@opengeni/runtime 6.5.2-canary.41607687019001 → 6.7.0

package/dist/chunk-3MNZZ2B4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sandbox/index.ts","../src/sandbox/host-archive-temporary.ts","../src/sandbox/providers/modal-command-raw-page.ts","../src/sandbox/host-archive-spool.ts","../src/sandbox/workspace-archive.ts","../src/sandbox/providers/index.ts","../src/sandbox/capabilities.ts","../src/sandbox/providers/types.ts","../src/sandbox/providers/blaxel.ts","../src/sandbox/providers/cloudflare.ts","../src/sandbox/providers/compute.ts","../src/sandbox/compute/control.ts","../src/sandbox/compute/plane.ts","../src/sandbox/compute/session.ts","../src/sandbox/providers/opensandbox-adapter.ts","../src/sandbox/stream-port.ts","../src/sandbox/stream-token.ts","../src/sandbox/providers/opensandbox-command-stream.ts","../src/sandbox/compute/orphans.ts","../src/sandbox/providers/selfhosted.ts","../src/sandbox/providers/daytona.ts","../src/sandbox/providers/docker.ts","../src/sandbox/providers/docker-workspace-drain.ts","../src/sandbox/provider-capacity.ts","../src/sandbox/providers/e2b.ts","../src/sandbox/providers/local.ts","../../../node_modules/.bun/@openai+agents-extensions@0.14.3+a12f36052e8bec66/node_modules/@openai/agents-extensions/src/sandbox/modal/sandbox.ts","../../../node_modules/.bun/@openai+agents-extensions@0.14.3+a12f36052e8bec66/node_modules/@openai/agents-extensions/src/sandbox/modal/mounts.ts","../src/sandbox/providers/modal.ts","../src/sandbox/providers/modal-command-session.ts","../src/sandbox/provider-errors.ts","../src/sandbox/providers/modal-materialization-verification.ts","../src/sandbox/providers/modal-command-control.ts","../src/sandbox/providers/modal-command-argv.ts","../src/sandbox/providers/modal-command-observation-errors.ts","../src/sandbox/providers/modal-command-client.ts","../src/sandbox/providers/modal-create-session.ts","../src/sandbox/providers/modal-create-boundary.ts","../src/sandbox/providers/modal-shared-client.ts","../src/sandbox/providers/none.ts","../src/sandbox/providers/opensandbox.ts","../src/sandbox/providers/runloop.ts","../src/sandbox/providers/vercel.ts","../src/sandbox/command-result.ts","../src/sandbox/selfhosted/terminal-replay.ts","../src/sandbox/tool-call-command-not-started.ts","../src/sandbox/providers/modal-native-create-preparation.ts","../src/sandbox/display-stack.ts","../src/sandbox/terminal-server.ts","../src/sandbox/browser-control-server.ts","../src/sandbox/browser-control-client.ts","../src/sandbox/browser-controller-compatibility.ts","../src/sandbox/browser-control-stream.ts","../src/sandbox/run-credentials.ts","../src/sandbox/codemode-token.ts","../src/sandbox/codemode-client.ts","../src/sandbox/codemode-authority.ts","../src/sandbox/recording.ts","../src/sandbox/selfhosted/capabilities.ts","../src/sandbox/selfhosted/testing.ts","../src/sandbox/selfhosted/op-testing.ts"],"sourcesContent":["export type {\n  ProviderCommandPersistence,\n  ProviderCommandSession,\n} from \"./provider-command-session\";\nexport {\n  ProviderCommandStartOutcomeUnknownError,\n  ProviderCommandInputOutcomeUnknownError,\n  ProviderCommandObservationUnavailableError,\n  isProviderCommandObservationUnavailableError,\n} from \"./provider-command-session\";\n// @opengeni/runtime/sandbox — the agent-loop-free sandbox leaf.\n//\n// This module is the load-bearing pre-req for the API-direct control plane\n// (docs/connected-machines.md). It exposes the sandbox client factory plus\n// the resume / recovery-envelope helpers that the API needs to touch a box by\n// id (resume-by-id, file/exec/port ops) WITHOUT importing the @openai/agents\n// agent-loop graph.\n//\n// IMPORT DISCIPLINE (enforced by packages/runtime/test/sandbox-leaf-no-agent-loop.test.ts):\n//   - ALLOWED: the per-provider sandbox SDK build imports\n//       `@openai/agents/sandbox`, `@openai/agents/sandbox/local`,\n//       `@openai/agents-extensions/sandbox/modal`\n//     and the workspace `@opengeni/config` / `@opengeni/contracts` packages.\n//   - FORBIDDEN: the agent-loop entrypoints — the bare `@openai/agents`,\n//       `@openai/agents-extensions`, or `@openai/agents-core` roots, and the\n//       loop symbols (`Agent`, `run`, `Runner`, `RunState`).\n// The barrel `packages/runtime/src/index.ts` re-exports everything here via\n// `export * from \"./sandbox\"`, so existing consumers (apps/worker) are\n// unchanged.\n\nimport type { Settings } from \"@opengeni/config\";\nimport {\n  collectSandboxEnvironment,\n  deploymentSandboxBackend,\n  hostSandboxBackendRefused,\n  parseExposedPorts,\n} from \"@opengeni/config\";\nexport type { WorkspaceArchiveSpool, VerifiedHostWorkspaceArchive } from \"./archive-spool\";\nexport {\n  sweepOrphanedHostArchiveTemporaryDirectoriesOnce,\n  workspaceArchiveDownloadTemporaryDirectory,\n} from \"./host-archive-temporary\";\nexport type { DockerHostWorkspaceRelease } from \"./providers/docker-workspace-drain\";\nexport { reduceModalRawOutputPage } from \"./providers/modal-command-raw-page\";\nexport {\n  isInSandboxSupervisedProcess,\n  SUPERVISED_STOP_KILL_AFTER_SECONDS,\n} from \"./durable-shell-process\";\nexport type {\n  ModalRawOutputPage,\n  ModalRawOutputStreams,\n  ModalRawOutputExit,\n} from \"./providers/modal-command-raw-page\";\nimport type { WorkspaceArchiveSpool } from \"./archive-spool\";\nimport {\n  convertHostWorkspaceArchiveToTar,\n  restoreHostWorkspaceArchive,\n  type PortableWorkspaceTar,\n} from \"./host-archive-spool\";\nexport {\n  captureWorkspaceArchiveForStorage,\n  disposeWorkspaceArchive,\n  type VerifiedWorkspaceArchivePayload,\n} from \"./workspace-archive\";\n\nimport {\n  BROWSER_CONTROL_PORT,\n  DESKTOP_STREAM_PORT,\n  OPENGENI_SANDBOX_PROVIDER_INSTANCE_ID_FIELD,\n  TERMINAL_STREAM_PORT,\n  omitInlineWorkspaceArchiveWhenObjectRefPresent,\n  parseWorkspaceArchiveObjectRef,\n  parseWorkspaceArchiveDescriptor,\n  type WorkspaceArchiveObjectRef,\n  type TarWorkspaceArchiveDescriptor,\n  type SandboxBackend,\n  type SandboxProviderContinuityRecovery,\n} from \"@opengeni/contracts\";\nimport type {\n  Manifest,\n  SandboxClient,\n  SandboxSessionLike,\n  SandboxSessionState,\n} from \"@openai/agents/sandbox\";\nimport { serializeManifestRecord } from \"@openai/agents-core/sandbox/internal\";\nimport { isProviderApiThrottleError, PROVIDER_REGISTRY } from \"./providers\";\nimport { ensureModalRegistryImage } from \"./providers/modal\";\nimport { ModalExecReadinessProbeLostError } from \"./providers/modal-command-control\";\nimport type { ModalCreateIntent } from \"./providers/modal-create-boundary\";\nimport type { ProviderRegistration } from \"./providers/types\";\nimport { sandboxBackendForSdkBackendId } from \"./select\";\nimport {\n  SandboxBackendNotServedError,\n  SandboxConfigError,\n  SandboxExactResumeReplacedError,\n  SandboxProviderContinuityUnavailableError,\n  SandboxResumeIdentityMismatchError,\n  SandboxResumeIdentityUnavailableError,\n  SandboxResumeStateUnavailableError,\n} from \"./errors\";\nimport { isProviderSandboxNotFoundError } from \"./provider-errors\";\nimport {\n  decodeNativeSnapshotRef,\n  readVerifiedWorkspaceArchive,\n  verifyRestoredWorkspace,\n  verifyRestoredWorkspaceContents,\n  workspaceArchiveExcludedPaths,\n  WorkspaceArchiveIntegrityError,\n  type VerifiedWorkspaceArchive,\n  type WorkspaceArchiveDescriptor,\n} from \"./workspace-archive\";\nimport type { RuntimeMetricsHooks } from \"../metrics\";\nimport { instrumentSandboxClientSessionOperations } from \"./operation-purpose\";\nexport {\n  currentSandboxOperationPurpose,\n  instrumentSandboxClientSessionOperations,\n  instrumentSandboxSessionOperations,\n  SANDBOX_OPERATION_PURPOSES,\n  sandboxHookOperationPurpose,\n  withSandboxOperationPurpose,\n  type SandboxOperationPurpose,\n  type SandboxSetupOperationObservation,\n} from \"./operation-purpose\";\nimport { normalizeProtocolJsonValue } from \"../protocol-json\";\nimport { sandboxCommandExitCode, sandboxCommandStillRunning } from \"./command-result\";\nimport { parseExecBannerSessionId } from \"./exec-banner\";\nimport type { ExposedPortEndpoint } from \"./stream-port\";\nimport type { ComputeCreateIdentity } from \"./compute/session\";\nimport { errorMessage, isRecord } from \"@opengeni/contracts/values\";\n\n// Re-export the config-owned environment/port helpers from the leaf so the\n// API-direct control plane can pull its full sandbox-construction surface from\n// a single agent-loop-free entrypoint. They physically live in @opengeni/config\n// (moving them into runtime would create a config→runtime cycle — ledger CR8).\nexport { collectSandboxEnvironment, parseExposedPorts } from \"@opengeni/config\";\nexport {\n  SandboxMaterializationVerificationError,\n  materializationVerificationDiagnostic,\n  type MaterializationFailureReason,\n  type MaterializationVerificationDiagnostic,\n} from \"./materialization-verification-error\";\nexport { sendCommandInput, type CommandInputSession } from \"./command-input\";\nexport { OpStreamExecClient, type OpStreamOutputFrame } from \"./selfhosted/op-stream\";\nexport {\n  replayConnectedCommandOutput,\n  connectedCommandExitProof,\n} from \"./selfhosted/terminal-replay\";\n\n// The provider registry surface — the descriptor table self-test, the per-\n// provider registrations, selection + capability negotiation, and the typed\n// construction errors. All agent-loop-free, so the API-direct control plane\n// imports them from this one leaf.\nexport {\n  CAPABILITY_DESCRIPTORS,\n  DESKTOP_STREAM_PORT,\n  assertDescriptorRegistryInvariants,\n  type CapabilityDescriptor,\n} from \"./capabilities\";\nexport {\n  SANDBOX_BACKEND_NOT_SERVED_CODE,\n  SandboxBackendNotServedError,\n  SandboxConfigError,\n  SandboxExactResumeInstanceUnavailableError,\n  SandboxExactResumeReplacedError,\n  SandboxProviderContinuityUnavailableError,\n  SandboxProviderUnavailableError,\n  SandboxProviderWorkspaceAbsentError,\n  SandboxResumeIdentityMismatchError,\n  SandboxResumeIdentityUnavailableError,\n  SandboxResumeStateUnavailableError,\n} from \"./errors\";\nexport {\n  PROVIDER_REGISTRY,\n  assertProviderRegistryInvariants,\n  buildImmutableProviderImage,\n  isProviderApiThrottleError,\n  prepareProviderForTeardownAfterCapture,\n  providerSupportsImmutableImageBuild,\n  renewSandboxProviderExpiration,\n  providerWorkspaceCapturePolicy,\n  providerWorkspaceCaptureIsPointInTime,\n  providerDrainCaptureIsPointInTime,\n  type ProviderRegistration,\n  type ProviderConstructionContext,\n  type ProviderExactResumeMode,\n  type ProviderImmutableImageBuildInput,\n  type ProviderImmutableImageBuildResult,\n  type ProviderExpirationRenewalInput,\n  type ProviderWorkspaceCapturePolicy,\n  type ProviderWorkspaceCaptureTakeover,\n} from \"./providers\";\nexport {\n  classifyProviderSandboxFailure,\n  isProviderSandboxGoneDuringRoutedOperation,\n  isProviderSandboxNotFoundError,\n  isProviderSandboxTransientError,\n  type ProviderSandboxFailure,\n  type ProviderSandboxFailureKind,\n} from \"./provider-errors\";\nexport {\n  isSandboxProviderCapacityError,\n  isSandboxProviderError,\n  loadE2BServiceBusyError,\n} from \"./provider-capacity\";\nexport {\n  WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION,\n  WorkspaceArchiveIntegrityError,\n  captureVerifiedWorkspaceArchive,\n  decodeNativeSnapshotRef,\n  encodeNativeSnapshotRef,\n  describeLegacyNativeSnapshotArchive,\n  describeNativeSnapshotArchive,\n  fingerprintSandboxWorkspace,\n  inlineWorkspaceArchiveForRestore,\n  parseWorkspaceArchiveDescriptor,\n  readVerifiedWorkspaceArchive,\n  verifyRestoredWorkspace,\n  type NativeSnapshotDescriptor,\n  type NativeSnapshotProvider,\n  type NativeSnapshotRef,\n  type TarWorkspaceArchiveDescriptor,\n  type VerifiedWorkspaceArchive,\n  type WorkspaceArchiveDescriptor,\n  type WorkspaceArchiveIntegrityCode,\n  type WorkspaceTreeFingerprint,\n} from \"./workspace-archive\";\nexport {\n  ToolCallCommandNotStartedError,\n  toolCallCommandNotStartedCallIds,\n  withCommandNotStartedCallProof,\n} from \"./tool-call-command-not-started\";\nexport {\n  ensureModalRegistryImage,\n  deleteModalCheckpointSnapshot,\n  inspectModalSandboxLifecycle,\n  isModalTaskExecStartPreDispatchUnavailableError,\n  isModalCommandStartOutcomeUnknownError,\n  modalSessionMatchesCheckpointProviderBinding,\n  modalSandboxAttributionEnvironment,\n  modalSandboxAttributionTags,\n  resolveModalCheckpointProviderBinding,\n  findModalProviderCreateReceipt,\n  resolveModalCheckpointProviderBindingForLiveSandbox,\n  resolveModalCheckpointProviderBindingForSession,\n  modalAppHasRunningSandboxes,\n  sweepModalOrphanSandboxes,\n  tagModalSandbox,\n  terminateModalSandboxById,\n  type LiveModalSandboxLeaseAttribution,\n  type ModalModuleLoader,\n  type ModalCheckpointProviderBinding,\n  type ModalOrphanSweepResult,\n  type ModalOrphanSweepTermination,\n  type ModalSandboxAttribution,\n  type RevalidateModalOrphanTermination,\n} from \"./providers/modal\";\nexport {\n  getModalCommandStartInvocation,\n  withModalCommandStartSignal,\n  type ModalCommandStartInvocation,\n} from \"./providers/modal-command-start-errors\";\n// Pure correlation only: these passive exports grant no dispatch authority.\nexport {\n  compileNativeFreshCreate,\n  describeNativeFreshCreate,\n  type NativeFreshCreateSpec,\n  type NativeFreshCreatePreparation,\n  type NativeFreshCreateCompilation,\n} from \"./providers/modal-native-create-preparation\";\nexport {\n  OpenSandboxClient,\n  OpenSandboxSession,\n  setOpenSandboxApplyDiff,\n  type OpenSandboxApplyDiff,\n  type OpenSandboxClientOptions,\n  type OpenSandboxEditor,\n  type OpenSandboxSessionState,\n} from \"./providers/opensandbox-adapter\";\nexport {\n  selectBackend,\n  sdkBackendIdForSandboxBackend,\n  sandboxBackendForSdkBackendId,\n  backendSupportsOs,\n  desktopCapableBackend,\n  negotiateCapabilities,\n  type NegotiationContext,\n} from \"./select\";\n\n// Scoped data-plane stream-token mint/verify (P3.1). Agent-loop-free; the API\n// pulls these from this leaf to authorize the desktop pixel plane.\nexport {\n  STREAM_TOKEN_DEFAULT_TTL_SECONDS,\n  mintStreamToken,\n  verifyStreamToken,\n  StreamTokenPayload,\n  type MintStreamTokenInput,\n  type StreamTokenPayloadType,\n} from \"./stream-token\";\n\n// The Channel-B desktop display-stack launcher (P4.1). Exec-launched,\n// flock-idempotent; the worker (per-turn) and the API (per viewer op) both drive\n// it from this leaf to bring up Xvfb -> XFCE -> x11vnc -viewonly -> websockify:6080.\nexport {\n  STREAM_PORT,\n  DISPLAY_STACK_TIMEOUT_MS,\n  DEFAULT_DESKTOP_GEOMETRY,\n  DisplayStackError,\n  DisplayStackUnsupportedError,\n  buildDisplayStackScript,\n  ensureDisplayStack,\n  tearDownDisplayStack,\n  type DesktopGeometry,\n  type DisplayStackCallerKind,\n  type DisplayStackClassification,\n  type DisplayStackTelemetryContext,\n  type DisplayStackTelemetryEvent,\n  type DisplayStackTelemetryStatus,\n  type EnsureDisplayStackOptions,\n  type EnsureDisplayStackResult,\n} from \"./display-stack\";\n\nexport {\n  sandboxCommandExitCode,\n  sandboxCommandOutput,\n  sandboxCommandStdout,\n  sandboxCommandStillRunning,\n} from \"./command-result\";\n\nexport {\n  createTurnToolCancellationController,\n  TurnSandboxCommandCancelledError,\n} from \"./turn-tool-cancellation\";\nexport type {\n  TurnSandboxCommandArgs,\n  TurnSandboxCommandSession,\n  TurnToolCancellationController,\n  TurnToolCancellationFence,\n} from \"./turn-tool-cancellation\";\n\n// The Channel-B REAL PTY terminal-server launcher (P5.t). Exec-launched,\n// flock-idempotent twin of ensureDisplayStack; brings up ttyd PTY-over-websocket\n// (bash -l per ws client) on 7681 over the SAME tunnel the desktop noVNC uses.\nexport {\n  TERMINAL_STREAM_PORT,\n  TERMINAL_SERVER_TIMEOUT_MS,\n  TerminalServerError,\n  TerminalServerUnsupportedError,\n  buildTerminalServerScript,\n  ensureTerminalServer,\n  tearDownTerminalServer,\n  type EnsureTerminalServerOptions,\n  type EnsureTerminalServerResult,\n} from \"./terminal-server\";\n\nexport {\n  BROWSER_CONTROL_PORT,\n  BROWSER_CONTROL_SERVER_TIMEOUT_MS,\n  BrowserControlServerError,\n  BrowserControlServerUnsupportedError,\n  buildBrowserControlServerScript,\n  ensureBrowserControlServer,\n  tearDownBrowserControlServer,\n  type EnsureBrowserControlServerOptions,\n  type EnsureBrowserControlServerResult,\n} from \"./browser-control-server\";\n\nexport {\n  BROWSER_CONTROL_ADMIN_TOKEN_FILE,\n  BrowserControlActionDeadlineError,\n  BrowserControlClient,\n  BrowserControlProtocolError,\n  BrowserControlRequestError,\n  BrowserControlSessionClient,\n  BrowserControlTransportError,\n  BrowserControlUnsupportedError,\n  ComputerFrameEvidenceMismatchError,\n  decodeComputerControlFrameMetadataHeader,\n  provisionBrowserControlClient,\n  validateComputerControlFrameEvidence,\n  type BrowserControlPlacementSession,\n  type BrowserControlScreenshotOptions,\n  type BrowserControlFrame,\n  type BrowserStateDownloadGrant,\n  type BrowserStateUploadGrant,\n  type BrowserViewGrant,\n  type CapturePlacementBrowserStateInput,\n  type CreatePlacementBrowserSessionInput,\n  type PlacementBrowserSession,\n  type PlacementBrowserSessionReference,\n  type PlacementBrowserNetworkRoute,\n  type PlacementBrowserTransport,\n  type PlacementBrowserStateCaptureReceipt,\n  type PlacementBrowserWorkingCopyAdoption,\n  type PlacementBrowserWorkingCopyAuthority,\n  type PlacementBrowserWorkingCopyInspection,\n  type PlacementBrowserWorkingCopyRefusal,\n  type ComputerControlFrame,\n  type ComputerControlFrameMetadata,\n  type ComputerFrameEvidenceMismatchReason,\n  type ExpectedComputerFrameEvidence,\n  type ProvisionBrowserControlClientInput,\n  type ProvisionBrowserControlClientResult,\n  type RestorePlacementBrowserStateInput,\n} from \"./browser-control-client\";\n\n// Host-owned rotating run credentials. Material lives outside the persisted\n// workspace/manifest and is activated atomically per session generation.\nexport {\n  RunCredentialValidationError,\n  normalizeRunCredentialsResolution,\n  runCredentialRoot,\n  runCredentialPointerFile,\n  materializeRunCredentials,\n  clearRunCredentials,\n  clearRunCredentialsForAttempt,\n  withRunCredentialEnvironment,\n  withRunCredentialsSession,\n  withRunCredentialsClient,\n  type RunCredentialExpectedScope,\n  type NormalizedRunCredentialMaterial,\n  type RunCredentialCommandSession,\n  type RunCredentialCommandRunner,\n  type RunCredentialSessionReady,\n  type MaterializeRunCredentialsOptions,\n} from \"./run-credentials\";\n\n// Secret references delivered at the physical exec boundary (W1). Values ride\n// an in-memory carry to the provider call; recorders keep references.\nexport {\n  SECRET_ENV_TOTAL_MAX_BYTES,\n  SECRET_ENV_VALUE_MAX_BYTES,\n  SECRET_FILE_ROOT,\n  clearSecretFilesCommand,\n  prepareSecretExec,\n  prepareSecretStdin,\n  resolveSecretImagePath,\n  resolveSecretLiteralText,\n  resolveSecretPatchText,\n  runWithSecretCarry,\n  secretExecCarryFor,\n  secretFilePath,\n  secretScopeFor,\n  type SecretCarry,\n  type SecretExecCarry,\n  type SecretStdinCarry,\n} from \"./secret-delivery\";\n\n// Credential profiles: per-command environment variables resolved from secret\n// references at the same exec boundary (docs/secrets.md).\nexport {\n  CREDENTIAL_PROFILE_GIT_HELPER,\n  CREDENTIAL_PROFILE_GIT_TOKEN_VARIABLE,\n  createCredentialEnvironment,\n  credentialProfileGitHelperEnvironment,\n  credentialProfileNoteText,\n  withCredentialProfileNotes,\n  type CreateCredentialEnvironmentInput,\n  type CredentialEnvironment,\n  type CredentialEnvironmentResult,\n} from \"./credential-profile-delivery\";\n\n// Session-specific Codemode token routing. The manifest retains one stable\n// legacy pointer for warm-box env parity; every session command selects its own\n// hashed token file off-manifest.\nexport {\n  CodemodeTokenPathError,\n  codemodeTokenFileForSession,\n  codemodeTokenFileFromEnvironment,\n  withCodemodeTokenEnvironment,\n  withCodemodeTokenSession,\n  withCodemodeTokenClient,\n} from \"./codemode-token\";\n\n// Exact-attempt Codemode authority. Shared by ordinary turn execution and\n// one-off Connected Machine execution so neither surface can drift into a\n// second token shape or lifetime.\nexport {\n  CODEMODE_TOKEN_TTL_SECONDS,\n  mintSandboxCodemodeToken,\n  type CodemodeAuthorityScope,\n  type SandboxCodemodeAuthority,\n  type MintedSandboxCodemodeToken,\n} from \"./codemode-authority\";\n\n// The Channel-B pixel DATA PLANE (P4.2). Resolves the provider's scoped tunnel\n// for port 6080 (client → provider-tunnel direct), assembles the WS URL, and\n// mints the scoped stream token. Called API-direct on the resumed handle.\nexport {\n  exposeStreamPort,\n  buildStreamUrl,\n  exposedPortAllowsHostFetch,\n  exposedPortEndpointFromUrl,\n  isOpenSandboxLifecycleProxyPath,\n  joinExposedPortPath,\n  parseOpenSandboxSignedUriPath,\n  redactOpenSandboxSignedUriPath,\n  signedEndpointExpiresAtMs,\n  signedEndpointNeedsRefresh,\n  StreamPortUnavailableError,\n  type ExposedPortEndpoint,\n  type ExposeStreamPortInput,\n  type ExposeStreamPortResult,\n  type OpenSandboxSignedUriPath,\n} from \"./stream-port\";\n\n// P4.3 recording loop — plain functions over a live session handle (no agent\n// loop); finalize uploads box -> object storage without buffering in the worker.\nexport {\n  startRecording,\n  stopRecording,\n  inspectRecordingArtifact,\n  uploadRecordingArtifact,\n  deleteRecordingArtifacts,\n  recordingStorageKey,\n  contentTypeForCodec,\n  extForCodec,\n  RecordingUnavailableError,\n  RecordingError,\n  type RecordingCodec,\n  type RecordingContentType,\n  type StartRecordingInput,\n  type RecordingProcess,\n  type RecordingArtifactMetadata,\n} from \"./recording\";\n\n// P4.4 Channel-A structured services — the provider-agnostic SandboxChannelAService\n// (FileSystem + Git + Terminal) over a live, resumed-by-id session handle. The\n// API constructs one per request around the box it just resumed; no ownership.\n// Agent-loop-free, so the API-direct control plane imports it from this leaf.\nexport { SynchronousCommandOutcomeUnknownError } from \"./synchronous-command\";\nexport {\n  SandboxChannelAService,\n  ChannelAPartialMutationError,\n  ChannelAValidationError,\n  ChannelAUnavailableError,\n  ChannelAConflictError,\n  ChannelAFileSystemRouteChangedError,\n  ChannelANotFoundError,\n  ChannelAUnsupportedError,\n  stripExecBanner,\n  parseExecBannerSessionId,\n  parseExecBannerExitCode,\n  isExecSessionLostBanner,\n  assertSafeRelPath,\n  parsePorcelainV2,\n  parseNumstatZ,\n  parseUnifiedPatch,\n  REPOSITORY_DISCOVERY_LIMIT,\n  CODE_SEARCH_RG_MAX_BYTES,\n  MAC_HOME_FILES_DIRS,\n  MAC_HOME_PRIVACY_GUARDED_DIRS,\n  validateCodeSearchRipgrepArgs,\n  type CodeSearchRipgrepOutcome,\n  type ChannelASession,\n  type ChannelAExecArgs,\n  type ChannelAExecResult,\n  type ChannelAEmitter,\n  type SandboxChannelAServiceOptions,\n  type FsWriteFilesRequest,\n  type FsWriteFilesResponse,\n  type RepositoryDiscoveryDegradedReason,\n  type RepositoryDiscoveryResult,\n  type NumstatEntry,\n} from \"./channel-a\";\n\n// The selfhosted (bring-your-own-compute) control surface (M3). The NATS-backed\n// `SelfhostedSession` presents the SAME structural exec/fs/git surface as Modal\n// over a `ControlRpc` seam (request/reply on the exact claimed process subject, encoded via\n// `@opengeni/agent-proto`). agent-offline is NEVER a NotFound — the lease never\n// cold-creates a rival for a user's real machine. The real NATS transport +\n// Accounts land in M4 behind the SAME `ControlRpc`.\nexport {\n  type ControlRpc,\n  NatsControlRpc,\n  SelfhostedControlError,\n  agentErrorToControlError,\n  parseAgentRpcSubject,\n  subjectFor,\n  offlineControlResponse,\n  timeoutControlResponse,\n  offlineAgentError,\n  timeoutAgentError,\n  drainingExhaustedError,\n  payloadTooLargeMessage,\n  drainingMessage,\n  execDeadlineHint,\n  NEVER_SENT_DETAIL_KEY,\n  CONNECTION_REPLACED_DETAIL_KEY,\n  AGENT_UNANSWERED_DETAIL_KEY,\n  agentNotAnsweredReason,\n  isAgentNotAnswered,\n  requestWithoutWaking,\n  withoutWaking,\n  type NoWakeReply,\n  connectionReplacedAgentError,\n  type NatsRequestConnection,\n  type SelfhostedUnavailableReason,\n} from \"./selfhosted/control-rpc\";\nexport {\n  AGENT_LINK_LOST_HEADER,\n  AGENT_UNANSWERED_HEADER,\n  NO_WAKE_HEADER,\n} from \"./selfhosted/control-replay\";\n// The transport-agnostic per-op observation seam (out-of-band telemetry — metrics\n// + machine.* events; the op-engine's op-stream client emits through this too).\nexport type { SelfhostedOpObserver, SelfhostedOpObservation } from \"./selfhosted/op-observer\";\n// The four-field in-band fault renderer (the failure-visibility doctrine).\nexport {\n  selfhostedFaultClass,\n  SELFHOSTED_INFRASTRUCTURE_FAULT_CLASSES,\n  renderSelfhostedFault,\n  FAULT_FIELD_WHAT_HAPPENED,\n  FAULT_FIELD_WHICH_LAYER,\n  FAULT_FIELD_WHAT_PRESERVED,\n  FAULT_FIELD_WHAT_TO_TRY,\n} from \"./selfhosted/fault-rendering\";\n// The selfhosted control-op retry policy (the pure decision + the injected clock).\nexport {\n  decideSelfhostedRetry,\n  selfhostedRetryBackoffMs,\n  defaultSelfhostedRetryClock,\n  SELFHOSTED_IDEMPOTENT_READONLY_OPS,\n  SELFHOSTED_DRAINING_MAX_RETRIES,\n  SELFHOSTED_EXEC_DRAINING_MAX_RETRIES,\n  SELFHOSTED_AGENT_UPDATE_DRAIN_REASON,\n  SELFHOSTED_UPDATE_DRAINING_MAX_RETRIES,\n  SELFHOSTED_TIMEOUT_MAX_RETRIES,\n  SELFHOSTED_NEVER_SENT_MAX_RETRIES,\n  SELFHOSTED_RETRY_BACKOFF_BASE_MS,\n  SELFHOSTED_RETRY_BACKOFF_FACTOR,\n  SELFHOSTED_RETRY_BACKOFF_CAP_MS,\n  type SelfhostedRetryClock,\n  type SelfhostedRetryDecision,\n} from \"./selfhosted/retry-policy\";\nexport {\n  SelfhostedSession,\n  SelfhostedWorkspaceRootChangedError,\n  SelfhostedSandboxClient,\n  buildSelfhostedBackendSession,\n  setSelfhostedApplyDiff,\n  SELFHOSTED_DEFAULT_TIMEOUT_MS,\n  SELFHOSTED_RELAY_STREAM_PATH,\n  type SelfhostedSessionState,\n  type SelfhostedSessionDeps,\n  type SelfhostedSessionBuild,\n  type SelfhostedOperationResourcePolicy,\n  type SelfhostedOperationAdmission,\n  type SelfhostedRelayConfig,\n  type SelfhostedExecArgs,\n  type SelfhostedExecResult,\n  type SelfhostedApplyDiff,\n  type SelfhostedEditor,\n  type SelfhostedImageOutput,\n  type SelfhostedOpStreamDeps,\n} from \"./selfhosted/session\";\nexport {\n  connectedMachinePathWithinRoot,\n  connectedMachineWorkspaceRootsEqual,\n  isConnectedMachineAbsolutePath,\n  isUnusableConnectedMachineWorkspace,\n  isWindowsConnectedMachinePath,\n  normalizeConnectedMachineWorkspaceRoot,\n  relativeConnectedMachinePath,\n  resolveConnectedMachinePath,\n  resolveConnectedMachineWorkspaceRoot,\n  type ConnectedMachineOs,\n} from \"./selfhosted/workspace-path\";\nexport type { SelfhostedConnectionBinding } from \"./routing/backend-resolver\";\n// Opengeni compute: managed microVM sandboxes whose provider session is the\n// Connected Machine agent inside the box (docs/compute-backend.md).\nexport {\n  ComputeControlClient,\n  ComputeControlError,\n  isComputeSandboxNotFound,\n  type ComputeCreateRequest,\n  type ComputeSandboxView,\n  type ComputeWokenView,\n} from \"./compute/control\";\nexport {\n  getComputeAgentPlane,\n  setComputeAgentPlane,\n  usesAgentTransport,\n  type ComputeAgentConnection,\n  type ComputeAgentPlane,\n} from \"./compute/plane\";\nexport {\n  COMPUTE_WORKSPACE_ROOT,\n  ComputeSandboxClient,\n  ComputeSandboxSession,\n  ComputeWakeGate,\n  ComputeWakingControlRpc,\n  deleteComputeBox,\n  wakeComputeSandboxOnNoResponders,\n  type ComputeCreateIdentity,\n  type ComputeSessionState,\n  type ComputeTurnDeps,\n} from \"./compute/session\";\nexport {\n  COMPUTE_METADATA,\n  createComputeOrphanSweepProgress,\n  reconcileStaleComputeEnrollments,\n  sweepComputeOrphans,\n  type ComputeOrphanSweepProgress,\n  type StaleComputeEnrollment,\n  type StaleComputeEnrollmentPage,\n  type ComputeOrphanSweepResult,\n  type ComputeSandboxIdentity,\n} from \"./compute/orphans\";\n// The op-stream exec transport (op-stream protocol v1.1 — streaming exec to a\n// Connected Machine runner). The worker injects `NatsOpStreamTransport` (over\n// the same bus connection as the control rpc) plus an `OpStreamJournal`\n// adapted onto Temporal. Connected Machine exec requires this injection and\n// fails closed when it is absent or unsupported.\nexport {\n  NatsOpStreamTransport,\n  OpStreamUnavailableError,\n  opAckSubject,\n  opFrameSubject,\n  type NatsOpStreamConnection,\n  type OpStreamSubscription,\n  type OpStreamTransport,\n} from \"./selfhosted/op-transport\";\nexport {\n  cancelSelfhostedOp,\n  isOpTombstone,\n  OP_STREAM_ACK_INTERVAL_MS,\n  OP_STREAM_DEFAULT_WINDOW_BYTES,\n  OP_STREAM_RECONNECT_HOLD_MS,\n  OP_STREAM_SILENCE_TIMEOUT_MS,\n  OP_START_RESEND_HORIZON_MS,\n  querySelfhostedOp,\n  releaseSelfhostedOpOutput,\n  type ExactSelfhostedOpControlInput,\n  type OpStreamExecOutcome,\n  type OpStreamJournal,\n} from \"./selfhosted/op-stream\";\n// The durable op-id correlation seam (B1): the runtime barrel BINDS it around\n// the SDK shell tool; the sandbox leaf READS it when minting op ids.\nexport { nextDurableOpId, runWithToolCallCorrelation, sanitizeOpIdToken } from \"./op-correlation\";\nexport {\n  negotiateSelfhostedCapabilities,\n  selfhostedLiveness,\n  selfhostedHeartbeatLiveness,\n  SELFHOSTED_RECONNECT_WINDOW_MS,\n  type SelfhostedNegotiationInput,\n  type SelfhostedLivenessState,\n  type SelfhostedEnrollment,\n} from \"./selfhosted/capabilities\";\nexport {\n  MockAgentResponder,\n  type MockAgentResponderOptions,\n  type MockExecHandler,\n} from \"./selfhosted/testing\";\nexport {\n  createMockSelfhostedOpStream,\n  FakeOpRunner,\n  type FakeOpScript,\n  InMemoryOpStreamTransport,\n} from \"./selfhosted/op-testing\";\n\n// The hot-swap routing proxy (M7): ONE stable session-shaped object the SDK binds\n// to, which re-reads the per-session active pointer per op and dispatches to the\n// currently-active backend (Modal or selfhosted) — flippable mid-turn, single\n// active at a time, fence-retrying on a swap race.\nexport {\n  isRoutingMutationOutcomeUnknownError,\n  isRoutingMutationOutputRejectedError,\n  RoutingMutationOutputRejectedError,\n  withRoutingMutationOutputRejectionFence,\n  RoutingBackendRecoveryRequiredError,\n  RoutingMutationOutcomeUnknownError,\n  renderRoutingMutationOutcomeUnknownToolResult,\n  RoutingRetainedProcessNotFoundError,\n  RoutingSandboxSession,\n  RoutingWorkspaceRootChangedError,\n  RoutingActiveRouteChangedError,\n  RoutingUnsupportedError,\n  type ActivePointer,\n  type DefaultBackendLossResult,\n  type RoutableBackendSession,\n  type ResolvedActiveBackend,\n  type RoutingMutationSettlementResult,\n  type RoutingSandboxFirstOperationObservation,\n  type RoutingSandboxFirstOperationObserver,\n  type RoutingSandboxFirstOperationPhase,\n  type RoutingSandboxFirstOperationPhaseObservation,\n  type RoutingSandboxOperationObservation,\n  type RoutingSandboxOperationObserver,\n  type RoutingSandboxCaptureWaitObserver,\n  type RoutingSandboxPhaseOutcome,\n  type RoutingSandboxWaitObservation,\n  type RoutingRetainedProcess,\n  type RoutingRetainedProcessAdoption,\n  type RoutingRetainedProcessTerminalProof,\n  type RoutingSandboxSessionDeps,\n  type RoutingTransitionEvent,\n} from \"./routing/routing-session\";\nexport {\n  makeActiveBackendResolver,\n  ActiveBackendUnresolvableError,\n  swapTargetEstablishability,\n  type ActiveBackendResolverDeps,\n  type RoutableSandbox,\n  type BackendUnresolvableCode,\n  type SwapTargetEstablishability,\n} from \"./routing/backend-resolver\";\n\n/**\n * Construct the raw provider SandboxClient for the configured backend. Registry-\n * driven (the old flat if/else is gone): the backend's ProviderRegistration owns\n * validateCredentials + build, with per-provider units/field-names. Returns\n * undefined for \"none\".\n *\n * The desktop stream port (6080) is merged into exposedPorts for every desktop-\n * capable (backend, os) when desktop is enabled AND the provider cannot expose\n * ports on demand (modal/runloop/e2b pre-declare; blaxel resolves on demand).\n * Existing modal/docker/local construction is behavior-preserved.\n */\nexport function createSandboxClient(\n  settings: Settings,\n  environment = collectSandboxEnvironment(settings),\n): unknown {\n  return createSandboxClientForBackend(\n    settings.sandboxBackend as SandboxBackend,\n    settings,\n    environment,\n  );\n}\n\n/**\n * Refuse a host-backed box (`local`, `docker`) unless the deployment serves it,\n * which for a host backend means it is the deployment's configured default\n * (`sandboxBackendServed`, the same rule session creation applies). The\n * deployment default is read from `settings.deploymentSandboxBackend`, which\n * survives the per-session `{...settings, sandboxBackend}` rebinds, so a\n * session's stored backend can never serve itself. A host box runs as\n * processes on this worker or API host, so whether it is allowed is a\n * deployment choice, never a consequence of what happens to be installed on\n * the host image. Remote providers keep their own credential validation.\n */\nexport function assertHostSandboxBackendServed(settings: Settings, backend: SandboxBackend): void {\n  if (hostSandboxBackendRefused(settings, backend)) {\n    throw new SandboxBackendNotServedError(backend, deploymentSandboxBackend(settings));\n  }\n}\n\n/**\n * Construct the raw provider SandboxClient for an EXPLICIT backend, independent\n * of settings.sandboxBackend. This is the resume-by-id builder the per-turn\n * resume path (and the API-direct control plane) call: a lease's box was created\n * on a specific backend (the envelope's backendId / the lease's\n * resume_backend_id), and the client that reattaches to it must be built for\n * THAT backend, not the process's currently-configured default. When the backend\n * equals settings.sandboxBackend this is identical to createSandboxClient\n * (behavior-preserved). Returns undefined for \"none\". A host backend (`local`,\n * `docker`) that is not the default of `settings` is refused before anything is\n * built (assertHostSandboxBackendServed).\n */\nexport function createSandboxClientForBackend(\n  backend: SandboxBackend,\n  settings: Settings,\n  environment = collectSandboxEnvironment(settings),\n  metrics?: RuntimeMetricsHooks,\n): unknown {\n  const registration = PROVIDER_REGISTRY[backend];\n  if (!registration) {\n    throw new SandboxConfigError(backend, `Unknown sandbox backend \"${backend}\"`);\n  }\n  if (registration.backend === \"none\") {\n    return undefined;\n  }\n  assertHostSandboxBackendServed(settings, registration.backend);\n  registration.validateCredentials(settings); // fail-fast, typed\n\n  const exposedPorts = parseExposedPorts(settings.dockerExposedPorts);\n  // 6080 port-merge: a desktop-capable backend that pre-declares ports (not\n  // on-demand) must carry the desktop port at construction so resolveExposedPort\n  // (6080) succeeds later. runloop is included (it is desktop-capable but NOT\n  // on-demand → must pre-declare). blaxel is on-demand → skipped here.\n  const desktop = registration.descriptor.capabilities.DesktopStream;\n  if (\n    desktop.available &&\n    settings.sandboxDesktopEnabled &&\n    !registration.descriptor.portExposure.supportsOnDemandPorts &&\n    !exposedPorts.includes(DESKTOP_STREAM_PORT)\n  ) {\n    exposedPorts.push(DESKTOP_STREAM_PORT);\n  }\n  // 7681 port-merge: the REAL PTY terminal (ttyd) rides the SAME tunnel as the\n  // desktop, so a desktop-capable pre-declared-port backend must ALSO carry 7681\n  // at construction for resolveExposedPort(7681) to succeed later on a fresh box.\n  // Same condition as the 6080 merge (a desktop-capable image bakes ttyd too).\n  if (\n    desktop.available &&\n    settings.sandboxTerminalEnabled &&\n    !registration.descriptor.portExposure.supportsOnDemandPorts &&\n    !exposedPorts.includes(TERMINAL_STREAM_PORT)\n  ) {\n    exposedPorts.push(TERMINAL_STREAM_PORT);\n  }\n  // The browser controller is a placement service baked into both canonical\n  // images. Providers that require port declaration must receive its fixed\n  // port when the box is created; on-demand providers resolve it lazily.\n  if (\n    !registration.descriptor.portExposure.supportsOnDemandPorts &&\n    !exposedPorts.includes(BROWSER_CONTROL_PORT)\n  ) {\n    exposedPorts.push(BROWSER_CONTROL_PORT);\n  }\n\n  const built = registration.build({\n    settings,\n    environment,\n    exposedPorts,\n    ...(metrics ? { metrics } : {}),\n  });\n  if (metrics?.onSandboxSetupOperation) {\n    instrumentSandboxClientSessionOperations(\n      built,\n      registration.backend,\n      metrics.onSandboxSetupOperation,\n    );\n  }\n  const raw = withProviderExactResumeContract(registration, built);\n  // Docker network decoration stays backend-specific (only docker).\n  return registration.backend === \"docker\"\n    ? withDockerNetwork(raw as SandboxClient, settings.dockerNetwork)\n    : raw;\n}\n\nfunction withProviderExactResumeContract(\n  registration: ProviderRegistration,\n  raw: unknown,\n): unknown {\n  if (!raw || typeof raw !== \"object\") {\n    throw new SandboxConfigError(\n      registration.backend,\n      `Sandbox backend \"${registration.backend}\" returned no client`,\n    );\n  }\n  const client = raw as {\n    resume?: (state: unknown, options?: unknown) => Promise<unknown>;\n    resumeExact?: (state: unknown) => Promise<unknown>;\n  };\n  if (typeof client.resume !== \"function\") {\n    throw new SandboxConfigError(\n      registration.backend,\n      `Sandbox backend \"${registration.backend}\" does not support resume()`,\n    );\n  }\n  if (registration.exactResumeMode === \"custom\") {\n    if (typeof client.resumeExact !== \"function\") {\n      throw new SandboxConfigError(\n        registration.backend,\n        `Sandbox backend \"${registration.backend}\" has no non-replacing resumeExact()`,\n      );\n    }\n    return client;\n  }\n  if (registration.exactResumeMode !== \"ordinary\") {\n    throw new SandboxConfigError(\n      registration.backend,\n      `Sandbox backend \"${registration.backend}\" has an invalid exact-resume contract`,\n    );\n  }\n  const resume = client.resume;\n  Object.defineProperty(client, \"resumeExact\", {\n    configurable: false,\n    enumerable: false,\n    writable: false,\n    value: async (state: unknown) => await resume.call(client, state),\n  });\n  return client;\n}\n\nfunction withDockerNetwork(client: SandboxClient, network: string | undefined): SandboxClient {\n  const trimmed = network?.trim();\n  if (!trimmed) {\n    return client;\n  }\n  const exactResume = (\n    client as SandboxClient & {\n      resumeExact?: (state: SandboxSessionState) => Promise<SandboxSessionLike>;\n    }\n  ).resumeExact;\n  const wrapSession = async <T extends SandboxSessionLike>(session: T): Promise<T> => {\n    const containerId = (session as { state?: { containerId?: unknown } }).state?.containerId;\n    if (typeof containerId === \"string\" && containerId.length > 0) {\n      await connectDockerNetwork(trimmed, containerId);\n      const portResolver = (\n        session as T & {\n          resolveExposedPort?: (port: number) => Promise<ExposedPortEndpoint>;\n        }\n      ).resolveExposedPort;\n      if (typeof portResolver === \"function\") {\n        Object.defineProperty(session, \"resolveExposedPort\", {\n          configurable: true,\n          enumerable: true,\n          writable: true,\n          value: async (port: number) =>\n            dockerNetworkExposedPortEndpoint(\n              containerId,\n              port,\n              await portResolver.call(session, port),\n            ),\n        });\n      }\n    }\n    return session;\n  };\n  return {\n    backendId: client.backendId,\n    ...(client.supportsDefaultOptions !== undefined\n      ? { supportsDefaultOptions: client.supportsDefaultOptions }\n      : {}),\n    ...(client.create\n      ? {\n          create: async (...args: any[]) =>\n            await wrapSession(await (client.create as any)(...args)),\n        }\n      : {}),\n    ...(client.resume\n      ? {\n          resume: async (state: SandboxSessionState) =>\n            await wrapSession(await client.resume!(state)),\n        }\n      : {}),\n    ...(exactResume\n      ? {\n          // Docker's ordinary SDK resume creates a replacement when the exact\n          // container is absent. Preserve Opengeni's non-replacing attach path\n          // through the network decorator; dropping it would turn an exact\n          // recovery probe into a provider mutation.\n          resumeExact: async (state: SandboxSessionState) =>\n            await wrapSession(await exactResume.call(client, state)),\n        }\n      : {}),\n    ...(\"attachWorkspaceForDrain\" in client && typeof client.attachWorkspaceForDrain === \"function\"\n      ? {\n          // A drain handle has no networking or normal execution capability.\n          attachWorkspaceForDrain: client.attachWorkspaceForDrain.bind(client),\n        }\n      : {}),\n    ...(client.delete\n      ? {\n          delete: async (state: SandboxSessionState) => await client.delete!(state),\n        }\n      : {}),\n    ...(client.serializeSessionState\n      ? {\n          serializeSessionState: async (state: SandboxSessionState, options) =>\n            await client.serializeSessionState!(state, options),\n        }\n      : {}),\n    ...(client.canPersistOwnedSessionState\n      ? {\n          canPersistOwnedSessionState: async (state: SandboxSessionState) =>\n            await client.canPersistOwnedSessionState!(state),\n        }\n      : {}),\n    ...(client.canReusePreservedOwnedSession\n      ? {\n          canReusePreservedOwnedSession: async (state: SandboxSessionState) =>\n            await client.canReusePreservedOwnedSession!(state),\n        }\n      : {}),\n    ...(client.deserializeSessionState\n      ? {\n          deserializeSessionState: async (state: Record<string, unknown>) =>\n            await client.deserializeSessionState!(state),\n        }\n      : {}),\n  };\n}\n\n/**\n * Once a Docker sandbox joins the API's network, server-side traffic must use\n * the container's network identity and original port. The SDK's published\n * 127.0.0.1 host port is meaningful only to the Docker host, not to an API\n * process running in another container. Calling the provider resolver first\n * preserves its exposed-port validation.\n */\nexport function dockerNetworkExposedPortEndpoint(\n  containerId: string,\n  containerPort: number,\n  endpoint: ExposedPortEndpoint,\n): ExposedPortEndpoint {\n  const host = /^[a-f0-9]{64}$/i.test(containerId) ? containerId.slice(0, 12) : containerId;\n  return {\n    ...endpoint,\n    host,\n    port: containerPort,\n  };\n}\n\nasync function connectDockerNetwork(network: string, containerId: string): Promise<void> {\n  const { spawnSync } = await import(\"node:child_process\");\n  const result = spawnSync(\"docker\", [\"network\", \"connect\", network, containerId], {\n    encoding: \"utf8\",\n  });\n  if (result.status === 0) {\n    return;\n  }\n  const stderr = result.stderr ?? result.error?.message ?? \"\";\n  if (stderr.includes(\"already exists\")) {\n    return;\n  }\n  throw new Error(\n    `Failed to connect Docker sandbox container to network ${network}: ${stderr.trim()}`,\n  );\n}\n\n/**\n * Extract the sandbox recovery entry from a run state as a plain JSON record,\n * for storage decoupled from the RunState blob (issue #35). Encapsulates the\n * underscore-internal `_sandbox` read in exactly one place.\n */\nexport function sandboxStateEntryFromRunState(\n  state: unknown,\n  options: {\n    /** W1 defensive strip: when set, persisted manifest/state env keeps only\n     *  names this predicate accepts (deployment constants), so a legacy box\n     *  whose live state still carries user values never re-persists them. */\n    keepEnvironmentName?: (name: string) => boolean;\n  } = {},\n): Record<string, unknown> | null {\n  const sandboxState = (state as any)?._sandbox;\n  if (!sandboxState) {\n    return null;\n  }\n  const entry =\n    sandboxState.sessionsByAgent?.[sandboxState.currentAgentKey] ??\n    (sandboxState.currentAgentKey && sandboxState.sessionState\n      ? {\n          backendId: sandboxState.backendId,\n          currentAgentKey: sandboxState.currentAgentKey,\n          currentAgentName: sandboxState.currentAgentName,\n          sessionState: sandboxState.sessionState,\n        }\n      : null);\n  if (!entry || !entry.sessionState) {\n    return null;\n  }\n  const persisted = sandboxEntryForPersistence(entry as Record<string, unknown>);\n  return normalizeProtocolJsonValue(\n    options.keepEnvironmentName\n      ? sandboxEntryWithConstantEnvironment(persisted, options.keepEnvironmentName)\n      : persisted,\n    '$[\"sandboxSessionEnvelope\"]',\n  ) as Record<string, unknown>;\n}\n\nfunction filterEnvironmentRecord(value: unknown, keep: (name: string) => boolean): unknown {\n  if (!isObjectRecord(value)) return value;\n  return Object.fromEntries(Object.entries(value).filter(([name]) => keep(name)));\n}\n\n/** Copy of a persisted entry whose `sessionState.manifest.environment`,\n *  `sessionState.environment` and `sessionState.providerState.environment` keep\n *  only accepted names. Values are never inspected. */\nexport function sandboxEntryWithConstantEnvironment(\n  entry: Record<string, unknown>,\n  keep: (name: string) => boolean,\n): Record<string, unknown> {\n  const sessionState = entry.sessionState;\n  if (!isObjectRecord(sessionState)) return entry;\n  const next: Record<string, unknown> = { ...sessionState };\n  const manifest = sessionState.manifest;\n  if (isObjectRecord(manifest) && Object.hasOwn(manifest, \"environment\")) {\n    const plain =\n      Object.getPrototypeOf(manifest) === Object.prototype ||\n      Object.getPrototypeOf(manifest) === null\n        ? manifest\n        : (serializeSdkManifestForEnvelope(manifest) as Record<string, unknown>);\n    next.manifest = { ...plain, environment: filterEnvironmentRecord(plain.environment, keep) };\n  }\n  if (Object.hasOwn(sessionState, \"environment\")) {\n    next.environment = filterEnvironmentRecord(sessionState.environment, keep);\n  }\n  const providerState = sessionState.providerState;\n  if (isObjectRecord(providerState) && Object.hasOwn(providerState, \"environment\")) {\n    next.providerState = {\n      ...providerState,\n      environment: filterEnvironmentRecord(providerState.environment, keep),\n    };\n  }\n  return { ...entry, sessionState: next };\n}\n\n/**\n * The Agents SDK session envelope carries its canonical serialized manifest at\n * `sessionState.manifest`. Some provider serializers also repeat a hydrated\n * `Manifest` instance at `sessionState.providerState.manifest`; the SDK restore\n * path always overlays the canonical outer value, so the duplicate is neither\n * read nor JSON-protocol-safe. Remove only that known redundant field before the\n * envelope crosses Opengeni's durable canonical-JSON boundary.\n */\nfunction sandboxEntryForPersistence(entry: Record<string, unknown>): Record<string, unknown> {\n  const sessionState = entry.sessionState;\n  if (!isObjectRecord(sessionState) || !Object.hasOwn(sessionState, \"manifest\")) {\n    return entry;\n  }\n  const providerState = sessionState.providerState;\n  if (!isObjectRecord(providerState) || !Object.hasOwn(providerState, \"manifest\")) {\n    return entry;\n  }\n  const { manifest: _redundantManifest, ...canonicalProviderState } = providerState;\n  return {\n    ...entry,\n    sessionState: {\n      ...sessionState,\n      providerState: canonicalProviderState,\n    },\n  };\n}\n\nfunction isObjectRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction providerStateWithoutDuplicateManifest(value: object): Record<string, unknown> {\n  const { manifest: _manifest, ...providerState } = value as Record<string, unknown>;\n  return providerState;\n}\n\nfunction serializeSdkManifestForEnvelope(value: unknown): unknown {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return value;\n  const prototype = Object.getPrototypeOf(value);\n  if (prototype === Object.prototype || prototype === null) return value;\n  return serializeManifestRecord(value as Manifest);\n}\n\n/**\n * Items-mode counterpart of restoredSandboxSessionState: rebuild the live\n * sandbox session state from a stored entry (as produced by\n * sandboxStateEntryFromRunState) instead of from a RunState blob.\n */\nexport async function restoredSandboxSessionStateFromEntry(\n  entry: Record<string, unknown>,\n  client: unknown,\n): Promise<SandboxSessionState | undefined> {\n  if (!client || !entry || typeof entry !== \"object\" || !(\"sessionState\" in entry)) {\n    return undefined;\n  }\n  if (entry.backendId && (client as SandboxClient).backendId !== entry.backendId) {\n    throw new Error(\"Stored sandbox envelope backend does not match the configured sandbox client\");\n  }\n  return await deserializeSandboxSessionStateEnvelope(client as SandboxClient, entry.sessionState);\n}\n\n/**\n * Read the persisted /workspace snapshot archive off a lease envelope's\n * `sessionState` (sandbox-file-persistence). The reaper (persistDrainSnapshot)\n * folds the base64 archive — a Modal native snapshot-ref or a tar archive, the\n * exact bytes `session.persistWorkspace()` returned — at\n * `sessionState.workspaceArchive`. Cold-restore decodes it and replays it via\n * `session.hydrateWorkspace(archive)` on the freshly-created box so /workspace is\n * restored. Returns undefined when the envelope carries no archive (a box that\n * was never drain-persisted, or a non-persistence config that stored none).\n *\n * It is deliberately read SEPARATELY from deserializeSandboxSessionStateEnvelope:\n * the archive does NOT ride serializeSessionState (it originates at reaper time),\n * and the SDK's deserializeSessionState must NOT receive it (it is an opaque\n * runtime-level field, not provider state).\n */\nexport function readWorkspaceArchiveFromEnvelopeSessionState(\n  sessionState: unknown,\n): Uint8Array | undefined {\n  if (!sessionState || typeof sessionState !== \"object\") {\n    return undefined;\n  }\n  const b64 = (sessionState as { workspaceArchive?: unknown }).workspaceArchive;\n  if (typeof b64 !== \"string\" || b64.length === 0) {\n    return undefined;\n  }\n  try {\n    return Uint8Array.from(Buffer.from(b64, \"base64\"));\n  } catch {\n    return undefined;\n  }\n}\n\n/** Decode the Modal snapshot id out of a persisted base64 archive ref, or\n *  undefined when the archive is a tar payload or is unparseable. */\nexport function decodeModalSnapshotId(archive: Uint8Array): string | undefined {\n  const ref = decodeNativeSnapshotRef(archive);\n  return ref?.provider === \"modal_snapshot_filesystem\" ||\n    ref?.provider === \"modal_snapshot_directory\"\n    ? ref.snapshotId\n    : undefined;\n}\n\n/** RunState owns `exposedPorts` as a port-keyed endpoint record; provider\n * clients keep their configured port arrays in provider state. */\nfunction runStateExposedPortsRecord(value: unknown): Record<string, unknown> | undefined {\n  return isRecord(value) ? structuredClone(value) : undefined;\n}\n\nexport async function deserializeSandboxSessionStateEnvelope(\n  client: SandboxClient,\n  envelope: unknown,\n  expectedInstanceId?: string,\n): Promise<SandboxSessionState | undefined> {\n  if (!envelope || typeof envelope !== \"object\") {\n    return undefined;\n  }\n  if (!client.deserializeSessionState) {\n    throw new Error(\n      \"Sandbox client must implement deserializeSessionState() to resume RunState sandbox state\",\n    );\n  }\n  const state = envelope as {\n    providerState?: Record<string, unknown>;\n    manifest?: unknown;\n    snapshot?: unknown;\n    snapshotFingerprint?: unknown;\n    snapshotFingerprintVersion?: unknown;\n    workspaceReady?: unknown;\n    exposedPorts?: unknown;\n  };\n  const providerState = { ...(state.providerState ?? {}) };\n  if (expectedInstanceId) {\n    const backend = sandboxBackendForSdkBackendId(client.backendId) ?? client.backendId;\n    const observedInstanceId = liveProviderInstanceIdFromState(backend, providerState);\n    if (observedInstanceId && observedInstanceId !== expectedInstanceId) {\n      throw new SandboxResumeIdentityMismatchError(backend, expectedInstanceId, observedInstanceId);\n    }\n    if (!observedInstanceId) {\n      const instanceIdField = PROVIDER_REGISTRY[backend as SandboxBackend]?.instanceIdFields[0];\n      if (instanceIdField) {\n        // New envelopes persist one provider-neutral Opengeni identity. SDK\n        // deserializers still require their legacy provider-specific address,\n        // so materialize it into a cloned payload at this adapter boundary.\n        // The live resumed handle is independently identity-checked before use.\n        providerState[instanceIdField] = expectedInstanceId;\n      }\n    }\n  }\n  const exposedPorts = runStateExposedPortsRecord(state.exposedPorts);\n  return await client.deserializeSessionState({\n    ...providerState,\n    manifest: state.manifest,\n    ...(state.snapshot !== undefined ? { snapshot: state.snapshot } : {}),\n    ...(state.snapshotFingerprint !== undefined\n      ? { snapshotFingerprint: state.snapshotFingerprint }\n      : {}),\n    ...(state.snapshotFingerprintVersion !== undefined\n      ? { snapshotFingerprintVersion: state.snapshotFingerprintVersion }\n      : {}),\n    workspaceReady: state.workspaceReady,\n    ...(exposedPorts !== undefined ? { exposedPorts } : {}),\n  });\n}\n\n// ============================================================================\n// The ONE resume / recovery primitive (P1.2).\n//\n// establishSandboxSessionFromEnvelope is the single re-establish-from-envelope\n// path the stateless model leans on. Creation authority is explicit:\n//\n//   - `create-or-restore` is reserved for the caller that won the durable\n//     cold->warming lease transition. It may create a cold box, or replace a\n//     resumable box that the provider proves is gone.\n//   - `resume-only` is for attached turns and API-direct operations. It may\n//     resume the leased box by id, but a provider NotFound propagates to the\n//     caller so the lease can be atomically marked cold. It NEVER creates.\n//\n// This ownership boundary is the double-spawn guard. A provider NotFound alone\n// is not creation authority: many attached callers can observe the same dead id\n// concurrently, while only one caller may own cold->warming.\n// ============================================================================\n\n/** A live, externally-owned sandbox session re-established from the group lease\n *  envelope. The caller injects `{client, session, sessionState}` NON-OWNED into\n *  the run (or drives session.exec/readFile/resolveExposedPort directly) and\n *  drops the handle when done — the lease, not this handle, owns the box. */\nexport type EstablishedSandboxSession = {\n  client: unknown;\n  session: unknown;\n  sessionState: unknown;\n  instanceId: string;\n  backendId: string;\n  /** How this establish reached a live box: warm reattach by id (\"resumed\"),\n   *  fresh create (\"created\"), or fresh create + archive hydration\n   *  (\"restored\"). Callers use it to emit the durable sandbox.box.* lifecycle\n   *  events — box transitions were previously unrecorded, which made both\n   *  2026-07-06 incidents near-unattributable. Optional so external/legacy\n   *  constructors of this shape stay valid. */\n  origin?: \"resumed\" | \"created\" | \"restored\";\n  /** Set when a create-authorized reattach found the envelope's box GONE\n   *  (provider NotFound) and fell through to cold-restore. */\n  lostInstanceId?: string;\n  /** Durable authorization used when an elected recovery owner adopted a new\n   * execution wrapper over the same provider-owned workspace. Unpublished\n   * failure cleanup must preserve that workspace for the next recovery owner. */\n  providerContinuity?: SandboxProviderContinuityRecovery;\n  /** Exact durable archive revision verified byte-for-byte after hydration. */\n  restoredArchive?: WorkspaceArchiveDescriptor;\n};\n\n/**\n * Terminate an SDK-managed provider session through the declared sandbox\n * lifecycle surface. The reaper must never guess non-standard `kill` or\n * `terminate` method names: every supported SDK provider exposes one of these\n * standard operations, while provider-specific by-id rescue stays in its\n * adapter.\n */\nexport async function terminateManagedSandboxSession(\n  client: unknown,\n  sessionState: unknown,\n  session: unknown,\n): Promise<void> {\n  const lifecycleClient = client as {\n    backendId?: unknown;\n    delete?: (state: never) => Promise<void>;\n  };\n  const lifecycleSession = session as Partial<SandboxSessionLike>;\n  const options = { reason: \"cleanup\" };\n  let firstError: unknown;\n  const attempt = async (operation: (() => Promise<void>) | undefined): Promise<void> => {\n    if (!operation) return;\n    try {\n      await operation();\n    } catch (error) {\n      firstError ??= error;\n    }\n  };\n  const runPreStopHooks =\n    typeof lifecycleSession.runPreStopHooks === \"function\"\n      ? lifecycleSession.runPreStopHooks.bind(lifecycleSession)\n      : undefined;\n  const preStop =\n    typeof lifecycleSession.preStop === \"function\"\n      ? lifecycleSession.preStop.bind(lifecycleSession)\n      : undefined;\n  const stop =\n    typeof lifecycleSession.stop === \"function\"\n      ? lifecycleSession.stop.bind(lifecycleSession)\n      : undefined;\n  const shutdown =\n    typeof lifecycleSession.shutdown === \"function\"\n      ? lifecycleSession.shutdown.bind(lifecycleSession)\n      : undefined;\n  const deleteSession =\n    typeof lifecycleSession.delete === \"function\"\n      ? lifecycleSession.delete.bind(lifecycleSession)\n      : undefined;\n  const close =\n    typeof lifecycleSession.close === \"function\"\n      ? lifecycleSession.close.bind(lifecycleSession)\n      : undefined;\n\n  // Mirror the Agents SDK's provider-neutral cleanupSandboxSession contract.\n  // Agents SDK 0.14.3 does not publicly export that helper, so this agent-loop-free leaf\n  // keeps the same small sequence locally. Prefer the live session lifecycle:\n  // it owns registered pre-stop hooks and provider cleanup semantics. The\n  // state-only client.delete contract is a fallback when no session teardown\n  // operation exists.\n  await attempt(runPreStopHooks);\n  await attempt(preStop ? async () => await preStop(options) : undefined);\n  await attempt(stop ? async () => await stop(options) : undefined);\n  await attempt(shutdown ? async () => await shutdown(options) : undefined);\n  await attempt(deleteSession ? async () => await deleteSession(options) : undefined);\n  const hasProviderTeardown = Boolean(stop || shutdown || deleteSession);\n  if (!hasProviderTeardown && close) {\n    await attempt(close);\n  } else if (\n    !hasProviderTeardown &&\n    !close &&\n    typeof lifecycleClient.delete === \"function\" &&\n    sessionState !== undefined &&\n    sessionState !== null\n  ) {\n    await attempt(async () => await lifecycleClient.delete!(sessionState as never));\n  }\n  if (firstError) throw firstError;\n  if (\n    hasProviderTeardown ||\n    close ||\n    (typeof lifecycleClient.delete === \"function\" &&\n      sessionState !== undefined &&\n      sessionState !== null)\n  ) {\n    return;\n  }\n\n  const backendId =\n    typeof lifecycleClient.backendId === \"string\" ? lifecycleClient.backendId : \"unknown\";\n  throw new Error(`Sandbox backend ${backendId} exposes no teardown lifecycle operation`);\n}\n\nexport class SandboxExecReadinessError extends Error {\n  readonly name = \"SandboxExecReadinessError\";\n\n  constructor(\n    public readonly backend: string,\n    /** `exec_probe_lost`: the provider no longer tracks the exact readiness\n     * probe exec (Modal router FAILED_PRECONDITION \"exec not found\"). The box\n     * has not proved command readiness; it is not probe replay authority. */\n    public readonly code:\n      | \"exec_probe_unavailable\"\n      | \"exec_probe_timeout\"\n      | \"exec_probe_failed\"\n      | \"exec_probe_lost\",\n    public readonly timeoutMs: number,\n    public readonly exitCode: number | null = null,\n    public readonly instanceId: string | null = null,\n    options?: { cause?: unknown },\n  ) {\n    const target = instanceId ? `${backend} sandbox ${instanceId}` : `${backend} sandbox`;\n    super(\n      code === \"exec_probe_timeout\"\n        ? `${target} timed out waiting for command readiness after ${timeoutMs}ms`\n        : code === \"exec_probe_unavailable\"\n          ? `${target} session does not expose an exec readiness probe`\n          : code === \"exec_probe_lost\"\n            ? `${target} lost its command-readiness probe: the provider no longer tracks the probe command`\n            : exitCode === null\n              ? `${target} exec readiness probe did not return a command exit code`\n              : `${target} exec readiness probe failed with exit code ${exitCode}`,\n      options && \"cause\" in options ? { cause: options.cause } : undefined,\n    );\n  }\n}\n\n/** A fresh-box readiness probe whose exact exec the provider lost. */\nexport function isSandboxExecReadinessProbeLostError(\n  error: unknown,\n): error is SandboxExecReadinessError & { code: \"exec_probe_lost\" } {\n  return error instanceof SandboxExecReadinessError && error.code === \"exec_probe_lost\";\n}\n\n/** A remote provider may return a sandbox handle before its command router\n * accepts exec. Allow cold restores to absorb provider tail latency without\n * publishing the lease warm before command execution is possible. */\nexport const MODAL_EXEC_READINESS_TIMEOUT_MS = 60_000;\n\nfunction sandboxExecProbeSessionId(result: unknown): number | null {\n  if (typeof result === \"string\") return parseExecBannerSessionId(result);\n  if (!result || typeof result !== \"object\") return null;\n  const candidate = result as { sessionId?: unknown; session_id?: unknown };\n  for (const value of [candidate.sessionId, candidate.session_id]) {\n    if (typeof value === \"number\" && Number.isSafeInteger(value) && value >= 0) return value;\n  }\n  return null;\n}\n\n/** A provider handle is not workspace readiness. Providers with asynchronous\n * startup must pass this bounded command probe before a caller publishes the\n * lease warm/ready. */\nexport async function verifySandboxExecReadiness(\n  established: EstablishedSandboxSession,\n  timeoutMs = MODAL_EXEC_READINESS_TIMEOUT_MS,\n  signal?: AbortSignal,\n): Promise<void> {\n  signal?.throwIfAborted();\n  if (established.backendId !== \"modal\" && established.backendId !== \"opensandbox\") return;\n  const session = established.session as {\n    verifyExecReadiness?: (signal: AbortSignal) => Promise<number>;\n    exec?: (args: {\n      cmd: string;\n      yieldTimeMs?: number;\n      maxOutputTokens?: number;\n    }) => Promise<unknown>;\n    execCommand?: (args: {\n      cmd: string;\n      yieldTimeMs?: number;\n      maxOutputTokens?: number;\n    }) => Promise<unknown>;\n    writeStdin?: (args: {\n      sessionId: number;\n      chars?: string;\n      yieldTimeMs?: number;\n      maxOutputTokens?: number;\n    }) => Promise<unknown>;\n  };\n  const run = session.exec ?? session.execCommand;\n  const nativeModalProbe =\n    established.backendId === \"modal\" ? session.verifyExecReadiness : undefined;\n  if (!run && !nativeModalProbe) {\n    throw new SandboxExecReadinessError(\n      established.backendId,\n      \"exec_probe_unavailable\",\n      timeoutMs,\n      null,\n      established.instanceId,\n    );\n  }\n  const timeoutError = () =>\n    new SandboxExecReadinessError(\n      established.backendId,\n      \"exec_probe_timeout\",\n      timeoutMs,\n      null,\n      established.instanceId,\n    );\n  const deadline = Date.now() + timeoutMs;\n  const withinDeadline = async <T>(operation: () => Promise<T>): Promise<T> => {\n    signal?.throwIfAborted();\n    const remainingMs = deadline - Date.now();\n    if (remainingMs <= 0) throw timeoutError();\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    let abort: (() => void) | undefined;\n    try {\n      const interrupted = new Promise<never>((_, reject) => {\n        abort = () => reject(signal?.reason);\n        signal?.addEventListener(\"abort\", abort, { once: true });\n        if (signal?.aborted) abort();\n        timer = setTimeout(() => reject(timeoutError()), remainingMs);\n        if (timer && \"unref\" in timer && typeof timer.unref === \"function\") timer.unref();\n      });\n      const result = await Promise.race([operation(), interrupted]);\n      signal?.throwIfAborted();\n      return result;\n    } finally {\n      if (timer) clearTimeout(timer);\n      if (abort) signal?.removeEventListener(\"abort\", abort);\n    }\n  };\n  if (nativeModalProbe) {\n    const cancellation = new AbortController();\n    const abort = () => cancellation.abort(signal?.reason);\n    signal?.addEventListener(\"abort\", abort, { once: true });\n    if (signal?.aborted) abort();\n    try {\n      let exitCode: number;\n      try {\n        exitCode = await withinDeadline(() => nativeModalProbe.call(session, cancellation.signal));\n      } catch (error) {\n        if (!(error instanceof ModalExecReadinessProbeLostError)) throw error;\n        throw new SandboxExecReadinessError(\n          established.backendId,\n          \"exec_probe_lost\",\n          timeoutMs,\n          null,\n          established.instanceId,\n          { cause: error },\n        );\n      }\n      if (exitCode !== 0)\n        throw new SandboxExecReadinessError(\n          established.backendId,\n          \"exec_probe_failed\",\n          timeoutMs,\n          exitCode,\n          established.instanceId,\n        );\n      return;\n    } finally {\n      signal?.removeEventListener(\"abort\", abort);\n      cancellation.abort(new Error(\"Sandbox readiness observation finished\"));\n    }\n  }\n  const execProbe = () =>\n    withinDeadline(() =>\n      run!.call(session, {\n        cmd: \"true\",\n        yieldTimeMs: Math.min(1_000, Math.max(1, deadline - Date.now())),\n        maxOutputTokens: 1_000,\n      }),\n    );\n\n  let result = await execProbe();\n  while (true) {\n    const exitCode = sandboxCommandExitCode(result);\n    if (exitCode !== null) {\n      if (exitCode === 0) return;\n      throw new SandboxExecReadinessError(\n        established.backendId,\n        \"exec_probe_failed\",\n        timeoutMs,\n        exitCode,\n        established.instanceId,\n      );\n    }\n\n    const sessionId = sandboxCommandStillRunning(result) ? sandboxExecProbeSessionId(result) : null;\n    const writeStdin = session.writeStdin;\n    if (sessionId !== null && writeStdin) {\n      result = await withinDeadline(() =>\n        writeStdin.call(session, {\n          sessionId,\n          chars: \"\",\n          yieldTimeMs: Math.min(1_000, Math.max(1, deadline - Date.now())),\n          maxOutputTokens: 1_000,\n        }),\n      );\n      continue;\n    }\n\n    const remainingMs = deadline - Date.now();\n    if (remainingMs <= 0) throw timeoutError();\n    await new Promise((resolve) => setTimeout(resolve, Math.min(100, remainingMs)));\n    result = await execProbe();\n  }\n}\n\nexport type SandboxCreatedCallback = (established: EstablishedSandboxSession) => Promise<void>;\n\n// The structural slice we need from a provider SandboxClient to resume by id and\n// cold-restore. Narrowed (not the full agent-loop SandboxClient) so the leaf\n// stays agent-loop-free.\ntype ResumeCapableClient = {\n  backendId: string;\n  deserializeSessionState?: (state: Record<string, unknown>) => Promise<unknown>;\n  resume?: (state: unknown, options?: unknown) => Promise<unknown>;\n  /** Opengeni extension implemented by providers whose ordinary SDK resume may\n   * create a replacement. This method must either return the addressed wrapper\n   * or prove it unavailable without creating anything. */\n  resumeExact?: (state: unknown) => Promise<unknown>;\n  create?: (manifest?: unknown, options?: unknown) => Promise<unknown>;\n  createWithLifecycle?: (\n    args: { manifest: unknown },\n    lifecycle: {\n      beforeDispatch: (intent: ModalCreateIntent, providerContext: unknown) => Promise<void>;\n      onCreated: (session: unknown, intent: ModalCreateIntent) => Promise<void>;\n    },\n  ) => Promise<unknown>;\n};\n\n/**\n * Per-provider NotFound discriminator. The @openai/agents-extensions\n * `isProviderSandboxNotFoundError` / `assertResumeRecreateAllowed` helpers live\n * under `@openai/agents-extensions/sandbox/shared`, which is NOT an exported\n * subpath (the package `exports` map only exposes `./sandbox/<provider>`), so we\n * re-implement the discrimination here by inspecting the thrown error shape.\n *\n * \"Box no longer running\" (the box was reaped / idled out / 24h-ceiling) is the\n * ONLY error that licenses a cold-restore via create(). Every other resume\n * failure (transient provider error, auth, network) must propagate so the caller\n * backs off — never spawns a rival box. We err on the side of NOT recreating:\n * an unrecognized error is treated as \"not NotFound\" (propagate), because a\n * false-positive recreate is the dangerous direction (double-spawn).\n */\nfunction liveProviderInstanceIdFromState(\n  backend: SandboxBackend | string,\n  state: unknown,\n): string | null {\n  if (!state || typeof state !== \"object\" || Array.isArray(state)) return null;\n  const registration = PROVIDER_REGISTRY[backend as SandboxBackend];\n  if (!registration || registration.backend !== backend) return null;\n  const record = state as Record<string, unknown>;\n  for (const field of registration.instanceIdFields) {\n    const value = record[field];\n    if (typeof value === \"string\" && value.length > 0) return value;\n  }\n  return null;\n}\n\nfunction legacySandboxProviderInstanceIdFromEnvelope(\n  envelope: Record<string, unknown> | null | undefined,\n  backend?: SandboxBackend | string,\n): string | null {\n  const sessionState =\n    envelope?.sessionState && typeof envelope.sessionState === \"object\"\n      ? (envelope.sessionState as Record<string, unknown>)\n      : null;\n  const providerState =\n    sessionState?.providerState && typeof sessionState.providerState === \"object\"\n      ? sessionState.providerState\n      : envelope?.providerState;\n  const envelopeBackendId =\n    typeof envelope?.backendId === \"string\" && envelope.backendId.length > 0\n      ? envelope.backendId\n      : null;\n  const resolvedBackend =\n    backend ??\n    (envelopeBackendId\n      ? (sandboxBackendForSdkBackendId(envelopeBackendId) ?? envelopeBackendId)\n      : null);\n  return resolvedBackend ? liveProviderInstanceIdFromState(resolvedBackend, providerState) : null;\n}\n\n/** Resolve the stable Opengeni identity first, then legacy SDK provider keys.\n * The fallback is compatibility-only: new envelopes always persist the stable\n * top-level identity, so downstream lease/reaper code remains provider-neutral. */\nexport function sandboxProviderInstanceIdFromEnvelope(\n  envelope: Record<string, unknown> | null | undefined,\n  backend?: SandboxBackend | string,\n): string | null {\n  const declared = envelope?.[OPENGENI_SANDBOX_PROVIDER_INSTANCE_ID_FIELD];\n  if (typeof declared === \"string\" && declared.length > 0) return declared;\n  return legacySandboxProviderInstanceIdFromEnvelope(envelope, backend);\n}\n\n/** Validate rolling-format envelopes before addressing a provider. The stable\n * Opengeni identity is authoritative, but a disagreeing legacy SDK address is\n * corruption/staleness—not evidence that the provider disappeared. */\nexport function assertConsistentSandboxProviderIdentity(\n  backend: SandboxBackend | string,\n  envelope: Record<string, unknown> | null | undefined,\n): string | null {\n  const declared = envelope?.[OPENGENI_SANDBOX_PROVIDER_INSTANCE_ID_FIELD];\n  const stable = typeof declared === \"string\" && declared.length > 0 ? declared : null;\n  const legacy = legacySandboxProviderInstanceIdFromEnvelope(envelope, backend);\n  if (stable && legacy && stable !== legacy) {\n    throw new SandboxResumeIdentityMismatchError(backend, stable, legacy);\n  }\n  return stable ?? legacy;\n}\n\nfunction exactResumeStateForBackend(backend: string, state: unknown): unknown {\n  if (backend !== \"vercel\" || !state || typeof state !== \"object\" || Array.isArray(state)) {\n    return state;\n  }\n  // Vercel's ordinary resume intentionally creates a replacement whenever the\n  // serialized state carries a fresh snapshot. Exact attach/reaper recovery\n  // must address sandboxId instead; clearing only this freshness marker makes\n  // the SDK use Sandbox.get while retaining the snapshot as recovery data.\n  const exactState = { ...(state as Record<string, unknown>) };\n  delete exactState.snapshotSandboxId;\n  return exactState;\n}\n\nfunction providerContinuityRegistration(backend: SandboxBackend | string) {\n  const registration = PROVIDER_REGISTRY[backend as SandboxBackend];\n  return registration?.backend === backend ? registration.continuity : undefined;\n}\n\nexport function sandboxProviderContinuityForState(\n  backend: SandboxBackend | string,\n  state: unknown,\n  sourceInstanceId: string,\n): SandboxProviderContinuityRecovery | null {\n  const continuity = providerContinuityRegistration(backend);\n  const continuityKey = continuity?.keyFromState(state) ?? null;\n  if (!continuity || !continuityKey || sourceInstanceId.length === 0) return null;\n  return {\n    version: 1,\n    backend: backend as SandboxBackend,\n    kind: continuity.kind,\n    sourceInstanceId,\n    continuityKey,\n  };\n}\n\nfunction parsedEnvelopeContinuity(\n  backend: SandboxBackend | string,\n  envelope: Record<string, unknown> | null,\n  state: unknown,\n  expectedInstanceId: string,\n): SandboxProviderContinuityRecovery | null {\n  const recovery =\n    envelope?.opengeniRecovery && typeof envelope.opengeniRecovery === \"object\"\n      ? (envelope.opengeniRecovery as { continuity?: unknown })\n      : null;\n  const value = recovery?.continuity;\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return null;\n  const candidate = value as Partial<SandboxProviderContinuityRecovery>;\n  const derived = sandboxProviderContinuityForState(backend, state, expectedInstanceId);\n  return derived &&\n    candidate.version === derived.version &&\n    candidate.backend === derived.backend &&\n    candidate.kind === derived.kind &&\n    candidate.sourceInstanceId === derived.sourceInstanceId &&\n    candidate.continuityKey === derived.continuityKey\n    ? derived\n    : null;\n}\n\nfunction continuityMatchesState(\n  receipt: SandboxProviderContinuityRecovery,\n  state: unknown,\n): boolean {\n  const continuity = providerContinuityRegistration(receipt.backend);\n  return (\n    continuity?.kind === receipt.kind && continuity.keyFromState(state) === receipt.continuityKey\n  );\n}\n\nfunction preserveContinuityWorkspaceForDiscard(\n  backend: SandboxBackend | string,\n  requestedState: unknown,\n  session: unknown,\n  sessionState: unknown,\n): boolean {\n  const continuity = providerContinuityRegistration(backend);\n  if (!continuity) return false;\n  const requestedKey = continuity.keyFromState(requestedState);\n  const replacementKey = continuity.keyFromState(sessionState);\n  if (!requestedKey || requestedKey !== replacementKey) return false;\n  continuity.preserveWorkspaceForDiscard(session, sessionState);\n  return true;\n}\n\nexport async function resumeExactSandboxSession(\n  clientInput: unknown,\n  backend: SandboxBackend | string,\n  state: unknown,\n  expectedInstanceId: string,\n  options?: { continuity?: SandboxProviderContinuityRecovery },\n): Promise<{\n  session: unknown;\n  sessionState: unknown;\n  instanceId: string;\n  providerContinuity?: SandboxProviderContinuityRecovery;\n}> {\n  const client = clientInput as ResumeCapableClient;\n  if (!client.resume) {\n    throw new SandboxConfigError(backend, `Sandbox backend \"${backend}\" does not support resume()`);\n  }\n  const exactState = exactResumeStateForBackend(client.backendId, state);\n  const continuity = options?.continuity;\n  if (\n    continuity &&\n    (continuity.backend !== backend ||\n      continuity.sourceInstanceId !== expectedInstanceId ||\n      !continuityMatchesState(continuity, exactState))\n  ) {\n    throw new SandboxResumeIdentityMismatchError(\n      backend,\n      expectedInstanceId,\n      continuity.sourceInstanceId,\n    );\n  }\n  if (!continuity && !client.resumeExact) {\n    throw new SandboxConfigError(\n      backend,\n      `Sandbox backend \"${backend}\" has no non-replacing resumeExact()`,\n    );\n  }\n  // A durable continuity receipt is creation authority owned by either the\n  // unique cold->warming winner or a durable teardown claim. Ordinary attached\n  // callers use resumeExact so an SDK cannot silently create a rival wrapper.\n  const session = continuity\n    ? await client.resume(exactState)\n    : await client.resumeExact!(exactState);\n  const actualInstanceId = readInstanceId(backend, session);\n  if (!actualInstanceId) {\n    // Do not tear down an unidentifiable handle: it may be the requested live\n    // provider. The adapter must expose a stable identity before Opengeni can\n    // safely command, publish, snapshot, or delete it.\n    throw new SandboxResumeIdentityUnavailableError(backend, expectedInstanceId);\n  }\n  if (actualInstanceId !== expectedInstanceId) {\n    const replacementState = (session as { state?: unknown }).state ?? exactState;\n    if (continuity && continuityMatchesState(continuity, replacementState)) {\n      return {\n        session,\n        sessionState: replacementState,\n        instanceId: actualInstanceId,\n        providerContinuity: continuity,\n      };\n    }\n    // A provider may race from running to absent between an exact preflight and\n    // its SDK resume. If that produced a same-workspace wrapper, discard only\n    // the wrapper; deleting the shared workspace would destroy recovery truth.\n    preserveContinuityWorkspaceForDiscard(backend, exactState, session, replacementState);\n    try {\n      await terminateManagedSandboxSession(client, replacementState, session);\n    } catch (cleanupError) {\n      throw new SandboxResumeIdentityMismatchError(backend, expectedInstanceId, actualInstanceId, {\n        cause: cleanupError,\n      });\n    }\n    throw new SandboxExactResumeReplacedError(backend, expectedInstanceId, actualInstanceId);\n  }\n  return {\n    session,\n    sessionState: (session as { state?: unknown }).state ?? exactState,\n    instanceId: actualInstanceId,\n    ...(continuity ? { providerContinuity: continuity } : {}),\n  };\n}\n\n/** Terminate a provider handle that never became durable warm ownership. A\n * continuity-adopted Docker wrapper is removed while its durable host\n * workspace remains available to the next elected recovery owner. */\nexport async function terminateUnpublishedSandboxSession(\n  established: EstablishedSandboxSession,\n): Promise<void> {\n  if (established.providerContinuity) {\n    const continuity = providerContinuityRegistration(established.providerContinuity.backend);\n    if (\n      continuity?.kind === established.providerContinuity.kind &&\n      continuity.keyFromState(established.sessionState) ===\n        established.providerContinuity.continuityKey\n    ) {\n      continuity.preserveWorkspaceForDiscard(established.session, established.sessionState);\n    }\n  }\n  await terminateManagedSandboxSession(\n    established.client,\n    established.sessionState,\n    established.session,\n  );\n}\n\n/** Remove every live-provider address while retaining backend-independent\n * archive/config state for a safe cold rematerialization. */\nexport function withoutSandboxProviderIdentity(\n  envelope: Record<string, unknown> | null,\n): Record<string, unknown> | null {\n  if (!envelope) return null;\n  const providerIndependentEnvelope = { ...envelope };\n  delete providerIndependentEnvelope[OPENGENI_SANDBOX_PROVIDER_INSTANCE_ID_FIELD];\n  // Some rolling/legacy envelopes contain both a top-level providerState and\n  // the newer nested sessionState. Strip both representations; retaining the\n  // top-level fallback would make the compatibility reader rediscover a dead\n  // provider after we deliberately converted the envelope to archive-only.\n  delete providerIndependentEnvelope.providerState;\n  const sessionState =\n    envelope.sessionState && typeof envelope.sessionState === \"object\"\n      ? (envelope.sessionState as Record<string, unknown>)\n      : null;\n  if (!sessionState) {\n    return providerIndependentEnvelope;\n  }\n  const { providerState: _providerState, ...providerIndependentState } = sessionState;\n  return {\n    ...providerIndependentEnvelope,\n    sessionState: providerIndependentState,\n  };\n}\n\nfunction readInstanceId(backend: SandboxBackend | string, session: unknown): string {\n  return liveProviderInstanceIdFromState(backend, (session as { state?: unknown }).state) ?? \"\";\n}\n\nasync function terminateCreatedSandbox(\n  client: ResumeCapableClient,\n  session: unknown,\n  sessionState: unknown,\n): Promise<void> {\n  try {\n    await terminateManagedSandboxSession(client, sessionState, session);\n  } catch {\n    /* best-effort */\n  }\n}\n\ntype ModalNativeWorkspacePersistence = \"snapshot_filesystem\" | \"snapshot_directory\";\ntype RestoreWorkspaceArchive =\n  | VerifiedWorkspaceArchive\n  | {\n      kind: \"host_spool\";\n      descriptor: TarWorkspaceArchiveDescriptor;\n      ref: WorkspaceArchiveObjectRef;\n    };\n\nfunction modalWorkspacePersistenceForRestore(\n  archive: RestoreWorkspaceArchive | null,\n): ModalNativeWorkspacePersistence | null {\n  if (archive?.kind !== \"provider_snapshot\") return null;\n  const snapshot = archive.nativeSnapshot;\n  if (!snapshot) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"native_snapshot_reference_invalid\",\n      `selected native snapshot archive revision ${archive.descriptor.revision} has no decoded provider receipt`,\n    );\n  }\n  const expected =\n    snapshot.provider === \"modal_snapshot_filesystem\"\n      ? \"snapshot_filesystem\"\n      : snapshot.provider === \"modal_snapshot_directory\"\n        ? \"snapshot_directory\"\n        : null;\n  if (!expected) return null;\n  if (snapshot.workspacePersistence !== undefined && snapshot.workspacePersistence !== expected) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"native_snapshot_reference_invalid\",\n      `selected Modal snapshot archive revision ${archive.descriptor.revision} has inconsistent persistence metadata`,\n    );\n  }\n  return expected;\n}\n\nfunction settingsForWorkspaceArchiveRestore(\n  backend: SandboxBackend,\n  settings: Settings,\n  archive: RestoreWorkspaceArchive | null,\n): Settings {\n  if (backend !== \"modal\") return settings;\n  const workspacePersistence = modalWorkspacePersistenceForRestore(archive);\n  if (workspacePersistence === \"snapshot_filesystem\" && archive?.kind === \"provider_snapshot\") {\n    // Boot the selected filesystem image directly. SDK hydrateWorkspace would\n    // create a second box and expose its identity only after old-box teardown.\n    // The ordinary create callback must own the only destination before verify.\n    return {\n      ...settings,\n      modalWorkspacePersistence: workspacePersistence,\n      modalImageId: archive.nativeSnapshot!.snapshotId,\n    };\n  }\n  return workspacePersistence && settings.modalWorkspacePersistence !== workspacePersistence\n    ? { ...settings, modalWorkspacePersistence: workspacePersistence }\n    : settings;\n}\n\n/**\n * Establish from one recovery envelope under an explicit creation policy. The\n * envelope is the lease's box-identity descriptor (the same per-turn `_sandbox`\n * envelope upserted by the turn activity).\n *\n *  - `opts.backendOverride ?? envelope.backendId ?? settings.sandboxBackend`\n *    selects the backend; the client is built for THAT backend (resume-by-id is\n *    fenced to the original provider).\n *  - warm reattach: deserialize the envelope sessionState → client.resume(state)\n *    (no lock; R4-safe). `resume-only` propagates provider NotFound.\n *  - `create-or-restore`: the elected owner may replace a missing warm instance,\n *    or create directly from a cold/null envelope.\n */\nexport async function establishSandboxSessionFromEnvelope(\n  settings: Settings,\n  envelope: Record<string, unknown> | null,\n  opts: {\n    sessionId: string;\n    recovery: \"create-or-restore\" | \"resume-only\";\n    loadHostWorkspaceArchive?: (ref: WorkspaceArchiveObjectRef) => Promise<WorkspaceArchiveSpool>;\n    backendOverride?: SandboxBackend;\n    environment?: Record<string, string>;\n    /** The lease a created box belongs to. A compute sandbox's agent is\n     * enrolled under it, so creating one requires it; other backends ignore it. */\n    createIdentity?: ComputeCreateIdentity;\n    onSandboxCreated?: SandboxCreatedCallback;\n    /** Durable lease owners fence the attempt before invoking a provider create.\n     * Called for each physical attempt, including logical-image fallback. A\n     * rejected hook prevents dispatch; a lost create reply is never permission\n     * to invoke the fallback under the same unresolved operation. */\n    onBeforeSandboxCreate?: (\n      settings: Settings,\n      intent?: ModalCreateIntent,\n      providerContext?: unknown,\n    ) => Promise<void>;\n    /** Called after archive hydration but immediately before the exact workspace\n     * fingerprint probe. Lease-aware callers persist `verifying` here so a box\n     * is never observable as ready while verification is in flight. */\n    onWorkspaceRestoreVerifying?: (descriptor: WorkspaceArchiveDescriptor) => Promise<void>;\n    metrics?: RuntimeMetricsHooks;\n    /** Exact pre-optimization sandbox settings. When a provider-immutable rig\n     * image is missing, retry from this logical image identity rather than\n     * guessing from a possibly absent tag or falling through to provider\n     * defaults. */\n    logicalFallbackSettings?: Settings;\n    /** Isolated conformance-test/embedding seam. Ordinary runtime callers use\n     * the validated provider registry. */\n    clientFactory?: (\n      backend: SandboxBackend,\n      settings: Settings,\n      environment: Record<string, string>,\n    ) => unknown;\n  },\n): Promise<EstablishedSandboxSession> {\n  const envelopeBackend =\n    typeof envelope?.backendId === \"string\" ? (envelope.backendId as SandboxBackend) : undefined;\n  const backend =\n    opts.backendOverride ?? envelopeBackend ?? (settings.sandboxBackend as SandboxBackend);\n  const createImageSource =\n    backend === \"modal\" && settings.modalImageId ? \"provider_immutable\" : \"logical\";\n  const environment = opts.environment ?? collectSandboxEnvironment(settings);\n  const client = (\n    opts.clientFactory\n      ? opts.clientFactory(backend, settings, environment)\n      : createSandboxClientForBackend(backend, settings, environment, opts.metrics)\n  ) as ResumeCapableClient | undefined;\n  if (!client) {\n    throw new SandboxConfigError(\n      backend,\n      `Cannot establish a sandbox session for backend \"${backend}\" (no client; sandboxBackend=none?)`,\n    );\n  }\n  if (opts.recovery === \"create-or-restore\" && !client.create) {\n    throw new SandboxConfigError(backend, `Sandbox backend \"${backend}\" does not support create()`);\n  }\n\n  // The manifest the box is CREATED with. Its `environment` must equal the\n  // environment the agent declares for this run (buildManifest's `environment`),\n  // because the SDK injects this box NON-OWNED and then applies the agent's\n  // manifest as a provided-session delta — `applyManifestToProvidedSession`\n  // throws on ANY environment delta (validateNoEnvironmentDelta). The client's\n  // constructor `env` materializes the RUNTIME env but does NOT populate\n  // `manifest.environment` (a bare create() yields `new Manifest()` with an empty\n  // environment), so the manifest env must be set here explicitly. `root` is left\n  // to default to \"/workspace\" to match buildManifest's declared root (the\n  // root-delta guard). The caller threads `opts.environment` = the SAME object\n  // passed to runtime.buildAgent, so current==target and the delta is empty.\n  const createManifest = { environment };\n\n  // The serialized provider state the box was last persisted as. The envelope\n  // shape is the per-turn `_sandbox` entry; its `sessionState` is the provider\n  // payload deserializeSandboxSessionStateEnvelope re-hydrates.\n  const envelopeSessionState =\n    envelope && typeof envelope === \"object\"\n      ? (envelope as { sessionState?: unknown }).sessionState\n      : undefined;\n\n  // The persisted /workspace snapshot the reaper folded onto the lease envelope\n  // (sandbox-file-persistence). Present on a re-warm whose box was drain-persisted:\n  //   - WARM reattach NotFound path (box gone, full envelope still has sandboxId);\n  //   - COLD lease re-warm (confirmDrainCold preserved a MINIMAL archive-only\n  //     envelope `{ sessionState: { workspaceArchive } }` — NO sandboxId, so the\n  //     warm-reattach branch must NOT try resume()-by-id; it cold-creates+hydrates).\n  const archiveState =\n    envelopeSessionState && typeof envelopeSessionState === \"object\"\n      ? (envelopeSessionState as {\n          workspaceArchive?: unknown;\n          workspaceArchiveRef?: unknown;\n          workspaceArchiveMeta?: unknown;\n        })\n      : undefined;\n  // Exactly one selected revision is restored. A present archive without its\n  // revision/hash/tree descriptor is not recoverable truth and fails before any\n  // provider create. `workspaceArchivePrev` is retained for explicit future\n  // operator selection, never silently substituted in this attempt.\n  const workspaceArchiveBase64 = archiveState?.workspaceArchive;\n  const workspaceArchiveMetadata = archiveState?.workspaceArchiveMeta;\n\n  // Create one destination directly from a Modal filesystem snapshot; other\n  // archive protocols hydrate the fresh destination. No archive is valid only\n  // for a genuinely new workspace; callers select and verify an exact archive before\n  // entering this seam. This is the SOLE archive-replay path, shared by the\n  // NotFound warm-reattach path and the cold-restore branch (b) below.\n  const coldRestore = async (resumeFallbackState?: unknown): Promise<EstablishedSandboxSession> => {\n    // Parse/verify lazily: a warm resume-by-id does not consume its retained\n    // archive, so a legacy live box remains resumable. Creation/restoration is\n    // the boundary that requires complete durable metadata.\n    let workspaceArchive: RestoreWorkspaceArchive | null = readVerifiedWorkspaceArchive(\n      workspaceArchiveBase64,\n      workspaceArchiveMetadata,\n    );\n    const objectRef = parseWorkspaceArchiveObjectRef(archiveState?.workspaceArchiveRef);\n    const objectDescriptor = parseWorkspaceArchiveDescriptor(workspaceArchiveMetadata);\n    if (\n      process.platform === \"linux\" &&\n      objectRef &&\n      objectDescriptor?.version === 1 &&\n      objectDescriptor.workspace.projection === \"sdk_local_archive_v1\" &&\n      opts.loadHostWorkspaceArchive\n    ) {\n      // Local/Docker restore a host-backed archive natively. Any other backend\n      // hydrates a portable tar converted from it, so a deployment that changes\n      // sandbox backend can still continue chats archived before the change.\n      if (\n        objectRef.sha256 !== objectDescriptor.archiveSha256 ||\n        objectRef.bytes !== objectDescriptor.archiveBytes\n      ) {\n        throw new WorkspaceArchiveIntegrityError(\n          \"archive_metadata_invalid\",\n          \"Host archive object reference does not match its descriptor\",\n        );\n      }\n      workspaceArchive = { kind: \"host_spool\", descriptor: objectDescriptor, ref: objectRef };\n    }\n    const hostBackedBackend = backend === \"local\" || backend === \"docker\";\n    if (objectRef && !workspaceArchive) {\n      throw new WorkspaceArchiveIntegrityError(\n        \"archive_hydration_failed\",\n        \"Selected workspace archive object has no supported restore loader\",\n      );\n    }\n    let hostSpool: WorkspaceArchiveSpool | undefined;\n    try {\n      // Preserve the pre-create integrity boundary used by inline archives.\n      // A missing/corrupt object must not create a provider just to delete it.\n      if (workspaceArchive?.kind === \"host_spool\") {\n        hostSpool = await opts.loadHostWorkspaceArchive!(workspaceArchive.ref);\n        if (\n          hostSpool.sha256 !== workspaceArchive.descriptor.archiveSha256 ||\n          hostSpool.byteSize !== workspaceArchive.descriptor.archiveBytes\n        ) {\n          throw new WorkspaceArchiveIntegrityError(\n            \"archive_hash_mismatch\",\n            \"Downloaded workspace archive does not match its descriptor\",\n          );\n        }\n      }\n      // The selected native artifact is the durable authority for its restore\n      // protocol. The process setting governs new sandboxes only: a mode rollout\n      // must not make an older, verified Modal snapshot impossible to hydrate.\n      const restoreSettings = settingsForWorkspaceArchiveRestore(\n        backend,\n        settings,\n        workspaceArchive,\n      );\n      const createdFromFilesystemSnapshot =\n        backend === \"modal\" &&\n        workspaceArchive?.kind === \"provider_snapshot\" &&\n        workspaceArchive.nativeSnapshot?.provider === \"modal_snapshot_filesystem\";\n      const restoreImageSource = createdFromFilesystemSnapshot\n        ? \"provider_immutable\"\n        : createImageSource;\n      // Resolve only the image this create will use. A retained filesystem\n      // snapshot must not depend on the availability of today's registry image\n      // or its secret. Rebuild the Modal client after registry resolution so\n      // fresh/directory creates receive the resolved private-image selector.\n      if (backend === \"modal\" && !opts.clientFactory) {\n        await ensureModalRegistryImage(restoreSettings);\n      }\n      const restoreClient =\n        restoreSettings === settings && (backend !== \"modal\" || opts.clientFactory)\n          ? client\n          : ((opts.clientFactory\n              ? opts.clientFactory(backend, restoreSettings, environment)\n              : createSandboxClientForBackend(\n                  backend,\n                  restoreSettings,\n                  environment,\n                  opts.metrics,\n                )) as ResumeCapableClient | undefined);\n      if (!restoreClient?.create) {\n        throw new SandboxConfigError(\n          backend,\n          `Sandbox backend \"${backend}\" does not support fresh archive restoration`,\n        );\n      }\n      let createdClient = restoreClient;\n      let attributedDuringCreate = false;\n      let providerDispatchAttempted = false;\n      const createWithAttribution = async (\n        candidate: ResumeCapableClient,\n        createSettings: Settings,\n      ) => {\n        if (candidate.createWithLifecycle && opts.onBeforeSandboxCreate) {\n          return await candidate.createWithLifecycle(\n            { manifest: createManifest },\n            {\n              beforeDispatch: async (intent, providerContext) => {\n                providerDispatchAttempted = true;\n                await opts.onBeforeSandboxCreate!(createSettings, intent, providerContext);\n              },\n              onCreated: async (session) => {\n                const instanceId = readInstanceId(backend, session);\n                if (!instanceId) throw new Error(\"Modal provider receipt has no physical identity\");\n                await opts.onSandboxCreated?.({\n                  client: candidate,\n                  session,\n                  sessionState: (session as { state?: unknown }).state ?? resumeFallbackState,\n                  instanceId,\n                  backendId: candidate.backendId,\n                });\n                attributedDuringCreate = true;\n              },\n            },\n          );\n        }\n        // Non-Modal providers and isolated client-factory fixtures retain their\n        // ordinary admission hook. Production Modal requires the wire intent.\n        await opts.onBeforeSandboxCreate?.(createSettings);\n        if (backend === \"compute\") {\n          return await candidate.create!(\n            { manifest: createManifest },\n            opts.createIdentity ? { opengeniCreateIdentity: opts.createIdentity } : undefined,\n          );\n        }\n        return await candidate.create!({ manifest: createManifest });\n      };\n      const createStarted = Date.now();\n      let restored: Awaited<ReturnType<NonNullable<typeof restoreClient.create>>>;\n      try {\n        restored = await createWithAttribution(restoreClient, restoreSettings);\n        recordSandboxCreateMetric(\n          opts.metrics,\n          restoreClient.backendId,\n          restoreImageSource,\n          \"completed\",\n          createStarted,\n        );\n      } catch (error) {\n        recordSandboxCreateMetric(\n          opts.metrics,\n          restoreClient.backendId,\n          restoreImageSource,\n          \"failed\",\n          createStarted,\n        );\n        recordSandboxProviderApiThrottleMetric(\n          opts.metrics,\n          restoreClient.backendId,\n          \"create\",\n          error,\n        );\n        if (providerDispatchAttempted) {\n          // Preserve the actual failure (including a known cleanup/setup\n          // failure); the durable receipt decides whether outcome is unknown.\n          throw error;\n        }\n        if (\n          createdFromFilesystemSnapshot ||\n          createImageSource !== \"provider_immutable\" ||\n          backend !== \"modal\" ||\n          !isProviderSandboxNotFoundError(restoreClient.backendId, error)\n        ) {\n          throw error;\n        }\n        const fallbackBaseSettings =\n          opts.logicalFallbackSettings ??\n          (settings.modalImageRef ? { ...settings, modalImageId: undefined } : null);\n        if (!fallbackBaseSettings) {\n          // An ID-only logical base is supported. Without the exact pre-selection\n          // settings, clearing the optimized ID would silently boot Modal's\n          // default image, so fail closed instead of changing the rig base.\n          throw error;\n        }\n        const fallbackSettings = settingsForWorkspaceArchiveRestore(\n          backend,\n          fallbackBaseSettings,\n          workspaceArchive,\n        );\n        await ensureModalRegistryImage(fallbackSettings);\n        const fallbackClient = (\n          opts.clientFactory\n            ? opts.clientFactory(backend, fallbackSettings, environment)\n            : createSandboxClientForBackend(backend, fallbackSettings, environment, opts.metrics)\n        ) as ResumeCapableClient | undefined;\n        if (!fallbackClient?.create) {\n          throw new SandboxConfigError(\n            backend,\n            \"Modal logical-image fallback does not support fresh creation\",\n          );\n        }\n        const fallbackStarted = Date.now();\n        try {\n          restored = await createWithAttribution(fallbackClient, fallbackSettings);\n          recordSandboxCreateMetric(\n            opts.metrics,\n            fallbackClient.backendId,\n            \"logical\",\n            \"completed\",\n            fallbackStarted,\n          );\n          createdClient = fallbackClient;\n        } catch (fallbackError) {\n          recordSandboxCreateMetric(\n            opts.metrics,\n            fallbackClient.backendId,\n            \"logical\",\n            \"failed\",\n            fallbackStarted,\n          );\n          recordSandboxProviderApiThrottleMetric(\n            opts.metrics,\n            fallbackClient.backendId,\n            \"create\",\n            fallbackError,\n          );\n          throw fallbackError;\n        }\n      }\n      let restoredState = (restored as { state?: unknown }).state;\n      const restoredInstanceId = readInstanceId(backend, restored);\n      if (!restoredInstanceId) {\n        await terminateCreatedSandbox(createdClient, restored, restoredState);\n        throw new SandboxConfigError(\n          backend,\n          `Sandbox backend \"${backend}\" created a handle without its declared provider identity`,\n        );\n      }\n      let established: EstablishedSandboxSession = {\n        client: createdClient,\n        session: restored,\n        sessionState: restoredState ?? resumeFallbackState,\n        instanceId: restoredInstanceId,\n        backendId: createdClient.backendId,\n      };\n      if (opts.onSandboxCreated && !attributedDuringCreate) {\n        try {\n          await opts.onSandboxCreated(established);\n        } catch (createCallbackError) {\n          await terminateCreatedSandbox(createdClient, restored, restoredState);\n          throw createCallbackError;\n        }\n      }\n      let hydrationApplied = false;\n      // A host-backed archive hydrated into a remote sandbox: what the converted\n      // tar materializes, verified after hydration instead of the archive's\n      // host-only fingerprint projection.\n      let portableContents: PortableWorkspaceTar[\"contents\"] | null = null;\n      if (workspaceArchive) {\n        const hydrate = (restored as { hydrateWorkspace?: (data: Uint8Array) => Promise<void> })\n          .hydrateWorkspace;\n        if (\n          !createdFromFilesystemSnapshot &&\n          (workspaceArchive.kind !== \"host_spool\" || !hostBackedBackend) &&\n          typeof hydrate !== \"function\"\n        ) {\n          await terminateCreatedSandbox(createdClient, restored, restoredState);\n          throw new WorkspaceArchiveIntegrityError(\n            \"archive_hydration_failed\",\n            `sandbox backend ${createdClient.backendId} cannot hydrate selected archive revision ${workspaceArchive.descriptor.revision}`,\n          );\n        }\n        try {\n          if (\n            createdFromFilesystemSnapshot &&\n            (restoredState as { imageId?: unknown } | undefined)?.imageId !==\n              restoreSettings.modalImageId\n          ) {\n            throw new WorkspaceArchiveIntegrityError(\n              \"archive_hydration_failed\",\n              \"Modal destination did not boot the selected filesystem snapshot\",\n            );\n          }\n          // Directory/tar hydration operates on the attributed destination.\n          if (workspaceArchive.kind === \"host_spool\" && hostBackedBackend) {\n            // This is the exact newly-created, unpublished destination. The lease\n            // restore fence must exclude admitted writers until verification ends;\n            // descriptor-relative filesystem access alone is not writer isolation.\n            const root = (restored as { state?: { workspaceRootPath?: unknown } }).state\n              ?.workspaceRootPath;\n            if (typeof root !== \"string\")\n              throw new WorkspaceArchiveIntegrityError(\n                \"archive_hydration_failed\",\n                \"Host archive restore has no exact workspace root\",\n              );\n            await restoreHostWorkspaceArchive(root, hostSpool!, {\n              archiveLimits: Reflect.get(restored as object, \"archiveLimits\"),\n            });\n          } else if (workspaceArchive.kind === \"host_spool\") {\n            const portable = await convertHostWorkspaceArchiveToTar(hostSpool!, {\n              excludedPaths: workspaceArchiveExcludedPaths(restored),\n              mtimeSeconds: Date.parse(workspaceArchive.descriptor.capturedAt) / 1000,\n            });\n            // The descriptor was fingerprinted from the source tree when it was\n            // captured; the archive must still be exactly that tree.\n            const expected = workspaceArchive.descriptor.workspace;\n            if (\n              portable.fingerprint.sha256 !== expected.sha256 ||\n              portable.fingerprint.entryCount !== expected.entryCount ||\n              portable.fingerprint.fileCount !== expected.fileCount ||\n              portable.fingerprint.totalFileBytes !== expected.totalFileBytes\n            ) {\n              throw new WorkspaceArchiveIntegrityError(\n                \"archive_hash_mismatch\",\n                `workspace archive revision ${workspaceArchive.descriptor.revision} does not match its recorded fingerprint`,\n              );\n            }\n            await hydrate!.call(restored, portable.bytes);\n            portableContents = portable.contents;\n          } else if (!createdFromFilesystemSnapshot) {\n            await hydrate!.call(restored, workspaceArchive.bytes);\n          }\n        } catch (error) {\n          await terminateCreatedSandbox(\n            createdClient,\n            restored,\n            (restored as { state?: unknown }).state,\n          );\n          if (error instanceof WorkspaceArchiveIntegrityError) throw error;\n          throw new WorkspaceArchiveIntegrityError(\n            \"archive_hydration_failed\",\n            `failed to hydrate selected workspace archive revision ${workspaceArchive.descriptor.revision}`,\n            { retryable: true, cause: error },\n          );\n        }\n        // Defend against a backend replacing its provider during hydration.\n        // Attribute the newly-active identity immediately,\n        // before restore-state marking, fingerprint verification, or any caller\n        // can publish the box warm. The callback is the durable lease/tagging\n        // boundary; if it cannot persist the replacement, the caller fails closed\n        // and this exact replacement is terminated below.\n        const hydratedState = (restored as { state?: unknown }).state;\n        const hydratedInstanceId = readInstanceId(backend, restored);\n        if (!hydratedInstanceId) {\n          await terminateCreatedSandbox(createdClient, restored, hydratedState);\n          throw new SandboxConfigError(\n            backend,\n            `Sandbox backend \"${backend}\" hydrated a handle without its declared provider identity`,\n          );\n        }\n        if (hydratedInstanceId !== established.instanceId) {\n          established = {\n            client: createdClient,\n            session: restored,\n            sessionState: hydratedState ?? resumeFallbackState,\n            instanceId: hydratedInstanceId,\n            backendId: createdClient.backendId,\n          };\n          if (opts.onSandboxCreated) {\n            try {\n              await opts.onSandboxCreated(established);\n            } catch (createCallbackError) {\n              await terminateCreatedSandbox(createdClient, restored, hydratedState);\n              throw createCallbackError;\n            }\n          }\n        }\n        if (opts.onWorkspaceRestoreVerifying) {\n          try {\n            await opts.onWorkspaceRestoreVerifying(workspaceArchive.descriptor);\n          } catch (error) {\n            await terminateCreatedSandbox(\n              createdClient,\n              restored,\n              (restored as { state?: unknown }).state,\n            );\n            throw error;\n          }\n        }\n        // Native provider snapshots are restored by their exact opaque receipt.\n        // Opengeni verifies receipt identity/hash before hydration, but it must not\n        // impose a tar/inode equivalence contract on the provider's filesystem\n        // image. Tar archives remain content-verified after hydration.\n        if (workspaceArchive.kind === \"tar\" || workspaceArchive.kind === \"host_spool\") {\n          try {\n            if (portableContents) {\n              await verifyRestoredWorkspaceContents(\n                restored,\n                portableContents,\n                workspaceArchive.descriptor.revision,\n              );\n            } else {\n              await verifyRestoredWorkspace(restored, workspaceArchive.descriptor);\n            }\n          } catch (error) {\n            await terminateCreatedSandbox(\n              createdClient,\n              restored,\n              (restored as { state?: unknown }).state,\n            );\n            if (error instanceof WorkspaceArchiveIntegrityError) throw error;\n            throw new WorkspaceArchiveIntegrityError(\n              \"workspace_fingerprint_unavailable\",\n              `failed to verify selected workspace archive revision ${workspaceArchive.descriptor.revision}`,\n              { retryable: true },\n            );\n          }\n        }\n        hydrationApplied = true;\n        console.info(\n          `[sandbox] cold-restore applied ${workspaceArchive.kind === \"provider_snapshot\" ? \"native snapshot receipt\" : \"verified tar archive\"} revision ${workspaceArchive.descriptor.revision}`,\n        );\n      }\n      restoredState = (restored as { state?: unknown }).state;\n      const finalInstanceId = readInstanceId(backend, restored);\n      if (!finalInstanceId) {\n        await terminateCreatedSandbox(createdClient, restored, restoredState);\n        throw new SandboxConfigError(\n          backend,\n          `Sandbox backend \"${backend}\" returned a handle without its declared provider identity`,\n        );\n      }\n      return {\n        client: createdClient,\n        session: restored,\n        sessionState: restoredState ?? resumeFallbackState,\n        instanceId: finalInstanceId,\n        backendId: createdClient.backendId,\n        origin: hydrationApplied ? (\"restored\" as const) : (\"created\" as const),\n        ...(workspaceArchive ? { restoredArchive: workspaceArchive.descriptor } : {}),\n      };\n    } finally {\n      await hostSpool?.dispose().catch(() => {\n        // Cleanup must not discard a successfully established provider handle\n        // or replace the authoritative restore failure with a filesystem error.\n        console.warn(\"workspace archive download spool cleanup failed\");\n      });\n    }\n  };\n\n  // Does the envelope carry a RESUMABLE box id (warm reattach), or only a\n  // restorable archive (cold lease)? Archive-only state is not resumable: the\n  // provider's deserialize/resume path would reject it before Opengeni could\n  // cold-restore. New envelopes use the stable Opengeni identity; legacy SDK\n  // provider keys remain readable during rollout.\n  const persistedInstanceId = assertConsistentSandboxProviderIdentity(backend, envelope);\n  const hasResumableInstance = persistedInstanceId !== null;\n\n  // (a) WARM REATTACH BY ID — only when the envelope carries a resumable box id.\n  if (\n    hasResumableInstance &&\n    envelopeSessionState &&\n    client.resume &&\n    client.deserializeSessionState\n  ) {\n    let resumedState: unknown;\n    try {\n      resumedState = await deserializeSandboxSessionStateEnvelope(\n        client as unknown as SandboxClient,\n        envelopeSessionState,\n        persistedInstanceId,\n      );\n    } catch (error) {\n      throw new SandboxConfigError(\n        backend,\n        `Failed to deserialize sandbox resume envelope for backend \"${backend}\": ${errorMessage(error)}`,\n      );\n    }\n    if (resumedState !== undefined) {\n      const providerContinuity =\n        opts.recovery === \"create-or-restore\"\n          ? parsedEnvelopeContinuity(backend, envelope, resumedState, persistedInstanceId)\n          : null;\n      try {\n        const resumed = await resumeExactSandboxSession(\n          client,\n          backend,\n          resumedState,\n          persistedInstanceId,\n          providerContinuity ? { continuity: providerContinuity } : undefined,\n        );\n        const established: EstablishedSandboxSession = {\n          client,\n          session: resumed.session,\n          sessionState: resumed.sessionState,\n          instanceId: resumed.instanceId,\n          backendId: client.backendId,\n          origin: \"resumed\",\n          ...(resumed.providerContinuity ? { providerContinuity: resumed.providerContinuity } : {}),\n          ...(resumed.instanceId !== persistedInstanceId\n            ? { lostInstanceId: persistedInstanceId }\n            : {}),\n        };\n        // A continuity resume occurs only on a lease's unique warming owner.\n        // Attribute the restarted/adopted wrapper before returning exactly as\n        // for a fresh create; failure discards the wrapper but preserves the\n        // durable workspace for the next owner.\n        if (resumed.providerContinuity && opts.onSandboxCreated) {\n          try {\n            await opts.onSandboxCreated(established);\n          } catch (error) {\n            await terminateUnpublishedSandboxSession(established).catch(() => undefined);\n            throw error;\n          }\n        }\n        return established;\n      } catch (error) {\n        // Attached callers never own replacement. Propagate the provider\n        // NotFound so their lease-aware caller can atomically mark this exact\n        // warm epoch/instance cold and re-enter normal admission. Only the\n        // cold->warming winner may replace the missing box.\n        if (\n          !isProviderSandboxNotFoundError(client.backendId, error) ||\n          opts.recovery === \"resume-only\"\n        ) {\n          throw error;\n        }\n        // COLD-RESTORE: the box is genuinely gone. Modal does NOT restore via\n        // create({ snapshot }) — passing `snapshot` to ModalSandboxClient.create()\n        // THROWS (assertCoreSnapshotUnsupported). Modal's real persistence is an\n        // OPAQUE ARCHIVE captured by session.persistWorkspace() at drain/turn-\n        // snapshot time and folded onto the lease envelope\n        // (sandbox-file-persistence). The shared coldRestore() seam creates a\n        // fresh box and replays that archive. `lostInstanceId` carries the gone\n        // box's id so the caller can emit the durable sandbox.box.lost event.\n        if (\n          providerContinuity &&\n          (typeof workspaceArchiveBase64 !== \"string\" || workspaceArchiveBase64.length === 0)\n        ) {\n          throw new SandboxProviderContinuityUnavailableError(backend, persistedInstanceId, false, {\n            cause: error,\n          });\n        }\n        let restoredSession: EstablishedSandboxSession;\n        try {\n          restoredSession = await coldRestore(resumedState);\n        } catch (restoreError) {\n          if (!providerContinuity) throw restoreError;\n          throw new SandboxProviderContinuityUnavailableError(\n            backend,\n            persistedInstanceId,\n            restoreError instanceof WorkspaceArchiveIntegrityError ? restoreError.retryable : true,\n            { cause: restoreError },\n          );\n        }\n        return persistedInstanceId\n          ? { ...restoredSession, lostInstanceId: persistedInstanceId }\n          : restoredSession;\n      }\n    }\n  }\n\n  // (b) COLD SESSION / COLD LEASE — no resumable box id. create() a fresh box, and\n  // if the envelope carries a persisted /workspace snapshot (the archive-only\n  // envelope confirmDrainCold preserves across draining->cold), replay it so\n  // /workspace survives the box churn (sandbox-file-persistence). No archive -> a\n  // clean empty box (a never-warmed session).\n  if (opts.recovery === \"resume-only\") {\n    throw new SandboxResumeStateUnavailableError(backend);\n  }\n  return await coldRestore();\n}\n\nfunction recordSandboxCreateMetric(\n  metrics: RuntimeMetricsHooks | undefined,\n  backend: string,\n  imageSource: \"logical\" | \"provider_immutable\",\n  outcome: \"completed\" | \"failed\",\n  startedMs: number,\n): void {\n  try {\n    metrics?.onSandboxCreate?.({\n      backend,\n      imageSource,\n      outcome,\n      durationSeconds: Math.max(0, (Date.now() - startedMs) / 1000),\n    });\n  } catch {\n    // Metrics emission must not affect sandbox lifecycle.\n  }\n}\n\nfunction recordSandboxProviderApiThrottleMetric(\n  metrics: RuntimeMetricsHooks | undefined,\n  backend: string,\n  operation: \"create\" | \"renew\",\n  error: unknown,\n): void {\n  if (!isProviderApiThrottleError(error)) return;\n  try {\n    metrics?.onSandboxProviderApiThrottle?.({ backend, operation });\n  } catch {\n    // Metrics emission must not affect sandbox lifecycle.\n  }\n}\n\n// A client that can SERIALIZE a live session state back to the persistable\n// envelope form (the inverse of deserializeSessionState). Narrowed so the leaf\n// stays agent-loop-free.\ntype SerializeCapableClient = {\n  backendId: string;\n  serializeSessionState?: (state: unknown, options?: unknown) => Promise<Record<string, unknown>>;\n};\n\n/**\n * Fold a freshly-established (or resumed) sandbox session into the persistable\n * `resume_state` envelope the lease stores — the SAME `{ backendId, sessionState }`\n * shape `establishSandboxSessionFromEnvelope` consumes to RESUME BY ID. The\n * API-direct control plane (viewer attach / Channel-A) MUST persist this onto the\n * lease at warm-commit time, or a later op (which reads the lease's resume_state)\n * has nothing to resume from and COLD-CREATES A RIVAL BOX — the box-churn the\n * prove-it surfaced (fs.write then fs.read 404'd on a different box; N Channel-A\n * ops leaked N boxes). Returns null when the client cannot serialize (the caller\n * stores null and the box rides the provider idle-timeout — no rival spawn, just\n * no warm-reattach).\n */\nexport async function serializeEstablishedSandboxEnvelope(\n  established: EstablishedSandboxSession,\n): Promise<Record<string, unknown> | null> {\n  const client = established.client as SerializeCapableClient | undefined;\n  if (!client || typeof client.serializeSessionState !== \"function\") {\n    return null;\n  }\n  if (established.sessionState === undefined || established.sessionState === null) {\n    return null;\n  }\n  try {\n    // serializeSessionState returns the PERSISTABLE FLAT provider state — for\n    // Modal `{ sandboxId, appName, imageTag, manifest(serialized),\n    // configuredExposedPorts, ... }` (sandboxId preserved via `...state`).\n    const serialized = await client.serializeSessionState(established.sessionState);\n\n    // deserializeSandboxSessionStateEnvelope expects the lease-envelope shape\n    // `{ providerState, manifest, snapshot?, exposedPorts?, workspaceReady }` and\n    // rehydrates `{ ...providerState, manifest, snapshot?, exposedPorts?,\n    // workspaceReady }`. So the FLAT serialized state must be nested under\n    // `providerState` (and manifest/ports lifted), or sandboxId is dropped on the\n    // round-trip and resume() throws \"requires a persisted sandboxId\". SDK-owned\n    // envelope fields are removed from providerState after lifting; providers can\n    // return live Manifest instances there, and deserialization overlays the\n    // authoritative manifest anyway. configuredExposedPorts is provider\n    // configuration/state, not the SDK's port-keyed endpoint record, so it must\n    // never be lifted.\n    const flat = serialized as Record<string, unknown>;\n    const backend = sandboxBackendForSdkBackendId(established.backendId) ?? established.backendId;\n    const serializedInstanceId = liveProviderInstanceIdFromState(backend, flat);\n    if (!serializedInstanceId || serializedInstanceId !== established.instanceId) {\n      return null;\n    }\n    const manifest = serializeSdkManifestForEnvelope(flat.manifest);\n    const exposedPorts = runStateExposedPortsRecord(flat.exposedPorts);\n    const sessionState: Record<string, unknown> = {\n      providerState: providerStateWithoutDuplicateManifest(flat),\n      ...(manifest !== undefined ? { manifest } : {}),\n      ...(exposedPorts !== undefined ? { exposedPorts } : {}),\n      workspaceReady: true,\n    };\n    return {\n      backendId: established.backendId,\n      [OPENGENI_SANDBOX_PROVIDER_INSTANCE_ID_FIELD]: established.instanceId,\n      sessionState,\n    };\n  } catch {\n    // A serialize failure must NOT fail the attach/op; we just lose warm-reattach\n    // for this box (it stays resumable-by-instance only via the next cold path).\n    return null;\n  }\n}\n\n/**\n * Whether a replacement envelope contains a provider-resumable identity. An\n * archive-only envelope is intentionally valid recovery metadata, but it is\n * never proof that the newly-created provider box can be resumed or attached.\n */\nexport function hasPersistableSandboxProviderIdentity(\n  envelope: Record<string, unknown> | null | undefined,\n  backend?: SandboxBackend | string,\n): envelope is Record<string, unknown> {\n  try {\n    const resolvedBackend =\n      backend ??\n      (typeof envelope?.backendId === \"string\"\n        ? (sandboxBackendForSdkBackendId(envelope.backendId) ?? envelope.backendId)\n        : undefined);\n    return resolvedBackend\n      ? assertConsistentSandboxProviderIdentity(resolvedBackend, envelope) !== null\n      : sandboxProviderInstanceIdFromEnvelope(envelope) !== null;\n  } catch {\n    return false;\n  }\n}\n\n/** A replacement provider may not be published warm without a resumable\n * identity. Archive-only state is retained only when the caller rolls back to\n * cold and needs the verified workspace bytes for the next attempt. */\nexport class SandboxReplacementProviderStateError extends Error {\n  readonly code = \"replacement_provider_state_unpersistable\" as const;\n\n  constructor(public readonly backend: string) {\n    super(\n      `sandbox backend \"${backend}\" replacement provider state could not be serialized; refusing to publish an attachable lease`,\n    );\n    this.name = \"SandboxReplacementProviderStateError\";\n  }\n}\n\nexport function requirePersistableReplacementSandboxEnvelope(\n  envelope: Record<string, unknown> | null,\n  backend: string,\n): Record<string, unknown> {\n  const providerInstanceId = assertConsistentSandboxProviderIdentity(backend, envelope);\n  if (!envelope || !providerInstanceId) {\n    throw new SandboxReplacementProviderStateError(backend);\n  }\n  return envelope;\n}\n\nconst DURABLE_WORKSPACE_ARCHIVE_FIELDS = [\n  \"workspaceArchive\",\n  \"workspaceArchiveMeta\",\n  \"workspaceArchiveRef\",\n  \"workspaceArchivePrev\",\n  \"workspaceArchivePrevMeta\",\n  \"workspaceArchivePrevRef\",\n  \"workspaceArchiveAt\",\n] as const;\n\nfunction durableWorkspaceArchiveFields(\n  envelope: Record<string, unknown> | null,\n): Record<string, unknown> | null {\n  const sessionState =\n    envelope?.sessionState && typeof envelope.sessionState === \"object\"\n      ? (envelope.sessionState as Record<string, unknown>)\n      : null;\n  if (!sessionState) return null;\n  const archiveRef = parseWorkspaceArchiveObjectRef(sessionState.workspaceArchiveRef);\n  const previousRef = parseWorkspaceArchiveObjectRef(sessionState.workspaceArchivePrevRef);\n  const hasInline =\n    typeof sessionState.workspaceArchive === \"string\" && sessionState.workspaceArchive.length > 0;\n  const hasPreviousInline =\n    typeof sessionState.workspaceArchivePrev === \"string\" &&\n    sessionState.workspaceArchivePrev.length > 0;\n  if (!hasInline && !archiveRef && !hasPreviousInline && !previousRef) {\n    return null;\n  }\n  const fields: Record<string, unknown> = {};\n  for (const key of DURABLE_WORKSPACE_ARCHIVE_FIELDS) {\n    if (sessionState[key] !== undefined && sessionState[key] !== null) {\n      fields[key] = sessionState[key];\n    }\n  }\n  return omitInlineWorkspaceArchiveWhenObjectRefPresent(fields);\n}\n\n/**\n * Build the only resume envelope that may be published for a newly-created\n * replacement sandbox. Historical state contributes durable archive pointers\n * only; it can never substitute for serialization of the replacement's provider\n * identity. If replacement serialization is unavailable or fails, publication\n * keeps an archive-only envelope (when one exists) or null. The new instance id\n * remains separately fenced on the lease, while later attach/resume fails closed\n * rather than targeting the dead provider that initiated rematerialization.\n */\nexport async function serializeReplacementSandboxEnvelope(\n  established: EstablishedSandboxSession,\n  archiveSource: Record<string, unknown> | null,\n): Promise<Record<string, unknown> | null> {\n  const serialized = await serializeEstablishedSandboxEnvelope(established);\n  const archiveFields = durableWorkspaceArchiveFields(archiveSource);\n  if (!serialized && !archiveFields) {\n    return null;\n  }\n  const serializedSessionState =\n    serialized?.sessionState && typeof serialized.sessionState === \"object\"\n      ? (serialized.sessionState as Record<string, unknown>)\n      : {};\n  const sessionState: Record<string, unknown> = {\n    ...serializedSessionState,\n    ...(archiveFields ?? {}),\n  };\n  // Spread cannot delete keys. Restore inlines that leaked into serialized\n  // replacement state must not survive a durable object-storage ref.\n  if (parseWorkspaceArchiveObjectRef(sessionState.workspaceArchiveRef)) {\n    delete sessionState.workspaceArchive;\n  }\n  if (parseWorkspaceArchiveObjectRef(sessionState.workspaceArchivePrevRef)) {\n    delete sessionState.workspaceArchivePrev;\n  }\n  return {\n    ...(serialized ?? {}),\n    // Never inherit a historical backend marker when the replacement could not\n    // serialize. The separately-persisted resume_backend_id and this envelope\n    // must both describe the replacement.\n    backendId: established.backendId,\n    sessionState,\n  };\n}\n","import { rmSync } from \"node:fs\";\nimport { lstat, mkdtemp, readdir, readFile, readlink, realpath, rm } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\n\n/**\n * Private host-archive spool directories are process-owned. In-process callers\n * dispose them on every success/failure path, but a worker that stops while a\n * capture, upload or restore is in flight (rolling deploy, SIGTERM drain, crash)\n * cannot run that cleanup, and each spool holds a whole workspace archive.\n *\n * The directory name therefore records its owner process identity: the PID\n * namespace, PID and kernel start time. A later process may remove a directory\n * only when that exact owner is provably gone: same PID namespace (PIDs from\n * another namespace are not comparable), and that PID either no longer exists or\n * now belongs to a different process start. Live owners, including concurrent\n * workers sharing one TMPDIR, are never touched. Unmarked legacy names are\n * never swept because their owner cannot be proven gone.\n *\n * The same ownership applies to the object-storage download spool\n * (`@opengeni/storage` `downloadWorkspaceArchiveSpool`), which cannot depend on\n * runtime and therefore receives `workspaceArchiveDownloadTemporaryDirectory`\n * from its callers.\n */\nexport const HOST_ARCHIVE_TEMPORARY_PREFIX = \"opengeni-host-archive-\";\nexport const WORKSPACE_ARCHIVE_DOWNLOAD_TEMPORARY_PREFIX = \"opengeni-workspace-archive-\";\nconst OWNER_MARKED_PREFIXES = [\n  HOST_ARCHIVE_TEMPORARY_PREFIX,\n  WORKSPACE_ARCHIVE_DOWNLOAD_TEMPORARY_PREFIX,\n] as const;\ntype OwnerMarkedPrefix = (typeof OWNER_MARKED_PREFIXES)[number];\n\nfunction ownedName(prefix: OwnerMarkedPrefix): RegExp {\n  return new RegExp(\"^\" + prefix + \"o(\\\\d+)\\\\.(\\\\d+)\\\\.(\\\\d+)-[A-Za-z0-9]{6}$\");\n}\nconst OWNED_NAMES = OWNER_MARKED_PREFIXES.map(ownedName);\n\ntype ProcessOwner = { namespace: string; pid: number; startTime: string };\n\nasync function processStartTime(pid: number | \"self\"): Promise<string | null> {\n  try {\n    const stat = await readFile(`/proc/${pid}/stat`, \"utf8\");\n    // The command name is parenthesized and may contain spaces or ')'.\n    const fields = stat.slice(stat.lastIndexOf(\")\") + 2).split(\" \");\n    // Field 22 (starttime) is the 20th field after \"pid (comm)\".\n    const startTime = fields[19];\n    return startTime && /^\\d+$/.test(startTime) ? startTime : null;\n  } catch {\n    return null;\n  }\n}\n\nasync function pidNamespace(): Promise<string | null> {\n  try {\n    return /^pid:\\[(\\d+)\\]$/.exec(await readlink(\"/proc/self/ns/pid\"))?.[1] ?? null;\n  } catch {\n    return null;\n  }\n}\n\nlet ownerIdentity: Promise<ProcessOwner | null> | undefined;\nfunction currentOwner(): Promise<ProcessOwner | null> {\n  return (ownerIdentity ??= (async () => {\n    const [namespace, startTime] = await Promise.all([pidNamespace(), processStartTime(\"self\")]);\n    return namespace && startTime ? { namespace, pid: process.pid, startTime } : null;\n  })());\n}\n\n/** Spool directories this process still owns; removed on normal process exit. */\nconst liveDirectories = new Set<string>();\nlet exitHookInstalled = false;\nfunction removeLiveDirectoriesOnExit() {\n  for (const directory of liveDirectories) {\n    try {\n      rmSync(directory, { recursive: true, force: true });\n    } catch {\n      // Exit cleanup is best effort; the next process's sweep reclaims it.\n    }\n  }\n  liveDirectories.clear();\n}\n\n/** Create a private owner-marked spool directory directly under `base`. */\nexport async function createHostArchiveTemporaryDirectory(\n  base: string,\n  kind: OwnerMarkedPrefix = HOST_ARCHIVE_TEMPORARY_PREFIX,\n): Promise<string> {\n  const owner = await currentOwner();\n  const prefix = owner ? `${kind}o${owner.namespace}.${owner.pid}.${owner.startTime}-` : kind;\n  const directory = await mkdtemp(join(base, prefix));\n  liveDirectories.add(directory);\n  if (!exitHookInstalled) {\n    exitHookInstalled = true;\n    process.once(\"exit\", removeLiveDirectoriesOnExit);\n  }\n  return directory;\n}\n\n/** Remove a spool directory created by this process. Idempotent. */\nexport async function removeHostArchiveTemporaryDirectory(directory: string): Promise<void> {\n  await rm(directory, { recursive: true, force: true });\n  liveDirectories.delete(directory);\n}\n\nasync function ownerIsGone(\n  current: ProcessOwner,\n  owner: { namespace: string; pid: number; startTime: string },\n): Promise<boolean> {\n  if (owner.namespace !== current.namespace) return false;\n  if (owner.pid === current.pid) return owner.startTime !== current.startTime;\n  if (!Number.isSafeInteger(owner.pid) || owner.pid < 1) return false;\n  const liveStartTime = await processStartTime(owner.pid);\n  return liveStartTime !== owner.startTime;\n}\n\n/**\n * Remove spool directories left behind by processes that no longer exist.\n * Returns the removed paths. Never throws: cleanup must not block startup or a\n * capture.\n */\nexport async function sweepOrphanedHostArchiveTemporaryDirectories(\n  bases: readonly string[] = hostArchiveTemporaryBases(),\n): Promise<string[]> {\n  const removed: string[] = [];\n  const current = await currentOwner();\n  const uid = typeof process.getuid === \"function\" ? process.getuid() : undefined;\n  if (!current || uid === undefined) return removed;\n  const seen = new Set<string>();\n  for (const candidate of bases) {\n    const base = await realpath(candidate).catch(() => null);\n    if (!base || seen.has(base)) continue;\n    seen.add(base);\n    const names = await readdir(base).catch(() => [] as string[]);\n    for (const name of names) {\n      const match = OWNED_NAMES.map((pattern) => pattern.exec(name)).find(Boolean);\n      if (!match) continue;\n      const owner = { namespace: match[1]!, pid: Number(match[2]), startTime: match[3]! };\n      try {\n        if (!(await ownerIsGone(current, owner))) continue;\n        const path = join(base, name);\n        const stats = await lstat(path);\n        if (!stats.isDirectory() || stats.uid !== uid) continue;\n        await rm(path, { recursive: true, force: true });\n        removed.push(path);\n      } catch {\n        // Another sweeper removed it, or it is not ours to inspect.\n      }\n    }\n  }\n  return removed;\n}\n\n/** The disk temporary locations `privateTemporaryDirectory` may choose. */\nexport function hostArchiveTemporaryBases(): string[] {\n  return [tmpdir(), \"/var/tmp\", \"/tmp\"];\n}\n\nlet processSweep: Promise<string[]> | undefined;\n/** Sweep once per process: at worker start and before the first spool or\n * download. Covers every owner-marked prefix. */\nexport function sweepOrphanedHostArchiveTemporaryDirectoriesOnce(): Promise<string[]> {\n  return (processSweep ??= sweepOrphanedHostArchiveTemporaryDirectories());\n}\n\n/** Owner-marked private directories for `downloadWorkspaceArchiveSpool`, so a\n * process killed mid-download leaves a directory a later process can prove\n * orphaned and reclaim. */\nexport const workspaceArchiveDownloadTemporaryDirectory = Object.freeze({\n  async create(): Promise<string> {\n    await sweepOrphanedHostArchiveTemporaryDirectoriesOnce();\n    return await createHostArchiveTemporaryDirectory(\n      tmpdir(),\n      WORKSPACE_ARCHIVE_DOWNLOAD_TEMPORARY_PREFIX,\n    );\n  },\n  remove: removeHostArchiveTemporaryDirectory,\n});\n","import { isDeepStrictEqual } from \"node:util\";\nimport { z } from \"zod\";\nimport { ModalRouterProviderCommand } from \"@opengeni/contracts\";\nimport type { ProviderCommandOutput } from \"../provider-command-session\";\nimport { MODAL_ROUTER_READ_PAGE_BYTES } from \"./modal-command-router-wire\";\n\n// A provider batch may end halfway through a UTF-8 character. Keep only that\n// unfinished suffix in protected cursor state; invalid complete bytes still\n// use the usual replacement-character decoding policy.\nfunction decodePage(prior: string, input: Uint8Array[], terminal: boolean) {\n  const bytes = Buffer.concat([Buffer.from(prior, \"base64\"), ...input]);\n  let boundary = bytes.length;\n  if (!terminal) {\n    for (let start = Math.max(0, bytes.length - 3); start < bytes.length; start++) {\n      const first = bytes[start]!;\n      const width =\n        first >= 0xc2 && first <= 0xdf\n          ? 2\n          : first >= 0xe0 && first <= 0xef\n            ? 3\n            : first >= 0xf0 && first <= 0xf4\n              ? 4\n              : 0;\n      if (!width || bytes.length - start >= width) continue;\n      const suffix = bytes.subarray(start + 1);\n      if (!suffix.every((byte) => byte >= 0x80 && byte <= 0xbf)) continue;\n      const second = suffix[0];\n      if (\n        second !== undefined &&\n        ((first === 0xe0 && second < 0xa0) ||\n          (first === 0xed && second > 0x9f) ||\n          (first === 0xf0 && second < 0x90) ||\n          (first === 0xf4 && second > 0x8f))\n      )\n        continue;\n      boundary = start;\n      break;\n    }\n  }\n  return {\n    text: bytes.subarray(0, boundary).toString(\"utf8\"),\n    remainder: bytes.subarray(boundary).toString(\"base64\"),\n  };\n}\n\nconst RawStream = z\n  .object({\n    bytes: z\n      .instanceof(Uint8Array)\n      .transform((bytes): Uint8Array<ArrayBufferLike> => bytes)\n      .refine(\n        (bytes) => bytes.byteLength <= MODAL_ROUTER_READ_PAGE_BYTES,\n        \"Raw page exceeded its bound\",\n      ),\n    eof: z.boolean(),\n  })\n  .strict();\nconst RawExit = z.discriminatedUnion(\"source\", [\n  z.object({ source: z.literal(\"router_poll\"), code: z.number().int().nullable() }).strict(),\n  z.object({ source: z.literal(\"retained_terminal\"), code: z.number().int() }).strict(),\n]);\nconst RawPage = z\n  .object({\n    protocol: z.literal(\"modal-router-raw-page-v1\"),\n    expected: ModalRouterProviderCommand,\n    command: ModalRouterProviderCommand,\n    streams: z.object({ stdout: RawStream, stderr: RawStream }).strict(),\n    exit: RawExit,\n  })\n  .strict();\n\n/** Bounded native RPC bytes and their exact cursor projection. The source tag\n * distinguishes a fresh poll from previously captured terminal evidence; it\n * does not authenticate an object supplied by a caller. No Start, custody,\n * database settlement or parent completion authority is conveyed. */\nexport type ModalRawOutputPage = z.infer<typeof RawPage>;\nexport type ModalRawOutputStreams = ModalRawOutputPage[\"streams\"];\nexport type ModalRawOutputExit = ModalRawOutputPage[\"exit\"];\ntype NativeOutput = ProviderCommandOutput & {\n  expected: ModalRouterProviderCommand;\n  command: ModalRouterProviderCommand;\n};\n\nfunction project(\n  expected: ModalRouterProviderCommand,\n  streams: ModalRawOutputStreams,\n  exit: ModalRawOutputExit,\n): NativeOutput {\n  const command = structuredClone(expected);\n  const chunks: ProviderCommandOutput[\"chunks\"] = [];\n  for (const stream of [\"stdout\", \"stderr\"] as const) {\n    const old = expected.streams[stream];\n    const page = streams[stream];\n    const decoded = decodePage(old.utf8Remainder, [page.bytes], page.eof);\n    const byteOffset = old.byteOffset + page.bytes.byteLength;\n    if (!Number.isSafeInteger(byteOffset)) throw new Error(\"Modal output offset exhausted\");\n    command.streams[stream] = {\n      byteOffset,\n      utf8Remainder: decoded.remainder,\n      eof: page.eof,\n      exitCode: page.eof ? exit.code : null,\n    };\n    if (decoded.text)\n      chunks.push({\n        stream,\n        chunkId: `modal-router:${expected.execId}:${stream}:${old.byteOffset}:${byteOffset}:${page.eof ? 1 : 0}`,\n        text: decoded.text,\n      });\n  }\n  return {\n    command,\n    expected: structuredClone(expected),\n    chunks,\n    exitCode: command.streams.stdout.eof && command.streams.stderr.eof ? exit.code : null,\n    providerExited: exit.code !== null,\n    streamFidelity: expected.pty ? \"merged\" : \"separate\",\n  };\n}\n\n/** Provider-private construction from joined read/poll replies. Keep the SDK\n * projection unchanged; this pure helper itself is not provider proof. */\nexport function collectModalRawOutputPage(\n  command: ModalRouterProviderCommand,\n  streams: ModalRawOutputStreams,\n  exit: ModalRawOutputExit,\n): { raw: ModalRawOutputPage; output: NativeOutput } {\n  const expected = structuredClone(command);\n  const captured = {\n    stdout: { bytes: Buffer.from(streams.stdout.bytes), eof: streams.stdout.eof },\n    stderr: { bytes: Buffer.from(streams.stderr.bytes), eof: streams.stderr.eof },\n  };\n  const output = project(expected, captured, exit);\n  return {\n    raw: {\n      protocol: \"modal-router-raw-page-v1\",\n      expected,\n      command: structuredClone(output.command),\n      streams: captured,\n      exit: { ...exit },\n    },\n    output,\n  };\n}\n\n/** Recompute decoded output from exact bytes, never caller-decoded text. The\n * current cursor must come from the caller's authoritative store. Equality\n * checks are not a database CAS; coherent bytes still need trusted acquisition\n * and atomic capture by the owner. */\nexport function reduceModalRawOutputPage(\n  input: ModalRawOutputPage,\n  current: ModalRouterProviderCommand,\n): NativeOutput {\n  const page = RawPage.parse(input);\n  const expected = ModalRouterProviderCommand.parse(current);\n  if (!isDeepStrictEqual(page.expected, expected))\n    throw new Error(\"Raw page does not match the current native cursor\");\n  for (const stream of [\"stdout\", \"stderr\"] as const) {\n    const old = expected.streams[stream];\n    const raw = page.streams[stream];\n    const remainder = Buffer.from(old.utf8Remainder, \"base64\");\n    if (\n      remainder.toString(\"base64\") !== old.utf8Remainder ||\n      remainder.length > 3 ||\n      remainder.length > old.byteOffset ||\n      (old.eof && remainder.length !== 0)\n    )\n      throw new Error(\"Raw page has an invalid saved UTF-8 remainder\");\n    if (old.eof && (!raw.eof || raw.bytes.byteLength !== 0))\n      throw new Error(\"Raw page reopened or advanced a completed stream\");\n    if (old.exitCode !== null && page.exit.code !== old.exitCode)\n      throw new Error(\"Raw page rewrote captured terminal evidence\");\n  }\n  if (\n    page.exit.source === \"retained_terminal\" &&\n    (!expected.streams.stdout.eof ||\n      !expected.streams.stderr.eof ||\n      expected.streams.stdout.exitCode !== page.exit.code ||\n      expected.streams.stderr.exitCode !== page.exit.code)\n  )\n    throw new Error(\"Raw page has no matching retained terminal evidence\");\n  const output = project(expected, page.streams, page.exit);\n  if (!isDeepStrictEqual(page.command, output.command))\n    throw new Error(\"Raw page cursor delta or remainder does not match its bytes\");\n  return output;\n}\n","import { createHash, type Hash } from \"node:crypto\";\nimport { constants, type BigIntStats } from \"node:fs\";\nimport {\n  lstat,\n  mkdir,\n  open,\n  readdir,\n  realpath,\n  rmdir,\n  unlink,\n  type FileHandle,\n} from \"node:fs/promises\";\nimport { isAbsolute, join, relative, resolve, sep } from \"node:path\";\nimport type { WorkspaceTreeFingerprint } from \"@opengeni/contracts\";\nimport type { WorkspaceArchiveSpool } from \"./archive-spool\";\nimport {\n  WorkspaceArchiveIntegrityError,\n  workspaceContentManifest,\n  type WorkspaceContentEntry,\n  type WorkspaceContentManifest,\n} from \"./workspace-archive\";\nimport {\n  createHostArchiveTemporaryDirectory,\n  hostArchiveTemporaryBases,\n  removeHostArchiveTemporaryDirectory,\n  sweepOrphanedHostArchiveTemporaryDirectoriesOnce,\n} from \"./host-archive-temporary\";\n\nconst CHUNK_BYTES = 64 * 1024;\n// Filesystem representability, not an archive resource quota. Check component\n// UTF-8 bytes before clearing a destination, not after open/mkdir fails.\nconst HOST_FILENAME_BYTES = 255;\nconst PROJECTION = \"sdk_local_archive_v1\" as const;\nconst READ = constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK;\nconst READ_DIRECTORY = READ | constants.O_DIRECTORY;\nconst CREATE = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW;\n\n/** Matches SDK 0.14.3 resolveSandboxArchiveLimits: absent/null means unlimited;\n * an explicit object fills undefined fields with SDK defaults, null disables a field.