS,SAAS,gBAAgB;AACpC,YAAM,IAAI,0BAA0B,qCAAqC,cAAc,GAAG;AAAA,IAC5F;AACA,QACE,SAAS,MAAM,SAAS,KACxB,SAAS,OAAO,SAAS,KACzB,SAAS,gBAAgB,SAAS,GAClC;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,cAAc;AAAA,MAClB,GAAI,KAAK,QAAQ,eAAe,CAAC;AAAA,MACjC,GAAI,MAAM,SAAS,mBAAmB;AAAA,IACxC;AACA,UAAM,UAAU,MAAM;AAAA,MACpB,KAAK;AAAA,MACL,OAAO,cAAc,MAAM,UAAU,cAAc,cAAc,KAAK,SAAS,WAAW,CAAC;AAAA,IAC7F;AACA,UAAM,QAAiC;AAAA,MACrC,cAAc;AAAA,MACd,WAAW,QAAQ;AAAA,MACnB;AAAA,MACA;AAAA,MACA,OAAO,KAAK,QAAQ;AAAA,MACpB,SAAS,KAAK,QAAQ,WAAW;AAAA,MACjC,qBAAqB,oBAAoB,KAAK,QAAQ,OAAO;AAAA,MAC7D,sBAAsB;AAAA,MACtB,wBAAwB,yBAAyB,KAAK,QAAQ,YAAY;AAAA,MAC1E,gBAAgB;AAAA,MAChB,WAAW,QAAQ,WAAW,YAAY,KAAK;AAAA,IACjD;AACA,WAAO,IAAI,mBAAmB;AAAA,MAC5B;AAAA,MACA,SAAS,KAAK;AAAA,MACd,GAAI,WAAW,kBAAkB,SAC7B,EAAE,eAAe,WAAW,cAAc,IAC1C,CAAC;AAAA,IACP,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,OACJ,OACA,UAAsC,CAAC,GACV;AAC7B,WAAO,MAAM,KAAK,YAAY,OAAO,OAAO;AAAA,EAC9C;AAAA,EAEA,MAAM,YACJ,OACA,UAAsC,CAAC,GACV;AAC7B,8BAA0B,OAAO,KAAK,OAAO;AAC7C,QAAI;AACF,YAAM,cAAc,KAAK,SAAS,OAAO,cAAc;AACrD,cAAM,OAAO,MAAM,UAAU,WAAW,MAAM,SAAS;AACvD,qCAA6B,MAAM,MAAM,SAAS;AAAA,MACpD,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,iBAAiB,8CAA8C,WAAW,KAAK,GAAG;AACpF,cAAM,IAAI,2CAA2C,eAAe,MAAM,SAAS;AAAA,MACrF;AACA,YAAM;AAAA,IACR;AACA,WAAO,IAAI,mBAAmB;AAAA,MAC5B;AAAA,MACA,SAAS,KAAK;AAAA,MACd,GAAI,QAAQ,kBAAkB,SAAY,EAAE,eAAe,QAAQ,cAAc,IAAI,CAAC;AAAA,IACxF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,OAAO,OAA+C;AAC1D,8BAA0B,OAAO,KAAK,OAAO;AAC7C,QAAI;AACF,YAAM,cAAc,KAAK,SAAS,OAAO,cAAc;AACrD,cAAM,UAAU,cAAc,MAAM,SAAS;AAAA,MAC/C,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,CAAC,WAAW,KAAK,EAAG,OAAM;AAAA,IAChC;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,WAAoC;AACxD,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,QAAQ,aAAa,GAAI,EAAE,YAAY;AACpF,UAAM,WAAW,MAAM;AAAA,MACrB,KAAK;AAAA,MACL,OAAO,cAAc,MAAM,UAAU,uBAAuB,WAAW,EAAE,UAAU,CAAC;AAAA,IACtF;AACA,WAAO,SAAS,WAAW,YAAY,KAAK;AAAA,EAC9C;AAAA,EAEA,MAAM,8BAAgD;AACpD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gCAAkD;AACtD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,sBAAsB,OAAkE;AAC5F,8BAA0B,OAAO,KAAK,OAAO;AAC7C,WAAO;AAAA,MACL,cAAc;AAAA,MACd,WAAW,MAAM;AAAA,MACjB,UAAU,wBAAwB,MAAM,QAAQ;AAAA,MAChD,aAAa,0CAA0C,MAAM,UAAU,MAAM,WAAW;AAAA,MACxF,OAAO,MAAM;AAAA,MACb,SAAS,MAAM;AAAA,MACf,qBAAqB,MAAM;AAAA,MAC3B,sBAAsB;AAAA,MACtB,wBAAwB,CAAC,GAAG,MAAM,sBAAsB;AAAA,MACxD,gBAAgB,MAAM;AAAA,MACtB,WAAW,MAAM;AAAA,MACjB,GAAI,KAAK,QAAQ,kBACb,CAAC,IACD,MAAM,eACJ,EAAE,cAAc,gBAAgB,MAAM,YAAY,EAAE,IACpD,CAAC;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,wBAAwB,OAAkE;AAC9F,QAAI,MAAM,iBAAiB,2BAA2B;AACpD,YAAM,IAAI;AAAA,QACR;AAAA,QACA,oDAAoD,OAAO,MAAM,YAAY,CAAC;AAAA,MAChF;AAAA,IACF;AACA,UAAM,WAAW;AAAA,MACf,MAAM,YAAY,OAAO,MAAM,aAAa,YAAY,CAAC,MAAM,QAAQ,MAAM,QAAQ,IAChF,MAAM,WACP;AAAA,IACN;AACA,QAAI,SAAS,SAAS,gBAAgB;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,mCAAmC,cAAc;AAAA,MACnD;AAAA,IACF;AACA,UAAM,QAAiC;AAAA,MACrC,cAAc;AAAA,MACd,WAAW,iBAAiB,MAAM,WAAW,WAAW;AAAA,MACxD;AAAA,MACA,aAAa,MAAM;AAAA,QACjB;AAAA,QACA,MAAM,eACJ,OAAO,MAAM,gBAAgB,YAC7B,CAAC,MAAM,QAAQ,MAAM,WAAW,IAC7B,MAAM,cACP;AAAA,QACJ,KAAK,QAAQ;AAAA,MACf;AAAA,MACA,OAAO,iBAAiB,MAAM,OAAO,OAAO;AAAA,MAC5C,SAAS,oBAAoB,MAAM,SAAS,SAAS;AAAA,MACrD,qBAAqB,iBAAiB,MAAM,qBAAqB,qBAAqB;AAAA,MACtF,sBAAsB;AAAA,MACtB,wBAAwB,MAAM,QAAQ,MAAM,sBAAsB,IAC9D;AAAA,QACE,MAAM,uBAAuB;AAAA,UAC3B,CAAC,UAA2B,OAAO,UAAU;AAAA,QAC/C;AAAA,MACF,IACA,CAAC;AAAA,MACL,gBAAgB,MAAM,mBAAmB;AAAA,MACzC,WAAW,oBAAoB,MAAM,WAAW,WAAW;AAAA,MAC3D,GAAI,MAAM,gBACV,OAAO,MAAM,iBAAiB,YAC9B,CAAC,MAAM,QAAQ,MAAM,YAAY,IAC7B;AAAA,QACE,cAAc;AAAA,UACZ,MAAM;AAAA,QACR;AAAA,MACF,IACA,CAAC;AAAA,IACP;AACA,8BAA0B,OAAO,KAAK,OAAO;AAC7C,WAAO;AAAA,EACT;AACF;;;AIl5DA,IAAM,sBAAsB;AAErB,IAAM,qCAAqC,OAAO,OAAO,EAAE,KAAK,KAAK,QAAQ,MAAM,CAAC;AACpF,IAAM,uCAAuC,OAAO,OAAO;AAAA,EAChE,KAAK;AAAA,EACL,QAAQ;AACV,CAAC;AAED,SAAS,cACP,UACA,cAAsC,CAAC,GACvC,eAAyB,CAAC,GAC1B,SACA;AACA,SAAO;AAAA,IACL,SAAS,SAAS;AAAA,IAClB,QAAQ,SAAS;AAAA,IACjB,OAAO,SAAS;AAAA,IAChB,YAAY,SAAS;AAAA,IACrB,gBAAgB,SAAS;AAAA,IACzB,iBAAiB,SAAS;AAAA,IAC1B,0BAA0B,SAAS;AAAA,IACnC,GAAI,SAAS,mCACT,EAAE,uBAAuB,SAAS,iCAAiC,IACnE,CAAC;AAAA,IACL,qBAAqB,KAAK,KAAK,SAAS,0BAA0B,GAAI;AAAA,IACtE,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB;AAAA,IACA;AAAA,IACA,GAAI,SAAS,qBAAqB,EAAE,SAAS,SAAS,mBAAmB,IAAI,CAAC;AAAA,IAC9E,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/B;AACF;AAEO,IAAM,sBAA4C;AAAA,EACvD,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,kBAAkB,CAAC,WAAW;AAAA,EAC9B,wBAAwB,MAAM;AAAA,EAC9B,YAAY,uBAAuB;AAAA,EACnC,oBAAoB,UAAU;AAC5B,QAAI,CAAC,SAAS,oBAAoB;AAChC,YAAM,IAAI,mBAAmB,eAAe,2CAA2C;AAAA,IACzF;AACA,QAAI,CAAC,SAAS,mBAAmB;AAC/B,YAAM,IAAI,mBAAmB,eAAe,0CAA0C;AAAA,IACxF;AACA,QAAI,CAAC,SAAS,oBAAoB,CAAC,oBAAoB,KAAK,SAAS,gBAAgB,GAAG;AACtF,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,gBAAgB,EAAE,UAAU,WAAW,GAAG;AAC9C,UAAM,IAAI,kBAAkB,cAAc,QAAQ,CAAC,EAAE,gBAAgB,UAAU;AAAA,EACjF;AAAA,EACA,MAAM,EAAE,UAAU,aAAa,cAAc,QAAQ,GAAG;AACtD,WAAO,IAAI,kBAAkB,cAAc,UAAU,aAAa,cAAc,OAAO,CAAC;AAAA,EAC1F;AACF;;;AC7DO,IAAM,kBAAwC;AAAA,EACnD,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,kBAAkB,CAAC,UAAU;AAAA;AAAA;AAAA;AAAA,EAI7B,wBAAwB,MAAM;AAAA,EAC9B,YAAY,uBAAuB;AAAA,EACnC,oBAAoB,UAAU;AAC5B,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI,mBAAmB,WAAW,sCAAsC;AAAA,IAChF;AAAA,EACF;AAAA,EACA,MAAM,EAAE,UAAU,aAAa,aAAa,GAAG;AAC7C,UAAM,UAA8E;AAAA,MAClF,QAAQ,SAAS;AAAA,MACjB,KAAK;AAAA,MACL;AAAA;AAAA,MAEA,QAAQ,SAAS;AAAA,IACnB;AACA,QAAI,SAAS,eAAgB,SAAQ,UAAU,SAAS;AACxD,QAAI,SAAS,qBAAsB,SAAQ,gBAAgB,SAAS;AACpE,QAAI,SAAS,mBAAoB,SAAQ,cAAc,SAAS;AAMhE,YAAQ,WAAW;AAAA,MACjB,mBAAmB,SAAS;AAAA,MAC5B,GAAI,SAAS,0BACT,EAAE,oBAAoB,SAAS,0BAA0B,IAAK,IAC9D,CAAC;AAAA,IACP;AACA,WAAO,IAAI,qBAAqB,OAAO;AAAA,EACzC;AACF;;;AC1BA;AAAA,EAGE,aAAAQ;AAAA,EACA;AAAA,EACA;AAAA,OASK;AACP,SAAS,uBAAAC,4BAA2B;;;AChCpC,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,SAA0C,eAAe;AAIlD,IAAM,8BAA8B,MAAM;AAE1C,SAAS,kBAAkB,SAA6B;AAC7D,SAAO,WAAW,OAAO,OAAO,CAAC;AACnC;AAEO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAElD,YACW,aACA,OACT,OACS,kBACT;AACA,UAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU;AACxD,UAAM,cACJ,4BAA4B,QAAQ,mBAAmB,iBAAiB,OAAO,KAAK;AACtF;AAAA,MACE,iBAAiB,WAAW,IAAI,KAAK,YAAY,MAAM,IAAI,WAAW;AAAA,MACtE,EAAE,MAAM;AAAA,IACV;AAXS;AACA;AAEA;AAST,SAAK,OAAO;AAAA,EACd;AAAA,EAfS,YAAY;AAgBvB;AAIA,eAAsB,mBAAmB,OAML;AAClC,QAAM,OAAO,OAAO,OAAO,WAAW,CAAC;AACvC,QAAM,SAAS,kBAAkB,MAAM,OAAO;AAC9C,QAAM,UAAU,CAAC,UAA2B;AAC1C,QAAI,MAAM,MAAO,OAAM,yBAAyB,MAAM,OAAO,MAAM,SAAS;AAC5E,QAAI,CAAC,MAAM,OAAQ,OAAM,IAAI,MAAM,+CAA+C;AAClF,WAAO,MAAM;AAAA,EACf;AACA,QAAM,OAAO,OAAOC,YAAmB,OAA0C;AAC/E,UAAM,QAAQ,MAAM,MAAM,QAAQA,YAAW,EAAE;AAC/C,QAAI,MAAM,cAAcA;AACtB,YAAM,IAAI,MAAM,oEAAoE;AACtF,WAAO,QAAQ,KAAK;AAAA,EACtB;AACA,QAAM,aAAa,CAAC,aAClB,EACE,SAAS,UAAU,cACnB,SAAS,SAAS,SAAS,QAC3B,SAAS,SAAS,UAAU,QAAQ,qBACpC,SAAS,SAAS,MAAM,aAAa,KACrC,SAAS,SAAS,KAAK,aACvB,SAAS,SAAS,KAAK,YACvB,SAAS,SAAS,KAAK,eACvB,SAAS,SAAS,KAAK,QAAQ,YAAY,UAC3C,SAAS,SAAS,KAAK,OAAO,YAAY,OAAO,MAAM,QAAQ,UAAU;AAE7E,QAAM,gBAAgB,OAAO,gBAAgB,UAAyB;AACpE,UAAM,WAAW,MAAM,KAAK,OAAO,WAAW,GAAG,EAAE,OAAO,WAAW,SAAS,EAAE,KAAK,EAAE,CAAC;AACxF,QAAI,WAAW,QAAQ,EAAG;AAC1B,QACE,iBACA,SAAS,UAAU,cACnB,SAAS,SAAS,SAAS,QAC3B,SAAS,SAAS,UAAU,QAAQ,kBACpC;AAIA,YAAM,YAAY,MAAM,KAAK,OAAO,WAAW,GAAG,EAAE,OAAO,YAAY,UAAU,EAAE,KAAK,EAAE,CAAC;AAC3F,UAAI,WAAW,SAAS,EAAG;AAC3B,UACE,UAAU,UAAU,cACpB,UAAU,SAAS,SAAS,QAC5B,UAAU,SAAS,UAAU,QAAQ,qBACrC,UAAU,SAAS,MAAM,WACzB;AACA,cAAM,IAAI,MAAM,wEAAwE;AAAA,MAC1F;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAuC;AAC3C,MAAI;AACF,UAAM,QAAQ,MAAM,KAAK,MAAM;AAAA,MAC7B,OAAO;AAAA,MACP,SAAS;AAAA,QACP,IAAI;AAAA,UACF,OAAO;AAAA,UACP,SAAS;AAAA,YACP,MAAM,MAAM;AAAA,YACZ,eAAe,MAAM,iBAAiB;AAAA,YACtC,MAAM;AAAA,YACN,oBACE,MAAM,gBAAgB,SAAY,KAAK,kBAAkB,MAAM,WAAW;AAAA,YAC5E,gBAAgB,MAAM,gBAAgB;AAAA,YACtC,eAAe;AAAA,YACf,aAAa,OAAO,MAAM,QAAQ,UAAU;AAAA,UAC9C;AAAA,QACF;AAAA,QACA,aAAa;AAAA,QACb,YAAY;AAAA,QACZ,UAAU;AAAA,MACZ;AAAA,IACF,CAAC;AACD,QACE,MAAM,UAAU,aAChB,CAAC,MAAM,QAAQ,YACf,MAAM,QAAQ,QAAQ,SAAS,MAC/B;AACA,YAAM,IAAI,MAAM,+DAA+D;AAAA,IACjF;AAEA,YAAQ;AACR,QAAI,SAAS;AACb,QAAI,MAAM;AACV,OAAG;AACD,YAAM,MAAM,KAAK,IAAI,MAAM,QAAQ,YAAY,SAAS,2BAA2B;AACnF,YAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,GAAG;AAAA,QAC5C,OAAO;AAAA,QACP,YAAY;AAAA,UACV;AAAA,UACA,KAAK,OAAO,GAAG;AAAA,UACf,QAAQ,OAAO,MAAM;AAAA,UACrB,OAAO,MAAM,QAAQ,SAAS,QAAQ,GAAG;AAAA,UACzC,MAAM,QAAQ,MAAM,QAAQ;AAAA,QAC9B;AAAA,MACF,CAAC;AACD,UAAI,MAAM,UAAU,gBAAgB,MAAM,WAAW,QAAQ,OAAO,GAAG,GAAG;AACxE,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,eAAS;AACT,aAAO;AAAA,IACT,SAAS,SAAS,MAAM,QAAQ;AAChC,YAAQ;AACR,UAAM,cAAc;AAAA,EACtB,SAAS,OAAO;AACd,QAAI,UAAU,SAAU,OAAM,IAAI,yBAAyB,MAAM,OAAO,KAAK;AAG7E,QAAI;AACF,YAAM,cAAc,IAAI;AACxB,aAAO,EAAE,WAAW,KAAK;AAAA,IAC3B,SAAS,kBAAkB;AACzB,YAAM,IAAI,yBAAyB,MAAM,OAAO,OAAO,gBAAgB;AAAA,IACzE;AAAA,EACF;AACA,SAAO,EAAE,WAAW,MAAM;AAC5B;;;ACjIO,IAAM,sCAAsC;;;ACD5C,IAAM,qCAA0D,oBAAI,IAAI;AAAA,EAC7E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAkBM,IAAM,kCAAkC;AACxC,IAAM,uCAAuC;AAG7C,IAAM,iCAAiC;AAKvC,IAAM,oCAAoC;AAG1C,IAAM,mCAAmC;AACzC,IAAM,kCAAkC;AAGxC,IAAM,kCAAkC;AAWxC,SAAS,yBAAyB,SAAiB,QAAwB;AAChF,QAAM,WAAW,mCAAmC,mCAAmC;AACvF,QAAM,UAAU,KAAK,IAAI,iCAAiC,QAAQ;AAClE,QAAM,gBAAgB,KAAK,IAAI,UAAW,KAAK,IAAI,GAAG,MAAM,CAAC;AAC7D,SAAO,KAAK,MAAM,gBAAgB,OAAO;AAC3C;AA6BO,SAAS,sBAAsB,OASV;AAC1B,QAAM,EAAE,QAAQ,OAAO,iBAAiB,gBAAgB,mBAAmB,GAAG,OAAO,IAAI;AAEzF,MAAI,MAAM,WAAW;AAInB,QAAI,oBAAoB,mCAAmC;AACzD,aAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AACA,WAAO,EAAE,QAAQ,SAAS,SAAS,yBAAyB,kBAAkB,MAAM,EAAE;AAAA,EACxF;AAEA,MAAI,MAAM,UAAU;AAGlB,UAAM,qBACJ,WAAW,SAAS,uCAAuC;AAC7D,QAAI,mBAAmB,oBAAoB;AACzC,aAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AACA,WAAO,EAAE,QAAQ,SAAS,SAAS,yBAAyB,iBAAiB,MAAM,EAAE;AAAA,EACvF;AAEA,MAAI,MAAM,WAAW,sBAAsB;AACzC,QAAI,CAAC,mCAAmC,IAAI,MAAM,GAAG;AAGnD,aAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AACA,QAAI,kBAAkB,gCAAgC;AACpD,aAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AACA,WAAO,EAAE,QAAQ,SAAS,SAAS,yBAAyB,gBAAgB,MAAM,EAAE;AAAA,EACtF;AAEA,SAAO,EAAE,QAAQ,OAAO;AAC1B;AAYO,IAAM,8BAAoD;AAAA,EAC/D,OAAO,CAAC,OAAO,IAAI,QAAQ,CAACC,aAAY,WAAWA,UAAS,EAAE,CAAC;AAAA,EAC/D,QAAQ,MAAM,KAAK,OAAO;AAC5B;;;AC9IA,SAAS,UAAAC,eAAc;AACvB,SAAS,cAAAC,mBAAkB;AAE3B;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAAC;AAAA,OAMK;;;ACjCA,SAAS,eACd,aACA,SACA,MACA,sBACQ;AACR,MAAI,OAAO,yBAAyB,YAAY,qBAAqB,KAAK,EAAE,WAAW,GAAG;AACxF,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,SAAO,SAAS,WAAW,IAAI,OAAO,eAAe,oBAAoB,OAAO,IAAI;AACtF;AAIO,SAAS,aACd,aACA,SACA,sBACQ;AACR,MAAI,OAAO,yBAAyB,YAAY,qBAAqB,KAAK,EAAE,WAAW,GAAG;AACxF,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,SAAO,SAAS,WAAW,IAAI,OAAO,eAAe,oBAAoB;AAC3E;AA0BO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAGlD,YACE,SACS,kBAA0C,aACnD;AACA,UAAM,OAAO;AAFJ;AAAA,EAGX;AAAA,EAPS,OAAO;AAQlB;AAqBO,IAAM,wBAAN,MAAyD;AAAA,EAC7C;AAAA,EACT;AAAA,EACA;AAAA,EAER,YAAY,SAAuD;AACjE,SAAK,UAAU;AAAA,EACjB;AAAA,EAEA,MAAc,oBAA4D;AACxE,QAAI,KAAK,YAAY;AACnB,aAAO,KAAK;AAAA,IACd;AAGA,SAAK,eAAe,KAAK,QAAQ,EAC9B,KAAK,CAAC,eAAe;AACpB,UAAI,YAAY;AACd,aAAK,aAAa;AAAA,MACpB;AACA,aAAO;AAAA,IACT,CAAC,EACA,MAAM,MAAM,IAAI,EAChB,QAAQ,MAAM;AACb,WAAK,aAAa;AAAA,IACpB,CAAC;AACH,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAM,UACJ,SACA,WAC+B;AAC/B,UAAM,OAAO,MAAM,KAAK,kBAAkB;AAC1C,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,yBAAyB,4CAA4C;AAAA,IACjF;AACA,UAAM,eAAe,KAAK,UAAU,OAAO;AAK3C,UAAM,YAAY;AAChB,UAAI;AACF,yBAAiB,WAAW,cAAc;AACxC,oBAAU,QAAQ,IAAI;AAAA,QACxB;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF,GAAG;AACH,QAAI,eAAe;AACnB,WAAO;AAAA,MACL,aAAa,MAAM;AACjB,YAAI,cAAc;AAChB;AAAA,QACF;AACA,uBAAe;AACf,YAAI;AACF,uBAAa,YAAY;AAAA,QAC3B,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,SAAiB,SAAoC;AACjE,UAAM,OAAO,MAAM,KAAK,kBAAkB;AAC1C,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,yBAAyB,4CAA4C;AAAA,IACjF;AACA,SAAK,QAAQ,SAAS,OAAO;AAAA,EAC/B;AACF;;;ADtGO,IAAM,iCAAiC,IAAI,OAAO;AAGlD,IAAM,4BAA4B;AAIlC,IAAM,+BAA+B;AAIrC,IAAM,8BAA8B;AAK3C,IAAM,oCAAoC;AAM1C,IAAM,oCAAoC;AAK1C,IAAM,gCAAgC;AACtC,IAAM,4BAA4B;AAyGlC,eAAe,yBACb,OACA,WACmB;AACnB,QAAMC,aAAY,OAAO,WAAW;AACpC,QAAM,WAAW,MAAM,MAAM,WAAW;AAAA,IACtC,MAAM;AAAA,IACN;AAAA,MACE,WAAAA;AAAA;AAAA;AAAA;AAAA,MAIA,OAAO;AAAA,MACP,gBAAgB;AAAA,MAChB,IACE,cAAc,UACV,EAAE,OAAO,WAAW,SAAS,EAAE,MAAM,MAAM,KAAK,EAAE,IAClD,EAAE,OAAO,YAAY,UAAU,EAAE,MAAM,MAAM,KAAK,EAAE;AAAA,IAC5D;AAAA,IACA,EAAE,WAAW,MAAM,iBAAiB;AAAA,EACtC;AACA,MAAI,SAAS,SAAS,CAAC,SAAS,QAAQ;AACtC,UAAM;AAAA,MACJ,SAAS,SAAS;AAAA,QAChB,MAAM,UAAU;AAAA,QAChB,SAAS,aAAa,SAAS;AAAA,QAC/B,WAAW;AAAA,QACX,QAAQ,CAAC;AAAA,MACX;AAAA,MACAA;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,OAAO,UAAU,YAAY;AACxC,UAAM,cAAc,aAAa,SAAS,uBAAuB,SAAS,OAAO,KAAK,EAAE;AAAA,EAC1F;AACA,MAAI,SAAS,OAAO,SAAS,SAAS,MAAM,MAAM;AAChD,UAAM,cAAc,aAAa,SAAS,kCAAkC,MAAM,IAAI,EAAE;AAAA,EAC1F;AACA,SAAO,SAAS,OAAO;AACzB;AAGA,eAAsB,kBAAkB,OAAyD;AAC/F,SAAO,MAAM,yBAAyB,OAAO,OAAO;AACtD;AAGA,eAAsB,mBAAmB,OAAyD;AAChG,SAAO,MAAM,yBAAyB,OAAO,QAAQ;AACvD;AAUA,IAAM,mBAAoE;AAAA,EACxE,CAAC,UAAU,iBAAiB,GAAG;AAAA,EAC/B,CAAC,UAAU,iBAAiB,GAAG;AACjC;AAOO,IAAM,qBAAN,MAAyB;AAAA,EACb;AAAA,EACA,UAAuB,CAAC;AAAA,EACxB,WAAW,oBAAI,IAAY;AAAA,EAC3B,kBAAkB,oBAAI,IAA8B;AAAA,EAC7D,eAA8B,QAAQ,QAAQ;AAAA,EAC9C,qBAAqB;AAAA,EAE7B,YAAY,MAA8B;AACxC,SAAK,OAAO;AAAA,EACd;AAAA,EAEQ,aAAqB;AAC3B,WAAO,KAAK,KAAK,SAAS,iBAAiB,KAAK;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,iBAAyB;AAC/B,UAAM,UAAU,OAAO,KAAK,WAAW,CAAC;AACxC,UAAM,MAAM,OAAO,KAAK,IAAI,CAAC;AAC7B,SAAK,qBAAqB,CAAC,KAAK,oBAAoB,SAAS,GAAG,EAAE;AAAA,MAChE,CAAC,SAAS,eAAgB,aAAa,UAAU,aAAa;AAAA,MAC9D;AAAA,IACF;AACA,WAAO,KAAK,mBAAmB,SAAS;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAO,MAA6B;AACxC,UAAM,WAAW,MAAM,KAAK,KAAK,WAAW;AAAA,MAC1C,KAAK,KAAK;AAAA,MACV;AAAA,QACE,WAAW,OAAO,WAAW;AAAA,QAC7B,OAAO,KAAK,KAAK;AAAA,QACjB,gBAAgB;AAAA,QAChB,IAAI,EAAE,OAAO,YAAY,UAAU,EAAE,KAAK,EAAE;AAAA,MAC9C;AAAA,MACA,EAAE,WAAW,KAAK,KAAK,iBAAiB;AAAA,IAC1C;AACA,QAAI,SAAS,SAAS,CAAC,SAAS,QAAQ;AACtC,YAAM;AAAA,QACJ,SAAS,SAAS;AAAA,UAChB,MAAM,UAAU;AAAA,UAChB,SAAS;AAAA,UACT,WAAW;AAAA,UACX,QAAQ,CAAC;AAAA,QACX;AAAA,MACF;AAAA,IACF;AACA,QAAI,SAAS,OAAO,UAAU,YAAY;AACxC,YAAM,cAAc,uCAAuC,SAAS,OAAO,KAAK,EAAE;AAAA,IACpF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,KACJ,MACA,MACA,YACA,QAC8B;AAC9B,UAAM,SAAS,MAAM,KAAK,cAAc,MAAM,MAAM,YAAY,QAAQ,IAAI;AAC5E,QAAI,OAAO,WAAW,aAAa;AACjC,YAAM,cAAc,8CAA8C;AAAA,IACpE;AACA,WAAO,OAAO;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,cACJ,MACA,MACA,YACA,QACA,cAC6B;AAC7B,QAAI,KAAK,SAAS,IAAI,IAAI,GAAG;AAC3B,YAAM,IAAI,uBAAuB;AAAA,QAC/B,SAAS,8CAA8C,IAAI;AAAA,QAC3D,MAAM,UAAU;AAAA,QAChB,QAAQ;AAAA,QACR,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,SAAK,SAAS,IAAI,IAAI;AACtB,UAAM,aAAa,oBAAoB;AACvC,QAAI;AACF,YAAM,WAAW,IAAI,WAAW,KAAK,MAAM,MAAM,KAAK,WAAW,CAAC;AAClE,UAAI;AACF,cAAM,SAAS,MAAM,SAAS,IAAI,MAAM,YAAY,QAAQ,YAAY;AACxE,YAAI,OAAO,WAAW,aAAa;AACjC,eAAK,QAAQ,KAAK;AAAA,YAChB;AAAA,YACA,SAAS,OAAO;AAAA,YAChB,YAAY,SAAS;AAAA,YACrB;AAAA,UACF,CAAC;AACD,iBAAO,EAAE,QAAQ,aAAa,SAAS,OAAO,QAAQ;AAAA,QACxD;AACA,eAAO;AAAA,MACT,UAAE;AACA,iBAAS,SAAS;AAAA,MACpB;AAAA,IACF,UAAE;AACA,WAAK,SAAS,OAAO,IAAI;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,aACJ,MACA,SACA,eAGA;AACA,QAAI,KAAK,SAAS,IAAI,IAAI,EAAG,OAAM,cAAc,4CAA4C;AAC7F,UAAM,WAAW,IAAI;AAAA,MACnB,KAAK;AAAA,MACL;AAAA,MACA,KAAK,eAAe;AAAA,MACpB,KAAK,gBAAgB,IAAI,IAAI;AAAA,IAC/B;AACA,SAAK,SAAS,IAAI,IAAI;AACtB,SAAK,gBAAgB,OAAO,IAAI;AAChC,QAAI;AACF,YAAM,SAAS,MAAM,SAAS;AAAA,QAC5B;AAAA,QACA;AAAA,QACA,KAAK,IAAI,UAAU,KAAK,KAAK,kBAAkB,GAAI;AAAA,QACnD;AAAA,UACE,SAAS,KAAK,IAAI,GAAG,OAAO;AAAA,UAC5B,SAAS,MAAM;AAAA,UAAC;AAAA,UAChB;AAAA,QACF;AAAA,MACF;AAGA,eAAS,SAAS;AAClB,UAAI,OAAO,WAAW,aAAa,CAAC,OAAO,UAAU;AACnD,aAAK,gBAAgB,IAAI,MAAM,SAAS,eAAe,CAAC;AAAA,MAC1D;AAIA,YAAM,iBAAiB,SAAS,eAAe,EAAE,YAAY,SAAS;AACtE,aAAO,OAAO,WAAW,cACrB;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,OAAO;AAAA,QAChB;AAAA,QACA,eAAe,EAAE,SAAS,OAAO,SAAS,kBAAkB,SAAS,WAAW;AAAA,MAClF,IACA,EAAE,GAAG,QAAQ,eAAe;AAAA,IAClC,UAAE;AACA,eAAS,SAAS;AAClB,WAAK,SAAS,OAAO,IAAI;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,sBACJ,MACA,SACuC;AACvC,UAAM,MAAM,CAAC,UAA0B;AACrC,UAAI,CAAC,qBAAqB,KAAK,KAAK,KAAK,OAAO,KAAK,IAAI;AACvD,cAAM,cAAc,qDAAqD;AAC3E,aAAO,OAAO,KAAK;AAAA,IACrB;AACA,UAAM,UAAU,IAAI,QAAQ,OAAO;AACnC,UAAM,qBAAqB,IAAI,QAAQ,gBAAgB;AACvD,UAAM,oBAAoB,IAAI,KAAK,eAAe,CAAC;AACnD,UAAM,cACJ,oBAAoB,qBAAqB,oBAAoB,qBAAqB,IAClF,SAAS;AACX,QAAI,UAAU;AACd,UAAMA,aAAY,OAAO,WAAW;AACpC,UAAM,WAAW,MAAM,KAAK,KAAK,WAAW;AAAA,MAC1C,KAAK,KAAK;AAAA,MACV;AAAA,QACE,WAAAA;AAAA,QACA,OAAO;AAAA,QACP,gBAAgB;AAAA,QAChB,IAAI;AAAA,UACF,OAAO;AAAA,UACP,UAAU;AAAA,YACR;AAAA,YACA,SAAS,QAAQ;AAAA,YACjB,kBAAkB;AAAA,YAClB,aAAa;AAAA,UACf;AAAA,QACF;AAAA,MACF;AAAA,MACA,EAAE,WAAW,KAAK,KAAK,iBAAiB;AAAA,IAC1C;AACA,QAAI,SAAS,SAAS,CAAC,SAAS;AAC9B,YAAM;AAAA,QACJ,SAAS,SAAS;AAAA,UAChB,MAAM,UAAU;AAAA,UAChB,SAAS;AAAA,UACT,WAAW;AAAA,UACX,QAAQ,CAAC;AAAA,QACX;AAAA,MACF;AACF,QAAI,SAAS,OAAO,UAAU,cAAc,SAAS,OAAO,SAAS,SAAS;AAC5E,YAAM,cAAc,oDAAoD;AAC1E,UAAMC,UAAS,SAAS,OAAO;AAC/B,QAAIA,QAAO,UAAUC,SAAQ,cAAe,QAAO;AACnD,QACED,QAAO,UAAUC,SAAQ,qBACzB,CAACD,QAAO,QACR,CAAC,WAAW,KAAKA,QAAO,OAAO,KAC/B,OAAOA,QAAO,OAAO,MAAM,UAAU;AAErC,YAAM,cAAc,uEAAuE;AAC7F,UAAM,KAAK,KAAK,UAAU;AAAA,MACxB,aAAa,KAAK,KAAK,aAAa,KAAK,KAAK,SAAS,KAAK,KAAK,oBAAoB;AAAA,MACrF,MAAM,OAAO;AAAA,QACX;AAAA,QACA,UAAU,QAAQ;AAAA,QAClB,aAAa;AAAA,QACb,OAAO;AAAA,QACP,kBAAkB;AAAA,MACpB,CAAC,EAAE,OAAO;AAAA,IACZ;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,mBAAmB,aAAgD;AACvE,UAAM,WAAW,gBAAgB,SAAY,OAAO,IAAI,IAAI,WAAW;AACvE,UAAM,WAAW,KAAK,QAAQ;AAAA,MAC5B,CAAC,OAAO,aAAa,QAAS,GAAG,eAAe,QAAQ,SAAS,IAAI,GAAG,UAAU;AAAA,IACpF;AACA,UAAM,eAAe,KAAK,aAAa,KAAK,MAAM,KAAK,YAAY,QAAQ,CAAC;AAG5E,SAAK,eAAe,aAAa,MAAM,MAAM,MAAS;AACtD,UAAM;AAAA,EACR;AAAA,EAEA,MAAc,YAAY,UAA+C;AACvE,UAAM,aAAa;AAAA,MACjB,KAAK,KAAK;AAAA,MACV,KAAK,KAAK;AAAA,MACV,KAAK,KAAK;AAAA,IACZ;AACA,eAAW,MAAM,UAAU;AAEzB,UAAI,CAAC,KAAK,QAAQ,SAAS,EAAE,EAAG;AAChC,YAAM,KAAK,KAAK,SAAS,eAAe,GAAG,MAAM,GAAG,OAAO;AAC3D,YAAM,MAAM,MAAM,OAAO;AAAA,QACvB,MAAM,GAAG;AAAA,QACT,UAAU,GAAG;AAAA,QACb,aAAa;AAAA,QACb,OAAO;AAAA,QACP,kBAAkB,GAAG;AAAA,MACvB,CAAC,EAAE,OAAO;AACV,UAAI;AACF,cAAM,KAAK,KAAK,UAAU,QAAQ,YAAY,GAAG;AAAA,MACnD,QAAQ;AAEN;AAAA,MACF;AACA,WAAK,QAAQ,OAAO,KAAK,QAAQ,QAAQ,EAAE,GAAG,CAAC;AAAA,IACjD;AAAA,EACF;AACF;AAWA,IAAM,aAAN,MAAiB;AAAA,EACE;AAAA,EACA;AAAA,EACR;AAAA,EACQ;AAAA;AAAA,EAGT,cAAc;AAAA,EACL,QAAQ,oBAAI,IAAmD;AAAA,EACxE,mBAAmB;AAAA,EACV,SAAyD;AAAA,IACxE,QAAQ,CAAC;AAAA,IACT,QAAQ,CAAC;AAAA,EACX;AAAA,EACiB,eAAsC,CAAC;AAAA,EACvC,iBAAiB,EAAE,QAAQ,IAAI,YAAY,GAAG,QAAQ,IAAI,YAAY,EAAE;AAAA,EACxE,SAAS,EAAE,QAAQE,QAAO,OAAO,GAAG,QAAQA,QAAO,OAAO,EAAE;AAAA,EAC5D,SAAS,EAAE,QAAQ,IAAI,QAAQ,GAAG;AAAA,EAC3C,cAAc;AAAA,EACd,uBAAuB;AAAA,EACvB,kBAAkB;AAAA,EAClB;AAAA,EACA;AAAA,EACA,QAAQ;AAAA,EACR;AAAA,EACA;AAAA,EACA,iBAAiB;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,OAAO;AAAA,EAEf,YACE,MACA,MACA,YACA,YACA;AACA,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,aAAa;AAClB,SAAK,cAAc,KAAK,eAAe;AACvC,SAAK,cAAc,KAAK,IAAI;AAC5B,QAAI,YAAY;AACd,WAAK,cAAc,WAAW;AAC9B,WAAK,SAAS,WAAW;AACzB,WAAK,SAAS,WAAW;AACzB,WAAK,iBAAiB,WAAW;AAAA,IACnC;AAAA,EACF;AAAA,EAEA,iBAAmC;AACjC,WAAO;AAAA,MACL,aAAa,KAAK;AAAA,MAClB,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK;AAAA,MACb,UAAU,KAAK;AAAA,IACjB;AAAA,EACF;AAAA,EAEA,IAAY,gBAAwB;AAClC,WAAO,KAAK,KAAK,iBAAiB;AAAA,EACpC;AAAA,EACA,IAAY,mBAA2B;AACrC,WAAO,KAAK,KAAK,oBAAoB;AAAA,EACvC;AAAA,EACA,IAAY,kBAA0B;AACpC,WAAO,KAAK,KAAK,mBAAmB;AAAA,EACtC;AAAA,EAEA,WAAiB;AACf,SAAK,OAAO;AACZ,QAAI,KAAK,UAAU;AACjB,oBAAc,KAAK,QAAQ;AAC3B,WAAK,WAAW;AAAA,IAClB;AACA,SAAK,cAAc,YAAY;AAC/B,SAAK,eAAe;AAAA,EACtB;AAAA,EAEA,MAAM,IACJ,MACA,YACA,QACA,cAQA;AACA,SAAK,cAAc,SAAS;AAI5B,UAAM,UAAU,IAAI,QAAc,CAACC,UAAS,WAAW;AACrD,WAAK,gBAAgBA;AACrB,WAAK,eAAe;AAAA,IACtB,CAAC;AAID,SAAK,eAAe,MAAM,KAAK,KAAK,UAAU;AAAA,MAC5C;AAAA,QACE,KAAK,KAAK;AAAA,QACV,KAAK,KAAK;AAAA,QACV,KAAK;AAAA,QACL,KAAK,KAAK;AAAA,MACZ;AAAA,MACA,CAAC,YAAY,KAAK,eAAe,OAAO;AAAA,IAC1C;AAEA,UAAM,eAAe,SAAS,OAAO,IAAI,MAAM,KAAK,QAAQ,MAAM,UAAU;AAK5E,UAAM,KAAK,OAAO,KAAK,WAAW;AAGlC,SAAK,WAAW,YAAY,MAAM;AAChC,WAAK,KAAK,QAAQ;AAAA,IACpB,GAAG,KAAK,aAAa;AACrB,UAAM,WAAW,KAAK,cAAc,MAAM;AAC1C,QAAI;AACJ,QAAI,UAAU;AACd,QAAI;AACF,UAAI,gBAAgB,aAAa,UAAU,GAAG;AAC5C,cAAM,QAAQ,MAAM,QAAQ,KAAK;AAAA,UAC/B,QAAQ,KAAK,MAAM,SAAkB;AAAA,UACrC,SAAS;AAAA,UACT,IAAI,QAAiB,CAACA,aAAY;AAChC,yBAAa,WAAW,MAAMA,SAAQ,OAAO,GAAG,aAAa,OAAO;AAAA,UACtE,CAAC;AAAA,QACH,CAAC;AACD,YAAI,UAAU,WAAW,KAAK,YAAY,QAAW;AACnD,cAAI;AACF,kBAAM,aAAa,QAAQ;AAC3B,sBAAU;AAAA,UACZ,SAAS,eAAe;AAKtB,kBAAM,KAAK,0BAA0B;AACrC,kBAAM,QAAQ,KAAK,CAAC,SAAS,SAAS,IAAI,CAAC;AAC3C,kBAAM;AAAA,UACR;AAIA,cAAI,KAAK,YAAY,QAAW;AAI9B,gBAAI,KAAK,YAAa,MAAK,SAAS;AACpC,kBAAM,KAAK,qBAAqB;AAChC,kBAAM,UAAU,KAAK,eAAe;AACpC,kBAAM,aAAa,gBAAgB,KAAK,aAAa,OAAO,CAAC,CAAC;AAC9D,mBAAO;AAAA,cACL,QAAQ;AAAA,cACR,MAAM,KAAK;AAAA,cACX,QAAQ,QAAQ;AAAA,cAChB,QAAQ,QAAQ;AAAA,cAChB,OAAO,KAAK;AAAA,cACZ;AAAA,cACA,YAAY,QAAQ,OAAO,aAAa,QAAQ,OAAO;AAAA,YACzD;AAAA,UACF;AAAA,QACF;AAAA,MACF,OAAO;AACL,cAAM,QAAQ,KAAK,CAAC,SAAS,SAAS,IAAI,CAAC;AAAA,MAC7C;AAAA,IACF,UAAE;AACA,UAAI,YAAY;AACd,qBAAa,UAAU;AAAA,MACzB;AACA,eAAS,KAAK;AAAA,IAChB;AAGA,UAAM,OAAO,KAAK;AAClB,UAAM,UAAU,KAAK;AACrB,QAAI,KAAK,eAAe,SAAS,QAAQ,CAAC,SAAS;AACjD,YAAM,4BAA4B,IAAI;AAAA,IACxC;AACA,UAAM,EAAE,QAAQ,OAAO,IAAI,KAAK,kBAAkB,IAAI;AACtD,QAAI,WAAW,SAAS,KAAM,OAAM,cAAc,gBAAgB,KAAK,aAAa,OAAO,CAAC,CAAC;AAC7F,UAAM,UAA+B;AAAA,MACnC,GAAI,KAAK,cACL,EAAE,SAAS,EAAE,aAAa,KAAK,aAAa,eAAe,KAAK,cAAc,EAAE,IAChF,CAAC;AAAA,MACL,UAAU;AAAA,QACR,UAAU,KAAK;AAAA,QACf;AAAA,QACA;AAAA,QACA,UAAU,KAAK;AAAA,QACf,YAAY,KAAK;AAAA,MACnB;AAAA,MACA,OAAO,KAAK;AAAA,MACZ;AAAA,MACA,YAAY,OAAO,aAAa,OAAO;AAAA,IACzC;AACA,QAAI,SAAS;AACX,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,MAAM,KAAK;AAAA,QACX;AAAA,QACA;AAAA,QACA,OAAO,KAAK;AAAA,QACZ;AAAA,QACA,YAAY,QAAQ;AAAA,QACpB,UAAU;AAAA,UACR;AAAA,UACA,SAAS,QAAQ,SAAS;AAAA,UAC1B,GAAI,cAAc,gBACd;AAAA,YACE,eAAe,EAAE,SAAS,QAAQ,SAAS,GAAG,kBAAkB,KAAK,WAAW;AAAA,UAClF,IACA,CAAC;AAAA,QACP;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,MACA,SAAS,QAAQ,SAAS;AAAA,IAC5B;AAAA,EACF;AAAA,EAEA,MAAc,4BAA2C;AACvD,eAAS;AACP,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,UAAU;AAAA,UAClC,OAAO;AAAA,UACP,UAAU,EAAE,MAAM,KAAK,KAAK;AAAA,QAC9B,CAAC;AACD,YAAI,OAAO,UAAU,YAAY;AAC/B,gBAAM,cAAc,uCAAuC,OAAO,KAAK,EAAE;AAAA,QAC3E;AACA,YAAI,OAAO,SAAS,UAAUF,SAAQ,eAAe;AACnD,gBAAM,mBAAmB,OAAO,QAAQ;AAAA,QAC1C;AACA,cAAM,KAAK,OAAO,CAAC;AACnB;AAAA,MACF,SAAS,OAAO;AACd,YACE,iBAAiB,2BAChB,MAAM,aAAa,MAAM,gBAAgB,MAAM,WAAW,uBAC3D;AACA,gBAAM,KAAK,KAAK,WAAW;AAAA,YACzB,yBAAyB,GAAG,KAAK,KAAK,WAAW,OAAO,CAAC;AAAA,UAC3D;AACA;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,uBAAsC;AAClD,UAAM,MAAM,MAAM,OAAO;AAAA,MACvB,MAAM,KAAK;AAAA,MACX,UAAU;AAAA,MACV,aAAa;AAAA,MACb,OAAO;AAAA,MACP,kBAAkB,KAAK;AAAA,IACzB,CAAC,EAAE,OAAO;AACV,QAAI;AACF,YAAM,KAAK,KAAK,UAAU;AAAA,QACxB,aAAa,KAAK,KAAK,aAAa,KAAK,KAAK,SAAS,KAAK,KAAK,oBAAoB;AAAA,QACrF;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAIR;AAAA,EACF;AAAA,EAEQ,iBAA6D;AACnE,WAAO;AAAA,MACL,QAAQ,aAAa,KAAK,OAAO,MAAM;AAAA,MACvC,QAAQ,aAAa,KAAK,OAAO,MAAM;AAAA,IACzC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,QAAQ,MAAmB,YAAqC;AAC5E,QAAI,kBAAkB;AACtB,QAAI,cAAc;AAClB,eAAS;AAIP,YAAM,KAAK,KAAK,6BAA6B;AAC7C,UAAI;AACF,cAAM,SAAS,MAAM,KAAK;AAAA,UACxB;AAAA,YACE,OAAO;AAAA,YACP,SAAS;AAAA,cACP,IAAI,EAAE,OAAO,QAAQ,KAAK;AAAA,cAC1B,aAAa,OAAO,KAAK,WAAW;AAAA;AAAA;AAAA,cAGpC,YAAY,aAAa,IAAI,OAAO,KAAK,IAAI,IAAI,UAAU,IAAI;AAAA,cAC/D,UAAU,KAAK,KAAK;AAAA,YACtB;AAAA,UACF;AAAA,UACA,KAAK;AAAA,QACP;AACA,YAAI,OAAO,UAAU,WAAW;AAC9B,gBAAM,cAAc,sCAAsC,OAAO,KAAK,EAAE;AAAA,QAC1E;AACA,cAAMD,UAAS,OAAO,QAAQ;AAC9B,YAAI,CAAC,OAAO,QAAQ,UAAU;AAC5B,gBAAM,KAAK,aAAaA,OAAM;AAAA,QAChC;AACA,YAAIA,SAAQ,UAAUC,SAAQ,eAAe;AAC3C,gBAAM,mBAAmBD,OAAM;AAAA,QACjC;AACA,eAAO,kBAAkB;AAAA,MAC3B,SAAS,OAAO;AACd,YAAI,EAAE,iBAAiB,yBAAyB;AAC9C,gBAAM;AAAA,QACR;AAKA,YACE,MAAM,SAAS,UAAU,uBACzB,MAAM,SAAS,UAAU,wBACzB;AACA,gBAAM,IAAI;AAAA,YACR,+BAA+B,MAAM,OAAO;AAAA,YAC5C;AAAA,UACF;AAAA,QACF;AACA,cAAM,OAAO,MAAM,WAAW,wBAAwB,MAAM;AAC5D,YAAI,MAAM,YAAY,kBAAkB,+BAA+B;AACrE,gBAAM,KAAK,KAAK,WAAW;AAAA,YACzB,yBAAyB,iBAAiB,KAAK,KAAK,WAAW,OAAO,CAAC;AAAA,UACzE;AACA,6BAAmB;AACnB;AAAA,QACF;AACA,YAAI,QAAQ,cAAc,2BAA2B;AACnD,gBAAM,KAAK,KAAK,WAAW;AAAA,YACzB,yBAAyB,aAAa,KAAK,KAAK,WAAW,OAAO,CAAC;AAAA,UACrE;AACA,yBAAe;AACf;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,aAAaA,SAAsD;AACzE,QAAIA,SAAQ,MAAM,WAAW;AAC3B,aAAO,IAAI,uBAAuB;AAAA,QAChC,SAAS;AAAA,QACT,MAAM,UAAU;AAAA,QAChB,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,QAAQ,EAAE,WAAW,OAAO;AAAA,MAC9B,CAAC;AAAA,IACH;AACA,QAAIA,SAAQ,UAAUC,SAAQ,eAAe;AAC3C,aAAO,mBAAmBD,OAAM;AAAA,IAClC;AACA,WAAO,cAAc,mEAAmE;AAAA,EAC1F;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,UACZ,IACAD,aAAoB,OAAO,WAAW,GACtC;AACA,UAAM,iBAAiB,GAAG,UAAU,YAAY,KAAK,KAAK,iBAAiB;AAC3E,UAAM,MAAM,MAAM,KAAK,KAAK,WAAW;AAAA,MACrC,KAAK,KAAK;AAAA,MACV;AAAA,QACE,WAAAA;AAAA,QACA,OAAO,KAAK,KAAK;AAAA,QACjB;AAAA,QACA;AAAA,MACF;AAAA,MACA,EAAE,WAAW,KAAK,KAAK,iBAAiB;AAAA,IAC1C;AACA,QAAI,IAAI,SAAS,CAAC,IAAI,QAAQ;AAC5B,YAAM;AAAA,QACJ,IAAI,SAAS;AAAA,UACX,MAAM,UAAU;AAAA,UAChB,SAAS;AAAA,UACT,WAAW;AAAA,UACX,QAAQ,CAAC;AAAA,QACX;AAAA,MACF;AAAA,IACF;AACA,WAAO,IAAI;AAAA,EACb;AAAA;AAAA;AAAA,EAIA,MAAc,OAAO,aAAwC;AAC3D,UAAM,SAAS,MAAM,KAAK,UAAU;AAAA,MAClC,OAAO;AAAA,MACP,UAAU;AAAA,QACR,MAAM,KAAK;AAAA,QACX,SAAS,KAAK,YAAY,SAAS;AAAA,QACnC,kBAAkB,KAAK;AAAA,QACvB,aAAa,OAAO,WAAW;AAAA,MACjC;AAAA,IACF,CAAC;AACD,QAAI,OAAO,UAAU,YAAY;AAC/B,YAAM,cAAc,uCAAuC,OAAO,KAAK,EAAE;AAAA,IAC3E;AACA,QAAI,OAAO,SAAS,UAAUE,SAAQ,eAAe;AACnD,YAAM,mBAAmB,OAAO,QAAQ;AAAA,IAC1C;AACA,WAAO,OAAO;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAKQ,oBAA0B;AAChC,QAAI,KAAK,kBAAkB,KAAK,MAAM;AACpC;AAAA,IACF;AACA,SAAK,iBAAiB;AACtB,SAAK,KAAK,OAAO,CAAC,EACf,KAAK,MAAM;AACV,WAAK,SAAS;AAAA,IAChB,CAAC,EACA,MAAM,CAAC,UAAU;AAChB,UAAI,iBAAiB,0BAA0B,CAAC,MAAM,aAAa,CAAC,MAAM,cAAc;AACtF,aAAK,eAAe,KAAK;AAAA,MAC3B;AAAA,IACF,CAAC,EACA,QAAQ,MAAM;AACb,WAAK,iBAAiB;AAAA,IACxB,CAAC;AAAA,EACL;AAAA,EAEQ,eAAe,SAA2B;AAChD,QAAI,KAAK,KAAM;AACf,QAAIG;AACJ,QAAI;AACF,MAAAA,SAAQ,QAAQ,OAAO,OAAO;AAAA,IAChC,QAAQ;AAGN;AAAA,IACF;AACA,QAAIA,OAAM,SAAS,KAAK,MAAM;AAC5B;AAAA,IACF;AACA,SAAK,cAAc,KAAK,IAAI;AAC5B,SAAK,eAAe;AACpB,UAAM,MAAM,OAAOA,OAAM,GAAG;AAC5B,QAAI,OAAO,KAAK,aAAa;AAC3B;AAAA,IACF;AACA,QAAI,QAAQ,KAAK,cAAc,IAAI;AAGjC,YAAM,YAAY,QAAQ;AAC1B,YAAM,gBAAgB,KAAK,cAAc;AACzC,UAAI,CAAC,KAAK,MAAM,IAAI,GAAG,GAAG;AACxB,YAAI,KAAK,mBAAmB,aAAa,eAAe;AACtD,eAAK,MAAM,IAAI,KAAK,EAAE,OAAAA,QAAO,UAAU,CAAC;AACxC,eAAK,oBAAoB;AAAA,QAC3B,OAAO;AACL,eAAK,MAAM,MAAM;AACjB,eAAK,mBAAmB;AAAA,QAC1B;AAAA,MACF;AACA,WAAK,kBAAkB;AACvB;AAAA,IACF;AACA,SAAK,WAAWA,MAAK;AAErB,eAAS;AACP,YAAM,UAAU,KAAK,MAAM,IAAI,KAAK,cAAc,EAAE;AACpD,UAAI,CAAC,SAAS;AACZ;AAAA,MACF;AACA,WAAK,MAAM,OAAO,KAAK,cAAc,EAAE;AACvC,WAAK,oBAAoB,QAAQ;AACjC,WAAK,WAAW,QAAQ,KAAK;AAAA,IAC/B;AACA,SAAK,YAAY;AACjB,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEQ,WAAWA,QAAsB;AACvC,SAAK,cAAc,OAAOA,OAAM,GAAG;AACnC,UAAM,OAAOA,OAAM;AACnB,QAAI,CAAC,MAAM;AACT;AAAA,IACF;AACA,YAAQ,KAAK,OAAO;AAAA,MAClB,KAAK,QAAQ;AACX,cAAM,UAAU,iBAAiB,KAAK,KAAK,OAAO;AAClD,YAAI,SAAS;AACX,cAAI,KAAK,aAAa;AACpB,iBAAK,OAAO,OAAO,EAAE,OAAO,KAAK,KAAK,KAAK;AAC3C,iBAAK,OAAO,OAAO,KAAK,OAAO,KAAK,KAAK,MAAM,UAAU;AAAA,UAC3D,OAAO;AACL,iBAAK,OAAO,OAAO,EAAE,KAAK,KAAK,KAAK,KAAK;AAAA,UAC3C;AACA,gBAAM,QAAQ,KAAK,eAAe,OAAO,EAAE,OAAO,KAAK,KAAK,OAAO,EAAE,QAAQ,KAAK,CAAC;AACnF,cAAI,MAAO,MAAK,aAAa,KAAK,EAAE,UAAUA,OAAM,KAAK,QAAQ,SAAS,MAAM,CAAC;AAAA,QACnF;AACA,aAAK,wBAAwB,OAAO,KAAK,KAAK,MAAM,UAAU;AAC9D;AAAA,MACF;AAAA,MACA,KAAK;AAEH,aAAK,KAAK,QAAQ;AAClB;AAAA,MACF,KAAK;AACH,mBAAW,UAAU,CAAC,UAAU,QAAQ,GAAY;AAClD,gBAAM,QAAQ,KAAK,eAAe,MAAM,EAAE,OAAO;AACjD,cAAI,MAAO,MAAK,aAAa,KAAK,EAAE,UAAUA,OAAM,KAAK,QAAQ,MAAM,CAAC;AAAA,QAC1E;AACA,aAAK,OAAO,KAAK;AACjB,aAAK,UAAU,OAAOA,OAAM,GAAG;AAC/B;AAAA,IACJ;AAAA,EACF;AAAA,EAEQ,cAAoB;AAC1B,QAAI,KAAK,YAAY,UAAa,KAAK,eAAe,KAAK,SAAS;AAClE,WAAK,gBAAgB;AAAA,IACvB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,mBAAyB;AAC/B,QAAI,KAAK,uBAAuB,KAAK,mBAAmB,OAAO,KAAK,WAAW,IAAI,IAAI;AACrF,WAAK,KAAK,QAAQ;AAAA,IACpB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,UAAyB;AACrC,QAAI,KAAK,MAAM;AACb;AAAA,IACF;AACA,SAAK,kBAAkB,KAAK;AAC5B,UAAM,MAAM,MAAM,OAAO;AAAA,MACvB,MAAM,KAAK;AAAA,MACX,UAAU;AAAA,MACV,cAAc,KAAK,uBAAuB,OAAO,KAAK,WAAW,GAAG,SAAS;AAAA,MAC7E,OAAO;AAAA,MACP,kBAAkB,KAAK;AAAA,IACzB,CAAC,EAAE,OAAO;AACV,QAAI;AACF,YAAM,KAAK,KAAK,UAAU;AAAA,QACxB,aAAa,KAAK,KAAK,aAAa,KAAK,KAAK,SAAS,KAAK,KAAK,oBAAoB;AAAA,QACrF;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,cAAc,QAA4D;AAChF,QAAI,UAAU;AACd,QAAI;AACJ,UAAM,OAAO,IAAI,QAAe,CAAC,GAAG,WAAW;AAC7C,YAAM,YAAY,KAAK,IAAI;AAC3B,YAAM,OAAO,YAAY;AACvB,YAAI,SAAS;AACX;AAAA,QACF;AACA,YAAI;AACF,cAAI,SAAS,KAAK,KAAK,IAAI,IAAI,aAAa,QAAQ;AAIlD,mBAAO,yBAAyB,kBAAkB,CAAC,CAAC;AACpD;AAAA,UACF;AACA,cAAI,KAAK,IAAI,IAAI,KAAK,eAAe,KAAK,kBAAkB;AAC1D,kBAAM,KAAK,aAAa,MAAM;AAAA,UAChC;AAAA,QACF,SAAS,OAAO;AACd,iBAAO,KAAK;AACZ;AAAA,QACF;AACA,gBAAQ,WAAW,MAAM,KAAK,IAAI,KAAK,mBAAmB,GAAG,IAAK,CAAC;AAAA,MACrE;AACA,cAAQ,WAAW,MAAM,KAAK,IAAI,KAAK,mBAAmB,GAAG,IAAK,CAAC;AAAA,IACrE,CAAC;AACD,WAAO;AAAA,MACL;AAAA,MACA,MAAM,MAAM;AACV,kBAAU;AACV,YAAI,OAAO;AACT,uBAAa,KAAK;AAAA,QACpB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA,EAIA,MAAc,aAAa,QAAiD;AAC1E,SAAK,iBAAiB,KAAK,IAAI;AAC/B,QAAI;AACF,YAAM,SAAS,MAAM,KAAK,UAAU,EAAE,OAAO,WAAW,SAAS,EAAE,MAAM,KAAK,KAAK,EAAE,CAAC;AACtF,UAAI,OAAO,UAAU,YAAY;AAC/B,cAAM,cAAc,sCAAsC,OAAO,KAAK,EAAE;AAAA,MAC1E;AACA,YAAMJ,UAAS,OAAO;AACtB,UAAIA,QAAO,UAAUC,SAAQ,eAAe;AAC1C,eAAO,mBAAmBD,OAAM,CAAC;AACjC;AAAA,MACF;AAIA,UAAI,OAAOA,QAAO,OAAO,IAAI,KAAK,cAAc,IAAI;AAClD,aAAK,kBAAkB;AAAA,MACzB;AAAA,IACF,SAAS,OAAO;AACd,UAAI,EAAE,iBAAiB,yBAAyB;AAC9C,cAAM;AAAA,MACR;AACA,YAAM,YACJ,MAAM,gBAAgB,MAAM,WAAW,wBAAwB,MAAM;AACvE,UAAI,CAAC,WAAW;AACd,cAAM;AAAA,MACR;AACA,YAAM,UAAU,KAAK,IAAI,KAAK,KAAK,gBAAgB,KAAK,IAAI;AAC5D,UAAI,WAAW,KAAK,iBAAiB;AAInC,eAAO,KAAK;AAAA,MACd;AAAA,IAGF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,kBAAkB,MAA0D;AAClF,UAAM,YAAY;AAAA,MAChB,QAAQ,aAAa,KAAK,OAAO,MAAM;AAAA,MACvC,QAAQ,aAAa,KAAK,OAAO,MAAM;AAAA,IACzC;AACA,eAAW,WAAW,CAAC,UAAU,QAAQ,GAAY;AACnD,YAAM,QAAQ,UAAU,OAAO;AAG/B,YAAM,gBAAgB,KAAK,SAAS,OAAO;AAC3C,UAAI,OAAO,kBAAkB,YAAY,CAAC,WAAW,KAAK,aAAa,GAAG;AACxE,cAAM,cAAc,yBAAyB,OAAO,2BAA2B;AAAA,MACjF;AACA,YAAM,QAAQ,KAAK,cAAc,KAAK,OAAO,OAAO,IAAI,OAAO,MAAM,UAAU;AAC/E,UAAI,OAAO,aAAa,MAAM,OAAO;AACnC,cAAM;AAAA,UACJ,yBAAyB,OAAO,wBAAwB,KAAK,qBACxC,aAAa;AAAA,QACpC;AAAA,MACF;AACA,YAAM,iBAAiB,KAAK,UAAU,OAAO;AAC7C,UAAI,OAAO,mBAAmB,YAAY,eAAe,WAAW,GAAG;AACrE,cAAM,cAAc,yBAAyB,OAAO,iBAAiB;AAAA,MACvE;AACA,YAAM,SAASK;AAAA,QACb,KAAK,cAAc,KAAK,OAAO,OAAO,EAAE,MAAM,EAAE,OAAO,IAAIH,QAAO,KAAK;AAAA,MACzE;AACA,UAAI,WAAW,gBAAgB;AAC7B,cAAM;AAAA,UACJ,yBAAyB,OAAO,yBAAyB,MAAM,qBAC1C,cAAc;AAAA,QACrC;AAAA,MACF;AACA,WAAK,OAAO,OAAO,EAAE,SAAS;AAAA,IAChC;AACA,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aAAa,QAAkC;AACtD,QAAM,QAAQ,OAAO,OAAO,CAAC,KAAK,UAAU,MAAM,MAAM,YAAY,CAAC;AACrE,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,QAAI,IAAI,OAAO,MAAM;AACrB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAEA,SAAS,cAAc,SAAyC;AAC9D,SAAO,IAAI,uBAAuB;AAAA,IAChC;AAAA,IACA,MAAM,UAAU;AAAA,IAChB,QAAQ;AAAA,IACR,WAAW;AAAA,EACb,CAAC;AACH;AAKA,SAAS,mBAAmBF,SAA0C;AACpE,QAAM,SACJA,QAAO,eAAe,aAAa,yBAC/B,sDACAA,QAAO,eAAe,aAAa,iCACjC,2DACA;AACR,SAAO,IAAI,uBAAuB;AAAA,IAChC,SACE,+DAA+D,MAAM;AAAA,IAEvE,MAAM,UAAU;AAAA,IAChB,QAAQ;AAAA,IACR,WAAW;AAAA,IACX,QAAQ,EAAE,aAAa,OAAOA,QAAO,UAAU,EAAE;AAAA,EACnD,CAAC;AACH;AAUO,SAAS,4BACd,MACwB;AACxB,MAAI,KAAK,gBAAgB,eAAe;AACtC,WAAO,IAAI,uBAAuB;AAAA,MAChC,SACE;AAAA,MAGF,MAAM,UAAU;AAAA,MAChB,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,iBAAiB;AAAA;AAAA;AAAA;AAAA,MAIjB,QAAQ,EAAE,GAAG,KAAK,eAAe,cAAc,KAAK,YAAY;AAAA,IAClE,CAAC;AAAA,EACH;AACA,SAAO,IAAI,uBAAuB;AAAA,IAChC,SACE,4DAA4D,KAAK,WAAW;AAAA,IAE9E,MAAM,UAAU;AAAA,IAChB,QAAQ;AAAA,IACR,WAAW;AAAA,IACX,QAAQ,EAAE,GAAG,KAAK,eAAe,cAAc,KAAK,YAAY;AAAA,EAClE,CAAC;AACH;;;AJ/vCA,IAAM,UAAU,IAAI,YAAY;AAChC,IAAM,UAAU,IAAI,YAAY;AAGhC,IAAM,iCAAiC,MAAM;AAC7C,IAAM,sCAAsC;AAC5C,IAAM,yCAAyC,MAAM;AAGrD,IAAM,8CAA8C,MAAM;AAgB1D,SAAS,kBAAkB,OAAe,SAAiB,OAA0B;AACnF,QAAM,OAAO,MAAM,WAAW,MAAM,GAAG,EAAE,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK;AAC7E,MAAI,SAAS,SAAS,SAAS,WAAW;AACxC,WAAO,CAAC,OAAO,MAAM,MAAM,MAAM,OAAO;AAAA,EAC1C;AACA,MACE,SAAS,gBACT,SAAS,oBACT,SAAS,UACT,SAAS,YACT;AACA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,GAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,CAAC;AAAA,MAC/B;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,CAAC,OAAO,GAAI,QAAQ,CAAC,IAAI,IAAI,CAAC,GAAI,MAAM,OAAO;AACxD;AAsBA,IAAIM;AAIG,SAAS,uBAAuB,IAA+B;AACpE,EAAAA,qBAAoB;AACtB;AAyBO,IAAM,gCAAgC;AAI7C,IAAM,iCAAiC;AAGvC,IAAM,iCAAiC,aAAgB;AACvD,IAAM,yCAAyC;AAC/C,IAAM,qCAAqC;AAE3C,SAAS,iCACP,QACqC;AACrC,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,kBAAkB,QAAQ,mBAAmB;AACnD,QAAM,mBAAmB,QAAQ,oBAAoB;AACrD,aAAW,CAAC,MAAM,KAAK,KAAK;AAAA,IAC1B,CAAC,kBAAkB,cAAc;AAAA,IACjC,CAAC,mBAAmB,eAAe;AAAA,EACrC,GAAY;AACV,QAAI,UAAU,SAAS,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,IAAI;AAClE,YAAM,IAAI,MAAM,GAAG,IAAI,qDAAqD;AAAA,IAC9E;AAAA,EACF;AACA,MAAI,mBAAmB,QAAQ,oBAAoB,QAAQ,kBAAkB,gBAAgB;AAC3F,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AACA,MACE,qBAAqB,SACpB,CAAC,OAAO,UAAU,gBAAgB,KAAK,oBAAoB,KAAK,mBAAmB,aACpF;AACA,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,MAAI,mBAAmB,QAAQ,oBAAoB,QAAQ,qBAAqB,MAAM;AACpF,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,GAAI,mBAAmB,OAAO,EAAE,gBAAgB,OAAO,cAAc,EAAE,IAAI,CAAC;AAAA,IAC5E,GAAI,oBAAoB,OAAO,EAAE,iBAAiB,OAAO,eAAe,EAAE,IAAI,CAAC;AAAA,IAC/E,GAAI,qBAAqB,OAAO,EAAE,iBAAiB,IAAI,CAAC;AAAA,EAC1D;AACF;AAkBO,IAAM,+BAA+B;AA8KrC,IAAM,sCAAN,cAAkD,MAAM;AAAA,EAI7D,YACkB,uBACA,qBAChB;AACA;AAAA,MACE,kDAAkD,qBAAqB,SAAS,mBAAmB;AAAA,IACrG;AALgB;AACA;AAAA,EAKlB;AAAA,EAVS,OAAO;AAAA,EACP,YAAY;AAUvB;AA2CO,IAAM,oBAAN,MAAwB;AAAA,EACpB,YAAY;AAAA,EACZ;AAAA,EACA;AAAA,EACA;AAAA,EACQ;AAAA;AAAA,EAEA,eAAe,oBAAI,IAAY;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA,kBAAkB,oBAAI,IAAgC;AAAA,EACtD,0BAA0B,oBAAI,IAAgC;AAAA,EAC9D,yBAAyB,oBAAI,IAG5C;AAAA,EACe,sBAAsB,oBAAI,IAAiC;AAAA,EAC3D,mBAAmB,oBAAI,IAA2B;AAAA;AAAA;AAAA,EAInE,MAAM,oBAAoB,WAAqC;AAC7D,UAAM,OAAO,KAAK,oBAAoB,IAAI,SAAS;AACnD,QAAI,CAAC,KAAM,QAAO;AAClB,QAAI,UAAU,KAAK,iBAAiB,IAAI,SAAS;AACjD,QAAI,CAAC,SAAS;AACZ,gBAAU,KAAK;AACf,WAAK,iBAAiB,IAAI,WAAW,OAAO;AAAA,IAC9C;AACA,QAAI;AACF,YAAM;AAAA,IACR,UAAE;AACA,UAAI,KAAK,iBAAiB,IAAI,SAAS,MAAM,QAAS,MAAK,iBAAiB,OAAO,SAAS;AAAA,IAC9F;AACA,WAAO;AAAA,EACT;AAAA,EACiB;AAAA;AAAA,EAER;AAAA,EACQ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EAGA;AAAA,EAGA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA6BR;AAAA,EAOT,YAAY,MAA6B;AACvC,QAAI,OAAO,KAAK,kBAAkB,YAAY,KAAK,cAAc,WAAW,GAAG;AAC7E,YAAM,IAAI,UAAU,6CAA6C;AAAA,IACnE;AACA,UAAMC,iBAAgB,4BAA4B,KAAK,eAAe,MAAS;AAC/E,QAAIA,mBAAkB,KAAK,eAAe;AACxC,YAAM,IAAI,UAAU,oEAAoE;AAAA,IAC1F;AACA,SAAK,cAAc,KAAK;AACxB,SAAK,qBAAqB,KAAK,sBAAsB,KAAK;AAC1D,SAAK,UAAU,KAAK;AACpB,SAAK,aAAa,KAAK;AACvB,SAAK,QAAQ,KAAK;AAClB,SAAK,kBAAkB,KAAK,mBAAmB;AAC/C,SAAK,QAAQ,KAAK,SAAS;AAC3B,SAAK,YAAY,KAAK,aAAa;AACnC,SAAK,gBAAgB,KAAK;AAC1B,SAAK,aAAa,KAAK,cAAc;AACrC,SAAK,OAAO,KAAK;AACjB,SAAK,UAAU,WAAW,KAAK,oBAAoB,KAAK,SAAS,KAAK,oBAAoB;AAC1F,SAAK,gBAAgBA;AACrB,SAAK,2BAA2B,KAAK;AACrC,SAAK,iBAAiB,iCAAiC,KAAK,uBAAuB;AACnF,SAAK,0BAA0B,KAAK,qCAAqC;AACzE,SAAK,6BAA6B,KAAK,+BAA+B;AACtE,SAAK,gCAAgC,KAAK,kCAAkC;AAC5E,SAAK,8BAA8B,KAAK,gCAAgC;AACxE,SAAK,kBAAkB,KAAK;AAC5B,SAAK,uBAAuB,KAAK;AACjC,SAAK,4BAA4B,KAAK;AACtC,SAAK,yBAAyB,KAAK;AACnC,SAAK,0BAA0B,KAAK;AACpC,SAAK,iCAAiC,KAAK;AAI3C,SAAK,wBACH,KAAK,YAAY,CAAC,KAAK,4BACnB,KAAK,kBAAkB;AAAA,MACrB,oBAAoB,KAAK;AAAA,MACzB,sBAAsB,KAAK;AAAA,MAC3B,SAAS,KAAK;AAAA,MACd,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf,+BAA+B,KAAK;AAAA,MACpC,6BAA6B,KAAK;AAAA,IACpC,CAAC,IACD;AAUN,SAAK,QAAQ;AAAA,MACX,SAAS,KAAK;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,UAAU,IAAI,SAAS;AAAA,QACrB,MAAM,KAAK;AAAA,QACX,SAAS,CAAC;AAAA,QACV,aAAa,KAAK,eAAe,CAAC;AAAA,MACpC,CAAC;AAAA;AAAA;AAAA;AAAA,MAID,aAAa,KAAK,eAAe,CAAC;AAAA,IACpC;AAAA,EACF;AAAA;AAAA;AAAA,EAIQ,OAAO,aAA4C;AACzD,QAAI,CAAC,KAAK,MAAM;AACd;AAAA,IACF;AACA,QAAI;AACF,WAAK,KAAK,WAAW;AAAA,IACvB,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEQ,8BACN,QACA,iBACA,cACM;AACN,UAAM,mBACJ,QAAQ,mBAAmB,UAAa,QAAQ,oBAAoB;AACtE,QAAI,oBAAoB,CAAC,iBAAiB;AACxC,YAAM,IAAI,uBAAuB;AAAA,QAC/B,SACE;AAAA,QACF,MAAMC,WAAU;AAAA,QAChB,QAAQ;AAAA,QACR,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,QAAI,QAAQ,qBAAqB,WAAc,CAAC,mBAAmB,CAAC,eAAe;AACjF,YAAM,IAAI,uBAAuB;AAAA,QAC/B,SACE;AAAA,QACF,MAAMA,WAAU;AAAA,QAChB,QAAQ;AAAA,QACR,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAc,eAAe,eAQ1B;AACD,QAAI,CAAC,KAAK,2BAA2B;AACnC,UAAI,eAAe;AACjB,aAAK;AAAA,UACH,KAAK;AAAA,UACL,KAAK;AAAA,UACL,KAAK;AAAA,QACP;AAAA,MACF;AACA,aAAO;AAAA,QACL,oBAAoB,KAAK;AAAA,QACzB,sBAAsB,KAAK;AAAA,QAC3B,SAAS,KAAK;AAAA,QACd,gBAAgB,gBAAgB,KAAK,iBAAiB;AAAA,QACtD,UAAU,KAAK;AAAA,QACf,+BAA+B,KAAK;AAAA,QACpC,6BAA6B,KAAK;AAAA,MACpC;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,KAAK,0BAA0B;AACtD,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,uBAAuB;AAAA,QAC/B,SAAS;AAAA,QACT,MAAMA,WAAU;AAAA,QAChB,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,cAAc;AAAA,MAChB,CAAC;AAAA,IACH;AACA,QAAI,CAAC,oCAAoC,SAAS,eAAe,KAAK,aAAa,GAAG;AACpF,YAAM,IAAI,oCAAoC,KAAK,eAAe,SAAS,aAAa;AAAA,IAC1F;AACA,UAAM,iBAAiB,iCAAiC,SAAS,uBAAuB;AACxF,QAAI,eAAe;AACjB,WAAK;AAAA,QACH;AAAA,QACA,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AACA,WAAO;AAAA,MACL,oBAAoB,SAAS,eAAe,KAAK;AAAA,MACjD,sBAAsB,SAAS;AAAA,MAC/B,SAAS;AAAA,QACP,SAAS,eAAe,KAAK;AAAA,QAC7B,KAAK;AAAA,QACL,SAAS;AAAA,MACX;AAAA,MACA,gBAAgB,gBAAgB,iBAAiB;AAAA,MACjD,UAAU,SAAS;AAAA,MACnB,+BAA+B,SAAS,kCAAkC;AAAA,MAC1E,6BAA6B,SAAS,gCAAgC;AAAA,IACxE;AAAA,EACF;AAAA,EAEA,MAAc,eAAkF;AAC9F,WAAO,MAAM,KAAK,eAAe,IAAI;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,2BACZ,UACe;AACf,UAAM,UAAU,MAAM,KAAK,aAAa;AACxC,UAAM,aACJ,QAAQ,gBAAgB,mBAAmB,SAAS,gBAAgB,kBACpE,QAAQ,gBAAgB,oBAAoB,SAAS,gBAAgB,mBACrE,QAAQ,gBAAgB,qBAAqB,SAAS,gBAAgB;AACxE,QACE,QAAQ,YAAY,SAAS,WAC7B,QAAQ,yBAAyB,SAAS,wBAC1C,QAAQ,QAAQ,QAAQ,MAAM,QAAQ,SAAS,QAAQ,KACvD,CAAC,YACD;AACA,YAAM,IAAI,uBAAuB;AAAA,QAC/B,SAAS;AAAA,QACT,MAAMA,WAAU;AAAA,QAChB,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEQ,kBACN,WACgC;AAChC,UAAM,SAAS,UAAU;AACzB,QAAI,CAAC,OAAQ,QAAO;AACpB,UAAM,MAAM,KAAK,UAAU;AAAA,MACzB,UAAU;AAAA,MACV,UAAU;AAAA,MACV,UAAU,gBAAgB,kBAAkB;AAAA,MAC5C,UAAU,gBAAgB,mBAAmB;AAAA,MAC7C,UAAU,gBAAgB,oBAAoB;AAAA,IAChD,CAAC;AACD,UAAM,WAAW,KAAK,gBAAgB,IAAI,GAAG;AAC7C,QAAI,SAAU,QAAO;AACrB,UAAM,SAAS,IAAI,mBAAmB;AAAA,MACpC,aAAa,UAAU;AAAA,MACvB,SAAS,KAAK;AAAA,MACd,sBAAsB,UAAU;AAAA,MAChC,OAAO,KAAK;AAAA,MACZ,YAAY,KAAK;AAAA,MACjB,YAAY,UAAU;AAAA,MACtB,WAAW,OAAO;AAAA,MAClB,kBAAkB,KAAK;AAAA,MACvB,YAAY,KAAK;AAAA,MACjB,GAAI,UAAU,mBAAmB,SAC7B,EAAE,gBAAgB,UAAU,eAAe,IAC3C,CAAC;AAAA,MACL,GAAI,KAAK,8BAA8B,SACnC;AAAA,QACE,4BAA4B,YAC1B,MAAM,KAAK,2BAA2B,SAAS;AAAA,MACnD,IACA,CAAC;AAAA,MACL,GAAI,OAAO,YAAY,SAAY,EAAE,SAAS,OAAO,QAAQ,IAAI,CAAC;AAAA,MAClE,GAAI,OAAO,gBAAgB,SAAY,EAAE,aAAa,OAAO,YAAY,IAAI,CAAC;AAAA,MAC9E,GAAI,OAAO,kBAAkB,SAAY,EAAE,eAAe,OAAO,cAAc,IAAI,CAAC;AAAA,MACpF,GAAI,OAAO,qBAAqB,SAC5B,EAAE,kBAAkB,OAAO,iBAAiB,IAC5C,CAAC;AAAA,MACL,GAAI,OAAO,oBAAoB,SAAY,EAAE,iBAAiB,OAAO,gBAAgB,IAAI,CAAC;AAAA,IAC5F,CAAC;AACD,SAAK,gBAAgB,IAAI,KAAK,MAAM;AACpC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAc,KACZ,IACA,YAAY,KAAK,WACjB,iBACiD;AACjD,UAAM,SAAS,GAAG;AAKlB,UAAM,mBAAmB,WAAW;AACpC,QAAI,qBAAqB,mBAAoB,MAAM,KAAK,eAAe,gBAAgB;AACvF,UAAM,YAAY,KAAK,IAAI;AAC3B,QAAI,kBAAkB;AACtB,QAAI,iBAAiB;AACrB,QAAI,mBAAmB;AACvB,eAAS;AACP,YAAM,mBAAmB,WAAW,QAAQ,qBAAqB;AACjE,YAAM,iBAAiB,kBAAkB;AACzC,YAAM,MAAsB;AAAA,QAC1B,WAAW,OAAO,WAAW;AAAA,QAC7B,OAAO,KAAK;AAAA,QACZ;AAAA,QACA;AAAA,MACF;AACA,YAAM,MAAM,MAAM,KAAK,WAAW,QAAQ,mBAAmB,SAAS,KAAK;AAAA,QACzE;AAAA,MACF,CAAC;AACD,UAAI,CAAC,IAAI,SAAS,IAAI,QAAQ;AAC5B,cAAM,UAAU,kBAAkB,iBAAiB;AACnD,aAAK,OAAO;AAAA,UACV,IAAI;AAAA,UACJ,SAAS;AAAA,UACT,QAAQ,UAAU;AAAA,UAClB;AAAA,UACA,YAAY,KAAK,IAAI,IAAI;AAAA,UACzB,WAAW,KAAK;AAAA;AAAA,UAEhB,GAAI,UAAU,IACV;AAAA,YACE,YACE,mBAAmB,IACf,YACA,kBAAkB,IAChB,aACA;AAAA,UACV,IACA,CAAC;AAAA,QACP,CAAC;AACD,eAAO,IAAI;AAAA,MACb;AACA,YAAM,QAAQ,IAAI,QACd,yBAAyB,IAAI,OAAO,IAAI,SAAS,IACjD;AAAA,QACE;AAAA,UACE,MAAM;AAAA;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,UACX,QAAQ,CAAC;AAAA,QACX;AAAA,QACA,IAAI;AAAA,MACN;AACJ,YAAM,WAAW,sBAAsB;AAAA,QACrC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,WAAW,OAAO;AAAA,MACjC,CAAC;AACD,UAAI,SAAS,WAAW,QAAQ;AAC9B,cAAM,UAAU,kBAAkB,iBAAiB;AACnD,cAAM,UAAU,OAAO,MAAM,OAAO,aAAa;AACjD,aAAK,OAAO;AAAA,UACV,IAAI;AAAA,UACJ,SAAS;AAAA,UACT,QAAQ;AAAA,UACR;AAAA,UACA,YAAY,KAAK,IAAI,IAAI;AAAA,UACzB,MAAM,MAAM;AAAA,UACZ,QAAQ,MAAM;AAAA,UACd,WAAW,MAAM;AAAA,UACjB,WAAW,KAAK;AAAA,UAChB,YAAY,qBAAqB,KAAK;AAAA;AAAA,UAEtC,GAAI,OAAO,SAAS,OAAO,KAAK,MAAM,OAAO,cAAc,YACvD,EAAE,YAAY,QAAQ,IACtB,CAAC;AAAA,QACP,CAAC;AAGD,YAAI,MAAM,YAAY,kBAAkB,GAAG;AACzC,gBAAM,uBAAuB,OAAO,eAAe;AAAA,QACrD;AACA,cAAM;AAAA,MACR;AACA,YAAM,KAAK,WAAW,MAAM,SAAS,OAAO;AAI5C,2BAAqB,MAAM,KAAK,eAAe,gBAAgB;AAE/D,UAAI,MAAM,WAAW;AACnB,4BAAoB;AAAA,MACtB,WAAW,MAAM,UAAU;AACzB,2BAAmB;AAAA,MACrB,OAAO;AACL,0BAAkB;AAAA,MACpB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,0BAAkC;AAIpC,UAAM,aAAa,KAAK,MAAM,KAAK,iBAAiB,KAAK,SAAS;AAClE,QAAI,cAAc,EAAG,QAAO;AAC5B,WAAO,KAAK,IAAI,YAAY,8BAA8B;AAAA,EAC5D;AAAA;AAAA,EAGQ,SAA0C;AAChD,UAAM,OAAO,KAAK;AAClB,QAAI,kBAAkB,KAAK,IAAI,KAAK,KAAK,WAAW,MAAM,EAAG,QAAO;AACpE,QAAI,KAAK,WAAW,GAAG,EAAG,QAAO;AACjC,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,qBAAqB,OAA8B;AACjD,WAAO,gBAAgB,OAAO,KAAK,KAAK,MAAM,KAAK,OAAO,CAAC;AAAA,EAC7D;AAAA;AAAA,EAGA,mBAAwC;AACtC,WAAO,KAAK,OAAO,MAAM,YAAY,YAAY;AAAA,EACnD;AAAA,EAEA,MAAc,kBACZ,MACA,gBACiF;AACjF,UAAM,QAAQ,mBAAmB,KAAK,GAAG;AACzC,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,UAAU,MAAM,UAAU,UAAU,KAAK,qBAAqB,cAAc;AAClF,UAAM,UAAU,YAAY,OAAO,OAAO;AAC1C,UAAM,UAAU,MAAM,UAAU,KAAK,MAAM,KAAK,IAAI,MAAM,MAAM,OAAO,EAAE,KAAK,QAAQ,IAAI;AAC1F,UAAM,MAAM,MAAM,sBAAsB,OAAO,SAAS,OAAO,SAAS;AACtE,YAAM,KAAK,sBAAsB,EAAE,GAAG,MAAM,eAAe,KAAK,CAAC;AACjE,WAAK,aAAa,IAAI,MAAM,KAAK;AAAA,IACnC,CAAC;AACD,UAAM,QAAQ,mBAAmB,YAAY,eAAe,eAAe;AAC3E,WAAO,EAAE,SAAS,OAAO,IAAI;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,2BAA2B,OAA+B;AAC9D,UAAM,SAAS,UAAU,SAAY,CAAC,GAAG,KAAK,YAAY,IAAI,CAAC,KAAK;AACpE,eAAW,SAAS,QAAQ;AAC1B,YAAM,OAAO,+BAA+B,qBAAqB,KAAK,CAAC;AACvE,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,KAAK;AAAA,UAC7B,OAAO;AAAA,UACP,UAAU,EAAE,MAAM,WAAW,KAAK;AAAA,QACpC,CAAC;AACD,YAAI,OAAO,UAAU,YAAY;AAC/B,gBAAM,IAAI,MAAM,kDAAkD,OAAO,KAAK,EAAE;AAAA,QAClF;AAAA,MACF,SAAS,OAAO;AACd,YAAI,EAAE,iBAAiB,0BAA0B,MAAM,YAAa,OAAM;AAAA,MAC5E;AACA,WAAK,aAAa,OAAO,KAAK;AAAA,IAChC;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,KAAK,MAAyD;AAClE,WAAO,MAAM,KAAK,aAAa,MAAM,KAAK;AAAA,EAC5C;AAAA;AAAA;AAAA,EAIA,MAAM,cACJ,MAC+B;AAC/B,QAAI,KAAK,MAAM,aAAa,wCAAwC;AAClE,YAAM,IAAI,WAAW,uCAAuC;AAAA,IAC9D;AACA,WAAO,MAAM,KAAK,aAAa,MAAM,OAAO,KAAK,MAAM,MAAM,CAAC;AAAA,EAChE;AAAA,EAEA,MAAc,aACZ,MACA,iBACA,QAAoB,IAAI,WAAW,CAAC,GACL;AAG/B,UAAM,OAAO,gBAAgB,KAAK,QAAQ,OAAO,WAAW,CAAC;AAC7D,QAAI;AACJ,QAAI;AACJ,QAAI;AAIJ,UAAM,qBAAqB,KAAK;AAChC,QAAI;AAGF,kBAAY,MAAM,KAAK,aAAa;AACpC,YAAM,iBAAiB,KAAK,OAAO,KAAK;AAOxC,YAAM,SAAS,MAAM,KAAK,kBAAkB,MAAM,cAAc;AAChE,YAAM,cAAc,QAAQ,WAAW,KAAK;AAC5C,YAAM,QAAQ,QAAQ,SAAS;AAC/B,gBAAU;AAAA;AAAA;AAAA;AAAA,QAIR,SAAS,QACL,kBAAkB,OAAO,aAAa,SAAS,QAAQ,KAAK,UAAU,IAAI,IAC1E,CAAC,WAAW;AAAA,QAChB,OAAO,CAAC;AAAA;AAAA;AAAA;AAAA,QAIR,KAAK,4BAA4B,KAAK,eAAe,KAAK,OAAO;AAAA;AAAA;AAAA;AAAA,QAIjE,KAAK,EAAE,GAAI,KAAK,2BAA2B,KAAK,CAAC,GAAI,GAAI,QAAQ,OAAO,CAAC,EAAG;AAAA,QAC5E;AAAA,QACA,WAAW;AAAA,MACb;AACA,uBAAiB,KAAK,kBAAkB,SAAS;AACjD,UAAI,CAAC,eAAgB,OAAM,qBAAqB;AAAA,IAClD,SAAS,OAAO;AAGd,yCAAmC,IAAI;AACvC,YAAM;AAAA,IACR;AACA,QAAI;AACF,aAAO,MAAM,KAAK;AAAA,QAChB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,kBACI,KAAK;AAAA,UACH;AAAA,UACA,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,eAAe,sCAAsC,CAAC;AAAA,QACpF,IACA;AAAA,QACJ,KAAK;AAAA,QACL;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,UAAI,iBAAiB,0BAA0B;AAC7C,cAAM,qBAAqB,KAAK;AAAA,MAClC;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAc,gBACZ,QACA,WACA,SACA,oBACA,mBACA,SACA,MAC+B;AAC/B,UAAM,YAAY,KAAK,IAAI;AAC3B,QAAI,mBAAkC;AACtC,QAAI,2BAA2B;AAC/B,QAAI,gBAAgB;AACpB,UAAM,iBAIF;AAAA,MACF,QAAQ,CAAC;AAAA,MACT,QAAQ,CAAC;AAAA,IACX;AACA,SAAK,wBAAwB,IAAI,MAAM,MAAM;AAC7C,SAAK,uBAAuB,IAAI,MAAM,cAAc;AACpD,UAAM,gBAAwC;AAAA,MAC5C,mBAAmB,OAAO,kBAAkB;AAC1C,YAAI,kBAAkB,KAAM,QAAO;AACnC,cAAM,OAAO,OAAO,IAAI;AACxB,eAAO;AAAA,MACT;AAAA,MACA,oBAAoB,OAAO,kBAAkB;AAC3C,YAAI,kBAAkB,MAAM;AAC1B,gBAAM,IAAI,MAAM,6DAA6D;AAAA,QAC/E;AACA,eAAO,MAAM,KAAK,6BAA6B,MAAM,QAAQ,cAAc;AAAA,MAC7E;AAAA,IACF;AACA,2CAAuC,aAAa;AACpD,QAAI;AACF,YAAM,SACJ,qBAAqB,IAAI,qBAAqB,iCAAiC;AACjF,YAAM,SACJ,oBAAoB,KAAK,KAAK,yBAC1B,MAAM,OAAO,cAAc,MAAM,SAAS,oBAAoB,QAAQ;AAAA,QACpE,SAAS;AAAA,QACT,eAAe,OAAO,WAAW;AAC/B,cAAI;AACF,kBAAM,KAAK,iCAAiC,kBAAkB,MAAM;AAAA,QACxE;AAAA,QACA,SAAS,YAAY;AACnB,qCAA2B;AAC3B,kDAAwC,IAAI;AAC5C,gBAAM,UAAU,MAAM,KAAK,uBAAwB;AAAA,YACjD,oBAAoB,UAAU;AAAA,YAC9B,cAAc,KAAK;AAAA,YACnB,sBAAsB,UAAU;AAAA,YAChC;AAAA,YACA;AAAA,UACF,CAAC;AACD,6BAAmB,QAAQ;AAC3B,eAAK,oBAAoB,IAAI,QAAQ,WAAW,YAAY;AAC1D,kBAAM,SAAS,MAAM,OAAO,aAAa,MAAM,KAAK,OAAO,WAAW;AACpE,oBAAM,KAAK,iCAAiC,QAAQ,WAAW,MAAM;AAAA,YACvE,CAAC;AACD,kBAAM,WAAW,OAAO,WAAW,cAAc,SAAS,OAAO;AACjE,kBAAM,gBACJ,OAAO,kBACN,OAAO,WAAW,YAAY,OAAO,UAAU,gBAAgB;AAClE,gBAAI,UAAU;AACZ,oBAAM,KAAK,0BAA0B;AAAA,gBACnC,WAAW,QAAQ;AAAA,gBACnB,oBAAoB,UAAU;AAAA,gBAC9B,cAAc,KAAK;AAAA,gBACnB,sBAAsB,UAAU;AAAA,gBAChC;AAAA,gBACA,SAAS;AAAA,gBACT,GAAI,KAAK,kCAAkC,gBACvC,EAAE,cAAc,IAChB,CAAC;AAAA,gBACL,UAAU,SAAS,QAAQ,SAAS;AAAA,gBACpC,QAAQ,SAAS,QAAQ,UACrB,cAAc,SAAS,QAAQ,QAAQ,YAAY,QAAQ,mBAAmB,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,KAChG;AAAA,gBACJ,GAAI,SAAS,QAAQ,UACjB;AAAA,kBACE,SAAS;AAAA,oBACP,MAAM,SAAS,QAAQ,QAAQ,YAC5B,QAAQ,mBAAmB,GAAG,EAC9B,MAAM,GAAG,GAAG;AAAA,oBACf,QAAQ,SAAS,QAAQ,QAAQ;AAAA,oBACjC,WAAW;AAAA,kBACb;AAAA,gBACF,IACA,CAAC;AAAA,cACP,CAAC;AACD,mBAAK,oBAAoB,OAAO,QAAQ,SAAS;AACjD,kBAAI,SAAS,QAAQ;AACnB,sBAAM,4BAA4B,SAAS,QAAQ,OAAO;AAAA,YAC9D;AAAA,UACF,CAAC;AACD,qCAA2B;AAC3B,8CAAoC,IAAI;AAAA,QAC1C;AAAA,MACF,CAAC,IACD;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,MAAM,OAAO,KAAK,MAAM,SAAS,oBAAoB,MAAM;AAAA,MACtE;AACN,UAAI,OAAO,WAAW,WAAW;AAC/B,wBAAgB,OAAO,aAAa;AACpC,YAAI,OAAO,YAAY,kBAAkB;AACvC,gBAAM,QAAQ;AAAA,YACZ,KAAK,0BAA0B;AAAA,cAC7B,WAAW;AAAA,cACX,oBAAoB,UAAU;AAAA,cAC9B,cAAc,KAAK;AAAA,cACnB,sBAAsB,UAAU;AAAA,cAChC;AAAA,cACA,SAAS;AAAA,cACT,GAAI,KAAK,kCAAkC,OAAO,SAAS,gBACvD,EAAE,eAAe,OAAO,SAAS,cAAc,IAC/C,CAAC;AAAA,cACL,UAAU,OAAO,SAAS,QAAQ,SAAS;AAAA,cAC3C,QAAQ,OAAO,SAAS,QAAQ,UAC5B,cAAc,OAAO,SAAS,QAAQ,QAAQ,YAAY,QAAQ,mBAAmB,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,KACvG;AAAA,cACJ,GAAI,OAAO,SAAS,QAAQ,UACxB;AAAA,gBACE,SAAS;AAAA,kBACP,MAAM,OAAO,SAAS,QAAQ,QAAQ,YACnC,QAAQ,mBAAmB,GAAG,EAC9B,MAAM,GAAG,GAAG;AAAA,kBACf,QAAQ,OAAO,SAAS,QAAQ,QAAQ;AAAA,kBACxC,WAAW;AAAA,gBACb;AAAA,cACF,IACA,CAAC;AAAA,YACP,CAAC;AAAA,UACH,EAAE,MAAM,MAAM,MAAS;AAAA,QACzB;AACA,cAAMC,WAAU,OAAO,QAAQ,OAAO;AACtC,aAAK,OAAO;AAAA,UACV,IAAI;AAAA,UACJ,SAAS;AAAA,UACT,QAAQA,WAAU;AAAA,UAClB,SAAAA;AAAA,UACA,YAAY,KAAK,IAAI,IAAI;AAAA,UACzB,WAAW,KAAK;AAAA,UAChB,YAAY,OAAO;AAAA,UACnB,GAAIA,WAAU,IAAI,EAAE,YAAY,OAAO,QAAQ,IAAI,iBAAiB,WAAW,IAAI,CAAC;AAAA,QACtF,CAAC;AACD,cAAM,SAAS,QAAQ,OAAO,OAAO,MAAM;AAC3C,cAAM,SAAS,QAAQ,OAAO,OAAO,MAAM;AAC3C,eAAO;AAAA,UACL,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,UACA,UAAU;AAAA,UACV,UAAU;AAAA,UACV,qBAAqB;AAAA,UACrB,gBAAgB,OAAO;AAAA,QACzB;AAAA,MACF;AACA,sBAAgB;AAChB,YAAM,UAAU,OAAO;AACvB,UAAI,kBAAkB;AACpB,cAAM,QAAQ;AAAA,UACZ,KAAK,0BAA0B;AAAA,YAC7B,WAAW;AAAA,YACX,oBAAoB,UAAU;AAAA,YAC9B,cAAc,KAAK;AAAA,YACnB,sBAAsB,UAAU;AAAA,YAChC;AAAA,YACA,SAAS;AAAA,YACT,UAAU,QAAQ,SAAS;AAAA,YAC3B,QAAQ,QAAQ,UACZ,cAAc,QAAQ,QAAQ,YAAY,QAAQ,mBAAmB,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,KACvF;AAAA,YACJ,GAAI,QAAQ,UACR;AAAA,cACE,SAAS;AAAA,gBACP,MAAM,QAAQ,QAAQ,YAAY,QAAQ,mBAAmB,GAAG,EAAE,MAAM,GAAG,GAAG;AAAA,gBAC9E,QAAQ,QAAQ,QAAQ;AAAA,gBACxB,WAAW;AAAA,cACb;AAAA,YACF,IACA,CAAC;AAAA,UACP,CAAC;AAAA,QACH,EAAE,MAAM,MAAM,MAAS;AAAA,MACzB;AACA,YAAM,UAAU,QAAQ,QAAQ,QAAQ;AACxC,WAAK,OAAO;AAAA,QACV,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,QAAQ,UAAU;AAAA,QAClB;AAAA,QACA,YAAY,KAAK,IAAI,IAAI;AAAA,QACzB,WAAW,KAAK;AAAA,QAChB,YAAY,QAAQ;AAAA;AAAA;AAAA,QAGpB,GAAI,UAAU,IAAI,EAAE,YAAY,QAAQ,QAAQ,IAAI,iBAAiB,WAAW,IAAI,CAAC;AAAA,MACvF,CAAC;AACD,YAAM,eAAe,qBAAqB,QAAQ,UAAU,kBAAkB;AAC9E,qBAAe,YAAY,EAAE,QAAQ,aAAa,QAAQ,aAAa;AACvE,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,4BAA4B,CAAC,kBAAkB;AAGjD,mCAA2B;AAC3B,+CAAuC,IAAI;AAAA,MAC7C;AACA,UAAI,iBAAiB,yBAA0B,OAAM;AACrD,YAAM,eACJ,iBAAiB,yBACb,QACA,IAAI,uBAAuB;AAAA,QACzB,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,QAC9D,MAAMD,WAAU;AAAA,QAChB,QAAQ;AAAA,QACR,WAAW;AAAA,MACb,CAAC;AACP,UACE,CAAC,iBACD,CAAC,oBACD,CAAC,aAAa,aACd,wBAAwB,YAAY,KACpC,KAAK,wBACL;AAMA,YAAI;AACF,kDAAwC,IAAI;AAC5C,gBAAM,YAAY,MAAM,KAAK,uBAAuB;AAAA,YAClD,oBAAoB,UAAU;AAAA,YAC9B,cAAc,KAAK;AAAA,YACnB,sBAAsB,UAAU;AAAA,YAChC;AAAA,YACA;AAAA,YACA,WAAW;AAAA,UACb,CAAC;AACD,6BAAmB,UAAU;AAC7B,8CAAoC,IAAI;AAAA,QAC1C,QAAQ;AACN,iDAAuC,IAAI;AAAA,QAC7C;AAAA,MACF;AACA,WAAK,OAAO;AAAA,QACV,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,YAAY,KAAK,IAAI,IAAI;AAAA,QACzB,MAAM,aAAa;AAAA,QACnB,QAAQ,aAAa;AAAA,QACrB,WAAW,aAAa;AAAA,QACxB,WAAW,KAAK;AAAA,QAChB,YAAY,qBAAqB,YAAY;AAAA,MAC/C,CAAC;AACD,YAAM;AAAA,IACR,UAAE;AAKA,UAAI,iBAAiB,kBAAkB;AACrC,aAAK,wBAAwB,OAAO,IAAI;AACxC,aAAK,uBAAuB,OAAO,IAAI;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,oBAAoB,aAAgD;AACxE,eAAW,UAAU,KAAK,gBAAgB,OAAO,GAAG;AAClD,YAAM,OAAO,mBAAmB,WAAW;AAAA,IAC7C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,YAAY,MAA2C;AAC3D,UAAM,YAAY,KAAK,IAAI;AAC3B,UAAM,SAAS,MAAM,KAAK,aAAa,MAAM,IAAI;AACjD,QAAI,OAAO,uBAAuB,OAAO,gBAAgB;AACvD,YAAM,SAAS,sBAAsB,OAAO,QAAQ,OAAO,MAAM;AACjE,aAAO;AAAA,QACL,iDAAiD,OAAO,mBAAmB;AAAA,QAC3E,+BAA+B,OAAO,cAAc;AAAA,QACpD,GAAI,SAAS,CAAC,IAAI,WAAW,MAAM,IAAI,CAAC;AAAA,MAC1C,EAAE,KAAK,IAAI;AAAA,IACb;AACA,UAAM,WACJ,OAAO,OAAO,aAAa,YAAY,OAAO,cAAc,OAAO,QAAQ,IACvE,OAAO,WACP;AACN,WAAO,mBAAmB;AAAA,MACxB,QAAQ,sBAAsB,OAAO,QAAQ,OAAO,MAAM;AAAA,MAC1D,iBAAiB,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS,IAAI;AAAA,MACvD;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,kBAAkB,MAAgC;AACtD,UAAM,SAAS,KAAK,wBAAwB,IAAI,IAAI,KAAK,KAAK;AAC9D,QAAI,CAAC,OAAQ,QAAO;AACpB,UAAM,OAAO,OAAO,IAAI;AACxB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA,EAIA,MAAM,mBAAmB,MAAmD;AAC1E,UAAM,SAAS,KAAK,wBAAwB,IAAI,IAAI;AACpD,QAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,sDAAsD;AACnF,UAAM,SAAS,KAAK,uBAAuB,IAAI,IAAI;AACnD,QAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,4DAA4D;AACzF,WAAO,MAAM,KAAK,6BAA6B,MAAM,QAAQ,MAAM;AAAA,EACrE;AAAA,EAEA,MAAc,6BACZ,MACA,QACA,QACqC;AACrC,QAAI,OAAO,WAAW,WAAW,YAAa,QAAO,OAAO;AAC5D,UAAM,WAAW,MAAM,OAAO,aAAa,MAAM,KAAK,OAAO,WAAW;AACtE,iBAAWE,UAAS,OAAQ,QAAOA,OAAM,MAAM,EAAE,KAAKA,OAAM,KAAK;AAAA,IACnE,CAAC;AACD,QAAI,SAAS,WAAW,WAAW;AACjC,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ;AAAA,UACN,QAAQ,OAAO,OAAO,KAAK,EAAE;AAAA,UAC7B,QAAQ,OAAO,OAAO,KAAK,EAAE;AAAA,UAC7B,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,IACF;AACA,UAAM,SAAS,qBAAqB,SAAS,QAAQ,UAAU,KAAK,uBAAuB;AAC3F,UAAM,YAAwC;AAAA,MAC5C,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN,GAAG;AAAA,QACH,QAAQ,OAAO,OAAO,KAAK,EAAE;AAAA,QAC7B,QAAQ,OAAO,OAAO,KAAK,EAAE;AAAA,QAC7B,QAAQ,OAAO,OAAO,KAAK,EAAE;AAAA,MAC/B;AAAA,MACA,GAAI,SAAS,QAAQ,UACjB,EAAE,SAAS,4BAA4B,SAAS,QAAQ,OAAO,EAAE,IACjE,CAAC;AAAA,IACP;AACA,WAAO,YAAY;AACnB,QAAI,KAAK,wBAAwB,IAAI,IAAI,MAAM,QAAQ;AACrD,WAAK,wBAAwB,OAAO,IAAI;AACxC,WAAK,uBAAuB,OAAO,IAAI;AAAA,IACzC;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,cAAuB;AACrB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,MAAwE;AACtF,UAAM,QAAQ,MAAM,KAAK,SAAS;AAAA,MAChC,MAAM,KAAK;AAAA,MACX,GAAI,KAAK,QAAQ,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,IAC5C,CAAC;AACD,UAAM,YAAY,oBAAoB,OAAO,KAAK,IAAI;AACtD,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,MAAM,uDAAuD,KAAK,IAAI,EAAE;AAAA,IACpF;AACA,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO,EAAE,MAAM,WAAW,KAAK,KAAK,GAAG,UAAU;AAAA,IACnD;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,WAAW,MAAc,QAAmC;AAChE,UAAM,EAAE,OAAO,IAAI,MAAM,KAAK,SAAS,EAAE,KAAK,CAAC;AAC/C,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,QAAQ,MAGqE;AACjF,UAAM,SAAS,MAAM,KAAK,UAAU,EAAE,MAAM,KAAK,KAAK,CAAC;AACvD,WAAO,OAAO,OAAO,QAAQ,IAAI,CAAC,WAAW;AAAA,MAC3C,MAAM,MAAM;AAAA,MACZ,MAAM,MAAM;AAAA,MACZ,MACE,MAAM,SAAS,YAAY,0BACtB,QACD,MAAM,SAAS,YAAY,qBACxB,SACA;AAAA,IACX,EAAE;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,iBAAiB,OAAwE;AAI7F,UAAM,KAAK,eAAe,KAAK;AAC/B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa,OAAkC;AAC7C,UAAM,YAAYJ;AAClB,QAAI,CAAC,WAAW;AACd,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,aAAa,CAAC,SAAmC,KAAK,WAAW,MAAM,KAAK;AAClF,UAAMK,YAAW,OAAO,SACtB,QAAQ,OAAO,MAAM,KAAK,SAAS,EAAE,MAAM,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC,EAAG,CAAC,CAAC;AAC3E,UAAM,YAAY,OAChB,MACA,SACA,SACiF;AACjF,YAAM,QAAQ,QAAQ,OAAO,OAAO;AAKpC,UAAI,MAAM,cAAc,+BAA+B,OAAO,SAAS,YAAY;AACjF,cAAM,KAAK,UAAU,EAAE,MAAM,SAAS,eAAe,KAAK,CAAC;AAC3D;AAAA,MACF;AACA,YAAM,UAAU,MAAM,KAAK,eAAe,KAAK;AAC/C,UAAI,CAAC,QAAQ,+BAA+B;AAG1C,cAAM,KAAK,UAAU,EAAE,MAAM,SAAS,eAAe,KAAK,CAAC;AAC3D;AAAA,MACF;AACA,UAAI,OAAO;AACT,cAAM,IAAI,uBAAuB;AAAA,UAC/B,MAAMH,WAAU;AAAA,UAChB,SACE;AAAA,UACF,QAAQ;AAAA,UACR,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,kBAAkB,KAAK,oBAAoB,OAAO;AACxD,YAAM,eAAe,OAAO,SAAS,aAAa,MAAM,KAAK,IAAI;AACjE,YAAM,oBAAoB,KAAK,IAAI;AACnC,UAAI;AACF,cAAM,SAAS,MAAM,mBAAmB;AAAA,UACtC,MAAM,4BAA4B,KAAK,eAAe,IAAI;AAAA,UAC1D,SAAS;AAAA,UACT,GAAI,iBAAiB,SAAY,CAAC,IAAI,EAAE,aAAa,QAAQ,OAAO,YAAY,EAAE;AAAA,UAClF,SAAS;AAAA,QACX,CAAC;AAED,aAAK,OAAO;AAAA,UACV,IAAI;AAAA,UACJ,SAAS;AAAA,UACT,QAAQ,OAAO;AAAA,UACf,SAAS;AAAA,UACT,YAAY,KAAK,IAAI,IAAI;AAAA,UACzB,WAAW,KAAK;AAAA,QAClB,CAAC;AAAA,MACH,SAAS,OAAO;AACd,aAAK,OAAO;AAAA,UACV,IAAI;AAAA,UACJ,SAAS;AAAA,UACT,QAAQ;AAAA,UACR,SAAS;AAAA,UACT,YAAY,KAAK,IAAI,IAAI;AAAA,UACzB,WAAW,KAAK;AAAA,QAClB,CAAC;AACD,cAAM;AAAA,MACR;AACA,aAAO,OAAO,QAAQ,eAAe;AAInC,YAAI;AACF,gBAAM,aAAa,4BAA4B,KAAK,eAAe,MAAM;AACzE,gBAAM,cAA4B,CAAC;AACnC,cAAI,SAAS;AACb,cAAI,QAAQ;AACZ,iBAAO,SAAS,OAAO;AACrB,kBAAMI,SAAQ,MAAM,gBAAgB,OAAO,WAAW,GAAG;AAAA,cACvD,OAAO;AAAA,cACP,QAAQ;AAAA,gBACN,MAAM;AAAA,gBACN,QAAQ,OAAO,MAAM;AAAA,gBACrB,QAAQ,OAAO,2BAA2B;AAAA,cAC5C;AAAA,YACF,CAAC;AACD,gBAAIA,OAAM,MAAO,OAAM,yBAAyBA,OAAM,KAAK;AAC3D,gBAAIA,OAAM,QAAQ,UAAU;AAC1B,oBAAM,IAAI,MAAM,sCAAsC;AACxD,kBAAM,OAAOA,OAAM,OAAO;AAC1B,oBAAQ,aAAa,KAAK,WAAW,kBAAkB;AACvD,gBAAI,CAAC,KAAK,QAAQ,UAAU,SAAS;AACnC,oBAAM,IAAI,MAAM,oCAAoC;AACtD,wBAAY,KAAK,KAAK,OAAO;AAC7B,sBAAU,KAAK,QAAQ;AAAA,UACzB;AACA,gBAAM,SAAS,IAAI,WAAW,MAAM;AACpC,cAAI,SAAS;AACb,qBAAW,SAAS,aAAa;AAC/B,mBAAO,IAAI,OAAO,MAAM;AACxB,sBAAU,MAAM;AAAA,UAClB;AACA,cAAI,kBAAkB,MAAM,MAAM,kBAAkB,QAAQ,OAAO,UAAU,CAAC;AAC5E,kBAAM,IAAI,MAAM,oCAAoC;AACtD,gBAAM,QAAQ,MAAM,gBAAgB,OAAO,WAAW,GAAG;AAAA,YACvD,OAAO;AAAA,YACP,UAAU,EAAE,MAAM,YAAY,WAAW,MAAM;AAAA,UACjD,CAAC;AACD,cAAI,MAAM,MAAO,OAAM,yBAAyB,MAAM,KAAK;AAC3D,cAAI,MAAM,QAAQ,UAAU;AAC1B,kBAAM,IAAI,MAAM,iCAAiC;AAAA,QACrD,SAAS,OAAO;AACd,gBAAM,IAAI;AAAA,YACR;AAAA,YACA,EAAE,MAAM;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,UAAM,aAAa,OAAO,SAAgC;AACxD,YAAM,SAAS,MAAM,KAAK,KAAK;AAAA,QAC7B,OAAO;AAAA,QACP,UAAU;AAAA,UACR,MAAM,4BAA4B,KAAK,eAAe,IAAI;AAAA,UAC1D,WAAW;AAAA,QACb;AAAA,MACF,CAAC;AACD,UAAI,OAAO,UAAU,YAAY;AAC/B,cAAM,IAAI,MAAM,4CAA4C,OAAO,KAAK,EAAE;AAAA,MAC5E;AAAA,IACF;AACA,WAAO;AAAA,MACL,MAAM,WAAW,WAAW;AAC1B,YAAI,MAAM,WAAW,UAAU,IAAI,GAAG;AACpC,gBAAM,IAAI,MAAM,+CAA+C,UAAU,IAAI,EAAE;AAAA,QACjF;AACA,cAAM,UAAU,UAAU,MAAM,UAAU,IAAI,UAAU,MAAM,QAAQ,CAAC;AACvE,eAAO,CAAC;AAAA,MACV;AAAA,MACA,MAAM,WAAW,WAAW;AAC1B,cAAM,UAAU,MAAMD,UAAS,UAAU,IAAI;AAC7C,cAAM,OAAO,UAAU,SAAS,UAAU,IAAI;AAC9C,cAAM,cAAc,UAAU,UAAU,UAAU;AAClD,cAAM,kBACJ,gBAAgB,UAAU,OACtB,UACA,YACG,MAAM,WAAW,WAAW,IAAK,MAAMA,UAAS,WAAW,IAAI;AACxE,cAAM,UAAU,MAAM,UAAU,aAAa,MAAM,eAAe;AAClE,YAAI,UAAU,UAAU,gBAAgB,UAAU,MAAM;AACtD,cAAI,QAAS,OAAM,QAAQ,UAAU,MAAM,OAAO;AAAA,cAC7C,OAAM,WAAW,UAAU,IAAI;AAAA,QACtC;AACA,eAAO,CAAC;AAAA,MACV;AAAA,MACA,MAAM,WAAW,WAAW;AAC1B,cAAM,WAAW,UAAU,IAAI;AAC/B,eAAO,CAAC;AAAA,MACV;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,SAAS,MAAgF;AAC7F,UAAM,OAAO,4BAA4B,KAAK,eAAe,KAAK,IAAI;AACtE,UAAM,iBAAiB,KAAK,YAAY,OAAO;AAC/C,UAAM,SAAuB,CAAC;AAC9B,QAAI,SAAS;AACb,QAAI,YAAY,OAAO;AAEvB,WAAO,SAAS,kBAAkB,SAAS,WAAW;AACpD,YAAM,YAAY,KAAK,IAAI,iBAAiB,QAAQ,8BAA8B;AAClF,YAAM,SAAS,MAAM,KAAK,KAAK;AAAA,QAC7B,OAAO;AAAA,QACP,QAAQ;AAAA,UACN;AAAA,UACA,QAAQ,OAAO,MAAM;AAAA,UACrB,QAAQ,OAAO,SAAS;AAAA,QAC1B;AAAA,MACF,CAAC;AACD,UAAI,OAAO,UAAU,UAAU;AAC7B,cAAM,IAAI,MAAM,0CAA0C,OAAO,KAAK,EAAE;AAAA,MAC1E;AACA,kBAAY,aAAa,OAAO,OAAO,WAAW,sBAAsB;AACxE,UAAI,OAAO,OAAO,QAAQ,eAAe,EAAG;AAC5C,aAAO,KAAK,OAAO,OAAO,OAAO;AACjC,gBAAU,OAAO,OAAO,QAAQ;AAAA,IAClC;AAEA,UAAM,UAAU,IAAI,WAAW,MAAM;AACrC,QAAI,SAAS;AACb,eAAW,SAAS,QAAQ;AAC1B,cAAQ,IAAI,OAAO,MAAM;AACzB,gBAAU,MAAM;AAAA,IAClB;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,oBAAoB,SAAmE;AAC7F,WAAO,OACLE,YACA,OAC6B;AAC7B,YAAM,YAAY,KAAK,IAAI;AAC3B,UAAI;AACF,cAAM,UAAU,MAAM,KAAK,eAAe,KAAK;AAC/C,YACE,CAAC,QAAQ,iCACT,QAAQ,YAAY,QAAQ,WAC5B,QAAQ,yBAAyB,QAAQ,sBACzC;AACA,gBAAM,IAAI;AAAA,YACR;AAAA,UACF;AAAA,QACF;AACA,cAAM,WAAW,MAAM,KAAK,WAAW;AAAA,UACrC,QAAQ;AAAA,UACR;AAAA,YACE,WAAAA;AAAA,YACA,OAAO,KAAK;AAAA,YACZ;AAAA,YACA,gBAAgB;AAAA,UAClB;AAAA,UACA,EAAE,WAAW,KAAK,UAAU;AAAA,QAC9B;AACA,YAAI,SAAS,cAAcA;AACzB,gBAAM,IAAI,MAAM,oEAAoE;AACtF,cAAM,QAAQ,SAAS,QACnB,yBAAyB,SAAS,OAAOA,UAAS,IAClD;AACJ,aAAK,OAAO;AAAA,UACV,IAAI,GAAG;AAAA,UACP,SAAS,SAAS,CAAC,SAAS,SAAS,WAAW;AAAA,UAChD,QAAQ;AAAA,UACR,SAAS;AAAA,UACT,YAAY,KAAK,IAAI,IAAI;AAAA,UACzB,WAAW,KAAK;AAAA,UAChB,GAAI,QACA,EAAE,MAAM,MAAM,MAAM,QAAQ,MAAM,QAAQ,YAAY,qBAAqB,KAAK,EAAE,IAClF,CAAC;AAAA,QACP,CAAC;AACD,eAAO;AAAA,MACT,SAAS,OAAO;AACd,aAAK,OAAO;AAAA,UACV,IAAI,GAAG;AAAA,UACP,SAAS;AAAA,UACT,QAAQ;AAAA,UACR,SAAS;AAAA,UACT,YAAY,KAAK,IAAI,IAAI;AAAA,UACzB,WAAW,KAAK;AAAA,UAChB,GAAI,iBAAiB,yBACjB,EAAE,MAAM,MAAM,MAAM,QAAQ,MAAM,QAAQ,YAAY,qBAAqB,KAAK,EAAE,IAClF,CAAC;AAAA,QACP,CAAC;AACD,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,UAAU,MAMI;AAClB,UAAM,UAAU,OAAO,KAAK,YAAY,WAAW,QAAQ,OAAO,KAAK,OAAO,IAAI,KAAK;AACvF,QAAI,KAAK,OAAO;AACd,YAAM,IAAI,uBAAuB;AAAA,QAC/B,MAAML,WAAU;AAAA,QAChB,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,QAAI,QAAQ,aAAa,+BAA+B,CAAC,KAAK,QAAQ;AACpE,YAAM,UAAU,MAAM,KAAK,eAAe,KAAK;AAC/C,UAAI,QAAQ,+BAA+B;AACzC,cAAM,cAAe,MAAM,KAAK,WAAW,KAAK,IAAI,IAChD,MAAM,KAAK,SAAS,EAAE,MAAM,KAAK,KAAK,CAAC,IACvC;AACJ,cAAM,mBAAmB;AAAA,UACvB,MAAM,4BAA4B,KAAK,eAAe,KAAK,IAAI;AAAA,UAC/D;AAAA,UACA,GAAI,gBAAgB,SAAY,CAAC,IAAI,EAAE,YAAY;AAAA,UACnD,eAAe,KAAK,iBAAiB;AAAA,UACrC,SAAS,KAAK,oBAAoB,OAAO;AAAA,QAC3C,CAAC;AACD,eAAO,QAAQ;AAAA,MACjB;AAAA,IACF;AACA,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,OAAO;AAAA,MACP,SAAS;AAAA,QACP,MAAM,4BAA4B,KAAK,eAAe,KAAK,IAAI;AAAA,QAC/D;AAAA,QACA,eAAe,KAAK,iBAAiB;AAAA,QACrC,QAAQ,KAAK,UAAU;AAAA,QACvB,MAAM;AAAA,MACR;AAAA,IACF,CAAC;AACD,QAAI,OAAO,UAAU,WAAW;AAC9B,YAAM,IAAI,MAAM,2CAA2C,OAAO,KAAK,EAAE;AAAA,IAC3E;AACA,WAAO,OAAO,OAAO,QAAQ,YAAY;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,sBAAsB,MAKR;AAClB,UAAM,OAAO,+BAA+B,KAAK,IAAI;AACrD,UAAM,UAAU,OAAO,KAAK,YAAY,WAAW,QAAQ,OAAO,KAAK,OAAO,IAAI,KAAK;AACvF,QAAI,QAAQ,aAAa,6CAA6C;AACpE,YAAM,IAAI,UAAU,iDAAiD;AAAA,IACvE;AACA,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,OAAO;AAAA,MACP,SAAS;AAAA,QACP;AAAA,QACA;AAAA,QACA,eAAe,KAAK,iBAAiB;AAAA,QACrC,QAAQ;AAAA,QACR,MAAM;AAAA,MACR;AAAA,IACF,CAAC;AACD,QAAI,OAAO,UAAU,WAAW;AAC9B,YAAM,IAAI,MAAM,uDAAuD,OAAO,KAAK,EAAE;AAAA,IACvF;AACA,WAAO,OAAO,OAAO,QAAQ,YAAY;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,uBAAuB,MAAc,QAAgC;AACzE,UAAM,cAAc,+BAA+B,IAAI;AACvD,QAAI;AACF,YAAM,SAAS,MAAM,KAAK,KAAK;AAAA,QAC7B,OAAO;AAAA,QACP,UAAU,EAAE,MAAM,aAAa,WAAW,MAAM;AAAA,MAClD,CAAC;AACD,UAAI,OAAO,UAAU,YAAY;AAC/B,cAAM,IAAI,MAAM,wDAAwD,OAAO,KAAK,EAAE;AAAA,MACxF;AAAA,IACF,SAAS,OAAO;AACd,UAAI,iBAAiB,0BAA0B,MAAM,WAAY;AACjE,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,UAAU,MAG0D;AACxE,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,OAAO;AAAA,MACP,QAAQ;AAAA,QACN,MAAM,4BAA4B,KAAK,eAAe,KAAK,IAAI;AAAA,QAC/D,WAAW,KAAK,aAAa;AAAA,MAC/B;AAAA,IACF,CAAC;AACD,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,IAAI,MAAM,2CAA2C,OAAO,KAAK,EAAE;AAAA,IAC3E;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,SAAS,MAAsD;AACnE,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,OAAO;AAAA,MACP,QAAQ,EAAE,MAAM,4BAA4B,KAAK,eAAe,KAAK,IAAI,EAAE;AAAA,IAC7E,CAAC;AACD,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,IAAI,MAAM,0CAA0C,OAAO,KAAK,EAAE;AAAA,IAC1E;AACA,WAAO,EAAE,QAAQ,OAAO,OAAO,OAAO;AAAA,EACxC;AAAA;AAAA;AAAA,EAIA,MAAM,qBACJ,SACuC;AACvC,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,OAAO;AAAA,MACP,sBAAsB;AAAA,IACxB,CAAC;AACD,QAAI,OAAO,UAAU,wBAAwB;AAC3C,YAAM,IAAI,MAAM,sDAAsD,OAAO,KAAK,EAAE;AAAA,IACtF;AACA,WAAO,OAAO;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,mBAAmB,SAAqE;AAC5F,UAAM,YAAY,MAAM,KAAK,eAAe,KAAK;AACjD,QAAI,CAAC,UAAU,4BAA6B,QAAO,EAAE,MAAM,cAAc;AAEzE,UAAM,eAAe,QAAQ,YAAY;AACzC,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,KAAK;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,oBAAoB;AAAA,YAClB,SAAS,QAAQ;AAAA,YACjB,iBAAiB,QAAQ;AAAA,YACzB,QAAQ,QAAQ;AAAA,YAChB,MAAM,QAAQ;AAAA,YACd,aAAa,QAAQ;AAAA,YACrB,MAAM,QAAQ,QAAQ,IAAI,WAAW;AAAA,YACrC,SAAS,QAAQ,SAAS;AAAA,YAC1B,WAAW,QAAQ;AAAA,YACnB,kBAAkB,OAAO,QAAQ,gBAAgB;AAAA,UACnD;AAAA,QACF;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,UACE,iBAAiB,0BACjB,MAAM,SAASA,WAAU,sBACzB;AACA,eAAO,EAAE,MAAM,oBAAoB;AAAA,MACrC;AACA,YAAM;AAAA,IACR;AACA,QAAI,OAAO,UAAU,sBAAsB;AACzC,YAAM,IAAI,MAAM,oDAAoD,OAAO,KAAK,EAAE;AAAA,IACpF;AACA,UAAM,WAAW,OAAO;AACxB,UAAM,aAAa,OAAO,SAAS,UAAU;AAC7C,QACE,CAAC,OAAO,cAAc,UAAU,KAChC,aAAa,SAAS,KAAK,cAC3B,aAAa,QAAQ,kBACrB;AACA,YAAM,IAAI,MAAM,2DAA2D;AAAA,IAC7E;AACA,QAAI,OAAO,SAAS;AACpB,QAAI,SAAS,SAAS;AACpB,YAAM,WAAW,IAAI,WAAW,UAAU;AAC1C,eAAS,IAAI,SAAS,MAAM,CAAC;AAC7B,UAAI,SAAS,SAAS,KAAK;AAC3B,iBAAS;AACP,cAAM,OAAO,MAAM,KAAK;AAAA,UACtB;AAAA,YACE,OAAO;AAAA,YACP,wBAAwB,EAAE,SAAS,SAAS,SAAS,QAAQ,OAAO,MAAM,EAAE;AAAA,UAC9E;AAAA,UACA,KAAK;AAAA,UACL;AAAA,QACF;AACA,YAAI,KAAK,UAAU,0BAA0B;AAC3C,gBAAM,IAAI,MAAM,wDAAwD,KAAK,KAAK,EAAE;AAAA,QACtF;AACA,cAAM,OAAO,KAAK;AAClB,YAAI,SAAS,KAAK,KAAK,aAAa,YAAY;AAC9C,gBAAM,IAAI,MAAM,gEAAgE;AAAA,QAClF;AACA,iBAAS,IAAI,KAAK,MAAM,MAAM;AAC9B,kBAAU,KAAK,KAAK;AACpB,YAAI,KAAK,KAAM;AACf,YAAI,KAAK,KAAK,eAAe,GAAG;AAC9B,gBAAM,IAAI,MAAM,2DAA2D;AAAA,QAC7E;AAAA,MACF;AACA,UAAI,WAAW,YAAY;AACzB,cAAM,IAAI,MAAM,2DAA2D;AAAA,MAC7E;AACA,aAAO;AAAA,IACT,WAAW,SAAS,KAAK,eAAe,YAAY;AAClD,YAAM,IAAI,MAAM,uDAAuD;AAAA,IACzE;AACA,UAAM,UAAU,oBAAI,IAAoB;AACxC,eAAW,UAAU,SAAS,QAAS,SAAQ,IAAI,OAAO,KAAK,YAAY,GAAG,OAAO,KAAK;AAC1F,WAAO,EAAE,MAAM,YAAY,QAAQ,SAAS,QAAQ,SAAS,KAAK;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,kBACJ,SACoE;AACpE,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,OAAO;AAAA,MACP,mBAAmB;AAAA,IACrB,CAAC;AACD,QAAI,OAAO,UAAU,uBAAuB,CAAC,OAAO,kBAAkB,SAAS;AAC7E,YAAM,IAAI,MAAM,mDAAmD,OAAO,KAAK,EAAE;AAAA,IACnF;AACA,UAAM,UAAU,OAAO,kBAAkB;AACzC,WAAO,EAAE,SAAS,UAAU,KAAK,cAAc,OAAO,EAAE;AAAA,EAC1D;AAAA;AAAA,EAGA,MAAM,mBACJ,SACoE;AACpE,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,OAAO;AAAA,MACP,oBAAoB;AAAA,IACtB,CAAC;AACD,QAAI,OAAO,UAAU,wBAAwB,CAAC,OAAO,mBAAmB,SAAS;AAC/E,YAAM,IAAI,MAAM,oDAAoD,OAAO,KAAK,EAAE;AAAA,IACpF;AACA,UAAM,UAAU,OAAO,mBAAmB;AAC1C,WAAO,EAAE,SAAS,UAAU,KAAK,cAAc,OAAO,EAAE;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,KAAK,QAAQ,YAAY,GAAqB;AAClD,UAAM,YAAY,MAAM,KAAK,eAAe,KAAK;AACjD,UAAM,MAAsB;AAAA,MAC1B,WAAW,OAAO,WAAW;AAAA,MAC7B,OAAO,KAAK;AAAA,MACZ,gBAAgB;AAAA,MAChB,IAAI,EAAE,OAAO,QAAQ,MAAM,EAAE,MAAM,EAAE;AAAA,IACvC;AACA,UAAM,MAAM,MAAM,KAAK,WAAW,QAAQ,UAAU,SAAS,KAAK;AAAA,MAChE,WAAW,KAAK;AAAA,IAClB,CAAC;AACD,WAAO,CAAC,IAAI,SAAS,IAAI,QAAQ,UAAU;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAM,mBAAmB,MAA4C;AAUnE,QAAI;AACJ,QAAI,SAASM,sBAAqB;AAChC,YAAM,SAAS,MAAM,KAAK,KAAK;AAAA,QAC7B,OAAO;AAAA,QACP,eAAe,EAAE,OAAO,GAAG,QAAQ,EAAE;AAAA,MACvC,CAAC;AACD,UAAI,OAAO,UAAU,iBAAiB;AACpC,cAAM,IAAI;AAAA,UACR,iCAAiC,IAAI,wBAAwB,OAAO,KAAK;AAAA,QAC3E;AAAA,MACF;AACA,gBAAU,OAAO,cAAc;AAAA,IACjC,OAAO;AAIL,YAAM,SAAS,MAAM,KAAK,KAAK;AAAA,QAC7B,OAAO;AAAA;AAAA,QAEP,SAAS;AAAA,UACP,SAAS,CAAC;AAAA,UACV,KAAK,KAAK;AAAA,UACV,KAAK,CAAC;AAAA,UACN,MAAM;AAAA,UACN,MAAM;AAAA,UACN,MAAM;AAAA,UACN,SAAS,KAAK;AAAA,QAChB;AAAA,MACF,CAAC;AACD,UAAI,OAAO,UAAU,WAAW;AAC9B,cAAM,IAAI;AAAA,UACR,iCAAiC,IAAI,wBAAwB,OAAO,KAAK;AAAA,QAC3E;AAAA,MACF;AACA,gBAAU,OAAO,QAAQ;AAAA,IAC3B;AACA,QAAI,QAAS,QAAO,KAAK,cAAc,OAAO;AAC9C,UAAM,YAAY,WAAW,KAAK,oBAAoB,KAAK,SAAS,IAAI;AACxE,UAAM,MAAM,KAAK,MAAM,OAAO;AAG9B,UAAM,eACJ,MAAM,mBAAmB,KAAK,kBAAkB,CAAC,UACvC,mBAAmB,KAAK,OAAO,CAAC,SACjC,IAAI,YACD,mBAAmB,SAAS,CAAC;AAC3C,WAAO;AAAA,MACL,MAAM,KAAK,MAAM;AAAA,MACjB,MAAM,KAAK,MAAM,SAAS,MAAM,MAAM;AAAA,MACtC;AAAA;AAAA,MAEA,MAAM,KAAK,MAAM,QAAQ;AAAA,MACzB,OAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,cAAc,SAA6C;AACjE,UAAM,MAAM,KAAK,MAAM,OAAO;AAC9B,UAAM,eACJ,MAAM,mBAAmB,QAAQ,WAAW,CAAC,UACnC,mBAAmB,QAAQ,OAAO,CAAC,SACpC,QAAQ,IAAI,YACT,mBAAmB,QAAQ,SAAS,CAAC;AACnD,WAAO;AAAA,MACL,MAAM,KAAK,MAAM;AAAA,MACjB,MAAM,KAAK,MAAM,SAAS,MAAM,MAAM;AAAA,MACtC;AAAA,MACA,MAAM,KAAK,MAAM,QAAQ;AAAA,MACzB,OAAO;AAAA,MACP,UAAU,eAAe,QAAQ,IAAI;AAAA,IACvC;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,wBAAyD;AAC7D,WAAO,EAAE,SAAS,KAAK,QAAQ;AAAA,EACjC;AACF;AAgBO,IAAM,0BAAN,MAA8B;AAAA,EAC1B,YAAY;AAAA,EACZ,yBAAyB;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EAGA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACT;AAAA,EAER,YAAY,MA4CT;AACD,SAAK,cAAc,KAAK;AACxB,SAAK,qBAAqB,KAAK;AAC/B,SAAK,QAAQ,KAAK;AAClB,SAAK,oBAAoB,KAAK;AAC9B,SAAK,gBAAgB,KAAK;AAC1B,SAAK,iBAAiB,KAAK;AAC3B,SAAK,uBAAuB,KAAK;AACjC,SAAK,kBAAkB,KAAK;AAC5B,SAAK,QAAQ,KAAK;AAClB,SAAK,YAAY,KAAK;AACtB,SAAK,gBAAgB,KAAK;AAC1B,SAAK,0BAA0B,KAAK;AACpC,SAAK,mCAAmC,KAAK;AAC7C,SAAK,6BAA6B,KAAK;AACvC,SAAK,gCAAgC,KAAK;AAC1C,SAAK,8BAA8B,KAAK;AACxC,SAAK,4BAA4B,KAAK;AACtC,SAAK,yBAAyB,KAAK;AACnC,SAAK,0BAA0B,KAAK;AACpC,SAAK,iCAAiC,KAAK;AAC3C,SAAK,cAAc,KAAK;AACxB,SAAK,2BAA2B,KAAK;AACrC,SAAK,OAAO,KAAK;AACjB,SAAK,WAAW,KAAK;AAAA,EACvB;AAAA,EAEQ,aAAyB;AAC/B,QAAI,CAAC,KAAK,gBAAgB;AACxB,WAAK,iBAAiB,KAAK,kBAAkB;AAAA,IAC/C;AACA,WAAO,KAAK;AAAA,EACd;AAAA,EAEQ,KAAK,SAAoC;AAC/C,WAAO,IAAI,kBAAkB;AAAA,MAC3B,aAAa,KAAK;AAAA,MAClB,GAAI,KAAK,uBAAuB,SAC5B,EAAE,oBAAoB,KAAK,mBAAmB,IAC9C,CAAC;AAAA,MACL;AAAA,MACA,sBAAsB,KAAK,4BAA4B;AAAA,MACvD,YAAY,KAAK,WAAW;AAAA,MAC5B,OAAO,KAAK;AAAA,MACZ,eAAe,KAAK;AAAA,MACpB,GAAI,KAAK,oBAAoB,SAAY,EAAE,iBAAiB,KAAK,gBAAgB,IAAI,CAAC;AAAA,MACtF,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,MACxD,GAAI,KAAK,cAAc,SAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,MACpE,GAAI,KAAK,kBAAkB,SAAY,EAAE,eAAe,KAAK,cAAc,IAAI,CAAC;AAAA,MAChF,GAAI,KAAK,4BAA4B,SACjC,EAAE,yBAAyB,KAAK,wBAAwB,IACxD,CAAC;AAAA,MACL,GAAI,KAAK,qCAAqC,SAC1C;AAAA,QACE,kCAAkC,KAAK;AAAA,MACzC,IACA,CAAC;AAAA,MACL,GAAI,KAAK,+BAA+B,SACpC,EAAE,4BAA4B,KAAK,2BAA2B,IAC9D,CAAC;AAAA,MACL,+BAA+B,KAAK,kCAAkC;AAAA,MACtE,6BAA6B,KAAK,gCAAgC;AAAA,MAClE,GAAI,KAAK,8BAA8B,SACnC,EAAE,2BAA2B,KAAK,0BAA0B,IAC5D,CAAC;AAAA,MACL,GAAI,KAAK,2BAA2B,SAChC,EAAE,wBAAwB,KAAK,uBAAuB,IACtD,CAAC;AAAA,MACL,GAAI,KAAK,4BAA4B,SACjC,EAAE,yBAAyB,KAAK,wBAAwB,IACxD