\n * chunkBytes controls buffering, never the amount of input accepted. */\nexport type HostWorkspaceArchiveOptions = {\n  chunkBytes?: number;\n  archiveLimits?: {\n    maxInputBytes?: number | null;\n    maxExtractedBytes?: number | null;\n    maxMembers?: number | null;\n  } | null;\n};\n\nfunction invalid(message: string): never {\n  throw new WorkspaceArchiveIntegrityError(\"archive_hydration_failed\", message);\n}\n\nfunction changed(cause?: unknown): never {\n  throw new WorkspaceArchiveIntegrityError(\n    \"workspace_changed_during_capture\",\n    \"host workspace changed during archive observation\",\n    { retryable: true, cause },\n  );\n}\n\nfunction captureError(error: unknown): never {\n  if (error instanceof WorkspaceArchiveIntegrityError) throw error;\n  const code = (error as NodeJS.ErrnoException | null)?.code;\n  if (code === \"ENOENT\" || code === \"ELOOP\" || code === \"ENOTDIR\") return changed(error);\n  // Disk exhaustion, permission failures and other operational errors are not\n  // evidence of a changing tree and must not become a retryable race diagnosis.\n  throw error;\n}\n\nfunction chunkSize(options: HostWorkspaceArchiveOptions): number {\n  const size = options.chunkBytes ?? CHUNK_BYTES;\n  if (!Number.isSafeInteger(size) || size < 1 || size > CHUNK_BYTES) {\n    throw new RangeError(`chunkBytes must be between 1 and ${CHUNK_BYTES}`);\n  }\n  return size;\n}\n\nfunction limitsFor(options: HostWorkspaceArchiveOptions) {\n  if (options.archiveLimits == null) return null;\n  const defaults = {\n    maxInputBytes: 1024 ** 3,\n    maxExtractedBytes: 4 * 1024 ** 3,\n    maxMembers: 100_000,\n  };\n  const limits = { ...defaults, ...options.archiveLimits };\n  for (const key of Object.keys(defaults) as Array<keyof typeof defaults>) {\n    if (limits[key] === undefined) limits[key] = defaults[key];\n    const value = limits[key];\n    if (value != null && (!Number.isSafeInteger(value) || value < 1)) {\n      throw new RangeError(`archiveLimits.${key} must be at least 1`);\n    }\n  }\n  return limits;\n}\n\nfunction checkLimit(actual: number, limit: number | null | undefined, label: string) {\n  if (!Number.isSafeInteger(actual)) invalid(`${label} exceeds the supported integer range`);\n  if (limit != null && actual > limit)\n    invalid(`workspace archive ${label} exceeds configured limit`);\n}\n\nfunction sameEntry(a: BigIntStats, b: BigIntStats) {\n  return a.dev === b.dev && a.ino === b.ino && a.mode === b.mode;\n}\n\nfunction sameVersion(a: BigIntStats, b: BigIntStats) {\n  return sameEntry(a, b) && a.size === b.size && a.mtimeNs === b.mtimeNs && a.ctimeNs === b.ctimeNs;\n}\n\nfunction fdPath(handle: FileHandle, name?: string) {\n  return name === undefined ? `/proc/self/fd/${handle.fd}` : `/proc/self/fd/${handle.fd}/${name}`;\n}\n\n/** Node has no openat API. Linux's descriptor namespace supplies the same pinned\n * parent resolution; O_NOFOLLOW applies to the child, never an untrusted ancestor.\n * Do not replace this with lstat(path) followed by open(path): that races. */\nexport type HostWorkspaceRootIdentity = Readonly<{\n  dev: string;\n  ino: string;\n  uid: string;\n  gid: string;\n  mode: string;\n}>;\n\nfunction rootIdentity(stats: BigIntStats): HostWorkspaceRootIdentity {\n  return Object.freeze({\n    dev: String(stats.dev),\n    ino: String(stats.ino),\n    uid: String(stats.uid),\n    gid: String(stats.gid),\n    mode: String(stats.mode),\n  });\n}\n\nasync function openRoot(\n  root: string,\n  create = false,\n  expected?: HostWorkspaceRootIdentity,\n): Promise<FileHandle> {\n  if (process.platform !== \"linux\")\n    invalid(\"host archive codec requires Linux descriptor-relative filesystem access\");\n  if (!isAbsolute(root)) invalid(\"host workspace root must be absolute\");\n  const absolute = resolve(root);\n  if (create && absolute === sep) invalid(\"cannot restore into the filesystem root\");\n  let current = await open(sep, READ_DIRECTORY);\n  try {\n    for (const segment of absolute.split(sep).filter(Boolean)) {\n      if (create) {\n        await mkdir(fdPath(current, segment), { mode: 0o777 }).catch(\n          (error: NodeJS.ErrnoException) => {\n            if (error.code !== \"EEXIST\") throw error;\n          },\n        );\n      }\n      const next = await open(fdPath(current, segment), READ_DIRECTORY);\n      await current.close();\n      current = next;\n    }\n    if (expected) {\n      const actual = rootIdentity(await current.stat({ bigint: true }));\n      if (\n        Object.keys(actual).some(\n          (key) =>\n            actual[key as keyof HostWorkspaceRootIdentity] !==\n            expected[key as keyof HostWorkspaceRootIdentity],\n        )\n      )\n        invalid(\"owned workspace root identity changed\");\n    }\n    return current;\n  } catch (error) {\n    await current.close();\n    throw error;\n  }\n}\n\n/** Metadata only. Content readers repeat this identity comparison on their\n * opened directory descriptor before inventory or file reads. */\nexport async function readHostWorkspaceRootIdentity(\n  root: string,\n  expected?: HostWorkspaceRootIdentity,\n): Promise<HostWorkspaceRootIdentity> {\n  if (process.platform !== \"linux\") {\n    if (!isAbsolute(root) || resolve(root) !== root || (await realpath(root)) !== root)\n      invalid(\"owned workspace root is not canonical\");\n    const handle = await open(root, READ_DIRECTORY);\n    try {\n      const stats = await handle.stat({ bigint: true });\n      if (!stats.isDirectory()) invalid(\"owned workspace root is not a directory\");\n      const actual = rootIdentity(stats);\n      if (\n        expected &&\n        Object.keys(actual).some(\n          (key) =>\n            actual[key as keyof HostWorkspaceRootIdentity] !==\n            expected[key as keyof HostWorkspaceRootIdentity],\n        )\n      )\n        invalid(\"owned workspace root identity changed\");\n      return actual;\n    } finally {\n      await handle.close();\n    }\n  }\n  const handle = await openRoot(root, false, expected);\n  try {\n    return rootIdentity(await handle.stat({ bigint: true }));\n  } finally {\n    await handle.close();\n  }\n}\n\ntype TreeIndex = {\n  directories: Map<string, BigIntStats>;\n  files: Map<string, BigIntStats>;\n};\n\nconst compare = (a: string, b: string) => (a < b ? -1 : a > b ? 1 : 0);\n\nasync function inventory(\n  root: FileHandle,\n  excludedPaths: readonly string[],\n  signal?: AbortSignal,\n): Promise<TreeIndex> {\n  const tree: TreeIndex = { directories: new Map(), files: new Map() };\n  const walk = async (handle: FileHandle, logical: string) => {\n    const before = await handle.stat({ bigint: true });\n    tree.directories.set(logical, before);\n    const names = await readdir(fdPath(handle));\n    for (const name of names) {\n      signal?.throwIfAborted();\n      const path = logical ? `${logical}/${name}` : name;\n      if (\n        excludedPaths.some(\n          (excluded) => excluded === \"\" || path === excluded || path.startsWith(`${excluded}/`),\n        )\n      )\n        continue;\n      const stats = await lstat(fdPath(handle, name), { bigint: true });\n      if (stats.isDirectory()) {\n        const child = await open(fdPath(handle, name), READ_DIRECTORY);\n        try {\n          if (!sameVersion(stats, await child.stat({ bigint: true }))) changed();\n          await walk(child, path);\n          if (!sameVersion(stats, await lstat(fdPath(handle, name), { bigint: true }))) changed();\n        } finally {\n          await child.close();\n        }\n      } else if (stats.isFile()) {\n        tree.files.set(path, stats);\n      }\n      // Exactly the SDK projection: symlinks, FIFOs, sockets and devices are skipped.\n    }\n    if (!sameVersion(before, await handle.stat({ bigint: true }))) changed();\n  };\n  await walk(root, \"\");\n  return tree;\n}\n\nasync function openDirectory(root: FileHandle, logical: string, tree?: TreeIndex, create = false) {\n  let current = await open(fdPath(root), READ_DIRECTORY & ~constants.O_NOFOLLOW);\n  try {\n    if (tree && !sameVersion(tree.directories.get(\"\")!, await current.stat({ bigint: true })))\n      changed();\n    let path = \"\";\n    for (const segment of logical.split(\"/\").filter(Boolean)) {\n      path = path ? `${path}/${segment}` : segment;\n      if (create) {\n        await mkdir(fdPath(current, segment), { mode: 0o777 }).catch(\n          (error: NodeJS.ErrnoException) => {\n            if (error.code !== \"EEXIST\") throw error;\n          },\n        );\n      }\n      const next = await open(fdPath(current, segment), READ_DIRECTORY);\n      await current.close();\n      current = next;\n      if (tree) {\n        const expected = tree.directories.get(path);\n        if (!expected || !sameVersion(expected, await current.stat({ bigint: true }))) changed();\n      }\n    }\n    return current;\n  } catch (error) {\n    await current.close();\n    throw error;\n  }\n}\n\nfunction parentAndName(path: string): [string, string] {\n  const slash = path.lastIndexOf(\"/\");\n  return slash < 0 ? [\"\", path] : [path.slice(0, slash), path.slice(slash + 1)];\n}\n\nasync function readTreeFile(\n  root: FileHandle,\n  tree: TreeIndex,\n  path: string,\n  consume: (bytes: Buffer) => void | Promise<void>,\n  signal?: AbortSignal,\n) {\n  const [parent, name] = parentAndName(path);\n  const directory = await openDirectory(root, parent, tree);\n  try {\n    const expected = tree.files.get(path)!;\n    const handle = await open(fdPath(directory, name), READ);\n    try {\n      if (!sameVersion(expected, await handle.stat({ bigint: true }))) changed();\n      const size = Number(expected.size);\n      checkLimit(size, null, \"file size\");\n      const buffer = Buffer.allocUnsafe(CHUNK_BYTES);\n      let offset = 0;\n      while (offset < size) {\n        signal?.throwIfAborted();\n        const { bytesRead } = await handle.read(\n          buffer,\n          0,\n          Math.min(buffer.length, size - offset),\n          offset,\n        );\n        if (bytesRead === 0) changed();\n        await consume(buffer.subarray(0, bytesRead));\n        offset += bytesRead;\n      }\n      if (\n        !sameVersion(expected, await handle.stat({ bigint: true })) ||\n        !sameVersion(expected, await lstat(fdPath(directory, name), { bigint: true }))\n      )\n        changed();\n    } finally {\n      await handle.close();\n    }\n  } finally {\n    await directory.close();\n  }\n}\n\nfunction frame(hash: Hash, label: string, value: string) {\n  hash\n    .update(label)\n    .update(\"\\0\")\n    .update(String(Buffer.byteLength(value)))\n    .update(\"\\0\")\n    .update(value)\n    .update(\"\\0\");\n}\n\nfunction projection(directories: readonly string[]) {\n  const hash = createHash(\"sha256\");\n  frame(hash, \"projection\", PROJECTION);\n  for (const path of [...directories].sort(compare)) frame(hash, \"dir\", path);\n  return hash;\n}\n\nfunction fingerprint(\n  hash: Hash,\n  directories: number,\n  files: number,\n  totalFileBytes: number,\n): WorkspaceTreeFingerprint {\n  checkLimit(totalFileBytes, null, \"extracted size\");\n  return {\n    algorithm: \"sha256\",\n    sha256: hash.digest(\"hex\"),\n    entryCount: directories + files,\n    fileCount: files,\n    totalFileBytes,\n    projection: PROJECTION,\n  };\n}\n\nasync function verifyInventory(\n  rootPath: string,\n  root: FileHandle,\n  tree: TreeIndex,\n  signal?: AbortSignal,\n) {\n  const fresh = await openRoot(rootPath);\n  try {\n    if (!sameVersion(tree.directories.get(\"\")!, await fresh.stat({ bigint: true }))) changed();\n  } finally {\n    await fresh.close();\n  }\n  for (const path of tree.directories.keys()) {\n    signal?.throwIfAborted();\n    const handle = await openDirectory(root, path, tree);\n    await handle.close();\n  }\n  for (const [path, expected] of tree.files) {\n    signal?.throwIfAborted();\n    const [parent, name] = parentAndName(path);\n    const handle = await openDirectory(root, parent, tree);\n    try {\n      if (!sameVersion(expected, await lstat(fdPath(handle, name), { bigint: true }))) changed();\n    } finally {\n      await handle.close();\n    }\n  }\n}\n\nasync function hashTree(rootPath: string, root: FileHandle, tree: TreeIndex, signal?: AbortSignal) {\n  const directories = [...tree.directories.keys()].filter(Boolean);\n  const hash = projection(directories);\n  let total = 0;\n  for (const path of [...tree.files.keys()].sort(compare)) {\n    const size = Number(tree.files.get(path)!.size);\n    frame(hash, \"file\", path);\n    frame(hash, \"bytes\", String(size));\n    signal?.throwIfAborted();\n    await readTreeFile(\n      root,\n      tree,\n      path,\n      (bytes) => {\n        hash.update(bytes);\n      },\n      signal,\n    );\n    total += size;\n  }\n  await verifyInventory(rootPath, root, tree, signal);\n  return fingerprint(hash, directories.length, tree.files.size, total);\n}\n\nexport async function fingerprintHostWorkspace(\n  root: string,\n  excludedPaths: readonly string[],\n  expectedRoot?: HostWorkspaceRootIdentity,\n): Promise<WorkspaceTreeFingerprint> {\n  const handle = await openRoot(root, false, expectedRoot);\n  try {\n    return await hashTree(root, handle, await inventory(handle, excludedPaths));\n  } catch (error) {\n    return captureError(error);\n  } finally {\n    await handle.close();\n  }\n}\n\nfunction within(root: string, candidate: string) {\n  const path = relative(root, candidate);\n  return path === \"\" || (!isAbsolute(path) && path !== \"..\" && !path.startsWith(`..${sep}`));\n}\n\nasync function privateTemporaryDirectory(root: string | null) {\n  // Resolve the actual location before creating anything: TMPDIR can itself be a\n  // symlink or live inside the source workspace. Never add spool files to it.\n  const actualRoot = root === null ? null : await realpath(root).catch(() => resolve(root));\n  // Reclaim spools whose owner process stopped mid-capture/upload/restore\n  // before adding another multi-gigabyte one. Never removes a live owner's.\n  await sweepOrphanedHostArchiveTemporaryDirectoriesOnce();\n  for (const candidate of hostArchiveTemporaryBases()) {\n    const base = await realpath(candidate).catch(() => null);\n    if (!base || (actualRoot !== null && within(actualRoot, base)) || within(\"/dev/shm\", base))\n      continue;\n    return await createHostArchiveTemporaryDirectory(base);\n  }\n  invalid(\"no private disk temporary directory exists outside the workspace\");\n}\n\nasync function writeAll(handle: FileHandle, bytes: Uint8Array) {\n  let offset = 0;\n  while (offset < bytes.byteLength) {\n    const { bytesWritten } = await handle.write(bytes, offset, bytes.byteLength - offset);\n    if (!bytesWritten) throw new Error(\"archive spool write made no progress\");\n    offset += bytesWritten;\n  }\n}\n\nclass ArchiveWriter {\n  readonly hash = createHash(\"sha256\");\n  byteSize = 0;\n  constructor(readonly handle: FileHandle) {}\n  async write(input: string | Uint8Array) {\n    const bytes = typeof input === \"string\" ? Buffer.from(input) : input;\n    for (let offset = 0; offset < bytes.length; offset += CHUNK_BYTES) {\n      const chunk = bytes.subarray(offset, offset + CHUNK_BYTES);\n      await writeAll(this.handle, chunk);\n      this.hash.update(chunk);\n      this.byteSize += chunk.length;\n      checkLimit(this.byteSize, null, \"input size\");\n    }\n  }\n}\n\n/** Native base64 conversion remains bounded to a chunk; both binary backing\n * stores are reused. In particular, never Buffer.concat the carry with every\n * source chunk or Buffer.from every encoded string: external-memory GC can lag\n * far behind those allocations even though no individual buffer is large. */\nclass Base64Encoder {\n  private readonly input = Buffer.allocUnsafe(CHUNK_BYTES + 2);\n  private readonly output = Buffer.allocUnsafe(Math.ceil((CHUNK_BYTES + 2) / 3) * 4);\n  private carry = 0;\n  constructor(private readonly writer: ArchiveWriter) {}\n  async write(bytes: Buffer) {\n    bytes.copy(this.input, this.carry);\n    const available = this.carry + bytes.length;\n    const length = available - (available % 3);\n    if (length) await this.encode(length);\n    this.carry = available - length;\n    this.input.copy(this.input, 0, length, available);\n  }\n  private async encode(length: number) {\n    const written = this.output.write(this.input.subarray(0, length).toString(\"base64\"), \"ascii\");\n    await this.writer.write(this.output.subarray(0, written));\n  }\n  async finish() {\n    if (this.carry) await this.encode(this.carry);\n  }\n}\n\nfunction ownedSpool(\n  directory: string,\n  path: string,\n  byteSize: number,\n  sha256: string,\n): WorkspaceArchiveSpool {\n  let disposal: Promise<void> | undefined;\n  return {\n    path,\n    byteSize,\n    sha256,\n    async *open() {\n      if (disposal) throw new Error(\"archive spool has been disposed\");\n      const handle = await open(path, READ);\n      try {\n        const before = await handle.stat({ bigint: true });\n        if (!before.isFile() || Number(before.size) !== byteSize) invalid(\"archive spool changed\");\n        let position = 0;\n        while (position < byteSize) {\n          const buffer = Buffer.allocUnsafe(Math.min(CHUNK_BYTES, byteSize - position));\n          const { bytesRead } = await handle.read(buffer, 0, buffer.length, position);\n          if (!bytesRead) invalid(\"archive spool was truncated\");\n          position += bytesRead;\n          yield buffer.subarray(0, bytesRead);\n        }\n        if (!sameVersion(before, await handle.stat({ bigint: true })))\n          invalid(\"archive spool changed while reading\");\n      } finally {\n        await handle.close();\n      }\n    },\n    dispose() {\n      return (disposal ??= removeHostArchiveTemporaryDirectory(directory));\n    },\n  };\n}\n\n/**\n * An aborted `signal` stops the capture at the next file chunk, removes its\n * temporary spool and rejects with the signal's reason. Every read is local\n * and owned here, so the rejection is the physical end of the capture: callers\n * may treat it as settled.\n */\nexport async function captureHostWorkspaceArchive(\n  root: string,\n  excludedPaths: readonly string[],\n  expectedRoot?: HostWorkspaceRootIdentity,\n  signal?: AbortSignal,\n): Promise<{\n  spool: WorkspaceArchiveSpool;\n  workspace: WorkspaceTreeFingerprint;\n}> {\n  signal?.throwIfAborted();\n  const handle = await openRoot(root, false, expectedRoot);\n  let temporary: string | undefined;\n  let handleClosed = false;\n  try {\n    const tree = await inventory(handle, excludedPaths, signal);\n    const before = await hashTree(root, handle, tree, signal);\n    temporary = await privateTemporaryDirectory(root);\n    const path = join(temporary, \"archive.json\");\n    const file = await open(path, CREATE, 0o600);\n    const writer = new ArchiveWriter(file);\n    const directories = [...tree.directories.keys()].filter(Boolean).sort(compare);\n    const hash = projection(directories);\n    let total = 0;\n    try {\n      await writer.write('{\"version\":1,\"directories\":[');\n      for (let index = 0; index < directories.length; index++) {\n        await writer.write(`${index ? \",\" : \"\"}${JSON.stringify(directories[index])}`);\n      }\n      await writer.write('],\"files\":[');\n      let first = true;\n      for (const logical of [...tree.files.keys()].sort(compare)) {\n        const size = Number(tree.files.get(logical)!.size);\n        frame(hash, \"file\", logical);\n        frame(hash, \"bytes\", String(size));\n        await writer.write(`${first ? \"\" : \",\"}{\"path\":${JSON.stringify(logical)},\"data\":\"`);\n        first = false;\n        const encoder = new Base64Encoder(writer);\n        await readTreeFile(\n          handle,\n          tree,\n          logical,\n          async (bytes) => {\n            hash.update(bytes);\n            await encoder.write(bytes);\n          },\n          signal,\n        );\n        await encoder.finish();\n        await writer.write('\"}');\n        total += size;\n      }\n      await writer.write(\"]}\");\n    } finally {\n      await file.close();\n    }\n    const archived = fingerprint(hash, directories.length, tree.files.size, total);\n    // Prove equivalence of the serialized bytes themselves, not just of the\n    // source chunks passed to the base64 encoder.\n    const encoded = await open(path, READ);\n    const payloadPath = join(temporary, \"capture-payload\");\n    let decoded: WorkspaceTreeFingerprint;\n    try {\n      const payload = await open(\n        payloadPath,\n        constants.O_RDWR | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW,\n        0o600,\n      );\n      try {\n        signal?.throwIfAborted();\n        const index = await indexArchive(encoded, payload, {}, signal);\n        signal?.throwIfAborted();\n        decoded = await fingerprintArchiveIndex(index, payload, signal);\n      } finally {\n        await payload.close();\n      }\n    } finally {\n      await encoded.close();\n    }\n    await unlink(payloadPath);\n    signal?.throwIfAborted();\n    await verifyInventory(root, handle, tree, signal);\n    const after = await hashTree(\n      root,\n      handle,\n      await inventory(handle, excludedPaths, signal),\n      signal,\n    );\n    if (\n      before.sha256 !== archived.sha256 ||\n      after.sha256 !== archived.sha256 ||\n      decoded.sha256 !== archived.sha256\n    )\n      changed();\n    // Close before handing over ownership: a close failure after the transfer\n    // would reject without giving the caller the spool it must dispose.\n    handleClosed = true;\n    await handle.close();\n    const spool = ownedSpool(temporary, path, writer.byteSize, writer.hash.digest(\"hex\"));\n    temporary = undefined;\n    return { spool, workspace: archived };\n  } catch (error) {\n    return captureError(error);\n  } finally {\n    try {\n      if (!handleClosed) await handle.close();\n    } finally {\n      if (temporary) await removeHostArchiveTemporaryDirectory(temporary);\n    }\n  }\n}\n\n/** Byte-oriented JSON lexer. Only metadata strings are accumulated. String\n * payloads are decoded in bounded runs, including JSON escapes and split UTF-8. */\nclass JsonReader {\n  private readonly buffer: Buffer;\n  private cursor = 0;\n  private available = 0;\n  private position = 0;\n  constructor(\n    private readonly handle: FileHandle,\n    size: number,\n    private readonly signal?: AbortSignal,\n  ) {\n    this.buffer = Buffer.allocUnsafe(size);\n  }\n  private async fill() {\n    if (this.cursor < this.available) return true;\n    // Re-reading a multi-gigabyte capture is not instantaneous: stop at the\n    // next chunk like every other capture pass.\n    this.signal?.throwIfAborted();\n    const { bytesRead } = await this.handle.read(this.buffer, 0, this.buffer.length, this.position);\n    this.position += bytesRead;\n    this.cursor = 0;\n    this.available = bytesRead;\n    return bytesRead !== 0;\n  }\n  async peek(): Promise<number> {\n    return (await this.fill()) ? this.buffer[this.cursor]! : -1;\n  }\n  async byte(): Promise<number> {\n    const byte = await this.peek();\n    if (byte === -1) invalid(\"truncated workspace archive JSON\");\n    this.cursor++;\n    return byte;\n  }\n  async whitespace() {\n    while (true) {\n      const byte = await this.peek();\n      if (byte !== 32 && byte !== 9 && byte !== 10 && byte !== 13) return;\n      this.cursor++;\n    }\n  }\n  async expect(character: string) {\n    await this.whitespace();\n    if ((await this.byte()) !== character.charCodeAt(0))\n      invalid(`expected ${character} in workspace archive JSON`);\n  }\n  async string(consume?: Base64Decoder): Promise<string> {\n    await this.expect('\"');\n    const parts: string[] = [];\n    const decoder = consume\n      ? undefined\n      : new TextDecoder(\"utf-8\", { fatal: true, ignoreBOM: true });\n    const emit = async (text: string) => {\n      if (!text) return;\n      if (consume) await consume.write(text);\n      else parts.push(text);\n    };\n    while (await this.fill()) {\n      const start = this.cursor;\n      while (this.cursor < this.available) {\n        const byte = this.buffer[this.cursor]!;\n        if (byte === 34 || byte === 92 || byte < 32) break;\n        this.cursor++;\n      }\n      if (this.cursor > start) {\n        const bytes = this.buffer.subarray(start, this.cursor);\n        // Base64's alphabet is ASCII. Its decoder validates these bytes directly,\n        // so payload runs never become UTF-8/base64 strings or fresh buffers.\n        if (consume) await consume.write(bytes);\n        else await emit(decoder!.decode(bytes, { stream: true }));\n      }\n      if (this.cursor === this.available) continue;\n      if (decoder) await emit(decoder.decode());\n      const special = await this.byte();\n      if (special === 34) return parts.join(\"\");\n      if (special !== 92) invalid(\"unescaped control character in workspace archive JSON\");\n      const escape = String.fromCharCode(await this.byte());\n      if (escape === \"u\") {\n        let digits = \"\";\n        for (let index = 0; index < 4; index++) digits += String.fromCharCode(await this.byte());\n        if (!/^[0-9a-fA-F]{4}$/.test(digits)) invalid(\"invalid JSON Unicode escape\");\n        await emit(String.fromCharCode(Number.parseInt(digits, 16)));\n      } else {\n        const escapes: Record<string, string> = {\n          '\"': '\"',\n          \"\\\\\": \"\\\\\",\n          \"/\": \"/\",\n          b: \"\\b\",\n          f: \"\\f\",\n          n: \"\\n\",\n          r: \"\\r\",\n          t: \"\\t\",\n        };\n        if (!Object.hasOwn(escapes, escape)) invalid(\"invalid JSON escape\");\n        await emit(escapes[escape]!);\n      }\n    }\n    invalid(\"unterminated workspace archive JSON string\");\n  }\n  async array(item: () => Promise<void>) {\n    await this.expect(\"[\");\n    await this.whitespace();\n    if ((await this.peek()) === 93) {\n      await this.byte();\n      return;\n    }\n    while (true) {\n      await item();\n      await this.whitespace();\n      const separator = await this.byte();\n      if (separator === 93) return;\n      if (separator !== 44) invalid(\"invalid workspace archive JSON array\");\n    }\n  }\n  async object(field: (key: string) => Promise<void>) {\n    await this.expect(\"{\");\n    const keys = new Set<string>();\n    await this.whitespace();\n    if ((await this.peek()) === 125) {\n      await this.byte();\n      return keys;\n    }\n    while (true) {\n      const key = await this.string();\n      if (keys.has(key)) invalid(\"duplicate workspace archive JSON property\");\n      keys.add(key);\n      await this.expect(\":\");\n      await field(key);\n      await this.whitespace();\n      const separator = await this.byte();\n      if (separator === 125) return keys;\n      if (separator !== 44) invalid(\"invalid workspace archive JSON object\");\n    }\n  }\n  async version() {\n    await this.whitespace();\n    // Recognize the exact numeric value 1 without accumulating a potentially\n    // archive-sized number token (1, 1.0, 0.1e1, 100e-2, etc.).\n    let digits = 0;\n    let integerDigits = 0;\n    let significant = -1;\n    let valid = true;\n    const isDigit = (byte: number) => byte >= 48 && byte <= 57;\n    const mantissaDigit = (byte: number) => {\n      if (byte !== 48) {\n        if (byte !== 49 || significant !== -1) valid = false;\n        if (significant === -1) significant = digits;\n      }\n      digits++;\n    };\n    if ((await this.peek()) === 45) {\n      valid = false;\n      await this.byte();\n    }\n    const first = await this.byte();\n    if (!isDigit(first)) invalid(\"invalid workspace archive version number\");\n    mantissaDigit(first);\n    integerDigits++;\n    if (first !== 48) {\n      while (isDigit(await this.peek())) {\n        mantissaDigit(await this.byte());\n        integerDigits++;\n      }\n    } else if (isDigit(await this.peek())) invalid(\"invalid leading zero in archive version\");\n    if ((await this.peek()) === 46) {\n      await this.byte();\n      if (!isDigit(await this.peek())) invalid(\"invalid archive version fraction\");\n      while (isDigit(await this.peek())) mantissaDigit(await this.byte());\n    }\n    let exponent = 0;\n    let sign = 1;\n    if ((await this.peek()) === 101 || (await this.peek()) === 69) {\n      await this.byte();\n      if ((await this.peek()) === 45 || (await this.peek()) === 43) {\n        if ((await this.byte()) === 45) sign = -1;\n      }\n      if (!isDigit(await this.peek())) invalid(\"invalid archive version exponent\");\n      while (isDigit(await this.peek())) {\n        // Saturation is arithmetic only: every byte is still read/validated.\n        exponent = Math.min(Number.MAX_SAFE_INTEGER, exponent * 10 + (await this.byte()) - 48);\n      }\n    }\n    if (!valid || significant === -1 || integerDigits - significant - 1 + sign * exponent !== 0)\n      invalid(\"unsupported workspace archive version\");\n  }\n}\n\nclass Base64Decoder {\n  private readonly output = Buffer.allocUnsafe(CHUNK_BYTES);\n  private outputLength = 0;\n  private bits = 0;\n  private digits = 0;\n  /** 1 requires the second '=', 2 forbids any further data. */\n  private padding = 0;\n  byteSize = 0;\n  constructor(private readonly consume: (bytes: Buffer) => Promise<void>) {}\n  private async flush() {\n    if (!this.outputLength) return;\n    await this.consume(this.output.subarray(0, this.outputLength));\n    this.byteSize += this.outputLength;\n    this.outputLength = 0;\n  }\n  async write(input: string | Uint8Array) {\n    for (let index = 0; index < input.length; index++) {\n      const code = typeof input === \"string\" ? input.charCodeAt(index) : input[index]!;\n      if (this.padding === 2) invalid(\"data follows workspace archive base64 padding\");\n      if (this.padding === 1) {\n        if (code !== 61) invalid(\"missing workspace archive base64 padding\");\n        this.padding = 2;\n        continue;\n      }\n      // Any complete quartet emits at most three bytes. Await the sink before\n      // reusing storage; there are no asynchronous operations per input byte.\n      if (this.outputLength > this.output.length - 3) await this.flush();\n      if (code === 61) {\n        if (this.digits === 2) {\n          if (this.bits & 15) invalid(\"noncanonical workspace archive base64 unused bits\");\n          this.output[this.outputLength++] = this.bits >>> 4;\n          this.padding = 1;\n        } else if (this.digits === 3) {\n          if (this.bits & 3) invalid(\"noncanonical workspace archive base64 unused bits\");\n          this.output[this.outputLength++] = this.bits >>> 10;\n          this.output[this.outputLength++] = (this.bits >>> 2) & 255;\n          this.padding = 2;\n        } else invalid(\"invalid workspace archive base64 padding\");\n        this.digits = 0;\n        continue;\n      }\n      const value =\n        code >= 65 && code <= 90\n          ? code - 65\n          : code >= 97 && code <= 122\n            ? code - 71\n            : code >= 48 && code <= 57\n              ? code + 4\n              : code === 43\n                ? 62\n                : code === 47\n                  ? 63\n                  : -1;\n      if (value < 0) invalid(\"invalid workspace archive base64 alphabet\");\n      this.bits = (this.bits << 6) | value;\n      if (++this.digits === 4) {\n        this.output[this.outputLength++] = this.bits >>> 16;\n        this.output[this.outputLength++] = (this.bits >>> 8) & 255;\n        this.output[this.outputLength++] = this.bits & 255;\n        this.bits = 0;\n        this.digits = 0;\n      }\n    }\n  }\n  async finish() {\n    if (this.digits || this.padding === 1) invalid(\"truncated workspace archive base64\");\n    await this.flush();\n  }\n}\n\ntype FileSpan = { path: string; offset: number; byteSize: number };\ntype ArchiveIndex = { directories: string[]; files: FileSpan[] };\n\nasync function fingerprintArchiveIndex(\n  index: ArchiveIndex,\n  payload: FileHandle,\n  signal?: AbortSignal,\n) {\n  const hash = projection(index.directories);\n  let total = 0;\n  const buffer = Buffer.allocUnsafe(CHUNK_BYTES);\n  for (const file of [...index.files].sort((a, b) => compare(a.path, b.path))) {\n    signal?.throwIfAborted();\n    frame(hash, \"file\", file.path);\n    frame(hash, \"bytes\", String(file.byteSize));\n    let copied = 0;\n    while (copied < file.byteSize) {\n      const { bytesRead } = await payload.read(\n        buffer,\n        0,\n        Math.min(buffer.length, file.byteSize - copied),\n        file.offset + copied,\n      );\n      if (!bytesRead) invalid(\"validated workspace payload was truncated\");\n      hash.update(buffer.subarray(0, bytesRead));\n      copied += bytesRead;\n    }\n    total += file.byteSize;\n  }\n  return fingerprint(hash, index.directories.length, index.files.length, total);\n}\n\nfunction validatePath(path: string) {\n  if (\n    !path ||\n    path.includes(\"\\0\") ||\n    Buffer.from(path).toString(\"utf8\") !== path ||\n    path\n      .split(\"/\")\n      .some(\n        (part) =>\n          !part ||\n          part === \".\" ||\n          part === \"..\" ||\n          Buffer.byteLength(part, \"utf8\") > HOST_FILENAME_BYTES,\n      )\n  )\n    invalid(\"unsafe workspace archive path\");\n}\n\nasync function indexArchive(\n  input: FileHandle,\n  payload: FileHandle,\n  options: HostWorkspaceArchiveOptions,\n  signal?: AbortSignal,\n): Promise<ArchiveIndex> {\n  const reader = new JsonReader(input, chunkSize(options), signal);\n  const limits = limitsFor(options);\n  const directories: string[] = [];\n  const files: FileSpan[] = [];\n  let extracted = 0;\n  let members = 0;\n  const member = () => {\n    checkLimit(++members, limits?.maxMembers, \"member count\");\n  };\n  const keys = await reader.object(async (key) => {\n    if (key === \"version\") return await reader.version();\n    if (key === \"directories\") {\n      return await reader.array(async () => {\n        const path = await reader.string();\n        validatePath(path);\n        directories.push(path);\n        member();\n      });\n    }\n    if (key === \"files\") {\n      return await reader.array(async () => {\n        let path: string | undefined;\n        const offset = extracted;\n        const decoder = new Base64Decoder(async (bytes) => {\n          extracted += bytes.length;\n          checkLimit(extracted, limits?.maxExtractedBytes, \"extracted size\");\n          await writeAll(payload, bytes);\n        });\n        const fields = await reader.object(async (field) => {\n          if (field === \"path\") {\n            path = await reader.string();\n            validatePath(path);\n          } else if (field === \"data\") {\n            await reader.string(decoder);\n            await decoder.finish();\n          } else invalid(\"unknown workspace archive file property\");\n        });\n        if (path === undefined || !fields.has(\"data\"))\n          invalid(\"workspace archive file is missing path or data\");\n        files.push({ path, offset, byteSize: decoder.byteSize });\n        member();\n      });\n    }\n    invalid(\"unknown workspace archive property\");\n  });\n  if (!keys.has(\"version\") || !keys.has(\"directories\") || !keys.has(\"files\"))\n    invalid(\"workspace archive is missing required properties\");\n  await reader.whitespace();\n  if ((await reader.peek()) !== -1) invalid(\"trailing data in workspace archive JSON\");\n  const paths = new Map<string, \"file\" | \"directory\">();\n  for (const [path, kind] of [\n    ...directories.map((directory) => [directory, \"directory\"] as const),\n    ...files.map((file) => [file.path, \"file\"] as const),\n  ]) {\n    if (paths.has(path)) invalid(\"duplicate workspace archive path\");\n    paths.set(path, kind);\n  }\n  for (const path of paths.keys()) {\n    let parent = parentAndName(path)[0];\n    while (parent) {\n      if (paths.get(parent) === \"file\") invalid(\"workspace archive file is also an ancestor\");\n      parent = parentAndName(parent)[0];\n    }\n  }\n  return { directories, files };\n}\n\n/** Removes directory entries through pinned parents. unlink never follows a\n * symlink; rmdir never follows a replacement symlink. No recursive rm uses an\n * attacker-controlled pathname. */\nasync function clearDirectory(handle: FileHandle) {\n  for (const name of await readdir(fdPath(handle))) {\n    const path = fdPath(handle, name);\n    const stats = await lstat(path, { bigint: true });\n    if (stats.isDirectory()) {\n      const child = await open(path, READ_DIRECTORY);\n      try {\n        if (!sameEntry(stats, await child.stat({ bigint: true })))\n          invalid(\"restore destination directory changed\");\n        await clearDirectory(child);\n        if (!sameEntry(stats, await lstat(path, { bigint: true })))\n          invalid(\"restore destination directory changed\");\n        await rmdir(path);\n      } finally {\n        await child.close();\n      }\n    } else {\n      await unlink(path);\n    }\n  }\n}\n\nasync function copySpan(payload: FileHandle, output: FileHandle, span: FileSpan) {\n  const buffer = Buffer.allocUnsafe(CHUNK_BYTES);\n  let copied = 0;\n  while (copied < span.byteSize) {\n    const { bytesRead } = await payload.read(\n      buffer,\n      0,\n      Math.min(buffer.length, span.byteSize - copied),\n      span.offset + copied,\n    );\n    if (!bytesRead) invalid(\"validated workspace payload was truncated\");\n    await writeAll(output, buffer.subarray(0, bytesRead));\n    copied += bytesRead;\n  }\n}\n\n/** Copies the untrusted spool once into a private temporary directory outside\n * `avoidRoot`, verifies its exact size and SHA-256, indexes it, and hands the\n * validated index and decoded payload to `use`. */\nasync function withValidatedHostArchive<T>(\n  avoidRoot: string | null,\n  spool: WorkspaceArchiveSpool,\n  options: HostWorkspaceArchiveOptions,\n  use: (archive: ArchiveIndex, payload: FileHandle) => Promise<T>,\n): Promise<T> {\n  // A provider callback can mutate the caller's spool/options objects. The\n  // selected expectation must remain the one supplied before any asynchronous\n  // work, not a replacement advertised while bytes are being produced.\n  const { byteSize: expectedByteSize, sha256: expectedSha256 } = spool;\n  const readChunks = spool.open.bind(spool);\n  const processingChunkBytes = chunkSize(options);\n  const limits = limitsFor(options);\n  checkLimit(expectedByteSize, limits?.maxInputBytes, \"input size\");\n  if (expectedByteSize < 0 || !/^[0-9a-f]{64}$/.test(expectedSha256))\n    invalid(\"invalid workspace archive spool metadata\");\n  const temporary = await privateTemporaryDirectory(avoidRoot);\n  const handles: FileHandle[] = [];\n  try {\n    const input = await open(\n      join(temporary, \"input.json\"),\n      constants.O_RDWR | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW,\n      0o600,\n    );\n    handles.push(input);\n    const writer = new ArchiveWriter(input);\n    // Read the untrusted source exactly once. All later work uses this private\n    // copy, so a changing/reopenable provider cannot switch bytes after validation.\n    for await (const bytes of readChunks()) {\n      if (!(bytes instanceof Uint8Array)) invalid(\"invalid workspace archive stream chunk\");\n      checkLimit(writer.byteSize + bytes.length, limits?.maxInputBytes, \"input size\");\n      if (writer.byteSize + bytes.length > expectedByteSize)\n        invalid(\"workspace archive size mismatch\");\n      await writer.write(bytes);\n    }\n    if (writer.byteSize !== expectedByteSize || writer.hash.digest(\"hex\") !== expectedSha256)\n      invalid(\"workspace archive SHA-256/size mismatch\");\n    const payload = await open(\n      join(temporary, \"payload\"),\n      constants.O_RDWR | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW,\n      0o600,\n    );\n    handles.push(payload);\n    const archive = await indexArchive(input, payload, {\n      chunkBytes: processingChunkBytes,\n      archiveLimits: limits,\n    });\n    return await use(archive, payload);\n  } finally {\n    try {\n      await Promise.all(handles.map((handle) => handle.close()));\n    } finally {\n      await removeHostArchiveTemporaryDirectory(temporary);\n    }\n  }\n}\n\nexport async function restoreHostWorkspaceArchive(\n  root: string,\n  spool: WorkspaceArchiveSpool,\n  options: HostWorkspaceArchiveOptions = {},\n): Promise<void> {\n  await withValidatedHostArchive(root, spool, options, async (archive, payload) => {\n    const handles: FileHandle[] = [];\n    try {\n      await restoreValidatedArchive(root, archive, payload, handles);\n    } finally {\n      await Promise.all(handles.map((handle) => handle.close()));\n    }\n  });\n}\n\nasync function restoreValidatedArchive(\n  root: string,\n  archive: ArchiveIndex,\n  payload: FileHandle,\n  handles: FileHandle[],\n): Promise<void> {\n  // Nothing before this creates, clears or truncates anything under root.\n  const destination = await openRoot(root, true);\n  handles.push(destination);\n  const destinationIdentity = await destination.stat({ bigint: true });\n  await clearDirectory(destination);\n  for (const path of archive.directories) {\n    const directory = await openDirectory(destination, path, undefined, true);\n    await directory.close();\n  }\n  for (const span of archive.files) {\n    const [parent, name] = parentAndName(span.path);\n    const directory = await openDirectory(destination, parent, undefined, true);\n    try {\n      const output = await open(fdPath(directory, name), CREATE, 0o666);\n      try {\n        const identity = await output.stat({ bigint: true });\n        await copySpan(payload, output, span);\n        const freshParent = await openDirectory(destination, parent);\n        try {\n          if (\n            !sameEntry(\n              await directory.stat({ bigint: true }),\n              await freshParent.stat({ bigint: true }),\n            ) ||\n            !sameEntry(identity, await lstat(fdPath(freshParent, name), { bigint: true }))\n          )\n            invalid(\"restore destination file changed\");\n        } finally {\n          await freshParent.close();\n        }\n      } finally {\n        await output.close();\n      }\n    } finally {\n      await directory.close();\n    }\n  }\n  const fresh = await openRoot(root);\n  try {\n    if (!sameEntry(destinationIdentity, await fresh.stat({ bigint: true })))\n      invalid(\"restore destination root changed\");\n  } finally {\n    await fresh.close();\n  }\n}\n\nconst TAR_BLOCK = 512;\n// Largest size a ustar header's 11 octal digits can carry. Portable sandbox\n// tar validators refuse a PAX size override, so a larger member is unportable.\nconst TAR_MAX_MEMBER_BYTES = 0o77777777777;\nconst TAR_DIRECTORY_MODE = 0o755;\nconst TAR_FILE_MODE = 0o644;\n\nfunction tarOctal(header: Buffer, offset: number, width: number, value: number) {\n  header.write(`${value.toString(8).padStart(width - 1, \"0\")}\\0`, offset, width, \"ascii\");\n}\n\nfunction tarHeader(name: string, type: \"0\" | \"5\" | \"x\", size: number, mode: number, mtime: number) {\n  const header = Buffer.alloc(TAR_BLOCK);\n  header.write(name, 0, 100, \"utf8\");\n  tarOctal(header, 100, 8, mode);\n  tarOctal(header, 108, 8, 0);\n  tarOctal(header, 116, 8, 0);\n  tarOctal(header, 124, 12, size);\n  tarOctal(header, 136, 12, mtime);\n  header.fill(0x20, 148, 156);\n  header.write(type, 156, 1, \"ascii\");\n  header.write(\"ustar\\0\", 257, 6, \"ascii\");\n  header.write(\"00\", 263, 2, \"ascii\");\n  let checksum = 0;\n  for (const byte of header) checksum += byte;\n  header.write(`${checksum.toString(8).padStart(6, \"0\")}\\0 `, 148, 8, \"ascii\");\n  return header;\n}\n\nfunction paxRecord(key: string, value: string): Buffer {\n  const body = ` ${key}=${value}\\n`;\n  const bodyBytes = Buffer.byteLength(body);\n  // The decimal length prefix counts its own digits.\n  let length = bodyBytes + String(bodyBytes).length;\n  while (bodyBytes + String(length).length !== length) length = bodyBytes + String(length).length;\n  return Buffer.from(`${length}${body}`);\n}\n\nfunction padded(bytes: number) {\n  return Math.ceil(bytes / TAR_BLOCK) * TAR_BLOCK;\n}\n\n/** Header blocks for one member; a name that does not fit ustar's 100 bytes\n * travels in a PAX `path` record, which sandbox tar validators accept. */\nfunction tarMemberHeader(name: string, type: \"0\" | \"5\", size: number, mtime: number): Buffer {\n  const mode = type === \"5\" ? TAR_DIRECTORY_MODE : TAR_FILE_MODE;\n  if (Buffer.byteLength(name) <= 100) return tarHeader(name, type, size, mode, mtime);\n  const record = paxRecord(\"path\", name);\n  const pax = Buffer.alloc(TAR_BLOCK + padded(record.length));\n  tarHeader(\"././@PaxHeader\", \"x\", record.length, 0o644, mtime).copy(pax, 0);\n  record.copy(pax, TAR_BLOCK);\n  return Buffer.concat([pax, tarHeader(\"././@LongName\", type, size, mode, mtime)]);\n}\n\nfunction excludedBy(path: string, excluded: readonly string[]) {\n  return excluded.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));\n}\n\nexport type PortableWorkspaceTar = {\n  /** A plain ustar/PAX archive of the workspace: directories and regular files. */\n  bytes: Uint8Array;\n  /** The archive's own `sdk_local_archive_v1` fingerprint over every member,\n   * comparable with the descriptor captured alongside it. */\n  fingerprint: WorkspaceTreeFingerprint;\n  /** Exactly what extracting `bytes` materializes, for verifying the result. */\n  contents: WorkspaceContentManifest;\n};\n\n/**\n * Converts a host-backed workspace archive (the portable JSON projection that\n * Local/Docker sandboxes capture) into a tar any remote sandbox can hydrate.\n * The spool is validated exactly like a host restore. `excludedPaths` are the\n * destination's ephemeral paths: they are not persisted there, so they are left\n * out of the tar and of `contents`.\n */\nexport async function convertHostWorkspaceArchiveToTar(\n  spool: WorkspaceArchiveSpool,\n  options: HostWorkspaceArchiveOptions & {\n    excludedPaths?: readonly string[];\n    mtimeSeconds?: number;\n  } = {},\n): Promise<PortableWorkspaceTar> {\n  const excluded = (options.excludedPaths ?? [])\n    .map((path) => path.replace(/^(\\.\\/)+/, \"\").replace(/\\/+$/, \"\"))\n    .filter((path) => path.length > 0);\n  const mtime =\n    options.mtimeSeconds !== undefined && Number.isFinite(options.mtimeSeconds)\n      ? Math.max(0, Math.floor(options.mtimeSeconds))\n      : 0;\n  return await withValidatedHostArchive(null, spool, options, async (archive, payload) => {\n    const archiveFingerprint = await fingerprintArchiveIndex(archive, payload);\n    // Every ancestor is a directory of the restored tree, listed or not.\n    const listed = new Set(archive.directories);\n    const directories = new Set<string>();\n    for (const path of [...archive.directories, ...archive.files.map((file) => file.path)]) {\n      let parent = listed.has(path) ? path : parentAndName(path)[0];\n      while (parent) {\n        if (!excludedBy(parent, excluded)) directories.add(parent);\n        parent = parentAndName(parent)[0];\n      }\n    }\n    const files = archive.files.filter((file) => !excludedBy(file.path, excluded));\n    const orderedDirectories = [...directories].sort((left, right) =>\n      Buffer.compare(Buffer.from(left), Buffer.from(right)),\n    );\n    const headers = new Map<string, Buffer>();\n    let total = 2 * TAR_BLOCK;\n    for (const directory of orderedDirectories) {\n      const header = tarMemberHeader(`${directory}/`, \"5\", 0, mtime);\n      headers.set(`d:${directory}`, header);\n      total += header.length;\n    }\n    for (const file of files) {\n      if (file.byteSize > TAR_MAX_MEMBER_BYTES)\n        invalid(\"workspace archive file is too large for a portable tar\");\n      const header = tarMemberHeader(file.path, \"0\", file.byteSize, mtime);\n      headers.set(`f:${file.path}`, header);\n      total += header.length + padded(file.byteSize);\n    }\n    checkLimit(total, Number.MAX_SAFE_INTEGER, \"portable tar size\");\n    const tar = Buffer.alloc(total);\n    const entries: WorkspaceContentEntry[] = [];\n    let offset = 0;\n    for (const directory of orderedDirectories) {\n      offset += headers.get(`d:${directory}`)!.copy(tar, offset);\n      entries.push({ kind: \"directory\", path: directory });\n    }\n    for (const file of files) {\n      offset += headers.get(`f:${file.path}`)!.copy(tar, offset);\n      const hash = createHash(\"sha256\");\n      let copied = 0;\n      while (copied < file.byteSize) {\n        const { bytesRead } = await payload.read(\n          tar,\n          offset + copied,\n          Math.min(CHUNK_BYTES, file.byteSize - copied),\n          file.offset + copied,\n        );\n        if (!bytesRead) invalid(\"validated workspace payload was truncated\");\n        hash.update(tar.subarray(offset + copied, offset + copied + bytesRead));\n        copied += bytesRead;\n      }\n      offset += padded(file.byteSize);\n      entries.push({\n        kind: \"file\",\n        path: file.path,\n        sha256: hash.digest(\"hex\"),\n        byteSize: file.byteSize,\n      });\n    }\n    return {\n      bytes: new Uint8Array(tar.buffer, tar.byteOffset, tar.byteLength),\n      fingerprint: archiveFingerprint,\n      contents: workspaceContentManifest(entries),\n    };\n  });\n}\n","import { createHash } from \"node:crypto\";\nimport { constants } from \"node:fs\";\nimport { lstat, open, readdir } from \"node:fs/promises\";\nimport { isAbsolute, join } from \"node:path\";\nimport {\n  WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION,\n  decodeNativeSnapshotRef,\n  parseWorkspaceArchiveDescriptor,\n  parseWorkspaceArchiveObjectRef,\n  type NativeSnapshotDescriptor,\n  type NativeSnapshotRef,\n  type TarWorkspaceArchiveDescriptor,\n  type WorkspaceArchiveDescriptor,\n  type WorkspaceTreeFingerprint,\n} from \"@opengeni/contracts\";\nimport { withSandboxProviderCapture } from \"./provider-operation-gate\";\nimport type { VerifiedHostWorkspaceArchive } from \"./archive-spool\";\nimport {\n  captureHostWorkspaceArchive,\n  fingerprintHostWorkspace,\n  type HostWorkspaceRootIdentity,\n} from \"./host-archive-spool\";\n\nexport {\n  WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION,\n  decodeNativeSnapshotRef,\n  encodeNativeSnapshotRef,\n  parseWorkspaceArchiveDescriptor,\n  type NativeSnapshotDescriptor,\n  type NativeSnapshotProvider,\n  type NativeSnapshotRef,\n  type TarWorkspaceArchiveDescriptor,\n  type WorkspaceArchiveDescriptor,\n  type WorkspaceTreeFingerprint,\n} from \"@opengeni/contracts\";\n\nexport type VerifiedWorkspaceArchive = {\n  bytes: Uint8Array;\n  base64: string;\n  descriptor: WorkspaceArchiveDescriptor;\n  kind: \"tar\" | \"provider_snapshot\";\n  nativeSnapshot?: NativeSnapshotRef;\n};\n\nexport type VerifiedWorkspaceArchivePayload =\n  | VerifiedWorkspaceArchive\n  | VerifiedHostWorkspaceArchive;\n\n/** Host-backed portable archives can go directly to object storage without an\n * intermediate whole-document string or buffer. Existing inline/provider APIs\n * retain their compatibility path when disk-backed publication is unavailable. */\nexport async function captureWorkspaceArchiveForStorage(\n  session: unknown,\n  capturedAtMs: number,\n  options: WorkspaceArchiveCaptureOptions,\n  objectStorageAvailable: boolean,\n): Promise<VerifiedWorkspaceArchivePayload> {\n  const target = session as WorkspaceSession;\n  await target.assertWorkspaceCaptureAuthority?.();\n  const root = hostBackedWorkspaceRoot(target);\n  if (\n    process.platform !== \"linux\" ||\n    !root ||\n    !objectStorageAvailable ||\n    options.strategy === \"portable_tar\"\n  ) {\n    return await captureVerifiedWorkspaceArchive(session, capturedAtMs, options);\n  }\n  return await withSandboxProviderCapture(\n    session,\n    async () => {\n      const { spool, workspace } = await captureHostWorkspaceArchive(\n        root,\n        workspaceFingerprintExcludes(target),\n        target.workspaceCaptureRootIdentity,\n        options.signal,\n      );\n      return {\n        kind: \"host_spool\" as const,\n        spool,\n        descriptor: {\n          version: 1 as const,\n          revision: `wa1:${String(capturedAtMs).padStart(13, \"0\")}:${spool.sha256}`,\n          archiveSha256: spool.sha256,\n          archiveBytes: spool.byteSize,\n          capturedAt: new Date(capturedAtMs).toISOString(),\n          workspace,\n        },\n      };\n    },\n    options.signal,\n  );\n}\n\nexport async function disposeWorkspaceArchive(\n  archive: VerifiedWorkspaceArchivePayload | undefined,\n): Promise<void> {\n  if (archive?.kind === \"host_spool\") await archive.spool.dispose();\n}\n\nexport type WorkspaceArchiveIntegrityCode =\n  | \"archive_metadata_missing\"\n  | \"archive_metadata_invalid\"\n  | \"archive_base64_invalid\"\n  | \"archive_hash_mismatch\"\n  | \"archive_hydration_failed\"\n  /** The referenced archive object does not exist (deleted, wrong bucket or\n   * account). Never proof that the checkpoint content is corrupt. */\n  | \"archive_object_missing\"\n  /** This process has no archive object storage configured. */\n  | \"archive_storage_unavailable\"\n  | \"workspace_fingerprint_unavailable\"\n  | \"workspace_changed_during_capture\"\n  | \"workspace_fingerprint_mismatch\"\n  | \"native_snapshot_reference_invalid\"\n  | \"native_snapshot_fallback_unverified\";\n\nexport class WorkspaceArchiveIntegrityError extends Error {\n  readonly name = \"WorkspaceArchiveIntegrityError\";\n  readonly retryable: boolean;\n\n  constructor(\n    public readonly code: WorkspaceArchiveIntegrityCode,\n    message: string,\n    options: { retryable?: boolean; cause?: unknown } = {},\n  ) {\n    super(message, options.cause === undefined ? undefined : { cause: options.cause });\n    this.retryable = options.retryable ?? false;\n  }\n}\n\ntype WorkspaceSession = {\n  /** Present only on the reaper's restricted Docker capture attachment. */\n  assertWorkspaceCaptureAuthority?: () => Promise<void>;\n  workspaceCaptureRootIdentity?: HostWorkspaceRootIdentity;\n  exec?: (args: {\n    cmd: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n  }) => Promise<unknown>;\n  execCommand?: (args: {\n    cmd: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n  }) => Promise<unknown>;\n  persistWorkspace?: (options?: WorkspaceArchiveCaptureOptions) => Promise<Uint8Array | undefined>;\n  /** Agents Extensions remote sessions expose this protected-at-type-level\n   * primitive on the concrete JS instance. Opengeni uses it only through an\n   * explicit provider policy to bypass replacing/unledgered native capture. */\n  persistWorkspaceTar?: () => Promise<Uint8Array | undefined>;\n  state?: {\n    workspacePersistence?: unknown;\n    workspaceRootPath?: unknown;\n    manifest?: {\n      root?: unknown;\n      ephemeralPersistencePaths?: () => Set<unknown>;\n    };\n  };\n};\n\ntype SdkLocalArchiveFile = { path: string; content: Uint8Array };\n\n/**\n * Durable correlation identity for one logical provider capture. A provider\n * adapter may place it on its wire request, but callers must not infer replay\n * idempotency unless that provider contract explicitly guarantees it.\n */\nexport type WorkspaceArchiveCaptureOptions = {\n  requestId: string;\n  strategy?: \"configured\" | \"portable_tar\";\n  /**\n   * Abandons the capture while it still waits for the provider operation gate,\n   * and stops a host-backed spool capture mid-read. A provider-native persist\n   * call that already started is not interrupted: its own settlement remains\n   * authoritative.\n   */\n  signal?: AbortSignal;\n};\n\nfunction sha256(bytes: Uint8Array): string {\n  return createHash(\"sha256\").update(bytes).digest(\"hex\");\n}\n\nfunction decodeBase64Strict(value: string): Uint8Array | null {\n  if (value.length === 0 || value.length % 4 !== 0 || !/^[A-Za-z0-9+/]+={0,2}$/.test(value)) {\n    return null;\n  }\n  const bytes = Uint8Array.from(Buffer.from(value, \"base64\"));\n  return Buffer.from(bytes).toString(\"base64\") === value ? bytes : null;\n}\n\nexport function describeNativeSnapshotArchive(\n  bytes: Uint8Array,\n  capturedAtMs = Date.now(),\n): NativeSnapshotDescriptor | null {\n  const native = decodeNativeSnapshotRef(bytes);\n  if (!native) return null;\n  const archiveSha256 = sha256(bytes);\n  return {\n    version: WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION,\n    kind: \"provider_snapshot\",\n    revision: `wa2:${String(capturedAtMs).padStart(13, \"0\")}:${archiveSha256}`,\n    archiveSha256,\n    archiveBytes: bytes.length,\n    capturedAt: new Date(capturedAtMs).toISOString(),\n    provider: native.provider,\n    snapshotId: native.snapshotId,\n    ...(native.workspacePersistence ? { workspacePersistence: native.workspacePersistence } : {}),\n  };\n}\n\nexport function describeLegacyNativeSnapshotArchive(\n  base64: unknown,\n  observedAtMs = Date.now(),\n): { archiveBase64: string; descriptor: NativeSnapshotDescriptor } | null {\n  if (typeof base64 !== \"string\") return null;\n  const bytes = decodeBase64Strict(base64);\n  if (!bytes) return null;\n  const descriptor = describeNativeSnapshotArchive(bytes, observedAtMs);\n  return descriptor ? { archiveBase64: base64, descriptor } : null;\n}\n\nexport function readVerifiedWorkspaceArchive(\n  base64: unknown,\n  metadata: unknown,\n): VerifiedWorkspaceArchive | null {\n  if (base64 === undefined || base64 === null || base64 === \"\") return null;\n  if (typeof base64 !== \"string\") {\n    throw new WorkspaceArchiveIntegrityError(\n      \"archive_base64_invalid\",\n      \"selected workspace archive is not a base64 string\",\n    );\n  }\n  if (metadata === undefined || metadata === null) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"archive_metadata_missing\",\n      \"selected workspace archive has no durable revision/fingerprint metadata\",\n    );\n  }\n  const descriptor = parseWorkspaceArchiveDescriptor(metadata);\n  if (!descriptor) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"archive_metadata_invalid\",\n      \"selected workspace archive metadata is invalid\",\n    );\n  }\n  const bytes = decodeBase64Strict(base64);\n  if (!bytes) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"archive_base64_invalid\",\n      `workspace archive revision ${descriptor.revision} has invalid base64 bytes`,\n    );\n  }\n  const actualHash = sha256(bytes);\n  if (bytes.length !== descriptor.archiveBytes || actualHash !== descriptor.archiveSha256) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"archive_hash_mismatch\",\n      `workspace archive revision ${descriptor.revision} failed SHA-256/size verification`,\n    );\n  }\n  const nativeSnapshot = decodeNativeSnapshotRef(bytes);\n  if (descriptor.version === WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION) {\n    if (\n      !nativeSnapshot ||\n      nativeSnapshot.provider !== descriptor.provider ||\n      nativeSnapshot.snapshotId !== descriptor.snapshotId ||\n      nativeSnapshot.workspacePersistence !== descriptor.workspacePersistence\n    ) {\n      throw new WorkspaceArchiveIntegrityError(\n        \"native_snapshot_reference_invalid\",\n        `native snapshot receipt does not match descriptor revision ${descriptor.revision}`,\n      );\n    }\n  } else if (nativeSnapshot) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"native_snapshot_reference_invalid\",\n      `legacy native snapshot receipt ${descriptor.revision} was not durably upgraded to a v2 provider descriptor`,\n    );\n  }\n  return {\n    bytes,\n    base64,\n    descriptor,\n    kind: descriptor.version === WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION ? \"provider_snapshot\" : \"tar\",\n    ...(descriptor.version === WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION && nativeSnapshot\n      ? { nativeSnapshot }\n      : {}),\n  };\n}\n\n/** Fetch object-storage tar bytes into the in-memory restore envelope. Legacy\n * inline base64 is left unchanged. Both payloads must agree when both exist. */\nexport async function inlineWorkspaceArchiveForRestore(\n  sessionState: Record<string, unknown>,\n  getObjectBytes: (key: string) => Promise<{ bytes: Uint8Array } | null>,\n): Promise<Record<string, unknown>> {\n  const ref = parseWorkspaceArchiveObjectRef(sessionState.workspaceArchiveRef);\n  if (!ref) return sessionState;\n  const object = await getObjectBytes(ref.key);\n  if (!object) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"archive_object_missing\",\n      `workspace archive object ${ref.key} is missing`,\n    );\n  }\n  const actualHash = sha256(object.bytes);\n  if (object.bytes.length !== ref.bytes || actualHash !== ref.sha256) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"archive_hash_mismatch\",\n      `workspace archive object ${ref.key} failed SHA-256/size verification`,\n    );\n  }\n  const base64 = Buffer.from(object.bytes).toString(\"base64\");\n  const inline = sessionState.workspaceArchive;\n  if (typeof inline === \"string\" && inline.length > 0 && inline !== base64) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"archive_hash_mismatch\",\n      \"inline workspace archive and object-storage ref disagree\",\n    );\n  }\n  readVerifiedWorkspaceArchive(base64, sessionState.workspaceArchiveMeta);\n  return { ...sessionState, workspaceArchive: base64 };\n}\n\nfunction stdoutFromExecResult(value: unknown): string {\n  if (typeof value === \"string\") {\n    const delimiter = /\\r?\\nOutput:\\r?\\n/u.exec(value);\n    return delimiter ? value.slice(delimiter.index + delimiter[0].length) : value;\n  }\n  if (!value || typeof value !== \"object\") return \"\";\n  const output = value as { stdout?: unknown; output?: unknown };\n  return typeof output.stdout === \"string\"\n    ? output.stdout\n    : typeof output.output === \"string\"\n      ? output.output\n      : \"\";\n}\n\nfunction execFailureDiagnostic(value: unknown): string {\n  if (!value || typeof value !== \"object\") return \"result=unstructured\";\n  const result = value as {\n    exitCode?: unknown;\n    status?: unknown;\n    stderr?: unknown;\n  };\n  const status =\n    typeof result.exitCode === \"number\"\n      ? `exitCode=${result.exitCode}`\n      : typeof result.status === \"number\"\n        ? `status=${result.status}`\n        : \"exitCode=unknown\";\n  const stderr =\n    typeof result.stderr === \"string\"\n      ? result.stderr.replace(/\\s+/g, \" \").trim().slice(0, 240)\n      : \"\";\n  return stderr.length > 0 ? `${status}, stderr=${stderr}` : status;\n}\n\nfunction isTransientRootDirectoryFingerprintRace(value: unknown): boolean {\n  if (!value || typeof value !== \"object\") return false;\n  const result = value as {\n    exitCode?: unknown;\n    status?: unknown;\n    stderr?: unknown;\n  };\n  const exitCode =\n    typeof result.exitCode === \"number\"\n      ? result.exitCode\n      : typeof result.status === \"number\"\n        ? result.status\n        : null;\n  if (exitCode !== 1 || typeof result.stderr !== \"string\") return false;\n  return result.stderr\n    .split(/\\r?\\n/)\n    .map((line) => line.trim())\n    .some((line) => line === \"tar: .: file changed as we read it\");\n}\n\nfunction shellQuote(value: string): string {\n  return `'${value.replaceAll(\"'\", `'\"'\"'`)}'`;\n}\n\nfunction workspaceFingerprintExcludes(session: WorkspaceSession): string[] {\n  return [...(session.state?.manifest?.ephemeralPersistencePaths?.() ?? [])]\n    .filter((path): path is string => typeof path === \"string\" && path.length > 0)\n    .sort((left, right) => left.localeCompare(right));\n}\n\n/** Workspace-relative paths a session never persists (its manifest's\n * ephemeral paths). Archives and fingerprints leave them out. */\nexport function workspaceArchiveExcludedPaths(session: unknown): string[] {\n  return workspaceFingerprintExcludes(session as WorkspaceSession);\n}\n\nfunction findPruneExpression(excludedPaths: readonly string[]): string {\n  const findExcludes = excludedPaths.flatMap((path) => [\n    `-path ${shellQuote(`./${path}`)}`,\n    `-path ${shellQuote(`./${path}/*`)}`,\n  ]);\n  return findExcludes.length === 0 ? \"\" : `\\\\( ${findExcludes.join(\" -o \")} \\\\) -prune -o `;\n}\n\nfunction workspaceFingerprintCommand(excludedPaths: readonly string[]): string {\n  const tarExcludes = excludedPaths.flatMap((path) => [\n    shellQuote(`--exclude=${path}`),\n    shellQuote(`--exclude=./${path}`),\n  ]);\n  const findPrefix = findPruneExpression(excludedPaths);\n  const script = String.raw`set -eu\ncd /workspace\ndigest=$(LC_ALL=C tar ${tarExcludes.join(\" \")} --sort=name --mtime=\"@0\" --owner=0 --group=0 --numeric-owner --hard-dereference --format=gnu -cf - . | sha256sum | awk \"{print \\$1}\")\nentries=$(find . -xdev -mindepth 1 ${findPrefix}! \\( -type s -o -type p -o -type b -o -type c \\) -printf x | wc -c | tr -d \" \")\nfiles=$(find . -xdev ${findPrefix}-type f -printf x | wc -c | tr -d \" \")\nbytes=$(find . -xdev ${findPrefix}-type f -printf \"%s\\n\" | awk \"{s+=\\$1} END {printf \\\"%.0f\\\", s+0}\")\nprintf \"OPENGENI_WORKSPACE_FINGERPRINT_V1 %s %s %s %s\\n\" \"$digest\" \"$entries\" \"$files\" \"$bytes\"`;\n  return `bash -o pipefail -c ${shellQuote(script)}`;\n}\n\nconst SDK_LOCAL_ARCHIVE_PROJECTION = \"sdk_local_archive_v1\" as const;\nconst HOST_FINGERPRINT_READ_FLAGS = constants.O_RDONLY | constants.O_NOFOLLOW;\n\nfunction hostBackedWorkspaceRoot(session: WorkspaceSession): string | null {\n  const root = session.state?.workspaceRootPath;\n  return typeof root === \"string\" && isAbsolute(root) ? root : null;\n}\n\nfunction appendFingerprintFrame(\n  hash: ReturnType<typeof createHash>,\n  label: string,\n  value: string,\n): void {\n  hash.update(label);\n  hash.update(\"\\0\");\n  hash.update(String(Buffer.byteLength(value)));\n  hash.update(\"\\0\");\n  hash.update(value);\n  hash.update(\"\\0\");\n}\n\nfunction stableLogicalPathCompare(left: string, right: string): number {\n  return left < right ? -1 : left > right ? 1 : 0;\n}\n\nfunction fingerprintSdkLocalProjection(\n  directoryInput: readonly string[],\n  fileInput: readonly SdkLocalArchiveFile[],\n): WorkspaceTreeFingerprint {\n  const directories = [...directoryInput].sort(stableLogicalPathCompare);\n  const files = [...fileInput].sort((left, right) =>\n    stableLogicalPathCompare(left.path, right.path),\n  );\n  const paths = new Set<string>();\n  const hash = createHash(\"sha256\");\n  appendFingerprintFrame(hash, \"projection\", SDK_LOCAL_ARCHIVE_PROJECTION);\n  for (const directory of directories) {\n    if (paths.has(directory)) {\n      throw new WorkspaceArchiveIntegrityError(\n        \"workspace_fingerprint_unavailable\",\n        \"host-backed sandbox archive contains a duplicate logical path\",\n        { retryable: true },\n      );\n    }\n    paths.add(directory);\n    appendFingerprintFrame(hash, \"dir\", directory);\n  }\n  let totalFileBytes = 0;\n  for (const file of files) {\n    if (paths.has(file.path)) {\n      throw new WorkspaceArchiveIntegrityError(\n        \"workspace_fingerprint_unavailable\",\n        \"host-backed sandbox archive contains a duplicate logical path\",\n        { retryable: true },\n      );\n    }\n    paths.add(file.path);\n    totalFileBytes += file.content.byteLength;\n    if (!Number.isSafeInteger(totalFileBytes)) {\n      throw new WorkspaceArchiveIntegrityError(\n        \"workspace_fingerprint_unavailable\",\n        \"host-backed sandbox workspace exceeds the supported fingerprint byte range\",\n      );\n    }\n    appendFingerprintFrame(hash, \"file\", file.path);\n    appendFingerprintFrame(hash, \"bytes\", String(file.content.byteLength));\n    hash.update(file.content);\n  }\n  return {\n    algorithm: \"sha256\",\n    sha256: hash.digest(\"hex\"),\n    entryCount: directories.length + files.length,\n    fileCount: files.length,\n    totalFileBytes,\n    projection: SDK_LOCAL_ARCHIVE_PROJECTION,\n  };\n}\n\nfunction sdkArchivePath(value: unknown): value is string {\n  return (\n    typeof value === \"string\" &&\n    value.length > 0 &&\n    !value.startsWith(\"/\") &&\n    !value.includes(\"\\0\") &&\n    value.split(\"/\").every((segment) => segment.length > 0 && segment !== \".\" && segment !== \"..\")\n  );\n}\n\nfunction decodeSdkArchiveFile(value: unknown): Uint8Array | null {\n  if (value === \"\") return new Uint8Array();\n  return typeof value === \"string\" ? decodeBase64Strict(value) : null;\n}\n\n/** Parse only the portable JSON shape emitted by Agents SDK Local/Docker\n * persistWorkspace(). This lets capture prove that the bytes themselves—not\n * merely two live-directory observations—contain the exact fenced projection. */\nfunction fingerprintSdkLocalArchive(bytes: Uint8Array): WorkspaceTreeFingerprint {\n  let decoded: unknown;\n  try {\n    decoded = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes));\n  } catch {\n    throw new WorkspaceArchiveIntegrityError(\n      \"workspace_fingerprint_unavailable\",\n      \"host-backed sandbox persistence returned an invalid SDK archive\",\n      { retryable: true },\n    );\n  }\n  if (!decoded || typeof decoded !== \"object\" || Array.isArray(decoded)) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"workspace_fingerprint_unavailable\",\n      \"host-backed sandbox persistence returned an invalid SDK archive\",\n      { retryable: true },\n    );\n  }\n  const archive = decoded as {\n    version?: unknown;\n    directories?: unknown;\n    files?: unknown;\n  };\n  if (\n    archive.version !== 1 ||\n    !Array.isArray(archive.directories) ||\n    !archive.directories.every(sdkArchivePath) ||\n    !Array.isArray(archive.files)\n  ) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"workspace_fingerprint_unavailable\",\n      \"host-backed sandbox persistence returned an invalid SDK archive\",\n      { retryable: true },\n    );\n  }\n  const files: SdkLocalArchiveFile[] = [];\n  for (const candidate of archive.files) {\n    if (!candidate || typeof candidate !== \"object\" || Array.isArray(candidate)) {\n      throw new WorkspaceArchiveIntegrityError(\n        \"workspace_fingerprint_unavailable\",\n        \"host-backed sandbox persistence returned an invalid SDK archive\",\n        { retryable: true },\n      );\n    }\n    const file = candidate as { path?: unknown; data?: unknown };\n    const content = decodeSdkArchiveFile(file.data);\n    if (!sdkArchivePath(file.path) || !content) {\n      throw new WorkspaceArchiveIntegrityError(\n        \"workspace_fingerprint_unavailable\",\n        \"host-backed sandbox persistence returned an invalid SDK archive\",\n        { retryable: true },\n      );\n    }\n    files.push({ path: file.path, content });\n  }\n  return fingerprintSdkLocalProjection(archive.directories, files);\n}\n\nfunction sameFilesystemEntry(\n  left: Awaited<ReturnType<typeof lstat>>,\n  right: Awaited<ReturnType<typeof lstat>>,\n): boolean {\n  return left.dev === right.dev && left.ino === right.ino;\n}\n\nfunction hostPathChanged(): WorkspaceArchiveIntegrityError {\n  return new WorkspaceArchiveIntegrityError(\n    \"workspace_fingerprint_unavailable\",\n    \"host-backed sandbox workspace changed while fingerprinting\",\n    { retryable: true },\n  );\n}\n\nasync function readStableHostFile(\n  path: string,\n  expected: Awaited<ReturnType<typeof lstat>>,\n): Promise<Buffer> {\n  const before = await lstat(path).catch(() => {\n    throw hostPathChanged();\n  });\n  if (!before.isFile() || !sameFilesystemEntry(before, expected)) {\n    throw hostPathChanged();\n  }\n  let handle: Awaited<ReturnType<typeof open>>;\n  try {\n    handle = await open(path, HOST_FINGERPRINT_READ_FLAGS);\n  } catch {\n    throw hostPathChanged();\n  }\n  try {\n    const opened = await handle.stat();\n    if (!opened.isFile() || !sameFilesystemEntry(opened, before)) {\n      throw hostPathChanged();\n    }\n    const content = await handle.readFile();\n    const after = await handle.stat();\n    if (\n      !after.isFile() ||\n      !sameFilesystemEntry(after, opened) ||\n      after.size !== opened.size ||\n      after.mtimeMs !== opened.mtimeMs ||\n      after.ctimeMs !== opened.ctimeMs\n    ) {\n      throw hostPathChanged();\n    }\n    return content;\n  } finally {\n    await handle.close();\n  }\n}\n\nfunction shouldSkipHostArchivePath(path: string, excludedPaths: ReadonlySet<string>): boolean {\n  for (const excluded of excludedPaths) {\n    if (excluded === \"\" || path === excluded || path.startsWith(`${excluded}/`)) return true;\n  }\n  return false;\n}\n\n/** Mirrors Agents SDK 0.13.x createWorkspaceArchive(): its Local/Docker\n * persistence is a provider-agnostic JSON archive containing directories and\n * regular files, not an in-container tar stream. Fingerprinting the same host\n * projection removes all image-tool dependencies (including Alpine's lack of\n * bash) and makes the descriptor match what cold restore can actually rebuild. */\nasync function fingerprintHostBackedWorkspace(\n  root: string,\n  excludedPaths: readonly string[],\n): Promise<WorkspaceTreeFingerprint> {\n  const excluded = new Set(excludedPaths);\n  const directories: string[] = [];\n  const files: SdkLocalArchiveFile[] = [];\n\n  const walk = async (\n    currentRoot: string,\n    relativeRoot = \"\",\n    expected?: Awaited<ReturnType<typeof lstat>>,\n  ): Promise<void> => {\n    const before = await lstat(currentRoot).catch(() => {\n      throw hostPathChanged();\n    });\n    if (!before.isDirectory() || (expected && !sameFilesystemEntry(before, expected))) {\n      throw hostPathChanged();\n    }\n    const entries = await readdir(currentRoot, { withFileTypes: true });\n    const afterRead = await lstat(currentRoot).catch(() => {\n      throw hostPathChanged();\n    });\n    if (!afterRead.isDirectory() || !sameFilesystemEntry(afterRead, before)) {\n      throw hostPathChanged();\n    }\n    entries.sort((left, right) => left.name.localeCompare(right.name));\n    for (const entry of entries) {\n      const relativePath = relativeRoot ? `${relativeRoot}/${entry.name}` : entry.name;\n      if (shouldSkipHostArchivePath(relativePath, excluded)) continue;\n      const entryPath = join(currentRoot, entry.name);\n      const stats = await lstat(entryPath).catch(() => {\n        throw hostPathChanged();\n      });\n      if (stats.isDirectory()) {\n        directories.push(relativePath);\n        await walk(entryPath, relativePath, stats);\n        continue;\n      }\n      // This is deliberately identical to the SDK archive projection: symlinks,\n      // sockets, devices and FIFOs are not serialized and therefore must not\n      // influence the restore fingerprint either.\n      if (!stats.isFile()) continue;\n      const content = await readStableHostFile(entryPath, stats);\n      files.push({ path: relativePath, content });\n    }\n    const afterWalk = await lstat(currentRoot).catch(() => {\n      throw hostPathChanged();\n    });\n    if (!afterWalk.isDirectory() || !sameFilesystemEntry(afterWalk, before)) {\n      throw hostPathChanged();\n    }\n  };\n\n  await walk(root);\n  return fingerprintSdkLocalProjection(directories, files);\n}\n\nasync function fingerprintRemoteWorkspace(\n  target: WorkspaceSession,\n): Promise<WorkspaceTreeFingerprint> {\n  const run = target.exec ?? target.execCommand;\n  if (!run) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"workspace_fingerprint_unavailable\",\n      \"sandbox session cannot execute the workspace fingerprint probe\",\n    );\n  }\n  const cmd = workspaceFingerprintCommand(workspaceFingerprintExcludes(target));\n  let result: unknown;\n  let match: RegExpMatchArray | null = null;\n  for (let attempt = 1; attempt <= 3; attempt += 1) {\n    result = await run.call(target, {\n      cmd,\n      yieldTimeMs: 120_000,\n      maxOutputTokens: 1_000,\n    });\n    match = stdoutFromExecResult(result)\n      .trim()\n      .match(/^OPENGENI_WORKSPACE_FINGERPRINT_V1 ([a-f0-9]{64}) ([0-9]+) ([0-9]+) ([0-9]+)$/);\n    if (match || !isTransientRootDirectoryFingerprintRace(result) || attempt === 3) break;\n    await new Promise((resolve) => setTimeout(resolve, attempt * 25));\n  }\n  if (!match) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"workspace_fingerprint_unavailable\",\n      `sandbox workspace fingerprint probe returned no valid digest (${execFailureDiagnostic(result)})`,\n      { retryable: true },\n    );\n  }\n  const entryCount = Number(match[2]);\n  const fileCount = Number(match[3]);\n  const totalFileBytes = Number(match[4]);\n  if (![entryCount, fileCount, totalFileBytes].every(Number.isSafeInteger)) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"workspace_fingerprint_unavailable\",\n      \"sandbox workspace fingerprint counters exceeded the supported range\",\n    );\n  }\n  return {\n    algorithm: \"sha256\",\n    sha256: match[1]!,\n    entryCount,\n    fileCount,\n    totalFileBytes,\n  };\n}\n\n/**\n * A projection-independent description of a workspace tree: every directory by\n * path and every regular file by path and content SHA-256. It verifies an\n * archive restored by a provider whose native fingerprint is not the archive's\n * own (for example a host-backed archive hydrated into a remote sandbox).\n */\nexport type WorkspaceContentManifest = {\n  sha256: string;\n  directoryCount: number;\n  fileCount: number;\n  totalFileBytes: number;\n};\n\nexport type WorkspaceContentEntry =\n  | { kind: \"directory\"; path: string }\n  | { kind: \"file\"; path: string; sha256: string; byteSize: number };\n\n/** Records are `d  <path>` or `<sha256>  <path>` (the `sha256sum` line shape),\n * NUL-terminated and ordered by their bytes, so a remote shell computes the\n * identical digest with find, sha256sum -z and `LC_ALL=C sort -z`. */\nexport function workspaceContentManifest(\n  entries: Iterable<WorkspaceContentEntry>,\n): WorkspaceContentManifest {\n  const records: Buffer[] = [];\n  let directoryCount = 0;\n  let fileCount = 0;\n  let totalFileBytes = 0;\n  for (const entry of entries) {\n    if (entry.kind === \"directory\") {\n      directoryCount += 1;\n      records.push(Buffer.from(`d  ${entry.path}`));\n    } else {\n      fileCount += 1;\n      totalFileBytes += entry.byteSize;\n      records.push(Buffer.from(`${entry.sha256}  ${entry.path}`));\n    }\n  }\n  records.sort(Buffer.compare);\n  const hash = createHash(\"sha256\");\n  for (const record of records) hash.update(record).update(\"\\0\");\n  return { sha256: hash.digest(\"hex\"), directoryCount, fileCount, totalFileBytes };\n}\n\nfunction workspaceRoot(target: WorkspaceSession): string {\n  const root = target.state?.manifest?.root;\n  return typeof root === \"string\" && isAbsolute(root) ? root : \"/workspace\";\n}\n\nfunction workspaceContentManifestCommand(root: string, excludedPaths: readonly string[]): string {\n  const prune = findPruneExpression(excludedPaths);\n  const script = String.raw`set -eu\ncd ${shellQuote(root)}\ndigest=$( { find . -xdev -mindepth 1 ${prune}-type d -printf \"d  %P\\0\"; find . -xdev -mindepth 1 ${prune}-type f -printf \"%P\\0\" | xargs -0 -r sha256sum -z --; } | LC_ALL=C sort -z | sha256sum | awk \"{print \\$1}\")\ndirs=$(find . -xdev -mindepth 1 ${prune}-type d -printf x | wc -c | tr -d \" \")\nfiles=$(find . -xdev -mindepth 1 ${prune}-type f -printf x | wc -c | tr -d \" \")\nbytes=$(find . -xdev -mindepth 1 ${prune}-type f -printf \"%s\\n\" | awk \"{s+=\\$1} END {printf \\\"%.0f\\\", s+0}\")\nprintf \"OPENGENI_WORKSPACE_CONTENTS_V1 %s %s %s %s\\n\" \"$digest\" \"$dirs\" \"$files\" \"$bytes\"`;\n  return `bash -o pipefail -c ${shellQuote(script)}`;\n}\n\n/** Reads the content manifest of a remote session's persistent workspace,\n * excluding its manifest-declared ephemeral paths. */\nexport async function readRemoteWorkspaceContentManifest(\n  session: unknown,\n): Promise<WorkspaceContentManifest> {\n  const target = session as WorkspaceSession;\n  const run = target.exec ?? target.execCommand;\n  if (!run) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"workspace_fingerprint_unavailable\",\n      \"sandbox session cannot execute the workspace content probe\",\n    );\n  }\n  const result = await run.call(target, {\n    cmd: workspaceContentManifestCommand(\n      workspaceRoot(target),\n      workspaceFingerprintExcludes(target),\n    ),\n    yieldTimeMs: 300_000,\n    maxOutputTokens: 1_000,\n  });\n  const match = stdoutFromExecResult(result)\n    .trim()\n    .match(/^OPENGENI_WORKSPACE_CONTENTS_V1 ([a-f0-9]{64}) ([0-9]+) ([0-9]+) ([0-9]+)$/);\n  if (!match) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"workspace_fingerprint_unavailable\",\n      `sandbox workspace content probe returned no valid digest (${execFailureDiagnostic(result)})`,\n      { retryable: true },\n    );\n  }\n  const directoryCount = Number(match[2]);\n  const fileCount = Number(match[3]);\n  const totalFileBytes = Number(match[4]);\n  if (![directoryCount, fileCount, totalFileBytes].every(Number.isSafeInteger)) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"workspace_fingerprint_unavailable\",\n      \"sandbox workspace content counters exceeded the supported range\",\n    );\n  }\n  return { sha256: match[1]!, directoryCount, fileCount, totalFileBytes };\n}\n\n/** Verifies that a remote session's workspace holds exactly `expected`. */\nexport async function verifyRestoredWorkspaceContents(\n  session: unknown,\n  expected: WorkspaceContentManifest,\n  revision: string,\n): Promise<void> {\n  const actual = await readRemoteWorkspaceContentManifest(session);\n  if (\n    actual.sha256 !== expected.sha256 ||\n    actual.directoryCount !== expected.directoryCount ||\n    actual.fileCount !== expected.fileCount ||\n    actual.totalFileBytes !== expected.totalFileBytes\n  ) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"workspace_fingerprint_mismatch\",\n      `restored workspace does not match selected archive revision ${revision}`,\n    );\n  }\n}\n\n/** Fingerprints the provider's exact persistent projection. Local/Docker use\n * the SDK's host-backed portable archive projection; remote tar providers use a\n * deterministic GNU-tar stream. Manifest-declared ephemeral paths are excluded\n * in both cases. Only the aggregate enters logs or durable metadata. */\nexport async function fingerprintSandboxWorkspace(\n  session: unknown,\n): Promise<WorkspaceTreeFingerprint> {\n  const target = session as WorkspaceSession;\n  await target.assertWorkspaceCaptureAuthority?.();\n  const hostRoot = hostBackedWorkspaceRoot(target);\n  return hostRoot\n    ? target.workspaceCaptureRootIdentity && process.platform === \"linux\"\n      ? await fingerprintHostWorkspace(\n          hostRoot,\n          workspaceFingerprintExcludes(target),\n          target.workspaceCaptureRootIdentity,\n        )\n      : await fingerprintHostBackedWorkspace(hostRoot, workspaceFingerprintExcludes(target))\n    : await fingerprintRemoteWorkspace(target);\n}\n\nfunction fingerprintsEqual(a: WorkspaceTreeFingerprint, b: WorkspaceTreeFingerprint): boolean {\n  return (\n    (a.projection ?? \"gnu_tar_v1\") === (b.projection ?? \"gnu_tar_v1\") &&\n    a.sha256 === b.sha256 &&\n    a.entryCount === b.entryCount &&\n    a.fileCount === b.fileCount &&\n    a.totalFileBytes === b.totalFileBytes\n  );\n}\n\n/** Provider-native persistence returns an opaque receipt and is accepted under\n * the provider/artifact publication fence. A real tar capture is accepted only\n * when the complete persistent tree is byte-identical immediately before and\n * after serialization; a concurrent mutation makes that candidate unusable. */\nexport async function captureVerifiedWorkspaceArchive(\n  session: unknown,\n  capturedAtMs = Date.now(),\n  options?: WorkspaceArchiveCaptureOptions,\n): Promise<VerifiedWorkspaceArchive> {\n  return await withSandboxProviderCapture(\n    session,\n    async () => await captureVerifiedWorkspaceArchiveExclusive(session, capturedAtMs, options),\n    options?.signal,\n  );\n}\n\nasync function captureVerifiedWorkspaceArchiveExclusive(\n  session: unknown,\n  capturedAtMs: number,\n  options?: WorkspaceArchiveCaptureOptions,\n): Promise<VerifiedWorkspaceArchive> {\n  const target = session as WorkspaceSession;\n  await target.assertWorkspaceCaptureAuthority?.();\n  const portableTar = options?.strategy === \"portable_tar\";\n  const persist = portableTar ? target.persistWorkspaceTar : target.persistWorkspace;\n  if (typeof persist !== \"function\") {\n    throw new WorkspaceArchiveIntegrityError(\n      \"workspace_fingerprint_unavailable\",\n      portableTar\n        ? \"sandbox provider policy requires portable tar capture but the session exposes no tar primitive\"\n        : \"sandbox session does not support workspace persistence\",\n    );\n  }\n  const configuredPersistence = target.state?.workspacePersistence;\n  const configuredTarFallback = workspaceFingerprintExcludes(target).length > 0;\n  const expectsNativeSnapshot =\n    !portableTar &&\n    typeof configuredPersistence === \"string\" &&\n    configuredPersistence !== \"tar\" &&\n    !configuredTarFallback;\n  const before = expectsNativeSnapshot ? null : await fingerprintSandboxWorkspace(target);\n  const bytes = portableTar\n    ? await target.persistWorkspaceTar!()\n    : await target.persistWorkspace!(options);\n  if (!bytes || bytes.length === 0) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"archive_base64_invalid\",\n      \"sandbox workspace persistence returned an empty archive\",\n      { retryable: true },\n    );\n  }\n  const nativeSnapshot = decodeNativeSnapshotRef(bytes);\n  if (nativeSnapshot) {\n    const descriptor = describeNativeSnapshotArchive(bytes, capturedAtMs)!;\n    return {\n      bytes,\n      base64: Buffer.from(bytes).toString(\"base64\"),\n      descriptor,\n      kind: \"provider_snapshot\",\n      nativeSnapshot,\n    };\n  }\n  if (expectsNativeSnapshot) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"native_snapshot_fallback_unverified\",\n      `sandbox configured for ${String(configuredPersistence)} returned a tar archive instead of a native snapshot receipt`,\n    );\n  }\n  const after = await fingerprintSandboxWorkspace(target);\n  const capturedProjection =\n    before?.projection === SDK_LOCAL_ARCHIVE_PROJECTION ? fingerprintSdkLocalArchive(bytes) : null;\n  if (\n    !before ||\n    !fingerprintsEqual(before, after) ||\n    (capturedProjection !== null && !fingerprintsEqual(before, capturedProjection))\n  ) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"workspace_changed_during_capture\",\n      \"workspace changed while its durable archive was being captured\",\n      { retryable: true },\n    );\n  }\n  const archiveSha256 = sha256(bytes);\n  const descriptor: TarWorkspaceArchiveDescriptor = {\n    version: 1,\n    revision: `wa1:${String(capturedAtMs).padStart(13, \"0\")}:${archiveSha256}`,\n    archiveSha256,\n    archiveBytes: bytes.length,\n    capturedAt: new Date(capturedAtMs).toISOString(),\n    workspace: before,\n  };\n  return {\n    bytes,\n    base64: Buffer.from(bytes).toString(\"base64\"),\n    descriptor,\n    kind: \"tar\",\n  };\n}\n\nexport async function verifyRestoredWorkspace(\n  session: unknown,\n  descriptor: WorkspaceArchiveDescriptor,\n): Promise<WorkspaceTreeFingerprint | null> {\n  if (descriptor.version === WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION) {\n    return null;\n  }\n  const target = session as WorkspaceSession;\n  // Descriptors written before the projection discriminator always used the\n  // in-sandbox GNU-tar probe, even for Local/Docker. Preserve that exact legacy\n  // behavior; new host-backed descriptors remain independent of image tools.\n  const actual =\n    descriptor.workspace.projection === SDK_LOCAL_ARCHIVE_PROJECTION\n      ? await (() => {\n          const root = hostBackedWorkspaceRoot(target);\n          if (!root) {\n            throw new WorkspaceArchiveIntegrityError(\n              \"workspace_fingerprint_unavailable\",\n              \"selected host-backed workspace archive was restored by a non-host-backed provider\",\n            );\n          }\n          return process.platform === \"linux\"\n            ? fingerprintHostWorkspace(root, workspaceFingerprintExcludes(target))\n            : fingerprintHostBackedWorkspace(root, workspaceFingerprintExcludes(target));\n        })()\n      : await fingerprintRemoteWorkspace(target);\n  if (!fingerprintsEqual(actual, descriptor.workspace)) {\n    throw new WorkspaceArchiveIntegrityError(\n      \"workspace_fingerprint_mismatch\",\n      `restored workspace does not match selected archive revision ${descriptor.revision}`,\n    );\n  }\n  return actual;\n}\n","// The provider registry — PROVIDER_REGISTRY maps each SandboxBackend to its\n// ProviderRegistration. This is the data structure createSandboxClient drives\n// (replacing the old flat if/else chain). The module also owns the\n// descriptor.backendId === SDK client.backendId assertion (deferred from P0.1):\n// it must construct the real SDK clients, so it lives here rather than in the\n// contracts-only capabilities self-test.\n\nimport type { Settings } from \"@opengeni/config\";\nimport {\n  LEGACY_SANDBOX_PROVIDER_INSTANCE_ID_FIELDS,\n  SANDBOX_PROVIDER_INSTANCE_ID_FIELDS_BY_BACKEND,\n  SandboxBackend,\n} from \"@opengeni/contracts\";\nimport type { RuntimeMetricsHooks } from \"../../metrics\";\nimport { assertDescriptorRegistryInvariants } from \"../capabilities\";\nimport { blaxelProvider } from \"./blaxel\";\nimport { cloudflareProvider } from \"./cloudflare\";\nimport { computeProvider } from \"./compute\";\nimport { daytonaProvider } from \"./daytona\";\nimport { dockerProvider } from \"./docker\";\nimport { dockerDrainCaptureIsPointInTime } from \"./docker-workspace-drain\";\nimport { e2bProvider } from \"./e2b\";\nimport { localProvider } from \"./local\";\nimport { modalProvider } from \"./modal\";\nimport { noneProvider } from \"./none\";\nimport { opensandboxProvider } from \"./opensandbox\";\nimport { runloopProvider } from \"./runloop\";\nimport { selfhostedProvider } from \"./selfhosted\";\nimport {\n  providerWorkspacePersistence,\n  type ProviderImmutableImageBuildResult,\n  type ProviderRegistration,\n  type ProviderWorkspaceCapturePolicy,\n} from \"./types\";\nimport { vercelProvider } from \"./vercel\";\n\nexport const PROVIDER_REGISTRY: Record<SandboxBackend, ProviderRegistration> = {\n  docker: dockerProvider,\n  modal: modalProvider,\n  local: localProvider,\n  none: noneProvider,\n  daytona: daytonaProvider,\n  runloop: runloopProvider,\n  e2b: e2bProvider,\n  blaxel: blaxelProvider,\n  cloudflare: cloudflareProvider,\n  vercel: vercelProvider,\n  selfhosted: selfhostedProvider,\n  opensandbox: opensandboxProvider,\n  compute: computeProvider,\n};\n\n// Stub settings carrying every per-provider credential, used ONLY by the\n// boot-time backendId assertion to construct each client without tripping\n// validateCredentials. The SDK client constructors are pure option-stores (the\n// underlying provider SDK is required lazily at create()/resume() time, never at\n// construction — verified against the pinned @openai/agents-extensions 0.14.3), so this is\n// safe with no provider peer dep installed and no network.\nconst ASSERTION_STUB_SETTINGS = {\n  dockerImage: \"opengeni-sandbox:local\",\n  modalAppName: \"opengeni-sandbox\",\n  modalTimeoutSeconds: 900,\n  daytonaApiKey: \"stub\",\n  runloopApiKey: \"stub\",\n  runloopTunnel: true,\n  e2bApiKey: \"stub\",\n  blaxelApiKey: \"stub\",\n  cloudflareWorkerUrl: \"https://stub.example.com\",\n  vercelToken: \"stub\",\n  vercelProjectId: \"stub\",\n  openSandboxBaseUrl: \"https://opensandbox.example.test\",\n  openSandboxApiKey: \"stub\",\n  openSandboxImage:\n    \"ghcr.io/cloudgeni-ai/opengeni-sandbox@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\n  computeApiUrl: \"https://compute.example.test\",\n  computeApiKey: \"stub\",\n  computeVcpus: 2,\n  computeMemoryMib: 4096,\n  computeAgentReadyTimeoutMs: 120_000,\n  publicBaseUrl: \"https://opengeni.example.test\",\n  enrollmentSigningSecret: \"stub-enrollment-signing-secret-0123456789\",\n  sandboxSelfhostedEnabled: true,\n  selfhostedNatsUrl: \"nats://nats.example.test:4222\",\n  agentOpStreamEnabled: true,\n} as unknown as Settings;\n\n/**\n * Assert the descriptor table AND that each registered provider's SDK client\n * reports the backendId its descriptor claims. The latter is the\n * deferred-from-P0.1 invariant — it can only run here because it constructs the\n * real clients. Called once at registry build (and from a unit test).\n */\nexport function assertProviderRegistryInvariants(): void {\n  assertDescriptorRegistryInvariants();\n  const knownIdentityFields = new Set<string>(LEGACY_SANDBOX_PROVIDER_INSTANCE_ID_FIELDS);\n  for (const backend of SandboxBackend.options) {\n    const registration = PROVIDER_REGISTRY[backend];\n    if (registration.backend !== backend) {\n      throw new Error(\n        `PROVIDER_REGISTRY[\"${backend}\"].backend mismatch (got \"${registration.backend}\")`,\n      );\n    }\n    if (registration.descriptor.backend !== backend) {\n      throw new Error(\n        `PROVIDER_REGISTRY[\"${backend}\"].descriptor.backend mismatch (got \"${registration.descriptor.backend}\")`,\n      );\n    }\n    const identityFields = [...registration.instanceIdFields];\n    const contractIdentityFields = [...SANDBOX_PROVIDER_INSTANCE_ID_FIELDS_BY_BACKEND[backend]];\n    if (\n      new Set(identityFields).size !== identityFields.length ||\n      identityFields.some((field) => !knownIdentityFields.has(field)) ||\n      identityFields.length !== contractIdentityFields.length ||\n      identityFields.some((field, index) => field !== contractIdentityFields[index])\n    ) {\n      throw new Error(`Provider \"${backend}\" has an invalid live instance identity declaration`);\n    }\n    if (backend === \"none\") {\n      // \"none\" has no SDK client (build returns undefined); the descriptor\n      // backendId \"none\" is self-consistent.\n      if (registration.descriptor.backendId !== \"none\") {\n        throw new Error(\n          `\"none\" descriptor.backendId must be \"none\" (got \"${registration.descriptor.backendId}\")`,\n        );\n      }\n      if (registration.exactResumeMode !== \"none\") {\n        throw new Error('Provider \"none\" must declare exactResumeMode=\"none\"');\n      }\n      continue;\n    }\n    if (registration.exactResumeMode === \"none\") {\n      throw new Error(`Provider \"${backend}\" cannot declare exactResumeMode=\"none\"`);\n    }\n    const client = registration.build({\n      settings: ASSERTION_STUB_SETTINGS,\n      environment: {},\n      exposedPorts: [],\n    });\n    const sdkBackendId = (client as { backendId?: unknown } | undefined)?.backendId;\n    if (typeof sdkBackendId !== \"string\") {\n      throw new Error(`Provider \"${backend}\" SDK client has no string backendId`);\n    }\n    if (sdkBackendId !== registration.descriptor.backendId) {\n      throw new Error(\n        `Provider \"${backend}\" backendId mismatch: descriptor.backendId=\"${registration.descriptor.backendId}\" but SDK client.backendId=\"${sdkBackendId}\"`,\n      );\n    }\n    if (typeof (client as { resume?: unknown }).resume !== \"function\") {\n      throw new Error(`Provider \"${backend}\" SDK client exposes no resume()`);\n    }\n    if (\n      registration.exactResumeMode === \"custom\" &&\n      typeof (client as { resumeExact?: unknown }).resumeExact !== \"function\"\n    ) {\n      throw new Error(`Provider \"${backend}\" requires but exposes no non-replacing resumeExact()`);\n    }\n    if (registration.continuity && registration.exactResumeMode !== \"custom\") {\n      throw new Error(`Provider \"${backend}\" continuity requires custom exact resume`);\n    }\n    const capturePolicy = registration.workspaceCapturePolicy({});\n    if ((backend === \"selfhosted\") !== (capturePolicy === null)) {\n      throw new Error(\n        `Provider \"${backend}\" must explicitly ${\n          backend === \"selfhosted\" ? \"omit\" : \"declare\"\n        } workspace capture`,\n      );\n    }\n    if (capturePolicy?.strategy === \"portable_tar\" && capturePolicy.liveInstance !== \"preserved\") {\n      throw new Error(`Provider \"${backend}\" portable tar capture must preserve its instance`);\n    }\n  }\n}\n\nexport function providerWorkspaceCapturePolicy(\n  backend: string,\n  state: unknown,\n): ProviderWorkspaceCapturePolicy | null {\n  const registration = PROVIDER_REGISTRY[backend as SandboxBackend];\n  return registration?.workspaceCapturePolicy(state) ?? null;\n}\n\n/** True when the provider's workspace capture images the paused box at one\n * instant (Modal native filesystem/directory snapshots), so a command still\n * running cannot tear the captured state across files the way a file-by-file\n * tar read of a running box can. */\nexport function providerWorkspaceCaptureIsPointInTime(backend: string, state: unknown): boolean {\n  if (backend !== \"modal\") return false;\n  const persistence = providerWorkspacePersistence(state);\n  return persistence === \"snapshot_filesystem\" || persistence === \"snapshot_directory\";\n}\n\n/** True when a drain's capture of this lease envelope is a point-in-time image,\n * so it may run around a request whose owner crashed: a Modal native snapshot\n * of the paused box, or a Docker host workspace read after the drain removed\n * the exact container (`stopForCapture`). Warm captures keep using\n * `providerWorkspaceCaptureIsPointInTime`, because they keep the box running. */\nexport function providerDrainCaptureIsPointInTime(backend: string, envelope: unknown): boolean {\n  if (providerWorkspaceCaptureIsPointInTime(backend, envelope)) return true;\n  return backend === \"docker\" && dockerDrainCaptureIsPointInTime(envelope);\n}\n\nexport function prepareProviderForTeardownAfterCapture(backend: string, session: unknown): void {\n  PROVIDER_REGISTRY[backend as SandboxBackend]?.prepareForTeardownAfterCapture?.(session);\n}\n\nexport function providerSupportsImmutableImageBuild(backend: SandboxBackend): boolean {\n  return typeof PROVIDER_REGISTRY[backend].buildImmutableImage === \"function\";\n}\n\nexport async function renewSandboxProviderExpiration(input: {\n  backend: SandboxBackend;\n  settings: Settings;\n  instanceId: string;\n  metrics?: RuntimeMetricsHooks;\n}): Promise<boolean> {\n  const registration = PROVIDER_REGISTRY[input.backend];\n  const renew = registration.renewExpiration;\n  if (!renew) return false;\n  registration.validateCredentials(input.settings);\n  try {\n    await renew({ settings: input.settings, instanceId: input.instanceId });\n    recordProviderRenewalMetric(input.metrics, input.backend, \"completed\");\n    return true;\n  } catch (error) {\n    recordProviderRenewalMetric(input.metrics, input.backend, \"failed\");\n    if (isProviderApiThrottleError(error)) {\n      try {\n        input.metrics?.onSandboxProviderApiThrottle?.({\n          backend: input.backend,\n          operation: \"renew\",\n        });\n      } catch {\n        // Metrics emission must not affect provider lifecycle.\n      }\n    }\n    throw error;\n  }\n}\n\nexport function isProviderApiThrottleError(error: unknown): boolean {\n  if (!error || typeof error !== \"object\") return false;\n  const candidate = error as {\n    status?: unknown;\n    statusCode?: unknown;\n    response?: { status?: unknown };\n  };\n  return (\n    candidate.status === 429 || candidate.statusCode === 429 || candidate.response?.status === 429\n  );\n}\n\nfunction recordProviderRenewalMetric(\n  metrics: RuntimeMetricsHooks | undefined,\n  backend: SandboxBackend,\n  outcome: \"completed\" | \"failed\",\n): void {\n  try {\n    metrics?.onSandboxTtlRenewal?.({ backend, outcome });\n  } catch {\n    // Metrics emission must not affect provider lifecycle.\n  }\n}\n\nexport async function buildImmutableProviderImage(input: {\n  backend: SandboxBackend;\n  settings: Settings;\n  session: unknown;\n  requestId: string;\n  timeoutMs: number;\n}): Promise<ProviderImmutableImageBuildResult | null> {\n  const build = PROVIDER_REGISTRY[input.backend].buildImmutableImage;\n  if (!build) return null;\n  return await build({\n    settings: input.settings,\n    session: input.session,\n    requestId: input.requestId,\n    timeoutMs: input.timeoutMs,\n  });\n}\n\n// Boot-validate the registry once at module load: the descriptor-table self-\n// test PLUS the descriptor.backendId === SDK client.backendId assertion (the\n// deferred-from-P0.1 invariant). The SDK client constructors are pure option-\n// stores (no network, no peer-dep require at construction), so this is a cheap,\n// side-effect-free guard that fails fast on any drift between the static matrix\n// and the installed @openai/agents-extensions.\nassertProviderRegistryInvariants();\n\nexport type {\n  ProviderRegistration,\n  ProviderConstructionContext,\n  ProviderExactResumeMode,\n  ProviderImmutableImageBuildInput,\n  ProviderImmutableImageBuildResult,\n  ProviderExpirationRenewalInput,\n  ProviderWorkspaceCapturePolicy,\n  ProviderWorkspaceCaptureTakeover,\n} from \"./types\";\n","// Capability-descriptor access + boot-time registry invariants (module 03 §2.3).\n//\n// The CapabilityDescriptor type and the CAPABILITY_DESCRIPTORS table-as-data\n// live in @opengeni/contracts (NOT here) so config can read them without an\n// import cycle through runtime (ledger CR8). This module re-exports them for the\n// registry's convenience and owns the boot-time self-test that keeps the table\n// honest as providers are added.\n\nimport {\n  CAPABILITY_DESCRIPTORS,\n  DESKTOP_STREAM_PORT,\n  SandboxBackend,\n  type CapabilityDescriptor,\n} from \"@opengeni/contracts\";\n\nexport { CAPABILITY_DESCRIPTORS, DESKTOP_STREAM_PORT };\nexport type { CapabilityDescriptor };\n\n/**\n * Descriptor-table invariants, asserted once at registry build (and from a unit\n * test). This is the guardrail that keeps the static matrix internally coherent.\n * It validates the descriptor data only; the descriptor.backendId === SDK\n * client.backendId assertion (the deferred-from-P0.1 check) lives in\n * providers/index.ts because it must construct the real SDK clients.\n */\nexport function assertDescriptorRegistryInvariants(): void {\n  for (const backend of SandboxBackend.options) {\n    const descriptor = CAPABILITY_DESCRIPTORS[backend];\n    if (!descriptor) {\n      throw new Error(`No CapabilityDescriptor for backend \"${backend}\"`);\n    }\n    if (descriptor.backend !== backend) {\n      throw new Error(`Descriptor.backend mismatch for \"${backend}\" (got \"${descriptor.backend}\")`);\n    }\n\n    // DesktopStream implies a non-\"none\" port-exposure mechanism (split-plane B\n    // needs a way to surface 6080 to a viewer).\n    if (\n      descriptor.capabilities.DesktopStream.available &&\n      descriptor.portExposure.kind === \"none\"\n    ) {\n      throw new Error(`\"${backend}\" claims DesktopStream but portExposure.kind=none`);\n    }\n\n    // DesktopStream implies a transport, and a desktop transport implies the\n    // capability is available (no half-declared desktop rows).\n    if (\n      descriptor.capabilities.DesktopStream.available &&\n      descriptor.capabilities.DesktopStream.transport === null\n    ) {\n      throw new Error(`\"${backend}\" claims DesktopStream but transport is null`);\n    }\n\n    // Recording feasibility is the same Xvfb display as DesktopStream: a desktop\n    // backend MUST be able to x11grab; a non-desktop backend MUST NOT claim it\n    // (Recording.available == DesktopStream.available && os==linux — Part D).\n    if (\n      descriptor.capabilities.DesktopStream.available !==\n      descriptor.capabilities.Recording.available\n    ) {\n      throw new Error(\n        `\"${backend}\" Recording.available (${descriptor.capabilities.Recording.available}) must equal DesktopStream.available (${descriptor.capabilities.DesktopStream.available})`,\n      );\n    }\n\n    // Persistable backends are the only ones the lease can re-establish from an\n    // envelope — they must carry a real snapshot mechanism.\n    if (descriptor.persistable && descriptor.snapshot.kind === \"none\") {\n      throw new Error(`\"${backend}\" persistable but snapshot.kind=none`);\n    }\n\n    // A native bucket-mount backend must be desktop/headless-tier real (modal):\n    // a dev/none tier cannot own a provider bucket mount.\n    if (\n      descriptor.bucketMount === \"native\" &&\n      (descriptor.tier === \"dev\" || descriptor.tier === \"none\")\n    ) {\n      throw new Error(`\"${backend}\" claims a native bucket mount on tier=${descriptor.tier}`);\n    }\n  }\n}\n","// The uniform per-provider registration shape (module 03 §3.1).\n//\n// One file per provider implements ProviderRegistration; PROVIDER_REGISTRY maps\n// each SandboxBackend to its registration. This replaces the flat if/else chain\n// that createSandboxClient used to be.\n\nimport type { Settings } from \"@opengeni/config\";\nimport type { CapabilityDescriptor, SandboxBackend } from \"@opengeni/contracts\";\nimport type { RuntimeMetricsHooks } from \"../../metrics\";\n\nexport interface ProviderConstructionContext {\n  settings: Settings;\n  /** The env map for the box (collectSandboxEnvironment / per-run environment). */\n  environment: Record<string, string>;\n  /**\n   * Parsed exposed ports (config string -> number[]); already includes the\n   * desktop stream port (6080) when this is a desktop tier with desktop enabled\n   * and the provider cannot expose ports on demand (the merge happens in\n   * createSandboxClient before build()).\n   */\n  exposedPorts: number[];\n  metrics?: RuntimeMetricsHooks;\n}\n\nexport type ProviderImmutableImageBuildResult = {\n  provider: string;\n  backend: SandboxBackend;\n  imageId: string | null;\n  imageDigest: string | null;\n  /** Exact provider account/workspace binding. Persist only a hash publicly. */\n  providerBindingKey: string | null;\n  /** Non-secret canonical binding retained only for durable provider artifact ownership. */\n  providerBinding: Record<string, unknown> | null;\n};\n\nexport type ProviderImmutableImageBuildInput = {\n  settings: Settings;\n  session: unknown;\n  requestId: string;\n  timeoutMs: number;\n};\n\nexport type ProviderExpirationRenewalInput = {\n  settings: Settings;\n  instanceId: string;\n};\n\n/**\n * Crash-recovery contract for one provider's /workspace capture path.\n *\n * - `same_request`: retrying with the durable request id resumes/returns the\n *   same provider operation.\n * - `parallel_read`: the adapter deliberately uses an independently repeatable,\n *   read-only capture (normally a uniquely-named tar); overlapping a predecessor\n *   after worker loss cannot replace or mutate the live sandbox.\n * - `exclusive`: neither property is proven, so an ambiguous predecessor may\n *   never be overlapped while the provider instance is still live.\n */\nexport type ProviderWorkspaceCaptureTakeover = \"same_request\" | \"parallel_read\" | \"exclusive\";\n\nexport type ProviderWorkspaceCapturePolicy = {\n  takeover: ProviderWorkspaceCaptureTakeover;\n  /** `portable_tar` bypasses a provider-native persistence mode whose capture\n   * replaces the live instance or creates an unledgered native artifact. */\n  strategy: \"configured\" | \"portable_tar\";\n  /** Warm checkpoints are legal only when capture preserves the addressed\n   * physical instance. A replacing capture must never run behind a lease whose\n   * provider identity cannot be atomically republished with it. */\n  liveInstance: \"preserved\" | \"replaced\";\n  /** Which warm checkpoints run. `periodic` (the default): turn-end and\n   * interval checkpoints keep a recent recovery point. `forced_only`: the\n   * provider persists the live sandbox itself, so only a forced capture (a\n   * rotation) runs; drains still capture for rotation, archive or a move. */\n  warmCheckpoints?: \"periodic\" | \"forced_only\";\n};\n\n/**\n * How Opengeni obtains a non-replacing attachment to the exact persisted\n * provider instance.\n *\n * - `ordinary`: SDK `resume()` is already a pure re-address operation; the\n *   factory exposes it through the explicit `resumeExact()` contract.\n * - `custom`: ordinary resume may restore/recreate, so the adapter itself must\n *   implement `resumeExact()` and fail when the addressed instance is absent.\n * - `none`: the backend has no provider session.\n */\nexport type ProviderExactResumeMode = \"ordinary\" | \"custom\" | \"none\";\n\nexport const REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE = Object.freeze({\n  takeover: \"parallel_read\",\n  strategy: \"configured\",\n  liveInstance: \"preserved\",\n} satisfies ProviderWorkspaceCapturePolicy);\n\nexport const REPEATABLE_PORTABLE_TAR_WORKSPACE_CAPTURE = Object.freeze({\n  takeover: \"parallel_read\",\n  strategy: \"portable_tar\",\n  liveInstance: \"preserved\",\n} satisfies ProviderWorkspaceCapturePolicy);\n\n/** A provider that persists the live sandbox itself (Opengeni compute): a\n * portable tar is read only to rotate, archive or move the workspace, never as\n * a periodic warm checkpoint. */\nexport const ROTATION_ONLY_PORTABLE_TAR_WORKSPACE_CAPTURE = Object.freeze({\n  ...REPEATABLE_PORTABLE_TAR_WORKSPACE_CAPTURE,\n  warmCheckpoints: \"forced_only\",\n} satisfies ProviderWorkspaceCapturePolicy);\n\n/** Read SDK workspace persistence without coupling callers to the three shapes\n * used across live sessions, serialized provider state, and lease envelopes. */\nexport function providerWorkspacePersistence(state: unknown): unknown {\n  if (!state || typeof state !== \"object\" || Array.isArray(state)) return undefined;\n  const outer = state as Record<string, unknown>;\n  const liveState =\n    outer.state && typeof outer.state === \"object\" && !Array.isArray(outer.state)\n      ? (outer.state as Record<string, unknown>)\n      : outer;\n  const sessionState =\n    liveState.sessionState &&\n    typeof liveState.sessionState === \"object\" &&\n    !Array.isArray(liveState.sessionState)\n      ? (liveState.sessionState as Record<string, unknown>)\n      : liveState;\n  const providerState =\n    sessionState.providerState &&\n    typeof sessionState.providerState === \"object\" &&\n    !Array.isArray(sessionState.providerState)\n      ? (sessionState.providerState as Record<string, unknown>)\n      : null;\n  return providerState?.workspacePersistence ?? sessionState.workspacePersistence;\n}\n\nexport interface ProviderRegistration {\n  backend: SandboxBackend;\n  exactResumeMode: ProviderExactResumeMode;\n  /** Exact live-session state fields that address this provider. New providers\n   * must declare this explicitly; generic `id` guessing is forbidden. */\n  instanceIdFields: readonly string[];\n  /** Optional identity below the disposable provider execution wrapper. A\n   * matching key licenses a replacement only when the caller supplies a\n   * durable continuity receipt; ordinary attached resumes remain exact. */\n  continuity?: {\n    kind: \"docker_workspace\";\n    keyFromState(state: unknown): string | null;\n    /** Make discarding an unpublished replacement preserve the shared durable\n     * workspace named by the continuity key. */\n    preserveWorkspaceForDiscard(session: unknown, sessionState: unknown): void;\n  };\n  /** Resolve capture semantics from either a live session, a serialized SDK\n   * session state, or Opengeni's outer session envelope. Required for every\n   * provider so new backends cannot silently inherit unsafe teardown behavior.\n   * `null` means the backend has no provider workspace to capture. */\n  workspaceCapturePolicy(state: unknown): ProviderWorkspaceCapturePolicy | null;\n  /** Optional provider preparation after a verified archive is durable and\n   * immediately before generic SDK teardown. This may only suppress redundant\n   * provider persistence; it must not alter durable identity or workspace data. */\n  prepareForTeardownAfterCapture?(session: unknown): void;\n  /**\n   * Build one provider-native immutable image from an already verified clean\n   * sandbox. Omission is the truthful unsupported-provider signal; callers\n   * must retain runtime setup as the fallback.\n   */\n  buildImmutableImage?(\n    input: ProviderImmutableImageBuildInput,\n  ): Promise<ProviderImmutableImageBuildResult>;\n  /** Refresh a renewable provider expiration for one exact live instance.\n   * Omission means the provider has no renewable TTL contract. */\n  renewExpiration?(input: ProviderExpirationRenewalInput): Promise<void>;\n  descriptor: CapabilityDescriptor;\n  /**\n   * What this provider's live session answers from `supportsPty()`: whether\n   * the agent gets the `write_stdin` tool. A lazily provisioned turn binds its\n   * tools before the box exists and answers with this value, so it must equal\n   * the live session's answer. Otherwise the tool list changes depending on\n   * whether something touched the box before the tools were bound (an attached\n   * file, a resumed box), and every such change costs a full prompt-cache\n   * miss. This is the agent's command-input capability, not the human\n   * terminal's PTY in `descriptor.capabilities.Terminal`.\n   */\n  sessionSupportsPty: boolean;\n  /**\n   * Validate that the settings carry the credentials/config this provider\n   * REQUIRES. Throw SandboxConfigError on any missing/contradictory field.\n   * Pure — no network. Called by both the factory and a deploy-time preflight.\n   * The factory calls this before build(), so build() may assume valid settings.\n   */\n  validateCredentials(settings: Settings): void;\n  /**\n   * Build the raw SDK SandboxClient. Returns undefined ONLY for \"none\".\n   * The factory calls validateCredentials() first, so build() can assume valid.\n   */\n  build(ctx: ProviderConstructionContext): unknown;\n}\n","import { BlaxelSandboxClient } from \"@openai/agents-extensions/sandbox/blaxel\";\nimport { CAPABILITY_DESCRIPTORS } from \"../capabilities\";\nimport { SandboxConfigError } from \"../errors\";\nimport { REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE, type ProviderRegistration } from \"./types\";\n\nexport const blaxelProvider: ProviderRegistration = {\n  backend: \"blaxel\",\n  exactResumeMode: \"custom\",\n  instanceIdFields: [\"sandboxIdentity\"],\n  workspaceCapturePolicy: () => REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE,\n  descriptor: CAPABILITY_DESCRIPTORS.blaxel,\n  // The SDK session offers stdin once it has a sandbox URL and API key, which\n  // every configured Blaxel box has.\n  sessionSupportsPty: true,\n  validateCredentials(settings) {\n    if (!settings.blaxelApiKey) {\n      throw new SandboxConfigError(\"blaxel\", \"OPENGENI_BLAXEL_API_KEY is required\");\n    }\n  },\n  build({ settings, environment }) {\n    // Blaxel exposes ports ON DEMAND (the only such backend) — its options take\n    // no `exposedPorts: number[]` list; 6080 is resolved at handshake time, so\n    // we do NOT pre-declare it here (this is why the factory's 6080-merge is\n    // gated on !supportsOnDemandPorts).\n    const options: NonNullable<ConstructorParameters<typeof BlaxelSandboxClient>[0]> = {\n      apiKey: settings.blaxelApiKey!,\n      env: environment,\n      // persistWorkspace() creates a remote tarball. Bound that provider-native\n      // operation by the same immutable deadline as the durable capture claim;\n      // Opengeni's outer timeout still protects every provider uniformly.\n      timeouts: { workspaceTarTimeoutMs: settings.sandboxSnapshotTimeoutMs },\n    };\n    if (settings.blaxelImage) options.image = settings.blaxelImage;\n    if (settings.blaxelRegion) options.region = settings.blaxelRegion;\n    if (settings.blaxelExposedPortPublic !== undefined) {\n      options.exposedPortPublic = settings.blaxelExposedPortPublic;\n    }\n    if (settings.blaxelExposedPortUrlTtlSeconds) {\n      options.exposedPortUrlTtlS = settings.blaxelExposedPortUrlTtlSeconds;\n    }\n    if (settings.blaxelMemoryMb) options.memory = settings.blaxelMemoryMb;\n    if (settings.blaxelTtl) options.ttl = settings.blaxelTtl;\n    return new BlaxelSandboxClient(options);\n  },\n};\n","import { CloudflareSandboxClient } from \"@openai/agents-extensions/sandbox/cloudflare\";\nimport { CAPABILITY_DESCRIPTORS } from \"../capabilities\";\nimport { SandboxConfigError } from \"../errors\";\nimport { REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE, type ProviderRegistration } from \"./types\";\n\nexport const cloudflareProvider: ProviderRegistration = {\n  backend: \"cloudflare\",\n  exactResumeMode: \"ordinary\",\n  instanceIdFields: [\"sandboxId\"],\n  workspaceCapturePolicy: () => REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE,\n  descriptor: CAPABILITY_DESCRIPTORS.cloudflare,\n  sessionSupportsPty: true,\n  validateCredentials(settings) {\n    // workerUrl is the addressing root for the Cloudflare Sandbox Worker — there\n    // is no construction without it (it is the one non-optional client option).\n    if (!settings.cloudflareWorkerUrl) {\n      throw new SandboxConfigError(\"cloudflare\", \"OPENGENI_CLOUDFLARE_WORKER_URL is required\");\n    }\n  },\n  build({ settings, exposedPorts }) {\n    const options: NonNullable<ConstructorParameters<typeof CloudflareSandboxClient>[0]> = {\n      workerUrl: settings.cloudflareWorkerUrl!,\n      exposedPorts,\n      // `/persist` is an HTTP request rather than the shared remote-tar helper.\n      // Abort its provider transport at the same immutable budget as the\n      // durable capture claim; the outer lifecycle fence still owns settlement.\n      timeouts: { requestTimeoutMs: settings.sandboxSnapshotTimeoutMs },\n    };\n    if (settings.cloudflareApiKey) options.apiKey = settings.cloudflareApiKey;\n    return new CloudflareSandboxClient(options);\n  },\n};\n","// Opengeni compute: managed microVMs run by Opengeni itself, each\n// running the Connected Machine agent. See docs/compute-backend.md.\n\nimport { computeSettingsIssues } from \"@opengeni/config\";\nimport { CAPABILITY_DESCRIPTORS } from \"../capabilities\";\nimport { ComputeControlClient } from \"../compute/control\";\nimport { getComputeAgentPlane } from \"../compute/plane\";\nimport { ComputeSandboxClient } from \"../compute/session\";\nimport { SandboxConfigError } from \"../errors\";\nimport { resolveRelayConfig } from \"./selfhosted\";\nimport { ROTATION_ONLY_PORTABLE_TAR_WORKSPACE_CAPTURE, type ProviderRegistration } from \"./types\";\n\n/** A request window that outlasts a wake from disk (the host holds a message\n * for up to 120 s) plus the agent's reply. */\nexport const COMPUTE_MIN_REQUEST_TIMEOUT_MS = 130_000;\n\nexport const computeProvider: ProviderRegistration = {\n  backend: \"compute\",\n  exactResumeMode: \"custom\",\n  instanceIdFields: [\"sandboxId\"],\n  // Compute persists the sandbox itself. A portable tar is only the read-only\n  // capture that rotates, archives or moves a workspace; no warm checkpoints.\n  workspaceCapturePolicy: () => ROTATION_ONLY_PORTABLE_TAR_WORKSPACE_CAPTURE,\n  descriptor: CAPABILITY_DESCRIPTORS.compute,\n  // Commands run over the Connected Machine operation stream; long ones become\n  // background commands, not stdin sessions. The relay PTY in the descriptor is\n  // the person's terminal.\n  sessionSupportsPty: false,\n  validateCredentials(settings) {\n    const issues = computeSettingsIssues(settings);\n    if (issues.length > 0) throw new SandboxConfigError(\"compute\", issues.join(\"; \"));\n  },\n  build({ settings, environment }) {\n    // The desktop tier starts the agent with its own virtual desktop, from the\n    // desktop image when one is configured.\n    const desktop = settings.sandboxDesktopEnabled === true;\n    return new ComputeSandboxClient({\n      control: new ComputeControlClient({\n        baseUrl: settings.computeApiUrl!,\n        apiKey: settings.computeApiKey!,\n      }),\n      plane: getComputeAgentPlane,\n      relay: resolveRelayConfig(settings),\n      gateway: settings.computeLinkUrl!,\n      image: (desktop ? settings.computeDesktopImage : undefined) ?? settings.computeImage ?? null,\n      desktop,\n      vcpus: settings.computeVcpus,\n      memoryMib: settings.computeMemoryMib,\n      ...(settings.computeMemoryRequestMib !== undefined\n        ? { memoryRequestMib: settings.computeMemoryRequestMib }\n        : {}),\n      ...(settings.computeCpuRequestMillis !== undefined\n        ? { cpuRequestMillis: settings.computeCpuRequestMillis }\n        : {}),\n      ...(settings.computeDiskMib !== undefined ? { diskMib: settings.computeDiskMib } : {}),\n      readyTimeoutMs: settings.computeAgentReadyTimeoutMs,\n      // The first request after idle takes the sandbox's wake: its host holds\n      // the message for up to 120 s while the sandbox wakes and its agent\n      // reconnects, so every compute request window covers that.\n      controlTimeoutMs: Math.max(\n        settings.sandboxSelfhostedControlTimeoutMs,\n        COMPUTE_MIN_REQUEST_TIMEOUT_MS,\n      ),\n      execTimeoutMs: settings.sandboxSelfhostedExecTimeoutMs,\n      environment,\n    });\n  },\n};\n","// The HTTP client for the control service of Opengeni compute (compute-control;\n// compute/ in this repository, its contract compute/docs/agent-link.md section\n// 1). Compute owns placement, sleep and persistence; Opengeni creates a\n// sandbox, wakes one no host serves, reads it, finds the sandbox a create\n// request made, deletes it, and reads the keys the control service signs\n// agent-link tokens with. Every request carries the team API key. Errors are `{code, message}` bodies.\n//\n// `create` is idempotent by `request_id`: the same id with the same body\n// answers the same sandbox, so an uncertain create is retried with the SAME id\n// and body, never a new one.\n\nexport type ComputeControlErrorKind =\n  | \"not_found\"\n  | \"invalid\"\n  | \"unauthorized\"\n  | \"busy\"\n  | \"request_mismatch\"\n  | \"request_gone\"\n  | \"host\"\n  | \"init_failed\"\n  | \"no_capacity\"\n  | \"unavailable\"\n  | \"unknown_outcome\"\n  | \"internal\"\n  | \"transport\";\n\nconst RETRYABLE_KINDS: ReadonlySet<ComputeControlErrorKind> = new Set([\n  \"busy\",\n  \"host\",\n  \"init_failed\",\n  \"no_capacity\",\n  \"unavailable\",\n  \"unknown_outcome\",\n  \"internal\",\n  \"transport\",\n]);\n\nexport class ComputeControlError extends Error {\n  readonly name = \"ComputeControlError\";\n  readonly kind: ComputeControlErrorKind;\n  readonly status: number | null;\n  /** Safe to repeat the same request (the same request_id for a create). */\n  readonly retryable: boolean;\n\n  constructor(input: {\n    kind: ComputeControlErrorKind;\n    status: number | null;\n    message: string;\n    cause?: unknown;\n  }) {\n    super(input.message, input.cause === undefined ? undefined : { cause: input.cause });\n    this.kind = input.kind;\n    this.status = input.status;\n    this.retryable = RETRYABLE_KINDS.has(input.kind);\n  }\n}\n\nexport function isComputeSandboxNotFound(error: unknown): boolean {\n  return error instanceof ComputeControlError && error.kind === \"not_found\";\n}\n\n/** The sandbox is gone for good: never existed, deleted, or its request's\n * sandbox was deleted. */\nexport function isComputeSandboxGone(error: unknown): boolean {\n  return (\n    error instanceof ComputeControlError &&\n    (error.kind === \"not_found\" || error.kind === \"request_gone\")\n  );\n}\n\nexport type ComputeSandboxView = {\n  id: string;\n  image: string;\n  config: Record<string, unknown>;\n  metadata: Record<string, string>;\n  /** The Opengeni agent the sandbox runs, as its create named it. */\n  agent?: { workspace: string; agent: string };\n  host: string | null;\n  owner_epoch: number;\n  created_ms: number;\n};\n\nexport type ComputeWokenView = {\n  waited_us: number;\n  generation: number;\n  host: string | null;\n};\n\n/** The agent a create names: its enrollment's ids. It holds no secret; the\n * agent is reached through its host's link to Opengeni's agent gateway. */\nexport type ComputeAgentInit = {\n  workspace_id: string;\n  agent_id: string;\n  workspace_root: string;\n  /** Start the agent with its own virtual desktop. */\n  desktop: boolean;\n};\n\nexport type ComputeCreateRequest = {\n  request_id: string;\n  image?: string;\n  vcpus: number;\n  memory_mib: number;\n  memory_request_mib?: number;\n  cpu_request_millis?: number;\n  /** How long its disk is in MiB, where longer than its image's. */\n  disk_mib?: number;\n  metadata: Record<string, string>;\n  init: {\n    env_vars: Record<string, string>;\n    default_user?: string;\n    default_workdir?: string;\n    agent: ComputeAgentInit;\n  };\n};\n\n/** One public key the control service signs agent-link tokens with (a JWK). */\nexport type ComputeLinkKey = { kty: string; crv: string; kid: string; x: string };\n\n/** `GET /v1/link/keys`: Opengeni's own team and the control service's link keys. */\nexport type ComputeLinkKeys = { team: string; keys: ComputeLinkKey[] };\n\n/** What `GET /v1/requests/{request_id}` found for a create request. */\nexport type ComputeRequestLookup =\n  | { state: \"live\"; sandbox: ComputeSandboxView }\n  | { state: \"none\" }\n  | { state: \"gone\" };\n\nexport type ComputeControlClientOptions = {\n  baseUrl: string;\n  apiKey: string;\n  /** Injected for tests; defaults to the global fetch. */\n  fetch?: typeof fetch;\n  /** Per-attempt request deadline. Create and wake can take a while: the\n   * control service answers a create once the guest kept its init, and a wake once the\n   * sandbox runs (a restore from a remote archive takes seconds). */\n  requestTimeoutMs?: number;\n  /** Bounded attempts for retryable failures (same body, same request_id). */\n  maxAttempts?: number;\n  sleep?: (ms: number) => Promise<void>;\n  /** Ends every request of this client: an aborted signal fails the request\n   * in flight at once and stops further attempts. */\n  signal?: AbortSignal;\n};\n\nconst DEFAULT_REQUEST_TIMEOUT_MS = 120_000;\nconst DEFAULT_MAX_ATTEMPTS = 4;\n\nconst KNOWN_CODES: ReadonlySet<string> = new Set([\n  \"not_found\",\n  \"invalid\",\n  \"busy\",\n  \"request_mismatch\",\n  \"request_gone\",\n  \"host\",\n  \"init_failed\",\n  \"no_capacity\",\n  \"unavailable\",\n  \"unknown_outcome\",\n  \"internal\",\n]);\n\n/** The body's `code` names the failure; the status is the fallback. */\nfunction kindFor(status: number, code: string | undefined): ComputeControlErrorKind {\n  if (status === 401 || status === 403) return \"unauthorized\";\n  if (code && KNOWN_CODES.has(code)) return code as ComputeControlErrorKind;\n  if (status === 404) return \"not_found\";\n  if (status === 400 || status === 422) return \"invalid\";\n  if (status === 409) return \"busy\";\n  if (status === 410) return \"request_gone\";\n  if (status === 502) return \"host\";\n  if (status === 503) return \"unavailable\";\n  if (status === 504) return \"unknown_outcome\";\n  return \"internal\";\n}\n\n/** The `code` and a bounded, secret-free message of an error body. */\nasync function errorBody(\n  response: Response,\n  readText: (response: Response) => Promise<string>,\n): Promise<{ code?: string; message: string }> {\n  let text = \"\";\n  try {\n    text = await readText(response);\n  } catch {\n    return { message: `HTTP ${response.status}` };\n  }\n  try {\n    const body = JSON.parse(text) as { code?: unknown; message?: unknown };\n    const code = typeof body.code === \"string\" ? body.code : undefined;\n    if (typeof body.message === \"string\" && body.message) {\n      return { ...(code ? { code } : {}), message: body.message.slice(0, 500) };\n    }\n    return { ...(code ? { code } : {}), message: `HTTP ${response.status}` };\n  } catch {\n    return { message: (text || `HTTP ${response.status}`).slice(0, 500) };\n  }\n}\n\nexport class ComputeControlClient {\n  private readonly baseUrl: string;\n  private readonly apiKey: string;\n  private readonly fetchImpl: typeof fetch;\n  private readonly requestTimeoutMs: number;\n  private readonly maxAttempts: number;\n  private readonly sleep: (ms: number) => Promise<void>;\n  private readonly signal: AbortSignal | undefined;\n\n  constructor(options: ComputeControlClientOptions) {\n    this.baseUrl = options.baseUrl.replace(/\\/+$/u, \"\");\n    this.apiKey = options.apiKey;\n    this.fetchImpl = options.fetch ?? fetch;\n    this.requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;\n    this.maxAttempts = Math.max(1, options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS);\n    this.sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));\n    this.signal = options.signal;\n  }\n\n  /** Create (or, for a repeated request_id and body, return and wake) one\n   * sandbox. Answers once the guest kept its init; its agent may not have\n   * connected yet. */\n  async create(body: ComputeCreateRequest): Promise<ComputeSandboxView> {\n    return await this.request<ComputeSandboxView>(\"POST\", \"/v1/sandboxes\", body);\n  }\n\n  /** Make the sandbox run, placing and adopting it when no host owns it (a\n   * no-op when it already runs). */\n  async wake(sandboxId: string): Promise<ComputeWokenView> {\n    return await this.request<ComputeWokenView>(\n      \"POST\",\n      `/v1/sandboxes/${encodeURIComponent(sandboxId)}/wake`,\n      {},\n    );\n  }\n\n  async get(sandboxId: string): Promise<ComputeSandboxView> {\n    return await this.request<ComputeSandboxView>(\n      \"GET\",\n      `/v1/sandboxes/${encodeURIComponent(sandboxId)}`,\n    );\n  }\n\n  /** The team's sandboxes whose metadata holds every given pair. */\n  async list(metadata: Record<string, string> = {}): Promise<ComputeSandboxView[]> {\n    const query = new URLSearchParams(metadata).toString();\n    return await this.request<ComputeSandboxView[]>(\n      \"GET\",\n      `/v1/sandboxes${query ? `?${query}` : \"\"}`,\n    );\n  }\n\n  /** The sandbox a create request made, so a caller that lost a create's\n   * answer can find it without creating one. */\n  async lookupRequest(requestId: string): Promise<ComputeRequestLookup> {\n    try {\n      const sandbox = await this.request<ComputeSandboxView>(\n        \"GET\",\n        `/v1/requests/${encodeURIComponent(requestId)}`,\n      );\n      return { state: \"live\", sandbox };\n    } catch (error) {\n      if (error instanceof ComputeControlError && error.kind === \"not_found\") {\n        return { state: \"none\" };\n      }\n      if (error instanceof ComputeControlError && error.kind === \"request_gone\") {\n        return { state: \"gone\" };\n      }\n      throw error;\n    }\n  }\n\n  /** Delete one sandbox. An already-gone sandbox is success. */\n  async delete(sandboxId: string): Promise<void> {\n    try {\n      await this.request<unknown>(\"DELETE\", `/v1/sandboxes/${encodeURIComponent(sandboxId)}`);\n    } catch (error) {\n      if (isComputeSandboxGone(error)) return;\n      throw error;\n    }\n  }\n\n  /** Opengeni's team and the keys the control service signs host tokens and sandbox\n   * tickets with, the current one first. */\n  async linkKeys(): Promise<ComputeLinkKeys> {\n    return await this.request<ComputeLinkKeys>(\"GET\", \"/v1/link/keys\");\n  }\n\n  private async request<T>(method: string, path: string, body?: unknown): Promise<T> {\n    let lastError: ComputeControlError | undefined;\n    for (let attempt = 0; attempt < this.maxAttempts; attempt += 1) {\n      if (attempt > 0) await this.backoff(Math.min(8_000, 250 * 2 ** attempt));\n      if (this.signal?.aborted) break;\n      try {\n        return await this.attempt<T>(method, path, body);\n      } catch (error) {\n        if (!(error instanceof ComputeControlError) || !error.retryable) throw error;\n        lastError = error;\n      }\n    }\n    throw (\n      lastError ??\n      new ComputeControlError({\n        kind: \"transport\",\n        status: null,\n        message: `compute control service ${method} ${path.split(\"?\")[0]} was abandoned`,\n      })\n    );\n  }\n\n  /** Wait before a retry, ending early once the client's signal aborts. */\n  private async backoff(ms: number): Promise<void> {\n    const signal = this.signal;\n    if (!signal) return await this.sleep(ms);\n    if (signal.aborted) return;\n    let onAbort: (() => void) | undefined;\n    const aborted = new Promise<void>((resolve) => {\n      onAbort = () => resolve();\n      signal.addEventListener(\"abort\", onAbort, { once: true });\n    });\n    try {\n      await Promise.race([this.sleep(ms), aborted]);\n    } finally {\n      if (onAbort) signal.removeEventListener(\"abort\", onAbort);\n    }\n  }\n\n  private async attempt<T>(method: string, path: string, body?: unknown): Promise<T> {\n    const route = path.split(\"?\")[0];\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.requestTimeoutMs);\n    const abandon = (): void => controller.abort();\n    this.signal?.addEventListener(\"abort\", abandon, { once: true });\n    if (this.signal?.aborted) controller.abort();\n    // The timeout and the caller's signal bound the whole exchange, body\n    // included: a peer that sends headers and then stalls must not outlive\n    // either deadline.\n    const unanswered = (cause?: unknown): ComputeControlError =>\n      new ComputeControlError({\n        kind: \"transport\",\n        status: null,\n        message: `compute control service ${method} ${route} did not answer`,\n        ...(cause === undefined ? {} : { cause }),\n      });\n    const ended = new Promise<never>((_, reject) => {\n      const fail = (): void => reject(unanswered());\n      if (controller.signal.aborted) fail();\n      else controller.signal.addEventListener(\"abort\", fail, { once: true });\n    });\n    ended.catch(() => {});\n    const readText = (response: Response): Promise<string> =>\n      Promise.race([response.text(), ended]);\n    try {\n      let response: Response;\n      try {\n        response = await Promise.race([\n          this.fetchImpl(`${this.baseUrl}${path}`, {\n            method,\n            headers: {\n              \"x-api-key\": this.apiKey,\n              accept: \"application/json\",\n              ...(body === undefined ? {} : { \"content-type\": \"application/json\" }),\n            },\n            ...(body === undefined ? {} : { body: JSON.stringify(body) }),\n            signal: controller.signal,\n          }),\n          ended,\n        ]);\n      } catch (error) {\n        // No answer: the request may or may not have taken effect. Callers only\n        // repeat idempotent requests (a create carries its request_id).\n        throw error instanceof ComputeControlError ? error : unanswered(error);\n      }\n      if (!response.ok) {\n        const { code, message } = await errorBody(response, readText);\n        throw new ComputeControlError({\n          kind: kindFor(response.status, code),\n          status: response.status,\n          message: `compute control service ${method} ${route}: ${message}`,\n        });\n      }\n      let text: string;\n      try {\n        text = await readText(response);\n      } catch (error) {\n        throw error instanceof ComputeControlError ? error : unanswered(error);\n      }\n      if (!text) return undefined as T;\n      try {\n        return JSON.parse(text) as T;\n      } catch (error) {\n        throw new ComputeControlError({\n          kind: \"internal\",\n          status: response.status,\n          message: `compute control service ${method} ${route} returned a non-JSON body`,\n          cause: error,\n        });\n      }\n    } finally {\n      clearTimeout(timer);\n      this.signal?.removeEventListener(\"abort\", abandon);\n    }\n  }\n}\n","// The Connected Machine plane a compute sandbox's agent is reached over.\n//\n// Every compute sandbox runs Opengeni's machine agent, reached through its\n// host's link to the agent gateway, which puts the agent's traffic on\n// Opengeni's NATS exactly where a Connected Machine's would be. So the runtime\n// needs the same live pieces a Connected Machine session uses: the NATS\n// request/reply connection (ControlRpc), the op-stream frame transport, the\n// database read that resolves an enrollment's current live connection, and the\n// sandbox enrollment's creation and revocation. The runtime leaf owns none of\n// them; the API and worker inject them once at boot.\n\nimport type { ControlRpc } from \"../selfhosted/control-rpc\";\nimport type { OpStreamTransport } from \"../selfhosted/op-transport\";\n\n/**\n * Whether a backend's provider session is the machine agent reached over NATS\n * and the relay (a Connected Machine, or the agent inside a compute sandbox).\n * Transport points (relay terminal and desktop frames, the agent's error\n * grammar) key on this; lease and provisioning points still treat compute as\n * a managed sandbox.\n */\nexport function usesAgentTransport(backend: string | null | undefined): boolean {\n  return backend === \"selfhosted\" || backend === \"compute\";\n}\n\n/** One authoritative snapshot of the box agent's live connection. */\nexport interface ComputeAgentConnection {\n  /** Control-plane workspace segment of the agent subject. */\n  workspaceId: string;\n  connectionInstanceId: string;\n  /** The enrollment's connection generation, from the same snapshot. */\n  connectionGeneration: string;\n  /** The workspace root the agent reported in its Hello. */\n  workspaceRoot: string | null;\n  /** The agent advertised the op-stream exec protocol. */\n  opStream: boolean;\n  transactionalFsWriteSupported: boolean;\n  /** Transactional writes also accept epoch 0, which compute requests carry. */\n  transactionalFsWriteMachineSupported: boolean;\n  browserControlHttpSupported: boolean;\n  /** The agent advertised per-request `run_as` (Hello `capabilities.run_as`). */\n  runAsSupported: boolean;\n}\n\nexport interface ComputeAgentPlane {\n  /** The request/reply transport. A missing connection answers agent_offline.\n   * `onNoResponders` runs on each \"no responders\" of a replayable request\n   * before the same delivery is retried; false stops retrying. */\n  controlRpc(options?: { onNoResponders?: (subject: string) => Promise<boolean> }): ControlRpc;\n  /** The op-stream frame transport, or null when the deployment has none. */\n  opStreamTransport(): OpStreamTransport | null;\n  /** The enrollment's current live connection, or null when it has none (its\n   * host has not opened the agent's session at the gateway, or it was revoked).\n   * A sleeping sandbox's session stays open, so it resolves. */\n  resolveConnection(input: {\n    workspaceId: string;\n    enrollmentId: string;\n  }): Promise<ComputeAgentConnection | null>;\n  /** Create the sandbox's enrollment, active at once and keyless, bound to the\n   * sandbox group (idempotent for the same id and group). */\n  createEnrollment(input: {\n    accountId: string;\n    workspaceId: string;\n    enrollmentId: string;\n    sandboxGroupId: string;\n    hasDisplay: boolean;\n    workspaceRoot: string;\n  }): Promise<void>;\n  /** Revoke the sandbox enrollment, which ends its session at the gateway\n   * (idempotent; absent is success). */\n  revokeEnrollment(input: { workspaceId: string; enrollmentId: string }): Promise<void>;\n}\n\nlet injectedPlane: ComputeAgentPlane | undefined;\n\n/** Installed once by the API and worker at boot. */\nexport function setComputeAgentPlane(plane: ComputeAgentPlane | undefined): void {\n  injectedPlane = plane;\n}\n\nexport function getComputeAgentPlane(): ComputeAgentPlane {\n  if (!injectedPlane) {\n    throw new Error(\n      \"compute sandbox: the agent plane is not installed in this process (the API and worker install it at boot when the compute backend is configured)\",\n    );\n  }\n  return injectedPlane;\n}\n","// A compute sandbox: a managed microVM run by Opengeni compute whose\n// provider session is the Connected Machine agent running inside it.\n//\n// Lifecycle is a managed sandbox's (lease, group, workspace setup, persistence\n// fallback), transport is the agent's (op-stream exec, files, Git, PTY,\n// desktop frames, browser control, ports over the relay). The agent holds no\n// credential: its host keeps one link to Opengeni's agent gateway and carries\n// the agent's NATS traffic, so a request to a sleeping sandbox reaches its host,\n// which wakes it. Only when no host serves the sandbox (its host was lost, or\n// it moved and is not yet adopted) does a request find no responder; the\n// session then asks the control service to wake the sandbox, which places and adopts\n// it, and resends the request under its replay identity until the agent\n// answers. Opengeni never tears a compute sandbox down for idleness; it is\n// deleted (and its enrollment revoked) only when its group ends.\n\nimport { randomUUID } from \"node:crypto\";\nimport { posix } from \"node:path\";\nimport {\n  Manifest,\n  Permissions,\n  SandboxArchiveError,\n  SandboxConfigurationError,\n  SandboxProviderError,\n  SandboxUnsupportedFeatureError,\n  normalizeRelativePath,\n  normalizeSandboxClientCreateArgs,\n  resolveSandboxArchiveLimits,\n  type Entry,\n  type MaterializeEntryArgs,\n  type SandboxArchiveLimits,\n  type SandboxClientCreateArgs,\n  type SandboxClientResumeOptions,\n  type WorkspaceArchiveData,\n  type WorkspaceArchiveOptions,\n} from \"@openai/agents/sandbox\";\nimport {\n  deserializeManifest,\n  mergeManifestDelta,\n  mergeManifestEntryDelta,\n  mergeMaterializedEnvironment,\n  rehydratePersistedEnvironmentForRuntime,\n  serializeManifestRecord,\n  serializeRuntimeEnvironmentForPersistence,\n  shellQuote,\n  toUint8Array,\n} from \"@openai/agents-core/sandbox/internal\";\nimport { ErrorCode, type ControlRequest, type ControlResponse } from \"@opengeni/agent-proto\";\nimport { SandboxConfigError, SandboxExactResumeInstanceUnavailableError } from \"../errors\";\nimport { archiveRestoreScript } from \"../providers/opensandbox-adapter\";\nimport {\n  CONNECTION_REPLACED_DETAIL_KEY,\n  NEVER_SENT_DETAIL_KEY,\n  RESPONDER_WAIT_EXHAUSTED_DETAIL_KEY,\n  SelfhostedControlError,\n  subjectFor,\n  type ControlRpc,\n} from \"../selfhosted/control-rpc\";\nimport { SELFHOSTED_FILE_CHUNK_BYTES } from \"../selfhosted/file-transfer\";\nimport {\n  SelfhostedSession,\n  type SelfhostedOperationAdmission,\n  type SelfhostedRelayConfig,\n  type SelfhostedSessionDeps,\n} from \"../selfhosted/session\";\nimport { ComputeControlClient, isComputeSandboxGone, type ComputeCreateRequest } from \"./control\";\nimport { COMPUTE_METADATA, UNSEEN_CREATE_SETTLE_MS } from \"./orphans\";\nimport type { ComputeAgentConnection, ComputeAgentPlane } from \"./plane\";\n\nexport const COMPUTE_WORKSPACE_ROOT = \"/workspace\";\nexport const COMPUTE_STATE_VERSION = 1;\nconst COMPUTE_PRIVATE_ROOT = \"/tmp/opengeni-private\";\n/** The least time between two control service wakes of one sandbox while a request\n * keeps finding no responder. */\nconst WAKE_INTERVAL_MS = 5_000;\n\n/** Who a compute sandbox belongs to. Required to create one: its agent's\n * enrollment is bound to this lease. */\nexport interface ComputeCreateIdentity {\n  accountId: string;\n  workspaceId: string;\n  sandboxGroupId: string;\n}\n\n/** The persisted provider state of one compute box. */\nexport interface ComputeSessionState {\n  stateVersion: typeof COMPUTE_STATE_VERSION;\n  sandboxId: string;\n  enrollmentId: string;\n  /** Workspace the enrollment (and agent subject) lives in. */\n  workspaceId: string;\n  accountId: string;\n  sandboxGroupId: string;\n  /** The control service create request id (idempotency key and orphan GC tag). */\n  requestId: string;\n  image: string | null;\n  manifest: Manifest;\n  environment: Record<string, string>;\n  workspacePersistence: \"tar\";\n  workspaceReady: boolean;\n}\n\n/** The live `state` a compute session exposes: the agent session's slice\n * (agentId = enrollment id, instanceId = compute sandbox id) plus the persisted\n * provider state the lease serializes. */\nexport type ComputeLiveState = ComputeSessionState & {\n  agentId: string;\n  instanceId: string;\n};\n\n/** Per-turn deps a worker turn binds onto an established compute session so\n * its commands are journaled, adoptable, metered and fenced like any agent\n * session. */\nexport type ComputeTurnDeps = Pick<\n  SelfhostedSessionDeps,\n  | \"terminalScopeId\"\n  | \"adoptBackgroundCommand\"\n  | \"abandonCommand\"\n  | \"settleBackgroundCommand\"\n  | \"captureBackgroundCommandOutput\"\n  | \"onOp\"\n  | \"transientExecEnvironment\"\n> & {\n  opJournal?: NonNullable<SelfhostedSessionDeps[\"opStream\"]>[\"journal\"];\n};\n\nfunction agentOfflineError(message: string): SelfhostedControlError {\n  return new SelfhostedControlError({\n    message,\n    code: ErrorCode.ERROR_CODE_AGENT_OFFLINE,\n    reason: \"agent_offline\",\n    retryable: false,\n    agentOffline: true,\n  });\n}\n\nfunction isNoResponder(response: ControlResponse): boolean {\n  return (\n    response.error?.code === ErrorCode.ERROR_CODE_AGENT_OFFLINE &&\n    response.error.detail?.[NEVER_SENT_DETAIL_KEY] === \"1\" &&\n    // A request whose agent connection was replaced is answered, not resent.\n    response.error.detail?.[CONNECTION_REPLACED_DETAIL_KEY] !== \"1\" &&\n    // The transport already woke and waited its whole window for this exact\n    // process; another round would only wait it again.\n    response.error.detail?.[RESPONDER_WAIT_EXHAUSTED_DETAIL_KEY] !== \"1\"\n  );\n}\n\nexport interface ComputeWakeGateDeps {\n  control: Pick<ComputeControlClient, \"wake\">;\n  sandboxId: string;\n  enrollmentId: string;\n  resolveConnection: () => Promise<ComputeAgentConnection | null>;\n  /** One raw liveness probe against an exact connection. */\n  probe: (connection: ComputeAgentConnection) => Promise<boolean>;\n  readyTimeoutMs: number;\n  now?: () => number;\n  sleep?: (ms: number) => Promise<void>;\n}\n\n/**\n * Reaches a compute sandbox's agent. Normally the gateway holds the agent's\n * session, asleep or not, and the agent's connection resolves at once. When it\n * does not (no host serves the sandbox), the gate asks the control service to wake the\n * sandbox, which places and adopts it, and waits until the new host's session\n * opens and the agent answers. Single flight: concurrent operations share one\n * recovery.\n */\nexport class ComputeWakeGate {\n  private inflight: Promise<ComputeAgentConnection> | null = null;\n  private lastWakeAtMs = Number.NEGATIVE_INFINITY;\n  private readonly now: () => number;\n  private readonly sleep: (ms: number) => Promise<void>;\n\n  constructor(private readonly deps: ComputeWakeGateDeps) {\n    this.now = deps.now ?? Date.now;\n    this.sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));\n  }\n\n  get readyTimeoutMs(): number {\n    return this.deps.readyTimeoutMs;\n  }\n\n  /** The agent's live connection as recorded now, or null; never wakes. */\n  async current(): Promise<ComputeAgentConnection | null> {\n    return await this.deps.resolveConnection();\n  }\n\n  /** The agent's live connection, recovering the sandbox when none is open. */\n  async admit(): Promise<ComputeAgentConnection> {\n    const connection = await this.deps.resolveConnection();\n    if (connection) return connection;\n    return await this.recover();\n  }\n\n  /** Wake the sandbox through the control service and wait until its agent answers. */\n  async recover(): Promise<ComputeAgentConnection> {\n    this.inflight ??= this.wakeAndWait().finally(() => {\n      this.inflight = null;\n    });\n    return await this.inflight;\n  }\n\n  /** Ask the control service to wake the sandbox, at most once per interval. */\n  async wake(): Promise<void> {\n    if (this.now() - this.lastWakeAtMs < WAKE_INTERVAL_MS) return;\n    this.lastWakeAtMs = this.now();\n    try {\n      await this.deps.control.wake(this.deps.sandboxId);\n    } catch (error) {\n      if (isComputeSandboxGone(error)) {\n        throw new SandboxExactResumeInstanceUnavailableError(\"compute\", this.deps.sandboxId);\n      }\n      throw error;\n    }\n  }\n\n  /** Wait until the agent answers on its current connection, without waking. */\n  async waitForAgent(deadline: number): Promise<ComputeAgentConnection> {\n    let delayMs = 100;\n    for (;;) {\n      const connection = await this.deps.resolveConnection();\n      if (connection && (await this.deps.probe(connection).catch(() => false))) {\n        return connection;\n      }\n      if (this.now() >= deadline) {\n        throw agentOfflineError(\n          `The agent of compute sandbox ${this.deps.sandboxId} did not answer within ${Math.round(this.deps.readyTimeoutMs / 1000)}s.`,\n        );\n      }\n      await this.sleep(Math.min(delayMs, Math.max(0, deadline - this.now())));\n      delayMs = Math.min(2_000, delayMs * 2);\n    }\n  }\n\n  private async wakeAndWait(): Promise<ComputeAgentConnection> {\n    const deadline = this.now() + this.deps.readyTimeoutMs;\n    this.lastWakeAtMs = Number.NEGATIVE_INFINITY;\n    await this.wake();\n    return await this.waitForAgent(deadline);\n  }\n}\n\n/**\n * The control transport of one compute sandbox. A request nobody received\n * means no host serves the sandbox; it wakes the sandbox through the control service\n * and resends the identical request, under the same request id (its replay\n * identity), until the agent answers or the ready deadline passes. When the\n * agent comes back on another connection the original no-responder answer is\n * returned, so the session re-admits the operation on the new connection.\n */\nexport class ComputeWakingControlRpc implements ControlRpc {\n  constructor(\n    private readonly inner: ControlRpc,\n    private readonly gate: ComputeWakeGate,\n    private readonly enrollmentId: string,\n    private readonly now: () => number = Date.now,\n    private readonly sleep: (ms: number) => Promise<void> = (ms) =>\n      new Promise((resolve) => setTimeout(resolve, ms)),\n  ) {}\n\n  async request(\n    subject: string,\n    req: ControlRequest,\n    opts: { timeoutMs: number },\n  ): Promise<ControlResponse> {\n    let response = await this.inner.request(subject, req, opts);\n    if (!isNoResponder(response)) return response;\n    const deadline = this.now() + this.gate.readyTimeoutMs;\n    let delayMs = 200;\n    while (isNoResponder(response) && this.now() < deadline) {\n      // A request bound to a connection that is no longer the agent's live one\n      // never wakes the sandbox: its agent is gone, and the session admits the\n      // operation again on the live connection.\n      const live = await this.gate.current().catch(() => null);\n      if (\n        live &&\n        subjectFor(live.workspaceId, this.enrollmentId, live.connectionInstanceId) !== subject\n      ) {\n        return response;\n      }\n      // Never delivered: safe to resend once a host serves the sandbox again.\n      await this.gate.wake();\n      const connection = await this.gate.admit().catch(() => null);\n      if (connection) {\n        const current = subjectFor(\n          connection.workspaceId,\n          this.enrollmentId,\n          connection.connectionInstanceId,\n        );\n        if (current !== subject) return response;\n      }\n      await this.sleep(Math.min(delayMs, Math.max(0, deadline - this.now())));\n      delayMs = Math.min(2_000, delayMs * 2);\n      response = await this.inner.request(subject, req, opts);\n    }\n    return response;\n  }\n}\n\nconst AGENT_RPC_SUBJECT = /^agent\\.([^.]+)\\.([^.]+)\\.connection\\.[^.]+\\.rpc$/u;\n\n/**\n * The no-responders handler of a transport that addresses an adopted\n * operation at its exact locator (its stop, its query), which may be in a\n * compute sandbox. A request no host received means no host serves the\n * sandbox: ask the control service to wake it (at most once per interval) and let the\n * transport retry the same delivery at the same subject, never at a successor\n * connection. An enrollment that is not a sandbox's (a Connected Machine)\n * keeps its ordinary offline retry. A deleted sandbox ends the retries. A\n * request bound to a connection that is no longer its enrollment's live one\n * never wakes anything and stops retrying: that agent is gone, and its\n * commands are settled by runner retirement instead.\n */\nexport function wakeComputeSandboxOnNoResponders(input: {\n  control: Pick<ComputeControlClient, \"wake\">;\n  /** The sandbox an enrollment runs in, or null for any other enrollment. */\n  sandboxOf: (agent: { workspaceId: string; enrollmentId: string }) => Promise<string | null>;\n  /** Whether the connection a subject names is still its enrollment's live\n   * one, read from the record of truth on every call. An unknown answer\n   * counts as current. */\n  connectionCurrent: (subject: string) => Promise<boolean>;\n  now?: () => number;\n}): (subject: string) => Promise<boolean> {\n  const now = input.now ?? Date.now;\n  const sandboxes = new Map<string, Promise<string | null>>();\n  const lastWakeAtMs = new Map<string, number>();\n  return async (subject) => {\n    const match = AGENT_RPC_SUBJECT.exec(subject);\n    if (!match) return true;\n    if (!(await input.connectionCurrent(subject).catch(() => true))) return false;\n    const agent = { workspaceId: match[1]!, enrollmentId: match[2]! };\n    const key = `${agent.workspaceId}.${agent.enrollmentId}`;\n    let lookup = sandboxes.get(key);\n    if (!lookup) {\n      lookup = input.sandboxOf(agent);\n      sandboxes.set(key, lookup);\n      // Only an answer is kept; a failed lookup is asked again next time.\n      const settled = lookup;\n      void settled.catch(() => {\n        if (sandboxes.get(key) === settled) sandboxes.delete(key);\n      });\n    }\n    const sandboxId = await lookup.catch(() => null);\n    if (!sandboxId) return true;\n    const atMs = now();\n    if (atMs - (lastWakeAtMs.get(sandboxId) ?? Number.NEGATIVE_INFINITY) < WAKE_INTERVAL_MS) {\n      return true;\n    }\n    lastWakeAtMs.set(sandboxId, atMs);\n    try {\n      await input.control.wake(sandboxId);\n    } catch (error) {\n      // Its operations went with it; anything else is retried until the deadline.\n      if (isComputeSandboxGone(error)) return false;\n    }\n    return true;\n  };\n}\n\nexport interface ComputeSessionDeps {\n  state: ComputeLiveState;\n  control: ComputeControlClient;\n  plane: ComputeAgentPlane;\n  relay: SelfhostedRelayConfig;\n  readyTimeoutMs: number;\n  controlTimeoutMs?: number;\n  execTimeoutMs?: number;\n  /** Shared by every session bound to the same box in this process. */\n  gate?: ComputeWakeGate;\n  turn?: ComputeTurnDeps;\n  archiveLimits?: SandboxArchiveLimits | null;\n}\n\nfunction pingRequest(): ControlRequest {\n  return {\n    requestId: randomUUID(),\n    epoch: 0,\n    resourcePolicy: undefined,\n    op: {\n      $case: \"ping\",\n      ping: {\n        nonce: String(Math.floor(Math.random() * Number.MAX_SAFE_INTEGER)),\n        controlReplayWindowMs: \"0\",\n      },\n    },\n  };\n}\n\nfunction workspacePath(path: string): string {\n  const absolute = path.startsWith(\"/\")\n    ? posix.normalize(path)\n    : posix.join(COMPUTE_WORKSPACE_ROOT, normalizeRelativePath(path));\n  if (absolute !== COMPUTE_WORKSPACE_ROOT && !absolute.startsWith(`${COMPUTE_WORKSPACE_ROOT}/`)) {\n    throw new SandboxConfigurationError(`compute manifest path escapes /workspace: ${path}`);\n  }\n  return absolute;\n}\n\nfunction assertSupportedManifest(manifest: Manifest): void {\n  if (manifest.root !== COMPUTE_WORKSPACE_ROOT) {\n    throw new SandboxConfigurationError(`Compute manifest root must be ${COMPUTE_WORKSPACE_ROOT}.`);\n  }\n  if (\n    manifest.users.length > 0 ||\n    manifest.groups.length > 0 ||\n    manifest.extraPathGrants.length > 0\n  ) {\n    throw new SandboxUnsupportedFeatureError(\n      \"Compute sandboxes do not support manifest users, groups, or host path grants.\",\n    );\n  }\n}\n\nexport class ComputeSandboxSession extends SelfhostedSession {\n  override readonly backendId = \"compute\" as const;\n  declare readonly state: SelfhostedSession[\"state\"] & ComputeLiveState;\n  private readonly computeDeps: ComputeSessionDeps;\n  readonly gate: ComputeWakeGate;\n  private readonly archiveLimits: SandboxArchiveLimits | null | undefined;\n\n  constructor(deps: ComputeSessionDeps) {\n    const { state, plane, control } = deps;\n    const resolveConnection = () =>\n      plane.resolveConnection({ workspaceId: state.workspaceId, enrollmentId: state.enrollmentId });\n    const rawRpc = plane.controlRpc({\n      // Nobody received the request: no host serves the sandbox. Wake it at\n      // once (the gate throttles the control service calls) and let the transport retry\n      // the same delivery, keeping its replay identity, until the agent is\n      // back. A request bound to a connection that is no longer the live one\n      // stops without waking anything: its agent is gone, and the operation is\n      // admitted again on the live connection.\n      onNoResponders: async (subject) => {\n        const connection = await resolveConnection().catch(() => null);\n        if (\n          connection &&\n          subjectFor(\n            connection.workspaceId,\n            state.enrollmentId,\n            connection.connectionInstanceId,\n          ) !== subject\n        ) {\n          return false;\n        }\n        await gate.wake();\n        return true;\n      },\n    });\n    const gate =\n      deps.gate ??\n      new ComputeWakeGate({\n        control,\n        sandboxId: state.sandboxId,\n        enrollmentId: state.enrollmentId,\n        resolveConnection,\n        probe: async (connection) => {\n          const res = await rawRpc.request(\n            subjectFor(connection.workspaceId, state.enrollmentId, connection.connectionInstanceId),\n            pingRequest(),\n            { timeoutMs: 5_000 },\n          );\n          return !res.error && res.result?.$case === \"ping\";\n        },\n        readyTimeoutMs: deps.readyTimeoutMs,\n      });\n    const transport = plane.opStreamTransport();\n    const turn = deps.turn ?? {};\n    const resolveOperationAdmission = async (): Promise<SelfhostedOperationAdmission> => {\n      const connection = await gate.admit();\n      return {\n        workspaceId: connection.workspaceId,\n        connectionInstanceId: connection.connectionInstanceId,\n        workspaceRoot: connection.workspaceRoot ?? COMPUTE_WORKSPACE_ROOT,\n        ...(connection.opStream && transport\n          ? {\n              opStream: {\n                transport,\n                ...(turn.opJournal !== undefined ? { journal: turn.opJournal } : {}),\n                // Every compute agent serves OpRelease and reports its\n                // operation inventory; one that does not is refused when its\n                // connection resolves.\n                outputReleaseSupported: true,\n                connectionGeneration: connection.connectionGeneration,\n              },\n            }\n          : {}),\n        operationResourcePolicy: {\n          memoryMaxBytes: null,\n          memoryHighBytes: null,\n          cpuMaxMillicores: null,\n          revision: 0,\n        },\n        operationResourcePolicySupported: false,\n        operationCpuQuotaSupported: false,\n        transactionalFsWriteSupported: connection.transactionalFsWriteSupported,\n        transactionalFsWriteMachineSupported: connection.transactionalFsWriteMachineSupported,\n        browserControlHttpSupported: connection.browserControlHttpSupported,\n        runAsSupported: connection.runAsSupported,\n      };\n    };\n    super({\n      workspaceId: state.workspaceId,\n      agentId: state.enrollmentId,\n      // Every operation re-resolves the live connection (resolveOperationAdmission);\n      // this placeholder only satisfies the static subject shape.\n      connectionInstanceId: \"unresolved\",\n      controlRpc: new ComputeWakingControlRpc(rawRpc, gate, state.enrollmentId),\n      relay: deps.relay,\n      workspaceRoot: COMPUTE_WORKSPACE_ROOT,\n      environment: state.environment,\n      resolveOperationAdmission,\n      // Without waking anything: while a request waits and after a failed\n      // one, to tell a replaced connection (a new instance) from an unreachable\n      // one.\n      liveConnectionInstance: async () => (await resolveConnection())?.connectionInstanceId ?? null,\n      ...(deps.controlTimeoutMs !== undefined ? { timeoutMs: deps.controlTimeoutMs } : {}),\n      ...(deps.execTimeoutMs !== undefined ? { execTimeoutMs: deps.execTimeoutMs } : {}),\n      // Machine-addressed (epoch 0): the sandbox's agent holds no session\n      // route epoch, so a nonzero one would be invented and fence nothing.\n      // Ownership is checked before each request is sent (see\n      // docs/compute-backend.md, \"Request epoch\").\n      ...(turn.terminalScopeId !== undefined ? { terminalScopeId: turn.terminalScopeId } : {}),\n      ...(turn.adoptBackgroundCommand\n        ? { adoptBackgroundCommand: turn.adoptBackgroundCommand }\n        : {}),\n      ...(turn.abandonCommand ? { abandonCommand: turn.abandonCommand } : {}),\n      ...(turn.settleBackgroundCommand\n        ? { settleBackgroundCommand: turn.settleBackgroundCommand }\n        : {}),\n      ...(turn.captureBackgroundCommandOutput\n        ? { captureBackgroundCommandOutput: turn.captureBackgroundCommandOutput }\n        : {}),\n      ...(turn.onOp ? { onOp: turn.onOp } : {}),\n      ...(turn.transientExecEnvironment\n        ? { transientExecEnvironment: turn.transientExecEnvironment }\n        : {}),\n    });\n    // The SDK reads and writes `state` by reference; every session bound to\n    // this box shares the one live state object.\n    (this as unknown as { state: ComputeLiveState }).state = state;\n    this.computeDeps = deps;\n    this.gate = gate;\n    this.archiveLimits = deps.archiveLimits;\n  }\n\n  get sandboxId(): string {\n    return this.state.sandboxId;\n  }\n\n  /** The same box, bound with one turn's journal, adoption, metering and fence. */\n  bindTurn(turn: ComputeTurnDeps): ComputeSandboxSession {\n    return new ComputeSandboxSession({ ...this.computeDeps, gate: this.gate, turn });\n  }\n\n  /** Wait until the sandbox's agent answers, waking the sandbox through the\n   * control service only if no host serves it. */\n  async waitForAgent(): Promise<void> {\n    await this.gate.admit();\n  }\n\n  /** Nothing to start: a request to a sleeping sandbox wakes it. */\n  async start(): Promise<void> {}\n\n  async running(): Promise<boolean> {\n    try {\n      await this.computeDeps.control.get(this.state.sandboxId);\n      return true;\n    } catch (error) {\n      if (isComputeSandboxGone(error)) return false;\n      throw error;\n    }\n  }\n\n  /** Delete the box and revoke its enrollment. Only the end of the box's group\n   * calls this; idleness never does. */\n  async delete(): Promise<void> {\n    await deleteComputeBox(this.computeDeps.control, this.computeDeps.plane, this.state);\n  }\n\n  /** The box keeps running (and sleeping) after a session is dropped. */\n  async close(): Promise<void> {}\n\n  /** A compute sandbox's agent runs as root, so acting as its own account in\n   * place of a requested user would silently elevate: refuse instead. */\n  protected override get runAsRequired(): boolean {\n    return true;\n  }\n\n  /** A manifest applied as another user needs the live agent's `run_as`. */\n  private async assertRunAsAvailable(runAs: string | undefined): Promise<void> {\n    if (runAs && !(await this.liveRunAsSupported())) {\n      throw new SandboxUnsupportedFeatureError(\n        \"This compute sandbox's agent does not support runAs.\",\n      );\n    }\n  }\n\n  private async run(cmd: string, label: string, runAs?: string) {\n    const result = await this.exec({ cmd, maxOutputTokens: 2_000, ...(runAs ? { runAs } : {}) });\n    if (result.exitCode !== 0) {\n      throw new SandboxProviderError(`Compute ${label} failed`, {\n        sandboxId: this.state.sandboxId,\n        exitCode: result.exitCode ?? null,\n        stderr: result.stderr.slice(-1_000),\n      });\n    }\n    return result;\n  }\n\n  private async writeChunked(path: string, bytes: Uint8Array, runAs?: string): Promise<void> {\n    const asUser = runAs ? { runAs } : {};\n    await this.writeFile({\n      path,\n      content: bytes.subarray(0, SELFHOSTED_FILE_CHUNK_BYTES),\n      ...asUser,\n    });\n    for (\n      let offset = SELFHOSTED_FILE_CHUNK_BYTES;\n      offset < bytes.byteLength;\n      offset += SELFHOSTED_FILE_CHUNK_BYTES\n    ) {\n      await this.writeFile({\n        path,\n        content: bytes.subarray(offset, offset + SELFHOSTED_FILE_CHUNK_BYTES),\n        append: true,\n        ...asUser,\n      });\n    }\n  }\n\n  private async applyPermissions(target: string, entry: Entry, runAs?: string): Promise<void> {\n    if (entry.group !== undefined) {\n      throw new SandboxUnsupportedFeatureError(\n        \"Compute sandboxes do not materialize named manifest groups.\",\n      );\n    }\n    if (entry.permissions === undefined) return;\n    const mode = (new Permissions(entry.permissions).toMode() & 0o777).toString(8);\n    await this.run(`chmod ${mode} -- ${shellQuote(target)}`, \"permission change\", runAs);\n  }\n\n  private async materialize(path: string, entry: Entry, runAs?: string): Promise<void> {\n    const target = workspacePath(path);\n    if (entry.type === \"dir\") {\n      await this.run(`mkdir -p -- ${shellQuote(target)}`, \"directory materialization\", runAs);\n      for (const [childPath, child] of Object.entries(entry.children ?? {})) {\n        await this.materialize(posix.join(path, childPath), child, runAs);\n      }\n      await this.applyPermissions(target, entry, runAs);\n      return;\n    }\n    if (entry.type === \"file\") {\n      const content =\n        typeof entry.content === \"string\" ? new TextEncoder().encode(entry.content) : entry.content;\n      await this.writeChunked(target, content, runAs);\n      await this.applyPermissions(target, entry, runAs);\n      return;\n    }\n    if (entry.type === \"git_repo\") {\n      const temp = `/tmp/opengeni-git-${randomUUID()}`;\n      const subpath = entry.subpath ? normalizeRelativePath(entry.subpath) : null;\n      const script = [\n        \"set -eu\",\n        `rm -rf -- ${shellQuote(temp)} ${shellQuote(target)}`,\n        `mkdir -p -- ${shellQuote(posix.dirname(target))}`,\n        `git clone --no-checkout --depth=1 ${shellQuote(entry.repo)} ${shellQuote(temp)}`,\n        ...(entry.ref\n          ? [\n              `git -C ${shellQuote(temp)} fetch --depth=1 origin ${shellQuote(entry.ref)}`,\n              `git -C ${shellQuote(temp)} checkout --detach FETCH_HEAD`,\n            ]\n          : [`git -C ${shellQuote(temp)} checkout --detach HEAD`]),\n        subpath\n          ? `mkdir -p -- ${shellQuote(target)} && cp -a -- ${shellQuote(`${temp}/${subpath}/.`)} ${shellQuote(target)}`\n          : `mv -- ${shellQuote(temp)} ${shellQuote(target)}`,\n        subpath ? `rm -rf -- ${shellQuote(temp)}` : \":\",\n      ].join(\"\\n\");\n      await this.run(script, \"git repository materialization\", runAs);\n      await this.applyPermissions(target, entry, runAs);\n      return;\n    }\n    // Host-local sources (local_file, local_dir) and mounts would read the\n    // Opengeni server's own filesystem; a remote box never receives them.\n    throw new SandboxUnsupportedFeatureError(\n      `Compute sandboxes do not support manifest entry type \"${entry.type}\".`,\n    );\n  }\n\n  override async materializeEntry(args: MaterializeEntryArgs): Promise<void> {\n    await this.assertRunAsAvailable(args.runAs);\n    await this.materialize(args.path, args.entry, args.runAs);\n    this.state.manifest = mergeManifestEntryDelta(this.state.manifest, args.path, args.entry);\n  }\n\n  async applyManifest(manifest: Manifest, runAs?: string): Promise<void> {\n    await this.assertRunAsAvailable(runAs);\n    assertSupportedManifest(manifest);\n    for (const [path, entry] of Object.entries(manifest.entries)) {\n      await this.materialize(path, entry, runAs);\n    }\n    const nextManifest = mergeManifestDelta(this.state.manifest, manifest);\n    this.state.environment = await mergeMaterializedEnvironment(\n      this.state.manifest,\n      nextManifest,\n      this.state.environment,\n    );\n    this.state.manifest = nextManifest;\n  }\n\n  private resolvedArchiveLimits(options?: WorkspaceArchiveOptions) {\n    return resolveSandboxArchiveLimits(\n      options?.archiveLimits === undefined ? this.archiveLimits : options.archiveLimits,\n    );\n  }\n\n  /** A portable tar of /workspace. Compute persists the box itself; this\n   * exists only to move a workspace to another backend. */\n  async persistWorkspaceTar(): Promise<Uint8Array> {\n    const archivePath = `${COMPUTE_PRIVATE_ROOT}/capture-${randomUUID()}.tar`;\n    const excludes = [\n      ...this.state.manifest.ephemeralPersistencePaths(),\n      \".opengeni-old-*\",\n      \".opengeni-restore-*\",\n    ].sort();\n    const excludeArgs = excludes.flatMap((path) => [\n      shellQuote(`--exclude=${path}`),\n      shellQuote(`--exclude=./${path}`),\n    ]);\n    const script = String.raw`set -eu\nmkdir -p ${shellQuote(COMPUTE_PRIVATE_ROOT)}\ncd ${shellQuote(COMPUTE_WORKSPACE_ROOT)}\nif find . -xdev -mindepth 1 \\( -type p -o -type b -o -type c \\) -print -quit | grep -q .; then\n  printf 'workspace contains a non-portable fifo or device\\n' >&2\n  exit 65\nfi\ntar ${excludeArgs.join(\" \")} --sort=name --mtime='@0' --owner=0 --group=0 --numeric-owner --hard-dereference --format=gnu -cf ${shellQuote(archivePath)} .`;\n    try {\n      const result = await this.exec({ cmd: script, maxOutputTokens: 1_000 });\n      if (result.exitCode !== 0) {\n        throw new SandboxArchiveError(\"Compute workspace archive capture failed\", {\n          sandboxId: this.state.sandboxId,\n          exitCode: result.exitCode ?? null,\n        });\n      }\n      const bytes = await this.readFile({ path: archivePath });\n      const limits = this.resolvedArchiveLimits();\n      if (limits && limits.maxInputBytes !== null && bytes.byteLength > limits.maxInputBytes) {\n        throw new SandboxArchiveError(\"Compute workspace archive exceeds maxInputBytes\", {\n          archiveBytes: bytes.byteLength,\n          maxInputBytes: limits.maxInputBytes,\n        });\n      }\n      return bytes;\n    } finally {\n      await this.exec({ cmd: `rm -f -- ${shellQuote(archivePath)}` }).catch(() => undefined);\n    }\n  }\n\n  async persistWorkspace(): Promise<Uint8Array> {\n    return await this.persistWorkspaceTar();\n  }\n\n  async hydrateWorkspace(\n    data: WorkspaceArchiveData,\n    options: WorkspaceArchiveOptions = {},\n  ): Promise<void> {\n    const bytes = await toUint8Array(data);\n    const limits = this.resolvedArchiveLimits(options);\n    if (limits && limits.maxInputBytes !== null && bytes.byteLength > limits.maxInputBytes) {\n      throw new SandboxArchiveError(\"Compute workspace archive exceeds maxInputBytes\", {\n        archiveBytes: bytes.byteLength,\n        maxInputBytes: limits.maxInputBytes,\n      });\n    }\n    const archivePath = `${COMPUTE_PRIVATE_ROOT}/restore-${randomUUID()}.tar`;\n    const stagingPath = `${COMPUTE_WORKSPACE_ROOT}/.opengeni-restore-${randomUUID()}`;\n    const backupPath = `${COMPUTE_WORKSPACE_ROOT}/.opengeni-old-${randomUUID()}`;\n    await this.run(`mkdir -p -- ${shellQuote(COMPUTE_PRIVATE_ROOT)}`, \"archive staging\");\n    await this.writeChunked(archivePath, bytes);\n    const excluded = [...this.state.manifest.ephemeralPersistencePaths()].sort().join(\"\\n\");\n    const limitArg = (value: number | null | undefined) =>\n      value === null || value === undefined ? \"-1\" : String(value);\n    const command = [\n      \"python3\",\n      \"-c\",\n      shellQuote(archiveRestoreScript()),\n      shellQuote(archivePath),\n      shellQuote(COMPUTE_WORKSPACE_ROOT),\n      shellQuote(stagingPath),\n      shellQuote(backupPath),\n      shellQuote(limitArg(limits?.maxMembers)),\n      shellQuote(limitArg(limits?.maxExtractedBytes)),\n      shellQuote(excluded),\n    ].join(\" \");\n    try {\n      const result = await this.exec({ cmd: command, maxOutputTokens: 2_000 });\n      if (result.exitCode !== 0) {\n        throw new SandboxArchiveError(\"Compute workspace archive restore failed\", {\n          sandboxId: this.state.sandboxId,\n          exitCode: result.exitCode ?? null,\n          stderr: result.stderr.slice(-1_000),\n        });\n      }\n      this.state.workspaceReady = true;\n    } finally {\n      await this.exec({\n        cmd: `rm -rf -- ${shellQuote(archivePath)} ${shellQuote(stagingPath)} ${shellQuote(backupPath)}`,\n      }).catch(() => undefined);\n    }\n  }\n\n  override async serializeSessionState(): Promise<never> {\n    throw new Error(\n      \"compute sessions serialize through ComputeSandboxClient.serializeSessionState\",\n    );\n  }\n}\n\nexport async function deleteComputeBox(\n  control: Pick<ComputeControlClient, \"delete\">,\n  plane: Pick<ComputeAgentPlane, \"revokeEnrollment\">,\n  state: Pick<ComputeSessionState, \"sandboxId\" | \"workspaceId\" | \"enrollmentId\">,\n): Promise<void> {\n  await control.delete(state.sandboxId);\n  await plane.revokeEnrollment({\n    workspaceId: state.workspaceId,\n    enrollmentId: state.enrollmentId,\n  });\n}\n\n/**\n * Undo a create whose sandbox nothing durable names: delete the sandbox its\n * request made, if any, then revoke the enrollment it would run under.\n *\n * The control service request id of a compute create is its enrollment id, and the\n * enrollment is written before the create is sent. It is revoked only once\n * the control service proves no sandbox exists or can still appear for that request.\n * Returns whether the enrollment was revoked; false (or a thrown error) leaves\n * the sandbox, if one appears, to the orphan sweep (./orphans.ts), and an\n * enrollment that never gets a sandbox to the worker's stale-enrollment revoke.\n */\nexport async function discardComputeCreate(\n  control: Pick<ComputeControlClient, \"lookupRequest\" | \"delete\">,\n  plane: Pick<ComputeAgentPlane, \"revokeEnrollment\">,\n  input: { workspaceId: string; enrollmentId: string; createdAtMs: number },\n  nowMs: number = Date.now(),\n): Promise<boolean> {\n  const found = await control.lookupRequest(input.enrollmentId);\n  if (found.state === \"live\") {\n    await control.delete(found.sandbox.id);\n  } else if (found.state === \"none\" && nowMs - input.createdAtMs < UNSEEN_CREATE_SETTLE_MS) {\n    return false;\n  }\n  await plane.revokeEnrollment({\n    workspaceId: input.workspaceId,\n    enrollmentId: input.enrollmentId,\n  });\n  return true;\n}\n\nexport interface ComputeSandboxClientOptions {\n  control: ComputeControlClient;\n  /** Resolved lazily: the registry builds clients before the host installs it. */\n  plane: () => ComputeAgentPlane;\n  relay: SelfhostedRelayConfig;\n  /** This deployment's gateway URL. Every sandbox it creates is tagged with\n   * it, so the orphan sweep only ever considers this deployment's sandboxes. */\n  gateway: string;\n  image: string | null;\n  vcpus: number;\n  memoryMib: number;\n  memoryRequestMib?: number;\n  cpuRequestMillis?: number;\n  /** How long a new sandbox's disk is; omitted, its image's length. */\n  diskMib?: number;\n  /** Start the agent with its own virtual desktop (the desktop image). */\n  desktop: boolean;\n  readyTimeoutMs: number;\n  controlTimeoutMs?: number;\n  execTimeoutMs?: number;\n  environment?: Record<string, string>;\n}\n\nfunction parseStateString(value: unknown, field: string): string {\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new SandboxConfigError(\"compute\", `persisted compute state has no ${field}`);\n  }\n  return value;\n}\n\nexport class ComputeSandboxClient {\n  readonly backendId = \"compute\" as const;\n  readonly supportsDefaultOptions = false;\n  private readonly options: ComputeSandboxClientOptions;\n\n  constructor(options: ComputeSandboxClientOptions) {\n    this.options = { ...options, environment: { ...(options.environment ?? {}) } };\n  }\n\n  private session(state: ComputeLiveState, archiveLimits?: SandboxArchiveLimits | null) {\n    return new ComputeSandboxSession({\n      state,\n      control: this.options.control,\n      plane: this.options.plane(),\n      relay: this.options.relay,\n      readyTimeoutMs: this.options.readyTimeoutMs,\n      ...(this.options.controlTimeoutMs !== undefined\n        ? { controlTimeoutMs: this.options.controlTimeoutMs }\n        : {}),\n      ...(this.options.execTimeoutMs !== undefined\n        ? { execTimeoutMs: this.options.execTimeoutMs }\n        : {}),\n      ...(archiveLimits !== undefined ? { archiveLimits } : {}),\n    });\n  }\n\n  /**\n   * Create one sandbox: make its agent's enrollment, ask the control service for the\n   * sandbox with an init naming that agent (idempotent by request id, retried\n   * with the same id and body), then wait until the host has opened the\n   * agent's session at the gateway and the agent answers. The lease identity\n   * arrives as `opengeniCreateIdentity` in the second argument.\n   *\n   * The request id is the enrollment id, and the enrollment is written before\n   * the create is sent. The sandbox carries its deployment, workspace, group\n   * and enrollment in its metadata, so one whose cleanup never finished is\n   * found and removed by the orphan sweep from the control service's own inventory.\n   */\n  async create(\n    args?: SandboxClientCreateArgs,\n    options?: Record<string, unknown> & { opengeniCreateIdentity?: ComputeCreateIdentity },\n  ): Promise<ComputeSandboxSession> {\n    const identity = options?.opengeniCreateIdentity;\n    if (!identity) {\n      throw new SandboxConfigError(\n        \"compute\",\n        \"creating a compute sandbox needs its lease identity (account, workspace, sandbox group)\",\n      );\n    }\n    const { opengeniCreateIdentity: _identity, ...manifestOptions } = options;\n    const normalized = normalizeSandboxClientCreateArgs(args as never, manifestOptions);\n    if (normalized.snapshot) {\n      throw new SandboxUnsupportedFeatureError(\n        \"Compute sandboxes restore workspaces from portable archives only.\",\n      );\n    }\n    const manifest = normalized.manifest;\n    assertSupportedManifest(manifest);\n    const environment = {\n      ...(this.options.environment ?? {}),\n      ...(await manifest.resolveEnvironment()),\n    };\n    const plane = this.options.plane();\n    const enrollmentId = randomUUID();\n    const requestId = enrollmentId;\n    await plane.createEnrollment({\n      accountId: identity.accountId,\n      workspaceId: identity.workspaceId,\n      enrollmentId,\n      sandboxGroupId: identity.sandboxGroupId,\n      hasDisplay: this.options.desktop,\n      workspaceRoot: COMPUTE_WORKSPACE_ROOT,\n    });\n    const body: ComputeCreateRequest = {\n      request_id: requestId,\n      ...(this.options.image ? { image: this.options.image } : {}),\n      vcpus: this.options.vcpus,\n      memory_mib: this.options.memoryMib,\n      ...(this.options.memoryRequestMib !== undefined\n        ? { memory_request_mib: this.options.memoryRequestMib }\n        : {}),\n      ...(this.options.cpuRequestMillis !== undefined\n        ? { cpu_request_millis: this.options.cpuRequestMillis }\n        : {}),\n      ...(this.options.diskMib !== undefined ? { disk_mib: this.options.diskMib } : {}),\n      metadata: {\n        [COMPUTE_METADATA.gateway]: this.options.gateway,\n        [COMPUTE_METADATA.workspaceId]: identity.workspaceId,\n        [COMPUTE_METADATA.sandboxGroupId]: identity.sandboxGroupId,\n        [COMPUTE_METADATA.enrollmentId]: enrollmentId,\n      },\n      init: {\n        env_vars: environment,\n        default_user: \"root\",\n        default_workdir: COMPUTE_WORKSPACE_ROOT,\n        agent: {\n          workspace_id: identity.workspaceId,\n          agent_id: enrollmentId,\n          workspace_root: COMPUTE_WORKSPACE_ROOT,\n          desktop: this.options.desktop,\n        },\n      },\n    };\n    let view;\n    try {\n      view = await this.options.control.create(body);\n    } catch (error) {\n      // The create may have taken effect without its answer reaching us. If\n      // the control service cannot yet prove there is no sandbox, the orphan sweep\n      // finishes the cleanup.\n      await discardComputeCreate(this.options.control, plane, {\n        workspaceId: identity.workspaceId,\n        enrollmentId,\n        createdAtMs: Date.now(),\n      }).catch(() => false);\n      throw error;\n    }\n    const state: ComputeLiveState = {\n      stateVersion: COMPUTE_STATE_VERSION,\n      sandboxId: view.id,\n      enrollmentId,\n      workspaceId: identity.workspaceId,\n      accountId: identity.accountId,\n      sandboxGroupId: identity.sandboxGroupId,\n      requestId,\n      image: view.image || this.options.image,\n      manifest,\n      environment,\n      workspacePersistence: \"tar\",\n      workspaceReady: false,\n      agentId: enrollmentId,\n      instanceId: view.id,\n    };\n    const session = this.session(state, normalized.archiveLimits);\n    try {\n      await session.gate.waitForAgent(Date.now() + this.options.readyTimeoutMs);\n      if (Object.keys(manifest.entries).length > 0) {\n        for (const [path, entry] of Object.entries(manifest.entries)) {\n          await session.materializeEntry({ path, entry });\n        }\n      }\n    } catch (error) {\n      // Nothing durable names this sandbox yet: do not leave it behind. A\n      // failed delete leaves it to the orphan sweep.\n      await deleteComputeBox(this.options.control, plane, state).catch(() => undefined);\n      throw error;\n    }\n    return session;\n  }\n\n  async resume(\n    state: ComputeSessionState,\n    options: SandboxClientResumeOptions = {},\n  ): Promise<ComputeSandboxSession> {\n    return await this.resumeExact(state, options);\n  }\n\n  /** Re-address the same box. It may be asleep: the first operation wakes it. */\n  async resumeExact(\n    state: ComputeSessionState,\n    options: SandboxClientResumeOptions = {},\n  ): Promise<ComputeSandboxSession> {\n    try {\n      await this.options.control.get(state.sandboxId);\n    } catch (error) {\n      if (isComputeSandboxGone(error)) {\n        throw new SandboxExactResumeInstanceUnavailableError(\"compute\", state.sandboxId);\n      }\n      throw error;\n    }\n    const live: ComputeLiveState = {\n      ...state,\n      agentId: state.enrollmentId,\n      instanceId: state.sandboxId,\n    };\n    return this.session(live, options.archiveLimits);\n  }\n\n  /** Delete the sandbox, then revoke its enrollment. A failure throws with\n   * the enrollment still active, so the caller's retry (or the orphan sweep)\n   * finishes it. Any other sandbox of the group is the orphan sweep's. */\n  async delete(state: ComputeSessionState): Promise<void> {\n    await deleteComputeBox(this.options.control, this.options.plane(), state);\n  }\n\n  async canPersistOwnedSessionState(): Promise<boolean> {\n    return true;\n  }\n\n  async canReusePreservedOwnedSession(): Promise<boolean> {\n    return false;\n  }\n\n  async serializeSessionState(state: ComputeSessionState): Promise<Record<string, unknown>> {\n    return {\n      stateVersion: COMPUTE_STATE_VERSION,\n      sandboxId: state.sandboxId,\n      enrollmentId: state.enrollmentId,\n      workspaceId: state.workspaceId,\n      accountId: state.accountId,\n      sandboxGroupId: state.sandboxGroupId,\n      requestId: state.requestId,\n      image: state.image,\n      manifest: serializeManifestRecord(state.manifest),\n      environment: serializeRuntimeEnvironmentForPersistence(state.manifest, state.environment),\n      workspacePersistence: \"tar\",\n      workspaceReady: state.workspaceReady,\n    };\n  }\n\n  async deserializeSessionState(value: Record<string, unknown>): Promise<ComputeSessionState> {\n    if (value.stateVersion !== COMPUTE_STATE_VERSION) {\n      throw new SandboxConfigError(\n        \"compute\",\n        `unsupported persisted compute state version: ${String(value.stateVersion)}`,\n      );\n    }\n    const manifest = deserializeManifest(\n      value.manifest && typeof value.manifest === \"object\" && !Array.isArray(value.manifest)\n        ? (value.manifest as Record<string, unknown>)\n        : undefined,\n    );\n    if (manifest.root !== COMPUTE_WORKSPACE_ROOT) {\n      throw new SandboxConfigError(\n        \"compute\",\n        `persisted manifest root must be ${COMPUTE_WORKSPACE_ROOT}`,\n      );\n    }\n    return {\n      stateVersion: COMPUTE_STATE_VERSION,\n      sandboxId: parseStateString(value.sandboxId, \"sandboxId\"),\n      enrollmentId: parseStateString(value.enrollmentId, \"enrollmentId\"),\n      workspaceId: parseStateString(value.workspaceId, \"workspaceId\"),\n      accountId: parseStateString(value.accountId, \"accountId\"),\n      sandboxGroupId: parseStateString(value.sandboxGroupId, \"sandboxGroupId\"),\n      requestId: parseStateString(value.requestId, \"requestId\"),\n      image: typeof value.image === \"string\" ? value.image : null,\n      manifest,\n      environment: await rehydratePersistedEnvironmentForRuntime(\n        manifest,\n        value.environment &&\n          typeof value.environment === \"object\" &&\n          !Array.isArray(value.environment)\n          ? (value.environment as Record<string, string>)\n          : undefined,\n        this.options.environment,\n      ),\n      workspacePersistence: \"tar\",\n      workspaceReady: value.workspaceReady === true,\n    };\n  }\n}\n","import {\n  ConnectionConfig,\n  Sandbox as ProviderSandbox,\n  SandboxApiException,\n  createDefaultAdapterFactory,\n  type AdapterFactory,\n  type ConnectionConfigOptions,\n  type CreateSandboxRequest,\n  type Endpoint,\n  type Sandboxes,\n} from \"@alibaba-group/opensandbox\";\nimport { confinedFileReadCommand, parseConfinedFileRead } from \"../confined-file-read\";\nimport {\n  Manifest,\n  Permissions,\n  SandboxArchiveError,\n  SandboxConfigurationError,\n  SandboxExposedPortUnavailableError,\n  SandboxProviderError,\n  SandboxUnsupportedFeatureError,\n  SandboxWorkspaceReadNotFoundError,\n  normalizeRelativePath,\n  normalizeSandboxClientCreateArgs,\n  recordExposedPortEndpoint,\n  resolveSandboxArchiveLimits,\n  validateSandboxArchiveLimits,\n  type Entry,\n  type ExecCommandArgs,\n  type ExposedPortEndpoint,\n  type MaterializeEntryArgs,\n  type SandboxArchiveLimits,\n  type SandboxClientCreateArgs,\n  type SandboxClientResumeOptions,\n  type SandboxDirectoryEntry,\n  type SandboxExecResult,\n  type SandboxSessionState,\n  type ViewImageArgs,\n  type WorkspaceArchiveData,\n  type WorkspaceArchiveOptions,\n  type WriteStdinArgs,\n} from \"@openai/agents/sandbox\";\nimport {\n  deserializeManifest,\n  elapsedSeconds,\n  formatExecResponse,\n  imageOutputFromBytes,\n  mergeManifestDelta,\n  mergeManifestEntryDelta,\n  mergeMaterializedEnvironment,\n  rehydratePersistedEnvironmentForRuntime,\n  serializeManifestRecord,\n  serializeRuntimeEnvironmentForPersistence,\n  shellQuote,\n  toUint8Array,\n  truncateOutput,\n} from \"@openai/agents-core/sandbox/internal\";\nimport { createHash, randomUUID } from \"node:crypto\";\nimport { lstat, readFile as readLocalFile, readdir } from \"node:fs/promises\";\nimport { posix } from \"node:path\";\nimport { SandboxConfigError, SandboxExactResumeInstanceUnavailableError } from \"../errors\";\nimport {\n  nextDurableOpId,\n  notifyRemoteOperationNotDispatched,\n  notifyRemoteOperationTransportSelected,\n  type RemoteOperationObservation,\n} from \"../op-correlation\";\nimport { parseOpenSandboxSignedUriPath, redactOpenSandboxSignedUriPath } from \"../stream-port\";\nimport type { RuntimeMetricsHooks } from \"../../metrics\";\nimport {\n  SynchronousCommandOutcomeUnknownError,\n  type SynchronousCommandPage,\n} from \"../synchronous-command\";\nimport {\n  OpenSandboxCommandStreamError,\n  OpenSandboxCommandDispatchError,\n  withOpenSandboxCommandDispatchProof,\n  withOpenSandboxCommandStreamProof,\n} from \"./opensandbox-command-stream\";\nimport { errorMessage } from \"@opengeni/contracts/values\";\n\nconst WORKSPACE_ROOT = \"/workspace\";\nconst PRIVATE_ROOT = \"/tmp/opengeni-private\";\nconst BROWSERD_ROOT = \"/tmp/opengeni-browserd\";\nconst ALLOWED_PRIVATE_ROOTS = [PRIVATE_ROOT, BROWSERD_ROOT] as const;\nconst DEFAULT_EXEC_YIELD_TIME_MS = 10_000;\n/** Lifecycle `commands.run` often spends ~10s on the control plane even for\n * `echo`. Channel-A file/git reads use a 10–20s yield and must not be\n * classified as retained processes just because that round-trip is slow. */\nconst COMMAND_API_SETTLE_GRACE_MS = 30_000;\nconst DEFAULT_WRITE_STDIN_YIELD_TIME_MS = 250;\nconst OPENSANDBOX_STATE_VERSION = 1;\n\nexport type OpenSandboxApplyDiff = (\n  input: string,\n  diff: string,\n  mode?: \"default\" | \"create\",\n) => string;\nlet injectedApplyDiff: OpenSandboxApplyDiff | undefined;\n\nexport function setOpenSandboxApplyDiff(fn: OpenSandboxApplyDiff): void {\n  injectedApplyDiff = fn;\n}\n\nexport interface OpenSandboxEditor {\n  createFile(\n    operation: { path: string; diff: string },\n    context?: unknown,\n  ): Promise<{ output?: string } | void>;\n  updateFile(\n    operation: { path: string; diff: string; moveTo?: string },\n    context?: unknown,\n  ): Promise<{ output?: string } | void>;\n  deleteFile(operation: { path: string }, context?: unknown): Promise<{ output?: string } | void>;\n}\n\nexport type OpenSandboxClientOptions = {\n  baseUrl: string;\n  apiKey: string;\n  image: string;\n  ttlSeconds: number;\n  useServerProxy: boolean;\n  /** OSEP-0011 signed URI-mode Channel B. Independent of `useServerProxy`. */\n  signedEndpoints?: boolean;\n  signedEndpointTtlSeconds?: number;\n  /** Laptop/port-forward rewrite for Channel B only. Preserves the signed path. */\n  channelBPublicBaseUrl?: string;\n  poolRef?: string;\n  readyTimeoutSeconds: number;\n  resourceLimits: Record<string, string>;\n  resourceRequests: Record<string, string>;\n  environment?: Record<string, string>;\n  exposedPorts?: number[];\n  adapterFactory?: AdapterFactory;\n  metrics?: RuntimeMetricsHooks;\n};\n\nexport interface OpenSandboxSessionState extends SandboxSessionState {\n  stateVersion: typeof OPENSANDBOX_STATE_VERSION;\n  sandboxId: string;\n  manifest: Manifest;\n  environment: Record<string, string>;\n  image: string;\n  poolRef: string | null;\n  providerBindingHash: string;\n  workspacePersistence: \"tar\";\n  configuredExposedPorts: number[];\n  workspaceReady: boolean;\n  expiresAt: string | null;\n}\n\ntype ProcessEvent = { stream: \"stdout\" | \"stderr\"; text: string; commandOutput?: false };\ntype ProcessOutcome = {\n  exitCode: number | null;\n  error?: unknown;\n  uncertain?: boolean;\n};\ntype RetainedProcess = {\n  opId: string;\n  sessionId: number | null;\n  /** The launch client, never a later reconnect or active route. */\n  provider: ProviderSandbox | null;\n  /** Physical terminal proof survives native alias retirement. It neither\n   * consumes output nor proves that the event stream was complete. */\n  physicalOutcome: { exitCode: number; error?: unknown } | null;\n  failureCause?: unknown;\n  startedAt: number;\n  events: ProcessEvent[];\n  cursor: number;\n  executionId: string | null;\n  executionIdReady: Promise<string | null>;\n  resolveExecutionId: (value: string | null) => void;\n  completed: Promise<ProcessOutcome>;\n  settled: boolean;\n  transportUncertain: boolean;\n  /** Status can prove physical exit, never reconstruct a lost event stream. */\n  outputUnavailable: boolean;\n  outputCursor: { stdout: number; stderr: number };\n};\n\nfunction canonicalBaseUrl(value: string): string {\n  const url = new URL(value);\n  url.hash = \"\";\n  url.search = \"\";\n  url.pathname = url.pathname.replace(/\\/+$/u, \"\");\n  return url.toString().replace(/\\/$/u, \"\");\n}\n\nfunction providerBindingHash(baseUrl: string): string {\n  return createHash(\"sha256\").update(canonicalBaseUrl(baseUrl)).digest(\"hex\");\n}\n\nfunction connectionOptions(input: OpenSandboxClientOptions): ConnectionConfigOptions {\n  return {\n    domain: canonicalBaseUrl(input.baseUrl),\n    apiKey: input.apiKey,\n    requestTimeoutSeconds: input.readyTimeoutSeconds,\n    useServerProxy: input.useServerProxy,\n    disableMetrics: true,\n  };\n}\n\nasync function withLifecycle<T>(\n  options: OpenSandboxClientOptions,\n  fn: (sandboxes: Sandboxes) => Promise<T>,\n): Promise<T> {\n  const connection = new ConnectionConfig(connectionOptions(options)).withTransportIfMissing();\n  try {\n    const factory = options.adapterFactory ?? createDefaultAdapterFactory();\n    const stack = factory.createLifecycleStack({\n      connectionConfig: connection,\n      lifecycleBaseUrl: connection.getBaseUrl(),\n    });\n    return await fn(stack.sandboxes);\n  } finally {\n    await connection.closeTransport();\n  }\n}\n\nfunction isNotFound(error: unknown): boolean {\n  return error instanceof SandboxApiException && error.statusCode === 404;\n}\n\nfunction assertSupportedProviderState(\n  info: { status?: { state?: unknown } },\n  sandboxId: string,\n): void {\n  const state = info.status?.state;\n  if (state !== \"Running\" && state !== \"Creating\") {\n    throw new SandboxExactResumeInstanceUnavailableError(\"opensandbox\", sandboxId);\n  }\n}\n\nfunction normalizeConfiguredPorts(ports: readonly number[] | undefined): number[] {\n  return [\n    ...new Set(\n      (ports ?? []).filter((port) => Number.isInteger(port) && port > 0 && port <= 65_535),\n    ),\n  ].sort((left, right) => left - right);\n}\n\nfunction assertNoSnapshot(args: ReturnType<typeof normalizeSandboxClientCreateArgs>): void {\n  if (args.snapshot && (args.snapshot as { type?: unknown }).type !== \"noop\") {\n    throw new SandboxUnsupportedFeatureError(\n      \"OpenSandbox v1 uses Opengeni portable workspace archives and does not accept SDK snapshot specs.\",\n    );\n  }\n}\n\nfunction recordSignedEndpointMetric(\n  metrics: RuntimeMetricsHooks | undefined,\n  input: { outcome: \"minted\" | \"mint_failed\" | \"host_fetch_unauthorized\"; port: number },\n): void {\n  try {\n    metrics?.onOpenSandboxSignedEndpoint?.(input);\n  } catch {\n    /* metrics must not affect Channel B */\n  }\n}\n\nfunction createRequest(\n  options: OpenSandboxClientOptions,\n  environment: Record<string, string>,\n): CreateSandboxRequest {\n  const common: CreateSandboxRequest = {\n    timeout: options.ttlSeconds,\n    env: environment,\n    metadata: { opengeni: \"true\", backend: \"opensandbox\" },\n    resourceLimits: options.resourceLimits,\n    resourceRequests: options.resourceRequests,\n    ...(options.signedEndpoints ? { secureAccess: true } : {}),\n  };\n  if (options.poolRef) {\n    return {\n      ...common,\n      extensions: { poolRef: options.poolRef },\n    };\n  }\n  return {\n    ...common,\n    image: { uri: options.image },\n    entrypoint: [\"tail\", \"-f\", \"/dev/null\"],\n  };\n}\n\nfunction parseStateString(value: unknown, field: string): string {\n  if (typeof value !== \"string\" || value.trim().length === 0) {\n    throw new SandboxConfigError(\"opensandbox\", `persisted OpenSandbox ${field} is invalid`);\n  }\n  return value;\n}\n\nfunction parseOptionalString(value: unknown, field: string): string | null {\n  if (value === null || value === undefined) return null;\n  return parseStateString(value, field);\n}\n\n/** An existing sandbox belongs to the OpenSandbox server that created it; that\n * binding is the only configuration a persisted sandbox must still match.\n * Image and pool are creation inputs recorded in the state: a deployment that\n * changes them affects new sandboxes only. A live sandbox created under the\n * previous values must stay resumable, serializable and deletable, otherwise\n * an upgrade strands it. The session verifies the provider-reported image and\n * pool against these recorded values, not against the current configuration. */\nfunction assertStateBoundToProvider(\n  state: OpenSandboxSessionState,\n  options: OpenSandboxClientOptions,\n): void {\n  if (state.providerBindingHash !== providerBindingHash(options.baseUrl)) {\n    throw new SandboxConfigError(\n      \"opensandbox\",\n      \"persisted OpenSandbox provider binding does not match the configured base URL\",\n    );\n  }\n}\n\nfunction isAllowedPrivatePath(absolute: string): boolean {\n  return ALLOWED_PRIVATE_ROOTS.some((root) => absolute === root || absolute.startsWith(`${root}/`));\n}\n\nfunction workspacePath(path: string, options: { allowPrivate?: boolean } = {}): string {\n  const raw = path.trim();\n  if (raw.includes(\"\\0\") || raw.includes(\"\\\\\")) {\n    throw new SandboxConfigurationError(`Invalid OpenSandbox path: ${path}`);\n  }\n  const absolute = raw.startsWith(\"/\") ? posix.normalize(raw) : posix.join(WORKSPACE_ROOT, raw);\n  const allowed =\n    absolute === WORKSPACE_ROOT ||\n    absolute.startsWith(`${WORKSPACE_ROOT}/`) ||\n    (options.allowPrivate === true && isAllowedPrivatePath(absolute));\n  if (!allowed) {\n    throw new SandboxConfigurationError(\n      `OpenSandbox path must stay within ${WORKSPACE_ROOT}${options.allowPrivate ? ` or ${ALLOWED_PRIVATE_ROOTS.join(\" or \")}` : \"\"}: ${path}`,\n    );\n  }\n  return absolute;\n}\n\nfunction logicalWorkspacePath(path: string): string {\n  const absolute = workspacePath(path);\n  return absolute === WORKSPACE_ROOT ? \"\" : absolute.slice(WORKSPACE_ROOT.length + 1);\n}\n\nfunction assertRunAsUnsupported(runAs: string | undefined): void {\n  if (runAs?.trim()) {\n    throw new SandboxUnsupportedFeatureError(\n      `OpenSandbox v1 cannot prove the uid/gid mapping for runAs=\"${runAs.trim()}\"; the operation was not run.`,\n    );\n  }\n}\n\nfunction commandForArgs(args: ExecCommandArgs): string {\n  const requestedShell = args.shell?.trim();\n  if (!requestedShell) return args.cmd;\n  return `${shellQuote(requestedShell)}${args.login === false ? \"\" : \" -l\"} -c ${shellQuote(args.cmd)}`;\n}\n\nfunction delay(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));\n}\n\nfunction consumeProcessOutput(process: RetainedProcess): {\n  output: string;\n  stdout: string;\n  stderr: string;\n  commandStdout: string;\n  commandStderr: string;\n  outputCursor: {\n    expected: { stdout: number; stderr: number };\n    next: { stdout: number; stderr: number };\n  };\n} {\n  const events = process.events.slice(process.cursor);\n  process.cursor = process.events.length;\n  const commandStdout = events\n    .filter((entry) => entry.stream === \"stdout\" && entry.commandOutput !== false)\n    .map((entry) => entry.text)\n    .join(\"\");\n  const commandStderr = events\n    .filter((entry) => entry.stream === \"stderr\" && entry.commandOutput !== false)\n    .map((entry) => entry.text)\n    .join(\"\");\n  const expected = { ...process.outputCursor };\n  process.outputCursor.stdout += Buffer.byteLength(commandStdout);\n  process.outputCursor.stderr += Buffer.byteLength(commandStderr);\n  return {\n    output: events.map((entry) => entry.text).join(\"\"),\n    stdout: events\n      .filter((entry) => entry.stream === \"stdout\")\n      .map((entry) => entry.text)\n      .join(\"\"),\n    stderr: events\n      .filter((entry) => entry.stream === \"stderr\")\n      .map((entry) => entry.text)\n      .join(\"\"),\n    commandStdout,\n    commandStderr,\n    outputCursor: { expected, next: { ...process.outputCursor } },\n  };\n}\n\nfunction archiveLimitArg(value: number | null): string {\n  return value === null ? \"-1\" : String(value);\n}\n\nexport function archiveRestoreScript(): string {\n  return String.raw`\nimport os, shutil, sys, tarfile\narchive, root, staging, backup, max_members, max_bytes, excluded_raw = sys.argv[1:]\nmax_members = int(max_members)\nmax_bytes = int(max_bytes)\nexcluded = [p for p in excluded_raw.split(\"\\n\") if p]\nreserved_prefixes = (\".opengeni-restore-\", \".opengeni-old-\")\n\ndef logical(name):\n    name = name.replace(\"\\\\\", \"/\")\n    while name.startswith(\"./\"):\n        name = name[2:]\n    if name in (\"\", \".\"):\n        return \"\"\n    if name.startswith(\"/\"):\n        raise ValueError(\"absolute archive member\")\n    normalized = os.path.normpath(name).replace(\"\\\\\", \"/\")\n    if normalized == \"..\" or normalized.startswith(\"../\"):\n        raise ValueError(\"escaping archive member\")\n    return normalized\n\ndef protected(name):\n    return any(name == p or name.startswith(p + \"/\") for p in excluded)\n\ndef reserved(name):\n    first = name.split(\"/\", 1)[0]\n    return any(first.startswith(prefix) for prefix in reserved_prefixes)\n\ndef workspace_child(path, prefix):\n    root_abs = os.path.abspath(root)\n    path_abs = os.path.abspath(path)\n    if os.path.dirname(path_abs) != root_abs:\n        raise ValueError(\"restore workspace path escaped root\")\n    if not os.path.basename(path_abs).startswith(prefix):\n        raise ValueError(\"restore workspace path has an invalid prefix\")\n    return path_abs\n\ndef exists(path):\n    return os.path.lexists(path)\n\nwith tarfile.open(archive, \"r:*\") as tf:\n    members = tf.getmembers()\n    if max_members >= 0 and len(members) > max_members:\n        raise ValueError(\"archive member limit exceeded\")\n    total = 0\n    checked = []\n    for member in members:\n        name = logical(member.name)\n        if protected(name):\n            raise ValueError(\"archive contains an ephemeral path\")\n        if reserved(name):\n            raise ValueError(\"archive contains a reserved restore path\")\n        if not (member.isdir() or member.isreg()):\n            raise ValueError(\"archive contains a non-file member\")\n        if member.isreg():\n            total += member.size\n            if max_bytes >= 0 and total > max_bytes:\n                raise ValueError(\"archive extracted-byte limit exceeded\")\n        checked.append((member, name))\n    shutil.rmtree(staging, ignore_errors=True)\n    os.makedirs(staging, mode=0o700, exist_ok=False)\n    for member, name in checked:\n        target = os.path.join(staging, name)\n        if member.isdir():\n            os.makedirs(target, exist_ok=True)\n            os.chmod(target, member.mode & 0o777)\n            continue\n        os.makedirs(os.path.dirname(target), exist_ok=True)\n        source = tf.extractfile(member)\n        if source is None:\n            raise ValueError(\"archive file has no content\")\n        with source, open(target, \"wb\") as dest:\n            shutil.copyfileobj(source, dest)\n        os.chmod(target, member.mode & 0o777)\n\nif not os.path.isdir(root):\n    raise ValueError(\"workspace root does not exist\")\nstaging = workspace_child(staging, \".opengeni-restore-\")\nbackup = workspace_child(backup, \".opengeni-old-\")\nshutil.rmtree(backup, ignore_errors=True)\nos.makedirs(backup, mode=0o700, exist_ok=False)\nmoved_old = []\nmoved_new = []\ntry:\n    for name in sorted(os.listdir(root)):\n        if name in (os.path.basename(staging), os.path.basename(backup)):\n            continue\n        os.replace(os.path.join(root, name), os.path.join(backup, name))\n        moved_old.append(name)\n    for name in sorted(os.listdir(staging)):\n        os.replace(os.path.join(staging, name), os.path.join(root, name))\n        moved_new.append(name)\nexcept Exception as swap_error:\n    rollback_errors = []\n    for name in reversed(moved_new):\n        current = os.path.join(root, name)\n        restored = os.path.join(staging, name)\n        try:\n            if exists(current):\n                os.replace(current, restored)\n        except Exception as error:\n            rollback_errors.append(str(error))\n    for name in reversed(moved_old):\n        saved = os.path.join(backup, name)\n        current = os.path.join(root, name)\n        try:\n            if exists(saved):\n                os.replace(saved, current)\n        except Exception as error:\n            rollback_errors.append(str(error))\n    if rollback_errors:\n        raise RuntimeError(\"workspace restore rollback failed: \" + \"; \".join(rollback_errors)) from swap_error\n    raise\nshutil.rmtree(backup)\nshutil.rmtree(staging)\n`;\n}\n\nexport class OpenSandboxSession {\n  readonly backendId = \"opensandbox\" as const;\n  readonly state: OpenSandboxSessionState;\n  private readonly options: OpenSandboxClientOptions;\n  get requireHostFetchController(): boolean {\n    return this.options.signedEndpoints === true;\n  }\n  get runtimeMetrics(): RuntimeMetricsHooks | undefined {\n    return this.options.metrics;\n  }\n  private provider: ProviderSandbox | null = null;\n  private startPromise: Promise<ProviderSandbox> | null = null;\n  private archiveLimits: SandboxArchiveLimits | null | undefined;\n  private nextSessionId = 1;\n  private readonly processesBySession = new Map<number, RetainedProcess>();\n  private readonly processesByOpId = new Map<string, RetainedProcess>();\n  private readonly synchronousResults = new WeakMap<object, SynchronousCommandPage>();\n  private readonly commandFailureCauses = new WeakMap<object, unknown>();\n  private readonly synchronousBanners = new Map<string, SynchronousCommandPage>();\n\n  constructor(args: {\n    state: OpenSandboxSessionState;\n    options: OpenSandboxClientOptions;\n    archiveLimits?: SandboxArchiveLimits | null;\n  }) {\n    this.state = args.state;\n    this.options = args.options;\n    this.setArchiveLimits(args.archiveLimits);\n  }\n\n  setArchiveLimits(limits?: SandboxArchiveLimits | null): void {\n    validateSandboxArchiveLimits(limits);\n    this.archiveLimits = limits;\n  }\n\n  private async ensureStarted(): Promise<ProviderSandbox> {\n    if (this.provider) return this.provider;\n    if (!this.startPromise) {\n      this.startPromise = ProviderSandbox.connect({\n        connectionConfig: connectionOptions(this.options),\n        sandboxId: this.state.sandboxId,\n        readyTimeoutSeconds: this.options.readyTimeoutSeconds,\n        adapterFactory: withOpenSandboxCommandStreamProof(\n          this.options.adapterFactory ?? createDefaultAdapterFactory(),\n        ),\n      })\n        .then(async (provider) => {\n          const info = await provider.getInfo();\n          assertSupportedProviderState(info, this.state.sandboxId);\n          if (info.id !== this.state.sandboxId) {\n            await provider.close().catch(() => undefined);\n            throw new SandboxProviderError(\"OpenSandbox connected to an unexpected sandbox ID\", {\n              expectedSandboxId: this.state.sandboxId,\n              actualSandboxId: info.id,\n            });\n          }\n          const image = info.image?.uri;\n          // Pool-backed BatchSandbox GET responses use \"unknown\" because the CR records a\n          // poolRef instead of an inline Pod template. Keep direct-image verification strict.\n          const providerReportedImage =\n            image && (this.state.poolRef === null || image !== \"unknown\") ? image : null;\n          if (providerReportedImage && providerReportedImage !== this.state.image) {\n            await provider.close().catch(() => undefined);\n            throw new SandboxProviderError(\"OpenSandbox image changed for the persisted sandbox\", {\n              sandboxId: this.state.sandboxId,\n            });\n          }\n          const poolRef =\n            info.extensions && typeof info.extensions.poolRef === \"string\"\n              ? info.extensions.poolRef\n              : null;\n          if (poolRef !== null && poolRef !== this.state.poolRef) {\n            await provider.close().catch(() => undefined);\n            throw new SandboxProviderError(\"OpenSandbox pool changed for the persisted sandbox\", {\n              sandboxId: this.state.sandboxId,\n            });\n          }\n          this.provider = provider;\n          this.state.expiresAt = info.expiresAt?.toISOString() ?? this.state.expiresAt;\n          return provider;\n        })\n        .catch((error) => {\n          this.startPromise = null;\n          if (isNotFound(error)) {\n            throw new SandboxExactResumeInstanceUnavailableError(\n              \"opensandbox\",\n              this.state.sandboxId,\n            );\n          }\n          throw error;\n        });\n    }\n    return await this.startPromise;\n  }\n\n  async start(): Promise<void> {\n    await this.ensureInitialManifestMaterialized();\n  }\n\n  async running(): Promise<boolean> {\n    try {\n      return await withLifecycle(this.options, async (sandboxes) => {\n        const info = await sandboxes.getSandbox(this.state.sandboxId);\n        return this.state.workspaceReady && info.status.state === \"Running\";\n      });\n    } catch (error) {\n      if (isNotFound(error)) return false;\n      throw error;\n    }\n  }\n\n  async renewExpiration(): Promise<string | null> {\n    const expiresAt = new Date(Date.now() + this.options.ttlSeconds * 1000).toISOString();\n    const response = await withLifecycle(\n      this.options,\n      async (sandboxes) =>\n        await sandboxes.renewSandboxExpiration(this.state.sandboxId, {\n          expiresAt,\n        }),\n    );\n    this.state.expiresAt = response.expiresAt?.toISOString() ?? expiresAt;\n    return this.state.expiresAt;\n  }\n\n  async delete(): Promise<void> {\n    try {\n      await withLifecycle(this.options, async (sandboxes) => {\n        await sandboxes.deleteSandbox(this.state.sandboxId);\n      });\n    } catch (error) {\n      if (!isNotFound(error)) throw error;\n    } finally {\n      await this.close();\n    }\n  }\n\n  async close(): Promise<void> {\n    const provider = this.provider;\n    this.provider = null;\n    this.startPromise = null;\n    if (provider) await provider.close();\n  }\n\n  supportsPty(): boolean {\n    return false;\n  }\n\n  async commandCancellationTransport(): Promise<\"remote_operation\"> {\n    return \"remote_operation\";\n  }\n\n  /** Adapter-owned event pages, never projections of the presentation banner.\n   * Reading a receipt does not acknowledge or release its output custody. */\n  getSynchronousCommandOutput(result: unknown): SynchronousCommandPage | null {\n    return typeof result === \"string\"\n      ? (this.synchronousBanners.get(result) ?? null)\n      : result && typeof result === \"object\"\n        ? (this.synchronousResults.get(result) ?? null)\n        : null;\n  }\n\n  async acknowledgeCommandOutput(result: string): Promise<void> {\n    const page = this.synchronousBanners.get(result);\n    if (page && !page.collectionUnavailable) this.synchronousBanners.delete(result);\n  }\n\n  private commandResult(\n    process: RetainedProcess,\n    consumed: ReturnType<typeof consumeProcessOutput>,\n    result: SandboxExecResult,\n  ): SandboxExecResult {\n    if (\"failureCause\" in process) this.commandFailureCauses.set(result, process.failureCause);\n    this.synchronousResults.set(result, {\n      stdout: consumed.commandStdout,\n      stderr: consumed.commandStderr,\n      exitCode: Number.isSafeInteger(result.exitCode) ? result.exitCode! : null,\n      ...(result.sessionId !== undefined ? { sessionId: result.sessionId } : {}),\n      wallTimeSeconds: result.wallTimeSeconds,\n      ...(process.outputUnavailable ? { collectionUnavailable: true } : {}),\n      outputCursor: {\n        identity: JSON.stringify([this.state.sandboxId, process.opId]),\n        ...consumed.outputCursor,\n      },\n    });\n    return result;\n  }\n\n  private commandBanner(result: SandboxExecResult): string {\n    let banner = formatExecResponse(result);\n    const page = this.synchronousResults.get(result);\n    if (page) {\n      // The SDK chooses the opaque Chunk ID. Do not rebind a still-owned\n      // receipt on a collision; formatting again performs no provider action.\n      while (this.synchronousBanners.has(banner)) banner = formatExecResponse(result);\n      this.synchronousBanners.set(banner, page);\n    }\n    return banner;\n  }\n\n  private async ensureInitialManifestMaterialized(): Promise<void> {\n    const provider = await this.ensureStarted();\n    if (this.state.workspaceReady) return;\n    await provider.files.createDirectories([{ path: WORKSPACE_ROOT }]);\n    for (const [path, entry] of Object.entries(this.state.manifest.entries)) {\n      await this.materialize(path, entry);\n    }\n    this.state.workspaceReady = true;\n  }\n  private beginCommand(args: ExecCommandArgs): RetainedProcess {\n    const opId = nextDurableOpId() ?? `anon_${randomUUID()}`;\n    let resolveExecutionId!: (value: string | null) => void;\n    const executionIdReady = new Promise<string | null>((resolve) => {\n      resolveExecutionId = resolve;\n    });\n    const process: RetainedProcess = {\n      opId,\n      sessionId: null,\n      provider: null,\n      physicalOutcome: null,\n      startedAt: Date.now(),\n      events: [],\n      cursor: 0,\n      executionId: null,\n      executionIdReady,\n      resolveExecutionId,\n      completed: Promise.resolve({ exitCode: 1 }),\n      settled: false,\n      transportUncertain: false,\n      outputUnavailable: false,\n      outputCursor: { stdout: 0, stderr: 0 },\n    };\n    let commandInvoked = false;\n    this.processesByOpId.set(opId, process);\n    // Joined turn cleanup outlives provider/routing alias retirement. Capture\n    // this exact process and its launch transport, not a mutable map lookup.\n    notifyRemoteOperationTransportSelected({\n      cancelExecCommand: async (requestedOpId) => {\n        this.assertOperationIdentity(process, requestedOpId);\n        return await this.cancelRetainedProcess(process);\n      },\n      observeExecCommand: async (requestedOpId) => {\n        this.assertOperationIdentity(process, requestedOpId);\n        return await this.observeRetainedProcess(process);\n      },\n    });\n    process.completed = this.ensureInitialManifestMaterialized()\n      .then(async () => {\n        const provider = await this.ensureStarted();\n        process.provider = provider;\n        commandInvoked = true;\n        const execution = await withOpenSandboxCommandDispatchProof(provider.commands, () =>\n          provider.commands.run(\n            commandForArgs(args),\n            {\n              workingDirectory: args.workdir ? workspacePath(args.workdir) : WORKSPACE_ROOT,\n              envs: this.state.environment,\n            },\n            {\n              onInit: (init) => {\n                this.bindExecutionIdentity(process, init.id);\n              },\n              onEvent: (event) => {\n                if (!event || typeof event !== \"object\") return;\n                const fields = event as Record<string, unknown>;\n                if (fields.type === \"init\") this.bindExecutionIdentity(process, fields.text);\n                for (const field of [\"id\", \"execution_id\", \"executionId\"] as const) {\n                  if (fields[field] !== undefined && fields[field] !== process.executionId)\n                    throw new SandboxProviderError(\"OpenSandbox command event identity mismatch\");\n                }\n              },\n              onStdout: (message) => {\n                process.events.push({ stream: \"stdout\", text: message.text });\n              },\n              onStderr: (message) => {\n                process.events.push({ stream: \"stderr\", text: message.text });\n              },\n            },\n          ),\n        );\n        this.bindExecutionIdentity(process, execution.id);\n        const exitCode = execution.exitCode;\n        if (!execution.complete || !Number.isSafeInteger(exitCode)) {\n          // A resolved transport without its completion envelope is not stream\n          // EOF or exit proof. Keep the original execution for status/control.\n          process.outputUnavailable = true;\n          process.transportUncertain = true;\n          return { exitCode: null, uncertain: true };\n        }\n        const outcome = {\n          exitCode: exitCode!,\n          ...(execution.error ? { error: execution.error } : {}),\n        };\n        process.physicalOutcome = outcome;\n        return outcome;\n      })\n      .catch((error) => {\n        const notDispatched =\n          error instanceof OpenSandboxCommandDispatchError && error.notDispatched;\n        const cause = error instanceof OpenSandboxCommandDispatchError ? error.cause : error;\n        process.failureCause = cause;\n        process.events.push({\n          stream: \"stderr\",\n          text: `${errorMessage(cause)}\\n`,\n          commandOutput: false,\n        });\n        if (\n          process.executionId ||\n          cause instanceof OpenSandboxCommandStreamError ||\n          (commandInvoked && !notDispatched)\n        ) {\n          process.transportUncertain = true;\n          process.outputUnavailable = true;\n          process.resolveExecutionId(process.executionId);\n          // Keep the genuine original transport/SDK cause with the retained\n          // invocation. No first authenticated ID means control stays unknown.\n          return { exitCode: null, error: cause, uncertain: true };\n        }\n        if (notDispatched) notifyRemoteOperationNotDispatched(opId);\n        process.resolveExecutionId(null);\n        return { exitCode: 1, error: cause };\n      })\n      .finally(() => {\n        if (!process.transportUncertain) {\n          process.settled = true;\n          this.processesByOpId.delete(opId);\n        }\n      });\n    return process;\n  }\n\n  private bindExecutionIdentity(process: RetainedProcess, id: unknown): void {\n    if (typeof id !== \"string\" || !id.trim())\n      throw new OpenSandboxCommandStreamError(\"command execution identity is missing\");\n    if (process.executionId !== null && process.executionId !== id)\n      throw new OpenSandboxCommandStreamError(\"command execution identity mismatch\");\n    if (process.executionId === null) {\n      process.executionId = id;\n      process.resolveExecutionId(id);\n    }\n  }\n\n  private assertStatusIdentity(statusId: unknown, executionId: string): void {\n    if (statusId !== executionId)\n      throw new SandboxProviderError(\"OpenSandbox command status identity mismatch\");\n  }\n\n  private assertOperationIdentity(process: RetainedProcess, opId: string): void {\n    if (opId !== process.opId)\n      throw new SandboxProviderError(\"OpenSandbox operation identity mismatch\");\n  }\n\n  private launchProvider(process: RetainedProcess): ProviderSandbox {\n    if (!process.provider)\n      throw new SandboxProviderError(\"OpenSandbox command launch transport is unavailable\");\n    return process.provider;\n  }\n\n  private async cancelRetainedProcess(process: RetainedProcess): Promise<boolean> {\n    if (process.physicalOutcome) return true;\n    const executionId = process.executionId ?? (await process.executionIdReady);\n    if (!executionId) return process.settled;\n    await this.launchProvider(process).commands.interrupt(executionId);\n    // Request delivery is advisory; only observeRetainedProcess proves exit.\n    return true;\n  }\n\n  private async observeRetainedProcess(\n    process: RetainedProcess,\n  ): Promise<RemoteOperationObservation> {\n    if (!process.physicalOutcome) {\n      const executionId = process.executionId;\n      if (!executionId) return { status: \"running\" };\n      const status = await this.launchProvider(process).commands.getCommandStatus(executionId);\n      this.assertStatusIdentity(status.id, executionId);\n      if (status.running !== false || !Number.isSafeInteger(status.exitCode))\n        return { status: \"running\" };\n      process.physicalOutcome = { exitCode: status.exitCode! };\n    }\n    return {\n      status: \"completed\",\n      result: { exitCode: process.physicalOutcome.exitCode },\n      // This control-only observer deliberately cannot recover command output.\n      // Never substitute its proof for a lossless FS/model result, acknowledge\n      // a receipt, advance cursors, or remove the native/routed output holder.\n      failure: new SynchronousCommandOutcomeUnknownError(\n        process.sessionId,\n        { stdout: \"\", stderr: \"\" },\n        new Error(\"Physical completion observed without consuming retained command output\"),\n      ),\n    };\n  }\n\n  async observeExecCommand(opId: string): Promise<RemoteOperationObservation> {\n    const process = this.processesByOpId.get(opId);\n    if (!process) throw new SandboxProviderError(\"OpenSandbox operation is not retained\");\n    return await this.observeRetainedProcess(process);\n  }\n\n  private async settleTransportUncertainProcess(process: RetainedProcess): Promise<ProcessOutcome> {\n    const executionId = process.executionId ?? (await process.executionIdReady);\n    if (!executionId) {\n      throw new SandboxProviderError(\n        \"OpenSandbox internal command lost its provider execution identity\",\n      );\n    }\n    const provider = this.launchProvider(process);\n    while (true) {\n      try {\n        const status = await provider.commands.getCommandStatus(executionId);\n        this.assertStatusIdentity(status.id, executionId);\n        if (status.running === false && Number.isSafeInteger(status.exitCode)) {\n          if (status.error) {\n            process.events.push({\n              stream: \"stderr\",\n              text: `${status.error}\\n`,\n              commandOutput: false,\n            });\n          }\n          process.settled = true;\n          process.transportUncertain = false;\n          process.physicalOutcome = {\n            exitCode: status.exitCode!,\n            ...(status.error ? { error: status.error } : {}),\n          };\n          this.processesByOpId.delete(process.opId);\n          return process.physicalOutcome;\n        }\n      } catch {\n        // The provider accepted this exact execution before transport loss. Keep\n        // polling its immutable execution ID instead of replaying or cleaning\n        // paths that the still-running command may be mutating.\n      }\n      await delay(DEFAULT_WRITE_STDIN_YIELD_TIME_MS);\n    }\n  }\n\n  private async execToCompletion(args: ExecCommandArgs): Promise<SandboxExecResult> {\n    if (args.tty) {\n      throw new SandboxUnsupportedFeatureError(\n        \"OpenSandbox v1 does not expose a bidirectional PTY; run the command with tty=false.\",\n      );\n    }\n    assertRunAsUnsupported(args.runAs);\n    if (args.workdir) workspacePath(args.workdir);\n    const process = this.beginCommand(args);\n    let outcome = await process.completed;\n    if (outcome.uncertain) {\n      outcome = await this.settleTransportUncertainProcess(process);\n    }\n    const consumed = consumeProcessOutput(process);\n    const output = truncateOutput(consumed.output, args.maxOutputTokens);\n    if (outcome.error && !process.executionId) throw outcome.error;\n    return this.commandResult(process, consumed, {\n      output: output.text,\n      stdout: consumed.stdout,\n      stderr: consumed.stderr,\n      wallTimeSeconds: elapsedSeconds(process.startedAt),\n      exitCode: outcome.exitCode,\n      ...(output.originalTokenCount !== undefined\n        ? { originalTokenCount: output.originalTokenCount }\n        : {}),\n    });\n  }\n\n  async exec(args: ExecCommandArgs): Promise<SandboxExecResult> {\n    if (args.tty) {\n      throw new SandboxUnsupportedFeatureError(\n        \"OpenSandbox v1 does not expose a bidirectional PTY; run the command with tty=false.\",\n      );\n    }\n    assertRunAsUnsupported(args.runAs);\n    if (args.workdir) workspacePath(args.workdir);\n    const process = this.beginCommand(args);\n    const requestedYieldMs = args.yieldTimeMs ?? DEFAULT_EXEC_YIELD_TIME_MS;\n    const yieldTimeMs =\n      requestedYieldMs >= DEFAULT_EXEC_YIELD_TIME_MS\n        ? requestedYieldMs + COMMAND_API_SETTLE_GRACE_MS\n        : requestedYieldMs;\n    const outcome = await Promise.race([\n      process.completed.then((value) => ({ done: true as const, value })),\n      delay(yieldTimeMs).then(() => ({ done: false as const })),\n    ]);\n    const consumed = consumeProcessOutput(process);\n    const output = truncateOutput(consumed.output, args.maxOutputTokens);\n    if (outcome.done) {\n      if (outcome.value.uncertain) {\n        const sessionId = this.nextSessionId++;\n        process.sessionId = sessionId;\n        this.processesBySession.set(sessionId, process);\n        return this.commandResult(process, consumed, {\n          output: output.text,\n          stdout: consumed.stdout,\n          stderr: consumed.stderr,\n          wallTimeSeconds: elapsedSeconds(process.startedAt),\n          sessionId,\n          ...(output.originalTokenCount !== undefined\n            ? { originalTokenCount: output.originalTokenCount }\n            : {}),\n        });\n      }\n      if (outcome.value.error && !process.executionId) throw outcome.value.error;\n      return this.commandResult(process, consumed, {\n        output: output.text,\n        stdout: consumed.stdout,\n        stderr: consumed.stderr,\n        wallTimeSeconds: elapsedSeconds(process.startedAt),\n        exitCode: outcome.value.exitCode,\n        ...(output.originalTokenCount !== undefined\n          ? { originalTokenCount: output.originalTokenCount }\n          : {}),\n      });\n    }\n    const sessionId = this.nextSessionId++;\n    process.sessionId = sessionId;\n    this.processesBySession.set(sessionId, process);\n    return this.commandResult(process, consumed, {\n      output: output.text,\n      stdout: consumed.stdout,\n      stderr: consumed.stderr,\n      wallTimeSeconds: elapsedSeconds(process.startedAt),\n      sessionId,\n      ...(output.originalTokenCount !== undefined\n        ? { originalTokenCount: output.originalTokenCount }\n        : {}),\n    });\n  }\n\n  async execCommand(args: ExecCommandArgs): Promise<string> {\n    return this.commandBanner(await this.exec(args));\n  }\n\n  hasRetainedProcess(providerSessionId: number): boolean {\n    return this.processesBySession.has(providerSessionId);\n  }\n\n  async cancelExecCommand(opId: string): Promise<boolean> {\n    const process = this.processesByOpId.get(opId);\n    if (!process) return false;\n    return await this.cancelRetainedProcess(process);\n  }\n\n  async writeStdin(args: WriteStdinArgs): Promise<string> {\n    const process = this.processesBySession.get(args.sessionId);\n    if (!process) {\n      return formatExecResponse({\n        output: `write_stdin failed: session not found: ${args.sessionId}`,\n        wallTimeSeconds: 0,\n        exitCode: 1,\n      });\n    }\n    const chars = args.chars ?? \"\";\n    const unsupportedChars = chars.replaceAll(\"\\u0003\", \"\");\n    if (unsupportedChars.length > 0) {\n      throw new SandboxUnsupportedFeatureError(\n        \"OpenSandbox v1 retained commands support polling and Ctrl-C interrupt, not arbitrary stdin.\",\n      );\n    }\n    const startedAt = Date.now();\n    if (chars.includes(\"\\u0003\")) {\n      const executionId = process.executionId ?? (await process.executionIdReady);\n      if (executionId) {\n        const provider = this.launchProvider(process);\n        await provider.commands.interrupt(executionId);\n      }\n    }\n    if (process.transportUncertain) {\n      const executionId = process.executionId;\n      if (!executionId) {\n        throw new SandboxProviderError(\n          \"OpenSandbox retained command lost its provider execution identity\",\n        );\n      }\n      const provider = this.launchProvider(process);\n      const status = await provider.commands.getCommandStatus(executionId);\n      this.assertStatusIdentity(status.id, executionId);\n      if (status.error) {\n        process.events.push({ stream: \"stderr\", text: `${status.error}\\n`, commandOutput: false });\n      }\n      const consumed = consumeProcessOutput(process);\n      const output = truncateOutput(consumed.output, args.maxOutputTokens);\n      if (status.running !== false || !Number.isSafeInteger(status.exitCode)) {\n        return this.commandBanner(\n          this.commandResult(process, consumed, {\n            output: output.text,\n            stdout: consumed.stdout,\n            stderr: consumed.stderr,\n            wallTimeSeconds: elapsedSeconds(startedAt),\n            sessionId: args.sessionId,\n            ...(output.originalTokenCount !== undefined\n              ? { originalTokenCount: output.originalTokenCount }\n              : {}),\n          }),\n        );\n      }\n      process.settled = true;\n      process.physicalOutcome = { exitCode: status.exitCode! };\n      this.processesBySession.delete(args.sessionId);\n      this.processesByOpId.delete(process.opId);\n      return this.commandBanner(\n        this.commandResult(process, consumed, {\n          output: output.text,\n          stdout: consumed.stdout,\n          stderr: consumed.stderr,\n          wallTimeSeconds: elapsedSeconds(startedAt),\n          exitCode: status.exitCode!,\n          ...(output.originalTokenCount !== undefined\n            ? { originalTokenCount: output.originalTokenCount }\n            : {}),\n        }),\n      );\n    }\n    const outcome = await Promise.race([\n      process.completed.then((value) => ({ done: true as const, value })),\n      delay(args.yieldTimeMs ?? DEFAULT_WRITE_STDIN_YIELD_TIME_MS).then(() => ({\n        done: false as const,\n      })),\n    ]);\n    const consumed = consumeProcessOutput(process);\n    const output = truncateOutput(consumed.output, args.maxOutputTokens);\n    if (outcome.done) {\n      // Loss can arrive while this read awaits completion, not only before it.\n      // The same alias remains available for exact status/control observation.\n      if (!outcome.value.uncertain) this.processesBySession.delete(args.sessionId);\n      return this.commandBanner(\n        this.commandResult(process, consumed, {\n          output: output.text,\n          stdout: consumed.stdout,\n          stderr: consumed.stderr,\n          wallTimeSeconds: elapsedSeconds(startedAt),\n          ...(outcome.value.uncertain\n            ? { sessionId: args.sessionId }\n            : { exitCode: outcome.value.exitCode }),\n          ...(output.originalTokenCount !== undefined\n            ? { originalTokenCount: output.originalTokenCount }\n            : {}),\n        }),\n      );\n    }\n    return this.commandBanner(\n      this.commandResult(process, consumed, {\n        output: output.text,\n        stdout: consumed.stdout,\n        stderr: consumed.stderr,\n        wallTimeSeconds: elapsedSeconds(startedAt),\n        sessionId: args.sessionId,\n        ...(output.originalTokenCount !== undefined\n          ? { originalTokenCount: output.originalTokenCount }\n          : {}),\n      }),\n    );\n  }\n\n  async writeStdinForProcessControl(args: WriteStdinArgs): Promise<string> {\n    return await this.writeStdin(args);\n  }\n\n  async readFile(args: { path: string; runAs?: string; maxBytes?: number }): Promise<Uint8Array> {\n    assertRunAsUnsupported(args.runAs);\n    const absolute = workspacePath(args.path, { allowPrivate: true });\n    const root = [WORKSPACE_ROOT, ...ALLOWED_PRIVATE_ROOTS].find(\n      (candidate) => absolute === candidate || absolute.startsWith(`${candidate}/`),\n    )!;\n    const maxBytes = args.maxBytes ?? 512 * 1024 * 1024;\n    if (!Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > 512 * 1024 * 1024) {\n      throw new SandboxConfigurationError(\"Invalid OpenSandbox read byte limit\");\n    }\n    const result = await this.exec({\n      cmd: confinedFileReadCommand(root, absolute.slice(root.length + 1), maxBytes),\n      login: false,\n      yieldTimeMs: 30_000,\n      maxOutputTokens: Math.ceil((maxBytes * 4) / 3) + 1024,\n    });\n    if (result.exitCode === 66) {\n      throw new SandboxWorkspaceReadNotFoundError(\"OpenSandbox workspace path not found\");\n    }\n    if (result.exitCode === 67) {\n      throw new SandboxConfigurationError(\"path resolves outside workspace or contains a symlink\");\n    }\n    const bytes =\n      result.sessionId === undefined && result.exitCode === 0\n        ? parseConfinedFileRead(result.stdout, maxBytes)\n        : null;\n    if (!bytes) {\n      // Preserve the native cause without treating it as terminal/no-dispatch\n      // proof. The original uncertain command and output remain retained.\n      if (this.commandFailureCauses.has(result)) throw this.commandFailureCauses.get(result);\n      throw new SandboxProviderError(\"OpenSandbox confined file read unavailable\");\n    }\n    return bytes;\n  }\n\n  private async rethrowFilesystemReadError(\n    provider: ProviderSandbox,\n    error: unknown,\n  ): Promise<never> {\n    if (isNotFound(error)) {\n      // A filesystem 404 is optional-path absence only while the exact provider\n      // still exists. Provider loss and lifecycle failures must reach recovery.\n      const info = await provider.getInfo();\n      assertSupportedProviderState(info, this.state.sandboxId);\n      if (info.id === this.state.sandboxId) {\n        throw new SandboxWorkspaceReadNotFoundError(\"OpenSandbox workspace path not found\");\n      }\n    }\n    throw error;\n  }\n\n  async writeFile(args: {\n    path: string;\n    content: string | Uint8Array;\n    createParents?: boolean;\n    append?: boolean;\n  }): Promise<number> {\n    if (args.append) {\n      throw new SandboxUnsupportedFeatureError(\n        \"OpenSandbox v1 raw file writes do not support append; use a shell command for append semantics.\",\n      );\n    }\n    const provider = await this.ensureStarted();\n    const target = workspacePath(args.path, { allowPrivate: true });\n    if (args.createParents ?? true) {\n      await provider.files.createDirectories([{ path: posix.dirname(target) }]);\n    }\n    await provider.files.writeFiles([{ path: target, data: args.content }]);\n    return typeof args.content === \"string\"\n      ? new TextEncoder().encode(args.content).byteLength\n      : args.content.byteLength;\n  }\n\n  async pathExists(path: string, runAs?: string): Promise<boolean> {\n    assertRunAsUnsupported(runAs);\n    const provider = await this.ensureStarted();\n    const target = workspacePath(path, { allowPrivate: true });\n    try {\n      const info = await provider.files.getFileInfo([target]);\n      return Boolean(info[target]);\n    } catch (error) {\n      if (isNotFound(error)) return false;\n      throw error;\n    }\n  }\n\n  async listDir(args: { path: string; runAs?: string }): Promise<SandboxDirectoryEntry[]> {\n    assertRunAsUnsupported(args.runAs);\n    const provider = await this.ensureStarted();\n    const absolute = workspacePath(args.path);\n    const absoluteOutput = args.path.trim().startsWith(\"/\");\n    const entries = await provider.files\n      .listDirectory({\n        path: absolute,\n        depth: 1,\n      })\n      .catch((error) => this.rethrowFilesystemReadError(provider, error));\n    return entries.map((entry) => {\n      const entryPath = workspacePath(entry.path);\n      return {\n        name: posix.basename(entryPath),\n        path: absoluteOutput\n          ? entryPath\n          : entryPath === WORKSPACE_ROOT\n            ? \"\"\n            : entryPath.slice(WORKSPACE_ROOT.length + 1),\n        type: entry.type === \"directory\" ? \"dir\" : entry.type === \"file\" ? \"file\" : \"other\",\n      };\n    });\n  }\n\n  async viewImage(args: ViewImageArgs) {\n    assertRunAsUnsupported(args.runAs);\n    const bytes = await this.readFile({ path: args.path });\n    return imageOutputFromBytes(args.path, bytes);\n  }\n\n  private async deletePath(path: string): Promise<void> {\n    const provider = await this.ensureStarted();\n    const target = workspacePath(path, { allowPrivate: true });\n    const info = await provider.files.getFileInfo([target]);\n    const entry = info[target];\n    if (!entry) return;\n    if (entry.type === \"directory\") await provider.files.deleteDirectories([target]);\n    else await provider.files.deleteFiles([target]);\n  }\n\n  createEditor(runAs?: string): OpenSandboxEditor {\n    assertRunAsUnsupported(runAs);\n    const applyDiff = injectedApplyDiff;\n    if (!applyDiff) {\n      throw new Error(\n        \"opensandbox createEditor: applyDiff not injected (the runtime barrel must call setOpenSandboxApplyDiff before an agent turn binds the filesystem capability)\",\n      );\n    }\n    const readText = async (path: string): Promise<string> =>\n      new TextDecoder().decode(await this.readFile({ path }));\n    return {\n      createFile: async (operation) => {\n        if (await this.pathExists(operation.path)) {\n          throw new Error(`opensandbox createFile: file already exists: ${operation.path}`);\n        }\n        await this.writeFile({\n          path: operation.path,\n          content: applyDiff(\"\", operation.diff, \"create\"),\n          createParents: true,\n        });\n        return {};\n      },\n      updateFile: async (operation) => {\n        const next = applyDiff(await readText(operation.path), operation.diff);\n        const destination = operation.moveTo ?? operation.path;\n        await this.writeFile({\n          path: destination,\n          content: next,\n          createParents: true,\n        });\n        if (operation.moveTo && operation.moveTo !== operation.path) {\n          await this.deletePath(operation.path);\n        }\n        return {};\n      },\n      deleteFile: async (operation) => {\n        await this.deletePath(operation.path);\n        return {};\n      },\n    };\n  }\n\n  private async applyPermissions(path: string, entry: Entry): Promise<void> {\n    if (entry.group !== undefined) {\n      throw new SandboxUnsupportedFeatureError(\n        \"OpenSandbox v1 does not materialize named manifest groups.\",\n      );\n    }\n    if (entry.permissions === undefined) return;\n    const provider = await this.ensureStarted();\n    await provider.files.setPermissions([\n      { path, mode: new Permissions(entry.permissions).toMode() & 0o777 },\n    ]);\n  }\n\n  private async copyLocalDirectory(source: string, destination: string): Promise<void> {\n    const stats = await lstat(source);\n    if (stats.isSymbolicLink()) {\n      throw new SandboxUnsupportedFeatureError(\n        `OpenSandbox local_dir source contains a symbolic link: ${source}`,\n      );\n    }\n    if (!stats.isDirectory()) {\n      throw new SandboxConfigurationError(\n        `OpenSandbox local_dir source is not a directory: ${source}`,\n      );\n    }\n    const provider = await this.ensureStarted();\n    await provider.files.createDirectories([{ path: destination }]);\n    const entries = await readdir(source, { withFileTypes: true });\n    for (const entry of entries) {\n      const sourcePath = `${source.replace(/\\/$/u, \"\")}/${entry.name}`;\n      const destinationPath = posix.join(destination, entry.name);\n      if (entry.isSymbolicLink()) {\n        throw new SandboxUnsupportedFeatureError(\n          `OpenSandbox local_dir source contains a symbolic link: ${sourcePath}`,\n        );\n      }\n      if (entry.isDirectory()) {\n        await this.copyLocalDirectory(sourcePath, destinationPath);\n      } else if (entry.isFile()) {\n        await provider.files.writeFiles([\n          {\n            path: destinationPath,\n            data: new Uint8Array(await readLocalFile(sourcePath)),\n          },\n        ]);\n      } else {\n        throw new SandboxUnsupportedFeatureError(\n          `OpenSandbox local_dir source contains an unsupported file type: ${sourcePath}`,\n        );\n      }\n    }\n  }\n\n  private async materialize(path: string, entry: Entry): Promise<void> {\n    const target = workspacePath(path);\n    const provider = await this.ensureStarted();\n    if (entry.type === \"dir\") {\n      await provider.files.createDirectories([{ path: target }]);\n      for (const [childPath, child] of Object.entries(entry.children ?? {})) {\n        await this.materialize(posix.join(path, childPath), child);\n      }\n      await this.applyPermissions(target, entry);\n      return;\n    }\n    if (entry.type === \"file\") {\n      await provider.files.createDirectories([{ path: posix.dirname(target) }]);\n      await provider.files.writeFiles([{ path: target, data: entry.content }]);\n      await this.applyPermissions(target, entry);\n      return;\n    }\n    if (entry.type === \"local_file\") {\n      const stats = await lstat(entry.src);\n      if (!stats.isFile() || stats.isSymbolicLink()) {\n        throw new SandboxUnsupportedFeatureError(\n          `OpenSandbox local_file source must be a regular non-symlink file: ${entry.src}`,\n        );\n      }\n      await provider.files.createDirectories([{ path: posix.dirname(target) }]);\n      await provider.files.writeFiles([\n        { path: target, data: new Uint8Array(await readLocalFile(entry.src)) },\n      ]);\n      await this.applyPermissions(target, entry);\n      return;\n    }\n    if (entry.type === \"local_dir\") {\n      await this.copyLocalDirectory(entry.src, target);\n      await this.applyPermissions(target, entry);\n      return;\n    }\n    if (entry.type === \"git_repo\") {\n      const temp = `/tmp/opengeni-git-${randomUUID()}`;\n      const subpath = entry.subpath ? normalizeRelativePath(entry.subpath) : null;\n      const script = [\n        \"set -eu\",\n        `rm -rf -- ${shellQuote(temp)} ${shellQuote(target)}`,\n        `git clone --no-checkout --depth=1 ${shellQuote(entry.repo)} ${shellQuote(temp)}`,\n        ...(entry.ref\n          ? [\n              `git -C ${shellQuote(temp)} fetch --depth=1 origin ${shellQuote(entry.ref)}`,\n              `git -C ${shellQuote(temp)} checkout --detach FETCH_HEAD`,\n            ]\n          : [`git -C ${shellQuote(temp)} checkout --detach HEAD`]),\n        subpath\n          ? `mkdir -p -- ${shellQuote(target)} && cp -a -- ${shellQuote(`${temp}/${subpath}/.`)} ${shellQuote(target)}`\n          : `mv -- ${shellQuote(temp)} ${shellQuote(target)}`,\n        subpath ? `rm -rf -- ${shellQuote(temp)}` : \":\",\n      ].join(\"\\n\");\n      const result = await this.execToCompletion({\n        cmd: script,\n        maxOutputTokens: 2_000,\n      });\n      if (typeof result.exitCode !== \"number\" || result.exitCode !== 0) {\n        throw new SandboxProviderError(\"OpenSandbox git repository materialization failed\", {\n          path,\n          exitCode: result.exitCode ?? null,\n        });\n      }\n      await this.applyPermissions(target, entry);\n      return;\n    }\n    throw new SandboxUnsupportedFeatureError(\n      `OpenSandbox v1 does not support manifest mount entry type \"${entry.type}\".`,\n    );\n  }\n\n  async materializeEntry(args: MaterializeEntryArgs): Promise<void> {\n    assertRunAsUnsupported(args.runAs);\n    const logicalPath = logicalWorkspacePath(args.path);\n    await this.materialize(logicalPath, args.entry);\n    this.state.manifest = mergeManifestEntryDelta(this.state.manifest, logicalPath, args.entry);\n  }\n\n  async applyManifest(manifest: Manifest, runAs?: string): Promise<void> {\n    assertRunAsUnsupported(runAs);\n    await this.ensureInitialManifestMaterialized();\n    if (manifest.root !== this.state.manifest.root) {\n      throw new SandboxConfigurationError(\n        `OpenSandbox manifest root must remain ${this.state.manifest.root}.`,\n      );\n    }\n    if (\n      manifest.users.length > 0 ||\n      manifest.groups.length > 0 ||\n      manifest.extraPathGrants.length > 0\n    ) {\n      throw new SandboxUnsupportedFeatureError(\n        \"OpenSandbox v1 does not support manifest users, groups, or host path grants.\",\n      );\n    }\n    for (const [path, entry] of Object.entries(manifest.entries)) {\n      await this.materialize(path, entry);\n    }\n    const nextManifest = mergeManifestDelta(this.state.manifest, manifest);\n    this.state.environment = await mergeMaterializedEnvironment(\n      this.state.manifest,\n      nextManifest,\n      this.state.environment,\n    );\n    this.state.manifest = nextManifest;\n  }\n\n  private resolvedArchiveLimits(options?: WorkspaceArchiveOptions) {\n    return resolveSandboxArchiveLimits(\n      options?.archiveLimits === undefined ? this.archiveLimits : options.archiveLimits,\n    );\n  }\n\n  async persistWorkspaceTar(): Promise<Uint8Array> {\n    const archivePath = `${PRIVATE_ROOT}/capture-${randomUUID()}.tar`;\n    const excludes = [\n      ...this.state.manifest.ephemeralPersistencePaths(),\n      \".opengeni-old-*\",\n      \".opengeni-restore-*\",\n    ].sort();\n    const excludeArgs = excludes.flatMap((path) => [\n      shellQuote(`--exclude=${path}`),\n      shellQuote(`--exclude=./${path}`),\n    ]);\n    const script = String.raw`set -eu\nmkdir -p ${shellQuote(PRIVATE_ROOT)}\ncd ${shellQuote(WORKSPACE_ROOT)}\n# Sockets (gpg-agent) and symlinks are normal in a live /workspace. GNU tar\n# ignores sockets (exit 0) and --hard-dereference stores symlink targets as\n# files. Fifos/devices are not portable archive members and can hang tar.\nif find . -xdev -mindepth 1 \\( -type p -o -type b -o -type c \\) -print -quit | grep -q .; then\n  printf 'workspace contains a non-portable fifo or device\\n' >&2\n  exit 65\nfi\ntar ${excludeArgs.join(\" \")} --sort=name --mtime='@0' --owner=0 --group=0 --numeric-owner --hard-dereference --format=gnu -cf ${shellQuote(archivePath)} .`;\n    try {\n      const result = await this.execToCompletion({\n        cmd: script,\n        maxOutputTokens: 1_000,\n      });\n      if (result.exitCode !== 0) {\n        throw new SandboxArchiveError(\"OpenSandbox workspace archive capture failed\", {\n          sandboxId: this.state.sandboxId,\n          exitCode: result.exitCode ?? null,\n        });\n      }\n      const bytes = await this.readFile({ path: archivePath });\n      const limits = this.resolvedArchiveLimits();\n      if (limits && limits.maxInputBytes !== null && bytes.byteLength > limits.maxInputBytes) {\n        throw new SandboxArchiveError(\"OpenSandbox workspace archive exceeds maxInputBytes\", {\n          archiveBytes: bytes.byteLength,\n          maxInputBytes: limits.maxInputBytes,\n        });\n      }\n      return bytes;\n    } finally {\n      await this.deletePath(archivePath).catch(() => undefined);\n    }\n  }\n\n  async persistWorkspace(): Promise<Uint8Array> {\n    return await this.persistWorkspaceTar();\n  }\n\n  async hydrateWorkspace(\n    data: WorkspaceArchiveData,\n    options: WorkspaceArchiveOptions = {},\n  ): Promise<void> {\n    const bytes = await toUint8Array(data);\n    const limits = this.resolvedArchiveLimits(options);\n    if (limits && limits.maxInputBytes !== null && bytes.byteLength > limits.maxInputBytes) {\n      throw new SandboxArchiveError(\"OpenSandbox workspace archive exceeds maxInputBytes\", {\n        archiveBytes: bytes.byteLength,\n        maxInputBytes: limits.maxInputBytes,\n      });\n    }\n    const archivePath = `${PRIVATE_ROOT}/restore-${randomUUID()}.tar`;\n    const stagingPath = `${WORKSPACE_ROOT}/.opengeni-restore-${randomUUID()}`;\n    const backupPath = `${WORKSPACE_ROOT}/.opengeni-old-${randomUUID()}`;\n    await this.writeFile({\n      path: archivePath,\n      content: bytes,\n      createParents: true,\n    });\n    const excluded = [...this.state.manifest.ephemeralPersistencePaths()].sort().join(\"\\n\");\n    const command = [\n      \"python3\",\n      \"-c\",\n      shellQuote(archiveRestoreScript()),\n      shellQuote(archivePath),\n      shellQuote(WORKSPACE_ROOT),\n      shellQuote(stagingPath),\n      shellQuote(backupPath),\n      shellQuote(archiveLimitArg(limits?.maxMembers ?? null)),\n      shellQuote(archiveLimitArg(limits?.maxExtractedBytes ?? null)),\n      shellQuote(excluded),\n    ].join(\" \");\n    try {\n      const result = await this.execToCompletion({\n        cmd: command,\n        maxOutputTokens: 2_000,\n      });\n      if (result.exitCode !== 0) {\n        throw new SandboxArchiveError(\"OpenSandbox workspace archive restore failed\", {\n          sandboxId: this.state.sandboxId,\n          exitCode: result.exitCode ?? null,\n          stderr: result.stderr.slice(-1_000),\n        });\n      }\n      this.state.workspaceReady = true;\n    } finally {\n      await this.deletePath(archivePath).catch(() => undefined);\n      await this.deletePath(stagingPath).catch(() => undefined);\n      await this.deletePath(backupPath).catch(() => undefined);\n    }\n  }\n\n  async resolveExposedPort(port: number): Promise<ExposedPortEndpoint> {\n    if (!Number.isInteger(port) || port <= 0 || port > 65_535) {\n      throw new SandboxExposedPortUnavailableError(`Invalid OpenSandbox port: ${port}`);\n    }\n    const signed = this.options.signedEndpoints === true;\n    try {\n      const endpoint = await withLifecycle(this.options, async (sandboxes) => {\n        if (signed) {\n          const expires =\n            Math.floor(Date.now() / 1000) + (this.options.signedEndpointTtlSeconds ?? 600);\n          return await sandboxes.getSignedEndpoint(this.state.sandboxId, port, expires);\n        }\n        return await sandboxes.getSandboxEndpoint(\n          this.state.sandboxId,\n          port,\n          this.options.useServerProxy,\n        );\n      });\n      const rewrite = channelBRewriteTarget(this.options);\n      const resolved = recordExposedPortEndpoint(\n        this.state,\n        withOpenSandboxDesktopViewerPath(\n          endpointToExposedPort(endpoint, rewrite.baseUrl, rewrite.rewriteToBaseUrl),\n          port,\n          signed,\n        ),\n        port,\n      );\n      const parsed = signed\n        ? parseOpenSandboxSignedUriPath(typeof resolved.path === \"string\" ? resolved.path : \"\")\n        : null;\n      console.info(\"opensandbox channel-b resolve\", {\n        mode: signed ? \"signed\" : \"server-proxy\",\n        sandboxId: this.state.sandboxId,\n        port,\n        expiresAtSeconds: parsed?.expiresAtSeconds ?? null,\n        path:\n          typeof resolved.path === \"string\" ? redactOpenSandboxSignedUriPath(resolved.path) : null,\n      });\n      if (signed) {\n        recordSignedEndpointMetric(this.options.metrics, { outcome: \"minted\", port });\n      }\n      return resolved;\n    } catch (error) {\n      if (signed) {\n        recordSignedEndpointMetric(this.options.metrics, { outcome: \"mint_failed\", port });\n      }\n      throw error;\n    }\n  }\n}\n\n/** noVNC on the OpenSandbox lifecycle proxy serves HTML at the port root\n * (`…/proxy/6080`). The RFB socket is `…/websockify`. Mint `vnc.html` so the\n * existing SDK `desktopSocketUrl` rewrite dials that socket. Signed URI-mode\n * ingress is a reverse proxy to the box port and does not need that HTML\n * viewer path. Modal/Daytona edges at `/` stay untouched. */\nconst OPENSANDBOX_DESKTOP_STREAM_PORT = 6080;\n\nfunction channelBRewriteTarget(options: OpenSandboxClientOptions): {\n  baseUrl: string;\n  rewriteToBaseUrl: boolean;\n} {\n  if (options.signedEndpoints) {\n    if (options.channelBPublicBaseUrl) {\n      return { baseUrl: options.channelBPublicBaseUrl, rewriteToBaseUrl: true };\n    }\n    return { baseUrl: options.baseUrl, rewriteToBaseUrl: false };\n  }\n  return { baseUrl: options.baseUrl, rewriteToBaseUrl: options.useServerProxy };\n}\n\nfunction withOpenSandboxDesktopViewerPath(\n  endpoint: ExposedPortEndpoint,\n  port: number,\n  signedEndpoints: boolean,\n): ExposedPortEndpoint {\n  if (signedEndpoints) return endpoint;\n  if (port !== OPENSANDBOX_DESKTOP_STREAM_PORT) return endpoint;\n  const rawPath =\n    typeof endpoint.path === \"string\" && endpoint.path.length > 0 ? endpoint.path : \"/\";\n  const prefix = (rawPath.startsWith(\"/\") ? rawPath : `/${rawPath}`).replace(/\\/+$/u, \"\");\n  if (prefix.length === 0) return endpoint;\n  if (/\\/vnc(_lite)?\\.html$/u.test(prefix) || prefix.endsWith(\"/websockify\")) {\n    return endpoint;\n  }\n  const path = `${prefix}/vnc.html`;\n  const url =\n    typeof endpoint.url === \"string\" && endpoint.url.length > 0\n      ? `${endpoint.url.replace(/\\/+$/u, \"\")}/vnc.html`\n      : endpoint.url;\n  return { ...endpoint, path, ...(url ? { url } : {}) };\n}\n\nfunction endpointToExposedPort(\n  endpoint: Endpoint,\n  baseUrl: string,\n  rewriteToBaseUrl: boolean,\n): ExposedPortEndpoint {\n  const base = new URL(baseUrl);\n  const reported = new URL(`${base.protocol}//${endpoint.endpoint}`);\n  // Channel B is browser → provider-tunnel direct. When we use the lifecycle\n  // server proxy, rewrite the advertised host to the configured base URL so a\n  // local port-forward (or in-cluster DNS) is what the viewer actually opens.\n  const url = rewriteToBaseUrl ? new URL(`${reported.pathname}${reported.search}`, base) : reported;\n  const tls = url.protocol === \"https:\" || url.protocol === \"wss:\";\n  return {\n    host: url.hostname,\n    port: url.port ? Number(url.port) : tls ? 443 : 80,\n    tls,\n    ...(url.pathname && url.pathname !== \"/\" ? { path: url.pathname } : {}),\n    ...(url.search.length > 1 ? { query: url.search.slice(1) } : {}),\n    protocol: url.protocol.replace(/:$/u, \"\"),\n    url: url.toString(),\n    ...(endpoint.headers ? { headers: { ...endpoint.headers } } : {}),\n  };\n}\n\nexport class OpenSandboxClient {\n  readonly backendId = \"opensandbox\" as const;\n  readonly supportsDefaultOptions = false;\n  private readonly options: OpenSandboxClientOptions;\n\n  constructor(options: OpenSandboxClientOptions) {\n    this.options = {\n      ...options,\n      baseUrl: canonicalBaseUrl(options.baseUrl),\n      environment: { ...(options.environment ?? {}) },\n      exposedPorts: normalizeConfiguredPorts(options.exposedPorts),\n      resourceLimits: { ...options.resourceLimits },\n      resourceRequests: { ...options.resourceRequests },\n    };\n  }\n\n  async create(\n    args?: SandboxClientCreateArgs,\n    manifestOptions?: Record<string, unknown>,\n  ): Promise<OpenSandboxSession> {\n    const normalized = normalizeSandboxClientCreateArgs(args as never, manifestOptions);\n    assertNoSnapshot(normalized);\n    const manifest = normalized.manifest;\n    if (manifest.root !== WORKSPACE_ROOT) {\n      throw new SandboxConfigurationError(`OpenSandbox manifest root must be ${WORKSPACE_ROOT}.`);\n    }\n    if (\n      manifest.users.length > 0 ||\n      manifest.groups.length > 0 ||\n      manifest.extraPathGrants.length > 0\n    ) {\n      throw new SandboxUnsupportedFeatureError(\n        \"OpenSandbox v1 does not support manifest users, groups, or host path grants.\",\n      );\n    }\n    const environment = {\n      ...(this.options.environment ?? {}),\n      ...(await manifest.resolveEnvironment()),\n    };\n    const created = await withLifecycle(\n      this.options,\n      async (sandboxes) => await sandboxes.createSandbox(createRequest(this.options, environment)),\n    );\n    const state: OpenSandboxSessionState = {\n      stateVersion: OPENSANDBOX_STATE_VERSION,\n      sandboxId: created.id,\n      manifest,\n      environment,\n      image: this.options.image,\n      poolRef: this.options.poolRef ?? null,\n      providerBindingHash: providerBindingHash(this.options.baseUrl),\n      workspacePersistence: \"tar\",\n      configuredExposedPorts: normalizeConfiguredPorts(this.options.exposedPorts),\n      workspaceReady: false,\n      expiresAt: created.expiresAt?.toISOString() ?? null,\n    };\n    return new OpenSandboxSession({\n      state,\n      options: this.options,\n      ...(normalized.archiveLimits !== undefined\n        ? { archiveLimits: normalized.archiveLimits }\n        : {}),\n    });\n  }\n\n  async resume(\n    state: OpenSandboxSessionState,\n    options: SandboxClientResumeOptions = {},\n  ): Promise<OpenSandboxSession> {\n    return await this.resumeExact(state, options);\n  }\n\n  async resumeExact(\n    state: OpenSandboxSessionState,\n    options: SandboxClientResumeOptions = {},\n  ): Promise<OpenSandboxSession> {\n    assertStateBoundToProvider(state, this.options);\n    try {\n      await withLifecycle(this.options, async (sandboxes) => {\n        const info = await sandboxes.getSandbox(state.sandboxId);\n        assertSupportedProviderState(info, state.sandboxId);\n      });\n    } catch (error) {\n      if (error instanceof SandboxExactResumeInstanceUnavailableError || isNotFound(error)) {\n        throw new SandboxExactResumeInstanceUnavailableError(\"opensandbox\", state.sandboxId);\n      }\n      throw error;\n    }\n    return new OpenSandboxSession({\n      state,\n      options: this.options,\n      ...(options.archiveLimits !== undefined ? { archiveLimits: options.archiveLimits } : {}),\n    });\n  }\n\n  async delete(state: OpenSandboxSessionState): Promise<void> {\n    assertStateBoundToProvider(state, this.options);\n    try {\n      await withLifecycle(this.options, async (sandboxes) => {\n        await sandboxes.deleteSandbox(state.sandboxId);\n      });\n    } catch (error) {\n      if (!isNotFound(error)) throw error;\n    }\n  }\n\n  async renewExpiration(sandboxId: string): Promise<string> {\n    const expiresAt = new Date(Date.now() + this.options.ttlSeconds * 1000).toISOString();\n    const response = await withLifecycle(\n      this.options,\n      async (sandboxes) => await sandboxes.renewSandboxExpiration(sandboxId, { expiresAt }),\n    );\n    return response.expiresAt?.toISOString() ?? expiresAt;\n  }\n\n  async canPersistOwnedSessionState(): Promise<boolean> {\n    return true;\n  }\n\n  async canReusePreservedOwnedSession(): Promise<boolean> {\n    return false;\n  }\n\n  async serializeSessionState(state: OpenSandboxSessionState): Promise<Record<string, unknown>> {\n    assertStateBoundToProvider(state, this.options);\n    return {\n      stateVersion: OPENSANDBOX_STATE_VERSION,\n      sandboxId: state.sandboxId,\n      manifest: serializeManifestRecord(state.manifest),\n      environment: serializeRuntimeEnvironmentForPersistence(state.manifest, state.environment),\n      image: state.image,\n      poolRef: state.poolRef,\n      providerBindingHash: state.providerBindingHash,\n      workspacePersistence: \"tar\",\n      configuredExposedPorts: [...state.configuredExposedPorts],\n      workspaceReady: state.workspaceReady,\n      expiresAt: state.expiresAt,\n      ...(this.options.signedEndpoints\n        ? {}\n        : state.exposedPorts\n          ? { exposedPorts: structuredClone(state.exposedPorts) }\n          : {}),\n    };\n  }\n\n  async deserializeSessionState(value: Record<string, unknown>): Promise<OpenSandboxSessionState> {\n    if (value.stateVersion !== OPENSANDBOX_STATE_VERSION) {\n      throw new SandboxConfigError(\n        \"opensandbox\",\n        `unsupported persisted OpenSandbox state version: ${String(value.stateVersion)}`,\n      );\n    }\n    const manifest = deserializeManifest(\n      value.manifest && typeof value.manifest === \"object\" && !Array.isArray(value.manifest)\n        ? (value.manifest as Record<string, unknown>)\n        : undefined,\n    );\n    if (manifest.root !== WORKSPACE_ROOT) {\n      throw new SandboxConfigError(\n        \"opensandbox\",\n        `persisted manifest root must be ${WORKSPACE_ROOT}`,\n      );\n    }\n    const state: OpenSandboxSessionState = {\n      stateVersion: OPENSANDBOX_STATE_VERSION,\n      sandboxId: parseStateString(value.sandboxId, \"sandboxId\"),\n      manifest,\n      environment: await rehydratePersistedEnvironmentForRuntime(\n        manifest,\n        value.environment &&\n          typeof value.environment === \"object\" &&\n          !Array.isArray(value.environment)\n          ? (value.environment as Record<string, string>)\n          : undefined,\n        this.options.environment,\n      ),\n      image: parseStateString(value.image, \"image\"),\n      poolRef: parseOptionalString(value.poolRef, \"poolRef\"),\n      providerBindingHash: parseStateString(value.providerBindingHash, \"providerBindingHash\"),\n      workspacePersistence: \"tar\",\n      configuredExposedPorts: Array.isArray(value.configuredExposedPorts)\n        ? normalizeConfiguredPorts(\n            value.configuredExposedPorts.filter(\n              (entry): entry is number => typeof entry === \"number\",\n            ),\n          )\n        : [],\n      workspaceReady: value.workspaceReady === true,\n      expiresAt: parseOptionalString(value.expiresAt, \"expiresAt\"),\n      ...(value.exposedPorts &&\n      typeof value.exposedPorts === \"object\" &&\n      !Array.isArray(value.exposedPorts)\n        ? {\n            exposedPorts: structuredClone(\n              value.exposedPorts as Record<string, ExposedPortEndpoint>,\n            ),\n          }\n        : {}),\n    };\n    assertStateBoundToProvider(state, this.options);\n    return state;\n  }\n}\n","// @opengeni/runtime/sandbox — the pixel DATA PLANE: exposeStreamPort (P4.2).\n//\n// This is the heart of Channel B's data plane. exposeStreamPort resolves the\n// provider's scoped tunnel for the ONE exposed stream port (6080), assembles the\n// direct-to-provider WS URL (client → provider-tunnel direct; the pixel socket\n// never traverses Opengeni), and mints the scoped Opengeni stream token. It is a\n// plain function over a live, externally-owned `{session}` handle — NO Temporal,\n// NO worker RPC, NO actor. The API-direct handshake handler (apps/api) calls it\n// in-process on a freshly-resumed-by-id box and returns the result as the HTTP\n// response; the worker's per-turn resume path calls the same function when a turn\n// is the first to bring the box up. Both pull it from this single agent-loop-free\n// leaf (@opengeni/runtime/sandbox).\n//\n// THE TOKEN IS NOT A URL QUERY PARAM. The provider's own scoped tunnel URL\n// (Modal raw-TLS host:port, Daytona signed preview, Blaxel preview-token query)\n// carries the reach-the-port boundary; the Opengeni stream token is RECORDED\n// against the viewer holder and is the in-box websockify edge boundary (P3/P5).\n// Per the sandbox contract ruling, exposeStreamPort returns the token alongside the\n// URL so the caller records it; it does NOT append it to `url`.\n\nimport { DESKTOP_STREAM_PORT } from \"@opengeni/contracts\";\nimport { mintStreamToken, STREAM_TOKEN_DEFAULT_TTL_SECONDS } from \"./stream-token\";\nimport { errorMessage } from \"@opengeni/contracts/values\";\n\n/** The provider-resolved endpoint for an exposed port. Mirrors the SDK's\n *  `ExposedPortEndpoint` (host/port/tls/query/...) WITHOUT importing the\n *  agent-loop barrel — the leaf stays agent-loop-free. */\nexport type ExposedPortEndpoint = {\n  host: string;\n  port: number;\n  tls?: boolean;\n  query?: string;\n  protocol?: string;\n  url?: string;\n  /** The URL path the socket connects on. Modal/Daytona/Blaxel serve the edge at\n   *  the root (`/`, the default); the selfhosted relay serves it at `/stream`\n   *  (M8b). When set, buildStreamUrl uses it instead of the root. */\n  path?: string;\n  /** A Connected Machine relay stream's exact channel; the viewer token is\n   *  bound to it (see MintStreamTokenInput.relayChannel). */\n  relayChannel?: { workspaceId: string; agentId: string; channelId: string };\n  [key: string]: unknown;\n};\n\n/** The structural slice of a provider session we need to resolve a tunnel. */\ntype PortResolvableSession = {\n  resolveExposedPort?: (port: number) => Promise<ExposedPortEndpoint>;\n};\n\n/** Thrown when the provider cannot expose the stream port (no resolveExposedPort,\n *  or the provider tunnel lookup failed). The caller degrades the desktop cell to\n *  `transport:null` (a value, never a crash) — a headless-only provider or a\n *  transient tunnel failure must not fail the whole handshake. */\nexport class StreamPortUnavailableError extends Error {\n  constructor(\n    message: string,\n    readonly cause?: unknown,\n  ) {\n    super(message);\n    this.name = \"StreamPortUnavailableError\";\n  }\n}\n\nexport type ExposeStreamPortInput = {\n  workspaceId: string;\n  sessionId: string;\n  /** The sandbox_lease_holders viewer row id the token is scoped to. */\n  viewerId: string;\n  /** The live lease epoch — the fence the token is pinned to. */\n  leaseEpoch: number;\n  /** The HMAC secret for the scoped stream token (resolveStreamTokenSecret). */\n  streamTokenSecret: string;\n  /** The exposed stream port; defaults to 6080. */\n  port?: number;\n  /** Token TTL in seconds; defaults to STREAM_TOKEN_DEFAULT_TTL_SECONDS. */\n  ttlSeconds?: number;\n  /** The framebuffer geometry to echo back to the client. */\n  resolution?: [number, number];\n  /** Override the issue clock (tests). Seconds since the epoch. */\n  nowSeconds?: number;\n  /** Input authority the API route granted this viewer. `view` (the default)\n   *  only watches; `control` lets the relay forward the viewer's input. */\n  mode?: \"view\" | \"control\";\n  /** The authenticated viewer subject the token is minted for (0281). */\n  subjectId?: string;\n  /** The session authority epoch observed at mint (0281). */\n  authorityEpoch?: number;\n};\n\nexport type ExposeStreamPortResult = {\n  /** The direct-to-provider WS URL the viewer connects to (provider-scoped; the\n   *  Opengeni token is NOT appended). */\n  url: string;\n  /** The scoped Opengeni stream token — recorded against the holder, NEVER a URL\n   *  query param. */\n  token: string;\n  /** ISO absolute expiry of the token (the rotation hot-swap window backstop). */\n  expiresAt: string;\n  /** The pixel transport the client speaks. */\n  transport: \"vnc-ws\";\n  /** The reference noVNC client the SDK helper mounts. */\n  client: \"novnc\";\n  resolution: [number, number];\n  leaseEpoch: number;\n};\n\nconst DEFAULT_RESOLUTION: [number, number] = [1280, 800];\n\n/**\n * Assemble the direct-to-provider WS URL from a resolved endpoint. The SDK's\n * `urlForExposedPort(endpoint,'ws')` is the canonical tls-aware, IPv6-bracketing,\n * provider-query-preserving assembler — we reimplement its exact logic here so\n * the leaf stays agent-loop-free (the helper lives behind the bare\n * `@openai/agents-core` root, which the import-discipline test forbids). The\n * provider's own `endpoint.query` (Blaxel `bl_preview_token`, Daytona signed\n * token) is preserved; the Opengeni token is NOT appended (it is recorded against\n * the holder + validated at the in-box websockify edge).\n */\nexport function buildStreamUrl(endpoint: ExposedPortEndpoint): string {\n  if (\n    typeof endpoint.host !== \"string\" ||\n    endpoint.host.length === 0 ||\n    typeof endpoint.port !== \"number\"\n  ) {\n    throw new StreamPortUnavailableError(\n      `provider returned a malformed exposed-port endpoint (host=${String(endpoint.host)}, port=${String(endpoint.port)})`,\n    );\n  }\n  const tls = endpoint.tls ?? false;\n  const scheme = tls ? \"wss\" : \"ws\";\n  const defaultPort = tls ? 443 : 80;\n  // Bracket a bare IPv6 host (urlForExposedPort parity).\n  const host =\n    endpoint.host.includes(\":\") && !endpoint.host.startsWith(\"[\")\n      ? `[${endpoint.host}]`\n      : endpoint.host;\n  // The path: default the root `/` (Modal/Daytona/Blaxel edge), or the\n  // provider-supplied path (the selfhosted relay's `/stream` route, M8b). Always\n  // leading-slash-normalized.\n  const rawPath =\n    typeof endpoint.path === \"string\" && endpoint.path.length > 0 ? endpoint.path : \"/\";\n  const path = rawPath.startsWith(\"/\") ? rawPath : `/${rawPath}`;\n  const origin =\n    endpoint.port === defaultPort ? `${scheme}://${host}` : `${scheme}://${host}:${endpoint.port}`;\n  const authority = `${origin}${path}`;\n  const query = endpoint.query ?? \"\";\n  return query ? `${authority}?${query}` : authority;\n}\n\n/**\n * Join a provider tunnel prefix with a controller/API path. Modal/Daytona/Blaxel\n * serve the edge at `/`; OpenSandbox's lifecycle proxy serves it at\n * `/v1/sandboxes/<id>/proxy/<port>`. The request path (`/v1/browser-sessions/...`)\n * must keep that prefix so Channel B hits browserd, not the lifecycle API root.\n */\nexport function joinExposedPortPath(endpointPath: string | undefined, requestPath: string): string {\n  if (\n    typeof requestPath !== \"string\" ||\n    !requestPath.startsWith(\"/\") ||\n    requestPath.includes(\"\\0\") ||\n    requestPath.includes(\"#\") ||\n    requestPath.includes(\"?\")\n  ) {\n    throw new StreamPortUnavailableError(\"exposed-port request path is invalid\");\n  }\n  const raw = typeof endpointPath === \"string\" && endpointPath.length > 0 ? endpointPath : \"/\";\n  const prefix = (raw.startsWith(\"/\") ? raw : `/${raw}`).replace(/\\/+$/u, \"\") || \"\";\n  return `${prefix}${requestPath}`;\n}\n\nconst OPENSANDBOX_LIFECYCLE_PROXY_PATH = /\\/v1\\/sandboxes\\/[^/]+\\/proxy\\/\\d+(?:\\/|$)/u;\n/** OSEP-0011 URI mode: `/{sandbox_id}/{port}/{expires_b36}/{signature}/…`. */\nconst OPENSANDBOX_SIGNED_URI_PATH =\n  /^\\/([^/]{1,128})\\/(\\d{1,5})\\/([0-9a-z]{1,13})\\/([0-9a-z]{8,64})(?:\\/|$)/iu;\nconst SIGNED_ENDPOINT_REFRESH_SKEW_MS = 30_000;\n\nexport type OpenSandboxSignedUriPath = {\n  sandboxId: string;\n  port: number;\n  expiresAtSeconds: number;\n  signature: string;\n};\n\nexport function isOpenSandboxLifecycleProxyPath(path: string): boolean {\n  return OPENSANDBOX_LIFECYCLE_PROXY_PATH.test(path);\n}\n\nexport function parseOpenSandboxSignedUriPath(path: string): OpenSandboxSignedUriPath | null {\n  const normalized = path.startsWith(\"/\") ? path : `/${path}`;\n  const match = OPENSANDBOX_SIGNED_URI_PATH.exec(normalized);\n  if (!match) return null;\n  const port = Number(match[2]);\n  if (!Number.isInteger(port) || port < 1 || port > 65_535) return null;\n  const expiresAtSeconds = Number.parseInt(match[3]!, 36);\n  if (!Number.isSafeInteger(expiresAtSeconds) || expiresAtSeconds < 0) return null;\n  return {\n    sandboxId: match[1]!,\n    port,\n    expiresAtSeconds,\n    signature: match[4]!,\n  };\n}\n\nfunction pathnameFromExposedPort(endpoint: ExposedPortEndpoint | string): string | null {\n  if (typeof endpoint === \"string\") {\n    try {\n      return new URL(endpoint).pathname;\n    } catch {\n      return null;\n    }\n  }\n  return typeof endpoint.path === \"string\" && endpoint.path.length > 0 ? endpoint.path : \"/\";\n}\n\n/**\n * Host-side JSON/WebSocket may send the browserd Bearer only when the edge does\n * not rewrite `Authorization`. Lifecycle `/v1/sandboxes/<id>/proxy/<port>` does;\n * native `/` tunnels and OSEP-0011 signed URIs do not.\n */\nexport function exposedPortAllowsHostFetch(endpoint: ExposedPortEndpoint | string): boolean {\n  const path = pathnameFromExposedPort(endpoint);\n  if (path === null) return false;\n  if (isOpenSandboxLifecycleProxyPath(path)) return false;\n  if (path === \"/\" || path === \"\") return true;\n  return parseOpenSandboxSignedUriPath(path) !== null;\n}\n\nexport function signedEndpointExpiresAtMs(path: string): number | null {\n  const parsed = parseOpenSandboxSignedUriPath(path);\n  return parsed ? parsed.expiresAtSeconds * 1000 : null;\n}\n\nexport function signedEndpointNeedsRefresh(\n  path: string,\n  nowMs = Date.now(),\n  skewMs = SIGNED_ENDPOINT_REFRESH_SKEW_MS,\n): boolean {\n  const expiresAt = signedEndpointExpiresAtMs(path);\n  if (expiresAt === null) return false;\n  return nowMs + skewMs >= expiresAt;\n}\n\n/** Logs and artifacts may keep the signed path shape, never the signature. */\nexport function redactOpenSandboxSignedUriPath(path: string): string {\n  return path.replace(/^(\\/[^/]+\\/\\d+\\/[0-9a-z]+)\\/[0-9a-z]+/iu, \"$1/[redacted]\");\n}\n\n/** Rehydrate a persisted provider tunnel URL without contacting the provider.\n * Only the exact ws/wss shape emitted by buildStreamUrl is accepted. */\nexport function exposedPortEndpointFromUrl(value: string): ExposedPortEndpoint {\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    throw new StreamPortUnavailableError(\"cached provider endpoint is not a valid URL\");\n  }\n  if (\n    (parsed.protocol !== \"ws:\" && parsed.protocol !== \"wss:\") ||\n    parsed.username !== \"\" ||\n    parsed.password !== \"\" ||\n    parsed.hash !== \"\" ||\n    parsed.hostname === \"\"\n  ) {\n    throw new StreamPortUnavailableError(\"cached provider endpoint has an invalid authority\");\n  }\n  const tls = parsed.protocol === \"wss:\";\n  const port = parsed.port === \"\" ? (tls ? 443 : 80) : Number(parsed.port);\n  if (!Number.isInteger(port) || port < 1 || port > 65_535) {\n    throw new StreamPortUnavailableError(\"cached provider endpoint has an invalid port\");\n  }\n  return {\n    host: parsed.hostname,\n    port,\n    tls,\n    path: parsed.pathname || \"/\",\n    query: parsed.search.startsWith(\"?\") ? parsed.search.slice(1) : parsed.search,\n  };\n}\n\n/**\n * Resolve the provider's scoped tunnel for the stream port and mint the scoped\n * Opengeni stream token. Returns a coherent `{url, token, expiresAt, transport,\n * client, resolution}` cell the caller records on the lease (data_plane_url) and\n * returns in the DesktopStream handshake.\n *\n * Throws `StreamPortUnavailableError` when the provider session cannot resolve\n * the port (no `resolveExposedPort`, or the tunnel lookup failed) — the caller\n * maps this to a `transport:null` degradation (a value, never a crash).\n */\nexport async function exposeStreamPort(\n  session: unknown,\n  input: ExposeStreamPortInput,\n): Promise<ExposeStreamPortResult> {\n  const s = session as PortResolvableSession;\n  const port = input.port ?? DESKTOP_STREAM_PORT;\n  if (typeof s?.resolveExposedPort !== \"function\") {\n    throw new StreamPortUnavailableError(\n      \"provider session cannot resolve exposed ports (no resolveExposedPort) — desktop stream unavailable\",\n    );\n  }\n\n  let endpoint: ExposedPortEndpoint;\n  try {\n    // (I7/OD-7) per-provider URL re-resolution folds in here: a provider with a\n    // preview/signed token (Daytona/Blaxel) re-resolves its own short-TTL token\n    // on every call, so a rotation re-mints both planes' freshness in one place.\n    endpoint = await s.resolveExposedPort(port);\n  } catch (error) {\n    throw new StreamPortUnavailableError(\n      `provider failed to resolve the stream port ${port}: ${errorMessage(error)}`,\n      error,\n    );\n  }\n\n  const url = buildStreamUrl(endpoint);\n  const ttlSeconds = input.ttlSeconds ?? STREAM_TOKEN_DEFAULT_TTL_SECONDS;\n  const nowSeconds = input.nowSeconds ?? Math.floor(Date.now() / 1000);\n  const token = await mintStreamToken(input.streamTokenSecret, {\n    workspaceId: input.workspaceId,\n    sessionId: input.sessionId,\n    viewerId: input.viewerId,\n    leaseEpoch: input.leaseEpoch,\n    mode: input.mode ?? \"view\",\n    port,\n    ttlSeconds,\n    nowSeconds,\n    ...(input.subjectId ? { subjectId: input.subjectId } : {}),\n    ...(input.authorityEpoch ? { authorityEpoch: input.authorityEpoch } : {}),\n    ...(endpoint.relayChannel ? { relayChannel: endpoint.relayChannel } : {}),\n  });\n\n  return {\n    url,\n    token,\n    expiresAt: new Date((nowSeconds + ttlSeconds) * 1000).toISOString(),\n    transport: \"vnc-ws\",\n    client: \"novnc\",\n    resolution: input.resolution ?? DEFAULT_RESOLUTION,\n    leaseEpoch: input.leaseEpoch,\n  };\n}\n","// @opengeni/runtime/sandbox — scoped stream-token mint/verify (P3.1).\n//\n// The agent-loop-free home for the scoped data-plane stream token used by the\n// desktop pixel plane (Channel B, sandbox contract §C.3 / crosscut PART 1.3). It is\n// a THIN wrapper over the contracts HMAC envelope (signStreamToken /\n// verifyStreamToken) — NOT a second crypto: it REUSES the exact base64Url +\n// hmacSha256 construction that backs signDelegatedAccessToken, with the distinct\n// `ogs_` prefix and the hard-narrow StreamTokenPayload claim set.\n//\n// It lives under @opengeni/runtime/sandbox so the API-direct control plane\n// (apps/api) can mint + verify stream tokens from the same single agent-loop-free\n// leaf it already pulls createSandboxClient / resume-by-id from.\n\nimport {\n  DESKTOP_STREAM_PORT,\n  StreamTokenPayload,\n  signStreamToken,\n  verifyStreamToken as verifyStreamTokenEnvelope,\n  type StreamTokenPayload as StreamTokenPayloadType,\n} from \"@opengeni/contracts\";\n\n// The default stream-token TTL (seconds). The token is short-lived by design:\n// URL rotation is event-driven under the epoch fence (re-resolve recorded on the\n// lease), not on a keepalive clock — so the token never needs a long life.\nexport const STREAM_TOKEN_DEFAULT_TTL_SECONDS = 120;\n\nexport type MintStreamTokenInput = {\n  workspaceId: string;\n  sessionId: string;\n  /** The sandbox_lease_holders viewer row id. */\n  viewerId: string;\n  /** The epoch the token is fenced to. For a Modal box this is the live LEASE\n   *  epoch (re-minted on box rollover). For a SELFHOSTED relay stream (M8b) this is\n   *  the session's swap `active_epoch`: the relay tracks the highest epoch any\n   *  viewer presented per channel and REJECTS a token with a lower epoch, so a\n   *  viewer whose token predates a swap-away cannot reach the machine the session\n   *  swapped off of. One field, two fences — the relay/in-box edge reads it as the\n   *  stale-viewer floor either way. */\n  leaseEpoch: number;\n  /** `view` (default) only watches; `control` lets the relay forward this\n   *  viewer's input (PTY keystrokes; typed desktop input on the desktop port). */\n  mode?: \"view\" | \"control\";\n  /** The exposed stream port (noVNC); defaults to 6080. */\n  port?: number;\n  /** TTL in seconds; defaults to STREAM_TOKEN_DEFAULT_TTL_SECONDS. */\n  ttlSeconds?: number;\n  /** Override the issue clock (tests). Seconds since the epoch. */\n  nowSeconds?: number;\n  /** The authenticated viewer subject the token is minted for (0281). */\n  subjectId?: string;\n  /** The session authority epoch observed at mint (0281). */\n  authorityEpoch?: number;\n  /** A Connected Machine relay stream's exact channel. When set, the token's\n   *  workspace is the channel's (where the machine is enrolled) and the relay\n   *  only accepts it for this machine and stream instance. */\n  relayChannel?: { workspaceId: string; agentId: string; channelId: string };\n};\n\n/**\n * Mint a scoped stream token for one viewer holder. Builds the hard-narrow\n * StreamTokenPayload (the claim set the in-box edge / control plane validates)\n * and signs it with the resolved stream-token secret via the contracts HMAC\n * envelope (`ogs_` prefix). The token is RECORDED against the holder row by the\n * caller and is NEVER appended to the data-plane URL as a query param.\n */\nexport async function mintStreamToken(\n  secret: string,\n  input: MintStreamTokenInput,\n): Promise<string> {\n  const nowSeconds = input.nowSeconds ?? Math.floor(Date.now() / 1000);\n  const ttlSeconds = input.ttlSeconds ?? STREAM_TOKEN_DEFAULT_TTL_SECONDS;\n  const payload: StreamTokenPayloadType = StreamTokenPayload.parse({\n    workspaceId: input.relayChannel?.workspaceId ?? input.workspaceId,\n    sessionId: input.sessionId,\n    viewerId: input.viewerId,\n    leaseEpoch: input.leaseEpoch,\n    mode: input.mode ?? \"view\",\n    port: input.port ?? DESKTOP_STREAM_PORT,\n    exp: nowSeconds + ttlSeconds,\n    ...(input.subjectId ? { subjectId: input.subjectId } : {}),\n    ...(input.authorityEpoch ? { authorityEpoch: input.authorityEpoch } : {}),\n    ...(input.relayChannel\n      ? { agentId: input.relayChannel.agentId, channelId: input.relayChannel.channelId }\n      : {}),\n  });\n  return signStreamToken(secret, payload);\n}\n\n/**\n * Verify a scoped stream token. Returns the parsed claims on success, or null on\n * a bad prefix / malformed envelope / bad HMAC signature / schema-invalid claims\n * / expiry. Re-exports the contracts verify; the leaf is the agent-loop-free\n * import surface the API uses.\n *\n * The epoch fence (claim.leaseEpoch vs the LIVE lease epoch) and the\n * workspace+session scope are enforced at USE by the caller against the live\n * lease + route params — verify proves authenticity + freshness only.\n */\nexport async function verifyStreamToken(\n  secret: string,\n  token: string,\n  nowSeconds = Math.floor(Date.now() / 1000),\n): Promise<StreamTokenPayloadType | null> {\n  return verifyStreamTokenEnvelope(secret, token, nowSeconds);\n}\n\nexport {\n  StreamTokenPayload,\n  type StreamTokenPayload as StreamTokenPayloadType,\n} from \"@opengeni/contracts\";\n","import { DefaultAdapterFactory, type AdapterFactory } from \"@alibaba-group/opensandbox\";\nimport { AsyncLocalStorage } from \"node:async_hooks\";\n\ntype Commands = ReturnType<AdapterFactory[\"createExecdStack\"]>[\"commands\"];\nconst defaultCreateExecdStack = DefaultAdapterFactory.prototype.createExecdStack;\nconst boundDefaultCommands = new WeakMap<Commands, Pick<Commands, \"run\" | \"runStream\">>();\nconst commandDispatch = new AsyncLocalStorage<{ attempted: boolean }>();\n\n/** Local proof from the actual command invocation and its bound wire seam,\n * never inferred from provider status codes, error text or a missing init. */\nexport class OpenSandboxCommandDispatchError extends Error {\n  constructor(\n    readonly notDispatched: boolean,\n    cause: unknown,\n  ) {\n    super(\n      notDispatched\n        ? \"OpenSandbox command was not dispatched\"\n        : \"OpenSandbox command dispatch is uncertain\",\n      { cause },\n    );\n    this.name = \"OpenSandboxCommandDispatchError\";\n  }\n}\n\nexport async function withOpenSandboxCommandDispatchProof<T>(\n  commands: Commands,\n  invoke: () => Promise<T>,\n): Promise<T> {\n  const bound = boundDefaultCommands.get(commands);\n  const trusted =\n    bound !== undefined && bound.run === commands.run && bound.runStream === commands.runStream;\n  const state = { attempted: false };\n  return await commandDispatch.run(state, async () => {\n    try {\n      return await invoke();\n    } catch (cause) {\n      // A custom adapter can bypass this fetch entirely. Its absence is never\n      // no-dispatch proof; only an unchanged, genuinely bound default SDK path\n      // that failed before invoking the command transport can grant that proof.\n      throw new OpenSandboxCommandDispatchError(trusted && !state.attempted, cause);\n    }\n  });\n}\n\n/** A successful command HTTP response was accepted, but its event stream no\n * longer proves complete output or exit. It is not proof of an unstarted op. */\nexport class OpenSandboxCommandStreamError extends Error {\n  constructor(message: string, cause?: unknown) {\n    super(`OpenSandbox command stream is uncertain: ${message}`, { cause });\n    this.name = \"OpenSandboxCommandStreamError\";\n  }\n}\n\n/** Decode complete wire lines, not whole transport chunks: a corrupt later\n * line must not erase an earlier authenticated init in the same HTTP chunk. */\nasync function* wireLines(reader: ReadableStreamDefaultReader<Uint8Array>) {\n  const decoder = new TextDecoder(\"utf-8\", { fatal: true, ignoreBOM: true });\n  let parts: Uint8Array[] = [];\n  let skipLf = false;\n  let first = true;\n  const decode = () => {\n    let line = decoder.decode(Buffer.concat(parts));\n    parts = [];\n    if (first) line = line.replace(/^\\uFEFF/u, \"\");\n    first = false;\n    return line;\n  };\n  while (true) {\n    const { done, value } = await reader.read();\n    if (done) break;\n    let start = 0;\n    for (let index = 0; index < value.length; index++) {\n      const byte = value[index];\n      if (skipLf) {\n        skipLf = false;\n        if (byte === 10) {\n          start = index + 1;\n          continue;\n        }\n      }\n      if (byte !== 10 && byte !== 13) continue;\n      parts.push(value.subarray(start, index));\n      yield { line: decode(), terminated: true };\n      skipLf = byte === 13;\n      start = index + 1;\n    }\n    if (start < value.length) parts.push(value.subarray(start));\n  }\n  if (parts.length) yield { line: decode(), terminated: false };\n}\n\n/** The SDK coerces these fields with String(), which can turn an array value\n * into a successful exit code. Validate the wire DTO before that conversion.