,CAAC;AAAA,MACL,GAAI,KAAK,iCACL,EAAE,gCAAgC,KAAK,+BAA+B,IACtE,CAAC;AAAA,MACL,GAAI,KAAK,gBAAgB,SAAY,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;AAAA,MAC1E,GAAI,KAAK,6BAA6B,SAClC,EAAE,0BAA0B,KAAK,yBAAyB,IAC1D,CAAC;AAAA,MACL,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACrD,GAAI,KAAK,aAAa,SAAY,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,IACnE,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,OAAO,WAAqB,UAAgD;AAChF,UAAM,UAAU,KAAK,eAAe;AACpC,WAAO,KAAK,KAAK,OAAO;AAAA,EAC1B;AAAA;AAAA,EAGA,MAAM,OACJ,OACA,UAC4B;AAC5B,UAAM,UAAU,YAAY,KAAK,KAAK,KAAK,eAAe;AAC1D,WAAO,KAAK,KAAK,OAAO;AAAA,EAC1B;AAAA;AAAA,EAGA,MAAM,sBACJ,OACiC;AACjC,UAAM,UAAU,YAAY,KAAK,KAAK,KAAK,eAAe;AAC1D,WAAO,EAAE,QAAQ;AAAA,EACnB;AAAA;AAAA,EAGA,MAAM,wBAAwB,OAAiE;AAC7F,UAAM,UAAU,YAAY,KAAK,KAAK,KAAK,eAAe;AAC1D,WAAO,EAAE,QAAQ;AAAA,EACnB;AAAA;AAAA;AAAA,EAIA,MAAM,8BAAgD;AACpD,WAAO;AAAA,EACT;AAAA,EAEQ,iBAAyB;AAC/B,QAAI,CAAC,KAAK,gBAAgB;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,KAAK;AAAA,EACd;AAAA,EAEQ,8BAAsC;AAC5C,QAAI,CAAC,KAAK,sBAAsB;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,KAAK;AAAA,EACd;AACF;AA4EA,eAAsB,8BACpB,MAC0E;AAC1E,QAAM,SAAS,IAAI,wBAAwB;AAAA,IACzC,aAAa,KAAK;AAAA,IAClB,GAAI,KAAK,uBAAuB,SAC5B,EAAE,oBAAoB,KAAK,mBAAmB,IAC9C,CAAC;AAAA,IACL,OAAO,KAAK;AAAA,IACZ,mBAAmB,KAAK;AAAA,IACxB,eAAe,KAAK;AAAA,IACpB,SAAS,KAAK;AAAA,IACd,sBAAsB,KAAK;AAAA,IAC3B,OAAO,KAAK;AAAA,IACZ,GAAI,KAAK,oBAAoB,SAAY,EAAE,iBAAiB,KAAK,gBAAgB,IAAI,CAAC;AAAA,IACtF,GAAI,KAAK,cAAc,SAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,IACpE,GAAI,KAAK,kBAAkB,SAAY,EAAE,eAAe,KAAK,cAAc,IAAI,CAAC;AAAA,IAChF,GAAI,KAAK,4BAA4B,SACjC,EAAE,yBAAyB,KAAK,wBAAwB,IACxD,CAAC;AAAA,IACL,GAAI,KAAK,qCAAqC,SAC1C;AAAA,MACE,kCAAkC,KAAK;AAAA,IACzC,IACA,CAAC;AAAA,IACL,GAAI,KAAK,+BAA+B,SACpC,EAAE,4BAA4B,KAAK,2BAA2B,IAC9D,CAAC;AAAA,IACL,+BAA+B,KAAK,kCAAkC;AAAA,IACtE,6BAA6B,KAAK,gCAAgC;AAAA,IAClE,GAAI,KAAK,8BAA8B,SACnC,EAAE,2BAA2B,KAAK,0BAA0B,IAC5D,CAAC;AAAA,IACL,GAAI,KAAK,2BAA2B,SAChC,EAAE,wBAAwB,KAAK,uBAAuB,IACtD,CAAC;AAAA,IACL,GAAI,KAAK,4BAA4B,SACjC,EAAE,yBAAyB,KAAK,wBAAwB,IACxD,CAAC;AAAA,IACL,GAAI,KAAK,iCACL,EAAE,gCAAgC,KAAK,+BAA+B,IACtE,CAAC;AAAA,IACL,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,IACrD,GAAI,KAAK,gBAAgB,SAAY,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;AAAA,IAC1E,GAAI,KAAK,6BAA6B,SAClC,EAAE,0BAA0B,KAAK,yBAAyB,IAC1D,CAAC;AAAA,IACL,GAAI,KAAK,aAAa,SAAY,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,EACnE,CAAC;AACD,QAAM,UAAU,MAAM,OAAO,OAAO,EAAE,SAAS,KAAK,QAAQ,CAAC;AAC7D,SAAO,EAAE,QAAQ,QAAQ;AAC3B;AAEA,SAAS,YAAY,OAAoC;AACvD,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,UAAM,YACH,MAAgC,WAChC,MAAoD,eAAe;AACtE,QAAI,OAAO,cAAc,YAAY,UAAU,SAAS,GAAG;AACzD,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,OAAe,OAAuB;AAC1D,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,GAAG;AAC/C,UAAM,IAAI,MAAM,GAAG,KAAK,iCAAiC;AAAA,EAC3D;AACA,SAAO;AACT;AAEA,SAAS,+BAA+B,OAAwB;AAC9D,MACE,OAAO,UAAU,YACjB,MAAM,SAAS,GAAG,mCAAmC,IAAI,UACzD,MAAM,SAAS,QACf,CAAC,MAAM,WAAW,mCAAmC,KACrD,yBAAyB,KAAK,KAAK,KACnC,MAAM,MAAM,GAAG,EAAE,KAAK,CAAC,YAAY,YAAY,OAAO,YAAY,IAAI,GACtE;AACA,UAAM,IAAI,UAAU,8CAA8C;AAAA,EACpE;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,QAAgB,QAAwB;AACrE,SAAO,CAAC,QAAQ,MAAM,EAAE,OAAO,CAAC,UAAU,MAAM,KAAK,EAAE,SAAS,CAAC,EAAE,KAAK,IAAI;AAC9E;AAEA,SAAS,qBAAqB,KAAmB,gBAA8C;AAC7F,QAAM,SAAS,QAAQ,OAAO,IAAI,MAAM;AACxC,MAAI,SAAS,QAAQ,OAAO,IAAI,MAAM;AACtC,MAAI,IAAI,YAAY,iBAAiB,GAAG;AAKtC,UAAM,OAAO,iBAAiB,KAAK,MAAM,iBAAiB,GAAI,CAAC;AAC/D,aAAS,SAAS,GAAG,MAAM;AAAA,EAAK,IAAI,KAAK;AAAA,EAC3C;AACA,SAAO;AAAA,IACL,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA,UAAU,IAAI;AAAA,IACd,UAAU,IAAI;AAAA,EAChB;AACF;AAEA,SAAS,qBAAqB,OAA0D;AACtF,QAAM,gBAAgB,OAAO,oBAAoB,YAAY,UAAU;AACvE,SAAO,IAAI,uBAAuB;AAAA,IAChC,SAAS,gBACL,sKACA;AAAA,IACJ,MAAM,gBAAgBN,WAAU,yBAAyBA,WAAU;AAAA,IACnE,QAAQ,gBAAgB,OAAO;AAAA,IAC/B,WAAW,CAAC;AAAA,EACd,CAAC;AACH;AAEA,SAAS,WAAW,aAAqB,SAAiB,MAAsB;AAC9E,SAAO,GAAG,WAAW,IAAI,OAAO,IAAI,IAAI;AAC1C;AAKA,SAAS,oBAAoB,OAAmB,MAAkC;AAChF,MAAI,MAAM,CAAC,MAAM,OAAQ,MAAM,CAAC,MAAM,MAAQ,MAAM,CAAC,MAAM,MAAQ,MAAM,CAAC,MAAM;AAC9E,WAAO;AACT,MAAI,MAAM,CAAC,MAAM,OAAQ,MAAM,CAAC,MAAM,OAAQ,MAAM,CAAC,MAAM,IAAM,QAAO;AACxE,MAAI,MAAM,CAAC,MAAM,MAAQ,MAAM,CAAC,MAAM,MAAQ,MAAM,CAAC,MAAM,MAAQ,MAAM,CAAC,MAAM;AAC9E,WAAO;AACT,MACE,MAAM,CAAC,MAAM,MACb,MAAM,CAAC,MAAM,MACb,MAAM,CAAC,MAAM,MACb,MAAM,CAAC,MAAM,MACb,MAAM,CAAC,MAAM,MACb,MAAM,CAAC,MAAM,MACb,MAAM,EAAE,MAAM,MACd,MAAM,EAAE,MAAM;AAEd,WAAO;AACT,MAAI,MAAM,CAAC,MAAM,MAAQ,MAAM,CAAC,MAAM,GAAM,QAAO;AACnD,MACG,MAAM,CAAC,MAAM,MAAQ,MAAM,CAAC,MAAM,MAAQ,MAAM,CAAC,MAAM,MAAQ,MAAM,CAAC,MAAM,KAC5E,MAAM,CAAC,MAAM,MAAQ,MAAM,CAAC,MAAM,MAAQ,MAAM,CAAC,MAAM,KAAQ,MAAM,CAAC,MAAM;AAE7E,WAAO;AACT,MAAI,aAAa,KAAK,EAAG,QAAO;AAChC,SAAO,kBAAkB,IAAI;AAC/B;AAEA,SAAS,aAAa,OAA4B;AAChD,QAAM,SAAS,QACZ,OAAO,MAAM,SAAS,GAAG,KAAK,IAAI,MAAM,YAAY,GAAG,CAAC,CAAC,EACzD,UAAU,EACV,YAAY;AACf,SAAO,OAAO,WAAW,MAAM,KAAK,sBAAsB,KAAK,MAAM;AACvE;AAEA,SAAS,kBAAkB,MAAkC;AAC3D,QAAM,IAAI,MAAM,KAAK,EAAE,YAAY,KAAK;AACxC,MAAI,EAAE,SAAS,MAAM,EAAG,QAAO;AAC/B,MAAI,EAAE,SAAS,MAAM,KAAK,EAAE,SAAS,OAAO,EAAG,QAAO;AACtD,MAAI,EAAE,SAAS,MAAM,EAAG,QAAO;AAC/B,MAAI,EAAE,SAAS,OAAO,EAAG,QAAO;AAChC,MAAI,EAAE,SAAS,MAAM,EAAG,QAAO;AAC/B,MAAI,EAAE,SAAS,MAAM,KAAK,EAAE,SAAS,OAAO,EAAG,QAAO;AACtD,MAAI,EAAE,SAAS,MAAM,KAAK,EAAE,SAAS,OAAO,EAAG,QAAO;AACtD,SAAO;AACT;AAMA,SAAS,wBAAwB,OAAwC;AACvE,QAAM,aAAa,qBAAqB,KAAK;AAC7C,SAAO,eAAe,aAAa,eAAe,kBAAkB,eAAe;AACrF;AAEA,SAAS,cAAsB;AAE7B,SAAO,OAAO,KAAK,MAAM,KAAK,OAAO,IAAI,OAAO,gBAAgB,CAAC;AACnE;AAEA,SAAS,eAAe,MAAsC;AAC5D,UAAQ,MAAM;AAAA,IACZ,KAAK,WAAW;AACd,aAAO;AAAA,IACT,KAAK,WAAW;AACd,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAgBO,SAAS,kCAAkC,QAAwB;AACxE,SAAO;AACT;;;AMrrFA,SAAS,mBAAmB,UAA2C;AACrE,QAAM,MAAM,SAAS,oBAAoB,KAAK;AAC9C,MAAI,CAAC,KAAK;AACR,WAAO,EAAE,MAAM,wBAAwB,MAAM,KAAK,KAAK,MAAM,MAAM,UAAU;AAAA,EAC/E;AACA,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,SAAS,KAAK,IAAI,MAAM,SAAS,GAAG,EAAE;AAC9D,UAAM,MAAM,IAAI,aAAa,UAAU,IAAI,aAAa;AACxD,UAAM,OAAO,IAAI,OAAO,OAAO,IAAI,IAAI,IAAI,MAAM,MAAM;AACvD,UAAM,OAAO,IAAI,YAAY,IAAI,aAAa,MAAM,IAAI,WAAW;AACnE,WAAO,EAAE,MAAM,IAAI,UAAU,MAAM,KAAK,KAAK;AAAA,EAC/C,QAAQ;AACN,WAAO,EAAE,MAAM,KAAK,MAAM,KAAK,KAAK,MAAM,MAAM,UAAU;AAAA,EAC5D;AACF;AAUA,SAAS,2BAAuC;AAC9C,SAAO,IAAI,eAAe,YAAmD,IAAI;AACnF;AAEO,IAAM,qBAA2C;AAAA,EACtD,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,kBAAkB,CAAC,SAAS;AAAA,EAC5B,wBAAwB,MAAM;AAAA,EAC9B,YAAY,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUnC,sBAAsB;AAAA,EAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQvB,MAAM,EAAE,SAAS,GAAG;AAClB,WAAO,IAAI,wBAAwB;AAAA;AAAA;AAAA;AAAA;AAAA,MAKjC,aAAa;AAAA;AAAA;AAAA,MAGb,eAAe;AAAA,MACf,OAAO,mBAAmB,QAAQ;AAAA,MAClC,mBAAmB;AAAA,IACrB,CAAC;AAAA,EACH;AACF;;;ACzFO,IAAM,iBAAuC;AAAA,EAClD,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,kBAAkB,CAAC,WAAW;AAAA,EAC9B,wBAAwB,CAAC,UACvB,6BAA6B,KAAK,MAAM,aACpC,4CACA;AAAA,EACN,+BAA+B,SAAS;AACtC,UAAM,QAAS,SAAmE;AAClF,QAAI,OAAO,yBAAyB,YAAY;AAI9C,YAAM,uBAAuB;AAAA,IAC/B;AAAA,EACF;AAAA,EACA,YAAY,uBAAuB;AAAA,EACnC,oBAAoB,UAAU;AAE5B,QAAI,CAAC,SAAS,aAAa;AACzB,YAAM,IAAI,mBAAmB,UAAU,mCAAmC;AAAA,IAC5E;AACA,QAAI,CAAC,SAAS,iBAAiB;AAC7B,YAAM,IAAI,mBAAmB,UAAU,wCAAwC;AAAA,IACjF;AAAA,EACF;AAAA,EACA,MAAM,EAAE,UAAU,aAAa,aAAa,GAAG;AAC7C,UAAM,UAA6E;AAAA,MACjF,OAAO,SAAS;AAAA,MAChB,WAAW,SAAS;AAAA,MACpB,KAAK;AAAA,MACL;AAAA,IACF;AACA,QAAI,SAAS,aAAc,SAAQ,SAAS,SAAS;AACrD,QAAI,SAAS,cAAe,SAAQ,UAAU,SAAS;AACvD,WAAO,IAAI,oBAAoB,OAAO;AAAA,EACxC;AACF;;;AlCdO,IAAM,oBAAkE;AAAA,EAC7E,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,OAAO;AAAA,EACP,MAAM;AAAA,EACN,SAAS;AAAA,EACT,SAAS;AAAA,EACT,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,aAAa;AACf;AAQA,IAAM,0BAA0B;AAAA,EAC9B,aAAa;AAAA,EACb,cAAc;AAAA,EACd,qBAAqB;AAAA,EACrB,eAAe;AAAA,EACf,eAAe;AAAA,EACf,eAAe;AAAA,EACf,WAAW;AAAA,EACX,cAAc;AAAA,EACd,qBAAqB;AAAA,EACrB,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,oBAAoB;AAAA,EACpB,mBAAmB;AAAA,EACnB,kBACE;AACJ;AAQO,SAAS,mCAAyC;AACvD,qCAAmC;AACnC,QAAM,sBAAsB,IAAI,IAAY,0CAA0C;AACtF,aAAW,WAAWO,gBAAe,SAAS;AAC5C,UAAM,eAAe,kBAAkB,OAAO;AAC9C,QAAI,aAAa,YAAY,SAAS;AACpC,YAAM,IAAI;AAAA,QACR,sBAAsB,OAAO,6BAA6B,aAAa,OAAO;AAAA,MAChF;AAAA,IACF;AACA,QAAI,aAAa,WAAW,YAAY,SAAS;AAC/C,YAAM,IAAI;AAAA,QACR,sBAAsB,OAAO,wCAAwC,aAAa,WAAW,OAAO;AAAA,MACtG;AAAA,IACF;AACA,UAAM,iBAAiB,CAAC,GAAG,aAAa,gBAAgB;AACxD,UAAM,yBAAyB,CAAC,GAAG,+CAA+C,OAAO,CAAC;AAC1F,QACE,IAAI,IAAI,cAAc,EAAE,SAAS,eAAe,UAChD,eAAe,KAAK,CAAC,UAAU,CAAC,oBAAoB,IAAI,KAAK,CAAC,KAC9D,eAAe,WAAW,uBAAuB,UACjD,eAAe,KAAK,CAAC,OAAO,UAAU,UAAU,uBAAuB,KAAK,CAAC,GAC7E;AACA,YAAM,IAAI,MAAM,aAAa,OAAO,qDAAqD;AAAA,IAC3F;AACA,QAAI,YAAY,QAAQ;AAGtB,UAAI,aAAa,WAAW,cAAc,QAAQ;AAChD,cAAM,IAAI;AAAA,UACR,oDAAoD,aAAa,WAAW,SAAS;AAAA,QACvF;AAAA,MACF;AACA,UAAI,aAAa,oBAAoB,QAAQ;AAC3C,cAAM,IAAI,MAAM,qDAAqD;AAAA,MACvE;AACA;AAAA,IACF;AACA,QAAI,aAAa,oBAAoB,QAAQ;AAC3C,YAAM,IAAI,MAAM,aAAa,OAAO,yCAAyC;AAAA,IAC/E;AACA,UAAM,SAAS,aAAa,MAAM;AAAA,MAChC,UAAU;AAAA,MACV,aAAa,CAAC;AAAA,MACd,cAAc,CAAC;AAAA,IACjB,CAAC;AACD,UAAM,eAAgB,QAAgD;AACtE,QAAI,OAAO,iBAAiB,UAAU;AACpC,YAAM,IAAI,MAAM,aAAa,OAAO,sCAAsC;AAAA,IAC5E;AACA,QAAI,iBAAiB,aAAa,WAAW,WAAW;AACtD,YAAM,IAAI;AAAA,QACR,aAAa,OAAO,+CAA+C,aAAa,WAAW,SAAS,+BAA+B,YAAY;AAAA,MACjJ;AAAA,IACF;AACA,QAAI,OAAQ,OAAgC,WAAW,YAAY;AACjE,YAAM,IAAI,MAAM,aAAa,OAAO,kCAAkC;AAAA,IACxE;AACA,QACE,aAAa,oBAAoB,YACjC,OAAQ,OAAqC,gBAAgB,YAC7D;AACA,YAAM,IAAI,MAAM,aAAa,OAAO,uDAAuD;AAAA,IAC7F;AACA,QAAI,aAAa,cAAc,aAAa,oBAAoB,UAAU;AACxE,YAAM,IAAI,MAAM,aAAa,OAAO,2CAA2C;AAAA,IACjF;AACA,UAAM,gBAAgB,aAAa,uBAAuB,CAAC,CAAC;AAC5D,QAAK,YAAY,kBAAmB,kBAAkB,OAAO;AAC3D,YAAM,IAAI;AAAA,QACR,aAAa,OAAO,qBAClB,YAAY,eAAe,SAAS,SACtC;AAAA,MACF;AAAA,IACF;AACA,QAAI,eAAe,aAAa,kBAAkB,cAAc,iBAAiB,aAAa;AAC5F,YAAM,IAAI,MAAM,aAAa,OAAO,mDAAmD;AAAA,IACzF;AAAA,EACF;AACF;AAEO,SAAS,+BACd,SACA,OACuC;AACvC,QAAM,eAAe,kBAAkB,OAAyB;AAChE,SAAO,cAAc,uBAAuB,KAAK,KAAK;AACxD;AAMO,SAAS,sCAAsC,SAAiB,OAAyB;AAC9F,MAAI,YAAY,QAAS,QAAO;AAChC,QAAM,cAAc,6BAA6B,KAAK;AACtD,SAAO,gBAAgB,yBAAyB,gBAAgB;AAClE;AAEO,SAAS,uCAAuC,SAAiB,SAAwB;AAC9F,oBAAkB,OAAyB,GAAG,iCAAiC,OAAO;AACxF;AAEO,SAAS,oCAAoC,SAAkC;AACpF,SAAO,OAAO,kBAAkB,OAAO,EAAE,wBAAwB;AACnE;AAEA,eAAsB,+BAA+B,OAKhC;AACnB,QAAM,eAAe,kBAAkB,MAAM,OAAO;AACpD,QAAM,QAAQ,aAAa;AAC3B,MAAI,CAAC,MAAO,QAAO;AACnB,eAAa,oBAAoB,MAAM,QAAQ;AAC/C,MAAI;AACF,UAAM,MAAM,EAAE,UAAU,MAAM,UAAU,YAAY,MAAM,WAAW,CAAC;AACtE,gCAA4B,MAAM,SAAS,MAAM,SAAS,WAAW;AACrE,WAAO;AAAA,EACT,SAAS,OAAO;AACd,gCAA4B,MAAM,SAAS,MAAM,SAAS,QAAQ;AAClE,QAAI,2BAA2B,KAAK,GAAG;AACrC,UAAI;AACF,cAAM,SAAS,+BAA+B;AAAA,UAC5C,SAAS,MAAM;AAAA,UACf,WAAW;AAAA,QACb,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;AAEO,SAAS,2BAA2B,OAAyB;AAClE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,YAAY;AAKlB,SACE,UAAU,WAAW,OAAO,UAAU,eAAe,OAAO,UAAU,UAAU,WAAW;AAE/F;AAEA,SAAS,4BACP,SACA,SACA,SACM;AACN,MAAI;AACF,aAAS,sBAAsB,EAAE,SAAS,QAAQ,CAAC;AAAA,EACrD,QAAQ;AAAA,EAER;AACF;AAEA,eAAsB,4BAA4B,OAMI;AACpD,QAAM,QAAQ,kBAAkB,MAAM,OAAO,EAAE;AAC/C,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,MAAM,MAAM;AAAA,IACjB,UAAU,MAAM;AAAA,IAChB,SAAS,MAAM;AAAA,IACf,WAAW,MAAM;AAAA,IACjB,WAAW,MAAM;AAAA,EACnB,CAAC;AACH;AAQA,iCAAiC;;;AmC9PjC;AAAA,EACE,0BAAAC;AAAA,OAMK;AA8FA,SAAS,cAAc,SAA+C;AAC3E,QAAM,aAAaA,wBAAuB,OAAO;AACjD,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,4BAA4B,OAAO,GAAG;AAAA,EACxD;AACA,SAAO;AACT;AAUO,SAAS,8BAA8B,SAAiC;AAC7E,SAAO,cAAc,OAAO,EAAE;AAChC;AAOO,SAAS,8BAA8B,WAA0C;AACtF,MAAI,OAAO,OAAOA,yBAAwB,SAAS,GAAG;AACpD,WAAO;AAAA,EACT;AACA,aAAW,WAAW,OAAO,KAAKA,uBAAsB,GAAuB;AAC7E,QAAIA,wBAAuB,OAAO,EAAE,cAAc,WAAW;AAC3D,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,kBAAkB,YAAkC,IAAwB;AAC1F,SAAO,WAAW,GAAG,UAAU,SAAS,EAAE;AAC5C;AAcO,SAAS,sBAAsB,SAA2C;AAC/E,QAAM,SAASA,wBAAuB,OAAyB;AAC/D,MAAI,QAAQ;AACV,WAAO,OAAO,aAAa,cAAc,cAAc;AAAA,EACzD;AAGA,aAAW,cAAc,OAAO,OAAOA,uBAAsB,GAAG;AAC9D,QAAI,WAAW,cAAc,SAAS;AACpC,aAAO,WAAW,aAAa,cAAc,cAAc;AAAA,IAC7D;AAAA,EACF;AACA,SAAO;AACT;AAQO,SAAS,sBAAsB,KAA8C;AAClF,QAAM,aAAa,cAAc,IAAI,OAAO;AAC5C,QAAM,cAAc,kBAAkB,YAAY,IAAI,EAAE;AACxD,QAAM,gBAAgB,IAAI,OAAO,oBAAI,KAAK,GAAG,YAAY;AAIzD,QAAM,WAA+C,cAAc,OAAO;AAE1E,QAAM,cAAc,MAAM;AACxB,QAAI,UAAU;AACZ,aAAO;AAAA,QACL,WAAW;AAAA,QACX,UAAU;AAAA,QACV,MAAM,WAAW;AAAA,QACjB,SAAS;AAAA,QACT,UAAU;AAAA,QACV,QAAQ;AAAA,MACV;AAAA,IACF;AACA,UAAM,MAAM,WAAW,aAAa;AACpC,WAAO;AAAA,MACL,WAAW,IAAI;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,WAAW;AAAA,MACjB,SAAS;AAAA,MACT,UAAU;AAAA,MACV,QAAQ,IAAI,YAAY,OAAQ;AAAA,IAClC;AAAA,EACF,GAAG;AAEH,QAAM,YAAY,MAAM;AACtB,UAAM,MAAM,WAAW,aAAa;AACpC,QAAI,UAAU;AACZ,aAAO;AAAA,QACL,WAAW;AAAA,QACX,YAAY;AAAA,QACZ,OAAO;AAAA,QACP,KAAK;AAAA,QACL,OAAO;AAAA,QACP,WAAW;AAAA,QACX,QAAQ;AAAA,MACV;AAAA,IACF;AACA,QAAI,CAAC,IAAI,WAAW;AAClB,aAAO;AAAA,QACL,WAAW;AAAA,QACX,YAAY;AAAA,QACZ,OAAO;AAAA,QACP,KAAK;AAAA,QACL,OAAO;AAAA,QACP,WAAW;AAAA,QACX,QAAQ;AAAA,MACV;AAAA,IACF;AAgBA,UAAM,aAAa,IAAI;AACvB,QAAI,YAAmD,aAClD,IAAI,gBAAgB,cAAc,IAAI,cAAc,cAAc,cAAc,YACjF;AACJ,QAAI,SAA6C;AACjD,QAAI,eAAe,IAAI,oBAAoB,SAAS,IAAI,+BAA+B,QAAQ;AAC7F,kBAAY;AACZ,eAAS;AAAA,IACX,WAAW,cAAc,IAAI,aAAa,UAAU,CAAC,IAAI,gBAAgB;AACvE,kBAAY;AACZ,eAAS;AAAA,IACX;AAIA,UAAM,SACJ,cAAc,YAAY,cAAc,cAAc,IAAI,iBAAiB;AAC7E,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,OAAO;AAAA,MACP,KAAK,QAAQ,OAAO;AAAA,MACpB,OAAO,QAAQ,SAAS;AAAA,MACxB,WAAW,QAAQ,aAAa;AAAA,MAChC;AAAA,IACF;AAAA,EACF,GAAG;AAEH,QAAM,OAAO,MAAM;AACjB,UAAM,MAAM,WAAW,aAAa;AACpC,QAAI,UAAU;AACZ,aAAO,EAAE,WAAW,OAAO,OAAO,CAAC,GAAG,QAAQ,SAAS;AAAA,IACzD;AACA,WAAO;AAAA,MACL,WAAW,IAAI;AAAA,MACf,OAAO,CAAC;AAAA,MACR,QAAQ,IAAI,YAAY,OAAQ;AAAA,IAClC;AAAA,EACF,GAAG;AAEH,QAAM,WAAW,MAAM;AACrB,UAAM,MAAM,WAAW,aAAa;AAGpC,QAAI,SAA6C;AACjD,QAAI,YAAY,IAAI;AACpB,QAAI,UAAU;AACZ,kBAAY;AACZ,eAAS;AAAA,IACX,WAAW,CAAC,IAAI,WAAW;AACzB,kBAAY;AAGZ,eAAS,WAAW,SAAS,aAAa,kBAAkB;AAAA,IAC9D,WAAW,CAAC,IAAI,gBAAgB;AAC9B,kBAAY;AACZ,eAAS;AAAA,IACX,WAAW,IAAI,+BAA+B,OAAO;AAKnD,kBAAY;AACZ,eAAS;AAAA,IACX,WAAW,IAAI,aAAa,UAAU,CAAC,IAAI,eAAe;AAOxD,kBAAY;AACZ,eAAS;AAAA,IACX;AACA,UAAM,SAAS,YAAY,QAAQ,IAAI,MAAM,IAAI;AAMjD,UAAM,eAAe,YAAY,QAAQ,IAAI,mBAAmB,IAAI;AACpE,UAAM,SAAS,aAAa,eAAe,IAAI,gBAAgB;AAa/D,UAAM,mBAAmB,IAAI,YAAY;AACzC,UAAM,cAAc,aAAa,CAAC,oBAAoB,IAAI,uBAAuB;AACjF,UAAM,OAAO,cAAe,gBAA2B;AACvD,WAAO;AAAA,MACL,WAAW,YAAa,mBAAoB,iBAA2B,IAAI,YAAa;AAAA,MACxF,QAAQ,YAAa,mBAAoB,WAAsB,UAAqB;AAAA,MACpF;AAAA,MACA,KAAK,QAAQ,OAAO;AAAA,MACpB,OAAO,QAAQ,SAAS;AAAA,MACxB,WAAW,QAAQ,aAAa;AAAA,MAChC,YAAY,QAAQ,cAAe,CAAC,MAAM,GAAG;AAAA;AAAA;AAAA,MAG7C,YAAY;AAAA,MACZ,wBAAwB;AAAA,MACxB,cAAc,YAAY,QAAQ,IAAI,mBAAmB,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,MAK7D;AAAA,MACA,kBAAkB,SAAU,IAAI,oBAAoB,CAAC,IAAK,CAAC;AAAA,MAC3D;AAAA,IACF;AAAA,EACF,GAAG;AAEH,QAAM,aAAa,MAAM;AACvB,UAAM,MAAM,WAAW,aAAa;AACpC,QAAI,UAAU;AACZ,aAAO;AAAA,QACL,WAAW;AAAA,QACX,OAAO,CAAC;AAAA,QACR,QAAQ,CAAC;AAAA,QACT,QAAQ;AAAA,MACV;AAAA,IACF;AACA,QAAI,CAAC,IAAI,WAAW;AAClB,aAAO;AAAA,QACL,WAAW;AAAA,QACX,OAAO,CAAC;AAAA,QACR,QAAQ,CAAC;AAAA,QACT,QACE,WAAW,SAAS,aACf,kBACA;AAAA,MACT;AAAA,IACF;AAEA,QAAI,CAAC,IAAI,gBAAgB;AACvB,aAAO;AAAA,QACL,WAAW;AAAA,QACX,OAAO,CAAC;AAAA,QACR,QAAQ,CAAC;AAAA,QACT,QAAQ;AAAA,MACV;AAAA,IACF;AACA,WAAO;AAAA,MACL,WAAW;AAAA,MACX,OAAO,CAAC,UAAU,WAAW;AAAA,MAC7B,QAAQ,CAAC,YAAY,UAAU;AAAA,MAC/B,QAAQ;AAAA,IACV;AAAA,EACF,GAAG;AAIH,QAAM,cAAc;AAAA,IAClB,WAAW;AAAA,IACX,UAAU;AAAA,IACV,QAAQ;AAAA,EACV;AAEA,SAAO;AAAA,IACL,WAAW,IAAI;AAAA,IACf,SAAS,IAAI;AAAA,IACb,IAAI,IAAI;AAAA,IACR,UAAU,IAAI;AAAA,IACd,YAAY,IAAI;AAAA,IAChB,qBAAqB,IAAI,uBAAuB;AAAA,IAChD,mBAAmB,IAAI,qBAAqB;AAAA,IAC5C,iBAAiB,IAAI,mBAAmB;AAAA,IACxC,2BAA2B;AAAA,IAC3B,YAAY;AAAA,IACZ,UAAU;AAAA,IACV,KAAK;AAAA,IACL,eAAe;AAAA,IACf,WAAW;AAAA,IACX,aAAa;AAAA,IACb;AAAA,EACF;AACF;;;ACtbO,SAAS,uBAAuB,QAAgC;AACrE,MAAI,OAAO,WAAW,UAAU;AAC9B,UAAM,QAAQ,OAAO,MAAM,kCAAkC;AAC7D,WAAO,QAAQ,OAAO,MAAM,CAAC,CAAC,IAAI;AAAA,EACpC;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,YAAY;AAMlB,aAAW,SAAS,CAAC,UAAU,UAAU,UAAU,WAAW,UAAU,MAAM,UAAU,MAAM,GAAG;AAC/F,QAAI,OAAO,UAAU,SAAU,QAAO;AAAA,EACxC;AACA,SAAO;AACT;AAEO,SAAS,qBAAqB,QAAyB;AAC5D,MAAI,OAAO,WAAW,UAAU;AAC9B,UAAM,cAAc,OAAO,QAAQ,SAAS;AAC5C,WAAO,eAAe,IAAI,OAAO,MAAM,cAAc,UAAU,MAAM,EAAE,KAAK,IAAI,OAAO,KAAK;AAAA,EAC9F;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,YAAY;AAClB,SAAO,CAAC,UAAU,QAAQ,UAAU,QAAQ,UAAU,MAAM,EACzD,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,EAChF,KAAK,IAAI;AACd;AAGO,SAAS,qBAAqB,QAAyB;AAC5D,MAAI,OAAO,WAAW,SAAU,QAAO,qBAAqB,MAAM;AAClE,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,YAAY;AAClB,MAAI,OAAO,UAAU,WAAW,YAAY,UAAU,OAAO,SAAS,GAAG;AACvE,WAAO,UAAU;AAAA,EACnB;AACA,SAAO,OAAO,UAAU,WAAW,WAAW,UAAU,SAAS;AACnE;AAEO,SAAS,2BAA2B,QAA0B;AACnE,MAAI,OAAO,WAAW,SAAU,QAAO,uCAAuC,KAAK,MAAM;AACzF,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,YAAY;AAClB,SAAO,OAAO,UAAU,cAAc,YAAY,OAAO,UAAU,eAAe;AACpF;;;AC/CA,IAAM,8BAA8B,oBAAI,IAAI;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAeD,SAAS,SAAS,OAAkD;AAClE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,WAAO;AAAA,EACT;AACA,QAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,SAAO,cAAc,OAAO,aAAa,cAAc;AACzD;AAMO,SAAS,2BAA2B,OAAqD;AAC9F,SAAO,SAAS,KAAK,IAAI,gBAAgB,KAAK,IAAI;AACpD;AAEO,SAAS,8BAA8B,OAAwB;AACpE,SAAO,OAAO,UAAU,YAAY,4BAA4B,IAAI,KAAK,IAAI,QAAQ;AACvF;AAEA,SAAS,uCACP,cACA,oBACQ;AACR,QAAM,kBAAkB;AAAA,IACtB,SAAS,YAAY,IAAI,aAAa,YAAY;AAAA,EACpD;AACA,SAAO,oBAAoB,YACvB,8BAA8B,kBAAkB,IAChD;AACN;AAEA,SAAS,0BACP,cACA,QACA,cACS;AACT,MAAI,CAAC,SAAS,YAAY,KAAK,EAAE,kBAAkB,eAAe;AAChE,WAAO;AAAA,EACT;AACA,MAAI,2BAA2B,aAAa,YAAY,GAAG;AACzD,WAAO;AAAA,EACT;AACA,SAAO,aAAa;AACpB,eAAa,IAAI,GAAG,OAAO,QAAQ,IAAI,OAAO,YAAY,IAAI,OAAO,IAAI,IAAI,MAAM;AACnF,SAAO;AACT;AAQO,SAAS,qCACd,oBACyC;AACzC,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,kBAAkB;AAAA,EACxC,QAAQ;AACN,WAAO,EAAE,oBAAoB,SAAS,CAAC,EAAE;AAAA,EAC3C;AACA,MAAI,CAAC,SAAS,MAAM,KAAK,CAAC,SAAS,OAAO,OAAO,GAAG;AAClD,WAAO,EAAE,oBAAoB,SAAS,CAAC,EAAE;AAAA,EAC3C;AAEA,QAAM,UAAU,OAAO;AACvB,QAAM,eAAe,oBAAI,IAAqD;AAC9E,MAAIC,WAAU;AAAA,IACZ,QAAQ;AAAA,IACR;AAAA,MACE,UAAU,uCAAuC,QAAQ,cAAc,QAAQ,SAAS;AAAA,MACxF,cAAc;AAAA,MACd,MAAM;AAAA,IACR;AAAA,IACA;AAAA,EACF;AAEA,MAAI,SAAS,QAAQ,eAAe,GAAG;AACrC,eAAW,SAAS,OAAO,OAAO,QAAQ,eAAe,GAAG;AAC1D,UAAI,CAAC,SAAS,KAAK,EAAG;AACtB,MAAAA,WACE;AAAA,QACE,MAAM;AAAA,QACN;AAAA,UACE,UAAU,uCAAuC,MAAM,cAAc,MAAM,SAAS;AAAA,UACpF,cAAc;AAAA,UACd,MAAM;AAAA,QACR;AAAA,QACA;AAAA,MACF,KAAKA;AAAA,IACT;AAAA,EACF;AAEA,SAAOA,WACH,EAAE,oBAAoB,KAAK,UAAU,MAAM,GAAG,SAAS,CAAC,GAAG,aAAa,OAAO,CAAC,EAAE,IAClF,EAAE,oBAAoB,SAAS,CAAC,EAAE;AACxC;;;A5CdA,SAAS,6BAAAC,4BAA2B,qBAAAC,0BAAyB;;;A6C5GtD,IAAM,0BAA0B;AAEvC,IAAM,YAAY;AAClB,IAAM,YAAY;AAQX,IAAM,iCAAN,cAA6C,MAAM;AAAA,EAC/C;AAAA,EAET,YAAY,QAAgB,OAAgB;AAC1C,UAAM,uCAAuC,EAAE,MAAM,CAAC;AACtD,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAaO,SAAS,+BAAwD,MAAY;AAClF,MAAI,KAAK,SAAS,cAAc,KAAK,SAAS,2BAA2B,CAAC,KAAK,QAAQ;AACrF,WAAO;AAAA,EACT;AACA,QAAM,SAAS,KAAK;AACpB,SAAO;AAAA,IACL,GAAG;AAAA,IACH,QAAQ,OAAO,SAAgB,OAAe,YAAoB;AAChE,UAAI;AACF,eAAO,MAAM,OAAO,SAAS,OAAO,OAAO;AAAA,MAC7C,SAAS,OAAO;AACd,cAAM,SAAU,SAA6D,UACzE;AACJ,YACE,OAAO,WAAW,YAClB,OAAO,SAAS,KAChB,gDAAgD,KAAK,GACrD;AACA,gBAAM,IAAI,+BAA+B,QAAQ,KAAK;AAAA,QACxD;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAOO,SAAS,iCAAiC,OAA0B;AACzE,MAAI,CAAC,gDAAgD,KAAK,EAAG,QAAO,CAAC;AACrE,QAAM,UAAU,oBAAI,IAAY;AAChC,QAAM,UAAoD,CAAC,EAAE,OAAO,GAAG,OAAO,MAAM,CAAC;AACrF,QAAM,OAAO,oBAAI,QAAgB;AACjC,MAAI,YAAY;AAChB,SAAO,QAAQ,SAAS,KAAK,YAAY,WAAW;AAClD,UAAM,UAAU,QAAQ,MAAM;AAC9B,iBAAa;AACb,QAAI,CAAC,QAAQ,SAAS,OAAO,QAAQ,UAAU,YAAY,KAAK,IAAI,QAAQ,KAAK,EAAG;AACpF,QAAI,QAAQ,QAAQ,UAAW;AAC/B,SAAK,IAAI,QAAQ,KAAK;AACtB,QAAI,QAAQ,iBAAiB,gCAAgC;AAC3D,UAAI,gDAAgD,QAAQ,MAAM,KAAK,GAAG;AACxE,gBAAQ,IAAI,QAAQ,MAAM,MAAM;AAAA,MAClC;AACA;AAAA,IACF;AACA,UAAM,SAAS,QAAQ;AACvB,eAAW,OAAO,CAAC,SAAS,OAAO,GAAY;AAC7C,YAAM,aAAa,OAAO,yBAAyB,QAAQ,GAAG;AAC9D,UAAI,cAAc,WAAW,YAAY;AACvC,gBAAQ,KAAK,EAAE,OAAO,QAAQ,QAAQ,GAAG,OAAO,WAAW,MAAM,CAAC;AAAA,MACpE;AAAA,IACF;AACA,UAAM,SAAS,OAAO,yBAAyB,QAAQ,QAAQ;AAC/D,QAAI,UAAU,WAAW,UAAU,MAAM,QAAQ,OAAO,KAAK,GAAG;AAC9D,iBAAW,UAAU,OAAO,MAAM,MAAM,GAAG,EAAE,GAAG;AAC9C,gBAAQ,KAAK,EAAE,OAAO,QAAQ,QAAQ,GAAG,OAAO,OAAO,CAAC;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AACA,SAAO,CAAC,GAAG,OAAO;AACpB;;;ACnGA,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,aAAa;AAEtB,SAAS,2CAAAC,gDAA+C;AAExD,IAAM,OAAO,iBAAE,OAAO,EAAE,MAAM,iEAAiE;AAC/F,IAAM,QAAQ,iBAAE,OAAO,CAAC,CAAC,EAAE,OAAO;AAClC,IAAM,UAAU,iBACb,OAAO;AAAA,EACN,SAAS,iBAAE,QAAQ,CAAC;AAAA,EACpB,WAAW,iBAAE,OAAO,EAAE,IAAI,IAAI;AAAA,EAC9B,eAAe,iBAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACxC,aAAa,iBAAE,OAAO,EAAE,IAAI,GAAG;AACjC,CAAC,EACA,OAAO;AACV,IAAM,YAAY,iBACf,OAAO;AAAA,EACN,SAAS,iBAAE,QAAQ,CAAC;AAAA,EACpB,WAAW,iBAAE,QAAQ,2CAA2C;AAAA,EAChE,QAAQ,iBACL,OAAO;AAAA,IACN,aAAa;AAAA,IACb,OAAO,iBAAE,OAAO,EAAE,MAAM,4BAA4B;AAAA,IACpD,SAAS,iBAAE,OAAO,EAAE,MAAM,4BAA4B;AAAA,IACtD,KAAK,iBACF,OAAO,EACP,SAAS,EACT,IAAI,GAAG,EACP,OAAO,CAAC,UAAU;AACjB,YAAM,QAAQ,KAAK,MAAM,MAAO,KAAK;AACrC,aAAO,OAAO,cAAc,KAAK,KAAK,SAAS,KAAK,QAAQ,QAAS;AAAA,IACvE,CAAC;AAAA,IACH,WAAW,iBAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,IAAI,OAAS;AAAA,IACzD,gBAAgB,iBAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,KAAM;AAAA,IACzD,KAAK;AAAA,IACL,QAAQ,iBAAE,MAAM,CAAC,CAAC;AAAA,EACpB,CAAC,EACA,OAAO;AAAA,EACV,SAAS,iBAAE,KAAK;AAAA,EAChB,WAAW,iBACR,OAAO;AAAA,IACN,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa,iBAAE,MAAM,CAAC,iBAAE,QAAQ,WAAW,CAAC,CAAC;AAAA,IAC7C,SAAS,iBAAE,QAAQ,MAAM;AAAA,IACzB,KAAK;AAAA,EACP,CAAC,EACA,OAAO;AAAA,EACV,oBAAoB;AAAA,EACpB,SAAS,iBACN,OAAO,EAAE,aAAa,MAAM,UAAU,iBAAE,QAAQ,yBAAyB,EAAE,CAAC,EAC5E,OAAO;AACZ,CAAC,EACA,OAAO;AAIV,IAAM,aAAa,iBAChB,OAAO;AAAA,EACN,SAAS,iBAAE,QAAQ,CAAC;AAAA,EACpB,UAAU,iBAAE,QAAQ,uBAAuB;AAAA,EAC3C,gBAAgB,iBAAE,QAAQ,CAAC;AAAA,EAC3B,eAAe,iBAAE,QAAQ,MAAM;AAAA,EAC/B,YAAY,iBAAE,MAAM,CAAC,iBAAE,QAAQ,OAAO,GAAG,iBAAE,QAAQ,UAAU,CAAC,CAAC;AAAA,EAC/D,QAAQ,iBACL,OAAO;AAAA,IACN,SAAS,iBAAE,QAAQ,CAAC;AAAA,IACpB,QAAQ;AAAA,IACR,WAAW;AAAA,IACX,WAAW;AAAA,IACX,aAAa;AAAA,IACb,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,WAAW;AAAA,IACX,qBAAqB,iBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,IACtD,gBAAgB;AAAA,IAChB,gBAAgB;AAAA,IAChB,WAAW,iBAAE,QAAQ,MAAM;AAAA,IAC3B,eAAe,iBAAE,KAAK;AAAA,IACtB,YAAY,iBAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK;AAAA,IAChD,oBAAoB,iBAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,IAC9C,iBAAiB;AAAA,EACnB,CAAC,EACA,OAAO;AAAA,EACV;AACF,CAAC,EACA,OAAO;AASV,IAAM,gBAAgB;AAAA,EACpB,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,YAAY;AAAA;AAAA;AAAA,EAGZ,iBAAiB;AAAA,EACjB,YAAY,CAAC,SAAS,UAAU;AAAA,EAChC,eAAe;AAAA,EACf,KAAK,CAAC;AAAA,EACN,QAAQ,CAAC;AAAA,EACT,SAAS;AAAA,EACT,aAAa;AAAA,EACb,KAAK;AAAA,EACL,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG;AAAA,EAC3C,UAAU;AAAA,EACV,aAAa;AAAA,EACb,KAAK;AAAA,EACL,SAAS;AAAA,EACT,OAAO;AAAA,EACP,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,SAAS;AAAA,IACP,QAAQ;AAAA,IACR,eAAe,CAAC;AAAA,IAChB,iBAAiB,CAAC;AAAA,IAClB,cAAc,CAAC;AAAA,IACf,MAAM;AAAA,EACR;AAAA,EACA,SAAS,CAAC;AAAA,EACV,mBAAmB,CAAC;AAAA,EACpB,SAAS,CAAC;AAAA,EACV,OAAO,CAAC;AAAA,EACR,OAAO;AAAA,EACP,SAAS;AAAA,EACT,0BAA0B;AAAA,EAC1B,qBAAqB,CAAC;AAAA,EACtB,uBAAuB,CAAC;AAAA,EACxB,cAAc;AAChB;AACA,IAAMC,UAAS,CAAC,UAAkBC,YAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACjF,IAAM,sBAAsBD,QAAO,KAAK,UAAU,aAAa,CAAC;AAEhE,SAAS,OAAU,OAAwB;AACzC,MAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC/C,eAAW,SAAS,OAAO,OAAO,KAAK,EAAG,QAAO,KAAK;AACtD,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,SAAO;AACT;AACA,OAAO,aAAa;AAIpB,SAAS,QAAQ,OAAgB,QAAQ,GAAS;AAChD,MAAI,QAAQ,GAAI,OAAM,IAAI,MAAM,+CAA+C;AAC/E,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW;AAC/E,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,OAAO,SAAS,KAAK,KAAK,CAAC,OAAO,GAAG,OAAO,EAAE,EAAG;AACrD,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAEA,MAAI,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK;AAClD,UAAM,IAAI,MAAM,+CAA+C;AACjE,QAAM,QAAQ,MAAM,QAAQ,KAAK;AACjC,QAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,MAAI,QAAQ,cAAc,MAAM,YAAY,cAAc,OAAO,aAAa,cAAc;AAC1F,UAAM,IAAI,MAAM,+CAA+C;AACjE,QAAM,cAAc,OAAO,0BAA0B,KAAK;AAC1D,QAAM,OAAO,QAAQ,QAAQ,WAAW,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,QAAQ,SAAS;AACtF,MAAI,SAAS,KAAK,WAAY,MAAoB;AAChD,UAAM,IAAI,MAAM,+CAA+C;AACjE,aAAW,OAAO,MAAM;AACtB,QAAI,OAAO,QAAQ,YAAa,SAAS,CAAC,qBAAqB,KAAK,GAAG;AACrE,YAAM,IAAI,MAAM,+CAA+C;AACjE,UAAM,aAAa,YAAY,GAAG;AAClC,QAAI,CAAC,WAAW,cAAc,EAAE,WAAW;AACzC,YAAM,IAAI,MAAM,+CAA+C;AACjE,YAAQ,WAAW,OAAO,QAAQ,CAAC;AAAA,EACrC;AACF;AAMA,SAAS,kBAAkB,MAA6B;AACtD,QAAM,SAAS,KAAK,UAAU;AAC9B,SAAO;AAAA,IACL,OAAO,OAAO;AAAA,IACd,YAAY;AAAA,MACV,gBAAgB,CAAC,GAAG,KAAK,UAAU;AAAA,MACnC,UAAU,CAAC;AAAA,MACX,SAAS,OAAO;AAAA,MAChB,WAAW,CAAC;AAAA,MACZ,WAAW;AAAA,QACT,UAAU,OAAO;AAAA,QACjB,UAAU,KAAK,MAAM,MAAO,OAAO,GAAG;AAAA,QACtC,WAAW,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG;AAAA,QAC5C,aAAa;AAAA,QACb,iBAAiB;AAAA,QACjB,aAAa;AAAA,QACb,MAAM;AAAA,MACR;AAAA,MACA,eAAe;AAAA,MACf,aAAc,OAAO,iBAAiB,MAAQ;AAAA,MAC9C,SAAS,KAAK;AAAA,MACd,WAAW,CAAC;AAAA,MACZ,cAAc;AAAA,MACd,cAAc;AAAA,MACd,UAAU,CAAC;AAAA,MACX,mBAAmB,CAAC;AAAA,MACpB,cAAc,CAAC;AAAA,MACf,SAAS;AAAA,MACT,oBAAoB;AAAA,MACpB,UAAU;AAAA,MACV,WAAW,EAAE,OAAO,CAAC,EAAE;AAAA,MACvB,aAAa;AAAA,MACb,eAAe,EAAE,mBAAmB,GAAG,cAAc,CAAC,GAAG,gBAAgB,CAAC,EAAE;AAAA,MAC5E,SAAS;AAAA,MACT,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,MACjB,kBAAkB;AAAA,MAClB,qBAAqB;AAAA,MACrB,SAAS;AAAA,MACT,SAAS;AAAA,MACT,MAAM,mBAAmB,OAAO,WAAW;AAAA,MAC3C,qBAAqB,CAAC;AAAA,MACtB,uBAAuB,CAAC;AAAA,MACxB,qBAAqB,CAAC;AAAA,MACtB,iBAAiB;AAAA,MACjB,8BAA8B;AAAA,MAC9B,qBAAqB;AAAA,MACrB,cAAc;AAAA,MACd,0BAA0B;AAAA,MAC1B,gBAAgB;AAAA,MAChB,sBAAsB,CAAC;AAAA,MACvB,sBAAsB;AAAA,IACxB;AAAA,IACA,iBAAiB;AAAA,IACjB,MAAM,CAAC,EAAE,SAAS,yCAAyC,UAAU,OAAO,YAAY,CAAC;AAAA,EAC3F;AACF;AAsBA,IAAM,WAAW,oBAAI,QAA8C;AAK5D,SAAS,yBACd,OAC8B;AAC9B,MAAI;AACF,YAAQ,KAAK;AACb,UAAM,SAAkB,gBAAgB,KAAK;AAC7C,QAAI,OAAO,WAAW,KAAK,UAAU,MAAM,CAAC,IAAI;AAC9C,YAAM,IAAI,MAAM,+CAA+C;AACjE,UAAM,OAAO,WAAW,MAAM,MAAM;AACpC,UAAM,EAAE,QAAQ,WAAW,KAAK,IAAI;AACpC,UAAM,YAAYD,yCAAwC,OAAO,eAAe;AAChF,UAAM,YAAY,IAAI,IAAI,OAAO,gBAAgB,SAAS;AAC1D,QACE,CAAC,aACD,UAAU,QAAQ,OAAO,sBACxB,CAAC,aAAa,iBAAiB,aAAa,EAAY;AAAA,MACvD,CAAC,UAAU,UAAU,QAAQ,KAAK,MAAM,OAAO,gBAAgB,KAAK;AAAA,IACtE,KACA,CAAC,CAAC,UAAU,OAAO,EAAE,SAAS,UAAU,QAAQ,KAChD,UAAU,YACV,UAAU,YACV,UAAU,UACV,UAAU,QACV,OAAO,cAAc,OAAO;AAE5B,YAAM,IAAI,MAAM,+CAA+C;AACjE,UAAM,MAAM;AAAA,MACV,OAAO;AAAA,MACP,OAAO;AAAA,MACP,KAAK,OAAO;AAAA,MACZ,KAAK,UAAU;AAAA,MACf,KAAK,UAAU;AAAA,MACf,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,IACf;AACA,QAAI,IAAI,IAAI,GAAG,EAAE,SAAS,EAAG,OAAM,IAAI,MAAM,+CAA+C;AAC5F,UAAM,UAAU,kBAAkB,IAAI;AACtC,UAAM,cAAc,KAAK,UAAU,OAAO;AAC1C,UAAM,cAA4C,OAAO;AAAA,MACvD,SAAS;AAAA,MACT,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB;AAAA,MACA,SAAS;AAAA,QACP,UAAU;AAAA,QACV,QAAQC,QAAO,WAAW;AAAA,QAC1B,YAAY,OAAO,WAAW,WAAW;AAAA,QACzC,oBAAoB;AAAA,MACtB;AAAA,IACF,CAAC;AACD,UAAM,SAAS,OAAO,OAAO,CAAC,CAAC;AAC/B,aAAS,IAAI,QAAQ,WAAW;AAChC,WAAO;AAAA,EACT,QAAQ;AAEN,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACF;AAIO,SAAS,0BACd,QAC8B;AAC9B,QAAM,cAAc,SAAS,IAAI,MAAM;AACvC,MAAI,CAAC,YAAa,OAAM,IAAI,MAAM,yCAAyC;AAC3E,SAAO;AACT;;;AC9TA;AAAA,EACE,uBAAAE;AAAA,EACA,8CAAAC;AAAA,EACA;AAAA,OACK;AAMA,IAAM,cAAcC;AAOpB,IAAM,2BAA2B;AAMxC,IAAM,kCAAkC;AACxC,IAAM,iCAAiC;AACvC,IAAM,qCAAqC;AAK3C,IAAM,gCAAgC;AACtC,IAAM,+BAA+B;AAIrC,IAAM,uBAAuB;AAC7B,IAAM,yBAAyB;AAwB/B,IAAM,kBAAkB;AAgBxB,IAAM,2BAA2B;AAU1B,IAAM,2BAA4C,EAAE,OAAO,MAAM,QAAQ,KAAK,KAAK,GAAG;AAOtF,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAClC;AAAA,EACA;AAAA,EAET,YAAY,UAAkB,QAAgB;AAC5C,UAAM,QACJ,aAAa,KACT,SACA,aAAa,KACX,WACA,aAAa,KACX,eACA,aAAa,KACX,UACA,aAAa,KACX,SACA,aAAa,OAAO,4BAA4B,KAAK,MAAM,IACzD,YACA;AAChB;AAAA,MACE,0CAA0C,KAAK,WAAW,QAAQ,IAAI,SAAS;AAAA,EAAM,MAAM,KAAK,EAAE;AAAA,IACpG;AACA,SAAK,OAAO;AACZ,SAAK,WAAW;AAChB,SAAK,QAAQ;AAAA,EACf;AACF;AAKO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EACtD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AA6FO,SAAS,wBAAwB,UAAqC,CAAC,GAAW;AACvF,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,OAAO,QAAQ,QAAQA;AAC7B,QAAM,MACJ,aAAa,SAAS,KAAK,cAAc,SAAS,MAAM,gBACzC,SAAS,GAAG,gBAAgB,IAAI;AAmCjD,QAAM,iBACJ,0TAIO,GAAG;AACZ,QAAM,UACJ,sBAAsB,IAAI,kJAEQ,IAAI,aAAa,SAAS,KAAK,IAAI,SAAS,MAAM,QAAQ,SAAS,GAAG,uOAS7FC,YAAW,cAAc,CAAC;AAUvC,QAAM,YACJ;AAcF,QAAM,aACJ,GAAG,SAAS,mGAEQ,oBAAoB,+IAUtB,eAAe,uBAAuB,eAAe,wEAAwE,wBAAwB,wEAIvJ,oBAAoB,oFAAoF,eAAe,+DAC9H,sBAAsB;AAEjC,QAAM,QACJ;AAGF,SAAO,GAAG,KAAK,uCAAuC,OAAO,aAAa,UAAU;AACtF;AAEA,SAAS,iBAAiB,QAAyC;AACjE,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO;AAAA,EACT;AACA,SAAO,CAAC,OAAO,QAAQ,OAAO,QAAQ,OAAO,MAAM,EAChD,OAAO,CAAC,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS,CAAC,EAChE,KAAK,IAAI;AACd;AAEA,SAAS,mBAAmB,QAAgD;AAC1E,MAAI,OAAO,WAAW,UAAU;AAC9B,UAAM,SAAS,wBAAwB,MAAM;AAC7C,QAAI,OAAO,SAAS,SAAU,QAAO,OAAO;AAG5C,WAAO,OAAO,SAAS,YAAY,KAAK;AAAA,EAC1C;AACA,SAAO,OAAO,OAAO,aAAa,WAAW,OAAO,WAAW;AACjE;AAEA,SAAS,oBAAoB,QAAgD;AAC3E,MAAI,OAAO,WAAW,UAAU;AAC9B,UAAM,SAAS,wBAAwB,MAAM;AAC7C,WAAO,OAAO,SAAS,YAAY,OAAO,YAAY;AAAA,EACxD;AACA,QAAM,QAAQ,OAAO,aAAa,OAAO;AACzC,SAAO,OAAO,UAAU,WAAW,QAAQ;AAC7C;AAEA,SAASA,YAAW,OAAuB;AACzC,SAAO,IAAI,MAAM,WAAW,KAAK,OAAO,CAAC;AAC3C;AAKA,SAAS,2BACP,SACA,WACA,YACA,aACQ;AACR,QAAM,UAAU,KAAK;AAAA,IACnB;AAAA,IACA,KAAK,IAAI,IAAI,KAAK,MAAM,YAAY,CAAC,CAAC;AAAA,EACxC;AACA,QAAM,mBAAmB,KAAK,IAAI,GAAG,YAAY,OAAO;AACxD,QAAM,cAAc,KAAK,IAAI,GAAG,KAAK,MAAM,UAAU,CAAC,CAAC;AACvD,QAAM,yBAAyB,mBAAmB,KAAO,QAAQ,CAAC;AAClE,QAAM,oBAAoB,cAAc,KAAO,QAAQ,CAAC;AACxD,QAAM,iBACJ,UAAUA,YAAW,UAAU,CAAC,WAAWA,YAAW,WAAW,CAAC,sZAUvDA,YAAW,OAAO,CAAC;AAChC;AAAA;AAAA;AAAA;AAAA;AAAA,IAKE,sCAAsC,gBAAgB,KAAK,qBAAqB,aACrEA,YAAW,cAAc,CAAC,iFAMQ,gBAAgB;AAAA;AAEjE;AAEA,IAAM,+BAAN,cAA2C,MAAM;AAAC;AAClD,IAAM,mCAAN,cAA+C,MAAM;AAAC;AAgCtD,IAAM,oCAAoC,oBAAI,IAAwC;AACtF,IAAM,oCAAoC,oBAAI,QAA4C;AAC1F,IAAM,8BAA8B,oBAAI,QAA4C;AAEpF,SAAS,SAAS,OAAgD;AAChE,SAAO,UAAU,QAAQ,OAAO,UAAU,WAAY,QAAoC;AAC5F;AAEA,SAAS,eAAe,OAA+B;AACrD,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AACjE;AAEA,SAAS,iBAAiB,SAA2B;AACnD,MAAI;AACF,WAAO,SAAS,OAAO,GAAG;AAAA,EAC5B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,sBACP,SACA,SACe;AACf,QAAM,WAAW,eAAe,QAAQ,kBAAkB,SAAS;AACnE,MAAI,SAAU,QAAO,WAAW,QAAQ;AAExC,QAAM,gBAAgB,SAAS,OAAO;AACtC,QAAM,QAAQ,SAAS,iBAAiB,OAAO,CAAC;AAChD,QAAM,gBAAgB,QAAQ,SAAS,MAAM,aAAa,IAAI;AAC9D,QAAM,aAAa,CAAC,eAAe,OAAO,aAAa;AAKvD,QAAM,SAAS;AAAA,IACb;AAAA,IACA,GAAGC;AAAA,EACL;AACA,aAAW,aAAa,YAAY;AAClC,QAAI,CAAC,UAAW;AAChB,eAAW,SAAS,QAAQ;AAC1B,YAAM,QAAQ,eAAe,UAAU,KAAK,CAAC;AAC7C,UAAI,MAAO,QAAO,WAAW,KAAK;AAAA,IACpC;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,oBAAgD;AACvD,SAAO;AAAA,IACL,OAAO;AAAA,IACP,OAAO;AAAA,IACP,SAAS,CAAC;AAAA,IACV,UAAU,oBAAI,IAAI;AAAA,IAClB,OAAO;AAAA,IACP,gBAAgB,oBAAI,IAAI;AAAA,IACxB,qBAAqB;AAAA,EACvB;AACF;AAEA,SAAS,eACP,SACA,SACmC;AACnC,OAAK,OAAO,YAAY,YAAY,YAAY,SAAS,OAAO,YAAY,YAAY;AACtF,WAAO;AAAA,EACT;AACA,QAAM,YAAY,sBAAsB,SAAS,OAAO;AACxD,MAAI,WAAW;AACb,QAAIC,SAAQ,kCAAkC,IAAI,SAAS;AAC3D,QAAI,CAACA,QAAO;AACV,MAAAA,SAAQ,kBAAkB;AAC1B,wCAAkC,IAAI,WAAWA,MAAK;AAAA,IACxD;AACA,WAAOA;AAAA,EACT;AAKA,QAAM,gBAAgB,iBAAiB,OAAO;AAC9C,MAAI,kBAAkB,OAAO,kBAAkB,YAAY,OAAO,kBAAkB,aAAa;AAC/F,UAAM,WAAW;AACjB,QAAIA,SAAQ,kCAAkC,IAAI,QAAQ;AAC1D,QAAI,CAACA,QAAO;AACV,MAAAA,SAAQ,kBAAkB;AAC1B,wCAAkC,IAAI,UAAUA,MAAK;AAAA,IACvD;AACA,WAAOA;AAAA,EACT;AAEA,QAAM,MAAM;AACZ,MAAI,QAAQ,4BAA4B,IAAI,GAAG;AAC/C,MAAI,CAAC,OAAO;AACV,YAAQ,kBAAkB;AAC1B,gCAA4B,IAAI,KAAK,KAAK;AAAA,EAC5C;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,QAAqC,OAAuB;AACzF,MAAI,OAAO,QAAS;AACpB,SAAO,UAAU;AACjB,MAAI,OAAO,MAAO,cAAa,OAAO,KAAK;AAC3C,MAAI,UAAU,OAAW,QAAO,QAAQ;AAAA,MACnC,QAAO,OAAO,KAAK;AAC1B;AAEA,SAAS,qBAAqB,OAAyC;AACrE,MAAI,MAAM,MAAO;AACjB,SAAO,MAAM,QAAQ,SAAS,GAAG;AAC/B,UAAM,SAAS,MAAM,QAAQ,MAAM;AACnC,QAAI,OAAO,QAAS;AACpB,QAAI,OAAO,UAAU,MAAM,OAAO;AAChC,4BAAsB,QAAQ,IAAI,iCAAiC,CAAC;AACpE;AAAA,IACF;AACA,UAAM,QAAQ;AACd,0BAAsB,MAAM;AAC5B;AAAA,EACF;AACF;AAEA,SAAS,iBACP,OACA,UACqB;AACrB,SAAO,IAAI,QAAoB,CAACC,UAAS,WAAW;AAClD,UAAM,SAAsC;AAAA,MAC1C,OAAO,MAAM;AAAA,MACb,SAAS;AAAA,MACT,SAAS,MAAM;AACb,QAAAA,SAAQ,MAAM;AACZ,cAAI,MAAM,UAAU,OAAQ;AAC5B,gBAAM,QAAQ;AACd,+BAAqB,KAAK;AAAA,QAC5B,CAAC;AAAA,MACH;AAAA,MACA;AAAA,IACF;AACA,UAAM,QAAQ,KAAK,MAAM;AACzB,UAAM,cAAc,WAAW,aAAa;AAC5C,QAAI,eAAe,GAAG;AACpB,aAAO,UAAU;AACjB,YAAM,UAAU,MAAM,QAAQ,OAAO,CAAC,cAAc,cAAc,MAAM;AACxE,aAAO,IAAI,6BAA6B,CAAC;AACzC;AAAA,IACF;AACA,WAAO,QAAQ,WAAW,MAAM;AAC9B,UAAI,OAAO,QAAS;AACpB,aAAO,UAAU;AACjB,YAAM,UAAU,MAAM,QAAQ,OAAO,CAAC,cAAc,cAAc,MAAM;AACxE,aAAO,IAAI,6BAA6B,CAAC;AAAA,IAC3C,GAAG,WAAW;AACd,WAAO,MAAM,QAAQ;AACrB,yBAAqB,KAAK;AAAA,EAC5B,CAAC;AACH;AAEA,SAAS,2BAA2B,OAAmC,OAAqB;AAC1F,QAAM,WAA0C,CAAC;AACjD,aAAW,UAAU,MAAM,SAAS;AAClC,QAAI,OAAO,UAAU;AACnB,4BAAsB,QAAQ,IAAI,iCAAiC,CAAC;AAAA,QACjE,UAAS,KAAK,MAAM;AAAA,EAC3B;AACA,QAAM,UAAU;AAClB;AAEA,SAAS,eAAuB;AAC9B,SAAO,YAAY,IAAI;AACzB;AAEA,eAAe,uBACb,OACA,UACkB;AAClB,QAAM,QAAQ,MAAM;AACpB,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,UAAM,eAAe,OAAO,QAAQ;AAAA,EACtC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,MAAM,UAAU,MAAO,OAAM,QAAQ;AACzC,SAAO;AACT;AAEA,SAAS,kBACP,OACA,SACY;AACZ,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,SAAS,IAAI,OAAO;AAC1B,OAAK,QAAQ;AAAA,IACX,MAAM,MAAM,SAAS,OAAO,OAAO;AAAA,IACnC,MAAM,MAAM,SAAS,OAAO,OAAO;AAAA,EACrC;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,SAA4C;AACxE,MAAI,QAAQ,WAAW,EAAG,QAAO,QAAQ,QAAQ;AACjD,SAAO,IAAI,QAAc,CAACA,aAAY;AACpC,QAAI,YAAY,QAAQ;AACxB,QAAI;AACJ,UAAM,SAAS,MAAM;AACnB,UAAI,MAAO,cAAa,KAAK;AAC7B,MAAAA,SAAQ;AAAA,IACV;AACA,YAAQ,WAAW,QAAQ,4BAA4B;AACvD,UAAM,QAAQ;AACd,eAAW,WAAW,SAAS;AAC7B,WAAK,QAAQ;AAAA,QACX,MAAM;AACJ,uBAAa;AACb,cAAI,cAAc,EAAG,QAAO;AAAA,QAC9B;AAAA,QACA,MAAM;AACJ,uBAAa;AACb,cAAI,cAAc,EAAG,QAAO;AAAA,QAC9B;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,SAAS,eACP,OACA,OACA,iBACA,SACM;AACN,kBAAgB,MAAM,IAAI,6BAA6B,CAAC;AACxD,MAAI,CAAC,MAAO;AAEZ,MAAI,MAAM,UAAU,MAAO;AAE3B,QAAM,eAAe,IAAI,QAAQ,aAAa,OAAO;AACrD,QAAM,sBAAsB;AAC5B,6BAA2B,OAAO,KAAK;AAKvC,QAAM,SAAS;AACf,QAAM,UAAU,CAAC,GAAG,MAAM,QAAQ;AAClC,QAAM,QAAQ,qBAAqB,OAAO;AAC1C,QAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAI,CAAC,MAAM,OAAO,KAAK,CAAC,EAAE,KAAK,MAAM,MAAS,IAAI;AAItF,OAAK,MAAM,KAAK,MAAM;AACpB,eAAW,WAAW,QAAS,OAAM,SAAS,OAAO,OAAO;AAAA,EAC9D,CAAC;AACH;AAEA,SAAS,uBAAuB,OAA0C,OAAqB;AAC7F,MAAI,SAAS,MAAM,UAAU,MAAO,OAAM,IAAI,iCAAiC;AACjF;AAEA,eAAe,eACb,SACA,UACA,MAAoB,cACR;AACZ,QAAM,cAAc,WAAW,IAAI;AACnC,MAAI,eAAe,EAAG,OAAM,IAAI,6BAA6B;AAC7D,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK;AAAA,MACxB;AAAA,MACA,IAAI,QAAW,CAAC,UAAU,WAAW;AACnC,gBAAQ,WAAW,MAAM,OAAO,IAAI,6BAA6B,CAAC,GAAG,WAAW;AAChF,cAAM,QAAQ;AAAA,MAChB,CAAC;AAAA,IACH,CAAC;AAAA,EACH,UAAE;AACA,QAAI,MAAO,cAAa,KAAK;AAAA,EAC/B;AACF;AAEA,SAAS,2BAA2B,YAAoB,aAA6B;AACnF,QAAM,SAASH,YAAW,UAAU;AACpC,QAAM,QAAQA,YAAW,WAAW;AAMpC,QAAM,SACJ,UAAU,MAAM,WAAW,KAAK;AAoBlC,SAAO,wDAAwDA,YAAW,MAAM,CAAC;AACnF;AAEA,eAAe,6BACb,SACA,SACA,UACkC;AAClC,QAAM,aAAa,IAAI,gBAAgB;AACvC,MAAI,SAAkC,MAAM;AAAA,IAC1C,QAAQ;AAAA,MACN,OAAO,QAAQ,SAAS,aACpB,QAAQ,KAAK;AAAA,QACX,KAAK;AAAA,QACL,aAAa,KAAK,IAAI,KAAK,6BAA6B;AAAA,QACxD,iBAAiB;AAAA,QACjB,QAAQ,WAAW;AAAA,MACrB,CAAC,IACD,QAAQ,YAAa;AAAA,QACnB,KAAK;AAAA,QACL,aAAa,KAAK,IAAI,KAAK,6BAA6B;AAAA,QACxD,iBAAiB;AAAA,QACjB,QAAQ,WAAW;AAAA,MACrB,CAAC;AAAA,IACP;AAAA,IACA;AAAA,EACF;AAEA,MAAI,oBAAoB,oBAAoB,MAAM;AAClD,SAAO,sBAAsB,MAAM;AACjC,QAAI,OAAO,QAAQ,eAAe,YAAY;AAC5C,YAAM,IAAI,MAAM,qDAAqD;AAAA,IACvE;AACA,UAAM,cAAc,WAAW,aAAa;AAC5C,QAAI,eAAe,EAAG,OAAM,IAAI,6BAA6B;AAC7D,aAAS,MAAM;AAAA,MACb,QAAQ,WAAW;AAAA,QACjB,WAAW;AAAA,QACX,OAAO;AAAA,QACP,aAAa,KAAK,IAAI,GAAG,KAAK,IAAI,KAAK,cAAc,CAAC,CAAC;AAAA,QACvD,iBAAiB;AAAA,QACjB,QAAQ,WAAW;AAAA,MACrB,CAAC;AAAA,MACD;AAAA,IACF;AACA,wBAAoB,oBAAoB,MAAM;AAAA,EAChD;AACA,SAAO;AACT;AAEA,eAAe,yBACb,SACA,mBACA,UACe;AACf,MAAI,sBAAsB,QAAQ,OAAO,QAAQ,eAAe,WAAY;AAC5E,MAAI;AAGF,UAAM;AAAA,MACJ,QAAQ,WAAW;AAAA,QACjB,WAAW;AAAA,QACX,OAAO;AAAA,QACP,aAAa;AAAA,QACb,iBAAiB;AAAA,MACnB,CAAC;AAAA,MACD;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AACF;AAEA,eAAe,2BACb,SACA,SACA,UACkB;AAClB,MAAI;AACF,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA,2BAA2B,QAAQ,YAAY,QAAQ,WAAW;AAAA,MAClE;AAAA,IACF;AACA,UAAM,SAAS,iBAAiB,MAAM;AACtC,UAAMI,UAAS,kEAAkE;AAAA,MAC/E;AAAA,IACF,IAAI,CAAC;AACL,WAAOA,YAAW;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,wBACb,SACA,OACA,UACkB;AAClB,QAAM,UAAU,CAAC,GAAG,MAAM,eAAe,OAAO,CAAC;AACjD,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM,sBAAsB;AAC5B,WAAO;AAAA,EACT;AACA,QAAM,UAAU,MAAM,QAAQ;AAAA,IAC5B,QAAQ,IAAI,OAAO,aAAa;AAAA,MAC9B;AAAA,MACA,SAAS,MAAM,2BAA2B,SAAS,SAAS,QAAQ;AAAA,IACtE,EAAE;AAAA,EACJ;AACA,aAAW,EAAE,SAAS,QAAQ,KAAK,SAAS;AAC1C,QAAI,QAAS,OAAM,eAAe,OAAO,QAAQ,WAAW;AAAA,EAC9D;AACA,QAAM,sBAAsB,MAAM,eAAe,SAAS;AAC1D,SAAO,MAAM;AACf;AAEA,SAAS,YAAoB;AAC3B,SAAO,GAAG,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC;AAC9E;AAEA,SAAS,kBACP,SACA,SACA,MAAoB,cACpB;AACA,QAAM,KAAK,UAAU;AACrB,QAAM,UAAU,QAAQ;AACxB,QAAM,OACJ,QAAQ,gBACP,UACG,CAAC,UACC,QAAQ,KAAK,mBAAmB,KAAK,UAAU,KAAK,CAAC,EAAE,IACzD;AACN,QAAM,uBAAuB,oBAAI,IAAY;AAE7C,QAAM,OAAO,CACX,OACAA,SACA,SAKI,CAAC,MACF;AACH,QAAI,CAAC,KAAM;AACX,UAAM,QAAoC;AAAA,MACxC,MAAM;AAAA,MACN,WAAW;AAAA,MACX;AAAA,MACA,QAAAA;AAAA,MACA,WAAW,OAAO,aAAa,IAAI,IAAI;AAAA,MACvC,QAAQ,OAAO,UAAU;AAAA,MACzB,gBAAgB,OAAO,kBAAkB;AAAA,MACzC,YAAY,SAAS,cAAc;AAAA,MACnC,GAAI,SAAS,YAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,MAC7D,GAAI,SAAS,eAAe,SAAY,EAAE,YAAY,QAAQ,WAAW,IAAI,CAAC;AAAA,MAC9E,GAAI,OAAO,sBAAsB,SAC7B,EAAE,mBAAmB,OAAO,kBAAkB,IAC9C,CAAC;AAAA,IACP;AACA,QAAI;AACF,WAAK,QAAQ,QAAQ,KAAK,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,IACzD,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,oBAAoB,CAAC,WAAmB;AAC5C,eAAW,SAAS,OAAO;AAAA,MACzB;AAAA,IACF,GAAG;AACD,YAAM,CAAC,MAAM,OAAO,SAAS,cAAc,IAAI;AAC/C,UAAI,CAAC,SAAS,CAAC,WAAW,qBAAqB,IAAI,IAAI,EAAG;AAC1D,2BAAqB,IAAI,IAAI;AAC7B,WAAK,OAAO,aAAa;AAAA,QACvB,QAAQ;AAAA,QACR,WAAW,OAAO,OAAO;AAAA,QACzB,gBAAiB,kBAA6D;AAAA,MAChF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,EAAE,MAAM,kBAAkB;AACnC;AAMA,SAAS,oBAAoB,QAAwB;AACnD,MAAI,2BAA2B,KAAK,MAAM,GAAG;AAC3C,WAAO;AAAA,EACT;AACA,MAAI,gCAAgC,KAAK,MAAM,GAAG;AAChD,WAAO;AAAA,EACT;AAKA,MAAI,gCAAgC,KAAK,MAAM,GAAG;AAChD,WAAO;AAAA,EACT;AACA,MAAI,wBAAwB,KAAK,MAAM,GAAG;AACxC,WAAO;AAAA,EACT;AACA,MAAI,yBAAyB,KAAK,MAAM,GAAG;AACzC,WAAO;AAAA,EACT;AACA,MAAI,mBAAmB,KAAK,MAAM,GAAG;AACnC,WAAO;AAAA,EACT;AACA,MAAI,uBAAuB,KAAK,MAAM,GAAG;AACvC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAeA,eAAsB,mBACpB,SACA,UAAqC,CAAC,GACH;AACnC,QAAM,IAAI;AACV,MAAI,OAAO,GAAG,SAAS,cAAc,OAAO,GAAG,gBAAgB,YAAY;AACzE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,OAAO,QAAQ,QAAQL;AAC7B,QAAM,YAAY,QAAQ,aAAa;AACvC,MAAI,CAAC,OAAO,SAAS,SAAS,KAAK,aAAa,GAAG;AACjD,UAAM,IAAI,WAAW,+DAA+D;AAAA,EACtF;AACA,QAAM,UAAU,aAAa;AAC7B,QAAM,WAAW,UAAU;AAC3B,QAAM,YAAY,kBAAkB,SAAS,SAAS,YAAY;AAClE,QAAM,iBAAiB,UAAU;AACjC,QAAM,aAAa,uCAAuC,cAAc;AACxE,QAAM,MAAM;AAAA,IACV,wBAAwB,EAAE,UAAU,KAAK,CAAC;AAAA,IAC1C;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,cAAwB,CAAC;AAC/B,QAAM,QAAQ,eAAe,SAAS,OAAO;AAC7C,MAAI;AACJ,MAAI,OAAO;AACT,QAAI;AACF,gBAAU,MAAM,iBAAiB,OAAO,QAAQ;AAAA,IAClD,SAAS,OAAO;AACd,UACE,iBAAiB,gCACjB,iBAAiB,kCACjB;AACA,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAEA,MAAI;AACF,QAAI,SAAS,CAAC,MAAM,qBAAqB;AACvC,YAAM,kBAAkB,aAAa,IAAI;AACzC,YAAM,WAAW,MAAM,wBAAwB,GAAG,OAAO,eAAe;AACxE,UAAI,CAAC,UAAU;AAIb,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,UAAM,QAAQ,OAAO,SAAS;AAC9B,UAAM,kBAAkB,IAAI,gBAAgB;AAC5C,QAAI,0BAAyC;AAC7C,cAAU,KAAK,iBAAiB,SAAS;AACzC,cAAU,KAAK,eAAe,SAAS;AAEvC,QAAI;AACF,YAAM,iBAAiB,KAAK,IAAI,GAAG,KAAK,IAAI,iCAAiC,YAAY,CAAC,CAAC;AAC3F,YAAM,cAAgD;AAAA,QAGpD;AAAA,QACA,QAAQ;AAAA,UACN,OAAO,EAAE,SAAS,aACd,EAAE,KAAK;AAAA,YACL;AAAA,YACA,aAAa;AAAA,YACb,iBAAiB;AAAA,YACjB,QAAQ,gBAAgB;AAAA,UAC1B,CAAC,IACD,EAAE,YAAa;AAAA,YACb;AAAA,YACA,aAAa;AAAA,YACb,iBAAiB;AAAA,YACjB,QAAQ,gBAAgB;AAAA,UAC1B,CAAC;AAAA,QACP;AAAA,MACF;AACA,UAAI,SAAkC,MAAM;AAAA,QAC1C;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,6BAAuB,OAAO,KAAK;AACnC,UAAI,QAAQ,iBAAiB,MAAM;AACnC,kBAAY,KAAK,KAAK;AACtB,gBAAU,kBAAkB,KAAK;AACjC,gBAAU,KAAK,yBAAyB,WAAW;AAEnD,UAAI,oBAAoB,oBAAoB,MAAM;AAClD,gCAA0B;AAC1B,aAAO,sBAAsB,MAAM;AACjC,kBAAU,KAAK,kBAAkB,WAAW,EAAE,kBAAkB,CAAC;AACjE,YAAI,OAAO,EAAE,eAAe,YAAY;AACtC,gBAAM,IAAI;AAAA,YACR;AAAA,YACA,GAAG,YAAY,KAAK,IAAI,CAAC;AAAA,2BAA8B,iBAAiB;AAAA,UAC1E;AAAA,QACF;AACA,+BAAuB,OAAO,KAAK;AACnC,cAAM,cAAc,WAAW,aAAa;AAC5C,YAAI,eAAe,EAAG,OAAM,IAAI,6BAA6B;AAC7D,cAAM,cAAc,KAAK,IAAI,GAAG,KAAK,IAAI,gCAAgC,cAAc,CAAC,CAAC;AACzF,iBAAS,MAAM;AAAA,UACb;AAAA,YACE;AAAA,YACA,EAAE,WAAW;AAAA,cACX,WAAW;AAAA,cACX,OAAO;AAAA,cACP,aAAa;AAAA,cACb,iBAAiB;AAAA,cACjB,QAAQ,gBAAgB;AAAA,YAC1B,CAAC;AAAA,UACH;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA,+BAAuB,OAAO,KAAK;AACnC,gBAAQ,iBAAiB,MAAM;AAC/B,oBAAY,KAAK,KAAK;AACtB,kBAAU,kBAAkB,KAAK;AACjC,4BAAoB,oBAAoB,MAAM;AAC9C,kCAA0B;AAAA,MAC5B;AAEA,YAAM,SAAS,YAAY,KAAK,IAAI;AACpC,YAAM,WAAW,mBAAmB,MAAM,KAAK,oBAAoB,MAAM;AACzE,gBAAU,KAAK,oBAAoB,aAAa,IAAI,cAAc,QAAQ;AAC1E,UAAI,aAAa,GAAG;AAClB,cAAM,IAAI,kBAAkB,UAAU,MAAM;AAAA,MAC9C;AAEA,YAAM,UAAU,OAAO,MAAM,2BAA2B,KAAK,CAAC,EAAE,GAAG,CAAC;AACpE,gBAAU,KAAK,sBAAsB,WAAW;AAChD,aAAO,EAAE,MAAM,UAAU,OAAO;AAAA,IAClC,SAAS,OAAO;AACd,UACE,iBAAiB,gCACjB,iBAAiB,kCACjB;AACA,cAAM,iBAA6C;AAAA,UACjD;AAAA,UACA,aAAa;AAAA,QACf;AACA,uBAAe,OAAO,OAAO,iBAAiB,cAAc;AAC5D,cAAM,kBAAkB,aAAa,IAAI;AACzC,kBAAU,KAAK,mBAAmB,SAAS;AAC3C,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,UACA,KAAK,IAAI,iBAAiB,aAAa,IAAI,EAAE;AAAA,QAC/C;AACA,YAAI,WAAW;AACf,YAAI,OAAO;AACT,qBAAW,MAAM,wBAAwB,GAAG,OAAO,eAAe;AAClE,cAAI,CAAC,UAAU;AACb,kBAAM;AAAA,cACJ;AAAA,cACA,KAAK,IAAI,iBAAiB,aAAa,IAAI,4BAA4B;AAAA,YACzE;AAAA,UACF;AAAA,QACF,OAAO;AACL,qBAAW,MAAM,2BAA2B,GAAG,gBAAgB,eAAe;AAAA,QAChF;AACA,kBAAU,KAAK,mBAAmB,WAAW,cAAc,QAAQ;AACnE,cAAM,SAAS,GAAG,YAAY,KAAK,IAAI,CAAC;AAAA,mCAAsC,SAAS;AACvF,kBAAU,KAAK,iBAAiB,QAAQ;AACxC,cAAM,IAAI,kBAAkB,KAAK,MAAM;AAAA,MACzC;AACA,gBAAU,KAAK,kBAAkB,QAAQ;AACzC,YAAM;AAAA,IACR;AAAA,EACF,UAAE;AACA,cAAU;AAAA,EACZ;AACF;AAIA,eAAsB,qBAAqB,SAAiC;AAC1E,QAAM,IAAI;AACV,MAAI,OAAO,GAAG,SAAS,YAAY;AACjC,UAAM,EAAE,KAAK,EAAE,KAAK,yBAAyB,aAAa,KAAQ,iBAAiB,IAAM,CAAC;AAC1F;AAAA,EACF;AACA,MAAI,OAAO,GAAG,gBAAgB,YAAY;AACxC,UAAM,EAAE,YAAY;AAAA,MAClB,KAAK;AAAA,MACL,aAAa;AAAA,MACb,iBAAiB;AAAA,IACnB,CAAC;AAAA,EACH;AACF;;;ACpqCA,SAAS,4BAA4B;AAU9B,IAAM,6BAA6B;AAMnC,IAAM,sBAAN,cAAkC,MAAM;AAAA,EACpC;AAAA,EACA;AAAA,EAET,YAAY,UAAkB,QAAgB;AAC5C,UAAM,QAAQ,aAAa,KAAK,SAAS;AACzC;AAAA,MACE,oCAAoC,KAAK,WAAW,QAAQ,IAAI,SAAS;AAAA,EAAM,MAAM,KAAK,EAAE;AAAA,IAC9F;AACA,SAAK,OAAO;AACZ,SAAK,WAAW;AAChB,SAAK,QAAQ;AAAA,EACf;AACF;AAMO,IAAM,iCAAN,cAA6C,MAAM;AAAA,EACxD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAuDO,SAAS,0BAA0B,UAAuC,CAAC,GAAW;AAC3F,QAAM,OAAO,QAAQ,QAAQ;AAI7B,SACE,iHAKqB,IAAI;AAE7B;AAEA,SAASM,kBAAiB,QAAyC;AACjE,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO;AAAA,EACT;AACA,SAAO,CAAC,OAAO,QAAQ,OAAO,QAAQ,OAAO,MAAM,EAChD,OAAO,CAAC,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS,CAAC,EAChE,KAAK,IAAI;AACd;AAEA,SAASC,oBAAmB,QAAgD;AAC1E,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO;AAAA,EACT;AACA,SAAO,OAAO,OAAO,aAAa,WAAW,OAAO,WAAW;AACjE;AAOA,SAASC,qBAAoB,QAAwB;AACnD,MAAI,yBAAyB,KAAK,MAAM,GAAG;AACzC,WAAO;AAAA,EACT;AACA,MAAI,yBAAyB,KAAK,MAAM,GAAG;AACzC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAeA,eAAsB,qBACpB,SACA,UAAuC,CAAC,GACH;AACrC,QAAM,IAAI;AACV,MAAI,OAAO,GAAG,SAAS,cAAc,OAAO,GAAG,gBAAgB,YAAY;AACzE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAO,QAAQ,QAAQ;AAC7B,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,MAAM,0BAA0B,EAAE,KAAK,CAAC;AAE9C,QAAM,SACJ,OAAO,EAAE,SAAS,aACd,MAAM,EAAE,KAAK,EAAE,KAAK,aAAa,WAAW,iBAAiB,IAAO,CAAC,IACrE,MAAM,EAAE,YAAa,EAAE,KAAK,aAAa,WAAW,iBAAiB,IAAO,CAAC;AAEnF,QAAM,SAASF,kBAAiB,MAAM;AACtC,QAAM,WAAWC,oBAAmB,MAAM,KAAKC,qBAAoB,MAAM;AAEzE,MAAI,aAAa,GAAG;AAClB,UAAM,IAAI,oBAAoB,UAAU,MAAM;AAAA,EAChD;AAEA,QAAM,UAAU,OAAO,MAAM,4BAA4B,KAAK,CAAC,EAAE,GAAG,CAAC;AACrE,SAAO,EAAE,MAAM,OAAO;AACxB;AAIA,eAAsB,uBAAuB,SAAiC;AAC5E,QAAM,IAAI;AACV,MAAI,OAAO,GAAG,SAAS,YAAY;AACjC,UAAM,EAAE,KAAK,EAAE,KAAK,0BAA0B,aAAa,KAAQ,iBAAiB,IAAM,CAAC;AAC3F;AAAA,EACF;AACA,MAAI,OAAO,GAAG,gBAAgB,YAAY;AACxC,UAAM,EAAE,YAAY;AAAA,MAClB,KAAK;AAAA,MACL,aAAa;AAAA,MACb,iBAAiB;AAAA,IACnB,CAAC;AAAA,EACH;AACF;;;AC/NA,SAAS,SAAS,iBAAiB;AACnC,SAAS,4BAA4B;AAI9B,IAAM,oCAAoC;AAC1C,IAAM,kCAAkC;AACxC,IAAM,6BAA6B;AACnC,IAAM,kCAAkC;AAExC,IAAM,4BAAN,cAAwC,MAAM;AAAA,EAC1C;AAAA,EACA;AAAA,EAET,YAAY,UAAkB,QAAgB;AAC5C,UAAM,QAAQ,4BAA4B,UAAU,MAAM;AAC1D;AAAA,MACE,2CAA2C,KAAK,WAAW,QAAQ,IAAI,SAAS;AAAA,EAAM,MAAM,KAAK,EAAE;AAAA,IACrG;AACA,SAAK,OAAO;AACZ,SAAK,WAAW;AAChB,SAAK,QAAQ;AAAA,EACf;AACF;AAEO,IAAM,uCAAN,cAAmD,MAAM;AAAA,EAC9D,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AA4BA,IAAM,+BAA+B;AAc9B,SAAS,gCACd,SAEQ;AACR,QAAM,OAAO,YAAY,QAAQ,QAAQ,oBAAoB;AAC7D,QAAM,YAAY,aAAa,QAAQ,gBAAgB,qCAAqC;AAC5F,QAAM,iBAAiB,iBAAiB,QAAQ,kBAAkB,CAAC,CAAC;AACpE,SAAO;AAAA,IACL;AAAA,IACA,gBAAgB,0BAA0B;AAAA,IAC1C;AAAA,IACA,8BAA8B,IAAI;AAAA,IAClC,0BAA0BC,YAAW,+BAA+B,CAAC;AAAA,IACrE,sCAAsCA,YAAW,SAAS,CAAC;AAAA,IAC3D,qCAAqCA,YAAW,eAAe,KAAK,GAAG,CAAC,CAAC;AAAA,IACzE;AAAA,IACA;AAAA,EACF,EAAE,KAAK,GAAG;AACZ;AAEA,eAAsB,2BACpB,SACA,SAC2C;AAC3C,QAAM,SAAS;AACf,MAAI,OAAO,QAAQ,SAAS,cAAc,OAAO,QAAQ,gBAAgB,YAAY;AACnF,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,OAAO,YAAY,QAAQ,QAAQ,oBAAoB;AAC7D,QAAM,YAAY,eAAe,QAAQ,aAAa,iCAAiC;AACvF,QAAM,MAAM,gCAAgC;AAAA,IAC1C;AAAA,IACA,gBAAgB,QAAQ;AAAA,IACxB,GAAI,QAAQ,iBAAiB,EAAE,gBAAgB,QAAQ,eAAe,IAAI,CAAC;AAAA,EAC7E,CAAC;AACD,QAAM,SAAS,OAAO,OAClB,MAAM,OAAO,KAAK;AAAA,IAChB;AAAA,IACA,SAAS;AAAA,IACT,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB,CAAC,IACD,MAAM,OAAO,YAAa;AAAA,IACxB;AAAA,IACA,SAAS;AAAA,IACT,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB,CAAC;AACL,QAAM,SAAS,SAAS,MAAM;AAC9B,QAAM,WAAW,WAAW,MAAM,KAAK,cAAc,MAAM;AAC3D,MAAI,aAAa,EAAG,OAAM,IAAI,0BAA0B,UAAU,MAAM;AACxE,QAAM,UAAU,OAAO,MAAM,4BAA4B,KAAK,CAAC,EAAE,GAAG,CAAC;AACrE,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,MACA,UAAU;AAAA,IACZ;AAAA,EACF;AACA,SAAO,EAAE,MAAM,OAAO;AACxB;AAEA,eAAsB,6BAA6B,SAAiC;AAClF,QAAM,SAAS;AACf,MAAI,QAAQ,MAAM;AAChB,UAAM,OAAO,KAAK;AAAA,MAChB,KAAK;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,iBAAiB;AAAA,IACnB,CAAC;AAAA,EACH,WAAW,QAAQ,aAAa;AAC9B,UAAM,OAAO,YAAY;AAAA,MACvB,KAAK;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,iBAAiB;AAAA,IACnB,CAAC;AAAA,EACH;AACF;AAEA,SAAS,SAAS,QAAyC;AACzD,MAAI,OAAO,WAAW,SAAU,QAAO;AACvC,SAAO,CAAC,OAAO,QAAQ,OAAO,QAAQ,OAAO,MAAM,EAChD,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,EAChF,KAAK,IAAI;AACd;AAEA,SAAS,WAAW,QAAgD;AAClE,SAAO,OAAO,WAAW,YAAY,OAAO,OAAO,aAAa,WAAW,OAAO,OAAO;AAC3F;AAEA,SAAS,4BACP,UACA,QACoC;AACpC,MAAI,aAAa,GAAI,QAAO;AAC5B,MAAI,aAAa,GAAI,QAAO;AAC5B,MAAI,aAAa,MAAM,8BAA8B,UAAU,MAAM,GAAG;AACtE,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,8BAA8B,UAAkB,QAAyB;AAChF,MAAI,aAAa,IAAK,QAAO;AAC7B,SAAO,mHAAmH;AAAA,IACxH;AAAA,EACF;AACF;AAEA,SAAS,cAAc,QAAwB;AAC7C,MAAI,0BAA0B,KAAK,MAAM,EAAG,QAAO;AACnD,MAAI,oCAAoC,KAAK,MAAM,EAAG,QAAO;AAC7D,MAAI,gCAAgC,KAAK,MAAM,KAAK,8BAA8B,IAAI,MAAM,GAAG;AAC7F,WAAO;AAAA,EACT;AACA,MAAI,gDAAgD,KAAK,MAAM,EAAG,QAAO;AACzE,SAAO;AACT;AAEA,SAAS,YAAY,OAAuB;AAC1C,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,OAAQ;AAC/D,UAAM,IAAI,WAAW,oCAAoC;AAAA,EAC3D;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAAuB;AAC7C,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,KAAK,KAAQ;AACpE,UAAM,IAAI,WAAW,uCAAuC;AAAA,EAC9D;AACA,SAAO;AACT;AAEA,SAAS,aAAa,OAAe,OAAuB;AAC1D,MAAI,CAAC,SAAS,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU,WAAW,KAAK,GAAG;AAClE,UAAM,IAAI,MAAM,GAAG,KAAK,mBAAmB;AAAA,EAC7C;AACA,SAAO,UAAU,UAAU,KAAK;AAClC;AAEA,SAAS,iBAAiB,QAAqC;AAC7D,MAAI,OAAO,SAAS,GAAI,OAAM,IAAI,MAAM,qCAAqC;AAC7E,SAAO,OAAO,IAAI,CAAC,UAAU;AAC3B,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QAAI,IAAI,WAAW,UAAU,IAAI,aAAa,OAAO,IAAI,UAAU,IAAI,MAAM;AAC3E,YAAM,IAAI,MAAM,sDAAsD;AAAA,IACxE;AACA,WAAO,IAAI;AAAA,EACb,CAAC;AACH;AAEA,SAASA,YAAW,OAAuB;AACzC,SAAO,IAAI,MAAM,WAAW,KAAK,OAAO,CAAC;AAC3C;;;ACpOA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,cAAAC,aAAY,cAAAC,mBAAkB;AACvC,SAAS,SAASC,kBAAiB;AACnC,SAAS,iCAA4D;AACrE;AAAA,EACE;AAAA,EACA;AAAA,EACA,wBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OA+BK;;;AC3EA,IAAM,8BAA8B,MAAM;AACjD,IAAM,mBAAmB,KAAK;AAQ9B,IAAMC,UAAS;AAMf,IAAM,wBAAwB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,wDAAwDA,OAAM;AAAA,EAC9D;AAAA,EACA;AACF,EAAE,KAAK,GAAG;AAMH,SAAS,wBAAwB,OAQ8B;AACpE,QAAMC,SAAQ,CAAC,UAA0B;AACvC,QAAI,YAAY,KAAK,KAAK,EAAG,OAAM,IAAI,MAAM,kCAAkC;AAC/E,WAAO,IAAI,MAAM,WAAW,MAAM,MAAM,EAAE,WAAW,KAAK,KAAK,CAAC;AAAA,EAClE;AACA,QAAM,UAAU,KAAK,IAAI,GAAG,KAAK,KAAK,MAAM,YAAY,GAAK,CAAC;AAC9D,QAAM,SAASD;AACf,QAAM,SAAS;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,qBAAqB,KAAK,IAAI,SAAS,EAAE,CAAC;AAAA,IAC1C,cAAc,OAAO;AAAA,IACrB,kBAAkB,MAAM,QAAQ;AAAA,IAChC,aAAaC,OAAM,MAAM,MAAM,CAAC;AAAA,IAChC,SAASA,OAAM,MAAM,GAAG,CAAC;AAAA,IACzB,YAAYA,OAAM,yBAAyB,MAAM,KAAK,EAAE,CAAC;AAAA,IACzD,GAAI,MAAM,SAAS,SACf,CAAC,IACD,CAAC,6CAA6C,iBAAiBA,OAAM,MAAM,IAAI,CAAC,EAAE;AAAA,IACtF;AAAA,EACF,EAAE,KAAK,IAAI;AACX,QAAM,QAAQ,OAAO,KAAK,MAAM;AAChC,MAAI,MAAM,aAAa,6BAA6B;AAClD,UAAM,IAAI,WAAW,uCAAuC;AAAA,EAC9D;AACA,MAAI,MAAM,SAAS,WAAW;AAC5B,WAAO,EAAE,KAAK,uBAAuB,OAAO,cAAc,OAAO,OAAO;AAAA,EAC1E;AACA,SAAO;AAAA,IACL,KAAK,8DAA8D,MAAM;AAAA,IACzE,OAAO;AAAA,IACP;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,8BACd,QACA,QACA,UACoE;AACpE,QAAM,eAAe,WAAW,mBAAmB,OAAO,SAAS;AAGnE,MAAI,OAAO,SAAS,KAAK,KAAK,eAAe,CAAC,IAAI,IAAI,OAAO,GAAG;AAC9D,UAAM,IAAI,WAAW,4CAA4C;AAAA,EACnE;AACA,QAAM,UAAU,OAAO,QAAQ,YAAY,EAAE;AAC7C,MAAI,QAAQ,SAAS,MAAM,KAAK,CAAC,0BAA0B,KAAK,OAAO,GAAG;AACxE,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AACA,QAAM,QAAQ,OAAO,KAAK,SAAS,QAAQ;AAC3C,QAAM,UAAU,OAAO,KAAK;AAAA,EAAK,MAAM,EAAE;AACzC,QAAM,MAAM,MAAM,YAAY,OAAO;AACrC,MAAI,MAAM,EAAG,OAAM,IAAI,MAAM,mCAAmC;AAChE,QAAM,OAAO,MAAM,SAAS,MAAM,QAAQ,MAAM,EAAE,SAAS,OAAO;AAClE,MAAI,CAAC,aAAa,KAAK,IAAI,KAAK,SAAS,KAAK;AAC5C,UAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AACA,MAAI,SAAS;AACb,SAAO,SAAS,KAAK;AACnB,UAAM,YAAY,MAAM,QAAQ,YAAY,MAAM;AAClD,QAAI,YAAY,UAAU,YAAY,IAAI,OAAO,YAAY,IAAI,kBAAkB;AACjF,YAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AACA,UAAM,QAAQ,MAAM,SAAS,QAAQ,SAAS,EAAE,SAAS,QAAQ,EAAE,MAAM,MAAM;AAC/E,UAAM,QAAQ,qCAAqC,KAAK,MAAM,MAAM,KAAK,EAAE;AAC3E,QAAI,CAAC,MAAO,OAAM,IAAI,MAAM,uCAAuC;AACnE,UAAMC,UAAS,OAAO,MAAM,CAAC,CAAC;AAC9B,aAAS,YAAY;AACrB,QAAIA,WAAU,OAAOA,UAAS,OAAOA,YAAW,IAAK;AACrD,QAAIA,UAAS,OAAOA,UAAS,IAAK,OAAM,IAAI,MAAM,uCAAuC;AACzF,UAAM,UAAU,oBAAI,IAAoB;AACxC,eAAW,QAAQ,OAAO;AACxB,YAAM,YAAY,KAAK,QAAQ,GAAG;AAClC,UAAI,aAAa,EAAG,OAAM,IAAI,MAAM,uCAAuC;AAC3E,cAAQ,IAAI,KAAK,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,YAAY,GAAG,KAAK,MAAM,YAAY,CAAC,EAAE,KAAK,CAAC;AAAA,IAC7F;AACA,UAAM,OAAO,MAAM,SAAS,QAAQ,GAAG;AACvC,QAAI,KAAK,aAAa;AACpB,YAAM,IAAI,WAAW,4CAA4C;AACnE,WAAO,EAAE,QAAAA,SAAQ,SAAS,KAAK;AAAA,EACjC;AACA,QAAM,IAAI,MAAM,mCAAmC;AACrD;;;ADvCA,IAAM,cAAc;AACpB,IAAM,uCAAuC;AAC7C,IAAM,sCAAsC;AACrC,IAAM,mCAAmC;AAChD,IAAM,aAAa;AACnB,IAAM,gBAAgB;AACtB,IAAM,yBAAyB,KAAK;AACpC,IAAM,oCAAoC,KAAK;AAC/C,IAAM,2BAA2B,MAAM;AACvC,IAAM,iBAAiB;AAOvB,IAAM,wBAAwB,oBAAI,IAAoB;AA+ItD,SAAS,2BAA2B,SAAiD;AACnF,MAAI,CAAC,QAAQ,qBAAsB,QAAO;AAG1C,SAAO,QAAQ,mBAAmB,MAAM,YAAY,MAAM;AAC5D;AAoKO,IAAM,gCAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,uCAAuC;AAAA,EAClD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAuDO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EAC7C,OAAO;AAAA,EACP,YAAY;AACvB;AAEO,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAC5C,OAAO;AAAA,EACP,YAAY;AACvB;AAEO,IAAM,qCAAN,cAAiD,4BAA4B;AAAA,EAClF,YAAqB,QAA6C;AAChE,UAAM,oDAAoD;AADvC;AAAA,EAErB;AACF;AAEO,IAAM,6BAAN,cAAyC,MAAM;AAAA,EAIpD,YACWC,SACA,OACT;AACA,UAAM,MAAM,OAAO;AAHV,kBAAAA;AACA;AAGT,SAAK,YAAY,MAAM;AAAA,EACzB;AAAA,EATS,OAAO;AAAA,EACP;AASX;AAEO,IAAM,iCAAN,cAA6C,MAAM;AAAA,EAC/C,OAAO;AAClB;AAEA,SAAS,oCAAoC,SAA6C;AACxF,SAAO,IAAI,2BAA2B,KAAK;AAAA,IACzC,MAAM;AAAA,IACN,SAAS,uCAAuC,OAAO;AAAA,IACvD,WAAW;AAAA,EACb,CAAC;AACH;AAGA,eAAsB,8BACpB,SACA,OAC8C;AAC9C,sCAAoC,OAAO;AAC3C,QAAM,aAAa,aAAa,MAAM,YAAY,gCAAgC;AAClF,MAAI,QAAQ,sBAAsB;AAChC,QAAI,CAAC,MAAM,iBAAiB;AAC1B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,UAAU,MAAM,QAAQ,qBAAqB;AAAA,MACjD,SAAS,MAAM,gBAAgB;AAAA,MAC/B,iBAAiB,MAAM,gBAAgB;AAAA,MACvC;AAAA,MACA,gBAAgB,CAAC,GAAI,MAAM,kBAAkB,CAAC,CAAE;AAAA,IAClD,CAAC;AACD,UAAM,OAAOC,aAAY,QAAQ,IAAI;AACrC,0BAAsB,IAAI,oBAAoB,MAAM,eAAe,GAAG,IAAI;AAC1E,WAAO;AAAA,MACL,QAAQ,IAAI,qBAAqB,SAAS;AAAA,QACxC;AAAA,QACA;AAAA,QACA,iBAAiB,MAAM;AAAA,QACvB,GAAI,MAAM,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,MAAM,UAAU;AAAA,MACxE,CAAC;AAAA,MACD,QAAQ,EAAE,MAAM,QAAQ,SAAS,QAAQ,iBAAiB,GAAG;AAAA,IAC/D;AAAA,EACF;AACA,QAAM,iBAAiB;AAAA,IACrB,MAAM,kBAAkB;AAAA,IACxB;AAAA,EACF;AACA,QAAM,qBAAqB,GAAG,cAAc,QAAQC,YAAW,CAAC;AAChE,QAAM,SAAS,eAAe,MAAM,GAAG,eAAe,YAAY,GAAG,CAAC,KAAK;AAC3E,MAAI;AACF,UAAM;AAAA,MACJ;AAAA,MACA,oCAAoCC,YAAW,MAAM,CAAC,oBAAoBA,YAAW,UAAU,CAAC;AAAA,MAChG,MAAM;AAAA,IACR;AACA,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,SAAS,GAAG,UAAU;AAAA;AAAA,QACtB,eAAe;AAAA,MACjB;AAAA,MACA,MAAM;AAAA,IACR;AACA,UAAM;AAAA,MACJ;AAAA,MACA,iBAAiBA,YAAW,kBAAkB,CAAC,cAAcA,YAAW,kBAAkB,CAAC,IAAIA,YAAW,cAAc,CAAC,oBAAoBA,YAAW,UAAU,CAAC;AAAA,MACnK,MAAM;AAAA,IACR;AACA,UAAM,SAAS,MAAM,2BAA2B,SAAS;AAAA,MACvD;AAAA,MACA,GAAI,MAAM,iBAAiB,EAAE,gBAAgB,MAAM,eAAe,IAAI,CAAC;AAAA,MACvE,GAAI,MAAM,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;AAAA,MACvD,GAAI,MAAM,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,MAAM,UAAU;AAAA,IACxE,CAAC;AACD,UAAM,SAAS,IAAI,qBAAqB,SAAS;AAAA,MAC/C;AAAA,MACA,MAAM,OAAO;AAAA,MACb,GAAI,MAAM,kBAAkB,EAAE,iBAAiB,MAAM,gBAAgB,IAAI,CAAC;AAAA,MAC1E,GAAI,MAAM,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,MAAM,UAAU;AAAA,IACxE,CAAC;AACD,QAAI,MAAM,kBAAkB,MAAM,eAAe,SAAS,GAAG;AAC3D,YAAM,OAAO,kBAAkB,MAAM,cAAc;AAAA,IACrD;AACA,WAAO,EAAE,QAAQ,OAAO;AAAA,EAC1B,UAAE;AACA,UAAM,cAAc,SAAS,YAAYA,YAAW,kBAAkB,CAAC,EAAE;AACzE,UAAM,QAAQ,sBAAsB,EAAE,MAAM,MAAM,MAAS;AAAA,EAC7D;AACF;AAEO,IAAM,uBAAN,MAA2B;AAAA,EACvB;AAAA,EACQ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YACE,SACA,SAMA;AACA,mCAA+B,OAAO;AACtC,SAAK,UAAU;AACf,SAAK,aAAa,aAAa,QAAQ,YAAY,gCAAgC;AACnF,SAAK,OAAOF,aAAY,QAAQ,QAAQG,qBAAoB;AAC5D,SAAK,YAAYC,gBAAe,QAAQ,aAAa,GAAM;AAC3D,SAAK,kBAAkB,QAAQ;AAAA,EACjC;AAAA,EAEA,MAAM,kBAAkB,SAAwD;AAC9E,QAAI,QAAQ,WAAW,KAAK,QAAQ,SAAS,IAAI;AAC/C,YAAM,IAAI,WAAW,gDAAgD;AAAA,IACvE;AACA,UAAM,aAAa,QAAQ,IAAI,eAAe;AAC9C,UAAM,OAAO,MAAM,KAAK,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,OAAO,KAAK;AAAA,MACZ,MAAM,EAAE,SAAS,WAAW;AAAA,IAC9B,CAAC;AACD,QAAI,CAACC,UAAS,IAAI,KAAK,CAAC,MAAM,QAAQ,KAAK,OAAO,GAAG;AACnD,YAAM,IAAI,4BAA4B,+CAA+C;AAAA,IACvF;AACA,WAAO,KAAK,QAAQ,IAAI,CAAC,WAAW,gBAAgB,MAAM,CAAC;AAAA,EAC7D;AAAA,EAEA,MAAM,cAAc,OAA6E;AAC/F,UAAM,YAAY,eAAe,KAAK;AACtC,QACE,MAAM,oCAAoC,WACzC,MAAM,oCAAoC,QACzC,MAAM,WACN,MAAM,eAAe,SACvB;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,UAAU,MAAM,UAAU,2BAA2B,MAAM,OAAO,IAAI;AAC5E,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,KAAK,YAAY;AAAA,QAC5B,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO,KAAK;AAAA,QACZ,MAAM;AAAA,UACJ,GAAG;AAAA,UACH,iBAAiB,oBAAoB,MAAM,iBAAiB,kBAAkB;AAAA,UAC9E,cAAc,aAAa,MAAM,cAAc,uBAAuB;AAAA,UACtE,WAAW,aAAa,MAAM,WAAW,oBAAoB;AAAA,UAC7D,QAAQ,MAAM;AAAA,UACd,GAAI,MAAM,kCACN,EAAE,iCAAiC,KAAK,IACxC,CAAC;AAAA,UACL,GAAI,MAAM,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,WAAW,MAAM,UAAU,EAAE;AAAA,UACrF,GAAI,MAAM,YAAY,EAAE,WAAW,0BAA0B,MAAM,SAAS,EAAE,IAAI,CAAC;AAAA,UACnF,GAAI,MAAM,iBACN,EAAE,gBAAgB,uBAAuB,MAAM,cAAc,EAAE,IAC/D,CAAC;AAAA,UACL,GAAI,MAAM,eACN,EAAE,cAAc,6BAA6B,MAAM,YAAY,EAAE,IACjE,CAAC;AAAA,UACL,GAAI,UAAU,EAAE,SAAS,QAAQ,KAAK,IAAI,CAAC;AAAA,QAC7C;AAAA,QACA,GAAI,UAAU,EAAE,WAAW,kCAAkC,IAAI,CAAC;AAAA,MACpE,CAAC;AAAA,IACH,UAAE;AACA,eAAS,QAAQ,KAAK,CAAC;AACvB,eAAS,IAAI,KAAK,CAAC;AAAA,IACrB;AACA,QAAI,CAACA,UAAS,IAAI,GAAG;AACnB,YAAM,IAAI,4BAA4B,oDAAoD;AAAA,IAC5F;AACA,UAAM,oBAAoB,eAAe,IAAI;AAC7C,QACE,kBAAkB,qBAAqB,UAAU,oBACjD,kBAAkB,yBAAyB,UAAU,sBACrD;AACA,YAAM,IAAI,4BAA4B,qDAAqD;AAAA,IAC7F;AACA,WAAO;AAAA,MACL,GAAG;AAAA,MACH,aAAa,mBAAmB,MAAM,KAAK,WAAW;AAAA,MACtD,GAAG,gBAAgB,KAAK,SAAS,iBAAiB;AAAA,IACpD;AAAA,EACF;AAAA,EAEA,MAAM,sBACJ,OACmC;AACnC,UAAM,YAAY,uBAAuB,KAAK;AAC9C,UAAM,OAAO,MAAM,KAAK,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,OAAO,KAAK;AAAA,MACZ,MAAM;AAAA,QACJ,GAAG;AAAA,QACH,iBAAiB,oBAAoB,MAAM,iBAAiB,kBAAkB;AAAA,QAC9E,cAAc,aAAa,MAAM,cAAc,wBAAwB;AAAA,QACvE,WAAW,aAAa,MAAM,WAAW,qBAAqB;AAAA,MAChE;AAAA,IACF,CAAC;AACD,QAAI,CAACA,UAAS,IAAI,KAAK,CAAC,MAAM,QAAQ,KAAK,OAAO,GAAG;AACnD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAW,uBAAuB,IAAI;AAC5C,QACE,SAAS,sBAAsB,UAAU,qBACzC,SAAS,yBAAyB,UAAU,sBAC5C;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAW,KAAK;AACtB,QAAI,aAAa,WAAW,aAAa,WAAW,aAAa,WAAW;AAC1E,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL,GAAG;AAAA,MACH;AAAA,MACA,SAAS,gBAAgB,KAAK,SAAS,kBAAkB;AAAA,MACzD,QAAQ,gBAAgB,KAAK,QAAQ,kBAAkB;AAAA,MACvD,WAAW,gBAAgB,KAAK,WAAW,qBAAqB;AAAA,MAChE,cAAc,4BAA4B,MAAM,KAAK,YAAY;AAAA,MACjE,SAAS,KAAK,QAAQ,IAAI,CAAC,WAAW,eAAe,MAAM,MAAM,CAAC;AAAA,IACpE;AAAA,EACF;AAAA,EAEA,MAAM,WACJ,WACA,SAKe;AACf,UAAMC,WAAU,eAAe,SAAS;AACxC,UAAM,OAAO,MAAM,KAAK,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,MAAM,wBAAwBA,SAAQ,gBAAgB;AAAA,MACtD,OAAO,KAAK;AAAA,MACZ,MAAM;AAAA,QACJ,sBAAsBA,SAAQ;AAAA,QAC9B,aAAa,QAAQ;AAAA;AAAA,QAErB,GAAI,QAAQ,wBAAwB,EAAE,uBAAuB,KAAK,IAAI,CAAC;AAAA,QACvE,GAAI,QAAQ,4BAA4B,EAAE,2BAA2B,KAAK,IAAI,CAAC;AAAA,MACjF;AAAA,IACF,CAAC;AACD,QAAI,CAACD,UAAS,IAAI,KAAK,KAAK,UAAU,MAAM;AAC1C,YAAM,IAAI,4BAA4B,mDAAmD;AAAA,IAC3F;AAAA,EACF;AAAA,EAEA,MAAM,mBACJ,WACA,SACe;AACf,UAAMC,WAAU,uBAAuB,SAAS;AAChD,UAAM,OAAO,MAAM,KAAK,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,MAAM,yBAAyBA,SAAQ,iBAAiB;AAAA,MACxD,OAAO,KAAK;AAAA,MACZ,MAAM;AAAA,QACJ,sBAAsBA,SAAQ;AAAA,QAC9B,aAAa,QAAQ;AAAA,MACvB;AAAA,IACF,CAAC;AACD,QAAI,CAACD,UAAS,IAAI,KAAK,KAAK,UAAU,MAAM;AAC1C,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBACJ,WACA,OAC2B;AAC3B,UAAMC,WAAU,eAAe,SAAS;AACxC,UAAM,UAAU,YAAY,MAAM,SAAS,eAAe;AAC1D,UAAM,YAAY,UAAU,MAAM,WAAW,mBAAmB;AAChE,UAAM,OAAO,MAAM,KAAK,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,MAAM,wBAAwBA,SAAQ,gBAAgB;AAAA,MACtD,OAAO,KAAK;AAAA,MACZ,MAAM;AAAA,QACJ;AAAA,QACA,sBAAsBA,SAAQ;AAAA,QAC9B,OAAO,aAAa,MAAM,OAAO,kBAAkB;AAAA,QACnD;AAAA,MACF;AAAA,IACF,CAAC;AACD,QAAI,CAACD,UAAS,IAAI,KAAK,KAAK,YAAY,WAAW,KAAK,cAAc,WAAW;AAC/E,YAAM,IAAI,4BAA4B,kDAAkD;AAAA,IAC1F;AACA,QAAI,KAAK,uBAAuB,UAAa,KAAK,uBAAuB,MAAM;AAC7E,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,KAAK,6BAA6B,UAAa,KAAK,6BAA6B,MAAM;AACzF,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,GAAI,KAAK,uBAAuB,OAAO,EAAE,oBAAoB,KAAK,IAAI,CAAC;AAAA,MACvE,GAAI,KAAK,6BAA6B,OAAO,EAAE,0BAA0B,KAAK,IAAI,CAAC;AAAA,IACrF;AAAA,EACF;AAAA,EAEA,MAAM,wBACJ,WACA,OAM4B;AAC5B,UAAMC,WAAU,uBAAuB,SAAS;AAChD,UAAM,UAAU,YAAY,MAAM,SAAS,wBAAwB;AACnE,UAAM,YAAY,UAAU,MAAM,WAAW,4BAA4B;AACzE,UAAM,OAAO,MAAM,KAAK,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,MAAM,yBAAyBA,SAAQ,iBAAiB;AAAA,MACxD,OAAO,KAAK;AAAA,MACZ,MAAM;AAAA,QACJ;AAAA,QACA,sBAAsBA,SAAQ;AAAA,QAC9B,OAAO,aAAa,MAAM,OAAO,2BAA2B;AAAA,QAC5D;AAAA,QACA,GAAI,MAAM,WACN;AAAA,UACE,UAAU,gBAAgB,MAAM,SAAS,UAAU,eAAe;AAAA,UAClE,kBAAkB,kBAAkB,MAAM,SAAS,gBAAgB;AAAA,UACnE,cAAc,MAAM,SAAS;AAAA,QAC/B,IACA,CAAC;AAAA,MACP;AAAA,IACF,CAAC;AACD,QAAI,CAACD,UAAS,IAAI,KAAK,KAAK,YAAY,WAAW,KAAK,cAAc,WAAW;AAC/E,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,KAAK,mBAAmB,UAAa,OAAO,KAAK,mBAAmB,WAAW;AACjF,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,MAAM,aACL,KAAK,mBAAmB,QACvB,KAAK,aAAa,MAAM,SAAS,YACjC,KAAK,qBAAqB,MAAM,SAAS,oBACzC,KAAK,iBAAiB,MAAM,SAAS,eACvC;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,SAAS,WAAW,gBAAgB,KAAK,mBAAmB,KAAK;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aACJ,OAC8C;AAC9C,UAAM,YAAY,eAAe,KAAK;AACtC,UAAM,cAAc,YAAY,MAAM,aAAa,4BAA4B;AAC/E,UAAM,YAAY,sBAAsB,MAAM,SAAS;AACvD,UAAM,UAAU,WAAW,MAAM,SAAS,IAAI,wBAAwB;AACtE,UAAM,MAAM,aAAa,MAAM,KAAK,GAAG,KAAK,MAAM,+BAA+B;AACjF,UAAM,SAAS,wBAAwB,MAAM,MAAM;AACnD,UAAM,OAAO,MAAM,KAAK,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,MAAM,wBAAwB,UAAU,gBAAgB;AAAA,MACxD,OAAO,KAAK;AAAA,MACZ,MAAM;AAAA,QACJ;AAAA,QACA,sBAAsB,UAAU;AAAA,QAChC;AAAA,QACA,cAAc,MAAM;AAAA,QACpB,eAAe,OAAO,KAAK,OAAO,EAAE,SAAS,QAAQ;AAAA,QACrD,WAAW,OAAO,KAAK,GAAG,EAAE,SAAS,QAAQ;AAAA,QAC7C;AAAA,MACF;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,UAAM,UAAU,yBAAyB,IAAI;AAC7C,QACE,QAAQ,gBAAgB,eACxB,QAAQ,qBAAqB,UAAU,oBACvC,QAAQ,yBAAyB,UAAU,wBAC3C,QAAQ,cAAc,WACtB;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,mBACJ,OACgD;AAChD,UAAM,YAAY,eAAe,KAAK;AACtC,UAAM,OAAO,MAAM,KAAK,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,MAAM,wBAAwB,UAAU,gBAAgB;AAAA,MACxD,OAAO,KAAK;AAAA,MACZ,MAAM,yBAAyB,WAAW,KAAK;AAAA,MAC/C,WAAW;AAAA,IACb,CAAC;AACD,WAAO,2BAA2B,MAAM,SAAS;AAAA,EACnD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,iBACJ,OAC8C;AAC9C,UAAM,YAAY,eAAe,KAAK;AACtC,UAAM,cAAc,YAAY,MAAM,aAAa,0BAA0B;AAC7E,UAAM,OAAO,MAAM,KAAK,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,MAAM,wBAAwB,UAAU,gBAAgB;AAAA,MACxD,OAAO,KAAK;AAAA,MACZ,MAAM;AAAA,QACJ,GAAG,yBAAyB,WAAW,KAAK;AAAA,QAC5C;AAAA,QACA,gBAAgBE,QAAO,MAAM,gBAAgB,8BAA8B;AAAA,MAC7E;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,UAAM,WAAW,yBAAyB,MAAM,WAAW,SAAS;AACpE,QAAI,SAAS,gBAAgB,aAAa;AACxC,YAAM,IAAI,4BAA4B,8CAA8C;AAAA,IACtF;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,oBACJ,WACA,aACsF;AACtF,UAAMD,WAAU,eAAe,SAAS;AACxC,UAAM,KAAK,YAAY,aAAa,0BAA0B;AAC9D,UAAM,OAAO,MAAM,KAAK,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,MAAM,wBAAwBA,SAAQ,gBAAgB,2BAA2B,EAAE;AAAA,MACnF,OAAO,KAAK;AAAA,IACd,CAAC;AACD,QAAI,CAACD,UAAS,IAAI,KAAK,OAAO,KAAK,aAAa,WAAW;AACzD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,WACJ,KAAK,aAAa,OAAO,OAAO,yBAAyB,KAAK,UAAUC,UAAS,UAAU;AAC7F,QAAI,YAAY,SAAS,gBAAgB,IAAI;AAC3C,YAAM,IAAI,4BAA4B,8CAA8C;AAAA,IACtF;AACA,WAAO,EAAE,UAAU,KAAK,UAAU,SAAS;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,0BACJ,OACsF;AACtF,UAAM,YAAY,eAAe,KAAK;AACtC,UAAM,KAAK,YAAY,MAAM,aAAa,0BAA0B;AACpE,UAAM,OAAO,MAAM,KAAK,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,MAAM,wBAAwB,UAAU,gBAAgB,2BAA2B,EAAE;AAAA,MACrF,OAAO,KAAK;AAAA,MACZ,MAAM,yBAAyB,WAAW,KAAK;AAAA,MAC/C,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAACD,UAAS,IAAI,KAAK,OAAO,KAAK,aAAa,WAAW;AACzD,YAAM,IAAI,4BAA4B,qDAAqD;AAAA,IAC7F;AACA,UAAM,WACJ,KAAK,aAAa,OACd,OACA,yBAAyB,KAAK,UAAU,WAAW,UAAU;AACnE,QAAI,YAAY,SAAS,gBAAgB,IAAI;AAC3C,YAAM,IAAI,4BAA4B,8CAA8C;AAAA,IACtF;AACA,WAAO,EAAE,UAAU,KAAK,UAAU,SAAS;AAAA,EAC7C;AAAA,EAEA,cAAc,OAIkB;AAC9B,WAAO,IAAI,4BAA4B,MAAM,KAAK;AAAA,EACpD;AAAA,EAEA,sBAAsB,OAIW;AAC/B,WAAO,IAAI,6BAA6B,MAAM,KAAK;AAAA,EACrD;AAAA,EAEA,MAAM,eACJ,WACA,UACA,SAMI,CAAC,GACY;AACjB,UAAMC,WAAU,eAAe,SAAS;AACxC,QAAI,CAAC,KAAK,QAAQ,oBAAoB;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAW,MAAM,KAAK,QAAQ,mBAAmB,KAAK,IAAI;AAChE,UAAM,OAAO;AAAA,MACX,SAAS;AAAA,MACT,wBAAwBA,SAAQ,gBAAgB,YAAY,mBAAmB,gBAAgB,UAAU,WAAW,CAAC,CAAC;AAAA,IACxH;AACA,WAAO,0BAA0B,eAAe,EAAE,GAAG,UAAU,KAAK,CAAC,GAAG,MAAM;AAAA,EAChF;AAAA,EAEA,MAAM,uBACJ,WACA,UACA,SAMI,CAAC,GACY;AACjB,UAAMA,WAAU,uBAAuB,SAAS;AAChD,QAAI,CAAC,KAAK,QAAQ,oBAAoB;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAW,MAAM,KAAK,QAAQ,mBAAmB,KAAK,IAAI;AAChE,UAAM,OAAO;AAAA,MACX,SAAS;AAAA,MACT,yBAAyBA,SAAQ,iBAAiB,YAAY,mBAAmB,gBAAgB,UAAU,oBAAoB,CAAC,CAAC;AAAA,IACnI;AACA,WAAO,0BAA0B,eAAe,EAAE,GAAG,UAAU,KAAK,CAAC,GAAG,MAAM;AAAA,EAChF;AAAA,EAEA,MAAM,qBACJ,WACA,UACiB;AACjB,UAAMA,WAAU,uBAAuB,SAAS;AAChD,QAAI,CAAC,KAAK,QAAQ,oBAAoB;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAW,MAAM,KAAK,QAAQ,mBAAmB,KAAK,IAAI;AAChE,UAAM,OAAO;AAAA,MACX,SAAS;AAAA,MACT,yBAAyBA,SAAQ,iBAAiB,YAAY,mBAAmB,gBAAgB,UAAU,oBAAoB,CAAC,CAAC;AAAA,IACnI;AACA,WAAO,eAAe,EAAE,GAAG,UAAU,KAAK,CAAC;AAAA,EAC7C;AAAA;AAAA;AAAA,EAIA,MAAM,uBAAuB,OAenB;AACR,QAAI,CAAC,KAAK,QAAQ,kBAAmB,QAAO;AAC5C,QAAI,CAAC,KAAK,iBAAiB;AACzB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,YAAY,eAAe,MAAM,SAAS;AAChD,UAAM,cAAc,KAAK,MAAM,MAAM,SAAS;AAC9C,QAAI,CAAC,OAAO,cAAc,WAAW,GAAG;AACtC,YAAM,IAAI,4BAA4B,sCAAsC;AAAA,IAC9E;AACA,UAAM,SAAS,MAAM,UAAU,CAAC;AAChC,WAAO,MAAM,KAAK,QAAQ,kBAAkB;AAAA,MAC1C,SAAS,KAAK,gBAAgB;AAAA,MAC9B,iBAAiB,KAAK,gBAAgB;AAAA,MACtC,kBAAkB,UAAU;AAAA,MAC5B,sBAAsB,UAAU;AAAA,MAChC,UAAU,gBAAgB,MAAM,UAAU,WAAW;AAAA,MACrD,WAAW,aAAa,MAAM,WAAW,oBAAoB;AAAA,MAC7D,aAAa,OAAO,WAAW;AAAA,MAC/B,QAAQ,OAAO,UAAU;AAAA,MACzB,SAAS,eAAe,OAAO,WAAW,IAAI,GAAG,KAAK,uBAAuB;AAAA,MAC7E,UAAU,eAAe,OAAO,YAAY,MAAO,GAAG,MAAO,qBAAqB;AAAA,MAClF,WAAW,eAAe,OAAO,aAAa,KAAK,GAAG,MAAO,sBAAsB;AAAA,MACnF,eAAe;AAAA,QACb,OAAO,iBAAiB;AAAA,QACxB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA,EAIA,MAAM,+BAA+B,OAe3B;AACR,QAAI,CAAC,KAAK,QAAQ,mBAAoB,QAAO;AAC7C,QAAI,CAAC,KAAK,iBAAiB;AACzB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,YAAY,uBAAuB,MAAM,SAAS;AACxD,UAAM,cAAc,KAAK,MAAM,MAAM,SAAS;AAC9C,QAAI,CAAC,OAAO,cAAc,WAAW,GAAG;AACtC,YAAM,IAAI,4BAA4B,uCAAuC;AAAA,IAC/E;AACA,UAAM,SAAS,MAAM,UAAU,CAAC;AAChC,WAAO,MAAM,KAAK,QAAQ,mBAAmB;AAAA,MAC3C,SAAS,KAAK,gBAAgB;AAAA,MAC9B,iBAAiB,KAAK,gBAAgB;AAAA,MACtC,mBAAmB,UAAU;AAAA,MAC7B,sBAAsB,UAAU;AAAA,MAChC,UAAU,gBAAgB,MAAM,UAAU,oBAAoB;AAAA,MAC9D,WAAW,aAAa,MAAM,WAAW,qBAAqB;AAAA,MAC9D,aAAa,OAAO,WAAW;AAAA,MAC/B,QAAQ,OAAO,UAAU;AAAA,MACzB,SAAS,eAAe,OAAO,WAAW,IAAI,GAAG,KAAK,wBAAwB;AAAA,MAC9E,UAAU,eAAe,OAAO,YAAY,MAAO,GAAG,MAAO,sBAAsB;AAAA,MACnF,WAAW,eAAe,OAAO,aAAa,MAAO,GAAG,MAAO,uBAAuB;AAAA,MACtF,eAAe;AAAA,QACb,OAAO,iBAAiB;AAAA,QACxB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,kBAAkB,OAMH;AACnB,WAAO,MAAM,KAAK,YAAY,KAAK;AAAA,EACrC;AAAA,EAEA,MAAM,uBAAuB,OAMK;AAChC,WAAQ,MAAM,KAAK,aAAa,EAAE,GAAG,OAAO,SAAS,WAAW,CAAC;AAAA,EACnE;AAAA,EAEA,MAAM,8BAA8B,OAMH;AAC/B,WAAQ,MAAM,KAAK,aAAa,EAAE,GAAG,OAAO,SAAS,UAAU,CAAC;AAAA,EAClE;AAAA,EAEA,MAAc,YACZ,OAOA,sBAAsB,MACJ;AAKlB,UAAM,mBAAmB,KAAK,QAAQ,+BAA+B;AACrE,QAAI,KAAK,QAAQ,sBAAsB,CAAC,KAAK,QAAQ,sBAAsB;AACzE,UAAI;AACF,cAAM,WAAW,MAAM,KAAK,QAAQ,mBAAmB,KAAK,IAAI;AAQhE,cAAM,mBAAmB,2BAA2B,QAAQ;AAC5D,cAAM,UAAU,QAAQ,KAAK,QAAQ,QAAQ,KAAK,QAAQ,WAAW;AACrE,YAAI,CAAC,qBAAqB,oBAAoB,CAAC,UAAU;AACvD,gBAAM,IAAI;AAAA,YACR,mBACI,oDACA;AAAA,UACN;AAAA,QACF;AACA,YAAI,kBAAkB;AACpB,cAAI;AACF,mBAAO,MAAM;AAAA,cACX;AAAA,cACA;AAAA,cACA,KAAK;AAAA,cACL,KAAK,QAAQ;AAAA,YACf;AAAA,UACF,SAAS,OAAO;AACd,gBACE,uBACA,CAAC,oBACD,MAAM,WAAW,SACjB,iBAAiB,8BACjB;AACA,qBAAO,MAAM,KAAK,YAAY,OAAO,KAAK;AAAA,YAC5C;AACA,kBAAM;AAAA,UACR;AAAA,QACF;AAAA,MACF,SAAS,OAAO;AACd,YACE,iBAAiB,8BACjB,iBAAiB,+BACjB,iBAAiB,gCACjB,iBAAiB,YACjB;AACA,gBAAM;AAAA,QACR;AACA,YAAI,oBAAqB,CAAC,KAAK,QAAQ,QAAQ,CAAC,KAAK,QAAQ,aAAc;AACzE,gBAAM,IAAI;AAAA,YACR,mBACI,uCACA;AAAA,YACJ,EAAE,OAAO,MAAM;AAAA,UACjB;AAAA,QACF;AAAA,MAIF;AAAA,IACF,WAAW,kBAAkB;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,KAAK,cAAc,OAAO,8BAA8B;AAC7E,QAAI,QAAQ;AACV,UAAI;AACJ,UAAI;AACF,eAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,OAAO,IAAI;AAAA,MACrE,SAAS,OAAO;AACd,cAAM,IAAI,4BAA4B,4CAA4C;AAAA,UAChF,OAAO;AAAA,QACT,CAAC;AAAA,MACH;AACA,aAAO,cAAc,MAAM,OAAO,MAAM;AAAA,IAC1C;AAEA,QACE,KAAK,QAAQ,kBACZ,MAAM,SAAS,UAAa,OAAO,WAAW,KAAK,UAAU,MAAM,IAAI,CAAC,KAAK,KAAK,OACnF;AACA,UAAI;AACF,cAAM,WAAW,MAAM,KAAK,cAAc,OAAO,8BAA8B;AAC/E,eAAO;AAAA,UACL,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,SAAS,IAAI;AAAA,UAC9D,SAAS;AAAA,QACX;AAAA,MACF,SAAS,OAAO;AACd,YACE,uBACA,MAAM,WAAW,SACjB,KAAK,mBACL,KAAK,QAAQ,wBACb,iBAAiB,8BACjB;AACA,gCAAsB,OAAO,oBAAoB,KAAK,eAAe,CAAC;AACtE,gBAAM,KAAK,eAAe;AAC1B,iBAAO,MAAM,KAAK,YAAY,OAAO,KAAK;AAAA,QAC5C;AACA,cAAM;AAAA,MACR,UAAE;AACA,cAAM,KAAK,QAAQ,sBAAsB,EAAE,MAAM,MAAM,MAAS;AAAA,MAClE;AAAA,IACF;AAEA,UAAM,iBAAiB,MAAM,KAAK,eAAe;AACjD,UAAM,YAAY,GAAG,WAAW,IAAIL,YAAW,CAAC;AAChD,UAAM,aAAa,GAAG,SAAS;AAC/B,UAAM,cAAc,GAAG,SAAS;AAChC,UAAM,eAAe,GAAG,SAAS;AACjC,UAAM,aAAa,GAAG,SAAS;AAC/B,UAAM,WAAW,GAAG,SAAS;AAC7B,UAAM,QAAQ,aAAa,MAAM,OAAO,0BAA0B;AAClE,UAAM,YAAYG,gBAAe,MAAM,aAAa,KAAK,SAAS;AAClE,UAAM,MAAM,mBAAmB,gBAAgB,MAAM,IAAI;AACzD,UAAM,OAAO,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,MAAM,IAAI;AAC7E,QAAI;AACF,YAAM;AAAA,QACJ,KAAK;AAAA,QACL,oCAAoCF,YAAW,SAAS,CAAC,oBAAoBA,YAAW,UAAU,CAAC;AAAA,QACnG;AAAA,MACF;AACA,UAAI,SAAS,QAAW;AACtB,YAAI,OAAO,WAAW,IAAI,IAAI,gCAAgC;AAC5D,gBAAM,IAAI,WAAW,8CAA8C;AAAA,QACrE;AACA,cAAM;AAAA,UACJ,KAAK;AAAA,UACL,EAAE,MAAM,aAAa,SAAS,MAAM,eAAe,MAAM;AAAA,UACzD;AAAA,QACF;AAAA,MACF;AACA,YAAM;AAAA,QACJ,KAAK;AAAA,QACL;AAAA,UACE,MAAM;AAAA,UACN,SAAS,WAAW;AAAA,YAClB,QAAQ,MAAM;AAAA,YACd;AAAA,YACA;AAAA,YACA;AAAA,YACA,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,YAAY;AAAA,YAC5C;AAAA,UACF,CAAC;AAAA,UACD,eAAe;AAAA,QACjB;AAAA,QACA;AAAA,MACF;AACA,YAAM;AAAA,QACJ,KAAK;AAAA,QACL,iBAAiBA,YAAW,UAAU,CAAC,GAAG,SAAS,SAAY,KAAK,IAAIA,YAAW,WAAW,CAAC,EAAE,SAASA,YAAW,UAAU,CAAC,6BAA6BA,YAAW,UAAU,CAAC,MAAMA,YAAW,UAAU,CAAC,8CAA8CA,YAAW,QAAQ,CAAC,oBAAoBA,YAAW,UAAU,CAAC;AAAA,QAC3T;AAAA,MACF;AACA,YAAM,WAAW;AAAA,QACf,MAAM,SAAS,KAAK,SAAS,UAAU,IAAI,SAAS;AAAA,QACpD;AAAA,MACF;AACA,UAAI,aAAa,GAAG;AAClB,cAAM,IAAI;AAAA,UACR,kDAAkD,QAAQ;AAAA,QAC5D;AAAA,MACF;AACA,YAAMH,UAAS,gBAAgB,MAAM,SAAS,KAAK,SAAS,YAAY,IAAI,SAAS,CAAC;AACtF,YAAM,eAAe,MAAM;AAAA,QACzB,KAAK;AAAA,QACL;AAAA,QACA,iCAAiC;AAAA,QACjC;AAAA,MACF;AACA,UAAI,OAAO,WAAW,YAAY,IAAI,gCAAgC;AACpE,cAAM,IAAI,4BAA4B,0CAA0C;AAAA,MAClF;AACA,aAAO,cAAc,cAAcA,OAAM;AAAA,IAC3C,SAAS,OAAO;AACd,UACE,iBAAiB,8BACjB,iBAAiB,+BACjB,iBAAiB,YACjB;AACA,cAAM;AAAA,MACR;AACA,UAAI,iBAAiB,8BAA8B;AACjD,YACE,uBACA,MAAM,WAAW,SACjB,KAAK,mBACL,KAAK,QAAQ,sBACb;AACA,gCAAsB,OAAO,oBAAoB,KAAK,eAAe,CAAC;AACtE,gBAAM,KAAK,eAAe;AAC1B,iBAAO,MAAM,KAAK,YAAY,OAAO,KAAK;AAAA,QAC5C;AACA,cAAM;AAAA,MACR;AACA,YAAM,IAAI,6BAA6B,+CAA+C;AAAA,QACpF,OAAO;AAAA,MACT,CAAC;AAAA,IACH,UAAE;AACA,YAAM,cAAc,KAAK,SAAS,aAAaG,YAAW,SAAS,CAAC,EAAE;AACtE,YAAM,KAAK,QAAQ,sBAAsB,EAAE,MAAM,MAAM,MAAS;AAAA,IAClE;AAAA,EACF;AAAA,EAEA,MAAc,aACZ,OACA,sBAAsB,MAC+B;AACrD,UAAM,mBAAmB,KAAK,QAAQ,+BAA+B;AACrE,QAAI,KAAK,QAAQ,sBAAsB,CAAC,KAAK,QAAQ,sBAAsB;AACzE,UAAI;AACF,cAAM,WAAW,MAAM,KAAK,QAAQ,mBAAmB,KAAK,IAAI;AAChE,cAAM,mBAAmB,2BAA2B,QAAQ;AAC5D,cAAM,UAAU,QAAQ,KAAK,QAAQ,QAAQ,KAAK,QAAQ,WAAW;AACrE,YAAI,CAAC,qBAAqB,oBAAoB,CAAC,UAAU;AACvD,gBAAM,IAAI;AAAA,YACR,mBACI,oDACA;AAAA,UACN;AAAA,QACF;AACA,YAAI,kBAAkB;AACpB,cAAI;AACF,mBAAO,MAAM,8BAA8B,UAAU,OAAO,KAAK,SAAS;AAAA,UAC5E,SAAS,OAAO;AACd,gBACE,uBACA,CAAC,oBACD,iBAAiB,8BACjB;AACA,qBAAO,MAAM,KAAK,aAAa,OAAO,KAAK;AAAA,YAC7C;AACA,kBAAM;AAAA,UACR;AAAA,QACF;AAAA,MACF,SAAS,OAAO;AACd,YACE,iBAAiB,8BACjB,iBAAiB,+BACjB,iBAAiB,gCACjB,iBAAiB,YACjB;AACA,gBAAM;AAAA,QACR;AACA,YAAI,oBAAqB,CAAC,KAAK,QAAQ,QAAQ,CAAC,KAAK,QAAQ,aAAc;AACzE,gBAAM,IAAI;AAAA,YACR,mBACI,uCACA;AAAA,YACJ,EAAE,OAAO,MAAM;AAAA,UACjB;AAAA,QACF;AAAA,MACF;AAAA,IACF,WAAW,kBAAkB;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,cAAc,MAAM,KAAK;AAAA,MAC7B;AAAA,MACA,MAAM,YAAY,YAAY,KAAK,OAAO,OAAO;AAAA,IACnD;AACA,QAAI,aAAa;AACf,UAAI,YAAY,SAAS,OAAO,YAAY,UAAU,KAAK;AACzD,sBAAc,IAAI,YAAY,EAAE,OAAO,YAAY,IAAI,GAAG,YAAY,MAAM;AAC5E,cAAM,IAAI,4BAA4B,8CAA8C;AAAA,MACtF;AACA,aAAO,qBAAqB,YAAY,MAAM,YAAY,SAAS,KAAK;AAAA,IAC1E;AAEA,QAAI,KAAK,QAAQ,eAAe;AAC9B,UAAI;AACF,cAAM,WAAW,MAAM,KAAK;AAAA,UAC1B;AAAA,UACA,MAAM,YAAY,YAAY,KAAK,OAAO,OAAO;AAAA,QACnD;AACA,YAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;AACnD,wBAAc,IAAI,YAAY,EAAE,OAAO,SAAS,IAAI,GAAG,SAAS,MAAM;AACtE,gBAAM,IAAI,4BAA4B,8CAA8C;AAAA,QACtF;AACA,eAAO,qBAAqB,SAAS,MAAM,SAAS,SAAS,KAAK;AAAA,MACpE,SAAS,OAAO;AACd,YACE,uBACA,KAAK,mBACL,KAAK,QAAQ,wBACb,iBAAiB,8BACjB;AACA,gCAAsB,OAAO,oBAAoB,KAAK,eAAe,CAAC;AACtE,gBAAM,KAAK,eAAe;AAC1B,iBAAO,MAAM,KAAK,aAAa,OAAO,KAAK;AAAA,QAC7C;AACA,cAAM;AAAA,MACR,UAAE;AACA,cAAM,KAAK,QAAQ,sBAAsB,EAAE,MAAM,MAAM,MAAS;AAAA,MAClE;AAAA,IACF;AAEA,UAAM,iBAAiB,MAAM,KAAK,eAAe;AACjD,UAAM,YAAY,GAAG,WAAW,IAAID,YAAW,CAAC;AAChD,UAAM,aAAa,GAAG,SAAS;AAC/B,UAAM,eAAe,GAAG,SAAS;AACjC,UAAM,sBAAsB,GAAG,SAAS;AACxC,UAAM,aAAa,GAAG,SAAS;AAC/B,UAAM,WAAW,GAAG,SAAS;AAC7B,UAAM,QAAQ,aAAa,MAAM,OAAO,0BAA0B;AAClE,UAAM,YAAYG,gBAAe,MAAM,aAAa,KAAK,SAAS;AAClE,UAAM,MAAM,mBAAmB,gBAAgB,MAAM,IAAI;AACzD,QAAI;AACF,YAAM;AAAA,QACJ,KAAK;AAAA,QACL,oCAAoCF,YAAW,SAAS,CAAC;AAAA,IAAmBA,YAAW,UAAU,CAAC;AAAA,QAClG;AAAA,MACF;AACA,YAAM;AAAA,QACJ,KAAK;AAAA,QACL;AAAA,UACE,MAAM;AAAA,UACN,SAAS,WAAW;AAAA,YAClB,QAAQ,MAAM;AAAA,YACd;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF,CAAC;AAAA,UACD,eAAe;AAAA,QACjB;AAAA,QACA;AAAA,MACF;AACA,YAAM;AAAA,QACJ,KAAK;AAAA,QACL,iBAAiBA,YAAW,UAAU,CAAC,SAASA,YAAW,UAAU,CAAC,6BAA6BA,YAAW,UAAU,CAAC,MAAMA,YAAW,UAAU,CAAC,8CAA8CA,YAAW,QAAQ,CAAC;AAAA,IAAmBA,YAAW,UAAU,CAAC;AAAA,QAChQ;AAAA,MACF;AACA,YAAM,WAAW;AAAA,QACf,MAAM,SAAS,KAAK,SAAS,UAAU,IAAI,SAAS;AAAA,QACpD;AAAA,MACF;AACA,UAAI,aAAa,GAAG;AAClB,cAAM,IAAI;AAAA,UACR,kDAAkD,QAAQ;AAAA,QAC5D;AAAA,MACF;AACA,YAAMH,UAAS,gBAAgB,MAAM,SAAS,KAAK,SAAS,YAAY,IAAI,SAAS,CAAC;AACtF,UAAIA,UAAS,OAAOA,WAAU,KAAK;AACjC,cAAM,eAAe,MAAM;AAAA,UACzB,KAAK;AAAA,UACL;AAAA,UACA,iCAAiC;AAAA,UACjC;AAAA,QACF;AACA,sBAAc,cAAcA,OAAM;AAClC,cAAM,IAAI,4BAA4B,8CAA8C;AAAA,MACtF;AACA,YAAM,UAAU;AAAA,QACd,MAAM,SAAS,KAAK,SAAS,qBAAqB,KAAK,MAAM,SAAS;AAAA,MACxE;AACA,YAAM,OAAO,MAAM;AAAA,QACjB,KAAK;AAAA,QACL;AAAA,QACA,MAAM,YAAY,YAAY,KAAK,OAAO,OAAO;AAAA,QACjD;AAAA,MACF;AACA,aAAO,qBAAqB,MAAM,SAAS,KAAK;AAAA,IAClD,SAAS,OAAO;AACd,UACE,iBAAiB,8BACjB,iBAAiB,+BACjB,iBAAiB,YACjB;AACA,cAAM;AAAA,MACR;AACA,UAAI,iBAAiB,8BAA8B;AACjD,YAAI,uBAAuB,KAAK,mBAAmB,KAAK,QAAQ,sBAAsB;AACpF,gCAAsB,OAAO,oBAAoB,KAAK,eAAe,CAAC;AACtE,gBAAM,KAAK,eAAe;AAC1B,iBAAO,MAAM,KAAK,aAAa,OAAO,KAAK;AAAA,QAC7C;AACA,cAAM;AAAA,MACR;AACA,YAAM,IAAI,6BAA6B,6CAA6C;AAAA,QAClF,OAAO;AAAA,MACT,CAAC;AAAA,IACH,UAAE;AACA,YAAM,cAAc,KAAK,SAAS,aAAaG,YAAW,SAAS,CAAC,EAAE;AACtE,YAAM,KAAK,QAAQ,sBAAsB,EAAE,MAAM,MAAM,MAAS;AAAA,IAClE;AAAA,EACF;AAAA,EAEA,MAAc,cACZ,OACA,UAC2D;AAC3D,UAAM,OAAO,MAAM,KAAK,eAAe;AACvC,UAAM,UAAU,wBAAwB;AAAA,MACtC,QAAQ,MAAM;AAAA,MACd,KAAK,mBAAmB,MAAM,MAAM,IAAI;AAAA,MACxC,OAAO,aAAa,MAAM,OAAO,0BAA0B;AAAA,MAC3D,GAAI,MAAM,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,MAAM,IAAI,EAAE;AAAA,MACvE,WAAWE,gBAAe,MAAM,aAAa,KAAK,SAAS;AAAA,MAC3D;AAAA,MACA,MAAM,KAAK,QAAQ,mBAAmB,KAAK;AAAA,IAC7C,CAAC;AACD,QAAI;AACF,YAAM,SAAS,MAAM,KAAK,QAAQ,cAAe;AAAA,QAC/C,KAAK,QAAQ;AAAA,QACb,OAAO,QAAQ;AAAA,QACf,OAAO,QAAQ;AAAA,QACf,OAAO;AAAA,QACP,SAAS,2BAA2B,KAAK,OAAO;AAAA,MAClD,CAAC;AACD,UAAI,OAAO,aAAa,KAAK,OAAO,WAAW,QAAW;AACxD,cAAM,IAAI,6BAA6B,mCAAmC;AAAA,MAC5E;AACA,aAAO,8BAA8B,OAAO,QAAQ,QAAQ,QAAQ,QAAQ;AAAA,IAC9E,SAAS,OAAO;AACd,UAAI,iBAAiB,cAAc,iBAAiB,6BAA8B,OAAM;AACxF,YAAM,IAAI,6BAA6B,+CAA+C;AAAA,QACpF,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAc,iBAAkC;AAC9C,QAAI,CAAC,KAAK,mBAAmB,CAAC,KAAK,QAAQ,qBAAsB,QAAO,KAAK;AAC7E,WAAO,MAAM,KAAK,qBAAqB,KAAK;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,cACZ,OACA,kBACA,QAAQ,MAC4E;AACpF,UAAM,YAAY,KAAK;AACvB,QAAI,CAAC,aAAa,CAAC,KAAK,QAAQ,sBAAsB,CAAC,KAAK,QAAQ,sBAAsB;AACxF,aAAO;AAAA,IACT;AACA,UAAM,SAAS,MAAM;AACrB,QAAI,WAAW,SAAS,WAAW,UAAU,WAAW,SAAS,WAAW,UAAU;AACpF,YAAM,IAAI,4BAA4B,8CAA8C;AAAA,IACtF;AAEA,uBAAmB,KAAK,MAAM,MAAM,IAAI;AACxC,UAAM,OACJ,MAAM,SAAS,SAAY,SAAY,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,MAAM,IAAI,CAAC;AAC5F,QAAI,SAAS,UAAa,KAAK,aAAa,gCAAgC;AAC1E,YAAM,IAAI,WAAW,8CAA8C;AAAA,IACrE;AACA,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,KAAK,QAAQ,mBAAmB;AAAA,QAC9C,SAAS,UAAU;AAAA,QACnB,iBAAiB,UAAU;AAAA,QAC3B;AAAA,QACA,MAAM,MAAM;AAAA,QACZ,aAAa,aAAa,MAAM,OAAO,0BAA0B;AAAA,QACjE,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,QACrC,WAAWA,gBAAe,MAAM,aAAa,KAAK,SAAS;AAAA,QAC3D;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,SAAS,WAAW,OAAO;AAC7B,cAAM,KAAK,qBAAqB,IAAI;AACpC,eAAO,MAAM,KAAK,cAAc,OAAO,kBAAkB,KAAK;AAAA,MAChE;AACA,YAAM,IAAI,6BAA6B,+CAA+C;AAAA,QACpF,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,QAAI,QAAQ,SAAS,cAAe,QAAO;AAC3C,QAAI,QAAQ,SAAS,qBAAqB;AACxC,UAAI,CAAC,MAAO,OAAM,IAAI,6BAA6B,mCAAmC;AACtF,YAAM,KAAK,qBAAqB,IAAI;AACpC,aAAO,MAAM,KAAK,cAAc,OAAO,kBAAkB,KAAK;AAAA,IAChE;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,qBAAqB,SAAmC;AACpE,QAAI,CAAC,KAAK,mBAAmB,CAAC,KAAK,QAAQ,qBAAsB,QAAO,KAAK;AAC7E,UAAM,MAAM,oBAAoB,KAAK,eAAe;AACpD,QAAI,QAAS,uBAAsB,OAAO,GAAG;AAC7C,UAAM,SAAS,sBAAsB,IAAI,GAAG;AAC5C,QAAI,WAAW,OAAW,QAAO;AACjC,UAAM,UAAU,MAAM,KAAK,QAAQ,qBAAqB;AAAA,MACtD,SAAS,KAAK,gBAAgB;AAAA,MAC9B,iBAAiB,KAAK,gBAAgB;AAAA,MACtC,YAAY,KAAK;AAAA,MACjB,gBAAgB,CAAC;AAAA,IACnB,CAAC;AACD,UAAM,OAAOJ,aAAY,QAAQ,IAAI;AACrC,0BAAsB,IAAI,KAAK,IAAI;AACnC,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBAAoB,WAAiE;AAC5F,SAAO,GAAG,UAAU,OAAO,KAAS,UAAU,eAAe;AAC/D;AAEO,IAAM,8BAAN,MAAkC;AAAA,EAC9B;AAAA,EACQ;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YACE,QACA,OAKA;AACA,SAAK,SAAS;AACd,SAAK,YAAY,eAAe,MAAM,SAAS;AAC/C,SAAK,eAAe,aAAa,MAAM,cAAc,uBAAuB;AAC5E,SAAK,YAAY,aAAa,MAAM,WAAW,oBAAoB;AAAA,EACrE;AAAA,EAEA,MAAM,cAA6C;AACjD,UAAM,OAAO,MAAM,KAAK,OAAO,kBAAkB;AAAA,MAC/C,QAAQ;AAAA,MACR,MAAM,KAAK,KAAK,SAAS;AAAA,MACzB,OAAO,KAAK;AAAA,IACd,CAAC;AACD,QAAI,CAAC,MAAM,QAAQ,IAAI,GAAG;AACxB,YAAM,IAAI,4BAA4B,+CAA+C;AAAA,IACvF;AACA,WAAO,KAAK,IAAI,CAAC,WAAW,cAAc,MAAM,MAAM,CAAC;AAAA,EACzD;AAAA,EAEA,MAAM,gBAA2D;AAC/D,UAAM,OAAO,MAAM,KAAK,OAAO,kBAAkB;AAAA,MAC/C,QAAQ;AAAA,MACR,MAAM,KAAK,KAAK,WAAW;AAAA,MAC3B,OAAO,KAAK;AAAA,IACd,CAAC;AACD,UAAM,WAAW,4BAA4B,MAAM,IAAI;AACvD,QACE,SAAS,qBAAqB,KAAK,UAAU,oBAC7C,SAAS,yBAAyB,KAAK,UAAU,sBACjD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,SAAS,YAAmD;AAChE,UAAM,KAAK,YAAY,YAAY,aAAa;AAChD,UAAM,OAAO,MAAM,KAAK,OAAO,kBAAkB;AAAA,MAC/C,QAAQ;AAAA,MACR,MAAM,KAAK,KAAK,aAAa,EAAE,EAAE;AAAA,MACjC,OAAO,KAAK;AAAA,IACd,CAAC;AACD,UAAM,WAAW,gBAAgB,MAAM,IAAI;AAC3C,QACE,SAAS,OAAO,MAChB,SAAS,qBAAqB,KAAK,UAAU,oBAC7C,SAAS,yBAAyB,KAAK,UAAU,sBACjD;AACA,YAAM,IAAI,4BAA4B,sDAAsD;AAAA,IAC9F;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,eACJ,YACA,cAC4C;AAC5C,UAAM,KAAK,YAAY,YAAY,aAAa;AAChD,UAAM,UAAU,6BAA6B,MAAM,YAAY;AAC/D,QAAI,QAAQ,eAAe,IAAI;AAC7B,YAAM,IAAI,4BAA4B,0CAA0C;AAAA,IAClF;AACA,UAAM,UAAU,6BAA6B;AAAA,MAC3C,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,KAAK,aAAa,EAAE,UAAU;AAAA,QACzC,OAAO,KAAK;AAAA,QACZ,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AACA,QAAI,QAAQ,gBAAgB,QAAQ,eAAe,QAAQ,eAAe,IAAI;AAC5E,YAAM,IAAI,4BAA4B,oDAAoD;AAAA,IAC5F;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,WAAW,KAAgD;AAC/D,WAAO,mBAAmB;AAAA,MACxB,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,KAAK,SAAS;AAAA,QACzB,OAAO,KAAK;AAAA,QACZ,MAAM,QAAQ,SAAY,CAAC,IAAI,EAAE,KAAK,WAAW,GAAG,EAAE;AAAA,MACxD,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,wBAAwB,KAAuD;AACnF,QAAI;AACJ,QAAI;AACF,iBAAW,0BAA0B;AAAA,QACnC,MAAM,KAAK,OAAO,kBAAkB;AAAA,UAClC,QAAQ;AAAA,UACR,MAAM,KAAK,KAAK,6BAA6B;AAAA,UAC7C,OAAO,KAAK;AAAA,UACZ,MAAM,QAAQ,SAAY,CAAC,IAAI,EAAE,KAAK,WAAW,GAAG,EAAE;AAAA,QACxD,CAAC;AAAA,MACH;AAAA,IACF,SAAS,OAAO;AAGd,UACE,iBAAiB,8BACjB,MAAM,WAAW,OACjB,MAAM,MAAM,SAAS,wBACrB,MAAM,MAAM,YAAY,mBACxB;AACA,cAAM,oCAAoC,2BAA2B;AAAA,MACvE;AACA,YAAM;AAAA,IACR;AACA,QACE,SAAS,qBAAqB,KAAK,UAAU,oBAC7C,SAAS,yBAAyB,KAAK,UAAU,wBACjD,SAAS,QAAQ;AAAA,MACf,CAAC,WACC,OAAO,qBAAqB,KAAK,UAAU,oBAC3C,OAAO,yBAAyB,KAAK,UAAU;AAAA,IACnD,GACA;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,UAAoD;AACrE,WAAO,mBAAmB;AAAA,MACxB,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,WAAW,UAAU,QAAQ;AAAA,QACxC,OAAO,KAAK;AAAA,QACZ,MAAM,CAAC;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,UAAiD;AACjE,UAAM,OAAO,MAAM,KAAK,OAAO,kBAAkB;AAAA,MAC/C,QAAQ;AAAA,MACR,MAAM,KAAK,WAAW,QAAQ;AAAA,MAC9B,OAAO,KAAK;AAAA,IACd,CAAC;AACD,QAAI,CAAC,MAAM,QAAQ,IAAI,GAAG;AACxB,YAAM,IAAI,4BAA4B,+CAA+C;AAAA,IACvF;AACA,WAAO,KAAK,IAAI,CAAC,WAAW,cAAc,MAAM,MAAM,CAAC;AAAA,EACzD;AAAA,EAEA,MAAM,QAAQ,UAAoD;AAChE,WAAO,mBAAmB;AAAA,MACxB,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,WAAW,UAAU,aAAa;AAAA,QAC7C,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,UAAoD;AACpE,QAAI;AACJ,QAAI;AACF,cAAQ,mBAAmB;AAAA,QACzB,MAAM,KAAK,OAAO,kBAAkB;AAAA,UAClC,QAAQ;AAAA,UACR,MAAM,KAAK,WAAW,UAAU,OAAO;AAAA,UACvC,OAAO,KAAK;AAAA,QACd,CAAC;AAAA,MACH;AAAA,IACF,SAAS,OAAO;AAId,UACE,EAAE,iBAAiB,+BACnB,MAAM,WAAW,OACjB,MAAM,MAAM,SAAS,wBACrB,MAAM,MAAM,YAAY,mBACxB;AACA,cAAM;AAAA,MACR;AACA,YAAM,cAAc,MAAM,KAAK,QAAQ,QAAQ;AAC/C,cAAQ,mBAAmB,MAAM;AAAA,QAC/B,kBAAkB,YAAY;AAAA,QAC9B,sBAAsB,YAAY,OAAO;AAAA,QACzC,UAAU,YAAY,OAAO;AAAA,QAC7B,kBAAkB,YAAY,OAAO;AAAA,QACrC,oBAAoB,YAAY,OAAO;AAAA,QACvC,SAAS,YAAY;AAAA,MACvB,CAAC;AAAA,IACH;AACA,QACE,MAAM,qBAAqB,KAAK,UAAU,oBAC1C,MAAM,yBAAyB,KAAK,UAAU,wBAC9C,MAAM,aAAa,UACnB;AACA,YAAM,IAAI,4BAA4B,iDAAiD;AAAA,IACzF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,QACJ,UACA,cACsC;AACtC,UAAM,UAAU,sBAAsB,MAAM,YAAY;AACxD,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,KAAK,OAAO,kBAAkB;AAAA,QACzC,QAAQ;AAAA,QACR,MAAM,KAAK,WAAW,UAAU,UAAU;AAAA,QAC1C,OAAO,KAAK;AAAA,QACZ,MAAM;AAAA,MACR,CAAC;AAAA,IACH,SAAS,OAAO;AAGd,UACE,iBAAiB,8BACjB,MAAM,WAAW,OACjB,MAAM,MAAM,SAAS,wBACrB,MAAM,MAAM,YAAY,mBACxB;AACA,cAAM,oCAAoC,mBAAmB;AAAA,MAC/D;AACA,YAAM;AAAA,IACR;AACA,UAAM,SAAS,uBAAuB,MAAM,IAAI;AAChD,QACE,OAAO,qBAAqB,KAAK,UAAU,oBAC3C,OAAO,yBAAyB,KAAK,UAAU,wBAC/C,OAAO,aAAa,YACpB,OAAO,qBAAqB,QAAQ,4BACpC,OAAO,uBAAuB,QAAQ,8BACtC,OAAO,YAAY,QAAQ,mBAC3B,OAAO,SAAS,QAAQ,MACxB;AACA,YAAM,IAAI,4BAA4B,6CAA6C;AAAA,IACrF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,QACJ,UACA,UAA2C,CAAC,GACd;AAC9B,UAAM,QAAQ,IAAI,gBAAgB;AAAA,MAChC,QAAQ,QAAQ,UAAU;AAAA,MAC1B,SAAS,OAAO,eAAe,QAAQ,WAAW,IAAI,GAAG,KAAK,4BAA4B,CAAC;AAAA,IAC7F,CAAC;AACD,QAAI,QAAQ,WAAW,UAAa,QAAQ,WAAW,UAAU,QAAQ,WAAW,OAAO;AACzF,YAAM,IAAI,WAAW,sCAAsC;AAAA,IAC7D;AACA,QAAI,QAAQ,aAAa,QAAW;AAClC,UAAI,OAAO,QAAQ,aAAa,WAAW;AACzC,cAAM,IAAI,WAAW,wCAAwC;AAAA,MAC/D;AACA,YAAM,IAAI,YAAY,OAAO,QAAQ,QAAQ,CAAC;AAAA,IAChD;AACA,WAAO,MAAM,KAAK,OAAO,8BAA8B;AAAA,MACrD,QAAQ;AAAA,MACR,MAAM,KAAK,WAAW,UAAU,cAAc,KAAK,EAAE;AAAA,MACrD,OAAO,KAAK;AAAA,MACZ,uBAAuB;AAAA,QACrB,kBAAkB,KAAK,UAAU;AAAA,QACjC,sBAAsB,KAAK,UAAU;AAAA,QACrC,UAAU,gBAAgB,UAAU,mBAAmB;AAAA,MACzD;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,gBAAgD;AACpD,WAAO,iBAAiB;AAAA,MACtB,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,KAAK,WAAW;AAAA,QAC3B,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,SAAwE;AACnF,UAAM,SAAS,qBAAqB,MAAM,OAAO;AACjD,QACE,OAAO,qBAAqB,KAAK,UAAU,oBAC3C,OAAO,yBAAyB,KAAK,UAAU,sBAC/C;AACA,YAAM,IAAI,4BAA4B,mDAAmD;AAAA,IAC3F;AACA,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,KAAK,OAAO,kBAAkB;AAAA,QACzC,QAAQ;AAAA;AAAA,QAER,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,IAAI,wCAAwC;AAAA,QACzE,OAAO,KAAK;AAAA,QACZ,MAAM;AAAA,MACR,CAAC;AAAA,IACH,SAAS,OAAO;AAId,UACE,iBAAiB,8BACjB,MAAM,WAAW,OACjB,MAAM,MAAM,SAAS,oBACrB,MAAM,MAAM,YAAY,6BACxB;AACA,cAAM,oCAAoC,qBAAqB;AAAA,MACjE;AACA,YAAM;AAAA,IACR;AACA,WAAO,qBAAqB,MAAM,IAAI;AAAA,EACxC;AAAA;AAAA;AAAA,EAIA,MAAM,oBACJ,SACiD;AACjD,UAAM,SAAS,iCAAiC,MAAM,OAAO;AAC7D,WAAO,kCAAkC;AAAA,MACvC,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,KAAK,cAAc,OAAO,WAAW,kBAAkB;AAAA,QAClE,OAAO,KAAK;AAAA,QACZ,MAAM;AAAA,QACN,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,aAAyD;AACrE,WAAO,qBAAqB;AAAA,MAC1B,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,KAAK,cAAc,YAAY,aAAa,cAAc,CAAC,EAAE;AAAA,QACxE,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YACJ,SAC0C;AAC1C,UAAM,SAAS,0BAA0B,MAAM,OAAO;AACtD,QACE,OAAO,qBAAqB,KAAK,UAAU,oBAC3C,OAAO,yBAAyB,KAAK,UAAU,sBAC/C;AACA,YAAM,IAAI,4BAA4B,iDAAiD;AAAA,IACzF;AACA,WAAO,2BAA2B;AAAA,MAChC,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,KAAK,eAAe;AAAA,QAC/B,OAAO,KAAK;AAAA,QACZ,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA,EAIA,MAAM,aACJ,cACyC;AACzC,UAAM,UAAU,2BAA2B,MAAM,YAAY;AAC7D,QACE,QAAQ,qBAAqB,KAAK,UAAU,oBAC5C,QAAQ,yBAAyB,KAAK,UAAU,sBAChD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,0BAA0B;AAAA,MAC/B,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,KAAK,eAAe;AAAA,QAC/B,OAAO,KAAK;AAAA,QACZ,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,YACJ,UACA,UAII,CAAC,GACiC;AACtC,UAAM,QAAQ,IAAI,gBAAgB;AAClC,QAAI,QAAQ,MAAO,OAAM,IAAI,SAAS,CAAC,GAAG,IAAI,IAAI,QAAQ,KAAK,CAAC,EAAE,KAAK,GAAG,CAAC;AAC3E,QAAI,QAAQ,kBAAkB,QAAW;AACvC,YAAM;AAAA,QACJ;AAAA,QACA,uBAAuB,QAAQ,eAAe,mBAAmB,EAAE,SAAS;AAAA,MAC9E;AAAA,IACF;AACA,QAAI,QAAQ,UAAU,QAAW;AAC/B,YAAM,QAAQ,oBAAoB,QAAQ,OAAO,kBAAkB;AACnE,UAAI,QAAQ,IAAO,OAAM,IAAI,WAAW,+BAA+B;AACvE,YAAM,IAAI,SAAS,MAAM,SAAS,CAAC;AAAA,IACrC;AACA,UAAM,SAAS,MAAM,SAAS,IAAI,KAAK,IAAI,MAAM,SAAS,CAAC;AAC3D,WAAO,uBAAuB;AAAA,MAC5B,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,GAAG,KAAK,WAAW,UAAU,aAAa,CAAC,GAAG,MAAM;AAAA,QAC1D,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEQ,KAAK,QAAwB;AACnC,WAAO,wBAAwB,KAAK,UAAU,gBAAgB,IAAI,MAAM;AAAA,EAC1E;AAAA,EAEQ,WAAW,UAAkB,QAAyB;AAC5D,UAAM,OAAO,KAAK,KAAK,WAAW,mBAAmB,gBAAgB,UAAU,WAAW,CAAC,CAAC,EAAE;AAC9F,WAAO,SAAS,GAAG,IAAI,IAAI,MAAM,KAAK;AAAA,EACxC;AACF;AAEO,IAAM,+BAAN,MAAmC;AAAA,EAC/B;AAAA,EACQ;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YACE,QACA,OAKA;AACA,SAAK,SAAS;AACd,SAAK,YAAY,uBAAuB,MAAM,SAAS;AACvD,SAAK,eAAe,aAAa,MAAM,cAAc,wBAAwB;AAC7E,SAAK,YAAY,aAAa,MAAM,WAAW,qBAAqB;AAAA,EACtE;AAAA,EAEA,MAAM,cAA8C;AAClD,UAAM,OAAO,MAAM,KAAK,OAAO,kBAAkB;AAAA,MAC/C,QAAQ;AAAA,MACR,MAAM,KAAK,KAAK,SAAS;AAAA,MACzB,OAAO,KAAK;AAAA,IACd,CAAC;AACD,QAAI,CAAC,MAAM,QAAQ,IAAI,GAAG;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,KAAK,IAAI,CAAC,WAAW,eAAe,MAAM,MAAM,CAAC;AAAA,EAC1D;AAAA,EAEA,MAAM,QAAQ,UAAqD;AACjE,WAAO,oBAAoB;AAAA,MACzB,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,WAAW,UAAU,aAAa;AAAA,QAC7C,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,QACJ,UACA,UAKI,CAAC,GAC0B;AAC/B,UAAM,QAAQ,IAAI,gBAAgB;AAClC,QAAI,QAAQ,WAAW,OAAW,OAAM,IAAI,UAAU,QAAQ,MAAM;AACpE,QAAI,QAAQ,YAAY,OAAW,OAAM,IAAI,WAAW,OAAO,QAAQ,OAAO,CAAC;AAC/E,QAAI,QAAQ,aAAa,OAAW,OAAM,IAAI,YAAY,OAAO,QAAQ,QAAQ,CAAC;AAClF,QAAI,QAAQ,cAAc,OAAW,OAAM,IAAI,aAAa,OAAO,QAAQ,SAAS,CAAC;AACrF,UAAM,SAAS,MAAM,OAAO,IAAI,cAAc,KAAK,KAAK;AACxD,WAAO,MAAM,KAAK,OAAO,uBAAuB;AAAA,MAC9C,QAAQ;AAAA,MACR,MAAM,KAAK,WAAW,UAAU,MAAM;AAAA,MACtC,OAAO,KAAK;AAAA,MACZ,uBAAuB;AAAA,QACrB,mBAAmB,KAAK,UAAU;AAAA,QAClC,sBAAsB,KAAK,UAAU;AAAA,QACrC,UAAU,gBAAgB,UAAU,oBAAoB;AAAA,MAC1D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,gBAAiD;AACrD,WAAO,kBAAkB;AAAA,MACvB,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,KAAK,WAAW;AAAA,QAC3B,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,SAAgE;AAC/E,UAAM,SAAS,sBAAsB,MAAM,OAAO;AAClD,QACE,OAAO,sBAAsB,KAAK,UAAU,qBAC5C,OAAO,yBAAyB,KAAK,UAAU;AAE/C,YAAM,IAAI,4BAA4B,gDAAgD;AACxF,WAAO,sBAAsB;AAAA,MAC3B,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,KAAK,cAAc;AAAA,QAC9B,OAAO,KAAK;AAAA,QACZ,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,SAA0E;AACrF,UAAM,SAAS,sBAAsB,MAAM,OAAO;AAClD,QACE,OAAO,sBAAsB,KAAK,UAAU,qBAC5C,OAAO,yBAAyB,KAAK,UAAU,sBAC/C;AACA,YAAM,IAAI,4BAA4B,oDAAoD;AAAA,IAC5F;AACA,WAAO,sBAAsB;AAAA,MAC3B,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,KAAK,SAAS;AAAA,QACzB,OAAO,KAAK;AAAA,QACZ,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,aAAwD;AACpE,WAAO,yBAAyB;AAAA,MAC9B,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,KAAK,cAAc,YAAY,aAAa,cAAc,CAAC,EAAE;AAAA,QACxE,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,YAA2B;AAC/B,UAAM,OAAO,MAAM,KAAK,OAAO,kBAAkB;AAAA,MAC/C,QAAQ;AAAA,MACR,MAAM,KAAK,KAAK,WAAW;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,MAAM,CAAC;AAAA,IACT,CAAC;AACD,QAAI,CAACK,UAAS,IAAI,KAAK,KAAK,UAAU,MAAM;AAC1C,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,KAAK,QAAwB;AACnC,WAAO,yBAAyB,KAAK,UAAU,iBAAiB,IAAI,MAAM;AAAA,EAC5E;AAAA,EAEQ,WAAW,UAAkB,QAAyB;AAC5D,UAAM,OAAO,KAAK;AAAA,MAChB,WAAW,mBAAmB,gBAAgB,UAAU,oBAAoB,CAAC,CAAC;AAAA,IAChF;AACA,WAAO,SAAS,GAAG,IAAI,IAAI,MAAM,KAAK;AAAA,EACxC;AACF;AAEA,SAAS,WAAW,OAQT;AACT,QAAM,UAAU,KAAK,IAAI,GAAG,KAAK,KAAK,MAAM,YAAY,GAAK,CAAC;AAC9D,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,aAAa,gBAAgB,GAAG,CAAC;AAAA,IACjC,qBAAqB,KAAK,IAAI,SAAS,EAAE,CAAC;AAAA,IAC1C,cAAc,OAAO;AAAA,IACrB,aAAa,gBAAgB,MAAM,MAAM,CAAC;AAAA,IAC1C,SAAS,gBAAgB,MAAM,GAAG,CAAC;AAAA,IACnC,YAAY,gBAAgB,yBAAyB,MAAM,KAAK,EAAE,CAAC;AAAA,IACnE,GAAI,MAAM,cACN;AAAA,MACE,YAAY,gBAAgB,gCAAgC,CAAC;AAAA,MAC7D,iBAAiB,gBAAgB,IAAI,MAAM,WAAW,EAAE,CAAC;AAAA,IAC3D,IACA,CAAC;AAAA,IACL,YAAY,gBAAgB,MAAM,YAAY,CAAC;AAAA,IAC/C,GAAI,MAAM,sBACN,CAAC,iBAAiB,gBAAgB,MAAM,mBAAmB,CAAC,EAAE,IAC9D,CAAC;AAAA,IACL,eAAe,gBAAgB,cAAc,CAAC;AAAA,IAC9C;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,mBAAmB,cAAkC,aAA6B;AACzF,MAAI;AACF,WAAO,oBAAoB,cAAc,WAAW;AAAA,EACtD,SAAS,OAAO;AACd,QAAI,iBAAiB,4BAA4B;AAC/C,YAAM,IAAI,4BAA4B,MAAM,OAAO;AAAA,IACrD;AACA,UAAM;AAAA,EACR;AACF;AAEA,SAAS,mBAAmB,UAAuD;AACjF,QAAM,MAAM,SAAS;AACrB,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,EAAG,QAAO,CAAC;AACnE,QAAM,UAAkC,CAAC;AACzC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,GAA8B,GAAG;AACzE,QAAI,OAAO,QAAQ,YAAY,OAAO,UAAU,SAAU;AAC1D,QAAI,IAAI,YAAY,MAAM,gBAAiB;AAC3C,YAAQ,GAAG,IAAI;AAAA,EACjB;AACA,SAAO;AACT;AAEA,eAAe,yBACb,UACA,OAOA,kBACA,SAMkB;AAClB,QAAM,QAAQ,aAAa,MAAM,OAAO,0BAA0B;AAClE,QAAM,YAAYD,gBAAe,MAAM,aAAa,gBAAgB;AACpE,QAAM,YAAY,qBAAqB,UAAU,MAAM,IAAI;AAC3D,YAAU,WAAW,UAAU,aAAa,SAAS,WAAW;AAChE,QAAM,OAAO,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,MAAM,IAAI;AAC7E,MAAI,SAAS,UAAa,OAAO,WAAW,IAAI,IAAI,gCAAgC;AAClF,UAAM,IAAI,WAAW,8CAA8C;AAAA,EACrE;AACA,QAAM,WAAW,MAAM;AAAA,IACrB,YACE,MAAM,MAAM,WAAW;AAAA,MACrB,QAAQ,MAAM;AAAA,MACd,SAAS;AAAA,QACP,GAAG,mBAAmB,QAAQ;AAAA,QAC9B,eAAe,UAAU,KAAK;AAAA,QAC9B,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;AAAA,MACrE;AAAA,MACA,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,MACrC,UAAU;AAAA,MACV,QAAQ,YAAY,QAAQ,SAAS;AAAA,IACvC,CAAC;AAAA,EACL;AACA,QAAM,eAAe,MAAM,oBAAoB,YAAY,MAAM,SAAS,KAAK,CAAC;AAChF,MAAI,OAAO,WAAW,YAAY,IAAI,gCAAgC;AACpE,UAAM,IAAI,4BAA4B,0CAA0C;AAAA,EAClF;AACA,gCAA8B,cAAc,SAAS,MAAM;AAC3D,OACG,SAAS,WAAW,OAAO,SAAS,WAAW,QAChD,CAAC,gCAAgC,YAAY,GAC7C;AACA,UAAM,SAAS,8BAA8B,SAAS,QAAQ,EAAE;AAChE,QAAI,QAAQ;AACV,UAAI;AACF,iBAAS,8BAA8B;AAAA,UACrC,SAAS;AAAA,UACT,MAAM,OAAO;AAAA,QACf,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,IAAI,6BAA6B,oCAAoC,SAAS,MAAM,EAAE;AAAA,EAC9F;AACA,SAAO,cAAc,cAAc,SAAS,MAAM;AACpD;AAEA,eAAe,8BACb,UACA,OACA,kBACqD;AACrD,QAAM,QAAQ,aAAa,MAAM,OAAO,0BAA0B;AAClE,QAAM,YAAYA,gBAAe,MAAM,aAAa,gBAAgB;AACpE,QAAM,YAAY,qBAAqB,UAAU,MAAM,IAAI;AAC3D,YAAU,WAAW,UAAU,aAAa,SAAS,WAAW;AAChE,QAAM,WAAW,MAAM;AAAA,IACrB,YACE,MAAM,MAAM,WAAW;AAAA,MACrB,QAAQ,MAAM;AAAA,MACd,SAAS;AAAA,QACP,GAAG,mBAAmB,QAAQ;AAAA,QAC9B,eAAe,UAAU,KAAK;AAAA,QAC9B,QAAQ;AAAA,MACV;AAAA,MACA,UAAU;AAAA,MACV,QAAQ,YAAY,QAAQ,SAAS;AAAA,IACvC,CAAC;AAAA,EACL;AACA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,eAAe,MAAM,oBAAoB,YAAY,MAAM,SAAS,KAAK,CAAC;AAChF,QAAI,OAAO,WAAW,YAAY,IAAI,gCAAgC;AACpE,YAAM,IAAI,4BAA4B,0CAA0C;AAAA,IAClF;AACA,kCAA8B,cAAc,SAAS,MAAM;AAC3D,kBAAc,cAAc,SAAS,MAAM;AAC3C,UAAM,IAAI,4BAA4B,8CAA8C;AAAA,EACtF;AACA,QAAM,iBAAiB,OAAO,SAAS,QAAQ,IAAI,gBAAgB,CAAC;AACpE,QAAM,WAAW,MAAM,YAAY,YAAY,KAAK,OAAO,OAAO;AAClE,MAAI,OAAO,SAAS,cAAc,KAAK,iBAAiB,UAAU;AAChE,UAAM,SAAS,MAAM,OAAO,8BAA8B,EAAE,MAAM,MAAM,MAAS;AACjF,UAAM,IAAI,WAAW,8BAA8B;AAAA,EACrD;AACA,QAAM,OAAO,MAAM;AAAA,IACjB,YAAY,MAAM,yBAAyB,UAAU,QAAQ;AAAA,EAC/D;AACA,SAAO,qBAAqB,MAAM,SAAS,SAAS,KAAK;AAC3D;AAEA,eAAe,oBAAuB,gBAA8C;AAClF,MAAI;AACF,WAAO,MAAM,eAAe;AAAA,EAC9B,SAAS,OAAO;AACd,QACE,iBAAiB,+BACjB,iBAAiB,gCACjB,iBAAiB,YACjB;AACA,YAAM;AAAA,IACR;AAIA,UAAM,IAAI,6BAA6B,wCAAwC;AAAA,MAC7E,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEA,eAAe,yBAAyB,UAAoB,UAAuC;AACjG,MAAI,CAAC,SAAS,KAAM,OAAM,IAAI,4BAA4B,mCAAmC;AAC7F,QAAM,SAAS,SAAS,KAAK,UAAU;AACvC,QAAM,SAAuB,CAAC;AAC9B,MAAI,OAAO;AACX,MAAI;AACF,eAAS;AACP,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,KAAM;AACV,cAAQ,MAAM;AACd,UAAI,OAAO,UAAU;AACnB,cAAM,OAAO,OAAO,8BAA8B,EAAE,MAAM,MAAM,MAAS;AACzE,cAAM,IAAI,WAAW,8BAA8B;AAAA,MACrD;AACA,aAAO,KAAK,KAAK;AAAA,IACnB;AAAA,EACF,UAAE;AACA,WAAO,YAAY;AAAA,EACrB;AACA,QAAM,OAAO,IAAI,WAAW,IAAI;AAChC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,SAAK,IAAI,OAAO,MAAM;AACtB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAEA,SAAS,qBACP,MACA,SACA,OAC4C;AAC5C,SAAO,MAAM,YAAY,YACrB,oBAAoB,MAAM,SAAS,MAAM,qBAAqB,IAC9D,qBAAqB,MAAM,SAAS,MAAM,qBAAqB;AACrE;AAEA,SAAS,oBACP,MACA,SACA,UACqB;AACrB,MAAI,KAAK,aAAa,KAAK,KAAK,aAAa,KAAK,OAAO,MAAM;AAC7D,UAAM,IAAI,WAAW,sCAAsC;AAAA,EAC7D;AACA,QAAM,MAAM,CAAC,SAAgC,QAAQ,IAAI,KAAK,YAAY,CAAC,KAAK;AAChF,QAAM,YAAY,IAAI,cAAc,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,YAAY;AAC5E,MAAI,cAAc,gBAAgB,cAAc,aAAa;AAC3D,UAAM,IAAI,4BAA4B,qCAAqC;AAAA,EAC7E;AACA,QAAM,iBAAiB,IAAI,0BAA0B;AACrD,MACE,CAAC,kBACD,eAAe,SAAS,KAAK,QAC7B,CAAC,oBAAoB,KAAK,cAAc,GACxC;AACA,UAAM,IAAI,4BAA4B,mCAAmC;AAAA,EAC3E;AACA,MAAI;AACJ,MAAI;AACF,eAAW;AAAA,MACT,KAAK,MAAM,OAAO,KAAK,gBAAgB,WAAW,EAAE,SAAS,MAAM,CAAC;AAAA,IACtE;AAAA,EACF,QAAQ;AACN,UAAM,IAAI,4BAA4B,mCAAmC;AAAA,EAC3E;AACA,MACE,SAAS,qBAAqB,SAAS,oBACvC,SAAS,yBAAyB,SAAS,wBAC3C,SAAS,aAAa,SAAS,YAC/B,SAAS,cAAc,WACvB;AACA,UAAM,IAAI,4BAA4B,mDAAmD;AAAA,EAC3F;AACA,SAAO,EAAE,MAAM,WAAW,gBAAgB,SAAS;AACrD;AAEA,SAAS,qBACP,MACA,SACA,UACsB;AACtB,MAAI,KAAK,aAAa,KAAK,KAAK,aAAa,+BAA+B;AAC1E,UAAM,IAAI,WAAW,uCAAuC;AAAA,EAC9D;AACA,QAAM,MAAM,CAAC,SAAgC,QAAQ,IAAI,KAAK,YAAY,CAAC,KAAK;AAChF,QAAM,YAAY,IAAI,cAAc,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,YAAY;AAC5E,MAAI,cAAc,gBAAgB,cAAc,aAAa;AAC3D,UAAM,IAAI,4BAA4B,sCAAsC;AAAA,EAC9E;AACA,QAAM,iBAAiB,IAAI,2BAA2B;AACtD,MACE,CAAC,kBACD,eAAe,SAAS,KAAK,QAC7B,CAAC,oBAAoB,KAAK,cAAc,GACxC;AACA,UAAM,IAAI,4BAA4B,oCAAoC;AAAA,EAC5E;AACA,SAAO,qCAAqC,EAAE,MAAM,WAAW,eAAe,GAAG,QAAQ;AAC3F;AAEO,SAAS,qCACdI,QACA,UACsB;AACtB,QAAM,WAAW,yCAAyCA,OAAM,cAAc;AAC9E,MAAI,SAAS,sBAAsB,SAAS,mBAAmB;AAC7D,UAAM,IAAI,mCAAmC,wBAAwB;AAAA,EACvE;AACA,MAAI,SAAS,aAAa,SAAS,UAAU;AAC3C,UAAM,IAAI,mCAAmC,uBAAuB;AAAA,EACtE;AACA,MAAI,SAAS,yBAAyB,SAAS,sBAAsB;AACnE,UAAM,IAAI,mCAAmC,2BAA2B;AAAA,EAC1E;AACA,MAAI,SAAS,cAAcA,OAAM,WAAW;AAC1C,UAAM,IAAI,mCAAmC,sBAAsB;AAAA,EACrE;AACA,QAAM,SAASC,YAAW,QAAQ,EAAE,OAAOD,OAAM,IAAI,EAAE,OAAO,KAAK;AACnE,MAAI,SAAS,WAAW,QAAQ;AAC9B,UAAM,IAAI,mCAAmC,uBAAuB;AAAA,EACtE;AACA,SAAO,EAAE,GAAGA,QAAO,SAAS;AAC9B;AAEO,SAAS,yCACd,OAC8B;AAC9B,MAAI,CAAC,SAAS,MAAM,SAAS,KAAK,QAAQ,CAAC,oBAAoB,KAAK,KAAK,GAAG;AAC1E,UAAM,IAAI,4BAA4B,oCAAoC;AAAA,EAC5E;AACA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,MAAM,CAAC;AAAA,EACvE,QAAQ;AACN,UAAM,IAAI,4BAA4B,oCAAoC;AAAA,EAC5E;AACA,MAAI,CAACH,UAAS,OAAO,GAAG;AACtB,UAAM,IAAI,4BAA4B,oCAAoC;AAAA,EAC5E;AACA,QAAM,UAAU,oBAAI,IAAI;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,IAAI,GAAG,CAAC,GAAG;AACzD,UAAM,IAAI,4BAA4B,oCAAoC;AAAA,EAC5E;AACA,aAAW,OAAO;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAAY;AACV,UAAM,OAAO,QAAQ,GAAG;AACxB,UAAM,WAAW,QAAQ,aAAa,MAAM,QAAQ,eAAe,MAAM;AACzE,QAAI,OAAO,SAAS,YAAY,KAAK,SAAS,KAAK,OAAO,WAAW,IAAI,IAAI,UAAU;AACrF,YAAM,IAAI,4BAA4B,oCAAoC;AAAA,IAC5E;AAAA,EACF;AACA,MAAI,OAAO,QAAQ,WAAW,YAAY,CAAC,eAAe,KAAK,QAAQ,MAAM,GAAG;AAC9E,UAAM,IAAI,mCAAmC,uBAAuB;AAAA,EACtE;AACA,MACE,CAAC,OAAO,cAAc,QAAQ,QAAQ,KACtC,OAAO,QAAQ,QAAQ,IAAI,KAC3B,CAAC,8BAA8B,QAAQ,OAAO,QAAQ,MAAM,GAC5D;AACA,UAAM,IAAI,4BAA4B,oCAAoC;AAAA,EAC5E;AACA,MAAI,QAAQ,cAAc,gBAAgB,QAAQ,cAAc,aAAa;AAC3E,UAAM,IAAI,4BAA4B,oCAAoC;AAAA,EAC5E;AACA,MAAI,CAAC,aAAa,QAAQ,iBAAiB,GAAG;AAC5C,UAAM,IAAI,4BAA4B,oCAAoC;AAAA,EAC5E;AACA,QAAM,uBAAuB,QAAQ;AACrC,MACE,OAAO,yBAAyB,YAChC,CAAC,iCAAiC,KAAK,oBAAoB,GAC3D;AACA,UAAM,IAAI,4BAA4B,oCAAoC;AAAA,EAC5E;AACA,QAAM,aAAa,QAAQ;AAC3B,MAAI,OAAO,eAAe,YAAY,CAAC,OAAO,SAAS,IAAI,KAAK,UAAU,EAAE,QAAQ,CAAC,GAAG;AACtF,UAAM,IAAI,4BAA4B,oCAAoC;AAAA,EAC5E;AACA,SAAO;AACT;AAEA,SAAS,8BAA8B,OAAgB,QAA0B;AAC/E,SACE,OAAO,cAAc,KAAK,KAC1B,OAAO,cAAc,MAAM,KAC3B,OAAO,KAAK,IAAI,KAChB,OAAO,MAAM,IAAI,KACjB,OAAO,KAAK,KAAK,SACjB,OAAO,MAAM,KAAK,SAClB,OAAO,KAAK,IAAI,OAAO,MAAM,KAAK;AAEtC;AAEA,SAAS,aAAa,OAAiC;AACrD,SACE,OAAO,UAAU,YACjB,8EAA8E,KAAK,KAAK;AAE5F;AAEA,SAAS,qBAAqB,UAA+B,aAA0B;AACrF,QAAM,YAAY,YAAY,QAAQ,GAAG;AACzC,QAAM,OAAO,cAAc,KAAK,cAAc,YAAY,MAAM,GAAG,SAAS;AAC5E,QAAM,eAAe,cAAc,KAAK,KAAK,YAAY,MAAM,YAAY,CAAC;AAC5E,QAAM,MAAM,IAAI;AAAA,IACd,eAAe,EAAE,GAAG,UAAU,MAAM,mBAAmB,SAAS,MAAM,IAAI,EAAE,CAAC;AAAA,EAC/E;AACA,aAAW,CAAC,MAAM,KAAK,KAAK,IAAI,gBAAgB,YAAY,GAAG;AAC7D,QAAI,aAAa,OAAO,MAAM,KAAK;AAAA,EACrC;AACA,SAAO;AACT;AAEA,SAAS,yBAAyB,OAAoC;AACpE,QAAM,UAAU,oBAAI,IAAoB;AACxC,aAAW,QAAQ,MAAM,MAAM,QAAQ,GAAG;AACxC,QAAI,WAAW,KAAK,IAAI,GAAG;AACzB,cAAQ,MAAM;AACd;AAAA,IACF;AACA,UAAM,YAAY,KAAK,QAAQ,GAAG;AAClC,QAAI,aAAa,EAAG;AACpB,UAAM,OAAO,KAAK,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,YAAY;AACzD,UAAM,cAAc,KAAK,MAAM,YAAY,CAAC,EAAE,KAAK;AACnD,QAAI,QAAQ,YAAa,SAAQ,IAAI,MAAM,WAAW;AAAA,EACxD;AACA,SAAO;AACT;AAEA,SAAS,gCAAgC,MAAuB;AAC9D,MAAI;AACF,UAAM,QAAiB,KAAK,MAAM,IAAI;AACtC,WAAOA,UAAS,KAAK,KAAK,MAAM,oBAAoB;AAAA,EACtD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,8BAA8B,MAAcN,SAAsB;AAIzE,MAAI,CAAC,KAAK,KAAK,GAAG,EAAE,SAASA,OAAM,KAAK,CAAC,gCAAgC,IAAI,GAAG;AAC9E,UAAM,IAAI,6BAA6B,oCAAoCA,OAAM,EAAE;AAAA,EACrF;AACF;AAEA,SAAS,cAAc,MAAcA,SAAyB;AAC5D,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,MAAM,IAAI;AAAA,EACzB,QAAQ;AACN,UAAM,IAAI,4BAA4B,6CAA6C;AAAA,EACrF;AACA,MAAI,CAACM,UAAS,KAAK,KAAK,MAAM,oBAAoB,kCAAkC;AAClF,UAAM,IAAI,4BAA4B,gDAAgD;AAAA,EACxF;AACA,MAAI,MAAM,OAAO,QAAQN,WAAU,OAAOA,UAAS,OAAO,UAAU,MAAO,QAAO,MAAM;AACxF,MAAI,MAAM,OAAO,SAASA,WAAU,OAAOA,WAAU,KAAK;AACxD,UAAM,SAAS,iBAAiB,UAAU,MAAM,KAAK;AACrD,QAAI,OAAO,QAAS,OAAM,IAAI,2BAA2BA,SAAQ,OAAO,IAAI;AAAA,EAC9E;AACA,QAAM,IAAI,4BAA4B,iDAAiD;AACzF;AAEA,SAAS,mBAAmB,MAAc,MAAsB;AAC9D,MAAI,CAAC,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,GAAG,GAAG;AACtE,UAAM,IAAI,4BAA4B,4CAA4C;AAAA,EACpF;AACA,SAAO,oBAAoB,IAAI,GAAG,IAAI;AACxC;AAEA,SAAS,eAAe,OAAkD;AACxE,MAAI,CAACM,UAAS,KAAK,EAAG,OAAM,IAAI,4BAA4B,oCAAoC;AAChG,SAAO;AAAA,IACL,kBAAkB,YAAY,MAAM,kBAAkB,oBAAoB;AAAA,IAC1E,sBAAsB,kBAAkB,MAAM,oBAAoB;AAAA,EACpE;AACF;AAKA,SAAS,gBACP,OACA,WACoC;AACpC,MAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,IAAQ,QAAO,CAAC;AAC5D,QAAM,UAAgC,CAAC;AACvC,aAAW,SAAS,OAAO;AACzB,UAAM,SAAS,cAAc,UAAU,KAAK;AAC5C,QACE,CAAC,OAAO,WACR,OAAO,KAAK,qBAAqB,UAAU,oBAC3C,OAAO,KAAK,yBAAyB,UAAU;AAE/C,aAAO,CAAC;AACV,YAAQ,KAAK,OAAO,IAAI;AAAA,EAC1B;AACA,SAAO,EAAE,QAAQ;AACnB;AAEA,SAAS,uBAAuB,OAAmD;AACjF,MAAI,CAACA,UAAS,KAAK,GAAG;AACpB,UAAM,IAAI,4BAA4B,qCAAqC;AAAA,EAC7E;AACA,SAAO;AAAA,IACL,mBAAmB,YAAY,MAAM,mBAAmB,qBAAqB;AAAA,IAC7E,sBAAsB,kBAAkB,MAAM,oBAAoB;AAAA,EACpE;AACF;AAEA,SAAS,0BAA0B,OAA6D;AAC9F,MAAI,MAAM,SAAS,WAAW;AAC5B,QACE,MAAM,WAAW,UACjB,MAAM,WAAW,cACjB,MAAM,WAAW,cACjB;AACA,YAAM,IAAI,4BAA4B,mCAAmC;AAAA,IAC3E;AACA,QAAI,MAAM,uBAAuB,UAAa,CAAC,eAAe,KAAK,MAAM,kBAAkB;AACzF,YAAM,IAAI,MAAM,wCAAwC;AAC1D,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ,MAAM,UAAU;AAAA,MACxB,GAAI,MAAM,qBAAqB,EAAE,oBAAoB,MAAM,mBAAmB,IAAI,CAAC;AAAA,IACrF;AAAA,EACF;AACA,MAAI,MAAM,SAAS,qBAAqB;AACtC,QAAI,MAAM,eAAe,iBAAiB,MAAM,eAAe,UAAU;AACvE,YAAM,IAAI,4BAA4B,0CAA0C;AAAA,IAClF;AACA,UAAM,WAAW,MAAM,UAAU,WAC7B,eAAe,MAAM,UAAU,UAAU,oCAAoC,IAC7E;AACJ,WAAO;AAAA,MACL,MAAM;AAAA,MACN,YAAY,MAAM;AAAA,MAClB,aAAa,gBAAgB,MAAM,aAAa,+BAA+B;AAAA,MAC/E,WAAW;AAAA,QACT,QAAQ;AAAA,UACN,MAAM,UAAU;AAAA,UAChB;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,QACA,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MACjC;AAAA,MACA,GAAI,MAAM,mBAAmB,SACzB,CAAC,IACD;AAAA,QACE,gBAAgB,8BAA8B,MAAM,cAAc;AAAA,MACpE;AAAA,MACJ,GAAI,MAAM,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,IAClE;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,UAAU,YAAY,MAAM,UAAU,qBAAqB;AAAA,IAC3D,sBAAsB,wBAAwB,MAAM,oBAAoB;AAAA,IACxE,aAAa,mBAAmB,MAAM,aAAa,GAAG,KAAK,uBAAuB;AAAA,IAClF,gBAAgB,mBAAmB,MAAM,gBAAgB,GAAG,KAAK,0BAA0B;AAAA,EAC7F;AACF;AAEA,SAAS,8BAA8B,OAAuB;AAC5D,QAAM,UAAU,oBAAoB,OAAO,0BAA0B;AACrE,MAAI,UAAU,OAAQ;AACpB,UAAM,IAAI,4BAA4B,qCAAqC;AAAA,EAC7E;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAAe,OAAuB;AAC5D,MAAI,OAAO,WAAW,KAAK,IAAI,OAAQ;AACrC,UAAM,IAAI,4BAA4B,GAAG,KAAK,aAAa;AAAA,EAC7D;AACA,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,UAAM,IAAI,4BAA4B,GAAG,KAAK,aAAa;AAAA,EAC7D;AACA,MACG,OAAO,aAAa,YAAY,OAAO,aAAa,WACrD,OAAO,YACP,OAAO,YACP,OAAO,MACP;AACA,UAAM,IAAI,4BAA4B,GAAG,KAAK,aAAa;AAAA,EAC7D;AACA,SAAO,OAAO,SAAS,EAAE,QAAQ,QAAQ,EAAE;AAC7C;AAEA,SAAS,6BACP,OAC8B;AAC9B,QAAM,OAAO,MAAM;AACnB,MAAI,SAAS,YAAY,SAAS,WAAW,SAAS,aAAa,SAAS,UAAU;AACpF,UAAM,IAAI,4BAA4B,uCAAuC;AAAA,EAC/E;AACA,MAAI,CAAC,6BAA6B,KAAK,MAAM,eAAe,GAAG;AAC7D,UAAM,IAAI,4BAA4B,4CAA4C;AAAA,EACpF;AACA,QAAM,WAAW,MAAM,aAAa,SAAY,SAAY,gBAAgB,MAAM,QAAQ;AAC1F,MAAI,SAAS,WAAW,aAAa,QAAW;AAC9C,UAAM,IAAI,4BAA4B,kDAAkD;AAAA,EAC1F;AACA,QAAM,gBACJ,MAAM,kBAAkB,SAAY,SAAY,uBAAuB,MAAM,aAAa;AAC5F,MAAI,SAAS,aAAa,kBAAkB,QAAW;AACrD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,aAAa,kBAAkB,QAAW;AACrD,UAAM,IAAI,4BAA4B,qDAAqD;AAAA,EAC7F;AACA,SAAO;AAAA,IACL,SAAS,YAAY,MAAM,SAAS,kBAAkB;AAAA,IACtD,cAAc,oBAAoB,MAAM,cAAc,uBAAuB;AAAA,IAC7E,iBAAiB,MAAM;AAAA,IACvB;AAAA,IACA,aAAa,wBAAwB,MAAM,MAAM,WAAW;AAAA,IAC5D,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS;AAAA,IAC7C,GAAI,kBAAkB,SAAY,CAAC,IAAI,EAAE,cAAc;AAAA,EACzD;AACF;AAEA,SAAS,uBACP,OAC4D;AAC5D,MAAI,MAAM,eAAe,iBAAiB,MAAM,eAAe,UAAU;AACvE,UAAM,IAAI,4BAA4B,+CAA+C;AAAA,EACvF;AACA,MACE,MAAM,gBAAgB,gBACtB,MAAM,gBAAgB,iBACtB,MAAM,gBAAgB,OACtB;AACA,UAAM,IAAI,4BAA4B,+CAA+C;AAAA,EACvF;AACA,SAAO;AAAA,IACL,YAAY,MAAM;AAAA,IAClB,SAAS,gBAAgB,MAAM,SAAS,mCAAmC;AAAA,IAC3E,aAAa,MAAM;AAAA,IACnB,QACE,MAAM,WAAW,OACb,OACA,mBAAmB,MAAM,QAAQ,GAAG,KAAK,8BAA8B;AAAA,EAC/E;AACF;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,MAAI,OAAO,WAAW,KAAK,IAAI,OAAQ;AACrC,UAAM,IAAI,4BAA4B,sCAAsC;AAAA,EAC9E;AACA,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,KAAK;AAAA,EACrB,QAAQ;AACN,UAAM,IAAI,4BAA4B,oCAAoC;AAAA,EAC5E;AACA,MACE,CAAC,CAAC,SAAS,UAAU,SAAS,EAAE,SAAS,IAAI,QAAQ,KACrD,CAAC,IAAI,YACJ,CAAC,IAAI,QAAQ,IAAI,aAAa,WAAW,IAAI,aAAa,YAC1D,IAAI,aAAa,MAAM,IAAI,aAAa,OACzC,IAAI,UACJ,IAAI,MACJ;AACA,UAAM,IAAI,4BAA4B,oCAAoC;AAAA,EAC5E;AACA,SAAO,IAAI,SAAS;AACtB;AAEA,SAAS,yBACP,WACA,OACA;AACA,SAAO;AAAA,IACL,sBAAsB,UAAU;AAAA,IAChC,iBAAiB,oBAAoB,MAAM,iBAAiB,kBAAkB;AAAA,IAC9E,cAAc,aAAa,MAAM,cAAc,eAAe;AAAA,IAC9D,WAAW,aAAa,MAAM,WAAW,YAAY;AAAA,EACvD;AACF;AAWA,SAAS,yBACP,OACA,WACA,YACqC;AACrC,MACE,CAACA,UAAS,KAAK,KACf,MAAM,qBAAqB,UAAU,oBACpC,eAAe,aAAa,MAAM,yBAAyB,UAAU,wBACtE,CAAC,qCAAqC;AAAA,IACpC,MAAM;AAAA,EACR,KACA,EAAE,MAAM,gBAAgB,QAAQ,OAAO,MAAM,gBAAgB,aAC7D,CAAC,MAAM,QAAQ,MAAM,mBAAmB,KACxC,MAAM,oBAAoB,SAAS,MACnC,CAAC,MAAM,oBAAoB;AAAA,IACzB,CAAC,SAAS,OAAO,SAAS,YAAY,sCAAsC,KAAK,IAAI;AAAA,EACvF,GACA;AACA,UAAM,IAAI,4BAA4B,kDAAkD;AAAA,EAC1F;AACA,SAAO;AAAA,IACL,kBAAkB,UAAU;AAAA,IAC5B,sBACE,eAAe,YACX,UAAU,uBACV,kBAAkB,MAAM,oBAAoB;AAAA,IAClD,aAAa,YAAY,MAAM,aAAa,0BAA0B;AAAA,IACtE,gBAAgBE,QAAO,MAAM,gBAAgB,8BAA8B;AAAA,IAC3E,OAAO,MAAM;AAAA,IACb,aACE,MAAM,gBAAgB,OAAO,OAAO,gBAAgB,MAAM,aAAa,cAAc;AAAA,IACvF,qBAAqB,MAAM;AAAA,IAC3B,WAAW,UAAU,MAAM,WAAW,qBAAqB;AAAA,IAC3D,WAAW,UAAU,MAAM,WAAW,qBAAqB;AAAA,EAC7D;AACF;AAEA,SAAS,2BACP,OACA,WACuC;AACvC,MACE,CAACF,UAAS,KAAK,KACf,MAAM,qBAAqB,UAAU,oBACrC,MAAM,yBAAyB,UAAU,wBACzC,OAAO,MAAM,sBAAsB,aACnC,OAAO,MAAM,2BAA2B,aACxC,EAAE,MAAM,iBAAiB,QAAQ,OAAO,MAAM,iBAAiB,cAC/D,EACE,MAAM,YAAY,QAClB,8BAA8B,SAAS,MAAM,OAA6C,IAE5F;AACA,UAAM,IAAI,4BAA4B,oDAAoD;AAAA,EAC5F;AACA,MAAI,WAA8D;AAClE,MAAI,MAAM,aAAa,MAAM;AAC3B,QAAI,CAACA,UAAS,MAAM,QAAQ,GAAG;AAC7B,YAAM,IAAI,4BAA4B,kDAAkD;AAAA,IAC1F;AACA,eAAW;AAAA,MACT,QAAQE,QAAO,MAAM,SAAS,QAAQ,8BAA8B;AAAA,MACpE,SAAS,uBAAuB,MAAM,SAAS,SAAS,sBAAsB;AAAA,MAC9E,OAAO,uBAAuB,MAAM,SAAS,OAAO,oBAAoB;AAAA,MACxE,UAAU,2BAA2B,MAAM,SAAS,QAAQ;AAAA,IAC9D;AAAA,EACF;AACA,MAAI,UAA4D;AAChE,MAAI,MAAM,YAAY,MAAM;AAC1B,UAAM,MAAM,MAAM;AAClB,QACE,CAACF,UAAS,GAAG,KACb,CAAC,CAAC,UAAU,WAAW,UAAU,OAAO,EAAE,SAAS,IAAI,MAAgB,KACvE,OAAO,IAAI,UAAU,YACrB,OAAO,IAAI,2BAA2B,aACtC,OAAO,IAAI,qBAAqB,aAChC,EAAE,IAAI,2BAA2B,QAAQ,OAAO,IAAI,2BAA2B,aAC/E,EAAE,IAAI,aAAa,QAAQA,UAAS,IAAI,QAAQ,IAChD;AACA,YAAM,IAAI,4BAA4B,iDAAiD;AAAA,IACzF;AACA,cAAU;AAAA,MACR,aAAa,YAAY,IAAI,aAAa,4BAA4B;AAAA,MACtE,QAAQ,IAAI;AAAA,MACZ,OAAO,gBAAgB,IAAI,OAAO,+BAA+B;AAAA,MACjE,wBAAwB,IAAI;AAAA,MAC5B,kBAAkB,IAAI;AAAA,MACtB,wBAAwB,IAAI,2BAA2B;AAAA,MACvD,UAAUA,UAAS,IAAI,QAAQ,IAC3B;AAAA,QACE,aAAa,YAAY,IAAI,SAAS,aAAa,0BAA0B;AAAA,QAC7E,gBAAgBE,QAAO,IAAI,SAAS,gBAAgB,8BAA8B;AAAA,MACpF,IACA;AAAA,IACN;AAAA,EACF;AACA,SAAO;AAAA,IACL,kBAAkB,UAAU;AAAA,IAC5B,sBAAsB,UAAU;AAAA,IAChC,mBAAmB,MAAM;AAAA,IACzB,SAAS,MAAM;AAAA,IACf;AAAA,IACA,wBAAwB,MAAM;AAAA,IAC9B,cAAc,MAAM;AAAA,IACpB;AAAA,IACA,gBACE,MAAM,mBAAmB,QAAQ,MAAM,mBAAmB,SACtD,OACA,yBAAyB,MAAM,gBAAgB,WAAW,UAAU;AAAA,EAC5E;AACF;AAEA,SAAS,yBAAyB,OAAqD;AACrF,MAAI,CAACF,UAAS,KAAK,KAAK,CAACA,UAAS,MAAM,QAAQ,GAAG;AACjD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,WAAW,MAAM;AACvB,MAAI,CAAC,MAAM,QAAQ,SAAS,IAAI,GAAG;AACjC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,mBAAmB,YAAY,MAAM,kBAAkB,oBAAoB;AACjF,QAAM,uBAAuB,kBAAkB,MAAM,oBAAoB;AACzE,QAAM,oBAAoB;AAAA,IACxB,SAAS;AAAA,IACT;AAAA,EACF;AACA,QAAM,+BAA+B,kBAAkB,SAAS,oBAAoB;AACpF,MACE,sBAAsB,oBACtB,iCAAiC,sBACjC;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MACE,MAAM,WAAW,mCACjB,SAAS,kBAAkB,KAC1B,SAAS,WAAW,cAAc,SAAS,WAAW,YACtD,SAAS,aAAa,WACrB,SAAS,aAAa,WACtB,SAAS,aAAa,aACvB,SAAS,iBAAiB,SAAS,SAAS,iBAAiB,SAC9D;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MACE,SAAS,kBAAkB,oBAC3B,SAAS,kBAAkB,4BAC3B,SAAS,kBAAkB,kBAC3B;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,OAAO,SAAS,KAAK,IAAI,CAAC,QAAQ;AACtC,QAAI,CAACA,UAAS,GAAG,KAAK,OAAO,IAAI,aAAa,WAAW;AACvD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,KAAK,WAAW,IAAI,GAAG,GAAG,UAAU,IAAI,SAAS;AAAA,EAC5D,CAAC;AACD,MAAI,KAAK,SAAS,OAAS,KAAK,OAAO,CAAC,QAAQ,IAAI,QAAQ,EAAE,SAAS,GAAG;AACxE,UAAM,IAAI,4BAA4B,wDAAwD;AAAA,EAChG;AACA,SAAO;AAAA,IACL,aAAa,YAAY,MAAM,aAAa,4BAA4B;AAAA,IACxE;AAAA,IACA;AAAA,IACA,WAAW,sBAAsB,MAAM,SAAS;AAAA,IAChD,QAAQ;AAAA,IACR,gBAAgBE,QAAO,MAAM,gBAAgB,+BAA+B;AAAA,IAC5E,eAAeA,QAAO,MAAM,eAAe,8BAA8B;AAAA,IACzE,WAAW,oBAAoB,MAAM,WAAW,6BAA6B;AAAA,IAC7E,WAAW,uBAAuB,MAAM,WAAW,0BAA0B;AAAA,IAC7E,cAAc,uBAAuB,MAAM,cAAc,4BAA4B;AAAA,IACrF,UAAU;AAAA,MACR,eAAe;AAAA,MACf,kBAAkB;AAAA,MAClB,sBAAsB;AAAA,MACtB,YAAY,UAAU,SAAS,YAAY,4BAA4B;AAAA,MACvE,QAAQ,SAAS;AAAA,MACjB,eACE,SAAS,kBAAkB,OACvB,OACA,gBAAgB,SAAS,eAAe,wBAAwB;AAAA,MACtE,UAAU,gBAAgB,SAAS,UAAU,mBAAmB;AAAA,MAChE,qBAAqB;AAAA,QACnB,SAAS;AAAA,QACT;AAAA,MACF;AAAA,MACA,eAAe,SAAS;AAAA,MACxB,UAAU,SAAS;AAAA,MACnB,cAAc,SAAS;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,OAAwB;AACrD,MACE,OAAO,UAAU,YACjB,OAAO,WAAW,KAAK,IAAI,QAC3B,CAAC,kJAAkJ;AAAA,IACjJ;AAAA,EACF,GACA;AACA,UAAM,IAAI,WAAW,qCAAqC;AAAA,EAC5D;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,OAAyC;AACxE,MAAI,CAACF,UAAS,KAAK,KAAK,CAACA,UAAS,MAAM,eAAe,GAAG;AACxD,UAAM,IAAI,WAAW,uCAAuC;AAAA,EAC9D;AACA,QAAM,MAAM,WAAW,MAAM,GAAG;AAChC,QAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,MACG,OAAO,aAAa,YAAY,OAAO,aAAa,WACrD,OAAO,YACP,OAAO,YACP,OAAO,MACP;AACA,UAAM,IAAI,WAAW,qCAAqC;AAAA,EAC5D;AACA,QAAM,UAAkC,CAAC;AACzC,aAAW,CAAC,MAAM,WAAW,KAAK,OAAO,QAAQ,MAAM,eAAe,GAAG;AACvE,QACG,SAAS,kBAAkB,SAAS,oBACrC,OAAO,gBAAgB,YACvB,UAAU,KAAK,WAAW,GAC1B;AACA,YAAM,IAAI,WAAW,wCAAwC;AAAA,IAC/D;AACA,YAAQ,IAAI,IAAI;AAAA,EAClB;AACA,MAAI,OAAO,KAAK,OAAO,EAAE,SAAS,KAAK,OAAO,KAAK,OAAO,EAAE,SAAS,GAAG;AACtE,UAAM,IAAI,WAAW,8CAA8C;AAAA,EACrE;AACA,MAAI,QAAQ,cAAc,MAAM,qCAAqC;AACnE,UAAM,IAAI,WAAW,8CAA8C;AAAA,EACrE;AACA,SAAO;AAAA,IACL,KAAK,OAAO,SAAS;AAAA,IACrB,iBAAiB;AAAA,IACjB,WAAW,UAAU,MAAM,WAAW,6BAA6B;AAAA,EACrE;AACF;AAEA,SAAS,0BAA0B,OAA2C;AAC5E,MAAI,CAACA,UAAS,KAAK,GAAG;AACpB,UAAM,IAAI,WAAW,yCAAyC;AAAA,EAChE;AACA,QAAM,MAAM,WAAW,MAAM,GAAG;AAChC,QAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,MACG,OAAO,aAAa,YAAY,OAAO,aAAa,WACrD,OAAO,YACP,OAAO,YACP,OAAO,MACP;AACA,UAAM,IAAI,WAAW,uCAAuC;AAAA,EAC9D;AACA,SAAO;AAAA,IACL,KAAK,OAAO,SAAS;AAAA,IACrB,WAAW,UAAU,MAAM,WAAW,+BAA+B;AAAA,EACvE;AACF;AAEA,SAAS,2BAA2B,OAIlC;AACA,MAAI,MAAM,WAAW,iCAAiC;AACpD,UAAM,IAAI,WAAW,6CAA6C;AAAA,EACpE;AACA,QAAM,UAAU,OAAO,KAAK,WAAW,MAAM,SAAS,IAAI,wBAAwB,CAAC;AACnF,QAAM,MAAM,OAAO,KAAK,aAAa,MAAM,KAAK,GAAG,KAAK,MAAM,+BAA+B,CAAC;AAC9F,MAAI;AACF,WAAO;AAAA,MACL,MAAM;AAAA,QACJ,WAAW,sBAAsB,MAAM,SAAS;AAAA,QAChD,QAAQ;AAAA,QACR,gBAAgBE,QAAO,MAAM,gBAAgB,+BAA+B;AAAA,QAC5E,eAAeA,QAAO,MAAM,eAAe,8BAA8B;AAAA,QACzE,gBAAgBA,QAAO,MAAM,gBAAgB,+BAA+B;AAAA,QAC5E,WAAW,oBAAoB,MAAM,WAAW,6BAA6B;AAAA,QAC7E,eAAe,QAAQ,SAAS,QAAQ;AAAA,QACxC,WAAW,IAAI,SAAS,QAAQ;AAAA,QAChC,iBAAiB,+BAA+B,MAAM,MAAM,eAAe;AAAA,QAC3E,UAAU,0BAA0B,MAAM,QAAQ;AAAA,MACpD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,KAAK,CAAC;AACd,QAAI,KAAK,CAAC;AACV,UAAM;AAAA,EACR;AACF;AAEA,SAAS,WAAW,OAAmB,QAAgB,OAA2B;AAChF,SAAO,aAAa,OAAO,QAAQ,QAAQ,KAAK;AAClD;AAEA,SAAS,aACP,OACA,SACA,SACA,OACY;AACZ,MAAI,EAAE,iBAAiB,eAAe,MAAM,aAAa,WAAW,MAAM,aAAa,SAAS;AAC9F,UAAM,IAAI,WAAW,GAAG,KAAK,aAAa;AAAA,EAC5C;AACA,SAAO;AACT;AAEA,SAASA,QAAO,OAAgB,OAAuB;AACrD,MAAI,OAAO,UAAU,YAAY,CAAC,eAAe,KAAK,KAAK,GAAG;AAC5D,UAAM,IAAI,4BAA4B,GAAG,KAAK,aAAa;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,SAAS,oCAAoC,SAA+C;AAC1F,QAAM,kBACJ,OAAO,QAAQ,0BAA0B,cACzC,OAAO,QAAQ,cAAc,eAC3B,OAAO,QAAQ,SAAS,cAAc,OAAO,QAAQ,gBAAgB,eACrE,OAAO,QAAQ,eAAe;AAClC,MACG,OAAO,QAAQ,SAAS,cAAc,OAAO,QAAQ,gBAAgB,cACtE,CAAC,iBACD;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,+BAA+B,SAA+C;AACrF,QAAM,UAAU,OAAO,QAAQ,SAAS,cAAc,OAAO,QAAQ,gBAAgB;AACrF,QAAM,kBACJ,OAAO,QAAQ,0BAA0B,cACzC,OAAO,QAAQ,cAAc,cAC5B,WAAW,OAAO,QAAQ,eAAe;AAC5C,MACE,OAAO,QAAQ,kBAAkB,cACjC,OAAO,QAAQ,uBAAuB,eACrC,CAAC,WAAW,CAAC,kBACd;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,yBAAyB,OAAyB;AACzD,SACE,iBAAiB,SACjB,kGAAkG;AAAA,IAChG,MAAM;AAAA,EACR;AAEJ;AAEA,eAAe,iBACb,SACA,OAKA,YAAY,KACG;AACf,MAAI,QAAQ,uBAAuB;AACjC,UAAM,QAAQ,sBAAsB,KAAK;AACzC;AAAA,EACF;AACA,MAAI,QAAQ,WAAW;AACrB,QAAI;AACF,YAAM,QAAQ,UAAU,KAAK;AAC7B;AAAA,IACF,SAAS,OAAO;AACd,UACE,CAAC,yBAAyB,KAAK,KAC9B,CAAC,QAAQ,QAAQ,CAAC,QAAQ,eAC3B,CAAC,QAAQ,YACT;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAK,CAAC,QAAQ,QAAQ,CAAC,QAAQ,eAAgB,CAAC,QAAQ,YAAY;AAClE,UAAM,IAAI,+BAA+B,iDAAiD;AAAA,EAC5F;AACA,QAAM,OAAO,oBAAoB,MAAM,MAAM,2BAA2B;AACxE,QAAM,QAAQ,OAAO,MAAM,YAAY,WAAW,OAAO,KAAK,MAAM,OAAO,IAAI,MAAM;AACrF,MAAI,MAAM,aAAa,gCAAgC;AACrD,UAAM,IAAI,WAAW,mCAAmC;AAAA,EAC1D;AACA,QAAM,SAASG,WAAU,QAAQ,IAAI;AACrC,MAAI,MAAM,eAAe;AACvB,UAAM;AAAA,MACJ;AAAA,MACA,oCAAoCR,YAAW,MAAM,CAAC;AAAA,IAAmBA,YAAW,UAAU,CAAC;AAAA,MAC/F;AAAA,IACF;AAAA,EACF;AACA,MAAI,MAAM,eAAe,GAAG;AAC1B,UAAM;AAAA,MACJ;AAAA,MACA,kBAAkBA,YAAW,IAAI,CAAC,mBAAmBA,YAAW,IAAI,CAAC;AAAA,IAAmBA,YAAW,UAAU,CAAC;AAAA,MAC9G;AAAA,IACF;AACA;AAAA,EACF;AAMA,QAAM,UAAU,OAAO,KAAK,KAAK,EAAE,SAAS,QAAQ;AACpD,QAAM,UAAU;AAAA,IACd;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB,QAAQ,MAAM,0CAA0CA,YAAW,IAAI,CAAC;AAAA,IACzF,iBAAiBA,YAAW,IAAI,CAAC;AAAA,IACjC;AAAA,IAAiBA,YAAW,UAAU,CAAC;AAAA,EACzC,EAAE,KAAK,GAAG;AACV,QAAM,UAAU,QAAQ,OACpB,MAAM,QAAQ,KAAK;AAAA,IACjB,KAAK;AAAA,IACL,SAAS,2BAA2B,OAAO;AAAA,IAC3C,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB,CAAC,IACD,MAAM,QAAQ,YAAa;AAAA,IACzB,KAAK;AAAA,IACL,SAAS,2BAA2B,OAAO;AAAA,IAC3C,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB,CAAC;AACL,QAAM,mBACJ,OAAO,YAAY,YACd,MAAM;AACL,UAAM,SAAS,wBAAwB,OAAO;AAC9C,WAAO,OAAO,SAAS,YAAY,OAAO,YAAY;AAAA,EACxD,GAAG,IACH,OAAO,cAAc,QAAQ,SAAS,MAAM,QAAQ,aAAa,OAAO,IACtE,QAAQ,YACR;AACR,MAAI,qBAAqB,MAAM;AAC7B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,MAAM,QAAQ,WAAW;AAAA,IACtC,WAAW;AAAA,IACX,OAAO;AAAA,IACP,aAAaE,gBAAe,SAAS;AAAA,IACrC,iBAAiB;AAAA,EACnB,CAAC;AACD,QAAM,WAAW,wBAAwB,MAAM;AAC/C,MACE,SAAS,SAAS,aAClB,SAAS,SAAS,aACjB,SAAS,SAAS,YAAY,SAAS,aAAa,KACrD,CAAC,OAAO,SAAS,UAAU,GAC3B;AACA,UAAM,IAAI,6BAA6B,uCAAuC;AAAA,EAChF;AACF;AAEA,eAAe,WACb,SACA,SACA,YAAY,KACG;AACf,QAAM,UAAUA,gBAAe,SAAS;AACxC,QAAM,SAAS,QAAQ,OACnB,MAAM,QAAQ,KAAK;AAAA,IACjB,KAAK;AAAA,IACL,SAAS,2BAA2B,OAAO;AAAA,IAC3C,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB,CAAC,IACD,MAAM,QAAQ,YAAa;AAAA,IACzB,KAAK;AAAA,IACL,SAAS,2BAA2B,OAAO;AAAA,IAC3C,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB,CAAC;AACL,QAAM,SAAS,cAAc,MAAM;AACnC,QAAM,WAAW,OAAO,WAAW,YAAY,SAAS,OAAO,WAAW;AAC1E,MAAK,OAAO,aAAa,YAAY,aAAa,KAAM,CAAC,OAAO,SAAS,UAAU,GAAG;AACpF,UAAM,IAAI,6BAA6B,kCAAkC;AAAA,EAC3E;AACF;AAEA,eAAe,cACb,SACA,SACe;AACf,MAAI;AACF,QAAI,QAAQ,MAAM;AAChB,YAAM,QAAQ,KAAK;AAAA,QACjB,KAAK;AAAA,QACL,SAAS,2BAA2B,OAAO;AAAA,QAC3C,aAAa;AAAA,QACb,iBAAiB;AAAA,MACnB,CAAC;AAAA,IACH,WAAW,QAAQ,aAAa;AAC9B,YAAM,QAAQ,YAAY;AAAA,QACxB,KAAK;AAAA,QACL,SAAS,2BAA2B,OAAO;AAAA,QAC3C,aAAa;AAAA,QACb,iBAAiB;AAAA,MACnB,CAAC;AAAA,IACH;AAAA,EACF,QAAQ;AAAA,EAER;AACF;AAEA,eAAe,SACb,SACA,MACA,UACA,WACiB;AACjB,QAAM,cAAc,oBAAoB,MAAM,+BAA+B;AAC7E,MACE,CAAC,OAAO,cAAc,QAAQ,KAC9B,WAAW,KACX,WAAW,iCAAiC,GAC5C;AACA,UAAM,IAAI,WAAW,2CAA2C;AAAA,EAClE;AACA,MAAI,QAAQ,UAAU;AACpB,QAAI;AACF,YAAM,QAAQ,MAAM,QAAQ,SAAS,EAAE,MAAM,aAAa,SAAS,CAAC;AACpE,aAAO,OAAO,UAAU,WACpB,QACA,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,KAAK;AAAA,IAC5D,QAAQ;AAAA,IAIR;AAAA,EACF;AAEA,QAAM,aAAa,iCAAiCH,YAAW,CAAC;AAChE,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,MACE;AAAA,MACA,kBAAkBC,YAAW,WAAW,CAAC;AAAA,MACzC,mBAAmBA,YAAW,UAAU,CAAC,YAAYA,YAAW,UAAU,CAAC;AAAA,IAC7E,EAAE,KAAK,GAAG;AAAA,IACV;AAAA,IACA;AAAA,EACF;AACA,QAAM,WAAW,mBAAmB,YAAY,UAAU;AAC1D,QAAM,OAAO,qBAAqB,UAAU,+BAA+B;AAC3E,QAAM,iBAAiB,KAAK,IAAI,MAAM,QAAQ;AAC9C,MAAI,mBAAmB,EAAG,QAAO;AAEjC,QAAM,SAAmB,CAAC;AAC1B,WAAS,SAAS,GAAG,SAAS,gBAAgB,UAAU,0BAA0B;AAChF,UAAM,aAAa,KAAK,MAAM,SAAS,wBAAwB;AAC/D,UAAM,gBAAgB,KAAK,IAAI,0BAA0B,iBAAiB,MAAM;AAChF,UAAM,SAAS,kCAAkCD,YAAW,CAAC;AAC7D,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,QACE;AAAA,QACA,eAAeC,YAAW,MAAM,CAAC;AAAA,QACjC,SAASA,YAAW,WAAW,CAAC,OAAO,wBAAwB,SAAS,UAAU;AAAA,QAClF,eAAeA,YAAW,MAAM,CAAC;AAAA,MACnC,EAAE,KAAK,GAAG;AAAA,MACV,KAAK,KAAM,gBAAgB,IAAK,CAAC,IAAI;AAAA,MACrC;AAAA,IACF;AACA,UAAM,UAAU,mBAAmB,QAAQ,MAAM;AACjD,QAAI,CAAC,oEAAoE,KAAK,OAAO,GAAG;AACtF,YAAM,IAAI,6BAA6B,8CAA8C;AAAA,IACvF;AACA,UAAM,UAAU,OAAO,KAAK,SAAS,QAAQ;AAC7C,QAAI,QAAQ,aAAa,eAAe;AACtC,YAAM,IAAI,6BAA6B,8CAA8C;AAAA,IACvF;AACA,WAAO,KAAK,QAAQ,SAAS,GAAG,aAAa,CAAC;AAAA,EAChD;AACA,SAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,OAAO,OAAO,MAAM,CAAC;AAC/E;AAEA,eAAe,UACb,SACA,MACA,UACA,WACqB;AACrB,QAAM,cAAc,oBAAoB,MAAM,sCAAsC;AACpF,MACE,CAAC,OAAO,cAAc,QAAQ,KAC9B,WAAW,KACX,WAAW,KAAK,IAAI,KAAK,OAAO,MAAM,6BAA6B,GACnE;AACA,UAAM,IAAI,WAAW,kDAAkD;AAAA,EACzE;AACA,QAAM,aAAa,iCAAiCD,YAAW,CAAC;AAChE,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,MACE;AAAA,MACA,kBAAkBC,YAAW,WAAW,CAAC;AAAA,MACzC,mBAAmBA,YAAW,UAAU,CAAC,YAAYA,YAAW,UAAU,CAAC;AAAA,IAC7E,EAAE,KAAK,GAAG;AAAA,IACV;AAAA,IACA;AAAA,EACF;AACA,QAAM,OAAO;AAAA,IACX,mBAAmB,YAAY,UAAU;AAAA,IACzC;AAAA,EACF;AACA,MAAI,OAAO,KAAK,OAAO,UAAU;AAC/B,UAAM,IAAI,WAAW,8BAA8B;AAAA,EACrD;AACA,QAAM,SAAmB,CAAC;AAC1B,WAAS,SAAS,GAAG,SAAS,MAAM,UAAU,0BAA0B;AACtE,UAAM,aAAa,KAAK,MAAM,SAAS,wBAAwB;AAC/D,UAAM,gBAAgB,KAAK,IAAI,0BAA0B,OAAO,MAAM;AACtE,UAAM,SAAS,kCAAkCD,YAAW,CAAC;AAC7D,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,QACE;AAAA,QACA,eAAeC,YAAW,MAAM,CAAC;AAAA,QACjC,SAASA,YAAW,WAAW,CAAC,OAAO,wBAAwB,SAAS,UAAU;AAAA,QAClF,eAAeA,YAAW,MAAM,CAAC;AAAA,MACnC,EAAE,KAAK,GAAG;AAAA,MACV,KAAK,KAAM,gBAAgB,IAAK,CAAC,IAAI;AAAA,MACrC;AAAA,IACF;AACA,UAAM,UAAU,mBAAmB,QAAQ,MAAM;AACjD,QAAI,CAAC,oEAAoE,KAAK,OAAO,GAAG;AACtF,YAAM,IAAI,6BAA6B,qDAAqD;AAAA,IAC9F;AACA,UAAM,UAAU,OAAO,KAAK,SAAS,QAAQ;AAC7C,QAAI,QAAQ,eAAe,eAAe;AACxC,YAAM,IAAI,6BAA6B,qDAAqD;AAAA,IAC9F;AACA,WAAO,KAAK,OAAO;AAAA,EACrB;AACA,SAAO,WAAW,KAAK,OAAO,OAAO,MAAM,CAAC;AAC9C;AAEA,eAAe,sBACb,SACA,SACA,iBACA,WACiB;AACjB,QAAM,UAAUE,gBAAe,SAAS;AACxC,QAAM,SAAS,QAAQ,OACnB,MAAM,QAAQ,KAAK;AAAA,IACjB,KAAK;AAAA,IACL,SAAS,2BAA2B,OAAO;AAAA,IAC3C,aAAa;AAAA,IACb;AAAA,EACF,CAAC,IACD,MAAM,QAAQ,YAAa;AAAA,IACzB,KAAK;AAAA,IACL,SAAS,2BAA2B,OAAO;AAAA,IAC3C,aAAa;AAAA,IACb;AAAA,EACF,CAAC;AACL,QAAM,WAAW,OAAO,WAAW,YAAY,SAAS,OAAO,WAAW;AAC1E,MAAI,OAAO,WAAW,YAAY,QAAQ,cAAc,QAAW;AACjE,UAAM,IAAI,6BAA6B,sCAAsC;AAAA,EAC/E;AACA,MAAI,OAAO,WAAW,UAAU;AAC9B,UAAM,WAAW,wBAAwB,MAAM;AAC/C,QACE,SAAS,SAAS,aAClB,SAAS,SAAS,aACjB,SAAS,SAAS,YAAY,SAAS,aAAa,GACrD;AACA,YAAM,IAAI,6BAA6B,sCAAsC;AAAA,IAC/E;AACA,WAAO;AAAA,EACT;AACA,MAAI,OAAO,aAAa,YAAY,aAAa,GAAG;AAClD,UAAM,IAAI,6BAA6B,sCAAsC;AAAA,EAC/E;AACA,SAAO,OAAO,UAAU,OAAO,UAAU;AAC3C;AAEA,SAAS,mBAAmB,QAAgB,QAAwB;AAClE,QAAM,QAAQ,OAAO,QAAQ,MAAM;AACnC,MAAI,QAAQ,GAAG;AACb,UAAM,IAAI,6BAA6B,2CAA2C;AAAA,EACpF;AACA,QAAM,aAAa,QAAQ,OAAO;AAClC,QAAM,MAAM,OAAO,QAAQ,QAAQ,UAAU;AAC7C,MAAI,MAAM,GAAG;AACX,UAAM,IAAI,6BAA6B,+CAA+C;AAAA,EACxF;AACA,SAAO,OAAO,MAAM,YAAY,GAAG;AACrC;AAEA,SAAS,cAAc,QAAyC;AAC9D,MAAI,OAAO,WAAW,SAAU,QAAO;AACvC,SAAO,CAAC,OAAO,QAAQ,OAAO,QAAQ,OAAO,MAAM,EAChD,OAAO,CAAC,SAAyB,OAAO,SAAS,QAAQ,EACzD,KAAK,IAAI;AACd;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,MAAI,YAAY,KAAK,KAAK,EAAG,OAAM,IAAI,4BAA4B,uBAAuB;AAC1F,SAAO,IAAI,MAAM,WAAW,MAAM,MAAM,EAAE,WAAW,KAAK,KAAK,CAAC;AAClE;AAEA,SAASF,YAAW,OAAuB;AACzC,SAAO,IAAI,MAAM,WAAW,KAAK,OAAO,CAAC;AAC3C;AAEA,SAAS,aAAa,OAAgB,OAAuB;AAC3D,MAAI,OAAO,UAAU,YAAY,CAAC,cAAc,KAAK,KAAK,GAAG;AAC3D,UAAM,IAAI,4BAA4B,GAAG,KAAK,aAAa;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,SAAS,YAAY,OAAgB,OAAuB;AAC1D,MACE,OAAO,UAAU,YACjB,CAAC,8EAA8E,KAAK,KAAK,GACzF;AACA,UAAM,IAAI,4BAA4B,GAAG,KAAK,aAAa;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,OAAwB;AACjD,MACE,OAAO,UAAU,YACjB,MAAM,SAAS,OACf,CAAC,iCAAiC,KAAK,KAAK,GAC5C;AACA,UAAM,IAAI,4BAA4B,kCAAkC;AAAA,EAC1E;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAgB,OAAuB;AAC9D,MACE,OAAO,UAAU,YACjB,MAAM,WAAW,KACjB,OAAO,WAAW,KAAK,IAAI,OAC3B,yBAAyB,KAAK,KAAK,GACnC;AACA,UAAM,IAAI,4BAA4B,GAAG,KAAK,aAAa;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,OAAwB;AACvD,MACE,OAAO,UAAU,YACjB,MAAM,SAAS,OACf,CAAC,iCAAiC,KAAK,KAAK,GAC5C;AACA,UAAM,IAAI,4BAA4B,mDAAmD;AAAA,EAC3F;AACA,SAAO;AACT;AAEA,SAAS,mBACP,OACA,SACA,SACA,OACQ;AACR,MACE,OAAO,UAAU,YACjB,OAAO,WAAW,KAAK,IAAI,WAC3B,OAAO,WAAW,KAAK,IAAI,WAC3B,yBAAyB,KAAK,KAAK,GACnC;AACA,UAAM,IAAI,4BAA4B,GAAG,KAAK,aAAa;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,SAAS,WAAW,OAAwB;AAC1C,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,KAAK,OAAO,WAAW,KAAK,IAAI,OAAQ;AACxF,UAAM,IAAI,4BAA4B,wBAAwB;AAAA,EAChE;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAwB;AAC/C,MAAI,OAAO,UAAU,SAAU,OAAM,IAAI,4BAA4B,2BAA2B;AAChG,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QAAI,IAAI,WAAW,UAAU,IAAI,aAAa,OAAO,IAAI,UAAU,IAAI,KAAM,OAAM,IAAI,MAAM;AAC7F,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,UAAM,IAAI,4BAA4B,2CAA2C;AAAA,EACnF;AACF;AAEA,SAAS,UAAU,OAAgB,OAAuB;AACxD,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,OAAO,CAAC,OAAO,SAAS,KAAK,MAAM,KAAK,CAAC,GAAG;AAC1F,UAAM,IAAI,4BAA4B,GAAG,KAAK,aAAa;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,OAAe,OAAuB;AACjE,MACE,CAAC,MAAM,WAAW,GAAG,KACrB,MAAM,SAAS,IAAI,KACnB,MAAM,SAAS,GAAG,KAClBQ,WAAU,UAAU,KAAK,MAAM,OAC/B;AACA,UAAM,IAAI,4BAA4B,GAAG,KAAK,aAAa;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,SAASV,aAAY,OAAuB;AAC1C,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,OAAQ;AAC/D,UAAM,IAAI,WAAW,oCAAoC;AAAA,EAC3D;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAAe,SAAiB,SAAiB,OAAuB;AAC9F,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,WAAW,QAAQ,SAAS;AACtE,UAAM,IAAI,WAAW,GAAG,KAAK,aAAa;AAAA,EAC5C;AACA,SAAO;AACT;AAEA,SAAS,0BACP,OACA,QAOQ;AACR,QAAM,MAAM,IAAI,IAAI,KAAK;AACzB,MAAI,OAAO,WAAW,OAAW,KAAI,aAAa,IAAI,UAAU,OAAO,MAAM;AAC7E,MAAI,OAAO,YAAY,QAAW;AAChC,QAAI,aAAa;AAAA,MACf;AAAA,MACA,OAAO,eAAe,OAAO,SAAS,GAAG,KAAK,uBAAuB,CAAC;AAAA,IACxE;AAAA,EACF;AACA,MAAI,OAAO,aAAa,QAAW;AACjC,QAAI,aAAa;AAAA,MACf;AAAA,MACA,OAAO,eAAe,OAAO,UAAU,GAAG,MAAO,qBAAqB,CAAC;AAAA,IACzE;AAAA,EACF;AACA,MAAI,OAAO,cAAc,QAAW;AAClC,QAAI,aAAa;AAAA,MACf;AAAA,MACA,OAAO,eAAe,OAAO,WAAW,GAAG,MAAO,sBAAsB,CAAC;AAAA,IAC3E;AAAA,EACF;AACA,MAAI,OAAO,kBAAkB,QAAW;AACtC,QAAI,aAAa;AAAA,MACf;AAAA,MACA,OAAO,eAAe,OAAO,eAAe,GAAG,IAAI,iCAAiC,CAAC;AAAA,IACvF;AAAA,EACF;AACA,SAAO,IAAI,SAAS;AACtB;AAEA,SAASI,gBAAe,OAAuB;AAC7C,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,wBAAwB;AAC/E,UAAM,IAAI,WAAW,uCAAuC;AAAA,EAC9D;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,OAAgB,OAAuB;AAClE,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAAG;AAC1E,UAAM,IAAI,WAAW,GAAG,KAAK,aAAa;AAAA,EAC5C;AACA,SAAO;AACT;AAEA,SAAS,uBAAuB,OAAgB,OAAuB;AACrE,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAAG;AAC1E,UAAM,IAAI,WAAW,GAAG,KAAK,aAAa;AAAA,EAC5C;AACA,SAAO;AACT;AAEA,SAAS,2BAA2B,OAA0B;AAC5D,MACE,CAAC,MAAM,QAAQ,KAAK,KACpB,MAAM,SAAS,MACf,CAAC,MAAM,MAAM,CAAC,UAAU,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,MAAM,UAAU,GAAG,GAC5F;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,CAAC,GAAG,KAAK;AAClB;AAEA,SAAS,qBAAqB,OAAe,OAAuB;AAClE,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,qBAAqB,KAAK,OAAO,GAAG;AACvC,UAAM,IAAI,4BAA4B,GAAG,KAAK,aAAa;AAAA,EAC7D;AACA,QAAM,SAAS,OAAO,OAAO;AAC7B,MAAI,CAAC,OAAO,cAAc,MAAM,GAAG;AACjC,UAAM,IAAI,4BAA4B,GAAG,KAAK,aAAa;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,QAAML,UAAS,qBAAqB,OAAO,aAAa;AACxD,MAAIA,UAAS,OAAOA,UAAS,KAAK;AAChC,UAAM,IAAI,4BAA4B,wBAAwB;AAAA,EAChE;AACA,SAAOA;AACT;AAEA,SAASM,UAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;AE/8HA;AAAA,EACE;AAAA,OAKK;AAQP,IAAM,0BAA0B;AAChC,IAAM,8BAA8B,KAAK;AACzC,IAAM,uBAAuB;AAC7B,IAAM,4BAA4B,OAAO;AACzC,IAAM,2BAA2B,IAAI,OAAO;AAC5C,IAAM,0BAA0B;AAIhC,IAAM,oBAAoB;AAC1B,IAAM,oBAAoB;AAC1B,IAAM,sBAAsB,oBAAI,IAAI;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,8BAA8B;AA0B7B,IAAM,+BAAN,cAA2C,MAAM;AAAA,EACtD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,WAAW,OAAuB;AACzC,SAAO,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE;AACzC;AAEA,SAASM,UAAS,OAAkD;AAClE,SAAO,QAAQ,KAAK,KAAK,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,oBAAoB,OAAgB,OAAe,UAAwB;AAClF,MAAI,UAAU,OAAW;AACzB,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI,6BAA6B,GAAG,KAAK,mBAAmB;AAAA,EACpE;AACA,MAAI,WAAW,KAAK,IAAI,UAAU;AAChC,UAAM,IAAI,6BAA6B,GAAG,KAAK,YAAY,QAAQ,QAAQ;AAAA,EAC7E;AACA,MAAI,OAAO,SAAS,IAAI,GAAG;AACzB,UAAM,IAAI,6BAA6B,GAAG,KAAK,sBAAsB;AAAA,EACvE;AACF;AAEA,SAAS,sBAAsB,OAAgB,OAAe,UAA0B;AACtF,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI,6BAA6B,GAAG,KAAK,mBAAmB;AAAA,EACpE;AACA,sBAAoB,OAAO,OAAO,QAAQ;AAC1C,SAAO;AACT;AAEA,SAAS,6BAA6B,OAAgB,OAAe,UAAwB;AAC3F,sBAAoB,OAAO,OAAO,QAAQ;AAC1C,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,KAAK,GAAG;AAC9C,UAAM,IAAI,6BAA6B,GAAG,KAAK,oBAAoB;AAAA,EACrE;AACF;AAEA,SAAS,oBAAoB,SAAkB,UAA8C;AAC3F,MAAI,YAAY,UAAa,CAAC,MAAM,QAAQ,OAAO,GAAG;AACpD,UAAM,IAAI,6BAA6B,6BAA6B;AAAA,EACtE;AACA,QAAM,aAAa,WAAW,CAAC;AAC/B,QAAM,aAAwC,CAAC;AAC/C,MAAI,YAAY,WAAW,WAAW,GAAG;AACvC,UAAM,IAAI,6BAA6B,8CAA8C;AAAA,EACvF;AACA,MAAI,WAAW,SAAS,yBAAyB;AAC/C,UAAM,IAAI;AAAA,MACR,oCAAoC,uBAAuB;AAAA,IAC7D;AAAA,EACF;AACA,aAAW,CAAC,OAAO,MAAM,KAAK,WAAW,QAAQ,GAAG;AAClD,QAAI,CAACA,UAAS,MAAM,GAAG;AACrB,YAAM,IAAI,6BAA6B,cAAc,KAAK,qBAAqB;AAAA,IACjF;AACA,UAAM,SAAS,OAAO;AACtB,QAAI,OAAO,WAAW,YAAY,CAAC,oBAAoB,IAAI,MAAM,GAAG;AAClE,YAAM,IAAI,6BAA6B,cAAc,KAAK,qBAAqB;AAAA,IACjF;AACA,iCAA6B,OAAO,gBAAgB,cAAc,KAAK,oBAAoB,GAAG;AAC9F,iCAA6B,OAAO,cAAc,cAAc,KAAK,kBAAkB,GAAG;AAC1F,iCAA6B,OAAO,UAAU,cAAc,KAAK,cAAc,IAAK;AACpF,iCAA6B,OAAO,SAAS,cAAc,KAAK,aAAa,IAAK;AAClF,QAAI,OAAO,WAAW,UAAa,CAAC,MAAM,QAAQ,OAAO,MAAM,GAAG;AAChE,YAAM,IAAI,6BAA6B,cAAc,KAAK,2BAA2B;AAAA,IACvF;AACA,UAAM,SAAS,OAAO,UAAU,CAAC;AACjC,QAAI,OAAO,SAAS,KAAK;AACvB,YAAM,IAAI,6BAA6B,cAAc,KAAK,8BAA8B;AAAA,IAC1F;AACA,eAAW,SAAS,QAAQ;AAC1B,4BAAsB,OAAO,cAAc,KAAK,WAAW,GAAG;AAC9D,UAAI,CAAC,MAAM,KAAK,GAAG;AACjB,cAAM,IAAI,6BAA6B,cAAc,KAAK,2BAA2B;AAAA,MACvF;AAAA,IACF;AACA,QAAI,OAAO,qBAAqB,QAAW;AACzC,YAAM,mBAAmB;AAAA,QACvB,OAAO;AAAA,QACP,cAAc,KAAK;AAAA,QACnB;AAAA,MACF;AACA,UAAI;AACJ,UAAI;AACF,cAAM,IAAI,IAAI,gBAAgB;AAAA,MAChC,QAAQ;AACN,cAAM,IAAI,6BAA6B,cAAc,KAAK,+BAA+B;AAAA,MAC3F;AACA,UAAI,IAAI,aAAa,YAAY,IAAI,aAAa,SAAS;AACzD,cAAM,IAAI;AAAA,UACR,cAAc,KAAK;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AACA,eAAW,KAAK;AAAA,MACd;AAAA,MACA,GAAI,OAAO,OAAO,mBAAmB,WACjC,EAAE,gBAAgB,OAAO,eAAe,IACxC,CAAC;AAAA,MACL,GAAI,OAAO,OAAO,iBAAiB,WAAW,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;AAAA,MACvF,GAAI,OAAO,SAAS,IAAI,EAAE,OAA2B,IAAI,CAAC;AAAA,MAC1D,GAAI,OAAO,OAAO,aAAa,WAAW,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;AAAA,MAC3E,GAAI,OAAO,OAAO,qBAAqB,WACnC,EAAE,kBAAkB,OAAO,iBAAiB,IAC5C,CAAC;AAAA,MACL,GAAI,OAAO,OAAO,YAAY,WAAW,EAAE,SAAS,OAAO,QAAQ,IAAI,CAAC;AAAA,IAC1E,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,SAAS,sBACP,YACA,UACM;AACN,MACE,WAAW,cAAc,SAAS,aAClC,WAAW,gBAAgB,SAAS,eACpC,WAAW,cAAc,SAAS,WAClC;AACA,UAAM,IAAI,6BAA6B,mDAAmD;AAAA,EAC5F;AACF;AAEA,SAAS,0BAA0B,MAAsB;AACvD,MACE,KAAK,WAAW,KAChB,KAAK,SAAS,OACd,KAAK,WAAW,GAAG,KACnB,KAAK,SAAS,IAAI,KAClB,KAAK,SAAS,IAAI,GAClB;AACA,UAAM,IAAI,6BAA6B,qCAAqC,IAAI,EAAE;AAAA,EACpF;AACA,QAAM,WAAW,KAAK,MAAM,GAAG;AAC/B,MAAI,SAAS,KAAK,CAAC,YAAY,QAAQ,WAAW,KAAK,YAAY,OAAO,YAAY,IAAI,GAAG;AAC3F,UAAM,IAAI,6BAA6B,qCAAqC,IAAI,EAAE;AAAA,EACpF;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,MAAc,OAAqB;AAChE,MAAI,CAAC,2BAA2B,KAAK,IAAI,GAAG;AAC1C,UAAM,IAAI,6BAA6B,WAAW,KAAK,KAAK,IAAI,EAAE;AAAA,EACpE;AACF;AAsBO,SAAS,kCACd,YACA,UACA,MAAY,oBAAI,KAAK,GACmB;AACxC,MAAI,CAACA,UAAS,UAAU,GAAG;AACzB,UAAM,IAAI,6BAA6B,6CAA6C;AAAA,EACtF;AACA,QAAM,YAAY;AAClB,MACE,UAAU,WAAW,QACrB,UAAU,WAAW,iBACrB,UAAU,WAAW,kBACrB;AACA,UAAM,IAAI,6BAA6B,6CAA6C;AAAA,EACtF;AACA,wBAAsB,WAAW,QAAQ;AACzC,MAAI,UAAU,WAAW,iBAAkB,QAAO;AAClD,QAAM,aAAa,oBAAoB,UAAU,YAAY,UAAU,WAAW,aAAa;AAC/F,MAAI,UAAU,WAAW,eAAe;AACtC,WAAO;AAAA,MACL,aAAa,CAAC;AAAA,MACd,OAAO,CAAC;AAAA,MACR,iBAAiB,CAAC;AAAA,MAClB,WAAW;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAACA,UAAS,UAAU,WAAW,GAAG;AACpC,UAAM,IAAI,6BAA6B,8CAA8C;AAAA,EACvF;AACA,QAAM,qBAAqB,OAAO,QAAQ,UAAU,WAAW;AAC/D,MAAI,mBAAmB,SAAS,yBAAyB;AACvD,UAAM,IAAI;AAAA,MACR,sCAAsC,uBAAuB;AAAA,IAC/D;AAAA,EACF;AACA,MAAI,aAAa;AACjB,QAAM,cAAsC,CAAC;AAC7C,aAAW,CAAC,MAAM,QAAQ,KAAK,oBAAoB;AACjD,0BAAsB,MAAM,iCAAiC;AAC7D,UAAM,QAAQ;AAAA,MACZ;AAAA,MACA,qCAAqC,IAAI;AAAA,MACzC;AAAA,IACF;AACA,UAAM,aAAa,WAAW,KAAK;AACnC,kBAAc;AACd,WAAO,eAAe,aAAa,MAAM;AAAA,MACvC;AAAA,MACA,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AAEA,MAAI,UAAU,UAAU,UAAa,CAAC,MAAM,QAAQ,UAAU,KAAK,GAAG;AACpE,UAAM,IAAI,6BAA6B,uCAAuC;AAAA,EAChF;AACA,QAAM,QAAQ,UAAU,SAAS,CAAC;AAClC,MAAI,MAAM,SAAS,sBAAsB;AACvC,UAAM,IAAI;AAAA,MACR,qCAAqC,oBAAoB;AAAA,IAC3D;AAAA,EACF;AACA,QAAM,QAAQ,oBAAI,IAAoB;AACtC,QAAM,kBAAkB,MAAM,IAAI,CAAC,MAAM,UAAU;AACjD,QAAI,CAACA,UAAS,IAAI,GAAG;AACnB,YAAM,IAAI,6BAA6B,uBAAuB,KAAK,oBAAoB;AAAA,IACzF;AACA,UAAM,OAAO;AAAA,MACX,sBAAsB,KAAK,MAAM,uBAAuB,KAAK,SAAS,GAAG;AAAA,IAC3E;AACA,UAAM,SAAS,KAAK,kBAAkB,OAAO;AAC7C,UAAM,YAAY,MAAM,IAAI,MAAM;AAClC,QAAI,cAAc,QAAW;AAC3B,YAAM,IAAI;AAAA,QACR,uCAAuC,SAAS,QAAQ,IAAI;AAAA,MAC9D;AAAA,IACF;AACA,UAAM,IAAI,QAAQ,IAAI;AACtB,UAAM,UAAU;AAAA,MACd,KAAK;AAAA,MACL,gCAAgC,IAAI;AAAA,MACpC;AAAA,IACF;AACA,UAAM,eAAe,WAAW,OAAO;AACvC,QAAI,KAAK,SAAS,UAAa,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AAC3E,YAAM,IAAI,6BAA6B,wCAAwC,IAAI,EAAE;AAAA,IACvF;AACA,kBAAc;AACd,WAAO,EAAE,MAAM,SAAS,MAAM,KAAK,QAAQ,OAAO;AAAA,EACpD,CAAC;AAED,MAAI,UAAU,oBAAoB,UAAa,CAACA,UAAS,UAAU,eAAe,GAAG;AACnF,UAAM,IAAI,6BAA6B,kDAAkD;AAAA,EAC3F;AACA,QAAM,kBAA0C,CAAC;AACjD,aAAW,CAAC,MAAM,cAAc,KAAK,OAAO,QAAQ,UAAU,mBAAmB,CAAC,CAAC,GAAG;AACpF,0BAAsB,MAAM,sCAAsC;AAClE,QAAI,OAAO,UAAU,eAAe,KAAK,aAAa,IAAI,GAAG;AAC3D,YAAM,IAAI;AAAA,QACR,sDAAsD,IAAI;AAAA,MAC5D;AAAA,IACF;AACA,UAAM,OAAO;AAAA,MACX,sBAAsB,gBAAgB,yCAAyC,IAAI,IAAI,GAAG;AAAA,IAC5F;AACA,QAAI,CAAC,MAAM,IAAI,KAAK,kBAAkB,OAAO,CAAC,GAAG;AAC/C,YAAM,IAAI;AAAA,QACR,+DAA+D,IAAI;AAAA,MACrE;AAAA,IACF;AACA,WAAO,eAAe,iBAAiB,MAAM;AAAA,MAC3C,OAAO;AAAA,MACP,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,MAAI,mBAAmB,SAAS,OAAO,KAAK,eAAe,EAAE,SAAS,yBAAyB;AAC7F,UAAM,IAAI;AAAA,MACR,+CAA+C,uBAAuB;AAAA,IACxE;AAAA,EACF;AACA,MAAI,aAAa,0BAA0B;AACzC,UAAM,IAAI;AAAA,MACR,mCAAmC,wBAAwB;AAAA,IAC7D;AAAA,EACF;AAEA,MAAI,YAAyB;AAC7B,MAAI,UAAU,cAAc,UAAa,UAAU,cAAc,MAAM;AACrE,UAAM,SAAS,sBAAsB,UAAU,WAAW,yBAAyB,GAAG;AACtF,gBAAY,IAAI,KAAK,MAAM;AAC3B,QAAI,CAAC,OAAO,SAAS,UAAU,QAAQ,CAAC,KAAK,UAAU,QAAQ,KAAK,IAAI,QAAQ,GAAG;AACjF,YAAM,IAAI,6BAA6B,qDAAqD;AAAA,IAC9F;AAAA,EACF;AACA,QAAM,YAAY,8BAA8B;AAAA,IAC9C,UAAU,QAAQ,SAAY,CAAC,IAAI,UAAU;AAAA,EAC/C;AACA,MAAI,CAAC,UAAU,SAAS;AAGtB,UAAM,IAAI,6BAA6B,wCAAwC;AAAA,EACjF;AAGA,SAAO;AAAA,IACL;AAAA,IACA,OAAO;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,UAAU,KAAK,SAAS,EAAE,KAAK,UAAU,KAAK,IAAI,CAAC;AAAA,EACzD;AACF;AAEA,SAAS,mBAAmB,OAAe,OAAuB;AAChE,MAAI,CAAC,yBAAyB,KAAK,KAAK,GAAG;AACzC,UAAM,IAAI,6BAA6B,GAAG,KAAK,oCAAoC;AAAA,EACrF;AACA,SAAO;AACT;AAEO,SAAS,kBAAkB,WAA2B;AAC3D,SAAO,iCAAiC,mBAAmB,WAAW,WAAW,CAAC;AACpF;AAEO,SAAS,yBAAyB,WAA2B;AAClE,SAAO,GAAG,kBAAkB,SAAS,CAAC;AACxC;AAEA,SAASC,YAAW,OAAuB;AACzC,SAAO,IAAI,MAAM,QAAQ,MAAM,OAAO,CAAC;AACzC;AAEA,SAAS,OAAO,OAAuB;AACrC,SAAO,OAAO,KAAK,OAAO,MAAM,EAAE,SAAS,QAAQ;AACrD;AAEA,SAAS,8BAAsC;AAC7C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAGA,SAAS,2BAA2B,MAAwB;AAC1D,QAAM,WAAWA,YAAW,GAAG,IAAI,gBAAgB;AACnD,QAAM,gBAAgBA,YAAW,GAAG,IAAI,mBAAmB;AAC3D,SAAO;AAAA,IACL;AAAA,IACA,YAAY,QAAQ;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,IACA,gCAAgC,aAAa;AAAA,IAC7C;AAAA,IACA;AAAA,IACA,2DAA2D,2BAA2B;AAAA,IACtF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB,aAAa;AAAA,IAC9B;AAAA,EACF;AACF;AAEA,SAAS,6BAAuC;AAC9C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAASC,UAAS,QAAyB;AACzC,MAAI,OAAO,WAAW,SAAU,QAAO;AACvC,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,YAAY;AAKlB,SAAO,CAAC,UAAU,QAAQ,UAAU,QAAQ,UAAU,MAAM,EACzD,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ,EAC5D,KAAK,IAAI;AACd;AAEA,eAAe,qBACb,SACA,KACA,eACe;AACf,QAAM,SAAS;AAAA;AAAA,EAAoB,GAAG;AAAA,aAAgB,iBAAiB;AACvE,QAAM,OAAwB;AAAA,IAC5B,KAAK;AAAA,6CAAsDD,YAAW,MAAM,CAAC;AAAA,IAC7E,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AACA,QAAM,SAAS,gBACX,MAAM,cAAc,SAAS,IAAI,IACjC,QAAQ,OACN,MAAM,QAAQ,KAAK,IAAI,IACvB,QAAQ,cACN,MAAM,QAAQ,YAAY,IAAI,IAC9B;AACR,MAAI,CAACC,UAAS,MAAM,EAAE,SAAS,iBAAiB,GAAG;AACjD,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACF;AAEA,eAAe,oBACb,SACA,WACA,cACA,SACA,eACe;AACf,QAAM;AAAA,IACJ;AAAA,IACA,sBAAsB,WAAW,cAAc,kCAAkC;AAAA,IACjF;AAAA,EACF;AACA,QAAM,UAAU,OAAO,OAAO;AAC9B,WAAS,SAAS,GAAG,SAAS,QAAQ,QAAQ,UAAU,mBAAmB;AACzE,UAAM,QAAQ,QAAQ,MAAM,QAAQ,SAAS,iBAAiB;AAC9D,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,aAAaD,YAAW,KAAK,CAAC,MAAM,4BAA4B,CAAC;AAAA,MACnE;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,qEAAqEA,YAAW,OAAO,WAAW,OAAO,CAAC,CAAC,CAAC;AAAA,IAC9G;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,WAAmB,cAAsB,SAAyB;AAI/F,QAAM,cAAc,CAAC,GAAG,OAAO,KAAK,cAAc,MAAM,CAAC,EACtD,IAAI,CAAC,SAAS,MAAM,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,EACxD,KAAK,EAAE;AACV,SAAO;AAAA,IACL,0CAA0CA,YAAW,WAAW,CAAC;AAAA,IACjE,6BAA6BA,YAAW,SAAS,CAAC;AAAA,IAClD;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAgBA,eAAsB,0BACpB,SACA,UACA,SACe;AACf,QAAM,OAAO,kBAAkB,QAAQ,SAAS;AAChD,QAAM,YAAY,mBAAmB,QAAQ,WAAW,WAAW;AACnE,MAAI,CAAC,OAAO,cAAc,QAAQ,mBAAmB,KAAK,QAAQ,sBAAsB,GAAG;AACzF,UAAM,IAAI,6BAA6B,oDAAoD;AAAA,EAC7F;AACA,QAAM,QAAQ,OAAO,WAAW;AAChC,QAAM,SAAS,GAAG,SAAS,IAAI,QAAQ,mBAAmB;AAC1D,QAAM,cAAc,GAAG,SAAS,IAAI,QAAQ,mBAAmB,IAAI,KAAK;AACxE,QAAM,QAAQ,GAAG,IAAI,oBAAoB,WAAW;AACpD,QAAM,UAAU,GAAG,IAAI,aAAa,WAAW;AAC/C,aAAW,QAAQ,SAAS,OAAO;AACjC,UAAM,OAAO,KAAK,QAAQ;AAC1B,QAAI,SAAS,UAAU,SAAS,QAAQ;AACtC,YAAM,IAAI,6BAA6B,wCAAwC,KAAK,IAAI,EAAE;AAAA,IAC5F;AAAA,EACF;AACA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,MACE;AAAA,MACA,eAAeA,YAAW,GAAG,IAAI,WAAW,CAAC;AAAA,MAC7C,iBAAiBA,YAAW,IAAI,CAAC,IAAIA,YAAW,GAAG,IAAI,WAAW,CAAC;AAAA,MACnE,aAAaA,YAAW,KAAK,CAAC;AAAA,MAC9B,eAAeA,YAAW,GAAG,KAAK,QAAQ,CAAC;AAAA,IAC7C,EAAE,KAAK,IAAI;AAAA,IACX,QAAQ;AAAA,EACV;AAEA,QAAM,mBAAmB;AAAA,IACvB,GAAG,OAAO,QAAQ,SAAS,WAAW,EAAE;AAAA,MACtC,CAAC,CAAC,MAAM,KAAK,MAAM,UAAU,IAAI,IAAIA,YAAW,KAAK,CAAC;AAAA,IACxD;AAAA,IACA,GAAG,OAAO,QAAQ,SAAS,eAAe,EAAE;AAAA,MAC1C,CAAC,CAAC,MAAM,IAAI,MAAM,UAAU,IAAI,IAAIA,YAAW,GAAG,OAAO,UAAU,IAAI,EAAE,CAAC;AAAA,IAC5E;AAAA,EACF;AACA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB,SAAS,IAAI,GAAG,iBAAiB,KAAK,IAAI,CAAC;AAAA,IAAO;AAAA,IACnE,QAAQ;AAAA,EACV;AACA,QAAM;AAAA,IACJ;AAAA,IACA,iBAAiBA,YAAW,GAAG,KAAK,MAAM,CAAC;AAAA,IAC3C,QAAQ;AAAA,EACV;AAEA,aAAW,QAAQ,SAAS,OAAO;AACjC,UAAM,YAAY,GAAG,KAAK;AAC1B,UAAM;AAAA,MACJ;AAAA,MACA,sBAAsB,WAAW,KAAK,MAAM,+CAA+C;AAAA,MAC3F,QAAQ;AAAA,IACV;AACA,UAAM,oBAAoB,SAAS,WAAW,KAAK,MAAM,KAAK,SAAS,QAAQ,aAAa;AAC5F,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE;AAAA,QACA,KAAK;AAAA,QACL,YAAYA,YAAW,KAAK,QAAQ,MAAM,CAAC;AAAA,MAC7C;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,EACF;AAEA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA;AAAA;AAAA,MAGE,6BAA6BA,YAAW,IAAI,CAAC;AAAA,MAC7C,qCAAqCA,YAAW,WAAW,CAAC;AAAA,MAC5D,+BAA+BA,YAAW,MAAM,CAAC;AAAA,MACjD,GAAG,2BAA2B,IAAI;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAI,QAAQ,2BACR;AAAA,QACE;AAAA,MACF,IACA,QAAQ,qBACN;AAAA,QACE;AAAA,MACF,IACA,QAAQ,6BACN;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,IACA,CAAC;AAAA,MACT,GAAG,2BAA2B;AAAA,IAChC,EAAE,KAAK,IAAI;AAAA,IACX,QAAQ;AAAA,EACV;AACF;AAEA,eAAsB,oBACpB,SACA,WACA,eACe;AACf,QAAM,OAAO,kBAAkB,SAAS;AACxC,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,MACE,WAAWA,YAAW,IAAI,CAAC;AAAA,MAC3B,GAAG,2BAA2B,IAAI,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE;AAAA,MAC7D,cAAcA,YAAW,GAAG,IAAI,UAAU,CAAC,IAAIA,YAAW,GAAG,IAAI,QAAQ,CAAC;AAAA,MAC1E,eAAeA,YAAW,GAAG,IAAI,WAAW,CAAC;AAAA,MAC7C,GAAG,2BAA2B,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE;AAAA,MACzD;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,IACX;AAAA,EACF;AACF;AAOA,eAAsB,8BACpB,SACA,SAIA,eACe;AACf,QAAM,OAAO,kBAAkB,QAAQ,SAAS;AAChD,QAAM,YAAY,mBAAmB,QAAQ,WAAW,WAAW;AACnE,MAAI,CAAC,OAAO,cAAc,QAAQ,mBAAmB,KAAK,QAAQ,sBAAsB,GAAG;AACzF,UAAM,IAAI,6BAA6B,oDAAoD;AAAA,EAC7F;AACA,QAAM,SAAS,GAAG,SAAS,IAAI,QAAQ,mBAAmB;AAC1D,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,MACE,WAAWA,YAAW,IAAI,CAAC;AAAA,MAC3B,GAAG,2BAA2B,IAAI,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE;AAAA,MAC7D,aAAaA,YAAW,GAAG,IAAI,UAAU,CAAC;AAAA,MAC1C,wBAAwBA,YAAW,GAAG,IAAI,UAAU,CAAC;AAAA,MACrD,0BAA0BA,YAAW,MAAM,CAAC,eAAeA,YAAW,GAAG,IAAI,UAAU,CAAC;AAAA,MACxF;AAAA,MACA,aAAaA,YAAW,GAAG,IAAI,WAAW,CAAC;AAAA,MAC3C,YAAYA,YAAW,GAAG,IAAI,WAAW,CAAC,kCAAkCA,YAAW,GAAG,MAAM,GAAG,CAAC;AAAA,MACpG,YAAYA,YAAW,GAAG,IAAI,WAAW,CAAC,kCAAkCA,YAAW,UAAU,MAAM,GAAG,CAAC;AAAA,MAC3G;AAAA,MACA,GAAG,2BAA2B,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE;AAAA,MACzD;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,IACX;AAAA,EACF;AACF;AAGO,SAAS,6BAA6B,KAAa,WAA2B;AACnF,QAAM,OAAO,kBAAkB,SAAS;AACxC,QAAM,cAAc,yBAAyB,SAAS;AACtD,SAAO;AAAA,IACL,WAAWA,YAAW,WAAW,CAAC;AAAA,IAClC,2CAA2CA,YAAW,WAAW,CAAC;AAAA,IAClE;AAAA,IACA;AAAA,IACA;AAAA,IACA,kCAAkCA,YAAW,GAAG,IAAI,WAAW,CAAC;AAAA,IAChE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAOO,SAAS,0BAA4C,SAAY,WAAsB;AAC5F,SAAO,IAAI,MAAM,SAAS;AAAA,IACxB,IAAI,QAAQ,UAAU,UAAU;AAC9B,UAAI,aAAa,UAAU,aAAa,eAAe;AACrD,cAAM,UAAU,QAAQ,IAAI,QAAQ,UAAU,MAAM;AAGpD,YAAI,CAAC,QAAS,QAAO;AACrB,eAAO,OAAO,SAA0B,aACtC,MAAM,QAAQ;AAAA,UACZ;AAAA,UACA,EAAE,GAAG,MAAM,KAAK,6BAA6B,KAAK,KAAK,SAAS,EAAE;AAAA,UAClE,GAAG;AAAA,QACL;AAAA,MACJ;AACA,YAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,QAAQ;AACpD,aAAO,OAAO,UAAU,aAAa,MAAM,KAAK,MAAM,IAAI;AAAA,IAC5D;AAAA,EACF,CAAC;AACH;AAGO,SAAS,yBACd,QACA,WACA,gBACe;AACf,QAAM,YAAY,oBAAI,QAAoC;AAC1D,QAAM,OAAO,OAAqC,YAA2B;AAC3E,UAAM,WAAW,UAAU,IAAI,OAAO;AACtC,QAAI,SAAU,QAAO;AACrB,UAAM,iBAAiB,OAAO;AAC9B,UAAM,UAAU,0BAA0B,SAAS,SAAS;AAC5D,cAAU,IAAI,SAAS,OAAO;AAC9B,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,WAAW,OAAO;AAAA,IAClB,GAAI,OAAO,2BAA2B,SAClC,EAAE,wBAAwB,OAAO,uBAAuB,IACxD,CAAC;AAAA,IACL,GAAI,OAAO,SACP;AAAA,MACE,QAAQ,UAAU,SAAgB,MAAM,KAAK,MAAO,OAAO,OAAe,GAAG,IAAI,CAAC;AAAA