\n * Fields are optional in the provider schema; supplied aliases must agree. */\nfunction assertCommandError(value: unknown): void {\n  if (!value || typeof value !== \"object\" || Array.isArray(value))\n    throw new Error(\"invalid command error envelope\");\n  const error = value as Record<string, unknown>;\n  let recognized = false;\n  for (const [primary, alias] of [\n    [\"ename\", \"name\"],\n    [\"evalue\", \"value\"],\n  ] as const) {\n    for (const field of [primary, alias]) {\n      if (error[field] === undefined) continue;\n      recognized = true;\n      if (typeof error[field] !== \"string\") throw new Error(\"invalid command error field\");\n    }\n    if (\n      error[primary] !== undefined &&\n      error[alias] !== undefined &&\n      error[primary] !== error[alias]\n    )\n      throw new Error(\"contradictory command error aliases\");\n  }\n  if (error.traceback !== undefined) {\n    recognized = true;\n    if (!Array.isArray(error.traceback) || error.traceback.some((line) => typeof line !== \"string\"))\n      throw new Error(\"invalid command error traceback\");\n  }\n  if (!recognized) throw new Error(\"empty command error DTO\");\n}\n\nasync function* commandFrames(response: Response): AsyncGenerator<Uint8Array> {\n  if (!response.body) throw new OpenSandboxCommandStreamError(\"missing response body\");\n  const reader = response.body.getReader();\n  const encoder = new TextEncoder();\n  let data: string[] = [];\n  let executionId: string | null = null;\n  let completed = false;\n  let eof = false;\n  // The SDK supports SSE and NDJSON independently of the response MIME type.\n  let mode: \"sse\" | \"ndjson\" | null = null;\n  const frame = (json: string) => {\n    const value: unknown = JSON.parse(json);\n    if (!value || typeof value !== \"object\" || Array.isArray(value))\n      throw new Error(\"invalid command event envelope\");\n    const event = value as Record<string, unknown>;\n    if (typeof event.type !== \"string\") throw new Error(\"missing command event type\");\n    if (event.type === \"init\") {\n      if (typeof event.text !== \"string\" || !event.text.trim())\n        throw new Error(\"missing execution identity\");\n      if (executionId !== null && event.text !== executionId)\n        throw new Error(\"contradictory execution identity\");\n      executionId = event.text;\n    }\n    for (const field of [\"id\", \"execution_id\", \"executionId\"] as const) {\n      if (event[field] !== undefined && event[field] !== executionId)\n        throw new Error(\"contradictory event identity\");\n    }\n    if ((event.type === \"stdout\" || event.type === \"stderr\") && typeof event.text !== \"string\")\n      throw new Error(\"invalid command output\");\n    if (event.type === \"error\") assertCommandError(event.error);\n    if (event.type === \"execution_complete\") {\n      if (executionId === null) throw new Error(\"completion without execution identity\");\n      completed = true;\n    }\n    // The pinned SDK accepts one JSON value per data line, but not legal SSE\n    // multiline JSON. Canonicalizing only framing preserves every text value.\n    return encoder.encode(`data: ${JSON.stringify(event)}\\n\\n`);\n  };\n  try {\n    for await (const { line, terminated } of wireLines(reader)) {\n      if (mode === null && line && !line.startsWith(\":\"))\n        mode = line.trimStart().startsWith(\"{\") ? \"ndjson\" : \"sse\";\n      if (mode === \"ndjson\") {\n        if (line.trim()) yield frame(line);\n        continue;\n      }\n      if (!terminated && line && !line.startsWith(\":\")) throw new Error(\"truncated SSE line\");\n      if (line === \"\") {\n        if (data.length) {\n          const json = data.join(\"\\n\");\n          data = [];\n          yield frame(json);\n        }\n        continue;\n      }\n      if (line.startsWith(\":\")) continue;\n      const colon = line.indexOf(\":\");\n      const field = colon === -1 ? line : line.slice(0, colon);\n      const value = colon === -1 ? \"\" : line.slice(colon + 1).replace(/^ /u, \"\");\n      if (field === \"data\") data.push(value);\n      // Other legal SSE fields (event/id/retry/extensions) do not alter data.\n    }\n    eof = true;\n    if (data.length) throw new Error(\"truncated SSE frame\");\n    if (!completed) throw new Error(\"EOF without command completion\");\n  } catch (error) {\n    throw error instanceof OpenSandboxCommandStreamError\n      ? error\n      : new OpenSandboxCommandStreamError(\"invalid or incomplete events\", error);\n  } finally {\n    if (!eof) await reader.cancel().catch(() => undefined);\n    reader.releaseLock();\n  }\n}\n\nfunction strictCommandFetch(original: typeof fetch): typeof fetch {\n  const wrapped = (async (input, init) => {\n    const url = input instanceof Request ? input.url : String(input);\n    const isCommand =\n      (init?.method ?? (input instanceof Request ? input.method : \"GET\")).toUpperCase() ===\n        \"POST\" && new URL(url).pathname.endsWith(\"/command\");\n    // Mark BEFORE the original transport. Header loss and a non-2xx response\n    // do not prove that the provider refused the original mutation.\n    const dispatch = commandDispatch.getStore();\n    if (isCommand && dispatch) dispatch.attempted = true;\n    const response = await original(input, init);\n    if (!response.ok || !isCommand) return response;\n    if (!response.body) throw new OpenSandboxCommandStreamError(\"missing response body\");\n    const frames = commandFrames(response);\n    const body = new ReadableStream<Uint8Array>(\n      {\n        async pull(controller) {\n          try {\n            const next = await frames.next();\n            if (next.done) controller.close();\n            else controller.enqueue(next.value);\n          } catch (error) {\n            controller.error(error);\n          }\n        },\n        async cancel() {\n          await frames.return(undefined);\n        },\n      },\n      // Do not observe later errors ahead of the SDK consuming a valid page.\n      { highWaterMark: 0 },\n    );\n    const headers = new Headers(response.headers);\n    headers.delete(\"content-length\");\n    headers.delete(\"content-encoding\");\n    headers.set(\"content-type\", \"text/event-stream\");\n    return new Response(body, {\n      status: response.status,\n      statusText: response.statusText,\n      headers,\n    });\n  }) as typeof fetch;\n  return wrapped;\n}\n\n/** Public factory/config seams only. The SDK still owns request construction,\n * headers, dispatch, HTTP errors and event callbacks. No start is repeated. */\nexport function withOpenSandboxCommandStreamProof(factory: AdapterFactory): AdapterFactory {\n  return {\n    createLifecycleStack: (options) => factory.createLifecycleStack(options),\n    createEgressStack: (options) => factory.createEgressStack(options),\n    createExecdStack(options) {\n      const sseFetch = strictCommandFetch(options.connectionConfig.sseFetch);\n      const createExecdStack = factory.createExecdStack;\n      const stack = createExecdStack.call(factory, {\n        ...options,\n        connectionConfig: new Proxy(options.connectionConfig, {\n          get(target, property) {\n            return property === \"sseFetch\" ? sseFetch : Reflect.get(target, property, target);\n          },\n        }),\n      });\n      if (createExecdStack === defaultCreateExecdStack) {\n        // The public default constructor binds THIS sseFetch to its commands.\n        // Delegating/custom factory methods are not assumed to do the same.\n        boundDefaultCommands.set(stack.commands, {\n          run: stack.commands.run,\n          runStream: stack.commands.runStream,\n        });\n      }\n      return stack;\n    },\n  };\n}\n","// The one owner of compute sandboxes nothing durable names any more.\n//\n// The control service is the inventory: every sandbox Opengeni creates carries its\n// deployment's gateway, workspace, sandbox group and enrollment in its metadata.\n// A sandbox whose enrollment is no longer the live box of its group (a create\n// whose answer was lost, a cleanup that failed, a worker that crashed between\n// create and commit, a workspace deleted with everything in it) has its\n// enrollment revoked and is deleted here. Nothing on this path messages its agent,\n// so the sweep never wakes or keeps awake a sleeping sandbox.\n\nimport type { ComputeControlClient, ComputeSandboxView } from \"./control\";\n\n/**\n * How long a create the control service has never seen may still arrive there, and how\n * long a new sandbox may wait for its create to commit. Nothing younger is\n * treated as abandoned.\n */\nexport const UNSEEN_CREATE_SETTLE_MS = 10 * 60_000;\n\n/** The metadata a compute create stamps on its sandbox. */\nexport const COMPUTE_METADATA = {\n  gateway: \"opengeni_gateway\",\n  workspaceId: \"opengeni_workspace_id\",\n  sandboxGroupId: \"opengeni_sandbox_group_id\",\n  enrollmentId: \"opengeni_enrollment_id\",\n} as const;\n\n/** The Opengeni identity of one compute sandbox, from its create's metadata. */\nexport type ComputeSandboxIdentity = {\n  sandboxId: string;\n  workspaceId: string;\n  sandboxGroupId: string;\n  enrollmentId: string;\n};\n\n/** Deletions per sweep, so one pass stays short; the next pass continues. */\nexport const COMPUTE_ORPHAN_SWEEP_LIMIT = 50;\n\nexport type ComputeOrphanSweepResult = {\n  examined: number;\n  deleted: ComputeSandboxIdentity[];\n  failed: number;\n};\n\nconst UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;\n\nfunction identityOf(view: ComputeSandboxView): ComputeSandboxIdentity | null {\n  const workspaceId = view.metadata?.[COMPUTE_METADATA.workspaceId];\n  const sandboxGroupId = view.metadata?.[COMPUTE_METADATA.sandboxGroupId];\n  const enrollmentId = view.metadata?.[COMPUTE_METADATA.enrollmentId];\n  // Opengeni names everything with UUIDs; anything else is not its sandbox.\n  if (![workspaceId, sandboxGroupId, enrollmentId].every((id) => id && UUID.test(id))) {\n    return null;\n  }\n  if (!workspaceId || !sandboxGroupId || !enrollmentId) return null;\n  // The agent the sandbox runs is the enrollment its create named.\n  if (view.agent && (view.agent.agent !== enrollmentId || view.agent.workspace !== workspaceId)) {\n    return null;\n  }\n  return { sandboxId: view.id, workspaceId, sandboxGroupId, enrollmentId };\n}\n\n/** Orphans handled at once, so one stalled delete never holds up the rest. */\nexport const COMPUTE_ORPHAN_SWEEP_CONCURRENCY = 8;\n\n/** How long a candidate whose cleanup failed sits out, doubling per failure. */\nexport const COMPUTE_ORPHAN_RETRY_BASE_MS = 10 * 60_000;\nexport const COMPUTE_ORPHAN_RETRY_MAX_MS = 60 * 60_000;\n\n/**\n * What one sweeper carries from pass to pass, so every listed sandbox is\n * reached in turn: each pass resumes after the last candidate the previous one\n * reached (wrapping around), and a candidate whose cleanup failed sits out a\n * growing interval instead of using up the next pass. Kept in memory; a fresh\n * sweeper simply starts at the oldest sandbox.\n */\nexport type ComputeOrphanSweepProgress = {\n  cursor: string | undefined;\n  failures: Map<string, { count: number; retryAtMs: number }>;\n};\n\nexport function createComputeOrphanSweepProgress(): ComputeOrphanSweepProgress {\n  return { cursor: undefined, failures: new Map() };\n}\n\n/** A stable traversal order: oldest first, the sandbox id breaking ties. */\nfunction traversalKey(view: Pick<ComputeSandboxView, \"id\" | \"created_ms\">): string {\n  return `${String(Math.max(0, Math.floor(view.created_ms))).padStart(16, \"0\")}:${view.id}`;\n}\n\n/** `ordered` (sorted by key) resumed after `cursor`, wrapping around. */\nfunction resumedAfter<T extends { key: string }>(ordered: T[], cursor: string | undefined): T[] {\n  const resumeAt = cursor === undefined ? 0 : ordered.findIndex((entry) => entry.key > cursor);\n  return resumeAt <= 0 ? ordered : [...ordered.slice(resumeAt), ...ordered.slice(0, resumeAt)];\n}\n\n/** Sit `id` out for a growing interval after a failed cleanup. */\nfunction deferFailed(progress: ComputeOrphanSweepProgress, id: string, nowMs: number): void {\n  const count = (progress.failures.get(id)?.count ?? 0) + 1;\n  const delay = Math.min(\n    COMPUTE_ORPHAN_RETRY_MAX_MS,\n    COMPUTE_ORPHAN_RETRY_BASE_MS * 2 ** Math.min(count - 1, 16),\n  );\n  progress.failures.set(id, { count, retryAtMs: nowMs + delay });\n}\n\n/** Wait for `work`, or end as soon as `signal` aborts. */\nasync function untilStopped<T>(work: Promise<T>, signal: AbortSignal | undefined): Promise<T> {\n  if (!signal) return await work;\n  work.catch(() => {});\n  let onAbort: (() => void) | undefined;\n  const stopped = new Promise<never>((_, reject) => {\n    onAbort = () => reject(new Error(\"The compute orphan sweep was stopped.\"));\n    if (signal.aborted) onAbort();\n    else signal.addEventListener(\"abort\", onAbort, { once: true });\n  });\n  stopped.catch(() => {});\n  try {\n    return await Promise.race([work, stopped]);\n  } finally {\n    if (onAbort) signal.removeEventListener(\"abort\", onAbort);\n  }\n}\n\n/**\n * Delete every sandbox of this deployment that nothing durable names. Its\n * enrollment is revoked first and the sandbox deleted after, so the control service's\n * listing keeps the cleanup owned until both are done: a failed revoke leaves\n * everything for the next sweep, and a failed delete leaves a listed sandbox\n * whose revoked enrollment no longer names it. Enrollments whose sandbox is\n * already gone are not seen here; the worker's stale-enrollment reconcile\n * revokes those.\n *\n * `named` decides from Opengeni's own records (the enrollment is active and its\n * group's lease holds this box, or a creator is still working on the group). A\n * sandbox younger than the settle window is left alone, because its create may\n * not have committed yet. Orphans are handled a few at a time; once `signal`\n * aborts (the caller's budget or cancellation) no new one starts and the\n * checks and requests in flight are abandoned at once. Failures are counted\n * and, with `progress`, sit out a while so the candidates behind them are\n * reached.\n */\nexport async function sweepComputeOrphans(input: {\n  control: Pick<ComputeControlClient, \"list\" | \"delete\">;\n  /** This deployment's gateway URL, stamped on every sandbox it creates. */\n  gateway: string;\n  named(identity: ComputeSandboxIdentity): Promise<boolean>;\n  revokeEnrollment(input: { workspaceId: string; enrollmentId: string }): Promise<void>;\n  nowMs?: number;\n  maxDeletions?: number;\n  concurrency?: number;\n  /** Stops the sweep: no new orphan starts after it aborts. Pass the same\n   * signal to the control service client so the requests in flight end too. */\n  signal?: AbortSignal;\n  /** Carried between passes by one sweeper (see ComputeOrphanSweepProgress). */\n  progress?: ComputeOrphanSweepProgress;\n}): Promise<ComputeOrphanSweepResult> {\n  const nowMs = input.nowMs ?? Date.now();\n  const maxDeletions = input.maxDeletions ?? COMPUTE_ORPHAN_SWEEP_LIMIT;\n  const concurrency = Math.max(1, input.concurrency ?? COMPUTE_ORPHAN_SWEEP_CONCURRENCY);\n  const signal = input.signal;\n  const progress = input.progress;\n  const result: ComputeOrphanSweepResult = { examined: 0, deleted: [], failed: 0 };\n  if (signal?.aborted) return result;\n  const views = await untilStopped(\n    input.control.list({ [COMPUTE_METADATA.gateway]: input.gateway }),\n    signal,\n  );\n  const ordered: { key: string; identity: ComputeSandboxIdentity }[] = [];\n  const listed = new Set<string>();\n  for (const view of views) {\n    const identity = identityOf(view);\n    if (!identity) continue;\n    result.examined += 1;\n    listed.add(identity.sandboxId);\n    if (nowMs - view.created_ms < UNSEEN_CREATE_SETTLE_MS) continue;\n    const failure = progress?.failures.get(identity.sandboxId);\n    if (failure && failure.retryAtMs > nowMs) continue;\n    ordered.push({ key: traversalKey(view), identity });\n  }\n  if (progress) {\n    // A sandbox the control service no longer lists needs nothing more.\n    for (const sandboxId of progress.failures.keys()) {\n      if (!listed.has(sandboxId)) progress.failures.delete(sandboxId);\n    }\n  }\n  ordered.sort((a, b) => (a.key < b.key ? -1 : a.key > b.key ? 1 : 0));\n  // Resume after the last candidate the previous pass reached, wrapping around.\n  const candidates = resumedAfter(ordered, progress?.cursor);\n  const recordFailure = (sandboxId: string): void => {\n    result.failed += 1;\n    if (progress) deferFailed(progress, sandboxId, nowMs);\n  };\n  let next = 0;\n  let started = 0;\n  const work = async (): Promise<void> => {\n    while (next < candidates.length && started < maxDeletions && !input.signal?.aborted) {\n      const { key, identity } = candidates[next]!;\n      next += 1;\n      if (progress) progress.cursor = key;\n      try {\n        if (await untilStopped(input.named(identity), signal)) {\n          progress?.failures.delete(identity.sandboxId);\n          continue;\n        }\n        if (signal?.aborted) return;\n        started += 1;\n        await untilStopped(\n          input.revokeEnrollment({\n            workspaceId: identity.workspaceId,\n            enrollmentId: identity.enrollmentId,\n          }),\n          signal,\n        );\n        await input.control.delete(identity.sandboxId);\n        result.deleted.push(identity);\n        progress?.failures.delete(identity.sandboxId);\n      } catch {\n        // A stopped sweep did not fail this candidate; the next pass retries it.\n        if (signal?.aborted) return;\n        recordFailure(identity.sandboxId);\n      }\n    }\n  };\n  await Promise.all(Array.from({ length: Math.min(concurrency, candidates.length) }, work));\n  return result;\n}\n\nexport type StaleComputeEnrollment = { workspaceId: string; enrollmentId: string };\n\n/** One page of the stale inventory, in enrollment-id order. */\nexport type StaleComputeEnrollmentPage = {\n  candidates: StaleComputeEnrollment[];\n  /** The inventory may go on past this page. */\n  more: boolean;\n};\n\n/**\n * Revoke the compute sandbox enrollments Opengeni's own records show are stale\n * (their sandbox is already gone, so no listing from the control service names them; see the\n * database's stale inventory). The inventory is read a page at a time in\n * enrollment-id order. With `progress` (its own, keyed by enrollment) each\n * pass reads the page after the last enrollment the previous one reached, and\n * starts again at the beginning after the last page; a failed revoke sits out\n * a while. However many enrollments keep failing, every other one is reached\n * within a few passes, and one whose workspace stays locked never keeps the\n * others waiting. Enrollments are revoked a few at a time; give each `revoke`\n * its own short deadline so a stuck one fails, rather than holding a slot\n * until `signal` stops the whole pass. Once `signal` aborts no new revoke\n * starts.\n */\nexport async function reconcileStaleComputeEnrollments(input: {\n  /** The page after `after` (from the start when undefined). */\n  list(after: string | undefined): Promise<StaleComputeEnrollmentPage>;\n  /** True when it revoked the enrollment, false when it no longer qualifies. */\n  revoke(candidate: StaleComputeEnrollment): Promise<boolean>;\n  nowMs?: number;\n  concurrency?: number;\n  signal?: AbortSignal;\n  progress?: ComputeOrphanSweepProgress;\n}): Promise<{ examined: number; revoked: StaleComputeEnrollment[]; failed: number }> {\n  const nowMs = input.nowMs ?? Date.now();\n  const concurrency = Math.max(1, input.concurrency ?? COMPUTE_ORPHAN_SWEEP_CONCURRENCY);\n  const { signal, progress } = input;\n  const result = { examined: 0, revoked: [] as StaleComputeEnrollment[], failed: 0 };\n  if (signal?.aborted) return result;\n  let after = progress?.cursor;\n  let page = await untilStopped(input.list(after), signal);\n  if (page.candidates.length === 0 && after !== undefined) {\n    // The previous pass reached the end: start again at the beginning.\n    after = undefined;\n    page = await untilStopped(input.list(undefined), signal);\n  }\n  const listed = page.candidates;\n  result.examined = listed.length;\n  const last = listed.at(-1)?.enrollmentId;\n  if (progress) {\n    // Forget the failures of enrollments this page shows are no longer stale.\n    const ids = new Set(listed.map((candidate) => candidate.enrollmentId));\n    const covered = (id: string): boolean =>\n      (after === undefined || id > after) && (!page.more || (last !== undefined && id <= last));\n    for (const id of progress.failures.keys()) {\n      if (covered(id) && !ids.has(id)) progress.failures.delete(id);\n    }\n  }\n  let next = 0;\n  const work = async (): Promise<void> => {\n    while (next < listed.length && !input.signal?.aborted) {\n      const candidate = listed[next]!;\n      next += 1;\n      if (progress) progress.cursor = candidate.enrollmentId;\n      const failure = progress?.failures.get(candidate.enrollmentId);\n      if (failure && failure.retryAtMs > nowMs) continue;\n      try {\n        if (await untilStopped(input.revoke(candidate), signal)) result.revoked.push(candidate);\n        progress?.failures.delete(candidate.enrollmentId);\n      } catch {\n        // A stopped pass did not fail this enrollment; the next pass retries it.\n        if (signal?.aborted) return;\n        result.failed += 1;\n        if (progress) deferFailed(progress, candidate.enrollmentId, nowMs);\n      }\n    }\n  };\n  await Promise.all(Array.from({ length: Math.min(concurrency, listed.length) }, work));\n  // The whole page was reached: the next pass reads the page after it, or the\n  // first page again once this was the last.\n  if (progress && next >= listed.length && !signal?.aborted) {\n    progress.cursor = page.more ? last : undefined;\n  }\n  return result;\n}\n","// Bring-your-own-compute: the user's own machine, enrolled via the Rust agent,\n// is reached over the NATS request/reply control plane. Postgres resolves the\n// exact claimed runner instance and NATS addresses\n// `agent.<workspace>.<agentId>.connection.<instanceId>.rpc`. There is NO provider\n// SDK and NO per-box credential — \"the agent is the box\".\n//\n// M3 ships the REAL `SelfhostedSandboxClient`: its `create()`/`resume()` return a\n// `SelfhostedSession` presenting the structural surface (`exec`/`readFile`/\n// `writeFile`/`resolveExposedPort`/`serializeSessionState`) that Channel-A and the\n// viewer consume unchanged — backed by a `ControlRpc` seam\n// (request/reply encoded via `@opengeni/agent-proto`) instead of a provider SDK.\n// `serializeSessionState`/`deserializeSessionState` round-trip `{agentId}` ONLY:\n// resume = re-address the live subject, never a cold re-create (the machine is\n// not recreatable). The live NATS request/reply transport + Accounts land in M4\n// behind the SAME `ControlRpc`.\n\nimport type { Settings } from \"@opengeni/config\";\nimport { CAPABILITY_DESCRIPTORS } from \"../capabilities\";\nimport {\n  NatsControlRpc,\n  type ControlRpc,\n  type NatsRequestConnection,\n} from \"../selfhosted/control-rpc\";\nimport { SelfhostedSandboxClient, type SelfhostedRelayConfig } from \"../selfhosted/session\";\nimport type { ProviderRegistration } from \"./types\";\n\n/**\n * Resolve the relay-URL shape config from settings. M8b threads the real relay\n * deployment URL (`OPENGENI_SELFHOSTED_RELAY_URL`, ops-repo IaC) behind this seam:\n * `resolveExposedPort` returns `{host, port, tls, path, query}` so `buildStreamUrl`\n * assembles the relay dial URL. A path-less URL defaults to the relay's `/stream`\n * route; an unconfigured deployment falls back to a placeholder host (the URL shape\n * is still well-formed; the relay is simply unreachable until configured).\n */\nexport function resolveRelayConfig(settings: Settings): SelfhostedRelayConfig {\n  const raw = settings.selfhostedRelayUrl?.trim();\n  if (!raw) {\n    return { host: \"relay.opengeni.local\", port: 443, tls: true, path: \"/stream\" };\n  }\n  try {\n    const url = new URL(raw.includes(\"://\") ? raw : `wss://${raw}`);\n    const tls = url.protocol === \"wss:\" || url.protocol === \"https:\";\n    const port = url.port ? Number(url.port) : tls ? 443 : 80;\n    const path = url.pathname && url.pathname !== \"/\" ? url.pathname : \"/stream\";\n    return { host: url.hostname, port, tls, path };\n  } catch {\n    return { host: raw, port: 443, tls: true, path: \"/stream\" };\n  }\n}\n\n/**\n * The default `ControlRpc` factory for a registry-built client: a\n * `NatsControlRpc` whose connection factory returns null — there is NO live NATS\n * connection wired into the agent-loop-free runtime leaf at build() time (the\n * API/worker inject the live `@opengeni/events` connection per request in M4).\n * A null connection surfaces `agent_offline` on every op rather than throwing at\n * construction, so boot never requires a live NATS — exactly the M3 ruling.\n */\nfunction defaultControlRpcFactory(): ControlRpc {\n  return new NatsControlRpc(async (): Promise<NatsRequestConnection | null> => null);\n}\n\nexport const selfhostedProvider: ProviderRegistration = {\n  backend: \"selfhosted\",\n  exactResumeMode: \"ordinary\",\n  instanceIdFields: [\"agentId\"],\n  workspaceCapturePolicy: () => null,\n  descriptor: CAPABILITY_DESCRIPTORS.selfhosted,\n  // Same session as compute: no agent stdin, whatever the person's terminal has.\n  sessionSupportsPty: false,\n  /**\n   * No per-box credentials: the machine is reached over the agent's own\n   * enrollment. The enrollment-signing + relay-token secrets are deployment-level\n   * config that lands with the connectivity/enrollment milestones (M4/M5) — and\n   * the whole feature is gated by a `sandboxSelfhostedEnabled` flag (default off)\n   * that does not yet exist in Settings. So validation is LENIENT (no-op) in M3:\n   * boot must never break, and there is nothing per-box to validate. M4/M5 add\n   * the (flag-gated) signing/relay presence checks here behind the same seam.\n   */\n  validateCredentials() {},\n  /**\n   * Build the registry client. `create()`/`resume()` bind a `SelfhostedSession`\n   * to the agent subject; the per-request `{workspaceId, agentId, controlRpc}`\n   * are supplied by the resume path (the lease's enrollment) — the registry\n   * client carries the relay config + the default (offline-until-M4) ControlRpc\n   * factory and a backendId-correct surface for `assertProviderRegistryInvariants`.\n   */\n  build({ settings }) {\n    return new SelfhostedSandboxClient({\n      // The workspaceId is bound per-request by the resume path (the API/worker\n      // construct a request-scoped client with the lease's workspace + a live\n      // ControlRpc). The registry-built client is the boot/assertion shape; an\n      // empty workspaceId is fine until a session is bound with a real one.\n      workspaceId: \"\",\n      // Inert registry shape only; request-scoped production clients replace\n      // this with the persisted machine Hello root before any operation.\n      workspaceRoot: \"/workspace\",\n      relay: resolveRelayConfig(settings),\n      controlRpcFactory: defaultControlRpcFactory,\n    });\n  },\n};\n","import { DaytonaSandboxClient } from \"@openai/agents-extensions/sandbox/daytona\";\nimport { CAPABILITY_DESCRIPTORS } from \"../capabilities\";\nimport { SandboxConfigError } from \"../errors\";\nimport { REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE, type ProviderRegistration } from \"./types\";\nimport { withDaytonaCommandBinding } from \"./daytona-command-binding\";\n\nexport const daytonaProvider: ProviderRegistration = {\n  backend: \"daytona\",\n  exactResumeMode: \"custom\",\n  instanceIdFields: [\"sandboxId\"],\n  workspaceCapturePolicy: () => REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE,\n  descriptor: CAPABILITY_DESCRIPTORS.daytona,\n  sessionSupportsPty: true,\n  validateCredentials(settings) {\n    if (!settings.daytonaApiKey) {\n      throw new SandboxConfigError(\"daytona\", \"OPENGENI_DAYTONA_API_KEY is required\");\n    }\n  },\n  build({ settings, environment, exposedPorts }) {\n    const options: NonNullable<ConstructorParameters<typeof DaytonaSandboxClient>[0]> = {\n      apiKey: settings.daytonaApiKey!,\n      env: environment,\n      exposedPorts,\n    };\n    if (settings.daytonaApiUrl) options.apiUrl = settings.daytonaApiUrl;\n    if (settings.daytonaTarget) options.target = settings.daytonaTarget;\n    if (settings.daytonaImage) options.image = settings.daytonaImage;\n    if (settings.daytonaSnapshotName) options.sandboxSnapshotName = settings.daytonaSnapshotName;\n    // autoStopInterval=0 disables the idle-kill, so forward 0 explicitly.\n    if (settings.daytonaAutoStopInterval !== undefined) {\n      options.autoStopInterval = settings.daytonaAutoStopInterval;\n    }\n    if (settings.daytonaTimeoutSeconds) options.timeoutSec = settings.daytonaTimeoutSeconds;\n    if (settings.daytonaExposedPortUrlTtlSeconds) {\n      options.exposedPortUrlTtlS = settings.daytonaExposedPortUrlTtlSeconds;\n    }\n    return withDaytonaCommandBinding(new DaytonaSandboxClient(options), options);\n  },\n};\n","import {\n  DockerSandboxClient,\n  DockerSandboxSession,\n  type DockerSandboxClientOptions,\n} from \"@openai/agents/sandbox/local\";\nimport { NoopSnapshotSpec } from \"@openai/agents/sandbox\";\nimport { execFile } from \"node:child_process\";\nimport { lstat } from \"node:fs/promises\";\nimport { isAbsolute } from \"node:path\";\nimport { promisify } from \"node:util\";\nimport { CAPABILITY_DESCRIPTORS } from \"../capabilities\";\nimport { installDurableShellProcesses } from \"../durable-shell-process\";\nimport {\n  SandboxConfigError,\n  SandboxExactResumeInstanceUnavailableError,\n  SandboxProviderWorkspaceAbsentError,\n} from \"../errors\";\nimport { REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE, type ProviderRegistration } from \"./types\";\n\nimport {\n  attachDockerWorkspaceForDrain,\n  dockerWorkspaceProvablyAbsent,\n  rememberOwnedDockerSdkState,\n  rememberSerializedDockerOwnership,\n  serializeDockerOwnership,\n} from \"./docker-workspace-drain\";\n\nconst execFileAsync = promisify(execFile);\n\n/** False only for a definite ENOENT; every other answer counts as present. */\nasync function pathPresent(path: unknown): Promise<boolean> {\n  if (typeof path !== \"string\") return true;\n  return await lstat(path).then(\n    () => true,\n    (error: unknown) =>\n      !(error && typeof error === \"object\" && Reflect.get(error, \"code\") === \"ENOENT\"),\n  );\n}\nconst DOCKER_EXACT_INSPECT_TIMEOUT_MS = 10_000;\nconst DOCKER_INSTANCE_ID = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;\n\ntype DockerResumeState = {\n  containerId?: unknown;\n  image?: unknown;\n  workspaceRootPath?: unknown;\n  workspaceRootOwned?: unknown;\n  snapshot?: unknown;\n};\n\n/** A cold continuity owner is the only caller allowed to replace a missing\n * Docker execution wrapper while preserving its host workspace. The durable\n * provider state carries the image of the missing container; prefer the\n * currently configured image for the replacement so a deployment upgrade\n * cannot publish a new lease image while silently restarting the old one. */\nexport function dockerContinuityResumeStateForImage<T>(\n  state: T,\n  configuredImage: string | undefined,\n): T {\n  const image = configuredImage?.trim();\n  if (!image || !state || typeof state !== \"object\" || Array.isArray(state)) return state;\n  return { ...state, image };\n}\n\nfunction dockerContinuityKey(state: unknown): string | null {\n  if (!state || typeof state !== \"object\" || Array.isArray(state)) return null;\n  const value = state as DockerResumeState;\n  // Opengeni explicitly disables the SDK's local snapshot facility. Requiring\n  // that invariant prevents the SDK from restoring an older local snapshot\n  // over a newer host workspace before restarting the container.\n  return typeof value.workspaceRootPath === \"string\" &&\n    isAbsolute(value.workspaceRootPath) &&\n    value.workspaceRootOwned === true &&\n    (value.snapshot === null || value.snapshot === undefined)\n    ? value.workspaceRootPath\n    : null;\n}\n\nfunction preserveDockerWorkspaceForDiscard(session: unknown, sessionState: unknown): void {\n  for (const candidate of [(session as { state?: unknown } | null)?.state, sessionState]) {\n    if (!candidate || typeof candidate !== \"object\" || Array.isArray(candidate)) continue;\n    (candidate as { workspaceRootOwned?: boolean }).workspaceRootOwned = false;\n  }\n}\n\nfunction dockerInspectMessage(error: unknown): string {\n  if (!error || typeof error !== \"object\") return \"\";\n  const stderr = Reflect.get(error, \"stderr\");\n  return typeof stderr === \"string\" ? stderr.trim() : \"\";\n}\n\nexport function dockerInspectProvesMissing(error: unknown, containerId: string): boolean {\n  const escaped = containerId.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n  return new RegExp(\n    `^(?:Error|Error response from daemon): No such (?:object|container): ${escaped}$`,\n  ).test(dockerInspectMessage(error));\n}\n\nclass OpenGeniDockerSandboxClient extends DockerSandboxClient {\n  readonly #openGeniOptions: DockerSandboxClientOptions;\n\n  constructor(options: DockerSandboxClientOptions = {}) {\n    super(options);\n    this.#openGeniOptions = options;\n  }\n\n  override async create(...args: Parameters<DockerSandboxClient[\"create\"]>) {\n    const session = await super.create(...args);\n    rememberOwnedDockerSdkState(session.state);\n    return installDurableShellProcesses(session, \"docker\");\n  }\n\n  override async deserializeSessionState(\n    state: Parameters<DockerSandboxClient[\"deserializeSessionState\"]>[0],\n  ) {\n    const restored = await super.deserializeSessionState(state);\n    rememberSerializedDockerOwnership(restored, state);\n    return restored;\n  }\n\n  override async serializeSessionState(\n    state: Parameters<DockerSandboxClient[\"serializeSessionState\"]>[0],\n    options?: Parameters<DockerSandboxClient[\"serializeSessionState\"]>[1],\n  ) {\n    const ownership = await serializeDockerOwnership(this, state);\n    return { ...(await super.serializeSessionState(state, options)), ...ownership };\n  }\n\n  /** Only the server reaper uses this capture-only surface. The network\n   * decorator forwards it without setup, connect or ordinary resume. */\n  async attachWorkspaceForDrain(\n    state: Parameters<DockerSandboxClient[\"resume\"]>[0],\n    assertCurrentCapture: () => Promise<{ archivePublished: boolean }>,\n    options?: Parameters<DockerSandboxClient[\"resume\"]>[1],\n  ) {\n    const archiveLimits =\n      options?.archiveLimits === undefined\n        ? this.#openGeniOptions.archiveLimits\n        : options.archiveLimits;\n    return await attachDockerWorkspaceForDrain(\n      this,\n      state,\n      assertCurrentCapture,\n      undefined,\n      archiveLimits,\n    );\n  }\n\n  /** Ordinary resume is reserved by Opengeni for the elected cold continuity\n   * owner. Exact live attachment uses resumeExact() below and never reimages. */\n  override async resume(\n    state: Parameters<DockerSandboxClient[\"resume\"]>[0],\n    options?: Parameters<DockerSandboxClient[\"resume\"]>[1],\n  ) {\n    // Without its host directory the SDK can only fail (\"resources are\n    // unavailable\"). Say whether the workspace is provably gone, so the lease\n    // can record the loss as final instead of retrying it on every turn; any\n    // doubt leaves the SDK's own error, which keeps the continuity receipt.\n    if (\n      !(await pathPresent(state.workspaceRootPath)) &&\n      (await dockerWorkspaceProvablyAbsent(state))\n    ) {\n      throw new SandboxProviderWorkspaceAbsentError(\"docker\", state.containerId);\n    }\n    const session = await super.resume(\n      dockerContinuityResumeStateForImage(state, this.#openGeniOptions.image),\n      options,\n    );\n    rememberOwnedDockerSdkState(session.state);\n    return installDurableShellProcesses(session, \"docker\");\n  }\n\n  /** Exact attach must not call the SDK's ordinary resume when the persisted\n   * container is absent: ordinary resume intentionally starts a new container.\n   * The elected recovery owner calls ordinary resume through the shared\n   * continuity protocol instead. */\n  async resumeExact(\n    state: Parameters<DockerSandboxClient[\"resume\"]>[0],\n    options?: Parameters<DockerSandboxClient[\"resume\"]>[1],\n  ) {\n    const containerId = (state as DockerResumeState).containerId;\n    if (typeof containerId !== \"string\" || !DOCKER_INSTANCE_ID.test(containerId)) {\n      throw new SandboxConfigError(\"docker\", \"persisted Docker container identity is invalid\");\n    }\n    try {\n      const result = await execFileAsync(\n        \"docker\",\n        [\"inspect\", \"--type\", \"container\", \"--format\", \"{{.State.Running}}\", containerId],\n        { timeout: DOCKER_EXACT_INSPECT_TIMEOUT_MS, maxBuffer: 64 * 1024 },\n      );\n      if (result.stdout.trim() !== \"true\") {\n        throw new SandboxExactResumeInstanceUnavailableError(\"docker\", containerId);\n      }\n    } catch (error) {\n      if (\n        error instanceof SandboxExactResumeInstanceUnavailableError ||\n        dockerInspectProvesMissing(error, containerId)\n      ) {\n        throw new SandboxExactResumeInstanceUnavailableError(\"docker\", containerId);\n      }\n      throw error;\n    }\n    // Do not call super.resume() after the preflight. The container can vanish\n    // between those operations and the SDK then restores/restarts a replacement.\n    // A direct session wrapper is non-mutating; a later command may fail if the\n    // container stopped after inspect, which is the correct fenced outcome.\n    const archiveLimits =\n      options?.archiveLimits === undefined\n        ? this.#openGeniOptions.archiveLimits\n        : options.archiveLimits;\n    const session = new DockerSandboxSession({\n      state,\n      ...(archiveLimits !== undefined ? { archiveLimits } : {}),\n    });\n    rememberOwnedDockerSdkState(session.state);\n    // Commands run under an in-container supervisor, so any session object\n    // for this container (another turn, worker or the reaper) reaches them.\n    return installDurableShellProcesses(session, \"docker\");\n  }\n}\n\nexport const dockerProvider: ProviderRegistration = {\n  backend: \"docker\",\n  exactResumeMode: \"custom\",\n  instanceIdFields: [\"containerId\"],\n  workspaceCapturePolicy: () => REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE,\n  continuity: {\n    kind: \"docker_workspace\",\n    keyFromState: dockerContinuityKey,\n    preserveWorkspaceForDiscard: preserveDockerWorkspaceForDiscard,\n  },\n  descriptor: CAPABILITY_DESCRIPTORS.docker,\n  sessionSupportsPty: true,\n  // Local dev container — no credentials. (The dockerNetwork decoration is\n  // applied by the factory, not here: it wraps the constructed client.)\n  validateCredentials(settings) {\n    const workspaceBaseDir = settings.dockerWorkspaceBaseDir?.trim();\n    if (workspaceBaseDir && !isAbsolute(workspaceBaseDir)) {\n      throw new SandboxConfigError(\n        \"docker\",\n        \"OPENGENI_DOCKER_WORKSPACE_BASE_DIR must be an absolute path\",\n      );\n    }\n  },\n  build({ settings, exposedPorts }) {\n    const workspaceBaseDir = settings.dockerWorkspaceBaseDir?.trim();\n    return new OpenGeniDockerSandboxClient({\n      image: settings.dockerImage,\n      exposedPorts,\n      // The Opengeni archive ledger is the recovery authority. SDK-local\n      // snapshots are process-host artifacts and, more importantly, ordinary\n      // Docker resume may overwrite a newer live host workspace from them.\n      snapshot: new NoopSnapshotSpec(),\n      ...(workspaceBaseDir ? { workspaceBaseDir } : {}),\n    });\n  },\n};\n","import { execFile } from \"node:child_process\";\nimport { dirname, isAbsolute, join, resolve } from \"node:path\";\nimport { constants } from \"node:fs\";\nimport { chmod, lstat, open, readdir, realpath, rm } from \"node:fs/promises\";\nimport { promisify } from \"node:util\";\nimport { DockerSandboxSession, type DockerSandboxClient } from \"@openai/agents/sandbox/local\";\nimport type { SandboxArchiveLimits } from \"@openai/agents/sandbox\";\nimport {\n  captureHostWorkspaceArchive,\n  readHostWorkspaceRootIdentity,\n  type HostWorkspaceRootIdentity,\n} from \"../host-archive-spool\";\nimport { SandboxConfigError } from \"../errors\";\nimport { errorMessage } from \"@opengeni/contracts/values\";\n\nconst execFileAsync = promisify(execFile);\ntype NativeProbe = (\n  args: readonly string[],\n  timeout: number,\n) => Promise<{ stdout: string; stderr: string }>;\nconst nativeProbe: NativeProbe = async (args, timeout) =>\n  await execFileAsync(\"docker\", [...args], { timeout, maxBuffer: 1024 * 1024 });\nconst FIELD = \"opengeniDockerWorkspaceOwnership\";\nconst ID = /^[a-f0-9]{64}$/;\nconst UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;\nconst SHA = /^[a-f0-9]{64}$/;\ntype State = Parameters<DockerSandboxClient[\"resume\"]>[0];\ntype Ownership = {\n  version: 1;\n  containerId: string;\n  sessionIdentity: string;\n  daemonId: string;\n  mountFingerprint: string;\n  root: string;\n  sourceRoot: string;\n  identity: HostWorkspaceRootIdentity;\n};\nconst receipts = new WeakMap<object, Ownership>();\n/** Receipts read back from the durable lease envelope, as opposed to minted in\n * this process. Only these let a later drain attempt re-attach to the host\n * workspace once the exact container is gone. */\nconst durableReceipts = new WeakSet<object>();\nconst ownedSdkStates = new WeakSet<object>();\n\n/** Internal SDK producer identity, not caller metadata or a filesystem grant. */\nexport function rememberOwnedDockerSdkState(state: State): void {\n  ownedSdkStates.add(state);\n}\n\nfunction invalid(message: string): never {\n  throw new SandboxConfigError(\"docker\", \"Docker drain workspace authority: \" + message);\n}\n\n/** Prove the SDK still owns this exact running container: its session\n * identity label, workspace mount and mount-authority fingerprint. The SDK's\n * reuse check also compares the container with the client's configured image\n * and exposed ports, which answers a different question (would a new\n * container look the same?). Ownership is a property of the container that\n * exists, so it is checked against the image and ports it was created with.\n * Otherwise a deployment that changes the sandbox image could neither serialize\n * nor drain any container that was live during the upgrade. */\nasync function provesLiveSdkOwnership(client: DockerSandboxClient, state: State) {\n  return await client.canReusePreservedOwnedSession(state, {\n    clientOptions: {\n      image: state.image,\n      exposedPorts: [...(state.configuredExposedPorts ?? [])],\n    },\n  });\n}\n\nfunction shape(state: State) {\n  if (\n    !ID.test(state.containerId) ||\n    !UUID.test(state.sessionIdentity ?? \"\") ||\n    state.workspaceRootOwned !== true ||\n    !isAbsolute(state.workspaceRootPath) ||\n    resolve(state.workspaceRootPath) !== state.workspaceRootPath ||\n    state.workspaceRootPath === \"/\" ||\n    (state.snapshot !== null && state.snapshot !== undefined)\n  )\n    invalid(\"owned SDK state is unavailable\");\n  return {\n    containerId: state.containerId,\n    sessionIdentity: state.sessionIdentity!,\n    root: state.workspaceRootPath,\n  };\n}\n\nfunction parsedReceipt(value: unknown, state: State): Ownership | null {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return null;\n  const v = value as Ownership;\n  const s = shape(state);\n  if (\n    v.version !== 1 ||\n    v.containerId !== s.containerId ||\n    v.sessionIdentity !== s.sessionIdentity ||\n    v.sourceRoot !== s.root ||\n    typeof v.root !== \"string\" ||\n    !isAbsolute(v.root) ||\n    resolve(v.root) !== v.root ||\n    v.root === \"/\" ||\n    typeof v.daemonId !== \"string\" ||\n    !/^[A-Za-z0-9:_.-]{1,200}$/.test(v.daemonId) ||\n    !SHA.test(v.mountFingerprint) ||\n    !v.identity ||\n    typeof v.identity !== \"object\" ||\n    ![\"dev\", \"ino\", \"uid\", \"gid\", \"mode\"].every(\n      (key) =>\n        typeof v.identity[key as keyof HostWorkspaceRootIdentity] === \"string\" &&\n        /^(?:0|[1-9][0-9]*)$/.test(v.identity[key as keyof HostWorkspaceRootIdentity]),\n    )\n  )\n    invalid(\"protected ownership receipt differs\");\n  return Object.freeze({ ...v, identity: Object.freeze({ ...v.identity }) });\n}\n\n/** Called only for the protected provider-state envelope deserialized by the\n * server lifecycle. This receipt is evidence, not authorization: drain must\n * independently pass the current scoped lease/epoch/capture fence. */\nexport function rememberSerializedDockerOwnership(state: State, serialized: unknown): void {\n  const value =\n    serialized && typeof serialized === \"object\" ? Reflect.get(serialized, FIELD) : undefined;\n  if (value !== undefined) {\n    if (\n      !serialized ||\n      typeof serialized !== \"object\" ||\n      Reflect.get(serialized, \"workspaceRootOwned\") !== true ||\n      Reflect.get(serialized, \"containerId\") !== state.containerId ||\n      Reflect.get(serialized, \"sessionIdentity\") !== state.sessionIdentity ||\n      Reflect.get(serialized, \"workspaceRootPath\") !== state.workspaceRootPath\n    )\n      invalid(\"protected SDK producer state differs\");\n    const receipt = parsedReceipt(value, state);\n    if (!receipt) invalid(\"protected ownership receipt is invalid\");\n    receipts.set(state, receipt);\n    durableReceipts.add(state);\n  }\n}\n\n/** Whether a Docker drain of this durable lease envelope captures a\n * point-in-time image. The drain stops the exact container before it reads the\n * host workspace (`stopForCapture`), so nothing can write during the read. That\n * needs the durable ownership receipt: without it a retry after a failed\n * capture could not prove the stopped container's root is still this\n * workspace, and would leave the lease draining. */\nexport function dockerDrainCaptureIsPointInTime(envelope: unknown): boolean {\n  if (!envelope || typeof envelope !== \"object\" || Array.isArray(envelope)) return false;\n  const outer = envelope as Record<string, unknown>;\n  const sessionState =\n    outer.sessionState && typeof outer.sessionState === \"object\"\n      ? (outer.sessionState as Record<string, unknown>)\n      : outer;\n  const providerState =\n    sessionState.providerState && typeof sessionState.providerState === \"object\"\n      ? (sessionState.providerState as Record<string, unknown>)\n      : null;\n  const receipt = providerState?.[FIELD];\n  return Boolean(receipt && typeof receipt === \"object\" && !Array.isArray(receipt));\n}\n\ntype Observation = {\n  id: string;\n  running: boolean;\n  labels: Record<string, string>;\n  mounts: Array<{ Source: string; Destination: string; Type: string; RW: boolean }>;\n};\n\nasync function daemon(probe: NativeProbe): Promise<string> {\n  const result = await probe([\"info\", \"--format\", \"{{.ID}}\"], 10_000);\n  const id = result.stdout.trim();\n  if (!/^[A-Za-z0-9:_.-]{1,200}$/.test(id) || result.stderr.trim())\n    invalid(\"native daemon observation failed\");\n  return id;\n}\n\nasync function observe(containerId: string, probe: NativeProbe): Promise<Observation | null> {\n  try {\n    const result = await probe(\n      [\n        \"inspect\",\n        \"--type\",\n        \"container\",\n        \"--format\",\n        '{\"id\":{{json .Id}},\"running\":{{json .State.Running}},\"labels\":{{json .Config.Labels}},\"mounts\":{{json .Mounts}}}',\n        containerId,\n      ],\n      10_000,\n    );\n    if (result.stderr.trim()) invalid(\"native container observation failed\");\n    const value = JSON.parse(result.stdout) as Observation;\n    if (\n      value.id !== containerId ||\n      typeof value.running !== \"boolean\" ||\n      !value.labels ||\n      !Array.isArray(value.mounts)\n    )\n      invalid(\"native container identity differs\");\n    return value;\n  } catch (error) {\n    const stderr = error && typeof error === \"object\" ? Reflect.get(error, \"stderr\") : null;\n    if (\n      typeof stderr === \"string\" &&\n      Reflect.get(error as object, \"code\") === 1 &&\n      !Reflect.get(error as object, \"signal\") &&\n      !Reflect.get(error as object, \"killed\") &&\n      new RegExp(\n        \"^(?:Error|Error response from daemon): No such (?:object|container): \" + containerId + \"$\",\n      ).test(stderr.trim())\n    )\n      return null;\n    throw error;\n  }\n}\n\nasync function ownedMount(\n  observation: Observation,\n  state: State,\n  receipt?: Ownership,\n): Promise<{ fingerprint: string; root: string }> {\n  const s = shape(state);\n  const fingerprint = observation.labels[\"openai-agents-sandbox.mount-authority-fingerprint\"];\n  if (\n    observation.labels[\"openai-agents-sandbox\"] !== \"true\" ||\n    observation.labels[\"openai-agents-sandbox.session-identity\"] !== s.sessionIdentity ||\n    !SHA.test(fingerprint ?? \"\") ||\n    (receipt && fingerprint !== receipt.mountFingerprint)\n  )\n    invalid(\"native SDK mount ownership differs\");\n  // The SDK records an actual canonical bind source. Preserve that authority,\n  // including platform-owned aliases such as macOS /var -> /private/var;\n  // content access always uses the recorded canonical source, never the alias.\n  const root = await realpath(s.root);\n  if (\n    (receipt && root !== receipt.root) ||\n    !observation.mounts.some(\n      (m) =>\n        m.Type === \"bind\" &&\n        m.Source === root &&\n        m.Destination === state.manifest.root &&\n        m.RW === true,\n    )\n  )\n    invalid(\"native SDK mount ownership differs\");\n  return { fingerprint: fingerprint!, root };\n}\n\n/** Mint only for a returned SDK producer state or an authenticated exact-live\n * attachment. SDK native reuse validation checks the complete mount authority\n * fingerprint, including inode identity; names and caller shapes do not mint. */\nexport async function serializeDockerOwnership(\n  client: DockerSandboxClient,\n  state: State,\n  probe: NativeProbe = nativeProbe,\n): Promise<Record<string, unknown>> {\n  if (!ownedSdkStates.has(state)) return {};\n  const s = shape(state);\n  const daemonId = await daemon(probe);\n  const native = await observe(s.containerId, probe);\n  if (!native?.running) invalid(\"live SDK ownership could not be verified\");\n  const mount = await ownedMount(native, state);\n  const identity = await readHostWorkspaceRootIdentity(mount.root);\n  if (!(await provesLiveSdkOwnership(client, state)))\n    invalid(\"live SDK ownership could not be verified\");\n  await readHostWorkspaceRootIdentity(mount.root, identity);\n  if ((await daemon(probe)) !== daemonId) invalid(\"native daemon identity changed\");\n  const receipt = Object.freeze({\n    version: 1 as const,\n    containerId: s.containerId,\n    sessionIdentity: s.sessionIdentity,\n    sourceRoot: s.root,\n    root: mount.root,\n    daemonId,\n    mountFingerprint: mount.fingerprint,\n    identity,\n  });\n  receipts.set(state, receipt);\n  return { [FIELD]: receipt };\n}\n\n/** Whether this durable envelope's workspace is provably gone, not merely\n * unreachable: its durable ownership receipt names the daemon, the same daemon\n * answers now and reports the exact container missing, the owned host root\n * (both its canonical path and the SDK path) does not exist, and the directory\n * that held it does, so an unmounted volume or another host's filesystem can\n * never pass for a deleted workspace. Every failure to observe is \"not proven\". */\nexport async function dockerWorkspaceProvablyAbsent(\n  state: State,\n  probe: NativeProbe = nativeProbe,\n): Promise<boolean> {\n  const receipt = durableReceipts.has(state) ? receipts.get(state) : undefined;\n  if (!receipt) return false;\n  try {\n    if ((await daemon(probe)) !== receipt.daemonId) return false;\n    if ((await observe(receipt.containerId, probe)) !== null) return false;\n    for (const path of new Set([receipt.root, receipt.sourceRoot])) {\n      const parent = await lstat(dirname(path)).catch(() => null);\n      if (!parent?.isDirectory()) return false;\n      const entry = await lstat(path).then(\n        () => \"present\" as const,\n        (error: unknown) =>\n          error && typeof error === \"object\" && Reflect.get(error, \"code\") === \"ENOENT\"\n            ? (\"absent\" as const)\n            : (\"unknown\" as const),\n      );\n      if (entry !== \"absent\") return false;\n    }\n    return (await daemon(probe)) === receipt.daemonId;\n  } catch {\n    return false;\n  }\n}\n\n/** What happened to the drained host workspace directory after exact\n * container teardown. `retained` is never an error for the drain: the archive\n * is already durably published, so the lease still goes cold. */\nexport type DockerHostWorkspaceRelease =\n  | { status: \"released\" }\n  | { status: \"already_released\" }\n  | { status: \"retained\"; reason: string };\n\nexport type DockerWorkspaceDrainCapture = {\n  state: { workspaceRootPath: string; manifest: State[\"manifest\"] };\n  workspaceCaptureRootIdentity: HostWorkspaceRootIdentity;\n  assertWorkspaceCaptureAuthority: () => Promise<void>;\n  /** Remove the exact container before the capture reads its host workspace,\n   * making the drain capture a point-in-time image. Requires the durable\n   * ownership receipt; the drain terminates the box next anyway. */\n  stopForCapture: () => Promise<void>;\n  persistWorkspace: () => Promise<Uint8Array>;\n  delete: () => Promise<void>;\n  /** Set by `delete()`; null until teardown ran. */\n  readonly hostWorkspaceRelease: DockerHostWorkspaceRelease | null;\n};\n\nfunction errorCode(error: unknown): unknown {\n  return error && typeof error === \"object\" ? Reflect.get(error, \"code\") : undefined;\n}\n\nfunction reasonOf(error: unknown): string {\n  return errorMessage(error).slice(0, 300);\n}\n\n/** True only when both the recorded SDK path and its canonical receipt root\n * are definitively absent. Any other failure keeps the ordinary fence. */\nasync function rootIsAbsent(sourceRoot: string, canonicalRoot: string): Promise<boolean> {\n  for (const path of [sourceRoot, canonicalRoot]) {\n    try {\n      await lstat(path);\n      return false;\n    } catch (error) {\n      if (errorCode(error) !== \"ENOENT\") return false;\n    }\n  }\n  return true;\n}\n\n/** Grants the owner u+rwx on every real descendant directory so read-only\n * trees (the Go module cache is written 0555) can be unlinked. Symlinks are\n * never followed or chmodded, and the root itself is left untouched so its\n * receipt identity (which includes the mode) still authenticates a retry. */\nasync function makeDescendantsRemovable(root: string): Promise<void> {\n  const pending = [root];\n  while (pending.length > 0) {\n    const directory = pending.pop()!;\n    for (const entry of await readdir(directory, { withFileTypes: true })) {\n      if (!entry.isDirectory()) continue;\n      const path = join(directory, entry.name);\n      const stats = await lstat(path);\n      if (!stats.isDirectory()) continue;\n      if ((stats.mode & 0o700) !== 0o700) await grantOwnerAccess(path, stats);\n      pending.push(path);\n    }\n  }\n}\n\n/** chmod through a no-follow directory handle pinned to the inode just\n * lstat'ed, so a path swapped for a symlink or another directory in between\n * is left alone. A directory without read permission cannot be opened; it\n * falls back to a path chmod of the same lstat'ed directory. */\nasync function grantOwnerAccess(\n  path: string,\n  stats: { dev: number; ino: number; mode: number },\n): Promise<void> {\n  const mode = (stats.mode & 0o7777) | 0o700;\n  let handle;\n  try {\n    handle = await open(path, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);\n  } catch (error) {\n    if (errorCode(error) !== \"EACCES\") throw error;\n    await chmod(path, mode);\n    return;\n  }\n  try {\n    const pinned = await handle.stat();\n    if (pinned.dev !== stats.dev || pinned.ino !== stats.ino) {\n      throw new Error(`workspace directory changed during release: ${path}`);\n    }\n    await handle.chmod(mode);\n  } finally {\n    await handle.close();\n  }\n}\n\nasync function removeOwnedTree(root: string): Promise<void> {\n  try {\n    await rm(root, { recursive: true, force: true });\n  } catch (error) {\n    const code = errorCode(error);\n    if (code !== \"EACCES\" && code !== \"EPERM\") throw error;\n    await makeDescendantsRemovable(root);\n    await rm(root, { recursive: true, force: true });\n  }\n}\n\n/** Capture-only attachment: no SDK resume/create, exec, viewer, hydration or\n * close capability. Its root comes from the protected SDK receipt and the\n * current scoped capture fence, never from a path/ownership flag alone. */\nexport async function attachDockerWorkspaceForDrain(\n  client: DockerSandboxClient,\n  state: State,\n  assertCurrentCapture: () => Promise<{ archivePublished: boolean }>,\n  probe: NativeProbe = nativeProbe,\n  archiveLimits?: SandboxArchiveLimits | null,\n): Promise<DockerWorkspaceDrainCapture> {\n  await assertCurrentCapture();\n  const s = shape(state);\n  let receipt = receipts.get(state);\n  if (!receipt) {\n    const native = await observe(s.containerId, probe);\n    // Legacy stopped/missing state has no independent inode/owner receipt.\n    // Preserve its data and lease; neither NotFound nor siblings grant custody.\n    if (!native?.running) invalid(\"legacy stopped/missing workspace has no owned-root receipt\");\n    await ownedMount(native, state);\n    if (!(await provesLiveSdkOwnership(client, state)))\n      invalid(\"live SDK ownership could not be verified\");\n    rememberOwnedDockerSdkState(state);\n    await serializeDockerOwnership(client, state, probe);\n    receipt = receipts.get(state)!;\n  }\n  const granted = receipt;\n  const durable = durableReceipts.has(state);\n  if (await rootIsAbsent(s.root, granted.root)) {\n    // A previous attempt of this same published drain already tore the\n    // container down and released the host workspace, then died before the\n    // cold commit. Only that exact state may skip the root fence: the archive\n    // is durably published (so no re-arm or continuity can claim this root),\n    // the daemon is unchanged and the exact container is gone.\n    const assertReleased = async () => {\n      if (!(await assertCurrentCapture()).archivePublished)\n        invalid(\"recorded SDK root is missing before durable publication\");\n      if ((await daemon(probe)) !== granted.daemonId) invalid(\"native daemon identity changed\");\n      if (await observe(s.containerId, probe))\n        invalid(\"recorded SDK root is missing while its exact container exists\");\n    };\n    await assertReleased();\n    let release: DockerHostWorkspaceRelease | null = null;\n    const released = () => invalid(\"host workspace was already released after publication\");\n    return {\n      state: { workspaceRootPath: granted.root, manifest: state.manifest },\n      workspaceCaptureRootIdentity: granted.identity,\n      assertWorkspaceCaptureAuthority: async () => released(),\n      stopForCapture: async () => released(),\n      persistWorkspace: async () => released(),\n      async delete() {\n        await assertReleased();\n        release = { status: \"already_released\" };\n      },\n      get hostWorkspaceRelease() {\n        return release;\n      },\n    };\n  }\n  const assertAuthority = async () => {\n    await assertCurrentCapture();\n    if ((await daemon(probe)) !== granted.daemonId) invalid(\"native daemon identity changed\");\n    const native = await observe(s.containerId, probe);\n    if ((await realpath(s.root)) !== granted.root) invalid(\"recorded SDK root changed\");\n    if (native) await ownedMount(native, state, granted);\n    await readHostWorkspaceRootIdentity(granted.root, granted.identity);\n  };\n  /** Best effort and never throws: the archive is already durable, and a\n   * throw here would keep the lease draining with a released container. */\n  const releaseHostWorkspace = async (): Promise<DockerHostWorkspaceRelease> => {\n    try {\n      // Re-prove every fence immediately before removal: the same published\n      // capture, the same daemon, the exact container gone (nothing can write\n      // or re-attach through it), and the recorded canonical root still the\n      // receipt's inode/owner/mode. The cold commit that follows is\n      // archive-only and never keeps docker continuity for this root.\n      if (!(await assertCurrentCapture()).archivePublished)\n        return {\n          status: \"retained\",\n          reason: \"capture is no longer durably published\",\n        };\n      if ((await daemon(probe)) !== granted.daemonId)\n        return {\n          status: \"retained\",\n          reason: \"native daemon identity changed\",\n        };\n      if (await observe(s.containerId, probe))\n        return { status: \"retained\", reason: \"exact container still exists\" };\n      if ((await realpath(s.root)) !== granted.root)\n        return { status: \"retained\", reason: \"recorded SDK root changed\" };\n      await readHostWorkspaceRootIdentity(granted.root, granted.identity);\n      await removeOwnedTree(granted.root);\n      return { status: \"released\" };\n    } catch (error) {\n      return { status: \"retained\", reason: reasonOf(error) };\n    }\n  };\n  let release: DockerHostWorkspaceRelease | null = null;\n  const removeExactContainer = async (): Promise<void> => {\n    if (await observe(s.containerId, probe)) {\n      // Exact-container teardown, without SDK close (which would also remove\n      // unrelated volumes and skips every fence around it).\n      const result = await probe([\"rm\", \"-f\", s.containerId], 30_000);\n      if (result.stderr.trim() || result.stdout.trim() !== s.containerId)\n        invalid(\"exact-container teardown outcome is unknown\");\n    }\n  };\n  await assertAuthority();\n  return {\n    state: { workspaceRootPath: granted.root, manifest: state.manifest },\n    workspaceCaptureRootIdentity: granted.identity,\n    assertWorkspaceCaptureAuthority: assertAuthority,\n    async stopForCapture() {\n      // A minted receipt lives only in this process. A retry after a failed\n      // capture would then find neither the container nor a receipt.\n      if (!durable) invalid(\"stopping before capture requires a durable ownership receipt\");\n      await assertAuthority();\n      await removeExactContainer();\n      await assertAuthority();\n    },\n    async persistWorkspace() {\n      await assertAuthority();\n      if (process.platform !== \"linux\") {\n        // Preserve the SDK's existing non-Linux archive format/limits. The\n        // borrowed object remains private and exposes no execution or close.\n        const borrowed = new DockerSandboxSession({\n          state: { ...state, workspaceRootPath: granted.root },\n          ...(archiveLimits !== undefined ? { archiveLimits } : {}),\n        });\n        const bytes = await borrowed.persistWorkspace();\n        await assertAuthority();\n        return bytes;\n      }\n      const archive = await captureHostWorkspaceArchive(\n        granted.root,\n        [...state.manifest.ephemeralPersistencePaths()],\n        granted.identity,\n      );\n      try {\n        const chunks: Uint8Array[] = [];\n        for await (const chunk of archive.spool.open()) chunks.push(chunk);\n        return Buffer.concat(chunks);\n      } finally {\n        await archive.spool.dispose();\n      }\n    },\n    async delete() {\n      if (!(await assertCurrentCapture()).archivePublished)\n        invalid(\"exact capture is not durably published\");\n      await assertAuthority();\n      await removeExactContainer();\n      // Once the published capture's container is gone, nothing references\n      // this host workspace: the lease can only commit cold from an archive.\n      release = await releaseHostWorkspace();\n    },\n    get hostWorkspaceRelease() {\n      return release;\n    },\n  };\n}\n","import { SandboxProviderError } from \"@openai/agents/sandbox\";\n\ntype ErrorClass = abstract new (...args: never[]) => Error;\n\n// The agents SDK loads the E2B SDK only when an E2B sandbox is used, so this\n// module must not import it eagerly. A ServiceBusyError can only exist once\n// the SDK is loaded; the E2B provider registers the class before first use.\nlet e2bServiceBusyError: ErrorClass | null = null;\nlet e2bLoad: Promise<ErrorClass | null> | null = null;\n\n/** Resolve (once) E2B's typed no-capacity error class, the one its SDK throws. */\nexport function loadE2BServiceBusyError(): Promise<ErrorClass | null> {\n  e2bLoad ??= import(\"e2b\").then(\n    (module) => (e2bServiceBusyError = module.ServiceBusyError),\n    () => null,\n  );\n  return e2bLoad;\n}\n\n/**\n * A sandbox provider's own typed \"no capacity to place a sandbox right now\".\n * E2B raises ServiceBusyError (HTTP 503) for it; the agents SDK keeps it as the\n * `cause` of the SandboxProviderError it throws. Compute's equivalent is\n * ComputeControlError with kind `no_capacity`.\n */\nexport function isSandboxProviderCapacityError(error: unknown): boolean {\n  return e2bServiceBusyError !== null && error instanceof e2bServiceBusyError;\n}\n\n/** The agents SDK's wrapper around a sandbox provider SDK's own failure. */\nexport function isSandboxProviderError(error: unknown): boolean {\n  return error instanceof SandboxProviderError;\n}\n","import { E2BSandboxClient } from \"@openai/agents-extensions/sandbox/e2b\";\nimport { CAPABILITY_DESCRIPTORS } from \"../capabilities\";\nimport { SandboxConfigError } from \"../errors\";\nimport { loadE2BServiceBusyError } from \"../provider-capacity\";\nimport {\n  REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE,\n  REPEATABLE_PORTABLE_TAR_WORKSPACE_CAPTURE,\n  providerWorkspacePersistence,\n  type ProviderRegistration,\n} from \"./types\";\n\nexport const e2bProvider: ProviderRegistration = {\n  backend: \"e2b\",\n  exactResumeMode: \"custom\",\n  instanceIdFields: [\"sandboxId\"],\n  workspaceCapturePolicy: (state) =>\n    providerWorkspacePersistence(state) === \"snapshot\"\n      ? REPEATABLE_PORTABLE_TAR_WORKSPACE_CAPTURE\n      : REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE,\n  descriptor: CAPABILITY_DESCRIPTORS.e2b,\n  // The SDK session offers stdin through the E2B PTY API.\n  sessionSupportsPty: true,\n  validateCredentials(settings) {\n    // build() hands the key to the SDK; checking it here makes a misconfigured\n    // deployment fail fast instead of deep in the SDK at create() time.\n    if (!settings.e2bApiKey) {\n      throw new SandboxConfigError(\"e2b\", \"OPENGENI_E2B_API_KEY is required\");\n    }\n  },\n  build({ settings, environment, exposedPorts }) {\n    // Classify E2B's typed capacity refusal as sandbox capacity, never a model outage.\n    void loadE2BServiceBusyError();\n    const options: NonNullable<ConstructorParameters<typeof E2BSandboxClient>[0]> = {\n      env: environment,\n      exposedPorts,\n    };\n    // Where and as whom the SDK connects, for every create and resume. The\n    // client keeps it out of serialized session state.\n    const connection: NonNullable<typeof options.connection> = {};\n    if (settings.e2bApiKey) connection.apiKey = settings.e2bApiKey;\n    if (settings.e2bDomain) connection.domain = settings.e2bDomain;\n    if (settings.e2bApiUrl) connection.apiUrl = settings.e2bApiUrl;\n    if (settings.e2bSandboxUrl) connection.sandboxUrl = settings.e2bSandboxUrl;\n    options.connection = connection;\n    if (settings.e2bTemplate) options.template = settings.e2bTemplate;\n    // e2b's `timeout` is in SECONDS (the SDK multiplies by 1000 internally) —\n    // a different unit from Modal's `timeoutMs`.\n    if (settings.e2bTimeoutSeconds) options.timeout = settings.e2bTimeoutSeconds;\n    if (settings.e2bTimeoutAction) options.timeoutAction = settings.e2bTimeoutAction;\n    if (settings.e2bAllowInternetAccess !== undefined) {\n      options.allowInternetAccess = settings.e2bAllowInternetAccess;\n    }\n    if (settings.e2bAutoResume !== undefined) options.autoResume = settings.e2bAutoResume;\n    if (settings.e2bWorkspacePersistence) {\n      options.workspacePersistence = settings.e2bWorkspacePersistence;\n    }\n    return new E2BSandboxClient(options);\n  },\n};\n","import {\n  UnixLocalSandboxClient,\n  UnixLocalSandboxSession,\n  type UnixLocalSandboxClientOptions,\n  type UnixLocalSandboxSessionState,\n} from \"@openai/agents/sandbox/local\";\nimport { NoopSnapshotSpec } from \"@openai/agents/sandbox\";\nimport { lstat } from \"node:fs/promises\";\nimport { isAbsolute } from \"node:path\";\nimport { CAPABILITY_DESCRIPTORS } from \"../capabilities\";\nimport { installDurableShellProcesses } from \"../durable-shell-process\";\nimport { SandboxConfigError, SandboxExactResumeInstanceUnavailableError } from \"../errors\";\nimport { REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE, type ProviderRegistration } from \"./types\";\n\nfunction isMissingLocalWorkspaceError(error: unknown): boolean {\n  if (!error || typeof error !== \"object\") return false;\n  const code = Reflect.get(error, \"code\");\n  return code === \"ENOENT\" || code === \"ENOTDIR\";\n}\n\nclass OpenGeniUnixLocalSandboxClient extends UnixLocalSandboxClient {\n  readonly #openGeniOptions: UnixLocalSandboxClientOptions;\n\n  constructor(options: UnixLocalSandboxClientOptions = {}) {\n    super(options);\n    this.#openGeniOptions = options;\n  }\n\n  // Commands run under a supervisor in the workspace's own namespace, so any\n  // session object for this workspace (another turn, worker or the reaper)\n  // reaches them, not only the object that started them.\n  override async create(...args: Parameters<UnixLocalSandboxClient[\"create\"]>) {\n    return installDurableShellProcesses(await super.create(...args), \"local\");\n  }\n\n  override async resume(...args: Parameters<UnixLocalSandboxClient[\"resume\"]>) {\n    return installDurableShellProcesses(await super.resume(...args), \"local\");\n  }\n\n  /** The SDK's ordinary resume may restore an older snapshot, including into a\n   * newly-created temporary directory. Exact attachment only re-opens the live\n   * workspace path and therefore never writes or creates provider state. */\n  async resumeExact(\n    state: UnixLocalSandboxSessionState,\n    options: Parameters<UnixLocalSandboxClient[\"resume\"]>[1] = {},\n  ): Promise<UnixLocalSandboxSession> {\n    if (!isAbsolute(state.workspaceRootPath)) {\n      throw new SandboxConfigError(\"local\", \"persisted local workspace path is invalid\");\n    }\n    let entry: Awaited<ReturnType<typeof lstat>>;\n    try {\n      entry = await lstat(state.workspaceRootPath);\n    } catch (error) {\n      if (isMissingLocalWorkspaceError(error)) {\n        throw new SandboxExactResumeInstanceUnavailableError(\"local\", state.workspaceRootPath);\n      }\n      throw error;\n    }\n    // A workspace created by this client is a real directory. Following a\n    // replacement symlink would silently rebind the persisted identity.\n    if (!entry.isDirectory()) {\n      throw new SandboxExactResumeInstanceUnavailableError(\"local\", state.workspaceRootPath);\n    }\n    const archiveLimits =\n      options?.archiveLimits === undefined\n        ? this.#openGeniOptions.archiveLimits\n        : options.archiveLimits;\n    return installDurableShellProcesses(\n      new UnixLocalSandboxSession({\n        state,\n        ...(this.#openGeniOptions.defaultShell !== undefined\n          ? { defaultShell: this.#openGeniOptions.defaultShell }\n          : {}),\n        ...(archiveLimits !== undefined ? { archiveLimits } : {}),\n      }),\n      \"local\",\n    );\n  }\n}\n\nexport const localProvider: ProviderRegistration = {\n  backend: \"local\",\n  exactResumeMode: \"custom\",\n  instanceIdFields: [\"workspaceRootPath\"],\n  workspaceCapturePolicy: () => REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE,\n  descriptor: CAPABILITY_DESCRIPTORS.local,\n  sessionSupportsPty: true,\n  // UnixLocalSandboxClient runs in-process — no credentials, no options.\n  validateCredentials() {},\n  build() {\n    // The durable Opengeni archive ledger owns restoration. A process-local SDK\n    // snapshot is neither portable nor independently governed and can be older\n    // than the still-live workspace path.\n    return new OpenGeniUnixLocalSandboxClient({ snapshot: new NoopSnapshotSpec() });\n  },\n};\n",null,null,"import {\n  ModalImageSelector,\n  ModalSandboxClient,\n  type ModalSandboxSession,\n  type ModalSandboxSessionState,\n} from \"@openai/agents-extensions/sandbox/modal\";\nimport { effectiveModalIdleTimeoutSeconds } from \"@opengeni/config\";\nimport type { Settings } from \"@opengeni/config\";\nimport {\n  canonicalModalCheckpointProviderBinding,\n  type ModalCheckpointProviderBinding,\n} from \"@opengeni/contracts\";\nimport { CAPABILITY_DESCRIPTORS } from \"../capabilities\";\nimport { SandboxChannelAService, type ChannelASession } from \"../channel-a\";\nimport { installModalCommandSession } from \"./modal-command-session\";\nimport {\n  installModalSynchronousCommandCollection,\n  withNativeSynchronousCommandCollection,\n} from \"../native-synchronous-collection\";\nimport { ModalCommandControl } from \"./modal-command-control\";\nimport {\n  ModalCommandStartPreDispatchUnavailableError,\n  ModalCommandStartNotDispatchedError,\n} from \"./modal-command-router-wire\";\nimport {\n  createModalSessionWithLifecycle,\n  resumeModalSessionOnSharedClient,\n  type ModalCreateLifecycle,\n  type OpenGeniModalSandboxClientOptions,\n} from \"./modal-create-session\";\nimport { isRoutingMutationOutcomeUnknownError } from \"../routing/routing-session\";\nimport type { ModalClient } from \"modal\";\nimport {\n  hasModalCommandStartBoundary,\n  hasModalCommandStartOutcomeUnknownBoundary,\n  installModalCommandStartContext,\n  installModalCommandStartRetention,\n  modalCommandStartHasOwnAccessor,\n  modalCommandStartOwnData,\n} from \"./modal-command-start-errors\";\nimport { ModalProcessObservationUnavailableError, SandboxConfigError } from \"../errors\";\nexport { ModalProcessObservationUnavailableError } from \"../errors\";\nimport { markTypedExecHandleLoss } from \"../exec-banner\";\nimport {\n  REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE,\n  providerWorkspacePersistence,\n  type ProviderRegistration,\n} from \"./types\";\n\nexport type { ModalCheckpointProviderBinding } from \"@opengeni/contracts\";\n\nconst MODAL_ORPHAN_SWEEP_LIMIT = 50;\nconst OPENGENI_MODAL_SDK_VERSION = \"0.9.0\";\nconst MODAL_LIST_DIR_MAX_ENTRIES = 20_000;\n// A provider box is invisible to the lease until Modal create + manifest\n// materialization returns and the creation callback records its instance id.\n// Production baseline (2026-07-15, all 8 turn workers): 155/155 completed creates\n// finished under 10s (154 under 2.5s). Two minutes is a 12x observed-max buffer,\n// while avoiding the former 30-minute retention of boxes abandoned by a rolling\n// worker restart. The live-instance guard below remains authoritative: once a box\n// is recorded by any lease, age and missing/stale tags can never terminate it.\nconst MODAL_UNATTRIBUTED_ORPHAN_GRACE_MS = 2 * 60_000;\n\nexport type ModalSandboxAttribution = {\n  leaseId: string;\n  workspaceId: string;\n  sandboxGroupId: string;\n};\n\nexport type LiveModalSandboxLeaseAttribution = ModalSandboxAttribution & {\n  instanceId: string | null;\n  liveness?: string;\n};\n\nexport type ModalOrphanSweepTermination = {\n  sandboxId: string;\n  reason: \"stale_attribution\" | \"unattributed\";\n  tags: Record<string, string>;\n};\n\nexport type ModalOrphanSweepResult = {\n  examined: number;\n  terminated: ModalOrphanSweepTermination[];\n  skipped: number;\n  /**\n   * Provider/lease reconciliation observed by this pass, judged against the\n   * live-lease snapshot passed in (read before the listing). `unterminated`\n   * holds orphan candidates still running after the pass (termination skipped,\n   * postponed, or failed); `missingLiveLeaseInstanceIds` names live-lease\n   * instances absent from the listing. Both can include a lease transition that\n   * raced the listing, so a caller re-reads durable ownership before reporting\n   * them. Only meaningful when `complete` (the whole app listing was read; the\n   * termination budget can cut a pass short).\n   */\n  inventory: {\n    complete: boolean;\n    running: number;\n    unterminated: ModalOrphanSweepTermination[];\n    missingLiveLeaseInstanceIds: string[];\n  };\n};\n\nexport type RevalidateModalOrphanTermination = (\n  candidate: ModalOrphanSweepTermination,\n) => Promise<boolean>;\n\nexport function modalSandboxAttributionEnvironment(\n  input: ModalSandboxAttribution,\n): Record<string, string> {\n  return {\n    OPENGENI_SANDBOX_LEASE_ID: input.leaseId,\n    OPENGENI_SANDBOX_GROUP_ID: input.sandboxGroupId,\n    OPENGENI_WORKSPACE_ID: input.workspaceId,\n  };\n}\n\nexport function modalSandboxAttributionTags(\n  input: ModalSandboxAttribution,\n): Record<string, string> {\n  return {\n    opengeni: \"true\",\n    opengeni_lease_id: input.leaseId,\n    opengeni_workspace_id: input.workspaceId,\n    opengeni_sandbox_group_id: input.sandboxGroupId,\n  };\n}\n\ntype MutableModalSnapshotSandbox = {\n  exec?: ConstructorParameters<typeof ModalSandboxSession>[0][\"sandbox\"][\"exec\"];\n  terminate?: (options?: { wait?: boolean }) => Promise<unknown>;\n  detach?: () => void;\n  snapshotFilesystem?: (...args: unknown[]) => Promise<unknown>;\n  snapshotDirectory?: (...args: unknown[]) => Promise<unknown>;\n};\n\ntype ModalWorkspaceCaptureOptions = {\n  requestId: string;\n};\n\ntype MutableModalSandboxSession = {\n  close?: () => Promise<void>;\n  // Pinned Agents Extensions 0.14.3 uses this synchronous adapter-local map.\n  activeProcesses?: unknown;\n  modal?: {\n    cpClient?: ModalClient[\"cpClient\"];\n    profile?: ModalClient[\"profile\"];\n    logger?: ModalClient[\"logger\"];\n    version?: () => string;\n    sandboxes?: {\n      fromId?: (sandboxId: string) => Promise<MutableModalSnapshotSandbox>;\n    };\n  };\n  sandbox?: MutableModalSnapshotSandbox;\n  state?: {\n    sandboxId?: string;\n    environment?: Record<string, string>;\n    manifest?: { root?: string };\n    workspacePersistence?: string;\n    snapshotFilesystemTimeoutMs?: number;\n  };\n  execCommand?: ChannelASession[\"execCommand\"];\n  getSynchronousCommandOutput?: ChannelASession[\"getSynchronousCommandOutput\"];\n  cancelPendingExecCommand?: () => Promise<void>;\n  readFile?: ChannelASession[\"readFile\"];\n  listDir?: ChannelASession[\"listDir\"];\n  persistWorkspace?: (options?: ModalWorkspaceCaptureOptions) => Promise<Uint8Array>;\n  writeStdin?: (args: {\n    sessionId: number;\n    chars?: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n  }) => Promise<string>;\n};\n\nconst modalRetentionWrappedSessions = new WeakSet<object>();\nconst modalTerminationWrappedSandboxes = new WeakSet<object>();\nconst modalFilesystemRetentionWrappedSandboxes = new WeakSet<object>();\nconst modalDirectoryRetentionWrappedSandboxes = new WeakSet<object>();\nconst modalSnapshotRequestIds = new WeakMap<object, string>();\nconst modalDirectorySnapshotTimeouts = new WeakMap<object, number | undefined>();\nconst MODAL_TURN_SHELL_MARKER = \"/tmp/opengeni-turn-shell/\";\n\ntype ModalPendingExecStart = {\n  sandbox: MutableModalSnapshotSandbox | null;\n  cancellationRequested: boolean;\n};\n\ntype ModalExecCancellationState = {\n  pending: Set<ModalPendingExecStart>;\n  cancellation: Promise<void> | null;\n};\n\nfunction modalWorkspaceRelativePath(path: string, workspaceRoot: string): string {\n  if (!path.startsWith(\"/\")) return path;\n  const root = workspaceRoot.replace(/\\/+$/, \"\") || \"/\";\n  const normalized = path.replace(/\\/+$/, \"\") || \"/\";\n  if (normalized === root) return \"\";\n  if (root === \"/\") return normalized.slice(1);\n  if (normalized.startsWith(`${root}/`)) return normalized.slice(root.length + 1);\n  throw new Error(`Modal listDir path is outside the workspace root: ${path}`);\n}\n\nfunction modalWorkspaceAbsolutePath(path: string, workspaceRoot: string): string {\n  const root = workspaceRoot.replace(/\\/+$/, \"\") || \"/\";\n  if (!path) return root;\n  return root === \"/\" ? `/${path}` : `${root}/${path}`;\n}\n\nfunction installModalListDirCompatibility(session: MutableModalSandboxSession): void {\n  if (typeof session.listDir === \"function\") return;\n  const execCommand = session.execCommand;\n  const writeStdin = session.writeStdin?.bind(session);\n  const getOutput = session.getSynchronousCommandOutput?.bind(session);\n  if (typeof execCommand !== \"function\" || typeof session.readFile !== \"function\") return;\n  const workspaceRoot = session.state?.manifest?.root;\n  if (!workspaceRoot) {\n    throw new Error(\"Modal listDir compatibility requires a manifest workspace root\");\n  }\n  session.listDir = async (args, commandRunner) => {\n    const absoluteResultPaths = args.path.startsWith(\"/\");\n    const relativePath = modalWorkspaceRelativePath(args.path, workspaceRoot);\n    // This function is the provider's listDir compatibility surface. Do not\n    // pass it back into Channel A as a native accelerator or fsList() recurses\n    // into this shim instead of using Modal's command data plane.\n    const service = new SandboxChannelAService({\n      session: {\n        execCommand: execCommand.bind(session),\n        ...(writeStdin ? { writeStdin } : {}),\n        ...(getOutput ? { getSynchronousCommandOutput: getOutput } : {}),\n        ...(session.cancelPendingExecCommand\n          ? { cancelPendingExecCommand: session.cancelPendingExecCommand.bind(session) }\n          : {}),\n      },\n      ...(commandRunner ? { commandRunner } : {}),\n      workspaceRoot,\n      ...(args.runAs ? { runAs: args.runAs } : {}),\n    });\n    const listed = await withNativeSynchronousCommandCollection(session as ChannelASession, () =>\n      service.fsList({\n        path: relativePath,\n        depth: 1,\n        maxEntries: MODAL_LIST_DIR_MAX_ENTRIES,\n        includeHidden: true,\n      }),\n    );\n    if (listed.truncated || listed.root.truncated) {\n      throw new Error(\n        `Modal listDir exceeded the ${MODAL_LIST_DIR_MAX_ENTRIES}-entry safety bound`,\n      );\n    }\n    return (listed.root.children ?? []).map((entry) => ({\n      name: entry.name,\n      path: absoluteResultPaths\n        ? modalWorkspaceAbsolutePath(entry.path, workspaceRoot)\n        : entry.path,\n      type: entry.type === \"file\" || entry.type === \"dir\" ? entry.type : \"other\",\n    }));\n  };\n}\n\nconst MODAL_EXEC_STDIN_WRITE_PATH =\n  \"/modal.task_command_router.TaskCommandRouter/TaskExecStdinWrite\";\nconst MODAL_EXEC_ALREADY_COMPLETED_DETAILS =\n  /^Exec has already completed; stdin is no longer accepting writes(?: \\(Error code: [A-Z0-9]+\\))?$/;\nconst MODAL_TASK_EXEC_START_ERROR_MAX_DEPTH = 8;\nconst MODAL_TASK_EXEC_START_ERROR_MAX_NODES = 64;\nconst MODAL_TASK_EXEC_START_ERROR_MAX_AGGREGATE_ERRORS = 32;\n\nfunction modalHttpStatus(value: unknown): number | null {\n  if (typeof value !== \"number\" && typeof value !== \"string\") return null;\n  const status = Number(value);\n  return Number.isInteger(status) && status >= 100 && status <= 599 ? status : null;\n}\n\nfunction hasContradictoryModalHttpStatus(record: Record<string, unknown>): boolean {\n  const keys = [\"status\", \"statusCode\", \"httpStatus\", \"httpStatusCode\"];\n  const values = keys.map((key) => modalCommandStartOwnData(record, key));\n  const response = modalCommandStartOwnData(record, \"response\");\n  if (response && typeof response === \"object\") {\n    values.push(...keys.map((key) => modalCommandStartOwnData(response, key)));\n  }\n  return values.some((value) => modalHttpStatus(value) !== null);\n}\n\n/**\n * Only the native client's pre-dispatch readiness gate proves Start was not\n * sent. Server-controlled gRPC/SDK status and DNS-looking details prove nothing.\n * Any retained or outcome-unknown routing boundary vetoes recovery even when\n * it contains a genuine pre-dispatch error among its causes.\n */\nexport function isModalTaskExecStartPreDispatchUnavailableError(error: unknown): boolean {\n  const pending: Array<{ depth: number; value: unknown }> = [{ depth: 0, value: error }];\n  const seen = new WeakSet<object>();\n  let inspected = 0;\n  let matchingLeaves = 0;\n\n  while (pending.length > 0) {\n    if (inspected >= MODAL_TASK_EXEC_START_ERROR_MAX_NODES) return false;\n    const current = pending.shift()!;\n    inspected += 1;\n    if (!current.value || typeof current.value !== \"object\" || seen.has(current.value)) {\n      return false;\n    }\n    if (current.depth > MODAL_TASK_EXEC_START_ERROR_MAX_DEPTH) return false;\n    seen.add(current.value);\n\n    let nested: unknown[];\n    try {\n      const record = current.value as Record<string, unknown>;\n      if (\n        [\n          \"cause\",\n          \"error\",\n          \"errors\",\n          \"response\",\n          \"status\",\n          \"statusCode\",\n          \"httpStatus\",\n          \"httpStatusCode\",\n        ].some((key) => modalCommandStartHasOwnAccessor(record, key))\n      )\n        return false;\n      if (isRoutingMutationOutcomeUnknownError(current.value)) return false;\n      if (hasModalCommandStartBoundary(current.value, \"outcome-unknown\")) return false;\n      if (current.value instanceof ModalCommandStartNotDispatchedError) return false;\n      if (hasContradictoryModalHttpStatus(record)) return false;\n\n      // This instance is created only by the client's readiness gate before\n      // Start dispatch; an RPC's own status or details never enters this path.\n      if (\n        current.value instanceof ModalCommandStartPreDispatchUnavailableError ||\n        hasModalCommandStartBoundary(current.value, \"pre-dispatch-unavailable\")\n      ) {\n        matchingLeaves += 1;\n        continue;\n      }\n\n      nested = [];\n      for (const key of [\"cause\", \"error\"] as const) {\n        const value = modalCommandStartOwnData(record, key);\n        if (value !== undefined) nested.push(value);\n      }\n\n      const errors = modalCommandStartOwnData(record, \"errors\");\n      if (errors !== undefined) {\n        if (\n          !Array.isArray(errors) ||\n          errors.length === 0 ||\n          errors.length > MODAL_TASK_EXEC_START_ERROR_MAX_AGGREGATE_ERRORS\n        ) {\n          return false;\n        }\n        for (let index = 0; index < errors.length; index++)\n          nested.push(modalCommandStartOwnData(errors, String(index)));\n      }\n\n      if (nested.length === 0) return false;\n    } catch {\n      return false;\n    }\n\n    if (current.depth >= MODAL_TASK_EXEC_START_ERROR_MAX_DEPTH) return false;\n    for (const value of nested) {\n      pending.push({ depth: current.depth + 1, value });\n    }\n  }\n\n  return matchingLeaves > 0;\n}\n\n/** Any typed ambiguous Start in a bounded wrapper graph vetoes generic provider\n * retries. Its original IDs are observation authority, never replay authority. */\nexport function isModalCommandStartOutcomeUnknownError(error: unknown): boolean {\n  return hasModalCommandStartOutcomeUnknownBoundary(error);\n}\n\n/**\n * Modal proves that the exact exec has already terminated with a typed\n * FAILED_PRECONDITION from its stdin-write RPC. Keep this deliberately\n * structural and exact: other FAILED_PRECONDITION errors are not process\n * lifetime authority.\n */\nexport function isModalExecAlreadyCompletedError(error: unknown): boolean {\n  if (!error || typeof error !== \"object\") return false;\n  const record = error as {\n    name?: unknown;\n    path?: unknown;\n    code?: unknown;\n    details?: unknown;\n  };\n  return (\n    record.name === \"ClientError\" &&\n    record.path === MODAL_EXEC_STDIN_WRITE_PATH &&\n    record.code === 9 &&\n    typeof record.details === \"string\" &&\n    MODAL_EXEC_ALREADY_COMPLETED_DETAILS.test(record.details)\n  );\n}\n\nfunction assertPinnedModalSdk(session: MutableModalSandboxSession): void {\n  const actualVersion = session.modal?.version?.();\n  if (actualVersion !== OPENGENI_MODAL_SDK_VERSION) {\n    throw new Error(\n      `Opengeni Modal snapshot compatibility requires modal@${OPENGENI_MODAL_SDK_VERSION}; ` +\n        `the active session reported ${actualVersion ?? \"no version\"}`,\n    );\n  }\n}\n\nasync function confirmModalTermination(\n  terminate: (options: { wait: true }) => Promise<unknown>,\n): Promise<number> {\n  // Modal 0.9 resolves terminate() once the stop request is accepted. Only\n  // wait:true observes the provider's terminal result before releasing a lease.\n  const exitCode = await terminate({ wait: true });\n  if (typeof exitCode !== \"number\" || !Number.isInteger(exitCode)) {\n    throw new Error(\"Modal termination did not confirm a terminal exit\");\n  }\n  return exitCode;\n}\n\nfunction installModalTerminationConfirmation(session: MutableModalSandboxSession): void {\n  if (typeof session.close !== \"function\") return;\n  const close = session.close.bind(session);\n  session.close = async () => {\n    // Hydration/cancellation may replace this handle. Install at close time,\n    // retaining the SDK's ownsSandbox check and process/hook cleanup ordering.\n    const sandbox = session.sandbox;\n    if (!sandbox || typeof sandbox.terminate !== \"function\") {\n      throw new Error(\"Modal session does not expose provider termination\");\n    }\n    if (!modalTerminationWrappedSandboxes.has(sandbox)) {\n      const terminate = sandbox.terminate.bind(sandbox);\n      sandbox.terminate = async () => confirmModalTermination(terminate);\n      modalTerminationWrappedSandboxes.add(sandbox);\n    }\n    await close();\n  };\n}\n\nfunction installModalNativeSnapshotRetention(session: MutableModalSandboxSession): void {\n  const persistence = session.state?.workspacePersistence;\n  if (persistence !== \"snapshot_filesystem\" && persistence !== \"snapshot_directory\") {\n    return;\n  }\n  const sandbox = session.sandbox;\n  if (!sandbox || typeof sandbox !== \"object\") {\n    throw new Error(`Modal ${persistence} persistence has no active provider sandbox`);\n  }\n\n  if (persistence === \"snapshot_filesystem\") {\n    if (modalFilesystemRetentionWrappedSandboxes.has(sandbox)) return;\n    const snapshotFilesystem = sandbox.snapshotFilesystem;\n    if (typeof snapshotFilesystem !== \"function\") {\n      throw new Error(\"Modal snapshot_filesystem persistence is unavailable\");\n    }\n    // Agents Extensions 0.13.x still invokes the Modal 0.7 positional timeout\n    // signature. Modal 0.9 moved timeout into an options object and changed the\n    // default Image retention from indefinite to 30 days. Translate at the\n    // provider boundary and retain the Image until Opengeni's artifact ledger\n    // proves it unreferenced and garbage-collects its exact provider id.\n    sandbox.snapshotFilesystem = async (legacyParams?: unknown) => {\n      if (legacyParams !== undefined && typeof legacyParams !== \"number\") {\n        throw new Error(\"Unexpected Modal snapshot_filesystem adapter call shape\");\n      }\n      const requestId = modalSnapshotRequestIds.get(session);\n      if (!requestId) {\n        throw new Error(\"Modal native workspace capture requires a durable request id\");\n      }\n      return await snapshotFilesystem.call(sandbox, {\n        ...(legacyParams === undefined ? {} : { timeoutMs: legacyParams }),\n        ttlMs: null,\n        snapshotId: requestId,\n      });\n    };\n    modalFilesystemRetentionWrappedSandboxes.add(sandbox);\n    return;\n  }\n\n  if (modalDirectoryRetentionWrappedSandboxes.has(sandbox)) return;\n  const snapshotDirectory = sandbox.snapshotDirectory;\n  if (typeof snapshotDirectory !== \"function\") {\n    throw new Error(\"Modal snapshot_directory persistence is unavailable\");\n  }\n  sandbox.snapshotDirectory = async (path?: unknown, legacyParams?: unknown) => {\n    if (typeof path !== \"string\" || legacyParams !== undefined) {\n      throw new Error(\"Unexpected Modal snapshot_directory adapter call shape\");\n    }\n    const requestId = modalSnapshotRequestIds.get(session);\n    if (!requestId) {\n      throw new Error(\"Modal native workspace capture requires a durable request id\");\n    }\n    // Own both timeout and caller id at the provider boundary. The wrapper\n    // around persistWorkspace temporarily disables Agents SDK 0.14.3's second,\n    // outer timeout; otherwise an old timed-out caller can later delete the same\n    // idempotent Image after a recovered caller has already published it.\n    const timeoutMs = modalDirectorySnapshotTimeouts.get(session);\n    return await snapshotDirectory.call(sandbox, path, {\n      ...(timeoutMs === undefined ? {} : { timeoutMs }),\n      ttlMs: null,\n      snapshotId: requestId,\n    });\n  };\n  modalDirectoryRetentionWrappedSandboxes.add(sandbox);\n}\n\nfunction installModalExecCompletionRecovery(session: MutableModalSandboxSession): void {\n  const writeStdin = session.writeStdin;\n  if (typeof writeStdin !== \"function\") return;\n  const observe = async (args: Parameters<typeof writeStdin>[0]) => {\n    // The pinned SDK looks up this map before its first await. Check the same\n    // handle synchronously, with no await before calling it: a missing entry\n    // is observer-state loss, while a real command may print the exact missing\n    // handle banner at ANY exit code. Never classify its output as authority.\n    // An SDK shape change must fail closed rather than reintroduce that guess.\n    if (!(session.activeProcesses instanceof Map)) {\n      throw new ModalProcessObservationUnavailableError(args.sessionId, {\n        reason: \"unsupported_handle_map\",\n      });\n    }\n    if (!session.activeProcesses.has(args.sessionId)) {\n      throw new ModalProcessObservationUnavailableError(args.sessionId, {\n        reason: \"missing_handle\",\n      });\n    }\n    return await writeStdin.call(session, args);\n  };\n  markTypedExecHandleLoss(session);\n  session.writeStdin = async (args) => {\n    try {\n      return await observe(args);\n    } catch (error) {\n      if (\n        !isModalExecAlreadyCompletedError(error) ||\n        !Number.isSafeInteger(args.sessionId) ||\n        args.sessionId <= 0\n      ) {\n        throw error;\n      }\n      // The process can finish between the SDK lookup and the provider stdin\n      // write. An empty poll may recover its exact terminal result; never replay\n      // stdin, and never turn failure to observe that result into loss proof.\n      try {\n        return await observe({ ...args, chars: \"\" });\n      } catch (cause) {\n        throw new ModalProcessObservationUnavailableError(args.sessionId, { cause });\n      }\n    }\n  };\n}\n\nfunction installModalPendingExecCancellation(session: MutableModalSandboxSession): void {\n  if (session.cancelPendingExecCommand) return;\n  if (\n    typeof session.execCommand !== \"function\" ||\n    typeof session.sandbox?.detach !== \"function\" ||\n    typeof session.modal?.sandboxes?.fromId !== \"function\" ||\n    !session.state?.sandboxId\n  ) {\n    return;\n  }\n  const state: ModalExecCancellationState = {\n    pending: new Set(),\n    cancellation: null,\n  };\n  const execCommand = session.execCommand.bind(session);\n  session.execCommand = async (args) => {\n    const command =\n      args && typeof args === \"object\" && typeof (args as { cmd?: unknown }).cmd === \"string\"\n        ? (args as { cmd: string }).cmd\n        : null;\n    if (!command?.includes(MODAL_TURN_SHELL_MARKER)) {\n      return await execCommand(args);\n    }\n\n    // A yielded ContainerProcess owns its command-router connection. Give each\n    // turn-owned start a separate handle so aborting a stuck TaskExecStart can\n    // never break stdin/control for an older, already-yielded command.\n    const pending: ModalPendingExecStart = {\n      sandbox: null,\n      cancellationRequested: false,\n    };\n    state.pending.add(pending);\n    try {\n      const sandbox = await session.modal!.sandboxes!.fromId!(session.state!.sandboxId!);\n      pending.sandbox = sandbox;\n      if (pending.cancellationRequested) {\n        sandbox.detach?.();\n        throw new Error(\"Modal exec start was cancelled before provider yield\");\n      }\n      session.sandbox = sandbox;\n      return await execCommand(args);\n    } finally {\n      state.pending.delete(pending);\n    }\n  };\n\n  session.cancelPendingExecCommand = async () => {\n    if (!state.cancellation) {\n      state.cancellation = (async () => {\n        const pendingStarts = [...state.pending];\n        const detached = new Set<MutableModalSnapshotSandbox>();\n        for (const start of pendingStarts) {\n          start.cancellationRequested = true;\n          if (start.sandbox) {\n            start.sandbox.detach?.();\n            detached.add(start.sandbox);\n          }\n        }\n        // Keep the session usable for the token/PGID proof helper. Handles for\n        // already-yielded commands were removed from `pending` and stay open.\n        if (session.sandbox && detached.has(session.sandbox)) {\n          const replacement = await session.modal!.sandboxes!.fromId!(session.state!.sandboxId!);\n          if (session.sandbox && detached.has(session.sandbox)) {\n            session.sandbox = replacement;\n            installModalNativeSnapshotRetention(session);\n          } else {\n            replacement.detach?.();\n          }\n        }\n      })().finally(() => {\n        state.cancellation = null;\n      });\n    }\n    await state.cancellation;\n  };\n}\n\n/**\n * Bridge the pinned Agents Extensions Modal adapter to Modal 0.9's provider\n * contracts. The wrapper re-checks the private provider sandbox on every\n * capture because snapshot_filesystem hydration replaces that object.\n */\nexport function installOpenGeniModalSnapshotPolicy<T extends object>(session: T): T {\n  const mutable = session as MutableModalSandboxSession;\n  if (modalRetentionWrappedSessions.has(session)) return session;\n  if (typeof mutable.persistWorkspace !== \"function\") {\n    throw new Error(\"Modal session does not expose workspace persistence\");\n  }\n  assertPinnedModalSdk(mutable);\n  if (mutable.modal) installModalCommandStartContext(mutable.modal);\n  installModalTerminationConfirmation(mutable);\n  installModalNativeSnapshotRetention(mutable);\n  installModalExecCompletionRecovery(mutable);\n  installModalPendingExecCancellation(mutable);\n  installModalSynchronousCommandCollection(mutable, () => mutable.sandbox);\n  installModalListDirCompatibility(mutable);\n  if (\n    mutable.modal?.cpClient &&\n    mutable.modal.version &&\n    mutable.state?.sandboxId &&\n    mutable.state.manifest?.root\n  ) {\n    if (!mutable.modal.profile)\n      throw new Error(\"Modal command control requires its original authenticated SDK profile\");\n    installModalCommandSession(\n      mutable,\n      ModalCommandControl.forSandbox(\n        {\n          cpClient: mutable.modal.cpClient,\n          version: mutable.modal.version.bind(mutable.modal),\n          profile: mutable.modal.profile,\n          ...(mutable.modal.logger ? { logger: mutable.modal.logger } : {}),\n        },\n        () => {\n          const sandboxId = mutable.state?.sandboxId;\n          if (!sandboxId) throw new Error(\"Modal session sandbox identity is unavailable\");\n          return sandboxId;\n        },\n        mutable.state.manifest.root,\n        () => mutable.state?.environment ?? {},\n      ),\n    );\n  }\n  const persistWorkspace = mutable.persistWorkspace.bind(session);\n  mutable.persistWorkspace = async (options?: ModalWorkspaceCaptureOptions) => {\n    assertPinnedModalSdk(mutable);\n    installModalNativeSnapshotRetention(mutable);\n    if (\n      (mutable.state?.workspacePersistence === \"snapshot_filesystem\" ||\n        mutable.state?.workspacePersistence === \"snapshot_directory\") &&\n      (!options ||\n        !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(\n          options.requestId,\n        ))\n    ) {\n      throw new Error(\"Modal native workspace capture requires a valid UUID request id\");\n    }\n    const nativePersistence =\n      mutable.state?.workspacePersistence === \"snapshot_filesystem\" ||\n      mutable.state?.workspacePersistence === \"snapshot_directory\";\n    if (options && nativePersistence) {\n      modalSnapshotRequestIds.set(session, options.requestId);\n    }\n    const directoryTimeout =\n      mutable.state?.workspacePersistence === \"snapshot_directory\"\n        ? mutable.state.snapshotFilesystemTimeoutMs\n        : undefined;\n    const directoryTimeoutWasPresent =\n      mutable.state?.workspacePersistence === \"snapshot_directory\" &&\n      Object.hasOwn(mutable.state, \"snapshotFilesystemTimeoutMs\");\n    if (mutable.state?.workspacePersistence === \"snapshot_directory\") {\n      modalDirectorySnapshotTimeouts.set(session, directoryTimeout);\n      // The wrapped provider call above owns this exact timeout. Disable the\n      // SDK's lossy late-result deletion race for the duration of this exclusive\n      // capture, then restore the serialized session field byte-for-byte.\n      delete mutable.state.snapshotFilesystemTimeoutMs;\n    }\n    try {\n      return await persistWorkspace();\n    } finally {\n      modalSnapshotRequestIds.delete(session);\n      if (mutable.state?.workspacePersistence === \"snapshot_directory\") {\n        if (directoryTimeoutWasPresent) {\n          Reflect.set(mutable.state, \"snapshotFilesystemTimeoutMs\", directoryTimeout);\n        } else {\n          delete mutable.state.snapshotFilesystemTimeoutMs;\n        }\n        modalDirectorySnapshotTimeouts.delete(session);\n      }\n    }\n  };\n  modalRetentionWrappedSessions.add(session);\n  installModalCommandStartRetention(session);\n  return session;\n}\n\nexport class OpenGeniModalSandboxClient extends ModalSandboxClient {\n  readonly #snapshotFilesystemTimeoutMs: number | undefined;\n  readonly #createOptions: OpenGeniModalSandboxClientOptions;\n\n  constructor(options?: OpenGeniModalSandboxClientOptions) {\n    super(options);\n    this.#snapshotFilesystemTimeoutMs = options?.snapshotFilesystemTimeoutMs;\n    this.#createOptions = { ...options };\n  }\n\n  override async create(\n    args?: Parameters<ModalSandboxClient[\"create\"]>[0],\n    manifestOptions?: Parameters<ModalSandboxClient[\"create\"]>[1],\n  ): Promise<ModalSandboxSession> {\n    const session = await super.create(args, manifestOptions);\n    return installOpenGeniModalSnapshotPolicy(session);\n  }\n\n  async createWithLifecycle(\n    args: Parameters<ModalSandboxClient[\"create\"]>[0],\n    lifecycle: ModalCreateLifecycle,\n  ): Promise<ModalSandboxSession> {\n    return await createModalSessionWithLifecycle(\n      this.#createOptions,\n      args,\n      lifecycle,\n      installOpenGeniModalSnapshotPolicy,\n    );\n  }\n\n  override async resume(state: ModalSandboxSessionState): Promise<ModalSandboxSession> {\n    // Snapshot timeout is an operator-controlled execution budget, not durable\n    // provider identity. Older resume envelopes legitimately retain the value\n    // that was current when the box was created; letting that stale value win\n    // makes a later production increase ineffective exactly when a large\n    // workspace needs it. Rebind only this operational field while preserving\n    // every provider-identity and filesystem field byte-for-byte.\n    const effectiveState =\n      this.#snapshotFilesystemTimeoutMs === undefined ||\n      state.snapshotFilesystemTimeoutMs === this.#snapshotFilesystemTimeoutMs\n        ? state\n        : {\n            ...state,\n            snapshotFilesystemTimeoutMs: this.#snapshotFilesystemTimeoutMs,\n          };\n    const session = await this.resumeOnSharedClient(effectiveState);\n    return installOpenGeniModalSnapshotPolicy(session);\n  }\n\n  /** Reattach on the shared process-wide Modal client (see\n   * resumeModalSessionOnSharedClient). Replaces the pinned adapter's resume,\n   * which built a new client for every call. */\n  async resumeOnSharedClient(state: ModalSandboxSessionState): Promise<ModalSandboxSession> {\n    return await resumeModalSessionOnSharedClient(this.#createOptions, state);\n  }\n}\n\nexport const modalProvider: ProviderRegistration = {\n  backend: \"modal\",\n  exactResumeMode: \"ordinary\",\n  instanceIdFields: [\"sandboxId\"],\n  workspaceCapturePolicy(state) {\n    const persistence = providerWorkspacePersistence(state);\n    if (persistence === \"snapshot_filesystem\" || persistence === \"snapshot_directory\") {\n      return {\n        takeover: \"same_request\",\n        strategy: \"configured\",\n        liveInstance: \"preserved\",\n      };\n    }\n    return REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE;\n  },\n  async buildImmutableImage({ settings, session, requestId, timeoutMs }) {\n    const mutable = session as MutableModalSandboxSession;\n    const sandboxId = mutable.state?.sandboxId;\n    const sandboxes = mutable.modal?.sandboxes;\n    if (!sandboxId || typeof sandboxes?.fromId !== \"function\") {\n      throw new Error(\"Modal provider image build requires an exact live sandbox identity\");\n    }\n    const snapshotHandle = await sandboxes.fromId(sandboxId);\n    try {\n      if (typeof snapshotHandle.snapshotFilesystem !== \"function\") {\n        throw new Error(\"Modal provider image build requires snapshotFilesystem support\");\n      }\n      const image = (await snapshotHandle.snapshotFilesystem({\n        snapshotId: requestId,\n        timeoutMs,\n        ttlMs: null,\n      })) as { imageId?: unknown; objectId?: unknown };\n      const imageId =\n        typeof image.imageId === \"string\"\n          ? image.imageId\n          : typeof image.objectId === \"string\"\n            ? image.objectId\n            : null;\n      if (!imageId) {\n        throw new Error(\"Modal provider image snapshot returned no immutable image id\");\n      }\n      const binding = await resolveModalCheckpointProviderBindingForSession(settings, session);\n      return {\n        provider: \"modal\",\n        backend: \"modal\",\n        imageId,\n        imageDigest: null,\n        providerBindingKey: binding.key,\n        providerBinding: binding.binding,\n      };\n    } finally {\n      snapshotHandle.detach?.();\n    }\n  },\n  descriptor: CAPABILITY_DESCRIPTORS.modal,\n  sessionSupportsPty: true,\n  validateCredentials(settings) {\n    // both-or-neither (preserves existing validation at config validateSettings).\n    if (Boolean(settings.modalTokenId) !== Boolean(settings.modalTokenSecret)) {\n      throw new SandboxConfigError(\n        \"modal\",\n        \"OPENGENI_MODAL_TOKEN_ID and OPENGENI_MODAL_TOKEN_SECRET must both be set or both omitted\",\n      );\n    }\n    if (!settings.modalAppName) {\n      throw new SandboxConfigError(\"modal\", \"OPENGENI_MODAL_APP_NAME is required\");\n    }\n  },\n  build({ settings, environment, exposedPorts }) {\n    const options: OpenGeniModalSandboxClientOptions = {\n      appName: settings.modalAppName,\n      timeoutMs: settings.modalTimeoutSeconds * 1000,\n      sandboxCreateTimeoutS: Math.ceil(settings.sandboxWarmingTimeoutMs / 1000),\n      // The Agents Extensions session persists this value in its provider\n      // state and passes it to persistWorkspace(). Keep it aligned with the\n      // same current setting that bounds Opengeni's outer capture operation.\n      snapshotFilesystemTimeoutMs: settings.sandboxSnapshotTimeoutMs,\n      exposedPorts,\n      env: environment,\n      // A registry image's own CMD is not a sandbox keepalive contract (for\n      // example, python:3.12-slim can exit immediately). Keep the provider's\n      // control process alive so exec/resume remains available; Modal's hard\n      // timeout and explicit Opengeni teardown still own the box lifetime.\n      useSleepCmd: true,\n    };\n    // gap-fill (module 03 §4.1): these SDK options were previously unmapped.\n    // ALWAYS pin idleTimeoutMs (sandbox-file-persistence): an UNSET idle timeout\n    // lets the SDK send idleTimeoutSecs=undefined, so Modal applies its short\n    // server-default idle-reap and kills an idle (between-turns) box LONG before\n    // Opengeni's reaper can resume+snapshot it. effectiveModalIdleTimeoutSeconds\n    // defaults this to the hard lifetime so the box survives its full warm window\n    // and the reaper — not Modal's idle-reap — governs teardown (and snapshots\n    // /workspace first).\n    options.idleTimeoutMs = effectiveModalIdleTimeoutSeconds(settings) * 1000;\n    if (settings.modalSandboxCpu !== undefined) {\n      options.cpu = settings.modalSandboxCpu;\n    }\n    if (settings.modalSandboxMemoryMiB !== undefined) {\n      options.memoryMiB = settings.modalSandboxMemoryMiB;\n    }\n    if (settings.modalRegions !== undefined) {\n      options.regions = [...settings.modalRegions];\n    }\n    if (settings.modalWorkspacePersistence) {\n      options.workspacePersistence = settings.modalWorkspacePersistence;\n    }\n    const imageSelector = resolveModalImageSelector(settings);\n    if (imageSelector) {\n      options.image = imageSelector;\n    }\n    if (settings.modalTokenId) {\n      options.tokenId = settings.modalTokenId;\n    }\n    if (settings.modalTokenSecret) {\n      options.tokenSecret = settings.modalTokenSecret;\n    }\n    if (settings.modalEnvironment) {\n      options.environment = settings.modalEnvironment;\n    }\n    return new OpenGeniModalSandboxClient(options);\n  },\n};\n\ntype ModalModule = typeof import(\"modal\");\ntype ModalClientLike = InstanceType<ModalModule[\"ModalClient\"]>;\n\n// --- Modal provider-native / private-registry image resolution --------------------\n//\n// OPENGENI_MODAL_IMAGE_ID is the preferred immutable provider-native path. The\n// Agents extension resolves it with ModalImageSelector.fromId and serializes the\n// actual imageId into the session state, while modalImageRef remains the logical\n// digest persisted on the Opengeni lease.\n//\n// The Agents-extension Modal backend resolves `modalImageRef` via\n// `Image.fromRegistry(tag)` with NO secret, so it can only pull PUBLIC images. To run\n// a PRIVATE image we resolve the named Modal Secret and pre-build the authenticated\n// `fromRegistry(tag, secret)` image ONCE per process, then hand the provider `build`\n// a `ModalImageSelector.fromImage(...)`. `build` is synchronous and modal is imported\n// lazily (never loaded for non-modal backends), so resolution can't happen inside\n// `build`; the worker awaits `ensureModalRegistryImage` at boot for global refs and\n\n// images are lazy, workspace-scoped definitions, so an image built by this module's\n// client is usable by the ModalSandboxClient's own client.\n\n/** Loader seam so unit tests can inject a fake modal module. */\nexport type ModalModuleLoader = () => Promise<Pick<ModalModule, \"ModalClient\">>;\n\nconst defaultModalLoader: ModalModuleLoader = () => import(\"modal\");\n\n/** Settled, synchronously-readable resolved images, keyed per config. */\nconst resolvedRegistryImages = new Map<string, unknown>();\n/** In-flight resolutions, for cross-call de-duplication. */\nconst inFlightRegistryImages = new Map<string, Promise<void>>();\nconst MODAL_AUTHENTICATED_REGISTRY_LABEL = \"LABEL io.opengeni.registry-import=authenticated\";\n\nfunction registryImageCacheKey(settings: Settings): string {\n  return [\n    settings.modalImageRef ?? \"\",\n    settings.modalImageRegistrySecret ?? \"\",\n    settings.modalEnvironment ?? \"\",\n  ].join(\"|\");\n}\n\nexport async function ensureModalRegistryImage(\n  settings: Settings,\n  loadModal: ModalModuleLoader = defaultModalLoader,\n): Promise<void> {\n  // A provider-native immutable image ID bypasses registry import entirely.\n  // ModalImageSelector.fromId resolves it during sandbox creation and the\n  // provider session state records that exact ID.\n  if (settings.modalImageId) {\n    return;\n  }\n  if (!settings.modalImageRegistrySecret || !settings.modalImageRef) {\n    return;\n  }\n  const key = registryImageCacheKey(settings);\n  if (resolvedRegistryImages.has(key)) {\n    return;\n  }\n  let pending = inFlightRegistryImages.get(key);\n  if (!pending) {\n    pending = (async () => {\n      const modal = await loadModal();\n      const client = new modal.ModalClient(modalClientOptions(settings));\n      // Resolve the Secret via the AUTHENTICATED client (client.secrets.fromName),\n      // NOT the static `modal.Secret.fromName`, which resolves against\n      // `getDefaultClient()` — i.e. the standard MODAL_TOKEN_ID/MODAL_TOKEN_SECRET env\n      // or ~/.modal.toml — and so would throw \"Profile is missing token_id\" in any host\n      // that supplies the token only through Opengeni settings (OPENGENI_MODAL_TOKEN_ID).\n      const secret = await client.secrets.fromName(\n        settings.modalImageRegistrySecret!,\n        settings.modalEnvironment ? { environment: settings.modalEnvironment } : undefined,\n      );\n      // fromRegistry is synchronous and returns a lazy image definition. Build it\n      // here with the same authenticated client that resolved the registry Secret.\n      // Passing the lazy definition into ModalSandboxClient crosses a ModalClient\n      // boundary and makes every sandbox creation hydrate/import it again; registry\n      // auth can then be lost and failed imports become sticky image builds. A built\n      // provider-native Image is immutable, reusable, and contains no registry\n      // credential boundary for the sandbox client to reconstruct.\n      const app = await client.apps.fromName(settings.modalAppName, {\n        ...(settings.modalEnvironment ? { environment: settings.modalEnvironment } : {}),\n        createIfMissing: true,\n      });\n      const registryImage = (forceBuild: boolean) =>\n        client.images\n          .fromRegistry(settings.modalImageRef!, secret)\n          .dockerfileCommands([MODAL_AUTHENTICATED_REGISTRY_LABEL], {\n            ...(forceBuild ? { forceBuild: true } : {}),\n          });\n      let builtImage;\n      try {\n        builtImage = await registryImage(false).build(app);\n      } catch {\n        // Modal memoizes registry-import failures by image definition. A\n        // corrected/rotated Secret would otherwise receive the same stale\n        // failed Image forever. Retry exactly once with the same deterministic\n        // definition and Modal's explicit force-build bit; successful imports\n        // remain cached normally on later worker starts.\n        builtImage = await registryImage(true).build(app);\n      }\n      resolvedRegistryImages.set(key, builtImage);\n    })().finally(() => {\n      inFlightRegistryImages.delete(key);\n    });\n    inFlightRegistryImages.set(key, pending);\n  }\n  await pending;\n}\n\n/** The resolved private-registry image for these settings, or undefined if none. */\nfunction cachedModalRegistryImage(settings: Settings): unknown | undefined {\n  if (!settings.modalImageRegistrySecret || !settings.modalImageRef) {\n    return undefined;\n  }\n  return resolvedRegistryImages.get(registryImageCacheKey(settings));\n}\n\n/**\n * Choose the image selector for a Modal sandbox client from settings. Returns:\n *  - `fromId(modalImageId)` when a provider-native immutable ID is configured;\n *  - `fromImage(resolved)` when a private-registry secret is configured AND the\n *    image has been resolved (ensureModalRegistryImage ran before create);\n *  - `fromTag(modalImageRef)` for the public path (no secret, or cold cache — the\n *    resume/attach paths never pull an image so the tag branch is harmless there);\n *  - `undefined` when no image ref is set (Modal uses its default image).\n * Exported for unit tests.\n */\nexport function resolveModalImageSelector(settings: Settings): ModalImageSelector | undefined {\n  if (settings.modalImageId) {\n    return ModalImageSelector.fromId(settings.modalImageId);\n  }\n  if (!settings.modalImageRef) {\n    return undefined;\n  }\n  const registryImage = cachedModalRegistryImage(settings);\n  return registryImage\n    ? ModalImageSelector.fromImage(\n        registryImage as Parameters<typeof ModalImageSelector.fromImage>[0],\n      )\n    : ModalImageSelector.fromTag(settings.modalImageRef);\n}\n\n/** Test-only: clear the resolved/in-flight image caches. */\nexport function __resetModalRegistryImageCacheForTest(): void {\n  resolvedRegistryImages.clear();\n  inFlightRegistryImages.clear();\n}\n\nfunction modalClientOptions(\n  settings: Settings,\n): ConstructorParameters<ModalModule[\"ModalClient\"]>[0] {\n  return {\n    ...(settings.modalTokenId ? { tokenId: settings.modalTokenId } : {}),\n    ...(settings.modalTokenSecret ? { tokenSecret: settings.modalTokenSecret } : {}),\n    ...(settings.modalEnvironment ? { environment: settings.modalEnvironment } : {}),\n  };\n}\n\nasync function createModalClient(settings: Settings): Promise<ModalClientLike> {\n  const modal = await import(\"modal\");\n  return new modal.ModalClient(modalClientOptions(settings));\n}\n\nfunction isModalNotFoundError(error: unknown): boolean {\n  const candidate = error as {\n    name?: unknown;\n    code?: unknown;\n  };\n  // The pinned Modal SDK normalizes image/sandbox NOT_FOUND and its documented\n  // FAILED_PRECONDITION alias to NotFoundError. Numeric gRPC code 5 is retained\n  // for narrow adapter/fake compatibility. Never classify message text: an auth,\n  // workspace, DNS, or proxy error containing \"not found\" is not deletion proof.\n  return candidate?.name === \"NotFoundError\" || candidate?.code === 5;\n}\n\nasync function modalCheckpointProviderBindingForClient(\n  settings: Settings,\n  modal: ModalClientLike,\n): Promise<ModalCheckpointProviderBinding> {\n  const identity = await modal.cpClient.workspaceNameLookup({});\n  const workspaceName = identity.workspaceName || identity.username;\n  if (!workspaceName) {\n    throw new Error(\"Modal credential resolved no workspace identity\");\n  }\n  const resolved = canonicalModalCheckpointProviderBinding({\n    version: 1,\n    serverUrl: modal.profile.serverUrl,\n    workspaceName,\n    // Resolve through the authenticated client, not the optional Opengeni\n    // override alone. When the override is absent Modal may select a profile\n    // environment; persisting \"\" would fail to fence a later profile change.\n    environment: modal.environmentName(settings.modalEnvironment),\n  });\n  if (!resolved) {\n    throw new Error(\"Modal credential resolved an invalid checkpoint provider identity\");\n  }\n  return resolved.binding;\n}\n\n// Keyed by the authenticated client, not the session: every session on the\n// shared process-wide client has the same identity, so it is looked up once.\nconst modalClientCheckpointBindings = new WeakMap<\n  object,\n  Map<string, Promise<{ key: string; binding: ModalCheckpointProviderBinding }>>\n>();\n\n/**\n * Resolve checkpoint ownership through the exact authenticated Modal client\n * embedded in the session that creates the snapshot. The field is private in\n * the pinned Agents extension, so this adapter is intentionally fail-closed:\n * an upstream shape change disables native publication instead of guessing\n * ownership from a newly-resolved ambient profile.\n */\nexport async function resolveModalCheckpointProviderBindingForSession(\n  settings: Settings,\n  session: unknown,\n): Promise<{ key: string; binding: ModalCheckpointProviderBinding }> {\n  if (!session || typeof session !== \"object\") {\n    throw new Error(\"Modal checkpoint session identity is unavailable\");\n  }\n  const modal = (session as { modal?: unknown }).modal as ModalClientLike | undefined;\n  if (\n    !modal ||\n    typeof modal.cpClient?.workspaceNameLookup !== \"function\" ||\n    typeof modal.profile?.serverUrl !== \"string\" ||\n    typeof modal.environmentName !== \"function\"\n  ) {\n    throw new Error(\"Pinned Modal session no longer exposes its authenticated checkpoint identity\");\n  }\n  let byEnvironment = modalClientCheckpointBindings.get(modal);\n  if (!byEnvironment) modalClientCheckpointBindings.set(modal, (byEnvironment = new Map()));\n  const environmentKey = settings.modalEnvironment ?? \"\";\n  const cached = byEnvironment.get(environmentKey);\n  if (cached) return await cached;\n  const pending = modalCheckpointProviderBindingForClient(settings, modal).then(\n    (binding) => canonicalModalCheckpointProviderBinding(binding)!,\n  );\n  byEnvironment.set(environmentKey, pending);\n  try {\n    return await pending;\n  } catch (error) {\n    if (byEnvironment.get(environmentKey) === pending) byEnvironment.delete(environmentKey);\n    throw error;\n  }\n}\n\n/** Compare a restore receipt against the exact authenticated Modal client\n * embedded in the created session. This deliberately does not resolve a second\n * ambient client: the session that will consume the snapshot is the authority. */\nexport async function modalSessionMatchesCheckpointProviderBinding(\n  settings: Settings,\n  session: unknown,\n  expectedBindingKey: string,\n): Promise<boolean> {\n  const identity = await resolveModalCheckpointProviderBindingForSession(settings, session);\n  return identity.key === expectedBindingKey;\n}\n\n/** Resolve the authoritative Modal workspace behind the configured credential.\n * Snapshot ids are workspace-scoped; persisting this non-secret binding lets GC\n * reject a credential rotation that points at a different workspace instead of\n * issuing a destructive call under ambient credentials. */\nexport async function resolveModalCheckpointProviderBinding(\n  settings: Settings,\n  createClient: (settings: Settings) => Promise<ModalClientLike> = createModalClient,\n): Promise<{ key: string; binding: ModalCheckpointProviderBinding }> {\n  const modal = await createClient(settings);\n  try {\n    const binding = await modalCheckpointProviderBindingForClient(settings, modal);\n    return canonicalModalCheckpointProviderBinding(binding)!;\n  } finally {\n    modal.close();\n  }\n}\n\n/** Positive discovery only. A missing/expired provider listing never proves\n * that a dispatched create did not happen, and never authorizes a retry. */\nexport async function findModalProviderCreateReceipt(\n  settings: Settings,\n  attempt: {\n    operationId: string;\n    providerBindingKey: string;\n    appId: string;\n    providerName: string;\n    imageId: string | null;\n  },\n  createClient: (settings: Settings) => Promise<ModalClientLike> = createModalClient,\n): Promise<string | null> {\n  if (\n    !attempt.imageId ||\n    !attempt.appId ||\n    attempt.providerName !== `opengeni-create-${attempt.operationId}`\n  )\n    throw new Error(\"Modal create recovery requires exact persisted provider identity\");\n  const modal = await createClient(settings);\n  try {\n    const binding = canonicalModalCheckpointProviderBinding(\n      await modalCheckpointProviderBindingForClient(settings, modal),\n    );\n    if (binding?.key !== attempt.providerBindingKey)\n      throw new Error(\"Modal create recovery refused a different authenticated namespace\");\n    let beforeTimestamp: number | undefined;\n    const found = new Set<string>();\n    // An operation normally has one result. Bound malformed/ambiguous provider\n    // inventory without treating partial pagination as a unique receipt.\n    for (let page = 0; page < 16; page++) {\n      const response = await modal.cpClient.sandboxList({\n        appId: attempt.appId,\n        environmentName: modal.environmentName(settings.modalEnvironment),\n        includeFinished: true,\n        tags: [{ tagName: \"opengeni_provider_create_operation_id\", tagValue: attempt.operationId }],\n        ...(beforeTimestamp === undefined ? {} : { beforeTimestamp }),\n      });\n      if (!response.sandboxes.length) return found.size === 1 ? [...found][0]! : null;\n      for (const info of response.sandboxes) {\n        if (\n          !info.id.startsWith(\"sb-\") ||\n          info.appId !== attempt.appId ||\n          info.name !== attempt.providerName ||\n          info.imageId !== attempt.imageId ||\n          info.tags.filter((tag) => tag.tagName === \"opengeni_provider_create_operation_id\")\n            .length !== 1 ||\n          !info.tags.some(\n            (tag) =>\n              tag.tagName === \"opengeni_provider_create_operation_id\" &&\n              tag.tagValue === attempt.operationId,\n          )\n        )\n          throw new Error(\"Modal create discovery returned inconsistent operation identity\");\n        found.add(info.id);\n        if (found.size > 1) throw new Error(\"Modal create discovery is ambiguous; preserve fence\");\n      }\n      const oldest = Math.min(...response.sandboxes.map((info) => info.createdAt));\n      if (\n        !Number.isFinite(oldest) ||\n        oldest <= 0 ||\n        (beforeTimestamp !== undefined && oldest >= beforeTimestamp)\n      )\n        throw new Error(\"Modal create discovery pagination did not advance\");\n      beforeTimestamp = oldest;\n    }\n    throw new Error(\"Modal create discovery exceeded its bounded inventory\");\n  } finally {\n    modal.close();\n  }\n}\n\n/** Prove a legacy lease's live sandbox is visible in the same Modal namespace\n * whose identity will own the adopted checkpoint row. */\nexport async function resolveModalCheckpointProviderBindingForLiveSandbox(\n  settings: Settings,\n  sandboxId: string,\n  createClient: (settings: Settings) => Promise<ModalClientLike> = createModalClient,\n): Promise<{ key: string; binding: ModalCheckpointProviderBinding }> {\n  if (!sandboxId) throw new Error(\"Modal live-sandbox identity requires a sandbox id\");\n  const modal = await createClient(settings);\n  try {\n    const binding = await modalCheckpointProviderBindingForClient(settings, modal);\n    const sandbox = await modal.sandboxes.fromId(sandboxId);\n    const exitCode = await sandbox.poll();\n    if (exitCode !== null) {\n      throw new Error(`Modal sandbox ${sandboxId} is no longer running`);\n    }\n    return canonicalModalCheckpointProviderBinding(binding)!;\n  } finally {\n    modal.close();\n  }\n}\n\n/**\n * Observe one exact historical Modal sandbox without consulting the current\n * lease or its (possibly successor-owned) resume envelope. This is deliberately\n * lifecycle-only: a running sandbox does not prove whether an individual\n * retained process is still running, while a terminal/missing sandbox proves\n * that none of its processes can still execute.\n */\nexport async function inspectModalSandboxLifecycle(\n  settings: Settings,\n  sandboxId: string,\n  expectedBindingKey?: string | null,\n  createClient: (settings: Settings) => Promise<ModalClientLike> = createModalClient,\n): Promise<\n  | {\n      status: \"running\";\n      providerBindingKey: string;\n      providerBinding: ModalCheckpointProviderBinding;\n    }\n  | {\n      status: \"terminated\";\n      exitCode: number;\n      providerBindingKey: string;\n      providerBinding: ModalCheckpointProviderBinding;\n    }\n  | {\n      status: \"not_found\";\n      providerBindingKey: string;\n      providerBinding: ModalCheckpointProviderBinding;\n    }\n> {\n  if (!sandboxId) throw new Error(\"Modal lifecycle inspection requires a sandbox id\");\n  const modal = await createClient(settings);\n  try {\n    const binding = canonicalModalCheckpointProviderBinding(\n      await modalCheckpointProviderBindingForClient(settings, modal),\n    )!;\n    if (expectedBindingKey && binding.key !== expectedBindingKey) {\n      throw new Error(\n        \"Modal lifecycle inspection refused because the configured credential workspace changed\",\n      );\n    }\n    try {\n      const sandbox = await modal.sandboxes.fromId(sandboxId);\n      const exitCode = await sandbox.poll();\n      return exitCode === null\n        ? {\n            status: \"running\",\n            providerBindingKey: binding.key,\n            providerBinding: binding.binding,\n          }\n        : {\n            status: \"terminated\",\n            exitCode,\n            providerBindingKey: binding.key,\n            providerBinding: binding.binding,\n          };\n    } catch (error) {\n      if (isModalNotFoundError(error)) {\n        return {\n          status: \"not_found\",\n          providerBindingKey: binding.key,\n          providerBinding: binding.binding,\n        };\n      }\n      throw error;\n    }\n  } finally {\n    modal.close();\n  }\n}\n\nexport async function deleteModalCheckpointSnapshot(\n  settings: Settings,\n  expectedBindingKey: string,\n  snapshotId: string,\n  createClient: (settings: Settings) => Promise<ModalClientLike> = createModalClient,\n): Promise<\"deleted\" | \"not_found\"> {\n  if (!snapshotId) throw new Error(\"Modal checkpoint deletion requires a snapshot id\");\n  // Resolve identity and delete through the same authenticated client. A cached\n  // or separately-created identity probe could approve workspace A and then\n  // issue the destructive call through a rotated ambient profile for workspace B.\n  const modal = await createClient(settings);\n  try {\n    const binding = await modalCheckpointProviderBindingForClient(settings, modal);\n    const identity = canonicalModalCheckpointProviderBinding(binding)!;\n    if (expectedBindingKey !== identity.key) {\n      throw new Error(\n        \"Modal checkpoint deletion refused because the configured credential workspace changed\",\n      );\n    }\n    try {\n      await modal.images.delete(snapshotId);\n      return \"deleted\";\n    } catch (error) {\n      if (isModalNotFoundError(error)) return \"not_found\";\n      throw error;\n    }\n  } finally {\n    modal.close();\n  }\n}\n\nexport async function tagModalSandbox(\n  settings: Settings,\n  sandboxId: string,\n  attribution: ModalSandboxAttribution,\n): Promise<boolean> {\n  if (!sandboxId) {\n    return false;\n  }\n  const modal = await createModalClient(settings);\n  try {\n    const sandbox = await modal.sandboxes.fromId(sandboxId);\n    await sandbox.setTags(modalSandboxAttributionTags(attribution));\n    return true;\n  } finally {\n    modal.close();\n  }\n}\n\nexport async function terminateModalSandboxById(\n  settings: Settings,\n  sandboxId: string,\n  createClient: (settings: Settings) => Promise<ModalClientLike> = createModalClient,\n  expectedProviderBindingKey?: string,\n): Promise<boolean> {\n  if (!sandboxId) {\n    return true;\n  }\n  const modal = await createClient(settings);\n  try {\n    if (expectedProviderBindingKey) {\n      const binding = canonicalModalCheckpointProviderBinding(\n        await modalCheckpointProviderBindingForClient(settings, modal),\n      );\n      if (binding?.key !== expectedProviderBindingKey)\n        throw new Error(\"Modal create cleanup refused a different authenticated namespace\");\n    }\n    const sandbox = await modal.sandboxes.fromId(sandboxId);\n    await confirmModalTermination(sandbox.terminate.bind(sandbox));\n    return true;\n  } finally {\n    modal.close();\n  }\n}\n\ntype ModalSandboxInfo = {\n  id: string;\n  createdAt?: number;\n  tags?: Array<{ tagName?: string; tagValue?: string }>;\n};\n\ntype ModalCpListClient = ModalClientLike & {\n  cpClient: {\n    sandboxList(input: {\n      appId?: string;\n      beforeTimestamp?: number;\n      environmentName?: string;\n      includeFinished?: boolean;\n      tags?: Array<{ tagName: string; tagValue: string }>;\n    }): Promise<{ sandboxes?: ModalSandboxInfo[] }>;\n  };\n};\n\nfunction tagsFromInfo(info: ModalSandboxInfo): Record<string, string> {\n  const tags: Record<string, string> = {};\n  for (const tag of info.tags ?? []) {\n    if (typeof tag.tagName === \"string\" && typeof tag.tagValue === \"string\") {\n      tags[tag.tagName] = tag.tagValue;\n    }\n  }\n  return tags;\n}\n\nfunction sandboxCreatedAtMs(info: ModalSandboxInfo): number | null {\n  if (\n    typeof info.createdAt !== \"number\" ||\n    !Number.isFinite(info.createdAt) ||\n    info.createdAt <= 0\n  ) {\n    return null;\n  }\n  // Modal protobuf timestamps in this SDK are seconds as doubles.\n  return info.createdAt < 10_000_000_000\n    ? Math.floor(info.createdAt * 1000)\n    : Math.floor(info.createdAt);\n}\n\nfunction attributionKey(\n  input: Pick<ModalSandboxAttribution, \"leaseId\" | \"workspaceId\" | \"sandboxGroupId\">,\n): string {\n  return `${input.workspaceId}:${input.sandboxGroupId}:${input.leaseId}`;\n}\n\n/**\n * Whether the deployment's Modal app has any unfinished sandbox: the first\n * page of exactly the listing the orphan sweep walks. When it has none, the\n * sweep has nothing to terminate or attribute, and its inventory is empty. A\n * missing app is an empty inventory, as in the sweep.\n */\nexport async function modalAppHasRunningSandboxes(\n  settings: Settings,\n  options: { client?: ModalClientLike } = {},\n): Promise<boolean> {\n  const ownedClient = options.client ? null : await createModalClient(settings);\n  const modal = (options.client ?? ownedClient)! as ModalCpListClient;\n  try {\n    let appId: string | undefined;\n    try {\n      appId = (\n        await modal.apps.fromName(settings.modalAppName, {\n          createIfMissing: false,\n          ...(settings.modalEnvironment ? { environment: settings.modalEnvironment } : {}),\n        })\n      ).appId;\n    } catch (error) {\n      if (isModalNotFoundError(error)) return false;\n      throw error;\n    }\n    if (!appId) return false;\n    const response = await modal.cpClient.sandboxList({\n      appId,\n      includeFinished: false,\n      ...(settings.modalEnvironment ? { environmentName: settings.modalEnvironment } : {}),\n      tags: [],\n    });\n    return (response.sandboxes ?? []).length > 0;\n  } finally {\n    ownedClient?.close();\n  }\n}\n\nexport async function sweepModalOrphanSandboxes(\n  settings: Settings,\n  liveLeases: LiveModalSandboxLeaseAttribution[],\n  options: {\n    now?: Date;\n    maxTerminations?: number;\n    unattributedGraceMs?: number;\n    client?: ModalClientLike;\n    /** Re-read durable ownership immediately before provider termination. A\n     * false result or callback failure skips the destructive action. */\n    revalidateTermination?: RevalidateModalOrphanTermination;\n  } = {},\n): Promise<ModalOrphanSweepResult> {\n  const nowMs = options.now?.getTime() ?? Date.now();\n  const maxTerminations = options.maxTerminations ?? MODAL_ORPHAN_SWEEP_LIMIT;\n  const unattributedGraceMs = options.unattributedGraceMs ?? MODAL_UNATTRIBUTED_ORPHAN_GRACE_MS;\n  const liveByAttribution = new Map(liveLeases.map((lease) => [attributionKey(lease), lease]));\n  // LIVE-INSTANCE GUARD: a box that any live lease's envelope points at is NEVER\n  // an orphan, whatever its tags say. Tags are best-effort attribution (setTags\n  // is a separate call after create and can fail or lag); the lease envelope is\n  // the source of truth the turn path actually resumes by. Judging by tags alone\n  // terminated a LIVE box mid-turn at exactly creation+30min (staging session\n  // e644e8a8, 2026-07-06) — the box's unpushed work was unrecoverable because\n  // nothing outside the reaper drain persists /workspace.\n  const liveByInstanceId = new Map(\n    liveLeases\n      .filter((lease) => lease.instanceId)\n      .map((lease) => [lease.instanceId as string, lease]),\n  );\n  const ownedClient = options.client ? null : await createModalClient(settings);\n  const modal = (options.client ?? ownedClient)! as ModalCpListClient;\n  try {\n    let app: Awaited<ReturnType<typeof modal.apps.fromName>>;\n    try {\n      app = await modal.apps.fromName(settings.modalAppName, {\n        createIfMissing: false,\n        ...(settings.modalEnvironment ? { environment: settings.modalEnvironment } : {}),\n      });\n    } catch (error) {\n      // A new deployment has no Modal app until its first sandbox is created.\n      // That is an empty provider inventory, not a failed orphan sweep.\n      if (isModalNotFoundError(error)) {\n        return emptyModalOrphanSweepResult(liveLeases);\n      }\n      throw error;\n    }\n    const appId = app.appId;\n    if (!appId) {\n      return emptyModalOrphanSweepResult(liveLeases);\n    }\n\n    let examined = 0;\n    let skipped = 0;\n    const unterminated: ModalOrphanSweepTermination[] = [];\n    let complete = false;\n    const seenInstanceIds = new Set<string>();\n    const terminated: ModalOrphanSweepTermination[] = [];\n    let beforeTimestamp: number | undefined;\n    while (terminated.length < maxTerminations) {\n      const response = await modal.cpClient.sandboxList({\n        appId,\n        ...(beforeTimestamp !== undefined ? { beforeTimestamp } : {}),\n        includeFinished: false,\n        ...(settings.modalEnvironment ? { environmentName: settings.modalEnvironment } : {}),\n        tags: [],\n      });\n      const sandboxes = response.sandboxes ?? [];\n      if (sandboxes.length === 0) {\n        complete = true;\n        break;\n      }\n      for (const info of sandboxes) {\n        examined += 1;\n        if (info.id) {\n          seenInstanceIds.add(info.id);\n        }\n        const tags = tagsFromInfo(info);\n        const leaseId = tags.opengeni_lease_id;\n        const workspaceId = tags.opengeni_workspace_id;\n        const sandboxGroupId = tags.opengeni_sandbox_group_id;\n        const liveByInstance = info.id ? liveByInstanceId.get(info.id) : undefined;\n        if (liveByInstance) {\n          // Live-instance guard (see above): a live lease resumes this exact box\n          // by id — hard-skip it, and HEAL its attribution tags when they are\n          // missing/stale so it stops looking sweep-eligible. Best-effort: a\n          // failed re-tag must never fail the sweep (the guard, not the tags,\n          // is what protects the box now).\n          if (\n            leaseId !== liveByInstance.leaseId ||\n            workspaceId !== liveByInstance.workspaceId ||\n            sandboxGroupId !== liveByInstance.sandboxGroupId\n          ) {\n            try {\n              const sandbox = await modal.sandboxes.fromId(info.id);\n              await sandbox.setTags(\n                modalSandboxAttributionTags({\n                  leaseId: liveByInstance.leaseId,\n                  workspaceId: liveByInstance.workspaceId,\n                  sandboxGroupId: liveByInstance.sandboxGroupId,\n                }),\n              );\n            } catch {\n              // Tag healing is opportunistic; the instance guard already\n              // protects this box on every future sweep pass.\n            }\n          }\n          skipped += 1;\n          continue;\n        }\n        let reason: ModalOrphanSweepTermination[\"reason\"] | null = null;\n        if (leaseId && workspaceId && sandboxGroupId) {\n          const live = liveByAttribution.get(\n            attributionKey({ leaseId, workspaceId, sandboxGroupId }),\n          );\n          if (!live || (live.instanceId && live.instanceId !== info.id)) {\n            reason = \"stale_attribution\";\n          }\n        } else {\n          const createdAtMs = sandboxCreatedAtMs(info);\n          if (createdAtMs !== null && nowMs - createdAtMs >= unattributedGraceMs) {\n            reason = \"unattributed\";\n          }\n        }\n\n        if (!reason) {\n          skipped += 1;\n          continue;\n        }\n        const candidate = { sandboxId: info.id, reason, tags };\n        let sandbox: Awaited<ReturnType<typeof modal.sandboxes.fromId>>;\n        try {\n          sandbox = await modal.sandboxes.fromId(info.id);\n        } catch {\n          skipped += 1;\n          unterminated.push(candidate);\n          continue;\n        }\n        if (options.revalidateTermination) {\n          try {\n            if (!(await options.revalidateTermination(candidate))) {\n              skipped += 1;\n              unterminated.push(candidate);\n              continue;\n            }\n          } catch {\n            // Destructive provider cleanup fails closed when the fresh durable\n            // ownership read is unavailable or otherwise inconclusive.\n            skipped += 1;\n            unterminated.push(candidate);\n            continue;\n          }\n        }\n        try {\n          await confirmModalTermination(sandbox.terminate.bind(sandbox));\n          terminated.push(candidate);\n        } catch {\n          skipped += 1;\n          unterminated.push(candidate);\n        }\n        if (terminated.length >= maxTerminations) {\n          break;\n        }\n      }\n      beforeTimestamp = sandboxes[sandboxes.length - 1]?.createdAt;\n      if (beforeTimestamp === undefined) {\n        complete = true;\n        break;\n      }\n    }\n    return {\n      examined,\n      terminated,\n      skipped,\n      inventory: {\n        complete,\n        running: examined,\n        unterminated,\n        // The live-lease snapshot was read before the listing began, so an\n        // instance id it names already existed and a complete listing of\n        // running boxes contains it unless that box has stopped.\n        missingLiveLeaseInstanceIds: complete\n          ? liveLeases.flatMap((lease) =>\n              lease.instanceId && !seenInstanceIds.has(lease.instanceId) ? [lease.instanceId] : [],\n            )\n          : [],\n      },\n    };\n  } finally {\n    ownedClient?.close();\n  }\n}\n\nfunction emptyModalOrphanSweepResult(\n  liveLeases: LiveModalSandboxLeaseAttribution[],\n): ModalOrphanSweepResult {\n  return {\n    examined: 0,\n    terminated: [],\n    skipped: 0,\n    inventory: {\n      complete: true,\n      running: 0,\n      unterminated: [],\n      missingLiveLeaseInstanceIds: liveLeases.flatMap((lease) =>\n        lease.instanceId ? [lease.instanceId] : [],\n      ),\n    },\n  };\n}\n","import { randomUUID } from \"node:crypto\";\nimport { isDeepStrictEqual } from \"node:util\";\nimport { truncateOutput } from \"@openai/agents-core/sandbox/internal\";\nimport type { ChannelASession } from \"../channel-a\";\nimport {\n  aliasNativeSynchronousCommandOutput,\n  retainSynchronousTerminalProviderPage,\n  synchronousTerminalProviderPage,\n} from \"../native-synchronous-collection\";\nimport { ModalProcessObservationUnavailableError } from \"../errors\";\nimport { classifyProviderSandboxFailure } from \"../provider-errors\";\nimport { markTypedExecHandleLoss, parseExecResponseBanner } from \"../exec-banner\";\nimport {\n  MAX_PROVIDER_COMMAND_HANDLE,\n  type ProviderCommandOutput,\n  type ProviderCommandPersistence,\n  type ProviderCommandSession,\n  admittedProviderCommandHandle,\n  ProviderCommandStartOutcomeUnknownError,\n  ProviderCommandInputOutcomeUnknownError,\n} from \"../provider-command-session\";\nimport type { ModalCommandControl, ModalProviderCommand } from \"./modal-command-control\";\nimport { MODAL_ROUTER_READ_MAX_WAIT_MS } from \"./modal-command-router-wire\";\nimport { verifyModalMaterializedPath } from \"./modal-materialization-verification\";\n\ntype Entry = {\n  command: ModalProviderCommand;\n  persistence?: ProviderCommandPersistence;\n};\n\nfunction sameExecution(a: ModalProviderCommand, b: ModalProviderCommand): boolean {\n  return (\n    a.kind === b.kind &&\n    a.sandboxId === b.sandboxId &&\n    a.taskId === b.taskId &&\n    a.execId === b.execId &&\n    isDeepStrictEqual(\n      \"supervision\" in a ? a.supervision : undefined,\n      \"supervision\" in b ? b.supervision : undefined,\n    ) &&\n    Boolean(a.pty) === Boolean(b.pty)\n  );\n}\n\nconst SLICE_PAUSE_MS = 25;\n\n/** True when a router page moved neither output cursor: nothing was read. */\nfunction unchangedCursor(page: ProviderCommandOutput): boolean {\n  const { command, expected } = page;\n  return (\n    command.kind === \"modal-router-v1\" &&\n    expected?.kind === \"modal-router-v1\" &&\n    command.streams.stdout.byteOffset === expected.streams.stdout.byteOffset &&\n    command.streams.stderr.byteOffset === expected.streams.stderr.byteOffset &&\n    command.streams.stdout.utf8Remainder === expected.streams.stdout.utf8Remainder &&\n    command.streams.stderr.utf8Remainder === expected.streams.stderr.utf8Remainder\n  );\n}\n\n/** Bridges the SDK's numeric/banner surface to provider-owned execution\n * locators. The local maps are only caches: a fresh adapter can adopt the same\n * handle from protected persistence and replay any unacknowledged page. */\nexport function installModalCommandSession(\n  session: ProviderCommandSession & {\n    execCommand?: ChannelASession[\"execCommand\"];\n    writeStdin?: ChannelASession[\"writeStdin\"];\n    verifyMaterializedPath?: (path: string, workdir: string) => Promise<void>;\n    verifyExecReadiness?: (signal: AbortSignal) => Promise<number>;\n  },\n  control: Pick<ModalCommandControl, \"start\" | \"read\" | \"readProbe\" | \"write\"> &\n    Partial<\n      Pick<\n        ModalCommandControl,\n        \"supervisionControl\" | \"verifySupervisionCapability\" | \"verifyExecReadiness\"\n      >\n    >,\n): void {\n  markTypedExecHandleLoss(session);\n  const originalExec = session.execCommand?.bind(session);\n  const originalWrite = session.writeStdin?.bind(session);\n  const cancelLegacyStart = session.cancelPendingExecCommand?.bind(session);\n  const pendingStarts = new Set<AbortController>();\n  if (control.verifyExecReadiness) {\n    const verify = control.verifyExecReadiness.bind(control);\n    session.verifyExecReadiness = async (signal: AbortSignal) => {\n      const cancellation = new AbortController();\n      const abort = () => cancellation.abort(signal.reason);\n      signal.addEventListener(\"abort\", abort, { once: true });\n      if (signal.aborted) abort();\n      pendingStarts.add(cancellation);\n      try {\n        const exit = await verify(cancellation.signal);\n        cancellation.signal.throwIfAborted();\n        return exit;\n      } finally {\n        signal.removeEventListener(\"abort\", abort);\n        pendingStarts.delete(cancellation);\n      }\n    };\n  }\n  session.verifyCommandSupervisionCapability = async () => {\n    if (!control.verifySupervisionCapability)\n      throw new Error(\"Modal instance lacks supervised command capability verification\");\n    return await control.verifySupervisionCapability();\n  };\n  session.verifyMaterializedPath = (path, workdir) =>\n    verifyModalMaterializedPath(control, path, workdir, pendingStarts);\n  const entries = new Map<number, Entry>();\n  // Current SDK setup commands are not retained/admitted commands. Give their\n  // live observer handles a disjoint, adapter-local range; never use a missing\n  // retained alias as permission to poll an unrelated SDK process with that id.\n  const setupHandles = new Map<number, number>();\n  let nextSetupHandle = MAX_PROVIDER_COMMAND_HANDLE + 1;\n  const receipts = new Map<string, { handle: number; page: ProviderCommandOutput }>();\n  const atomicallyCaptured = new WeakSet<ProviderCommandOutput>();\n\n  const supervise = async (entry: Entry, release = false): Promise<void> => {\n    if (entry.command.kind !== \"modal-router-v1\" || !entry.command.supervision) return;\n    const persistence = entry.persistence;\n    if (\n      !persistence?.recordSupervisionReceipt ||\n      !persistence.loadSupervisionReceipt ||\n      !persistence.cancellationRequested ||\n      !control.supervisionControl\n    )\n      throw new Error(\"Supervised command requires durable control persistence\");\n    let receipt = await persistence.loadSupervisionReceipt();\n    if (!receipt) {\n      const action = (await persistence.cancellationRequested())\n        ? \"cancel\"\n        : release\n          ? \"release\"\n          : \"status\";\n      const observation = await control.supervisionControl(entry.command, action);\n      receipt = observation.receipt ?? null;\n      if (receipt) await persistence.recordSupervisionReceipt(receipt);\n    }\n    if (receipt) {\n      // Lost ACK responses are safe to retry. A dead control socket is not\n      // terminal proof: the subsequent authenticated provider read still must\n      // prove exit and commit every output byte.\n      await control\n        .supervisionControl(entry.command, \"ack\", receipt.receiptId)\n        .catch(() => undefined);\n    }\n  };\n\n  const captureRouterPage = async (entry: Entry, page: ProviderCommandOutput): Promise<boolean> => {\n    if (\n      page.command.kind !== \"modal-router-v1\" ||\n      !page.expected ||\n      !entry.persistence?.captureRouterPage\n    )\n      throw new Error(\"Modal byte-offset output requires atomic retained capture\");\n    const result = await entry.persistence.captureRouterPage({\n      expected: page.expected,\n      command: page.command,\n      stdout: page.chunks\n        .filter((chunk) => chunk.stream === \"stdout\")\n        .map((chunk) => chunk.text)\n        .join(\"\"),\n      stderr: page.chunks\n        .filter((chunk) => chunk.stream === \"stderr\")\n        .map((chunk) => chunk.text)\n        .join(\"\"),\n    });\n    if (!sameExecution(entry.command, result.command))\n      throw new Error(\"Modal output capture changed execution identity\");\n    entry.command = result.command;\n    if (result.captured) atomicallyCaptured.add(page);\n    return result.captured;\n  };\n\n  const setupPage = (raw: string, handle: number, sdkHandle: number): string => {\n    const banner = parseExecResponseBanner(raw);\n    if (banner.kind === \"exited\") {\n      setupHandles.delete(handle);\n      return raw;\n    }\n    if (banner.kind !== \"running\" || banner.sessionId !== sdkHandle)\n      throw new ModalProcessObservationUnavailableError(handle);\n    // The parser validated the unique status in the metadata header, before\n    // command-controlled Output. Replace only that first trusted status line.\n    const aliased = raw.replace(\n      /^Process running with session ID \\d+(?=\\r?$)/mu,\n      `Process running with session ID ${handle}`,\n    );\n    aliasNativeSynchronousCommandOutput(session, raw, aliased, handle);\n    return aliased;\n  };\n\n  const formatPage = (\n    handle: number,\n    page: ProviderCommandOutput,\n    maxOutputTokens?: number,\n  ): string => {\n    const result = [\n      `Provider output receipt: ${randomUUID()}`,\n      page.exitCode === null\n        ? `Process running with session ID ${handle}`\n        : `Process exited with code ${page.exitCode}`,\n      \"Output:\",\n      truncateOutput(page.chunks.map((chunk) => chunk.text).join(\"\"), maxOutputTokens).text,\n    ].join(\"\\n\");\n    if (page.exitCode === null || entries.get(handle)?.persistence) {\n      receipts.set(result, { handle, page });\n    } else {\n      retainSynchronousTerminalProviderPage(session, result, page);\n      entries.delete(handle);\n    }\n    return result;\n  };\n  const read = async (\n    handle: number,\n    entry: Entry,\n    yieldTimeMs: number,\n    maxOutputTokens?: number,\n    signal?: AbortSignal,\n  ): Promise<string> => {\n    if (entry.persistence) {\n      const retained = await entry.persistence.load();\n      if (!retained || !sameExecution(entry.command, retained))\n        throw new Error(\"Original Modal command identity is unavailable\");\n      entry.command = retained;\n      // Output observation stays available when control/proof persistence is\n      // unavailable. Terminal exposure below remains fenced by durable proof.\n      await supervise(entry).catch(() => undefined);\n    }\n    // One provider read waits at most MODAL_ROUTER_READ_MAX_WAIT_MS. Honor a\n    // longer requested wait (a large upload, for example) with further reads\n    // while the command is still running and has produced nothing new.\n    const deadline = performance.now() + yieldTimeMs;\n    const readSlice = () =>\n      control.read(\n        entry.command,\n        Math.min(\n          MODAL_ROUTER_READ_MAX_WAIT_MS,\n          Math.max(0, Math.ceil(deadline - performance.now())),\n        ),\n        signal,\n      );\n    let page: ProviderCommandOutput;\n    while (true) {\n      page = await readSlice();\n      if (entry.persistence && page.command.kind === \"modal-router-v1\") {\n        // A stale concurrent observer must reread from the committed cursor before\n        // exposing a terminal receipt; its uncommitted tail is not settlement proof.\n        let captured = false;\n        for (let attempt = 0; attempt < 3; attempt++) {\n          if (await captureRouterPage(entry, page)) {\n            captured = true;\n            break;\n          }\n          if (attempt < 2) page = await readSlice();\n        }\n        if (!captured)\n          throw new Error(\"Modal command output cursor changed during bounded capture\");\n      }\n      if (\n        page.exitCode !== null ||\n        page.chunks.length > 0 ||\n        !unchangedCursor(page) ||\n        deadline - performance.now() <= SLICE_PAUSE_MS\n      )\n        break;\n      // A read normally blocks for its slice; avoid a hot loop if one returns\n      // early without output (for example EOF seen before exit evidence).\n      await new Promise((resolve) => setTimeout(resolve, SLICE_PAUSE_MS));\n    }\n    if (page.command.kind === \"modal-router-v1\" && page.command.supervision) {\n      const receipt = await entry.persistence?.loadSupervisionReceipt?.();\n      // The supervisor exits 0 after ACK; that is provider terminal evidence,\n      // not the original shell result. Retain both without conflating them.\n      page = { ...page, exitCode: receipt && page.exitCode === 0 ? receipt.leaderExitCode : null };\n    }\n    // The receipt is generated here, not parsed from command output. Its only\n    // purpose is correlating this return value with a trusted in-memory page.\n    return formatPage(handle, page, maxOutputTokens);\n  };\n\n  session.execCommand = async (args) => {\n    const handle = admittedProviderCommandHandle();\n    // Setup/readiness may yield too. Retain only its original local observer,\n    // without publishing a durable locator or replaying its command.\n    if (handle === undefined) {\n      if (!originalExec) throw new Error(\"Modal command requires mutation admission\");\n      if (!Number.isSafeInteger(nextSetupHandle)) throw new Error(\"Modal setup handles exhausted\");\n      const setupHandle = nextSetupHandle++;\n      const raw = await originalExec(args);\n      const banner = parseExecResponseBanner(raw);\n      if (banner.kind !== \"running\") return raw;\n      setupHandles.set(setupHandle, banner.sessionId);\n      return setupPage(raw, setupHandle, banner.sessionId);\n    }\n    if (entries.has(handle)) throw new Error(\"Modal command handle is already bound\");\n    const cancellation = new AbortController();\n    pendingStarts.add(cancellation);\n    try {\n      const command = await control.start(args, cancellation.signal);\n      // Pre-dispatch reservation can already bind protected persistence.\n      const entry = entries.get(handle) ?? { command };\n      if (!sameExecution(entry.command, command))\n        throw new Error(\"Reserved Modal command changed during dispatch\");\n      entries.set(handle, entry);\n      if (entry.command.kind === \"modal-router-v1\" && entry.command.supervision) {\n        // The launch cannot run user code until the routing layer commits\n        // initial retention and calls releaseSupervisedCommand.\n        return formatPage(handle, { command: entry.command, chunks: [], exitCode: null });\n      }\n      try {\n        return await read(\n          handle,\n          entry,\n          args.yieldTimeMs ?? 10000,\n          args.maxOutputTokens,\n          cancellation.signal,\n        );\n      } catch {\n        // Start succeeded. A failed/cancelled first observation must still\n        // publish the known locator for durable retention and exact cleanup.\n        return formatPage(handle, {\n          command: entry.command,\n          chunks: [],\n          exitCode: null,\n        });\n      }\n    } catch (error) {\n      if (error instanceof ProviderCommandStartOutcomeUnknownError) {\n        const entry = entries.get(handle);\n        if (entry && !sameExecution(entry.command, error.command))\n          throw new Error(\"Reserved Modal command changed during failed dispatch\", {\n            cause: error,\n          });\n        entries.set(handle, entry ?? { command: error.command });\n      }\n      throw error;\n    } finally {\n      pendingStarts.delete(cancellation);\n    }\n  };\n\n  session.cancelPendingExecCommand = async () => {\n    for (const start of pendingStarts)\n      start.abort(\n        new Error(\"Modal command start observation cancelled; provider outcome is unknown\"),\n      );\n    // SDK-internal foreground commands retain their separate legacy transport\n    // cancellation. Neither path closes an already-yielded command's locator.\n    await cancelLegacyStart?.();\n  };\n\n  session.getProviderCommand = (handle) => {\n    const entry = entries.get(handle);\n    return entry ? structuredClone(entry.command) : null;\n  };\n  session.releaseSupervisedCommand = async (handle) => {\n    const entry = entries.get(handle);\n    if (!entry || entry.command.kind !== \"modal-router-v1\" || !entry.command.supervision) return;\n    const retained = await entry.persistence?.load();\n    if (!retained || !sameExecution(entry.command, retained))\n      throw new Error(\"Supervisor release requires committed initial retention\");\n    entry.command = retained;\n    await supervise(entry, true);\n  };\n  session.cancelSupervisedCommand = async (handle, reason) => {\n    const entry = entries.get(handle);\n    if (!entry || entry.command.kind !== \"modal-router-v1\" || !entry.command.supervision)\n      return false;\n    if (!entry.persistence?.requestCancellation)\n      throw new Error(\"Supervisor cancellation requires durable intent\");\n    await entry.persistence.requestCancellation(reason);\n    await supervise(entry);\n    return true;\n  };\n  session.bindProviderCommand = (handle, command, persistence) => {\n    if (!Number.isSafeInteger(handle) || handle <= 0 || handle > MAX_PROVIDER_COMMAND_HANDLE)\n      throw new Error(\"Invalid retained Modal command handle\");\n    const existing = entries.get(handle);\n    if (existing && !sameExecution(existing.command, command))\n      throw new Error(\"Modal command handle cannot be rebound to another execution\");\n    entries.set(handle, { command: structuredClone(command), persistence });\n  };\n  session.getProviderCommandOutput = (result) =>\n    typeof result === \"string\"\n      ? (receipts.get(result)?.page ?? synchronousTerminalProviderPage(session, result))\n      : null;\n  session.captureCommandOutput = async (result) => {\n    const receipt = receipts.get(result);\n    if (!receipt) return false;\n    if (\n      !receipt.page.expected &&\n      receipt.page.exitCode === null &&\n      receipt.page.chunks.length === 0\n    ) {\n      // Both a supervised idle launch and an unavailable first observation\n      // carry identity only. Retention already owns this command; there are\n      // no observed bytes or terminal evidence to ACK.\n      receipts.delete(result);\n      return true;\n    }\n    if (atomicallyCaptured.has(receipt.page)) {\n      receipts.delete(result);\n      return true;\n    }\n    const entry = entries.get(receipt.handle);\n    if (!entry?.persistence?.captureRouterPage || !receipt.page.expected)\n      throw new Error(\"Modal byte-offset output requires atomic retained capture\");\n    if (!(await captureRouterPage(entry, receipt.page))) {\n      const target = receipt.page.command;\n      const covered = () =>\n        ([\"stdout\", \"stderr\"] as const).every((stream) => {\n          const current = entry.command.streams[stream];\n          const wanted = target.streams[stream];\n          return (\n            current.byteOffset >= wanted.byteOffset &&\n            (!wanted.eof || current.eof) &&\n            (wanted.exitCode === null || current.exitCode === wanted.exitCode)\n          );\n        });\n      for (let attempt = 0; !covered() && attempt < 3; attempt++) {\n        // Initial promotion can race reconciliation before background adoption.\n        // Re-read, never re-execute; only a committed cursor covering the original\n        // page makes that page's terminal proof eligible for settlement.\n        const refreshedReceipt = await read(receipt.handle, entry, 250);\n        const refreshed = receipts.get(refreshedReceipt);\n        if (refreshed && atomicallyCaptured.has(refreshed.page)) receipts.delete(refreshedReceipt);\n      }\n      if (!covered())\n        throw new Error(\"Initial Modal output tail remains uncommitted after bounded capture\");\n    }\n    receipts.delete(result);\n    return true;\n  };\n  session.writeStdin = async (args) => {\n    const sdkHandle = setupHandles.get(args.sessionId);\n    if (sdkHandle !== undefined && originalWrite) {\n      const raw = await originalWrite({ ...args, sessionId: sdkHandle });\n      return setupPage(raw, args.sessionId, sdkHandle);\n    }\n    const entry = entries.get(args.sessionId);\n    if (!entry?.persistence)\n      throw new ModalProcessObservationUnavailableError(args.sessionId, {\n        reason: \"missing_handle\",\n      });\n    if (args.chars) {\n      const retained = await entry.persistence.load();\n      if (!retained || !sameExecution(entry.command, retained))\n        throw new Error(\"Original Modal command identity is unavailable\");\n      const index = await entry.persistence.reserveInput(Buffer.byteLength(args.chars));\n      try {\n        await control.write(retained, args.chars, index);\n      } catch (error) {\n        // Native gRPC transport failure does not establish whether this reserved\n        // range reached stdin. Never resend it or recommend another input write.\n        if (\n          retained.kind === \"modal-router-v1\" &&\n          // Contain supported transport graphs, including mixed failures. This\n          // grants no read/write retry permission; the locator and byte range\n          // come only from the retained command and its one input reservation.\n          classifyProviderSandboxFailure(\"modal\", error).kind === \"transient_transport\"\n        )\n          throw new ProviderCommandInputOutcomeUnknownError(\n            retained,\n            index,\n            Buffer.byteLength(args.chars),\n            error,\n          );\n        throw error;\n      }\n    }\n    return read(args.sessionId, entry, args.yieldTimeMs ?? 250, args.maxOutputTokens, args.signal);\n  };\n}\n","/**\n * Provider sandbox failure classification.\n *\n * This is deliberately structural and fail-closed. DNS failures often contain\n * the word \"not found\" (`ENOTFOUND`) while gRPC status values are also used by\n * unrelated SDKs and command routers. A bare numeric status (including gRPC's\n * numeric 5) is therefore not enough to retire a provider instance. Only\n * authoritative, non-transient evidence may retire a provider instance and\n * license lease recovery.\n */\nexport type ProviderSandboxFailureKind = \"not_found\" | \"transient_transport\" | \"other\";\n\nexport type ProviderSandboxFailure = {\n  kind: ProviderSandboxFailureKind;\n  /** Bounded, non-secret diagnostic suitable for logs and lifecycle events. */\n  diagnostic: string;\n};\n\nconst GRPC_TRANSIENT = new Set([1, 2, 4, 13, 14]);\nconst TRANSIENT_CODES = new Set([\n  \"1\",\n  \"2\",\n  \"4\",\n  \"13\",\n  \"14\",\n  \"CANCELLED\",\n  \"UNKNOWN\",\n  \"DEADLINE_EXCEEDED\",\n  \"INTERNAL\",\n  \"UNAVAILABLE\",\n  \"ECONNRESET\",\n  \"ECONNREFUSED\",\n  \"ETIMEDOUT\",\n  \"EAI_AGAIN\",\n  \"ENOTFOUND\",\n]);\nconst NOT_FOUND_CODES = new Set([\"404\", \"NOT_FOUND\", \"RESOURCE_NOT_FOUND\", \"SANDBOX_NOT_FOUND\"]);\nconst SAFE_CODE = /^[A-Z0-9._:-]{1,64}$/;\n\ntype ErrorSignals = {\n  numbers: number[];\n  codes: string[];\n  messages: string[];\n  incomplete: boolean;\n};\n\nconst UNREADABLE_ERROR_SIGNAL = Symbol(\"unreadable-error-signal\");\n\nfunction safeRead(record: object, key: string): unknown {\n  try {\n    const descriptor = Object.getOwnPropertyDescriptor(record, key);\n    return descriptor\n      ? \"value\" in descriptor\n        ? descriptor.value\n        : UNREADABLE_ERROR_SIGNAL\n      : undefined;\n  } catch {\n    return UNREADABLE_ERROR_SIGNAL;\n  }\n}\n\nfunction collectSignals(value: unknown): ErrorSignals {\n  const out: ErrorSignals = { numbers: [], codes: [], messages: [], incomplete: false };\n  const seen = new Set<object>();\n  const read = (record: object, key: string): unknown => {\n    const signal = safeRead(record, key);\n    if (signal !== UNREADABLE_ERROR_SIGNAL) return signal;\n    out.incomplete = true;\n    return undefined;\n  };\n  const visit = (current: unknown, depth: number): void => {\n    if (current === null || current === undefined) return;\n    if (depth > 6 || seen.size >= 64) {\n      out.incomplete = true;\n      return;\n    }\n    if (typeof current === \"string\") {\n      if (current.length <= 512) out.messages.push(current);\n      return;\n    }\n    if (typeof current !== \"object\" || seen.has(current)) return;\n    seen.add(current);\n    for (const key of [\n      \"status\",\n      \"statusCode\",\n      \"httpStatus\",\n      \"httpStatusCode\",\n      \"responseStatus\",\n      \"errorCode\",\n      \"code\",\n    ]) {\n      const signal = read(current, key);\n      if (typeof signal === \"number\" && Number.isFinite(signal)) out.numbers.push(signal);\n      if (typeof signal === \"string\") {\n        const code = signal.trim().toUpperCase();\n        if (SAFE_CODE.test(code)) out.codes.push(code);\n      }\n    }\n    for (const key of [\"name\", \"message\", \"details\", \"cause\"]) {\n      const signal = read(current, key);\n      if (typeof signal === \"string\" && signal.length <= 512) out.messages.push(signal);\n      else visit(signal, depth + 1);\n    }\n    visit(read(current, \"response\"), depth + 1);\n    visit(read(current, \"error\"), depth + 1);\n    const errors = read(current, \"errors\");\n    if (errors !== undefined) {\n      if (!Array.isArray(errors) || !errors.length || errors.length > 16) out.incomplete = true;\n      else\n        for (let index = 0; index < errors.length; index++) {\n          const nested = read(errors, String(index));\n          if (!nested || typeof nested !== \"object\") out.incomplete = true;\n          visit(nested, depth + 1);\n        }\n    }\n  };\n  visit(value, 0);\n  return out;\n}\n\nfunction safeDiagnostic(signals: ErrorSignals): string {\n  const code = signals.codes.find(Boolean);\n  const numeric = signals.numbers.find((value) => Number.isFinite(value));\n  return [code ? `code=${code}` : \"\", numeric !== undefined ? `status=${numeric}` : \"\"]\n    .filter(Boolean)\n    .join(\" \");\n}\n\nfunction hasTransientSignal(signals: ErrorSignals): boolean {\n  return (\n    signals.codes.some((code) => TRANSIENT_CODES.has(code)) ||\n    signals.numbers.some((status) => GRPC_TRANSIENT.has(status))\n  );\n}\n\nfunction hasModalTerminalSandboxMessage(signals: ErrorSignals): boolean {\n  return signals.messages.some(\n    (message) =>\n      /^Modal sandbox [A-Za-z0-9_-]+ is no longer running\\.$/.test(message) ||\n      /^Modal sandbox [A-Za-z0-9_-]+ not found \\(has been terminated\\)$/.test(message),\n  );\n}\n\nfunction hasUnixLocalTerminalWorkspaceMessage(signals: ErrorSignals): boolean {\n  return signals.messages.includes(\n    \"UnixLocal sandbox workspace is unavailable and no local snapshot could be restored.\",\n  );\n}\n\nfunction hasDockerTerminalWorkspaceMessage(signals: ErrorSignals): boolean {\n  return signals.messages.includes(\n    \"Docker sandbox resources are unavailable and no local snapshot could be restored.\",\n  );\n}\n\nfunction hasCloudflareTerminalSandboxMessage(signals: ErrorSignals): boolean {\n  return signals.messages.some((message) =>\n    /^Cloudflare sandbox [A-Za-z0-9._:-]+ is no longer running\\.$/.test(message),\n  );\n}\n\n/** Typed transport evidence always dominates nested/string NotFound text. */\nexport function classifyProviderSandboxFailure(\n  backendId: string,\n  error: unknown,\n): ProviderSandboxFailure {\n  if (backendId === \"selfhosted\" || !error) {\n    return { kind: \"other\", diagnostic: \"selfhosted-or-empty\" };\n  }\n  const signals = collectSignals(error);\n  const diagnostic = safeDiagnostic(signals) || \"unclassified_provider_failure\";\n\n  if (hasTransientSignal(signals)) {\n    return { kind: \"transient_transport\", diagnostic };\n  }\n  if (signals.incomplete) return { kind: \"other\", diagnostic };\n  // A compute sandbox's operations are answered by its agent, whose not-found\n  // and offline replies concern files and connections, never the sandbox. Only\n  // the provider's own proof that the control service has no such sandbox counts.\n  if (backendId === \"compute\") {\n    return signals.codes.includes(\"SANDBOX_NOT_FOUND\")\n      ? { kind: \"not_found\", diagnostic }\n      : { kind: \"other\", diagnostic };\n  }\n  if (\n    signals.numbers.some((status) => status === 404) ||\n    signals.codes.some((code) => NOT_FOUND_CODES.has(code))\n  ) {\n    return { kind: \"not_found\", diagnostic };\n  }\n\n  // Modal's SDK emits these exact terminal grammars after resolving one exact\n  // sandbox id. Generic \"not found\" prose is intentionally not authoritative.\n  if (backendId === \"modal\" && hasModalTerminalSandboxMessage(signals)) {\n    return {\n      kind: \"not_found\",\n      diagnostic:\n        diagnostic === \"unclassified_provider_failure\"\n          ? \"modal_terminal_message\"\n          : `${diagnostic} modal_terminal_message`,\n    };\n  }\n\n  // Cloudflare's resume() performs its sandbox-scoped running probe itself and\n  // emits this exact UserError only after that probe returns false. It carries\n  // no HTTP/code field, so omitting the provider grammar would strand a dead\n  // lease in warm/draining forever. Arbitrary Cloudflare path 404s do not match.\n  if (backendId === \"cloudflare\" && hasCloudflareTerminalSandboxMessage(signals)) {\n    return {\n      kind: \"not_found\",\n      diagnostic:\n        diagnostic === \"unclassified_provider_failure\"\n          ? \"cloudflare_terminal_message\"\n          : `${diagnostic} cloudflare_terminal_message`,\n    };\n  }\n\n  // The SDK emits this exact UserError only after resolving one serialized\n  // unix_local session and proving that both its process-local workspace and\n  // its persisted fallback are absent. That is authoritative provider loss:\n  // on resume it licenses a fresh local workspace, and on drain it licenses\n  // the lease's provider-missing cold transition. Generic \"unavailable\" prose\n  // remains fail-closed.\n  if (\n    (backendId === \"local\" || backendId === \"unix_local\") &&\n    hasUnixLocalTerminalWorkspaceMessage(signals)\n  ) {\n    return {\n      kind: \"not_found\",\n      diagnostic:\n        diagnostic === \"unclassified_provider_failure\"\n          ? \"unix_local_workspace_missing\"\n          : `${diagnostic} unix_local_workspace_missing`,\n    };\n  }\n\n  // Docker's ordinary resume is used only by a durable same-workspace recovery\n  // owner. This exact SDK error is emitted after it has checked both the\n  // serialized container and its host workspace (plus any configured local\n  // snapshot) and proved that none can be resumed. Treating it as transient\n  // would preserve an unusable continuity receipt forever. Routed operations\n  // use the stricter discriminator below, so an arbitrary command error cannot\n  // retire a live container through this message rule.\n  if (backendId === \"docker\" && hasDockerTerminalWorkspaceMessage(signals)) {\n    return {\n      kind: \"not_found\",\n      diagnostic:\n        diagnostic === \"unclassified_provider_failure\"\n          ? \"docker_resources_missing\"\n          : `${diagnostic} docker_resources_missing`,\n    };\n  }\n\n  return { kind: \"other\", diagnostic };\n}\n\nexport function isProviderSandboxNotFoundError(backendId: string, error: unknown): boolean {\n  return classifyProviderSandboxFailure(backendId, error).kind === \"not_found\";\n}\n\n/**\n * Whether a failure from an operation routed through an already-established\n * sandbox proves that exact provider sandbox disappeared.\n *\n * Routed operations can legitimately return HTTP 404 / `NOT_FOUND` for paths,\n * files, ports, processes, and other subresources. Those generic signals are\n * sufficient for provider create/resume APIs, but they must never retire the\n * live sandbox identity after an arbitrary operation. Only an explicit\n * sandbox-scoped provider code or Modal's exact terminal sandbox grammar is\n * authoritative on this path. Transient transport evidence still dominates.\n */\nexport function isProviderSandboxGoneDuringRoutedOperation(\n  backendId: string,\n  error: unknown,\n): boolean {\n  if (backendId === \"selfhosted\" || !error) return false;\n  const signals = collectSignals(error);\n  if (hasTransientSignal(signals) || signals.incomplete) return false;\n  if (signals.codes.includes(\"SANDBOX_NOT_FOUND\")) return true;\n  return backendId === \"modal\" && hasModalTerminalSandboxMessage(signals);\n}\n\nexport function isProviderSandboxTransientError(backendId: string, error: unknown): boolean {\n  return classifyProviderSandboxFailure(backendId, error).kind === \"transient_transport\";\n}\n","import { isDeepStrictEqual } from \"node:util\";\nimport { setTimeout as delay } from \"node:timers/promises\";\nimport {\n  SandboxMaterializationVerificationError,\n  retainMaterializationVerificationDiagnostic,\n  type MaterializationVerificationDiagnostic,\n} from \"../materialization-verification-error\";\nimport type { ModalCommandControl, ModalProviderCommand } from \"./modal-command-control\";\nimport {\n  ProviderCommandObservationUnavailableError,\n  ProviderCommandStartOutcomeUnknownError,\n  type ProviderCommandOutput,\n} from \"../provider-command-session\";\nimport { errorMessage } from \"@opengeni/contracts/values\";\n\nconst MARKER = \"__OPENGENI_MATERIALIZED_PATH_VISIBLE__\";\nconst OUTPUT_LIMIT = 16 * 1024;\n\n/** A fixed read-only probe, not an admitted user command. Advance its private\n * provider cursor locally; never borrow the surrounding mutation's retained\n * handle or relax retained-command persistence requirements. The caller keeps\n * the original backend and provider-operation gate for the entire observation.\n */\nexport async function verifyModalMaterializedPath(\n  control: Pick<ModalCommandControl, \"start\" | \"readProbe\">,\n  path: string,\n  workdir: string,\n  pending: Set<AbortController>,\n  observationTimeoutMs = 30_000,\n): Promise<void> {\n  const quote = (value: string) => `'${value.replaceAll(\"'\", `'\"'\"'`)}'`;\n  const command = `test -e ${quote(path)} && printf %s ${quote(MARKER)}`;\n  const cancellation = new AbortController();\n  const deadlineReason = new Error(\"Materialization visibility observation deadline exceeded\");\n  let providerCommand: ModalProviderCommand | undefined;\n  let startUnknown: ProviderCommandStartOutcomeUnknownError | undefined;\n  let stdout = \"\";\n  let stderr = \"\";\n  const diagnostic = (\n    reason: MaterializationVerificationDiagnostic[\"reason\"],\n    exitCode: number | null = null,\n  ): MaterializationVerificationDiagnostic => ({\n    reason,\n    path,\n    workdir,\n    command,\n    output: (stdout + stderr).slice(0, OUTPUT_LIMIT),\n    exitCode,\n    providerSessionId: null,\n    ...(providerCommand\n      ? {\n          providerExecution: {\n            sandboxId: providerCommand.sandboxId,\n            taskId: providerCommand.taskId,\n            execId: providerCommand.execId,\n          },\n        }\n      : {}),\n  });\n  const timer = setTimeout(() => {\n    cancellation.abort(deadlineReason);\n  }, observationTimeoutMs);\n  timer.unref();\n  pending.add(cancellation);\n  try {\n    try {\n      providerCommand = await control.start(\n        { cmd: command, workdir, shell: \"sh\", login: false, tty: false },\n        cancellation.signal,\n      );\n    } catch (error) {\n      // A possibly dispatched fixed visibility probe has one original locator.\n      // Observe that invocation; never replay it or the surrounding mutation.\n      if (!(error instanceof ProviderCommandStartOutcomeUnknownError)) throw error;\n      providerCommand = structuredClone(error.command);\n      startUnknown = error;\n    }\n    for (;;) {\n      cancellation.signal.throwIfAborted();\n      let page: ProviderCommandOutput;\n      try {\n        page = await control.readProbe(providerCommand, 1_000, cancellation);\n      } catch (error) {\n        cancellation.signal.throwIfAborted();\n        if (\n          !(error instanceof ProviderCommandObservationUnavailableError) ||\n          !error.readRetryAllowed\n        ) {\n          if (!startUnknown) throw error;\n          // A missing/denied read cannot disprove the original Start. Preserve\n          // its exact invocation without granting any further read retry.\n          throw new ProviderCommandObservationUnavailableError(\n            structuredClone(providerCommand),\n            new AggregateError(\n              [startUnknown, error],\n              \"Original visibility Start and observation remain uncertain\",\n            ),\n            false,\n          );\n        }\n        // Unavailable reads do not advance any cursor. A contradictory locator\n        // is an invariant failure, never authority to inspect another process.\n        if (!isDeepStrictEqual(error.command, providerCommand))\n          throw new SandboxMaterializationVerificationError(diagnostic(\"invalid_response\"), {\n            cause: error,\n          });\n        // Read retries remain inside this probe's original thirty-second\n        // deadline, including outages longer than a single bounded read.\n        try {\n          await delay(100, undefined, { signal: cancellation.signal });\n        } catch (interrupted) {\n          cancellation.signal.throwIfAborted();\n          throw interrupted;\n        }\n        continue;\n      }\n      // Cancellation ends observation, not the process. Never accept a late\n      // success after the attempt requested cancellation.\n      cancellation.signal.throwIfAborted();\n      if (\n        page.command.sandboxId !== providerCommand.sandboxId ||\n        page.command.taskId !== providerCommand.taskId ||\n        page.command.execId !== providerCommand.execId\n      ) {\n        throw new SandboxMaterializationVerificationError(diagnostic(\"invalid_response\"));\n      }\n      providerCommand = page.command;\n      for (const chunk of page.chunks) {\n        if (chunk.stream === \"stdout\") stdout += chunk.text;\n        else stderr += chunk.text;\n      }\n      if (stdout.length + stderr.length > OUTPUT_LIMIT) {\n        throw new SandboxMaterializationVerificationError(diagnostic(\"invalid_response\"));\n      }\n      if (page.exitCode === null) {\n        // An empty provider page may return immediately. Yield to cancellation\n        // and the deadline instead of starving timers with resolved promises.\n        await new Promise<void>((resolve) => setImmediate(resolve));\n        continue;\n      }\n      if (page.exitCode === 0 && stdout === MARKER) return;\n      throw new SandboxMaterializationVerificationError(\n        diagnostic(\n          page.exitCode === 1\n            ? \"path_not_visible\"\n            : page.exitCode === 0\n              ? \"invalid_response\"\n              : \"command_failed\",\n          page.exitCode,\n        ),\n      );\n    }\n  } catch (error) {\n    if (cancellation.signal.reason === deadlineReason) {\n      throw new SandboxMaterializationVerificationError(\n        {\n          ...diagnostic(\"command_pending\"),\n          causeMessage: \"Observation deadline exceeded; provider process completion is unconfirmed\",\n        },\n        {\n          cause: providerCommand\n            ? new ProviderCommandObservationUnavailableError(\n                providerCommand,\n                startUnknown\n                  ? new AggregateError(\n                      [startUnknown, error],\n                      \"Original visibility Start and observation deadline remain uncertain\",\n                    )\n                  : error,\n              )\n            : error,\n        },\n      );\n    }\n    if (!(error instanceof SandboxMaterializationVerificationError)) {\n      retainMaterializationVerificationDiagnostic(error, {\n        ...diagnostic(\"command_error\"),\n        causeMessage: errorMessage(error),\n      });\n    }\n    throw error;\n  } finally {\n    cancellation.abort(new Error(\"Materialization visibility observation finished\"));\n    clearTimeout(timer);\n    pending.delete(cancellation);\n  }\n}\n","import { randomUUID, randomBytes } from \"node:crypto\";\nimport { posix } from \"node:path\";\nimport { status } from \"@grpc/grpc-js\";\nimport { setTimeout as delay } from \"node:timers/promises\";\nimport { modalCommandArgv } from \"./modal-command-argv\";\nimport {\n  SandboxProviderCommand,\n  CommandSupervisionReceipt,\n  ModalRouterProviderCommand,\n} from \"@opengeni/contracts\";\nimport type { ChannelAExecArgs } from \"../channel-a\";\nimport type { ProviderCommandOutput } from \"../provider-command-session\";\nimport {\n  admittedCommandSupervisionReady,\n  markPendingCommandSupervised,\n  reserveSupervisedLaunch,\n  ProviderCommandStartOutcomeUnknownError,\n  ProviderCommandObservationUnavailableError,\n} from \"../provider-command-session\";\nimport { isModalCommandObservationTransportError } from \"./modal-command-observation-errors\";\nimport { ModalCommandStartOutcomeUnknownError } from \"./modal-command-start-errors\";\nimport { classifyProviderSandboxFailure } from \"../provider-errors\";\nimport { commandControlPlane } from \"./modal-command-client\";\nimport {\n  MODAL_ROUTER_READ_MAX_WAIT_MS,\n  ModalCommandRouterWire,\n  ModalCommandStartPreDispatchUnavailableError,\n  ModalCommandStartRejectedError,\n  ModalCommandStartNotDispatchedError,\n} from \"./modal-command-router-wire\";\nimport { collectModalRawOutputPage, type ModalRawOutputPage } from \"./modal-command-raw-page\";\n\nexport { modalCommandAbortMiddleware } from \"./modal-command-client\";\nexport type ModalProviderCommand = SandboxProviderCommand;\nexport type ModalProviderOutputPage = ProviderCommandOutput;\n\ntype Client = Parameters<typeof commandControlPlane>[0];\ntype RouterEntry = {\n  router: ModalCommandRouterWire;\n  users: number;\n  refreshAt: number;\n  idle?: ReturnType<typeof setTimeout>;\n};\ntype RouterLookup = { controller: AbortController; waiters: number; settled: boolean };\n/** A post-EOF exit re-poll may finish this long after the read deadline. */\nconst REPOLL_GRACE_MS = 250;\ntype ControlObservation = { command: ModalRouterProviderCommand; output: string };\ntype SupervisionControlResult = {\n  state: \"idle\" | \"running\" | \"quiescent\";\n  receipt?: CommandSupervisionReceipt;\n};\ntype ControlHelper = ControlObservation & {\n  startPending: boolean;\n  startUnknown?: unknown;\n  inFlight?: Promise<SupervisionControlResult>;\n};\n\n/** New bytes, a newly reached EOF, or the terminal exit of fully read streams. */\nfunction observedProgress(\n  command: ModalRouterProviderCommand,\n  page: ReturnType<typeof collectModalRawOutputPage>,\n): boolean {\n  return (\n    page.output.exitCode !== null ||\n    ([\"stdout\", \"stderr\"] as const).some(\n      (stream) =>\n        page.raw.streams[stream].bytes.byteLength > 0 ||\n        (page.raw.streams[stream].eof && !command.streams[stream].eof),\n    )\n  );\n}\n\n/** Cancels this waiter, not the shared provider operation. The rejection\n * handler remains attached even when an uncooperative provider settles late. */\nfunction awaitRouterAccess<T>(pending: Promise<T>, signal?: AbortSignal): Promise<T> {\n  if (!signal) return pending;\n  signal.throwIfAborted();\n  return new Promise<T>((resolve, reject) => {\n    const abort = () => {\n      signal.removeEventListener(\"abort\", abort);\n      reject(signal.reason);\n    };\n    signal.addEventListener(\"abort\", abort, { once: true });\n    void pending.then(resolve, reject).finally(() => signal.removeEventListener(\"abort\", abort));\n  });\n}\n\n/** Modal's task command router answers an observation of an exec id it does\n * not hold with FAILED_PRECONDITION and this fixed detail prefix (live text:\n * \"Failed to poll exec process: exec not found. If the exec already completed,\n * its output and exit status were discarded; ...\"). Exact code + anchored\n * prefix only; other FAILED_PRECONDITION replies are not exec-state evidence. */\nconst MODAL_ROUTER_EXEC_NOT_FOUND_DETAILS =\n  /^Failed to (?:poll|read) exec [a-z ]*: exec not found\\b/;\n\nfunction isModalRouterExecNotFound(error: unknown): boolean {\n  if (!(error instanceof Error)) return false;\n  const record = error as Error & { code?: unknown; details?: unknown };\n  return (\n    record.code === status.FAILED_PRECONDITION &&\n    typeof record.details === \"string\" &&\n    MODAL_ROUTER_EXEC_NOT_FOUND_DETAILS.test(record.details)\n  );\n}\n\n/**\n * The fixed `/bin/true` readiness probe's exact exec identity is unknown to the\n * box's command router: its Start never registered (a lost or timed-out Start\n * reply) or the router lost its exec state. Either way the box has not proved\n * command readiness. This is NOT replay authority for the probe; the caller\n * discards the never-published box instead. The only retained cause is the\n * router's observation reply: an ambiguous probe Start is contained to that\n * discarded box and must not leak start-uncertainty into turn settlement.\n */\nexport class ModalExecReadinessProbeLostError extends Error {\n  readonly name = \"ModalExecReadinessProbeLostError\";\n\n  constructor(cause: Error) {\n    super(\"Modal command router no longer tracks the readiness probe exec\", { cause });\n  }\n}\n\n/** Commands use replayable task-router byte offsets. */\nexport class ModalCommandControl {\n  private readonly routers = new Map<string, Promise<RouterEntry>>();\n  private readonly routerLookups = new Map<Promise<RouterEntry>, RouterLookup>();\n  /** A Modal sandbox runs exactly one task for its lifetime, so its task id is\n   * fixed. Resolving it per command added a control-plane round trip to every\n   * Start. A failed Start retires the entry so the next one re-resolves. */\n  private readonly taskIds = new Map<string, Promise<string>>();\n  private readonly controlHelpers = new Map<string, ControlHelper>();\n  private readonly client: ReturnType<typeof commandControlPlane>;\n  private closed = false;\n\n  private constructor(\n    client: Client,\n    private readonly sandboxIdentity: string | (() => string),\n    private readonly root: string,\n    private readonly environment: Record<string, string> | (() => Record<string, string>),\n  ) {\n    this.client = commandControlPlane(client);\n  }\n\n  static forSandbox(\n    client: Client,\n    sandboxId: string | (() => string),\n    root: string,\n    environment: Record<string, string> | (() => Record<string, string>) = {},\n  ): ModalCommandControl {\n    if (client.version() !== \"0.9.0\")\n      throw new Error(\"Modal command control requires the verified 0.9.0 SDK contract\");\n    return new ModalCommandControl(client, sandboxId, root, environment);\n  }\n\n  private get sandboxId(): string {\n    return typeof this.sandboxIdentity === \"function\"\n      ? this.sandboxIdentity()\n      : this.sandboxIdentity;\n  }\n\n  private async withRouter<T>(\n    taskId: string,\n    signal: AbortSignal | undefined,\n    run: (router: ModalCommandRouterWire) => Promise<T>,\n  ): Promise<T> {\n    signal?.throwIfAborted();\n    if (this.closed) throw new Error(\"Modal command control is closed\");\n    let pending = this.routers.get(taskId);\n    const reused = Boolean(pending);\n    if (!pending) {\n      const lookup: RouterLookup = {\n        controller: new AbortController(),\n        waiters: 0,\n        settled: false,\n      };\n      pending = (async () => {\n        const access = await awaitRouterAccess(\n          this.client.taskGetCommandRouterAccess({ taskId }, { signal: lookup.controller.signal }),\n          lookup.controller.signal,\n        );\n        let refreshAt = Date.now() + 60_000;\n        try {\n          // Expiry only shortens cache lifetime; it never authenticates access.\n          const payload = JSON.parse(\n            Buffer.from(access.jwt.split(\".\")[1] ?? \"\", \"base64url\").toString(),\n          );\n          if (typeof payload.exp === \"number\" && Number.isFinite(payload.exp))\n            refreshAt = Math.min(refreshAt, payload.exp * 1000 - 15_000);\n        } catch {\n          /* Authentication remains the provider's responsibility. */\n        }\n        return { router: new ModalCommandRouterWire(access), users: 0, refreshAt };\n      })();\n      this.routers.set(taskId, pending);\n      this.routerLookups.set(pending, lookup);\n      const settled = () => {\n        lookup.settled = true;\n        this.routerLookups.delete(pending!);\n      };\n      void pending.then(settled, () => {\n        settled();\n        if (this.routers.get(taskId) === pending) this.routers.delete(taskId);\n      });\n    }\n    const lookup = this.routerLookups.get(pending);\n    if (lookup) lookup.waiters++;\n    let entry: RouterEntry;\n    try {\n      entry = await awaitRouterAccess(pending, signal);\n    } finally {\n      if (lookup && --lookup.waiters === 0 && !lookup.settled) {\n        // No interested callers remain. Never cancel a sibling's lookup, and\n        // retire only this exact promise if a replacement has already won.\n        if (this.routers.get(taskId) === pending) this.routers.delete(taskId);\n        lookup.controller.abort(new Error(\"Modal router access has no remaining waiters\"));\n      }\n    }\n    // Refresh credentials between operations, never close another active read.\n    if (reused && !entry.users && Date.now() > entry.refreshAt) {\n      // Another continuation may already have installed fresh access. Retire\n      // only the captured cache entry, then join its replacement rather than\n      // deleting or closing the newer transport.\n      if (this.routers.get(taskId) === pending) {\n        this.routers.delete(taskId);\n        clearTimeout(entry.idle);\n        entry.router.close();\n      }\n      return await this.withRouter(taskId, signal, run);\n    }\n    clearTimeout(entry.idle);\n    entry.users++;\n    try {\n      signal?.throwIfAborted();\n      return await run(entry.router);\n    } finally {\n      entry.users--;\n      if (!entry.users) {\n        entry.idle = setTimeout(() => {\n          if (this.routers.get(taskId) === pending && !entry.users) {\n            this.routers.delete(taskId);\n            entry.router.close();\n          }\n        }, 30_000);\n        entry.idle.unref?.();\n      }\n    }\n  }\n\n  async close(): Promise<void> {\n    this.closed = true;\n    this.taskIds.clear();\n    for (const lookup of this.routerLookups.values())\n      lookup.controller.abort(new Error(\"Modal command control is closed\"));\n    const entries = await Promise.allSettled(this.routers.values());\n    this.routers.clear();\n    for (const entry of entries)\n      if (entry.status === \"fulfilled\") {\n        clearTimeout(entry.value.idle);\n        entry.value.router.close();\n      }\n  }\n\n  /** Access lookup may retry safely, but once the callback enters the Start\n   * boundary only the wire's own dispatch proof can authorize recovery. */\n  private async withStartRouter<T>(\n    taskId: string,\n    signal: AbortSignal | undefined,\n    run: (router: ModalCommandRouterWire) => Promise<T>,\n  ): Promise<T> {\n    let entered = false;\n    try {\n      return await this.withRouter(taskId, signal, async (router) => {\n        entered = true;\n        return await run(router);\n      });\n    } catch (error) {\n      if (entered) throw error;\n      return await ModalCommandStartPreDispatchUnavailableError.beforeDispatch(async () => {\n        throw error;\n      }, signal);\n    }\n  }\n\n  async start(args: ChannelAExecArgs, signal?: AbortSignal): Promise<ModalRouterProviderCommand> {\n    signal?.throwIfAborted();\n    const supervised = admittedCommandSupervisionReady() && !args.tty && !args.runAs;\n    if (supervised) markPendingCommandSupervised();\n    const sandboxId = this.sandboxId;\n    const workdir = posix.resolve(this.root, args.workdir ?? this.root);\n    if (workdir !== this.root && !workdir.startsWith(`${this.root.replace(/\\/$/u, \"\")}/`))\n      throw new Error(\"Command workdir is outside the sandbox workspace\");\n    const taskLookup = this.startTaskId(sandboxId);\n    const taskId = await ModalCommandStartPreDispatchUnavailableError.beforeDispatch(\n      () => awaitRouterAccess(taskLookup, signal),\n      signal,\n    );\n    if (this.sandboxId !== sandboxId)\n      throw new Error(\"Modal sandbox changed during command preparation\");\n    try {\n      return await this.startOnTask(args, signal, supervised, sandboxId, workdir, taskId);\n    } catch (error) {\n      if (this.taskIds.get(sandboxId) === taskLookup) this.taskIds.delete(sandboxId);\n      throw error;\n    }\n  }\n\n  private startTaskId(sandboxId: string): Promise<string> {\n    let pending = this.taskIds.get(sandboxId);\n    if (pending) return pending;\n    // Shared by concurrent Starts, so it never inherits one caller's abort.\n    pending = (async () => {\n      const task = await this.client.sandboxGetTaskId(\n        { sandboxId },\n        { signal: AbortSignal.timeout(30_000) },\n      );\n      if (!task.taskId || task.taskResult) throw new Error(\"Modal command task is unavailable\");\n      return task.taskId;\n    })();\n    this.taskIds.set(sandboxId, pending);\n    void pending.catch(() => {\n      if (this.taskIds.get(sandboxId) === pending) this.taskIds.delete(sandboxId);\n    });\n    return pending;\n  }\n\n  private async startOnTask(\n    args: ChannelAExecArgs,\n    signal: AbortSignal | undefined,\n    supervised: boolean,\n    sandboxId: string,\n    workdir: string,\n    taskId: string,\n  ): Promise<ModalRouterProviderCommand> {\n    const execId = randomUUID();\n    // PTY and runAs retain their existing explicit unsupported supervision\n    // semantics. Never attach a fabricated descriptor to either path.\n    const invocationId = randomUUID();\n    const supervision = supervised\n      ? {\n          protocol: \"native-subreaper-v1\" as const,\n          invocationId,\n          nonce: randomBytes(32).toString(\"hex\"),\n          controlPath: `/tmp/opengeni-supervision/${invocationId}.sock`,\n        }\n      : undefined;\n    let commandArgs = modalCommandArgv(args);\n    const env = typeof this.environment === \"function\" ? this.environment() : this.environment;\n    if (supervision)\n      commandArgs = [\n        \"/usr/local/bin/opengeni-command-supervisor\",\n        \"launch\",\n        \"--invocation\",\n        supervision.invocationId,\n        \"--nonce\",\n        supervision.nonce,\n        \"--socket\",\n        supervision.controlPath,\n        \"--\",\n        ...commandArgs,\n      ];\n    const command: ModalRouterProviderCommand = {\n      kind: \"modal-router-v1\",\n      sandboxId,\n      taskId,\n      execId,\n      ...(args.tty ? { pty: true } : {}),\n      ...(supervision ? { supervision } : {}),\n      streams: {\n        stdout: { byteOffset: 0, utf8Remainder: \"\", eof: false, exitCode: null },\n        stderr: { byteOffset: 0, utf8Remainder: \"\", eof: false, exitCode: null },\n      },\n    };\n    if (supervision) await reserveSupervisedLaunch(command);\n    let startAttempted = false;\n    try {\n      await this.withStartRouter(taskId, signal, async (router) => {\n        startAttempted = true;\n        await router.start(\n          {\n            taskId,\n            execId,\n            commandArgs,\n            workdir,\n            env,\n            ...(args.tty\n              ? {\n                  ptyInfo: {\n                    enabled: true,\n                    winszRows: 24,\n                    winszCols: 80,\n                    envTerm: \"xterm\",\n                    ptyType: 1,\n                    noTerminateOnIdleStdin: true,\n                  },\n                }\n              : {}),\n          },\n          signal,\n        );\n      });\n    } catch (error) {\n      // A client-chosen router id remains the only possible invocation. Retain\n      // it even for PTY/runAs/unsupervised starts: a rejected acknowledgement\n      // does not prove that the provider rejected the launch.\n      if (\n        !startAttempted ||\n        error instanceof ModalCommandStartNotDispatchedError ||\n        error instanceof ModalCommandStartRejectedError ||\n        error instanceof ModalCommandStartPreDispatchUnavailableError\n      )\n        throw error;\n      throw new ProviderCommandStartOutcomeUnknownError(command, error);\n    }\n    return command;\n  }\n\n  /** Read-only, authenticated control execution on this exact instance. Never\n   * inferred from a fleet image selector or user command stdout. No cache: warm\n   * instances and route/task replacement must each pass before admission. */\n  async verifySupervisionCapability(): Promise<{ sandboxId: string; taskId: string }> {\n    const sandboxId = this.sandboxId;\n    const signal = AbortSignal.timeout(5_000);\n    const task = await ModalCommandStartPreDispatchUnavailableError.beforeDispatch(\n      () => this.client.sandboxGetTaskId({ sandboxId }, { signal }),\n      signal,\n    );\n    if (!task.taskId || task.taskResult) throw new Error(\"Modal command task is unavailable\");\n    await this.withStartRouter(task.taskId, signal, async (router) => {\n      const identity = { taskId: task.taskId!, execId: randomUUID() };\n      const observation: ControlObservation = {\n        command: {\n          kind: \"modal-router-v1\",\n          sandboxId,\n          ...identity,\n          streams: {\n            stdout: { byteOffset: 0, utf8Remainder: \"\", eof: false, exitCode: null },\n            stderr: { byteOffset: 0, utf8Remainder: \"\", eof: false, exitCode: null },\n          },\n        },\n        output: \"\",\n      };\n      let startUnknown: ModalCommandStartOutcomeUnknownError | undefined;\n      try {\n        await router.start(\n          {\n            ...identity,\n            commandArgs: [\"/usr/local/bin/opengeni-command-supervisor\", \"capabilities\"],\n            workdir: \"/tmp\",\n            env: {},\n          },\n          signal,\n        );\n      } catch (error) {\n        // A lost acknowledgement does not authorize another Start. This fixed\n        // read-only probe can still prove capability by observing its original\n        // invocation inside the same five-second budget.\n        if (!(error instanceof ModalCommandStartOutcomeUnknownError)) throw error;\n        if (error.taskId !== identity.taskId || error.execId !== identity.execId) throw error;\n        startUnknown = error;\n      }\n      let result: { output: string; exit: number };\n      try {\n        result = await this.readControlOutput(identity, 128, signal, observation);\n      } catch (error) {\n        if (!startUnknown) throw error;\n        // Missing/denied observation cannot erase a genuine unknown Start or\n        // turn it into sandbox-loss or replay authority.\n        throw new ProviderCommandObservationUnavailableError(\n          structuredClone(observation.command),\n          new AggregateError(\n            [startUnknown, error],\n            \"Original capability Start and observation remain uncertain\",\n          ),\n          error instanceof ProviderCommandObservationUnavailableError && error.readRetryAllowed,\n        );\n      }\n      signal.throwIfAborted();\n      const { output, exit } = result;\n      if (exit !== 0 || output !== \"native-subreaper-v1\")\n        throw new Error(\n          \"Exact Modal instance lacks compatible native supervision; command not admitted\",\n        );\n    });\n    if (sandboxId !== this.sandboxId)\n      throw new Error(\"Modal instance changed during supervision capability verification\");\n    return { sandboxId, taskId: task.taskId };\n  }\n\n  /** Fixed provider readiness probe. No shell, user environment, admission or\n   * SDK Start retries. Once Start may have been sent, only observe that exact\n   * invocation; DNS-shaped server replies never authorize another Start. */\n  async verifyExecReadiness(signal: AbortSignal): Promise<number> {\n    signal.throwIfAborted();\n    const sandboxId = this.sandboxId;\n    const task = await ModalCommandStartPreDispatchUnavailableError.beforeDispatch(\n      () => this.client.sandboxGetTaskId({ sandboxId }, { signal }),\n      signal,\n    );\n    if (!task.taskId || task.taskResult) throw new Error(\"Modal command task is unavailable\");\n    if (sandboxId !== this.sandboxId)\n      throw new Error(\"Modal sandbox changed during readiness preparation\");\n    const identity = { taskId: task.taskId, execId: randomUUID() };\n    const transientObservation = (error: unknown) =>\n      [status.UNAVAILABLE, status.DEADLINE_EXCEEDED].includes(\n        (error as { code?: number } | null)?.code ?? -1,\n      );\n    const pause = () => delay(100, undefined, { signal });\n    return await this.withStartRouter(task.taskId, signal, async (router) => {\n      for (;;) {\n        signal.throwIfAborted();\n        try {\n          await router.start(\n            { ...identity, commandArgs: [\"/bin/true\"], workdir: \"/tmp\", env: {} },\n            signal,\n          );\n          break;\n        } catch (error) {\n          signal.throwIfAborted();\n          if (error instanceof ModalCommandStartPreDispatchUnavailableError) {\n            await pause();\n            continue;\n          }\n          // A lost Start acknowledgement is not replay permission. The probe\n          // may already exist, so keep this identity even if observation later\n          // exhausts the caller's readiness budget.\n          if (\n            error instanceof ModalCommandStartRejectedError ||\n            error instanceof ModalCommandStartNotDispatchedError\n          )\n            throw error;\n          break;\n        }\n      }\n      const streams = {\n        stdout: { offset: 0, eof: false },\n        stderr: { offset: 0, eof: false },\n      };\n      for (;;) {\n        signal.throwIfAborted();\n        try {\n          for (const stream of [\"stdout\", \"stderr\"] as const) {\n            const cursor = streams[stream];\n            if (cursor.eof) continue;\n            const page = await router.read(identity, stream, cursor.offset, 1_000, signal);\n            cursor.offset += page.bytes.length;\n            cursor.eof = page.eof;\n          }\n          const exit = await router.poll(identity, signal);\n          signal.throwIfAborted();\n          if (exit !== null && streams.stdout.eof && streams.stderr.eof) return exit;\n        } catch (error) {\n          signal.throwIfAborted();\n          if (isModalRouterExecNotFound(error))\n            throw new ModalExecReadinessProbeLostError(error as Error);\n          if (!transientObservation(error)) throw error;\n        }\n        await pause();\n      }\n    });\n  }\n\n  /** Separate authenticated provider execution of the installed control helper.\n   * User command streams are never inspected for control evidence. */\n  async supervisionControl(\n    command: ModalRouterProviderCommand,\n    action: \"release\" | \"cancel\" | \"status\" | \"ack\",\n    receiptId?: string,\n  ): Promise<SupervisionControlResult> {\n    SandboxProviderCommand.parse(command);\n    const descriptor = command.supervision;\n    if (!descriptor || command.sandboxId !== this.sandboxId)\n      throw new Error(\"Supervised command identity is unavailable\");\n    const key = JSON.stringify([\n      command.sandboxId,\n      command.taskId,\n      command.execId,\n      descriptor.invocationId,\n      descriptor.nonce,\n      descriptor.controlPath,\n      action,\n      receiptId ?? null,\n    ]);\n    let helper = this.controlHelpers.get(key);\n    if (!helper) {\n      helper = {\n        startPending: true,\n        output: \"\",\n        command: {\n          kind: \"modal-router-v1\",\n          sandboxId: command.sandboxId,\n          taskId: command.taskId,\n          execId: randomUUID(),\n          streams: {\n            stdout: { byteOffset: 0, utf8Remainder: \"\", eof: false, exitCode: null },\n            stderr: { byteOffset: 0, utf8Remainder: \"\", eof: false, exitCode: null },\n          },\n        },\n      };\n      this.controlHelpers.set(key, helper);\n    }\n    const observation = helper;\n    const run = async (): Promise<SupervisionControlResult> => {\n      const signal = AbortSignal.timeout(5_000);\n      if (observation.startPending) {\n        try {\n          await this.withStartRouter(command.taskId, signal, async (router) => {\n            // Once the wire may dispatch, neither a failed acknowledgement nor\n            // a later drain may create another helper invocation.\n            observation.startPending = false;\n            await router.start(\n              {\n                taskId: observation.command.taskId,\n                execId: observation.command.execId,\n                commandArgs: [\n                  \"/usr/local/bin/opengeni-command-supervisor\",\n                  \"control\",\n                  \"--invocation\",\n                  descriptor.invocationId,\n                  \"--nonce\",\n                  descriptor.nonce,\n                  \"--socket\",\n                  descriptor.controlPath,\n                  \"--action\",\n                  action,\n                  ...(receiptId ? [\"--receipt\", receiptId] : []),\n                ],\n                workdir: \"/tmp\",\n                env: {},\n              },\n              signal,\n            );\n          });\n        } catch (error) {\n          if (\n            observation.startPending ||\n            error instanceof ModalCommandStartNotDispatchedError ||\n            error instanceof ModalCommandStartRejectedError ||\n            error instanceof ModalCommandStartPreDispatchUnavailableError\n          ) {\n            this.controlHelpers.delete(key);\n            throw error;\n          }\n          // Preserve the genuine original Start boundary. A later drain reads\n          // this same helper; it never repeats a possibly dispatched Start.\n          observation.startUnknown = error;\n          throw error;\n        }\n      }\n      let response: { output: string; exit: number };\n      try {\n        response = await this.readControlOutput(observation.command, 4096, signal, observation);\n      } catch (error) {\n        if (\n          observation.startUnknown !== undefined &&\n          error instanceof ProviderCommandObservationUnavailableError\n        )\n          throw new ProviderCommandObservationUnavailableError(\n            error.command,\n            new AggregateError(\n              [observation.startUnknown, error],\n              \"Original helper Start and observation remain uncertain\",\n            ),\n            error.readRetryAllowed,\n          );\n        throw error;\n      }\n      const { output, exit } = response;\n      // Only a complete authenticated helper response retires its private\n      // cursor/output cache. Uncertainty keeps the same action and UUID.\n      this.controlHelpers.delete(key);\n      if (exit !== 0) throw new Error(\"Supervisor control is unavailable\");\n      const result = JSON.parse(output);\n      if (!result || ![\"idle\", \"running\", \"quiescent\"].includes(result.state))\n        throw new Error(\"Invalid supervisor control response\");\n      if (result.receipt !== undefined) {\n        result.receipt = CommandSupervisionReceipt.parse(result.receipt);\n        if (result.receipt.invocationId !== descriptor.invocationId)\n          throw new Error(\"Supervisor receipt invocation mismatch\");\n      }\n      if ((result.state === \"quiescent\") !== Boolean(result.receipt))\n        throw new Error(\"Supervisor quiescence response lacks its receipt\");\n      return result;\n    };\n    observation.inFlight ??= run().finally(() => {\n      delete observation.inFlight;\n    });\n    return await observation.inFlight;\n  }\n\n  /** These fixed helpers already started once. Observe only their original\n   * invocation within the caller's existing five-second budget. */\n  private async readControlOutput(\n    identity: { taskId: string; execId: string },\n    limit: number,\n    signal: AbortSignal,\n    observation?: ControlObservation,\n  ): Promise<{ output: string; exit: number }> {\n    const state: ControlObservation = observation ?? {\n      command: {\n        kind: \"modal-router-v1\",\n        sandboxId: this.sandboxId,\n        ...identity,\n        streams: {\n          stdout: { byteOffset: 0, utf8Remainder: \"\", eof: false, exitCode: null },\n          stderr: { byteOffset: 0, utf8Remainder: \"\", eof: false, exitCode: null },\n        },\n      },\n      output: \"\",\n    };\n    for (;;) {\n      try {\n        signal.throwIfAborted();\n        const page = await this.read(state.command, 250, signal);\n        state.command = page.command as ModalRouterProviderCommand;\n        if (\n          state.command.streams.stdout.byteOffset + state.command.streams.stderr.byteOffset >\n          limit\n        )\n          throw new Error(\"Supervisor control response exceeds its bound\");\n        state.output += page.chunks\n          .filter((chunk) => chunk.stream === \"stdout\")\n          .map((chunk) => chunk.text)\n          .join(\"\");\n        if (page.exitCode !== null) return { output: state.output, exit: page.exitCode };\n      } catch (error) {\n        if (signal.aborted)\n          throw new ProviderCommandObservationUnavailableError(\n            structuredClone(state.command),\n            error,\n          );\n        if (\n          !(error instanceof ProviderCommandObservationUnavailableError) ||\n          !error.readRetryAllowed\n        )\n          throw error;\n      }\n      try {\n        await delay(100, undefined, { signal });\n      } catch (error) {\n        throw new ProviderCommandObservationUnavailableError(structuredClone(state.command), error);\n      }\n    }\n  }\n\n  async read(\n    command: ModalProviderCommand,\n    waitMs: number,\n    signal?: AbortSignal,\n  ): Promise<ModalProviderOutputPage> {\n    SandboxProviderCommand.parse(command);\n    if (command.sandboxId !== this.sandboxId)\n      throw new Error(\"Modal command does not belong to this sandbox\");\n    return (await this.readNative(command, waitMs, signal)).output;\n  }\n\n  /** Native capture plumbing only. Raw bytes are acquired by the same joined\n   * read/poll path as read(); no new command is admitted. */\n  async readRaw(\n    command: ModalRouterProviderCommand,\n    waitMs: number,\n    signal?: AbortSignal,\n  ): Promise<ModalRawOutputPage> {\n    return (await this.readNative(command, waitMs, signal)).raw;\n  }\n\n  private async readNative(\n    input: ModalRouterProviderCommand,\n    waitMs: number,\n    signal?: AbortSignal,\n  ): Promise<ReturnType<typeof collectModalRawOutputPage>> {\n    const command = structuredClone(ModalRouterProviderCommand.parse(input));\n    if (command.sandboxId !== this.sandboxId)\n      throw new Error(\"Modal command does not belong to this sandbox\");\n    if (!Number.isFinite(waitMs) || waitMs < 0 || waitMs > MODAL_ROUTER_READ_MAX_WAIT_MS)\n      throw new Error(\"Invalid Modal output read bounds\");\n    signal?.throwIfAborted();\n    const stdout = command.streams.stdout;\n    const stderr = command.streams.stderr;\n    if (\n      stdout.eof &&\n      stderr.eof &&\n      stdout.utf8Remainder === \"\" &&\n      stderr.utf8Remainder === \"\" &&\n      stdout.exitCode !== null &&\n      stdout.exitCode === stderr.exitCode\n    ) {\n      // Both complete streams and their matching terminal observation were\n      // already captured. An expired provider handle cannot revoke that exact\n      // evidence; the session still atomically verifies the retained cursor.\n      return collectModalRawOutputPage(\n        command,\n        {\n          stdout: { bytes: Buffer.alloc(0), eof: true },\n          stderr: { bytes: Buffer.alloc(0), eof: true },\n        },\n        { source: \"retained_terminal\", code: stdout.exitCode },\n      );\n    }\n    const budget = new AbortController();\n    const abort = () => budget.abort(signal?.reason);\n    signal?.addEventListener(\"abort\", abort, { once: true });\n    if (signal?.aborted) abort();\n    // The router deliberately ends a quiet stream at its read deadline with\n    // a partial page. Let that deadline settle before outer containment aborts\n    // the whole page, including bytes already read from the other stream.\n    // Caller cancellation still bounds this allowance independently.\n    const deadline = performance.now() + Math.max(1, waitMs);\n    const timeout = setTimeout(\n      () => budget.abort(new Error(\"Modal command read budget exhausted\")),\n      Math.max(1, waitMs) + 5_000,\n    );\n    let lastError: unknown;\n    try {\n      for (let attempt = 0; attempt < 5; attempt++) {\n        signal?.throwIfAborted();\n        if (attempt > 0 && performance.now() >= deadline) break;\n        let page: ReturnType<typeof collectModalRawOutputPage>;\n        try {\n          page = await this.readRouterPage(\n            command,\n            Math.min(Math.max(1, waitMs), Math.max(1, deadline - performance.now())),\n            budget.signal,\n            deadline,\n          );\n        } catch (error) {\n          signal?.throwIfAborted();\n          if (isModalRouterExecNotFound(error)) {\n            // The router has discarded this invocation's observation state.\n            // That is not proof its process group stopped, nor authority to\n            // replay Start. Keep the locator/cursors for ordinary retained\n            // ownership and lifecycle containment, without a hot read retry.\n            throw new ProviderCommandObservationUnavailableError(\n              structuredClone(command),\n              error,\n              false,\n            );\n          }\n          if (!budget.signal.aborted && !isModalCommandObservationTransportError(error)) {\n            // Containment is not retry permission. A structural provider fault\n            // dominates nested missing-handle prose, but mixed/unreadable\n            // graphs do not acquire the strict safe-read retry authority.\n            if (classifyProviderSandboxFailure(\"modal\", error).kind === \"transient_transport\")\n              throw new ProviderCommandObservationUnavailableError(\n                structuredClone(command),\n                error,\n                false,\n              );\n            throw error;\n          }\n          lastError = error;\n          if (budget.signal.aborted || performance.now() >= deadline || attempt === 4) break;\n          try {\n            await delay(Math.min(100, Math.max(1, deadline - performance.now())), undefined, {\n              signal: budget.signal,\n            });\n          } catch {\n            signal?.throwIfAborted();\n            break;\n          }\n          continue;\n        }\n        // A quiet page is the router's normal answer when a healthy stream has\n        // nothing new before its deadline. After this read already failed, a\n        // retry that merely reached the remaining (possibly tiny) deadline\n        // proves nothing about the stream: the client gives up before a slow\n        // provider can answer either way. Only new bytes, EOF or a terminal\n        // exit show recovery; otherwise the earlier failure remains this\n        // read's outcome.\n        if (lastError === undefined || observedProgress(command, page)) return page;\n        break;\n      }\n      throw new ProviderCommandObservationUnavailableError(structuredClone(command), lastError);\n    } finally {\n      clearTimeout(timeout);\n      signal?.removeEventListener(\"abort\", abort);\n    }\n  }\n\n  private async readRouterPage(\n    command: ModalRouterProviderCommand,\n    waitMs: number,\n    signal: AbortSignal,\n    deadline: number,\n  ): Promise<ReturnType<typeof collectModalRawOutputPage>> {\n    const cancellation = new AbortController();\n    const lookupCancellation = new AbortController();\n    const abort = () => {\n      cancellation.abort(signal.reason);\n      lookupCancellation.abort(signal.reason);\n    };\n    signal?.addEventListener(\"abort\", abort, { once: true });\n    if (signal?.aborted) abort();\n    const lookupTimeout = setTimeout(\n      () =>\n        lookupCancellation.abort(\n          new ProviderCommandObservationUnavailableError(\n            structuredClone(command),\n            new Error(\"Modal command read access budget exhausted\"),\n          ),\n        ),\n      Math.max(1, deadline - performance.now()),\n    );\n    try {\n      return await this.withRouter(command.taskId, lookupCancellation.signal, async (router) => {\n        clearTimeout(lookupTimeout);\n        lookupCancellation.signal.throwIfAborted();\n        signal.throwIfAborted();\n        if (performance.now() >= deadline)\n          throw new ProviderCommandObservationUnavailableError(\n            structuredClone(command),\n            new Error(\"Modal command read budget exhausted\"),\n          );\n        const remainingWait = Math.max(1, Math.min(waitMs, deadline - performance.now()));\n        const operations = [\n          ...([\"stdout\", \"stderr\"] as const).map(async (stream) =>\n            command.streams[stream].eof\n              ? { bytes: Buffer.alloc(0), eof: true }\n              : await router.read(\n                  command,\n                  stream,\n                  command.streams[stream].byteOffset,\n                  remainingWait,\n                  cancellation.signal,\n                ),\n          ),\n          router.poll(command, cancellation.signal),\n        ] as const;\n        const results = await Promise.allSettled(\n          operations.map((operation) =>\n            operation.catch((error) => {\n              cancellation.abort(error);\n              throw error;\n            }),\n          ),\n        );\n        const failed = results.find((result) => result.status === \"rejected\");\n        // Abort-induced sibling rejections may sort before the failing poll.\n        // Preserve the first actual provider fault rather than array order.\n        if (failed?.status === \"rejected\") throw cancellation.signal.reason ?? failed.reason;\n        const stdout = (results[0] as PromiseFulfilledResult<{ bytes: Buffer; eof: boolean }>)\n          .value;\n        const stderr = (results[1] as PromiseFulfilledResult<{ bytes: Buffer; eof: boolean }>)\n          .value;\n        let exit = (results[2] as PromiseFulfilledResult<number | null>).value;\n        if (exit === null && stdout.eof && stderr.eof)\n          exit = await this.pollAfterEof(router, command, cancellation.signal, deadline);\n        return collectModalRawOutputPage(\n          command,\n          { stdout, stderr },\n          { source: \"router_poll\", code: exit },\n        );\n      });\n    } finally {\n      clearTimeout(lookupTimeout);\n      signal?.removeEventListener(\"abort\", abort);\n    }\n  }\n\n  /** TaskExecPoll is a point-in-time status, issued concurrently with stream\n   * reads that may wait for EOF. A poll answered before the command exited\n   * reports \"running\" even when both streams then finish, and callers that\n   * read once (internal Channel-A commands) would treat a finished command as\n   * still running. After both streams reach EOF, poll again within this read's\n   * existing budget. EOF is not exit proof: a re-poll fault or an exhausted\n   * budget keeps the observed bytes and reports the exit as still unknown, and\n   * only caller cancellation propagates. Re-poll faults are deliberately not\n   * classified here; the next page's concurrent poll classifies the same\n   * provider state. Each re-poll is bounded by the read deadline so a slow\n   * poll cannot exhaust the outer budget and discard the page. */\n  private async pollAfterEof(\n    router: ModalCommandRouterWire,\n    command: ModalRouterProviderCommand,\n    signal: AbortSignal,\n    deadline: number,\n  ): Promise<number | null> {\n    let pause = 10;\n    for (;;) {\n      signal.throwIfAborted();\n      const budget = deadline - performance.now();\n      if (budget <= 0) return null;\n      let exit: number | null;\n      try {\n        exit = await router.poll(\n          command,\n          AbortSignal.any([signal, AbortSignal.timeout(Math.ceil(budget) + REPOLL_GRACE_MS)]),\n        );\n      } catch {\n        signal.throwIfAborted();\n        return null;\n      }\n      if (exit !== null) return exit;\n      const remaining = deadline - performance.now();\n      if (remaining <= 0) return null;\n      try {\n        await delay(Math.min(pause, remaining), undefined, { signal });\n      } catch {\n        signal.throwIfAborted();\n        return null;\n      }\n      pause = Math.min(pause * 2, 250);\n    }\n  }\n\n  async readProbe(\n    command: ModalProviderCommand,\n    waitMs: number,\n    cancellation: AbortController,\n  ): Promise<ModalProviderOutputPage> {\n    return await this.read(command, waitMs, cancellation.signal);\n  }\n\n  async write(command: ModalProviderCommand, chars: string, index: number): Promise<void> {\n    SandboxProviderCommand.parse(command);\n    if (command.sandboxId !== this.sandboxId)\n      throw new Error(\"Modal command does not belong to this sandbox\");\n    await this.withRouter(command.taskId, undefined, (router) =>\n      router.write(command, index, Buffer.from(chars)),\n    );\n  }\n}\n","import type { ChannelAExecArgs } from \"../channel-a\";\n\n/** Keep the command payload once in argv. Embedding it in each run-as branch\n * multiplies large lifecycle scripts past the provider's aggregate limit. */\nexport function modalCommandArgv(args: ChannelAExecArgs): string[] {\n  const command = [\n    args.shell ?? \"/bin/sh\",\n    args.shell && (args.login ?? true) ? \"-lc\" : \"-c\",\n    args.cmd,\n  ];\n  if (!args.runAs) return command;\n  return [\n    \"/bin/sh\",\n    \"-c\",\n    'user=$1; shift; if [ \"$(id -u)\" = \"$user\" ] || [ \"$(id -un 2>/dev/null)\" = \"$user\" ]; then exec \"$@\"; elif [ \"$(id -u)\" = 0 ]; then exec su -s /bin/sh -c \\'exec \"$@\"\\' -- \"$user\" sh \"$@\"; else exec sudo -n -u \"$user\" -- \"$@\"; fi',\n    \"opengeni-run-as\",\n    args.runAs,\n    ...command,\n  ];\n}\n","/** Only used inside a read-only provider RPC boundary. This is deliberately\n * not a Start classifier: remote DNS prose never proves non-dispatch. */\nexport function isModalCommandObservationTransportError(error: unknown): boolean {\n  const seen = new Map<object, boolean>();\n  let nodes = 0;\n  const own = (value: object, key: string): unknown => {\n    const descriptor = Object.getOwnPropertyDescriptor(value, key);\n    if (descriptor && !(\"value\" in descriptor)) throw new Error(\"Unreadable provider error graph\");\n    return descriptor && \"value\" in descriptor ? descriptor.value : undefined;\n  };\n  const visit = (value: unknown, depth: number): boolean => {\n    if (!value || typeof value !== \"object\" || depth > 6 || ++nodes > 32) return false;\n    if (seen.has(value)) return seen.get(value)!;\n    // A cycle sees false until this bounded branch has been fully evaluated.\n    seen.set(value, false);\n    try {\n      const code = own(value, \"code\");\n      const nested: unknown[] = [own(value, \"cause\"), own(value, \"error\")].filter(\n        (item) => item !== undefined,\n      );\n      const errors = own(value, \"errors\");\n      if (errors !== undefined) {\n        if (!Array.isArray(errors) || !errors.length || errors.length > 16) return false;\n        for (let index = 0; index < errors.length; index++) nested.push(own(errors, String(index)));\n      }\n      if (code !== undefined) {\n        const normalized = typeof code === \"string\" ? code.trim().toUpperCase() : code;\n        if (\n          ![\n            1,\n            2,\n            4,\n            13,\n            14,\n            \"1\",\n            \"2\",\n            \"4\",\n            \"13\",\n            \"14\",\n            \"CANCELLED\",\n            \"UNKNOWN\",\n            \"DEADLINE_EXCEEDED\",\n            \"INTERNAL\",\n            \"UNAVAILABLE\",\n            \"ECONNRESET\",\n            \"ECONNREFUSED\",\n            \"ETIMEDOUT\",\n            \"EAI_AGAIN\",\n            \"ENOTFOUND\",\n          ].includes(normalized as never)\n        )\n          return false;\n        const result = nested.length === 0 || nested.every((item) => visit(item, depth + 1));\n        seen.set(value, result);\n        return result;\n      }\n      const result = nested.length > 0 && nested.every((item) => visit(item, depth + 1));\n      seen.set(value, result);\n      return result;\n    } catch {\n      return false;\n    }\n  };\n  return visit(error, 0);\n}\n","import { ModalClient } from \"modal\";\n\ntype ControlPlane = Pick<\n  ModalClient[\"cpClient\"],\n  \"sandboxGetTaskId\" | \"taskGetCommandRouterAccess\"\n>;\n\ntype CommandClient = Pick<ModalClient, \"cpClient\" | \"version\"> &\n  Partial<Pick<ModalClient, \"profile\" | \"logger\">>;\ntype GrpcMiddleware = NonNullable<\n  NonNullable<ConstructorParameters<typeof ModalClient>[0]>[\"grpcMiddleware\"]\n>[number];\n/** This dedicated command client never retries a request behind the caller's\n * back and preserves the exact cancellation signal, including streaming RPCs. */\nexport const modalCommandAbortMiddleware: GrpcMiddleware = async function* (call, options) {\n  options.signal?.throwIfAborted();\n  return yield* call.next(call.request, options);\n};\n\n// Version-pinned compatibility boundary: 0.9.0's retryMiddleware drops signal\n// for streaming and retries=0. Its public custom middleware runs OUTSIDE that\n// branch, so cannot repair it. Override only this dedicated instance's factory\n// hook before construction; never mutate the SDK's global prototype or use\n// negative/fractional retry counts to manipulate its branch conditions.\ntype PublicModalClient = Pick<ModalClient, keyof ModalClient>;\nconst ModalClientBase: new (\n  options?: ConstructorParameters<typeof ModalClient>[0],\n) => PublicModalClient = ModalClient;\nclass ModalCommandClient extends ModalClientBase {\n  retryMiddleware(): GrpcMiddleware {\n    return modalCommandAbortMiddleware;\n  }\n}\nconst controlClients = new WeakMap<object, PublicModalClient>();\n\nexport function commandControlPlane(client: CommandClient): ControlPlane {\n  // Minimal injected control planes are used by deterministic unit tests.\n  // Production installation requires the authenticated SDK profile below.\n  if (!client.profile) return client.cpClient;\n  if (typeof Reflect.get(ModalClient.prototype, \"retryMiddleware\") !== \"function\")\n    throw new Error(\"Verified Modal command cancellation contract is unavailable\");\n  let controlled = controlClients.get(client);\n  if (!controlled) {\n    const profile = client.profile;\n    if (!profile.tokenId || !profile.tokenSecret)\n      throw new Error(\"Modal command control requires its original authenticated profile\");\n    controlled = new ModalCommandClient({\n      tokenId: profile.tokenId,\n      tokenSecret: profile.tokenSecret,\n      endpoint: profile.serverUrl,\n      environment: profile.environment ?? \"\",\n      ...(profile.maxThrottleWaitSecs !== undefined\n        ? { maxThrottleWaitSecs: profile.maxThrottleWaitSecs }\n        : {}),\n      ...(client.logger ? { logger: client.logger } : {}),\n    });\n    controlClients.set(client, controlled);\n  }\n  return controlled.cpClient;\n}\n","import {\n  ModalImageSelector,\n  ModalSandboxSession,\n  buildModalCloudBucketMountConfig,\n  isModalCloudBucketMountEntry,\n  type ModalSandboxClient,\n  type ModalSandboxClientOptions,\n  type ModalSandboxSessionState,\n} from \"@openai/agents-extensions/sandbox/modal\";\nimport {\n  Manifest,\n  isMount,\n  normalizeSandboxClientCreateArgs,\n  SandboxProviderError,\n  SandboxUnsupportedFeatureError,\n  type Entry,\n} from \"@openai/agents/sandbox\";\nimport {\n  assertHostPathGrantsRebound,\n  materializeEnvironment,\n  readOptionalString,\n} from \"@openai/agents-core/sandbox/internal\";\nimport { Sandbox, type CloudBucketMount, type Image, type ModalClient } from \"modal\";\nimport { createModalProviderCreateBoundary, type ModalCreateIntent } from \"./modal-create-boundary\";\nimport { modalCommandStartCleanupIsSafe } from \"./modal-command-start-errors\";\nimport {\n  cachedModalApp,\n  cachedModalImage,\n  sharedModalClient,\n  withModalCreateBoundary,\n} from \"./modal-shared-client\";\nimport { errorMessage } from \"@opengeni/contracts/values\";\n\n/** The shared process-wide client is never closed by one create. */\nconst SHARED_CLIENT_TRANSPORT: Pick<ModalClient, \"close\"> = { close() {} };\n\nexport type ModalCreateLifecycle = {\n  beforeDispatch: (intent: ModalCreateIntent, providerContext: unknown) => Promise<void>;\n  onCreated: (session: ModalSandboxSession, intent: ModalCreateIntent) => Promise<void>;\n};\n\n/** The pinned Agents adapter options plus Opengeni-owned physical-create\n * placement. `regions` is applied only by Opengeni's own create boundary; the\n * pinned adapter never sees or persists it, and resume keeps a box's placement. */\nexport type OpenGeniModalSandboxClientOptions = Partial<ModalSandboxClientOptions> & {\n  regions?: string[];\n};\n\n/** Release local transport after a failed create, but never stop a box whose\n * original setup invocation may still be writing behind its durable fence. */\nexport async function releaseModalCreateFailure(\n  session: Pick<ModalSandboxSession, \"close\"> | undefined,\n  modal: Pick<ModalClient, \"close\">,\n  error: unknown,\n): Promise<never> {\n  try {\n    if (session && modalCommandStartCleanupIsSafe(error)) {\n      try {\n        await session.close();\n      } catch (cleanupError) {\n        // eslint-disable-next-line preserve-caught-error -- Both failures remain exact AggregateError causes.\n        throw new AggregateError(\n          [error, cleanupError],\n          \"Modal create failed and cleanup needs reconciliation\",\n          { cause: cleanupError },\n        );\n      }\n    }\n  } finally {\n    modal.close();\n  }\n  throw error;\n}\n\nfunction defined<T extends object>(\n  value: T,\n): {\n  [K in keyof T]?: Exclude<T[K], undefined>;\n} {\n  return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined)) as {\n    [K in keyof T]?: Exclude<T[K], undefined>;\n  };\n}\n\nfunction unsupported(feature: string): never {\n  throw new SandboxUnsupportedFeatureError(`Modal create does not support ${feature}`, {\n    provider: \"modal\",\n    feature,\n  });\n}\n\nfunction validateManifest(manifest: Manifest): void {\n  if (manifest.users.length) unsupported(\"manifest.users\");\n  if (manifest.groups.length) unsupported(\"manifest.groups\");\n  if (manifest.extraPathGrants.length) unsupported(\"manifest.extraPathGrants\");\n  for (const { entry } of manifest.iterEntries()) {\n    if (entry.permissions !== undefined) unsupported(\"entry.permissions\");\n    if (entry.group !== undefined) unsupported(\"entry.group\");\n    if (isMount(entry) && !isModalCloudBucketMountEntry(entry)) unsupported(\"entry.mountStrategy\");\n  }\n}\n\nfunction withoutMounts(manifest: Manifest): Manifest {\n  const entries = (source: Record<string, Entry>): Record<string, Entry> =>\n    Object.fromEntries(\n      Object.entries(source)\n        .filter(([, entry]) => !isMount(entry))\n        .map(([path, entry]) => [\n          path,\n          entry.type === \"dir\" && entry.children\n            ? { ...structuredClone(entry), children: entries(entry.children) }\n            : structuredClone(entry),\n        ]),\n    );\n  return new Manifest({\n    version: manifest.version,\n    root: manifest.root,\n    entries: entries(manifest.entries),\n    environment: Object.fromEntries(\n      Object.entries(manifest.environment).map(([key, value]) => [key, value.init()]),\n    ),\n    users: structuredClone(manifest.users),\n    groups: structuredClone(manifest.groups),\n    extraPathGrants: structuredClone(manifest.extraPathGrants),\n    remoteMountCommandAllowlist: [...manifest.remoteMountCommandAllowlist],\n  });\n}\n\n/** Native Modal cloud-bucket mounts for a manifest, resolved on `modal`. */\nexport async function resolveModalCloudBucketMounts(\n  modal: ModalClient,\n  source: Manifest,\n  defaultSecretName: string | undefined,\n  /** Resume keeps the pinned adapter's behavior: ignore foreign mounts. */\n  foreignMounts: \"reject\" | \"skip\" = \"reject\",\n): Promise<Record<string, CloudBucketMount> | undefined> {\n  const result: Record<string, CloudBucketMount> = {};\n  for (const { entry, mountPath } of source.mountTargets()) {\n    if (!isModalCloudBucketMountEntry(entry)) {\n      if (foreignMounts === \"skip\") continue;\n      unsupported(\"entry.mountStrategy\");\n    }\n    const config = buildModalCloudBucketMountConfig(\n      entry,\n      defined({\n        secretName: readOptionalString(entry.mountStrategy, \"secretName\") ?? defaultSecretName,\n        secretEnvironmentName: readOptionalString(entry.mountStrategy, \"secretEnvironmentName\"),\n      }),\n    );\n    const secret = config.secretName\n      ? await modal.secrets.fromName(\n          config.secretName,\n          defined({\n            environment: config.secretEnvironmentName,\n          }),\n        )\n      : config.credentials\n        ? await modal.secrets.fromObject(config.credentials)\n        : undefined;\n    result[mountPath] = modal.cloudBucketMounts.create(\n      config.bucketName,\n      defined({\n        bucketEndpointUrl: config.bucketEndpointUrl,\n        keyPrefix: config.keyPrefix,\n        readOnly: config.readOnly,\n        secret,\n      }),\n    );\n  }\n  return Object.keys(result).length ? result : undefined;\n}\n\n/** Own physical creation while retaining the pinned SDK's public session API.\n * Its ordinary create() applies the manifest before exposing the instance ID,\n * which is too late for a durable worker lease. No global SDK monkey-patching.\n */\nexport async function createModalSessionWithLifecycle(\n  defaults: OpenGeniModalSandboxClientOptions,\n  args: Parameters<ModalSandboxClient[\"create\"]>[0],\n  lifecycle: ModalCreateLifecycle,\n  installPolicy: (session: ModalSandboxSession) => ModalSandboxSession,\n): Promise<ModalSandboxSession> {\n  const create = normalizeSandboxClientCreateArgs(args);\n  if (create.snapshot !== undefined) unsupported(\"snapshot\");\n  const overrides = create.options as OpenGeniModalSandboxClientOptions | undefined;\n  const options = { ...defaults };\n  for (const [key, value] of Object.entries(overrides ?? {})) {\n    if (value !== null && value !== undefined) Object.assign(options, { [key]: value });\n  }\n  options.env = { ...defaults.env, ...overrides?.env };\n  if (options.sandbox) unsupported(\"existing sandbox selector in physical create\");\n  if (!options.appName?.trim()) throw new Error(\"Modal create requires a non-empty appName\");\n  if (\n    options.nativeCloudBucketSecretName !== undefined &&\n    !options.nativeCloudBucketSecretName.trim()\n  ) {\n    throw new Error(\"Modal nativeCloudBucketSecretName must be non-empty\");\n  }\n  const workspacePersistence = options.workspacePersistence ?? \"tar\";\n  if (![\"tar\", \"snapshot_filesystem\", \"snapshot_directory\"].includes(workspacePersistence))\n    unsupported(\"workspacePersistence\");\n  for (const key of [\n    \"sandboxCreateTimeoutS\",\n    \"snapshotFilesystemTimeoutMs\",\n    \"snapshotFilesystemRestoreTimeoutMs\",\n    \"timeoutMs\",\n    \"idleTimeoutMs\",\n    \"cpu\",\n    \"memoryMiB\",\n  ] as const) {\n    const value = options[key];\n    if (value !== undefined && (!Number.isFinite(value) || value <= 0))\n      throw new Error(`Modal ${key} must be positive`);\n  }\n  if (\n    options.regions !== undefined &&\n    (!Array.isArray(options.regions) ||\n      options.regions.length === 0 ||\n      options.regions.some((region) => typeof region !== \"string\" || !region.trim()))\n  ) {\n    throw new Error(\"Modal regions must be a non-empty list of region names\");\n  }\n  const manifest = create.manifest;\n  validateManifest(manifest);\n  // Validate mount configuration before any provider resource is requested.\n  for (const { entry } of manifest.mountTargets()) {\n    buildModalCloudBucketMountConfig(\n      entry,\n      defined({\n        secretName:\n          readOptionalString(entry.mountStrategy, \"secretName\") ??\n          options.nativeCloudBucketSecretName,\n        secretEnvironmentName: readOptionalString(entry.mountStrategy, \"secretEnvironmentName\"),\n      }),\n    );\n  }\n  let session: ModalSandboxSession | undefined;\n  let timedOut = false;\n  let cloudBucketMounts: Record<string, CloudBucketMount> | undefined;\n  let state: Omit<ModalSandboxSessionState, \"sandboxId\">;\n  let app: Awaited<ReturnType<ModalClient[\"apps\"][\"fromName\"]>>;\n  const modal = sharedModalClient(\n    defined({\n      tokenId: options.tokenId,\n      tokenSecret: options.tokenSecret,\n      environment: options.environment,\n      endpoint: options.endpoint,\n      imageBuilderVersion: options.imageBuilderVersion,\n    }),\n  );\n  // Each attempted physical create keeps its own one-shot durable boundary;\n  // only this operation's SandboxCreate (inside withModalCreateBoundary) sees it.\n  const createBoundary = createModalProviderCreateBoundary({\n    operationId: crypto.randomUUID(),\n    beforeDispatch: async (intent) => {\n      if (timedOut) throw new Error(\"Modal create expired before provider dispatch\");\n      await lifecycle.beforeDispatch(intent, { modal });\n    },\n    onReceipt: async (receipt) => {\n      const constructorArgs = {\n        modal,\n        app,\n        sandbox: new Sandbox(modal, receipt.instanceId),\n        ownsSandbox: true,\n        state: { ...state, sandboxId: receipt.instanceId, imageId: receipt.imageId },\n        cloudBucketMounts,\n        cloudBucketMountsProvider: async () =>\n          await resolveMounts(session?.state.manifest ?? manifest),\n        concurrencyLimits: create.concurrencyLimits,\n        archiveLimits: create.archiveLimits,\n      };\n      // Agents Extensions 0.14.3's structural Modal types predate Modal 0.9's\n      // snapshot options. Runtime policy adapts that pinned interface.\n      session = installPolicy(\n        new ModalSandboxSession(\n          constructorArgs as unknown as ConstructorParameters<typeof ModalSandboxSession>[0],\n        ),\n      );\n      await lifecycle.onCreated(session, receipt);\n    },\n  });\n  const resolveMounts = async (source: Manifest) =>\n    await resolveModalCloudBucketMounts(modal, source, options.nativeCloudBucketSecretName);\n  try {\n    app = await cachedModalApp(\n      modal,\n      options.appName,\n      defined({\n        createIfMissing: true,\n        environment: options.environment,\n      }),\n    );\n    const environment = await materializeEnvironment(manifest, options.env);\n    const selector =\n      options.image ?? ModalImageSelector.fromTag(options.imageTag ?? \"debian:bookworm-slim\");\n    let image: Image;\n    if (selector.kind === \"image\") image = selector.value as Image;\n    else if (typeof selector.value !== \"string\" || !selector.value.trim())\n      throw new Error(\"Modal image identity must be non-empty\");\n    else if (selector.kind === \"id\" || selector.kind === \"tag\")\n      image = await cachedModalImage(modal, app, { kind: selector.kind, value: selector.value });\n    else throw new Error(\"Unsupported Modal image selector\");\n    if (typeof image?.build !== \"function\")\n      throw new Error(\"Modal image selector requires a native Image\");\n    cloudBucketMounts = await resolveMounts(manifest);\n    state = {\n      manifest,\n      ownsSandbox: true,\n      appName: options.appName,\n      imageTag:\n        selector.kind === \"tag\"\n          ? (selector.value as string)\n          : (options.imageTag ?? \"debian:bookworm-slim\"),\n      sandboxCreateTimeoutS: options.sandboxCreateTimeoutS,\n      workspacePersistence,\n      snapshotFilesystemTimeoutMs: options.snapshotFilesystemTimeoutMs,\n      snapshotFilesystemRestoreTimeoutMs: options.snapshotFilesystemRestoreTimeoutMs,\n      environment,\n      timeoutMs: options.timeoutMs,\n      idleTimeoutMs: options.idleTimeoutMs,\n      cpu: options.cpu,\n      memoryMiB: options.memoryMiB,\n      gpu: options.gpu,\n      configuredExposedPorts: options.exposedPorts,\n      modalEnvironment: options.environment,\n      endpoint: options.endpoint,\n      imageBuilderVersion: options.imageBuilderVersion,\n      nativeCloudBucketSecretName: options.nativeCloudBucketSecretName,\n      useSleepCmd: options.useSleepCmd ?? true,\n    };\n    // The boundary scope stays active until the provider call settles, so a\n    // late receipt after the local timeout is still persisted.\n    const physicalCreate = withModalCreateBoundary(createBoundary, () =>\n      modal.sandboxes.create(\n        app,\n        image,\n        defined({\n          workdir: manifest.root,\n          env: environment,\n          command: state.useSleepCmd ? [\"sleep\", \"infinity\"] : undefined,\n          timeoutMs: options.timeoutMs,\n          idleTimeoutMs: options.idleTimeoutMs,\n          cpu: options.cpu,\n          memoryMiB: options.memoryMiB,\n          gpu: options.gpu,\n          encryptedPorts: options.exposedPorts,\n          cloudBucketMounts,\n          regions: options.regions ? [...options.regions] : undefined,\n        }),\n      ),\n    );\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    try {\n      await (options.sandboxCreateTimeoutS === undefined\n        ? physicalCreate\n        : Promise.race([\n            physicalCreate,\n            new Promise<never>((_, reject) => {\n              timer = setTimeout(() => {\n                timedOut = true;\n                reject(\n                  new Error(\"Modal sandbox creation timed out; provider receipt remains fenced\"),\n                );\n              }, options.sandboxCreateTimeoutS! * 1000);\n            }),\n          ]));\n    } finally {\n      if (timer) clearTimeout(timer);\n      // A late callback still persists its ID. Cleanup cannot license another\n      // create until the durable lease has that identity and terminal proof.\n      if (timedOut)\n        void physicalCreate\n          .then(\n            async () => {\n              await session?.close();\n            },\n            async () => {\n              await session?.close();\n            },\n          )\n          .catch(() => {\n            modal.logger.warn(\n              \"Late Modal create cleanup failed; durable lease requires reconciliation\",\n            );\n          });\n    }\n    if (!session) throw new Error(\"Modal create bypassed the required physical receipt boundary\");\n    await session.applyManifest(withoutMounts(manifest));\n    return session;\n  } catch (error) {\n    // The transport is the shared process-wide client and is never released\n    // here; a failed box is still stopped when cleanup is provably safe.\n    if (!timedOut) {\n      return await releaseModalCreateFailure(session, SHARED_CLIENT_TRANSPORT, error);\n    }\n    throw error;\n  }\n}\n\n/** A resume that cannot proceed for this state (no persisted id, or a box\n * that already stopped). Kept local so the sandbox leaf never imports the\n * agent loop; callers classify these by their exact message. */\nclass ModalResumeUnavailableError extends Error {\n  override readonly name = \"UserError\";\n}\n\n/** The pinned adapter's provider-error shape: a SandboxProviderError naming the\n * operation, with the provider failure as its exact cause. */\nasync function withModalProviderError<T>(\n  operation: string,\n  context: Record<string, string>,\n  run: () => Promise<T>,\n): Promise<T> {\n  try {\n    return await run();\n  } catch (error) {\n    if (error instanceof ModalResumeUnavailableError) throw error;\n    const cause = errorMessage(error);\n    throw Object.assign(\n      new SandboxProviderError(\n        `ModalSandboxClient failed to ${operation}${cause ? `: ${cause}` : \"\"}`,\n        { provider: \"modal\", operation, ...context, cause },\n      ),\n      { cause: error },\n    );\n  }\n}\n\n/**\n * Reattach to a live box on the shared process-wide client. Same lookups,\n * errors and session as the pinned adapter's resume, which instead built a new\n * client per call and so paid a fresh TLS channel, AuthTokenGet and\n * EnvironmentGetOrCreate (about 0.5 s) on every warm turn.\n */\nexport async function resumeModalSessionOnSharedClient(\n  defaults: OpenGeniModalSandboxClientOptions,\n  state: ModalSandboxSessionState,\n): Promise<ModalSandboxSession> {\n  assertHostPathGrantsRebound(state);\n  if (!state.sandboxId) {\n    throw new ModalResumeUnavailableError(\"Modal sandbox resume requires a persisted sandboxId.\");\n  }\n  const sandboxId = state.sandboxId;\n  const modal = sharedModalClient(\n    defined({\n      tokenId: defaults.tokenId,\n      tokenSecret: defaults.tokenSecret,\n      environment: state.modalEnvironment ?? defaults.environment,\n      endpoint: state.endpoint ?? defaults.endpoint,\n      imageBuilderVersion: state.imageBuilderVersion ?? defaults.imageBuilderVersion,\n    }),\n  );\n  const sandbox = await withModalProviderError(\n    \"resume sandbox\",\n    { sandboxId },\n    async () => await modal.sandboxes.fromId(sandboxId),\n  );\n  const ownsSandbox = state.ownsSandbox !== false;\n  const app =\n    ownsSandbox || state.workspacePersistence === \"snapshot_filesystem\"\n      ? await withModalProviderError(\n          \"look up app\",\n          { appName: state.appName },\n          async () =>\n            await cachedModalApp(\n              modal,\n              state.appName,\n              defined({ createIfMissing: ownsSandbox, environment: state.modalEnvironment }),\n            ),\n        )\n      : {};\n  const exitCode = await withModalProviderError(\n    \"poll sandbox\",\n    { sandboxId },\n    async () => await sandbox.poll(),\n  );\n  if (exitCode !== null) {\n    throw new ModalResumeUnavailableError(`Modal sandbox ${state.sandboxId} is no longer running.`);\n  }\n  const constructorArgs = {\n    state,\n    modal,\n    app,\n    sandbox,\n    ownsSandbox,\n    cloudBucketMountsProvider: async () =>\n      await resolveModalCloudBucketMounts(\n        modal,\n        state.manifest,\n        state.nativeCloudBucketSecretName ?? defaults.nativeCloudBucketSecretName,\n        \"skip\",\n      ),\n    archiveLimits: defaults.archiveLimits,\n  };\n  return new ModalSandboxSession(\n    constructorArgs as unknown as ConstructorParameters<typeof ModalSandboxSession>[0],\n  );\n}\n","import { createHash } from \"node:crypto\";\nimport type { ModalClient } from \"modal\";\n\ntype ModalMiddleware = NonNullable<\n  NonNullable<ConstructorParameters<typeof ModalClient>[0]>[\"grpcMiddleware\"]\n>[number];\n\nconst CREATE_PATH = \"/modal.client.ModalClient/SandboxCreate\";\nconst OPERATION_TAG = \"opengeni_provider_create_operation_id\";\n\nexport type ModalCreateIntent = {\n  operationId: string;\n  name: string;\n  appId: string;\n  imageId: string;\n  requestSha256: string;\n};\n\nexport function modalCreateOperationName(operationId: string): string {\n  if (!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/u.test(operationId)) {\n    throw new Error(\"Modal create requires a UUID operation identity\");\n  }\n  return `opengeni-create-${operationId}`;\n}\n\n/** One controller per attempted physical create, on a dedicated Modal client.\n *\n * Modal 0.9.0 runs this middleware outside its retry middleware. Disable retries\n * for this RPC: the SDK otherwise invents a new, unpersisted idempotency key.\n * Preparation (image builds, secret hydration) runs before this boundary. Once\n * beforeDispatch starts, even an interrupted database acknowledgement is an\n * uncertain attempt. Neither an exception nor named lookup absence licenses a\n * second dispatch. The durable lease, not this in-memory latch, owns recovery.\n *\n * Names/tags are atomic positive-discovery aids, never a quiescence guarantee.\n * No raw request, environment, or secret material leaves this adapter.\n */\nexport function createModalProviderCreateBoundary(input: {\n  operationId: string;\n  beforeDispatch: (intent: ModalCreateIntent) => Promise<void>;\n  onReceipt: (receipt: ModalCreateIntent & { instanceId: string }) => Promise<void>;\n}): ModalMiddleware {\n  const name = modalCreateOperationName(input.operationId);\n  let attempted = false;\n  return async function* modalProviderCreateBoundary(call, options) {\n    if (call.method.path !== CREATE_PATH) return yield* call.next(call.request, options);\n    if (call.requestStream || call.responseStream) {\n      throw new Error(\"Modal SandboxCreate unexpectedly became a streaming RPC\");\n    }\n    if (attempted)\n      throw new Error(\"Modal provider create was already attempted; reconcile its receipt\");\n    const request = call.request as {\n      appId?: unknown;\n      definition?: { imageId?: unknown; name?: unknown; [key: string]: unknown };\n      tags?: Array<{ tagName: string; tagValue: string }>;\n    };\n    if (\n      typeof request.appId !== \"string\" ||\n      !request.appId ||\n      typeof request.definition?.imageId !== \"string\" ||\n      !request.definition.imageId ||\n      (request.definition.name && request.definition.name !== name) ||\n      !Array.isArray(request.tags) ||\n      request.tags.some(\n        (tag) => tag.tagName === OPERATION_TAG && tag.tagValue !== input.operationId,\n      )\n    ) {\n      throw new Error(\"Modal SandboxCreate wire identity does not match the owned operation\");\n    }\n    const wireRequest = {\n      ...request,\n      definition: { ...request.definition, name },\n      tags: [\n        ...request.tags.filter((tag) => tag.tagName !== OPERATION_TAG),\n        { tagName: OPERATION_TAG, tagValue: input.operationId },\n      ],\n    };\n    const intent: ModalCreateIntent = {\n      operationId: input.operationId,\n      name,\n      appId: request.appId,\n      imageId: request.definition.imageId,\n      requestSha256: createHash(\"sha256\").update(JSON.stringify(wireRequest)).digest(\"hex\"),\n    };\n    attempted = true;\n    await input.beforeDispatch(intent);\n    // Middleware is generic over every Modal RPC. The exact method/path and\n    // validated request above narrow this one operation's protobuf boundary.\n    const dispatchOptions = { ...options, retries: 0 };\n    const response = yield* call.next(wireRequest as typeof call.request, dispatchOptions);\n    const instanceId = (response as { sandboxId?: unknown } | null)?.sandboxId;\n    if (typeof instanceId !== \"string\" || !instanceId.startsWith(\"sb-\")) {\n      throw new Error(\n        \"Modal create returned no physical sandbox identity; operation remains uncertain\",\n      );\n    }\n    // Persist even if the caller has since cancelled. Cancellation cannot erase\n    // an already-created provider instance or turn it into a never-sent request.\n    await input.onReceipt({ ...intent, instanceId });\n    return response;\n  };\n}\n","import { AsyncLocalStorage } from \"node:async_hooks\";\nimport { createHash } from \"node:crypto\";\nimport { ModalClient, type App, type Image } from \"modal\";\n\ntype ModalMiddleware = NonNullable<\n  NonNullable<ConstructorParameters<typeof ModalClient>[0]>[\"grpcMiddleware\"]\n>[number];\n\nconst CREATE_PATH = \"/modal.client.ModalClient/SandboxCreate\";\n\nexport type SharedModalClientOptions = {\n  tokenId?: string;\n  tokenSecret?: string;\n  environment?: string;\n  endpoint?: string;\n  imageBuilderVersion?: string;\n};\n\ntype BoundaryScope = { middleware: ModalMiddleware; active: boolean };\n\nconst createBoundaries = new AsyncLocalStorage<BoundaryScope>();\n\n/**\n * The one middleware installed on every shared client. A physical\n * SandboxCreate is only ever dispatched through the create boundary of the\n * operation that is currently running it (see {@link withModalCreateBoundary}).\n * A SandboxCreate outside an active boundary fails closed: work started inside\n * an earlier create (timers, background reads) inherits that create's async\n * context, and must never reuse its fenced, already-attempted boundary.\n */\nexport const ambientCreateBoundary: ModalMiddleware = async function* (call, options) {\n  const scope = createBoundaries.getStore();\n  if (scope?.active) return yield* scope.middleware(call, options);\n  if (call.method.path === CREATE_PATH) {\n    throw new Error(\"Modal SandboxCreate requires an active durable create boundary\");\n  }\n  return yield* call.next(call.request, options);\n};\n\nconst clients = new Map<string, ModalClient>();\n\nfunction clientKey(options: SharedModalClientOptions): string {\n  return JSON.stringify([\n    options.tokenId ?? \"\",\n    options.tokenSecret ? createHash(\"sha256\").update(options.tokenSecret).digest(\"hex\") : \"\",\n    options.environment ?? \"\",\n    options.endpoint ?? \"\",\n    options.imageBuilderVersion ?? \"\",\n  ]);\n}\n\n/**\n * One Modal client per credential, environment and endpoint for the whole\n * process. A fresh client pays a new TLS channel, an AuthTokenGet and an\n * EnvironmentGetOrCreate (about 0.4 to 0.7 s from a worker) before its first\n * useful call, and Modal's close() never releases the gRPC channel. The shared\n * client refreshes its own auth token and multiplexes every sandbox's control\n * calls over one channel. Callers must never close it.\n */\nexport function sharedModalClient(options: SharedModalClientOptions): ModalClient {\n  const key = clientKey(options);\n  const existing = clients.get(key);\n  if (existing) return existing;\n  const client = new ModalClient({\n    ...(options.tokenId ? { tokenId: options.tokenId } : {}),\n    ...(options.tokenSecret ? { tokenSecret: options.tokenSecret } : {}),\n    ...(options.environment ? { environment: options.environment } : {}),\n    ...(options.endpoint ? { endpoint: options.endpoint } : {}),\n    grpcMiddleware: [ambientCreateBoundary],\n  });\n  // Same adaptation the pinned Agents adapter applies to its own clients.\n  const patchable = client as unknown as {\n    imageBuilderVersion?: (version?: string) => unknown;\n  };\n  if (options.imageBuilderVersion !== undefined && patchable.imageBuilderVersion) {\n    const original = patchable.imageBuilderVersion.bind(client);\n    patchable.imageBuilderVersion = (version?: string) =>\n      original(version ?? options.imageBuilderVersion);\n  }\n  clients.set(key, client);\n  return client;\n}\n\n/**\n * Run one physical create with its own durable boundary on the shared client.\n * Only SandboxCreate calls made inside `run` reach `middleware`; the scope is\n * deactivated as soon as `run` settles.\n */\nexport async function withModalCreateBoundary<T>(\n  middleware: ModalMiddleware,\n  run: () => Promise<T>,\n): Promise<T> {\n  const scope: BoundaryScope = { middleware, active: true };\n  try {\n    return await createBoundaries.run(scope, run);\n  } finally {\n    scope.active = false;\n  }\n}\n\nconst APP_CACHE_TTL_MS = 10 * 60_000;\nconst apps = new WeakMap<ModalClient, Map<string, { expiresAt: number; app: Promise<App> }>>();\n\n/** apps.fromName, memoized per shared client for a bounded time. A failed\n * lookup is never cached. */\nexport async function cachedModalApp(\n  client: ModalClient,\n  appName: string,\n  params: { environment?: string; createIfMissing?: boolean },\n): Promise<App> {\n  let byName = apps.get(client);\n  if (!byName) apps.set(client, (byName = new Map()));\n  const key = JSON.stringify([appName, params.environment ?? \"\", params.createIfMissing === true]);\n  const now = Date.now();\n  const hit = byName.get(key);\n  if (hit && hit.expiresAt > now) return await hit.app;\n  const app = client.apps.fromName(appName, {\n    ...(params.environment ? { environment: params.environment } : {}),\n    ...(params.createIfMissing !== undefined ? { createIfMissing: params.createIfMissing } : {}),\n  });\n  const entry = { expiresAt: now + APP_CACHE_TTL_MS, app };\n  byName.set(key, entry);\n  try {\n    return await app;\n  } catch (error) {\n    if (byName.get(key) === entry) byName.delete(key);\n    throw error;\n  }\n}\n\nconst images = new WeakMap<ModalClient, Map<string, Promise<Image>>>();\n\n/**\n * A built provider image for an immutable registry reference or image ID,\n * resolved once per shared client. A built Image carries its imageId, so\n * sandbox creation skips ImageGetOrCreate. Failures are never cached: Modal\n * memoizes failed imports by definition, and the next create retries.\n */\nexport async function cachedModalImage(\n  client: ModalClient,\n  app: App,\n  selector: { kind: \"tag\" | \"id\"; value: string },\n): Promise<Image> {\n  let byRef = images.get(client);\n  if (!byRef) images.set(client, (byRef = new Map()));\n  const key = `${selector.kind}:${app.environmentName ?? \"\"}:${selector.value}`;\n  const hit = byRef.get(key);\n  if (hit) return await hit;\n  const image =\n    selector.kind === \"id\"\n      ? client.images.fromId(selector.value)\n      : client.images.fromRegistry(selector.value).build(app);\n  byRef.set(key, image);\n  try {\n    return await image;\n  } catch (error) {\n    if (byRef.get(key) === image) byRef.delete(key);\n    throw error;\n  }\n}\n\n/** Test-only: drop every shared client and memoized lookup. */\nexport function __resetSharedModalClientsForTest(): void {\n  clients.clear();\n}\n","import { CAPABILITY_DESCRIPTORS } from \"../capabilities\";\nimport type { ProviderRegistration } from \"./types\";\n\nexport const noneProvider: ProviderRegistration = {\n  backend: \"none\",\n  exactResumeMode: \"none\",\n  instanceIdFields: [],\n  workspaceCapturePolicy: () => null,\n  descriptor: CAPABILITY_DESCRIPTORS.none,\n  sessionSupportsPty: false,\n  // No sandbox: nothing to validate, and build() returns undefined. The factory\n  // short-circuits on \"none\" before calling build, but we keep build honest.\n  validateCredentials() {},\n  build() {\n    return undefined;\n  },\n};\n","import { CAPABILITY_DESCRIPTORS } from \"../capabilities\";\nimport { SandboxConfigError } from \"../errors\";\nimport { OpenSandboxClient } from \"./opensandbox-adapter\";\nimport { REPEATABLE_PORTABLE_TAR_WORKSPACE_CAPTURE, type ProviderRegistration } from \"./types\";\n\nconst IMMUTABLE_OCI_IMAGE = /@sha256:[0-9a-f]{64}$/iu;\n/** Desktop-class box: Chromium + XFCE + ttyd will OOM in 1Gi. Two such boxes still fit a D4s_v3. */\nexport const OPENSANDBOX_DIRECT_RESOURCE_LIMITS = Object.freeze({ cpu: \"2\", memory: \"4Gi\" });\nexport const OPENSANDBOX_DIRECT_RESOURCE_REQUESTS = Object.freeze({\n  cpu: \"500m\",\n  memory: \"2Gi\",\n});\n\nfunction clientOptions(\n  settings: Parameters<ProviderRegistration[\"validateCredentials\"]>[0],\n  environment: Record<string, string> = {},\n  exposedPorts: number[] = [],\n  metrics?: import(\"../../metrics\").RuntimeMetricsHooks,\n) {\n  return {\n    baseUrl: settings.openSandboxBaseUrl!,\n    apiKey: settings.openSandboxApiKey!,\n    image: settings.openSandboxImage!,\n    ttlSeconds: settings.openSandboxTtlSeconds,\n    useServerProxy: settings.openSandboxUseServerProxy,\n    signedEndpoints: settings.openSandboxSignedEndpoints,\n    signedEndpointTtlSeconds: settings.openSandboxSignedEndpointTtlSeconds,\n    ...(settings.openSandboxChannelBPublicBaseUrl\n      ? { channelBPublicBaseUrl: settings.openSandboxChannelBPublicBaseUrl }\n      : {}),\n    readyTimeoutSeconds: Math.ceil(settings.sandboxWarmingTimeoutMs / 1000),\n    resourceLimits: OPENSANDBOX_DIRECT_RESOURCE_LIMITS,\n    resourceRequests: OPENSANDBOX_DIRECT_RESOURCE_REQUESTS,\n    environment,\n    exposedPorts,\n    ...(settings.openSandboxPoolRef ? { poolRef: settings.openSandboxPoolRef } : {}),\n    ...(metrics ? { metrics } : {}),\n  };\n}\n\nexport const opensandboxProvider: ProviderRegistration = {\n  backend: \"opensandbox\",\n  exactResumeMode: \"custom\",\n  instanceIdFields: [\"sandboxId\"],\n  workspaceCapturePolicy: () => REPEATABLE_PORTABLE_TAR_WORKSPACE_CAPTURE,\n  descriptor: CAPABILITY_DESCRIPTORS.opensandbox,\n  sessionSupportsPty: false,\n  validateCredentials(settings) {\n    if (!settings.openSandboxBaseUrl) {\n      throw new SandboxConfigError(\"opensandbox\", \"OPENGENI_OPENSANDBOX_BASE_URL is required\");\n    }\n    if (!settings.openSandboxApiKey) {\n      throw new SandboxConfigError(\"opensandbox\", \"OPENGENI_OPENSANDBOX_API_KEY is required\");\n    }\n    if (!settings.openSandboxImage || !IMMUTABLE_OCI_IMAGE.test(settings.openSandboxImage)) {\n      throw new SandboxConfigError(\n        \"opensandbox\",\n        \"OPENGENI_OPENSANDBOX_IMAGE must be an immutable OCI digest\",\n      );\n    }\n  },\n  async renewExpiration({ settings, instanceId }) {\n    await new OpenSandboxClient(clientOptions(settings)).renewExpiration(instanceId);\n  },\n  build({ settings, environment, exposedPorts, metrics }) {\n    return new OpenSandboxClient(clientOptions(settings, environment, exposedPorts, metrics));\n  },\n};\n","import { RunloopSandboxClient } from \"@openai/agents-extensions/sandbox/runloop\";\nimport { CAPABILITY_DESCRIPTORS } from \"../capabilities\";\nimport { SandboxConfigError } from \"../errors\";\nimport { REPEATABLE_PORTABLE_TAR_WORKSPACE_CAPTURE, type ProviderRegistration } from \"./types\";\n\nexport const runloopProvider: ProviderRegistration = {\n  backend: \"runloop\",\n  exactResumeMode: \"custom\",\n  instanceIdFields: [\"devboxId\"],\n  // The SDK otherwise creates a non-idempotent native disk snapshot whose\n  // provider artifact has no Opengeni outcome ledger. Lifecycle capture uses\n  // the inherited unique-path tar primitive instead.\n  workspaceCapturePolicy: () => REPEATABLE_PORTABLE_TAR_WORKSPACE_CAPTURE,\n  descriptor: CAPABILITY_DESCRIPTORS.runloop,\n  sessionSupportsPty: false,\n  validateCredentials(settings) {\n    if (!settings.runloopApiKey) {\n      throw new SandboxConfigError(\"runloop\", \"OPENGENI_RUNLOOP_API_KEY is required\");\n    }\n  },\n  build({ settings, environment, exposedPorts }) {\n    const options: NonNullable<ConstructorParameters<typeof RunloopSandboxClient>[0]> = {\n      apiKey: settings.runloopApiKey!,\n      env: environment,\n      exposedPorts,\n      // Tunnel v2: one tunnel for all ports. Defaults to true in our config.\n      tunnel: settings.runloopTunnel,\n    };\n    if (settings.runloopBaseUrl) options.baseUrl = settings.runloopBaseUrl;\n    if (settings.runloopBlueprintName) options.blueprintName = settings.runloopBlueprintName;\n    if (settings.runloopBlueprintId) options.blueprintId = settings.runloopBlueprintId;\n    // Keep the provider-native snapshot request inside the same immutable\n    // budget as Opengeni's durable capture claim. The outer lifecycle timeout\n    // remains the final fence; this prevents an abandoned SDK request from\n    // needlessly running past it when Runloop supports an exact operation knob.\n    // Runloop keep-alive also lives in this bag (ms), not at Modal's top level.\n    options.timeouts = {\n      snapshotTimeoutMs: settings.sandboxSnapshotTimeoutMs,\n      ...(settings.runloopKeepAliveSeconds\n        ? { keepAliveTimeoutMs: settings.runloopKeepAliveSeconds * 1000 }\n        : {}),\n    };\n    return new RunloopSandboxClient(options);\n  },\n};\n","import { VercelSandboxClient } from \"@openai/agents-extensions/sandbox/vercel\";\nimport { CAPABILITY_DESCRIPTORS } from \"../capabilities\";\nimport { SandboxConfigError } from \"../errors\";\nimport {\n  REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE,\n  REPEATABLE_PORTABLE_TAR_WORKSPACE_CAPTURE,\n  providerWorkspacePersistence,\n  type ProviderRegistration,\n} from \"./types\";\n\nexport const vercelProvider: ProviderRegistration = {\n  backend: \"vercel\",\n  exactResumeMode: \"ordinary\",\n  instanceIdFields: [\"sandboxId\"],\n  workspaceCapturePolicy: (state) =>\n    providerWorkspacePersistence(state) === \"snapshot\"\n      ? REPEATABLE_PORTABLE_TAR_WORKSPACE_CAPTURE\n      : REPEATABLE_CONFIGURED_WORKSPACE_CAPTURE,\n  prepareForTeardownAfterCapture(session) {\n    const state = (session as { state?: { workspacePersistence?: unknown } } | null)?.state;\n    if (state?.workspacePersistence === \"snapshot\") {\n      // Vercel close() otherwise takes a second native snapshot before stop.\n      // The portable tar is already durable, so suppress that unledgered,\n      // identity-adjacent side effect on this disposable resumed handle only.\n      state.workspacePersistence = \"tar\";\n    }\n  },\n  descriptor: CAPABILITY_DESCRIPTORS.vercel,\n  sessionSupportsPty: false,\n  validateCredentials(settings) {\n    // Vercel needs the access token + the project/team it scopes to.\n    if (!settings.vercelToken) {\n      throw new SandboxConfigError(\"vercel\", \"OPENGENI_VERCEL_TOKEN is required\");\n    }\n    if (!settings.vercelProjectId) {\n      throw new SandboxConfigError(\"vercel\", \"OPENGENI_VERCEL_PROJECT_ID is required\");\n    }\n  },\n  build({ settings, environment, exposedPorts }) {\n    const options: NonNullable<ConstructorParameters<typeof VercelSandboxClient>[0]> = {\n      token: settings.vercelToken!,\n      projectId: settings.vercelProjectId!,\n      env: environment,\n      exposedPorts,\n    };\n    if (settings.vercelTeamId) options.teamId = settings.vercelTeamId;\n    if (settings.vercelRuntime) options.runtime = settings.vercelRuntime;\n    return new VercelSandboxClient(options);\n  },\n};\n","/** Provider-neutral helpers for normalizing sandbox command results. */\nexport function sandboxCommandExitCode(result: unknown): number | null {\n  if (typeof result === \"string\") {\n    const match = result.match(/Process exited with code (-?\\d+)/);\n    return match ? Number(match[1]) : null;\n  }\n  if (!result || typeof result !== \"object\") return null;\n  const candidate = result as {\n    exitCode?: unknown;\n    exit_code?: unknown;\n    code?: unknown;\n    status?: unknown;\n  };\n  for (const value of [candidate.exitCode, candidate.exit_code, candidate.code, candidate.status]) {\n    if (typeof value === \"number\") return value;\n  }\n  return null;\n}\n\nexport function sandboxCommandOutput(result: unknown): string {\n  if (typeof result === \"string\") {\n    const outputIndex = result.indexOf(\"Output:\");\n    return outputIndex >= 0 ? result.slice(outputIndex + \"Output:\".length).trim() : result.trim();\n  }\n  if (!result || typeof result !== \"object\") return \"\";\n  const candidate = result as { output?: unknown; stdout?: unknown; stderr?: unknown };\n  return [candidate.output, candidate.stderr, candidate.stdout]\n    .filter((value): value is string => typeof value === \"string\" && value.length > 0)\n    .join(\"\\n\");\n}\n\n/** Return stdout exactly once for machine parsing. */\nexport function sandboxCommandStdout(result: unknown): string {\n  if (typeof result === \"string\") return sandboxCommandOutput(result);\n  if (!result || typeof result !== \"object\") return \"\";\n  const candidate = result as { output?: unknown; stdout?: unknown };\n  if (typeof candidate.stdout === \"string\" && candidate.stdout.length > 0) {\n    return candidate.stdout;\n  }\n  return typeof candidate.output === \"string\" ? candidate.output : \"\";\n}\n\nexport function sandboxCommandStillRunning(result: unknown): boolean {\n  if (typeof result === \"string\") return /Process running with session ID \\d+/u.test(result);\n  if (!result || typeof result !== \"object\") return false;\n  const candidate = result as { sessionId?: unknown; session_id?: unknown };\n  return typeof candidate.sessionId === \"number\" || typeof candidate.session_id === \"number\";\n}\n","import type { OpStreamExecClient } from \"./op-stream\";\nimport type { OpExit } from \"@opengeni/agent-proto\";\n\n/** Identical terminal reason projection for pushed and reconciled exits. */\nexport function connectedCommandExitProof(exit: OpExit, observedAt: Date) {\n  const code = exit.failureCode.replace(/[^A-Za-z0-9_-]/g, \"_\").slice(0, 128);\n  return {\n    outcome: \"exited\" as const,\n    exitCode: exit.exitCode,\n    ...(exit.backgroundChildrenStopped ? { backgroundChildrenStopped: true } : {}),\n    reason: code\n      ? `op_failure_${code}`\n      : exit.cancelled\n        ? \"op_cancelled\"\n        : exit.timedOut\n          ? \"op_timed_out\"\n          : \"op_exit\",\n    ...(code ? { failure: { code, detail: exit.failureDetail, retryable: false as const } } : {}),\n    observedAt,\n  };\n}\n\n/** A finite terminal drain: settlement is forbidden until the verified exit\n * frontier has been captured. A fresh collector always replays retained truth. */\nexport async function replayConnectedCommandOutput(\n  client: Pick<OpStreamExecClient, \"readExisting\">,\n  opId: string,\n  terminalKnown: boolean,\n  capture: Parameters<OpStreamExecClient[\"readExisting\"]>[2],\n  deadlineAt?: number,\n): Promise<Awaited<ReturnType<OpStreamExecClient[\"readExisting\"]>>> {\n  const checkDeadline = () => {\n    if (deadlineAt !== undefined && Date.now() >= deadlineAt)\n      throw new Error(\"Connected command output collector reached its claim deadline\");\n  };\n  const boundedCapture: typeof capture =\n    deadlineAt === undefined\n      ? capture\n      : async (frames) => {\n          for (const frame of frames) {\n            checkDeadline();\n            await capture([frame]);\n          }\n          checkDeadline();\n        };\n  let capturedThrough = 0n;\n  while (true) {\n    // Only collector ownership is bounded, never the native command. The push\n    // caller reserves an in-flight read window before its existing claim expires.\n    checkDeadline();\n    const before = capturedThrough;\n    const replay = await client.readExisting(opId, terminalKnown ? 5_000 : 250, boundedCapture);\n    checkDeadline();\n    if (!terminalKnown || replay.status === \"completed\" || replay.terminal) return replay;\n    // Heartbeats and partial UTF-8 advance the contiguous protocol frontier\n    // even when no decoded output chunk is produced.\n    capturedThrough = BigInt(replay.replaySequence);\n    if (capturedThrough === before)\n      throw new Error(\"Connected command terminal output replay has not reached its exit frontier\");\n  }\n}\n","import { isModalTaskExecStartPreDispatchUnavailableError } from \"./providers/modal\";\n\n/** The function tool whose one invocation starts exactly one sandbox command. */\nexport const COMMAND_START_TOOL_NAME = \"exec_command\";\n\nconst MAX_DEPTH = 8;\nconst MAX_NODES = 64;\n\n/**\n * Call-scoped proof that one `exec_command` invocation never dispatched its\n * command. Only the runtime's own invocation wrapper creates it, and only around\n * the provider's typed pre-dispatch readiness proof, so the worker can settle\n * exactly this call as not started instead of unknown.\n */\nexport class ToolCallCommandNotStartedError extends Error {\n  readonly callId: string;\n\n  constructor(callId: string, cause: unknown) {\n    super(\"The sandbox command was not started\", { cause });\n    this.name = \"ToolCallCommandNotStartedError\";\n    this.callId = callId;\n  }\n}\n\ntype InvokableTool = {\n  type: string;\n  name: string;\n  invoke?: (context: never, input: string, details?: never) => Promise<unknown>;\n};\n\n/**\n * Wrap `exec_command` so a proven pre-dispatch command-start failure carries\n * the exact call it belongs to. Every other outcome, including a rendered\n * error string or an ambiguous start, passes through unchanged.\n */\nexport function withCommandNotStartedCallProof<T extends InvokableTool>(tool: T): T {\n  if (tool.type !== \"function\" || tool.name !== COMMAND_START_TOOL_NAME || !tool.invoke) {\n    return tool;\n  }\n  const invoke = tool.invoke;\n  return {\n    ...tool,\n    invoke: async (context: never, input: string, details?: never) => {\n      try {\n        return await invoke(context, input, details);\n      } catch (error) {\n        const callId = (details as { toolCall?: { callId?: unknown } } | undefined)?.toolCall\n          ?.callId;\n        if (\n          typeof callId === \"string\" &&\n          callId.length > 0 &&\n          isModalTaskExecStartPreDispatchUnavailableError(error)\n        ) {\n          throw new ToolCallCommandNotStartedError(callId, error);\n        }\n        throw error;\n      }\n    },\n  };\n}\n\n/**\n * The call ids an error proves were never started. The whole error must still\n * satisfy the pre-dispatch proof: any retained or outcome-unknown boundary in\n * the same chain vetoes every call, and lookalike names never qualify.\n */\nexport function toolCallCommandNotStartedCallIds(error: unknown): string[] {\n  if (!isModalTaskExecStartPreDispatchUnavailableError(error)) return [];\n  const callIds = new Set<string>();\n  const pending: Array<{ depth: number; value: unknown }> = [{ depth: 0, value: error }];\n  const seen = new WeakSet<object>();\n  let inspected = 0;\n  while (pending.length > 0 && inspected < MAX_NODES) {\n    const current = pending.shift()!;\n    inspected += 1;\n    if (!current.value || typeof current.value !== \"object\" || seen.has(current.value)) continue;\n    if (current.depth > MAX_DEPTH) continue;\n    seen.add(current.value);\n    if (current.value instanceof ToolCallCommandNotStartedError) {\n      if (isModalTaskExecStartPreDispatchUnavailableError(current.value.cause)) {\n        callIds.add(current.value.callId);\n      }\n      continue;\n    }\n    const record = current.value as Record<string, unknown>;\n    for (const key of [\"cause\", \"error\"] as const) {\n      const descriptor = Object.getOwnPropertyDescriptor(record, key);\n      if (descriptor && \"value\" in descriptor) {\n        pending.push({ depth: current.depth + 1, value: descriptor.value });\n      }\n    }\n    const errors = Object.getOwnPropertyDescriptor(record, \"errors\");\n    if (errors && \"value\" in errors && Array.isArray(errors.value)) {\n      for (const nested of errors.value.slice(0, 32)) {\n        pending.push({ depth: current.depth + 1, value: nested });\n      }\n    }\n  }\n  return [...callIds];\n}\n","import { createHash } from \"node:crypto\";\nimport { types } from \"node:util\";\nimport { z } from \"zod\";\nimport { canonicalModalCheckpointProviderBinding } from \"@opengeni/contracts\";\n\nconst uuid = z.string().regex(/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/u);\nconst empty = z.object({}).strict();\nconst binding = z\n  .object({\n    version: z.literal(1),\n    serverUrl: z.string().max(2048),\n    workspaceName: z.string().min(1).max(200),\n    environment: z.string().max(200),\n  })\n  .strict();\nconst blueprint = z\n  .object({\n    version: z.literal(1),\n    adapterId: z.literal(\"modal-native-fresh-creator-reservation-v1\"),\n    create: z\n      .object({\n        operationId: uuid,\n        appId: z.string().regex(/^ap-[A-Za-z0-9_-]{1,200}$/u),\n        imageId: z.string().regex(/^im-[A-Za-z0-9_-]{1,200}$/u),\n        cpu: z\n          .number()\n          .positive()\n          .max(128)\n          .refine((value) => {\n            const milli = Math.trunc(1000 * value);\n            return Number.isSafeInteger(milli) && milli >= 1 && milli / 1000 === value;\n          }),\n        memoryMiB: z.number().int().safe().min(128).max(1_048_576),\n        timeoutSeconds: z.number().int().safe().min(1).max(86_400),\n        env: empty,\n        mounts: z.tuple([]),\n      })\n      .strict(),\n    restore: z.null(),\n    readiness: z\n      .object({\n        operationId: uuid,\n        execId: uuid,\n        commandArgs: z.tuple([z.literal(\"/bin/true\")]),\n        workdir: z.literal(\"/tmp\"),\n        env: empty,\n      })\n      .strict(),\n    publishOperationId: uuid,\n    cleanup: z\n      .object({ operationId: uuid, requires: z.literal(\"physical-terminal-proof\") })\n      .strict(),\n  })\n  .strict();\n\n/** A new wrapper around the unchanged reservation vocabulary. These additional\n * fields MUST NOT be passed as extra keys to the reservation-v1 DB API. */\nconst specSchema = z\n  .object({\n    version: z.literal(1),\n    recipeId: z.literal(\"modal-native-fresh-v1\"),\n    recipeRevision: z.literal(1),\n    createWorkdir: z.literal(\"/tmp\"),\n    entrypoint: z.tuple([z.literal(\"sleep\"), z.literal(\"infinity\")]),\n    origin: z\n      .object({\n        version: z.literal(1),\n        planId: uuid,\n        creatorId: uuid,\n        accountId: uuid,\n        workspaceId: uuid,\n        sessionId: uuid,\n        turnId: uuid,\n        attemptId: uuid,\n        executionGeneration: z.number().int().positive().safe(),\n        triggerEventId: uuid,\n        sandboxGroupId: uuid,\n        routeKind: z.literal(\"home\"),\n        routeTargetId: z.null(),\n        routeEpoch: z.number().int().nonnegative().safe(),\n        providerBindingKey: z.string().min(1).max(4096),\n        providerBinding: binding,\n      })\n      .strict(),\n    blueprint,\n  })\n  .strict();\nexport type NativeFreshCreateSpec = z.infer<typeof specSchema>;\n\ntype Immutable<T> = T extends readonly unknown[]\n  ? { readonly [K in keyof T]: Immutable<T[K]> }\n  : T extends object\n    ? { readonly [K in keyof T]: Immutable<T[K]> }\n    : T;\n\nconst normalization = {\n  recipeId: \"modal-native-fresh-v1\",\n  recipeRevision: 1,\n  schema: \"modal.client.ModalClient/SandboxCreate\",\n  encoding: \"modal-create-json-v1\",\n  sdkVersion: \"0.9.0\",\n  // Reviewed installed source; this is a pinned normalization fingerprint,\n  // not a runtime file read or an attestation of transmitted protobuf bytes.\n  sdkSourceSha256: \"bb830ded1925e1d927d1fc221b2329d961f9a57eafdd9a85bf13fb7cfc982599\",\n  entrypoint: [\"sleep\", \"infinity\"],\n  createWorkdir: \"/tmp\",\n  env: {},\n  mounts: [],\n  restore: null,\n  idleTimeout: \"unset\",\n  gpu: \"unset\",\n  gpuProto: { type: 0, count: 0, gpuType: \"\" },\n  cpuLimit: \"unset\",\n  memoryLimit: \"unset\",\n  pty: \"unset\",\n  regions: \"unset\",\n  proxy: \"unset\",\n  readinessProbe: \"unset\",\n  environmentVariables: \"unset\",\n  network: {\n    access: \"OPEN\",\n    outboundCidrs: [],\n    outboundDomains: [],\n    inboundCidrs: [],\n    i6pn: false,\n  },\n  volumes: [],\n  cloudBucketMounts: [],\n  secrets: [],\n  ports: [],\n  cloud: \"\",\n  verbose: false,\n  includeOidcIdentityToken: false,\n  experimentalOptions: {},\n  experimentalOptionsV2: {},\n  customDomain: \"\",\n} as const;\nconst sha256 = (value: string) => createHash(\"sha256\").update(value).digest(\"hex\");\nconst compilerFingerprint = sha256(JSON.stringify(normalization));\n\nfunction freeze<T>(value: T): Immutable<T> {\n  if (value !== null && typeof value === \"object\") {\n    for (const child of Object.values(value)) freeze(child);\n    Object.freeze(value);\n  }\n  return value as Immutable<T>;\n}\nfreeze(normalization);\n\n/** Inspect descriptors before parsing/cloning: no getter, callback, class,\n * sparse array, hidden key or non-JSON input may provide a specification. */\nfunction ownData(value: unknown, depth = 0): void {\n  if (depth > 12) throw new Error(\"Unsupported native fresh-create specification\");\n  if (value === null || typeof value === \"string\" || typeof value === \"boolean\") return;\n  if (typeof value === \"number\") {\n    if (Number.isFinite(value) && !Object.is(value, -0)) return;\n    throw new Error(\"Unsupported native fresh-create specification\");\n  }\n  // Native detection must precede reflection, including for revoked Proxies.\n  if (typeof value !== \"object\" || types.isProxy(value))\n    throw new Error(\"Unsupported native fresh-create specification\");\n  const array = Array.isArray(value);\n  const prototype = Object.getPrototypeOf(value);\n  if (array ? prototype !== Array.prototype : prototype !== Object.prototype && prototype !== null)\n    throw new Error(\"Unsupported native fresh-create specification\");\n  const descriptors = Object.getOwnPropertyDescriptors(value);\n  const keys = Reflect.ownKeys(descriptors).filter((key) => !(array && key === \"length\"));\n  if (array && keys.length !== (value as unknown[]).length)\n    throw new Error(\"Unsupported native fresh-create specification\");\n  for (const key of keys) {\n    if (typeof key !== \"string\" || (array && !/^(0|[1-9][0-9]*)$/u.test(key)))\n      throw new Error(\"Unsupported native fresh-create specification\");\n    const descriptor = descriptors[key]!;\n    if (!descriptor.enumerable || !