,IACpF,IACA,CAAC;AAAA,IACL,GAAI,OAAO,SACP;AAAA,MACE,QAAQ,UAAU,SAAgB,MAAM,KAAK,MAAO,OAAO,OAAe,GAAG,IAAI,CAAC;AAAA,IACpF,IACA,CAAC;AAAA,IACL,GAAI,OAAO,SACP;AAAA,MACE,QAAQ,OAAO,UAA+B,MAAM,OAAO,OAAQ,KAAK;AAAA,IAC1E,IACA,CAAC;AAAA,IACL,GAAI,OAAO,wBACP;AAAA,MACE,uBAAuB,OAAO,OAA4B,YACxD,MAAM,OAAO,sBAAuB,OAAO,OAAO;AAAA,IACtD,IACA,CAAC;AAAA,IACL,GAAI,OAAO,8BACP;AAAA,MACE,6BAA6B,OAAO,UAClC,MAAM,OAAO,4BAA6B,KAAK;AAAA,IACnD,IACA,CAAC;AAAA,IACL,GAAI,OAAO,gCACP;AAAA,MACE,+BAA+B,OAAO,UACpC,MAAM,OAAO,8BAA+B,KAAK;AAAA,IACrD,IACA,CAAC;AAAA,IACL,GAAI,OAAO,0BACP;AAAA,MACE,yBAAyB,OAAO,UAC9B,MAAM,OAAO,wBAAyB,KAAK;AAAA,IAC/C,IACA,CAAC;AAAA,EACP;AACF;;;AC10BA,SAAS,cAAAE,mBAAkB;AAC3B,SAAS,SAASC,kBAAiB;;;ACDnC,SAAS,cAAAC,aAAY,cAAAC,mBAAkB;AACvC,SAAS,YAAY,oBAAoB;AACzC,SAAS,SAAS,QAAAC,OAAM,SAAAC,QAAO,WAAAC,gBAAe;AAC9C,SAAS,qBAAqB;AAUvB,SAAS,4BAA4B,QAAuC;AACjF,SAAOC,YAAW,QAAQ,EAAE,OAAO,KAAK,UAAU,MAAM,CAAC,EAAE,OAAO,KAAK;AACzE;AAEO,SAAS,+BACd,QACAC,iBAAgB,cACR;AACR,MAAI,CAACC,OAAM,WAAWD,cAAa,KAAKA,eAAc,SAAS,IAAI,GAAG;AACpE,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,SAAOC,OAAM;AAAA,IACXD;AAAA,IACA;AAAA,IACA,4BAA4B,MAAM;AAAA,EACpC;AACF;AAEA,eAAsB,2BAA2B,MAA8C;AAC7F,QAAM,SAAS,OAAO,OAAe,QAAuB,WAAoB;AAC9E,UAAM,SAAS,MAAM,IAAI,MAAM;AAAA,MAC7B,aAAa,CAACE,MAAK,MAAM,KAAK,CAAC;AAAA,MAC/B,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC7B,CAAC;AACD,QAAI,CAAC,OAAO,WAAW,OAAO,QAAQ,WAAW,GAAG;AAClD,YAAM,IAAI,MAAM,yCAAyC,KAAK,EAAE;AAAA,IAClE;AACA,WAAO,MAAM,OAAO,QAAQ,CAAC,EAAG,KAAK;AAAA,EACvC;AACA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,OAAO;AAAA,MACL,QAAQ,MAAM,OAAO,8BAA8B,OAAO,qBAAqB;AAAA,MAC/E,cAAc,MAAM,OAAO,kCAAkC,KAAK;AAAA;AAAA,MAElE,gBAAgB;AAAA,IAClB;AAAA,EACF;AACF;AAEA,IAAI;AACG,SAAS,4BAA4D;AAC1E,SAAQ,mBAAmB,YAAY;AACrC,UAAM,YAAY,QAAQ,cAAc,YAAY,GAAG,CAAC;AAExD,UAAM,OAAOC,SAAQ,WAAW,aAAa;AAC7C,QACE,YAAY,IAAI,SAAS,iCAAiC,KAC1D,WAAWD,MAAK,MAAM,4BAA4B,CAAC,GACnD;AACA,aAAO,MAAM,2BAA2B,IAAI;AAAA,IAC9C;AACA,UAAM,aAAa;AAAA,MACjBA,MAAK,WAAW,6BAA6B;AAAA,MAC7CA,MAAK,WAAW,gCAAgC;AAAA,MAChDA,MAAK,WAAW,wCAAwC;AAAA,IAC1D;AACA,eAAW,QAAQ,YAAY;AAC7B,UAAI,CAAC,WAAW,IAAI,EAAG;AACvB,YAAM,QAAQ,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AACnD,UACE,CAAC,SACD,OAAO,UAAU,YACjB,MAAM,YAAY,KAClB,OAAO,KAAK,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,MAAM,mBACxC,OAAO,MAAM,OAAO,WAAW,YAC/B,OAAO,MAAM,QAAQ,YAAY,MAAM,YACvC,MAAM,QAAQ,cAAc,MAAM,2BAClC,OAAO,KAAK,MAAM,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,MAAM,kCAC9C;AACA,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAEA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF,GAAG;AACL;AAEA,SAAS,MAAM,OAAuB;AACpC,SAAO,IAAI,MAAM,QAAQ,MAAM,OAAO,CAAC;AACzC;AAGA,eAAsB,6BACpB,SACA,QACAE,MACA,OACAJ,iBAAgB,cACD;AACf,QAAM,YAAY,+BAA+B,QAAQA,cAAa;AACtE,QAAM,SAAS,4BAA4B,MAAM;AACjD,QAAM,SAAS;AAAA;AAAA,eAEF,KAAK,UAAU,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gGAOwD,KAAK,UAAU,MAAM,CAAC;AAAA;AAEpH,MAAI,uBAAuB,MAAMI,KAAI,WAAW,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,EAAG;AACrF,QAAM,SAAS,QAAQ,eAAe,KAAK;AAC3C,MAAI,CAAC;AACH,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AACF,QAAM,QAAQ,GAAGH,OAAM,QAAQ,SAAS,CAAC,UAAUI,YAAW,CAAC;AAC/D,MAAI;AACJ,MAAI;AACF,UAAM,OAAO,WAAW;AAAA,MACtB,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM,IAAI,KAAK,UAAU,MAAM,CAAC;AAAA,IAClC,CAAC;AACD,UAAM,UAAU;AAAA;AAAA,8BAEU,KAAK,UAAU,KAAK,CAAC;AAAA,gEACa,KAAK,UAAU,MAAM,CAAC;AAAA,uCAC/C,KAAK,UAAU,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAS5D,UAAM,SAAS,MAAMD,KAAI,WAAW,MAAM,OAAO,CAAC,eAAe,MAAM,MAAM,CAAC,EAAE;AAChF,QAAI,uBAAuB,MAAM,MAAM,GAAG;AACxC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,0BAAsB,EAAE,MAAM;AAAA,EAChC;AACA,MAAI;AACF,UAAM,OAAO,WAAW,EAAE,MAAM,eAAe,MAAM,MAAM,CAAC;AAAA,EAC9D,QAAQ;AAGN,QAAI;AACF,YAAM,UAAU,MAAMA;AAAA,QACpB,WAAW,MAAM,6BAA6B,KAAK,UAAU,KAAK,CAAC,kBAAkB,CAAC;AAAA,MACxF;AACA,UAAI,uBAAuB,OAAO,MAAM,GAAG;AACzC,cAAM,IAAI,MAAM,6BAA6B;AAAA,MAC/C;AAAA,IACF,QAAQ;AAKN,UAAI;AACF,gBAAQ;AAAA,UACN;AAAA,UACA;AAAA,YACE,WAAWH,OAAM,SAAS,KAAK;AAAA,YAC/B,cAAc,sBAAsB,WAAW;AAAA,UACjD;AAAA,QACF;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACA,MAAI,oBAAqB,OAAM,oBAAoB;AACrD;AAEO,SAAS,iCAAiC,WAA6B;AAC5E,SAAO;AAAA;AAAA;AAAA,IAGL;AAAA,IACA,iBAAiB,MAAM,SAAS,CAAC;AAAA,IACjC,4CAA4C,MAAM,GAAG,SAAS,aAAa,CAAC;AAAA,IAC5E;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;ADlMA,IAAM,gCAAgC;AAE/B,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAASK,YAAW,OAAuB;AACzC,SAAO,IAAI,MAAM,QAAQ,MAAM,OAAO,CAAC;AACzC;AAEA,SAAS,wBAAwB,WAA2B;AAC1D,MACE,CAAC,aACD,UAAU,KAAK,MAAM,aACrB,IAAI,YAAY,EAAE,OAAO,SAAS,EAAE,aAAa,iCACjD,UAAU,SAAS,IAAI,GACvB;AACA,UAAM,IAAI,uBAAuB,gCAAgC;AAAA,EACnE;AACA,SAAO;AACT;AAEA,SAAS,uBAAuB,OAAe,OAAuB;AACpE,MAAI,CAAC,SAAS,MAAM,SAAS,IAAI,KAAK,CAACC,WAAU,WAAW,KAAK,GAAG;AAClE,UAAM,IAAI,uBAAuB,GAAG,KAAK,mBAAmB;AAAA,EAC9D;AACA,SAAOA,WAAU,UAAU,KAAK;AAClC;AAEO,SAAS,kBAAkB,OAAuB;AACvD,SAAOD,YAAW,uBAAuB,OAAO,qBAAqB,CAAC;AACxE;AAYO,SAAS,4BAA4B,mBAA2B,WAA2B;AAChG,QAAM,yBAAyB;AAAA,IAC7B;AAAA,IACA;AAAA,EACF;AACA,QAAM,SAASE,YAAW,QAAQ,EAAE,OAAO,wBAAwB,SAAS,CAAC,EAAE,OAAO,KAAK;AAC3F,SAAOD,WAAU,KAAKA,WAAU,QAAQ,sBAAsB,GAAG,mBAAmB,MAAM;AAC5F;AAEO,SAAS,iCACd,aACA,WACQ;AACR,QAAM,oBACJ,YAAY,gCACZ,GAAG,YAAY,QAAQ,YAAY;AACrC,SAAO,4BAA4B,mBAAmB,SAAS;AACjE;AAWO,SAAS,6BACd,KACA,WACA,aACA,iBACQ;AACR,SAAO;AAAA,IACL,uCAAuC,kBAAkB,SAAS,CAAC;AAAA,IACnE,GAAI,cAAc,CAAC,gCAAgCD,YAAW,WAAW,CAAC,EAAE,IAAI,CAAC;AAAA,IACjF,GAAI,kBAAkB,iCAAiC,eAAe,IAAI,CAAC;AAAA,IAC3E;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAGO,SAAS,yBACd,SACA,WACA,aACA,iBACG;AACH,SAAO,IAAI,MAAM,SAAS;AAAA,IACxB,IAAI,QAAQ,UAAU,UAAU;AAC9B,UAAI,aAAa,UAAU,aAAa,eAAe;AACrD,cAAM,UAAU,QAAQ,IAAI,QAAQ,UAAU,MAAM;AAGpD,YAAI,CAAC,QAAS,QAAO;AACrB,eAAO,OAAO,SAA0B,aACtC,MAAM,QAAQ;AAAA,UACZ;AAAA,UACA;AAAA,YACE,GAAG;AAAA,YACH,KAAK,6BAA6B,KAAK,KAAK,WAAW,aAAa,eAAe;AAAA,UACrF;AAAA,UACA,GAAG;AAAA,QACL;AAAA,MACJ;AACA,YAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,QAAQ;AACpD,aAAO,OAAO,UAAU,aAAa,MAAM,KAAK,MAAM,IAAI;AAAA,IAC5D;AAAA,EACF,CAAC;AACH;AAGO,SAAS,wBACd,QACA,WACA,aACA,iBACe;AACf,QAAM,YAAY,oBAAI,QAAoC;AAC1D,QAAM,OAAO,CAA+B,YAAkB;AAC5D,UAAM,WAAW,UAAU,IAAI,OAAO;AACtC,QAAI,SAAU,QAAO;AACrB,UAAM,UAAU,yBAAyB,SAAS,WAAW,aAAa,eAAe;AACzF,cAAU,IAAI,SAAS,OAAO;AAC9B,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,WAAW,OAAO;AAAA,IAClB,GAAI,OAAO,2BAA2B,SAClC,EAAE,wBAAwB,OAAO,uBAAuB,IACxD,CAAC;AAAA,IACL,GAAI,OAAO,SACP,EAAE,QAAQ,UAAU,SAAgB,KAAK,MAAO,OAAO,OAAe,GAAG,IAAI,CAAC,EAAE,IAChF,CAAC;AAAA,IACL,GAAI,OAAO,SACP,EAAE,QAAQ,UAAU,SAAgB,KAAK,MAAO,OAAO,OAAe,GAAG,IAAI,CAAC,EAAE,IAChF,CAAC;AAAA,IACL,GAAI,OAAO,SACP,EAAE,QAAQ,OAAO,UAA+B,MAAM,OAAO,OAAQ,KAAK,EAAE,IAC5E,CAAC;AAAA,IACL,GAAI,OAAO,wBACP;AAAA,MACE,uBAAuB,OAAO,OAA4B,YACxD,MAAM,OAAO,sBAAuB,OAAO,OAAO;AAAA,IACtD,IACA,CAAC;AAAA,IACL,GAAI,OAAO,8BACP;AAAA,MACE,6BAA6B,OAAO,UAClC,MAAM,OAAO,4BAA6B,KAAK;AAAA,IACnD,IACA,CAAC;AAAA,IACL,GAAI,OAAO,gCACP;AAAA,MACE,+BAA+B,OAAO,UACpC,MAAM,OAAO,8BAA+B,KAAK;AAAA,IACrD,IACA,CAAC;AAAA,IACL,GAAI,OAAO,0BACP;AAAA,MACE,yBAAyB,OAAO,UAC9B,MAAM,OAAO,wBAAyB,KAAK;AAAA,IAC/C,IACA,CAAC;AAAA,EACP;AACF;;;AEvLA,SAAS,yCAAwD;AACjE,SAAS,gCAAgC;AAElC,IAAM,6BAA6B,KAAK;AA0B/C,eAAsB,yBACpB,UACA,OACA,WACA,QAAQ,KAAK,IAAI,GACgC;AACjD,QAAM,mBAAmB,kCAAkC,QAAQ;AACnE,MAAI,CAAC,iBAAkB,QAAO;AAC9B,QAAM,mBAAmB,KAAK,MAAM,QAAQ,GAAI,IAAI;AACpD,QAAM,QAAQ,MAAM,yBAAyB,kBAAkB;AAAA,IAC7D,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,WAAW,WAAW,UAAU,SAAS;AAAA,IACzC,cAAc;AAAA,IACd,aAAa,CAAC,eAAe;AAAA,IAC7B,WAAW,UAAU;AAAA,IACrB,QAAQ,UAAU;AAAA,IAClB,WAAW,UAAU;AAAA,IACrB,qBAAqB,UAAU;AAAA,IAC/B,GAAI,UAAU,wBACV,EAAE,uBAAuB,UAAU,sBAAsB,IACzD,CAAC;AAAA,IACL,eAAe;AAAA,IACf,KAAK;AAAA,EACP,CAAC;AACD,SAAO,EAAE,OAAO,WAAW,IAAI,KAAK,mBAAmB,GAAI,EAAE;AAC/D;;;AC/BA,SAAS,uBAAAG,4BAA2B;AAOpC,IAAM,sBAAsB;AAC5B,IAAM,oBAAoB;AAC1B,IAAM,oBAAoB;AAC1B,IAAM,qBAAuC,CAAC,MAAM,GAAG;AAEvD,IAAM,gBAAgB;AACtB,IAAM,gBAAgB;AAEf,SAAS,oBAAoB,OAA6C;AAC/E,SAAO,UAAU,aAAa,eAAe;AAC/C;AACO,SAAS,YAAY,OAA+B;AACzD,SAAO,UAAU,aAAa,SAAS;AACzC;AAGO,IAAM,4BAAN,cAAwC,MAAM;AAAA,EACnD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YACE,SACS,QACT;AACA,UAAM,OAAO;AAFJ;AAGT,SAAK,OAAO;AAAA,EACd;AACF;AA0BA,SAAS,IAAI,GAAmB;AAC9B,SAAO,IAAI,EAAE,QAAQ,MAAM,OAAO,CAAC;AACrC;AAEA,SAAS,aAAa,QAAyC;AAC7D,MAAI,OAAO,WAAW,SAAU,QAAO;AACvC,SAAO,CAAC,OAAO,QAAQ,OAAO,QAAQ,OAAO,MAAM,EAChD,OAAO,CAAC,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS,CAAC,EAChE,KAAK,IAAI;AACd;AAGA,IAAM,4BAA4B;AAElC,eAAe,IACb,SACA,KACA,OACA,cAAc,eACd,kBAAkB,2BACD;AACjB,QAAM,OAKF,EAAE,KAAK,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC,GAAI,aAAa,gBAAgB;AACrE,MAAI,OAAO,QAAQ,SAAS,YAAY;AACtC,WAAO,aAAa,MAAM,QAAQ,KAAK,IAAI,CAAC;AAAA,EAC9C;AACA,MAAI,OAAO,QAAQ,gBAAgB,YAAY;AAC7C,WAAO,aAAa,MAAM,QAAQ,YAAY,IAAI,CAAC;AAAA,EACrD;AACA,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAMA,SAAS,gBAAgB,KAAqB;AAC5C,QAAM,SAAS,IAAI,YAAY,aAAa;AAC5C,MAAI,UAAU,EAAG,QAAO,IAAI,MAAM,SAAS,cAAc,MAAM;AAC/D,MAAI,IAAI,WAAW,WAAW,EAAG,QAAO,IAAI,MAAM,YAAY,MAAM;AACpE,SAAO;AACT;AAgCA,eAAsB,eACpB,SACA,OAC2B;AAC3B,QAAM,IAAI;AACV,QAAM,QAAQ,MAAM,SAAS;AAC7B,QAAM,aAAa,MAAM,cAAc;AACvC,QAAM,YAAY,MAAM,aAAa;AACrC,QAAM,aAAa,MAAM,cAAc;AACvC,QAAM,UAAU,MAAM,WAAW;AACjC,QAAM,MAAM,MAAM,UAAU;AAC5B,QAAM,MAAM,YAAY,KAAK;AAC7B,QAAM,UAAU,GAAG,GAAG,WAAW,MAAM,WAAW,IAAI,GAAG;AACzD,QAAM,UAAU,GAAG,GAAG,WAAW,MAAM,WAAW;AAClD,QAAM,UAAU,GAAG,GAAG,WAAW,MAAM,WAAW;AAClD,QAAM,CAAC,GAAG,CAAC,IAAI;AACf,QAAM,MACJ,UAAU,aACN,6CACA;AACN,QAAM,SACJ,iFAAiF,SAAS,gBAC3E,CAAC,IAAI,CAAC,OAAO,OAAO,SAAS,UAAU,IAAI,GAAG,IAAI,OAAO,gBACzD,OAAO,qBAAqB,OAAO;AACpD,QAAM,IAAI,GAAG,YAAY,IAAI,MAAM,CAAC,IAAI,MAAM,KAAK;AACnD,SAAO;AAAA,IACL,aAAa,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,KAAK,IAAI;AAAA,IACpB;AAAA,IACA,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,EAC9C;AACF;AAOA,eAAsB,cAAc,SAAkB,MAAuC;AAC3F,QAAM,IAAI;AACV,QAAM,OAAO,oBAAoB,KAAK,OAAO,2DAA2D,KAAK,OAAO;AACpH,QAAM,IAAI,GAAG,YAAY,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,aAAa,EAAE,MAAM,MAAM,MAAS;AACxF;AAYA,eAAsB,yBACpB,SACA,MACA,WAAW,mBACyB;AACpC,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,SAAS,cAAc,OAAO,EAAE,gBAAgB,YAAY;AACvE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WACJ,MAAM;AAAA,IACJ;AAAA,IACA,YAAY,IAAI,cAAc,KAAK,OAAO,8BAA8B,CAAC;AAAA,IACzE,KAAK;AAAA,EACP,GACA,KAAK;AACP,QAAM,WACJ,QACG,MAAM,IAAI,EACV,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO,EACd,IAAI,KAAK;AACd,MAAI,aAAa,aAAa,aAAa,IAAI;AAC7C,UAAM,IAAI,eAAe,kCAAkC,KAAK,OAAO,IAAI,WAAW;AAAA,EACxF;AACA,QAAM,OAAO,OAAO,QAAQ;AAC5B,MAAI,CAAC,OAAO,SAAS,IAAI,KAAK,QAAQ,GAAG;AACvC,UAAM,IAAI,eAAe,gCAAgC,KAAK,OAAO,IAAI,cAAc;AAAA,EACzF;AACA,MAAI,OAAO,UAAU;AACnB,UAAM,IAAI,eAAe,aAAa,IAAI,iBAAiB,QAAQ,KAAK,oBAAoB;AAAA,EAC9F;AACA,SAAO;AAAA,IACL,aAAa,oBAAoB,KAAK,KAAK;AAAA,IAC3C,WAAW;AAAA,IACX,iBAAiB,KAAK,IAAI,GAAG,KAAK,OAAO,KAAK,IAAI,IAAI,KAAK,aAAa,GAAI,CAAC;AAAA,EAC/E;AACF;AAEA,IAAM,sBAAsB;AAC5B,IAAM,+BAA+B;AASrC,eAAsB,wBACpB,SACA,MACA,OAMoC;AACpC,QAAM,aAAa,MAAM,cAAc;AACvC,MAAI,CAAC,OAAO,cAAc,UAAU,KAAK,cAAc,KAAK,aAAa,KAAK;AAC5E,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,QAAM,WAAW,MAAM,yBAAyB,SAAS,MAAM,MAAM,QAAQ;AAC7E,QAAM,UAAU,OAAO,QAAQ,MAAM,eAAe,EACjD,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,cAAc,KAAK,CAAC,EACnD,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,YAAY,IAAI,GAAG,IAAI,KAAK,KAAK,EAAE,CAAC,EAAE,EAC7D,KAAK,GAAG;AACX,QAAM,SAAS;AAAA,IACb;AAAA,IACA,qEAAqE,UAAU,kBAAkB,OAAO,kBAAkB,IAAI,KAAK,OAAO,CAAC,IAAI,IAAI,MAAM,GAAG,CAAC;AAAA,IAC7J,WAAW,mBAAmB;AAAA,EAChC,EAAE,KAAK,IAAI;AACX,QAAM,SAAS;AAAA,IACb,MAAM;AAAA,MACJ;AAAA,MACA,YAAY,IAAI,MAAM,CAAC;AAAA,MACvB,KAAK;AAAA,OACJ,aAAa,MAAM;AAAA,IACtB;AAAA,EACF;AACA,MAAI,CAAC,OAAO,SAAS,mBAAmB,GAAG;AACzC,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACA,SAAO;AACT;AAMA,eAAsB,yBACpB,SACA,MACe;AACf,QAAM,IAAI;AACV,QAAM,UAAU,KAAK,QAAQ,QAAQ,iBAAiB,MAAM;AAC5D,QAAM,IAAI,GAAG,SAAS,KAAK,OAAO,IAAI,KAAK,OAAO,IAAI,OAAO,IAAI,KAAK,KAAK,EAAE;AAAA,IAC3E,MAAM;AAAA,EACR;AACF;AAGO,SAAS,oBACd,aACA,WACA,aACA,OACQ;AACR,SAAO,cAAc,WAAW,IAAI,SAAS,IAAI,WAAW,IAAI,YAAY,KAAK,CAAC;AACpF;;;ACzQO,IAAM,iCAAiC;AAevC,SAAS,mBAAmB,OAMP;AAC1B,QAAM,EAAE,WAAW,IAAI;AACvB,MAAI,CAAC,cAAc,WAAW,WAAW,UAAU;AACjD,WAAO,EAAE,OAAO,WAAW,WAAW,OAAO,YAAY,MAAM;AAAA,EACjE;AACA,QAAM,YAAY,WAAW,aAAa,mBAAmB,WAAW;AACxE,QAAM,aAAa,WAAW;AAO9B,MAAI,WAAW,eAAe;AAC5B,WAAO,EAAE,OAAO,WAAW,WAAW,WAAW;AAAA,EACnD;AACA,MAAI,MAAM,gBAAgB;AACxB,WAAO,EAAE,OAAO,UAAU,WAAW,WAAW;AAAA,EAClD;AAEA,QAAM,OAAO,MAAM,OAAO,oBAAI,KAAK,GAAG,QAAQ;AAC9C,QAAM,WAAW,WAAW,aAAa,IAAI,KAAK,WAAW,UAAU,EAAE,QAAQ,IAAI;AACrF,MAAI,aAAa,QAAQ,MAAM,YAAY,gCAAgC;AACzE,WAAO,EAAE,OAAO,gBAAgB,WAAW,WAAW;AAAA,EACxD;AACA,SAAO,EAAE,OAAO,WAAW,WAAW,WAAW;AACnD;AAQO,SAAS,4BAA4B,OAGhB;AAC1B,QAAM,EAAE,WAAW,IAAI;AACvB,MAAI,CAAC,cAAc,WAAW,WAAW,UAAU;AACjD,WAAO,EAAE,OAAO,WAAW,WAAW,OAAO,YAAY,MAAM;AAAA,EACjE;AACA,QAAM,MAAM,MAAM,OAAO,oBAAI,KAAK;AAClC,QAAM,WAAW,WAAW,aAAa,IAAI,KAAK,WAAW,UAAU,EAAE,QAAQ,IAAI;AACrF,QAAM,iBACJ,aAAa,QAAQ,IAAI,QAAQ,IAAI,YAAY;AACnD,SAAO,mBAAmB;AAAA,IACxB;AAAA,IACA,gBAAgB;AAAA,IAChB;AAAA,EACF,CAAC;AACH;AAgCA,eAAsB,gCACpB,OAC8B;AAC9B,QAAM,iBACJ,MAAM,mBAAmB,MAAM,UAAU,MAAM,MAAM,QAAQ,KAAK,IAAI;AACxE,QAAM,WAAW,mBAAmB;AAAA,IAClC,YAAY,MAAM;AAAA,IAClB;AAAA,IACA,GAAI,MAAM,MAAM,EAAE,KAAK,MAAM,IAAI,IAAI,CAAC;AAAA,EACxC,CAAC;AAMD,QAAM,eACJ,SAAS,UAAU,WAAW,SAAS;AACzC,QAAM,OAA2B;AAAA,IAC/B,WAAW,MAAM;AAAA,IACjB,SAAS;AAAA,IACT,IAAI,MAAM,MAAM;AAAA,IAChB,UAAU;AAAA,IACV,YAAY,MAAM;AAAA,IAClB,gBAAgB,MAAM,kBAAkB;AAAA,IACxC,oBAAoB,MAAM,sBAAsB;AAAA,IAChD,iBAAiB,MAAM,mBAAmB;AAAA,IAC1C,4BAA4B,MAAM,8BAA8B;AAAA,IAChE,GAAI,MAAM,wBAAwB,SAC9B,EAAE,qBAAqB,MAAM,oBAAoB,IACjD,CAAC;AAAA,IACL,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IAC7D,GAAI,MAAM,qBAAqB,SAAY,EAAE,kBAAkB,MAAM,iBAAiB,IAAI,CAAC;AAAA,IAC3F,GAAI,MAAM,MAAM,EAAE,KAAK,MAAM,IAAI,IAAI,CAAC;AAAA,EACxC;AACA,QAAM,aAAa,sBAAsB,IAAI;AAC7C,QAAM,OAA4B;AAAA,IAChC,GAAG;AAAA,IACH,YAAY;AAAA,MACV,GAAG,WAAW;AAAA,MACd,MAAM,MAAM,YAAY,iBAAiB;AAAA,IAC3C;AAAA,EACF;AAQA,MAAI,SAAS,UAAU,UAAU;AAC/B,UAAM,SACJ,SAAS,UAAU,YAAY,kBAAkB;AACnD,WAAO;AAAA,MACL,GAAG;AAAA,MACH,YAAY,EAAE,GAAG,KAAK,YAAY,WAAW,OAAO,UAAU,MAAM,OAAO;AAAA,MAC3E,UAAU;AAAA,QACR,GAAG,KAAK;AAAA,QACR,WAAW;AAAA,QACX,KAAK;AAAA,QACL,OAAO;AAAA,QACP,WAAW;AAAA,QACX;AAAA,MACF;AAAA,MACA,KAAK,EAAE,GAAG,KAAK,KAAK,WAAW,OAAO,OAAO;AAAA,MAC7C,eAAe;AAAA,QACb,GAAG,KAAK;AAAA,QACR,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,KAAK;AAAA,QACL,OAAO;AAAA,QACP,WAAW;AAAA,QACX,wBAAwB;AAAA,QACxB,cAAc;AAAA,QACd,QAAQ;AAAA,QACR,kBAAkB,CAAC;AAAA,QACnB;AAAA,MACF;AAAA,MACA,WAAW,EAAE,GAAG,KAAK,WAAW,WAAW,OAAO,OAAO,CAAC,GAAG,QAAQ,CAAC,GAAG,OAAO;AAAA,IAClF;AAAA,EACF;AAgBA,MAAI,CAAC,SAAS,YAAY;AACxB,UAAM,SAAsC;AAC5C,WAAO;AAAA,MACL,GAAG;AAAA,MACH,eACE,KAAK,cAAc,cAAc,OAC7B;AAAA,QACE,GAAG,KAAK;AAAA,QACR,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,KAAK;AAAA,QACL,OAAO;AAAA,QACP,WAAW;AAAA,QACX,wBAAwB;AAAA,QACxB,cAAc;AAAA,QACd,QAAQ;AAAA,QACR,kBAAkB,CAAC;AAAA,QACnB;AAAA,MACF,IACA,KAAK;AAAA,MACX,WAAW,KAAK,UAAU,YACtB,EAAE,GAAG,KAAK,WAAW,WAAW,OAAO,OAAO,CAAC,GAAG,QAAQ,CAAC,GAAG,OAAO,IACrE,KAAK;AAAA,IACX;AAAA,EACF;AAEA,MAAI,CAAC,SAAS,WAAW;AAIvB,WAAO;AAAA,MACL,GAAG;AAAA,MACH,eACE,KAAK,cAAc,cAAc,OAC7B,EAAE,GAAG,KAAK,eAAe,MAAM,YAAY,IAC3C,KAAK;AAAA,IACb;AAAA,EACF;AAIA,SAAO;AACT;;;AClTA;AAAA,EAIE,aAAAC;AAAA,EACA,eAAAC;AAAA,OAOK;AAGP,IAAMC,WAAU,IAAI,YAAY;AAChC,IAAMC,WAAU,IAAI,YAAY;AA8BzB,IAAM,qBAAN,MAA+C;AAAA,EAC5C;AAAA,EACS;AAAA,EACA;AAAA,EACA,QAAQ,oBAAI,IAAwB;AAAA,EACpC;AAAA,EACR;AAAA;AAAA,EAGA,WAA4D,CAAC;AAAA,EAEtE,YAAY,OAAkC,CAAC,GAAG;AAChD,SAAK,SAAS,KAAK,UAAU;AAC7B,SAAK,YAAY,KAAK,aAAa;AACnC,SAAK,WAAW,KAAK,YAAY;AACjC,SAAK,WAAW,KAAK,YAAY;AACjC,SAAK,cAAc,KAAK,SAAS,CAAC,QAAQ,YAAY,KAAK,KAAK,QAAQ;AACxE,eAAW,CAAC,MAAM,OAAO,KAAK,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,GAAG;AAC9D,WAAK,MAAM;AAAA,QACT,UAAU,IAAI;AAAA,QACd,OAAO,YAAY,WAAWD,SAAQ,OAAO,OAAO,IAAI;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,UAAU,QAAuB;AAC/B,SAAK,SAAS;AAAA,EAChB;AAAA;AAAA,EAGA,SAAS,MAAkC;AACzC,UAAM,QAAQ,KAAK,MAAM,IAAI,UAAU,IAAI,CAAC;AAC5C,WAAO,QAAQC,SAAQ,OAAO,KAAK,IAAI;AAAA,EACzC;AAAA;AAAA,EAGA,MAAM,QAAQ,KAAyC;AACrD,WAAO,MAAM,KAAK,YAAY,GAAG;AAAA,EACnC;AAAA,EAEA,MAAM,QACJ,SACA,KACA,OAC0B;AAC1B,SAAK,SAAS,KAAK,EAAE,SAAS,IAAI,CAAC;AACnC,QAAI,CAAC,KAAK,QAAQ;AAChB,aAAO;AAAA,QACL,IAAI;AAAA,QACJH,WAAU;AAAA,QACV;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,KAAK,UAAU;AACjB,aAAO;AAAA,QACL,IAAI;AAAA,QACJA,WAAU;AAAA,QACV;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,KAAK,IAAI;AACf,QAAI,CAAC,IAAI;AACP,aAAO,cAAc,IAAI,WAAWA,WAAU,qBAAqB,YAAY,KAAK;AAAA,IACtF;AACA,UAAM,eAAe,QAAQ,MAAM,GAAG;AACtC,UAAM,cAAc,aAAa,CAAC,KAAK;AACvC,UAAM,UAAU,aAAa,CAAC,KAAK;AACnC,YAAQ,GAAG,OAAO;AAAA,MAChB,KAAK;AACH,eAAO,GAAG,IAAI,WAAW;AAAA,UACvB,OAAO;AAAA,UACP,MAAM,EAAE,OAAO,GAAG,KAAK,OAAO,kBAAkB,IAAI;AAAA,QACtD,CAAC;AAAA,MACH,KAAK,UAAU;AACb,cAAM,QAAQ,KAAK,MAAM,IAAI,UAAU,GAAG,OAAO,IAAI,CAAC;AACtD,YAAI,CAAC,OAAO;AACV,iBAAO;AAAA,YACL,IAAI;AAAA,YACJA,WAAU;AAAA,YACV,iBAAiB,GAAG,OAAO,IAAI;AAAA,YAC/B;AAAA,UACF;AAAA,QACF;AACA,cAAM,MAAsB,EAAE,SAAS,OAAO,WAAW,OAAO,MAAM,MAAM,EAAE;AAC9E,eAAO,GAAG,IAAI,WAAW,EAAE,OAAO,UAAU,QAAQ,IAAI,CAAC;AAAA,MAC3D;AAAA,MACA,KAAK,WAAW;AACd,cAAM,OAAO,UAAU,GAAG,QAAQ,IAAI;AACtC,cAAM,OAAO,GAAG,QAAQ,SACpB,OAAO,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,WAAW,CAAC,GAAG,GAAG,QAAQ,OAAO,IACpE,GAAG,QAAQ;AACf,aAAK,MAAM,IAAI,MAAM,IAAI;AACzB,cAAM,MAAuB,EAAE,cAAc,OAAO,GAAG,QAAQ,QAAQ,MAAM,EAAE;AAC/E,eAAO,GAAG,IAAI,WAAW,EAAE,OAAO,WAAW,SAAS,IAAI,CAAC;AAAA,MAC7D;AAAA,MACA,KAAK,YAAY;AACf,cAAM,OAAO,UAAU,GAAG,SAAS,IAAI;AACvC,YAAI,CAAC,KAAK,MAAM,OAAO,IAAI,GAAG;AAC5B,iBAAO;AAAA,YACL,IAAI;AAAA,YACJA,WAAU;AAAA,YACV,iBAAiB,GAAG,SAAS,IAAI;AAAA,YACjC;AAAA,UACF;AAAA,QACF;AACA,eAAO,GAAG,IAAI,WAAW,EAAE,OAAO,YAAY,UAAU,CAAC,EAAE,CAAC;AAAA,MAC9D;AAAA,MACA,KAAK,UAAU;AACb,cAAM,SAAS,UAAU,GAAG,OAAO,IAAI,EAAE,QAAQ,QAAQ,GAAG;AAC5D,cAAM,MAAsB;AAAA,UAC1B,SAAS,CAAC,GAAG,KAAK,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,MAAM,EAAE,WAAW,MAAM,CAAC,EAClC,IAAI,CAAC,MAAM;AACV,kBAAM,QAAQ,KAAK,MAAM,IAAI,CAAC;AAC9B,kBAAM,MAAM,EAAE,MAAM,OAAO,MAAM;AACjC,mBAAO;AAAA,cACL,MAAM,IAAI,MAAM,GAAG,EAAE,IAAI,KAAK;AAAA,cAC9B,MAAM;AAAA,cACN,MAAMC,aAAY;AAAA,cAClB,MAAM,OAAO,MAAM,MAAM;AAAA,cACzB,YAAY;AAAA,cACZ,MAAM;AAAA,YACR;AAAA,UACF,CAAC;AAAA,QACL;AACA,eAAO,GAAG,IAAI,WAAW,EAAE,OAAO,UAAU,QAAQ,IAAI,CAAC;AAAA,MAC3D;AAAA,MACA,KAAK,UAAU;AACb,cAAM,QAAQ,KAAK,MAAM,IAAI,UAAU,GAAG,OAAO,IAAI,CAAC;AACtD,cAAM,MAAsB,QACxB;AAAA,UACE,QAAQ;AAAA,UACR,OAAO;AAAA,YACL,MAAM,UAAU,GAAG,OAAO,IAAI,EAAE,MAAM,GAAG,EAAE,IAAI,KAAK;AAAA,YACpD,MAAM,GAAG,OAAO;AAAA,YAChB,MAAMA,aAAY;AAAA,YAClB,MAAM,OAAO,MAAM,MAAM;AAAA,YACzB,YAAY;AAAA,YACZ,MAAM;AAAA,UACR;AAAA,QACF,IACA,EAAE,QAAQ,OAAO,OAAO,OAAU;AACtC,eAAO,GAAG,IAAI,WAAW,EAAE,OAAO,UAAU,QAAQ,IAAI,CAAC;AAAA,MAC3D;AAAA,MACA,KAAK,iBAAiB;AAOpB,eAAO,GAAG,IAAI,WAAW;AAAA,UACvB,OAAO;AAAA,UACP,eAAe;AAAA,YACb,SAAS;AAAA,cACP,WAAW;AAAA,cACX;AAAA,cACA;AAAA,cACA,MAAM;AAAA,cACN,MAAM;AAAA,YACR;AAAA,YACA,SAAS,EAAE,IAAI,OAAO,OAAO,MAAM,QAAQ,KAAK,SAAS,KAAK;AAAA,UAChE;AAAA,QACF,CAAC;AAAA,MACH;AAAA,MACA,KAAK,WAAW;AAId,eAAO,GAAG,IAAI,WAAW;AAAA,UACvB,OAAO;AAAA,UACP,SAAS;AAAA,YACP,OAAO;AAAA,YACP,SAAS,EAAE,WAAW,YAAY,aAAa,SAAS,MAAM,GAAG,MAAM,KAAK;AAAA,UAC9E;AAAA,QACF,CAAC;AAAA,MACH;AAAA,MACA,KAAK;AACH,eAAO,GAAG,IAAI,WAAW;AAAA,UACvB,OAAO;AAAA,UACP,sBAAsB,EAAE,MAAM,OAAQ,mBAAmB,iBAAiB;AAAA,QAC5E,CAAC;AAAA,MACH,KAAK,qBAAqB;AACxB,eAAO,GAAG,IAAI,WAAW;AAAA,UACvB,OAAO;AAAA,UACP,mBAAmB;AAAA,YACjB,SAAS;AAAA,cACP,WAAW,gBAAgB,GAAG,kBAAkB,QAAQ;AAAA,cACxD;AAAA,cACA;AAAA,cACA,MAAM;AAAA,cACN,MAAM;AAAA,YACR;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH;AAAA,MACA,KAAK,sBAAsB;AACzB,eAAO,GAAG,IAAI,WAAW;AAAA,UACvB,OAAO;AAAA,UACP,oBAAoB;AAAA,YAClB,SAAS;AAAA,cACP,WAAW,iBAAiB,GAAG,mBAAmB,QAAQ;AAAA,cAC1D;AAAA,cACA;AAAA,cACA,MAAM;AAAA,cACN,MAAM;AAAA,YACR;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH;AAAA,MACA;AACE,eAAO;AAAA,UACL,IAAI;AAAA,UACJD,WAAU;AAAA,UACV,2BAA2B,GAAG,KAAK;AAAA,UACnC;AAAA,QACF;AAAA,IACJ;AAAA,EACF;AACF;AAEA,SAAS,YAAY,KAAkB,UAAgC;AACrE,QAAM,SAAS,IAAI,QAAQ,KAAK,GAAG;AACnC,QAAM,SAAS,oBAAoB,KAAK,MAAM,IAAI,WAAW;AAC7D,SAAO;AAAA,IACL,UAAU;AAAA,IACV,QAAQE,SAAQ,OAAO,GAAG,MAAM;AAAA,CAAI;AAAA,IACpC,QAAQ,IAAI,WAAW,CAAC;AAAA,IACxB,UAAU;AAAA,IACV,YAAY;AAAA,EACd;AACF;AAEA,SAAS,GAAGE,YAAmB,QAAiE;AAC9F,SAAO,EAAE,WAAAA,YAAW,OAAO,QAAW,OAAO;AAC/C;AAEA,SAAS,cACPA,YACA,MACA,SACA,WACiB;AACjB,QAAM,QAAoB,EAAE,MAAM,SAAS,WAAW,QAAQ,CAAC,EAAE;AACjE,SAAO,EAAE,WAAAA,YAAW,OAAO,QAAQ,OAAU;AAC/C;AAEA,SAAS,UAAU,MAAsB;AAEvC,QAAM,UAAU,KAAK,QAAQ,QAAQ,EAAE;AACvC,SAAO,QAAQ,WAAW,GAAG,IAAI,UAAU,IAAI,OAAO;AACxD;AAEA,SAAS,OAAO,GAAe,GAA2B;AACxD,QAAM,MAAM,IAAI,WAAW,EAAE,SAAS,EAAE,MAAM;AAC9C,MAAI,IAAI,GAAG,CAAC;AACZ,MAAI,IAAI,GAAG,EAAE,MAAM;AACnB,SAAO;AACT;;;AC3SA,SAAS,UAAAC,eAAc;AACvB,SAAS,cAAAC,mBAAkB;AAC3B;AAAA,EAGE,aAAAC;AAAA,EAGA,SAAAC;AAAA,EACA,aAAAC;AAAA,EACA,WAAAC;AAAA,EACA,gBAAAC;AAAA,EACA,WAAAC;AAAA,OAKK;AAgBA,IAAM,4BAAN,MAA6D;AAAA,EAClE,YAAY;AAAA,EACH,YAA6D,CAAC;AAAA,EACvE;AAAA,EACiB,WAAW,oBAAI,IAAgD;AAAA,EAEhF,MAAM,UACJ,SACA,WAC+B;AAC/B,QAAI,CAAC,KAAK,WAAW;AACnB,YAAM,IAAI,yBAAyB,wCAAwC;AAAA,IAC7E;AACA,QAAI,MAAM,KAAK,SAAS,IAAI,OAAO;AACnC,QAAI,CAAC,KAAK;AACR,YAAM,oBAAI,IAAI;AACd,WAAK,SAAS,IAAI,SAAS,GAAG;AAAA,IAChC;AACA,QAAI,IAAI,SAAS;AACjB,WAAO;AAAA,MACL,aAAa,MAAM;AACjB,YAAI,OAAO,SAAS;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,SAAiB,SAAoC;AACjE,QAAI,CAAC,KAAK,WAAW;AACnB,YAAM,IAAI,yBAAyB,wCAAwC;AAAA,IAC7E;AACA,SAAK,UAAU,KAAK,EAAE,SAAS,QAAQ,CAAC;AACxC,SAAK,YAAY,SAAS,OAAO;AAAA,EACnC;AAAA;AAAA,EAGA,QAAQ,SAAiB,SAA2B;AAClD,eAAW,WAAW,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,GAAG;AACtD,cAAQ,OAAO;AAAA,IACjB;AAAA,EACF;AAAA;AAAA,EAGA,cAAuB;AACrB,WAAO,KAAK,UAAU,IAAI,CAAC,EAAE,QAAQ,MAAMC,OAAM,OAAO,OAAO,CAAC;AAAA,EAClE;AACF;AAgDA,IAAMC,WAAU,IAAI,YAAY;AAMzB,IAAM,eAAN,MAAyC;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAGA,UAAU,oBAAI,IAA0B;AAAA,EAChD,OAAO,oBAAI,IAAuB;AAAA,EAClC,SAAqD,CAAC;AAAA;AAAA;AAAA,EAGtD,UAAU,oBAAI,IAAY;AAAA,EAClB,uBAAuB,oBAAI,IAAY;AAAA,EAExD,YAAY,MAMT;AACD,SAAK,YAAY,KAAK;AACtB,SAAK,cAAc,KAAK;AACxB,SAAK,UAAU,KAAK;AACpB,SAAK,uBAAuB,KAAK;AACjC,SAAK,gBAAgB,KAAK;AAC1B,SAAK,UAAU,YAAY,CAAC,UAAU,YAAY,KAAK,MAAM,OAAO;AAAA,EACtE;AAAA;AAAA,EAGA,OAAO,MAAc,QAA4B;AAC/C,SAAK,QAAQ,IAAI,MAAM,MAAM;AAAA,EAC/B;AAAA,EAEQ,MAAM,SAA2B;AACvC,QAAI;AACJ,QAAI;AACF,YAAMD,OAAM,OAAO,OAAO;AAAA,IAC5B,QAAQ;AACN;AAAA,IACF;AACA,UAAME,OAAM,KAAK,KAAK,IAAI,IAAI,IAAI;AAClC,QAAI,CAACA,MAAK;AACR;AAAA,IACF;AAGA,UAAM,aAAa,OAAO,IAAI,gBAAgB;AAC9C,QAAI,eAAe,MAAM,eAAeA,KAAI,mBAAmB;AAC7D;AAAA,IACF;AACA,IAAAA,KAAI,KAAK,KAAK,GAAG;AACjB,QAAI,IAAI,SAAS,OAAO,IAAI,QAAQ,KAAKA,KAAI,SAAS;AACpD,MAAAA,KAAI,aAAa;AAAA,IACnB;AAAA,EACF;AAAA,EAEA,MAAM,QACJ,SACA,KACA,OAC0B;AAC1B,UAAM,uBAAuB,gCAAgC,OAAO;AACpE,QAAI,CAAC,sBAAsB;AACzB,aAAOC;AAAA,QACL,IAAI;AAAA,QACJC,WAAU;AAAA,QACV;AAAA,MACF;AAAA,IACF;AACA,UAAM,KAAK,IAAI;AACf,QAAI,CAAC,IAAI;AACP,aAAOD,eAAc,IAAI,WAAWC,WAAU,qBAAqB,OAAO;AAAA,IAC5E;AACA,YAAQ,GAAG,OAAO;AAAA,MAChB,KAAK;AACH,eAAO,MAAM,KAAK,YAAY,IAAI,WAAW,GAAG,SAAS,oBAAoB;AAAA,MAC/E,KAAK;AACH,eAAO,KAAK;AAAA,UACV,IAAI;AAAA,UACJ,GAAG,SAAS;AAAA,UACZ,OAAO,GAAG,SAAS,OAAO;AAAA,UAC1B,GAAG,SAAS;AAAA,UACZ;AAAA,QACF;AAAA,MACF,KAAK;AACH,eAAO,KAAK,YAAY,IAAI,WAAW,GAAG,QAAQ,MAAM,oBAAoB;AAAA,MAC9E,KAAK;AACH,eAAO,KAAK,aAAa,IAAI,WAAW,GAAG,SAAS,MAAM,oBAAoB;AAAA,MAChF,SAAS;AACP,eAAOD;AAAA,UACL,IAAI;AAAA,UACJC,WAAU;AAAA,UACV,8BAA8B,GAAG,KAAK;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,YACZ,MACA,OACA,sBAC0B;AAC1B,QAAI,KAAK,qBAAqB,IAAI,IAAI,GAAG;AACvC,aAAO,cAAc,MAAM,gBAAgB,IAAI,GAAG,KAAK;AAAA,IACzD;AACA,UAAM,WAAW,KAAK,KAAK,IAAI,IAAI;AACnC,QAAI,UAAU;AACZ,UAAI,SAAS,yBAAyB,sBAAsB;AAC1D,eAAOD;AAAA,UACL;AAAA,UACAC,WAAU;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAGA,eAAS,cAAc;AACvB,aAAO,cAAc,MAAM,KAAK,SAAS,MAAM,QAAQ,CAAC;AAAA,IAC1D;AACA,UAAM,OAAO,MAAM,IAAI,UAAU,SAAS,MAAM,GAAG,OAAO;AAC1D,QAAI,CAAC,MAAM;AACT,aAAOD;AAAA,QACL;AAAA,QACAC,WAAU;AAAA,QACV;AAAA,MACF;AAAA,IACF;AACA,SAAK,OAAO,KAAK,EAAE,MAAM,KAAK,CAAC;AAC/B,UAAM,WAAW,KAAK,QAAQ,IAAI,IAAI,KAAM,MAAM,KAAK,gBAAgB,MAAM,IAAI;AACjF,QAAI,YAAY,CAAC,KAAK,QAAQ,IAAI,IAAI,EAAG,MAAK,QAAQ,IAAI,MAAM,QAAQ;AACxE,UAAM,SAAS,KAAK,QAAQ,IAAI,IAAI;AACpC,QAAI,CAAC,QAAQ;AACX,aAAOD;AAAA,QACL;AAAA,QACAC,WAAU;AAAA,QACV,iCAAiC,IAAI;AAAA,MACvC;AAAA,IACF;AACA,QAAI,OAAO,YAAY;AACrB,aAAO,EAAE,WAAW,MAAM,OAAO,OAAO,YAAY,QAAQ,OAAU;AAAA,IACxE;AACA,UAAM,UAAU,KAAK,QAAQ,IAAI,IAAI;AACrC,SAAK,QAAQ,kBAAkB,KAAK,GAAG;AAErC,WAAK,QAAQ,IAAI,MAAM,EAAE,GAAG,SAAS,iBAAiB,QAAQ,kBAAkB,KAAK,EAAE,CAAC;AACxF,aAAO;AAAA,QACL,WAAW;AAAA,QACX,OAAO;AAAA,UACL,MAAMA,WAAU;AAAA,UAChB,SAAS;AAAA,UACT,WAAW;AAAA,UACX,QAAQ,CAAC;AAAA,QACX;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF;AACA,UAAMF,OAAM,KAAK,SAAS,MAAM,KAAK,QAAQ,IAAI,IAAI,GAAmB,oBAAoB;AAC5F,IAAAA,KAAI,aAAa;AACjB,SAAK,KAAK,IAAI,MAAMA,IAAG;AACvB,WAAO,cAAc,MAAM,KAAK,SAAS,MAAMA,IAAG,CAAC;AAAA,EACrD;AAAA,EAEQ,aACNG,YACA,MACA,SACA,YACA,sBACiB;AACjB,QAAI,KAAK,QAAQ,IAAI,IAAI,GAAG;AAC1B,aAAO,WAAWA,YAAW,WAAW,IAAI,CAAC;AAAA,IAC/C;AACA,UAAMH,OAAM,KAAK,KAAK,IAAI,IAAI;AAC9B,QAAI,CAACA,MAAK;AACR,aAAO,WAAWG,YAAW,WAAW,IAAI,CAAC;AAAA,IAC/C;AACA,QAAIH,KAAI,yBAAyB,sBAAsB;AACrD,aAAOC;AAAA,QACLE;AAAA,QACAD,WAAU;AAAA,QACV;AAAA,MACF;AAAA,IACF;AACA,IAAAF,KAAI,eAAe;AACnB,UAAM,mBAAmB,OAAO,UAAU;AAG1C,QAAI,qBAAqB,MAAM,mBAAmBA,KAAI,mBAAmB;AACvE,aAAO,WAAWG,YAAW,KAAK,SAAS,MAAMH,IAAG,CAAC;AAAA,IACvD;AACA,QAAI,mBAAmBA,KAAI,mBAAmB;AAC5C,MAAAA,KAAI,oBAAoB;AAAA,IAC1B;AACA,UAAM,UAAU,eAAe,KAAK,aAAa,KAAK,SAAS,MAAMA,KAAI,oBAAoB;AAC7F,QAAIA,KAAI,OAAO,QAAQ,CAACA,KAAI,aAAa;AAGvC,UAAI,CAACA,KAAI,OAAO,gBAAiB,MAAK,SAAS,MAAMA,MAAK,OAAO;AACjE,aAAO,WAAWG,YAAW,KAAK,SAAS,MAAMH,IAAG,CAAC;AAAA,IACvD;AAIA,UAAM,SAASA,KAAI,OAAO,OAAO,CAACI,WAAU,OAAOA,OAAM,GAAG,IAAI,OAAO;AACvE,mBAAe,MAAM;AACnB,iBAAWA,UAAS,QAAQ;AAC1B,aAAK,UAAU,QAAQ,SAASC,SAAQ,OAAOD,MAAK,EAAE,OAAO,CAAC;AAAA,MAChE;AAAA,IACF,CAAC;AACD,WAAO,WAAWD,YAAW,KAAK,SAAS,MAAMH,IAAG,CAAC;AAAA,EACvD;AAAA,EAEQ,YACNG,YACA,MACA,sBACiB;AACjB,QAAI,KAAK,QAAQ,IAAI,IAAI,GAAG;AAC1B,aAAO,WAAWA,YAAW,WAAW,IAAI,CAAC;AAAA,IAC/C;AACA,UAAMH,OAAM,KAAK,KAAK,IAAI,IAAI;AAC9B,QAAI,CAACA,MAAK;AACR,aAAO,WAAWG,YAAW,WAAW,IAAI,CAAC;AAAA,IAC/C;AACA,QAAIH,KAAI,yBAAyB,sBAAsB;AACrD,aAAOC;AAAA,QACLE;AAAA,QACAD,WAAU;AAAA,QACV;AAAA,MACF;AAAA,IACF;AACA,WAAO,WAAWC,YAAW,KAAK,SAAS,MAAMH,IAAG,CAAC;AAAA,EACvD;AAAA,EAEQ,aACNG,YACA,MACA,sBACiB;AACjB,UAAMH,OAAM,KAAK,KAAK,IAAI,IAAI;AAC9B,QAAI,CAACA,MAAK;AACR,WAAK,qBAAqB,IAAI,IAAI;AAClC,aAAO,WAAWG,YAAW,gBAAgB,IAAI,CAAC;AAAA,IACpD;AACA,QAAIH,KAAI,yBAAyB,sBAAsB;AACrD,aAAOC;AAAA,QACLE;AAAA,QACAD,WAAU;AAAA,QACV;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAACF,KAAI,eAAeA,KAAI,OAAO,iBAAiB;AAClD,MAAAA,KAAI,KAAK,WAAW;AACpB,MAAAA,KAAI,KAAK,YAAY;AACrB,MAAAA,KAAI,cAAc;AAClB,YAAM,UAAU;AAAA,QACd,KAAK;AAAA,QACL,KAAK;AAAA,QACL;AAAA,QACAA,KAAI;AAAA,MACN;AACA,qBAAe,MAAM;AACnB,mBAAWI,UAASJ,KAAI,QAAQ;AAC9B,eAAK,UAAU,QAAQ,SAASK,SAAQ,OAAOD,MAAK,EAAE,OAAO,CAAC;AAAA,QAChE;AAAA,MACF,CAAC;AAAA,IACH;AACA,WAAO,WAAWD,YAAW,KAAK,SAAS,MAAMH,IAAG,CAAC;AAAA,EACvD;AAAA;AAAA;AAAA,EAIQ,SAAS,MAAcA,MAAgB,SAAuB;AACpE,IAAAA,KAAI,cAAc;AAClB,UAAM,EAAE,cAAc,mBAAmB,iBAAiB,IAAIA,KAAI;AAClE,QAAI,WAAW,CAAC,GAAGA,KAAI,MAAM;AAC7B,QAAI,kBAAkB;AACpB,eAAS,IAAI,GAAG,IAAI,IAAI,SAAS,QAAQ,KAAK,GAAG;AAC/C,cAAM,IAAI,SAAS,CAAC;AACpB,iBAAS,CAAC,IAAI,SAAS,IAAI,CAAC;AAC5B,iBAAS,IAAI,CAAC,IAAI;AAAA,MACpB;AAAA,IACF;AACA,eAAW,SAAS,OAAO,CAACI,WAAU,CAAC,cAAc,IAAI,OAAOA,OAAM,GAAG,CAAC,CAAC;AAC3E,mBAAe,MAAM;AACnB,iBAAWA,UAAS,UAAU;AAC5B,cAAM,UAAUC,SAAQ,OAAOD,MAAK,EAAE,OAAO;AAC7C,aAAK,UAAU,QAAQ,SAAS,OAAO;AACvC,YAAI,mBAAmB,IAAI,OAAOA,OAAM,GAAG,CAAC,GAAG;AAC7C,eAAK,UAAU,QAAQ,SAAS,OAAO;AAAA,QACzC;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEQ,SAAS,MAAcJ,MAA0B;AAMvD,UAAM,WAAW,CAACA,KAAI,OAAO,QAAQA,KAAI;AACzC,WAAO;AAAA,MACL;AAAA,MACA,OAAO,WAAWM,SAAQ,oBAAoBA,SAAQ;AAAA,MACtD,SAAS,YAAYN,KAAI,UAAU,IAAI,SAAS,IAAI;AAAA,MACpD,aAAa;AAAA,MACb,MAAM,WAAWA,KAAI,OAAO;AAAA,MAC5B,YAAYO,cAAa;AAAA,IAC3B;AAAA,EACF;AAAA,EAEQ,SAAS,MAAc,QAAsB,sBAAyC;AAC5F,UAAM,SAAoB,CAAC;AAC3B,UAAM,eAA0D,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,EAAE;AACzF,QAAI,MAAM;AACV,eAAW,QAAQ,OAAO,QAAQ;AAChC,aAAO;AACP,UAAI,SAAS,YAAY;AACvB,eAAO,KAAK,EAAE,MAAM,KAAK,IAAI,SAAS,GAAG,MAAM,EAAE,OAAO,YAAY,UAAU,CAAC,EAAE,EAAE,CAAC;AACpF;AAAA,MACF;AACA,YAAM,QAAQ,OAAO,KAAK,UAAU,WAAWR,SAAQ,OAAO,KAAK,KAAK,IAAI,KAAK;AACjF,mBAAa,KAAK,OAAO,EAAE,KAAK,KAAK;AACrC,aAAO,KAAK;AAAA,QACV;AAAA,QACA,KAAK,IAAI,SAAS;AAAA,QAClB,MAAM;AAAA,UACJ,OAAO;AAAA,UACP,MAAM;AAAA,YACJ,SACE,KAAK,YAAY,WAAWS,WAAU,oBAAoBA,WAAU;AAAA,YACtE;AAAA,UACF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AACA,WAAO;AACP,UAAM,UAAkC,CAAC;AACzC,UAAM,SAAiC,CAAC;AACxC,eAAW,WAAW,CAAC,UAAU,QAAQ,GAAY;AACnD,YAAM,SAASC,QAAO,aAAa,OAAO,CAAC;AAC3C,cAAQ,OAAO,IAAIC,YAAWC,QAAO,MAAM,CAAC;AAC5C,aAAO,OAAO,IAAI,OAAO,OAAO,UAAU;AAAA,IAC5C;AACA,UAAM,OAAe;AAAA,MACnB,UAAU;AAAA,MACV,UAAU;AAAA,MACV,WAAW;AAAA,MACX,YAAY;AAAA,MACZ;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,eAAe,CAAC;AAAA,MAChB,GAAG,OAAO;AAAA,IACZ;AACA,WAAO,KAAK,EAAE,MAAM,KAAK,IAAI,SAAS,GAAG,MAAM,EAAE,OAAO,QAAQ,KAAK,EAAE,CAAC;AACxE,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT;AAAA,MACA,YAAY;AAAA,MACZ,aAAa;AAAA,MACb,mBAAmB,OAAO,kBAAkB;AAAA,MAC5C,aAAa;AAAA,MACb,YAAY;AAAA,MACZ,MAAM,CAAC;AAAA,MACP,mBAAmB;AAAA,IACrB;AAAA,EACF;AACF;AAEO,SAAS,6BAA6B,OAK1C;AACD,QAAM,YAAY,IAAI,0BAA0B;AAChD,QAAM,SAAS,IAAI,aAAa;AAAA,IAC9B;AAAA,IACA,aAAa,MAAM;AAAA,IACnB,SAAS,MAAM;AAAA,IACf,sBAAsB,MAAM;AAAA,IAC5B,eAAe,OAAO,SAAS;AAC7B,YAAM,WAAW,MAAM,MAAM,UAAU,QAAQ,IAAI;AACnD,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAI,SAAS,OAAO,SAAS,IACzB,CAAC,EAAE,SAAS,UAAmB,OAAO,SAAS,OAAO,CAAC,IACvD,CAAC;AAAA,UACL,GAAI,SAAS,OAAO,SAAS,IACzB,CAAC,EAAE,SAAS,UAAmB,OAAO,SAAS,OAAO,CAAC,IACvD,CAAC;AAAA,QACP;AAAA,QACA,MAAM;AAAA,UACJ,UAAU,SAAS;AAAA,UACnB,UAAU,SAAS;AAAA,UACnB,YAAY,SAAS;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACD,QAAM,aAAyB;AAAA,IAC7B,SAAS,OAAO,SAAS,SAAS,SAAS;AACzC,YAAM,OAAO,MAAM,MAAM,UAAU,QAAQ,SAAS,SAAS,IAAI;AACjE,UAAI,KAAK,OAAO,SAAST,WAAU,uBAAwB,QAAO;AAClE,aAAO,MAAM,OAAO,QAAQ,SAAS,SAAS,IAAI;AAAA,IACpD;AAAA,EACF;AACA,SAAO;AAAA,IACL;AAAA,IACA,UAAU,EAAE,UAAU;AAAA,IACtB;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAASO,QAAO,QAAkC;AAChD,QAAM,QAAQ,OAAO,OAAO,CAAC,KAAK,MAAM,MAAM,EAAE,YAAY,CAAC;AAC7D,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,QAAI,IAAI,OAAO,MAAM;AACrB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAEA,SAAS,gCAAgC,SAAqC;AAC5E,QAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,QAAM,kBAAkB,MAAM,QAAQ,YAAY;AAClD,SAAO,mBAAmB,IAAI,MAAM,kBAAkB,CAAC,IAAI;AAC7D;AAEA,SAASR,eAAcE,YAAmB,MAAiB,SAAkC;AAC3F,SAAO;AAAA,IACL,WAAAA;AAAA,IACA,OAAO,EAAE,MAAM,SAAS,WAAW,OAAO,QAAQ,CAAC,EAAE;AAAA,IACrD,QAAQ;AAAA,EACV;AACF;AAEA,SAAS,cAAcA,YAAmBS,SAAkB,WAAW,MAAuB;AAC5F,SAAO;AAAA,IACL,WAAAT;AAAA,IACA,OAAO;AAAA,IACP,QAAQ,EAAE,OAAO,WAAW,SAAS,EAAE,UAAU,QAAAS,QAAO,EAAE;AAAA,EAC5D;AACF;AAEA,SAAS,WAAWT,YAAmBS,SAAmC;AACxE,SAAO;AAAA,IACL,WAAAT;AAAA,IACA,OAAO;AAAA,IACP,QAAQ,EAAE,OAAO,YAAY,UAAUS,QAAO;AAAA,EAChD;AACF;AAEA,SAAS,WAAW,MAAwB;AAC1C,SAAO;AAAA,IACL;AAAA,IACA,OAAON,SAAQ;AAAA,IACf,aAAa;AAAA,IACb,SAAS;AAAA,IACT,MAAM;AAAA,IACN,YAAYC,cAAa;AAAA,EAC3B;AACF;AAEA,SAAS,gBAAgB,MAAwB;AAC/C,SAAO;AAAA,IACL;AAAA,IACA,OAAOD,SAAQ;AAAA,IACf,aAAa;AAAA,IACb,SAAS;AAAA,IACT,MAAM;AAAA,MACJ,UAAU;AAAA,MACV,UAAU;AAAA,MACV,WAAW;AAAA,MACX,YAAY;AAAA,MACZ,SAAS,CAAC;AAAA,MACV,QAAQ,CAAC;AAAA,MACT,aAAa;AAAA,MACb,eAAe,CAAC;AAAA,IAClB;AAAA,IACA,YAAYC,cAAa;AAAA,EAC3B;AACF;;;AC7aO,IAAM,iCAAN,cAA6C,MAAM;AAAA,EAC/C,OAAO;AAAA,EACP;AAAA,EACT,YAAY,MAA+B,SAAiB;AAC1D,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAyBO,SAAS,2BAA2B,QAGZ;AAC7B,MAAI,OAAO,gBAAgB;AACzB,WAAO,EAAE,IAAI,KAAK;AAAA,EACpB;AACA,MAAI,OAAO,SAAS,cAAc;AAChC,WAAO,EAAE,IAAI,KAAK;AAAA,EACpB;AACA,MAAI,OAAO,SAAS,SAAS;AAC3B,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,QACE;AAAA,IACJ;AAAA,EACF;AACA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,QAAQ,sBAAsB,OAAO,IAAI;AAAA,EAC3C;AACF;AAgBO,SAAS,0BACd,MAC4D;AAC5D,SAAO,OAAO,YAA2D;AASvE,QAAI,QAAQ,oBAAoB,MAAM;AAQpC,UAAI,KAAK,kBAAkB,OAAO;AAChC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,KAAK,uBAAuB;AAC9B,eAAO,MAAM,KAAK,sBAAsB,OAAO;AAAA,MACjD;AACA,aAAO;AAAA,QACL,SAAS,KAAK;AAAA,QACd,WAAW;AAAA,QACX,MAAM,KAAK;AAAA,MACb;AAAA,IACF;AASA,QACE,KAAK,oBACL,QAAQ,oBAAoB,KAAK,iBAAiB,aAClD,QAAQ,gBAAgB,KAAK,iBAAiB,OAC9C;AACA,aAAO;AAAA,QACL,SAAS,KAAK,iBAAiB;AAAA,QAC/B,WAAW,QAAQ;AAAA,QACnB,MAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,UAAU,MAAM,KAAK,WAAW,QAAQ,eAAe;AAC7D,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR;AAAA,QACA,kBAAkB,QAAQ,eAAe,2BAA2B,KAAK,WAAW;AAAA,MACtF;AAAA,IACF;AAEA,QAAI,QAAQ,SAAS,cAAc;AACjC,UAAI,CAAC,QAAQ,cAAc;AACzB,cAAM,IAAI;AAAA,UACR;AAAA,UACA,sBAAsB,QAAQ,EAAE;AAAA,QAClC;AAAA,MACF;AAMA,YAAM,aAAa,MAAM,KAAK,4BAA4B,OAAO;AACjE,UAAI,CAAC,YAAY;AACf,cAAM,IAAI;AAAA,UACR;AAAA,UACA,sBAAsB,QAAQ,EAAE;AAAA,QAClC;AAAA,MACF;AACA,UAAI,CAAC,WAAW,eAAe;AAC7B,cAAM,IAAI;AAAA,UACR;AAAA,UACA,sBAAsB,QAAQ,EAAE;AAAA,QAClC;AAAA,MACF;AACA,YAAMM,iBAAgB;AAAA,QACpB,WAAW;AAAA,QACX,QAAQ;AAAA,MACV;AACA,YAAM,EAAE,QAAQ,IAAI,MAAM,8BAA8B;AAAA,QACtD,aAAa,KAAK;AAAA,QAClB,GAAI,WAAW,gBAAgB,SAC3B,EAAE,oBAAoB,WAAW,YAAY,IAC7C,CAAC;AAAA,QACL,OAAO,KAAK;AAAA,QACZ,mBAAmB,KAAK;AAAA,QACxB,SAAS,QAAQ;AAAA,QACjB,sBAAsB,WAAW;AAAA,QACjC,eAAAA;AAAA,QACA,OAAO,QAAQ;AAAA,QACf,GAAI,KAAK,wBAAwB,SAAY,EAAE,WAAW,KAAK,oBAAoB,IAAI,CAAC;AAAA,QACxF,GAAI,KAAK,4BAA4B,SACjC,EAAE,eAAe,KAAK,wBAAwB,IAC9C,CAAC;AAAA,QACL,GAAI,KAAK,mBAAmB,SAAY,EAAE,MAAM,KAAK,eAAe,IAAI,CAAC;AAAA,QACzE,GAAI,KAAK,qCAAqC,SAC1C,EAAE,wBAAwB,KAAK,iCAAiC,IAChE,CAAC;AAAA,QACL,GAAI,KAAK,sCAAsC,SAC3C,EAAE,yBAAyB,KAAK,kCAAkC,IAClE,CAAC;AAAA,QACL,GAAI,KAAK,2CACL,EAAE,gCAAgC,KAAK,yCAAyC,IAChF,CAAC;AAAA,QACL,GAAI,WAAW,aAAa,SAAY,EAAE,UAAU,WAAW,SAAS,IAAI,CAAC;AAAA,QAC7E,yBAAyB,WAAW;AAAA,QACpC,kCAAkC,WAAW;AAAA,QAC7C,4BAA4B,WAAW;AAAA,QACvC,+BAA+B,WAAW,kCAAkC;AAAA,QAC5E,6BAA6B,WAAW,gCAAgC;AAAA;AAAA;AAAA;AAAA,QAIxE,2BAA2B,YAAY;AACrC,gBAAM,UAAU,MAAM,KAAK,4BAA4B,OAAO;AAC9D,cAAI,CAAC,QAAS,QAAO;AACrB,cAAI,CAAC,QAAQ,eAAe;AAC1B,kBAAM,IAAI;AAAA,cACR;AAAA,cACA,sBAAsB,QAAQ,EAAE;AAAA,YAClC;AAAA,UACF;AACA,iBAAO;AAAA,YACL,GAAG;AAAA,YACH,eAAe;AAAA,cACb,QAAQ;AAAA,cACR,QAAQ;AAAA,YACV;AAAA,UACF;AAAA,QACF;AAAA;AAAA;AAAA;AAAA,QAIA,GAAI,KAAK,gBAAgB,SAAY,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;AAAA,QAC1E,GAAI,KAAK,6BAA6B,SAClC,EAAE,0BAA0B,KAAK,yBAAyB,IAC1D,CAAC;AAAA,MACP,CAAC;AACD,aAAO;AAAA,QACL;AAAA,QACA,WAAW,QAAQ;AAAA,QACnB,MAAM;AAAA,MACR;AAAA,IACF;AAEA,QAAI,QAAQ,SAAS,SAAS;AAC5B,UAAI,CAAC,KAAK,sBAAsB;AAC9B,cAAM,IAAI;AAAA,UACR;AAAA,UACA,qBAAqB,QAAQ,EAAE;AAAA,QACjC;AAAA,MACF;AACA,YAAM,UAAU,MAAM,KAAK,qBAAqB,OAAO;AACvD,aAAO,EAAE,SAAS,WAAW,QAAQ,IAAI,MAAM,QAAQ;AAAA,IACzD;AAEA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iCAAiC,QAAQ,IAAI,iBAAiB,QAAQ,EAAE;AAAA,IAC1E;AAAA,EACF;AACF;;;A5D6PO,SAAS,oBACd,UACA,cAAc,0BAA0B,QAAQ,GACvC;AACT,SAAO;AAAA,IACL,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AAYO,SAAS,8BACd,SACA,UACA,cAAc,0BAA0B,QAAQ,GAChD,SACS;AACT,QAAM,eAAe,kBAAkB,OAAO;AAC9C,MAAI,CAAC,cAAc;AACjB,UAAM,IAAI,mBAAmB,SAAS,4BAA4B,OAAO,GAAG;AAAA,EAC9E;AACA,MAAI,aAAa,YAAY,QAAQ;AACnC,WAAO;AAAA,EACT;AACA,eAAa,oBAAoB,QAAQ;AAEzC,QAAM,eAAe,kBAAkB,SAAS,kBAAkB;AAKlE,QAAM,UAAU,aAAa,WAAW,aAAa;AACrD,MACE,QAAQ,aACR,SAAS,yBACT,CAAC,aAAa,WAAW,aAAa,yBACtC,CAAC,aAAa,SAASC,oBAAmB,GAC1C;AACA,iBAAa,KAAKA,oBAAmB;AAAA,EACvC;AAKA,MACE,QAAQ,aACR,SAAS,0BACT,CAAC,aAAa,WAAW,aAAa,yBACtC,CAAC,aAAa,SAASC,qBAAoB,GAC3C;AACA,iBAAa,KAAKA,qBAAoB;AAAA,EACxC;AAIA,MACE,CAAC,aAAa,WAAW,aAAa,yBACtC,CAAC,aAAa,SAASC,qBAAoB,GAC3C;AACA,iBAAa,KAAKA,qBAAoB;AAAA,EACxC;AAEA,QAAM,MAAM;AAAA,IACV;AAAA,IACA,aAAa,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/B,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,YAAY,WAC5B,kBAAkB,KAAsB,SAAS,aAAa,IAC9D;AACN;AAEA,SAAS,gCACP,cACA,KACS;AACT,MAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,UAAM,IAAI;AAAA,MACR,aAAa;AAAA,MACb,oBAAoB,aAAa,OAAO;AAAA,IAC1C;AAAA,EACF;AACA,QAAM,SAAS;AAIf,MAAI,OAAO,OAAO,WAAW,YAAY;AACvC,UAAM,IAAI;AAAA,MACR,aAAa;AAAA,MACb,oBAAoB,aAAa,OAAO;AAAA,IAC1C;AAAA,EACF;AACA,MAAI,aAAa,oBAAoB,UAAU;AAC7C,QAAI,OAAO,OAAO,gBAAgB,YAAY;AAC5C,YAAM,IAAI;AAAA,QACR,aAAa;AAAA,QACb,oBAAoB,aAAa,OAAO;AAAA,MAC1C;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,MAAI,aAAa,oBAAoB,YAAY;AAC/C,UAAM,IAAI;AAAA,MACR,aAAa;AAAA,MACb,oBAAoB,aAAa,OAAO;AAAA,IAC1C;AAAA,EACF;AACA,QAAM,SAAS,OAAO;AACtB,SAAO,eAAe,QAAQ,eAAe;AAAA,IAC3C,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,UAAU;AAAA,IACV,OAAO,OAAO,UAAmB,MAAM,OAAO,KAAK,QAAQ,KAAK;AAAA,EAClE,CAAC;AACD,SAAO;AACT;AAEA,SAAS,kBAAkB,QAAuB,SAA4C;AAC5F,QAAM,UAAU,SAAS,KAAK;AAC9B,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AACA,QAAM,cACJ,OAGA;AACF,QAAM,cAAc,OAAqC,YAA2B;AAClF,UAAM,cAAe,QAAkD,OAAO;AAC9E,QAAI,OAAO,gBAAgB,YAAY,YAAY,SAAS,GAAG;AAC7D,YAAM,qBAAqB,SAAS,WAAW;AAC/C,YAAM,eACJ,QAGA;AACF,UAAI,OAAO,iBAAiB,YAAY;AACtC,eAAO,eAAe,SAAS,sBAAsB;AAAA,UACnD,cAAc;AAAA,UACd,YAAY;AAAA,UACZ,UAAU;AAAA,UACV,OAAO,OAAO,SACZ;AAAA,YACE;AAAA,YACA;AAAA,YACA,MAAM,aAAa,KAAK,SAAS,IAAI;AAAA,UACvC;AAAA,QACJ,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,WAAW,OAAO;AAAA,IAClB,GAAI,OAAO,2BAA2B,SAClC,EAAE,wBAAwB,OAAO,uBAAuB,IACxD,CAAC;AAAA,IACL,GAAI,OAAO,SACP;AAAA,MACE,QAAQ,UAAU,SAChB,MAAM,YAAY,MAAO,OAAO,OAAe,GAAG,IAAI,CAAC;AAAA,IAC3D,IACA,CAAC;AAAA,IACL,GAAI,OAAO,SACP;AAAA,MACE,QAAQ,OAAO,UACb,MAAM,YAAY,MAAM,OAAO,OAAQ,KAAK,CAAC;AAAA,IACjD,IACA,CAAC;AAAA,IACL,GAAI,cACA;AAAA;AAAA;AAAA;AAAA;AAAA,MAKE,aAAa,OAAO,UAClB,MAAM,YAAY,MAAM,YAAY,KAAK,QAAQ,KAAK,CAAC;AAAA,IAC3D,IACA,CAAC;AAAA,IACL,GAAI,6BAA6B,UAAU,OAAO,OAAO,4BAA4B,aACjF;AAAA;AAAA,MAEE,yBAAyB,OAAO,wBAAwB,KAAK,MAAM;AAAA,IACrE,IACA,CAAC;AAAA,IACL,GAAI,OAAO,SACP;AAAA,MACE,QAAQ,OAAO,UAA+B,MAAM,OAAO,OAAQ,KAAK;AAAA,IAC1E,IACA,CAAC;AAAA,IACL,GAAI,OAAO,wBACP;AAAA,MACE,uBAAuB,OAAO,OAA4B,YACxD,MAAM,OAAO,sBAAuB,OAAO,OAAO;AAAA,IACtD,IACA,CAAC;AAAA,IACL,GAAI,OAAO,8BACP;AAAA,MACE,6BAA6B,OAAO,UAClC,MAAM,OAAO,4BAA6B,KAAK;AAAA,IACnD,IACA,CAAC;AAAA,IACL,GAAI,OAAO,gCACP;AAAA,MACE,+BAA+B,OAAO,UACpC,MAAM,OAAO,8BAA+B,KAAK;AAAA,IACrD,IACA,CAAC;AAAA,IACL,GAAI,OAAO,0BACP;AAAA,MACE,yBAAyB,OAAO,UAC9B,MAAM,OAAO,wBAAyB,KAAK;AAAA,IAC/C,IACA,CAAC;AAAA,EACP;AACF;AASO,SAAS,iCACd,aACA,eACA,UACqB;AACrB,QAAM,OAAO,kBAAkB,KAAK,WAAW,IAAI,YAAY,MAAM,GAAG,EAAE,IAAI;AAC9E,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,MAAM;AAAA,EACR;AACF;AAEA,eAAe,qBAAqB,SAAiB,aAAoC;AACvF,QAAM,EAAE,UAAU,IAAI,MAAM,OAAO,eAAoB;AACvD,QAAM,SAAS,UAAU,UAAU,CAAC,WAAW,WAAW,SAAS,WAAW,GAAG;AAAA,IAC/E,UAAU;AAAA,EACZ,CAAC;AACD,MAAI,OAAO,WAAW,GAAG;AACvB;AAAA,EACF;AACA,QAAM,SAAS,OAAO,UAAU,OAAO,OAAO,WAAW;AACzD,MAAI,OAAO,SAAS,gBAAgB,GAAG;AACrC;AAAA,EACF;AACA,QAAM,IAAI;AAAA,IACR,yDAAyD,OAAO,KAAK,OAAO,KAAK,CAAC;AAAA,EACpF;AACF;AAOO,SAAS,8BACd,OACA,UAKI,CAAC,GAC2B;AAChC,QAAM,eAAgB,OAAe;AACrC,MAAI,CAAC,cAAc;AACjB,WAAO;AAAA,EACT;AACA,QAAM,QACJ,aAAa,kBAAkB,aAAa,eAAe,MAC1D,aAAa,mBAAmB,aAAa,eAC1C;AAAA,IACE,WAAW,aAAa;AAAA,IACxB,iBAAiB,aAAa;AAAA,IAC9B,kBAAkB,aAAa;AAAA,IAC/B,cAAc,aAAa;AAAA,EAC7B,IACA;AACN,MAAI,CAAC,SAAS,CAAC,MAAM,cAAc;AACjC,WAAO;AAAA,EACT;AACA,QAAM,YAAY,2BAA2B,KAAgC;AAC7E,SAAO;AAAA,IACL,QAAQ,sBACJ,oCAAoC,WAAW,QAAQ,mBAAmB,IAC1E;AAAA,IACJ;AAAA,EACF;AACF;AAEA,SAAS,wBAAwB,OAAgB,MAA0C;AACzF,MAAI,CAAC,eAAe,KAAK,EAAG,QAAO;AACnC,SAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC;AAChF;AAKO,SAAS,oCACd,OACA,MACyB;AACzB,QAAM,eAAe,MAAM;AAC3B,MAAI,CAAC,eAAe,YAAY,EAAG,QAAO;AAC1C,QAAM,OAAgC,EAAE,GAAG,aAAa;AACxD,QAAM,WAAW,aAAa;AAC9B,MAAI,eAAe,QAAQ,KAAK,OAAO,OAAO,UAAU,aAAa,GAAG;AACtE,UAAM,QACJ,OAAO,eAAe,QAAQ,MAAM,OAAO,aAC3C,OAAO,eAAe,QAAQ,MAAM,OAChC,WACC,gCAAgC,QAAQ;AAC/C,SAAK,WAAW,EAAE,GAAG,OAAO,aAAa,wBAAwB,MAAM,aAAa,IAAI,EAAE;AAAA,EAC5F;AACA,MAAI,OAAO,OAAO,cAAc,aAAa,GAAG;AAC9C,SAAK,cAAc,wBAAwB,aAAa,aAAa,IAAI;AAAA,EAC3E;AACA,QAAM,gBAAgB,aAAa;AACnC,MAAI,eAAe,aAAa,KAAK,OAAO,OAAO,eAAe,aAAa,GAAG;AAChF,SAAK,gBAAgB;AAAA,MACnB,GAAG;AAAA,MACH,aAAa,wBAAwB,cAAc,aAAa,IAAI;AAAA,IACtE;AAAA,EACF;AACA,SAAO,EAAE,GAAG,OAAO,cAAc,KAAK;AACxC;AAUA,SAAS,2BAA2B,OAAyD;AAC3F,QAAM,eAAe,MAAM;AAC3B,MAAI,CAAC,eAAe,YAAY,KAAK,CAAC,OAAO,OAAO,cAAc,UAAU,GAAG;AAC7E,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,aAAa;AACnC,MAAI,CAAC,eAAe,aAAa,KAAK,CAAC,OAAO,OAAO,eAAe,UAAU,GAAG;AAC/E,WAAO;AAAA,EACT;AACA,QAAM,EAAE,UAAU,oBAAoB,GAAG,uBAAuB,IAAI;AACpE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,cAAc;AAAA,MACZ,GAAG;AAAA,MACH,eAAe;AAAA,IACjB;AAAA,EACF;AACF;AAEA,SAAS,eAAe,OAAkD;AACxE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,sCAAsC,OAAwC;AACrF,QAAM,EAAE,UAAU,WAAW,GAAG,cAAc,IAAI;AAClD,SAAO;AACT;AAEA,SAAS,gCAAgC,OAAyB;AAChE,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,MAAI,cAAc,OAAO,aAAa,cAAc,KAAM,QAAO;AACjE,SAAO,wBAAwB,KAAiB;AAClD;AAOA,eAAsB,qCACpB,OACA,QAC0C;AAC1C,MAAI,CAAC,UAAU,CAAC,SAAS,OAAO,UAAU,YAAY,EAAE,kBAAkB,QAAQ;AAChF,WAAO;AAAA,EACT;AACA,MAAI,MAAM,aAAc,OAAyB,cAAc,MAAM,WAAW;AAC9E,UAAM,IAAI,MAAM,8EAA8E;AAAA,EAChG;AACA,SAAO,MAAM,uCAAuC,QAAyB,MAAM,YAAY;AACjG;AAiBO,SAAS,6CACd,cACwB;AACxB,MAAI,CAAC,gBAAgB,OAAO,iBAAiB,UAAU;AACrD,WAAO;AAAA,EACT;AACA,QAAM,MAAO,aAAgD;AAC7D,MAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,GAAG;AAC/C,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,WAAW,KAAK,OAAO,KAAK,KAAK,QAAQ,CAAC;AAAA,EACnD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIO,SAAS,sBAAsB,SAAyC;AAC7E,QAAM,MAAMC,yBAAwB,OAAO;AAC3C,SAAO,KAAK,aAAa,+BACvB,KAAK,aAAa,6BAChB,IAAI,aACJ;AACN;AAEA,eAAsB,uCACpB,QACA,UACA,oBAC0C;AAC1C,MAAI,CAAC,YAAY,OAAO,aAAa,UAAU;AAC7C,WAAO;AAAA,EACT;AACA,MAAI,CAAC,OAAO,yBAAyB;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAQ;AASd,QAAM,gBAAgB,EAAE,GAAI,MAAM,iBAAiB,CAAC,EAAG;AACvD,MAAI,oBAAoB;AACtB,UAAM,UAAU,8BAA8B,OAAO,SAAS,KAAK,OAAO;AAC1E,UAAM,qBAAqB,gCAAgC,SAAS,aAAa;AACjF,QAAI,sBAAsB,uBAAuB,oBAAoB;AACnE,YAAM,IAAI,mCAAmC,SAAS,oBAAoB,kBAAkB;AAAA,IAC9F;AACA,QAAI,CAAC,oBAAoB;AACvB,YAAM,kBAAkB,kBAAkB,OAAyB,GAAG,iBAAiB,CAAC;AACxF,UAAI,iBAAiB;AAKnB,sBAAc,eAAe,IAAI;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AACA,QAAM,eAAe,2BAA2B,MAAM,YAAY;AAClE,MAAI,MAAM,iBAAiB,UAAa,iBAAiB,QAAW;AAClE,YAAQ,KAAK,wDAAwD;AAAA,MACnE,UAAU,8BAA8B,OAAO,SAAS;AAAA,MACxD,cAAc;AAAA,MACd,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO,MAAM,OAAO,wBAAwB;AAAA,IAC1C,GAAG;AAAA,IACH,UAAU,MAAM;AAAA,IAChB,GAAI,MAAM,aAAa,SAAY,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;AAAA,IACnE,GAAI,MAAM,wBAAwB,SAC9B,EAAE,qBAAqB,MAAM,oBAAoB,IACjD,CAAC;AAAA,IACL,GAAI,MAAM,+BAA+B,SACrC,EAAE,4BAA4B,MAAM,2BAA2B,IAC/D,CAAC;AAAA,IACL,gBAAgB,MAAM;AAAA,IACtB,GAAI,iBAAiB,SAAY,EAAE,aAAa,IAAI,CAAC;AAAA,EACvD,CAAC;AACH;AAuDA,eAAsB,+BACpB,QACA,cACA,SACe;AACf,QAAM,kBAAkB;AAIxB,QAAM,mBAAmB;AACzB,QAAM,UAAU,EAAE,QAAQ,UAAU;AACpC,MAAI;AACJ,QAAM,UAAU,OAAO,cAAgE;AACrF,QAAI,CAAC,UAAW;AAChB,QAAI;AACF,YAAM,UAAU;AAAA,IAClB,SAAS,OAAO;AACd,qBAAe;AAAA,IACjB;AAAA,EACF;AACA,QAAM,kBACJ,OAAO,iBAAiB,oBAAoB,aACxC,iBAAiB,gBAAgB,KAAK,gBAAgB,IACtD;AACN,QAAM,UACJ,OAAO,iBAAiB,YAAY,aAChC,iBAAiB,QAAQ,KAAK,gBAAgB,IAC9C;AACN,QAAM,OACJ,OAAO,iBAAiB,SAAS,aAC7B,iBAAiB,KAAK,KAAK,gBAAgB,IAC3C;AACN,QAAM,WACJ,OAAO,iBAAiB,aAAa,aACjC,iBAAiB,SAAS,KAAK,gBAAgB,IAC/C;AACN,QAAM,gBACJ,OAAO,iBAAiB,WAAW,aAC/B,iBAAiB,OAAO,KAAK,gBAAgB,IAC7C;AACN,QAAM,QACJ,OAAO,iBAAiB,UAAU,aAC9B,iBAAiB,MAAM,KAAK,gBAAgB,IAC5C;AAQN,QAAM,QAAQ,eAAe;AAC7B,QAAM,QAAQ,UAAU,YAAY,MAAM,QAAQ,OAAO,IAAI,MAAS;AACtE,QAAM,QAAQ,OAAO,YAAY,MAAM,KAAK,OAAO,IAAI,MAAS;AAChE,QAAM,QAAQ,WAAW,YAAY,MAAM,SAAS,OAAO,IAAI,MAAS;AACxE,QAAM,QAAQ,gBAAgB,YAAY,MAAM,cAAc,OAAO,IAAI,MAAS;AAClF,QAAM,sBAAsB,QAAQ,QAAQ,YAAY,aAAa;AACrE,MAAI,CAAC,uBAAuB,OAAO;AACjC,UAAM,QAAQ,KAAK;AAAA,EACrB,WACE,CAAC,uBACD,CAAC,SACD,OAAO,gBAAgB,WAAW,cAClC,iBAAiB,UACjB,iBAAiB,MACjB;AACA,UAAM,QAAQ,YAAY,MAAM,gBAAgB,OAAQ,YAAqB,CAAC;AAAA,EAChF;AACA,MAAI,WAAY,OAAM;AACtB,MACE,uBACA,SACC,OAAO,gBAAgB,WAAW,cACjC,iBAAiB,UACjB,iBAAiB,MACnB;AACA;AAAA,EACF;AAEA,QAAM,YACJ,OAAO,gBAAgB,cAAc,WAAW,gBAAgB,YAAY;AAC9E,QAAM,IAAI,MAAM,mBAAmB,SAAS,0CAA0C;AACxF;AAEO,IAAM,4BAAN,cAAwC,MAAM;AAAA,EAGnD,YACkB,SACA,MACA,WACA,WAA0B,MAC1B,aAA4B,MAC5C;AACA,UAAM,SAAS,aAAa,GAAG,OAAO,YAAY,UAAU,KAAK,GAAG,OAAO;AAC3E;AAAA,MACE,SAAS,uBACL,GAAG,MAAM,kDAAkD,SAAS,OACpE,SAAS,2BACP,GAAG,MAAM,qDACT,aAAa,OACX,GAAG,MAAM,6DACT,GAAG,MAAM,+CAA+C,QAAQ;AAAA,IAC1E;AAfgB;AACA;AACA;AACA;AACA;AAAA,EAYlB;AAAA,EAnBS,OAAO;AAoBlB;AAKO,IAAM,kCAAkC;AAE/C,SAAS,0BAA0B,QAAgC;AACjE,MAAI,OAAO,WAAW,SAAU,QAAO,yBAAyB,MAAM;AACtE,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,YAAY;AAClB,aAAW,SAAS,CAAC,UAAU,WAAW,UAAU,UAAU,GAAG;AAC/D,QAAI,OAAO,UAAU,YAAY,OAAO,cAAc,KAAK,KAAK,SAAS,EAAG,QAAO;AAAA,EACrF;AACA,SAAO;AACT;AAKA,eAAsB,2BACpB,aACA,YAAY,iCACZ,QACe;AACf,UAAQ,eAAe;AACvB,MAAI,YAAY,cAAc,WAAW,YAAY,cAAc,cAAe;AAClF,QAAM,UAAU,YAAY;AAmB5B,QAAMC,OAAM,QAAQ,QAAQ,QAAQ;AACpC,QAAM,mBACJ,YAAY,cAAc,UAAU,QAAQ,sBAAsB;AACpE,MAAI,CAACA,QAAO,CAAC,kBAAkB;AAC7B,UAAM,IAAI;AAAA,MACR,YAAY;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA,YAAY;AAAA,IACd;AAAA,EACF;AACA,QAAM,eAAe,MACnB,IAAI;AAAA,IACF,YAAY;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY;AAAA,EACd;AACF,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,QAAM,iBAAiB,OAAU,cAA4C;AAC3E,YAAQ,eAAe;AACvB,UAAM,cAAc,WAAW,KAAK,IAAI;AACxC,QAAI,eAAe,EAAG,OAAM,aAAa;AACzC,QAAI;AACJ,QAAI;AACJ,QAAI;AACF,YAAM,cAAc,IAAI,QAAe,CAAC,GAAG,WAAW;AACpD,gBAAQ,MAAM,OAAO,QAAQ,MAAM;AACnC,gBAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AACvD,YAAI,QAAQ,QAAS,OAAM;AAC3B,gBAAQ,WAAW,MAAM,OAAO,aAAa,CAAC,GAAG,WAAW;AAC5D,YAAI,SAAS,WAAW,SAAS,OAAO,MAAM,UAAU,WAAY,OAAM,MAAM;AAAA,MAClF,CAAC;AACD,YAAMC,UAAS,MAAM,QAAQ,KAAK,CAAC,UAAU,GAAG,WAAW,CAAC;AAC5D,cAAQ,eAAe;AACvB,aAAOA;AAAA,IACT,UAAE;AACA,UAAI,MAAO,cAAa,KAAK;AAC7B,UAAI,MAAO,SAAQ,oBAAoB,SAAS,KAAK;AAAA,IACvD;AAAA,EACF;AACA,MAAI,kBAAkB;AACpB,UAAM,eAAe,IAAI,gBAAgB;AACzC,UAAM,QAAQ,MAAM,aAAa,MAAM,QAAQ,MAAM;AACrD,YAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AACvD,QAAI,QAAQ,QAAS,OAAM;AAC3B,QAAI;AACF,YAAM,WAAW,MAAM;AAAA,QAAe,MACpC,iBAAiB,KAAK,SAAS,aAAa,MAAM;AAAA,MACpD;AACA,UAAI,aAAa;AACf,cAAM,IAAI;AAAA,UACR,YAAY;AAAA,UACZ;AAAA,UACA;AAAA,UACA;AAAA,UACA,YAAY;AAAA,QACd;AACF;AAAA,IACF,UAAE;AACA,cAAQ,oBAAoB,SAAS,KAAK;AAC1C,mBAAa,MAAM,IAAI,MAAM,wCAAwC,CAAC;AAAA,IACxE;AAAA,EACF;AACA,QAAM,YAAY,MAChB;AAAA,IAAe,MACbD,KAAK,KAAK,SAAS;AAAA,MACjB,KAAK;AAAA,MACL,aAAa,KAAK,IAAI,KAAO,KAAK,IAAI,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC;AAAA,MAC/D,iBAAiB;AAAA,IACnB,CAAC;AAAA,EACH;AAEF,MAAI,SAAS,MAAM,UAAU;AAC7B,SAAO,MAAM;AACX,UAAM,WAAW,uBAAuB,MAAM;AAC9C,QAAI,aAAa,MAAM;AACrB,UAAI,aAAa,EAAG;AACpB,YAAM,IAAI;AAAA,QACR,YAAY;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY;AAAA,MACd;AAAA,IACF;AAEA,UAAM,YAAY,2BAA2B,MAAM,IAAI,0BAA0B,MAAM,IAAI;AAC3F,UAAM,aAAa,QAAQ;AAC3B,QAAI,cAAc,QAAQ,YAAY;AACpC,eAAS,MAAM;AAAA,QAAe,MAC5B,WAAW,KAAK,SAAS;AAAA,UACvB;AAAA,UACA,OAAO;AAAA,UACP,aAAa,KAAK,IAAI,KAAO,KAAK,IAAI,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC;AAAA,UAC/D,iBAAiB;AAAA,QACnB,CAAC;AAAA,MACH;AACA;AAAA,IACF;AAEA,UAAM,cAAc,WAAW,KAAK,IAAI;AACxC,QAAI,eAAe,EAAG,OAAM,aAAa;AACzC,UAAM,IAAI,QAAQ,CAACE,aAAY,WAAWA,UAAS,KAAK,IAAI,KAAK,WAAW,CAAC,CAAC;AAC9E,aAAS,MAAM,UAAU;AAAA,EAC3B;AACF;AAuCA,SAAS,gCACP,SACA,OACe;AACf,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAM,eAAe,kBAAkB,OAAyB;AAChE,MAAI,CAAC,gBAAgB,aAAa,YAAY,QAAS,QAAO;AAC9D,QAAM,SAAS;AACf,aAAW,SAAS,aAAa,kBAAkB;AACjD,UAAM,QAAQ,OAAO,KAAK;AAC1B,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAAA,EAC5D;AACA,SAAO;AACT;AAEA,SAAS,4CACP,UACA,SACe;AACf,QAAM,eACJ,UAAU,gBAAgB,OAAO,SAAS,iBAAiB,WACtD,SAAS,eACV;AACN,QAAM,gBACJ,cAAc,iBAAiB,OAAO,aAAa,kBAAkB,WACjE,aAAa,gBACb,UAAU;AAChB,QAAM,oBACJ,OAAO,UAAU,cAAc,YAAY,SAAS,UAAU,SAAS,IACnE,SAAS,YACT;AACN,QAAM,kBACJ,YACC,oBACI,8BAA8B,iBAAiB,KAAK,oBACrD;AACN,SAAO,kBAAkB,gCAAgC,iBAAiB,aAAa,IAAI;AAC7F;AAKO,SAAS,sCACd,UACA,SACe;AACf,QAAM,WAAW,WAAWC,4CAA2C;AACvE,MAAI,OAAO,aAAa,YAAY,SAAS,SAAS,EAAG,QAAO;AAChE,SAAO,4CAA4C,UAAU,OAAO;AACtE;AAKO,SAAS,wCACd,SACA,UACe;AACf,QAAM,WAAW,WAAWA,4CAA2C;AACvE,QAAM,SAAS,OAAO,aAAa,YAAY,SAAS,SAAS,IAAI,WAAW;AAChF,QAAM,SAAS,4CAA4C,UAAU,OAAO;AAC5E,MAAI,UAAU,UAAU,WAAW,QAAQ;AACzC,UAAM,IAAI,mCAAmC,SAAS,QAAQ,MAAM;AAAA,EACtE;AACA,SAAO,UAAU;AACnB;AAEA,SAAS,2BAA2B,SAAiB,OAAyB;AAC5E,MAAI,YAAY,YAAY,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvF,WAAO;AAAA,EACT;AAKA,QAAM,aAAa,EAAE,GAAI,MAAkC;AAC3D,SAAO,WAAW;AAClB,SAAO;AACT;AAEA,SAAS,+BAA+B,SAAkC;AACxE,QAAM,eAAe,kBAAkB,OAAyB;AAChE,SAAO,cAAc,YAAY,UAAU,aAAa,aAAa;AACvE;AAEO,SAAS,kCACd,SACA,OACA,kBAC0C;AAC1C,QAAM,aAAa,+BAA+B,OAAO;AACzD,QAAM,gBAAgB,YAAY,aAAa,KAAK,KAAK;AACzD,MAAI,CAAC,cAAc,CAAC,iBAAiB,iBAAiB,WAAW,EAAG,QAAO;AAC3E,SAAO;AAAA,IACL,SAAS;AAAA,IACT;AAAA,IACA,MAAM,WAAW;AAAA,IACjB;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,yBACP,SACA,UACA,OACA,oBAC0C;AAC1C,QAAM,WACJ,UAAU,oBAAoB,OAAO,SAAS,qBAAqB,WAC9D,SAAS,mBACV;AACN,QAAM,QAAQ,UAAU;AACxB,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAM,YAAY;AAClB,QAAM,UAAU,kCAAkC,SAAS,OAAO,kBAAkB;AACpF,SAAO,WACL,UAAU,YAAY,QAAQ,WAC9B,UAAU,YAAY,QAAQ,WAC9B,UAAU,SAAS,QAAQ,QAC3B,UAAU,qBAAqB,QAAQ,oBACvC,UAAU,kBAAkB,QAAQ,gBAClC,UACA;AACN;AAEA,SAAS,uBACP,SACA,OACS;AACT,QAAM,aAAa,+BAA+B,QAAQ,OAAO;AACjE,SACE,YAAY,SAAS,QAAQ,QAAQ,WAAW,aAAa,KAAK,MAAM,QAAQ;AAEpF;AAEA,SAAS,sCACP,SACA,gBACA,SACA,cACS;AACT,QAAM,aAAa,+BAA+B,OAAO;AACzD,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,eAAe,WAAW,aAAa,cAAc;AAC3D,QAAM,iBAAiB,WAAW,aAAa,YAAY;AAC3D,MAAI,CAAC,gBAAgB,iBAAiB,eAAgB,QAAO;AAC7D,aAAW,4BAA4B,SAAS,YAAY;AAC5D,SAAO;AACT;AAEA,eAAsB,0BACpB,aACA,SACA,OACA,oBACA,SAMC;AACD,QAAM,SAAS;AACf,MAAI,CAAC,OAAO,QAAQ;AAClB,UAAM,IAAI,mBAAmB,SAAS,oBAAoB,OAAO,6BAA6B;AAAA,EAChG;AACA,QAAM,aAAa,2BAA2B,OAAO,WAAW,KAAK;AACrE,QAAM,aAAa,SAAS;AAC5B,MACE,eACC,WAAW,YAAY,WACtB,WAAW,qBAAqB,sBAChC,CAAC,uBAAuB,YAAY,UAAU,IAChD;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb;AAAA,EACF;AACA,MAAI,CAAC,cAAc,CAAC,OAAO,aAAa;AACtC,UAAM,IAAI;AAAA,MACR;AAAA,MACA,oBAAoB,OAAO;AAAA,IAC7B;AAAA,EACF;AAIA,QAAM,UAAU,aACZ,MAAM,OAAO,OAAO,UAAU,IAC9B,MAAM,OAAO,YAAa,UAAU;AACxC,QAAM,mBAAmB,eAAe,SAAS,OAAO;AACxD,MAAI,CAAC,kBAAkB;AAIrB,UAAM,IAAI,sCAAsC,SAAS,kBAAkB;AAAA,EAC7E;AACA,MAAI,qBAAqB,oBAAoB;AAC3C,UAAM,mBAAoB,QAAgC,SAAS;AACnE,QAAI,cAAc,uBAAuB,YAAY,gBAAgB,GAAG;AACtE,aAAO;AAAA,QACL;AAAA,QACA,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,oBAAoB;AAAA,MACtB;AAAA,IACF;AAIA,0CAAsC,SAAS,YAAY,SAAS,gBAAgB;AACpF,QAAI;AACF,YAAM,+BAA+B,QAAQ,kBAAkB,OAAO;AAAA,IACxE,SAAS,cAAc;AACrB,YAAM,IAAI,mCAAmC,SAAS,oBAAoB,kBAAkB;AAAA,QAC1F,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,UAAM,IAAI,gCAAgC,SAAS,oBAAoB,gBAAgB;AAAA,EACzF;AACA,SAAO;AAAA,IACL;AAAA,IACA,cAAe,QAAgC,SAAS;AAAA,IACxD,YAAY;AAAA,IACZ,GAAI,aAAa,EAAE,oBAAoB,WAAW,IAAI,CAAC;AAAA,EACzD;AACF;AAKA,eAAsB,mCACpB,aACe;AACf,MAAI,YAAY,oBAAoB;AAClC,UAAM,aAAa,+BAA+B,YAAY,mBAAmB,OAAO;AACxF,QACE,YAAY,SAAS,YAAY,mBAAmB,QACpD,WAAW,aAAa,YAAY,YAAY,MAC9C,YAAY,mBAAmB,eACjC;AACA,iBAAW,4BAA4B,YAAY,SAAS,YAAY,YAAY;AAAA,IACtF;AAAA,EACF;AACA,QAAM;AAAA,IACJ,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,YAAY;AAAA,EACd;AACF;AAIO,SAAS,+BACd,UACgC;AAChC,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,8BAA8B,EAAE,GAAG,SAAS;AAClD,SAAO,4BAA4BA,4CAA2C;AAK9E,SAAO,4BAA4B;AACnC,QAAM,eACJ,SAAS,gBAAgB,OAAO,SAAS,iBAAiB,WACrD,SAAS,eACV;AACN,MAAI,CAAC,cAAc;AACjB,WAAO;AAAA,EACT;AACA,QAAM,EAAE,eAAe,gBAAgB,GAAG,yBAAyB,IAAI;AACvE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,cAAc;AAAA,EAChB;AACF;AAEA,SAAS,eAAe,SAAkC,SAA0B;AAClF,SAAO,gCAAgC,SAAU,QAAgC,KAAK,KAAK;AAC7F;AAEA,eAAe,wBACb,QACA,SACA,cACe;AACf,MAAI;AACF,UAAM,+BAA+B,QAAQ,cAAc,OAAO;AAAA,EACpE,QAAQ;AAAA,EAER;AACF;AAWA,SAAS,oCACP,SACwC;AACxC,MAAI,SAAS,SAAS,oBAAqB,QAAO;AAClD,QAAM,WAAW,QAAQ;AACzB,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,MACA,6CAA6C,QAAQ,WAAW,QAAQ;AAAA,IAC1E;AAAA,EACF;AACA,QAAM,WACJ,SAAS,aAAa,8BAClB,wBACA,SAAS,aAAa,6BACpB,uBACA;AACR,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI,SAAS,yBAAyB,UAAa,SAAS,yBAAyB,UAAU;AAC7F,UAAM,IAAI;AAAA,MACR;AAAA,MACA,4CAA4C,QAAQ,WAAW,QAAQ;AAAA,IACzE;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mCACP,SACA,UACA,SACU;AACV,MAAI,YAAY,QAAS,QAAO;AAChC,QAAM,uBAAuB,oCAAoC,OAAO;AACxE,MAAI,yBAAyB,yBAAyB,SAAS,SAAS,qBAAqB;AAI3F,WAAO;AAAA,MACL,GAAG;AAAA,MACH,2BAA2B;AAAA,MAC3B,cAAc,QAAQ,eAAgB;AAAA,IACxC;AAAA,EACF;AACA,SAAO,wBAAwB,SAAS,8BAA8B,uBAClE,EAAE,GAAG,UAAU,2BAA2B,qBAAqB,IAC/D;AACN;AAeA,eAAsB,oCACpB,UACA,UACA,MAkCoC;AACpC,QAAM,kBACJ,OAAO,UAAU,cAAc,WAAY,SAAS,YAA+B;AACrF,QAAM,UACJ,KAAK,mBAAmB,mBAAoB,SAAS;AACvD,QAAM,oBACJ,YAAY,WAAW,SAAS,eAAe,uBAAuB;AACxE,QAAM,cAAc,KAAK,eAAe,0BAA0B,QAAQ;AAC1E,QAAM,SACJ,KAAK,gBACD,KAAK,cAAc,SAAS,UAAU,WAAW,IACjD,8BAA8B,SAAS,UAAU,aAAa,KAAK,OAAO;AAEhF,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,MACA,mDAAmD,OAAO;AAAA,IAC5D;AAAA,EACF;AACA,MAAI,KAAK,aAAa,uBAAuB,CAAC,OAAO,QAAQ;AAC3D,UAAM,IAAI,mBAAmB,SAAS,oBAAoB,OAAO,6BAA6B;AAAA,EAChG;AAaA,QAAM,iBAAiB,EAAE,YAAY;AAKrC,QAAM,uBACJ,YAAY,OAAO,aAAa,WAC3B,SAAwC,eACzC;AAQN,QAAM,eACJ,wBAAwB,OAAO,yBAAyB,WACnD,uBAKD;AAKN,QAAM,yBAAyB,cAAc;AAC7C,QAAM,2BAA2B,cAAc;AAO/C,QAAM,cAAc,OAAO,wBAAsE;AAI/F,QAAI,mBAAmD;AAAA,MACrD;AAAA,MACA;AAAA,IACF;AACA,UAAM,YAAYC,gCAA+B,cAAc,mBAAmB;AAClF,UAAM,mBAAmBC,iCAAgC,wBAAwB;AACjF,QACE,QAAQ,aAAa,WACrB,aACA,kBAAkB,YAAY,KAC9B,iBAAiB,UAAU,eAAe,0BAC1C,KAAK,0BACL;AAIA,UACE,UAAU,WAAW,iBAAiB,iBACtC,UAAU,UAAU,iBAAiB,cACrC;AACA,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,yBAAmB,EAAE,MAAM,cAAc,YAAY,kBAAkB,KAAK,UAAU;AAAA,IACxF;AACA,UAAM,oBAAoB,YAAY,WAAW,YAAY;AAC7D,QAAI,aAAa,CAAC,kBAAkB;AAClC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI;AACJ,QAAI;AAGF,UAAI,kBAAkB,SAAS,cAAc;AAC3C,oBAAY,MAAM,KAAK,yBAA0B,iBAAiB,GAAG;AACrE,YACE,UAAU,WAAW,iBAAiB,WAAW,iBACjD,UAAU,aAAa,iBAAiB,WAAW,cACnD;AACA,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAIA,YAAM,kBAAkB;AAAA,QACtB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM,gCACJ,YAAY,WACZ,kBAAkB,SAAS,uBAC3B,iBAAiB,gBAAgB,aAAa;AAChD,YAAM,qBAAqB,gCACvB,uBACA;AAKJ,UAAI,YAAY,WAAW,CAAC,KAAK,eAAe;AAC9C,cAAM,yBAAyB,eAAe;AAAA,MAChD;AACA,YAAM,gBACJ,oBAAoB,aAAa,YAAY,WAAW,KAAK,iBACzD,SACE,KAAK,gBACH,KAAK,cAAc,SAAS,iBAAiB,WAAW,IACxD;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA,KAAK;AAAA,MACP;AACV,UAAI,CAAC,eAAe,QAAQ;AAC1B,cAAM,IAAI;AAAA,UACR;AAAA,UACA,oBAAoB,OAAO;AAAA,QAC7B;AAAA,MACF;AACA,UAAI,gBAAgB;AACpB,UAAI,yBAAyB;AAC7B,UAAI,4BAA4B;AAChC,YAAM,wBAAwB,OAC5B,WACA,mBACG;AACH,YAAI,UAAU,uBAAuB,KAAK,uBAAuB;AAC/D,iBAAO,MAAM,UAAU;AAAA,YACrB,EAAE,UAAU,eAAe;AAAA,YAC3B;AAAA,cACE,gBAAgB,OAAO,QAAQ,oBAAoB;AACjD,4CAA4B;AAC5B,sBAAM,KAAK,sBAAuB,gBAAgB,QAAQ,eAAe;AAAA,cAC3E;AAAA,cACA,WAAW,OAAO,YAAY;AAC5B,sBAAM,aAAa,eAAe,SAAS,OAAO;AAClD,oBAAI,CAAC,WAAY,OAAM,IAAI,MAAM,iDAAiD;AAClF,sBAAM,KAAK,mBAAmB;AAAA,kBAC5B,QAAQ;AAAA,kBACR;AAAA,kBACA,cAAe,QAAgC,SAAS;AAAA,kBACxD;AAAA,kBACA,WAAW,UAAU;AAAA,gBACvB,CAAC;AACD,yCAAyB;AAAA,cAC3B;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAGA,cAAM,KAAK,wBAAwB,cAAc;AACjD,eAAO,MAAM,UAAU,OAAQ,EAAE,UAAU,eAAe,CAAC;AAAA,MAC7D;AACA,YAAM,gBAAgB,KAAK,IAAI;AAC/B,UAAI;AACJ,UAAI;AACF,mBAAW,MAAM,sBAAsB,eAAe,eAAe;AACrE;AAAA,UACE,KAAK;AAAA,UACL,cAAc;AAAA,UACd;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF,SAAS,OAAO;AACd;AAAA,UACE,KAAK;AAAA,UACL,cAAc;AAAA,UACd;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA;AAAA,UACE,KAAK;AAAA,UACL,cAAc;AAAA,UACd;AAAA,UACA;AAAA,QACF;AACA,YAAI,2BAA2B;AAG7B,gBAAM;AAAA,QACR;AACA,YACE,iCACA,sBAAsB,wBACtB,YAAY,WACZ,CAAC,+BAA+B,cAAc,WAAW,KAAK,GAC9D;AACA,gBAAM;AAAA,QACR;AACA,cAAM,uBACJ,KAAK,4BACJ,SAAS,gBAAgB,EAAE,GAAG,UAAU,cAAc,OAAU,IAAI;AACvE,YAAI,CAAC,sBAAsB;AAIzB,gBAAM;AAAA,QACR;AACA,cAAM,mBAAmB;AAAA,UACvB;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA,cAAM,yBAAyB,gBAAgB;AAC/C,cAAM,iBACJ,KAAK,gBACD,KAAK,cAAc,SAAS,kBAAkB,WAAW,IACzD,8BAA8B,SAAS,kBAAkB,aAAa,KAAK,OAAO;AAExF,YAAI,CAAC,gBAAgB,QAAQ;AAC3B,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AAAA,QACF;AACA,cAAM,kBAAkB,KAAK,IAAI;AACjC,YAAI;AACF,qBAAW,MAAM,sBAAsB,gBAAgB,gBAAgB;AACvE;AAAA,YACE,KAAK;AAAA,YACL,eAAe;AAAA,YACf;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA,0BAAgB;AAAA,QAClB,SAAS,eAAe;AACtB;AAAA,YACE,KAAK;AAAA,YACL,eAAe;AAAA,YACf;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA;AAAA,YACE,KAAK;AAAA,YACL,eAAe;AAAA,YACf;AAAA,YACA;AAAA,UACF;AACA,gBAAM;AAAA,QACR;AAAA,MACF;AACA,UAAI,gBAAiB,SAAiC;AACtD,YAAM,qBAAqB,eAAe,SAAS,QAAQ;AAC3D,UAAI,CAAC,oBAAoB;AACvB,cAAM,wBAAwB,eAAe,UAAU,aAAa;AACpE,cAAM,IAAI;AAAA,UACR;AAAA,UACA,oBAAoB,OAAO;AAAA,QAC7B;AAAA,MACF;AACA,UAAI,cAAyC;AAAA,QAC3C,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,cAAc,iBAAiB;AAAA,QAC/B,YAAY;AAAA,QACZ,WAAW,cAAc;AAAA,MAC3B;AACA,UAAI,KAAK,oBAAoB,CAAC,wBAAwB;AACpD,YAAI;AACF,gBAAM,KAAK,iBAAiB,WAAW;AAAA,QACzC,SAAS,qBAAqB;AAC5B,gBAAM,wBAAwB,eAAe,UAAU,aAAa;AACpE,gBAAM;AAAA,QACR;AAAA,MACF;AACA,UAAI,mBAAmB;AAIvB,UAAI,mBAA4D;AAChE,UAAI,kBAAkB;AACpB,cAAM,UAAW,SACd;AACH,YACE,CAAC,kCACA,iBAAiB,SAAS,gBAAgB,CAAC,sBAC5C,OAAO,YAAY,YACnB;AACA,gBAAM,wBAAwB,eAAe,UAAU,aAAa;AACpE,gBAAM,IAAI;AAAA,YACR;AAAA,YACA,mBAAmB,cAAc,SAAS,6CAA6C,iBAAiB,WAAW,QAAQ;AAAA,UAC7H;AAAA,QACF;AACA,YAAI;AACF,cACE,iCACC,eAAqD,YACpD,gBAAgB,cAClB;AACA,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAEA,cAAI,iBAAiB,SAAS,gBAAgB,mBAAmB;AAI/D,kBAAM,OAAQ,SAAyD,OACnE;AACJ,gBAAI,OAAO,SAAS;AAClB,oBAAM,IAAI;AAAA,gBACR;AAAA,gBACA;AAAA,cACF;AACF,kBAAM,4BAA4B,MAAM,WAAY;AAAA,cAClD,eAAe,QAAQ,IAAI,UAAoB,eAAe;AAAA,YAChE,CAAC;AAAA,UACH,WAAW,iBAAiB,SAAS,cAAc;AACjD,kBAAM,WAAW,MAAM,iCAAiC,WAAY;AAAA,cAClE,eAAe,8BAA8B,QAAQ;AAAA,cACrD,cAAc,KAAK,MAAM,iBAAiB,WAAW,UAAU,IAAI;AAAA,YACrE,CAAC;AAGD,kBAAM,WAAW,iBAAiB,WAAW;AAC7C,gBACE,SAAS,YAAY,WAAW,SAAS,UACzC,SAAS,YAAY,eAAe,SAAS,cAC7C,SAAS,YAAY,cAAc,SAAS,aAC5C,SAAS,YAAY,mBAAmB,SAAS,gBACjD;AACA,oBAAM,IAAI;AAAA,gBACR;AAAA,gBACA,8BAA8B,iBAAiB,WAAW,QAAQ;AAAA,cACpE;AAAA,YACF;AACA,kBAAM,QAAS,KAAK,UAAU,SAAS,KAAK;AAC5C,+BAAmB,SAAS;AAAA,UAC9B,WAAW,CAAC,+BAA+B;AACzC,kBAAM,QAAS,KAAK,UAAU,iBAAiB,KAAK;AAAA,UACtD;AAAA,QACF,SAAS,OAAO;AACd,gBAAM;AAAA,YACJ;AAAA,YACA;AAAA,YACC,SAAiC;AAAA,UACpC;AACA,cAAI,iBAAiB,+BAAgC,OAAM;AAC3D,gBAAM,IAAI;AAAA,YACR;AAAA,YACA,yDAAyD,iBAAiB,WAAW,QAAQ;AAAA,YAC7F,EAAE,WAAW,MAAM,OAAO,MAAM;AAAA,UAClC;AAAA,QACF;AAOA,cAAM,gBAAiB,SAAiC;AACxD,cAAM,qBAAqB,eAAe,SAAS,QAAQ;AAC3D,YAAI,CAAC,oBAAoB;AACvB,gBAAM,wBAAwB,eAAe,UAAU,aAAa;AACpE,gBAAM,IAAI;AAAA,YACR;AAAA,YACA,oBAAoB,OAAO;AAAA,UAC7B;AAAA,QACF;AACA,YAAI,uBAAuB,YAAY,YAAY;AACjD,wBAAc;AAAA,YACZ,QAAQ;AAAA,YACR,SAAS;AAAA,YACT,cAAc,iBAAiB;AAAA,YAC/B,YAAY;AAAA,YACZ,WAAW,cAAc;AAAA,UAC3B;AACA,cAAI,KAAK,kBAAkB;AACzB,gBAAI;AACF,oBAAM,KAAK,iBAAiB,WAAW;AAAA,YACzC,SAAS,qBAAqB;AAC5B,oBAAM,wBAAwB,eAAe,UAAU,aAAa;AACpE,oBAAM;AAAA,YACR;AAAA,UACF;AAAA,QACF;AACA,YAAI,KAAK,6BAA6B;AACpC,cAAI;AACF,kBAAM,KAAK,4BAA4B,iBAAiB,UAAU;AAAA,UACpE,SAAS,OAAO;AACd,kBAAM;AAAA,cACJ;AAAA,cACA;AAAA,cACC,SAAiC;AAAA,YACpC;AACA,kBAAM;AAAA,UACR;AAAA,QACF;AAKA,YAAI,iBAAiB,SAAS,SAAS,iBAAiB,SAAS,cAAc;AAC7E,cAAI;AACF,gBAAI,kBAAkB;AACpB,oBAAM;AAAA,gBACJ;AAAA,gBACA;AAAA,gBACA,iBAAiB,WAAW;AAAA,cAC9B;AAAA,YACF,OAAO;AACL,oBAAM,wBAAwB,UAAU,iBAAiB,UAAU;AAAA,YACrE;AAAA,UACF,SAAS,OAAO;AACd,kBAAM;AAAA,cACJ;AAAA,cACA;AAAA,cACC,SAAiC;AAAA,YACpC;AACA,gBAAI,iBAAiB,+BAAgC,OAAM;AAC3D,kBAAM,IAAI;AAAA,cACR;AAAA,cACA,wDAAwD,iBAAiB,WAAW,QAAQ;AAAA,cAC5F,EAAE,WAAW,KAAK;AAAA,YACpB;AAAA,UACF;AAAA,QACF;AACA,2BAAmB;AACnB,gBAAQ;AAAA,UACN,kCAAkC,iBAAiB,SAAS,sBAAsB,4BAA4B,sBAAsB,aAAa,iBAAiB,WAAW,QAAQ;AAAA,QACvL;AAAA,MACF;AACA,sBAAiB,SAAiC;AAClD,YAAM,kBAAkB,eAAe,SAAS,QAAQ;AACxD,UAAI,CAAC,iBAAiB;AACpB,cAAM,wBAAwB,eAAe,UAAU,aAAa;AACpE,cAAM,IAAI;AAAA,UACR;AAAA,UACA,oBAAoB,OAAO;AAAA,QAC7B;AAAA,MACF;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,cAAc,iBAAiB;AAAA,QAC/B,YAAY;AAAA,QACZ,WAAW,cAAc;AAAA,QACzB,QAAQ,mBAAoB,aAAwB;AAAA,QACpD,GAAI,mBAAmB,EAAE,iBAAiB,iBAAiB,WAAW,IAAI,CAAC;AAAA,MAC7E;AAAA,IACF,UAAE;AACA,YAAM,WAAW,QAAQ,EAAE,MAAM,MAAM;AAGrC,gBAAQ,KAAK,iDAAiD;AAAA,MAChE,CAAC;AAAA,IACH;AAAA,EACF;AAOA,QAAM,sBAAsB,wCAAwC,SAAS,QAAQ;AACrF,QAAM,uBAAuB,wBAAwB;AAGrD,MACE,wBACA,wBACA,OAAO,UACP,OAAO,yBACP;AACA,QAAI;AACJ,QAAI;AACF,qBAAe,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR;AAAA,QACA,8DAA8D,OAAO,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACnI;AAAA,IACF;AACA,QAAI,iBAAiB,QAAW;AAC9B,YAAM,qBACJ,KAAK,aAAa,sBACd,yBAAyB,SAAS,UAAU,cAAc,mBAAmB,IAC7E;AACN,UAAI;AACF,cAAM,UAAU,MAAM;AAAA,UACpB;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,qBAAqB,EAAE,YAAY,mBAAmB,IAAI;AAAA,QAC5D;AACA,cAAM,cAAyC;AAAA,UAC7C;AAAA,UACA,SAAS,QAAQ;AAAA,UACjB,cAAc,QAAQ;AAAA,UACtB,YAAY,QAAQ;AAAA,UACpB,WAAW,OAAO;AAAA,UAClB,QAAQ;AAAA,UACR,GAAI,QAAQ,qBAAqB,EAAE,oBAAoB,QAAQ,mBAAmB,IAAI,CAAC;AAAA,UACvF,GAAI,QAAQ,eAAe,sBACvB,EAAE,gBAAgB,oBAAoB,IACtC,CAAC;AAAA,QACP;AAKA,YAAI,QAAQ,sBAAsB,KAAK,kBAAkB;AACvD,cAAI;AACF,kBAAM,KAAK,iBAAiB,WAAW;AAAA,UACzC,SAAS,OAAO;AACd,kBAAM,mCAAmC,WAAW,EAAE,MAAM,MAAM,MAAS;AAC3E,kBAAM;AAAA,UACR;AAAA,QACF;AACA,eAAO;AAAA,MACT,SAAS,OAAO;AAKd,YACE,CAAC,+BAA+B,OAAO,WAAW,KAAK,KACvD,KAAK,aAAa,eAClB;AACA,gBAAM;AAAA,QACR;AASA,YACE,uBACC,OAAO,2BAA2B,YAAY,uBAAuB,WAAW,IACjF;AACA,gBAAM,IAAI,0CAA0C,SAAS,qBAAqB,OAAO;AAAA,YACvF,OAAO;AAAA,UACT,CAAC;AAAA,QACH;AACA,YAAI;AACJ,YAAI;AACF,4BAAkB,MAAM,YAAY,YAAY;AAAA,QAClD,SAAS,cAAc;AACrB,cAAI,CAAC,mBAAoB,OAAM;AAC/B,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,YACA,wBAAwB,iCAAiC,aAAa,YAAY;AAAA,YAClF,EAAE,OAAO,aAAa;AAAA,UACxB;AAAA,QACF;AACA,eAAO,sBACH,EAAE,GAAG,iBAAiB,gBAAgB,oBAAoB,IAC1D;AAAA,MACN;AAAA,IACF;AAAA,EACF;AAOA,MAAI,KAAK,aAAa,eAAe;AACnC,UAAM,IAAI,mCAAmC,OAAO;AAAA,EACtD;AACA,SAAO,MAAM,YAAY;AAC3B;AAEA,SAAS,0BACP,SACA,SACA,aACA,SACA,WACM;AACN,MAAI;AACF,aAAS,kBAAkB;AAAA,MACzB;AAAA,MACA;AAAA,MACA;AAAA,MACA,iBAAiB,KAAK,IAAI,IAAI,KAAK,IAAI,IAAI,aAAa,GAAI;AAAA,IAC9D,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,uCACP,SACA,SACA,WACA,OACM;AACN,MAAI,CAAC,2BAA2B,KAAK,EAAG;AACxC,MAAI;AACF,aAAS,+BAA+B,EAAE,SAAS,UAAU,CAAC;AAAA,EAChE,QAAQ;AAAA,EAER;AACF;AAsBA,eAAsB,oCACpB,aACyC;AACzC,QAAM,SAAS,YAAY;AAC3B,MAAI,CAAC,UAAU,OAAO,OAAO,0BAA0B,YAAY;AACjE,WAAO;AAAA,EACT;AACA,MAAI,YAAY,iBAAiB,UAAa,YAAY,iBAAiB,MAAM;AAC/E,WAAO;AAAA,EACT;AACA,MAAI;AAIF,UAAM,aAAa,MAAM,OAAO,sBAAsB,YAAY,YAAY;AAa9E,UAAM,OAAO;AACb,UAAM,UAAU,8BAA8B,YAAY,SAAS,KAAK,YAAY;AACpF,UAAM,uBAAuB,gCAAgC,SAAS,IAAI;AAC1E,QAAI,CAAC,wBAAwB,yBAAyB,YAAY,YAAY;AAC5E,aAAO;AAAA,IACT;AACA,UAAM,WAAW,gCAAgC,KAAK,QAAQ;AAC9D,UAAM,eAAe,2BAA2B,KAAK,YAAY;AACjE,UAAM,eAAwC;AAAA,MAC5C,eAAe,sCAAsC,IAAI;AAAA,MACzD,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,MAC7C,GAAI,iBAAiB,SAAY,EAAE,aAAa,IAAI,CAAC;AAAA,MACrD,gBAAgB;AAAA,IAClB;AACA,WAAO;AAAA,MACL,WAAW,YAAY;AAAA,MACvB,CAACF,4CAA2C,GAAG,YAAY;AAAA,MAC3D;AAAA,IACF;AAAA,EACF,QAAQ;AAGN,WAAO;AAAA,EACT;AACF;AAOO,SAAS,sCACd,UACA,SACqC;AACrC,MAAI;AACF,UAAM,kBACJ,YACC,OAAO,UAAU,cAAc,WAC3B,8BAA8B,SAAS,SAAS,KAAK,SAAS,YAC/D;AACN,WAAO,kBACH,wCAAwC,iBAAiB,QAAQ,MAAM,OACvE,sCAAsC,QAAQ,MAAM;AAAA,EAC1D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAKO,IAAM,uCAAN,cAAmD,MAAM;AAAA,EAG9D,YAA4B,SAAiB;AAC3C;AAAA,MACE,oBAAoB,OAAO;AAAA,IAC7B;AAH0B;AAI1B,SAAK,OAAO;AAAA,EACd;AAAA,EAPS,OAAO;AAQlB;AAEO,SAAS,6CACd,UACA,SACyB;AACzB,QAAM,qBAAqB,wCAAwC,SAAS,QAAQ;AACpF,MAAI,CAAC,YAAY,CAAC,oBAAoB;AACpC,UAAM,IAAI,qCAAqC,OAAO;AAAA,EACxD;AACA,SAAO;AACT;AAEA,IAAM,mCAAmC;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,8BACP,UACgC;AAChC,QAAM,eACJ,UAAU,gBAAgB,OAAO,SAAS,iBAAiB,WACtD,SAAS,eACV;AACN,MAAI,CAAC,aAAc,QAAO;AAC1B,QAAM,aAAaC,gCAA+B,aAAa,mBAAmB;AAClF,QAAM,cAAcA,gCAA+B,aAAa,uBAAuB;AACvF,QAAM,YACJ,OAAO,aAAa,qBAAqB,YAAY,aAAa,iBAAiB,SAAS;AAC9F,QAAM,oBACJ,OAAO,aAAa,yBAAyB,YAC7C,aAAa,qBAAqB,SAAS;AAC7C,MAAI,CAAC,aAAa,CAAC,cAAc,CAAC,qBAAqB,CAAC,aAAa;AACnE,WAAO;AAAA,EACT;AACA,QAAM,SAAkC,CAAC;AACzC,aAAW,OAAO,kCAAkC;AAClD,QAAI,aAAa,GAAG,MAAM,UAAa,aAAa,GAAG,MAAM,MAAM;AACjE,aAAO,GAAG,IAAI,aAAa,GAAG;AAAA,IAChC;AAAA,EACF;AACA,SAAO,+CAA+C,MAAM;AAC9D;AAWA,eAAsB,oCACpB,aACA,eACyC;AACzC,QAAM,aAAa,MAAM,oCAAoC,WAAW;AACxE,QAAM,gBAAgB,8BAA8B,aAAa;AACjE,MAAI,CAAC,cAAc,CAAC,eAAe;AACjC,WAAO;AAAA,EACT;AACA,QAAM,yBACJ,YAAY,gBAAgB,OAAO,WAAW,iBAAiB,WAC1D,WAAW,eACZ,CAAC;AACP,QAAM,eAAwC;AAAA,IAC5C,GAAG;AAAA,IACH,GAAI,iBAAiB,CAAC;AAAA,EACxB;AAGA,MAAIA,gCAA+B,aAAa,mBAAmB,GAAG;AACpE,WAAO,aAAa;AAAA,EACtB;AACA,MAAIA,gCAA+B,aAAa,uBAAuB,GAAG;AACxE,WAAO,aAAa;AAAA,EACtB;AACA,SAAO;AAAA,IACL,GAAI,cAAc,CAAC;AAAA;AAAA;AAAA;AAAA,IAInB,WAAW,YAAY;AAAA,IACvB;AAAA,EACF;AACF;","names":["createHash","constants","lstat","open","readdir","realpath","isAbsolute","join","lstat","readdir","join","decodeNativeSnapshotRef","WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION","decodeNativeSnapshotRef","encodeNativeSnapshotRef","parseWorkspaceArchiveDescriptor","base64","status","shellQuote","lstat","readdir","join","run","resolve","descriptor","constants","isAbsolute","open","realpath","handle","readdir","lstat","createHash","sha256","join","encoder","decoder","BROWSER_CONTROL_PORT","DESKTOP_STREAM_PORT","OPENGENI_SANDBOX_PROVIDER_INSTANCE_ID_FIELD","TERMINAL_STREAM_PORT","parseWorkspaceArchiveObjectRef","parseWorkspaceArchiveDescriptor","SandboxBackend","execFile","isAbsolute","promisify","isAbsolute","join","resolve","constants","lstat","open","readdir","realpath","rm","invalid","isAbsolute","resolve","fingerprint","realpath","lstat","readdir","join","open","constants","rm","release","execFileAsync","promisify","execFile","isAbsolute","lstat","isAbsolute","isAbsolute","lstat","validateCredentialPair","process","output","absolutePath","status","ModalClient","image","resolve","isDeepStrictEqual","status","isDeepStrictEqual","quote","isDeepStrictEqual","resolve","isDeepStrictEqual","receipts","randomUUID","posix","status","delay","ModalRouterProviderCommand","result","resolve","ModalCommandControl","run","lookup","posix","randomUUID","status","delay","ModalRouterProviderCommand","ModalClient","createHash","ModalClient","workspaceRoot","status","requestId","observe","ModalCommandControl","binding","binding","sandbox","createHash","randomUUID","lstat","readdir","posix","DESKTOP_STREAM_PORT","DESKTOP_STREAM_PORT","StreamTokenPayload","DESKTOP_STREAM_PORT","decoder","encoder","frame","DEFAULT_EXEC_YIELD_TIME_MS","DEFAULT_WRITE_STDIN_YIELD_TIME_MS","createHash","posix","delay","resolve","process","randomUUID","status","sessionId","consumed","output","readText","lstat","readdir","ErrorCode","DESKTOP_STREAM_PORT","requestId","resolve","blake3","bytesToHex","OpState","requestId","status","OpState","blake3","resolve","frame","bytesToHex","injectedApplyDiff","workspaceRoot","ErrorCode","retries","frame","readText","reply","requestId","DESKTOP_STREAM_PORT","SandboxBackend","CAPABILITY_DESCRIPTORS","changed","collectSandboxEnvironment","parseExposedPorts","createHash","canonicalModalCheckpointProviderBinding","sha256","createHash","DESKTOP_STREAM_PORT","LEGACY_SANDBOX_PROVIDER_INSTANCE_ID_FIELDS","DESKTOP_STREAM_PORT","shellQuote","LEGACY_SANDBOX_PROVIDER_INSTANCE_ID_FIELDS","state","resolve","status","execResultOutput","execResultExitCode","inferExitFromOutput","shellQuote","createHash","randomUUID","posixPath","BROWSER_CONTROL_PORT","MARKER","quote","status","status","boundedPort","randomUUID","shellQuote","BROWSER_CONTROL_PORT","boundedTimeout","isRecord","binding","sha256","frame","createHash","posixPath","isRecord","shellQuote","outputOf","createHash","posixPath","createHash","randomUUID","join","posix","resolve","createHash","workspaceRoot","posix","join","resolve","run","randomUUID","shellQuote","posixPath","createHash","DESKTOP_STREAM_PORT","ErrorCode","FsEntryKind","encoder","decoder","requestId","blake3","bytesToHex","ErrorCode","OpAck","OpChannel","OpFrame","OpLostReason","OpState","OpAck","encoder","run","errorResponse","ErrorCode","requestId","frame","OpFrame","OpState","OpLostReason","OpChannel","concat","bytesToHex","blake3","status","workspaceRoot","DESKTOP_STREAM_PORT","TERMINAL_STREAM_PORT","BROWSER_CONTROL_PORT","decodeNativeSnapshotRef","run","result","resolve","OPENGENI_SANDBOX_PROVIDER_INSTANCE_ID_FIELD","parseWorkspaceArchiveObjectRef","parseWorkspaceArchiveDescriptor"]}