(\"value\" in descriptor))\n      throw new Error(\"Unsupported native fresh-create specification\");\n    ownData(descriptor.value, depth + 1);\n  }\n}\n\n/** Modal 0.9.0 buildSandboxCreateRequestProto + generated fromPartial defaults,\n * followed by the atomic name/tag injection of modal-create-boundary. Property\n * order and intentionally undefined fields are part of this JSON correlation\n * recipe. Pinned-SDK parity tests, not generic SDK reentry, guard this mirror. */\nfunction normalizedRequest(spec: NativeFreshCreateSpec) {\n  const create = spec.blueprint.create;\n  return {\n    appId: create.appId,\n    definition: {\n      entrypointArgs: [...spec.entrypoint],\n      mountIds: [],\n      imageId: create.imageId,\n      secretIds: [],\n      resources: {\n        memoryMb: create.memoryMiB,\n        milliCpu: Math.trunc(1000 * create.cpu),\n        gpuConfig: { type: 0, count: 0, gpuType: \"\" },\n        memoryMbMax: 0,\n        ephemeralDiskMb: 0,\n        milliCpuMax: 0,\n        rdma: false,\n      },\n      cloudProvider: 0,\n      timeoutSecs: (create.timeoutSeconds * 1000) / 1000,\n      workdir: spec.createWorkdir,\n      nfsMounts: [],\n      runtimeDebug: false,\n      blockNetwork: false,\n      s3Mounts: [],\n      cloudBucketMounts: [],\n      volumeMounts: [],\n      ptyInfo: undefined,\n      schedulerPlacement: undefined,\n      workerId: \"\",\n      openPorts: { ports: [] },\n      i6pnEnabled: false,\n      networkAccess: { networkAccessType: 1, allowedCidrs: [], allowedDomains: [] },\n      proxyId: undefined,\n      enableSnapshot: false,\n      snapshotVersion: undefined,\n      cloudProviderStr: \"\",\n      runscRuntimeVersion: undefined,\n      runtime: undefined,\n      verbose: false,\n      name: `opengeni-create-${create.operationId}`,\n      experimentalOptions: {},\n      experimentalOptionsV2: {},\n      preloadPathPrefixes: [],\n      idleTimeoutSecs: undefined,\n      directSandboxCommandsEnabled: false,\n      RestoreInstanceType: \"\",\n      customDomain: \"\",\n      includeOidcIdentityToken: false,\n      readinessProbe: undefined,\n      inboundCidrAllowlist: [],\n      environmentVariables: undefined,\n    },\n    environmentName: \"\",\n    tags: [{ tagName: \"opengeni_provider_create_operation_id\", tagValue: create.operationId }],\n  };\n}\n\nexport type NativeFreshCreateCompilation = Immutable<{\n  version: 1;\n  recipeId: \"modal-native-fresh-v1\";\n  recipeRevision: 1;\n  compilerFingerprint: string;\n  normalization: typeof normalization;\n  spec: NativeFreshCreateSpec;\n  normalizedRequest: ReturnType<typeof normalizedRequest>;\n  requestJson: string;\n  request: {\n    encoding: \"modal-create-json-v1\";\n    sha256: string;\n    byteLength: number;\n    encoderFingerprint: string;\n  };\n}>;\n\n/** Opaque local compilation handle. It is correlation data, never an accepted\n * operation, authenticated principal, reservation or fresh dispatch grant. */\nexport type NativeFreshCreatePreparation = Readonly<object>;\nconst prepared = new WeakMap<object, NativeFreshCreateCompilation>();\n\n/** Synchronous, credentials-free and zero provider/DB/config I/O. Requires all\n * IDs and the complete known fresh recipe before election. Never creates IDs,\n * resolves apps/images, invokes SDK helpers or consumes dispatch authority. */\nexport function compileNativeFreshCreate(\n  input: NativeFreshCreateSpec,\n): NativeFreshCreatePreparation {\n  try {\n    ownData(input);\n    const copied: unknown = structuredClone(input);\n    if (Buffer.byteLength(JSON.stringify(copied)) > 32_768)\n      throw new Error(\"Unsupported native fresh-create specification\");\n    const spec = specSchema.parse(copied);\n    const { origin, blueprint: plan } = spec;\n    const canonical = canonicalModalCheckpointProviderBinding(origin.providerBinding);\n    const serverUrl = new URL(origin.providerBinding.serverUrl);\n    if (\n      !canonical ||\n      canonical.key !== origin.providerBindingKey ||\n      ([\"serverUrl\", \"workspaceName\", \"environment\"] as const).some(\n        (field) => canonical.binding[field] !== origin.providerBinding[field],\n      ) ||\n      ![\"https:\", \"http:\"].includes(serverUrl.protocol) ||\n      serverUrl.username ||\n      serverUrl.password ||\n      serverUrl.search ||\n      serverUrl.hash ||\n      origin.creatorId === origin.attemptId\n    )\n      throw new Error(\"Unsupported native fresh-create specification\");\n    const ids = [\n      origin.planId,\n      origin.creatorId,\n      plan.create.operationId,\n      plan.readiness.operationId,\n      plan.readiness.execId,\n      plan.publishOperationId,\n      plan.cleanup.operationId,\n    ];\n    if (new Set(ids).size !== 7) throw new Error(\"Unsupported native fresh-create specification\");\n    const request = normalizedRequest(spec);\n    const requestJson = JSON.stringify(request);\n    const compilation: NativeFreshCreateCompilation = freeze({\n      version: 1,\n      recipeId: \"modal-native-fresh-v1\",\n      recipeRevision: 1,\n      compilerFingerprint,\n      normalization,\n      spec,\n      normalizedRequest: request,\n      requestJson,\n      request: {\n        encoding: \"modal-create-json-v1\",\n        sha256: sha256(requestJson),\n        byteLength: Buffer.byteLength(requestJson),\n        encoderFingerprint: compilerFingerprint,\n      },\n    });\n    const handle = Object.freeze({});\n    prepared.set(handle, compilation);\n    return handle;\n  } catch {\n    // Do not echo arbitrary input, provider tokens or schema diagnostics.\n    throw new Error(\"Unsupported native fresh-create specification\");\n  }\n}\n\n/** Authenticates ONLY local compiler issuance. The full frozen record contains\n * no credential/JWT, grant, DB receipt or transmitted-byte attestation. */\nexport function describeNativeFreshCreate(\n  handle: NativeFreshCreatePreparation,\n): NativeFreshCreateCompilation {\n  const compilation = prepared.get(handle);\n  if (!compilation) throw new Error(\"Unknown native fresh-create preparation\");\n  return compilation;\n}\n","// @opengeni/runtime/sandbox — the desktop display-stack launcher (P4.1).\n//\n// The agent-loop-free home for `ensureDisplayStack`: the exec-launched,\n// flock-idempotent procedure that brings up the Channel-B pixel stack\n// (Xvfb :0 -> XFCE -> x11vnc -> websockify:6080 -> noVNC) on a live,\n// externally-owned box. It is driven over the box's `exec`/`execCommand` channel\n// (NOT a container CMD) so it re-establishes after a snapshot rollover / box\n// re-election, and it is safe to call from the API on a viewer op OR from the\n// agent turn — a second concurrent call serializes on the in-box flock and\n// no-ops when the stack is already up.\n//\n// It lives under @opengeni/runtime/sandbox so the API-direct control plane\n// (apps/api) and the worker (apps/worker) both pull it from the same single\n// agent-loop-free leaf.\n//\n// Productionized from the PROVEN spike (spikes/desktop-stack PASSED locally:\n// noVNC 200, WS 101 + RFB banner, OCR'd a secret off the framebuffer) + the\n// gVisor harness (V2 PASSED live on Modal: XTEST input read-back under runsc).\n\nimport {\n  DESKTOP_STREAM_PORT,\n  LEGACY_SANDBOX_PROVIDER_INSTANCE_ID_FIELDS,\n  OPENGENI_SANDBOX_PROVIDER_INSTANCE_ID_FIELD,\n} from \"@opengeni/contracts\";\nimport { parseExecResponseBanner } from \"./exec-banner\";\n\n// Re-export under the canonical name the module spec uses (STREAM_PORT) while\n// keeping DESKTOP_STREAM_PORT as the single source of truth (contracts).\nexport { DESKTOP_STREAM_PORT };\nexport const STREAM_PORT = DESKTOP_STREAM_PORT;\n\n// The whole-stack launch is bounded by the readiness gates inside the up-script\n// (four loops of 50 * 0.1s = ~5s each, ~20s worst case) PLUS the PAINTABLE-FRAME\n// gate we append (up to ~30s of scrot probing) PLUS first-boot XFCE/dbus + font-cache\n// warm-up on a cold gVisor box. 90s gives headroom over the spike's observed ~5-10s\n// warm path AND the cold-box paint warm-up without masking a genuine wedge.\nexport const DISPLAY_STACK_TIMEOUT_MS = 90_000;\n\n// Provider exec APIs use `yieldTimeMs` as an output-yield window, not a process\n// deadline. Poll often enough to surface stage telemetry while the command keeps\n// running, but let the in-box `timeout(1)` own termination (see\n// `boundedDisplayStackCommand`).\nconst DISPLAY_STACK_PROVIDER_YIELD_MS = 15_000;\nconst DISPLAY_STACK_PROVIDER_POLL_MS = 5_000;\nconst DISPLAY_STACK_TERMINATION_GRACE_MS = 5_000;\n// Provider cancellation is transport-level and may never settle. Keep the\n// JavaScript-side cleanup/drain bounded as well; a later caller either gets a\n// positive in-box quiescence proof or remains fail-closed, but it must never\n// wait forever on a provider promise.\nconst DISPLAY_STACK_CLEANUP_CALL_MS = 250;\nconst DISPLAY_STACK_DRAIN_GRACE_MS = 100;\n\n// PAINTABLE-FRAME gate: poll scrot up to this many times, this many seconds apart,\n// waiting for an actually-PAINTED frame before declaring the stack \"up\" (~30s worst case).\nconst PAINT_PROBE_ATTEMPTS = 150;\nconst PAINT_PROBE_INTERVAL_S = 0.2;\n\n// The paint FLOOR (bytes): a scrot at/above this size is a real painted desktop; below\n// it, the root is still unpainted and the frame would read as \"blank\" to the model.\n//\n// WHY A SIZE FLOOR, NOT NON-EMPTINESS (the bug this fixes): the old gate only checked\n// `[ -s frame.png ]` (non-empty). But an UNPAINTED root is never zero-byte — a fresh\n// Xvfb draws either the `-retro` weave stipple or (with `-retro` dropped) solid black,\n// and scrot happily encodes that as a small-but-non-empty PNG. So the old gate passed\n// the instant the VNC ports bound — MEASURED at ~1.4s (fast runc host) to several\n// seconds (cold gVisor) BEFORE xfdesktop finishes its first wallpaper paint — handing\n// the model the pre-paint frame. That pre-paint frame is exactly the \"blank/black\"\n// screenshot that 400s the model and blanks the human viewer.\n//\n// The sizes are unambiguous and were measured on the canonical desktop image (1280x800)\n// under runc — both the current staging image and a fresh local build:\n//   painted XFCE desktop (blue-gradient wallpaper + panel + icons): ~210-222 KB\n//   `-retro` stipple root (unpainted, current image):                ~17 KB\n//   solid-black root (unpainted, after we drop `-retro`):            ~13.5 KB\n// 60 KB sits ~3.5x above every unpainted state and ~3.5x below a real paint — a wide,\n// unambiguous margin. It holds against BOTH the currently-deployed `-retro` image and\n// the `-retro`-dropped image this change ships, so the runtime gate is correct before\n// AND after the image rebuild lands. (Assumes the default ~1280x800 geometry; a larger\n// framebuffer only scales the painted frame further above the floor.)\nconst PAINT_MIN_BYTES = 60_000;\n\n// SETTLE gate (the gVisor staged-paint fix): crossing the 60 KB floor is necessary but\n// NOT sufficient. On a fast runc host the paint is atomic (black 13.5 KB -> full 209 KB\n// in one step, panel + icons included). On a STONE-COLD gVisor Modal box it is STAGED:\n// the wallpaper gradient paints and crosses 60 KB a beat BEFORE xfdesktop draws the\n// panel / launcher icons / logo. A screenshot in that window shows a bare teal wallpaper\n// with no panel — which the model correctly reports as \"graphical, but the desktop\n// hasn't fully loaded\" (VERIFIED live on staging: a cold-box turn's first agent\n// screenshot caught exactly this). So the gate additionally waits for the frame to\n// SETTLE: two consecutive probes both above the floor whose byte-sizes agree within\n// PAINT_SETTLE_DELTA_BYTES. A still-painting desktop grows between probes; a fully\n// rendered, static one is byte-stable (scrot -o omits the cursor, and the clock is\n// minute-precision, so consecutive captures of a settled desktop are near-identical).\n// This makes ensureDisplayStack block until the FULL desktop is up, so the turn's first\n// screenshot — which runs AFTER this gate — sees the panel, not a bare wallpaper.\nconst PAINT_SETTLE_DELTA_BYTES = 2_000;\n\n/** Desktop geometry for the framebuffer. v1 has no live RANDR: a resolution\n *  change is a full down -> up restart (a separate op). */\nexport type DesktopGeometry = {\n  width: number; // default 1280\n  height: number; // default 800\n  dpi: number; // default 96\n};\n\nexport const DEFAULT_DESKTOP_GEOMETRY: DesktopGeometry = { width: 1280, height: 800, dpi: 96 };\n\n/** Thrown when a stage of the launch script failed. exitCode 11/12/13 map to\n *  Xvfb / x11vnc / websockify respectively (the stage that died); 14 is the\n *  PAINTABLE-FRAME gate (ports listening but scrot still yields an empty frame —\n *  the display is up but not actually painting). Degradation is surfaced as a\n *  value to viewers by the caller; this error is for diagnostics. */\nexport class DisplayStackError extends Error {\n  readonly exitCode: number;\n  readonly stage: \"xvfb\" | \"x11vnc\" | \"websockify\" | \"paint\" | \"lock\" | \"timeout\" | \"unknown\";\n\n  constructor(exitCode: number, output: string) {\n    const stage =\n      exitCode === 11\n        ? \"xvfb\"\n        : exitCode === 12\n          ? \"x11vnc\"\n          : exitCode === 13\n            ? \"websockify\"\n            : exitCode === 14\n              ? \"paint\"\n              : exitCode === 15\n                ? \"lock\"\n                : exitCode === 124 || /OPENGENI_DISPLAY_TIMEOUT/u.test(output)\n                  ? \"timeout\"\n                  : \"unknown\";\n    super(\n      `desktop display stack failed at stage \"${stage}\" (exit ${exitCode})${output ? `:\\n${output}` : \"\"}`,\n    );\n    this.name = \"DisplayStackError\";\n    this.exitCode = exitCode;\n    this.stage = stage;\n  }\n}\n\n/** Thrown when the provider session cannot run commands (a headless-only\n *  backend with neither `exec` nor `execCommand`). The desktop tier degrades to\n *  Channel-A-only — the caller maps this to `DesktopStream.transport: null`. */\nexport class DisplayStackUnsupportedError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"DisplayStackUnsupportedError\";\n  }\n}\n\n// The structural slice of a provider session we need: run a command (preferring\n// `exec` for the structured exit code, falling back to `execCommand`).\ntype ExecResultLike = {\n  output?: string;\n  stdout?: string;\n  stderr?: string;\n  exitCode?: number | null;\n  sessionId?: number;\n  session_id?: number;\n};\ntype ExecCapableSession = {\n  state?: unknown;\n  exec?: (args: {\n    cmd: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n    signal?: AbortSignal;\n  }) => Promise<ExecResultLike>;\n  execCommand?: (args: {\n    cmd: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n    signal?: AbortSignal;\n  }) => Promise<string>;\n  writeStdin?: (args: {\n    sessionId: number;\n    chars: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n    signal?: AbortSignal;\n  }) => Promise<ExecResultLike | string>;\n};\n\nexport type DisplayStackCallerKind = \"viewer\" | \"computer\" | \"unknown\";\nexport type DisplayStackClassification = \"cold\" | \"already_ready\" | \"contention\" | \"unknown\";\nexport type DisplayStackTelemetryStatus = \"started\" | \"waiting\" | \"completed\" | \"failed\";\n\n/** Secret-free, bounded-cardinality stage observation. Provider/sandbox IDs are\n * log correlation fields, never metric labels. */\nexport type DisplayStackTelemetryEvent = {\n  type: \"display_stack.stage\";\n  requestId: string;\n  stage: string;\n  status: DisplayStackTelemetryStatus;\n  elapsedMs: number;\n  source: \"host\" | \"sandbox\";\n  classification: DisplayStackClassification;\n  callerKind: DisplayStackCallerKind;\n  sandboxId?: string;\n  leaseEpoch?: number;\n  providerSessionId?: number;\n};\n\nexport type DisplayStackTelemetryContext = {\n  callerKind: DisplayStackCallerKind;\n  sandboxId?: string;\n  leaseEpoch?: number;\n};\n\nexport type EnsureDisplayStackOptions = {\n  geometry?: DesktopGeometry;\n  /** The exposed stream port; defaults to 6080. */\n  port?: number;\n  /** Whole-operation wall-clock timeout; defaults to DISPLAY_STACK_TIMEOUT_MS. */\n  timeoutMs?: number;\n  /** Caller correlation. Supplying it enables the default structured log sink. */\n  telemetryContext?: DisplayStackTelemetryContext;\n  /** Optional non-blocking telemetry sink (tests/embedders may replace logging). */\n  onTelemetry?: (event: DisplayStackTelemetryEvent) => void | Promise<void>;\n};\n\nexport type EnsureDisplayStackResult = {\n  /** The exposed port the stack listens on (websockify/noVNC). */\n  port: number;\n  geometry: DesktopGeometry;\n  /** The raw `OPENGENI_DESKTOP_UP …` marker line, for diagnostics. Never\n   *  surfaced to viewers. */\n  marker: string;\n};\n\n/**\n * Build the shell command that runs the idempotent up-script under an in-box\n * `flock`. The script is shipped in the image at /usr/local/bin/opengeni-desktop-up\n * (the canonical desktop image); we set the geometry/port env and wrap the call\n * in `flock` so two concurrent ensureDisplayStack callers (the API viewer op +\n * the agent turn, both racing after a rollover) serialize without a double\n * launch. The up-script's own per-stage PID guards make the second call a no-op.\n *\n * Exported (pure, side-effect-free) so the ensureDisplayStack unit test can\n * assert the exact command sequence without a live box.\n */\nexport function buildDisplayStackScript(options: EnsureDisplayStackOptions = {}): string {\n  const geometry = options.geometry ?? DEFAULT_DESKTOP_GEOMETRY;\n  const port = options.port ?? DESKTOP_STREAM_PORT;\n  const env =\n    `DESKTOP_W=${geometry.width} DESKTOP_H=${geometry.height} ` +\n    `DESKTOP_DPI=${geometry.dpi} STREAM_PORT=${port}`;\n  // FAST PRE-CHECK (lock-free) before the outer flock: if the exposed port and\n  // x11vnc are ALREADY listening, the stack is up — print the marker and short-\n  // circuit, so a no-op caller (the agent turn re-ensuring after a viewer attach\n  // already brought the stack up) never serializes behind a lock holder and never\n  // burns the 45s flock -w timeout. `nc -z` to the two loopback ports is the cheap\n  // (sub-millisecond) \"already up?\" signal; on a miss we fall through to the\n  // flock-wrapped up-script (which ALSO pre-checks under its own lock).\n  //\n  // flock -w bounds the wait so a wedged holder can't deadlock the caller; the\n  // up-script itself ALSO takes the same lock (belt + braces) so this works even\n  // against an older image that predates the wrapper.\n  //\n  // PAINTABLE-FRAME GATE (the completion criterion): the up-script's readiness gates\n  // only assert that Xvfb answers xdpyinfo and that x11vnc:5900 + websockify:PORT are\n  // LISTENING — NOT that the display actually PAINTS. On a stone-cold gVisor box (the\n  // machine→sandbox swap-recovery turn always hits one), Xvfb answers and the VNC ports\n  // bind ~1.4s (fast host) to several seconds BEFORE xfdesktop finishes its first\n  // wallpaper paint. In that window a scrot yields a small UNPAINTED frame (the -retro\n  // stipple or a solid-black root) — never zero-byte — which is exactly the \"blank/black\"\n  // screenshot that 400s the model and blanks the human viewer. (VERIFIED locally: the\n  // real xfdesktop backdrop window maps at full 1280x800 the whole time; the render is\n  // never structurally broken — it is purely this pre-paint capture race.)\n  //\n  // We therefore chain a real scrot probe as the completion gate: after the up-script\n  // reports success, poll scrot until it produces an actually-PAINTED frame — a PNG at or\n  // above PAINT_MIN_BYTES, not merely NON-EMPTY (the old `[ -s ]` check passed on the\n  // ~17 KB pre-paint stipple immediately; that WAS the bug) — bounded ~30s, and only THEN\n  // let the command exit 0. If it never paints we exit 14 so the caller sees a typed\n  // DisplayStackError(\"paint\") — an HONEST failure the worker can degrade + log, rather\n  // than a false \"up\" that hands the model an unpainted image. `-ac` on Xvfb disables\n  // access control so this root-side scrot reaches :0. Runs on a pre-check hit too (cheap\n  // — an already-up display paints on the first probe). Lives in the runtime-built script\n  // (not the baked image up-script) so it ships with the worker/api, no image rebuild —\n  // and its size floor holds against the currently-deployed image too.\n  const lockedLauncher =\n    `ds_started=$1; fw=$2; ds_class=cold; ` +\n    `ds_stage() { ds_now=$(date +%s%3N); echo \"OPENGENI_DISPLAY_STAGE stage=$1 elapsed_ms=$((ds_now-ds_started)) classification=$ds_class\"; }; ` +\n    `fa=$(date +%s%3N); fd=$((fa-fw)); [ \"$fd\" -ge 50 ] && ds_class=contention; ` +\n    `ds_stage outer_flock_acquired; ds_stage launcher_issued; ` +\n    `env ${env} opengeni-desktop-up; urc=$?; ds_stage launcher_complete; exit \"$urc\"`;\n  const bringUp =\n    `if nc -z 127.0.0.1 ${port} >/dev/null 2>&1 && nc -z 127.0.0.1 5900 >/dev/null 2>&1; then ` +\n    `ds_class=already_ready; ds_stage precheck_ready; ` +\n    `echo \"OPENGENI_DESKTOP_UP port=${port} geometry=${geometry.width}x${geometry.height} dpi=${geometry.dpi} (precheck)\"; ` +\n    `else ` +\n    `ds_class=cold; ds_stage precheck_miss; ` +\n    `mkdir -p /tmp/opengeni-desktop; ` +\n    `ds_stage outer_flock_wait; fw=$(date +%s%3N); ` +\n    // Command-mode flock is the supervisor: it retains the lock until the launcher\n    // exits, while --close prevents Xvfb/XFCE/x11vnc/websockify from inheriting the\n    // lock descriptor when the launcher intentionally detaches them.\n    `flock --close --conflict-exit-code 75 --wait 45 /tmp/opengeni-desktop/up.outer.lock ` +\n    `bash -c ${shellQuote(lockedLauncher)} _ \"$ds_started\" \"$fw\"; frc=$?; ` +\n    `if [ \"$frc\" -eq 75 ]; then ds_stage outer_flock_timeout; echo \"OPENGENI_DESKTOP_LOCK_TIMEOUT\"; exit 15; fi; ` +\n    `if [ \"$frc\" -ne 0 ]; then exit \"$frc\"; fi; ` +\n    `fi`;\n  // A fresh /workspace HOME has no xfce4-desktop xfconf. xfdesktop then keeps a\n  // 10x10 manager window and never maps the 1280x800 Desktop child, so scrot\n  // stays ~21 KB (panel on black) and this gate fails forever. Seed the\n  // canonical xfce-blue.jpg backdrop (measured ~365 KB scrot) and start\n  // xfdesktop when the session autostart did not. $mon/$candidate/$WALL are\n  // shell — no ${} braces.\n  const paintSeed =\n    `ds_stage paint_backdrop_seed; ` +\n    `WALL=\"\"; ` +\n    `for candidate in /usr/share/backgrounds/xfce/xfce-blue.jpg /usr/share/backgrounds/xfce/*.jpg /usr/share/backgrounds/xfce/*.png; do ` +\n    `[ -f \"$candidate\" ] && WALL=\"$candidate\" && break; ` +\n    `done; ` +\n    `if [ -n \"$WALL\" ] && command -v xfconf-query >/dev/null 2>&1; then ` +\n    `for mon in monitor0 monitor1 monitorscreen monitorScreen monitorXvfb; do ` +\n    `xfconf-query -c xfce4-desktop -p /backdrop/screen0/$mon/workspace0/last-image --create -t string -s \"$WALL\" >/dev/null 2>&1 || true; ` +\n    `xfconf-query -c xfce4-desktop -p /backdrop/screen0/$mon/workspace0/image-style --create -t int -s 5 >/dev/null 2>&1 || true; ` +\n    `done; ` +\n    `fi; ` +\n    `if command -v xfdesktop >/dev/null 2>&1 && ! pgrep -x xfdesktop >/dev/null 2>&1; then ` +\n    `DISPLAY=:0 xfdesktop --disable-wm-check >/tmp/opengeni-desktop/xfdesktop.log 2>&1 & ` +\n    `fi; `;\n  const paintProbe =\n    `${paintSeed}` +\n    `ds_stage paint_probe_started; p=/tmp/opengeni-desktop/paint-probe.png; prev=0; ` +\n    `for i in $(seq 1 ${PAINT_PROBE_ATTEMPTS}); do ` +\n    // Capture, then measure the PNG byte-size. `wc -c < \"$p\"` yields a bare integer; a\n    // failed scrot leaves sz=0. A frame at/above PAINT_MIN_BYTES is a real painted desktop.\n    `if DISPLAY=:0 scrot -o \"$p\" >/dev/null 2>&1; then sz=$(wc -c < \"$p\" 2>/dev/null || echo 0); else sz=0; fi; ` +\n    `rm -f \"$p\"; ` +\n    // SETTLE: accept only when THIS probe AND the PREVIOUS one are both above the floor\n    // and their sizes agree within PAINT_SETTLE_DELTA_BYTES — i.e., the paint has stopped\n    // growing (the full desktop, panel + icons included, is up), not merely crossed the\n    // floor mid-paint on a staged gVisor boot. ($sz/$prev/$d are bare shell — no ${}\n    // braces — so JS leaves them for bash; ${PAINT_*} ARE JS constants and interpolate.)\n    `if [ \"$sz\" -ge ${PAINT_MIN_BYTES} ] && [ \"$prev\" -ge ${PAINT_MIN_BYTES} ]; then d=$((sz-prev)); [ \"$d\" -lt 0 ] && d=$((0-d)); if [ \"$d\" -le ${PAINT_SETTLE_DELTA_BYTES} ]; then ds_stage paint_ready; break; fi; fi; ` +\n    `prev=$sz; ` +\n    // NOTE: NOT_PAINTING goes to STDOUT (not stderr): Modal is execCommand-only, so the\n    // caller infers the outcome by string-matching the output — stdout is always captured.\n    `if [ \"$i\" = \"${PAINT_PROBE_ATTEMPTS}\" ]; then ds_stage paint_failed; echo \"OPENGENI_DESKTOP_NOT_PAINTING scrot below ${PAINT_MIN_BYTES}B or unsettled after warmup (last=$sz)\"; exit 14; fi; ` +\n    `sleep ${PAINT_PROBE_INTERVAL_S}; ` +\n    `done`;\n  const trace =\n    `ds_started=$(date +%s%3N); ds_class=unknown; ` +\n    `ds_stage() { ds_now=$(date +%s%3N); echo \"OPENGENI_DISPLAY_STAGE stage=$1 elapsed_ms=$((ds_now-ds_started)) classification=$ds_class\"; }; ` +\n    `ds_stage script_entry`;\n  return `${trace}; mkdir -p /tmp/opengeni-desktop; { ${bringUp} ; } && { ${paintProbe} ; }`;\n}\n\nfunction execResultOutput(result: ExecResultLike | string): string {\n  if (typeof result === \"string\") {\n    return result;\n  }\n  return [result.output, result.stderr, result.stdout]\n    .filter((v): v is string => typeof v === \"string\" && v.length > 0)\n    .join(\"\\n\");\n}\n\nfunction execResultExitCode(result: ExecResultLike | string): number | null {\n  if (typeof result === \"string\") {\n    const banner = parseExecResponseBanner(result);\n    if (banner.kind === \"exited\") return banner.exitCode;\n    // A malformed/truncated SDK response must not fall through to command-body\n    // marker inference, because its real terminal status is unknowable.\n    return banner.kind === \"invalid\" ? -1 : null;\n  }\n  return typeof result.exitCode === \"number\" ? result.exitCode : null;\n}\n\nfunction execResultSessionId(result: ExecResultLike | string): number | null {\n  if (typeof result === \"string\") {\n    const banner = parseExecResponseBanner(result);\n    return banner.kind === \"running\" ? banner.sessionId : null;\n  }\n  const value = result.sessionId ?? result.session_id;\n  return typeof value === \"number\" ? value : null;\n}\n\nfunction shellQuote(value: string): string {\n  return `'${value.replaceAll(\"'\", `'\"'\"'`)}'`;\n}\n\n/** The provider yield is not a deadline. Bound the actual lock-owning process in\n * the box, leaving time for TERM/KILL cleanup and the final exit result to reach\n * the caller before the outer JavaScript deadline. */\nfunction boundedDisplayStackCommand(\n  command: string,\n  timeoutMs: number,\n  markerPath: string,\n  markerToken: string,\n): string {\n  const graceMs = Math.min(\n    DISPLAY_STACK_TERMINATION_GRACE_MS,\n    Math.max(20, Math.floor(timeoutMs / 4)),\n  );\n  const commandTimeoutMs = Math.max(1, timeoutMs - graceMs);\n  const killAfterMs = Math.max(1, Math.floor(graceMs / 2));\n  const commandTimeoutSeconds = (commandTimeoutMs / 1_000).toFixed(3);\n  const killAfterSeconds = (killAfterMs / 1_000).toFixed(3);\n  const managedCommand =\n    `marker=${shellQuote(markerPath)}; token=${shellQuote(markerToken)}; ` +\n    `cancel=\"$marker.cancelled\"; ` +\n    `if [ -e \"$cancel\" ]; then echo \"OPENGENI_DISPLAY_CANCELLED\"; exit 124; fi; ` +\n    `pid=$$; pgid=$(ps -o pgid= -p \"$pid\" 2>/dev/null | tr -d ' '); ` +\n    `start=$(awk '{print $22}' \"/proc/$pid/stat\" 2>/dev/null || true); ` +\n    `printf '%s %s %s %s\\\\n' \"$pid\" \"$pgid\" \"$start\" \"$token\" >\"$marker\"; ` +\n    `if [ -e \"$cancel\" ]; then rm -f \"$marker\"; echo \"OPENGENI_DISPLAY_CANCELLED\"; exit 124; fi; ` +\n    // Do not install an EXIT trap: GNU timeout may terminate this supervisor\n    // while descendants survive. The marker must remain for the independent\n    // cleanup command to find and kill that orphaned process group.\n    `bash -c ${shellQuote(command)}; rc=$?; rm -f \"$marker\"; exit \"$rc\"`;\n  return (\n    // Do not use timeout --foreground here. The display command contains flock\n    // supervisors and launcher children; default process-group mode is required\n    // so a deadline cannot leave a waiter alive to acquire the lock and launch\n    // after the caller has already failed.\n    `timeout --signal=TERM --kill-after=${killAfterSeconds}s ${commandTimeoutSeconds}s ` +\n    `bash -c ${shellQuote(managedCommand)}; rc=$?; ` +\n    // Exit 137 is also a normal SIGKILL/OOM/provider-termination result. Only\n    // attach timeout attribution to the exit code that this wrapper positively\n    // knows GNU timeout emitted for its own deadline. A kill-after escalation\n    // may still be reported as 137, but it is not safe to infer that here.\n    `if [ \"$rc\" -eq 124 ]; then ` +\n    `echo \"OPENGENI_DISPLAY_TIMEOUT elapsed_ms=${commandTimeoutMs}\"; fi; exit \"$rc\"`\n  );\n}\n\nclass DisplayStackWallTimeoutError extends Error {}\nclass DisplayStackOperationFencedError extends Error {}\n\ntype PendingDisplayStackCleanup = {\n  markerPath: string;\n  markerToken: string;\n};\n\ntype DisplayStackOperationWaiter = {\n  epoch: number;\n  settled: boolean;\n  resolve: () => void;\n  reject: (error: unknown) => void;\n  timer?: ReturnType<typeof setTimeout>;\n};\n\ntype DisplayStackOperationState = {\n  /** Incremented before a timed-out operation is reported to its caller. */\n  epoch: number;\n  /** One provider operation at a time for each physical sandbox. */\n  owner: DisplayStackOperationWaiter | null;\n  /** Calls that started in the current epoch but are waiting for admission. */\n  waiters: DisplayStackOperationWaiter[];\n  /** Raw provider calls from fenced operations; only the in-box proof gates retries. */\n  inFlight: Set<Promise<unknown>>;\n  /** A bounded advisory drain for provider calls that may never settle. */\n  drain: Promise<void> | null;\n  /** Timed-out in-box processes that still need an independent kill/verify. */\n  pendingCleanup: Map<string, PendingDisplayStackCleanup>;\n  /** True only after every timed-out process has a positive quiescence proof. */\n  physicallyQuiescent: boolean;\n};\n\nconst stableDisplayStackOperationStates = new Map<string, DisplayStackOperationState>();\nconst stableSessionStateOperationStates = new WeakMap<object, DisplayStackOperationState>();\nconst displayStackOperationStates = new WeakMap<object, DisplayStackOperationState>();\n\nfunction asRecord(value: unknown): Record<string, unknown> | null {\n  return value !== null && typeof value === \"object\" ? (value as Record<string, unknown>) : null;\n}\n\nfunction nonEmptyString(value: unknown): string | null {\n  return typeof value === \"string\" && value.length > 0 ? value : null;\n}\n\nfunction readSessionState(session: unknown): unknown {\n  try {\n    return asRecord(session)?.state;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction stableSandboxIdentity(\n  session: unknown,\n  options: EnsureDisplayStackOptions,\n): string | null {\n  const explicit = nonEmptyString(options.telemetryContext?.sandboxId);\n  if (explicit) return `sandbox:${explicit}`;\n\n  const sessionRecord = asRecord(session);\n  const state = asRecord(readSessionState(session));\n  const providerState = state ? asRecord(state.providerState) : null;\n  const candidates = [sessionRecord, state, providerState];\n  // Use the same provider-neutral identity vocabulary as durable envelopes and\n  // the reaper. This keeps display-stack serialization stable for providers\n  // whose SDK identity is not named `sandboxId` (for example Runloop devboxId\n  // and Blaxel sandboxName) while retaining compatibility with existing SDKs.\n  const fields = [\n    OPENGENI_SANDBOX_PROVIDER_INSTANCE_ID_FIELD,\n    ...LEGACY_SANDBOX_PROVIDER_INSTANCE_ID_FIELDS,\n  ];\n  for (const candidate of candidates) {\n    if (!candidate) continue;\n    for (const field of fields) {\n      const value = nonEmptyString(candidate[field]);\n      if (value) return `sandbox:${value}`;\n    }\n  }\n  return null;\n}\n\nfunction newOperationState(): DisplayStackOperationState {\n  return {\n    epoch: 0,\n    owner: null,\n    waiters: [],\n    inFlight: new Set(),\n    drain: null,\n    pendingCleanup: new Map(),\n    physicallyQuiescent: true,\n  };\n}\n\nfunction operationState(\n  session: unknown,\n  options: EnsureDisplayStackOptions,\n): DisplayStackOperationState | null {\n  if ((typeof session !== \"object\" || session === null) && typeof session !== \"function\") {\n    return null;\n  }\n  const stableKey = stableSandboxIdentity(session, options);\n  if (stableKey) {\n    let state = stableDisplayStackOperationStates.get(stableKey);\n    if (!state) {\n      state = newOperationState();\n      stableDisplayStackOperationStates.set(stableKey, state);\n    }\n    return state;\n  }\n\n  // Modal resumed wrappers share their provider `state` object even when the\n  // wrapper instance is reconstructed. This is a useful stable fallback when\n  // an older/provider-specific state shape has no named identity field.\n  const providerState = readSessionState(session);\n  if (providerState && (typeof providerState === \"object\" || typeof providerState === \"function\")) {\n    const stateKey = providerState as object;\n    let state = stableSessionStateOperationStates.get(stateKey);\n    if (!state) {\n      state = newOperationState();\n      stableSessionStateOperationStates.set(stateKey, state);\n    }\n    return state;\n  }\n\n  const key = session as object;\n  let state = displayStackOperationStates.get(key);\n  if (!state) {\n    state = newOperationState();\n    displayStackOperationStates.set(key, state);\n  }\n  return state;\n}\n\nfunction settleOperationWaiter(waiter: DisplayStackOperationWaiter, error?: unknown): void {\n  if (waiter.settled) return;\n  waiter.settled = true;\n  if (waiter.timer) clearTimeout(waiter.timer);\n  if (error === undefined) waiter.resolve();\n  else waiter.reject(error);\n}\n\nfunction pumpOperationWaiters(state: DisplayStackOperationState): void {\n  if (state.owner) return;\n  while (state.waiters.length > 0) {\n    const waiter = state.waiters.shift()!;\n    if (waiter.settled) continue;\n    if (waiter.epoch !== state.epoch) {\n      settleOperationWaiter(waiter, new DisplayStackOperationFencedError());\n      continue;\n    }\n    state.owner = waiter;\n    settleOperationWaiter(waiter);\n    return;\n  }\n}\n\nfunction acquireOperation(\n  state: DisplayStackOperationState,\n  deadline: number,\n): Promise<() => void> {\n  return new Promise<() => void>((resolve, reject) => {\n    const waiter: DisplayStackOperationWaiter = {\n      epoch: state.epoch,\n      settled: false,\n      resolve: () => {\n        resolve(() => {\n          if (state.owner !== waiter) return;\n          state.owner = null;\n          pumpOperationWaiters(state);\n        });\n      },\n      reject,\n    };\n    state.waiters.push(waiter);\n    const remainingMs = deadline - monotonicNow();\n    if (remainingMs <= 0) {\n      waiter.settled = true;\n      state.waiters = state.waiters.filter((candidate) => candidate !== waiter);\n      reject(new DisplayStackWallTimeoutError());\n      return;\n    }\n    waiter.timer = setTimeout(() => {\n      if (waiter.settled) return;\n      waiter.settled = true;\n      state.waiters = state.waiters.filter((candidate) => candidate !== waiter);\n      reject(new DisplayStackWallTimeoutError());\n    }, remainingMs);\n    waiter.timer.unref?.();\n    pumpOperationWaiters(state);\n  });\n}\n\nfunction invalidateQueuedOperations(state: DisplayStackOperationState, epoch: number): void {\n  const retained: DisplayStackOperationWaiter[] = [];\n  for (const waiter of state.waiters) {\n    if (waiter.epoch === epoch)\n      settleOperationWaiter(waiter, new DisplayStackOperationFencedError());\n    else retained.push(waiter);\n  }\n  state.waiters = retained;\n}\n\nfunction monotonicNow(): number {\n  return performance.now();\n}\n\nasync function waitForFencedOperation(\n  state: DisplayStackOperationState,\n  deadline: number,\n): Promise<boolean> {\n  const drain = state.drain;\n  if (!drain) return true;\n  try {\n    await beforeDeadline(drain, deadline);\n  } catch {\n    return false;\n  }\n  if (state.drain === drain) state.drain = null;\n  return true;\n}\n\nfunction trackProviderCall<T>(\n  state: DisplayStackOperationState | null,\n  promise: Promise<T>,\n): Promise<T> {\n  if (!state) return promise;\n  state.inFlight.add(promise);\n  void promise.then(\n    () => state.inFlight.delete(promise),\n    () => state.inFlight.delete(promise),\n  );\n  return promise;\n}\n\nfunction boundedProviderDrain(pending: Promise<unknown>[]): Promise<void> {\n  if (pending.length === 0) return Promise.resolve();\n  return new Promise<void>((resolve) => {\n    let remaining = pending.length;\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    const finish = () => {\n      if (timer) clearTimeout(timer);\n      resolve();\n    };\n    timer = setTimeout(finish, DISPLAY_STACK_DRAIN_GRACE_MS);\n    timer.unref?.();\n    for (const promise of pending) {\n      void promise.then(\n        () => {\n          remaining -= 1;\n          if (remaining === 0) finish();\n        },\n        () => {\n          remaining -= 1;\n          if (remaining === 0) finish();\n        },\n      );\n    }\n  });\n}\n\nfunction fenceOperation(\n  state: DisplayStackOperationState | null,\n  epoch: number,\n  abortController: AbortController,\n  cleanup: PendingDisplayStackCleanup,\n): void {\n  abortController.abort(new DisplayStackWallTimeoutError());\n  if (!state) return;\n\n  if (state.epoch !== epoch) return;\n\n  state.pendingCleanup.set(cleanup.markerToken, cleanup);\n  state.physicallyQuiescent = false;\n  invalidateQueuedOperations(state, epoch);\n\n  // Advance the ownership epoch BEFORE the timeout error is surfaced. Any\n  // completion from this operation is now stale. A retry is gated by the\n  // independent in-box cleanup proof, not by an SDK promise that may hang.\n  state.epoch += 1;\n  const pending = [...state.inFlight];\n  const drain = boundedProviderDrain(pending);\n  state.drain = state.drain ? Promise.all([state.drain, drain]).then(() => undefined) : drain;\n  // A provider transport can retain an unresolved promise forever. Once the\n  // bounded advisory window ends, release those promises from the registry;\n  // the tombstone and in-box process-group proof remain the authoritative fence.\n  void drain.then(() => {\n    for (const promise of pending) state.inFlight.delete(promise);\n  });\n}\n\nfunction assertCurrentOperation(state: DisplayStackOperationState | null, epoch: number): void {\n  if (state && state.epoch !== epoch) throw new DisplayStackOperationFencedError();\n}\n\nasync function beforeDeadline<T>(\n  promise: Promise<T>,\n  deadline: number,\n  now: () => number = monotonicNow,\n): Promise<T> {\n  const remainingMs = deadline - now();\n  if (remainingMs <= 0) throw new DisplayStackWallTimeoutError();\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  try {\n    return await Promise.race([\n      promise,\n      new Promise<T>((_resolve, reject) => {\n        timer = setTimeout(() => reject(new DisplayStackWallTimeoutError()), remainingMs);\n        timer.unref?.();\n      }),\n    ]);\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n}\n\nfunction displayStackCleanupCommand(markerPath: string, markerToken: string): string {\n  const marker = shellQuote(markerPath);\n  const token = shellQuote(markerToken);\n  // The launcher writes pid, process-group id, /proc start time, and a random\n  // token before it starts the lock-owning command. The start-time check keeps\n  // a stale marker from killing an unrelated process after PID reuse. The\n  // process group is the authority: a provider session can disappear while\n  // descendants of the shell continue to hold the display lock.\n  const script =\n    `marker=${marker}; token=${token}; ` +\n    `cancel=\"$marker.cancelled\"; ` +\n    `: >\"$cancel\" || { echo \"OPENGENI_DISPLAY_CLEANUP status=invalid\"; exit 75; }; ` +\n    `if [ ! -r \"$marker\" ]; then echo \"OPENGENI_DISPLAY_CLEANUP status=stopped\"; exit 0; fi; ` +\n    `read -r pid pgid start actual <\"$marker\" || { echo \"OPENGENI_DISPLAY_CLEANUP status=invalid\"; exit 75; }; ` +\n    `[ \"$actual\" = \"$token\" ] || { echo \"OPENGENI_DISPLAY_CLEANUP status=invalid\"; exit 75; }; ` +\n    `case \"$pid\" in ''|*[!0-9]*) echo \"OPENGENI_DISPLAY_CLEANUP status=invalid\"; exit 75;; esac; ` +\n    `case \"$pgid\" in ''|*[!0-9]*) echo \"OPENGENI_DISPLAY_CLEANUP status=invalid\"; exit 75;; esac; ` +\n    `case \"$start\" in ''|*[!0-9]*) echo \"OPENGENI_DISPLAY_CLEANUP status=invalid\"; exit 75;; esac; ` +\n    `current=$(awk '{print $22}' \"/proc/$pid/stat\" 2>/dev/null || true); ` +\n    `if [ -z \"$current\" ] || [ \"$current\" != \"$start\" ]; then rm -f \"$marker\"; echo \"OPENGENI_DISPLAY_CLEANUP status=stopped\"; exit 0; fi; ` +\n    `kill -TERM -- \"-$pgid\" 2>/dev/null || true; ` +\n    `for i in $(seq 1 10); do ` +\n    `if ! kill -0 -- \"-$pgid\" 2>/dev/null; then rm -f \"$marker\"; echo \"OPENGENI_DISPLAY_CLEANUP status=stopped\"; exit 0; fi; ` +\n    `sleep 0.05; done; ` +\n    `kill -KILL -- \"-$pgid\" 2>/dev/null || true; ` +\n    `for i in $(seq 1 20); do ` +\n    `if ! kill -0 -- \"-$pgid\" 2>/dev/null; then rm -f \"$marker\"; echo \"OPENGENI_DISPLAY_CLEANUP status=stopped\"; exit 0; fi; ` +\n    `sleep 0.05; done; ` +\n    `echo \"OPENGENI_DISPLAY_CLEANUP status=alive\"; exit 75`;\n  return `timeout --signal=TERM --kill-after=0.2s 1.5s bash -c ${shellQuote(script)}`;\n}\n\nasync function runProviderCommandToDeadline(\n  session: ExecCapableSession,\n  command: string,\n  deadline: number,\n): Promise<ExecResultLike | string> {\n  const controller = new AbortController();\n  let result: ExecResultLike | string = await beforeDeadline(\n    Promise.resolve(\n      typeof session.exec === \"function\"\n        ? session.exec({\n            cmd: command,\n            yieldTimeMs: Math.min(500, DISPLAY_STACK_CLEANUP_CALL_MS),\n            maxOutputTokens: 4_000,\n            signal: controller.signal,\n          })\n        : session.execCommand!({\n            cmd: command,\n            yieldTimeMs: Math.min(500, DISPLAY_STACK_CLEANUP_CALL_MS),\n            maxOutputTokens: 4_000,\n            signal: controller.signal,\n          }),\n    ),\n    deadline,\n  );\n\n  let providerSessionId = execResultSessionId(result);\n  while (providerSessionId !== null) {\n    if (typeof session.writeStdin !== \"function\") {\n      throw new Error(\"display cleanup provider yielded without writeStdin\");\n    }\n    const remainingMs = deadline - monotonicNow();\n    if (remainingMs <= 1) throw new DisplayStackWallTimeoutError();\n    result = await beforeDeadline(\n      session.writeStdin({\n        sessionId: providerSessionId,\n        chars: \"\",\n        yieldTimeMs: Math.max(1, Math.min(250, remainingMs - 1)),\n        maxOutputTokens: 4_000,\n        signal: controller.signal,\n      }),\n      deadline,\n    );\n    providerSessionId = execResultSessionId(result);\n  }\n  return result;\n}\n\nasync function interruptProviderProcess(\n  session: ExecCapableSession,\n  providerSessionId: number | null,\n  deadline: number,\n): Promise<void> {\n  if (providerSessionId === null || typeof session.writeStdin !== \"function\") return;\n  try {\n    // This is an advisory provider-level interrupt. The marker/PGID cleanup\n    // below remains authoritative because the Agents SDK 0.14.3 Modal adapter ignores AbortSignal.\n    await beforeDeadline(\n      session.writeStdin({\n        sessionId: providerSessionId,\n        chars: \"\\u0003\",\n        yieldTimeMs: 100,\n        maxOutputTokens: 256,\n      }),\n      deadline,\n    );\n  } catch {\n    // A hung provider write is not evidence either way; in-box cleanup decides.\n  }\n}\n\nasync function cleanupDisplayStackProcess(\n  session: ExecCapableSession,\n  pending: PendingDisplayStackCleanup,\n  deadline: number,\n): Promise<boolean> {\n  try {\n    const result = await runProviderCommandToDeadline(\n      session,\n      displayStackCleanupCommand(pending.markerPath, pending.markerToken),\n      deadline,\n    );\n    const output = execResultOutput(result);\n    const status = /OPENGENI_DISPLAY_CLEANUP status=(stopped|absent|alive|invalid)/u.exec(\n      output,\n    )?.[1];\n    return status === \"stopped\";\n  } catch {\n    return false;\n  }\n}\n\nasync function reconcilePendingCleanup(\n  session: ExecCapableSession,\n  state: DisplayStackOperationState,\n  deadline: number,\n): Promise<boolean> {\n  const entries = [...state.pendingCleanup.values()];\n  if (entries.length === 0) {\n    state.physicallyQuiescent = true;\n    return true;\n  }\n  const results = await Promise.all(\n    entries.map(async (pending) => ({\n      pending,\n      stopped: await cleanupDisplayStackProcess(session, pending, deadline),\n    })),\n  );\n  for (const { pending, stopped } of results) {\n    if (stopped) state.pendingCleanup.delete(pending.markerToken);\n  }\n  state.physicallyQuiescent = state.pendingCleanup.size === 0;\n  return state.physicallyQuiescent;\n}\n\nfunction requestId(): string {\n  return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;\n}\n\nfunction telemetryReporter(\n  options: EnsureDisplayStackOptions,\n  started: number,\n  now: () => number = monotonicNow,\n) {\n  const id = requestId();\n  const context = options.telemetryContext;\n  const sink =\n    options.onTelemetry ??\n    (context\n      ? (event: DisplayStackTelemetryEvent) =>\n          console.info(`[display-stack] ${JSON.stringify(event)}`)\n      : undefined);\n  const emittedSandboxStages = new Set<string>();\n\n  const emit = (\n    stage: string,\n    status: DisplayStackTelemetryStatus,\n    fields: {\n      source?: \"host\" | \"sandbox\";\n      elapsedMs?: number;\n      classification?: DisplayStackClassification;\n      providerSessionId?: number;\n    } = {},\n  ) => {\n    if (!sink) return;\n    const event: DisplayStackTelemetryEvent = {\n      type: \"display_stack.stage\",\n      requestId: id,\n      stage,\n      status,\n      elapsedMs: fields.elapsedMs ?? now() - started,\n      source: fields.source ?? \"host\",\n      classification: fields.classification ?? \"unknown\",\n      callerKind: context?.callerKind ?? \"unknown\",\n      ...(context?.sandboxId ? { sandboxId: context.sandboxId } : {}),\n      ...(context?.leaseEpoch !== undefined ? { leaseEpoch: context.leaseEpoch } : {}),\n      ...(fields.providerSessionId !== undefined\n        ? { providerSessionId: fields.providerSessionId }\n        : {}),\n    };\n    try {\n      void Promise.resolve(sink(event)).catch(() => undefined);\n    } catch {\n      // Telemetry must never affect display readiness.\n    }\n  };\n\n  const emitSandboxStages = (output: string) => {\n    for (const match of output.matchAll(\n      /OPENGENI_(?:DISPLAY|DESKTOP)_STAGE stage=([a-z0-9_]+) elapsed_ms=(\\d+)(?: classification=(cold|already_ready|contention|unknown))?/gu,\n    )) {\n      const [line, stage, elapsed, classification] = match;\n      if (!stage || !elapsed || emittedSandboxStages.has(line)) continue;\n      emittedSandboxStages.add(line);\n      emit(stage, \"completed\", {\n        source: \"sandbox\",\n        elapsedMs: Number(elapsed),\n        classification: (classification as DisplayStackClassification | undefined) ?? \"unknown\",\n      });\n    }\n  };\n\n  return { emit, emitSandboxStages };\n}\n\n// Parse the exit code the up-script signals via its trailing marker. When we ran\n// through `exec` we have the real exitCode; when we only had `execCommand` (a\n// bare string), we infer success from the OPENGENI_DESKTOP_UP marker and infer\n// the failing stage from the stage-failure message the script prints to stderr.\nfunction inferExitFromOutput(output: string): number {\n  if (/OPENGENI_DISPLAY_TIMEOUT/.test(output)) {\n    return 124;\n  }\n  if (/OPENGENI_DESKTOP_LOCK_TIMEOUT/.test(output)) {\n    return 15;\n  }\n  // Check the PAINTABLE-FRAME failure FIRST: on that path the up-script already\n  // printed OPENGENI_DESKTOP_UP (bring-up succeeded) and THEN the paint gate failed,\n  // so both markers are present — the NOT_PAINTING one is the authoritative outcome.\n  // (Modal is execCommand-only, so this string-inference path is the live one.)\n  if (/OPENGENI_DESKTOP_NOT_PAINTING/.test(output)) {\n    return 14;\n  }\n  if (/OPENGENI_DESKTOP_UP\\b/.test(output)) {\n    return 0;\n  }\n  if (/Xvfb failed to come up/.test(output)) {\n    return 11;\n  }\n  if (/x11vnc failed on/.test(output)) {\n    return 12;\n  }\n  if (/websockify failed on/.test(output)) {\n    return 13;\n  }\n  return -1;\n}\n\n/**\n * Idempotently bring up the desktop display stack on the live box. Safe to call\n * N times (the in-box flock + the up-script's PID guards make a second call a\n * no-op). Resolves with the exposed port + geometry on success; throws\n * `DisplayStackError` on a stage failure and `DisplayStackUnsupportedError` when\n * the session cannot run commands.\n *\n * `session` is the externally-owned provider session (the `established.session`\n * from establishSandboxSessionFromEnvelope, or any SandboxSessionLike). We\n * prefer `session.exec` (structured `{exitCode}`) and fall back to\n * `session.execCommand` (bare string), inferring success from the up-script's\n * marker line in the fallback case.\n */\nexport async function ensureDisplayStack(\n  session: unknown,\n  options: EnsureDisplayStackOptions = {},\n): Promise<EnsureDisplayStackResult> {\n  const s = session as ExecCapableSession;\n  if (typeof s?.exec !== \"function\" && typeof s?.execCommand !== \"function\") {\n    throw new DisplayStackUnsupportedError(\n      \"provider session cannot run commands (no exec/execCommand) — desktop tier unavailable\",\n    );\n  }\n\n  const geometry = options.geometry ?? DEFAULT_DESKTOP_GEOMETRY;\n  const port = options.port ?? DESKTOP_STREAM_PORT;\n  const timeoutMs = options.timeoutMs ?? DISPLAY_STACK_TIMEOUT_MS;\n  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {\n    throw new RangeError(\"ensureDisplayStack timeoutMs must be a positive finite number\");\n  }\n  const started = monotonicNow();\n  const deadline = started + timeoutMs;\n  const telemetry = telemetryReporter(options, started, monotonicNow);\n  const operationToken = requestId();\n  const markerPath = `/tmp/opengeni-desktop/display-stack-${operationToken}.pid`;\n  const cmd = boundedDisplayStackCommand(\n    buildDisplayStackScript({ geometry, port }),\n    timeoutMs,\n    markerPath,\n    operationToken,\n  );\n  const outputParts: string[] = [];\n  const state = operationState(session, options);\n  let release: (() => void) | undefined;\n  if (state) {\n    try {\n      release = await acquireOperation(state, deadline);\n    } catch (error) {\n      if (\n        error instanceof DisplayStackWallTimeoutError ||\n        error instanceof DisplayStackOperationFencedError\n      ) {\n        throw new DisplayStackError(\n          124,\n          \"OPENGENI_DISPLAY_TIMEOUT display operation admission was fenced\",\n        );\n      }\n      throw error;\n    }\n  }\n\n  try {\n    if (state && !state.physicallyQuiescent) {\n      const cleanupDeadline = monotonicNow() + DISPLAY_STACK_CLEANUP_CALL_MS;\n      const quiesced = await reconcilePendingCleanup(s, state, cleanupDeadline);\n      if (!quiesced) {\n        // Fail closed. A new session wrapper may share this physical sandbox,\n        // but without a positive marker/PGID proof it must not issue overlapping\n        // display work merely because the old SDK promise remains unresolved.\n        throw new DisplayStackError(\n          124,\n          \"OPENGENI_DISPLAY_TIMEOUT physical cleanup is still pending; retry is fenced\",\n        );\n      }\n    }\n    const epoch = state?.epoch ?? 0;\n    const abortController = new AbortController();\n    let activeProviderSessionId: number | null = null;\n    telemetry.emit(\"request_entry\", \"started\");\n    telemetry.emit(\"exec_issued\", \"started\");\n\n    try {\n      const initialYieldMs = Math.max(1, Math.min(DISPLAY_STACK_PROVIDER_YIELD_MS, timeoutMs - 1));\n      const initialExec: Promise<ExecResultLike | string> = trackProviderCall<\n        ExecResultLike | string\n      >(\n        state,\n        Promise.resolve(\n          typeof s.exec === \"function\"\n            ? s.exec({\n                cmd,\n                yieldTimeMs: initialYieldMs,\n                maxOutputTokens: 20_000,\n                signal: abortController.signal,\n              })\n            : s.execCommand!({\n                cmd,\n                yieldTimeMs: initialYieldMs,\n                maxOutputTokens: 20_000,\n                signal: abortController.signal,\n              }),\n        ),\n      );\n      let result: ExecResultLike | string = await beforeDeadline(\n        initialExec,\n        deadline,\n        monotonicNow,\n      );\n      assertCurrentOperation(state, epoch);\n      let chunk = execResultOutput(result);\n      outputParts.push(chunk);\n      telemetry.emitSandboxStages(chunk);\n      telemetry.emit(\"provider_first_result\", \"completed\");\n\n      let providerSessionId = execResultSessionId(result);\n      activeProviderSessionId = providerSessionId;\n      while (providerSessionId !== null) {\n        telemetry.emit(\"provider_yield\", \"waiting\", { providerSessionId });\n        if (typeof s.writeStdin !== \"function\") {\n          throw new DisplayStackError(\n            -1,\n            `${outputParts.join(\"\\n\")}\\nprovider yielded process ${providerSessionId} but exposes no writeStdin poll surface`,\n          );\n        }\n        assertCurrentOperation(state, epoch);\n        const remainingMs = deadline - monotonicNow();\n        if (remainingMs <= 1) throw new DisplayStackWallTimeoutError();\n        const pollYieldMs = Math.max(1, Math.min(DISPLAY_STACK_PROVIDER_POLL_MS, remainingMs - 1));\n        result = await beforeDeadline(\n          trackProviderCall(\n            state,\n            s.writeStdin({\n              sessionId: providerSessionId,\n              chars: \"\",\n              yieldTimeMs: pollYieldMs,\n              maxOutputTokens: 20_000,\n              signal: abortController.signal,\n            }),\n          ),\n          deadline,\n          monotonicNow,\n        );\n        assertCurrentOperation(state, epoch);\n        chunk = execResultOutput(result);\n        outputParts.push(chunk);\n        telemetry.emitSandboxStages(chunk);\n        providerSessionId = execResultSessionId(result);\n        activeProviderSessionId = providerSessionId;\n      }\n\n      const output = outputParts.join(\"\\n\");\n      const exitCode = execResultExitCode(result) ?? inferExitFromOutput(output);\n      telemetry.emit(\"process_complete\", exitCode === 0 ? \"completed\" : \"failed\");\n      if (exitCode !== 0) {\n        throw new DisplayStackError(exitCode, output);\n      }\n\n      const marker = (output.match(/OPENGENI_DESKTOP_UP[^\\n]*/) ?? [\"\"])[0];\n      telemetry.emit(\"readiness_complete\", \"completed\");\n      return { port, geometry, marker };\n    } catch (error) {\n      if (\n        error instanceof DisplayStackWallTimeoutError ||\n        error instanceof DisplayStackOperationFencedError\n      ) {\n        const pendingCleanup: PendingDisplayStackCleanup = {\n          markerPath,\n          markerToken: operationToken,\n        };\n        fenceOperation(state, epoch, abortController, pendingCleanup);\n        const cleanupDeadline = monotonicNow() + DISPLAY_STACK_CLEANUP_CALL_MS;\n        telemetry.emit(\"process_cleanup\", \"started\");\n        await interruptProviderProcess(\n          s,\n          activeProviderSessionId,\n          Math.min(cleanupDeadline, monotonicNow() + 50),\n        );\n        let quiesced = false;\n        if (state) {\n          quiesced = await reconcilePendingCleanup(s, state, cleanupDeadline);\n          if (!quiesced) {\n            await waitForFencedOperation(\n              state,\n              Math.min(cleanupDeadline, monotonicNow() + DISPLAY_STACK_DRAIN_GRACE_MS),\n            );\n          }\n        } else {\n          quiesced = await cleanupDisplayStackProcess(s, pendingCleanup, cleanupDeadline);\n        }\n        telemetry.emit(\"process_cleanup\", quiesced ? \"completed\" : \"failed\");\n        const output = `${outputParts.join(\"\\n\")}\\nOPENGENI_DISPLAY_TIMEOUT wall_ms=${timeoutMs}`;\n        telemetry.emit(\"wall_deadline\", \"failed\");\n        throw new DisplayStackError(124, output);\n      }\n      telemetry.emit(\"request_failed\", \"failed\");\n      throw error;\n    }\n  } finally {\n    release?.();\n  }\n}\n\n/** Tear the stack down (down-script). Best-effort; never throws on a missing\n *  process. Used by the geometry-change restart and cold/drain. */\nexport async function tearDownDisplayStack(session: unknown): Promise<void> {\n  const s = session as ExecCapableSession;\n  if (typeof s?.exec === \"function\") {\n    await s.exec({ cmd: \"opengeni-desktop-down\", yieldTimeMs: 10_000, maxOutputTokens: 4_000 });\n    return;\n  }\n  if (typeof s?.execCommand === \"function\") {\n    await s.execCommand({\n      cmd: \"opengeni-desktop-down\",\n      yieldTimeMs: 10_000,\n      maxOutputTokens: 4_000,\n    });\n  }\n}\n","// @opengeni/runtime/sandbox — the REAL PTY terminal-server launcher (P5.t).\n//\n// The agent-loop-free home for `ensureTerminalServer`: the exec-launched,\n// flock-idempotent procedure that brings up the ttyd PTY-over-websocket server\n// (a live PTY-backed `bash -l` per ws client, listening on 7681) on a live,\n// externally-owned box. It is the SYMMETRIC TWIN of ensureDisplayStack (the\n// Channel-B pixel stack) — same exec/execCommand channel (NOT a container CMD)\n// so it re-establishes after a snapshot rollover / box re-election, same flock\n// idempotency so a second concurrent caller (the API viewer op + the agent turn,\n// both racing after a rollover) serializes and no-ops when ttyd is already up.\n//\n// WHY A REAL PTY OVER THE TUNNEL (not the old ptyWrite-over-HTTP): the stateless\n// HTTP plane builds a fresh provider session per call, so the in-memory live-PTY\n// process handle (Modal's per-call activeProcesses Map) is gone by the next\n// write (\"session not found: 1\"). ttyd holds the live PTY in-box and streams it\n// over the SAME Modal raw-TLS tunnel the desktop noVNC already uses, gated by the\n// SAME scoped stream-token mechanism (the server records the token; the boundary\n// is the unguessable short-TTL tunnel URL + the recorded token — no in-box gate).\n//\n// It lives under @opengeni/runtime/sandbox so the API-direct control plane\n// (apps/api) and the worker (apps/worker) both pull it from the same single\n// agent-loop-free leaf.\n\nimport { TERMINAL_STREAM_PORT } from \"@opengeni/contracts\";\n\n// Re-export the canonical terminal port so callers (exposeStreamPort, the API\n// mint) pull the single source of truth (contracts) from this leaf.\nexport { TERMINAL_STREAM_PORT };\n\n// The ttyd launch is bounded by the readiness gate inside the up-script (50 *\n// 0.1s = ~5s) PLUS first-boot warm-up on a cold gVisor box. 60s gives headroom\n// over the observed warm path (~1-2s; ttyd is a single static binary) without\n// masking a genuine wedge. Symmetric with DISPLAY_STACK_TIMEOUT_MS.\nexport const TERMINAL_SERVER_TIMEOUT_MS = 60_000;\n\n/** Thrown when the ttyd launch failed inside the box. exitCode 14 maps to the\n *  up-script's \"ttyd failed to come up\" stage; any other non-zero is unknown.\n *  Degradation is surfaced as a value to clients by the caller (Terminal\n *  transport falls back to sse-events / null); this error is for diagnostics. */\nexport class TerminalServerError extends Error {\n  readonly exitCode: number;\n  readonly stage: \"ttyd\" | \"unknown\";\n\n  constructor(exitCode: number, output: string) {\n    const stage = exitCode === 14 ? \"ttyd\" : \"unknown\";\n    super(\n      `terminal server failed at stage \"${stage}\" (exit ${exitCode})${output ? `:\\n${output}` : \"\"}`,\n    );\n    this.name = \"TerminalServerError\";\n    this.exitCode = exitCode;\n    this.stage = stage;\n  }\n}\n\n/** Thrown when the provider session cannot run commands (a headless-only backend\n *  with neither `exec` nor `execCommand`). The terminal tier degrades to the\n *  Channel-A sse-events firehose — the caller maps this to a `transport:null`\n *  pty-ws (the read-only firehose still works). */\nexport class TerminalServerUnsupportedError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"TerminalServerUnsupportedError\";\n  }\n}\n\n// The structural slice of a provider session we need: run a command (preferring\n// `exec` for the structured exit code, falling back to `execCommand`).\ntype ExecResultLike = {\n  output?: string;\n  stdout?: string;\n  stderr?: string;\n  exitCode?: number | null;\n};\ntype ExecCapableSession = {\n  exec?: (args: {\n    cmd: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n  }) => Promise<ExecResultLike>;\n  execCommand?: (args: {\n    cmd: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n  }) => Promise<string>;\n};\n\nexport type EnsureTerminalServerOptions = {\n  /** The exposed terminal port; defaults to 7681 (ttyd default). */\n  port?: number;\n  /** Per-exec timeout; defaults to TERMINAL_SERVER_TIMEOUT_MS. */\n  timeoutMs?: number;\n};\n\nexport type EnsureTerminalServerResult = {\n  /** The exposed port ttyd listens on (PTY-over-websocket). */\n  port: number;\n  /** The raw `OPENGENI_TERMINAL_UP …` marker line, for diagnostics. Never\n   *  surfaced to clients. */\n  marker: string;\n};\n\n/**\n * Build the shell command that runs the idempotent up-script under an in-box\n * `flock`. The script is shipped in the image at /usr/local/bin/opengeni-terminal-up\n * (the canonical desktop image, alongside opengeni-desktop-up); we set the port\n * env and wrap the call in `flock` so two concurrent ensureTerminalServer callers\n * (the API viewer op + the agent turn, both racing after a rollover) serialize\n * without a double launch. The up-script's own curl readiness probe makes the\n * second call a no-op.\n *\n * Exported (pure, side-effect-free) so the ensureTerminalServer unit test can\n * assert the exact command sequence without a live box. Mirrors\n * buildDisplayStackScript. A ttyd process is sandbox-group-global, not\n * Opengeni-session-specific, so it must never inherit the box-global legacy\n * Codemode pointer. Session-scoped interactive exec/PTY uses Channel A; the\n * shared ttyd shell fails closed for Codemode until that stream plane itself is\n * session-isolated.\n */\nexport function buildTerminalServerScript(options: EnsureTerminalServerOptions = {}): string {\n  const port = options.port ?? TERMINAL_STREAM_PORT;\n  // flock -w bounds the wait so a wedged holder can't deadlock the caller; the\n  // up-script's curl probe ALSO makes the launch idempotent (belt + braces) so\n  // this works even against an older image that predates the wrapper.\n  return (\n    `mkdir -p /tmp/opengeni-terminal && ` +\n    // --close prevents the detached ttyd child from inheriting the lock fd and\n    // pinning this lock for its entire lifetime. The flock parent still holds\n    // the lock until opengeni-terminal-up exits.\n    `flock -w 30 --close /tmp/opengeni-terminal/up.outer.lock ` +\n    `env TERMINAL_PORT=${port} OPENGENI_CODEMODE_TOKEN_FILE=/dev/null opengeni-terminal-up`\n  );\n}\n\nfunction execResultOutput(result: ExecResultLike | string): string {\n  if (typeof result === \"string\") {\n    return result;\n  }\n  return [result.output, result.stderr, result.stdout]\n    .filter((v): v is string => typeof v === \"string\" && v.length > 0)\n    .join(\"\\n\");\n}\n\nfunction execResultExitCode(result: ExecResultLike | string): number | null {\n  if (typeof result === \"string\") {\n    return null; // execCommand returns a bare string — no exit code available.\n  }\n  return typeof result.exitCode === \"number\" ? result.exitCode : null;\n}\n\n// Parse the exit code the up-script signals via its trailing marker. When we ran\n// through `exec` we have the real exitCode; when we only had `execCommand` (a\n// bare string), we infer success from the OPENGENI_TERMINAL_UP marker and infer\n// the failing stage from the stage-failure message the script prints to stderr.\n// Mirrors inferExitFromOutput (display-stack).\nfunction inferExitFromOutput(output: string): number {\n  if (/OPENGENI_TERMINAL_UP\\b/.test(output)) {\n    return 0;\n  }\n  if (/ttyd failed to come up/.test(output)) {\n    return 14;\n  }\n  return -1;\n}\n\n/**\n * Idempotently bring up the ttyd PTY-over-websocket server on the live box. Safe\n * to call N times (the in-box flock + the up-script's curl readiness probe make a\n * second call a no-op). Resolves with the exposed port on success; throws\n * `TerminalServerError` on a launch failure and `TerminalServerUnsupportedError`\n * when the session cannot run commands.\n *\n * `session` is the externally-owned provider session (the `established.session`\n * from establishSandboxSessionFromEnvelope, or any SandboxSessionLike). We prefer\n * `session.exec` (structured `{exitCode}`) and fall back to `session.execCommand`\n * (bare string), inferring success from the up-script's marker line in the\n * fallback case. Mirrors ensureDisplayStack exactly.\n */\nexport async function ensureTerminalServer(\n  session: unknown,\n  options: EnsureTerminalServerOptions = {},\n): Promise<EnsureTerminalServerResult> {\n  const s = session as ExecCapableSession;\n  if (typeof s?.exec !== \"function\" && typeof s?.execCommand !== \"function\") {\n    throw new TerminalServerUnsupportedError(\n      \"provider session cannot run commands (no exec/execCommand) — terminal pty-ws unavailable\",\n    );\n  }\n\n  const port = options.port ?? TERMINAL_STREAM_PORT;\n  const timeoutMs = options.timeoutMs ?? TERMINAL_SERVER_TIMEOUT_MS;\n  const cmd = buildTerminalServerScript({ port });\n\n  const result =\n    typeof s.exec === \"function\"\n      ? await s.exec({ cmd, yieldTimeMs: timeoutMs, maxOutputTokens: 20_000 })\n      : await s.execCommand!({ cmd, yieldTimeMs: timeoutMs, maxOutputTokens: 20_000 });\n\n  const output = execResultOutput(result);\n  const exitCode = execResultExitCode(result) ?? inferExitFromOutput(output);\n\n  if (exitCode !== 0) {\n    throw new TerminalServerError(exitCode, output);\n  }\n\n  const marker = (output.match(/OPENGENI_TERMINAL_UP[^\\n]*/) ?? [\"\"])[0];\n  return { port, marker };\n}\n\n/** Tear the terminal server down (down-script). Best-effort; never throws on a\n *  missing process. Mirrors tearDownDisplayStack. */\nexport async function tearDownTerminalServer(session: unknown): Promise<void> {\n  const s = session as ExecCapableSession;\n  if (typeof s?.exec === \"function\") {\n    await s.exec({ cmd: \"opengeni-terminal-down\", yieldTimeMs: 10_000, maxOutputTokens: 4_000 });\n    return;\n  }\n  if (typeof s?.execCommand === \"function\") {\n    await s.execCommand({\n      cmd: \"opengeni-terminal-down\",\n      yieldTimeMs: 10_000,\n      maxOutputTokens: 4_000,\n    });\n  }\n}\n","import { posix as posixPath } from \"node:path\";\nimport { BROWSER_CONTROL_PORT } from \"@opengeni/contracts\";\n\nexport { BROWSER_CONTROL_PORT };\n\nexport const BROWSER_CONTROL_SERVER_TIMEOUT_MS = 60_000;\nexport const BROWSER_CONTROL_STATE_DIRECTORY = \"/tmp/opengeni-browserd/state\";\nexport const BROWSER_CONTROL_SERVER_BIN = \"/usr/local/bin/opengeni-browserd-up\";\nexport const BROWSER_CONTROL_SERVER_DOWN_BIN = \"/usr/local/bin/opengeni-browserd-down\";\n\nexport class BrowserControlServerError extends Error {\n  readonly exitCode: number;\n  readonly stage: \"startup\" | \"port_conflict\" | \"engine_unavailable\" | \"unknown\";\n\n  constructor(exitCode: number, output: string) {\n    const stage = classifyBrowserControlStage(exitCode, output);\n    super(\n      `browser control server failed at stage \"${stage}\" (exit ${exitCode})${output ? `:\\n${output}` : \"\"}`,\n    );\n    this.name = \"BrowserControlServerError\";\n    this.exitCode = exitCode;\n    this.stage = stage;\n  }\n}\n\nexport class BrowserControlServerUnsupportedError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"BrowserControlServerUnsupportedError\";\n  }\n}\n\ntype ExecResultLike = {\n  output?: string;\n  stdout?: string;\n  stderr?: string;\n  exitCode?: number | null;\n};\n\ntype ExecCapableSession = {\n  exec?: (args: {\n    cmd: string;\n    workdir?: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n  }) => Promise<ExecResultLike>;\n  execCommand?: (args: {\n    cmd: string;\n    workdir?: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n  }) => Promise<string>;\n};\n\n// Image-backed controller commands use absolute private paths under /tmp, but\n// managed sandbox exec confines `workdir` to the canonical workspace root.\n// Keep the cwd stable without asking the provider to validate /tmp as a\n// workspace path.\nconst PLACEMENT_CONTROLLER_WORKDIR = \"/workspace\";\n\nexport type EnsureBrowserControlServerOptions = {\n  port?: number;\n  timeoutMs?: number;\n  adminTokenFile: string;\n  allowedOrigins?: readonly string[];\n};\n\nexport type EnsureBrowserControlServerResult = {\n  port: number;\n  marker: string;\n};\n\nexport function buildBrowserControlServerScript(\n  options: Pick<EnsureBrowserControlServerOptions, \"adminTokenFile\"> &\n    Partial<Pick<EnsureBrowserControlServerOptions, \"port\" | \"allowedOrigins\">>,\n): string {\n  const port = boundedPort(options.port ?? BROWSER_CONTROL_PORT);\n  const tokenFile = absolutePath(options.adminTokenFile, \"browser controller admin token file\");\n  const allowedOrigins = normalizeOrigins(options.allowedOrigins ?? []);\n  return [\n    \"mkdir -p /tmp/opengeni-browserd &&\",\n    `if ! test -x ${BROWSER_CONTROL_SERVER_BIN}; then echo 'opengeni-browserd-up is not installed on this sandbox image' >&2; exit 16; fi &&`,\n    \"flock -w 30 --close /tmp/opengeni-browserd/up.outer.lock\",\n    `env OPENGENI_BROWSERD_PORT=${port}`,\n    `OPENGENI_BROWSERD_ROOT=${shellQuote(BROWSER_CONTROL_STATE_DIRECTORY)}`,\n    `OPENGENI_BROWSERD_ADMIN_TOKEN_FILE=${shellQuote(tokenFile)}`,\n    `OPENGENI_BROWSERD_ALLOWED_ORIGINS=${shellQuote(allowedOrigins.join(\",\"))}`,\n    \"OPENGENI_CODEMODE_TOKEN_FILE=/dev/null\",\n    BROWSER_CONTROL_SERVER_BIN,\n  ].join(\" \");\n}\n\nexport async function ensureBrowserControlServer(\n  session: unknown,\n  options: EnsureBrowserControlServerOptions,\n): Promise<EnsureBrowserControlServerResult> {\n  const target = session as ExecCapableSession;\n  if (typeof target?.exec !== \"function\" && typeof target?.execCommand !== \"function\") {\n    throw new BrowserControlServerUnsupportedError(\n      \"provider session cannot run commands (no exec/execCommand) — browser control unavailable\",\n    );\n  }\n  const port = boundedPort(options.port ?? BROWSER_CONTROL_PORT);\n  const timeoutMs = boundedTimeout(options.timeoutMs ?? BROWSER_CONTROL_SERVER_TIMEOUT_MS);\n  const cmd = buildBrowserControlServerScript({\n    port,\n    adminTokenFile: options.adminTokenFile,\n    ...(options.allowedOrigins ? { allowedOrigins: options.allowedOrigins } : {}),\n  });\n  const result = target.exec\n    ? await target.exec({\n        cmd,\n        workdir: PLACEMENT_CONTROLLER_WORKDIR,\n        yieldTimeMs: timeoutMs,\n        maxOutputTokens: 4_000,\n      })\n    : await target.execCommand!({\n        cmd,\n        workdir: PLACEMENT_CONTROLLER_WORKDIR,\n        yieldTimeMs: timeoutMs,\n        maxOutputTokens: 4_000,\n      });\n  const output = outputOf(result);\n  const exitCode = exitCodeOf(result) ?? inferExitCode(output);\n  if (exitCode !== 0) throw new BrowserControlServerError(exitCode, output);\n  const marker = (output.match(/OPENGENI_BROWSERD_UP[^\\n]*/) ?? [\"\"])[0];\n  if (!marker) {\n    throw new BrowserControlServerError(\n      14,\n      output || \"browser controller did not emit its readiness marker\",\n    );\n  }\n  return { port, marker };\n}\n\nexport async function tearDownBrowserControlServer(session: unknown): Promise<void> {\n  const target = session as ExecCapableSession;\n  if (target?.exec) {\n    await target.exec({\n      cmd: BROWSER_CONTROL_SERVER_DOWN_BIN,\n      workdir: PLACEMENT_CONTROLLER_WORKDIR,\n      yieldTimeMs: 15_000,\n      maxOutputTokens: 4_000,\n    });\n  } else if (target?.execCommand) {\n    await target.execCommand({\n      cmd: BROWSER_CONTROL_SERVER_DOWN_BIN,\n      workdir: PLACEMENT_CONTROLLER_WORKDIR,\n      yieldTimeMs: 15_000,\n      maxOutputTokens: 4_000,\n    });\n  }\n}\n\nfunction outputOf(result: ExecResultLike | string): string {\n  if (typeof result === \"string\") return result;\n  return [result.output, result.stderr, result.stdout]\n    .filter((value): value is string => typeof value === \"string\" && value.length > 0)\n    .join(\"\\n\");\n}\n\nfunction exitCodeOf(result: ExecResultLike | string): number | null {\n  return typeof result === \"string\" || typeof result.exitCode !== \"number\" ? null : result.exitCode;\n}\n\nfunction classifyBrowserControlStage(\n  exitCode: number,\n  output: string,\n): BrowserControlServerError[\"stage\"] {\n  if (exitCode === 14) return \"startup\";\n  if (exitCode === 15) return \"port_conflict\";\n  if (exitCode === 16 || isMissingBrowserControlServer(exitCode, output)) {\n    return \"engine_unavailable\";\n  }\n  return \"unknown\";\n}\n\nfunction isMissingBrowserControlServer(exitCode: number, output: string): boolean {\n  if (exitCode === 127) return true;\n  return /opengeni-browserd-up[^\\n]*No such file or directory|opengeni-browserd-up is not installed on this sandbox image/u.test(\n    output,\n  );\n}\n\nfunction inferExitCode(output: string): number {\n  if (/OPENGENI_BROWSERD_UP\\b/u.test(output)) return 0;\n  if (/occupied by an unmanaged process/u.test(output)) return 15;\n  if (/no supported Chromium engine/u.test(output) || isMissingBrowserControlServer(-1, output)) {\n    return 16;\n  }\n  if (/exited during startup|failed to become ready/u.test(output)) return 14;\n  return -1;\n}\n\nfunction boundedPort(value: number): number {\n  if (!Number.isSafeInteger(value) || value < 1 || value > 65_535) {\n    throw new RangeError(\"browser controller port is invalid\");\n  }\n  return value;\n}\n\nfunction boundedTimeout(value: number): number {\n  if (!Number.isSafeInteger(value) || value < 1 || value > 10 * 60_000) {\n    throw new RangeError(\"browser controller timeout is invalid\");\n  }\n  return value;\n}\n\nfunction absolutePath(value: string, label: string): string {\n  if (!value || value.includes(\"\\0\") || !posixPath.isAbsolute(value)) {\n    throw new Error(`${label} must be absolute`);\n  }\n  return posixPath.normalize(value);\n}\n\nfunction normalizeOrigins(values: readonly string[]): string[] {\n  if (values.length > 64) throw new Error(\"too many browser controller origins\");\n  return values.map((value) => {\n    const url = new URL(value);\n    if (url.origin === \"null\" || url.pathname !== \"/\" || url.search || url.hash) {\n      throw new Error(\"browser controller origin must be an absolute origin\");\n    }\n    return url.origin;\n  });\n}\n\nfunction shellQuote(value: string): string {\n  return `'${value.replaceAll(\"'\", `'\\\\''`)}'`;\n}\n","import {\n  ComputerNativeCommand,\n  ComputerNativeReceipt,\n  ComputerOperationReceipt,\n  parseInteractionDriverDiagnostic,\n  type InteractionDriverDiagnostic,\n} from \"@opengeni/contracts\";\nimport { createHash, randomUUID } from \"node:crypto\";\nimport { posix as posixPath } from \"node:path\";\nimport { parseBrowserFrameMetadata, type BrowserFrameMetadata } from \"@opengeni/sdk\";\nimport { olderBrowserControllerMessage } from \"./browser-controller-compatibility\";\nimport {\n  BROWSER_ACTION_RECEIPT_NOTES_PARAMETER,\n  BROWSER_ACTION_RECEIPT_NOTES_VERSION,\n  BROWSER_ACTION_RECEIPT_TARGETS_PARAMETER,\n  BROWSER_OBSERVATION_NOTICES_PARAMETER,\n  BROWSER_SESSION_NO_OBSERVATION_PARAMETER,\n  BROWSER_CONTROL_MAX_JSON_BYTES,\n  BROWSER_CONTROL_PORT,\n  COMPUTER_ACTION_RECEIPT_STAND_INS_PARAMETER,\n  COMPUTER_ACTION_RECEIPT_UNCONFIRMED_INPUT_PARAMETER,\n  BROWSER_CONTROL_PROTOCOL_VERSION,\n  BROWSER_PROFILE_ARTIFACT_FORMAT,\n  BROWSER_STATE_ARTIFACT_CONTENT_TYPE,\n  INTERACTION_ACTION_DEADLINE_MAX_MS,\n  browserActionDeadlineMs,\n  computerActionDeadlineMs,\n  BrowserActionCommand,\n  BrowserActionReceipt,\n  BrowserClipboard,\n  BrowserDiagnosticBatch,\n  BrowserDownload,\n  BrowserDownloadExportReceipt,\n  BrowserRecordingExportReceipt,\n  BrowserRecordingExportRequest,\n  BrowserRecordingStartRequest,\n  BrowserRecordingSummary,\n  BrowserRecordingUploadRequest,\n  BrowserRecordingUploadStatus,\n  BrowserDownloadExportRequest,\n  BrowserDownloadListResponse,\n  BrowserDomReadRequest,\n  BrowserDomReadResponse,\n  BrowserExternalAuthCommand,\n  BrowserExternalAuthResult,\n  BrowserObservation,\n  BrowserRevisionMaterialization,\n  BrowserTarget,\n  BrowserTargetListResponse,\n  BrowserTargetState,\n  BrowserWorkspaceFileStageRequest,\n  BrowserWorkspaceFileStageResponse,\n  BrowserPasskeySyncRequest,\n  BrowserPasskeySyncResponse,\n  ComputerActionCommand,\n  ComputerActionReceipt,\n  ComputerClipboard,\n  ComputerObservation,\n  COMPUTER_SCREENSHOT_MAX_BYTES,\n  ComputerSessionCapabilities,\n  ComputerTarget,\n  InteractionError,\n  NetworkRouteConsistency,\n  type BrowserActionCommand as BrowserActionCommandValue,\n  type BrowserActionReceipt as BrowserActionReceiptValue,\n  type BrowserClipboard as BrowserClipboardValue,\n  type BrowserDiagnosticBatch as BrowserDiagnosticBatchValue,\n  type BrowserDownload as BrowserDownloadValue,\n  type BrowserDownloadExportReceipt as BrowserDownloadExportReceiptValue,\n  type BrowserRecordingExportReceipt as BrowserRecordingExportReceiptValue,\n  type BrowserRecordingExportRequest as BrowserRecordingExportRequestValue,\n  type BrowserRecordingSummary as BrowserRecordingSummaryValue,\n  type BrowserRecordingUploadRequest as BrowserRecordingUploadRequestValue,\n  type BrowserRecordingUploadStatus as BrowserRecordingUploadStatusValue,\n  type BrowserDownloadExportRequest as BrowserDownloadExportRequestValue,\n  type BrowserDownloadListResponse as BrowserDownloadListResponseValue,\n  type BrowserDomReadRequest as BrowserDomReadRequestValue,\n  type BrowserDomReadResponse as BrowserDomReadResponseValue,\n  type BrowserExternalAuthCommand as BrowserExternalAuthCommandValue,\n  type BrowserExternalAuthResult as BrowserExternalAuthResultValue,\n  type BrowserDiagnosticKind,\n  type BrowserTargetListResponse as BrowserTargetListResponseValue,\n  type BrowserObservation as BrowserObservationValue,\n  type BrowserRevisionMaterialization as BrowserRevisionMaterializationValue,\n  type BrowserTarget as BrowserTargetValue,\n  type BrowserTargetState as BrowserTargetStateValue,\n  type BrowserWorkspaceFileStageRequest as BrowserWorkspaceFileStageRequestValue,\n  type BrowserWorkspaceFileStageResponse as BrowserWorkspaceFileStageResponseValue,\n  type BrowserPasskeySyncRequest as BrowserPasskeySyncRequestValue,\n  type BrowserPasskeySyncResponse as BrowserPasskeySyncResponseValue,\n  type ComputerActionCommand as ComputerActionCommandValue,\n  type ComputerActionReceipt as ComputerActionReceiptValue,\n  type ComputerClipboard as ComputerClipboardValue,\n  type ComputerObservation as ComputerObservationValue,\n  type ComputerSessionCapabilities as ComputerSessionCapabilitiesValue,\n  type ComputerTarget as ComputerTargetValue,\n  type InteractionError as InteractionErrorValue,\n  type NetworkRouteConsistency as NetworkRouteConsistencyValue,\n} from \"@opengeni/contracts\";\nimport type {\n  BrowserControlEnsureRequest,\n  BrowserControlEnsureResponse,\n  BrowserFramesOpenRequest,\n  ComputerFramesOpenRequest,\n  StreamChannel,\n} from \"@opengeni/agent-proto\";\nimport {\n  ensureBrowserControlServer,\n  type EnsureBrowserControlServerResult,\n} from \"./browser-control-server\";\nimport { parseExecResponseBanner } from \"./exec-banner\";\nimport { controllerStreamRequest, parseControllerStreamResponse } from \"./browser-control-stream\";\nimport type { BrowserControlHttpCall, BrowserControlHttpOutcome } from \"./browser-control-http\";\nimport {\n  buildStreamUrl,\n  exposedPortAllowsHostFetch,\n  joinExposedPortPath,\n  parseOpenSandboxSignedUriPath,\n  StreamPortUnavailableError,\n  type ExposedPortEndpoint,\n} from \"./stream-port\";\nimport { isRecord } from \"@opengeni/contracts/values\";\n\nconst CLIENT_ROOT = \"/tmp/opengeni-private/browser-control-client\";\nconst MANAGED_PLACEMENT_CONTROLLER_WORKDIR = \"/workspace\";\nconst NATIVE_PLACEMENT_CONTROLLER_WORKDIR = \"/tmp\";\nexport const BROWSER_CONTROL_ADMIN_TOKEN_FILE = \"/tmp/opengeni-browserd/authority/admin-token\";\nconst COMMAND_OK = \"OPENGENI_BROWSER_CONTROL_CLIENT_OK\";\nconst TOKEN_PATTERN = /^[A-Za-z0-9._~-]{32,2048}$/u;\nconst MAX_REQUEST_TIMEOUT_MS = INTERACTION_ACTION_DEADLINE_MAX_MS;\nconst BROWSER_STATE_TRANSFER_TIMEOUT_MS = 20 * 60_000;\n/** Stopping writes the recording's bundle (up to 200 MB) to local disk. */\nconst BROWSER_RECORDING_STOP_TIMEOUT_MS = 2 * 60_000;\n/** Slack for the controller to answer after its bounded upload wait. */\nconst BROWSER_RECORDING_UPLOAD_RESPONSE_MARGIN_MS = 15_000;\nconst PRIVATE_READ_CHUNK_BYTES = 512 * 1024;\nconst SHA256_PATTERN = /^[0-9a-f]{64}$/u;\n\n// Connected-machine browserd binds an OS-assigned loopback port. The agent\n// owns that endpoint, so the API must never fall back to the image port merely\n// because a fresh request constructed a fresh client. Cache the negotiated\n// endpoint by its physical authority fence; a transport failure invalidates it\n// and performs one idempotent ensure/retry below.\nconst nativeControllerPorts = new Map<string, number>();\n\ntype ExecResultLike = {\n  output?: string;\n  stdout?: string;\n  stderr?: string;\n  exitCode?: number | null;\n  sessionId?: number;\n};\n\nexport type BrowserControlPlacementSession = {\n  /** Connected Machine command stdin is byte-exact and private. Optional so\n   * older placement adapters retain their existing file-based transport. */\n  execWithInput?: (args: {\n    cmd: string;\n    stdin: Uint8Array;\n    shell: string;\n    login: boolean;\n    workdir: string;\n  }) => Promise<ExecResultLike>;\n  /** Host family of a Connected Machine. Windows hosts have no POSIX shell,\n   * /tmp or base64, so the controller transport uses its Windows form there. */\n  controllerHostOs?: () => \"posix\" | \"windows\";\n  exec?: (args: {\n    cmd: string;\n    workdir?: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n  }) => Promise<ExecResultLike | string>;\n  execCommand?: (args: {\n    cmd: string;\n    workdir?: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n  }) => Promise<string>;\n  readFile?: (args: { path: string; maxBytes?: number }) => Promise<string | Uint8Array>;\n  writeFile?: (args: {\n    path: string;\n    content: string | Uint8Array;\n    createParents?: boolean;\n  }) => Promise<unknown>;\n  writePlacementPrivate?: (args: {\n    path: string;\n    content: string | Uint8Array;\n    createParents?: boolean;\n  }) => Promise<unknown>;\n  deletePlacementPrivate?: (path: string) => Promise<void>;\n  writeStdin?: (args: {\n    sessionId: number;\n    chars?: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n  }) => Promise<string>;\n  resolveExposedPort?: (port: number) => Promise<ExposedPortEndpoint>;\n  /** Signed OpenSandbox Channel B must host-fetch. Never fall through to in-box curl. */\n  requireHostFetchController?: boolean;\n  runtimeMetrics?: {\n    onOpenSandboxSignedEndpoint?: (input: {\n      outcome: \"minted\" | \"mint_failed\" | \"host_fetch_unauthorized\";\n      port: number;\n    }) => void;\n  };\n  ensureBrowserControl?: (\n    request: BrowserControlEnsureRequest,\n  ) => Promise<BrowserControlEnsureResponse>;\n  /** Agent-native controller transport, addressed by authority scope. */\n  browserControlHttp?: (request: BrowserControlHttpCall) => Promise<BrowserControlHttpOutcome>;\n  openBrowserFrames?: (\n    request: BrowserFramesOpenRequest,\n  ) => Promise<{ channel: StreamChannel; endpoint: ExposedPortEndpoint }>;\n  openComputerFrames?: (\n    request: ComputerFramesOpenRequest,\n  ) => Promise<{ channel: StreamChannel; endpoint: ExposedPortEndpoint }>;\n  finalizeOpStreamOps?: () => Promise<void>;\n};\n\nexport type ComputerControlFrame = {\n  data: Uint8Array;\n  mediaType: \"image/jpeg\" | \"image/png\";\n  metadataHeader: string;\n  metadata: ComputerControlFrameMetadata;\n};\n\nexport type BrowserControlFrame = {\n  data: Uint8Array;\n  mediaType: \"image/jpeg\" | \"image/png\";\n  metadataHeader: string;\n  metadata: BrowserFrameMetadata;\n  /** Set when a full-page capture could not keep every scrollbar's space. */\n  inexactScrollbars?: true;\n};\n\nexport type BrowserControlScreenshotOptions = {\n  fullPage?: boolean;\n  format?: \"jpeg\" | \"png\";\n  quality?: number;\n};\n\ntype ExpectedBrowserFrameEvidence = {\n  browserSessionId: string;\n  controllerGeneration: string;\n  targetId: string;\n};\n\ntype FrameRequest = {\n  method: \"GET\";\n  path: string;\n  token: string;\n  timeoutMs?: number;\n} & (\n  | { surface: \"browser\"; expectedFrameEvidence: ExpectedBrowserFrameEvidence }\n  | { surface: \"computer\"; expectedFrameEvidence: ExpectedComputerFrameEvidence }\n);\n\nexport type ComputerControlFrameMetadata = {\n  frameId: string;\n  computerSessionId: string;\n  controllerGeneration: string;\n  targetId: string;\n  targetGeneration: string;\n  sequence: number;\n  mediaType: \"image/jpeg\" | \"image/png\";\n  width: number;\n  height: number;\n  capturedAt: string;\n  sha256: string;\n};\n\nexport type ComputerFrameEvidenceMismatchReason =\n  | \"frame_session_mismatch\"\n  | \"frame_target_mismatch\"\n  | \"frame_controller_mismatch\"\n  | \"frame_media_mismatch\"\n  | \"frame_digest_mismatch\";\n\nexport type ExpectedComputerFrameEvidence = {\n  computerSessionId: string;\n  controllerGeneration: string;\n  targetId: string;\n};\n\n/** Controller I/O uses absolute private paths under /tmp, so its cwd carries\n * no data authority. Connected Machines need a native /tmp cwd because their\n * session directory may disappear; managed sandboxes must use /workspace\n * because provider exec confines workdir to the workspace root. */\nfunction placementControllerWorkdir(session: BrowserControlPlacementSession): string {\n  if (!session.ensureBrowserControl) return MANAGED_PLACEMENT_CONTROLLER_WORKDIR;\n  // A Windows machine has no /tmp. The relative \".\" resolves to its reported\n  // workspace root, which exists for the connection's lifetime.\n  return session.controllerHostOs?.() === \"windows\" ? \".\" : NATIVE_PLACEMENT_CONTROLLER_WORKDIR;\n}\n\nexport type PlacementBrowserSessionReference = {\n  browserSessionId: string;\n  controllerGeneration: string;\n};\n\nexport type PlacementBrowserSession = PlacementBrowserSessionReference & {\n  /** Null when a session continued in the person's own browser with none of\n   * its tabs left: it has no tab until one is opened. */\n  observation: BrowserObservationValue | null;\n  /** The tab inventory at creation, when the controller reports it. */\n  targets?: BrowserTargetValue[];\n  /** A plain line about how the controller launched this browser. */\n  notice?: string;\n  /** How a headed managed browser shows on its machine as launched: in a\n   * native window, or offscreen with none. An older controller omits it. */\n  display?: \"window\" | \"offscreen\";\n};\n\nexport type PlacementComputerSessionReference = {\n  computerSessionId: string;\n  controllerGeneration: string;\n};\n\nexport type PlacementComputerSession = PlacementComputerSessionReference & {\n  platform: \"linux\" | \"macos\" | \"windows\";\n  adapter: string;\n  seatId: string;\n  displayId: string;\n  capabilities: ComputerSessionCapabilitiesValue;\n  targets: ComputerTargetValue[];\n};\n\nexport type CreatePlacementComputerSessionInput = PlacementComputerSessionReference & {\n  cursorIdentity?: import(\"@opengeni/contracts\").ComputerCursorIdentity;\n  tokenGeneration: number;\n  controlToken: string;\n  viewToken: string;\n};\n\nexport type CreatePlacementBrowserSessionInput = PlacementBrowserSessionReference & {\n  tokenGeneration: number;\n  controlToken: string;\n  viewToken: string;\n  headed: boolean;\n  initialUrl?: string;\n  /** Private same-runtime recovery intent; never restores a saved revision. */\n  recoverExistingWorkingDirectory?: true;\n  restore?: RestorePlacementBrowserStateInput;\n  transport?: PlacementBrowserTransport;\n  linkedComputer?: PlacementComputerSessionReference;\n  networkRoute?: PlacementBrowserNetworkRoute;\n};\n\nexport type PlacementBrowserNetworkRoute = {\n  routeId: string;\n  routeVersion: number;\n  authorityDigest: string;\n  kind: \"direct\" | \"proxy\" | \"managed\" | \"tunnel\";\n  consistency: NetworkRouteConsistencyValue;\n  /** Present for an initial authenticated-proxy launch; omitted only when\n   * replaying an already-live controller after the referenced credential was\n   * rotated. Never persisted or returned by the controller. */\n  proxyUrl?: string;\n  /** Provider-native egress selector. Provider API authority remains on the\n   * external transport and is never duplicated into this route material. */\n  providerRoute?: {\n    providerId: \"browserbase\" | \"kernel\";\n    routeId: string;\n    egressClass: \"datacenter\" | \"residential\" | \"isp\";\n    region: string | null;\n  };\n};\n\nexport type PlacementBrowserTransport =\n  | { kind: \"managed\"; engine?: \"chromium\" | \"lightpanda\"; ephemeralPartition?: string }\n  | {\n      kind: \"external_provider\";\n      providerId: \"browserbase\" | \"kernel\";\n      placementId: string;\n      /** Private launch authority. Browserd never returns or journals it. */\n      authority: {\n        apiKey: string;\n        endpoint?: string;\n      };\n      timeoutSeconds?: number;\n      stealth?: boolean;\n    }\n  | {\n      kind: \"attached_chrome\";\n      deviceId: string;\n      connectionGeneration: string;\n      browserName: string;\n      browserVersion: string;\n    };\n\nexport type BrowserViewGrant = {\n  fencedInputBatches?: true;\n  focusedInputObservations?: true;\n  grantId: string;\n  expiresAt: string;\n};\n\nexport type ComputerViewGrant = BrowserViewGrant & { scopedRfbInput: boolean };\n\nexport type BrowserStateUploadGrant = {\n  url: string;\n  requiredHeaders: Readonly<Record<string, string>>;\n  expiresAt: string;\n};\n\nexport type BrowserStateDownloadGrant = {\n  url: string;\n  expiresAt: string;\n};\n\nexport type RestorePlacementBrowserStateInput = {\n  objectKey: string;\n  format: typeof BROWSER_PROFILE_ARTIFACT_FORMAT;\n  artifactDigest: string;\n  contentDigest: string;\n  manifestDigest: string;\n  sizeBytes: number;\n  dataKey: Uint8Array;\n  aad: Uint8Array;\n  materialization: BrowserRevisionMaterializationValue;\n  download: BrowserStateDownloadGrant;\n};\n\nexport type CapturePlacementBrowserStateInput = PlacementBrowserSessionReference & {\n  operationId: string;\n  objectKey: string;\n  afterCapture: \"restart\" | \"stop\";\n  dataKey: Uint8Array;\n  aad: Uint8Array;\n  upload: BrowserStateUploadGrant;\n};\n\nexport type PlacementBrowserStateCaptureReceipt = PlacementBrowserSessionReference & {\n  operationId: string;\n  objectKey: string;\n  format: typeof BROWSER_PROFILE_ARTIFACT_FORMAT;\n  artifactDigest: string;\n  contentDigest: string;\n  sizeBytes: number;\n  fileCount: number;\n  profileBytes: number;\n  manifest: {\n    schemaVersion: 1;\n    browserSessionId: string;\n    controllerGeneration: string;\n    capturedAt: string;\n    engine: \"chromium\" | \"chrome\";\n    engineVersion: string | null;\n    driverId: string;\n    driverSchemaVersion: number;\n    profileCrypto: \"chromium_basic\" | \"chromium_mock_keychain\" | \"platform_bound\";\n    platform: \"linux\" | \"macos\" | \"windows\";\n    architecture: \"x64\" | \"arm64\";\n    tabs: Array<{ url: string; selected: boolean }>;\n  };\n};\n\n/** The exact controller authority a preserved working copy was launched\n * under; the controller refuses any other. */\nexport type PlacementBrowserWorkingCopyAuthority = PlacementBrowserSessionReference & {\n  tokenGeneration: number;\n  controlToken: string;\n  viewToken: string;\n};\n\nexport const BROWSER_WORKING_COPY_REFUSALS = [\n  \"unsupported_platform\",\n  \"browser_running\",\n  \"working_copy_invalid\",\n  \"receipt_not_adoptable\",\n  \"authority_changed\",\n  \"process_state_unknown\",\n  \"adoption_not_needed\",\n  \"adoption_unresolved\",\n] as const;\nexport type PlacementBrowserWorkingCopyRefusal = (typeof BROWSER_WORKING_COPY_REFUSALS)[number];\n\nexport const BROWSER_WORKING_COPY_ADOPTION_PHASES = [\n  \"intent\",\n  \"copied\",\n  \"receipt\",\n  \"source_preserved\",\n  \"adopted\",\n  \"interrupted\",\n  \"failed\",\n  \"collision\",\n  \"reverting\",\n  \"reverted\",\n] as const;\nexport type PlacementBrowserWorkingCopyAdoptionPhase =\n  (typeof BROWSER_WORKING_COPY_ADOPTION_PHASES)[number];\n\nexport type PlacementBrowserWorkingCopyAdoption = PlacementBrowserSessionReference & {\n  operationId: string;\n  manifestDigest: string;\n  phase: PlacementBrowserWorkingCopyAdoptionPhase;\n  failureCode: string | null;\n  /** Directories this adoption kept beside the browser's own, by name. */\n  retainedDirectories: string[];\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type PlacementBrowserWorkingCopyInspection = PlacementBrowserSessionReference & {\n  platformSupported: boolean;\n  refusal: PlacementBrowserWorkingCopyRefusal | null;\n  /** Exact digest of the bytes an adoption would take; null when refused. */\n  manifest: { digest: string; entries: number; bytes: number; excluded: string[] } | null;\n  profileIdentityMatches: boolean;\n  /** false only when no process provably uses the profile. */\n  profileInUse: boolean | null;\n  receipt: {\n    operationId: string;\n    intent: \"launch\" | \"suspend\" | \"retire\" | \"adopt\";\n    state: string;\n    directoryLaunchAllowed: boolean;\n    authorityMatches: boolean;\n    /** True when this working copy was first launched from a saved checkpoint. */\n    launchedFromCheckpoint: boolean;\n    adoption: { operationId: string; manifestDigest: string } | null;\n  } | null;\n  activeAdoption: PlacementBrowserWorkingCopyAdoption | null;\n};\n\nexport type ProvisionBrowserControlClientInput = {\n  adminToken: string;\n  adminTokenFile?: string;\n  allowedOrigins?: readonly string[];\n  port?: number;\n  timeoutMs?: number;\n  /** Native connected-machine sidecar authority. Ignored by image-backed\n   * placements, whose browserd is already supervised inside the sandbox image. */\n  nativeAuthority?: {\n    scopeId: string;\n    scopeGeneration: string;\n  };\n};\n\nexport type ProvisionBrowserControlClientResult = {\n  client: BrowserControlClient;\n  server: EnsureBrowserControlServerResult;\n};\n\nexport class BrowserControlTransportError extends Error {\n  readonly name = \"BrowserControlTransportError\";\n  readonly retryable = true;\n}\n\n/**\n * An action request outlived the deadline derived from its own declared waits\n * (browserActionDeadlineMs / computerActionDeadlineMs). The controller may\n * still be running it, so it is neither a transport outage nor safe to replay:\n * callers report it as is and never retry it.\n */\nexport class BrowserControlActionDeadlineError extends Error {\n  readonly name = \"BrowserControlActionDeadlineError\";\n  readonly retryable = false;\n\n  constructor(\n    readonly surface: \"browser\" | \"computer\",\n    readonly deadlineMs: number,\n    options?: ErrorOptions,\n  ) {\n    super(`${surface} action did not finish within its ${deadlineMs} ms deadline`, options);\n  }\n}\n\n/** Every transport bounds a request by its timeoutMs and then fails with a\n * transport error (curl max-time, the fetch abort, the runner's own deadline\n * or its reply timer). A transport failure that arrives once the deadline has\n * elapsed is that deadline; an earlier one remains an ordinary transport fault. */\nconst ACTION_DEADLINE_DETECTION_SLACK_MS = 1_000;\n/** Connected Machine runners released before the 20-minute request maximum\n * clamp every request to 15 minutes, so on them a longer deadline ends there. */\nconst LEGACY_RUNNER_REQUEST_MAX_MS = 15 * 60_000;\n\n/** The deadline a transport failure after `elapsedMs` proves was reached, if any. */\nfunction reachedActionDeadline(deadlineMs: number, elapsedMs: number): number | null {\n  if (elapsedMs >= deadlineMs - ACTION_DEADLINE_DETECTION_SLACK_MS) return deadlineMs;\n  if (\n    deadlineMs > LEGACY_RUNNER_REQUEST_MAX_MS &&\n    elapsedMs >= LEGACY_RUNNER_REQUEST_MAX_MS - ACTION_DEADLINE_DETECTION_SLACK_MS\n  )\n    return LEGACY_RUNNER_REQUEST_MAX_MS;\n  return null;\n}\n\nasync function withActionDeadline<T>(\n  surface: \"browser\" | \"computer\",\n  deadlineMs: number,\n  request: (timeoutMs: number) => Promise<T>,\n): Promise<T> {\n  const startedAt = Date.now();\n  try {\n    return await request(deadlineMs);\n  } catch (error) {\n    const reached =\n      error instanceof BrowserControlTransportError\n        ? reachedActionDeadline(deadlineMs, Date.now() - startedAt)\n        : null;\n    if (reached !== null) {\n      throw new BrowserControlActionDeadlineError(surface, reached, { cause: error });\n    }\n    throw error;\n  }\n}\n\nexport class BrowserControlProtocolError extends Error {\n  readonly name = \"BrowserControlProtocolError\";\n  readonly retryable = false;\n}\n\nexport class ComputerFrameEvidenceMismatchError extends BrowserControlProtocolError {\n  constructor(readonly reason: ComputerFrameEvidenceMismatchReason) {\n    super(\"computer frame evidence does not match its request\");\n  }\n}\n\nexport class BrowserControlRequestError extends Error {\n  readonly name = \"BrowserControlRequestError\";\n  readonly retryable: boolean;\n\n  constructor(\n    readonly status: number,\n    readonly error: InteractionErrorValue,\n    /** Operator-only context the controller sent beside a driver failure;\n     * logged, never shown to callers. */\n    readonly diagnostic: InteractionDriverDiagnostic | null = null,\n  ) {\n    super(error.message);\n    this.retryable = error.retryable;\n  }\n}\n\nexport class BrowserControlUnsupportedError extends Error {\n  readonly name = \"BrowserControlUnsupportedError\";\n}\n\nfunction browserControllerCompatibilityError(\n  feature: string,\n  controllerInAgent: boolean,\n): BrowserControlRequestError {\n  return new BrowserControlRequestError(409, {\n    code: \"unsupported\",\n    // A controller embedded in the Opengeni agent updates with that agent;\n    // only image-backed placements have a controller image.\n    message: controllerInAgent\n      ? `browser controller does not support ${feature}; it runs in an older Opengeni agent, and updating the agent adds support`\n      : `browser controller does not support ${feature}; update the placement's controller image to match this release`,\n    retryable: false,\n  });\n}\n\n/** The controller's route table rejected a request before dispatch: its release\n *  predates this route. Distinct from a missing target or session. */\nfunction isLegacyRouteMiss(error: unknown): boolean {\n  return (\n    error instanceof BrowserControlRequestError &&\n    error.status === 404 &&\n    error.error.code === \"resource_not_found\" &&\n    error.error.message === \"route not found\"\n  );\n}\n\n/** Install one placement-stable admin credential and start the pinned controller. */\nexport async function provisionBrowserControlClient(\n  session: BrowserControlPlacementSession,\n  input: ProvisionBrowserControlClientInput,\n): Promise<ProvisionBrowserControlClientResult> {\n  requirePlacementProvisioningSurface(session);\n  const adminToken = requireToken(input.adminToken, \"browser controller admin token\");\n  if (session.ensureBrowserControl) {\n    if (!input.nativeAuthority) {\n      throw new BrowserControlProtocolError(\n        \"connected browser placement is missing its controller authority scope\",\n      );\n    }\n    const ensured = await session.ensureBrowserControl({\n      scopeId: input.nativeAuthority.scopeId,\n      scopeGeneration: input.nativeAuthority.scopeGeneration,\n      adminToken,\n      allowedOrigins: [...(input.allowedOrigins ?? [])],\n    });\n    const port = boundedPort(ensured.port);\n    nativeControllerPorts.set(nativeControllerKey(input.nativeAuthority), port);\n    return {\n      client: new BrowserControlClient(session, {\n        adminToken,\n        port,\n        nativeAuthority: input.nativeAuthority,\n        ...(input.timeoutMs === undefined ? {} : { timeoutMs: input.timeoutMs }),\n      }),\n      server: { port, marker: `agent:${ensured.sidecarGeneration}` },\n    };\n  }\n  const adminTokenFile = absolutePrivatePath(\n    input.adminTokenFile ?? BROWSER_CONTROL_ADMIN_TOKEN_FILE,\n    \"browser controller admin token file\",\n  );\n  const temporaryTokenFile = `${adminTokenFile}.new.${randomUUID()}`;\n  const parent = adminTokenFile.slice(0, adminTokenFile.lastIndexOf(\"/\")) || \"/\";\n  try {\n    await runChecked(\n      session,\n      `umask 077; install -d -m 0700 -- ${shellQuote(parent)}; printf '%s\\\\n' ${shellQuote(COMMAND_OK)}`,\n      input.timeoutMs,\n    );\n    await writePrivateFile(\n      session,\n      {\n        path: temporaryTokenFile,\n        content: `${adminToken}\\n`,\n        createParents: false,\n      },\n      input.timeoutMs,\n    );\n    await runChecked(\n      session,\n      `chmod 0600 -- ${shellQuote(temporaryTokenFile)}; mv -f -- ${shellQuote(temporaryTokenFile)} ${shellQuote(adminTokenFile)}; printf '%s\\\\n' ${shellQuote(COMMAND_OK)}`,\n      input.timeoutMs,\n    );\n    const server = await ensureBrowserControlServer(session, {\n      adminTokenFile,\n      ...(input.allowedOrigins ? { allowedOrigins: input.allowedOrigins } : {}),\n      ...(input.port === undefined ? {} : { port: input.port }),\n      ...(input.timeoutMs === undefined ? {} : { timeoutMs: input.timeoutMs }),\n    });\n    const client = new BrowserControlClient(session, {\n      adminToken,\n      port: server.port,\n      ...(input.nativeAuthority ? { nativeAuthority: input.nativeAuthority } : {}),\n      ...(input.timeoutMs === undefined ? {} : { timeoutMs: input.timeoutMs }),\n    });\n    if (input.allowedOrigins && input.allowedOrigins.length > 0) {\n      await client.addAllowedOrigins(input.allowedOrigins);\n    }\n    return { client, server };\n  } finally {\n    await runBestEffort(session, `rm -f -- ${shellQuote(temporaryTokenFile)}`);\n    await session.finalizeOpStreamOps?.().catch(() => undefined);\n  }\n}\n\nexport class BrowserControlClient {\n  readonly port: number;\n  private readonly session: BrowserControlPlacementSession;\n  private readonly adminToken: string;\n  private readonly timeoutMs: number;\n  private readonly nativeAuthority: { scopeId: string; scopeGeneration: string } | undefined;\n\n  constructor(\n    session: BrowserControlPlacementSession,\n    options: {\n      adminToken: string;\n      port?: number;\n      timeoutMs?: number;\n      nativeAuthority?: { scopeId: string; scopeGeneration: string };\n    },\n  ) {\n    requirePlacementRequestSurface(session);\n    this.session = session;\n    this.adminToken = requireToken(options.adminToken, \"browser controller admin token\");\n    this.port = boundedPort(options.port ?? BROWSER_CONTROL_PORT);\n    this.timeoutMs = boundedTimeout(options.timeoutMs ?? 60_000);\n    this.nativeAuthority = options.nativeAuthority;\n  }\n\n  /** True when the controller ships inside the placement's Opengeni agent\n   *  (connected machines, attached devices, compute sandboxes) rather than a\n   *  controller image pinned to this release. */\n  controllerRunsInAgent(): boolean {\n    return typeof this.session.ensureBrowserControl === \"function\";\n  }\n\n  async addAllowedOrigins(origins: readonly string[]): Promise<readonly string[]> {\n    if (origins.length === 0 || origins.length > 64) {\n      throw new RangeError(\"browser controller origin list size is invalid\");\n    }\n    const normalized = origins.map(normalizeOrigin);\n    const data = await this.requestJson({\n      method: \"PUT\",\n      path: \"/v1/origins\",\n      token: this.adminToken,\n      body: { origins: normalized },\n    });\n    if (!isRecord(data) || !Array.isArray(data.origins)) {\n      throw new BrowserControlProtocolError(\"browser controller returned malformed origins\");\n    }\n    return data.origins.map((origin) => normalizeOrigin(origin));\n  }\n\n  async createSession(input: CreatePlacementBrowserSessionInput): Promise<PlacementBrowserSession> {\n    const reference = parseReference(input);\n    if (\n      input.recoverExistingWorkingDirectory !== undefined &&\n      (input.recoverExistingWorkingDirectory !== true ||\n        input.restore ||\n        input.initialUrl !== undefined)\n    ) {\n      throw new BrowserControlProtocolError(\n        \"working directory recovery cannot restore or navigate\",\n      );\n    }\n    const restore = input.restore ? browserStateRestoreRequest(input.restore) : null;\n    let data: unknown;\n    try {\n      data = await this.requestJson({\n        method: \"POST\",\n        path: `/v1/browser-sessions?${BROWSER_SESSION_NO_OBSERVATION_PARAMETER}=1`,\n        token: this.adminToken,\n        body: {\n          ...reference,\n          tokenGeneration: positiveSafeInteger(input.tokenGeneration, \"token generation\"),\n          controlToken: requireToken(input.controlToken, \"browser control token\"),\n          viewToken: requireToken(input.viewToken, \"browser view token\"),\n          headed: input.headed,\n          ...(input.recoverExistingWorkingDirectory\n            ? { recoverExistingWorkingDirectory: true }\n            : {}),\n          ...(input.initialUrl === undefined ? {} : { initialUrl: boundedUrl(input.initialUrl) }),\n          ...(input.transport ? { transport: placementBrowserTransport(input.transport) } : {}),\n          ...(input.linkedComputer\n            ? { linkedComputer: parseComputerReference(input.linkedComputer) }\n            : {}),\n          ...(input.networkRoute\n            ? { networkRoute: placementBrowserNetworkRoute(input.networkRoute) }\n            : {}),\n          ...(restore ? { restore: restore.wire } : {}),\n        },\n        ...(restore ? { timeoutMs: BROWSER_STATE_TRANSFER_TIMEOUT_MS } : {}),\n      });\n    } finally {\n      restore?.dataKey.fill(0);\n      restore?.aad.fill(0);\n    }\n    if (!isRecord(data)) {\n      throw new BrowserControlProtocolError(\"browser controller returned malformed session data\");\n    }\n    const returnedReference = parseReference(data);\n    if (\n      returnedReference.browserSessionId !== reference.browserSessionId ||\n      returnedReference.controllerGeneration !== reference.controllerGeneration\n    ) {\n      throw new BrowserControlProtocolError(\"browser controller returned another session binding\");\n    }\n    return {\n      ...returnedReference,\n      observation: data.observation === null ? null : BrowserObservation.parse(data.observation),\n      ...creationTargets(data.targets, returnedReference),\n      ...creationNotice(data.notice),\n      ...creationDisplay(data.display),\n    };\n  }\n\n  async createComputerSession(\n    input: CreatePlacementComputerSessionInput,\n  ): Promise<PlacementComputerSession> {\n    const reference = parseComputerReference(input);\n    const request = {\n      method: \"POST\",\n      path: \"/v1/computer-sessions\",\n      token: this.adminToken,\n      body: {\n        ...reference,\n        tokenGeneration: positiveSafeInteger(input.tokenGeneration, \"token generation\"),\n        controlToken: requireToken(input.controlToken, \"computer control token\"),\n        viewToken: requireToken(input.viewToken, \"computer view token\"),\n        ...(input.cursorIdentity ? { cursorIdentity: input.cursorIdentity } : {}),\n      },\n    } as const;\n    let data: unknown;\n    try {\n      data = await this.requestJson(request);\n    } catch (error) {\n      // Older agents reject the new field in their request parser, before\n      // creating a session. Only this exact, definite pre-dispatch rejection\n      // permits a metadata-free retry; never replay an uncertain create.\n      if (\n        !input.cursorIdentity ||\n        !(error instanceof BrowserControlRequestError) ||\n        error.status !== 400 ||\n        error.error.code !== \"invalid_action\" ||\n        error.error.message !== \"request contains unknown fields\"\n      )\n        throw error;\n      const { cursorIdentity: _identity, ...body } = request.body;\n      data = await this.requestJson({ ...request, body });\n    }\n    if (!isRecord(data) || !Array.isArray(data.targets)) {\n      throw new BrowserControlProtocolError(\n        \"interaction controller returned malformed computer session data\",\n      );\n    }\n    const returned = parseComputerReference(data);\n    if (\n      returned.computerSessionId !== reference.computerSessionId ||\n      returned.controllerGeneration !== reference.controllerGeneration\n    ) {\n      throw new BrowserControlProtocolError(\n        \"interaction controller returned another computer session binding\",\n      );\n    }\n    const platform = data.platform;\n    if (platform !== \"linux\" && platform !== \"macos\" && platform !== \"windows\") {\n      throw new BrowserControlProtocolError(\n        \"interaction controller returned an invalid computer platform\",\n      );\n    }\n    return {\n      ...returned,\n      platform,\n      adapter: requireOpaqueId(data.adapter, \"computer adapter\"),\n      seatId: requireOpaqueId(data.seatId, \"computer seat id\"),\n      displayId: requireOpaqueId(data.displayId, \"computer display id\"),\n      capabilities: ComputerSessionCapabilities.parse(data.capabilities),\n      targets: data.targets.map((target) => ComputerTarget.parse(target)),\n    };\n  }\n\n  async endSession(\n    reference: PlacementBrowserSessionReference,\n    options: {\n      removeState: boolean;\n      discardWorkingRuntime?: boolean;\n      setAsideInterruptedLaunch?: boolean;\n    },\n  ): Promise<void> {\n    const binding = parseReference(reference);\n    const data = await this.requestJson({\n      method: \"POST\",\n      path: `/v1/browser-sessions/${binding.browserSessionId}/end`,\n      token: this.adminToken,\n      body: {\n        controllerGeneration: binding.controllerGeneration,\n        removeState: options.removeState,\n        // Older controllers reject unknown keys, so send it only when set.\n        ...(options.discardWorkingRuntime ? { discardWorkingRuntime: true } : {}),\n        ...(options.setAsideInterruptedLaunch ? { setAsideInterruptedLaunch: true } : {}),\n      },\n    });\n    if (!isRecord(data) || data.ended !== true) {\n      throw new BrowserControlProtocolError(\"browser controller returned malformed end receipt\");\n    }\n  }\n\n  /**\n   * Tells the controller that the agent session using this browser is still\n   * working or deliberately waiting, so its idle release keeps the browser\n   * running at least until `until` (capped by the controller; a hold only\n   * extends). Advisory: it never launches, recovers or counts as a use of the\n   * browser. Returns whether the controller holds the browser; false when it\n   * no longer runs this exact generation or predates holds (an older agent or\n   * controller image, which keeps its plain idle release).\n   */\n  async holdForWait(reference: PlacementBrowserSessionReference, until: Date): Promise<boolean> {\n    const binding = parseReference(reference);\n    let data: unknown;\n    try {\n      data = await this.requestJson({\n        method: \"POST\",\n        path: `/v1/browser-sessions/${binding.browserSessionId}/wait-hold`,\n        token: this.adminToken,\n        body: {\n          controllerGeneration: binding.controllerGeneration,\n          until: until.toISOString(),\n        },\n      });\n    } catch (error) {\n      if (isLegacyRouteMiss(error)) return false;\n      throw error;\n    }\n    if (!isRecord(data) || typeof data.held !== \"boolean\") {\n      throw new BrowserControlProtocolError(\n        \"browser controller returned malformed wait hold receipt\",\n      );\n    }\n    return data.held;\n  }\n\n  async endComputerSession(\n    reference: PlacementComputerSessionReference,\n    options: { removeState: boolean },\n  ): Promise<void> {\n    const binding = parseComputerReference(reference);\n    const data = await this.requestJson({\n      method: \"POST\",\n      path: `/v1/computer-sessions/${binding.computerSessionId}/end`,\n      token: this.adminToken,\n      body: {\n        controllerGeneration: binding.controllerGeneration,\n        removeState: options.removeState,\n      },\n    });\n    if (!isRecord(data) || data.ended !== true) {\n      throw new BrowserControlProtocolError(\n        \"interaction controller returned malformed computer end receipt\",\n      );\n    }\n  }\n\n  async createViewGrant(\n    reference: PlacementBrowserSessionReference,\n    input: { grantId: string; token: string; expiresAt: string },\n  ): Promise<BrowserViewGrant> {\n    const binding = parseReference(reference);\n    const grantId = requireUuid(input.grantId, \"view grant id\");\n    const expiresAt = timestamp(input.expiresAt, \"view grant expiry\");\n    const data = await this.requestJson({\n      method: \"POST\",\n      path: `/v1/browser-sessions/${binding.browserSessionId}/view-grants`,\n      token: this.adminToken,\n      body: {\n        grantId,\n        controllerGeneration: binding.controllerGeneration,\n        token: requireToken(input.token, \"view grant token\"),\n        expiresAt,\n      },\n    });\n    if (!isRecord(data) || data.grantId !== grantId || data.expiresAt !== expiresAt) {\n      throw new BrowserControlProtocolError(\"browser controller returned malformed view grant\");\n    }\n    if (data.fencedInputBatches !== undefined && data.fencedInputBatches !== true) {\n      throw new BrowserControlProtocolError(\n        \"browser controller returned invalid input batching capability\",\n      );\n    }\n    if (data.focusedInputObservations !== undefined && data.focusedInputObservations !== true) {\n      throw new BrowserControlProtocolError(\n        \"browser controller returned invalid focused input capability\",\n      );\n    }\n    return {\n      grantId,\n      expiresAt,\n      ...(data.fencedInputBatches === true ? { fencedInputBatches: true } : {}),\n      ...(data.focusedInputObservations === true ? { focusedInputObservations: true } : {}),\n    };\n  }\n\n  async createComputerViewGrant(\n    reference: PlacementComputerSessionReference,\n    input: {\n      grantId: string;\n      token: string;\n      expiresAt: string;\n      rfbScope?: { targetId: string; targetGeneration: string; inputAllowed: boolean };\n    },\n  ): Promise<ComputerViewGrant> {\n    const binding = parseComputerReference(reference);\n    const grantId = requireUuid(input.grantId, \"computer view grant id\");\n    const expiresAt = timestamp(input.expiresAt, \"computer view grant expiry\");\n    const data = await this.requestJson({\n      method: \"POST\",\n      path: `/v1/computer-sessions/${binding.computerSessionId}/view-grants`,\n      token: this.adminToken,\n      body: {\n        grantId,\n        controllerGeneration: binding.controllerGeneration,\n        token: requireToken(input.token, \"computer view grant token\"),\n        expiresAt,\n        ...(input.rfbScope\n          ? {\n              targetId: requireOpaqueId(input.rfbScope.targetId, \"RFB target id\"),\n              targetGeneration: requireGeneration(input.rfbScope.targetGeneration),\n              inputAllowed: input.rfbScope.inputAllowed,\n            }\n          : {}),\n      },\n    });\n    if (!isRecord(data) || data.grantId !== grantId || data.expiresAt !== expiresAt) {\n      throw new BrowserControlProtocolError(\n        \"interaction controller returned malformed computer view grant\",\n      );\n    }\n    if (data.scopedRfbInput !== undefined && typeof data.scopedRfbInput !== \"boolean\") {\n      throw new BrowserControlProtocolError(\n        \"interaction controller returned invalid RFB scope capability\",\n      );\n    }\n    if (\n      input.rfbScope &&\n      (data.scopedRfbInput !== true ||\n        data.targetId !== input.rfbScope.targetId ||\n        data.targetGeneration !== input.rfbScope.targetGeneration ||\n        data.inputAllowed !== input.rfbScope.inputAllowed)\n    ) {\n      throw new BrowserControlProtocolError(\n        \"interaction controller did not bind the requested RFB scope\",\n      );\n    }\n    return { grantId, expiresAt, scopedRfbInput: data.scopedRfbInput === true };\n  }\n\n  /** Quiesce one exact controller, upload its encrypted working profile, and\n   * return only integrity/compatibility metadata. Secret authority is carried\n   * in a private placement request file and never returned by browserd. */\n  async captureState(\n    input: CapturePlacementBrowserStateInput,\n  ): Promise<PlacementBrowserStateCaptureReceipt> {\n    const reference = parseReference(input);\n    const operationId = requireUuid(input.operationId, \"browser state operation id\");\n    const objectKey = browserStateObjectKey(input.objectKey);\n    const dataKey = exactBytes(input.dataKey, 32, \"browser state data key\");\n    const aad = boundedBytes(input.aad, 1, 16 * 1024, \"browser state associated data\");\n    const upload = browserStateUploadGrant(input.upload);\n    const data = await this.requestJson({\n      method: \"POST\",\n      path: `/v1/browser-sessions/${reference.browserSessionId}/state-captures`,\n      token: this.adminToken,\n      body: {\n        operationId,\n        controllerGeneration: reference.controllerGeneration,\n        objectKey,\n        afterCapture: input.afterCapture,\n        dataKeyBase64: Buffer.from(dataKey).toString(\"base64\"),\n        aadBase64: Buffer.from(aad).toString(\"base64\"),\n        upload,\n      },\n      timeoutMs: BROWSER_STATE_TRANSFER_TIMEOUT_MS,\n    });\n    const receipt = parseStateCaptureReceipt(data);\n    if (\n      receipt.operationId !== operationId ||\n      receipt.browserSessionId !== reference.browserSessionId ||\n      receipt.controllerGeneration !== reference.controllerGeneration ||\n      receipt.objectKey !== objectKey\n    ) {\n      throw new BrowserControlProtocolError(\n        \"browser controller returned another state-capture binding\",\n      );\n    }\n    return receipt;\n  }\n\n  /** Read-only evidence about a preserved working copy whose controller\n   * memory was lost: the exact digest of its bytes and whether it can be\n   * adopted. Hashing a large profile can take minutes. */\n  async inspectWorkingCopy(\n    input: PlacementBrowserWorkingCopyAuthority,\n  ): Promise<PlacementBrowserWorkingCopyInspection> {\n    const reference = parseReference(input);\n    const data = await this.requestJson({\n      method: \"POST\",\n      path: `/v1/browser-sessions/${reference.browserSessionId}/working-copy/inspection`,\n      token: this.adminToken,\n      body: workingCopyAuthorityBody(reference, input),\n      timeoutMs: BROWSER_STATE_TRANSFER_TIMEOUT_MS,\n    });\n    return parseWorkingCopyInspection(data, reference);\n  }\n\n  /** Adopt the exact inspected bytes of a preserved working copy. A lost reply\n   * is checked with {@link workingCopyAdoption}. Sending the same operation id\n   * again never repeats a side effect: it only settles what that operation\n   * already did, under the authority that approved it. */\n  async adoptWorkingCopy(\n    input: PlacementBrowserWorkingCopyAuthority & { operationId: string; manifestDigest: string },\n  ): Promise<PlacementBrowserWorkingCopyAdoption> {\n    const reference = parseReference(input);\n    const operationId = requireUuid(input.operationId, \"working copy adoption id\");\n    const data = await this.requestJson({\n      method: \"POST\",\n      path: `/v1/browser-sessions/${reference.browserSessionId}/working-copy/adoptions`,\n      token: this.adminToken,\n      body: {\n        ...workingCopyAuthorityBody(reference, input),\n        operationId,\n        manifestDigest: sha256(input.manifestDigest, \"working copy manifest digest\"),\n      },\n      timeoutMs: BROWSER_STATE_TRANSFER_TIMEOUT_MS,\n    });\n    const adoption = parseWorkingCopyAdoption(data, reference, \"current\");\n    if (adoption.operationId !== operationId) {\n      throw new BrowserControlProtocolError(\"browser controller returned another adoption\");\n    }\n    return adoption;\n  }\n\n  /** The recorded state of one adoption, read without changing it. */\n  async workingCopyAdoption(\n    reference: PlacementBrowserSessionReference,\n    operationId: string,\n  ): Promise<{ inFlight: boolean; adoption: PlacementBrowserWorkingCopyAdoption | null }> {\n    const binding = parseReference(reference);\n    const id = requireUuid(operationId, \"working copy adoption id\");\n    const data = await this.requestJson({\n      method: \"GET\",\n      path: `/v1/browser-sessions/${binding.browserSessionId}/working-copy/adoptions/${id}`,\n      token: this.adminToken,\n    });\n    if (!isRecord(data) || typeof data.inFlight !== \"boolean\") {\n      throw new BrowserControlProtocolError(\n        \"browser controller returned malformed adoption status\",\n      );\n    }\n    const adoption =\n      data.adoption === null ? null : parseWorkingCopyAdoption(data.adoption, binding, \"recorded\");\n    if (adoption && adoption.operationId !== id) {\n      throw new BrowserControlProtocolError(\"browser controller returned another adoption\");\n    }\n    return { inFlight: data.inFlight, adoption };\n  }\n\n  /** Revert one unfinished adoption under the browser's current authority:\n   * its own directory goes back to the live path and the staged copy is\n   * kept. Retrying the same revert finishes one that stopped part way. */\n  async revertWorkingCopyAdoption(\n    input: PlacementBrowserWorkingCopyAuthority & { operationId: string },\n  ): Promise<{ inFlight: boolean; adoption: PlacementBrowserWorkingCopyAdoption | null }> {\n    const reference = parseReference(input);\n    const id = requireUuid(input.operationId, \"working copy adoption id\");\n    const data = await this.requestJson({\n      method: \"POST\",\n      path: `/v1/browser-sessions/${reference.browserSessionId}/working-copy/adoptions/${id}/revert`,\n      token: this.adminToken,\n      body: workingCopyAuthorityBody(reference, input),\n      timeoutMs: BROWSER_STATE_TRANSFER_TIMEOUT_MS,\n    });\n    if (!isRecord(data) || typeof data.inFlight !== \"boolean\") {\n      throw new BrowserControlProtocolError(\"browser controller returned malformed revert status\");\n    }\n    const adoption =\n      data.adoption === null\n        ? null\n        : parseWorkingCopyAdoption(data.adoption, reference, \"recorded\");\n    if (adoption && adoption.operationId !== id) {\n      throw new BrowserControlProtocolError(\"browser controller returned another adoption\");\n    }\n    return { inFlight: data.inFlight, adoption };\n  }\n\n  sessionClient(input: {\n    reference: PlacementBrowserSessionReference;\n    controlToken: string;\n    viewToken: string;\n  }): BrowserControlSessionClient {\n    return new BrowserControlSessionClient(this, input);\n  }\n\n  computerSessionClient(input: {\n    reference: PlacementComputerSessionReference;\n    controlToken: string;\n    viewToken: string;\n  }): ComputerControlSessionClient {\n    return new ComputerControlSessionClient(this, input);\n  }\n\n  async frameStreamUrl(\n    reference: PlacementBrowserSessionReference,\n    targetId: string,\n    stream: {\n      format?: \"jpeg\" | \"png\" | undefined;\n      quality?: number | undefined;\n      maxWidth?: number | undefined;\n      maxHeight?: number | undefined;\n      everyNthFrame?: number | undefined;\n    } = {},\n  ): Promise<string> {\n    const binding = parseReference(reference);\n    if (!this.session.resolveExposedPort) {\n      throw new BrowserControlUnsupportedError(\n        \"browser placement cannot expose its live-frame port\",\n      );\n    }\n    const endpoint = await this.session.resolveExposedPort(this.port);\n    const path = joinControllerPath(\n      endpoint.path,\n      `/v1/browser-sessions/${binding.browserSessionId}/targets/${encodeURIComponent(requireOpaqueId(targetId, \"target id\"))}/frames`,\n    );\n    return frameStreamUrlWithOptions(buildStreamUrl({ ...endpoint, path }), stream);\n  }\n\n  async computerFrameStreamUrl(\n    reference: PlacementComputerSessionReference,\n    targetId: string,\n    stream: {\n      format?: \"jpeg\" | \"png\" | undefined;\n      quality?: number | undefined;\n      maxWidth?: number | undefined;\n      maxHeight?: number | undefined;\n      everyNthFrame?: number | undefined;\n    } = {},\n  ): Promise<string> {\n    const binding = parseComputerReference(reference);\n    if (!this.session.resolveExposedPort) {\n      throw new BrowserControlUnsupportedError(\n        \"computer placement cannot expose its live-frame port\",\n      );\n    }\n    const endpoint = await this.session.resolveExposedPort(this.port);\n    const path = joinControllerPath(\n      endpoint.path,\n      `/v1/computer-sessions/${binding.computerSessionId}/targets/${encodeURIComponent(requireOpaqueId(targetId, \"computer target id\"))}/frames`,\n    );\n    return frameStreamUrlWithOptions(buildStreamUrl({ ...endpoint, path }), stream);\n  }\n\n  async computerRfbStreamUrl(\n    reference: PlacementComputerSessionReference,\n    targetId: string,\n  ): Promise<string> {\n    const binding = parseComputerReference(reference);\n    if (!this.session.resolveExposedPort) {\n      throw new BrowserControlUnsupportedError(\n        \"computer placement cannot expose its live RFB port\",\n      );\n    }\n    const endpoint = await this.session.resolveExposedPort(this.port);\n    const path = joinControllerPath(\n      endpoint.path,\n      `/v1/computer-sessions/${binding.computerSessionId}/targets/${encodeURIComponent(requireOpaqueId(targetId, \"computer target id\"))}/rfb`,\n    );\n    return buildStreamUrl({ ...endpoint, path });\n  }\n\n  /** Open the browser frame source through the connected-machine relay adapter.\n   * Returns null on image-backed placements, which expose browserd directly. */\n  async openRelayedFrameStream(input: {\n    reference: PlacementBrowserSessionReference;\n    targetId: string;\n    viewToken: string;\n    expiresAt: string;\n    stream?: {\n      format?: \"jpeg\" | \"png\" | undefined;\n      quality?: number | undefined;\n      maxWidth?: number | undefined;\n      maxHeight?: number | undefined;\n      everyNthFrame?: number | undefined;\n    };\n  }): Promise<{\n    channel: StreamChannel;\n    endpoint: ExposedPortEndpoint;\n  } | null> {\n    if (!this.session.openBrowserFrames) return null;\n    if (!this.nativeAuthority) {\n      throw new BrowserControlProtocolError(\n        \"connected browser placement is missing its controller authority scope\",\n      );\n    }\n    const reference = parseReference(input.reference);\n    const expiresAtMs = Date.parse(input.expiresAt);\n    if (!Number.isSafeInteger(expiresAtMs)) {\n      throw new BrowserControlProtocolError(\"browser view grant expiry is invalid\");\n    }\n    const stream = input.stream ?? {};\n    return await this.session.openBrowserFrames({\n      scopeId: this.nativeAuthority.scopeId,\n      scopeGeneration: this.nativeAuthority.scopeGeneration,\n      browserSessionId: reference.browserSessionId,\n      controllerGeneration: reference.controllerGeneration,\n      targetId: requireOpaqueId(input.targetId, \"target id\"),\n      viewToken: requireToken(input.viewToken, \"browser view grant\"),\n      expiresAtMs: String(expiresAtMs),\n      format: stream.format ?? \"jpeg\",\n      quality: boundedInteger(stream.quality ?? 70, 1, 100, \"browser frame quality\"),\n      maxWidth: boundedInteger(stream.maxWidth ?? 1_440, 1, 4_096, \"browser frame width\"),\n      maxHeight: boundedInteger(stream.maxHeight ?? 900, 1, 4_096, \"browser frame height\"),\n      everyNthFrame: boundedInteger(\n        stream.everyNthFrame ?? 1,\n        1,\n        60,\n        \"browser frame sampling interval\",\n      ),\n    });\n  }\n\n  /** Open a ComputerSession frame source through the connected-machine relay.\n   * Image-backed placements return null and expose browserd directly. */\n  async openRelayedComputerFrameStream(input: {\n    reference: PlacementComputerSessionReference;\n    targetId: string;\n    viewToken: string;\n    expiresAt: string;\n    stream?: {\n      format?: \"jpeg\" | \"png\" | undefined;\n      quality?: number | undefined;\n      maxWidth?: number | undefined;\n      maxHeight?: number | undefined;\n      everyNthFrame?: number | undefined;\n    };\n  }): Promise<{\n    channel: StreamChannel;\n    endpoint: ExposedPortEndpoint;\n  } | null> {\n    if (!this.session.openComputerFrames) return null;\n    if (!this.nativeAuthority) {\n      throw new BrowserControlProtocolError(\n        \"connected computer placement is missing its controller authority scope\",\n      );\n    }\n    const reference = parseComputerReference(input.reference);\n    const expiresAtMs = Date.parse(input.expiresAt);\n    if (!Number.isSafeInteger(expiresAtMs)) {\n      throw new BrowserControlProtocolError(\"computer view grant expiry is invalid\");\n    }\n    const stream = input.stream ?? {};\n    return await this.session.openComputerFrames({\n      scopeId: this.nativeAuthority.scopeId,\n      scopeGeneration: this.nativeAuthority.scopeGeneration,\n      computerSessionId: reference.computerSessionId,\n      controllerGeneration: reference.controllerGeneration,\n      targetId: requireOpaqueId(input.targetId, \"computer target id\"),\n      viewToken: requireToken(input.viewToken, \"computer view grant\"),\n      expiresAtMs: String(expiresAtMs),\n      format: stream.format ?? \"jpeg\",\n      quality: boundedInteger(stream.quality ?? 70, 1, 100, \"computer frame quality\"),\n      maxWidth: boundedInteger(stream.maxWidth ?? 4_096, 1, 4_096, \"computer frame width\"),\n      maxHeight: boundedInteger(stream.maxHeight ?? 4_096, 1, 4_096, \"computer frame height\"),\n      everyNthFrame: boundedInteger(\n        stream.everyNthFrame ?? 1,\n        1,\n        60,\n        \"computer frame sampling interval\",\n      ),\n    });\n  }\n\n  async requestForSession(input: {\n    method: \"GET\" | \"POST\" | \"DELETE\";\n    path: string;\n    token: string;\n    body?: unknown;\n    timeoutMs?: number;\n  }): Promise<unknown> {\n    return await this.requestJson(input);\n  }\n\n  async requestBytesForSession(input: {\n    method: \"GET\";\n    path: string;\n    token: string;\n    expectedFrameEvidence: ExpectedComputerFrameEvidence;\n    timeoutMs?: number;\n  }): Promise<ComputerControlFrame> {\n    return (await this.requestBytes({ ...input, surface: \"computer\" })) as ComputerControlFrame;\n  }\n\n  async requestBrowserBytesForSession(input: {\n    method: \"GET\";\n    path: string;\n    token: string;\n    expectedFrameEvidence: ExpectedBrowserFrameEvidence;\n    timeoutMs?: number;\n  }): Promise<BrowserControlFrame> {\n    return (await this.requestBytes({ ...input, surface: \"browser\" })) as BrowserControlFrame;\n  }\n\n  private async requestJson(\n    input: {\n      method: \"GET\" | \"POST\" | \"PUT\" | \"DELETE\";\n      path: string;\n      token: string;\n      body?: unknown;\n      timeoutMs?: number;\n    },\n    retryNativeEndpoint = true,\n  ): Promise<unknown> {\n    // Image-backed placements expose browserd through the provider tunnel. Use\n    // that actual data plane for control too: one authenticated HTTP request,\n    // instead of materializing files and starting curl through the sandbox exec\n    // API for every click or key. Connected machines keep their agent transport.\n    const requireHostFetch = this.session.requireHostFetchController === true;\n    if (this.session.resolveExposedPort && !this.session.ensureBrowserControl) {\n      try {\n        const endpoint = await this.session.resolveExposedPort(this.port);\n        // Lifecycle proxies rewrite Authorization, so a host-side Bearer cannot\n        // be both the proxy key and the browserd admin token. Native `/` tunnels\n        // and OSEP-0011 signed URIs host-fetch. Unsigned OpenSandbox still uses\n        // in-box loopback curl on the lifecycle prefix. Signed Channel B never\n        // takes that path. A cached controller-only session has no exec, so\n        // host-fetching a lifecycle prefix would 401; throw a retryable\n        // transport error so the caller invalidates and provisions.\n        const hostFetchAllowed = exposedPortAllowsHostFetch(endpoint);\n        const canExec = Boolean(this.session.exec || this.session.execCommand);\n        if (!hostFetchAllowed && (requireHostFetch || !canExec)) {\n          throw new BrowserControlTransportError(\n            requireHostFetch\n              ? \"signed Channel B cannot use the lifecycle proxy\"\n              : \"cached browser controller endpoint cannot host-fetch a prefixed proxy\",\n          );\n        }\n        if (hostFetchAllowed) {\n          try {\n            return await requestExposedController(\n              endpoint,\n              input,\n              this.timeoutMs,\n              this.session.runtimeMetrics,\n            );\n          } catch (error) {\n            if (\n              retryNativeEndpoint &&\n              !requireHostFetch &&\n              input.method === \"GET\" &&\n              error instanceof BrowserControlTransportError\n            ) {\n              return await this.requestJson(input, false);\n            }\n            throw error;\n          }\n        }\n      } catch (error) {\n        if (\n          error instanceof BrowserControlRequestError ||\n          error instanceof BrowserControlProtocolError ||\n          error instanceof BrowserControlTransportError ||\n          error instanceof RangeError\n        ) {\n          throw error;\n        }\n        if (requireHostFetch || (!this.session.exec && !this.session.execCommand)) {\n          throw new BrowserControlTransportError(\n            requireHostFetch\n              ? \"signed Channel B host-fetch failed\"\n              : \"cached browser controller endpoint is temporarily unavailable\",\n            { cause: error },\n          );\n        }\n        // Unsigned lifecycle placements may fall back to in-box curl when port\n        // discovery fails. Signed Channel B must not; that would restore the\n        // Authorization-rewriting proxy path the signed edge exists to avoid.\n      }\n    } else if (requireHostFetch) {\n      throw new BrowserControlTransportError(\n        \"signed Channel B requires a host-fetch controller endpoint\",\n      );\n    }\n\n    const native = await this.requestNative(input, BROWSER_CONTROL_MAX_JSON_BYTES);\n    if (native) {\n      let text: string;\n      try {\n        text = new TextDecoder(\"utf-8\", { fatal: true }).decode(native.body);\n      } catch (error) {\n        throw new BrowserControlProtocolError(\"browser controller response is not UTF-8\", {\n          cause: error,\n        });\n      }\n      return parseEnvelope(text, native.status);\n    }\n\n    if (\n      this.session.execWithInput &&\n      (input.body === undefined || Buffer.byteLength(JSON.stringify(input.body)) <= 32 * 1024)\n    ) {\n      try {\n        const response = await this.requestStream(input, BROWSER_CONTROL_MAX_JSON_BYTES);\n        return parseEnvelope(\n          new TextDecoder(\"utf-8\", { fatal: true }).decode(response.data),\n          response.status,\n        );\n      } catch (error) {\n        if (\n          retryNativeEndpoint &&\n          input.method === \"GET\" &&\n          this.nativeAuthority &&\n          this.session.ensureBrowserControl &&\n          error instanceof BrowserControlTransportError\n        ) {\n          nativeControllerPorts.delete(nativeControllerKey(this.nativeAuthority));\n          await this.controllerPort();\n          return await this.requestJson(input, false);\n        }\n        throw error;\n      } finally {\n        await this.session.finalizeOpStreamOps?.().catch(() => undefined);\n      }\n    }\n\n    const controllerPort = await this.controllerPort();\n    const directory = `${CLIENT_ROOT}/${randomUUID()}`;\n    const configPath = `${directory}/curl.conf`;\n    const requestPath = `${directory}/request.json`;\n    const responsePath = `${directory}/response.json`;\n    const statusPath = `${directory}/status`;\n    const exitPath = `${directory}/curl-exit`;\n    const token = requireToken(input.token, \"browser controller token\");\n    const timeoutMs = boundedTimeout(input.timeoutMs ?? this.timeoutMs);\n    const url = localControllerUrl(controllerPort, input.path);\n    const body = input.body === undefined ? undefined : JSON.stringify(input.body);\n    try {\n      await runChecked(\n        this.session,\n        `umask 077; install -d -m 0700 -- ${shellQuote(directory)}; printf '%s\\\\n' ${shellQuote(COMMAND_OK)}`,\n        timeoutMs,\n      );\n      if (body !== undefined) {\n        if (Buffer.byteLength(body) > BROWSER_CONTROL_MAX_JSON_BYTES) {\n          throw new RangeError(\"browser controller request body is too large\");\n        }\n        await writePrivateFile(\n          this.session,\n          { path: requestPath, content: body, createParents: false },\n          timeoutMs,\n        );\n      }\n      await writePrivateFile(\n        this.session,\n        {\n          path: configPath,\n          content: curlConfig({\n            method: input.method,\n            url,\n            token,\n            responsePath,\n            ...(body === undefined ? {} : { requestPath }),\n            timeoutMs,\n          }),\n          createParents: false,\n        },\n        timeoutMs,\n      );\n      await runChecked(\n        this.session,\n        `chmod 0600 -- ${shellQuote(configPath)}${body === undefined ? \"\" : ` ${shellQuote(requestPath)}`}; : > ${shellQuote(statusPath)}; curl --disable --config ${shellQuote(configPath)} > ${shellQuote(statusPath)}; curl_exit=$?; printf '%s' \"$curl_exit\" > ${shellQuote(exitPath)}; printf '%s\\\\n' ${shellQuote(COMMAND_OK)}`,\n        timeoutMs,\n      );\n      const curlExit = parseUnsignedInteger(\n        await readText(this.session, exitPath, 32, timeoutMs),\n        \"curl exit\",\n      );\n      if (curlExit !== 0) {\n        throw new BrowserControlTransportError(\n          `browser controller transport failed (curl exit ${curlExit})`,\n        );\n      }\n      const status = parseHttpStatus(await readText(this.session, statusPath, 32, timeoutMs));\n      const responseText = await readText(\n        this.session,\n        responsePath,\n        BROWSER_CONTROL_MAX_JSON_BYTES + 1,\n        timeoutMs,\n      );\n      if (Buffer.byteLength(responseText) > BROWSER_CONTROL_MAX_JSON_BYTES) {\n        throw new BrowserControlProtocolError(\"browser controller response is too large\");\n      }\n      return parseEnvelope(responseText, status);\n    } catch (error) {\n      if (\n        error instanceof BrowserControlRequestError ||\n        error instanceof BrowserControlProtocolError ||\n        error instanceof RangeError\n      ) {\n        throw error;\n      }\n      if (error instanceof BrowserControlTransportError) {\n        if (\n          retryNativeEndpoint &&\n          input.method === \"GET\" &&\n          this.nativeAuthority &&\n          this.session.ensureBrowserControl\n        ) {\n          nativeControllerPorts.delete(nativeControllerKey(this.nativeAuthority));\n          await this.controllerPort();\n          return await this.requestJson(input, false);\n        }\n        throw error;\n      }\n      throw new BrowserControlTransportError(\"browser controller request transport failed\", {\n        cause: error,\n      });\n    } finally {\n      await runBestEffort(this.session, `rm -rf -- ${shellQuote(directory)}`);\n      await this.session.finalizeOpStreamOps?.().catch(() => undefined);\n    }\n  }\n\n  private async requestBytes(\n    input: FrameRequest,\n    retryNativeEndpoint = true,\n  ): Promise<ComputerControlFrame | BrowserControlFrame> {\n    const requireHostFetch = this.session.requireHostFetchController === true;\n    if (this.session.resolveExposedPort && !this.session.ensureBrowserControl) {\n      try {\n        const endpoint = await this.session.resolveExposedPort(this.port);\n        const hostFetchAllowed = exposedPortAllowsHostFetch(endpoint);\n        const canExec = Boolean(this.session.exec || this.session.execCommand);\n        if (!hostFetchAllowed && (requireHostFetch || !canExec)) {\n          throw new BrowserControlTransportError(\n            requireHostFetch\n              ? \"signed Channel B cannot use the lifecycle proxy\"\n              : \"cached browser controller endpoint cannot host-fetch a prefixed proxy\",\n          );\n        }\n        if (hostFetchAllowed) {\n          try {\n            return await requestExposedControllerBytes(endpoint, input, this.timeoutMs);\n          } catch (error) {\n            if (\n              retryNativeEndpoint &&\n              !requireHostFetch &&\n              error instanceof BrowserControlTransportError\n            ) {\n              return await this.requestBytes(input, false);\n            }\n            throw error;\n          }\n        }\n      } catch (error) {\n        if (\n          error instanceof BrowserControlRequestError ||\n          error instanceof BrowserControlProtocolError ||\n          error instanceof BrowserControlTransportError ||\n          error instanceof RangeError\n        ) {\n          throw error;\n        }\n        if (requireHostFetch || (!this.session.exec && !this.session.execCommand)) {\n          throw new BrowserControlTransportError(\n            requireHostFetch\n              ? \"signed Channel B host-fetch failed\"\n              : \"cached browser controller endpoint is temporarily unavailable\",\n            { cause: error },\n          );\n        }\n      }\n    } else if (requireHostFetch) {\n      throw new BrowserControlTransportError(\n        \"signed Channel B requires a host-fetch controller endpoint\",\n      );\n    }\n\n    const nativeFrame = await this.requestNative(\n      input,\n      input.surface === \"browser\" ? 24 * 1024 * 1024 : COMPUTER_SCREENSHOT_MAX_BYTES,\n    );\n    if (nativeFrame) {\n      if (nativeFrame.status < 200 || nativeFrame.status >= 300) {\n        parseEnvelope(new TextDecoder().decode(nativeFrame.body), nativeFrame.status);\n        throw new BrowserControlProtocolError(\"browser controller image response is invalid\");\n      }\n      return controllerImageFrame(nativeFrame.body, nativeFrame.headers, input);\n    }\n\n    if (this.session.execWithInput) {\n      try {\n        const response = await this.requestStream(\n          input,\n          input.surface === \"browser\" ? 24 * 1024 * 1024 : COMPUTER_SCREENSHOT_MAX_BYTES,\n        );\n        if (response.status < 200 || response.status >= 300) {\n          parseEnvelope(new TextDecoder().decode(response.data), response.status);\n          throw new BrowserControlProtocolError(\"browser controller image response is invalid\");\n        }\n        return controllerImageFrame(response.data, response.headers, input);\n      } catch (error) {\n        if (\n          retryNativeEndpoint &&\n          this.nativeAuthority &&\n          this.session.ensureBrowserControl &&\n          error instanceof BrowserControlTransportError\n        ) {\n          nativeControllerPorts.delete(nativeControllerKey(this.nativeAuthority));\n          await this.controllerPort();\n          return await this.requestBytes(input, false);\n        }\n        throw error;\n      } finally {\n        await this.session.finalizeOpStreamOps?.().catch(() => undefined);\n      }\n    }\n\n    const controllerPort = await this.controllerPort();\n    const directory = `${CLIENT_ROOT}/${randomUUID()}`;\n    const configPath = `${directory}/curl.conf`;\n    const responsePath = `${directory}/response.bin`;\n    const responseHeadersPath = `${directory}/response.headers`;\n    const statusPath = `${directory}/status`;\n    const exitPath = `${directory}/curl-exit`;\n    const token = requireToken(input.token, \"browser controller token\");\n    const timeoutMs = boundedTimeout(input.timeoutMs ?? this.timeoutMs);\n    const url = localControllerUrl(controllerPort, input.path);\n    try {\n      await runChecked(\n        this.session,\n        `umask 077; install -d -m 0700 -- ${shellQuote(directory)}; printf '%s\\n' ${shellQuote(COMMAND_OK)}`,\n        timeoutMs,\n      );\n      await writePrivateFile(\n        this.session,\n        {\n          path: configPath,\n          content: curlConfig({\n            method: input.method,\n            url,\n            token,\n            responsePath,\n            responseHeadersPath,\n            timeoutMs,\n          }),\n          createParents: false,\n        },\n        timeoutMs,\n      );\n      await runChecked(\n        this.session,\n        `chmod 0600 -- ${shellQuote(configPath)}; : > ${shellQuote(statusPath)}; curl --disable --config ${shellQuote(configPath)} > ${shellQuote(statusPath)}; curl_exit=$?; printf '%s' \"$curl_exit\" > ${shellQuote(exitPath)}; printf '%s\\n' ${shellQuote(COMMAND_OK)}`,\n        timeoutMs,\n      );\n      const curlExit = parseUnsignedInteger(\n        await readText(this.session, exitPath, 32, timeoutMs),\n        \"curl exit\",\n      );\n      if (curlExit !== 0) {\n        throw new BrowserControlTransportError(\n          `browser controller transport failed (curl exit ${curlExit})`,\n        );\n      }\n      const status = parseHttpStatus(await readText(this.session, statusPath, 32, timeoutMs));\n      if (status < 200 || status >= 300) {\n        const responseText = await readText(\n          this.session,\n          responsePath,\n          BROWSER_CONTROL_MAX_JSON_BYTES + 1,\n          timeoutMs,\n        );\n        parseEnvelope(responseText, status);\n        throw new BrowserControlProtocolError(\"browser controller image response is invalid\");\n      }\n      const headers = parseCurlResponseHeaders(\n        await readText(this.session, responseHeadersPath, 64 * 1024, timeoutMs),\n      );\n      const data = await readBytes(\n        this.session,\n        responsePath,\n        input.surface === \"browser\" ? 24 * 1024 * 1024 : COMPUTER_SCREENSHOT_MAX_BYTES,\n        timeoutMs,\n      );\n      return controllerImageFrame(data, headers, input);\n    } catch (error) {\n      if (\n        error instanceof BrowserControlRequestError ||\n        error instanceof BrowserControlProtocolError ||\n        error instanceof RangeError\n      ) {\n        throw error;\n      }\n      if (error instanceof BrowserControlTransportError) {\n        if (retryNativeEndpoint && this.nativeAuthority && this.session.ensureBrowserControl) {\n          nativeControllerPorts.delete(nativeControllerKey(this.nativeAuthority));\n          await this.controllerPort();\n          return await this.requestBytes(input, false);\n        }\n        throw error;\n      }\n      throw new BrowserControlTransportError(\"browser controller image transport failed\", {\n        cause: error,\n      });\n    } finally {\n      await runBestEffort(this.session, `rm -rf -- ${shellQuote(directory)}`);\n      await this.session.finalizeOpStreamOps?.().catch(() => undefined);\n    }\n  }\n\n  private async requestStream(\n    input: { method: string; path: string; token: string; body?: unknown; timeoutMs?: number },\n    maxBytes: number,\n  ): Promise<ReturnType<typeof parseControllerStreamResponse>> {\n    const port = await this.controllerPort();\n    const request = controllerStreamRequest({\n      method: input.method,\n      url: localControllerUrl(port, input.path),\n      token: requireToken(input.token, \"browser controller token\"),\n      ...(input.body === undefined ? {} : { body: JSON.stringify(input.body) }),\n      timeoutMs: boundedTimeout(input.timeoutMs ?? this.timeoutMs),\n      maxBytes,\n      host: this.session.controllerHostOs?.() ?? \"posix\",\n    });\n    try {\n      const result = await this.session.execWithInput!({\n        cmd: request.cmd,\n        stdin: request.stdin,\n        shell: request.shell,\n        login: false,\n        workdir: placementControllerWorkdir(this.session),\n      });\n      if (result.exitCode !== 0 || result.stdout === undefined) {\n        throw new BrowserControlTransportError(\"browser controller command failed\");\n      }\n      return parseControllerStreamResponse(result.stdout, request.marker, maxBytes);\n    } catch (error) {\n      if (error instanceof RangeError || error instanceof BrowserControlTransportError) throw error;\n      throw new BrowserControlTransportError(\"browser controller request transport failed\", {\n        cause: error,\n      });\n    }\n  }\n\n  private async controllerPort(): Promise<number> {\n    if (!this.nativeAuthority || !this.session.ensureBrowserControl) return this.port;\n    return await this.ensureControllerPort(false);\n  }\n\n  /** The agent-native transport: one in-process loopback request on the\n   * Connected Machine, addressed by authority scope, with no process started.\n   * Null when the placement does not serve it; the caller then keeps its\n   * command transport. A controller that is not running receives nothing, so\n   * it is ensured and the request sent once more whatever its method. */\n  private async requestNative(\n    input: { method: string; path: string; token: string; body?: unknown; timeoutMs?: number },\n    maxResponseBytes: number,\n    retry = true,\n  ): Promise<{ status: number; headers: Map<string, string>; body: Uint8Array } | null> {\n    const authority = this.nativeAuthority;\n    if (!authority || !this.session.browserControlHttp || !this.session.ensureBrowserControl) {\n      return null;\n    }\n    const method = input.method;\n    if (method !== \"GET\" && method !== \"POST\" && method !== \"PUT\" && method !== \"DELETE\") {\n      throw new BrowserControlProtocolError(\"browser controller request method is invalid\");\n    }\n    // Validates the path exactly as the command transport does.\n    localControllerUrl(this.port, input.path);\n    const body =\n      input.body === undefined ? undefined : new TextEncoder().encode(JSON.stringify(input.body));\n    if (body !== undefined && body.byteLength > BROWSER_CONTROL_MAX_JSON_BYTES) {\n      throw new RangeError(\"browser controller request body is too large\");\n    }\n    let outcome: BrowserControlHttpOutcome;\n    try {\n      outcome = await this.session.browserControlHttp({\n        scopeId: authority.scopeId,\n        scopeGeneration: authority.scopeGeneration,\n        method,\n        path: input.path,\n        bearerToken: requireToken(input.token, \"browser controller token\"),\n        ...(body === undefined ? {} : { body }),\n        timeoutMs: boundedTimeout(input.timeoutMs ?? this.timeoutMs),\n        maxResponseBytes,\n      });\n    } catch (error) {\n      if (retry && method === \"GET\") {\n        await this.ensureControllerPort(true);\n        return await this.requestNative(input, maxResponseBytes, false);\n      }\n      throw new BrowserControlTransportError(\"browser controller request transport failed\", {\n        cause: error,\n      });\n    }\n    if (outcome.kind === \"unsupported\") return null;\n    if (outcome.kind === \"controller_absent\") {\n      if (!retry) throw new BrowserControlTransportError(\"browser controller is not running\");\n      await this.ensureControllerPort(true);\n      return await this.requestNative(input, maxResponseBytes, false);\n    }\n    return outcome;\n  }\n\n  private async ensureControllerPort(replace: boolean): Promise<number> {\n    if (!this.nativeAuthority || !this.session.ensureBrowserControl) return this.port;\n    const key = nativeControllerKey(this.nativeAuthority);\n    if (replace) nativeControllerPorts.delete(key);\n    const cached = nativeControllerPorts.get(key);\n    if (cached !== undefined) return cached;\n    const ensured = await this.session.ensureBrowserControl({\n      scopeId: this.nativeAuthority.scopeId,\n      scopeGeneration: this.nativeAuthority.scopeGeneration,\n      adminToken: this.adminToken,\n      allowedOrigins: [],\n    });\n    const port = boundedPort(ensured.port);\n    nativeControllerPorts.set(key, port);\n    return port;\n  }\n}\n\nfunction nativeControllerKey(authority: { scopeId: string; scopeGeneration: string }): string {\n  return `${authority.scopeId}\\u0000${authority.scopeGeneration}`;\n}\n\nexport class BrowserControlSessionClient {\n  readonly reference: PlacementBrowserSessionReference;\n  private readonly parent: BrowserControlClient;\n  private readonly controlToken: string;\n  private readonly viewToken: string;\n\n  constructor(\n    parent: BrowserControlClient,\n    input: {\n      reference: PlacementBrowserSessionReference;\n      controlToken: string;\n      viewToken: string;\n    },\n  ) {\n    this.parent = parent;\n    this.reference = parseReference(input.reference);\n    this.controlToken = requireToken(input.controlToken, \"browser control token\");\n    this.viewToken = requireToken(input.viewToken, \"browser view token\");\n  }\n\n  async listTargets(): Promise<BrowserTargetValue[]> {\n    const data = await this.parent.requestForSession({\n      method: \"GET\",\n      path: this.path(\"targets\"),\n      token: this.viewToken,\n    });\n    if (!Array.isArray(data)) {\n      throw new BrowserControlProtocolError(\"browser controller returned malformed targets\");\n    }\n    return data.map((target) => BrowserTarget.parse(target));\n  }\n\n  async listDownloads(): Promise<BrowserDownloadListResponseValue> {\n    const data = await this.parent.requestForSession({\n      method: \"GET\",\n      path: this.path(\"downloads\"),\n      token: this.viewToken,\n    });\n    const response = BrowserDownloadListResponse.parse(data);\n    if (\n      response.browserSessionId !== this.reference.browserSessionId ||\n      response.controllerGeneration !== this.reference.controllerGeneration\n    ) {\n      throw new BrowserControlProtocolError(\n        \"browser controller returned downloads for another session binding\",\n      );\n    }\n    return response;\n  }\n\n  async download(downloadId: string): Promise<BrowserDownloadValue> {\n    const id = requireUuid(downloadId, \"download id\");\n    const data = await this.parent.requestForSession({\n      method: \"GET\",\n      path: this.path(`downloads/${id}`),\n      token: this.viewToken,\n    });\n    const download = BrowserDownload.parse(data);\n    if (\n      download.id !== id ||\n      download.browserSessionId !== this.reference.browserSessionId ||\n      download.controllerGeneration !== this.reference.controllerGeneration\n    ) {\n      throw new BrowserControlProtocolError(\"browser controller returned another download binding\");\n    }\n    return download;\n  }\n\n  async exportDownload(\n    downloadId: string,\n    requestInput: BrowserDownloadExportRequestValue,\n  ): Promise<BrowserDownloadExportReceiptValue> {\n    const id = requireUuid(downloadId, \"download id\");\n    const request = BrowserDownloadExportRequest.parse(requestInput);\n    if (request.downloadId !== id) {\n      throw new BrowserControlProtocolError(\"download export targets another resource\");\n    }\n    const receipt = BrowserDownloadExportReceipt.parse(\n      await this.parent.requestForSession({\n        method: \"POST\",\n        path: this.path(`downloads/${id}/exports`),\n        token: this.controlToken,\n        body: request,\n      }),\n    );\n    if (receipt.operationId !== request.operationId || receipt.downloadId !== id) {\n      throw new BrowserControlProtocolError(\"browser controller returned another export receipt\");\n    }\n    return receipt;\n  }\n\n  async startRecording(targetId: string): Promise<BrowserRecordingSummaryValue> {\n    let data: unknown;\n    try {\n      data = await this.parent.requestForSession({\n        method: \"POST\",\n        path: this.path(\"recordings\"),\n        token: this.controlToken,\n        body: BrowserRecordingStartRequest.parse({ targetId }),\n      });\n    } catch (error) {\n      // A controller older than browser recording has no such route; say so\n      // instead of surfacing a bare \"route not found\".\n      if (isLegacyRouteMiss(error))\n        throw browserControllerCompatibilityError(\n          \"browser recording\",\n          this.parent.controllerRunsInAgent(),\n        );\n      throw error;\n    }\n    return BrowserRecordingSummary.parse(data);\n  }\n\n  async recording(recordingId: string): Promise<BrowserRecordingSummaryValue> {\n    const id = requireUuid(recordingId, \"recording id\");\n    return BrowserRecordingSummary.parse(\n      await this.parent.requestForSession({\n        method: \"GET\",\n        path: this.path(`recordings/${id}`),\n        token: this.viewToken,\n      }),\n    );\n  }\n\n  async stopRecording(recordingId: string): Promise<BrowserRecordingSummaryValue> {\n    const id = requireUuid(recordingId, \"recording id\");\n    return BrowserRecordingSummary.parse(\n      await this.parent.requestForSession({\n        method: \"POST\",\n        path: this.path(`recordings/${id}/stop`),\n        token: this.controlToken,\n        body: {},\n        timeoutMs: BROWSER_RECORDING_STOP_TIMEOUT_MS,\n      }),\n    );\n  }\n\n  /** Waits for the whole bundle upload. Controllers that support it are asked\n   * through `uploadRecording` instead, which never outlives a slow link. */\n  async exportRecording(\n    requestInput: BrowserRecordingExportRequestValue,\n    options: { timeoutMs?: number } = {},\n  ): Promise<BrowserRecordingExportReceiptValue> {\n    const request = BrowserRecordingExportRequest.parse(requestInput);\n    const receipt = BrowserRecordingExportReceipt.parse(\n      await this.parent.requestForSession({\n        method: \"POST\",\n        path: this.path(`recordings/${request.recordingId}/exports`),\n        token: this.controlToken,\n        body: request,\n        ...(options.timeoutMs === undefined ? {} : { timeoutMs: options.timeoutMs }),\n      }),\n    );\n    if (receipt.recordingId !== request.recordingId) {\n      throw new BrowserControlProtocolError(\"browser controller returned another recording\");\n    }\n    return receipt;\n  }\n\n  /** Starts or joins the bundle upload and waits at most `waitMs` for it to\n   * land. Returns null from a controller that predates resumable uploads. */\n  async uploadRecording(\n    requestInput: BrowserRecordingUploadRequestValue,\n  ): Promise<BrowserRecordingUploadStatusValue | null> {\n    const request = BrowserRecordingUploadRequest.parse(requestInput);\n    let data: unknown;\n    try {\n      data = await this.parent.requestForSession({\n        method: \"POST\",\n        path: this.path(`recordings/${request.recordingId}/uploads`),\n        token: this.controlToken,\n        body: request,\n        timeoutMs: request.waitMs + BROWSER_RECORDING_UPLOAD_RESPONSE_MARGIN_MS,\n      });\n    } catch (error) {\n      if (isLegacyRouteMiss(error)) return null;\n      throw error;\n    }\n    const status = BrowserRecordingUploadStatus.parse(data);\n    if (status.recordingId !== request.recordingId) {\n      throw new BrowserControlProtocolError(\"browser controller returned another recording\");\n    }\n    return status;\n  }\n\n  async openTarget(url?: string): Promise<BrowserObservationValue> {\n    return BrowserObservation.parse(\n      await this.parent.requestForSession({\n        method: \"POST\",\n        path: this.path(\"targets\"),\n        token: this.controlToken,\n        body: url === undefined ? {} : { url: boundedUrl(url) },\n      }),\n    );\n  }\n\n  async openTargetWithInventory(url?: string): Promise<BrowserTargetListResponseValue> {\n    let response: BrowserTargetListResponseValue;\n    try {\n      response = BrowserTargetListResponse.parse(\n        await this.parent.requestForSession({\n          method: \"POST\",\n          path: this.path(\"targets/open-with-inventory\"),\n          token: this.controlToken,\n          body: url === undefined ? {} : { url: boundedUrl(url) },\n        }),\n      );\n    } catch (error) {\n      // A controller image older than this release has no such route. Its\n      // route table rejects the request before dispatch, so no tab was opened\n      // and the original open route is safe to use instead. Every other\n      // failure, including an uncertain open outcome, is never re-sent.\n      if (!isLegacyRouteMiss(error)) throw error;\n      const opened = await this.openTarget(url);\n      if (\n        opened.target.browserSessionId !== this.reference.browserSessionId ||\n        opened.target.controllerGeneration !== this.reference.controllerGeneration\n      ) {\n        throw new BrowserControlProtocolError(\n          \"browser controller opened a tab for another session binding\",\n        );\n      }\n      let targets: BrowserTargetValue[];\n      try {\n        targets = await this.listTargets();\n      } catch {\n        // The tab is open. A raw inventory error (for example a missing or\n        // re-tokened session) would let a caller's recovery replay the open.\n        throw new BrowserControlRequestError(409, {\n          code: \"outcome_unknown\",\n          message:\n            \"browser tab was opened, but the tab list could not be read; list tabs before opening it again\",\n          retryable: false,\n        });\n      }\n      response = {\n        browserSessionId: this.reference.browserSessionId,\n        controllerGeneration: this.reference.controllerGeneration,\n        targets,\n      };\n    }\n    if (\n      response.browserSessionId !== this.reference.browserSessionId ||\n      response.controllerGeneration !== this.reference.controllerGeneration ||\n      response.targets.some(\n        (target) =>\n          target.browserSessionId !== this.reference.browserSessionId ||\n          target.controllerGeneration !== this.reference.controllerGeneration,\n      )\n    ) {\n      throw new BrowserControlProtocolError(\n        \"browser controller returned inventory for another session binding\",\n      );\n    }\n    return response;\n  }\n\n  /** notices: the caller is the agent and receives (and so uses up) any\n   * notice about the tab; see BROWSER_OBSERVATION_NOTICES_PARAMETER. */\n  async selectTarget(\n    targetId: string,\n    options: BrowserObservationNoticeRequest = {},\n  ): Promise<BrowserObservationValue> {\n    return BrowserObservation.parse(\n      await this.parent.requestForSession({\n        method: \"POST\",\n        path: withObservationNotices(this.targetPath(targetId, \"select\"), options),\n        token: this.controlToken,\n        body: {},\n      }),\n    );\n  }\n\n  async closeTarget(targetId: string): Promise<BrowserTargetValue[]> {\n    const data = await this.parent.requestForSession({\n      method: \"DELETE\",\n      path: this.targetPath(targetId),\n      token: this.controlToken,\n    });\n    if (!Array.isArray(data)) {\n      throw new BrowserControlProtocolError(\"browser controller returned malformed targets\");\n    }\n    return data.map((target) => BrowserTarget.parse(target));\n  }\n\n  async observe(\n    targetId: string,\n    options: BrowserObservationNoticeRequest = {},\n  ): Promise<BrowserObservationValue> {\n    return BrowserObservation.parse(\n      await this.parent.requestForSession({\n        method: \"GET\",\n        path: withObservationNotices(this.targetPath(targetId, \"observation\"), options),\n        token: this.viewToken,\n      }),\n    );\n  }\n\n  async targetState(targetId: string): Promise<BrowserTargetStateValue> {\n    let state: BrowserTargetStateValue;\n    try {\n      state = BrowserTargetState.parse(\n        await this.parent.requestForSession({\n          method: \"GET\",\n          path: this.targetPath(targetId, \"state\"),\n          token: this.viewToken,\n        }),\n      );\n    } catch (error) {\n      // Active Connected Machines can run an older browserd during an API rollout.\n      // Only its exact unknown-route response permits the existing observation path.\n      // A missing session or target must keep its original error.\n      if (\n        !(error instanceof BrowserControlRequestError) ||\n        error.status !== 404 ||\n        error.error.code !== \"resource_not_found\" ||\n        error.error.message !== \"route not found\"\n      ) {\n        throw error;\n      }\n      const observation = await this.observe(targetId);\n      state = BrowserTargetState.parse({\n        browserSessionId: observation.browserSessionId,\n        controllerGeneration: observation.target.controllerGeneration,\n        targetId: observation.target.id,\n        targetGeneration: observation.target.targetGeneration,\n        documentGeneration: observation.target.documentGeneration,\n        frameId: observation.frameId,\n      });\n    }\n    if (\n      state.browserSessionId !== this.reference.browserSessionId ||\n      state.controllerGeneration !== this.reference.controllerGeneration ||\n      state.targetId !== targetId\n    ) {\n      throw new BrowserControlProtocolError(\"browser target state belongs to another binding\");\n    }\n    return state;\n  }\n\n  async readDom(\n    targetId: string,\n    requestInput: BrowserDomReadRequestValue,\n  ): Promise<BrowserDomReadResponseValue> {\n    const request = BrowserDomReadRequest.parse(requestInput);\n    let data: unknown;\n    try {\n      data = await this.parent.requestForSession({\n        method: \"POST\",\n        path: this.targetPath(targetId, \"dom-read\"),\n        token: this.viewToken,\n        body: request,\n      });\n    } catch (error) {\n      // Protocol v1 predates focused DOM reads. Distinguish that exact legacy\n      // route response from a missing target/session; neither is safe to retry.\n      if (isLegacyRouteMiss(error)) {\n        throw browserControllerCompatibilityError(\n          \"focused DOM reads\",\n          this.parent.controllerRunsInAgent(),\n        );\n      }\n      throw error;\n    }\n    const result = BrowserDomReadResponse.parse(data);\n    if (\n      result.browserSessionId !== this.reference.browserSessionId ||\n      result.controllerGeneration !== this.reference.controllerGeneration ||\n      result.targetId !== targetId ||\n      result.targetGeneration !== request.expectedTargetGeneration ||\n      result.documentGeneration !== request.expectedDocumentGeneration ||\n      result.frameId !== request.expectedFrameId ||\n      result.kind !== request.kind\n    ) {\n      throw new BrowserControlProtocolError(\"browser DOM read belongs to another binding\");\n    }\n    return result;\n  }\n\n  async capture(\n    targetId: string,\n    options: BrowserControlScreenshotOptions = {},\n  ): Promise<BrowserControlFrame> {\n    const query = new URLSearchParams({\n      format: options.format ?? \"jpeg\",\n      quality: String(boundedInteger(options.quality ?? 55, 1, 100, \"browser screenshot quality\")),\n    });\n    if (options.format !== undefined && options.format !== \"jpeg\" && options.format !== \"png\") {\n      throw new RangeError(\"browser screenshot format is invalid\");\n    }\n    if (options.fullPage !== undefined) {\n      if (typeof options.fullPage !== \"boolean\") {\n        throw new RangeError(\"browser screenshot fullPage is invalid\");\n      }\n      query.set(\"fullPage\", String(options.fullPage));\n    }\n    return await this.parent.requestBrowserBytesForSession({\n      method: \"GET\",\n      path: this.targetPath(targetId, `screenshot?${query}`),\n      token: this.viewToken,\n      expectedFrameEvidence: {\n        browserSessionId: this.reference.browserSessionId,\n        controllerGeneration: this.reference.controllerGeneration,\n        targetId: requireOpaqueId(targetId, \"browser target id\"),\n      },\n    });\n  }\n\n  async readClipboard(): Promise<BrowserClipboardValue> {\n    return BrowserClipboard.parse(\n      await this.parent.requestForSession({\n        method: \"GET\",\n        path: this.path(\"clipboard\"),\n        token: this.viewToken,\n      }),\n    );\n  }\n\n  async action(\n    command: BrowserActionCommandValue,\n    options: BrowserObservationNoticeRequest = {},\n  ): Promise<BrowserActionReceiptValue> {\n    const parsed = BrowserActionCommand.parse(command);\n    if (\n      parsed.browserSessionId !== this.reference.browserSessionId ||\n      parsed.controllerGeneration !== this.reference.controllerGeneration\n    ) {\n      throw new BrowserControlProtocolError(\"browser action targets another controller binding\");\n    }\n    let data: unknown;\n    try {\n      data = await withActionDeadline(\n        \"browser\",\n        browserActionDeadlineMs(parsed.action),\n        async (timeoutMs) =>\n          await this.parent.requestForSession({\n            method: \"POST\",\n            // Controllers that predate resolved targets, notes or notices\n            // ignore these parameters.\n            path: withObservationNotices(\n              `${this.path(\"actions\")}?${BROWSER_ACTION_RECEIPT_TARGETS_PARAMETER}=1&${BROWSER_ACTION_RECEIPT_NOTES_PARAMETER}=${BROWSER_ACTION_RECEIPT_NOTES_VERSION}`,\n              options,\n            ),\n            token: this.controlToken,\n            body: parsed,\n            timeoutMs,\n          }),\n      );\n    } catch (error) {\n      // This command already passed the release's schema. The controller's\n      // exact parser rejection proves a schema mismatch, not invalid tool use.\n      // Do not replay the action, restart the controller, or lose live tabs.\n      // The controller parses before it runs anything, so nothing ran; name the\n      // newer option it did not know.\n      if (\n        error instanceof BrowserControlRequestError &&\n        error.status === 400 &&\n        error.error.code === \"invalid_action\" &&\n        error.error.message === \"browser action is invalid\"\n      ) {\n        throw new BrowserControlRequestError(409, {\n          code: \"unsupported\",\n          message: olderBrowserControllerMessage(\n            parsed.action,\n            this.parent.controllerRunsInAgent(),\n          ),\n          retryable: false,\n        });\n      }\n      throw error;\n    }\n    return BrowserActionReceipt.parse(data);\n  }\n\n  /** API-broker-only file authority path. Signed read URLs are materialized by\n   * browserd and never become part of the public action or durable receipt. */\n  async stageWorkspaceFiles(\n    request: BrowserWorkspaceFileStageRequestValue,\n  ): Promise<BrowserWorkspaceFileStageResponseValue> {\n    const parsed = BrowserWorkspaceFileStageRequest.parse(request);\n    return BrowserWorkspaceFileStageResponse.parse(\n      await this.parent.requestForSession({\n        method: \"POST\",\n        path: this.path(`operations/${parsed.operationId}/workspace-files`),\n        token: this.controlToken,\n        body: parsed,\n        timeoutMs: BROWSER_STATE_TRANSFER_TIMEOUT_MS,\n      }),\n    );\n  }\n\n  async receipt(operationId: string): Promise<BrowserActionReceiptValue> {\n    return BrowserActionReceipt.parse(\n      await this.parent.requestForSession({\n        method: \"GET\",\n        path: this.path(`operations/${requireUuid(operationId, \"operation id\")}`),\n        token: this.viewToken,\n      }),\n    );\n  }\n\n  /** Controller-private passkey exchange (design §10B.4): load the\n   * principal's passkeys into every authenticator and pull registration and\n   * assertion events. Controllers that predate it answer 404. */\n  async passkeySync(\n    request: BrowserPasskeySyncRequestValue,\n  ): Promise<BrowserPasskeySyncResponseValue> {\n    const parsed = BrowserPasskeySyncRequest.parse(request);\n    if (\n      parsed.browserSessionId !== this.reference.browserSessionId ||\n      parsed.controllerGeneration !== this.reference.controllerGeneration\n    ) {\n      throw new BrowserControlProtocolError(\"passkey sync targets another controller binding\");\n    }\n    return BrowserPasskeySyncResponse.parse(\n      await this.parent.requestForSession({\n        method: \"POST\",\n        path: this.path(\"passkeys/sync?backupFlags=1\"),\n        token: this.controlToken,\n        body: parsed,\n      }),\n    );\n  }\n\n  /** API-broker-only provider-auth path. The interactive URL response is\n   * deliberately not exposed by any model-facing SDK or Codemode facade. */\n  async externalAuth(\n    commandInput: BrowserExternalAuthCommandValue,\n  ): Promise<BrowserExternalAuthResultValue> {\n    const command = BrowserExternalAuthCommand.parse(commandInput);\n    if (\n      command.browserSessionId !== this.reference.browserSessionId ||\n      command.controllerGeneration !== this.reference.controllerGeneration\n    ) {\n      throw new BrowserControlProtocolError(\n        \"external authentication targets another browser controller binding\",\n      );\n    }\n    return BrowserExternalAuthResult.parse(\n      await this.parent.requestForSession({\n        method: \"POST\",\n        path: this.path(\"external-auth\"),\n        token: this.controlToken,\n        body: command,\n      }),\n    );\n  }\n\n  async diagnostics(\n    targetId: string,\n    options: {\n      kinds?: readonly BrowserDiagnosticKind[];\n      afterSequence?: number;\n      limit?: number;\n    } = {},\n  ): Promise<BrowserDiagnosticBatchValue> {\n    const query = new URLSearchParams();\n    if (options.kinds) query.set(\"kinds\", [...new Set(options.kinds)].join(\",\"));\n    if (options.afterSequence !== undefined) {\n      query.set(\n        \"after\",\n        nonnegativeSafeInteger(options.afterSequence, \"diagnostic cursor\").toString(),\n      );\n    }\n    if (options.limit !== undefined) {\n      const limit = positiveSafeInteger(options.limit, \"diagnostic limit\");\n      if (limit > 1_000) throw new RangeError(\"diagnostic limit is too large\");\n      query.set(\"limit\", limit.toString());\n    }\n    const suffix = query.size === 0 ? \"\" : `?${query.toString()}`;\n    return BrowserDiagnosticBatch.parse(\n      await this.parent.requestForSession({\n        method: \"GET\",\n        path: `${this.targetPath(targetId, \"diagnostics\")}${suffix}`,\n        token: this.viewToken,\n      }),\n    );\n  }\n\n  private path(suffix: string): string {\n    return `/v1/browser-sessions/${this.reference.browserSessionId}/${suffix}`;\n  }\n\n  private targetPath(targetId: string, suffix?: string): string {\n    const base = this.path(`targets/${encodeURIComponent(requireOpaqueId(targetId, \"target id\"))}`);\n    return suffix ? `${base}/${suffix}` : base;\n  }\n}\n\nexport class ComputerControlSessionClient {\n  readonly reference: PlacementComputerSessionReference;\n  private readonly parent: BrowserControlClient;\n  private readonly controlToken: string;\n  private readonly viewToken: string;\n\n  constructor(\n    parent: BrowserControlClient,\n    input: {\n      reference: PlacementComputerSessionReference;\n      controlToken: string;\n      viewToken: string;\n    },\n  ) {\n    this.parent = parent;\n    this.reference = parseComputerReference(input.reference);\n    this.controlToken = requireToken(input.controlToken, \"computer control token\");\n    this.viewToken = requireToken(input.viewToken, \"computer view token\");\n  }\n\n  async listTargets(): Promise<ComputerTargetValue[]> {\n    const data = await this.parent.requestForSession({\n      method: \"GET\",\n      path: this.path(\"targets\"),\n      token: this.viewToken,\n    });\n    if (!Array.isArray(data)) {\n      throw new BrowserControlProtocolError(\n        \"interaction controller returned malformed computer targets\",\n      );\n    }\n    return data.map((target) => ComputerTarget.parse(target));\n  }\n\n  async observe(targetId: string): Promise<ComputerObservationValue> {\n    return ComputerObservation.parse(\n      await this.parent.requestForSession({\n        method: \"GET\",\n        path: this.targetPath(targetId, \"observation\"),\n        token: this.viewToken,\n      }),\n    );\n  }\n\n  async capture(\n    targetId: string,\n    options: {\n      format?: \"jpeg\" | \"png\";\n      quality?: number;\n      maxWidth?: number;\n      maxHeight?: number;\n    } = {},\n  ): Promise<ComputerControlFrame> {\n    const query = new URLSearchParams();\n    if (options.format !== undefined) query.set(\"format\", options.format);\n    if (options.quality !== undefined) query.set(\"quality\", String(options.quality));\n    if (options.maxWidth !== undefined) query.set(\"maxWidth\", String(options.maxWidth));\n    if (options.maxHeight !== undefined) query.set(\"maxHeight\", String(options.maxHeight));\n    const suffix = query.size > 0 ? `screenshot?${query}` : \"screenshot\";\n    return await this.parent.requestBytesForSession({\n      method: \"GET\",\n      path: this.targetPath(targetId, suffix),\n      token: this.viewToken,\n      expectedFrameEvidence: {\n        computerSessionId: this.reference.computerSessionId,\n        controllerGeneration: this.reference.controllerGeneration,\n        targetId: requireOpaqueId(targetId, \"computer target id\"),\n      },\n    });\n  }\n\n  async readClipboard(): Promise<ComputerClipboardValue> {\n    return ComputerClipboard.parse(\n      await this.parent.requestForSession({\n        method: \"GET\",\n        path: this.path(\"clipboard\"),\n        token: this.viewToken,\n      }),\n    );\n  }\n\n  async nativeCall(command: ComputerNativeCommand): Promise<ComputerNativeReceipt> {\n    const parsed = ComputerNativeCommand.parse(command);\n    if (\n      parsed.computerSessionId !== this.reference.computerSessionId ||\n      parsed.controllerGeneration !== this.reference.controllerGeneration\n    )\n      throw new BrowserControlProtocolError(\"native call targets another controller binding\");\n    return ComputerNativeReceipt.parse(\n      await this.parent.requestForSession({\n        method: \"POST\",\n        path: this.path(\"native-calls\"),\n        token: this.controlToken,\n        body: parsed,\n      }),\n    );\n  }\n\n  async action(command: ComputerActionCommandValue): Promise<ComputerActionReceiptValue> {\n    const parsed = ComputerActionCommand.parse(command);\n    if (\n      parsed.computerSessionId !== this.reference.computerSessionId ||\n      parsed.controllerGeneration !== this.reference.controllerGeneration\n    ) {\n      throw new BrowserControlProtocolError(\"computer action targets another controller binding\");\n    }\n    return ComputerActionReceipt.parse(\n      await withActionDeadline(\n        \"computer\",\n        computerActionDeadlineMs(parsed.action),\n        async (timeoutMs) =>\n          await this.parent.requestForSession({\n            method: \"POST\",\n            // Controllers that predate role stand-ins or unconfirmed input\n            // ignore these parameters.\n            path: `${this.path(\"actions\")}?${COMPUTER_ACTION_RECEIPT_STAND_INS_PARAMETER}=1&${COMPUTER_ACTION_RECEIPT_UNCONFIRMED_INPUT_PARAMETER}=1`,\n            token: this.controlToken,\n            body: parsed,\n            timeoutMs,\n          }),\n      ),\n    );\n  }\n\n  async receipt(operationId: string): Promise<ComputerOperationReceipt> {\n    return ComputerOperationReceipt.parse(\n      await this.parent.requestForSession({\n        method: \"GET\",\n        path: this.path(`operations/${requireUuid(operationId, \"operation id\")}`),\n        token: this.viewToken,\n      }),\n    );\n  }\n\n  async heartbeat(): Promise<void> {\n    const data = await this.parent.requestForSession({\n      method: \"POST\",\n      path: this.path(\"heartbeat\"),\n      token: this.controlToken,\n      body: {},\n    });\n    if (!isRecord(data) || data.alive !== true) {\n      throw new BrowserControlProtocolError(\n        \"interaction controller returned malformed computer heartbeat\",\n      );\n    }\n  }\n\n  private path(suffix: string): string {\n    return `/v1/computer-sessions/${this.reference.computerSessionId}/${suffix}`;\n  }\n\n  private targetPath(targetId: string, suffix?: string): string {\n    const base = this.path(\n      `targets/${encodeURIComponent(requireOpaqueId(targetId, \"computer target id\"))}`,\n    );\n    return suffix ? `${base}/${suffix}` : base;\n  }\n}\n\nfunction curlConfig(input: {\n  method: string;\n  url: string;\n  token: string;\n  responsePath: string;\n  responseHeadersPath?: string;\n  requestPath?: string;\n  timeoutMs: number;\n}): string {\n  const seconds = Math.max(1, Math.ceil(input.timeoutMs / 1_000));\n  return [\n    \"silent\",\n    \"show-error\",\n    `noproxy = ${curlConfigQuote(\"*\")}`,\n    `connect-timeout = ${Math.min(seconds, 15)}`,\n    `max-time = ${seconds}`,\n    `request = ${curlConfigQuote(input.method)}`,\n    `url = ${curlConfigQuote(input.url)}`,\n    `header = ${curlConfigQuote(`Authorization: Bearer ${input.token}`)}`,\n    ...(input.requestPath\n      ? [\n          `header = ${curlConfigQuote(\"Content-Type: application/json\")}`,\n          `data-binary = ${curlConfigQuote(`@${input.requestPath}`)}`,\n        ]\n      : []),\n    `output = ${curlConfigQuote(input.responsePath)}`,\n    ...(input.responseHeadersPath\n      ? [`dump-header = ${curlConfigQuote(input.responseHeadersPath)}`]\n      : []),\n    `write-out = ${curlConfigQuote(\"%{http_code}\")}`,\n    \"\",\n  ].join(\"\\n\");\n}\n\nfunction joinControllerPath(endpointPath: string | undefined, requestPath: string): string {\n  try {\n    return joinExposedPortPath(endpointPath, requestPath);\n  } catch (error) {\n    if (error instanceof StreamPortUnavailableError) {\n      throw new BrowserControlProtocolError(error.message);\n    }\n    throw error;\n  }\n}\n\nfunction exposedPortHeaders(endpoint: ExposedPortEndpoint): Record<string, string> {\n  const raw = endpoint.headers;\n  if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return {};\n  const headers: Record<string, string> = {};\n  for (const [key, value] of Object.entries(raw as Record<string, unknown>)) {\n    if (typeof key !== \"string\" || typeof value !== \"string\") continue;\n    if (key.toLowerCase() === \"authorization\") continue;\n    headers[key] = value;\n  }\n  return headers;\n}\n\nasync function requestExposedController(\n  endpoint: ExposedPortEndpoint,\n  input: {\n    method: \"GET\" | \"POST\" | \"PUT\" | \"DELETE\";\n    path: string;\n    token: string;\n    body?: unknown;\n    timeoutMs?: number;\n  },\n  defaultTimeoutMs: number,\n  metrics?: {\n    onOpenSandboxSignedEndpoint?: (input: {\n      outcome: \"minted\" | \"mint_failed\" | \"host_fetch_unauthorized\";\n      port: number;\n    }) => void;\n  },\n): Promise<unknown> {\n  const token = requireToken(input.token, \"browser controller token\");\n  const timeoutMs = boundedTimeout(input.timeoutMs ?? defaultTimeoutMs);\n  const streamUrl = exposedControllerUrl(endpoint, input.path);\n  streamUrl.protocol = streamUrl.protocol === \"wss:\" ? \"https:\" : \"http:\";\n  const body = input.body === undefined ? undefined : JSON.stringify(input.body);\n  if (body !== undefined && Buffer.byteLength(body) > BROWSER_CONTROL_MAX_JSON_BYTES) {\n    throw new RangeError(\"browser controller request body is too large\");\n  }\n  const response = await controllerTransport(\n    async () =>\n      await fetch(streamUrl, {\n        method: input.method,\n        headers: {\n          ...exposedPortHeaders(endpoint),\n          authorization: `Bearer ${token}`,\n          ...(body === undefined ? {} : { \"content-type\": \"application/json\" }),\n        },\n        ...(body === undefined ? {} : { body }),\n        redirect: \"manual\",\n        signal: AbortSignal.timeout(timeoutMs),\n        // The signal is this request's whole deadline. The runtime's default\n        // five-minute socket idle timer would otherwise end a longer action\n        // batch, whose controller sends nothing until the batch finishes.\n        timeout: false,\n      }),\n  );\n  const responseText = await controllerTransport(async () => await response.text());\n  if (Buffer.byteLength(responseText) > BROWSER_CONTROL_MAX_JSON_BYTES) {\n    throw new BrowserControlProtocolError(\"browser controller response is too large\");\n  }\n  rejectProviderGatewayResponse(responseText, response.status);\n  if (\n    (response.status === 401 || response.status === 403) &&\n    !looksLikeBrowserControlEnvelope(responseText)\n  ) {\n    const signed = parseOpenSandboxSignedUriPath(endpoint.path ?? \"\");\n    if (signed) {\n      try {\n        metrics?.onOpenSandboxSignedEndpoint?.({\n          outcome: \"host_fetch_unauthorized\",\n          port: signed.port,\n        });\n      } catch {\n        /* metrics must not affect Channel B */\n      }\n    }\n    throw new BrowserControlTransportError(`browser controller returned HTTP ${response.status}`);\n  }\n  return parseEnvelope(responseText, response.status);\n}\n\nasync function requestExposedControllerBytes(\n  endpoint: ExposedPortEndpoint,\n  input: FrameRequest,\n  defaultTimeoutMs: number,\n): Promise<ComputerControlFrame | BrowserControlFrame> {\n  const token = requireToken(input.token, \"browser controller token\");\n  const timeoutMs = boundedTimeout(input.timeoutMs ?? defaultTimeoutMs);\n  const streamUrl = exposedControllerUrl(endpoint, input.path);\n  streamUrl.protocol = streamUrl.protocol === \"wss:\" ? \"https:\" : \"http:\";\n  const response = await controllerTransport(\n    async () =>\n      await fetch(streamUrl, {\n        method: input.method,\n        headers: {\n          ...exposedPortHeaders(endpoint),\n          authorization: `Bearer ${token}`,\n          accept: \"image/jpeg, image/png\",\n        },\n        redirect: \"manual\",\n        signal: AbortSignal.timeout(timeoutMs),\n      }),\n  );\n  if (!response.ok) {\n    const responseText = await controllerTransport(async () => await response.text());\n    if (Buffer.byteLength(responseText) > BROWSER_CONTROL_MAX_JSON_BYTES) {\n      throw new BrowserControlProtocolError(\"browser controller response is too large\");\n    }\n    rejectProviderGatewayResponse(responseText, response.status);\n    parseEnvelope(responseText, response.status);\n    throw new BrowserControlProtocolError(\"browser controller image response is invalid\");\n  }\n  const declaredLength = Number(response.headers.get(\"content-length\"));\n  const maxBytes = input.surface === \"browser\" ? 24 * 1024 * 1024 : COMPUTER_SCREENSHOT_MAX_BYTES;\n  if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {\n    await response.body?.cancel(\"frame exceeds its byte bound\").catch(() => undefined);\n    throw new RangeError(\"frame exceeds its byte bound\");\n  }\n  const data = await controllerTransport(\n    async () => await readBoundedFrameResponse(response, maxBytes),\n  );\n  return controllerImageFrame(data, response.headers, input);\n}\n\nasync function controllerTransport<T>(readOrDispatch: () => Promise<T>): Promise<T> {\n  try {\n    return await readOrDispatch();\n  } catch (error) {\n    if (\n      error instanceof BrowserControlProtocolError ||\n      error instanceof BrowserControlTransportError ||\n      error instanceof RangeError\n    ) {\n      throw error;\n    }\n    // Fetch or response-body failure cannot prove the controller did not\n    // execute a mutation. Keep it typed so endpoint discovery's in-box fallback\n    // cannot replay an already-dispatched request.\n    throw new BrowserControlTransportError(\"browser controller host-fetch failed\", {\n      cause: error,\n    });\n  }\n}\n\nasync function readBoundedFrameResponse(response: Response, maxBytes: number): Promise<Uint8Array> {\n  if (!response.body) throw new BrowserControlProtocolError(\"browser controller image is empty\");\n  const reader = response.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let size = 0;\n  try {\n    for (;;) {\n      const { done, value } = await reader.read();\n      if (done) break;\n      size += value.byteLength;\n      if (size > maxBytes) {\n        await reader.cancel(\"frame exceeds its byte bound\").catch(() => undefined);\n        throw new RangeError(\"frame exceeds its byte bound\");\n      }\n      chunks.push(value);\n    }\n  } finally {\n    reader.releaseLock();\n  }\n  const data = new Uint8Array(size);\n  let offset = 0;\n  for (const chunk of chunks) {\n    data.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return data;\n}\n\nfunction controllerImageFrame(\n  data: Uint8Array,\n  headers: { get(name: string): string | null | undefined },\n  input: FrameRequest,\n): ComputerControlFrame | BrowserControlFrame {\n  return input.surface === \"browser\"\n    ? browserControlFrame(data, headers, input.expectedFrameEvidence)\n    : computerControlFrame(data, headers, input.expectedFrameEvidence);\n}\n\nfunction browserControlFrame(\n  data: Uint8Array,\n  headers: { get(name: string): string | null | undefined },\n  expected: ExpectedBrowserFrameEvidence,\n): BrowserControlFrame {\n  if (data.byteLength < 1 || data.byteLength > 24 * 1024 * 1024) {\n    throw new RangeError(\"browser frame exceeds its byte bound\");\n  }\n  const get = (name: string): string | null => headers.get(name.toLowerCase()) ?? null;\n  const mediaType = get(\"content-type\")?.split(\";\", 1)[0]?.trim().toLowerCase();\n  if (mediaType !== \"image/jpeg\" && mediaType !== \"image/png\") {\n    throw new BrowserControlProtocolError(\"browser frame media type is invalid\");\n  }\n  const metadataHeader = get(\"x-opengeni-browser-frame\");\n  if (\n    !metadataHeader ||\n    metadataHeader.length > 64 * 1024 ||\n    !/^[A-Za-z0-9_-]+$/u.test(metadataHeader)\n  ) {\n    throw new BrowserControlProtocolError(\"browser frame metadata is invalid\");\n  }\n  let metadata: BrowserFrameMetadata;\n  try {\n    metadata = parseBrowserFrameMetadata(\n      JSON.parse(Buffer.from(metadataHeader, \"base64url\").toString(\"utf8\")),\n    );\n  } catch {\n    throw new BrowserControlProtocolError(\"browser frame metadata is invalid\");\n  }\n  if (\n    metadata.browserSessionId !== expected.browserSessionId ||\n    metadata.controllerGeneration !== expected.controllerGeneration ||\n    metadata.targetId !== expected.targetId ||\n    metadata.mediaType !== mediaType\n  ) {\n    throw new BrowserControlProtocolError(\"browser frame evidence does not match its request\");\n  }\n  return {\n    data,\n    mediaType,\n    metadataHeader,\n    metadata,\n    ...(get(\"x-opengeni-browser-frame-note\") === \"inexact-scrollbars\"\n      ? { inexactScrollbars: true as const }\n      : {}),\n  };\n}\n\nfunction computerControlFrame(\n  data: Uint8Array,\n  headers: { get(name: string): string | null | undefined },\n  expected: ExpectedComputerFrameEvidence,\n): ComputerControlFrame {\n  if (data.byteLength < 1 || data.byteLength > COMPUTER_SCREENSHOT_MAX_BYTES) {\n    throw new RangeError(\"computer frame exceeds its byte bound\");\n  }\n  const get = (name: string): string | null => headers.get(name.toLowerCase()) ?? null;\n  const mediaType = get(\"content-type\")?.split(\";\", 1)[0]?.trim().toLowerCase();\n  if (mediaType !== \"image/jpeg\" && mediaType !== \"image/png\") {\n    throw new BrowserControlProtocolError(\"computer frame media type is invalid\");\n  }\n  const metadataHeader = get(\"x-opengeni-computer-frame\");\n  if (\n    !metadataHeader ||\n    metadataHeader.length > 32 * 1024 ||\n    !/^[A-Za-z0-9_-]+$/u.test(metadataHeader)\n  ) {\n    throw new BrowserControlProtocolError(\"computer frame metadata is invalid\");\n  }\n  return validateComputerControlFrameEvidence({ data, mediaType, metadataHeader }, expected);\n}\n\nexport function validateComputerControlFrameEvidence(\n  frame: Pick<ComputerControlFrame, \"data\" | \"mediaType\" | \"metadataHeader\">,\n  expected: ExpectedComputerFrameEvidence,\n): ComputerControlFrame {\n  const metadata = decodeComputerControlFrameMetadataHeader(frame.metadataHeader);\n  if (metadata.computerSessionId !== expected.computerSessionId) {\n    throw new ComputerFrameEvidenceMismatchError(\"frame_session_mismatch\");\n  }\n  if (metadata.targetId !== expected.targetId) {\n    throw new ComputerFrameEvidenceMismatchError(\"frame_target_mismatch\");\n  }\n  if (metadata.controllerGeneration !== expected.controllerGeneration) {\n    throw new ComputerFrameEvidenceMismatchError(\"frame_controller_mismatch\");\n  }\n  if (metadata.mediaType !== frame.mediaType) {\n    throw new ComputerFrameEvidenceMismatchError(\"frame_media_mismatch\");\n  }\n  const digest = createHash(\"sha256\").update(frame.data).digest(\"hex\");\n  if (metadata.sha256 !== digest) {\n    throw new ComputerFrameEvidenceMismatchError(\"frame_digest_mismatch\");\n  }\n  return { ...frame, metadata };\n}\n\nexport function decodeComputerControlFrameMetadataHeader(\n  value: string,\n): ComputerControlFrameMetadata {\n  if (!value || value.length > 32 * 1024 || !/^[A-Za-z0-9_-]+$/u.test(value)) {\n    throw new BrowserControlProtocolError(\"computer frame metadata is invalid\");\n  }\n  let decoded: unknown;\n  try {\n    decoded = JSON.parse(Buffer.from(value, \"base64url\").toString(\"utf8\"));\n  } catch {\n    throw new BrowserControlProtocolError(\"computer frame metadata is invalid\");\n  }\n  if (!isRecord(decoded)) {\n    throw new BrowserControlProtocolError(\"computer frame metadata is invalid\");\n  }\n  const allowed = new Set([\n    \"frameId\",\n    \"computerSessionId\",\n    \"controllerGeneration\",\n    \"targetId\",\n    \"targetGeneration\",\n    \"sequence\",\n    \"mediaType\",\n    \"width\",\n    \"height\",\n    \"capturedAt\",\n    \"sha256\",\n  ]);\n  if (Object.keys(decoded).some((key) => !allowed.has(key))) {\n    throw new BrowserControlProtocolError(\"computer frame metadata is invalid\");\n  }\n  for (const key of [\n    \"frameId\",\n    \"computerSessionId\",\n    \"controllerGeneration\",\n    \"targetId\",\n    \"targetGeneration\",\n    \"mediaType\",\n    \"capturedAt\",\n  ] as const) {\n    const item = decoded[key];\n    const maxBytes = key === \"targetId\" ? 512 : key === \"capturedAt\" ? 128 : 256;\n    if (typeof item !== \"string\" || item.length < 1 || Buffer.byteLength(item) > maxBytes) {\n      throw new BrowserControlProtocolError(\"computer frame metadata is invalid\");\n    }\n  }\n  if (typeof decoded.sha256 !== \"string\" || !SHA256_PATTERN.test(decoded.sha256)) {\n    throw new ComputerFrameEvidenceMismatchError(\"frame_digest_mismatch\");\n  }\n  if (\n    !Number.isSafeInteger(decoded.sequence) ||\n    Number(decoded.sequence) < 0 ||\n    !boundedComputerFrameDimension(decoded.width, decoded.height)\n  ) {\n    throw new BrowserControlProtocolError(\"computer frame metadata is invalid\");\n  }\n  if (decoded.mediaType !== \"image/jpeg\" && decoded.mediaType !== \"image/png\") {\n    throw new BrowserControlProtocolError(\"computer frame metadata is invalid\");\n  }\n  if (!isUuidString(decoded.computerSessionId)) {\n    throw new BrowserControlProtocolError(\"computer frame metadata is invalid\");\n  }\n  const controllerGeneration = decoded.controllerGeneration;\n  if (\n    typeof controllerGeneration !== \"string\" ||\n    !/^[A-Za-z0-9][A-Za-z0-9._:-]*$/u.test(controllerGeneration)\n  ) {\n    throw new BrowserControlProtocolError(\"computer frame metadata is invalid\");\n  }\n  const capturedAt = decoded.capturedAt;\n  if (typeof capturedAt !== \"string\" || !Number.isFinite(new Date(capturedAt).valueOf())) {\n    throw new BrowserControlProtocolError(\"computer frame metadata is invalid\");\n  }\n  return decoded as ComputerControlFrameMetadata;\n}\n\nfunction boundedComputerFrameDimension(width: unknown, height: unknown): boolean {\n  return (\n    Number.isSafeInteger(width) &&\n    Number.isSafeInteger(height) &&\n    Number(width) > 0 &&\n    Number(height) > 0 &&\n    Number(width) <= 32_768 &&\n    Number(height) <= 32_768 &&\n    Number(width) * Number(height) <= 100_000_000\n  );\n}\n\nfunction isUuidString(value: unknown): value is string {\n  return (\n    typeof value === \"string\" &&\n    /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(value)\n  );\n}\n\nfunction exposedControllerUrl(endpoint: ExposedPortEndpoint, requestPath: string): URL {\n  const separator = requestPath.indexOf(\"?\");\n  const path = separator === -1 ? requestPath : requestPath.slice(0, separator);\n  const requestQuery = separator === -1 ? \"\" : requestPath.slice(separator + 1);\n  const url = new URL(\n    buildStreamUrl({ ...endpoint, path: joinControllerPath(endpoint.path, path) }),\n  );\n  for (const [name, value] of new URLSearchParams(requestQuery)) {\n    url.searchParams.append(name, value);\n  }\n  return url;\n}\n\nfunction parseCurlResponseHeaders(value: string): Map<string, string> {\n  const headers = new Map<string, string>();\n  for (const line of value.split(/\\r?\\n/u)) {\n    if (/^HTTP\\//u.test(line)) {\n      headers.clear();\n      continue;\n    }\n    const separator = line.indexOf(\":\");\n    if (separator <= 0) continue;\n    const name = line.slice(0, separator).trim().toLowerCase();\n    const headerValue = line.slice(separator + 1).trim();\n    if (name && headerValue) headers.set(name, headerValue);\n  }\n  return headers;\n}\n\nfunction looksLikeBrowserControlEnvelope(body: string): boolean {\n  try {\n    const value: unknown = JSON.parse(body);\n    return isRecord(value) && value.protocolVersion === BROWSER_CONTROL_PROTOCOL_VERSION;\n  } catch {\n    return false;\n  }\n}\n\nfunction rejectProviderGatewayResponse(body: string, status: number): void {\n  // A tunnel's transient upstream failure is not a browserd protocol response.\n  // Preserve browserd envelopes, including their semantic retry policy. This\n  // transport classification cannot prove that a mutation was not dispatched.\n  if ([502, 503, 504].includes(status) && !looksLikeBrowserControlEnvelope(body)) {\n    throw new BrowserControlTransportError(`browser controller returned HTTP ${status}`);\n  }\n}\n\nfunction parseEnvelope(body: string, status: number): unknown {\n  let value: unknown;\n  try {\n    value = JSON.parse(body);\n  } catch {\n    throw new BrowserControlProtocolError(\"browser controller response is invalid JSON\");\n  }\n  if (!isRecord(value) || value.protocolVersion !== BROWSER_CONTROL_PROTOCOL_VERSION) {\n    throw new BrowserControlProtocolError(\"browser controller protocol version is invalid\");\n  }\n  if (value.ok === true && status >= 200 && status < 300 && \"data\" in value) return value.data;\n  if (value.ok === false && status >= 400 && status <= 599) {\n    const parsed = InteractionError.safeParse(value.error);\n    if (parsed.success) {\n      throw new BrowserControlRequestError(\n        status,\n        parsed.data,\n        // A driver failure, or a read that kept failing for an unclassified\n        // reason, carries the driver's error class and frame for logs.\n        parsed.data.code === \"driver_failed\" || parsed.data.code === \"resource_unavailable\"\n          ? parseInteractionDriverDiagnostic(value.diagnostic)\n          : null,\n      );\n    }\n  }\n  throw new BrowserControlProtocolError(\"browser controller response envelope is invalid\");\n}\n\nfunction localControllerUrl(port: number, path: string): string {\n  if (!path.startsWith(\"/\") || path.includes(\"\\0\") || path.includes(\"#\")) {\n    throw new BrowserControlProtocolError(\"browser controller request path is invalid\");\n  }\n  return `http://127.0.0.1:${port}${path}`;\n}\n\nfunction parseReference(value: unknown): PlacementBrowserSessionReference {\n  if (!isRecord(value)) throw new BrowserControlProtocolError(\"browser session binding is invalid\");\n  return {\n    browserSessionId: requireUuid(value.browserSessionId, \"browser session id\"),\n    controllerGeneration: requireGeneration(value.controllerGeneration),\n  };\n}\n\n/** A create's tab inventory is a convenience: an older controller omits it,\n * and an inventory that does not validate, or that belongs to another\n * binding, is dropped rather than failing a browser that did launch. */\nfunction creationTargets(\n  value: unknown,\n  reference: PlacementBrowserSessionReference,\n): { targets?: BrowserTargetValue[] } {\n  if (!Array.isArray(value) || value.length > 10_000) return {};\n  const targets: BrowserTargetValue[] = [];\n  for (const entry of value) {\n    const parsed = BrowserTarget.safeParse(entry);\n    if (\n      !parsed.success ||\n      parsed.data.browserSessionId !== reference.browserSessionId ||\n      parsed.data.controllerGeneration !== reference.controllerGeneration\n    )\n      return {};\n    targets.push(parsed.data);\n  }\n  return { targets };\n}\n\n/** A launch notice is advisory text; an older controller omits it and a\n * malformed one is dropped rather than failing a browser that did launch. */\nfunction creationNotice(value: unknown): { notice?: string } {\n  if (typeof value !== \"string\") return {};\n  const notice = value.replace(/\\s+/gu, \" \").trim();\n  return notice.length > 0 && notice.length <= 1_024 ? { notice } : {};\n}\n\n/** The launched display is a report, not authority: anything but a known\n * value is dropped, as from an older controller that sends none. */\nfunction creationDisplay(value: unknown): { display?: \"window\" | \"offscreen\" } {\n  return value === \"window\" || value === \"offscreen\" ? { display: value } : {};\n}\n\nfunction parseComputerReference(value: unknown): PlacementComputerSessionReference {\n  if (!isRecord(value)) {\n    throw new BrowserControlProtocolError(\"computer session binding is invalid\");\n  }\n  return {\n    computerSessionId: requireUuid(value.computerSessionId, \"computer session id\"),\n    controllerGeneration: requireGeneration(value.controllerGeneration),\n  };\n}\n\nfunction placementBrowserTransport(input: PlacementBrowserTransport): PlacementBrowserTransport {\n  if (input.kind === \"managed\") {\n    if (\n      input.engine !== undefined &&\n      input.engine !== \"chromium\" &&\n      input.engine !== \"lightpanda\"\n    ) {\n      throw new BrowserControlProtocolError(\"managed browser engine is invalid\");\n    }\n    if (input.ephemeralPartition !== undefined && !SHA256_PATTERN.test(input.ephemeralPartition))\n      throw new Error(\"ephemeral browser partition is invalid\");\n    return {\n      kind: \"managed\",\n      engine: input.engine ?? \"chromium\",\n      ...(input.ephemeralPartition ? { ephemeralPartition: input.ephemeralPartition } : {}),\n    };\n  }\n  if (input.kind === \"external_provider\") {\n    if (input.providerId !== \"browserbase\" && input.providerId !== \"kernel\") {\n      throw new BrowserControlProtocolError(\"external browser provider is unsupported\");\n    }\n    const endpoint = input.authority.endpoint\n      ? boundedHttpUrl(input.authority.endpoint, \"external browser provider endpoint\")\n      : undefined;\n    return {\n      kind: \"external_provider\",\n      providerId: input.providerId,\n      placementId: requireOpaqueId(input.placementId, \"external browser placement id\"),\n      authority: {\n        apiKey: requireBoundedText(\n          input.authority.apiKey,\n          1,\n          8_192,\n          \"external browser provider credential\",\n        ),\n        ...(endpoint ? { endpoint } : {}),\n      },\n      ...(input.timeoutSeconds === undefined\n        ? {}\n        : {\n            timeoutSeconds: boundedExternalBrowserTimeout(input.timeoutSeconds),\n          }),\n      ...(input.stealth === undefined ? {} : { stealth: input.stealth }),\n    };\n  }\n  return {\n    kind: \"attached_chrome\",\n    deviceId: requireUuid(input.deviceId, \"attached browser id\"),\n    connectionGeneration: requireBridgeGeneration(input.connectionGeneration),\n    browserName: requireBoundedText(input.browserName, 1, 100, \"attached browser name\"),\n    browserVersion: requireBoundedText(input.browserVersion, 1, 256, \"attached browser version\"),\n  };\n}\n\nfunction boundedExternalBrowserTimeout(value: number): number {\n  const timeout = positiveSafeInteger(value, \"external browser timeout\");\n  if (timeout > 86_400) {\n    throw new BrowserControlProtocolError(\"external browser timeout is invalid\");\n  }\n  return timeout;\n}\n\nfunction boundedHttpUrl(value: string, label: string): string {\n  if (Buffer.byteLength(value) > 16_384) {\n    throw new BrowserControlProtocolError(`${label} is invalid`);\n  }\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    throw new BrowserControlProtocolError(`${label} is invalid`);\n  }\n  if (\n    (parsed.protocol !== \"https:\" && parsed.protocol !== \"http:\") ||\n    parsed.username ||\n    parsed.password ||\n    parsed.hash\n  ) {\n    throw new BrowserControlProtocolError(`${label} is invalid`);\n  }\n  return parsed.toString().replace(/\\/$/u, \"\");\n}\n\nfunction placementBrowserNetworkRoute(\n  input: PlacementBrowserNetworkRoute,\n): PlacementBrowserNetworkRoute {\n  const kind = input.kind;\n  if (kind !== \"direct\" && kind !== \"proxy\" && kind !== \"managed\" && kind !== \"tunnel\") {\n    throw new BrowserControlProtocolError(\"browser network route kind is invalid\");\n  }\n  if (!/^[A-Za-z0-9._~-]{16,256}$/u.test(input.authorityDigest)) {\n    throw new BrowserControlProtocolError(\"browser network route authority is invalid\");\n  }\n  const proxyUrl = input.proxyUrl === undefined ? undefined : boundedProxyUrl(input.proxyUrl);\n  if (kind !== \"proxy\" && proxyUrl !== undefined) {\n    throw new BrowserControlProtocolError(\"non-proxy browser route contains proxy authority\");\n  }\n  const providerRoute =\n    input.providerRoute === undefined ? undefined : placementProviderRoute(input.providerRoute);\n  if (kind !== \"managed\" && providerRoute !== undefined) {\n    throw new BrowserControlProtocolError(\n      \"non-managed browser route contains provider route material\",\n    );\n  }\n  if (kind === \"managed\" && providerRoute === undefined) {\n    throw new BrowserControlProtocolError(\"managed browser route omits provider route material\");\n  }\n  return {\n    routeId: requireUuid(input.routeId, \"network route id\"),\n    routeVersion: positiveSafeInteger(input.routeVersion, \"network route version\"),\n    authorityDigest: input.authorityDigest,\n    kind,\n    consistency: NetworkRouteConsistency.parse(input.consistency),\n    ...(proxyUrl === undefined ? {} : { proxyUrl }),\n    ...(providerRoute === undefined ? {} : { providerRoute }),\n  };\n}\n\nfunction placementProviderRoute(\n  input: NonNullable<PlacementBrowserNetworkRoute[\"providerRoute\"]>,\n): NonNullable<PlacementBrowserNetworkRoute[\"providerRoute\"]> {\n  if (input.providerId !== \"browserbase\" && input.providerId !== \"kernel\") {\n    throw new BrowserControlProtocolError(\"managed browser route provider is unsupported\");\n  }\n  if (\n    input.egressClass !== \"datacenter\" &&\n    input.egressClass !== \"residential\" &&\n    input.egressClass !== \"isp\"\n  ) {\n    throw new BrowserControlProtocolError(\"managed browser route egress class is invalid\");\n  }\n  return {\n    providerId: input.providerId,\n    routeId: requireOpaqueId(input.routeId, \"managed browser provider route id\"),\n    egressClass: input.egressClass,\n    region:\n      input.region === null\n        ? null\n        : requireBoundedText(input.region, 1, 128, \"managed browser route region\"),\n  };\n}\n\nfunction boundedProxyUrl(value: string): string {\n  if (Buffer.byteLength(value) > 16_384) {\n    throw new BrowserControlProtocolError(\"browser proxy authority is too large\");\n  }\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new BrowserControlProtocolError(\"browser proxy authority is invalid\");\n  }\n  if (\n    ![\"http:\", \"https:\", \"socks5:\"].includes(url.protocol) ||\n    !url.hostname ||\n    (!url.port && url.protocol !== \"http:\" && url.protocol !== \"https:\") ||\n    (url.pathname !== \"\" && url.pathname !== \"/\") ||\n    url.search ||\n    url.hash\n  ) {\n    throw new BrowserControlProtocolError(\"browser proxy authority is invalid\");\n  }\n  return url.toString();\n}\n\nfunction workingCopyAuthorityBody(\n  reference: PlacementBrowserSessionReference,\n  input: PlacementBrowserWorkingCopyAuthority,\n) {\n  return {\n    controllerGeneration: reference.controllerGeneration,\n    tokenGeneration: positiveSafeInteger(input.tokenGeneration, \"token generation\"),\n    controlToken: requireToken(input.controlToken, \"control token\"),\n    viewToken: requireToken(input.viewToken, \"view token\"),\n  };\n}\n\n/**\n * An adoption record. `generation: \"current\"` (a new adoption) requires the\n * record to belong to the requesting controller generation. `\"recorded\"`\n * (status, revert, inspection) keeps the generation the adoption was recorded\n * under: recovering an unfinished adoption after a controller restart means\n * reading and reverting a record made by an earlier generation, under the\n * browser's legitimate current control. The browser and operation always\n * have to match exactly.\n */\nfunction parseWorkingCopyAdoption(\n  value: unknown,\n  reference: PlacementBrowserSessionReference,\n  generation: \"current\" | \"recorded\",\n): PlacementBrowserWorkingCopyAdoption {\n  if (\n    !isRecord(value) ||\n    value.browserSessionId !== reference.browserSessionId ||\n    (generation === \"current\" && value.controllerGeneration !== reference.controllerGeneration) ||\n    !BROWSER_WORKING_COPY_ADOPTION_PHASES.includes(\n      value.phase as PlacementBrowserWorkingCopyAdoptionPhase,\n    ) ||\n    !(value.failureCode === null || typeof value.failureCode === \"string\") ||\n    !Array.isArray(value.retainedDirectories) ||\n    value.retainedDirectories.length > 64 ||\n    !value.retainedDirectories.every(\n      (name) => typeof name === \"string\" && /^[A-Za-z0-9][A-Za-z0-9._-]{0,255}$/u.test(name),\n    )\n  ) {\n    throw new BrowserControlProtocolError(\"browser controller returned a malformed adoption\");\n  }\n  return {\n    browserSessionId: reference.browserSessionId,\n    controllerGeneration:\n      generation === \"current\"\n        ? reference.controllerGeneration\n        : requireGeneration(value.controllerGeneration),\n    operationId: requireUuid(value.operationId, \"working copy adoption id\"),\n    manifestDigest: sha256(value.manifestDigest, \"working copy manifest digest\"),\n    phase: value.phase as PlacementBrowserWorkingCopyAdoptionPhase,\n    failureCode:\n      value.failureCode === null ? null : requireOpaqueId(value.failureCode, \"failure code\"),\n    retainedDirectories: value.retainedDirectories as string[],\n    createdAt: timestamp(value.createdAt, \"adoption created at\"),\n    updatedAt: timestamp(value.updatedAt, \"adoption updated at\"),\n  };\n}\n\nfunction parseWorkingCopyInspection(\n  value: unknown,\n  reference: PlacementBrowserSessionReference,\n): PlacementBrowserWorkingCopyInspection {\n  if (\n    !isRecord(value) ||\n    value.browserSessionId !== reference.browserSessionId ||\n    value.controllerGeneration !== reference.controllerGeneration ||\n    typeof value.platformSupported !== \"boolean\" ||\n    typeof value.profileIdentityMatches !== \"boolean\" ||\n    !(value.profileInUse === null || typeof value.profileInUse === \"boolean\") ||\n    !(\n      value.refusal === null ||\n      BROWSER_WORKING_COPY_REFUSALS.includes(value.refusal as PlacementBrowserWorkingCopyRefusal)\n    )\n  ) {\n    throw new BrowserControlProtocolError(\"browser controller returned a malformed inspection\");\n  }\n  let manifest: PlacementBrowserWorkingCopyInspection[\"manifest\"] = null;\n  if (value.manifest !== null) {\n    if (!isRecord(value.manifest)) {\n      throw new BrowserControlProtocolError(\"browser controller returned a malformed manifest\");\n    }\n    manifest = {\n      digest: sha256(value.manifest.digest, \"working copy manifest digest\"),\n      entries: nonnegativeSafeInteger(value.manifest.entries, \"working copy entries\"),\n      bytes: nonnegativeSafeInteger(value.manifest.bytes, \"working copy bytes\"),\n      excluded: excludedWorkingCopyEntries(value.manifest.excluded),\n    };\n  }\n  let receipt: PlacementBrowserWorkingCopyInspection[\"receipt\"] = null;\n  if (value.receipt !== null) {\n    const raw = value.receipt;\n    if (\n      !isRecord(raw) ||\n      ![\"launch\", \"suspend\", \"retire\", \"adopt\"].includes(raw.intent as string) ||\n      typeof raw.state !== \"string\" ||\n      typeof raw.directoryLaunchAllowed !== \"boolean\" ||\n      typeof raw.authorityMatches !== \"boolean\" ||\n      !(raw.restoreAuthorityDigest === null || typeof raw.restoreAuthorityDigest === \"string\") ||\n      !(raw.adoption === null || isRecord(raw.adoption))\n    ) {\n      throw new BrowserControlProtocolError(\"browser controller returned a malformed receipt\");\n    }\n    receipt = {\n      operationId: requireUuid(raw.operationId, \"working runtime receipt id\"),\n      intent: raw.intent as \"launch\" | \"suspend\" | \"retire\" | \"adopt\",\n      state: requireOpaqueId(raw.state, \"working runtime receipt state\"),\n      directoryLaunchAllowed: raw.directoryLaunchAllowed,\n      authorityMatches: raw.authorityMatches,\n      launchedFromCheckpoint: raw.restoreAuthorityDigest !== null,\n      adoption: isRecord(raw.adoption)\n        ? {\n            operationId: requireUuid(raw.adoption.operationId, \"working copy adoption id\"),\n            manifestDigest: sha256(raw.adoption.manifestDigest, \"working copy manifest digest\"),\n          }\n        : null,\n    };\n  }\n  return {\n    browserSessionId: reference.browserSessionId,\n    controllerGeneration: reference.controllerGeneration,\n    platformSupported: value.platformSupported,\n    refusal: value.refusal as PlacementBrowserWorkingCopyRefusal | null,\n    manifest,\n    profileIdentityMatches: value.profileIdentityMatches,\n    profileInUse: value.profileInUse,\n    receipt,\n    activeAdoption:\n      value.activeAdoption === null || value.activeAdoption === undefined\n        ? null\n        : parseWorkingCopyAdoption(value.activeAdoption, reference, \"recorded\"),\n  };\n}\n\nfunction parseStateCaptureReceipt(value: unknown): PlacementBrowserStateCaptureReceipt {\n  if (!isRecord(value) || !isRecord(value.manifest)) {\n    throw new BrowserControlProtocolError(\n      \"browser controller returned malformed state-capture data\",\n    );\n  }\n  const manifest = value.manifest;\n  if (!Array.isArray(manifest.tabs)) {\n    throw new BrowserControlProtocolError(\n      \"browser controller returned malformed state-capture manifest\",\n    );\n  }\n  const browserSessionId = requireUuid(value.browserSessionId, \"browser session id\");\n  const controllerGeneration = requireGeneration(value.controllerGeneration);\n  const manifestSessionId = requireUuid(\n    manifest.browserSessionId,\n    \"browser state manifest session id\",\n  );\n  const manifestControllerGeneration = requireGeneration(manifest.controllerGeneration);\n  if (\n    manifestSessionId !== browserSessionId ||\n    manifestControllerGeneration !== controllerGeneration\n  ) {\n    throw new BrowserControlProtocolError(\n      \"browser controller returned inconsistent state-capture metadata\",\n    );\n  }\n  if (\n    value.format !== BROWSER_PROFILE_ARTIFACT_FORMAT ||\n    manifest.schemaVersion !== 1 ||\n    (manifest.engine !== \"chromium\" && manifest.engine !== \"chrome\") ||\n    (manifest.platform !== \"linux\" &&\n      manifest.platform !== \"macos\" &&\n      manifest.platform !== \"windows\") ||\n    (manifest.architecture !== \"x64\" && manifest.architecture !== \"arm64\")\n  ) {\n    throw new BrowserControlProtocolError(\n      \"browser controller returned unsupported state-capture metadata\",\n    );\n  }\n  if (\n    manifest.profileCrypto !== \"chromium_basic\" &&\n    manifest.profileCrypto !== \"chromium_mock_keychain\" &&\n    manifest.profileCrypto !== \"platform_bound\"\n  ) {\n    throw new BrowserControlProtocolError(\n      \"browser controller returned unsupported profile crypto policy\",\n    );\n  }\n  const tabs = manifest.tabs.map((tab) => {\n    if (!isRecord(tab) || typeof tab.selected !== \"boolean\") {\n      throw new BrowserControlProtocolError(\n        \"browser controller returned malformed state-capture tab\",\n      );\n    }\n    return { url: boundedUrl(tab.url), selected: tab.selected };\n  });\n  if (tabs.length > 1_000 || tabs.filter((tab) => tab.selected).length > 1) {\n    throw new BrowserControlProtocolError(\"browser controller returned invalid state-capture tabs\");\n  }\n  return {\n    operationId: requireUuid(value.operationId, \"browser state operation id\"),\n    browserSessionId,\n    controllerGeneration,\n    objectKey: browserStateObjectKey(value.objectKey),\n    format: BROWSER_PROFILE_ARTIFACT_FORMAT,\n    artifactDigest: sha256(value.artifactDigest, \"browser state artifact digest\"),\n    contentDigest: sha256(value.contentDigest, \"browser state content digest\"),\n    sizeBytes: positiveSafeInteger(value.sizeBytes, \"browser state artifact size\"),\n    fileCount: nonnegativeSafeInteger(value.fileCount, \"browser state file count\"),\n    profileBytes: nonnegativeSafeInteger(value.profileBytes, \"browser state profile size\"),\n    manifest: {\n      schemaVersion: 1,\n      browserSessionId: manifestSessionId,\n      controllerGeneration: manifestControllerGeneration,\n      capturedAt: timestamp(manifest.capturedAt, \"browser state capture time\"),\n      engine: manifest.engine,\n      engineVersion:\n        manifest.engineVersion === null\n          ? null\n          : requireOpaqueId(manifest.engineVersion, \"browser engine version\"),\n      driverId: requireOpaqueId(manifest.driverId, \"browser driver id\"),\n      driverSchemaVersion: positiveSafeInteger(\n        manifest.driverSchemaVersion,\n        \"browser driver schema version\",\n      ),\n      profileCrypto: manifest.profileCrypto,\n      platform: manifest.platform,\n      architecture: manifest.architecture,\n      tabs,\n    },\n  };\n}\n\nfunction browserStateObjectKey(value: unknown): string {\n  if (\n    typeof value !== \"string\" ||\n    Buffer.byteLength(value) > 2_048 ||\n    !/^workspaces\\/[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\\/browser-state\\/[A-Za-z0-9._=-]+(?:\\/[A-Za-z0-9._=-]+)*$/iu.test(\n      value,\n    )\n  ) {\n    throw new RangeError(\"browser state object key is invalid\");\n  }\n  return value;\n}\n\nfunction browserStateUploadGrant(value: unknown): BrowserStateUploadGrant {\n  if (!isRecord(value) || !isRecord(value.requiredHeaders)) {\n    throw new RangeError(\"browser state upload grant is invalid\");\n  }\n  const url = boundedUrl(value.url);\n  const parsed = new URL(url);\n  if (\n    (parsed.protocol !== \"https:\" && parsed.protocol !== \"http:\") ||\n    parsed.username ||\n    parsed.password ||\n    parsed.hash\n  ) {\n    throw new RangeError(\"browser state upload URL is invalid\");\n  }\n  const headers: Record<string, string> = {};\n  for (const [name, headerValue] of Object.entries(value.requiredHeaders)) {\n    if (\n      (name !== \"content-type\" && name !== \"x-ms-blob-type\") ||\n      typeof headerValue !== \"string\" ||\n      /[\\r\\n]/u.test(headerValue)\n    ) {\n      throw new RangeError(\"browser state upload header is invalid\");\n    }\n    headers[name] = headerValue;\n  }\n  if (Object.keys(headers).length < 1 || Object.keys(headers).length > 2) {\n    throw new RangeError(\"browser state upload header count is invalid\");\n  }\n  if (headers[\"content-type\"] !== BROWSER_STATE_ARTIFACT_CONTENT_TYPE) {\n    throw new RangeError(\"browser state upload content type is invalid\");\n  }\n  return {\n    url: parsed.toString(),\n    requiredHeaders: headers,\n    expiresAt: timestamp(value.expiresAt, \"browser state upload expiry\"),\n  };\n}\n\nfunction browserStateDownloadGrant(value: unknown): BrowserStateDownloadGrant {\n  if (!isRecord(value)) {\n    throw new RangeError(\"browser state download grant is invalid\");\n  }\n  const url = boundedUrl(value.url);\n  const parsed = new URL(url);\n  if (\n    (parsed.protocol !== \"https:\" && parsed.protocol !== \"http:\") ||\n    parsed.username ||\n    parsed.password ||\n    parsed.hash\n  ) {\n    throw new RangeError(\"browser state download URL is invalid\");\n  }\n  return {\n    url: parsed.toString(),\n    expiresAt: timestamp(value.expiresAt, \"browser state download expiry\"),\n  };\n}\n\nfunction browserStateRestoreRequest(input: RestorePlacementBrowserStateInput): {\n  wire: Record<string, unknown>;\n  dataKey: Buffer;\n  aad: Buffer;\n} {\n  if (input.format !== BROWSER_PROFILE_ARTIFACT_FORMAT) {\n    throw new RangeError(\"browser state restore format is unsupported\");\n  }\n  const dataKey = Buffer.from(exactBytes(input.dataKey, 32, \"browser state data key\"));\n  const aad = Buffer.from(boundedBytes(input.aad, 1, 16 * 1024, \"browser state associated data\"));\n  try {\n    return {\n      wire: {\n        objectKey: browserStateObjectKey(input.objectKey),\n        format: BROWSER_PROFILE_ARTIFACT_FORMAT,\n        artifactDigest: sha256(input.artifactDigest, \"browser state artifact digest\"),\n        contentDigest: sha256(input.contentDigest, \"browser state content digest\"),\n        manifestDigest: sha256(input.manifestDigest, \"browser state manifest digest\"),\n        sizeBytes: positiveSafeInteger(input.sizeBytes, \"browser state artifact size\"),\n        dataKeyBase64: dataKey.toString(\"base64\"),\n        aadBase64: aad.toString(\"base64\"),\n        materialization: BrowserRevisionMaterialization.parse(input.materialization),\n        download: browserStateDownloadGrant(input.download),\n      },\n      dataKey,\n      aad,\n    };\n  } catch (error) {\n    dataKey.fill(0);\n    aad.fill(0);\n    throw error;\n  }\n}\n\nfunction exactBytes(value: Uint8Array, length: number, label: string): Uint8Array {\n  return boundedBytes(value, length, length, label);\n}\n\nfunction boundedBytes(\n  value: Uint8Array,\n  minimum: number,\n  maximum: number,\n  label: string,\n): Uint8Array {\n  if (!(value instanceof Uint8Array) || value.byteLength < minimum || value.byteLength > maximum) {\n    throw new RangeError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction sha256(value: unknown, label: string): string {\n  if (typeof value !== \"string\" || !SHA256_PATTERN.test(value)) {\n    throw new BrowserControlProtocolError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction requirePlacementProvisioningSurface(session: BrowserControlPlacementSession): void {\n  const hasPrivateWrite =\n    typeof session.writePlacementPrivate === \"function\" ||\n    typeof session.writeFile === \"function\" ||\n    ((typeof session.exec === \"function\" || typeof session.execCommand === \"function\") &&\n      typeof session.writeStdin === \"function\");\n  if (\n    (typeof session.exec !== \"function\" && typeof session.execCommand !== \"function\") ||\n    !hasPrivateWrite\n  ) {\n    throw new BrowserControlUnsupportedError(\n      \"browser placement requires exec and a private file transport\",\n    );\n  }\n}\n\nfunction requirePlacementRequestSurface(session: BrowserControlPlacementSession): void {\n  const hasExec = typeof session.exec === \"function\" || typeof session.execCommand === \"function\";\n  const hasPrivateWrite =\n    typeof session.writePlacementPrivate === \"function\" ||\n    typeof session.writeFile === \"function\" ||\n    (hasExec && typeof session.writeStdin === \"function\");\n  if (\n    typeof session.execWithInput !== \"function\" &&\n    typeof session.resolveExposedPort !== \"function\" &&\n    (!hasExec || !hasPrivateWrite)\n  ) {\n    throw new BrowserControlUnsupportedError(\n      \"browser placement requires a controller endpoint or exec and a private file transport\",\n    );\n  }\n}\n\nfunction isWorkspaceConfinedWrite(error: unknown): boolean {\n  return (\n    error instanceof Error &&\n    /must stay within|confines|workspace mount|within \\/workspace|escapes? the workspace(?: root)?/iu.test(\n      error.message,\n    )\n  );\n}\n\nasync function writePrivateFile(\n  session: BrowserControlPlacementSession,\n  input: {\n    path: string;\n    content: string | Uint8Array;\n    createParents?: boolean;\n  },\n  timeoutMs = 60_000,\n): Promise<void> {\n  if (session.writePlacementPrivate) {\n    await session.writePlacementPrivate(input);\n    return;\n  }\n  if (session.writeFile) {\n    try {\n      await session.writeFile(input);\n      return;\n    } catch (error) {\n      if (\n        !isWorkspaceConfinedWrite(error) ||\n        (!session.exec && !session.execCommand) ||\n        !session.writeStdin\n      ) {\n        throw error;\n      }\n    }\n  }\n  if ((!session.exec && !session.execCommand) || !session.writeStdin) {\n    throw new BrowserControlUnsupportedError(\"browser placement has no private file transport\");\n  }\n  const path = absolutePrivatePath(input.path, \"browser private file path\");\n  const bytes = typeof input.content === \"string\" ? Buffer.from(input.content) : input.content;\n  if (bytes.byteLength > BROWSER_CONTROL_MAX_JSON_BYTES) {\n    throw new RangeError(\"browser private file is too large\");\n  }\n  const parent = posixPath.dirname(path);\n  if (input.createParents) {\n    await runChecked(\n      session,\n      `umask 077; install -d -m 0700 -- ${shellQuote(parent)}; printf '%s\\n' ${shellQuote(COMMAND_OK)}`,\n      timeoutMs,\n    );\n  }\n  if (bytes.byteLength === 0) {\n    await runChecked(\n      session,\n      `umask 077; : > ${shellQuote(path)}; chmod 0600 -- ${shellQuote(path)}; printf '%s\\n' ${shellQuote(COMMAND_OK)}`,\n      timeoutMs,\n    );\n    return;\n  }\n\n  // SandboxSession deliberately has no generic writeFile capability. Stream a\n  // bounded base64 payload over the provider's stdin channel into an exact-byte\n  // decoder. Secret material never appears in a shell command, argv, env, URL,\n  // workspace, or provider process listing.\n  const payload = Buffer.from(bytes).toString(\"base64\");\n  const command = [\n    \"umask 077;\",\n    \"if base64 --help 2>&1 | grep -q -- '--decode'; then decode_flag=--decode;\",\n    \"elif printf '' | base64 -d >/dev/null 2>&1; then decode_flag=-d;\",\n    \"elif printf '' | base64 -D >/dev/null 2>&1; then decode_flag=-D;\",\n    \"else exit 69; fi;\",\n    `dd bs=1 count=${payload.length} 2>/dev/null | base64 \"$decode_flag\" > ${shellQuote(path)};`,\n    `chmod 0600 -- ${shellQuote(path)};`,\n    `printf '%s\\n' ${shellQuote(COMMAND_OK)}`,\n  ].join(\" \");\n  const started = session.exec\n    ? await session.exec({\n        cmd: command,\n        workdir: placementControllerWorkdir(session),\n        yieldTimeMs: 250,\n        maxOutputTokens: 2_000,\n      })\n    : await session.execCommand!({\n        cmd: command,\n        workdir: placementControllerWorkdir(session),\n        yieldTimeMs: 250,\n        maxOutputTokens: 2_000,\n      });\n  const startedSessionId =\n    typeof started === \"string\"\n      ? (() => {\n          const banner = parseExecResponseBanner(started);\n          return banner.kind === \"running\" ? banner.sessionId : null;\n        })()\n      : Number.isSafeInteger(started.sessionId) && (started.sessionId ?? -1) >= 0\n        ? started.sessionId!\n        : null;\n  if (startedSessionId === null) {\n    throw new BrowserControlTransportError(\n      \"browser private file transport did not yield an input session\",\n    );\n  }\n  const output = await session.writeStdin({\n    sessionId: startedSessionId,\n    chars: payload,\n    yieldTimeMs: boundedTimeout(timeoutMs),\n    maxOutputTokens: 2_000,\n  });\n  const terminal = parseExecResponseBanner(output);\n  if (\n    terminal.kind === \"invalid\" ||\n    terminal.kind === \"running\" ||\n    (terminal.kind === \"exited\" && terminal.exitCode !== 0) ||\n    !output.includes(COMMAND_OK)\n  ) {\n    throw new BrowserControlTransportError(\"browser private file transport failed\");\n  }\n}\n\nasync function runChecked(\n  session: BrowserControlPlacementSession,\n  command: string,\n  timeoutMs = 60_000,\n): Promise<void> {\n  const bounded = boundedTimeout(timeoutMs);\n  const result = session.exec\n    ? await session.exec({\n        cmd: command,\n        workdir: placementControllerWorkdir(session),\n        yieldTimeMs: bounded,\n        maxOutputTokens: 2_000,\n      })\n    : await session.execCommand!({\n        cmd: command,\n        workdir: placementControllerWorkdir(session),\n        yieldTimeMs: bounded,\n        maxOutputTokens: 2_000,\n      });\n  const output = commandOutput(result);\n  const exitCode = typeof result === \"object\" && result ? result.exitCode : undefined;\n  if ((typeof exitCode === \"number\" && exitCode !== 0) || !output.includes(COMMAND_OK)) {\n    throw new BrowserControlTransportError(\"browser placement command failed\");\n  }\n}\n\nasync function runBestEffort(\n  session: BrowserControlPlacementSession,\n  command: string,\n): Promise<void> {\n  try {\n    if (session.exec) {\n      await session.exec({\n        cmd: command,\n        workdir: placementControllerWorkdir(session),\n        yieldTimeMs: 15_000,\n        maxOutputTokens: 100,\n      });\n    } else if (session.execCommand) {\n      await session.execCommand({\n        cmd: command,\n        workdir: placementControllerWorkdir(session),\n        yieldTimeMs: 15_000,\n        maxOutputTokens: 100,\n      });\n    }\n  } catch {\n    // UUID-scoped request directories contain no durable state.\n  }\n}\n\nasync function readText(\n  session: BrowserControlPlacementSession,\n  path: string,\n  maxBytes: number,\n  timeoutMs: number,\n): Promise<string> {\n  const privatePath = absolutePrivatePath(path, \"browser private response path\");\n  if (\n    !Number.isSafeInteger(maxBytes) ||\n    maxBytes < 1 ||\n    maxBytes > BROWSER_CONTROL_MAX_JSON_BYTES + 1\n  ) {\n    throw new RangeError(\"browser private response limit is invalid\");\n  }\n  if (session.readFile) {\n    try {\n      const value = await session.readFile({ path: privatePath, maxBytes });\n      return typeof value === \"string\"\n        ? value\n        : new TextDecoder(\"utf-8\", { fatal: true }).decode(value);\n    } catch {\n      // The standard Docker SandboxSession intentionally confines readFile to\n      // its workspace mount. Keep controller traffic out of that capturable\n      // mount and fall back to the same placement's bounded command channel.\n    }\n  }\n\n  const sizeMarker = `OPENGENI_BROWSER_PRIVATE_SIZE_${randomUUID()}`;\n  const sizeOutput = await runPrivateReadCommand(\n    session,\n    [\n      \"LC_ALL=C;\",\n      `size=$(wc -c < ${shellQuote(privatePath)}) || exit 66;`,\n      `printf '%s%s%s' ${shellQuote(sizeMarker)} \"$size\" ${shellQuote(sizeMarker)}`,\n    ].join(\" \"),\n    1_024,\n    timeoutMs,\n  );\n  const sizeText = extractMarkedValue(sizeOutput, sizeMarker);\n  const size = parseUnsignedInteger(sizeText, \"browser private response size\");\n  const requestedBytes = Math.min(size, maxBytes);\n  if (requestedBytes === 0) return \"\";\n\n  const chunks: Buffer[] = [];\n  for (let offset = 0; offset < requestedBytes; offset += PRIVATE_READ_CHUNK_BYTES) {\n    const chunkIndex = Math.floor(offset / PRIVATE_READ_CHUNK_BYTES);\n    const expectedBytes = Math.min(PRIVATE_READ_CHUNK_BYTES, requestedBytes - offset);\n    const marker = `OPENGENI_BROWSER_PRIVATE_CHUNK_${randomUUID()}`;\n    const output = await runPrivateReadCommand(\n      session,\n      [\n        \"LC_ALL=C;\",\n        `printf '%s' ${shellQuote(marker)};`,\n        `dd if=${shellQuote(privatePath)} bs=${PRIVATE_READ_CHUNK_BYTES} skip=${chunkIndex} count=1 2>/dev/null | base64 | tr -d '\\\\r\\\\n';`,\n        `printf '%s' ${shellQuote(marker)}`,\n      ].join(\" \"),\n      Math.ceil((expectedBytes * 4) / 3) + 4_096,\n      timeoutMs,\n    );\n    const encoded = extractMarkedValue(output, marker);\n    if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u.test(encoded)) {\n      throw new BrowserControlTransportError(\"browser private response encoding is invalid\");\n    }\n    const decoded = Buffer.from(encoded, \"base64\");\n    if (decoded.byteLength < expectedBytes) {\n      throw new BrowserControlTransportError(\"browser private response changed during read\");\n    }\n    chunks.push(decoded.subarray(0, expectedBytes));\n  }\n  return new TextDecoder(\"utf-8\", { fatal: true }).decode(Buffer.concat(chunks));\n}\n\nasync function readBytes(\n  session: BrowserControlPlacementSession,\n  path: string,\n  maxBytes: number,\n  timeoutMs: number,\n): Promise<Uint8Array> {\n  const privatePath = absolutePrivatePath(path, \"browser private binary response path\");\n  if (\n    !Number.isSafeInteger(maxBytes) ||\n    maxBytes < 1 ||\n    maxBytes > Math.max(24 * 1024 * 1024, COMPUTER_SCREENSHOT_MAX_BYTES)\n  ) {\n    throw new RangeError(\"browser private binary response limit is invalid\");\n  }\n  const sizeMarker = `OPENGENI_BROWSER_PRIVATE_SIZE_${randomUUID()}`;\n  const sizeOutput = await runPrivateReadCommand(\n    session,\n    [\n      \"LC_ALL=C;\",\n      `size=$(wc -c < ${shellQuote(privatePath)}) || exit 66;`,\n      `printf '%s%s%s' ${shellQuote(sizeMarker)} \"$size\" ${shellQuote(sizeMarker)}`,\n    ].join(\" \"),\n    1_024,\n    timeoutMs,\n  );\n  const size = parseUnsignedInteger(\n    extractMarkedValue(sizeOutput, sizeMarker),\n    \"browser private binary response size\",\n  );\n  if (size < 1 || size > maxBytes) {\n    throw new RangeError(\"frame exceeds its byte bound\");\n  }\n  const chunks: Buffer[] = [];\n  for (let offset = 0; offset < size; offset += PRIVATE_READ_CHUNK_BYTES) {\n    const chunkIndex = Math.floor(offset / PRIVATE_READ_CHUNK_BYTES);\n    const expectedBytes = Math.min(PRIVATE_READ_CHUNK_BYTES, size - offset);\n    const marker = `OPENGENI_BROWSER_PRIVATE_CHUNK_${randomUUID()}`;\n    const output = await runPrivateReadCommand(\n      session,\n      [\n        \"LC_ALL=C;\",\n        `printf '%s' ${shellQuote(marker)};`,\n        `dd if=${shellQuote(privatePath)} bs=${PRIVATE_READ_CHUNK_BYTES} skip=${chunkIndex} count=1 2>/dev/null | base64 | tr -d '\\\\r\\\\n';`,\n        `printf '%s' ${shellQuote(marker)}`,\n      ].join(\" \"),\n      Math.ceil((expectedBytes * 4) / 3) + 4_096,\n      timeoutMs,\n    );\n    const encoded = extractMarkedValue(output, marker);\n    if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u.test(encoded)) {\n      throw new BrowserControlTransportError(\"browser private binary response encoding is invalid\");\n    }\n    const decoded = Buffer.from(encoded, \"base64\");\n    if (decoded.byteLength !== expectedBytes) {\n      throw new BrowserControlTransportError(\"browser private binary response changed during read\");\n    }\n    chunks.push(decoded);\n  }\n  return Uint8Array.from(Buffer.concat(chunks));\n}\n\nasync function runPrivateReadCommand(\n  session: BrowserControlPlacementSession,\n  command: string,\n  maxOutputTokens: number,\n  timeoutMs: number,\n): Promise<string> {\n  const bounded = boundedTimeout(timeoutMs);\n  const result = session.exec\n    ? await session.exec({\n        cmd: command,\n        workdir: placementControllerWorkdir(session),\n        yieldTimeMs: bounded,\n        maxOutputTokens,\n      })\n    : await session.execCommand!({\n        cmd: command,\n        workdir: placementControllerWorkdir(session),\n        yieldTimeMs: bounded,\n        maxOutputTokens,\n      });\n  const exitCode = typeof result === \"object\" && result ? result.exitCode : undefined;\n  if (typeof result === \"object\" && result?.sessionId !== undefined) {\n    throw new BrowserControlTransportError(\"browser private response read failed\");\n  }\n  if (typeof result === \"string\") {\n    const terminal = parseExecResponseBanner(result);\n    if (\n      terminal.kind === \"invalid\" ||\n      terminal.kind === \"running\" ||\n      (terminal.kind === \"exited\" && terminal.exitCode !== 0)\n    ) {\n      throw new BrowserControlTransportError(\"browser private response read failed\");\n    }\n    return result;\n  }\n  if (typeof exitCode === \"number\" && exitCode !== 0) {\n    throw new BrowserControlTransportError(\"browser private response read failed\");\n  }\n  return result.stdout ?? result.output ?? \"\";\n}\n\nfunction extractMarkedValue(output: string, marker: string): string {\n  const start = output.indexOf(marker);\n  if (start < 0) {\n    throw new BrowserControlTransportError(\"browser private response marker is absent\");\n  }\n  const valueStart = start + marker.length;\n  const end = output.indexOf(marker, valueStart);\n  if (end < 0) {\n    throw new BrowserControlTransportError(\"browser private response marker is incomplete\");\n  }\n  return output.slice(valueStart, end);\n}\n\nfunction commandOutput(result: ExecResultLike | string): string {\n  if (typeof result === \"string\") return result;\n  return [result.output, result.stdout, result.stderr]\n    .filter((part): part is string => typeof part === \"string\")\n    .join(\"\\n\");\n}\n\nfunction curlConfigQuote(value: string): string {\n  if (/[\\r\\n\\0]/u.test(value)) throw new BrowserControlProtocolError(\"curl value is invalid\");\n  return `\"${value.replaceAll(\"\\\\\", \"\\\\\\\\\").replaceAll('\"', '\\\\\"')}\"`;\n}\n\nfunction shellQuote(value: string): string {\n  return `'${value.replaceAll(\"'\", `'\\\\''`)}'`;\n}\n\nfunction requireToken(value: unknown, label: string): string {\n  if (typeof value !== \"string\" || !TOKEN_PATTERN.test(value)) {\n    throw new BrowserControlProtocolError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction requireUuid(value: unknown, label: string): string {\n  if (\n    typeof value !== \"string\" ||\n    !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(value)\n  ) {\n    throw new BrowserControlProtocolError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction requireGeneration(value: unknown): string {\n  if (\n    typeof value !== \"string\" ||\n    value.length > 256 ||\n    !/^[A-Za-z0-9][A-Za-z0-9._:-]*$/u.test(value)\n  ) {\n    throw new BrowserControlProtocolError(\"controller generation is invalid\");\n  }\n  return value;\n}\n\nfunction requireOpaqueId(value: unknown, label: string): string {\n  if (\n    typeof value !== \"string\" ||\n    value.length === 0 ||\n    Buffer.byteLength(value) > 512 ||\n    /[\\u0000-\\u001f\\u007f]/u.test(value)\n  ) {\n    throw new BrowserControlProtocolError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction requireBridgeGeneration(value: unknown): string {\n  if (\n    typeof value !== \"string\" ||\n    value.length > 512 ||\n    !/^[A-Za-z0-9][A-Za-z0-9._:-]*$/u.test(value)\n  ) {\n    throw new BrowserControlProtocolError(\"attached browser connection generation is invalid\");\n  }\n  return value;\n}\n\nfunction requireBoundedText(\n  value: unknown,\n  minimum: number,\n  maximum: number,\n  label: string,\n): string {\n  if (\n    typeof value !== \"string\" ||\n    Buffer.byteLength(value) < minimum ||\n    Buffer.byteLength(value) > maximum ||\n    /[\\u0000-\\u001f\\u007f]/u.test(value)\n  ) {\n    throw new BrowserControlProtocolError(`${label} is invalid`);\n  }\n  return value;\n}\n\n/** Whether a request returns BrowserObservation.notice to its caller, the\n * agent; other callers neither receive nor use one up. */\nexport type BrowserObservationNoticeRequest = { notices?: boolean };\n\nfunction withObservationNotices(path: string, options: BrowserObservationNoticeRequest): string {\n  if (!options.notices) return path;\n  return `${path}${path.includes(\"?\") ? \"&\" : \"?\"}${BROWSER_OBSERVATION_NOTICES_PARAMETER}=1`;\n}\n\nfunction boundedUrl(value: unknown): string {\n  if (typeof value !== \"string\" || value.length === 0 || Buffer.byteLength(value) > 16_384) {\n    throw new BrowserControlProtocolError(\"browser URL is invalid\");\n  }\n  return value;\n}\n\nfunction normalizeOrigin(value: unknown): string {\n  if (typeof value !== \"string\") throw new BrowserControlProtocolError(\"browser origin is invalid\");\n  try {\n    const url = new URL(value);\n    if (url.origin === \"null\" || url.pathname !== \"/\" || url.search || url.hash) throw new Error();\n    return url.origin;\n  } catch {\n    throw new BrowserControlProtocolError(\"browser origin must be an absolute origin\");\n  }\n}\n\nfunction timestamp(value: unknown, label: string): string {\n  if (typeof value !== \"string\" || value.length > 128 || !Number.isFinite(Date.parse(value))) {\n    throw new BrowserControlProtocolError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction absolutePrivatePath(value: string, label: string): string {\n  if (\n    !value.startsWith(\"/\") ||\n    value.includes(\"\\0\") ||\n    value.endsWith(\"/\") ||\n    posixPath.normalize(value) !== value\n  ) {\n    throw new BrowserControlProtocolError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction boundedPort(value: number): number {\n  if (!Number.isSafeInteger(value) || value < 1 || value > 65_535) {\n    throw new RangeError(\"browser controller port is invalid\");\n  }\n  return value;\n}\n\nfunction boundedInteger(value: number, minimum: number, maximum: number, label: string): number {\n  if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {\n    throw new RangeError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction frameStreamUrlWithOptions(\n  value: string,\n  stream: {\n    format?: \"jpeg\" | \"png\" | undefined;\n    quality?: number | undefined;\n    maxWidth?: number | undefined;\n    maxHeight?: number | undefined;\n    everyNthFrame?: number | undefined;\n  },\n): string {\n  const url = new URL(value);\n  if (stream.format !== undefined) url.searchParams.set(\"format\", stream.format);\n  if (stream.quality !== undefined) {\n    url.searchParams.set(\n      \"quality\",\n      String(boundedInteger(stream.quality, 1, 100, \"browser frame quality\")),\n    );\n  }\n  if (stream.maxWidth !== undefined) {\n    url.searchParams.set(\n      \"maxWidth\",\n      String(boundedInteger(stream.maxWidth, 1, 4_096, \"browser frame width\")),\n    );\n  }\n  if (stream.maxHeight !== undefined) {\n    url.searchParams.set(\n      \"maxHeight\",\n      String(boundedInteger(stream.maxHeight, 1, 4_096, \"browser frame height\")),\n    );\n  }\n  if (stream.everyNthFrame !== undefined) {\n    url.searchParams.set(\n      \"everyNthFrame\",\n      String(boundedInteger(stream.everyNthFrame, 1, 60, \"browser frame sampling interval\")),\n    );\n  }\n  return url.toString();\n}\n\nfunction boundedTimeout(value: number): number {\n  if (!Number.isSafeInteger(value) || value < 1 || value > MAX_REQUEST_TIMEOUT_MS) {\n    throw new RangeError(\"browser controller timeout is invalid\");\n  }\n  return value;\n}\n\nfunction positiveSafeInteger(value: unknown, label: string): number {\n  if (typeof value !== \"number\" || !Number.isSafeInteger(value) || value < 1) {\n    throw new RangeError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction nonnegativeSafeInteger(value: unknown, label: string): number {\n  if (typeof value !== \"number\" || !Number.isSafeInteger(value) || value < 0) {\n    throw new RangeError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction excludedWorkingCopyEntries(value: unknown): string[] {\n  if (\n    !Array.isArray(value) ||\n    value.length > 16 ||\n    !value.every((entry) => typeof entry === \"string\" && entry.length > 0 && entry.length <= 256)\n  ) {\n    throw new BrowserControlProtocolError(\n      \"browser controller returned malformed working copy exclusions\",\n    );\n  }\n  return [...value];\n}\n\nfunction parseUnsignedInteger(value: string, label: string): number {\n  const trimmed = value.trim();\n  if (!/^(0|[1-9][0-9]*)$/u.test(trimmed)) {\n    throw new BrowserControlProtocolError(`${label} is invalid`);\n  }\n  const parsed = Number(trimmed);\n  if (!Number.isSafeInteger(parsed)) {\n    throw new BrowserControlProtocolError(`${label} is invalid`);\n  }\n  return parsed;\n}\n\nfunction parseHttpStatus(value: string): number {\n  const status = parseUnsignedInteger(value, \"HTTP status\");\n  if (status < 100 || status > 599) {\n    throw new BrowserControlProtocolError(\"HTTP status is invalid\");\n  }\n  return status;\n}\n","/**\n * Browser action options that a browser controller from an older release\n * rejects.\n *\n * Every controller parses a whole action command strictly before it runs any\n * of it, so an option it does not know is refused with nothing dispatched; the\n * action's meaning is never silently changed. What an older controller cannot\n * say is which option it did not know. A controller embedded in the Opengeni\n * agent of a connected machine, attached browser device or compute sandbox\n * runs whatever agent release that machine has, so the server can be newer.\n * This list lets the server name the option and its alternative.\n *\n * Add an entry whenever the public browser action contract gains an option or\n * value; `test/browser-controller-compatibility.test.ts` fails until the new\n * public-api surface keys are listed here. Once every connected agent runs a\n * release that accepts an option, move the test's baseline fixture to that\n * release and remove the entry.\n */\n\nexport type NewerBrowserActionOption = {\n  /** Flattened public-api surface keys (`<schema> <path>`) this option added. */\n  readonly surfaceKeys: readonly string[];\n  /** The option as the agent writes it, for example `type \"viewport_reset\"`. */\n  readonly name: string;\n  /** Where the option appears, completing \"does not accept <name> on ...\". */\n  readonly context: string;\n  /** What else achieves the same result, completing \"Retry without <name>, or ...\". */\n  readonly alternative: string;\n  /** True when the action, or any action of a batch, uses the option. */\n  readonly usedBy: (action: unknown) => boolean;\n};\n\nexport const NEWER_BROWSER_ACTION_OPTIONS: readonly NewerBrowserActionOption[] = [\n  {\n    // First accepted by the agent release after 0.1.144.\n    surfaceKeys: [\n      \"BrowserAction $\",\n      \"BrowserAction $|type=viewport_reset\",\n      \"BrowserAction $|type=viewport_reset.type\",\n    ],\n    name: 'type \"viewport_reset\"',\n    context: \"an action\",\n    alternative: \"set type viewport with the window's own width and height\",\n    usedBy: (action) => someObject(action, (value) => value.type === \"viewport_reset\"),\n  },\n];\n\n/**\n * Fields of the command envelope around the action (`BrowserActionCommand`,\n * set by the server, not chosen by the agent) added after the baseline agent\n * release. An older controller rejects the whole command when it sees one,\n * and the agent cannot drop it, so the server must not send it to a\n * controller that predates it: gate it on the placement's agent version (as\n * `secretValues` is gated in the API) or on a capability the controller\n * reports. List each such field with how that is done; the guard test fails\n * for an envelope field that is not listed.\n */\nexport type NewerBrowserActionEnvelopeField = {\n  /** Flattened envelope shape keys (`$.<path>`) this field added. */\n  readonly surfaceKeys: readonly string[];\n  /** How the server keeps the field from controllers that predate it. */\n  readonly olderControllers: string;\n};\n\nexport const NEWER_BROWSER_ACTION_ENVELOPE_FIELDS: readonly NewerBrowserActionEnvelopeField[] = [];\n\n/** The plain refusal an agent sees when the controller rejected the action's\n * format. `controllerInAgent` is true when the controller ships inside the\n * Opengeni agent rather than a controller image. */\nexport function olderBrowserControllerMessage(action: unknown, controllerInAgent: boolean): string {\n  const used = NEWER_BROWSER_ACTION_OPTIONS.filter((option) => option.usedBy(action));\n  const subject = controllerInAgent\n    ? \"This browser's controller runs in an older Opengeni agent that\"\n    : \"This browser's controller image is older than this server and\";\n  const update = controllerInAgent\n    ? \"Updating the agent adds support.\"\n    : \"Updating the controller image adds support.\";\n  if (used.length === 0) {\n    return `${subject} does not accept this action. Nothing ran. Retry with fewer options, or target elements by ref. ${update}`;\n  }\n  const accepted = used.map((option) => `${option.name} on ${option.context}`).join(\" or \");\n  const names = used.map((option) => option.name).join(\" or \");\n  const alternatives = [...new Set(used.map((option) => option.alternative))];\n  return `${subject} does not accept ${accepted}. Nothing ran. Retry without ${names}, or ${alternatives.join(\", or \")}. ${update}`;\n}\n\nfunction someObject(value: unknown, matches: (value: Record<string, unknown>) => boolean): boolean {\n  if (Array.isArray(value)) return value.some((item) => someObject(item, matches));\n  if (value === null || typeof value !== \"object\") return false;\n  const record = value as Record<string, unknown>;\n  return matches(record) || Object.values(record).some((item) => someObject(item, matches));\n}\n","export const CONTROLLER_STREAM_MAX_INPUT = 128 * 1024;\nconst MAX_HEADER_BYTES = 64 * 1024;\n\n/** The machine family that runs the controller command. POSIX hosts use\n * `/bin/sh`, curl and base64. Windows has no POSIX shell or base64 utility, so\n * Windows PowerShell 5.1 (present on every supported Windows) relays the same\n * curl config to the system curl.exe and base64-encodes its exact bytes. */\nexport type ControllerStreamHost = \"posix\" | \"windows\";\n\nconst MARKER = \"OPENGENI_CONTROLLER_END_V1\";\n\n// Single quotes only: the script crosses a Windows command line as one argv\n// element, where embedded double quotes are not reliably preserved. The stdin\n// writer encoding is set without a BOM before the child pipe is created; a BOM\n// would make curl reject the first config line.\nconst WINDOWS_STREAM_SCRIPT = [\n  \"$ErrorActionPreference='Stop'\",\n  \"$i=New-Object IO.MemoryStream\",\n  \"[Console]::OpenStandardInput().CopyTo($i)\",\n  \"[Console]::InputEncoding=New-Object Text.UTF8Encoding($false)\",\n  \"$s=New-Object Diagnostics.ProcessStartInfo\",\n  \"$s.FileName=[IO.Path]::Combine([Environment]::SystemDirectory,'curl.exe')\",\n  \"$s.Arguments='--disable --config -'\",\n  \"$s.UseShellExecute=$false\",\n  \"$s.CreateNoWindow=$true\",\n  \"$s.RedirectStandardInput=$true\",\n  \"$s.RedirectStandardOutput=$true\",\n  \"$s.RedirectStandardError=$true\",\n  \"$p=[Diagnostics.Process]::Start($s)\",\n  \"$e=$p.StandardError.ReadToEndAsync()\",\n  \"$i.WriteTo($p.StandardInput.BaseStream)\",\n  \"$p.StandardInput.Close()\",\n  \"$o=New-Object IO.MemoryStream\",\n  \"$p.StandardOutput.BaseStream.CopyTo($o)\",\n  \"$p.WaitForExit()\",\n  `$t=[Text.Encoding]::ASCII.GetBytes([string][char]10+'${MARKER}'+$p.ExitCode)`,\n  \"$o.Write($t,0,$t.Length)\",\n  \"[Console]::Out.Write([Convert]::ToBase64String($o.ToArray()))\",\n].join(\";\");\n\n/** One command over the existing binary-input transport. The command is static\n * with a stable trailer so replayed command output remains readable; all\n * authority and page data stay on stdin.\n * Base64 preserves screenshot bytes across text-only command result adapters. */\nexport function controllerStreamRequest(input: {\n  method: string;\n  url: string;\n  token: string;\n  body?: string;\n  timeoutMs: number;\n  maxBytes: number;\n  host?: ControllerStreamHost;\n}): { cmd: string; shell: string; stdin: Uint8Array; marker: string } {\n  const quote = (value: string): string => {\n    if (/[\\r\\n\\0]/u.test(value)) throw new Error(\"invalid controller request value\");\n    return `\"${value.replaceAll(\"\\\\\", \"\\\\\\\\\").replaceAll('\"', '\\\\\"')}\"`;\n  };\n  const seconds = Math.max(1, Math.ceil(input.timeoutMs / 1_000));\n  const marker = MARKER;\n  const config = [\n    \"silent\",\n    \"show-error\",\n    \"include\",\n    `noproxy = \"*\"`,\n    `connect-timeout = ${Math.min(seconds, 15)}`,\n    `max-time = ${seconds}`,\n    `max-filesize = ${input.maxBytes}`,\n    `request = ${quote(input.method)}`,\n    `url = ${quote(input.url)}`,\n    `header = ${quote(`Authorization: Bearer ${input.token}`)}`,\n    ...(input.body === undefined\n      ? []\n      : [`header = \"Content-Type: application/json\"`, `data-binary = ${quote(input.body)}`]),\n    \"\",\n  ].join(\"\\n\");\n  const stdin = Buffer.from(config);\n  if (stdin.byteLength > CONTROLLER_STREAM_MAX_INPUT) {\n    throw new RangeError(\"controller command input is too large\");\n  }\n  if (input.host === \"windows\") {\n    return { cmd: WINDOWS_STREAM_SCRIPT, shell: \"powershell\", stdin, marker };\n  }\n  return {\n    cmd: `(curl --disable --config -; controller_exit=$?; printf '\\\\n${marker}%s' \"$controller_exit\") | base64`,\n    shell: \"/bin/sh\",\n    stdin,\n    marker,\n  };\n}\n\nexport function parseControllerStreamResponse(\n  output: string,\n  marker: string,\n  maxBytes: number,\n): { status: number; headers: Map<string, string>; data: Uint8Array } {\n  const maxWireBytes = maxBytes + MAX_HEADER_BYTES + marker.length + 32;\n  // Allow the standard base64 utility's line wrapping, but no arbitrary log\n  // noise or oversized allocation before validating and decoding the payload.\n  if (output.length > Math.ceil(maxWireBytes / 3) * 4 * 1.05 + 4) {\n    throw new RangeError(\"controller response exceeds its byte bound\");\n  }\n  const encoded = output.replace(/[\\r\\n]/gu, \"\");\n  if (encoded.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/u.test(encoded)) {\n    throw new Error(\"controller response encoding is invalid\");\n  }\n  const bytes = Buffer.from(encoded, \"base64\");\n  const trailer = Buffer.from(`\\n${marker}`);\n  const end = bytes.lastIndexOf(trailer);\n  if (end < 0) throw new Error(\"controller response is incomplete\");\n  const exit = bytes.subarray(end + trailer.length).toString(\"ascii\");\n  if (!/^\\d{1,3}$/u.test(exit) || exit !== \"0\") {\n    throw new Error(\"controller request did not complete successfully\");\n  }\n  let offset = 0;\n  while (offset < end) {\n    const headerEnd = bytes.indexOf(\"\\r\\n\\r\\n\", offset);\n    if (headerEnd < offset || headerEnd + 4 > end || headerEnd + 4 > MAX_HEADER_BYTES) {\n      throw new Error(\"controller response headers are invalid\");\n    }\n    const lines = bytes.subarray(offset, headerEnd).toString(\"latin1\").split(\"\\r\\n\");\n    const match = /^HTTP\\/\\d(?:\\.\\d)? (\\d{3})(?: |$)/u.exec(lines.shift() ?? \"\");\n    if (!match) throw new Error(\"controller response status is invalid\");\n    const status = Number(match[1]);\n    offset = headerEnd + 4;\n    if (status >= 100 && status < 200 && status !== 101) continue;\n    if (status < 200 || status > 599) throw new Error(\"controller response status is invalid\");\n    const headers = new Map<string, string>();\n    for (const line of lines) {\n      const separator = line.indexOf(\":\");\n      if (separator <= 0) throw new Error(\"controller response header is invalid\");\n      headers.set(line.slice(0, separator).trim().toLowerCase(), line.slice(separator + 1).trim());\n    }\n    const data = bytes.subarray(offset, end);\n    if (data.byteLength > maxBytes)\n      throw new RangeError(\"controller response exceeds its byte bound\");\n    return { status, headers, data };\n  }\n  throw new Error(\"controller response is incomplete\");\n}\n","import {\n  CredentialProviderMcpMaterial,\n  type CredentialProviderMcpMaterial as McpMaterial,\n  type RunCredentialAuthNeeded,\n  type RunCredentialFile,\n  type RunCredentialsResolution,\n} from \"@opengeni/contracts\";\nimport type {\n  ExecCommandArgs,\n  SandboxClient,\n  SandboxSessionLike,\n  SandboxSessionState,\n} from \"@openai/agents/sandbox\";\nimport { withSandboxOperationPurpose } from \"./operation-purpose\";\nimport { isRecord } from \"@opengeni/contracts/values\";\n\nconst MAX_ENVIRONMENT_ENTRIES = 256;\nconst MAX_ENVIRONMENT_VALUE_BYTES = 64 * 1024;\nconst MAX_CREDENTIAL_FILES = 64;\nconst MAX_CREDENTIAL_FILE_BYTES = 1024 * 1024;\nconst MAX_TOTAL_MATERIAL_BYTES = 4 * 1024 * 1024;\nconst MAX_AUTH_NEEDED_NOTICES = 32;\n// Encoded chunks must leave room for both the cancellation shell and the SDK\n// run-as wrapper, each of which repeats and quotes the command. Keep chunks\n// base64-aligned and bounded without dropping any credential bytes.\nconst WRITE_CHUNK_BYTES = 1536;\n// One generation is a sequence of small shell steps. Steps are packed into as\n// few sandbox commands as this bound allows, so an ordinary generation is one\n// round trip instead of several per file. Each step runs in its own subshell,\n// so umask and variables behave exactly as when every step was its own command.\nconst COMMAND_STEP_BUDGET_BYTES = 12 * 1024;\nconst COMMAND_OK_MARKER = \"__OPENGENI_RUN_CREDENTIAL_COMMAND_OK__\";\nconst AUTH_NEEDED_REASONS = new Set([\n  \"missing_connection\",\n  \"expired\",\n  \"insufficient_scope\",\n  \"refresh_failed\",\n]);\nconst PORTABLE_LOCK_STALE_MINUTES = 2;\n\nexport type RunCredentialExpectedScope = {\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n};\n\nexport type NormalizedRunCredentialMaterial = {\n  environment: Record<string, string>;\n  files: RunCredentialFile[];\n  fileEnvironment: Record<string, string>;\n  expiresAt: Date | null;\n  authNeeded: RunCredentialAuthNeeded[];\n  mcp?: McpMaterial;\n};\n\nexport type RunCredentialCommandSession = Pick<SandboxSessionLike, \"exec\" | \"execCommand\">;\nexport type RunCredentialCommandRunner = (\n  session: RunCredentialCommandSession,\n  args: ExecCommandArgs,\n) => Promise<unknown>;\nexport type RunCredentialSessionReady = (\n  session: RunCredentialCommandSession,\n) => Promise<void> | void;\n\nexport class RunCredentialValidationError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"RunCredentialValidationError\";\n  }\n}\n\nfunction byteLength(value: string): number {\n  return new TextEncoder().encode(value).byteLength;\n}\n\nfunction assertBoundedString(value: unknown, label: string, maxBytes: number): void {\n  if (value === undefined) return;\n  if (typeof value !== \"string\") {\n    throw new RunCredentialValidationError(`${label} must be a string`);\n  }\n  if (byteLength(value) > maxBytes) {\n    throw new RunCredentialValidationError(`${label} exceeds ${maxBytes} bytes`);\n  }\n  if (value?.includes(\"\\0\")) {\n    throw new RunCredentialValidationError(`${label} contains a NUL byte`);\n  }\n}\n\nfunction requiredBoundedString(value: unknown, label: string, maxBytes: number): string {\n  if (typeof value !== \"string\") {\n    throw new RunCredentialValidationError(`${label} must be a string`);\n  }\n  assertBoundedString(value, label, maxBytes);\n  return value;\n}\n\nfunction assertOptionalNonEmptyString(value: unknown, label: string, maxBytes: number): void {\n  assertBoundedString(value, label, maxBytes);\n  if (typeof value === \"string\" && !value.trim()) {\n    throw new RunCredentialValidationError(`${label} must not be empty`);\n  }\n}\n\nfunction normalizeAuthNeeded(notices: unknown, required: boolean): RunCredentialAuthNeeded[] {\n  if (notices !== undefined && !Array.isArray(notices)) {\n    throw new RunCredentialValidationError(\"authNeeded must be an array\");\n  }\n  const rawNotices = notices ?? [];\n  const normalized: RunCredentialAuthNeeded[] = [];\n  if (required && rawNotices.length === 0) {\n    throw new RunCredentialValidationError(\"auth_needed resolution must contain a notice\");\n  }\n  if (rawNotices.length > MAX_AUTH_NEEDED_NOTICES) {\n    throw new RunCredentialValidationError(\n      `auth-needed notice count exceeds ${MAX_AUTH_NEEDED_NOTICES}`,\n    );\n  }\n  for (const [index, notice] of rawNotices.entries()) {\n    if (!isRecord(notice)) {\n      throw new RunCredentialValidationError(`authNeeded[${index}] must be an object`);\n    }\n    const reason = notice.reason;\n    if (typeof reason !== \"string\" || !AUTH_NEEDED_REASONS.has(reason)) {\n      throw new RunCredentialValidationError(`authNeeded[${index}].reason is invalid`);\n    }\n    assertOptionalNonEmptyString(notice.providerDomain, `authNeeded[${index}].providerDomain`, 512);\n    assertOptionalNonEmptyString(notice.connectionId, `authNeeded[${index}].connectionId`, 512);\n    assertOptionalNonEmptyString(notice.resource, `authNeeded[${index}].resource`, 2_048);\n    assertOptionalNonEmptyString(notice.message, `authNeeded[${index}].message`, 2_048);\n    if (notice.scopes !== undefined && !Array.isArray(notice.scopes)) {\n      throw new RunCredentialValidationError(`authNeeded[${index}].scopes must be an array`);\n    }\n    const scopes = notice.scopes ?? [];\n    if (scopes.length > 128) {\n      throw new RunCredentialValidationError(`authNeeded[${index}].scopes exceeds 128 entries`);\n    }\n    for (const scope of scopes) {\n      requiredBoundedString(scope, `authNeeded[${index}].scope`, 512);\n      if (!scope.trim()) {\n        throw new RunCredentialValidationError(`authNeeded[${index}].scope must not be empty`);\n      }\n    }\n    if (notice.authorizationUrl !== undefined) {\n      const authorizationUrl = requiredBoundedString(\n        notice.authorizationUrl,\n        `authNeeded[${index}].authorizationUrl`,\n        4_096,\n      );\n      let url: URL;\n      try {\n        url = new URL(authorizationUrl);\n      } catch {\n        throw new RunCredentialValidationError(`authNeeded[${index}].authorizationUrl is invalid`);\n      }\n      if (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n        throw new RunCredentialValidationError(\n          `authNeeded[${index}].authorizationUrl must use http or https`,\n        );\n      }\n    }\n    normalized.push({\n      reason: reason as RunCredentialAuthNeeded[\"reason\"],\n      ...(typeof notice.providerDomain === \"string\"\n        ? { providerDomain: notice.providerDomain }\n        : {}),\n      ...(typeof notice.connectionId === \"string\" ? { connectionId: notice.connectionId } : {}),\n      ...(scopes.length > 0 ? { scopes: scopes as string[] } : {}),\n      ...(typeof notice.resource === \"string\" ? { resource: notice.resource } : {}),\n      ...(typeof notice.authorizationUrl === \"string\"\n        ? { authorizationUrl: notice.authorizationUrl }\n        : {}),\n      ...(typeof notice.message === \"string\" ? { message: notice.message } : {}),\n    });\n  }\n  return normalized;\n}\n\nfunction assertResolutionScope(\n  resolution: Record<string, unknown>,\n  expected: RunCredentialExpectedScope,\n): void {\n  if (\n    resolution.accountId !== expected.accountId ||\n    resolution.workspaceId !== expected.workspaceId ||\n    resolution.sessionId !== expected.sessionId\n  ) {\n    throw new RunCredentialValidationError(\"run credential provider returned a scope mismatch\");\n  }\n}\n\nfunction normalizeRelativeFilePath(path: string): string {\n  if (\n    path.length === 0 ||\n    path.length > 240 ||\n    path.startsWith(\"/\") ||\n    path.includes(\"\\\\\") ||\n    path.includes(\"\\0\")\n  ) {\n    throw new RunCredentialValidationError(`invalid run credential file path: ${path}`);\n  }\n  const segments = path.split(\"/\");\n  if (segments.some((segment) => segment.length === 0 || segment === \".\" || segment === \"..\")) {\n    throw new RunCredentialValidationError(`invalid run credential file path: ${path}`);\n  }\n  return path;\n}\n\nfunction assertEnvironmentName(name: string, label: string): void {\n  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {\n    throw new RunCredentialValidationError(`invalid ${label}: ${name}`);\n  }\n}\n\n/**\n * Validate the untrusted host-port response before any secret is written to a\n * box. The host owns credential selection; Opengeni owns scope checks, bounds,\n * path safety, and the transport lifecycle.\n */\nexport function normalizeRunCredentialsResolution(\n  resolution: Extract<RunCredentialsResolution, { status: \"not_applicable\" }>,\n  expected: RunCredentialExpectedScope,\n  now?: Date,\n): null;\nexport function normalizeRunCredentialsResolution(\n  resolution: Exclude<RunCredentialsResolution, { status: \"not_applicable\" }>,\n  expected: RunCredentialExpectedScope,\n  now?: Date,\n): NormalizedRunCredentialMaterial;\nexport function normalizeRunCredentialsResolution(\n  resolution: RunCredentialsResolution,\n  expected: RunCredentialExpectedScope,\n  now?: Date,\n): NormalizedRunCredentialMaterial | null;\nexport function normalizeRunCredentialsResolution(\n  resolution: RunCredentialsResolution,\n  expected: RunCredentialExpectedScope,\n  now: Date = new Date(),\n): NormalizedRunCredentialMaterial | null {\n  if (!isRecord(resolution)) {\n    throw new RunCredentialValidationError(\"run credential resolution must be an object\");\n  }\n  const candidate = resolution as unknown as Record<string, unknown>;\n  if (\n    candidate.status !== \"ok\" &&\n    candidate.status !== \"auth_needed\" &&\n    candidate.status !== \"not_applicable\"\n  ) {\n    throw new RunCredentialValidationError(\"run credential resolution status is invalid\");\n  }\n  assertResolutionScope(candidate, expected);\n  if (candidate.status === \"not_applicable\") return null;\n  const authNeeded = normalizeAuthNeeded(candidate.authNeeded, candidate.status === \"auth_needed\");\n  if (candidate.status === \"auth_needed\") {\n    return {\n      environment: {},\n      files: [],\n      fileEnvironment: {},\n      expiresAt: null,\n      authNeeded,\n    };\n  }\n\n  if (!isRecord(candidate.environment)) {\n    throw new RunCredentialValidationError(\"run credential environment must be an object\");\n  }\n  const environmentEntries = Object.entries(candidate.environment);\n  if (environmentEntries.length > MAX_ENVIRONMENT_ENTRIES) {\n    throw new RunCredentialValidationError(\n      `run credential environment exceeds ${MAX_ENVIRONMENT_ENTRIES} entries`,\n    );\n  }\n  let totalBytes = 0;\n  const environment: Record<string, string> = {};\n  for (const [name, rawValue] of environmentEntries) {\n    assertEnvironmentName(name, \"run credential environment name\");\n    const value = requiredBoundedString(\n      rawValue,\n      `run credential environment value: ${name}`,\n      MAX_ENVIRONMENT_VALUE_BYTES,\n    );\n    const valueBytes = byteLength(value);\n    totalBytes += valueBytes;\n    Object.defineProperty(environment, name, {\n      value,\n      enumerable: true,\n      configurable: true,\n      writable: true,\n    });\n  }\n\n  if (candidate.files !== undefined && !Array.isArray(candidate.files)) {\n    throw new RunCredentialValidationError(\"run credential files must be an array\");\n  }\n  const files = candidate.files ?? [];\n  if (files.length > MAX_CREDENTIAL_FILES) {\n    throw new RunCredentialValidationError(\n      `run credential file count exceeds ${MAX_CREDENTIAL_FILES}`,\n    );\n  }\n  const paths = new Map<string, string>();\n  const normalizedFiles = files.map((file, index) => {\n    if (!isRecord(file)) {\n      throw new RunCredentialValidationError(`run credential file ${index} must be an object`);\n    }\n    const path = normalizeRelativeFilePath(\n      requiredBoundedString(file.path, `run credential file ${index} path`, 240),\n    );\n    const folded = path.toLocaleLowerCase(\"en-US\");\n    const collision = paths.get(folded);\n    if (collision !== undefined) {\n      throw new RunCredentialValidationError(\n        `run credential file path collision: ${collision} and ${path}`,\n      );\n    }\n    paths.set(folded, path);\n    const content = requiredBoundedString(\n      file.content,\n      `run credential file content: ${path}`,\n      MAX_CREDENTIAL_FILE_BYTES,\n    );\n    const contentBytes = byteLength(content);\n    if (file.mode !== undefined && file.mode !== \"0400\" && file.mode !== \"0600\") {\n      throw new RunCredentialValidationError(`run credential file mode is invalid: ${path}`);\n    }\n    totalBytes += contentBytes;\n    return { path, content, mode: file.mode ?? \"0600\" } as RunCredentialFile;\n  });\n\n  if (candidate.fileEnvironment !== undefined && !isRecord(candidate.fileEnvironment)) {\n    throw new RunCredentialValidationError(\"run credential fileEnvironment must be an object\");\n  }\n  const fileEnvironment: Record<string, string> = {};\n  for (const [name, unresolvedPath] of Object.entries(candidate.fileEnvironment ?? {})) {\n    assertEnvironmentName(name, \"run credential file environment name\");\n    if (Object.prototype.hasOwnProperty.call(environment, name)) {\n      throw new RunCredentialValidationError(\n        `run credential environment name is declared twice: ${name}`,\n      );\n    }\n    const path = normalizeRelativeFilePath(\n      requiredBoundedString(unresolvedPath, `run credential file environment path: ${name}`, 240),\n    );\n    if (!paths.has(path.toLocaleLowerCase(\"en-US\"))) {\n      throw new RunCredentialValidationError(\n        `run credential file environment references an unknown file: ${path}`,\n      );\n    }\n    Object.defineProperty(fileEnvironment, name, {\n      value: path,\n      enumerable: true,\n      configurable: true,\n      writable: true,\n    });\n  }\n  if (environmentEntries.length + Object.keys(fileEnvironment).length > MAX_ENVIRONMENT_ENTRIES) {\n    throw new RunCredentialValidationError(\n      `combined run credential environment exceeds ${MAX_ENVIRONMENT_ENTRIES} entries`,\n    );\n  }\n  if (totalBytes > MAX_TOTAL_MATERIAL_BYTES) {\n    throw new RunCredentialValidationError(\n      `run credential material exceeds ${MAX_TOTAL_MATERIAL_BYTES} bytes`,\n    );\n  }\n\n  let expiresAt: Date | null = null;\n  if (candidate.expiresAt !== undefined && candidate.expiresAt !== null) {\n    const expiry = requiredBoundedString(candidate.expiresAt, \"run credential expiry\", 128);\n    expiresAt = new Date(expiry);\n    if (!Number.isFinite(expiresAt.getTime()) || expiresAt.getTime() <= now.getTime()) {\n      throw new RunCredentialValidationError(\"run credential expiry is invalid or already expired\");\n    }\n  }\n  const parsedMcp = CredentialProviderMcpMaterial.safeParse(\n    candidate.mcp === undefined ? [] : candidate.mcp,\n  );\n  if (!parsedMcp.success) {\n    // Zod issues can contain untrusted inputs. Never expose credential values\n    // through errors that a worker may publish or log.\n    throw new RunCredentialValidationError(\"run MCP credential material is invalid\");\n  }\n  // Per-target expiry is enforced by the attempt-local MCP controller. A\n  // stale or unselected entry must not prevent unrelated sandbox material.\n  return {\n    environment,\n    files: normalizedFiles,\n    fileEnvironment,\n    expiresAt,\n    authNeeded,\n    ...(parsedMcp.data.length ? { mcp: parsedMcp.data } : {}),\n  };\n}\n\nfunction assertPathIdentity(value: string, label: string): string {\n  if (!/^[A-Za-z0-9_-]{1,128}$/.test(value)) {\n    throw new RunCredentialValidationError(`${label} is not safe for a credential path`);\n  }\n  return value;\n}\n\nexport function runCredentialRoot(sessionId: string): string {\n  return `/tmp/opengeni-run-credentials/${assertPathIdentity(sessionId, \"sessionId\")}`;\n}\n\nexport function runCredentialPointerFile(sessionId: string): string {\n  return `${runCredentialRoot(sessionId)}/current`;\n}\n\nfunction shellQuote(value: string): string {\n  return `'${value.replace(/'/g, \"'\\\\''\")}'`;\n}\n\nfunction base64(value: string): string {\n  return Buffer.from(value, \"utf8\").toString(\"base64\");\n}\n\nfunction portableBase64DecodeCommand(): string {\n  return [\n    \"{\",\n    \"if printf %s QQ== | base64 -d >/dev/null 2>&1; then base64 -d\",\n    \"elif printf %s QQ== | base64 -D >/dev/null 2>&1; then base64 -D\",\n    \"elif command -v openssl >/dev/null 2>&1; then openssl base64 -d -A\",\n    \"else exit 69\",\n    \"fi\",\n    \"}\",\n  ].join(\"\\n\");\n}\n\n/** Prefer util-linux flock; fall back to an atomic, stale-reaped mkdir lock. */\nfunction pointerLockAcquireCommands(root: string): string[] {\n  const lockFile = shellQuote(`${root}/.pointer.lock`);\n  const lockDirectory = shellQuote(`${root}/.pointer.lockdir`);\n  return [\n    `if command -v flock >/dev/null 2>&1; then`,\n    `  exec 9>${lockFile}`,\n    \"  flock -w 30 9\",\n    \"  _opengeni_pointer_lock_kind=flock\",\n    \"else\",\n    `  _opengeni_pointer_lock_dir=${lockDirectory}`,\n    \"  _opengeni_pointer_lock_deadline=$(($(date +%s) + 30))\",\n    '  while ! mkdir \"$_opengeni_pointer_lock_dir\" 2>/dev/null; do',\n    `    if find \"$_opengeni_pointer_lock_dir\" -prune -mmin +${PORTABLE_LOCK_STALE_MINUTES} -print 2>/dev/null | grep -q .; then`,\n    '      _opengeni_stale_lock=\"${_opengeni_pointer_lock_dir}.stale.$$\"',\n    '      if mv \"$_opengeni_pointer_lock_dir\" \"$_opengeni_stale_lock\" 2>/dev/null; then',\n    '        rm -rf -- \"$_opengeni_stale_lock\"',\n    \"        continue\",\n    \"      fi\",\n    \"    fi\",\n    '    [ \"$(date +%s)\" -lt \"$_opengeni_pointer_lock_deadline\" ] || exit 73',\n    \"    sleep 0.1\",\n    \"  done\",\n    \"  _opengeni_pointer_lock_kind=directory\",\n    `  trap 'rmdir ${lockDirectory} 2>/dev/null || :' EXIT HUP INT TERM`,\n    \"fi\",\n  ];\n}\n\nfunction pointerLockReleaseCommands(): string[] {\n  return [\n    'if [ \"${_opengeni_pointer_lock_kind:-}\" = directory ]; then',\n    '  rmdir \"$_opengeni_pointer_lock_dir\" 2>/dev/null || :',\n    \"  trap - EXIT HUP INT TERM\",\n    \"fi\",\n  ];\n}\n\nfunction outputOf(result: unknown): string {\n  if (typeof result === \"string\") return result;\n  if (!result || typeof result !== \"object\") return \"\";\n  const candidate = result as {\n    output?: unknown;\n    stdout?: unknown;\n    stderr?: unknown;\n  };\n  return [candidate.output, candidate.stdout, candidate.stderr]\n    .filter((value): value is string => typeof value === \"string\")\n    .join(\"\\n\");\n}\n\nasync function runCredentialCommand(\n  session: RunCredentialCommandSession,\n  cmd: string,\n  commandRunner?: RunCredentialCommandRunner,\n): Promise<void> {\n  const marked = `set +x\\nset -eu\\n${cmd}\\nprintf '\\\\n${COMMAND_OK_MARKER}\\\\n'`;\n  const args: ExecCommandArgs = {\n    cmd: `set +x\\nenv -u BASH_ENV bash --noprofile --norc -c ${shellQuote(marked)}`,\n    yieldTimeMs: 120_000,\n    maxOutputTokens: 4_000,\n  };\n  const result = commandRunner\n    ? await commandRunner(session, args)\n    : session.exec\n      ? await session.exec(args)\n      : session.execCommand\n        ? await session.execCommand(args)\n        : undefined;\n  if (!outputOf(result).includes(COMMAND_OK_MARKER)) {\n    throw new Error(\"run credential materialization command failed\");\n  }\n}\n\n/** Run ordered steps in as few commands as the bound allows. Every step keeps\n * its own subshell, so a packed command behaves like the separate commands. */\nasync function runCredentialSteps(\n  session: RunCredentialCommandSession,\n  steps: readonly string[],\n  commandRunner?: RunCredentialCommandRunner,\n): Promise<void> {\n  let batch: string[] = [];\n  let batchBytes = 0;\n  const flush = async () => {\n    if (batch.length === 0) return;\n    const cmd = batch.map((step) => `(\\n${step}\\n)`).join(\"\\n\");\n    batch = [];\n    batchBytes = 0;\n    await runCredentialCommand(session, cmd, commandRunner);\n  };\n  for (const step of steps) {\n    const stepBytes = byteLength(step) + 5;\n    if (batch.length > 0 && batchBytes + stepBytes > COMMAND_STEP_BUDGET_BYTES) await flush();\n    batch.push(step);\n    batchBytes += stepBytes;\n  }\n  await flush();\n}\n\nfunction credentialFileWriteSteps(\n  directory: string,\n  relativePath: string,\n  content: string,\n): string[] {\n  const steps = [\n    credentialFileCommand(directory, relativePath, ': > \"$_opengeni_credential_path\"'),\n  ];\n  const encoded = base64(content);\n  for (let offset = 0; offset < encoded.length; offset += WRITE_CHUNK_BYTES) {\n    const chunk = encoded.slice(offset, offset + WRITE_CHUNK_BYTES);\n    steps.push(\n      credentialFileCommand(\n        directory,\n        relativePath,\n        `printf %s ${shellQuote(chunk)} | ${portableBase64DecodeCommand()} >> \"$_opengeni_credential_path\"`,\n      ),\n    );\n  }\n  steps.push(\n    credentialFileCommand(\n      directory,\n      relativePath,\n      `[ \"$(wc -c < \"$_opengeni_credential_path\" | tr -d '[:space:]')\" = ${shellQuote(String(byteLength(content)))} ]`,\n    ),\n  );\n  return steps;\n}\n\nfunction credentialFileCommand(directory: string, relativePath: string, command: string): string {\n  // Avoid multiplying accepted path quotes through nested shell wrappers. The\n  // existing outer Bash decodes only literal UTF-8 bytes, including trailing\n  // newlines, without evaluating host-provided text or invoking a path decoder.\n  const escapedPath = [...Buffer.from(relativePath, \"utf8\")]\n    .map((byte) => `\\\\x${byte.toString(16).padStart(2, \"0\")}`)\n    .join(\"\");\n  return [\n    `printf -v _opengeni_credential_path %b ${shellQuote(escapedPath)}`,\n    `_opengeni_credential_path=${shellQuote(directory)}/\"$_opengeni_credential_path\"`,\n    command,\n  ].join(\"\\n\");\n}\n\nexport type MaterializeRunCredentialsOptions = {\n  sessionId: string;\n  attemptId: string;\n  executionGeneration: number;\n  /** Initial provision after recovery may prune generations from older attempts. */\n  pruneOtherAttempts?: boolean;\n  /** An all-auth-needed replacement removes every prior readable generation. */\n  prunePreviousGenerations?: boolean;\n  /** Renewal keeps the active and immediately prior same-attempt generations. */\n  pruneSupersededGenerations?: boolean;\n  commandRunner?: RunCredentialCommandRunner;\n};\n\n/** Materialize one complete immutable generation, then atomically flip current. */\nexport async function materializeRunCredentials(\n  session: RunCredentialCommandSession,\n  material: NormalizedRunCredentialMaterial,\n  options: MaterializeRunCredentialsOptions,\n): Promise<void> {\n  await withSandboxOperationPurpose(\"run_credentials\", () =>\n    materializeRunCredentialsUnscoped(session, material, options),\n  );\n}\n\nasync function materializeRunCredentialsUnscoped(\n  session: RunCredentialCommandSession,\n  material: NormalizedRunCredentialMaterial,\n  options: MaterializeRunCredentialsOptions,\n): Promise<void> {\n  const root = runCredentialRoot(options.sessionId);\n  const attemptId = assertPathIdentity(options.attemptId, \"attemptId\");\n  if (!Number.isSafeInteger(options.executionGeneration) || options.executionGeneration < 0) {\n    throw new RunCredentialValidationError(\"executionGeneration must be a non-negative integer\");\n  }\n  const nonce = crypto.randomUUID();\n  const prefix = `${attemptId}-${options.executionGeneration}-`;\n  const versionName = `${attemptId}-${options.executionGeneration}-${nonce}`;\n  const stage = `${root}/versions/.stage-${versionName}`;\n  const version = `${root}/versions/${versionName}`;\n  for (const file of material.files) {\n    const mode = file.mode ?? \"0600\";\n    if (mode !== \"0400\" && mode !== \"0600\") {\n      throw new RunCredentialValidationError(`run credential file mode is invalid: ${file.path}`);\n    }\n  }\n  const steps: string[] = [\n    [\n      \"umask 077\",\n      `mkdir -p -- ${shellQuote(`${root}/versions`)}`,\n      `chmod -- 0700 ${shellQuote(root)} ${shellQuote(`${root}/versions`)}`,\n      `rm -rf -- ${shellQuote(stage)}`,\n      `mkdir -p -- ${shellQuote(`${stage}/files`)}`,\n    ].join(\"\\n\"),\n  ];\n\n  const environmentLines = [\n    ...Object.entries(material.environment).map(\n      ([name, value]) => `export ${name}=${shellQuote(value)}`,\n    ),\n    ...Object.entries(material.fileEnvironment).map(\n      ([name, path]) => `export ${name}=${shellQuote(`${version}/files/${path}`)}`,\n    ),\n  ];\n  steps.push(\n    ...credentialFileWriteSteps(\n      stage,\n      \"env\",\n      environmentLines.length > 0 ? `${environmentLines.join(\"\\n\")}\\n` : \"\",\n    ),\n    `chmod -- 0600 ${shellQuote(`${stage}/env`)}`,\n  );\n\n  for (const file of material.files) {\n    const directory = `${stage}/files`;\n    steps.push(\n      credentialFileCommand(directory, file.path, 'mkdir -p -- \"${_opengeni_credential_path%/*}\"'),\n      ...credentialFileWriteSteps(directory, file.path, file.content),\n      credentialFileCommand(\n        directory,\n        file.path,\n        `chmod -- ${shellQuote(file.mode ?? \"0600\")} \"$_opengeni_credential_path\"`,\n      ),\n    );\n  }\n\n  steps.push(\n    [\n      // Bind validated identifiers once rather than repeatedly expanding long\n      // paths through cancellation and SDK run-as shell quoting.\n      `_opengeni_credential_root=${shellQuote(root)}`,\n      `_opengeni_credential_version_name=${shellQuote(versionName)}`,\n      `_opengeni_credential_prefix=${shellQuote(prefix)}`,\n      ...pointerLockAcquireCommands(root),\n      'previous=$(cat -- \"$_opengeni_credential_root/current\" 2>/dev/null || :)',\n      'mv -- \"$_opengeni_credential_root/versions/.stage-$_opengeni_credential_version_name\" \"$_opengeni_credential_root/versions/$_opengeni_credential_version_name\"',\n      'printf \\'%s\\\\n\\' \"$_opengeni_credential_version_name\" > \"$_opengeni_credential_root/.next\"',\n      'mv -f -- \"$_opengeni_credential_root/.next\" \"$_opengeni_credential_root/current\"',\n      ...(options.prunePreviousGenerations\n        ? [\n            'find \"$_opengeni_credential_root/versions\" -mindepth 1 -maxdepth 1 ! -name \"$_opengeni_credential_version_name\" -exec rm -rf -- {} +',\n          ]\n        : options.pruneOtherAttempts\n          ? [\n              'find \"$_opengeni_credential_root/versions\" -mindepth 1 -maxdepth 1 ! -name \"${_opengeni_credential_prefix}*\" -exec rm -rf -- {} +',\n            ]\n          : options.pruneSupersededGenerations\n            ? [\n                'for candidate in \"$_opengeni_credential_root/versions/$_opengeni_credential_prefix\"*; do',\n                `  [ -e \"$candidate\" ] || continue`,\n                `  name=\\${candidate##*/}`,\n                '  [ \"$name\" = \"$_opengeni_credential_version_name\" ] || [ \"$name\" = \"$previous\" ] || rm -rf -- \"$candidate\"',\n                \"done\",\n              ]\n            : []),\n      ...pointerLockReleaseCommands(),\n    ].join(\"\\n\"),\n  );\n  await runCredentialSteps(session, steps, options.commandRunner);\n}\n\nexport async function clearRunCredentials(\n  session: RunCredentialCommandSession,\n  sessionId: string,\n  commandRunner?: RunCredentialCommandRunner,\n): Promise<void> {\n  const root = runCredentialRoot(sessionId);\n  await runCredentialCommand(\n    session,\n    [\n      `if [ -d ${shellQuote(root)} ]; then`,\n      ...pointerLockAcquireCommands(root).map((line) => `  ${line}`),\n      `  rm -f -- ${shellQuote(`${root}/current`)} ${shellQuote(`${root}/.next`)}`,\n      `  rm -rf -- ${shellQuote(`${root}/versions`)}`,\n      ...pointerLockReleaseCommands().map((line) => `  ${line}`),\n      \"fi\",\n    ].join(\"\\n\"),\n    commandRunner,\n  );\n}\n\n/**\n * Remove only generations owned by one attempt. A successor may already have\n * atomically activated its own pointer after queue admission; this cleanup must\n * never clear or overwrite that newer generation.\n */\nexport async function clearRunCredentialsForAttempt(\n  session: RunCredentialCommandSession,\n  options: Pick<\n    MaterializeRunCredentialsOptions,\n    \"sessionId\" | \"attemptId\" | \"executionGeneration\"\n  >,\n  commandRunner?: RunCredentialCommandRunner,\n): Promise<void> {\n  const root = runCredentialRoot(options.sessionId);\n  const attemptId = assertPathIdentity(options.attemptId, \"attemptId\");\n  if (!Number.isSafeInteger(options.executionGeneration) || options.executionGeneration < 0) {\n    throw new RunCredentialValidationError(\"executionGeneration must be a non-negative integer\");\n  }\n  const prefix = `${attemptId}-${options.executionGeneration}-`;\n  await runCredentialCommand(\n    session,\n    [\n      `if [ -d ${shellQuote(root)} ]; then`,\n      ...pointerLockAcquireCommands(root).map((line) => `  ${line}`),\n      `  if [ -r ${shellQuote(`${root}/current`)} ]; then`,\n      `    current=$(cat -- ${shellQuote(`${root}/current`)} 2>/dev/null || :)`,\n      `    case \"$current\" in ${shellQuote(prefix)}*) rm -f -- ${shellQuote(`${root}/current`)} ;; esac`,\n      \"  fi\",\n      `  if [ -d ${shellQuote(`${root}/versions`)} ]; then`,\n      `    find ${shellQuote(`${root}/versions`)} -mindepth 1 -maxdepth 1 -name ${shellQuote(`${prefix}*`)} -exec rm -rf -- {} +`,\n      `    find ${shellQuote(`${root}/versions`)} -mindepth 1 -maxdepth 1 -name ${shellQuote(`.stage-${prefix}*`)} -exec rm -rf -- {} +`,\n      \"  fi\",\n      ...pointerLockReleaseCommands().map((line) => `  ${line}`),\n      \"fi\",\n    ].join(\"\\n\"),\n    commandRunner,\n  );\n}\n\n/** Prefix one sandbox command so every new process observes the active generation. */\nexport function withRunCredentialEnvironment(cmd: string, sessionId: string): string {\n  const root = runCredentialRoot(sessionId);\n  const pointerFile = runCredentialPointerFile(sessionId);\n  return [\n    `if [ -r ${shellQuote(pointerFile)} ]; then`,\n    `  _opengeni_credential_version=$(cat -- ${shellQuote(pointerFile)} 2>/dev/null || :)`,\n    '  case \"$_opengeni_credential_version\" in',\n    \"    ''|*[!A-Za-z0-9_-]*) ;;\",\n    \"    *)\",\n    `      _opengeni_credential_env=${shellQuote(`${root}/versions`)}/\"$_opengeni_credential_version/env\"`,\n    '      if [ -r \"$_opengeni_credential_env\" ]; then',\n    \"        set -a\",\n    '        . \"$_opengeni_credential_env\"',\n    \"        set +a\",\n    \"      fi\",\n    \"      unset _opengeni_credential_env\",\n    \"      ;;\",\n    \"  esac\",\n    \"  unset _opengeni_credential_version\",\n    \"fi\",\n    cmd,\n  ].join(\"\\n\");\n}\n\n/**\n * Preserve the provider session identity/capabilities while decorating only\n * command creation. Trailing invocation options stay unchanged; non-command\n * methods stay bound to the original instance.\n */\nexport function withRunCredentialsSession<T extends object>(session: T, sessionId: string): T {\n  return new Proxy(session, {\n    get(target, property, receiver) {\n      if (property === \"exec\" || property === \"execCommand\") {\n        const command = Reflect.get(target, property, target) as\n          | ((args: ExecCommandArgs, ...callArgs: unknown[]) => Promise<unknown>)\n          | undefined;\n        if (!command) return undefined;\n        return async (args: ExecCommandArgs, ...callArgs: unknown[]) =>\n          await command.call(\n            target,\n            { ...args, cmd: withRunCredentialEnvironment(args.cmd, sessionId) },\n            ...callArgs,\n          );\n      }\n      const value = Reflect.get(target, property, receiver) as unknown;\n      return typeof value === \"function\" ? value.bind(target) : value;\n    },\n  });\n}\n\n/** Decorate every client-created/resumed session after the host seeds it. */\nexport function withRunCredentialsClient(\n  client: SandboxClient,\n  sessionId: string,\n  onSessionReady?: RunCredentialSessionReady,\n): SandboxClient {\n  const decorated = new WeakMap<object, SandboxSessionLike>();\n  const wrap = async <T extends SandboxSessionLike>(session: T): Promise<T> => {\n    const existing = decorated.get(session);\n    if (existing) return existing as T;\n    await onSessionReady?.(session);\n    const wrapped = withRunCredentialsSession(session, sessionId);\n    decorated.set(session, wrapped);\n    return wrapped;\n  };\n  return {\n    backendId: client.backendId,\n    ...(client.supportsDefaultOptions !== undefined\n      ? { supportsDefaultOptions: client.supportsDefaultOptions }\n      : {}),\n    ...(client.create\n      ? {\n          create: async (...args: any[]) => await wrap(await (client.create as any)(...args)),\n        }\n      : {}),\n    ...(client.resume\n      ? {\n          resume: async (...args: any[]) => await wrap(await (client.resume as any)(...args)),\n        }\n      : {}),\n    ...(client.delete\n      ? {\n          delete: async (state: SandboxSessionState) => await client.delete!(state),\n        }\n      : {}),\n    ...(client.serializeSessionState\n      ? {\n          serializeSessionState: async (state: SandboxSessionState, options) =>\n            await client.serializeSessionState!(state, options),\n        }\n      : {}),\n    ...(client.canPersistOwnedSessionState\n      ? {\n          canPersistOwnedSessionState: async (state: SandboxSessionState) =>\n            await client.canPersistOwnedSessionState!(state),\n        }\n      : {}),\n    ...(client.canReusePreservedOwnedSession\n      ? {\n          canReusePreservedOwnedSession: async (state: SandboxSessionState) =>\n            await client.canReusePreservedOwnedSession!(state),\n        }\n      : {}),\n    ...(client.deserializeSessionState\n      ? {\n          deserializeSessionState: async (state: Record<string, unknown>) =>\n            await client.deserializeSessionState!(state),\n        }\n      : {}),\n  };\n}\n","import { createHash } from \"node:crypto\";\nimport { posix as posixPath } from \"node:path\";\nimport { managedCodemodeClientEnvironment } from \"./codemode-client\";\n\nimport type {\n  ExecCommandArgs,\n  SandboxClient,\n  SandboxSessionLike,\n  SandboxSessionState,\n} from \"@openai/agents/sandbox\";\n\nconst MAX_CODEMODE_SESSION_ID_BYTES = 512;\n\nexport class CodemodeTokenPathError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"CodemodeTokenPathError\";\n  }\n}\n\nfunction shellQuote(value: string): string {\n  return `'${value.replace(/'/g, \"'\\\\''\")}'`;\n}\n\nfunction assertCodemodeSessionId(sessionId: string): string {\n  if (\n    !sessionId ||\n    sessionId.trim() !== sessionId ||\n    new TextEncoder().encode(sessionId).byteLength > MAX_CODEMODE_SESSION_ID_BYTES ||\n    sessionId.includes(\"\\0\")\n  ) {\n    throw new CodemodeTokenPathError(\"Codemode session id is invalid\");\n  }\n  return sessionId;\n}\n\nfunction assertCodemodeFilePath(value: string, label: string): string {\n  if (!value || value.includes(\"\\0\") || !posixPath.isAbsolute(value)) {\n    throw new CodemodeTokenPathError(`${label} must be absolute`);\n  }\n  return posixPath.normalize(value);\n}\n\nexport function shellCodemodePath(value: string): string {\n  return shellQuote(assertCodemodeFilePath(value, \"Codemode token file\"));\n}\n\n/**\n * Derive the per-session token file beside the legacy manifest pointer.\n *\n * The manifest pointer stays box-global so an already-warm shared sandbox does\n * not receive an illegal environment delta. Every Opengeni command overrides\n * that pointer with this deterministic path. The hash is path hygiene and\n * avoids disclosing host/session ids in filenames; filesystem paths are not an\n * authorization boundary. The delegated bearer's session claim remains the\n * authority boundary for Codemode calls.\n */\nexport function codemodeTokenFileForSession(manifestTokenFile: string, sessionId: string): string {\n  const normalizedManifestFile = assertCodemodeFilePath(\n    manifestTokenFile,\n    \"Codemode manifest token file\",\n  );\n  const digest = createHash(\"sha256\").update(assertCodemodeSessionId(sessionId)).digest(\"hex\");\n  return posixPath.join(posixPath.dirname(normalizedManifestFile), \"codemode-tokens\", digest);\n}\n\nexport function codemodeTokenFileFromEnvironment(\n  environment: Readonly<Record<string, string>>,\n  sessionId: string,\n): string {\n  const manifestTokenFile =\n    environment.OPENGENI_CODEMODE_TOKEN_FILE ??\n    `${environment.HOME ?? \"/workspace\"}/.opengeni/codemode-token`;\n  return codemodeTokenFileForSession(manifestTokenFile, sessionId);\n}\n\n/**\n * Prefix one sandbox command with its attempt-current Codemode routing.\n *\n * The token pointer is session-specific. The URL is deliberately projected on\n * every exec too: a warm managed box keeps its baked manifest environment, but\n * the externally reachable deployment/tunnel origin may change between turns.\n * Per-command export makes a resumed box use the current route without an\n * illegal live-manifest environment mutation.\n */\nexport function withCodemodeTokenEnvironment(\n  cmd: string,\n  tokenFile: string,\n  codemodeUrl?: string,\n  clientDirectory?: string,\n): string {\n  return [\n    `export OPENGENI_CODEMODE_TOKEN_FILE=${shellCodemodePath(tokenFile)}`,\n    ...(codemodeUrl ? [`export OPENGENI_CODEMODE_URL=${shellQuote(codemodeUrl)}`] : []),\n    ...(clientDirectory ? managedCodemodeClientEnvironment(clientDirectory) : []),\n    cmd,\n  ].join(\"\\n\");\n}\n\n/** Decorate command creation without changing identity, capabilities or trailing options. */\nexport function withCodemodeTokenSession<T extends object>(\n  session: T,\n  tokenFile: string,\n  codemodeUrl?: string,\n  clientDirectory?: string,\n): T {\n  return new Proxy(session, {\n    get(target, property, receiver) {\n      if (property === \"exec\" || property === \"execCommand\") {\n        const command = Reflect.get(target, property, target) as\n          | ((args: ExecCommandArgs, ...callArgs: unknown[]) => Promise<unknown>)\n          | undefined;\n        if (!command) return undefined;\n        return async (args: ExecCommandArgs, ...callArgs: unknown[]) =>\n          await command.call(\n            target,\n            {\n              ...args,\n              cmd: withCodemodeTokenEnvironment(args.cmd, tokenFile, codemodeUrl, clientDirectory),\n            },\n            ...callArgs,\n          );\n      }\n      const value = Reflect.get(target, property, receiver) as unknown;\n      return typeof value === \"function\" ? value.bind(target) : value;\n    },\n  });\n}\n\n/** Decorate every client-created/resumed session with one session pointer. */\nexport function withCodemodeTokenClient(\n  client: SandboxClient,\n  tokenFile: string,\n  codemodeUrl?: string,\n  clientDirectory?: string,\n): SandboxClient {\n  const decorated = new WeakMap<object, SandboxSessionLike>();\n  const wrap = <T extends SandboxSessionLike>(session: T): T => {\n    const existing = decorated.get(session);\n    if (existing) return existing as T;\n    const wrapped = withCodemodeTokenSession(session, tokenFile, codemodeUrl, clientDirectory);\n    decorated.set(session, wrapped);\n    return wrapped;\n  };\n  return {\n    backendId: client.backendId,\n    ...(client.supportsDefaultOptions !== undefined\n      ? { supportsDefaultOptions: client.supportsDefaultOptions }\n      : {}),\n    ...(client.create\n      ? { create: async (...args: any[]) => wrap(await (client.create as any)(...args)) }\n      : {}),\n    ...(client.resume\n      ? { resume: async (...args: any[]) => wrap(await (client.resume as any)(...args)) }\n      : {}),\n    ...(client.delete\n      ? { delete: async (state: SandboxSessionState) => await client.delete!(state) }\n      : {}),\n    ...(client.serializeSessionState\n      ? {\n          serializeSessionState: async (state: SandboxSessionState, options) =>\n            await client.serializeSessionState!(state, options),\n        }\n      : {}),\n    ...(client.canPersistOwnedSessionState\n      ? {\n          canPersistOwnedSessionState: async (state: SandboxSessionState) =>\n            await client.canPersistOwnedSessionState!(state),\n        }\n      : {}),\n    ...(client.canReusePreservedOwnedSession\n      ? {\n          canReusePreservedOwnedSession: async (state: SandboxSessionState) =>\n            await client.canReusePreservedOwnedSession!(state),\n        }\n      : {}),\n    ...(client.deserializeSessionState\n      ? {\n          deserializeSessionState: async (state: Record<string, unknown>) =>\n            await client.deserializeSessionState!(state),\n        }\n      : {}),\n  } as SandboxClient;\n}\n","import { createHash, randomUUID } from \"node:crypto\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { dirname, join, posix, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport type { SandboxSessionLike } from \"@openai/agents/sandbox\";\nimport { sandboxCommandExitCode } from \"./command-result\";\n\n/** Data shipped with the worker, never fetched from a package registry at turn time. */\nexport type ManagedCodemodeClient = {\n  version: 1;\n  files: { ogtool: string; \"client.mjs\": string; \"package.json\": string };\n};\n\nexport function managedCodemodeClientDigest(client: ManagedCodemodeClient): string {\n  return createHash(\"sha256\").update(JSON.stringify(client)).digest(\"hex\");\n}\n\n/** The exact transfer bytes: their SHA-256 is the client digest. */\nexport function managedCodemodeClientBytes(client: ManagedCodemodeClient): string {\n  return JSON.stringify(client);\n}\n\n/**\n * A short-lived signed URL for this release's client bytes, published by the\n * worker under the client digest. The box fetches the bytes itself, so a fresh\n * box installs the client in one provider command instead of staging a large\n * file through several editor round trips.\n */\nexport type ManagedCodemodeClientDownload = { url: string };\n\nexport function managedCodemodeClientDirectory(\n  client: ManagedCodemodeClient,\n  workspaceRoot = \"/workspace\",\n): string {\n  if (!posix.isAbsolute(workspaceRoot) || workspaceRoot.includes(\"\\0\")) {\n    throw new Error(\"Managed Codemode client workspace root must be absolute\");\n  }\n  return posix.join(\n    workspaceRoot,\n    \".opengeni/codemode-clients\",\n    managedCodemodeClientDigest(client),\n  );\n}\n\nexport async function buildManagedCodemodeClient(root: string): Promise<ManagedCodemodeClient> {\n  const bundle = async (entry: string, format: \"esm\" | \"cjs\", banner?: string) => {\n    const result = await Bun.build({\n      entrypoints: [join(root, entry)],\n      target: \"node\",\n      format,\n      minify: true,\n      sourcemap: \"none\",\n      ...(banner ? { banner } : {}),\n    });\n    if (!result.success || result.outputs.length !== 1) {\n      throw new Error(`Managed Codemode client build failed: ${entry}`);\n    }\n    return await result.outputs[0]!.text();\n  };\n  return {\n    version: 1,\n    files: {\n      ogtool: await bundle(\"packages/ogtool/src/cli.ts\", \"cjs\", \"#!/usr/bin/env node\"),\n      \"client.mjs\": await bundle(\"packages/codemode/src/index.ts\", \"esm\"),\n      // The extensionless executable must not inherit a user's ESM workspace.\n      \"package.json\": '{\"type\":\"commonjs\"}\\n',\n    },\n  };\n}\n\nlet releaseClient: Promise<ManagedCodemodeClient> | undefined;\nexport function loadManagedCodemodeClient(): Promise<ManagedCodemodeClient> {\n  return (releaseClient ??= (async () => {\n    const moduleDir = dirname(fileURLToPath(import.meta.url));\n    // A checkout must not reuse stale dist assets after source changes.\n    const root = resolve(moduleDir, \"../../../..\");\n    if (\n      import.meta.url.endsWith(\"/src/sandbox/codemode-client.ts\") &&\n      existsSync(join(root, \"packages/ogtool/src/cli.ts\"))\n    ) {\n      return await buildManagedCodemodeClient(root);\n    }\n    const candidates = [\n      join(moduleDir, \"assets/codemode-client.json\"),\n      join(moduleDir, \"../assets/codemode-client.json\"),\n      join(moduleDir, \"../../dist/assets/codemode-client.json\"),\n    ];\n    for (const path of candidates) {\n      if (!existsSync(path)) continue;\n      const value = JSON.parse(readFileSync(path, \"utf8\")) as ManagedCodemodeClient;\n      if (\n        !value ||\n        typeof value !== \"object\" ||\n        value.version !== 1 ||\n        Object.keys(value).sort().join(\",\") !== \"files,version\" ||\n        typeof value.files?.ogtool !== \"string\" ||\n        typeof value.files?.[\"client.mjs\"] !== \"string\" ||\n        value.files?.[\"package.json\"] !== '{\"type\":\"commonjs\"}\\n' ||\n        Object.keys(value.files).sort().join(\",\") !== \"client.mjs,ogtool,package.json\"\n      ) {\n        throw new Error(\n          \"Invalid deployment-owned managed Codemode client asset; rebuild the worker release\",\n        );\n      }\n      return value;\n    }\n    // Published runtimes must carry their own exact bytes.\n    throw new Error(\n      \"Managed Codemode client asset missing; rebuild and deploy the matching worker/runtime package (do not install latest or replace the sandbox)\",\n    );\n  })());\n}\n\nfunction quote(value: string): string {\n  return `'${value.replace(/'/g, \"'\\\\''\")}'`;\n}\n\n/** Immutable per-release paths permit old/new workers to share a warm box. */\nexport async function installManagedCodemodeClient(\n  session: SandboxSessionLike,\n  client: ManagedCodemodeClient,\n  run: (cmd: string) => Promise<unknown>,\n  runAs?: string,\n  workspaceRoot = \"/workspace\",\n  download?: ManagedCodemodeClientDownload,\n): Promise<void> {\n  const directory = managedCodemodeClientDirectory(client, workspaceRoot);\n  const digest = managedCodemodeClientDigest(client);\n  const verify = `\nconst fs = require('node:fs'), crypto = require('node:crypto');\nconst root = ${JSON.stringify(directory)};\nif (!fs.lstatSync(root).isDirectory()) process.exit(1);\nfor (const name of ['ogtool', 'client.mjs', 'package.json']) {\n  if (!fs.lstatSync(root + '/' + name).isFile()) process.exit(1);\n}\nfs.accessSync(root + '/ogtool', fs.constants.X_OK);\nconst files = {ogtool: fs.readFileSync(root + '/ogtool', 'utf8'), 'client.mjs': fs.readFileSync(root + '/client.mjs', 'utf8'), 'package.json': fs.readFileSync(root + '/package.json', 'utf8')};\nif (crypto.createHash('sha256').update(JSON.stringify({version: 1, files})).digest('hex') !== ${JSON.stringify(digest)}) process.exit(1);\n`;\n  // The staged transfer file is the first argument, so the same program\n  // installs from a fetched file and from an editor-staged one.\n  const install = `\nconst fs = require('node:fs'), crypto = require('node:crypto');\nconst transferred = fs.readFileSync(process.argv[1]);\nconst raw = (transferred[0] === 0x1f && transferred[1] === 0x8b\n  ? require('node:zlib').gunzipSync(transferred, {maxOutputLength: ${Buffer.byteLength(managedCodemodeClientBytes(client))}})\n  : transferred).toString('utf8').trim();\nif (crypto.createHash('sha256').update(raw).digest('hex') !== ${JSON.stringify(digest)}) throw Error('Codemode client transfer integrity failure');\nconst data = JSON.parse(raw), root = ${JSON.stringify(directory)};\nfs.mkdirSync(root, {recursive: true});\nif (!fs.lstatSync(root).isDirectory()) throw Error('Codemode client directory must not be a symlink');\nfor (const name of ['package.json', 'ogtool', 'client.mjs']) {\n  const tmp = root + '/' + name + '.' + crypto.randomUUID();\n  fs.writeFileSync(tmp, data.files[name], {mode: 0o755, flag: 'wx'});\n  fs.renameSync(tmp, root + '/' + name);\n}\n`;\n  if (download) {\n    // One command whether the box is warm or fresh: verify, otherwise fetch the\n    // digest-addressed bytes, install, and verify. Any failure (storage,\n    // network, a missing curl) falls back to editor staging below.\n    // A subshell scopes `exit` and the cleanup trap to this program.\n    const fetchInstall = [\n      \"(\",\n      `if node -e ${quote(verify)} 2>/dev/null; then exit 0; fi`,\n      'stage=\"$(mktemp \"${TMPDIR:-/tmp}/opengeni-codemode-client.XXXXXX\")\" || exit 1',\n      \"trap 'rm -f -- \\\"$stage\\\"' EXIT\",\n      `curl --fail --location --silent --show-error --connect-timeout 10 --max-time 60 --retry 2 --retry-delay 1 --output \"$stage\" ${quote(download.url)} || exit 1`,\n      `node -e ${quote(install)} \"$stage\" && node -e ${quote(verify)}`,\n      \")\",\n    ].join(\"\\n\");\n    try {\n      if (sandboxCommandExitCode(await run(fetchInstall)) === 0) return;\n    } catch {\n      // Fall through to the editor path, which reports its own failure.\n    }\n    // Bounded diagnostic only: never the signed URL or command output.\n    console.warn(\"Managed Codemode client download failed; staging the release bytes instead\", {\n      digest,\n    });\n  } else if (sandboxCommandExitCode(await run(`node -e ${quote(verify)} 2>/dev/null`)) === 0) {\n    return;\n  }\n  const editor = session.createEditor?.(runAs);\n  if (!editor)\n    throw new Error(\n      \"Managed Codemode client delivery requires sandbox file ingress; update the sandbox provider adapter\",\n    );\n  const stage = `${posix.dirname(directory)}/stage-${randomUUID()}.json`;\n  let installationFailure: { error: unknown } | undefined;\n  try {\n    await editor.createFile({\n      type: \"create_file\",\n      path: stage,\n      diff: `+${managedCodemodeClientBytes(client)}`,\n    });\n    const result = await run(\n      `node -e ${quote(install)} ${quote(stage)} && node -e ${quote(verify)}`,\n    );\n    if (sandboxCommandExitCode(result) !== 0) {\n      throw new Error(\n        \"Managed Codemode client delivery failed; verify Node and sandbox file ingress, then retry with the same worker release\",\n      );\n    }\n  } catch (error) {\n    installationFailure = { error };\n  }\n  try {\n    await editor.deleteFile({ type: \"delete_file\", path: stage });\n  } catch {\n    // A provider can support ingress but lose its delete reply. Remove only\n    // this exact attempt's staging file, through the same command fence.\n    try {\n      const cleanup = await run(\n        `node -e ${quote(`require('node:fs').rmSync(${JSON.stringify(stage)}, {force: true})`)}`,\n      );\n      if (sandboxCommandExitCode(cleanup) !== 0) {\n        throw new Error(\"Staging file removal failed\");\n      }\n    } catch {\n      // This file contains only immutable, non-secret release bytes. Failed\n      // housekeeping cannot invalidate a verified install or wrap its original\n      // delivery error (especially pre-dispatch/outcome-unknown provenance).\n      // Log one bounded identity, never provider errors, output, or client bytes.\n      try {\n        console.warn(\n          \"Managed Codemode client staging cleanup failed; installation result preserved\",\n          {\n            stageFile: posix.basename(stage),\n            installation: installationFailure ? \"failed\" : \"verified\",\n          },\n        );\n      } catch {\n        // Diagnostics must not change the installation result either.\n      }\n    }\n  }\n  if (installationFailure) throw installationFailure.error;\n}\n\nexport function managedCodemodeClientEnvironment(directory: string): string[] {\n  return [\n    // A routing proxy can switch to a Connected Machine during the attempt.\n    // Its native client is projected by the connection-bound exec transport.\n    'if [ -z \"${OPENGENI_CODEMODE_NATIVE_CLIENT:-}\" ]; then',\n    `  export PATH=${quote(directory)}:\"$PATH\"`,\n    `  export OPENGENI_CODEMODE_CLIENT_MODULE=${quote(`${directory}/client.mjs`)}`,\n    \"else\",\n    \"  unset OPENGENI_CODEMODE_CLIENT_MODULE\",\n    \"fi\",\n  ];\n}\n","import { resolveFirstPartyDelegationSecret, type Settings } from \"@opengeni/config\";\nimport { signDelegatedAccessToken } from \"@opengeni/contracts\";\n\nexport const CODEMODE_TOKEN_TTL_SECONDS = 60 * 60;\n\nexport type CodemodeAuthorityScope = {\n  accountId: string;\n  workspaceId: string;\n};\n\nexport type SandboxCodemodeAuthority = {\n  sessionId: string;\n  turnId: string;\n  attemptId: string;\n  executionGeneration: number;\n  credentialRestriction?: \"developer_setup\";\n  /** The machine that runs the process holding this token, when it is not the\n   *  session's active sandbox (a `run_on` exec). Paths resolve there. */\n  executionSandboxId?: string;\n};\n\nexport type MintedSandboxCodemodeToken = {\n  token: string;\n  expiresAt: Date;\n};\n\n/**\n * Mint the one canonical exact-attempt Codemode bearer used by every compute\n * placement. Delivery is deliberately a separate concern: managed sandboxes\n * rotate it through a private file, while Connected Machines receive it only\n * in the environment of an authorized child process.\n */\nexport async function mintSandboxCodemodeToken(\n  settings: Settings,\n  scope: CodemodeAuthorityScope,\n  authority: SandboxCodemodeAuthority,\n  nowMs = Date.now(),\n): Promise<MintedSandboxCodemodeToken | undefined> {\n  const delegationSecret = resolveFirstPartyDelegationSecret(settings);\n  if (!delegationSecret) return undefined;\n  const expiresAtSeconds = Math.floor(nowMs / 1000) + CODEMODE_TOKEN_TTL_SECONDS;\n  const token = await signDelegatedAccessToken(delegationSecret, {\n    accountId: scope.accountId,\n    workspaceId: scope.workspaceId,\n    subjectId: `sandbox:${authority.attemptId}`,\n    subjectLabel: \"sandbox Codemode\",\n    permissions: [\"codemode:call\"],\n    sessionId: authority.sessionId,\n    turnId: authority.turnId,\n    attemptId: authority.attemptId,\n    executionGeneration: authority.executionGeneration,\n    ...(authority.credentialRestriction\n      ? { credentialRestriction: authority.credentialRestriction }\n      : {}),\n    ...(authority.executionSandboxId ? { executionSandboxId: authority.executionSandboxId } : {}),\n    principalKind: \"agent_attempt\",\n    exp: expiresAtSeconds,\n  });\n  return { token, expiresAt: new Date(expiresAtSeconds * 1000) };\n}\n","// @opengeni/runtime/sandbox — explicit desktop recording primitives.\n//\n// ffmpeg x11grab on :0 → mp4/webm artifact on the box → direct scoped PUT to\n// object storage → recording.available. ffmpeg reads exactly the :0 framebuffer\n// watched over Channel B (zero projection).\n//\n// These are PLAIN functions over a live, externally-owned session handle — NO\n// Temporal, NO worker RPC, NO actor. They live in the agent-loop-free leaf so the\n// SAME process that already holds the resumed-by-id box for an explicit manual or\n// on-verify capture authorizes a direct box-to-storage upload. Recording bytes never\n// enter worker memory or a Temporal payload (F10).\n//\n// ── Adversarial-review fixes folded in (module 05 §Adversarial) ──────────────\n//   F1  exec is OPTIONAL on Modal (only execCommand) — every command dual-paths.\n//   F3  exec/execCommand YIELDS — the stop and direct-upload commands are bounded.\n//   F8  size is gated on the box first (stat); over-limit artifacts fail instead\n//       of being uploaded partially.\n//   FR  curl reads the absolute /tmp artifact in the box and sends it directly to\n//       the short-lived scoped URL. No workspace-root read API is involved.\n//   F9  the box file is deleted ONLY after the storage PUT confirms — never\n//       before (so a failed upload leaves the bytes recoverable for a retry).\n//   F12 ffmpeg/x11vnc backgrounding does not block the yield (nohup … & echo $!).\n//   F14 duration is computed from wall-clock (stop − start), not assumed.\n\nimport { DESKTOP_STREAM_PORT } from \"@opengeni/contracts\";\n\nexport { DESKTOP_STREAM_PORT };\n\nexport type RecordingCodec = \"h264-mp4\" | \"vp9-webm\";\nexport type RecordingContentType = \"video/mp4\" | \"video/webm\";\n\nconst DEFAULT_MAX_SECONDS = 600; // 10 min hard ceiling (the -t bound)\nconst DEFAULT_FRAMERATE = 15;\nconst DEFAULT_MAX_BYTES = 268_435_456; // 256 MB\nconst DEFAULT_DIMENSIONS: [number, number] = [1280, 800];\n// The SIGINT-and-wait loop is bounded well under the command yield window (F3).\nconst STOP_YIELD_MS = 20_000;\nconst EXEC_YIELD_MS = 15_000;\n\nexport function contentTypeForCodec(codec: RecordingCodec): RecordingContentType {\n  return codec === \"vp9-webm\" ? \"video/webm\" : \"video/mp4\";\n}\nexport function extForCodec(codec: RecordingCodec): string {\n  return codec === \"vp9-webm\" ? \"webm\" : \"mp4\";\n}\n\n/** No exec/execCommand on the session — the box cannot run ffmpeg. */\nexport class RecordingUnavailableError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"RecordingUnavailableError\";\n  }\n}\n/** ffmpeg failed, the file is missing, or the artifact is over its size limit. */\nexport class RecordingError extends Error {\n  constructor(\n    message: string,\n    readonly reason: \"ffmpeg-error\" | \"box-death\" | \"max-bytes-exceeded\" | \"display-unavailable\",\n  ) {\n    super(message);\n    this.name = \"RecordingError\";\n  }\n}\n\n// The structural slice of a provider session the recording loop drives. exec and\n// execCommand are optional (Modal has only execCommand — F1).\ntype ExecResultLike = {\n  output?: string;\n  stdout?: string;\n  stderr?: string;\n  exitCode?: number | null;\n  sessionId?: number;\n};\ntype RecordingSession = {\n  exec?: (args: {\n    cmd: string;\n    runAs?: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n  }) => Promise<ExecResultLike>;\n  execCommand?: (args: {\n    cmd: string;\n    runAs?: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n  }) => Promise<string>;\n};\n\nfunction shq(s: string): string {\n  return `'${s.replace(/'/g, `'\\\\''`)}'`;\n}\n\nfunction resultOutput(result: ExecResultLike | string): string {\n  if (typeof result === \"string\") return result;\n  return [result.output, result.stderr, result.stdout]\n    .filter((v): v is string => typeof v === \"string\" && v.length > 0)\n    .join(\"\\n\");\n}\n\n// Default per-command output cap (tokens). Recording transfer does not use stdout.\nconst DEFAULT_MAX_OUTPUT_TOKENS = 4_000;\n\nasync function run(\n  session: RecordingSession,\n  cmd: string,\n  runAs?: string,\n  yieldTimeMs = EXEC_YIELD_MS,\n  maxOutputTokens = DEFAULT_MAX_OUTPUT_TOKENS,\n): Promise<string> {\n  const args: {\n    cmd: string;\n    runAs?: string;\n    yieldTimeMs?: number;\n    maxOutputTokens?: number;\n  } = { cmd, ...(runAs ? { runAs } : {}), yieldTimeMs, maxOutputTokens };\n  if (typeof session.exec === \"function\") {\n    return resultOutput(await session.exec(args));\n  }\n  if (typeof session.execCommand === \"function\") {\n    return resultOutput(await session.execCommand(args));\n  }\n  throw new RecordingUnavailableError(\n    \"session cannot run commands (no exec/execCommand) — recording unavailable\",\n  );\n}\n\n// Extract the command body from a provider exec banner. Modal's execCommand\n// returns \"<chunk banner>\\nProcess exited…\\nOutput:\\n<body>\"; the body is what\n// follows the last \"Output:\\n\" marker. Plain exec results (no banner) pass\n// through unchanged.\nfunction stripExecBanner(raw: string): string {\n  const marker = raw.lastIndexOf(\"\\nOutput:\\n\");\n  if (marker >= 0) return raw.slice(marker + \"\\nOutput:\\n\".length);\n  if (raw.startsWith(\"Output:\\n\")) return raw.slice(\"Output:\\n\".length);\n  return raw;\n}\n\nexport type StartRecordingInput = {\n  recordingId: string;\n  codec?: RecordingCodec;\n  framerate?: number;\n  maxSeconds?: number;\n  dimensions?: [number, number];\n  display?: string; // \":0\"\n  runAs?: string;\n  tmpDir?: string; // \"/tmp\"\n};\n\nexport type RecordingProcess = {\n  recordingId: string;\n  codec: RecordingCodec;\n  boxPath: string;\n  pidFile: string;\n  dimensions: [number, number];\n  framerate: number;\n  /** epoch-ms when ffmpeg was launched (for duration computation, F14). */\n  startedAt: number;\n  display: string;\n  runAs?: string;\n};\n\n/**\n * Launch ffmpeg x11grab on :0 → an mp4/webm file on the box. Backgrounded with\n * `nohup … & echo $!` so the launch returns immediately (F12 — the exec does not\n * block on the recording). A hard `-t <maxSeconds>` ceiling bounds a runaway file\n * across a multi-day turn. Returns the handle the caller carries to stop+finalize.\n */\nexport async function startRecording(\n  session: unknown,\n  input: StartRecordingInput,\n): Promise<RecordingProcess> {\n  const s = session as RecordingSession;\n  const codec = input.codec ?? \"h264-mp4\";\n  const dimensions = input.dimensions ?? DEFAULT_DIMENSIONS;\n  const framerate = input.framerate ?? DEFAULT_FRAMERATE;\n  const maxSeconds = input.maxSeconds ?? DEFAULT_MAX_SECONDS;\n  const display = input.display ?? \":0\";\n  const tmp = input.tmpDir ?? \"/tmp\";\n  const ext = extForCodec(codec);\n  const boxPath = `${tmp}/og-rec-${input.recordingId}.${ext}`;\n  const pidFile = `${tmp}/og-rec-${input.recordingId}.pid`;\n  const logFile = `${tmp}/og-rec-${input.recordingId}.log`;\n  const [w, h] = dimensions;\n  const enc =\n    codec === \"vp9-webm\"\n      ? `-c:v libvpx-vp9 -b:v 0 -crf 32 -row-mt 1`\n      : `-c:v libx264 -preset veryfast -pix_fmt yuv420p -movflags +faststart`;\n  const ffmpeg =\n    `nohup ffmpeg -hide_banner -loglevel error -f x11grab -draw_mouse 1 -framerate ${framerate} ` +\n    `-video_size ${w}x${h} -i ${display}.0 -t ${maxSeconds} ${enc} ${boxPath} ` +\n    `</dev/null >${logFile} 2>&1 & echo $! > ${pidFile}`;\n  await run(s, `bash -lc ${shq(ffmpeg)}`, input.runAs);\n  return {\n    recordingId: input.recordingId,\n    codec,\n    boxPath,\n    pidFile,\n    dimensions,\n    framerate,\n    startedAt: Date.now(),\n    display,\n    ...(input.runAs ? { runAs: input.runAs } : {}),\n  };\n}\n\n/**\n * SIGINT ffmpeg (so it writes a clean moov atom / webm trailer) and wait for the\n * pid to exit. Bounded well under the yield window (F3). Idempotent: a missing\n * pid file is a no-op.\n */\nexport async function stopRecording(session: unknown, proc: RecordingProcess): Promise<void> {\n  const s = session as RecordingSession;\n  const wait = `kill -INT \"$(cat ${proc.pidFile})\" 2>/dev/null; for i in $(seq 1 80); do kill -0 \"$(cat ${proc.pidFile})\" 2>/dev/null || break; sleep 0.1; done`;\n  await run(s, `bash -lc ${shq(wait)}`, proc.runAs, STOP_YIELD_MS).catch(() => undefined);\n}\n\nexport type RecordingArtifactMetadata = {\n  contentType: RecordingContentType;\n  sizeBytes: number;\n  durationSeconds: number;\n};\n\n/**\n * Inspect and size-gate the finalized recording while it is still on the box.\n * No recording bytes cross into the worker process.\n */\nexport async function inspectRecordingArtifact(\n  session: unknown,\n  proc: RecordingProcess,\n  maxBytes = DEFAULT_MAX_BYTES,\n): Promise<RecordingArtifactMetadata> {\n  const s = session as RecordingSession;\n  if (typeof s.exec !== \"function\" && typeof s.execCommand !== \"function\") {\n    throw new RecordingUnavailableError(\n      \"session cannot run commands (no exec/execCommand) — recording finalize unavailable\",\n    );\n  }\n  // F8: size-gate on the box before authorizing the upload.\n  const sizeOut = (\n    await run(\n      s,\n      `bash -lc ${shq(`stat -c %s ${proc.boxPath} 2>/dev/null || echo MISSING`)}`,\n      proc.runAs,\n    )\n  ).trim();\n  const sizeLine =\n    sizeOut\n      .split(\"\\n\")\n      .map((l) => l.trim())\n      .filter(Boolean)\n      .pop() ?? \"MISSING\";\n  if (sizeLine === \"MISSING\" || sizeLine === \"\") {\n    throw new RecordingError(`recording file missing on box: ${proc.boxPath}`, \"box-death\");\n  }\n  const size = Number(sizeLine);\n  if (!Number.isFinite(size) || size <= 0) {\n    throw new RecordingError(`recording file empty on box: ${proc.boxPath}`, \"ffmpeg-error\");\n  }\n  if (size > maxBytes) {\n    throw new RecordingError(`recording ${size}B exceeds max ${maxBytes}B`, \"max-bytes-exceeded\");\n  }\n  return {\n    contentType: contentTypeForCodec(proc.codec),\n    sizeBytes: size,\n    durationSeconds: Math.max(0, Math.round((Date.now() - proc.startedAt) / 1000)),\n  };\n}\n\nconst RECORDING_UPLOAD_OK = \"OPENGENI_RECORDING_UPLOAD_OK\";\nconst RECORDING_UPLOAD_MAX_SECONDS = 300;\n\n/**\n * Upload the finalized artifact directly from the sandbox to a scoped object-\n * storage URL. The worker carries only the short URL/headers and metadata; it\n * never materializes a base64 string or Uint8Array for a recording that may be\n * hundreds of megabytes. curl's success marker makes an exec transport that\n * returns non-zero command output instead of throwing still fail closed.\n */\nexport async function uploadRecordingArtifact(\n  session: unknown,\n  proc: RecordingProcess,\n  input: {\n    url: string;\n    requiredHeaders: Record<string, string>;\n    maxBytes?: number;\n    maxSeconds?: number;\n  },\n): Promise<RecordingArtifactMetadata> {\n  const maxSeconds = input.maxSeconds ?? RECORDING_UPLOAD_MAX_SECONDS;\n  if (!Number.isSafeInteger(maxSeconds) || maxSeconds <= 0 || maxSeconds > 300) {\n    throw new Error(\"recording upload maxSeconds must be an integer between 1 and 300\");\n  }\n  const metadata = await inspectRecordingArtifact(session, proc, input.maxBytes);\n  const headers = Object.entries(input.requiredHeaders)\n    .sort(([left], [right]) => left.localeCompare(right))\n    .map(([name, value]) => `--header ${shq(`${name}: ${value}`)}`)\n    .join(\" \");\n  const upload = [\n    \"set -euo pipefail\",\n    `curl --fail --silent --show-error --connect-timeout 20 --max-time ${maxSeconds} --request PUT ${headers} --upload-file ${shq(proc.boxPath)} ${shq(input.url)}`,\n    `printf '${RECORDING_UPLOAD_OK}\\\\n'`,\n  ].join(\"; \");\n  const output = stripExecBanner(\n    await run(\n      session as RecordingSession,\n      `bash -lc ${shq(upload)}`,\n      proc.runAs,\n      (maxSeconds + 10) * 1_000,\n    ),\n  );\n  if (!output.includes(RECORDING_UPLOAD_OK)) {\n    throw new Error(\"recording upload did not confirm success\");\n  }\n  return metadata;\n}\n\n/**\n * Delete the box artifacts. F9: call this ONLY after the storage PUT confirmed\n * and the `available` row committed — never before. Best-effort; never throws.\n */\nexport async function deleteRecordingArtifacts(\n  session: unknown,\n  proc: RecordingProcess,\n): Promise<void> {\n  const s = session as RecordingSession;\n  const logFile = proc.boxPath.replace(/\\.(mp4|webm)$/, \".log\");\n  await run(s, `rm -f ${proc.boxPath} ${proc.pidFile} ${logFile}`, proc.runAs).catch(\n    () => undefined,\n  );\n}\n\n/** The storage object key for a recording artifact (parallels the file-asset layout). */\nexport function recordingStorageKey(\n  workspaceId: string,\n  sessionId: string,\n  recordingId: string,\n  codec: RecordingCodec,\n): string {\n  return `recordings/${workspaceId}/${sessionId}/${recordingId}.${extForCodec(codec)}`;\n}\n","// Selfhosted capability negotiation (M3, item 4).\n//\n// `negotiateSelfhostedCapabilities` resolves the selfhosted-specific cells from\n//   (a) the M2 enrollment row (consent / display / status / lastSeenAt), and\n//   (b) a LIVENESS PROBE (a `ControlRpc` Ping, mockable) — \"is there a responder\n//       on the subject right now?\"\n// into the right `SessionCapabilities` cells with the selfhosted reasons:\n//   - online              → responder + consented: cells available.\n//   - offline             → no enrollment / revoked / no responder: agent_offline.\n//   - reconnecting        → a transient blip (a recent lastSeenAt but the probe\n//                           missed): agent_reconnecting.\n//   - consent_required    → enrolled but whole-machine / screen-control not acked:\n//                           the interactive desktop stream becomes read-only.\n//   - display_unavailable → online but the machine has no display (headless, no\n//                           Xvfb): desktop and recording degrade with\n//                           display_unavailable.\n//\n// It REUSES `negotiateCapabilities` for the descriptor-shaped cells (so the\n// \"every cell present, degradation is a value\" rule and the FS/Terminal/Git\n// surface stay identical to Modal), then overlays the selfhosted liveness/consent\n// /display reasons. The base function stays pure + synchronous; this is the\n// selfhosted-aware entrypoint the API/worker call.\n\nimport type {\n  CapabilityUnavailableReason,\n  SandboxOs,\n  SessionCapabilities,\n} from \"@opengeni/contracts\";\nimport { negotiateCapabilities, type NegotiationContext } from \"../select\";\nimport type { SelfhostedSession } from \"./session\";\n\n/**\n * The structural slice of the M2 `@opengeni/db` `EnrollmentRecord` the selfhosted\n * negotiation reads. Defined STRUCTURALLY (not imported from `@opengeni/db`) so\n * the agent-loop-free sandbox leaf does not couple to the DB package's graph —\n * the API/worker pass an `EnrollmentRecord`, which satisfies this shape. The\n * fields: `status` (active gates reachability), `exposure` +\n * `allowScreenControl` (whole-machine + screen-control consent),`hasDisplay`\n * (the display plane), `lastSeenAt` (the reconnecting-window disambiguator).\n */\nexport interface SelfhostedEnrollment {\n  status: string;\n  exposure: string;\n  allowScreenControl: boolean;\n  hasDisplay: boolean;\n  /** Exact normalized launch root persisted from the authoritative Hello. */\n  workspaceRoot?: string | null;\n  lastSeenAt: string | null;\n  /** An un-cleared clean going-offline marker (the machine announced a typed\n   *  GoingOffline). When set, the derivation reads the machine OFFLINE immediately,\n   *  regardless of a still-fresh `lastSeenAt`. NULL ⇒ no pending goodbye. */\n  wentOfflineAt: string | null;\n  /** The typed reason string of the pending goodbye (rides alongside\n   *  `wentOfflineAt`; NULL when there is no un-cleared marker). */\n  wentOfflineReason: string | null;\n}\n\n/** The derived liveness state of a selfhosted machine (the online/offline/\n *  reconnecting/consent/display matrix). */\nexport interface SelfhostedLivenessState {\n  /** The dominant machine state. */\n  state: \"online\" | \"reconnecting\" | \"offline\";\n  /** Whole-machine + screen-control consent acknowledged (gates desktop input). */\n  consented: boolean;\n  /** A display (real or Xvfb) is present (gates the desktop pixel plane). */\n  hasDisplay: boolean;\n}\n\n/**\n * The window after `lastSeenAt` within which a missed liveness probe is read as a\n * transient BLIP (`reconnecting`) rather than a hard `offline`. Mirrors the\n * resiliency model (§10.6: reconnecting after 1 missed window, offline after\n * ~30s). A probe miss with a lastSeenAt inside this window → reconnecting.\n */\nexport const SELFHOSTED_RECONNECT_WINDOW_MS = 30_000;\n\n/**\n * Derive the selfhosted liveness state from the enrollment row + a liveness probe\n * outcome. The probe is the authoritative \"is the agent answering NOW\" signal;\n * `lastSeenAt` disambiguates a probe-miss into reconnecting (recent) vs offline\n * (stale / never seen).\n *\n *   - no enrollment / revoked         → offline (the machine isn't enrolled).\n *   - un-cleared clean goodbye        → offline (an announced GoingOffline beats\n *                                       last_seen aging AND a lingering probe).\n *   - probe responded                 → online.\n *   - probe missed, lastSeenAt recent → reconnecting (a transient blip).\n *   - probe missed, lastSeenAt stale  → offline.\n */\nexport function selfhostedLiveness(input: {\n  enrollment: SelfhostedEnrollment | null;\n  /** The ControlRpc Ping outcome: true iff a responder answered. */\n  probeResponded: boolean;\n  /** Override the clock (tests). */\n  now?: Date;\n}): SelfhostedLivenessState {\n  const { enrollment } = input;\n  if (!enrollment || enrollment.status !== \"active\") {\n    return { state: \"offline\", consented: false, hasDisplay: false };\n  }\n  const consented = enrollment.exposure === \"whole-machine\" && enrollment.allowScreenControl;\n  const hasDisplay = enrollment.hasDisplay;\n  // A CLEAN going-offline the machine announced takes precedence over BOTH\n  // last_seen aging and a lingering probe: a machine that said \"I'm stopping\" must\n  // read offline immediately (so no new work is routed at it) until a NEWER\n  // liveness signal — a reconnect Hello or a fresher heartbeat — clears the marker\n  // in the row. `status: \"revoked\"` above still trumps this (a revoked machine is\n  // offline regardless). This is the #348 lease-waits-on-dead-detect fix.\n  if (enrollment.wentOfflineAt) {\n    return { state: \"offline\", consented, hasDisplay };\n  }\n  if (input.probeResponded) {\n    return { state: \"online\", consented, hasDisplay };\n  }\n  // Probe missed → reconnecting if we saw it recently, else offline.\n  const now = (input.now ?? new Date()).getTime();\n  const lastSeen = enrollment.lastSeenAt ? new Date(enrollment.lastSeenAt).getTime() : null;\n  if (lastSeen !== null && now - lastSeen <= SELFHOSTED_RECONNECT_WINDOW_MS) {\n    return { state: \"reconnecting\", consented, hasDisplay };\n  }\n  return { state: \"offline\", consented, hasDisplay };\n}\n\n/**\n * Dashboard/list liveness: heartbeat + goodbye only. Fresh `lastSeenAt` (inside\n * the reconnect window) is online. There is no ControlRpc ping here — attach,\n * capability negotiation, and fleet tools still probe when they must know\n * whether a responder is answering now.\n */\nexport function selfhostedHeartbeatLiveness(input: {\n  enrollment: SelfhostedEnrollment | null;\n  now?: Date;\n}): SelfhostedLivenessState {\n  const { enrollment } = input;\n  if (!enrollment || enrollment.status !== \"active\") {\n    return { state: \"offline\", consented: false, hasDisplay: false };\n  }\n  const now = input.now ?? new Date();\n  const lastSeen = enrollment.lastSeenAt ? new Date(enrollment.lastSeenAt).getTime() : null;\n  const heartbeatFresh =\n    lastSeen !== null && now.getTime() - lastSeen <= SELFHOSTED_RECONNECT_WINDOW_MS;\n  return selfhostedLiveness({\n    enrollment,\n    probeResponded: heartbeatFresh,\n    now,\n  });\n}\n\nexport interface SelfhostedNegotiationInput {\n  sessionId: string;\n  os?: SandboxOs;\n  leaseEpoch: number;\n  /** The M2 enrollment row for the machine (null → never enrolled → offline). */\n  enrollment: SelfhostedEnrollment | null;\n  /** A live liveness probe — typically `session.ping()`. When a session is\n   *  provided this is called; otherwise pass `probeResponded` explicitly. */\n  session?: Pick<SelfhostedSession, \"ping\">;\n  /** Explicit probe outcome (when no session is given, e.g. a pure read). */\n  probeResponded?: boolean;\n  /** The deployment desktop/terminal policy toggles (threaded through to the\n   *  base negotiation). */\n  desktopEnabled?: boolean;\n  desktopInteractive?: boolean;\n  terminalEnabled?: boolean;\n  streamTokenSecretAvailable?: boolean;\n  /** Whether the calling principal acknowledged the un-redacted desktop. */\n  desktopAcknowledged?: boolean;\n  shared?: boolean;\n  sharedSessionIds?: string[];\n  /** Override the clock (tests). */\n  now?: Date;\n}\n\n/**\n * Negotiate the full `SessionCapabilities` document for a selfhosted machine,\n * with the online/offline/reconnecting/consent_required/display_unavailable cells\n * correctly decided. Async because it issues the liveness probe.\n */\nexport async function negotiateSelfhostedCapabilities(\n  input: SelfhostedNegotiationInput,\n): Promise<SessionCapabilities> {\n  const probeResponded =\n    input.probeResponded ?? (input.session ? await input.session.ping() : false);\n  const liveness = selfhostedLiveness({\n    enrollment: input.enrollment,\n    probeResponded,\n    ...(input.now ? { now: input.now } : {}),\n  });\n\n  // The base context: map the machine state onto the lease `liveness` axis so the\n  // descriptor-shaped cells (FS/Terminal/Git/Desktop) negotiate as on a warm box\n  // when online, and a cold box when not reachable (no live tunnel). The\n  // selfhosted overlay below then stamps the selfhosted-specific reasons.\n  const baseLiveness: NegotiationContext[\"liveness\"] =\n    liveness.state === \"online\" ? \"warm\" : \"cold\";\n  const base: NegotiationContext = {\n    sessionId: input.sessionId,\n    backend: \"selfhosted\",\n    os: input.os ?? \"linux\",\n    liveness: baseLiveness,\n    leaseEpoch: input.leaseEpoch,\n    desktopEnabled: input.desktopEnabled ?? true,\n    desktopInteractive: input.desktopInteractive ?? true,\n    terminalEnabled: input.terminalEnabled ?? true,\n    streamTokenSecretAvailable: input.streamTokenSecretAvailable ?? true,\n    ...(input.desktopAcknowledged !== undefined\n      ? { desktopAcknowledged: input.desktopAcknowledged }\n      : {}),\n    ...(input.shared !== undefined ? { shared: input.shared } : {}),\n    ...(input.sharedSessionIds !== undefined ? { sharedSessionIds: input.sharedSessionIds } : {}),\n    ...(input.now ? { now: input.now } : {}),\n  };\n  const negotiated = negotiateCapabilities(base);\n  const caps: SessionCapabilities = {\n    ...negotiated,\n    FileSystem: {\n      ...negotiated.FileSystem,\n      root: input.enrollment?.workspaceRoot ?? \".\",\n    },\n  };\n\n  // ── Overlay the selfhosted liveness/consent/display reasons ────────────────\n\n  // When the machine is not online, the Channel-A surface (FS/Terminal/Git) and\n  // the desktop plane cannot be reached — stamp the machine-liveness reason. This\n  // is the dominant degrade (like os_unsupported): an offline/reconnecting agent\n  // knocks out every reachable capability with the single coherent reason.\n  if (liveness.state !== \"online\") {\n    const reason: CapabilityUnavailableReason =\n      liveness.state === \"offline\" ? \"agent_offline\" : \"agent_reconnecting\";\n    return {\n      ...caps,\n      FileSystem: { ...caps.FileSystem, available: false, readOnly: true, reason },\n      Terminal: {\n        ...caps.Terminal,\n        transport: null,\n        url: null,\n        token: null,\n        expiresAt: null,\n        reason,\n      },\n      Git: { ...caps.Git, available: false, reason },\n      DesktopStream: {\n        ...caps.DesktopStream,\n        transport: null,\n        client: null,\n        mode: \"read-only\",\n        url: null,\n        token: null,\n        expiresAt: null,\n        requiresAcknowledgment: false,\n        acknowledged: false,\n        shared: false,\n        sharedSessionIds: [],\n        reason,\n      },\n      Recording: { ...caps.Recording, available: false, modes: [], codecs: [], reason },\n    };\n  }\n\n  // Online: FS/Terminal/Git stay as the base negotiated them (the machine is\n  // reachable). The desktop plane splits VIEW from CONTROL:\n  //  - VIEW (a read-only DesktopStream, Recording) requires a DISPLAY only. The\n  //    agent already holds whole-machine shell exec (it can `screencapture` the\n  //    screen itself), so passive viewing is within the exposure the user already\n  //    consented to; a missing display (headless, no Xvfb / no macOS Screen\n  //    Recording grant) is the only blocker.\n  //  - CONTROL — an INTERACTIVE stream — additionally requires the explicit\n  //    allowScreenControl consent (`consented`).\n  // Precedence: a headless machine blocks everything (display_unavailable); a\n  // displayed-but-unconsented machine can be VIEWED (read-only) + RECORDED but not\n  // CONTROLLED (consent_required). (If the base already degraded a cell for a\n  // policy reason — desktop disabled / no stream-token secret — that base reason\n  // wins; we only stamp a selfhosted reason on a cell the base left AVAILABLE.)\n  if (!liveness.hasDisplay) {\n    const reason: CapabilityUnavailableReason = \"display_unavailable\";\n    return {\n      ...caps,\n      DesktopStream:\n        caps.DesktopStream.transport !== null\n          ? {\n              ...caps.DesktopStream,\n              transport: null,\n              client: null,\n              mode: \"read-only\",\n              url: null,\n              token: null,\n              expiresAt: null,\n              requiresAcknowledgment: false,\n              acknowledged: false,\n              shared: false,\n              sharedSessionIds: [],\n              reason,\n            }\n          : caps.DesktopStream,\n      Recording: caps.Recording.available\n        ? { ...caps.Recording, available: false, modes: [], codecs: [], reason }\n        : caps.Recording,\n    };\n  }\n\n  if (!liveness.consented) {\n    // Displayed but no screen-CONTROL consent: VIEW (read-only) + Recording stay\n    // available; only interactive viewer CONTROL is withheld. Force the stream to read-only\n    // so no input is forwarded even if the base offered an interactive mode.\n    return {\n      ...caps,\n      DesktopStream:\n        caps.DesktopStream.transport !== null\n          ? { ...caps.DesktopStream, mode: \"read-only\" }\n          : caps.DesktopStream,\n    };\n  }\n\n  // Fully online + displayed + consented: the base negotiation already produced\n  // the correct available viewer and recording cells.\n  return caps;\n}\n","// `MockAgentResponder` — an in-process `ControlRpc` test double standing in for\n// a real enrolled agent over NATS (the live NATS transport is M4). It answers\n// the request/reply op table (ping / fs.read / fs.write / fs.list / fs.stat /\n// git / metrics / desktopEnsure) against an in-memory virtual filesystem, so\n// the non-exec `SelfhostedSession` surface and mocked-NATS\n// integration tests run with zero broker.\n//\n// It is shipped from the runtime package (a testing util, not test-only-private)\n// because the API/worker integration suites (M4+) reuse it to drive\n// `withChannelA`/viewer/swap end-to-end without a real machine.\n\nimport {\n  AgentError,\n  ControlRequest,\n  ControlResponse,\n  ErrorCode,\n  FsEntryKind,\n  type ExecRequest,\n  type ExecResponse,\n  type FsListResponse,\n  type FsReadResponse,\n  type FsStatResponse,\n  type FsWriteResponse,\n} from \"@opengeni/agent-proto\";\nimport type { ControlRpc } from \"./control-rpc\";\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\n\n/** Test-only command behavior consumed by an op-stream fake runner. */\nexport type MockExecHandler = (req: ExecRequest) => ExecResponse | Promise<ExecResponse>;\n\nexport interface MockAgentResponderOptions {\n  /** Whether a responder exists at all. When false EVERY request yields an\n   *  AGENT_OFFLINE error (the \"machine is offline\" condition) — used to drive the\n   *  agent_offline capability + the isProviderSandboxNotFoundError test. */\n  online?: boolean;\n  /** Whether the agent has acknowledged whole-machine / screen-control consent.\n   *  When false, an op gated on consent yields CONSENT_REQUIRED. Defaults true. */\n  consented?: boolean;\n  /** Force the agent into a draining posture (every op → DRAINING). */\n  draining?: boolean;\n  /** Seed files (path → string|Uint8Array) into the virtual filesystem. */\n  files?: Record<string, string | Uint8Array>;\n  /** Command behavior for an op-stream test harness. This responder never\n   *  exposes request/reply exec itself. */\n  exec?: MockExecHandler;\n  /** The hostname the mock reports (so PTY `$HOSTNAME`-style asserts work). */\n  hostname?: string;\n}\n\n/**\n * An in-process `ControlRpc` answering the agent op table against an in-memory\n * virtual filesystem. Drive a `SelfhostedSession` with this to test readFile /\n * writeFile / list / stat round-trips without any NATS. Exec tests use the\n * op-stream fake runner from `op-testing.ts`.\n */\nexport class MockAgentResponder implements ControlRpc {\n  private online: boolean;\n  private readonly consented: boolean;\n  private readonly draining: boolean;\n  private readonly files = new Map<string, Uint8Array>();\n  private readonly execHandler: MockExecHandler;\n  readonly hostname: string;\n\n  /** Every request seen, for assertion (subject + decoded ControlRequest). */\n  readonly requests: Array<{ subject: string; req: ControlRequest }> = [];\n\n  constructor(opts: MockAgentResponderOptions = {}) {\n    this.online = opts.online ?? true;\n    this.consented = opts.consented ?? true;\n    this.draining = opts.draining ?? false;\n    this.hostname = opts.hostname ?? \"mock-machine\";\n    this.execHandler = opts.exec ?? ((req) => defaultEcho(req, this.hostname));\n    for (const [path, content] of Object.entries(opts.files ?? {})) {\n      this.files.set(\n        normalize(path),\n        typeof content === \"string\" ? encoder.encode(content) : content,\n      );\n    }\n  }\n\n  /** Flip the responder offline mid-test (a deliberate stop / blip). */\n  setOnline(online: boolean): void {\n    this.online = online;\n  }\n\n  /** Read a file the session wrote (test assertion helper). */\n  fileText(path: string): string | undefined {\n    const bytes = this.files.get(normalize(path));\n    return bytes ? decoder.decode(bytes) : undefined;\n  }\n\n  /** Produce the command result used by an op-stream test runner. */\n  async runExec(req: ExecRequest): Promise<ExecResponse> {\n    return await this.execHandler(req);\n  }\n\n  async request(\n    subject: string,\n    req: ControlRequest,\n    _opts: { timeoutMs: number },\n  ): Promise<ControlResponse> {\n    this.requests.push({ subject, req });\n    if (!this.online) {\n      return errorResponse(\n        req.requestId,\n        ErrorCode.ERROR_CODE_AGENT_OFFLINE,\n        \"the enrolled agent is offline\",\n        false,\n      );\n    }\n    if (this.draining) {\n      return errorResponse(\n        req.requestId,\n        ErrorCode.ERROR_CODE_DRAINING,\n        \"the agent is draining\",\n        true,\n      );\n    }\n    const op = req.op;\n    if (!op) {\n      return errorResponse(req.requestId, ErrorCode.ERROR_CODE_PROTOCOL, \"empty op\", false);\n    }\n    const subjectParts = subject.split(\".\");\n    const workspaceId = subjectParts[1] ?? \"\";\n    const agentId = subjectParts[2] ?? \"\";\n    switch (op.$case) {\n      case \"ping\":\n        return ok(req.requestId, {\n          $case: \"ping\",\n          ping: { nonce: op.ping.nonce, agentMonotonicMs: \"0\", controlReplayTokens: [] },\n        });\n      case \"fsRead\": {\n        const bytes = this.files.get(normalize(op.fsRead.path));\n        if (!bytes) {\n          return errorResponse(\n            req.requestId,\n            ErrorCode.ERROR_CODE_NOT_FOUND,\n            `no such file: ${op.fsRead.path}`,\n            false,\n          );\n        }\n        const res: FsReadResponse = { content: bytes, totalSize: String(bytes.length) };\n        return ok(req.requestId, { $case: \"fsRead\", fsRead: res });\n      }\n      case \"fsWrite\": {\n        const path = normalize(op.fsWrite.path);\n        const next = op.fsWrite.append\n          ? concat(this.files.get(path) ?? new Uint8Array(0), op.fsWrite.content)\n          : op.fsWrite.content;\n        this.files.set(path, next);\n        const res: FsWriteResponse = { bytesWritten: String(op.fsWrite.content.length) };\n        return ok(req.requestId, { $case: \"fsWrite\", fsWrite: res });\n      }\n      case \"fsRemove\": {\n        const path = normalize(op.fsRemove.path);\n        if (!this.files.delete(path)) {\n          return errorResponse(\n            req.requestId,\n            ErrorCode.ERROR_CODE_NOT_FOUND,\n            `no such file: ${op.fsRemove.path}`,\n            false,\n          );\n        }\n        return ok(req.requestId, { $case: \"fsRemove\", fsRemove: {} });\n      }\n      case \"fsList\": {\n        const prefix = normalize(op.fsList.path).replace(/\\/?$/, \"/\");\n        const res: FsListResponse = {\n          entries: [...this.files.keys()]\n            .filter((p) => p.startsWith(prefix))\n            .map((p) => {\n              const bytes = this.files.get(p)!;\n              const rel = p.slice(prefix.length);\n              return {\n                name: rel.split(\"/\").pop() ?? rel,\n                path: rel,\n                kind: FsEntryKind.FS_ENTRY_KIND_FILE,\n                size: String(bytes.length),\n                modifiedMs: \"0\",\n                mode: 0o644,\n              };\n            }),\n        };\n        return ok(req.requestId, { $case: \"fsList\", fsList: res });\n      }\n      case \"fsStat\": {\n        const bytes = this.files.get(normalize(op.fsStat.path));\n        const res: FsStatResponse = bytes\n          ? {\n              exists: true,\n              entry: {\n                name: normalize(op.fsStat.path).split(\"/\").pop() ?? \"\",\n                path: op.fsStat.path,\n                kind: FsEntryKind.FS_ENTRY_KIND_FILE,\n                size: String(bytes.length),\n                modifiedMs: \"0\",\n                mode: 0o644,\n              },\n            }\n          : { exists: false, entry: undefined };\n        return ok(req.requestId, { $case: \"fsStat\", fsStat: res });\n      }\n      case \"desktopEnsure\": {\n        // The desktop STREAM (view) is DISPLAY-gated, not consent-gated: the real\n        // agent registers the channel + captures frames regardless of screen-control\n        // consent (`register_desktop` in hub.rs sets `allow_input` from consent and\n        // the pump captures anyway) — only INPUT injection is gated. This stub has a\n        // (mock) display and does not model viewer input injection, so\n        // desktopEnsure always succeeds; `consented` only affects interactive control.\n        return ok(req.requestId, {\n          $case: \"desktopEnsure\",\n          desktopEnsure: {\n            channel: {\n              channelId: \"mock-desktop\",\n              workspaceId,\n              agentId,\n              kind: 1,\n              port: 6080,\n            },\n            display: { id: \":99\", width: 1024, height: 768, virtual: true },\n          },\n        });\n      }\n      case \"ptyOpen\": {\n        // The PTY plane is display-INDEPENDENT and has NO consent gate (unlike\n        // desktopEnsure) — a terminal works on a headless machine. Returns a PTY\n        // StreamChannel on the 7681 port.\n        return ok(req.requestId, {\n          $case: \"ptyOpen\",\n          ptyOpen: {\n            ptyId: \"mock-pty\",\n            channel: { channelId: \"mock-pty\", workspaceId, agentId, kind: 1, port: 7681 },\n          },\n        });\n      }\n      case \"browserControlEnsure\":\n        return ok(req.requestId, {\n          $case: \"browserControlEnsure\",\n          browserControlEnsure: { port: 17_321, sidecarGeneration: \"mock-sidecar-1\" },\n        });\n      case \"browserFramesOpen\": {\n        return ok(req.requestId, {\n          $case: \"browserFramesOpen\",\n          browserFramesOpen: {\n            channel: {\n              channelId: `mock-browser-${op.browserFramesOpen.targetId}`,\n              workspaceId,\n              agentId,\n              kind: 3,\n              port: 20_000,\n            },\n          },\n        });\n      }\n      case \"computerFramesOpen\": {\n        return ok(req.requestId, {\n          $case: \"computerFramesOpen\",\n          computerFramesOpen: {\n            channel: {\n              channelId: `mock-computer-${op.computerFramesOpen.targetId}`,\n              workspaceId,\n              agentId,\n              kind: 4,\n              port: 20_001,\n            },\n          },\n        });\n      }\n      default:\n        return errorResponse(\n          req.requestId,\n          ErrorCode.ERROR_CODE_UNSUPPORTED,\n          `mock does not implement ${op.$case}`,\n          false,\n        );\n    }\n  }\n}\n\nfunction defaultEcho(req: ExecRequest, hostname: string): ExecResponse {\n  const joined = req.command.join(\" \");\n  const stdout = /hostname|HOSTNAME/.test(joined) ? hostname : joined;\n  return {\n    exitCode: 0,\n    stdout: encoder.encode(`${stdout}\\n`),\n    stderr: new Uint8Array(0),\n    timedOut: false,\n    durationMs: \"1\",\n    backgroundChildrenStopped: false,\n  };\n}\n\nfunction ok(requestId: string, result: NonNullable<ControlResponse[\"result\"]>): ControlResponse {\n  return { requestId, error: undefined, result };\n}\n\nfunction errorResponse(\n  requestId: string,\n  code: ErrorCode,\n  message: string,\n  retryable: boolean,\n): ControlResponse {\n  const error: AgentError = { code, message, retryable, detail: {} };\n  return { requestId, error, result: undefined };\n}\n\nfunction normalize(path: string): string {\n  // Collapse to a leading-slash absolute form for stable keys.\n  const trimmed = path.replace(/\\/+$/, \"\");\n  return trimmed.startsWith(\"/\") ? trimmed : `/${trimmed}`;\n}\n\nfunction concat(a: Uint8Array, b: Uint8Array): Uint8Array {\n  const out = new Uint8Array(a.length + b.length);\n  out.set(a, 0);\n  out.set(b, a.length);\n  return out;\n}\n","// Test doubles for the op-stream exec client (op-stream.ts): an in-memory\n// transport and a scripted FAKE RUNNER that emulates the Rust runner's\n// protocol behavior faithfully enough to exercise every client path —\n// idempotent OpStart (dedup by op id, never re-runs), attach replay from\n// retention, live-emission fault injection (drops / duplicates / reordering),\n// OpQuery status, typed lost states, and DRAINING admission. The runner's own\n// half is proven by its Rust harness (the E-scenarios); this double exists so\n// the CLIENT's reassembly/heal/ack logic is unit-testable with no broker and\n// no binary, deterministically.\n//\n// Emission model (mirrors the real runner): frames live in RETENTION the\n// moment they exist. With `live: false` (the default) the op is already\n// COMPLETE at start — the client's initial attach replays everything (the\n// completed-op collection path, incl. re-dispatch attach-not-rerun). With\n// `live: true` the first attach replays nothing and triggers the LIVE\n// emission with the fault filters applied (drops/dups/reordering); any LATER\n// attach is a heal and replays from retention unfiltered — exactly how the\n// runner's ring/spool heals what the wire mangled.\n\nimport { blake3 } from \"@noble/hashes/blake3\";\nimport { bytesToHex } from \"@noble/hashes/utils\";\nimport {\n  ControlRequest,\n  ControlResponse,\n  ErrorCode,\n  type ExecRequest,\n  type ExecResponse,\n  OpAck,\n  OpChannel,\n  OpFrame,\n  OpLostReason,\n  OpState,\n  type AgentError,\n  type OpExit,\n  type OpStart,\n  type OpStatus,\n} from \"@opengeni/agent-proto\";\nimport type { ControlRpc } from \"./control-rpc\";\nimport {\n  opFrameSubject,\n  OpStreamUnavailableError,\n  type OpStreamSubscription,\n  type OpStreamTransport,\n} from \"./op-transport\";\n\n/**\n * An in-memory `OpStreamTransport`: subscriptions are a subject→handler map,\n * and everything the CLIENT publishes (its acks) is recorded for assertions\n * and mirrored to `onPublish` (the fake runner's ack intake). `available =\n * false` makes both primitives throw `OpStreamUnavailableError` so callers\n * can assert that exec fails closed before dispatch.\n */\nexport class InMemoryOpStreamTransport implements OpStreamTransport {\n  available = true;\n  readonly published: Array<{ subject: string; payload: Uint8Array }> = [];\n  onPublish: ((subject: string, payload: Uint8Array) => void) | undefined;\n  private readonly handlers = new Map<string, Set<(payload: Uint8Array) => void>>();\n\n  async subscribe(\n    subject: string,\n    onMessage: (payload: Uint8Array) => void,\n  ): Promise<OpStreamSubscription> {\n    if (!this.available) {\n      throw new OpStreamUnavailableError(\"in-memory transport marked unavailable\");\n    }\n    let set = this.handlers.get(subject);\n    if (!set) {\n      set = new Set();\n      this.handlers.set(subject, set);\n    }\n    set.add(onMessage);\n    return {\n      unsubscribe: () => {\n        set.delete(onMessage);\n      },\n    };\n  }\n\n  async publish(subject: string, payload: Uint8Array): Promise<void> {\n    if (!this.available) {\n      throw new OpStreamUnavailableError(\"in-memory transport marked unavailable\");\n    }\n    this.published.push({ subject, payload });\n    this.onPublish?.(subject, payload);\n  }\n\n  /** Deliver a payload to the subject's subscribers (the runner→client leg). */\n  deliver(subject: string, payload: Uint8Array): void {\n    for (const handler of this.handlers.get(subject) ?? []) {\n      handler(payload);\n    }\n  }\n\n  /** Every OpAck the client published, decoded, in publish order. */\n  decodedAcks(): OpAck[] {\n    return this.published.map(({ payload }) => OpAck.decode(payload));\n  }\n}\n\n/** One scripted data frame (the exit frame is synthesized from `exit`). */\nexport interface FakeOpDataFrame {\n  channel: \"stdout\" | \"stderr\";\n  bytes: Uint8Array | string;\n}\n\nexport interface FakeOpScript {\n  /** Data/progress frames in emission order (seq 1..N; the exit takes N+1). */\n  frames: Array<FakeOpDataFrame | \"progress\">;\n  /** Exit overrides (exitCode/timedOut/failureCode/…). Digests and totals are\n   *  computed from the scripted data frames unless overridden. */\n  exit?: Partial<OpExit>;\n  /** LIVE mode: the first attach replays nothing and triggers the (faulty)\n   *  live emission; later attaches replay from retention unfiltered. Default\n   *  false = the op is COMPLETE at start (pure collection). */\n  live?: boolean;\n  /** Keep a live op RUNNING with no frames until OpCancel is received. */\n  holdUntilCancel?: boolean;\n  /** Seqs whose LIVE emission is dropped (retention keeps them). */\n  dropLiveSeqs?: ReadonlySet<number>;\n  /** Seqs whose LIVE emission is duplicated (delivered twice back-to-back). */\n  duplicateLiveSeqs?: ReadonlySet<number>;\n  /** Swap each adjacent live pair (1,2 → 2,1) to exercise the stash path. */\n  reorderLivePairs?: boolean;\n  /** The first N OpStarts answer a DRAINING AgentError (admission pressure). */\n  drainingStarts?: number;\n  /** Refuse every OpStart with this error (e.g. a PROTOCOL refusal from a\n   *  runner that does not speak the required op-stream protocol). */\n  startError?: AgentError;\n}\n\ninterface FakeOpRun {\n  connectionInstanceId: string;\n  script: FakeOpScript;\n  frames: OpFrame[];\n  exitSeq: bigint;\n  exit: OpExit;\n  startCount: number;\n  attachCount: number;\n  drainingRemaining: number;\n  liveEmitted: boolean;\n  finalAcked: boolean;\n  acks: OpAck[];\n  highestGeneration: bigint;\n}\n\nconst encoder = new TextEncoder();\n\n/**\n * The scripted fake runner: a `ControlRpc` that answers the op-stream control\n * ops and emits frames through an `InMemoryOpStreamTransport`.\n */\nexport class FakeOpRunner implements ControlRpc {\n  private readonly transport: InMemoryOpStreamTransport;\n  private readonly workspaceId: string;\n  private readonly agentId: string;\n  private readonly connectionInstanceId: string;\n  private readonly defaultScript:\n    | ((exec: ExecRequest, opId: string) => FakeOpScript | Promise<FakeOpScript>)\n    | undefined;\n  private readonly scripts = new Map<string, FakeOpScript>();\n  readonly runs = new Map<string, FakeOpRun>();\n  readonly starts: Array<{ opId: string; exec: ExecRequest }> = [];\n  /** Op ids that answer LOST (evicted) on query/attach — bounded-retention\n   *  collateral. */\n  readonly lostOps = new Set<string>();\n  /** Op ids released by an `OpRelease` for their exact exit frame: dropped,\n   *  and answered LOST (released) from then on. */\n  readonly releasedOps = new Set<string>();\n  private readonly cancelledBeforeStart = new Set<string>();\n\n  constructor(opts: {\n    transport: InMemoryOpStreamTransport;\n    workspaceId: string;\n    agentId: string;\n    connectionInstanceId: string;\n    defaultScript?: (exec: ExecRequest, opId: string) => FakeOpScript | Promise<FakeOpScript>;\n  }) {\n    this.transport = opts.transport;\n    this.workspaceId = opts.workspaceId;\n    this.agentId = opts.agentId;\n    this.connectionInstanceId = opts.connectionInstanceId;\n    this.defaultScript = opts.defaultScript;\n    this.transport.onPublish = (_subject, payload) => this.onAck(payload);\n  }\n\n  /** Script the op the NEXT OpStart with this id will run. */\n  script(opId: string, script: FakeOpScript): void {\n    this.scripts.set(opId, script);\n  }\n\n  private onAck(payload: Uint8Array): void {\n    let ack: OpAck;\n    try {\n      ack = OpAck.decode(payload);\n    } catch {\n      return;\n    }\n    const run = this.runs.get(ack.opId);\n    if (!run) {\n      return;\n    }\n    // Generation fencing exactly like the runner: only the highest generation\n    // seen has any effect; `final` is honored only when it covers the exit.\n    const generation = BigInt(ack.attachGeneration);\n    if (generation === 0n || generation !== run.highestGeneration) {\n      return;\n    }\n    run.acks.push(ack);\n    if (ack.final && BigInt(ack.ackedSeq) >= run.exitSeq) {\n      run.finalAcked = true;\n    }\n  }\n\n  async request(\n    subject: string,\n    req: ControlRequest,\n    _opts: { timeoutMs: number },\n  ): Promise<ControlResponse> {\n    const connectionInstanceId = connectionInstanceIdFromSubject(subject);\n    if (!connectionInstanceId) {\n      return errorResponse(\n        req.requestId,\n        ErrorCode.ERROR_CODE_PROTOCOL,\n        \"request did not address an exact connection instance\",\n      );\n    }\n    const op = req.op;\n    if (!op) {\n      return errorResponse(req.requestId, ErrorCode.ERROR_CODE_PROTOCOL, \"no op\");\n    }\n    switch (op.$case) {\n      case \"opStart\":\n        return await this.handleStart(req.requestId, op.opStart, connectionInstanceId);\n      case \"opAttach\":\n        return this.handleAttach(\n          req.requestId,\n          op.opAttach.opId,\n          BigInt(op.opAttach.fromSeq),\n          op.opAttach.attachGeneration,\n          connectionInstanceId,\n        );\n      case \"opQuery\":\n        return this.handleQuery(req.requestId, op.opQuery.opId, connectionInstanceId);\n      case \"opCancel\":\n        return this.handleCancel(req.requestId, op.opCancel.opId, connectionInstanceId);\n      case \"opRelease\":\n        return this.handleRelease(\n          req.requestId,\n          op.opRelease.opId,\n          BigInt(op.opRelease.exitSeq),\n          connectionInstanceId,\n        );\n      default: {\n        return errorResponse(\n          req.requestId,\n          ErrorCode.ERROR_CODE_UNSUPPORTED,\n          `fake runner: unscripted op ${op.$case}`,\n        );\n      }\n    }\n  }\n\n  private async handleStart(\n    opId: string,\n    start: OpStart,\n    connectionInstanceId: string,\n  ): Promise<ControlResponse> {\n    if (this.cancelledBeforeStart.has(opId)) {\n      return startResponse(opId, cancelledStatus(opId), false);\n    }\n    const existing = this.runs.get(opId);\n    if (existing) {\n      if (existing.connectionInstanceId !== connectionInstanceId) {\n        return errorResponse(\n          opId,\n          ErrorCode.ERROR_CODE_FENCED,\n          \"operation belongs to a different connection instance\",\n        );\n      }\n      // IDEMPOTENT BY OP ID: a known op answers its current status and NEVER\n      // re-runs (the whole point of B1).\n      existing.startCount += 1;\n      return startResponse(opId, this.statusOf(opId, existing));\n    }\n    const exec = start.op?.$case === \"exec\" ? start.op.exec : undefined;\n    if (!exec) {\n      return errorResponse(\n        opId,\n        ErrorCode.ERROR_CODE_UNSUPPORTED,\n        \"fake runner: only exec OpStart is supported\",\n      );\n    }\n    this.starts.push({ opId, exec });\n    const scripted = this.scripts.get(opId) ?? (await this.defaultScript?.(exec, opId));\n    if (scripted && !this.scripts.has(opId)) this.scripts.set(opId, scripted);\n    const script = this.scripts.get(opId);\n    if (!script) {\n      return errorResponse(\n        opId,\n        ErrorCode.ERROR_CODE_PROTOCOL,\n        `fake runner: no script for op ${opId}`,\n      );\n    }\n    if (script.startError) {\n      return { requestId: opId, error: script.startError, result: undefined };\n    }\n    const pending = this.scripts.get(opId) as FakeOpScript;\n    if ((pending.drainingStarts ?? 0) > 0) {\n      // Admission pressure: count down across retries of the un-admitted op.\n      this.scripts.set(opId, { ...pending, drainingStarts: (pending.drainingStarts ?? 0) - 1 });\n      return {\n        requestId: opId,\n        error: {\n          code: ErrorCode.ERROR_CODE_DRAINING,\n          message: \"fake runner: admission pool full\",\n          retryable: true,\n          detail: {},\n        },\n        result: undefined,\n      };\n    }\n    const run = this.buildRun(opId, this.scripts.get(opId) as FakeOpScript, connectionInstanceId);\n    run.startCount = 1;\n    this.runs.set(opId, run);\n    return startResponse(opId, this.statusOf(opId, run));\n  }\n\n  private handleAttach(\n    requestId: string,\n    opId: string,\n    fromSeq: bigint,\n    generation: string,\n    connectionInstanceId: string,\n  ): ControlResponse {\n    if (this.releasedOps.has(opId)) {\n      return statusOnly(requestId, releasedStatus(opId));\n    }\n    if (this.lostOps.has(opId)) {\n      return statusOnly(requestId, lostStatus(opId));\n    }\n    const run = this.runs.get(opId);\n    if (!run) {\n      return statusOnly(\n        requestId,\n        this.cancelledBeforeStart.has(opId) ? tombstoneStatus(opId) : lostStatus(opId),\n      );\n    }\n    if (run.connectionInstanceId !== connectionInstanceId) {\n      return errorResponse(\n        requestId,\n        ErrorCode.ERROR_CODE_FENCED,\n        \"operation belongs to a different connection instance\",\n      );\n    }\n    run.attachCount += 1;\n    const attachGeneration = BigInt(generation);\n    // Rust apply_attach still returns status but refuses replay for generation\n    // zero or an older consumer. Do not make stale clients appear healthy.\n    if (attachGeneration === 0n || attachGeneration < run.highestGeneration) {\n      return statusOnly(requestId, this.statusOf(opId, run));\n    }\n    if (attachGeneration > run.highestGeneration) {\n      run.highestGeneration = attachGeneration;\n    }\n    const subject = opFrameSubject(this.workspaceId, this.agentId, opId, run.connectionInstanceId);\n    if (run.script.live && !run.liveEmitted) {\n      // First attach on a live op: nothing retained yet worth replaying — the\n      // child \"runs now\" and the (faulty) live flow begins.\n      if (!run.script.holdUntilCancel) this.emitLive(opId, run, subject);\n      return statusOnly(requestId, this.statusOf(opId, run));\n    }\n    // A heal (or completed-op collection): replay from RETENTION — every frame\n    // > fromSeq, in order, NO fault injection (the runner's ring/spool holds\n    // them all under the credit-only ack policy).\n    const replay = run.frames.filter((frame) => BigInt(frame.seq) > fromSeq);\n    queueMicrotask(() => {\n      for (const frame of replay) {\n        this.transport.deliver(subject, OpFrame.encode(frame).finish());\n      }\n    });\n    return statusOnly(requestId, this.statusOf(opId, run));\n  }\n\n  private handleQuery(\n    requestId: string,\n    opId: string,\n    connectionInstanceId: string,\n  ): ControlResponse {\n    if (this.releasedOps.has(opId)) {\n      return statusOnly(requestId, releasedStatus(opId));\n    }\n    if (this.lostOps.has(opId)) {\n      return statusOnly(requestId, lostStatus(opId));\n    }\n    const run = this.runs.get(opId);\n    if (!run) {\n      return statusOnly(\n        requestId,\n        this.cancelledBeforeStart.has(opId) ? tombstoneStatus(opId) : lostStatus(opId),\n      );\n    }\n    if (run.connectionInstanceId !== connectionInstanceId) {\n      return errorResponse(\n        requestId,\n        ErrorCode.ERROR_CODE_FENCED,\n        \"operation belongs to a different connection instance\",\n      );\n    }\n    return statusOnly(requestId, this.statusOf(opId, run));\n  }\n\n  /** The agent's OpRelease: drop a COMPLETE op whose exit frame is exactly\n   *  `exitSeq` and confirm it in the answer; anything else answers its status\n   *  and releases nothing. */\n  private handleRelease(\n    requestId: string,\n    opId: string,\n    exitSeq: bigint,\n    connectionInstanceId: string,\n  ): ControlResponse {\n    const answer = this.handleQuery(requestId, opId, connectionInstanceId);\n    const run = this.runs.get(opId);\n    if (\n      !run ||\n      this.releasedOps.has(opId) ||\n      this.lostOps.has(opId) ||\n      answer.result?.$case !== \"opStatus\" ||\n      answer.result.opStatus.state !== OpState.OP_STATE_COMPLETE ||\n      run.exitSeq !== exitSeq\n    ) {\n      return answer;\n    }\n    this.releasedOps.add(opId);\n    run.finalAcked = true;\n    return statusOnly(requestId, releasedStatus(opId));\n  }\n\n  private handleCancel(\n    requestId: string,\n    opId: string,\n    connectionInstanceId: string,\n  ): ControlResponse {\n    const run = this.runs.get(opId);\n    if (!run) {\n      this.cancelledBeforeStart.add(opId);\n      return statusOnly(requestId, cancelledStatus(opId));\n    }\n    if (run.connectionInstanceId !== connectionInstanceId) {\n      return errorResponse(\n        requestId,\n        ErrorCode.ERROR_CODE_FENCED,\n        \"operation belongs to a different connection instance\",\n      );\n    }\n    if (!run.liveEmitted && run.script.holdUntilCancel) {\n      run.exit.exitCode = -1;\n      run.exit.cancelled = true;\n      run.liveEmitted = true;\n      const subject = opFrameSubject(\n        this.workspaceId,\n        this.agentId,\n        opId,\n        run.connectionInstanceId,\n      );\n      queueMicrotask(() => {\n        for (const frame of run.frames) {\n          this.transport.deliver(subject, OpFrame.encode(frame).finish());\n        }\n      });\n    }\n    return statusOnly(requestId, this.statusOf(opId, run));\n  }\n\n  /** The LIVE flow: fault filters applied (drops, duplicates, adjacent\n   *  reordering); retention still holds every frame for the heal replay. */\n  private emitLive(opId: string, run: FakeOpRun, subject: string): void {\n    run.liveEmitted = true;\n    const { dropLiveSeqs, duplicateLiveSeqs, reorderLivePairs } = run.script;\n    let sequence = [...run.frames];\n    if (reorderLivePairs) {\n      for (let i = 0; i + 1 < sequence.length; i += 2) {\n        const a = sequence[i] as OpFrame;\n        sequence[i] = sequence[i + 1] as OpFrame;\n        sequence[i + 1] = a;\n      }\n    }\n    sequence = sequence.filter((frame) => !dropLiveSeqs?.has(Number(frame.seq)));\n    queueMicrotask(() => {\n      for (const frame of sequence) {\n        const payload = OpFrame.encode(frame).finish();\n        this.transport.deliver(subject, payload);\n        if (duplicateLiveSeqs?.has(Number(frame.seq))) {\n          this.transport.deliver(subject, payload);\n        }\n      }\n    });\n  }\n\n  private statusOf(opId: string, run: FakeOpRun): OpStatus {\n    // The fake's ops are instant: COMPLETE the moment their frames exist. A\n    // live op that has not yet emitted reads RUNNING with nothing produced;\n    // once emission ran (even if the wire dropped frames), the runner-side\n    // truth is COMPLETE with the full high watermark — exactly what a silence\n    // probe needs to see to detect \"the runner is ahead of us\".\n    const complete = !run.script.live || run.liveEmitted;\n    return {\n      opId,\n      state: complete ? OpState.OP_STATE_COMPLETE : OpState.OP_STATE_RUNNING,\n      nextSeq: complete ? (run.exitSeq + 1n).toString() : \"1\",\n      writeOffset: \"0\",\n      exit: complete ? run.exit : undefined,\n      lostReason: OpLostReason.OP_LOST_REASON_UNSPECIFIED,\n    };\n  }\n\n  private buildRun(opId: string, script: FakeOpScript, connectionInstanceId: string): FakeOpRun {\n    const frames: OpFrame[] = [];\n    const channelBytes: Record<\"stdout\" | \"stderr\", Uint8Array[]> = { stdout: [], stderr: [] };\n    let seq = 0n;\n    for (const spec of script.frames) {\n      seq += 1n;\n      if (spec === \"progress\") {\n        frames.push({ opId, seq: seq.toString(), body: { $case: \"progress\", progress: {} } });\n        continue;\n      }\n      const bytes = typeof spec.bytes === \"string\" ? encoder.encode(spec.bytes) : spec.bytes;\n      channelBytes[spec.channel].push(bytes);\n      frames.push({\n        opId,\n        seq: seq.toString(),\n        body: {\n          $case: \"data\",\n          data: {\n            channel:\n              spec.channel === \"stdout\" ? OpChannel.OP_CHANNEL_STDOUT : OpChannel.OP_CHANNEL_STDERR,\n            bytes,\n          },\n        },\n      });\n    }\n    seq += 1n;\n    const digests: Record<string, string> = {};\n    const totals: Record<string, string> = {};\n    for (const channel of [\"stdout\", \"stderr\"] as const) {\n      const joined = concat(channelBytes[channel]);\n      digests[channel] = bytesToHex(blake3(joined));\n      totals[channel] = String(joined.byteLength);\n    }\n    const exit: OpExit = {\n      exitCode: 0,\n      timedOut: false,\n      cancelled: false,\n      durationMs: \"5\",\n      digests,\n      totals,\n      failureCode: \"\",\n      failureDetail: {},\n      backgroundChildrenStopped: false,\n      ...script.exit,\n    };\n    frames.push({ opId, seq: seq.toString(), body: { $case: \"exit\", exit } });\n    return {\n      connectionInstanceId,\n      script,\n      frames,\n      exitSeq: seq,\n      exit,\n      startCount: 0,\n      attachCount: 0,\n      drainingRemaining: script.drainingStarts ?? 0,\n      liveEmitted: false,\n      finalAcked: false,\n      acks: [],\n      highestGeneration: 0n,\n    };\n  }\n}\n\nexport function createMockSelfhostedOpStream(input: {\n  responder: ControlRpc & { runExec(exec: ExecRequest): Promise<ExecResponse> };\n  workspaceId: string;\n  agentId: string;\n  connectionInstanceId: string;\n}) {\n  const transport = new InMemoryOpStreamTransport();\n  const runner = new FakeOpRunner({\n    transport,\n    workspaceId: input.workspaceId,\n    agentId: input.agentId,\n    connectionInstanceId: input.connectionInstanceId,\n    defaultScript: async (exec) => {\n      const response = await input.responder.runExec(exec);\n      return {\n        frames: [\n          ...(response.stdout.length > 0\n            ? [{ channel: \"stdout\" as const, bytes: response.stdout }]\n            : []),\n          ...(response.stderr.length > 0\n            ? [{ channel: \"stderr\" as const, bytes: response.stderr }]\n            : []),\n        ],\n        exit: {\n          exitCode: response.exitCode,\n          timedOut: response.timedOut,\n          durationMs: response.durationMs,\n          backgroundChildrenStopped: response.backgroundChildrenStopped,\n        },\n      };\n    },\n  });\n  const controlRpc: ControlRpc = {\n    request: async (subject, request, opts) => {\n      const gate = await input.responder.request(subject, request, opts);\n      if (gate.error?.code !== ErrorCode.ERROR_CODE_UNSUPPORTED) return gate;\n      return await runner.request(subject, request, opts);\n    },\n  };\n  return {\n    controlRpc,\n    opStream: { transport },\n    runner,\n    transport,\n  };\n}\n\nfunction concat(chunks: Uint8Array[]): Uint8Array {\n  const total = chunks.reduce((sum, c) => sum + c.byteLength, 0);\n  const out = new Uint8Array(total);\n  let offset = 0;\n  for (const chunk of chunks) {\n    out.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return out;\n}\n\nfunction connectionInstanceIdFromSubject(subject: string): string | undefined {\n  const parts = subject.split(\".\");\n  const connectionIndex = parts.indexOf(\"connection\");\n  return connectionIndex >= 0 ? parts[connectionIndex + 1] : undefined;\n}\n\nfunction errorResponse(requestId: string, code: ErrorCode, message: string): ControlResponse {\n  return {\n    requestId,\n    error: { code, message, retryable: false, detail: {} },\n    result: undefined,\n  };\n}\n\nfunction startResponse(requestId: string, status: OpStatus, accepted = true): ControlResponse {\n  return {\n    requestId,\n    error: undefined,\n    result: { $case: \"opStart\", opStart: { accepted, status } },\n  };\n}\n\nfunction statusOnly(requestId: string, status: OpStatus): ControlResponse {\n  return {\n    requestId,\n    error: undefined,\n    result: { $case: \"opStatus\", opStatus: status },\n  };\n}\n\nfunction lostStatus(opId: string): OpStatus {\n  return {\n    opId,\n    state: OpState.OP_STATE_LOST,\n    writeOffset: \"0\",\n    nextSeq: \"0\",\n    exit: undefined,\n    lostReason: OpLostReason.OP_LOST_REASON_EVICTED,\n  };\n}\n\nfunction releasedStatus(opId: string): OpStatus {\n  return { ...lostStatus(opId), lostReason: OpLostReason.OP_LOST_REASON_RELEASED };\n}\n\n/** The agent's status for an op cancelled before it began: complete and\n *  cancelled, no frame ever sent, no output record. */\nfunction tombstoneStatus(opId: string): OpStatus {\n  return { ...cancelledStatus(opId), nextSeq: \"0\" };\n}\n\nfunction cancelledStatus(opId: string): OpStatus {\n  return {\n    opId,\n    state: OpState.OP_STATE_COMPLETE,\n    writeOffset: \"0\",\n    nextSeq: \"1\",\n    exit: {\n      exitCode: -1,\n      timedOut: false,\n      cancelled: true,\n      durationMs: \"0\",\n      digests: {},\n      totals: {},\n      failureCode: \"\",\n      failureDetail: {},\n      backgroundChildrenStopped: false,\n    },\n    lostReason: OpLostReason.OP_LOST_REASON_UNSPECIFIED,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;ACpCP,SAAS,cAAc;AACvB,SAAS,OAAO,SAAS,SAAS,UAAU,UAAU,UAAU,UAAU;AAC1E,SAAS,cAAc;AACvB,SAAS,YAAY;AAqBd,IAAM,gCAAgC;AACtC,IAAM,8CAA8C;AAC3D,IAAM,wBAAwB;AAAA,EAC5B;AAAA,EACA;AACF;AAGA,SAAS,UAAU,QAAmC;AACpD,SAAO,IAAI,OAAO,MAAM,SAAS,2CAA2C;AAC9E;AACA,IAAM,cAAc,sBAAsB,IAAI,SAAS;AAIvD,eAAe,iBAAiB,KAA8C;AAC5E,MAAI;AACF,UAAM,OAAO,MAAM,SAAS,SAAS,GAAG,SAAS,MAAM;AAEvD,UAAM,SAAS,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC,EAAE,MAAM,GAAG;AAE9D,UAAM,YAAY,OAAO,EAAE;AAC3B,WAAO,aAAa,QAAQ,KAAK,SAAS,IAAI,YAAY;AAAA,EAC5D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,eAAuC;AACpD,MAAI;AACF,WAAO,kBAAkB,KAAK,MAAM,SAAS,mBAAmB,CAAC,IAAI,CAAC,KAAK;AAAA,EAC7E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,IAAI;AACJ,SAAS,eAA6C;AACpD,SAAQ,mBAAmB,YAAY;AACrC,UAAM,CAAC,WAAW,SAAS,IAAI,MAAM,QAAQ,IAAI,CAAC,aAAa,GAAG,iBAAiB,MAAM,CAAC,CAAC;AAC3F,WAAO,aAAa,YAAY,EAAE,WAAW,KAAK,QAAQ,KAAK,UAAU,IAAI;AAAA,EAC/E,GAAG;AACL;AAGA,IAAM,kBAAkB,oBAAI,IAAY;AACxC,IAAI,oBAAoB;AACxB,SAAS,8BAA8B;AACrC,aAAW,aAAa,iBAAiB;AACvC,QAAI;AACF,aAAO,WAAW,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,IACpD,QAAQ;AAAA,IAER;AAAA,EACF;AACA,kBAAgB,MAAM;AACxB;AAGA,eAAsB,oCACpB,MACA,OAA0B,+BACT;AACjB,QAAM,QAAQ,MAAM,aAAa;AACjC,QAAM,SAAS,QAAQ,GAAG,IAAI,IAAI,MAAM,SAAS,IAAI,MAAM,GAAG,IAAI,MAAM,SAAS,MAAM;AACvF,QAAM,YAAY,MAAM,QAAQ,KAAK,MAAM,MAAM,CAAC;AAClD,kBAAgB,IAAI,SAAS;AAC7B,MAAI,CAAC,mBAAmB;AACtB,wBAAoB;AACpB,YAAQ,KAAK,QAAQ,2BAA2B;AAAA,EAClD;AACA,SAAO;AACT;AAGA,eAAsB,oCAAoC,WAAkC;AAC1F,QAAM,GAAG,WAAW,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AACpD,kBAAgB,OAAO,SAAS;AAClC;AAEA,eAAe,YACb,SACA,OACkB;AAClB,MAAI,MAAM,cAAc,QAAQ,UAAW,QAAO;AAClD,MAAI,MAAM,QAAQ,QAAQ,IAAK,QAAO,MAAM,cAAc,QAAQ;AAClE,MAAI,CAAC,OAAO,cAAc,MAAM,GAAG,KAAK,MAAM,MAAM,EAAG,QAAO;AAC9D,QAAM,gBAAgB,MAAM,iBAAiB,MAAM,GAAG;AACtD,SAAO,kBAAkB,MAAM;AACjC;AAOA,eAAsB,6CACpB,QAA2B,0BAA0B,GAClC;AACnB,QAAM,UAAoB,CAAC;AAC3B,QAAM,UAAU,MAAM,aAAa;AACnC,QAAM,MAAM,OAAO,QAAQ,WAAW,aAAa,QAAQ,OAAO,IAAI;AACtE,MAAI,CAAC,WAAW,QAAQ,OAAW,QAAO;AAC1C,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,aAAa,OAAO;AAC7B,UAAM,OAAO,MAAM,SAAS,SAAS,EAAE,MAAM,MAAM,IAAI;AACvD,QAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,EAAG;AAC7B,SAAK,IAAI,IAAI;AACb,UAAM,QAAQ,MAAM,QAAQ,IAAI,EAAE,MAAM,MAAM,CAAC,CAAa;AAC5D,eAAW,QAAQ,OAAO;AACxB,YAAM,QAAQ,YAAY,IAAI,CAAC,YAAY,QAAQ,KAAK,IAAI,CAAC,EAAE,KAAK,OAAO;AAC3E,UAAI,CAAC,MAAO;AACZ,YAAM,QAAQ,EAAE,WAAW,MAAM,CAAC,GAAI,KAAK,OAAO,MAAM,CAAC,CAAC,GAAG,WAAW,MAAM,CAAC,EAAG;AAClF,UAAI;AACF,YAAI,CAAE,MAAM,YAAY,SAAS,KAAK,EAAI;AAC1C,cAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,cAAM,QAAQ,MAAM,MAAM,IAAI;AAC9B,YAAI,CAAC,MAAM,YAAY,KAAK,MAAM,QAAQ,IAAK;AAC/C,cAAM,GAAG,MAAM,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAC/C,gBAAQ,KAAK,IAAI;AAAA,MACnB,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,4BAAsC;AACpD,SAAO,CAAC,OAAO,GAAG,YAAY,MAAM;AACtC;AAEA,IAAI;AAGG,SAAS,mDAAsE;AACpF,SAAQ,iBAAiB,6CAA6C;AACxE;AAKO,IAAM,6CAA6C,OAAO,OAAO;AAAA,EACtE,MAAM,SAA0B;AAC9B,UAAM,iDAAiD;AACvD,WAAO,MAAM;AAAA,MACX,OAAO;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AACV,CAAC;;;AChLD,SAAS,yBAAyB;AAElC,SAAS,kCAAkC;AAO3C,SAAS,WAAW,OAAe,OAAqB,UAAmB;AACzE,QAAM,QAAQ,OAAO,OAAO,CAAC,OAAO,KAAK,OAAO,QAAQ,GAAG,GAAG,KAAK,CAAC;AACpE,MAAI,WAAW,MAAM;AACrB,MAAI,CAAC,UAAU;AACb,aAAS,QAAQ,KAAK,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,QAAQ,MAAM,QAAQ,SAAS;AAC7E,YAAM,QAAQ,MAAM,KAAK;AACzB,YAAM,QACJ,SAAS,OAAQ,SAAS,MACtB,IACA,SAAS,OAAQ,SAAS,MACxB,IACA,SAAS,OAAQ,SAAS,MACxB,IACA;AACV,UAAI,CAAC,SAAS,MAAM,SAAS,SAAS,MAAO;AAC7C,YAAM,SAAS,MAAM,SAAS,QAAQ,CAAC;AACvC,UAAI,CAAC,OAAO,MAAM,CAAC,SAAS,QAAQ,OAAQ,QAAQ,GAAI,EAAG;AAC3D,YAAM,SAAS,OAAO,CAAC;AACvB,UACE,WAAW,WACT,UAAU,OAAQ,SAAS,OAC1B,UAAU,OAAQ,SAAS,OAC3B,UAAU,OAAQ,SAAS,OAC3B,UAAU,OAAQ,SAAS;AAE9B;AACF,iBAAW;AACX;AAAA,IACF;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM,MAAM,SAAS,GAAG,QAAQ,EAAE,SAAS,MAAM;AAAA,IACjD,WAAW,MAAM,SAAS,QAAQ,EAAE,SAAS,QAAQ;AAAA,EACvD;AACF;AAEA,IAAM,YAAY,iBACf,OAAO;AAAA,EACN,OAAO,iBACJ,WAAW,UAAU,EACrB,UAAU,CAAC,UAAuC,KAAK,EACvD;AAAA,IACC,CAAC,UAAU,MAAM,cAAc;AAAA,IAC/B;AAAA,EACF;AAAA,EACF,KAAK,iBAAE,QAAQ;AACjB,CAAC,EACA,OAAO;AACV,IAAM,UAAU,iBAAE,mBAAmB,UAAU;AAAA,EAC7C,iBAAE,OAAO,EAAE,QAAQ,iBAAE,QAAQ,aAAa,GAAG,MAAM,iBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO;AAAA,EACzF,iBAAE,OAAO,EAAE,QAAQ,iBAAE,QAAQ,mBAAmB,GAAG,MAAM,iBAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO;AACtF,CAAC;AACD,IAAM,UAAU,iBACb,OAAO;AAAA,EACN,UAAU,iBAAE,QAAQ,0BAA0B;AAAA,EAC9C,UAAU;AAAA,EACV,SAAS;AAAA,EACT,SAAS,iBAAE,OAAO,EAAE,QAAQ,WAAW,QAAQ,UAAU,CAAC,EAAE,OAAO;AAAA,EACnE,MAAM;AACR,CAAC,EACA,OAAO;AAcV,SAAS,QACP,UACA,SACA,MACc;AACd,QAAM,UAAU,gBAAgB,QAAQ;AACxC,QAAM,SAA0C,CAAC;AACjD,aAAW,UAAU,CAAC,UAAU,QAAQ,GAAY;AAClD,UAAM,MAAM,SAAS,QAAQ,MAAM;AACnC,UAAM,OAAO,QAAQ,MAAM;AAC3B,UAAM,UAAU,WAAW,IAAI,eAAe,CAAC,KAAK,KAAK,GAAG,KAAK,GAAG;AACpE,UAAM,aAAa,IAAI,aAAa,KAAK,MAAM;AAC/C,QAAI,CAAC,OAAO,cAAc,UAAU,EAAG,OAAM,IAAI,MAAM,+BAA+B;AACtF,YAAQ,QAAQ,MAAM,IAAI;AAAA,MACxB;AAAA,MACA,eAAe,QAAQ;AAAA,MACvB,KAAK,KAAK;AAAA,MACV,UAAU,KAAK,MAAM,KAAK,OAAO;AAAA,IACnC;AACA,QAAI,QAAQ;AACV,aAAO,KAAK;AAAA,QACV;AAAA,QACA,SAAS,gBAAgB,SAAS,MAAM,IAAI,MAAM,IAAI,IAAI,UAAU,IAAI,UAAU,IAAI,KAAK,MAAM,IAAI,CAAC;AAAA,QACtG,MAAM,QAAQ;AAAA,MAChB,CAAC;AAAA,EACL;AACA,SAAO;AAAA,IACL;AAAA,IACA,UAAU,gBAAgB,QAAQ;AAAA,IAClC;AAAA,IACA,UAAU,QAAQ,QAAQ,OAAO,OAAO,QAAQ,QAAQ,OAAO,MAAM,KAAK,OAAO;AAAA,IACjF,gBAAgB,KAAK,SAAS;AAAA,IAC9B,gBAAgB,SAAS,MAAM,WAAW;AAAA,EAC5C;AACF;AAIO,SAAS,0BACd,SACA,SACA,MACmD;AACnD,QAAM,WAAW,gBAAgB,OAAO;AACxC,QAAM,WAAW;AAAA,IACf,QAAQ,EAAE,OAAO,OAAO,KAAK,QAAQ,OAAO,KAAK,GAAG,KAAK,QAAQ,OAAO,IAAI;AAAA,IAC5E,QAAQ,EAAE,OAAO,OAAO,KAAK,QAAQ,OAAO,KAAK,GAAG,KAAK,QAAQ,OAAO,IAAI;AAAA,EAC9E;AACA,QAAM,SAAS,QAAQ,UAAU,UAAU,IAAI;AAC/C,SAAO;AAAA,IACL,KAAK;AAAA,MACH,UAAU;AAAA,MACV;AAAA,MACA,SAAS,gBAAgB,OAAO,OAAO;AAAA,MACvC,SAAS;AAAA,MACT,MAAM,EAAE,GAAG,KAAK;AAAA,IAClB;AAAA,IACA;AAAA,EACF;AACF;AAMO,SAAS,yBACd,OACA,SACc;AACd,QAAM,OAAO,QAAQ,MAAM,KAAK;AAChC,QAAM,WAAW,2BAA2B,MAAM,OAAO;AACzD,MAAI,CAAC,kBAAkB,KAAK,UAAU,QAAQ;AAC5C,UAAM,IAAI,MAAM,mDAAmD;AACrE,aAAW,UAAU,CAAC,UAAU,QAAQ,GAAY;AAClD,UAAM,MAAM,SAAS,QAAQ,MAAM;AACnC,UAAM,MAAM,KAAK,QAAQ,MAAM;AAC/B,UAAM,YAAY,OAAO,KAAK,IAAI,eAAe,QAAQ;AACzD,QACE,UAAU,SAAS,QAAQ,MAAM,IAAI,iBACrC,UAAU,SAAS,KACnB,UAAU,SAAS,IAAI,cACtB,IAAI,OAAO,UAAU,WAAW;AAEjC,YAAM,IAAI,MAAM,+CAA+C;AACjE,QAAI,IAAI,QAAQ,CAAC,IAAI,OAAO,IAAI,MAAM,eAAe;AACnD,YAAM,IAAI,MAAM,kDAAkD;AACpE,QAAI,IAAI,aAAa,QAAQ,KAAK,KAAK,SAAS,IAAI;AAClD,YAAM,IAAI,MAAM,6CAA6C;AAAA,EACjE;AACA,MACE,KAAK,KAAK,WAAW,wBACpB,CAAC,SAAS,QAAQ,OAAO,OACxB,CAAC,SAAS,QAAQ,OAAO,OACzB,SAAS,QAAQ,OAAO,aAAa,KAAK,KAAK,QAC/C,SAAS,QAAQ,OAAO,aAAa,KAAK,KAAK;AAEjD,UAAM,IAAI,MAAM,qDAAqD;AACvE,QAAM,SAAS,QAAQ,UAAU,KAAK,SAAS,KAAK,IAAI;AACxD,MAAI,CAAC,kBAAkB,KAAK,SAAS,OAAO,OAAO;AACjD,UAAM,IAAI,MAAM,6DAA6D;AAC/E,SAAO;AACT;;;ACxLA,SAAS,cAAAA,mBAA6B;AACtC,SAAS,aAAAC,kBAAmC;AAC5C;AAAA,EACE,SAAAC;AAAA,EACA;AAAA,EACA,QAAAC;AAAA,EACA,WAAAC;AAAA,EACA,YAAAC;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,cAAAC,aAAY,QAAAC,OAAM,UAAU,SAAS,WAAW;;;ACZzD,SAAS,kBAAkB;AAC3B,SAAS,iBAAiB;AAC1B,SAAS,SAAAC,QAAO,MAAM,WAAAC,gBAAe;AACrC,SAAS,YAAY,QAAAC,aAAY;AACjC;AAAA,EACE;AAAA,EACA,2BAAAC;AAAA,EACA;AAAA,EACA;AAAA,OAMK;AASP;AAAA,EACE,wCAAAC;AAAA,EACA,2BAAAC;AAAA,EACA,2BAAAC;AAAA,EACA,mCAAAC;AAAA,OAOK;AAiBP,eAAsB,kCACpB,SACA,cACA,SACA,wBAC0C;AAC1C,QAAM,SAAS;AACf,QAAM,OAAO,kCAAkC;AAC/C,QAAM,OAAO,wBAAwB,MAAM;AAC3C,MACE,QAAQ,aAAa,WACrB,CAAC,QACD,CAAC,0BACD,QAAQ,aAAa,gBACrB;AACA,WAAO,MAAM,gCAAgC,SAAS,cAAc,OAAO;AAAA,EAC7E;AACA,SAAO,MAAM;AAAA,IACX;AAAA,IACA,YAAY;AACV,YAAM,EAAE,OAAO,UAAU,IAAI,MAAM;AAAA,QACjC;AAAA,QACA,6BAA6B,MAAM;AAAA,QACnC,OAAO;AAAA,QACP,QAAQ;AAAA,MACV;AACA,aAAO;AAAA,QACL,MAAM;AAAA,QACN;AAAA,QACA,YAAY;AAAA,UACV,SAAS;AAAA,UACT,UAAU,OAAO,OAAO,YAAY,EAAE,SAAS,IAAI,GAAG,CAAC,IAAI,MAAM,MAAM;AAAA,UACvE,eAAe,MAAM;AAAA,UACrB,cAAc,MAAM;AAAA,UACpB,YAAY,IAAI,KAAK,YAAY,EAAE,YAAY;AAAA,UAC/C;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,EACV;AACF;AAEA,eAAsB,wBACpB,SACe;AACf,MAAI,SAAS,SAAS,aAAc,OAAM,QAAQ,MAAM,QAAQ;AAClE;AAmBO,IAAM,iCAAN,cAA6C,MAAM;AAAA,EAIxD,YACkB,MAChB,SACA,UAAoD,CAAC,GACrD;AACA,UAAM,SAAS,QAAQ,UAAU,SAAY,SAAY,EAAE,OAAO,QAAQ,MAAM,CAAC;AAJjE;AAKhB,SAAK,YAAY,QAAQ,aAAa;AAAA,EACxC;AAAA,EAVS,OAAO;AAAA,EACP;AAUX;AAkDA,SAAS,OAAO,OAA2B;AACzC,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACxD;AAEA,SAAS,mBAAmB,OAAkC;AAC5D,MAAI,MAAM,WAAW,KAAK,MAAM,SAAS,MAAM,KAAK,CAAC,yBAAyB,KAAK,KAAK,GAAG;AACzF,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,WAAW,KAAK,OAAO,KAAK,OAAO,QAAQ,CAAC;AAC1D,SAAO,OAAO,KAAK,KAAK,EAAE,SAAS,QAAQ,MAAM,QAAQ,QAAQ;AACnE;AAEO,SAAS,8BACd,OACA,eAAe,KAAK,IAAI,GACS;AACjC,QAAM,SAASF,yBAAwB,KAAK;AAC5C,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,gBAAgB,OAAO,KAAK;AAClC,SAAO;AAAA,IACL,SAAS;AAAA,IACT,MAAM;AAAA,IACN,UAAU,OAAO,OAAO,YAAY,EAAE,SAAS,IAAI,GAAG,CAAC,IAAI,aAAa;AAAA,IACxE;AAAA,IACA,cAAc,MAAM;AAAA,IACpB,YAAY,IAAI,KAAK,YAAY,EAAE,YAAY;AAAA,IAC/C,UAAU,OAAO;AAAA,IACjB,YAAY,OAAO;AAAA,IACnB,GAAI,OAAO,uBAAuB,EAAE,sBAAsB,OAAO,qBAAqB,IAAI,CAAC;AAAA,EAC7F;AACF;AAEO,SAAS,oCACdG,SACA,eAAe,KAAK,IAAI,GACgD;AACxE,MAAI,OAAOA,YAAW,SAAU,QAAO;AACvC,QAAM,QAAQ,mBAAmBA,OAAM;AACvC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,aAAa,8BAA8B,OAAO,YAAY;AACpE,SAAO,aAAa,EAAE,eAAeA,SAAQ,WAAW,IAAI;AAC9D;AAEO,SAAS,6BACdA,SACA,UACiC;AACjC,MAAIA,YAAW,UAAaA,YAAW,QAAQA,YAAW,GAAI,QAAO;AACrE,MAAI,OAAOA,YAAW,UAAU;AAC9B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,aAAa,UAAa,aAAa,MAAM;AAC/C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,aAAa,gCAAgC,QAAQ;AAC3D,MAAI,CAAC,YAAY;AACf,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAQ,mBAAmBA,OAAM;AACvC,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR;AAAA,MACA,8BAA8B,WAAW,QAAQ;AAAA,IACnD;AAAA,EACF;AACA,QAAM,aAAa,OAAO,KAAK;AAC/B,MAAI,MAAM,WAAW,WAAW,gBAAgB,eAAe,WAAW,eAAe;AACvF,UAAM,IAAI;AAAA,MACR;AAAA,MACA,8BAA8B,WAAW,QAAQ;AAAA,IACnD;AAAA,EACF;AACA,QAAM,iBAAiBH,yBAAwB,KAAK;AACpD,MAAI,WAAW,YAAY,sCAAsC;AAC/D,QACE,CAAC,kBACD,eAAe,aAAa,WAAW,YACvC,eAAe,eAAe,WAAW,cACzC,eAAe,yBAAyB,WAAW,sBACnD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA,8DAA8D,WAAW,QAAQ;AAAA,MACnF;AAAA,IACF;AAAA,EACF,WAAW,gBAAgB;AACzB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,kCAAkC,WAAW,QAAQ;AAAA,IACvD;AAAA,EACF;AACA,SAAO;AAAA,IACL;AAAA,IACA,QAAAG;AAAA,IACA;AAAA,IACA,MAAM,WAAW,YAAY,uCAAuC,sBAAsB;AAAA,IAC1F,GAAI,WAAW,YAAY,wCAAwC,iBAC/D,EAAE,eAAe,IACjB,CAAC;AAAA,EACP;AACF;AAIA,eAAsB,iCACpB,cACA,gBACkC;AAClC,QAAM,MAAM,+BAA+B,aAAa,mBAAmB;AAC3E,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,SAAS,MAAM,eAAe,IAAI,GAAG;AAC3C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,MACA,4BAA4B,IAAI,GAAG;AAAA,IACrC;AAAA,EACF;AACA,QAAM,aAAa,OAAO,OAAO,KAAK;AACtC,MAAI,OAAO,MAAM,WAAW,IAAI,SAAS,eAAe,IAAI,QAAQ;AAClE,UAAM,IAAI;AAAA,MACR;AAAA,MACA,4BAA4B,IAAI,GAAG;AAAA,IACrC;AAAA,EACF;AACA,QAAMA,UAAS,OAAO,KAAK,OAAO,KAAK,EAAE,SAAS,QAAQ;AAC1D,QAAM,SAAS,aAAa;AAC5B,MAAI,OAAO,WAAW,YAAY,OAAO,SAAS,KAAK,WAAWA,SAAQ;AACxE,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,+BAA6BA,SAAQ,aAAa,oBAAoB;AACtE,SAAO,EAAE,GAAG,cAAc,kBAAkBA,QAAO;AACrD;AAEA,SAAS,qBAAqB,OAAwB;AACpD,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,YAAY,qBAAqB,KAAK,KAAK;AACjD,WAAO,YAAY,MAAM,MAAM,UAAU,QAAQ,UAAU,CAAC,EAAE,MAAM,IAAI;AAAA,EAC1E;AACA,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,SAAS;AACf,SAAO,OAAO,OAAO,WAAW,WAC5B,OAAO,SACP,OAAO,OAAO,WAAW,WACvB,OAAO,SACP;AACR;AAEA,SAAS,sBAAsB,OAAwB;AACrD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,SAAS;AAKf,QAAMC,UACJ,OAAO,OAAO,aAAa,WACvB,YAAY,OAAO,QAAQ,KAC3B,OAAO,OAAO,WAAW,WACvB,UAAU,OAAO,MAAM,KACvB;AACR,QAAM,SACJ,OAAO,OAAO,WAAW,WACrB,OAAO,OAAO,QAAQ,QAAQ,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,GAAG,IACtD;AACN,SAAO,OAAO,SAAS,IAAI,GAAGA,OAAM,YAAY,MAAM,KAAKA;AAC7D;AAEA,SAAS,wCAAwC,OAAyB;AACxE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,SAAS;AAKf,QAAM,WACJ,OAAO,OAAO,aAAa,WACvB,OAAO,WACP,OAAO,OAAO,WAAW,WACvB,OAAO,SACP;AACR,MAAI,aAAa,KAAK,OAAO,OAAO,WAAW,SAAU,QAAO;AAChE,SAAO,OAAO,OACX,MAAM,OAAO,EACb,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,KAAK,CAAC,SAAS,SAAS,oCAAoC;AACjE;AAEA,SAASC,YAAW,OAAuB;AACzC,SAAO,IAAI,MAAM,WAAW,KAAK,OAAO,CAAC;AAC3C;AAEA,SAAS,6BAA6B,SAAqC;AACzE,SAAO,CAAC,GAAI,QAAQ,OAAO,UAAU,4BAA4B,KAAK,CAAC,CAAE,EACtE,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,SAAS,CAAC,EAC5E,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC;AACpD;AAIO,SAAS,8BAA8B,SAA4B;AACxE,SAAO,6BAA6B,OAA2B;AACjE;AAEA,SAAS,oBAAoB,eAA0C;AACrE,QAAM,eAAe,cAAc,QAAQ,CAAC,SAAS;AAAA,IACnD,SAASA,YAAW,KAAK,IAAI,EAAE,CAAC;AAAA,IAChC,SAASA,YAAW,KAAK,IAAI,IAAI,CAAC;AAAA,EACpC,CAAC;AACD,SAAO,aAAa,WAAW,IAAI,KAAK,OAAO,aAAa,KAAK,MAAM,CAAC;AAC1E;AAEA,SAAS,4BAA4B,eAA0C;AAC7E,QAAM,cAAc,cAAc,QAAQ,CAAC,SAAS;AAAA,IAClDA,YAAW,aAAa,IAAI,EAAE;AAAA,IAC9BA,YAAW,eAAe,IAAI,EAAE;AAAA,EAClC,CAAC;AACD,QAAM,aAAa,oBAAoB,aAAa;AACpD,QAAM,SAAS,OAAO;AAAA;AAAA,wBAEA,YAAY,KAAK,GAAG,CAAC;AAAA,qCACR,UAAU;AAAA,uBACxB,UAAU;AAAA,uBACV,UAAU;AAAA;AAE/B,SAAO,uBAAuBA,YAAW,MAAM,CAAC;AAClD;AAEA,IAAM,+BAA+B;AACrC,IAAM,8BAA8B,UAAU,WAAW,UAAU;AAEnE,SAAS,wBAAwB,SAA0C;AACzE,QAAM,OAAO,QAAQ,OAAO;AAC5B,SAAO,OAAO,SAAS,YAAY,WAAW,IAAI,IAAI,OAAO;AAC/D;AAEA,SAAS,uBACP,MACA,OACA,OACM;AACN,OAAK,OAAO,KAAK;AACjB,OAAK,OAAO,IAAI;AAChB,OAAK,OAAO,OAAO,OAAO,WAAW,KAAK,CAAC,CAAC;AAC5C,OAAK,OAAO,IAAI;AAChB,OAAK,OAAO,KAAK;AACjB,OAAK,OAAO,IAAI;AAClB;AAEA,SAAS,yBAAyB,MAAc,OAAuB;AACrE,SAAO,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI;AAChD;AAEA,SAAS,8BACP,gBACA,WAC0B;AAC1B,QAAM,cAAc,CAAC,GAAG,cAAc,EAAE,KAAK,wBAAwB;AACrE,QAAM,QAAQ,CAAC,GAAG,SAAS,EAAE;AAAA,IAAK,CAAC,MAAM,UACvC,yBAAyB,KAAK,MAAM,MAAM,IAAI;AAAA,EAChD;AACA,QAAM,QAAQ,oBAAI,IAAY;AAC9B,QAAM,OAAO,WAAW,QAAQ;AAChC,yBAAuB,MAAM,cAAc,4BAA4B;AACvE,aAAW,aAAa,aAAa;AACnC,QAAI,MAAM,IAAI,SAAS,GAAG;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,EAAE,WAAW,KAAK;AAAA,MACpB;AAAA,IACF;AACA,UAAM,IAAI,SAAS;AACnB,2BAAuB,MAAM,OAAO,SAAS;AAAA,EAC/C;AACA,MAAI,iBAAiB;AACrB,aAAW,QAAQ,OAAO;AACxB,QAAI,MAAM,IAAI,KAAK,IAAI,GAAG;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,EAAE,WAAW,KAAK;AAAA,MACpB;AAAA,IACF;AACA,UAAM,IAAI,KAAK,IAAI;AACnB,sBAAkB,KAAK,QAAQ;AAC/B,QAAI,CAAC,OAAO,cAAc,cAAc,GAAG;AACzC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,2BAAuB,MAAM,QAAQ,KAAK,IAAI;AAC9C,2BAAuB,MAAM,SAAS,OAAO,KAAK,QAAQ,UAAU,CAAC;AACrE,SAAK,OAAO,KAAK,OAAO;AAAA,EAC1B;AACA,SAAO;AAAA,IACL,WAAW;AAAA,IACX,QAAQ,KAAK,OAAO,KAAK;AAAA,IACzB,YAAY,YAAY,SAAS,MAAM;AAAA,IACvC,WAAW,MAAM;AAAA,IACjB;AAAA,IACA,YAAY;AAAA,EACd;AACF;AAEA,SAAS,eAAe,OAAiC;AACvD,SACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,CAAC,MAAM,WAAW,GAAG,KACrB,CAAC,MAAM,SAAS,IAAI,KACpB,MAAM,MAAM,GAAG,EAAE,MAAM,CAAC,YAAY,QAAQ,SAAS,KAAK,YAAY,OAAO,YAAY,IAAI;AAEjG;AAEA,SAAS,qBAAqB,OAAmC;AAC/D,MAAI,UAAU,GAAI,QAAO,IAAI,WAAW;AACxC,SAAO,OAAO,UAAU,WAAW,mBAAmB,KAAK,IAAI;AACjE;AAKA,SAAS,2BAA2B,OAA6C;AAC/E,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;AAAA,EAC9E,QAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,EAAE,WAAW,KAAK;AAAA,IACpB;AAAA,EACF;AACA,MAAI,CAAC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAAG;AACrE,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,EAAE,WAAW,KAAK;AAAA,IACpB;AAAA,EACF;AACA,QAAM,UAAU;AAKhB,MACE,QAAQ,YAAY,KACpB,CAAC,MAAM,QAAQ,QAAQ,WAAW,KAClC,CAAC,QAAQ,YAAY,MAAM,cAAc,KACzC,CAAC,MAAM,QAAQ,QAAQ,KAAK,GAC5B;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,EAAE,WAAW,KAAK;AAAA,IACpB;AAAA,EACF;AACA,QAAM,QAA+B,CAAC;AACtC,aAAW,aAAa,QAAQ,OAAO;AACrC,QAAI,CAAC,aAAa,OAAO,cAAc,YAAY,MAAM,QAAQ,SAAS,GAAG;AAC3E,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,EAAE,WAAW,KAAK;AAAA,MACpB;AAAA,IACF;AACA,UAAM,OAAO;AACb,UAAM,UAAU,qBAAqB,KAAK,IAAI;AAC9C,QAAI,CAAC,eAAe,KAAK,IAAI,KAAK,CAAC,SAAS;AAC1C,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,EAAE,WAAW,KAAK;AAAA,MACpB;AAAA,IACF;AACA,UAAM,KAAK,EAAE,MAAM,KAAK,MAAM,QAAQ,CAAC;AAAA,EACzC;AACA,SAAO,8BAA8B,QAAQ,aAAa,KAAK;AACjE;AAEA,SAAS,oBACP,MACA,OACS;AACT,SAAO,KAAK,QAAQ,MAAM,OAAO,KAAK,QAAQ,MAAM;AACtD;AAEA,SAAS,kBAAkD;AACzD,SAAO,IAAI;AAAA,IACT;AAAA,IACA;AAAA,IACA,EAAE,WAAW,KAAK;AAAA,EACpB;AACF;AAEA,eAAe,mBACb,MACA,UACiB;AACjB,QAAM,SAAS,MAAMC,OAAM,IAAI,EAAE,MAAM,MAAM;AAC3C,UAAM,gBAAgB;AAAA,EACxB,CAAC;AACD,MAAI,CAAC,OAAO,OAAO,KAAK,CAAC,oBAAoB,QAAQ,QAAQ,GAAG;AAC9D,UAAM,gBAAgB;AAAA,EACxB;AACA,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,KAAK,MAAM,2BAA2B;AAAA,EACvD,QAAQ;AACN,UAAM,gBAAgB;AAAA,EACxB;AACA,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,KAAK;AACjC,QAAI,CAAC,OAAO,OAAO,KAAK,CAAC,oBAAoB,QAAQ,MAAM,GAAG;AAC5D,YAAM,gBAAgB;AAAA,IACxB;AACA,UAAM,UAAU,MAAM,OAAO,SAAS;AACtC,UAAM,QAAQ,MAAM,OAAO,KAAK;AAChC,QACE,CAAC,MAAM,OAAO,KACd,CAAC,oBAAoB,OAAO,MAAM,KAClC,MAAM,SAAS,OAAO,QACtB,MAAM,YAAY,OAAO,WACzB,MAAM,YAAY,OAAO,SACzB;AACA,YAAM,gBAAgB;AAAA,IACxB;AACA,WAAO;AAAA,EACT,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAEA,SAAS,0BAA0B,MAAc,eAA6C;AAC5F,aAAW,YAAY,eAAe;AACpC,QAAI,aAAa,MAAM,SAAS,YAAY,KAAK,WAAW,GAAG,QAAQ,GAAG,EAAG,QAAO;AAAA,EACtF;AACA,SAAO;AACT;AAOA,eAAe,+BACb,MACA,eACmC;AACnC,QAAM,WAAW,IAAI,IAAI,aAAa;AACtC,QAAM,cAAwB,CAAC;AAC/B,QAAM,QAA+B,CAAC;AAEtC,QAAM,OAAO,OACX,aACA,eAAe,IACf,aACkB;AAClB,UAAM,SAAS,MAAMA,OAAM,WAAW,EAAE,MAAM,MAAM;AAClD,YAAM,gBAAgB;AAAA,IACxB,CAAC;AACD,QAAI,CAAC,OAAO,YAAY,KAAM,YAAY,CAAC,oBAAoB,QAAQ,QAAQ,GAAI;AACjF,YAAM,gBAAgB;AAAA,IACxB;AACA,UAAM,UAAU,MAAMC,SAAQ,aAAa,EAAE,eAAe,KAAK,CAAC;AAClE,UAAM,YAAY,MAAMD,OAAM,WAAW,EAAE,MAAM,MAAM;AACrD,YAAM,gBAAgB;AAAA,IACxB,CAAC;AACD,QAAI,CAAC,UAAU,YAAY,KAAK,CAAC,oBAAoB,WAAW,MAAM,GAAG;AACvE,YAAM,gBAAgB;AAAA,IACxB;AACA,YAAQ,KAAK,CAAC,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;AACjE,eAAW,SAAS,SAAS;AAC3B,YAAM,eAAe,eAAe,GAAG,YAAY,IAAI,MAAM,IAAI,KAAK,MAAM;AAC5E,UAAI,0BAA0B,cAAc,QAAQ,EAAG;AACvD,YAAM,YAAYE,MAAK,aAAa,MAAM,IAAI;AAC9C,YAAM,QAAQ,MAAMF,OAAM,SAAS,EAAE,MAAM,MAAM;AAC/C,cAAM,gBAAgB;AAAA,MACxB,CAAC;AACD,UAAI,MAAM,YAAY,GAAG;AACvB,oBAAY,KAAK,YAAY;AAC7B,cAAM,KAAK,WAAW,cAAc,KAAK;AACzC;AAAA,MACF;AAIA,UAAI,CAAC,MAAM,OAAO,EAAG;AACrB,YAAM,UAAU,MAAM,mBAAmB,WAAW,KAAK;AACzD,YAAM,KAAK,EAAE,MAAM,cAAc,QAAQ,CAAC;AAAA,IAC5C;AACA,UAAM,YAAY,MAAMA,OAAM,WAAW,EAAE,MAAM,MAAM;AACrD,YAAM,gBAAgB;AAAA,IACxB,CAAC;AACD,QAAI,CAAC,UAAU,YAAY,KAAK,CAAC,oBAAoB,WAAW,MAAM,GAAG;AACvE,YAAM,gBAAgB;AAAA,IACxB;AAAA,EACF;AAEA,QAAM,KAAK,IAAI;AACf,SAAO,8BAA8B,aAAa,KAAK;AACzD;AAEA,eAAe,2BACb,QACmC;AACnC,QAAMG,OAAM,OAAO,QAAQ,OAAO;AAClC,MAAI,CAACA,MAAK;AACR,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAM,4BAA4B,6BAA6B,MAAM,CAAC;AAC5E,MAAI;AACJ,MAAI,QAAiC;AACrC,WAAS,UAAU,GAAG,WAAW,GAAG,WAAW,GAAG;AAChD,aAAS,MAAMA,KAAI,KAAK,QAAQ;AAAA,MAC9B;AAAA,MACA,aAAa;AAAA,MACb,iBAAiB;AAAA,IACnB,CAAC;AACD,YAAQ,qBAAqB,MAAM,EAChC,KAAK,EACL,MAAM,+EAA+E;AACxF,QAAI,SAAS,CAAC,wCAAwC,MAAM,KAAK,YAAY,EAAG;AAChF,UAAM,IAAI,QAAQ,CAACC,aAAY,WAAWA,UAAS,UAAU,EAAE,CAAC;AAAA,EAClE;AACA,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iEAAiE,sBAAsB,MAAM,CAAC;AAAA,MAC9F,EAAE,WAAW,KAAK;AAAA,IACpB;AAAA,EACF;AACA,QAAM,aAAa,OAAO,MAAM,CAAC,CAAC;AAClC,QAAM,YAAY,OAAO,MAAM,CAAC,CAAC;AACjC,QAAM,iBAAiB,OAAO,MAAM,CAAC,CAAC;AACtC,MAAI,CAAC,CAAC,YAAY,WAAW,cAAc,EAAE,MAAM,OAAO,aAAa,GAAG;AACxE,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AAAA,IACL,WAAW;AAAA,IACX,QAAQ,MAAM,CAAC;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAsBO,SAAS,yBACd,SAC0B;AAC1B,QAAM,UAAoB,CAAC;AAC3B,MAAI,iBAAiB;AACrB,MAAI,YAAY;AAChB,MAAI,iBAAiB;AACrB,aAAW,SAAS,SAAS;AAC3B,QAAI,MAAM,SAAS,aAAa;AAC9B,wBAAkB;AAClB,cAAQ,KAAK,OAAO,KAAK,MAAM,MAAM,IAAI,EAAE,CAAC;AAAA,IAC9C,OAAO;AACL,mBAAa;AACb,wBAAkB,MAAM;AACxB,cAAQ,KAAK,OAAO,KAAK,GAAG,MAAM,MAAM,KAAK,MAAM,IAAI,EAAE,CAAC;AAAA,IAC5D;AAAA,EACF;AACA,UAAQ,KAAK,OAAO,OAAO;AAC3B,QAAM,OAAO,WAAW,QAAQ;AAChC,aAAW,UAAU,QAAS,MAAK,OAAO,MAAM,EAAE,OAAO,IAAI;AAC7D,SAAO,EAAE,QAAQ,KAAK,OAAO,KAAK,GAAG,gBAAgB,WAAW,eAAe;AACjF;AAEA,SAAS,cAAc,QAAkC;AACvD,QAAM,OAAO,OAAO,OAAO,UAAU;AACrC,SAAO,OAAO,SAAS,YAAY,WAAW,IAAI,IAAI,OAAO;AAC/D;AAEA,SAAS,gCAAgC,MAAc,eAA0C;AAC/F,QAAM,QAAQ,oBAAoB,aAAa;AAC/C,QAAM,SAAS,OAAO;AAAA,KACnBL,YAAW,IAAI,CAAC;AAAA,uCACkB,KAAK,uDAAuD,KAAK;AAAA,kCACtE,KAAK;AAAA,mCACJ,KAAK;AAAA,mCACL,KAAK;AAAA;AAEtC,SAAO,uBAAuBA,YAAW,MAAM,CAAC;AAClD;AAIA,eAAsB,mCACpB,SACmC;AACnC,QAAM,SAAS;AACf,QAAMI,OAAM,OAAO,QAAQ,OAAO;AAClC,MAAI,CAACA,MAAK;AACR,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,MAAMA,KAAI,KAAK,QAAQ;AAAA,IACpC,KAAK;AAAA,MACH,cAAc,MAAM;AAAA,MACpB,6BAA6B,MAAM;AAAA,IACrC;AAAA,IACA,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB,CAAC;AACD,QAAM,QAAQ,qBAAqB,MAAM,EACtC,KAAK,EACL,MAAM,4EAA4E;AACrF,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR;AAAA,MACA,6DAA6D,sBAAsB,MAAM,CAAC;AAAA,MAC1F,EAAE,WAAW,KAAK;AAAA,IACpB;AAAA,EACF;AACA,QAAM,iBAAiB,OAAO,MAAM,CAAC,CAAC;AACtC,QAAM,YAAY,OAAO,MAAM,CAAC,CAAC;AACjC,QAAM,iBAAiB,OAAO,MAAM,CAAC,CAAC;AACtC,MAAI,CAAC,CAAC,gBAAgB,WAAW,cAAc,EAAE,MAAM,OAAO,aAAa,GAAG;AAC5E,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,MAAM,CAAC,GAAI,gBAAgB,WAAW,eAAe;AACxE;AAGA,eAAsB,gCACpB,SACA,UACA,UACe;AACf,QAAM,SAAS,MAAM,mCAAmC,OAAO;AAC/D,MACE,OAAO,WAAW,SAAS,UAC3B,OAAO,mBAAmB,SAAS,kBACnC,OAAO,cAAc,SAAS,aAC9B,OAAO,mBAAmB,SAAS,gBACnC;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,+DAA+D,QAAQ;AAAA,IACzE;AAAA,EACF;AACF;AAMA,eAAsB,4BACpB,SACmC;AACnC,QAAM,SAAS;AACf,QAAM,OAAO,kCAAkC;AAC/C,QAAM,WAAW,wBAAwB,MAAM;AAC/C,SAAO,WACH,OAAO,gCAAgC,QAAQ,aAAa,UAC1D,MAAM;AAAA,IACJ;AAAA,IACA,6BAA6B,MAAM;AAAA,IACnC,OAAO;AAAA,EACT,IACA,MAAM,+BAA+B,UAAU,6BAA6B,MAAM,CAAC,IACrF,MAAM,2BAA2B,MAAM;AAC7C;AAEA,SAAS,kBAAkB,GAA6B,GAAsC;AAC5F,UACG,EAAE,cAAc,mBAAmB,EAAE,cAAc,iBACpD,EAAE,WAAW,EAAE,UACf,EAAE,eAAe,EAAE,cACnB,EAAE,cAAc,EAAE,aAClB,EAAE,mBAAmB,EAAE;AAE3B;AAMA,eAAsB,gCACpB,SACA,eAAe,KAAK,IAAI,GACxB,SACmC;AACnC,SAAO,MAAM;AAAA,IACX;AAAA,IACA,YAAY,MAAM,yCAAyC,SAAS,cAAc,OAAO;AAAA,IACzF,SAAS;AAAA,EACX;AACF;AAEA,eAAe,yCACb,SACA,cACA,SACmC;AACnC,QAAM,SAAS;AACf,QAAM,OAAO,kCAAkC;AAC/C,QAAM,cAAc,SAAS,aAAa;AAC1C,QAAM,UAAU,cAAc,OAAO,sBAAsB,OAAO;AAClE,MAAI,OAAO,YAAY,YAAY;AACjC,UAAM,IAAI;AAAA,MACR;AAAA,MACA,cACI,mGACA;AAAA,IACN;AAAA,EACF;AACA,QAAM,wBAAwB,OAAO,OAAO;AAC5C,QAAM,wBAAwB,6BAA6B,MAAM,EAAE,SAAS;AAC5E,QAAM,wBACJ,CAAC,eACD,OAAO,0BAA0B,YACjC,0BAA0B,SAC1B,CAAC;AACH,QAAM,SAAS,wBAAwB,OAAO,MAAM,4BAA4B,MAAM;AACtF,QAAM,QAAQ,cACV,MAAM,OAAO,oBAAqB,IAClC,MAAM,OAAO,iBAAkB,OAAO;AAC1C,MAAI,CAAC,SAAS,MAAM,WAAW,GAAG;AAChC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,EAAE,WAAW,KAAK;AAAA,IACpB;AAAA,EACF;AACA,QAAM,iBAAiBT,yBAAwB,KAAK;AACpD,MAAI,gBAAgB;AAClB,UAAMW,cAAa,8BAA8B,OAAO,YAAY;AACpE,WAAO;AAAA,MACL;AAAA,MACA,QAAQ,OAAO,KAAK,KAAK,EAAE,SAAS,QAAQ;AAAA,MAC5C,YAAAA;AAAA,MACA,MAAM;AAAA,MACN;AAAA,IACF;AAAA,EACF;AACA,MAAI,uBAAuB;AACzB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,0BAA0B,OAAO,qBAAqB,CAAC;AAAA,IACzD;AAAA,EACF;AACA,QAAM,QAAQ,MAAM,4BAA4B,MAAM;AACtD,QAAM,qBACJ,QAAQ,eAAe,+BAA+B,2BAA2B,KAAK,IAAI;AAC5F,MACE,CAAC,UACD,CAAC,kBAAkB,QAAQ,KAAK,KAC/B,uBAAuB,QAAQ,CAAC,kBAAkB,QAAQ,kBAAkB,GAC7E;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,EAAE,WAAW,KAAK;AAAA,IACpB;AAAA,EACF;AACA,QAAM,gBAAgB,OAAO,KAAK;AAClC,QAAM,aAA4C;AAAA,IAChD,SAAS;AAAA,IACT,UAAU,OAAO,OAAO,YAAY,EAAE,SAAS,IAAI,GAAG,CAAC,IAAI,aAAa;AAAA,IACxE;AAAA,IACA,cAAc,MAAM;AAAA,IACpB,YAAY,IAAI,KAAK,YAAY,EAAE,YAAY;AAAA,IAC/C,WAAW;AAAA,EACb;AACA,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,OAAO,KAAK,KAAK,EAAE,SAAS,QAAQ;AAAA,IAC5C;AAAA,IACA,MAAM;AAAA,EACR;AACF;AAEA,eAAsB,wBACpB,SACA,YAC0C;AAC1C,MAAI,WAAW,YAAY,sCAAsC;AAC/D,WAAO;AAAA,EACT;AACA,QAAM,SAAS;AAIf,QAAM,SACJ,WAAW,UAAU,eAAe,+BAChC,OAAO,MAAM;AACX,UAAM,OAAO,wBAAwB,MAAM;AAC3C,QAAI,CAAC,MAAM;AACT,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO,QAAQ,aAAa,UACxB,yBAAyB,MAAM,6BAA6B,MAAM,CAAC,IACnE,+BAA+B,MAAM,6BAA6B,MAAM,CAAC;AAAA,EAC/E,GAAG,IACH,MAAM,2BAA2B,MAAM;AAC7C,MAAI,CAAC,kBAAkB,QAAQ,WAAW,SAAS,GAAG;AACpD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,+DAA+D,WAAW,QAAQ;AAAA,IACpF;AAAA,EACF;AACA,SAAO;AACT;;;AD3+BA,IAAM,cAAc,KAAK;AAGzB,IAAM,sBAAsB;AAC5B,IAAM,aAAa;AACnB,IAAM,OAAOC,WAAU,WAAWA,WAAU,aAAaA,WAAU;AACnE,IAAM,iBAAiB,OAAOA,WAAU;AACxC,IAAM,SAASA,WAAU,WAAWA,WAAU,UAAUA,WAAU,SAASA,WAAU;AAcrF,SAAS,QAAQ,SAAwB;AACvC,QAAM,IAAI,+BAA+B,4BAA4B,OAAO;AAC9E;AAEA,SAAS,QAAQ,OAAwB;AACvC,QAAM,IAAI;AAAA,IACR;AAAA,IACA;AAAA,IACA,EAAE,WAAW,MAAM,MAAM;AAAA,EAC3B;AACF;AAEA,SAAS,aAAa,OAAuB;AAC3C,MAAI,iBAAiB,+BAAgC,OAAM;AAC3D,QAAM,OAAQ,OAAwC;AACtD,MAAI,SAAS,YAAY,SAAS,WAAW,SAAS,UAAW,QAAO,QAAQ,KAAK;AAGrF,QAAM;AACR;AAEA,SAAS,UAAU,SAA8C;AAC/D,QAAM,OAAO,QAAQ,cAAc;AACnC,MAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,KAAK,OAAO,aAAa;AACjE,UAAM,IAAI,WAAW,oCAAoC,WAAW,EAAE;AAAA,EACxE;AACA,SAAO;AACT;AAEA,SAAS,UAAU,SAAsC;AACvD,MAAI,QAAQ,iBAAiB,KAAM,QAAO;AAC1C,QAAM,WAAW;AAAA,IACf,eAAe,QAAQ;AAAA,IACvB,mBAAmB,IAAI,QAAQ;AAAA,IAC/B,YAAY;AAAA,EACd;AACA,QAAM,SAAS,EAAE,GAAG,UAAU,GAAG,QAAQ,cAAc;AACvD,aAAW,OAAO,OAAO,KAAK,QAAQ,GAAmC;AACvE,QAAI,OAAO,GAAG,MAAM,OAAW,QAAO,GAAG,IAAI,SAAS,GAAG;AACzD,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,SAAS,SAAS,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,IAAI;AAChE,YAAM,IAAI,WAAW,iBAAiB,GAAG,qBAAqB;AAAA,IAChE;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,WAAW,QAAgB,OAAkC,OAAe;AACnF,MAAI,CAAC,OAAO,cAAc,MAAM,EAAG,SAAQ,GAAG,KAAK,sCAAsC;AACzF,MAAI,SAAS,QAAQ,SAAS;AAC5B,YAAQ,qBAAqB,KAAK,2BAA2B;AACjE;AAEA,SAAS,UAAU,GAAgB,GAAgB;AACjD,SAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE;AAC5D;AAEA,SAAS,YAAY,GAAgB,GAAgB;AACnD,SAAO,UAAU,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE;AAC5F;AAEA,SAAS,OAAO,QAAoB,MAAe;AACjD,SAAO,SAAS,SAAY,iBAAiB,OAAO,EAAE,KAAK,iBAAiB,OAAO,EAAE,IAAI,IAAI;AAC/F;AAaA,SAAS,aAAa,OAA+C;AACnE,SAAO,OAAO,OAAO;AAAA,IACnB,KAAK,OAAO,MAAM,GAAG;AAAA,IACrB,KAAK,OAAO,MAAM,GAAG;AAAA,IACrB,KAAK,OAAO,MAAM,GAAG;AAAA,IACrB,KAAK,OAAO,MAAM,GAAG;AAAA,IACrB,MAAM,OAAO,MAAM,IAAI;AAAA,EACzB,CAAC;AACH;AAEA,eAAe,SACb,MACA,SAAS,OACT,UACqB;AACrB,MAAI,QAAQ,aAAa;AACvB,YAAQ,yEAAyE;AACnF,MAAI,CAACC,YAAW,IAAI,EAAG,SAAQ,sCAAsC;AACrE,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,UAAU,aAAa,IAAK,SAAQ,yCAAyC;AACjF,MAAI,UAAU,MAAMC,MAAK,KAAK,cAAc;AAC5C,MAAI;AACF,eAAW,WAAW,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO,GAAG;AACzD,UAAI,QAAQ;AACV,cAAM,MAAM,OAAO,SAAS,OAAO,GAAG,EAAE,MAAM,IAAM,CAAC,EAAE;AAAA,UACrD,CAAC,UAAiC;AAChC,gBAAI,MAAM,SAAS,SAAU,OAAM;AAAA,UACrC;AAAA,QACF;AAAA,MACF;AACA,YAAM,OAAO,MAAMA,MAAK,OAAO,SAAS,OAAO,GAAG,cAAc;AAChE,YAAM,QAAQ,MAAM;AACpB,gBAAU;AAAA,IACZ;AACA,QAAI,UAAU;AACZ,YAAM,SAAS,aAAa,MAAM,QAAQ,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC;AAChE,UACE,OAAO,KAAK,MAAM,EAAE;AAAA,QAClB,CAAC,QACC,OAAO,GAAsC,MAC7C,SAAS,GAAsC;AAAA,MACnD;AAEA,gBAAQ,uCAAuC;AAAA,IACnD;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,QAAQ,MAAM;AACpB,UAAM;AAAA,EACR;AACF;AAIA,eAAsB,8BACpB,MACA,UACoC;AACpC,MAAI,QAAQ,aAAa,SAAS;AAChC,QAAI,CAACD,YAAW,IAAI,KAAK,QAAQ,IAAI,MAAM,QAAS,MAAME,UAAS,IAAI,MAAO;AAC5E,cAAQ,uCAAuC;AACjD,UAAMC,UAAS,MAAMF,MAAK,MAAM,cAAc;AAC9C,QAAI;AACF,YAAM,QAAQ,MAAME,QAAO,KAAK,EAAE,QAAQ,KAAK,CAAC;AAChD,UAAI,CAAC,MAAM,YAAY,EAAG,SAAQ,yCAAyC;AAC3E,YAAM,SAAS,aAAa,KAAK;AACjC,UACE,YACA,OAAO,KAAK,MAAM,EAAE;AAAA,QAClB,CAAC,QACC,OAAO,GAAsC,MAC7C,SAAS,GAAsC;AAAA,MACnD;AAEA,gBAAQ,uCAAuC;AACjD,aAAO;AAAA,IACT,UAAE;AACA,YAAMA,QAAO,MAAM;AAAA,IACrB;AAAA,EACF;AACA,QAAM,SAAS,MAAM,SAAS,MAAM,OAAO,QAAQ;AACnD,MAAI;AACF,WAAO,aAAa,MAAM,OAAO,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC;AAAA,EACzD,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAOA,IAAM,UAAU,CAAC,GAAW,MAAe,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI;AAEpE,eAAe,UACb,MACA,eACA,QACoB;AACpB,QAAM,OAAkB,EAAE,aAAa,oBAAI,IAAI,GAAG,OAAO,oBAAI,IAAI,EAAE;AACnE,QAAM,OAAO,OAAO,QAAoB,YAAoB;AAC1D,UAAM,SAAS,MAAM,OAAO,KAAK,EAAE,QAAQ,KAAK,CAAC;AACjD,SAAK,YAAY,IAAI,SAAS,MAAM;AACpC,UAAM,QAAQ,MAAMC,SAAQ,OAAO,MAAM,CAAC;AAC1C,eAAW,QAAQ,OAAO;AACxB,cAAQ,eAAe;AACvB,YAAM,OAAO,UAAU,GAAG,OAAO,IAAI,IAAI,KAAK;AAC9C,UACE,cAAc;AAAA,QACZ,CAAC,aAAa,aAAa,MAAM,SAAS,YAAY,KAAK,WAAW,GAAG,QAAQ,GAAG;AAAA,MACtF;AAEA;AACF,YAAM,QAAQ,MAAMC,OAAM,OAAO,QAAQ,IAAI,GAAG,EAAE,QAAQ,KAAK,CAAC;AAChE,UAAI,MAAM,YAAY,GAAG;AACvB,cAAM,QAAQ,MAAMJ,MAAK,OAAO,QAAQ,IAAI,GAAG,cAAc;AAC7D,YAAI;AACF,cAAI,CAAC,YAAY,OAAO,MAAM,MAAM,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC,EAAG,SAAQ;AACrE,gBAAM,KAAK,OAAO,IAAI;AACtB,cAAI,CAAC,YAAY,OAAO,MAAMI,OAAM,OAAO,QAAQ,IAAI,GAAG,EAAE,QAAQ,KAAK,CAAC,CAAC,EAAG,SAAQ;AAAA,QACxF,UAAE;AACA,gBAAM,MAAM,MAAM;AAAA,QACpB;AAAA,MACF,WAAW,MAAM,OAAO,GAAG;AACzB,aAAK,MAAM,IAAI,MAAM,KAAK;AAAA,MAC5B;AAAA,IAEF;AACA,QAAI,CAAC,YAAY,QAAQ,MAAM,OAAO,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC,EAAG,SAAQ;AAAA,EACzE;AACA,QAAM,KAAK,MAAM,EAAE;AACnB,SAAO;AACT;AAEA,eAAe,cAAc,MAAkB,SAAiB,MAAkB,SAAS,OAAO;AAChG,MAAI,UAAU,MAAMJ,MAAK,OAAO,IAAI,GAAG,iBAAiB,CAACF,WAAU,UAAU;AAC7E,MAAI;AACF,QAAI,QAAQ,CAAC,YAAY,KAAK,YAAY,IAAI,EAAE,GAAI,MAAM,QAAQ,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC;AACtF,cAAQ;AACV,QAAI,OAAO;AACX,eAAW,WAAW,QAAQ,MAAM,GAAG,EAAE,OAAO,OAAO,GAAG;AACxD,aAAO,OAAO,GAAG,IAAI,IAAI,OAAO,KAAK;AACrC,UAAI,QAAQ;AACV,cAAM,MAAM,OAAO,SAAS,OAAO,GAAG,EAAE,MAAM,IAAM,CAAC,EAAE;AAAA,UACrD,CAAC,UAAiC;AAChC,gBAAI,MAAM,SAAS,SAAU,OAAM;AAAA,UACrC;AAAA,QACF;AAAA,MACF;AACA,YAAM,OAAO,MAAME,MAAK,OAAO,SAAS,OAAO,GAAG,cAAc;AAChE,YAAM,QAAQ,MAAM;AACpB,gBAAU;AACV,UAAI,MAAM;AACR,cAAM,WAAW,KAAK,YAAY,IAAI,IAAI;AAC1C,YAAI,CAAC,YAAY,CAAC,YAAY,UAAU,MAAM,QAAQ,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC,EAAG,SAAQ;AAAA,MACzF;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,QAAQ,MAAM;AACpB,UAAM;AAAA,EACR;AACF;AAEA,SAAS,cAAc,MAAgC;AACrD,QAAM,QAAQ,KAAK,YAAY,GAAG;AAClC,SAAO,QAAQ,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,MAAM,GAAG,KAAK,GAAG,KAAK,MAAM,QAAQ,CAAC,CAAC;AAC9E;AAEA,eAAe,aACb,MACA,MACA,MACA,SACA,QACA;AACA,QAAM,CAAC,QAAQ,IAAI,IAAI,cAAc,IAAI;AACzC,QAAM,YAAY,MAAM,cAAc,MAAM,QAAQ,IAAI;AACxD,MAAI;AACF,UAAM,WAAW,KAAK,MAAM,IAAI,IAAI;AACpC,UAAM,SAAS,MAAMA,MAAK,OAAO,WAAW,IAAI,GAAG,IAAI;AACvD,QAAI;AACF,UAAI,CAAC,YAAY,UAAU,MAAM,OAAO,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC,EAAG,SAAQ;AACzE,YAAM,OAAO,OAAO,SAAS,IAAI;AACjC,iBAAW,MAAM,MAAM,WAAW;AAClC,YAAM,SAAS,OAAO,YAAY,WAAW;AAC7C,UAAI,SAAS;AACb,aAAO,SAAS,MAAM;AACpB,gBAAQ,eAAe;AACvB,cAAM,EAAE,UAAU,IAAI,MAAM,OAAO;AAAA,UACjC;AAAA,UACA;AAAA,UACA,KAAK,IAAI,OAAO,QAAQ,OAAO,MAAM;AAAA,UACrC;AAAA,QACF;AACA,YAAI,cAAc,EAAG,SAAQ;AAC7B,cAAM,QAAQ,OAAO,SAAS,GAAG,SAAS,CAAC;AAC3C,kBAAU;AAAA,MACZ;AACA,UACE,CAAC,YAAY,UAAU,MAAM,OAAO,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC,KAC1D,CAAC,YAAY,UAAU,MAAMI,OAAM,OAAO,WAAW,IAAI,GAAG,EAAE,QAAQ,KAAK,CAAC,CAAC;AAE7E,gBAAQ;AAAA,IACZ,UAAE;AACA,YAAM,OAAO,MAAM;AAAA,IACrB;AAAA,EACF,UAAE;AACA,UAAM,UAAU,MAAM;AAAA,EACxB;AACF;AAEA,SAAS,MAAM,MAAY,OAAe,OAAe;AACvD,OACG,OAAO,KAAK,EACZ,OAAO,IAAI,EACX,OAAO,OAAO,OAAO,WAAW,KAAK,CAAC,CAAC,EACvC,OAAO,IAAI,EACX,OAAO,KAAK,EACZ,OAAO,IAAI;AAChB;AAEA,SAAS,WAAW,aAAgC;AAClD,QAAM,OAAOC,YAAW,QAAQ;AAChC,QAAM,MAAM,cAAc,UAAU;AACpC,aAAW,QAAQ,CAAC,GAAG,WAAW,EAAE,KAAK,OAAO,EAAG,OAAM,MAAM,OAAO,IAAI;AAC1E,SAAO;AACT;AAEA,SAAS,YACP,MACA,aACA,OACA,gBAC0B;AAC1B,aAAW,gBAAgB,MAAM,gBAAgB;AACjD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,QAAQ,KAAK,OAAO,KAAK;AAAA,IACzB,YAAY,cAAc;AAAA,IAC1B,WAAW;AAAA,IACX;AAAA,IACA,YAAY;AAAA,EACd;AACF;AAEA,eAAe,gBACb,UACA,MACA,MACA,QACA;AACA,QAAM,QAAQ,MAAM,SAAS,QAAQ;AACrC,MAAI;AACF,QAAI,CAAC,YAAY,KAAK,YAAY,IAAI,EAAE,GAAI,MAAM,MAAM,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC,EAAG,SAAQ;AAAA,EAC3F,UAAE;AACA,UAAM,MAAM,MAAM;AAAA,EACpB;AACA,aAAW,QAAQ,KAAK,YAAY,KAAK,GAAG;AAC1C,YAAQ,eAAe;AACvB,UAAM,SAAS,MAAM,cAAc,MAAM,MAAM,IAAI;AACnD,UAAM,OAAO,MAAM;AAAA,EACrB;AACA,aAAW,CAAC,MAAM,QAAQ,KAAK,KAAK,OAAO;AACzC,YAAQ,eAAe;AACvB,UAAM,CAAC,QAAQ,IAAI,IAAI,cAAc,IAAI;AACzC,UAAM,SAAS,MAAM,cAAc,MAAM,QAAQ,IAAI;AACrD,QAAI;AACF,UAAI,CAAC,YAAY,UAAU,MAAMD,OAAM,OAAO,QAAQ,IAAI,GAAG,EAAE,QAAQ,KAAK,CAAC,CAAC,EAAG,SAAQ;AAAA,IAC3F,UAAE;AACA,YAAM,OAAO,MAAM;AAAA,IACrB;AAAA,EACF;AACF;AAEA,eAAe,SAAS,UAAkB,MAAkB,MAAiB,QAAsB;AACjG,QAAM,cAAc,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,EAAE,OAAO,OAAO;AAC/D,QAAM,OAAO,WAAW,WAAW;AACnC,MAAI,QAAQ;AACZ,aAAW,QAAQ,CAAC,GAAG,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK,OAAO,GAAG;AACvD,UAAM,OAAO,OAAO,KAAK,MAAM,IAAI,IAAI,EAAG,IAAI;AAC9C,UAAM,MAAM,QAAQ,IAAI;AACxB,UAAM,MAAM,SAAS,OAAO,IAAI,CAAC;AACjC,YAAQ,eAAe;AACvB,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA,CAAC,UAAU;AACT,aAAK,OAAO,KAAK;AAAA,MACnB;AAAA,MACA;AAAA,IACF;AACA,aAAS;AAAA,EACX;AACA,QAAM,gBAAgB,UAAU,MAAM,MAAM,MAAM;AAClD,SAAO,YAAY,MAAM,YAAY,QAAQ,KAAK,MAAM,MAAM,KAAK;AACrE;AAEA,eAAsB,yBACpB,MACA,eACA,cACmC;AACnC,QAAM,SAAS,MAAM,SAAS,MAAM,OAAO,YAAY;AACvD,MAAI;AACF,WAAO,MAAM,SAAS,MAAM,QAAQ,MAAM,UAAU,QAAQ,aAAa,CAAC;AAAA,EAC5E,SAAS,OAAO;AACd,WAAO,aAAa,KAAK;AAAA,EAC3B,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAEA,SAAS,OAAO,MAAc,WAAmB;AAC/C,QAAM,OAAO,SAAS,MAAM,SAAS;AACrC,SAAO,SAAS,MAAO,CAACL,YAAW,IAAI,KAAK,SAAS,QAAQ,CAAC,KAAK,WAAW,KAAK,GAAG,EAAE;AAC1F;AAEA,eAAe,0BAA0B,MAAqB;AAG5D,QAAM,aAAa,SAAS,OAAO,OAAO,MAAME,UAAS,IAAI,EAAE,MAAM,MAAM,QAAQ,IAAI,CAAC;AAGxF,QAAM,iDAAiD;AACvD,aAAW,aAAa,0BAA0B,GAAG;AACnD,UAAM,OAAO,MAAMA,UAAS,SAAS,EAAE,MAAM,MAAM,IAAI;AACvD,QAAI,CAAC,QAAS,eAAe,QAAQ,OAAO,YAAY,IAAI,KAAM,OAAO,YAAY,IAAI;AACvF;AACF,WAAO,MAAM,oCAAoC,IAAI;AAAA,EACvD;AACA,UAAQ,kEAAkE;AAC5E;AAEA,eAAe,SAAS,QAAoB,OAAmB;AAC7D,MAAI,SAAS;AACb,SAAO,SAAS,MAAM,YAAY;AAChC,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,MAAM,OAAO,QAAQ,MAAM,aAAa,MAAM;AACpF,QAAI,CAAC,aAAc,OAAM,IAAI,MAAM,sCAAsC;AACzE,cAAU;AAAA,EACZ;AACF;AAEA,IAAM,gBAAN,MAAoB;AAAA,EAGlB,YAAqB,QAAoB;AAApB;AAAA,EAAqB;AAAA,EAFjC,OAAOI,YAAW,QAAQ;AAAA,EACnC,WAAW;AAAA,EAEX,MAAM,MAAM,OAA4B;AACtC,UAAM,QAAQ,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAI;AAC/D,aAAS,SAAS,GAAG,SAAS,MAAM,QAAQ,UAAU,aAAa;AACjE,YAAM,QAAQ,MAAM,SAAS,QAAQ,SAAS,WAAW;AACzD,YAAM,SAAS,KAAK,QAAQ,KAAK;AACjC,WAAK,KAAK,OAAO,KAAK;AACtB,WAAK,YAAY,MAAM;AACvB,iBAAW,KAAK,UAAU,MAAM,YAAY;AAAA,IAC9C;AAAA,EACF;AACF;AAMA,IAAM,gBAAN,MAAoB;AAAA,EAIlB,YAA6B,QAAuB;AAAvB;AAAA,EAAwB;AAAA,EAHpC,QAAQ,OAAO,YAAY,cAAc,CAAC;AAAA,EAC1C,SAAS,OAAO,YAAY,KAAK,MAAM,cAAc,KAAK,CAAC,IAAI,CAAC;AAAA,EACzE,QAAQ;AAAA,EAEhB,MAAM,MAAM,OAAe;AACzB,UAAM,KAAK,KAAK,OAAO,KAAK,KAAK;AACjC,UAAM,YAAY,KAAK,QAAQ,MAAM;AACrC,UAAM,SAAS,YAAa,YAAY;AACxC,QAAI,OAAQ,OAAM,KAAK,OAAO,MAAM;AACpC,SAAK,QAAQ,YAAY;AACzB,SAAK,MAAM,KAAK,KAAK,OAAO,GAAG,QAAQ,SAAS;AAAA,EAClD;AAAA,EACA,MAAc,OAAO,QAAgB;AACnC,UAAM,UAAU,KAAK,OAAO,MAAM,KAAK,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,QAAQ,GAAG,OAAO;AAC5F,UAAM,KAAK,OAAO,MAAM,KAAK,OAAO,SAAS,GAAG,OAAO,CAAC;AAAA,EAC1D;AAAA,EACA,MAAM,SAAS;AACb,QAAI,KAAK,MAAO,OAAM,KAAK,OAAO,KAAK,KAAK;AAAA,EAC9C;AACF;AAEA,SAAS,WACP,WACA,MACA,UACAC,SACuB;AACvB,MAAI;AACJ,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,QAAAA;AAAA,IACA,OAAO,OAAO;AACZ,UAAI,SAAU,OAAM,IAAI,MAAM,iCAAiC;AAC/D,YAAM,SAAS,MAAMN,MAAK,MAAM,IAAI;AACpC,UAAI;AACF,cAAM,SAAS,MAAM,OAAO,KAAK,EAAE,QAAQ,KAAK,CAAC;AACjD,YAAI,CAAC,OAAO,OAAO,KAAK,OAAO,OAAO,IAAI,MAAM,SAAU,SAAQ,uBAAuB;AACzF,YAAI,WAAW;AACf,eAAO,WAAW,UAAU;AAC1B,gBAAM,SAAS,OAAO,YAAY,KAAK,IAAI,aAAa,WAAW,QAAQ,CAAC;AAC5E,gBAAM,EAAE,UAAU,IAAI,MAAM,OAAO,KAAK,QAAQ,GAAG,OAAO,QAAQ,QAAQ;AAC1E,cAAI,CAAC,UAAW,SAAQ,6BAA6B;AACrD,sBAAY;AACZ,gBAAM,OAAO,SAAS,GAAG,SAAS;AAAA,QACpC;AACA,YAAI,CAAC,YAAY,QAAQ,MAAM,OAAO,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC;AAC1D,kBAAQ,qCAAqC;AAAA,MACjD,UAAE;AACA,cAAM,OAAO,MAAM;AAAA,MACrB;AAAA,IACF;AAAA,IACA,UAAU;AACR,aAAQ,aAAa,oCAAoC,SAAS;AAAA,IACpE;AAAA,EACF;AACF;AAQA,eAAsB,4BACpB,MACA,eACA,cACA,QAIC;AACD,UAAQ,eAAe;AACvB,QAAM,SAAS,MAAM,SAAS,MAAM,OAAO,YAAY;AACvD,MAAI;AACJ,MAAI,eAAe;AACnB,MAAI;AACF,UAAM,OAAO,MAAM,UAAU,QAAQ,eAAe,MAAM;AAC1D,UAAM,SAAS,MAAM,SAAS,MAAM,QAAQ,MAAM,MAAM;AACxD,gBAAY,MAAM,0BAA0B,IAAI;AAChD,UAAM,OAAOO,MAAK,WAAW,cAAc;AAC3C,UAAM,OAAO,MAAMP,MAAK,MAAM,QAAQ,GAAK;AAC3C,UAAM,SAAS,IAAI,cAAc,IAAI;AACrC,UAAM,cAAc,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,EAAE,OAAO,OAAO,EAAE,KAAK,OAAO;AAC7E,UAAM,OAAO,WAAW,WAAW;AACnC,QAAI,QAAQ;AACZ,QAAI;AACF,YAAM,OAAO,MAAM,8BAA8B;AACjD,eAAS,QAAQ,GAAG,QAAQ,YAAY,QAAQ,SAAS;AACvD,cAAM,OAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,GAAG,KAAK,UAAU,YAAY,KAAK,CAAC,CAAC,EAAE;AAAA,MAC/E;AACA,YAAM,OAAO,MAAM,aAAa;AAChC,UAAI,QAAQ;AACZ,iBAAW,WAAW,CAAC,GAAG,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK,OAAO,GAAG;AAC1D,cAAM,OAAO,OAAO,KAAK,MAAM,IAAI,OAAO,EAAG,IAAI;AACjD,cAAM,MAAM,QAAQ,OAAO;AAC3B,cAAM,MAAM,SAAS,OAAO,IAAI,CAAC;AACjC,cAAM,OAAO,MAAM,GAAG,QAAQ,KAAK,GAAG,WAAW,KAAK,UAAU,OAAO,CAAC,WAAW;AACnF,gBAAQ;AACR,cAAMQ,WAAU,IAAI,cAAc,MAAM;AACxC,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,UACA;AAAA,UACA,OAAO,UAAU;AACf,iBAAK,OAAO,KAAK;AACjB,kBAAMA,SAAQ,MAAM,KAAK;AAAA,UAC3B;AAAA,UACA;AAAA,QACF;AACA,cAAMA,SAAQ,OAAO;AACrB,cAAM,OAAO,MAAM,IAAI;AACvB,iBAAS;AAAA,MACX;AACA,YAAM,OAAO,MAAM,IAAI;AAAA,IACzB,UAAE;AACA,YAAM,KAAK,MAAM;AAAA,IACnB;AACA,UAAM,WAAW,YAAY,MAAM,YAAY,QAAQ,KAAK,MAAM,MAAM,KAAK;AAG7E,UAAM,UAAU,MAAMR,MAAK,MAAM,IAAI;AACrC,UAAM,cAAcO,MAAK,WAAW,iBAAiB;AACrD,QAAI;AACJ,QAAI;AACF,YAAM,UAAU,MAAMP;AAAA,QACpB;AAAA,QACAF,WAAU,SAASA,WAAU,UAAUA,WAAU,SAASA,WAAU;AAAA,QACpE;AAAA,MACF;AACA,UAAI;AACF,gBAAQ,eAAe;AACvB,cAAM,QAAQ,MAAM,aAAa,SAAS,SAAS,CAAC,GAAG,MAAM;AAC7D,gBAAQ,eAAe;AACvB,kBAAU,MAAM,wBAAwB,OAAO,SAAS,MAAM;AAAA,MAChE,UAAE;AACA,cAAM,QAAQ,MAAM;AAAA,MACtB;AAAA,IACF,UAAE;AACA,YAAM,QAAQ,MAAM;AAAA,IACtB;AACA,UAAM,OAAO,WAAW;AACxB,YAAQ,eAAe;AACvB,UAAM,gBAAgB,MAAM,QAAQ,MAAM,MAAM;AAChD,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,MAAM,UAAU,QAAQ,eAAe,MAAM;AAAA,MAC7C;AAAA,IACF;AACA,QACE,OAAO,WAAW,SAAS,UAC3B,MAAM,WAAW,SAAS,UAC1B,QAAQ,WAAW,SAAS;AAE5B,cAAQ;AAGV,mBAAe;AACf,UAAM,OAAO,MAAM;AACnB,UAAM,QAAQ,WAAW,WAAW,MAAM,OAAO,UAAU,OAAO,KAAK,OAAO,KAAK,CAAC;AACpF,gBAAY;AACZ,WAAO,EAAE,OAAO,WAAW,SAAS;AAAA,EACtC,SAAS,OAAO;AACd,WAAO,aAAa,KAAK;AAAA,EAC3B,UAAE;AACA,QAAI;AACF,UAAI,CAAC,aAAc,OAAM,OAAO,MAAM;AAAA,IACxC,UAAE;AACA,UAAI,UAAW,OAAM,oCAAoC,SAAS;AAAA,IACpE;AAAA,EACF;AACF;AAIA,IAAM,aAAN,MAAiB;AAAA,EAKf,YACmB,QACjB,MACiB,QACjB;AAHiB;AAEA;AAEjB,SAAK,SAAS,OAAO,YAAY,IAAI;AAAA,EACvC;AAAA,EAViB;AAAA,EACT,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,WAAW;AAAA,EAQnB,MAAc,OAAO;AACnB,QAAI,KAAK,SAAS,KAAK,UAAW,QAAO;AAGzC,SAAK,QAAQ,eAAe;AAC5B,UAAM,EAAE,UAAU,IAAI,MAAM,KAAK,OAAO,KAAK,KAAK,QAAQ,GAAG,KAAK,OAAO,QAAQ,KAAK,QAAQ;AAC9F,SAAK,YAAY;AACjB,SAAK,SAAS;AACd,SAAK,YAAY;AACjB,WAAO,cAAc;AAAA,EACvB;AAAA,EACA,MAAM,OAAwB;AAC5B,WAAQ,MAAM,KAAK,KAAK,IAAK,KAAK,OAAO,KAAK,MAAM,IAAK;AAAA,EAC3D;AAAA,EACA,MAAM,OAAwB;AAC5B,UAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,QAAI,SAAS,GAAI,SAAQ,kCAAkC;AAC3D,SAAK;AACL,WAAO;AAAA,EACT;AAAA,EACA,MAAM,aAAa;AACjB,WAAO,MAAM;AACX,YAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,UAAI,SAAS,MAAM,SAAS,KAAK,SAAS,MAAM,SAAS,GAAI;AAC7D,WAAK;AAAA,IACP;AAAA,EACF;AAAA,EACA,MAAM,OAAO,WAAmB;AAC9B,UAAM,KAAK,WAAW;AACtB,QAAK,MAAM,KAAK,KAAK,MAAO,UAAU,WAAW,CAAC;AAChD,cAAQ,YAAY,SAAS,4BAA4B;AAAA,EAC7D;AAAA,EACA,MAAM,OAAO,SAA0C;AACrD,UAAM,KAAK,OAAO,GAAG;AACrB,UAAM,QAAkB,CAAC;AACzB,UAAMW,WAAU,UACZ,SACA,IAAI,YAAY,SAAS,EAAE,OAAO,MAAM,WAAW,KAAK,CAAC;AAC7D,UAAM,OAAO,OAAO,SAAiB;AACnC,UAAI,CAAC,KAAM;AACX,UAAI,QAAS,OAAM,QAAQ,MAAM,IAAI;AAAA,UAChC,OAAM,KAAK,IAAI;AAAA,IACtB;AACA,WAAO,MAAM,KAAK,KAAK,GAAG;AACxB,YAAM,QAAQ,KAAK;AACnB,aAAO,KAAK,SAAS,KAAK,WAAW;AACnC,cAAM,OAAO,KAAK,OAAO,KAAK,MAAM;AACpC,YAAI,SAAS,MAAM,SAAS,MAAM,OAAO,GAAI;AAC7C,aAAK;AAAA,MACP;AACA,UAAI,KAAK,SAAS,OAAO;AACvB,cAAM,QAAQ,KAAK,OAAO,SAAS,OAAO,KAAK,MAAM;AAGrD,YAAI,QAAS,OAAM,QAAQ,MAAM,KAAK;AAAA,YACjC,OAAM,KAAKA,SAAS,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC,CAAC;AAAA,MAC1D;AACA,UAAI,KAAK,WAAW,KAAK,UAAW;AACpC,UAAIA,SAAS,OAAM,KAAKA,SAAQ,OAAO,CAAC;AACxC,YAAM,UAAU,MAAM,KAAK,KAAK;AAChC,UAAI,YAAY,GAAI,QAAO,MAAM,KAAK,EAAE;AACxC,UAAI,YAAY,GAAI,SAAQ,uDAAuD;AACnF,YAAM,SAAS,OAAO,aAAa,MAAM,KAAK,KAAK,CAAC;AACpD,UAAI,WAAW,KAAK;AAClB,YAAI,SAAS;AACb,iBAAS,QAAQ,GAAG,QAAQ,GAAG,QAAS,WAAU,OAAO,aAAa,MAAM,KAAK,KAAK,CAAC;AACvF,YAAI,CAAC,mBAAmB,KAAK,MAAM,EAAG,SAAQ,6BAA6B;AAC3E,cAAM,KAAK,OAAO,aAAa,OAAO,SAAS,QAAQ,EAAE,CAAC,CAAC;AAAA,MAC7D,OAAO;AACL,cAAM,UAAkC;AAAA,UACtC,KAAK;AAAA,UACL,MAAM;AAAA,UACN,KAAK;AAAA,UACL,GAAG;AAAA,UACH,GAAG;AAAA,UACH,GAAG;AAAA,UACH,GAAG;AAAA,UACH,GAAG;AAAA,QACL;AACA,YAAI,CAAC,OAAO,OAAO,SAAS,MAAM,EAAG,SAAQ,qBAAqB;AAClE,cAAM,KAAK,QAAQ,MAAM,CAAE;AAAA,MAC7B;AAAA,IACF;AACA,YAAQ,4CAA4C;AAAA,EACtD;AAAA,EACA,MAAM,MAAM,MAA2B;AACrC,UAAM,KAAK,OAAO,GAAG;AACrB,UAAM,KAAK,WAAW;AACtB,QAAK,MAAM,KAAK,KAAK,MAAO,IAAI;AAC9B,YAAM,KAAK,KAAK;AAChB;AAAA,IACF;AACA,WAAO,MAAM;AACX,YAAM,KAAK;AACX,YAAM,KAAK,WAAW;AACtB,YAAM,YAAY,MAAM,KAAK,KAAK;AAClC,UAAI,cAAc,GAAI;AACtB,UAAI,cAAc,GAAI,SAAQ,sCAAsC;AAAA,IACtE;AAAA,EACF;AAAA,EACA,MAAM,OAAO,OAAuC;AAClD,UAAM,KAAK,OAAO,GAAG;AACrB,UAAM,OAAO,oBAAI,IAAY;AAC7B,UAAM,KAAK,WAAW;AACtB,QAAK,MAAM,KAAK,KAAK,MAAO,KAAK;AAC/B,YAAM,KAAK,KAAK;AAChB,aAAO;AAAA,IACT;AACA,WAAO,MAAM;AACX,YAAM,MAAM,MAAM,KAAK,OAAO;AAC9B,UAAI,KAAK,IAAI,GAAG,EAAG,SAAQ,2CAA2C;AACtE,WAAK,IAAI,GAAG;AACZ,YAAM,KAAK,OAAO,GAAG;AACrB,YAAM,MAAM,GAAG;AACf,YAAM,KAAK,WAAW;AACtB,YAAM,YAAY,MAAM,KAAK,KAAK;AAClC,UAAI,cAAc,IAAK,QAAO;AAC9B,UAAI,cAAc,GAAI,SAAQ,uCAAuC;AAAA,IACvE;AAAA,EACF;AAAA,EACA,MAAM,UAAU;AACd,UAAM,KAAK,WAAW;AAGtB,QAAI,SAAS;AACb,QAAI,gBAAgB;AACpB,QAAI,cAAc;AAClB,QAAI,QAAQ;AACZ,UAAM,UAAU,CAAC,SAAiB,QAAQ,MAAM,QAAQ;AACxD,UAAM,gBAAgB,CAAC,SAAiB;AACtC,UAAI,SAAS,IAAI;AACf,YAAI,SAAS,MAAM,gBAAgB,GAAI,SAAQ;AAC/C,YAAI,gBAAgB,GAAI,eAAc;AAAA,MACxC;AACA;AAAA,IACF;AACA,QAAK,MAAM,KAAK,KAAK,MAAO,IAAI;AAC9B,cAAQ;AACR,YAAM,KAAK,KAAK;AAAA,IAClB;AACA,UAAM,QAAQ,MAAM,KAAK,KAAK;AAC9B,QAAI,CAAC,QAAQ,KAAK,EAAG,SAAQ,0CAA0C;AACvE,kBAAc,KAAK;AACnB;AACA,QAAI,UAAU,IAAI;AAChB,aAAO,QAAQ,MAAM,KAAK,KAAK,CAAC,GAAG;AACjC,sBAAc,MAAM,KAAK,KAAK,CAAC;AAC/B;AAAA,MACF;AAAA,IACF,WAAW,QAAQ,MAAM,KAAK,KAAK,CAAC,EAAG,SAAQ,yCAAyC;AACxF,QAAK,MAAM,KAAK,KAAK,MAAO,IAAI;AAC9B,YAAM,KAAK,KAAK;AAChB,UAAI,CAAC,QAAQ,MAAM,KAAK,KAAK,CAAC,EAAG,SAAQ,kCAAkC;AAC3E,aAAO,QAAQ,MAAM,KAAK,KAAK,CAAC,EAAG,eAAc,MAAM,KAAK,KAAK,CAAC;AAAA,IACpE;AACA,QAAI,WAAW;AACf,QAAI,OAAO;AACX,QAAK,MAAM,KAAK,KAAK,MAAO,OAAQ,MAAM,KAAK,KAAK,MAAO,IAAI;AAC7D,YAAM,KAAK,KAAK;AAChB,UAAK,MAAM,KAAK,KAAK,MAAO,MAAO,MAAM,KAAK,KAAK,MAAO,IAAI;AAC5D,YAAK,MAAM,KAAK,KAAK,MAAO,GAAI,QAAO;AAAA,MACzC;AACA,UAAI,CAAC,QAAQ,MAAM,KAAK,KAAK,CAAC,EAAG,SAAQ,kCAAkC;AAC3E,aAAO,QAAQ,MAAM,KAAK,KAAK,CAAC,GAAG;AAEjC,mBAAW,KAAK,IAAI,OAAO,kBAAkB,WAAW,KAAM,MAAM,KAAK,KAAK,IAAK,EAAE;AAAA,MACvF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,gBAAgB,MAAM,gBAAgB,cAAc,IAAI,OAAO,aAAa;AACxF,cAAQ,uCAAuC;AAAA,EACnD;AACF;AAEA,IAAM,gBAAN,MAAoB;AAAA,EAQlB,YAA6B,SAA2C;AAA3C;AAAA,EAA4C;AAAA,EAPxD,SAAS,OAAO,YAAY,WAAW;AAAA,EAChD,eAAe;AAAA,EACf,OAAO;AAAA,EACP,SAAS;AAAA;AAAA,EAET,UAAU;AAAA,EAClB,WAAW;AAAA,EAEX,MAAc,QAAQ;AACpB,QAAI,CAAC,KAAK,aAAc;AACxB,UAAM,KAAK,QAAQ,KAAK,OAAO,SAAS,GAAG,KAAK,YAAY,CAAC;AAC7D,SAAK,YAAY,KAAK;AACtB,SAAK,eAAe;AAAA,EACtB;AAAA,EACA,MAAM,MAAM,OAA4B;AACtC,aAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,YAAM,OAAO,OAAO,UAAU,WAAW,MAAM,WAAW,KAAK,IAAI,MAAM,KAAK;AAC9E,UAAI,KAAK,YAAY,EAAG,SAAQ,+CAA+C;AAC/E,UAAI,KAAK,YAAY,GAAG;AACtB,YAAI,SAAS,GAAI,SAAQ,0CAA0C;AACnE,aAAK,UAAU;AACf;AAAA,MACF;AAGA,UAAI,KAAK,eAAe,KAAK,OAAO,SAAS,EAAG,OAAM,KAAK,MAAM;AACjE,UAAI,SAAS,IAAI;AACf,YAAI,KAAK,WAAW,GAAG;AACrB,cAAI,KAAK,OAAO,GAAI,SAAQ,mDAAmD;AAC/E,eAAK,OAAO,KAAK,cAAc,IAAI,KAAK,SAAS;AACjD,eAAK,UAAU;AAAA,QACjB,WAAW,KAAK,WAAW,GAAG;AAC5B,cAAI,KAAK,OAAO,EAAG,SAAQ,mDAAmD;AAC9E,eAAK,OAAO,KAAK,cAAc,IAAI,KAAK,SAAS;AACjD,eAAK,OAAO,KAAK,cAAc,IAAK,KAAK,SAAS,IAAK;AACvD,eAAK,UAAU;AAAA,QACjB,MAAO,SAAQ,0CAA0C;AACzD,aAAK,SAAS;AACd;AAAA,MACF;AACA,YAAM,QACJ,QAAQ,MAAM,QAAQ,KAClB,OAAO,KACP,QAAQ,MAAM,QAAQ,MACpB,OAAO,KACP,QAAQ,MAAM,QAAQ,KACpB,OAAO,IACP,SAAS,KACP,KACA,SAAS,KACP,KACA;AACd,UAAI,QAAQ,EAAG,SAAQ,2CAA2C;AAClE,WAAK,OAAQ,KAAK,QAAQ,IAAK;AAC/B,UAAI,EAAE,KAAK,WAAW,GAAG;AACvB,aAAK,OAAO,KAAK,cAAc,IAAI,KAAK,SAAS;AACjD,aAAK,OAAO,KAAK,cAAc,IAAK,KAAK,SAAS,IAAK;AACvD,aAAK,OAAO,KAAK,cAAc,IAAI,KAAK,OAAO;AAC/C,aAAK,OAAO;AACZ,aAAK,SAAS;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,SAAS;AACb,QAAI,KAAK,UAAU,KAAK,YAAY,EAAG,SAAQ,oCAAoC;AACnF,UAAM,KAAK,MAAM;AAAA,EACnB;AACF;AAKA,eAAe,wBACb,OACA,SACA,QACA;AACA,QAAM,OAAO,WAAW,MAAM,WAAW;AACzC,MAAI,QAAQ;AACZ,QAAM,SAAS,OAAO,YAAY,WAAW;AAC7C,aAAW,QAAQ,CAAC,GAAG,MAAM,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG;AAC3E,YAAQ,eAAe;AACvB,UAAM,MAAM,QAAQ,KAAK,IAAI;AAC7B,UAAM,MAAM,SAAS,OAAO,KAAK,QAAQ,CAAC;AAC1C,QAAI,SAAS;AACb,WAAO,SAAS,KAAK,UAAU;AAC7B,YAAM,EAAE,UAAU,IAAI,MAAM,QAAQ;AAAA,QAClC;AAAA,QACA;AAAA,QACA,KAAK,IAAI,OAAO,QAAQ,KAAK,WAAW,MAAM;AAAA,QAC9C,KAAK,SAAS;AAAA,MAChB;AACA,UAAI,CAAC,UAAW,SAAQ,2CAA2C;AACnE,WAAK,OAAO,OAAO,SAAS,GAAG,SAAS,CAAC;AACzC,gBAAU;AAAA,IACZ;AACA,aAAS,KAAK;AAAA,EAChB;AACA,SAAO,YAAY,MAAM,MAAM,YAAY,QAAQ,MAAM,MAAM,QAAQ,KAAK;AAC9E;AAEA,SAAS,aAAa,MAAc;AAClC,MACE,CAAC,QACD,KAAK,SAAS,IAAI,KAClB,OAAO,KAAK,IAAI,EAAE,SAAS,MAAM,MAAM,QACvC,KACG,MAAM,GAAG,EACT;AAAA,IACC,CAAC,SACC,CAAC,QACD,SAAS,OACT,SAAS,QACT,OAAO,WAAW,MAAM,MAAM,IAAI;AAAA,EACtC;AAEF,YAAQ,+BAA+B;AAC3C;AAEA,eAAe,aACb,OACA,SACA,SACA,QACuB;AACvB,QAAM,SAAS,IAAI,WAAW,OAAO,UAAU,OAAO,GAAG,MAAM;AAC/D,QAAM,SAAS,UAAU,OAAO;AAChC,QAAM,cAAwB,CAAC;AAC/B,QAAM,QAAoB,CAAC;AAC3B,MAAI,YAAY;AAChB,MAAI,UAAU;AACd,QAAM,SAAS,MAAM;AACnB,eAAW,EAAE,SAAS,QAAQ,YAAY,cAAc;AAAA,EAC1D;AACA,QAAM,OAAO,MAAM,OAAO,OAAO,OAAO,QAAQ;AAC9C,QAAI,QAAQ,UAAW,QAAO,MAAM,OAAO,QAAQ;AACnD,QAAI,QAAQ,eAAe;AACzB,aAAO,MAAM,OAAO,MAAM,YAAY;AACpC,cAAM,OAAO,MAAM,OAAO,OAAO;AACjC,qBAAa,IAAI;AACjB,oBAAY,KAAK,IAAI;AACrB,eAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,QAAI,QAAQ,SAAS;AACnB,aAAO,MAAM,OAAO,MAAM,YAAY;AACpC,YAAI;AACJ,cAAM,SAAS;AACf,cAAMA,WAAU,IAAI,cAAc,OAAO,UAAU;AACjD,uBAAa,MAAM;AACnB,qBAAW,WAAW,QAAQ,mBAAmB,gBAAgB;AACjE,gBAAM,SAAS,SAAS,KAAK;AAAA,QAC/B,CAAC;AACD,cAAM,SAAS,MAAM,OAAO,OAAO,OAAO,UAAU;AAClD,cAAI,UAAU,QAAQ;AACpB,mBAAO,MAAM,OAAO,OAAO;AAC3B,yBAAa,IAAI;AAAA,UACnB,WAAW,UAAU,QAAQ;AAC3B,kBAAM,OAAO,OAAOA,QAAO;AAC3B,kBAAMA,SAAQ,OAAO;AAAA,UACvB,MAAO,SAAQ,yCAAyC;AAAA,QAC1D,CAAC;AACD,YAAI,SAAS,UAAa,CAAC,OAAO,IAAI,MAAM;AAC1C,kBAAQ,gDAAgD;AAC1D,cAAM,KAAK,EAAE,MAAM,QAAQ,UAAUA,SAAQ,SAAS,CAAC;AACvD,eAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,YAAQ,oCAAoC;AAAA,EAC9C,CAAC;AACD,MAAI,CAAC,KAAK,IAAI,SAAS,KAAK,CAAC,KAAK,IAAI,aAAa,KAAK,CAAC,KAAK,IAAI,OAAO;AACvE,YAAQ,kDAAkD;AAC5D,QAAM,OAAO,WAAW;AACxB,MAAK,MAAM,OAAO,KAAK,MAAO,GAAI,SAAQ,yCAAyC;AACnF,QAAM,QAAQ,oBAAI,IAAkC;AACpD,aAAW,CAAC,MAAM,IAAI,KAAK;AAAA,IACzB,GAAG,YAAY,IAAI,CAAC,cAAc,CAAC,WAAW,WAAW,CAAU;AAAA,IACnE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,MAAM,MAAM,CAAU;AAAA,EACrD,GAAG;AACD,QAAI,MAAM,IAAI,IAAI,EAAG,SAAQ,kCAAkC;AAC/D,UAAM,IAAI,MAAM,IAAI;AAAA,EACtB;AACA,aAAW,QAAQ,MAAM,KAAK,GAAG;AAC/B,QAAI,SAAS,cAAc,IAAI,EAAE,CAAC;AAClC,WAAO,QAAQ;AACb,UAAI,MAAM,IAAI,MAAM,MAAM,OAAQ,SAAQ,4CAA4C;AACtF,eAAS,cAAc,MAAM,EAAE,CAAC;AAAA,IAClC;AAAA,EACF;AACA,SAAO,EAAE,aAAa,MAAM;AAC9B;AAKA,eAAe,eAAe,QAAoB;AAChD,aAAW,QAAQ,MAAMN,SAAQ,OAAO,MAAM,CAAC,GAAG;AAChD,UAAM,OAAO,OAAO,QAAQ,IAAI;AAChC,UAAM,QAAQ,MAAMC,OAAM,MAAM,EAAE,QAAQ,KAAK,CAAC;AAChD,QAAI,MAAM,YAAY,GAAG;AACvB,YAAM,QAAQ,MAAMJ,MAAK,MAAM,cAAc;AAC7C,UAAI;AACF,YAAI,CAAC,UAAU,OAAO,MAAM,MAAM,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC;AACtD,kBAAQ,uCAAuC;AACjD,cAAM,eAAe,KAAK;AAC1B,YAAI,CAAC,UAAU,OAAO,MAAMI,OAAM,MAAM,EAAE,QAAQ,KAAK,CAAC,CAAC;AACvD,kBAAQ,uCAAuC;AACjD,cAAM,MAAM,IAAI;AAAA,MAClB,UAAE;AACA,cAAM,MAAM,MAAM;AAAA,MACpB;AAAA,IACF,OAAO;AACL,YAAM,OAAO,IAAI;AAAA,IACnB;AAAA,EACF;AACF;AAEA,eAAe,SAAS,SAAqB,QAAoB,MAAgB;AAC/E,QAAM,SAAS,OAAO,YAAY,WAAW;AAC7C,MAAI,SAAS;AACb,SAAO,SAAS,KAAK,UAAU;AAC7B,UAAM,EAAE,UAAU,IAAI,MAAM,QAAQ;AAAA,MAClC;AAAA,MACA;AAAA,MACA,KAAK,IAAI,OAAO,QAAQ,KAAK,WAAW,MAAM;AAAA,MAC9C,KAAK,SAAS;AAAA,IAChB;AACA,QAAI,CAAC,UAAW,SAAQ,2CAA2C;AACnE,UAAM,SAAS,QAAQ,OAAO,SAAS,GAAG,SAAS,CAAC;AACpD,cAAU;AAAA,EACZ;AACF;AAKA,eAAe,yBACb,WACA,OACA,SACA,KACY;AAIZ,QAAM,EAAE,UAAU,kBAAkB,QAAQ,eAAe,IAAI;AAC/D,QAAM,aAAa,MAAM,KAAK,KAAK,KAAK;AACxC,QAAM,uBAAuB,UAAU,OAAO;AAC9C,QAAM,SAAS,UAAU,OAAO;AAChC,aAAW,kBAAkB,QAAQ,eAAe,YAAY;AAChE,MAAI,mBAAmB,KAAK,CAAC,iBAAiB,KAAK,cAAc;AAC/D,YAAQ,0CAA0C;AACpD,QAAM,YAAY,MAAM,0BAA0B,SAAS;AAC3D,QAAM,UAAwB,CAAC;AAC/B,MAAI;AACF,UAAM,QAAQ,MAAMJ;AAAA,MAClBO,MAAK,WAAW,YAAY;AAAA,MAC5BT,WAAU,SAASA,WAAU,UAAUA,WAAU,SAASA,WAAU;AAAA,MACpE;AAAA,IACF;AACA,YAAQ,KAAK,KAAK;AAClB,UAAM,SAAS,IAAI,cAAc,KAAK;AAGtC,qBAAiB,SAAS,WAAW,GAAG;AACtC,UAAI,EAAE,iBAAiB,YAAa,SAAQ,wCAAwC;AACpF,iBAAW,OAAO,WAAW,MAAM,QAAQ,QAAQ,eAAe,YAAY;AAC9E,UAAI,OAAO,WAAW,MAAM,SAAS;AACnC,gBAAQ,iCAAiC;AAC3C,YAAM,OAAO,MAAM,KAAK;AAAA,IAC1B;AACA,QAAI,OAAO,aAAa,oBAAoB,OAAO,KAAK,OAAO,KAAK,MAAM;AACxE,cAAQ,yCAAyC;AACnD,UAAM,UAAU,MAAME;AAAA,MACpBO,MAAK,WAAW,SAAS;AAAA,MACzBT,WAAU,SAASA,WAAU,UAAUA,WAAU,SAASA,WAAU;AAAA,MACpE;AAAA,IACF;AACA,YAAQ,KAAK,OAAO;AACpB,UAAM,UAAU,MAAM,aAAa,OAAO,SAAS;AAAA,MACjD,YAAY;AAAA,MACZ,eAAe;AAAA,IACjB,CAAC;AACD,WAAO,MAAM,IAAI,SAAS,OAAO;AAAA,EACnC,UAAE;AACA,QAAI;AACF,YAAM,QAAQ,IAAI,QAAQ,IAAI,CAAC,WAAW,OAAO,MAAM,CAAC,CAAC;AAAA,IAC3D,UAAE;AACA,YAAM,oCAAoC,SAAS;AAAA,IACrD;AAAA,EACF;AACF;AAEA,eAAsB,4BACpB,MACA,OACA,UAAuC,CAAC,GACzB;AACf,QAAM,yBAAyB,MAAM,OAAO,SAAS,OAAO,SAAS,YAAY;AAC/E,UAAM,UAAwB,CAAC;AAC/B,QAAI;AACF,YAAM,wBAAwB,MAAM,SAAS,SAAS,OAAO;AAAA,IAC/D,UAAE;AACA,YAAM,QAAQ,IAAI,QAAQ,IAAI,CAAC,WAAW,OAAO,MAAM,CAAC,CAAC;AAAA,IAC3D;AAAA,EACF,CAAC;AACH;AAEA,eAAe,wBACb,MACA,SACA,SACA,SACe;AAEf,QAAM,cAAc,MAAM,SAAS,MAAM,IAAI;AAC7C,UAAQ,KAAK,WAAW;AACxB,QAAM,sBAAsB,MAAM,YAAY,KAAK,EAAE,QAAQ,KAAK,CAAC;AACnE,QAAM,eAAe,WAAW;AAChC,aAAW,QAAQ,QAAQ,aAAa;AACtC,UAAM,YAAY,MAAM,cAAc,aAAa,MAAM,QAAW,IAAI;AACxE,UAAM,UAAU,MAAM;AAAA,EACxB;AACA,aAAW,QAAQ,QAAQ,OAAO;AAChC,UAAM,CAAC,QAAQ,IAAI,IAAI,cAAc,KAAK,IAAI;AAC9C,UAAM,YAAY,MAAM,cAAc,aAAa,QAAQ,QAAW,IAAI;AAC1E,QAAI;AACF,YAAM,SAAS,MAAME,MAAK,OAAO,WAAW,IAAI,GAAG,QAAQ,GAAK;AAChE,UAAI;AACF,cAAM,WAAW,MAAM,OAAO,KAAK,EAAE,QAAQ,KAAK,CAAC;AACnD,cAAM,SAAS,SAAS,QAAQ,IAAI;AACpC,cAAM,cAAc,MAAM,cAAc,aAAa,MAAM;AAC3D,YAAI;AACF,cACE,CAAC;AAAA,YACC,MAAM,UAAU,KAAK,EAAE,QAAQ,KAAK,CAAC;AAAA,YACrC,MAAM,YAAY,KAAK,EAAE,QAAQ,KAAK,CAAC;AAAA,UACzC,KACA,CAAC,UAAU,UAAU,MAAMI,OAAM,OAAO,aAAa,IAAI,GAAG,EAAE,QAAQ,KAAK,CAAC,CAAC;AAE7E,oBAAQ,kCAAkC;AAAA,QAC9C,UAAE;AACA,gBAAM,YAAY,MAAM;AAAA,QAC1B;AAAA,MACF,UAAE;AACA,cAAM,OAAO,MAAM;AAAA,MACrB;AAAA,IACF,UAAE;AACA,YAAM,UAAU,MAAM;AAAA,IACxB;AAAA,EACF;AACA,QAAM,QAAQ,MAAM,SAAS,IAAI;AACjC,MAAI;AACF,QAAI,CAAC,UAAU,qBAAqB,MAAM,MAAM,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC;AACpE,cAAQ,kCAAkC;AAAA,EAC9C,UAAE;AACA,UAAM,MAAM,MAAM;AAAA,EACpB;AACF;AAEA,IAAM,YAAY;AAGlB,IAAM,uBAAuB;AAC7B,IAAM,qBAAqB;AAC3B,IAAM,gBAAgB;AAEtB,SAAS,SAAS,QAAgB,QAAgB,OAAe,OAAe;AAC9E,SAAO,MAAM,GAAG,MAAM,SAAS,CAAC,EAAE,SAAS,QAAQ,GAAG,GAAG,CAAC,MAAM,QAAQ,OAAO,OAAO;AACxF;AAEA,SAAS,UAAU,MAAc,MAAuB,MAAc,MAAc,OAAe;AACjG,QAAM,SAAS,OAAO,MAAM,SAAS;AACrC,SAAO,MAAM,MAAM,GAAG,KAAK,MAAM;AACjC,WAAS,QAAQ,KAAK,GAAG,IAAI;AAC7B,WAAS,QAAQ,KAAK,GAAG,CAAC;AAC1B,WAAS,QAAQ,KAAK,GAAG,CAAC;AAC1B,WAAS,QAAQ,KAAK,IAAI,IAAI;AAC9B,WAAS,QAAQ,KAAK,IAAI,KAAK;AAC/B,SAAO,KAAK,IAAM,KAAK,GAAG;AAC1B,SAAO,MAAM,MAAM,KAAK,GAAG,OAAO;AAClC,SAAO,MAAM,WAAW,KAAK,GAAG,OAAO;AACvC,SAAO,MAAM,MAAM,KAAK,GAAG,OAAO;AAClC,MAAI,WAAW;AACf,aAAW,QAAQ,OAAQ,aAAY;AACvC,SAAO,MAAM,GAAG,SAAS,SAAS,CAAC,EAAE,SAAS,GAAG,GAAG,CAAC,OAAO,KAAK,GAAG,OAAO;AAC3E,SAAO;AACT;AAEA,SAAS,UAAU,KAAa,OAAuB;AACrD,QAAM,OAAO,IAAI,GAAG,IAAI,KAAK;AAAA;AAC7B,QAAM,YAAY,OAAO,WAAW,IAAI;AAExC,MAAI,SAAS,YAAY,OAAO,SAAS,EAAE;AAC3C,SAAO,YAAY,OAAO,MAAM,EAAE,WAAW,OAAQ,UAAS,YAAY,OAAO,MAAM,EAAE;AACzF,SAAO,OAAO,KAAK,GAAG,MAAM,GAAG,IAAI,EAAE;AACvC;AAEA,SAAS,OAAO,OAAe;AAC7B,SAAO,KAAK,KAAK,QAAQ,SAAS,IAAI;AACxC;AAIA,SAAS,gBAAgB,MAAc,MAAiB,MAAc,OAAuB;AAC3F,QAAM,OAAO,SAAS,MAAM,qBAAqB;AACjD,MAAI,OAAO,WAAW,IAAI,KAAK,IAAK,QAAO,UAAU,MAAM,MAAM,MAAM,MAAM,KAAK;AAClF,QAAM,SAAS,UAAU,QAAQ,IAAI;AACrC,QAAM,MAAM,OAAO,MAAM,YAAY,OAAO,OAAO,MAAM,CAAC;AAC1D,YAAU,kBAAkB,KAAK,OAAO,QAAQ,KAAO,KAAK,EAAE,KAAK,KAAK,CAAC;AACzE,SAAO,KAAK,KAAK,SAAS;AAC1B,SAAO,OAAO,OAAO,CAAC,KAAK,UAAU,iBAAiB,MAAM,MAAM,MAAM,KAAK,CAAC,CAAC;AACjF;AAEA,SAAS,WAAW,MAAc,UAA6B;AAC7D,SAAO,SAAS,KAAK,CAAC,WAAW,SAAS,UAAU,KAAK,WAAW,GAAG,MAAM,GAAG,CAAC;AACnF;AAmBA,eAAsB,iCACpB,OACA,UAGI,CAAC,GAC0B;AAC/B,QAAM,YAAY,QAAQ,iBAAiB,CAAC,GACzC,IAAI,CAAC,SAAS,KAAK,QAAQ,YAAY,EAAE,EAAE,QAAQ,QAAQ,EAAE,CAAC,EAC9D,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;AACnC,QAAM,QACJ,QAAQ,iBAAiB,UAAa,OAAO,SAAS,QAAQ,YAAY,IACtE,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,YAAY,CAAC,IAC5C;AACN,SAAO,MAAM,yBAAyB,MAAM,OAAO,SAAS,OAAO,SAAS,YAAY;AACtF,UAAM,qBAAqB,MAAM,wBAAwB,SAAS,OAAO;AAEzE,UAAM,SAAS,IAAI,IAAI,QAAQ,WAAW;AAC1C,UAAM,cAAc,oBAAI,IAAY;AACpC,eAAW,QAAQ,CAAC,GAAG,QAAQ,aAAa,GAAG,QAAQ,MAAM,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,GAAG;AACtF,UAAI,SAAS,OAAO,IAAI,IAAI,IAAI,OAAO,cAAc,IAAI,EAAE,CAAC;AAC5D,aAAO,QAAQ;AACb,YAAI,CAAC,WAAW,QAAQ,QAAQ,EAAG,aAAY,IAAI,MAAM;AACzD,iBAAS,cAAc,MAAM,EAAE,CAAC;AAAA,MAClC;AAAA,IACF;AACA,UAAM,QAAQ,QAAQ,MAAM,OAAO,CAAC,SAAS,CAAC,WAAW,KAAK,MAAM,QAAQ,CAAC;AAC7E,UAAM,qBAAqB,CAAC,GAAG,WAAW,EAAE;AAAA,MAAK,CAAC,MAAM,UACtD,OAAO,QAAQ,OAAO,KAAK,IAAI,GAAG,OAAO,KAAK,KAAK,CAAC;AAAA,IACtD;AACA,UAAM,UAAU,oBAAI,IAAoB;AACxC,QAAI,QAAQ,IAAI;AAChB,eAAW,aAAa,oBAAoB;AAC1C,YAAM,SAAS,gBAAgB,GAAG,SAAS,KAAK,KAAK,GAAG,KAAK;AAC7D,cAAQ,IAAI,KAAK,SAAS,IAAI,MAAM;AACpC,eAAS,OAAO;AAAA,IAClB;AACA,eAAW,QAAQ,OAAO;AACxB,UAAI,KAAK,WAAW;AAClB,gBAAQ,wDAAwD;AAClE,YAAM,SAAS,gBAAgB,KAAK,MAAM,KAAK,KAAK,UAAU,KAAK;AACnE,cAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM;AACpC,eAAS,OAAO,SAAS,OAAO,KAAK,QAAQ;AAAA,IAC/C;AACA,eAAW,OAAO,OAAO,kBAAkB,mBAAmB;AAC9D,UAAM,MAAM,OAAO,MAAM,KAAK;AAC9B,UAAM,UAAmC,CAAC;AAC1C,QAAI,SAAS;AACb,eAAW,aAAa,oBAAoB;AAC1C,gBAAU,QAAQ,IAAI,KAAK,SAAS,EAAE,EAAG,KAAK,KAAK,MAAM;AACzD,cAAQ,KAAK,EAAE,MAAM,aAAa,MAAM,UAAU,CAAC;AAAA,IACrD;AACA,eAAW,QAAQ,OAAO;AACxB,gBAAU,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,EAAG,KAAK,KAAK,MAAM;AACzD,YAAM,OAAOC,YAAW,QAAQ;AAChC,UAAI,SAAS;AACb,aAAO,SAAS,KAAK,UAAU;AAC7B,cAAM,EAAE,UAAU,IAAI,MAAM,QAAQ;AAAA,UAClC;AAAA,UACA,SAAS;AAAA,UACT,KAAK,IAAI,aAAa,KAAK,WAAW,MAAM;AAAA,UAC5C,KAAK,SAAS;AAAA,QAChB;AACA,YAAI,CAAC,UAAW,SAAQ,2CAA2C;AACnE,aAAK,OAAO,IAAI,SAAS,SAAS,QAAQ,SAAS,SAAS,SAAS,CAAC;AACtE,kBAAU;AAAA,MACZ;AACA,gBAAU,OAAO,KAAK,QAAQ;AAC9B,cAAQ,KAAK;AAAA,QACX,MAAM;AAAA,QACN,MAAM,KAAK;AAAA,QACX,QAAQ,KAAK,OAAO,KAAK;AAAA,QACzB,UAAU,KAAK;AAAA,MACjB,CAAC;AAAA,IACH;AACA,WAAO;AAAA,MACL,OAAO,IAAI,WAAW,IAAI,QAAQ,IAAI,YAAY,IAAI,UAAU;AAAA,MAChE,aAAa;AAAA,MACb,UAAU,yBAAyB,OAAO;AAAA,IAC5C;AAAA,EACF,CAAC;AACH;;;AHzxCA;AAAA,EACE,wBAAAK;AAAA,EACA,uBAAAC;AAAA,EACA,+CAAAC;AAAA,EACA,wBAAAC;AAAA,EACA;AAAA,EACA,kCAAAC;AAAA,EACA,mCAAAC;AAAA,OAKK;;;AKrEP;AAAA,EACE;AAAA,EACA;AAAA,EACA,kBAAAC;AAAA,OACK;;;ACJP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAYA,SAAS,qCAA2C;AACzD,aAAW,WAAW,eAAe,SAAS;AAC5C,UAAM,aAAa,uBAAuB,OAAO;AACjD,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,MAAM,wCAAwC,OAAO,GAAG;AAAA,IACpE;AACA,QAAI,WAAW,YAAY,SAAS;AAClC,YAAM,IAAI,MAAM,oCAAoC,OAAO,WAAW,WAAW,OAAO,IAAI;AAAA,IAC9F;AAIA,QACE,WAAW,aAAa,cAAc,aACtC,WAAW,aAAa,SAAS,QACjC;AACA,YAAM,IAAI,MAAM,IAAI,OAAO,mDAAmD;AAAA,IAChF;AAIA,QACE,WAAW,aAAa,cAAc,aACtC,WAAW,aAAa,cAAc,cAAc,MACpD;AACA,YAAM,IAAI,MAAM,IAAI,OAAO,8CAA8C;AAAA,IAC3E;AAKA,QACE,WAAW,aAAa,cAAc,cACtC,WAAW,aAAa,UAAU,WAClC;AACA,YAAM,IAAI;AAAA,QACR,IAAI,OAAO,0BAA0B,WAAW,aAAa,UAAU,SAAS,yCAAyC,WAAW,aAAa,cAAc,SAAS;AAAA,MAC1K;AAAA,IACF;AAIA,QAAI,WAAW,eAAe,WAAW,SAAS,SAAS,QAAQ;AACjE,YAAM,IAAI,MAAM,IAAI,OAAO,sCAAsC;AAAA,IACnE;AAIA,QACE,WAAW,gBAAgB,aAC1B,WAAW,SAAS,SAAS,WAAW,SAAS,SAClD;AACA,YAAM,IAAI,MAAM,IAAI,OAAO,0CAA0C,WAAW,IAAI,EAAE;AAAA,IACxF;AAAA,EACF;AACF;;;ACQO,IAAM,0CAA0C,OAAO,OAAO;AAAA,EACnE,UAAU;AAAA,EACV,UAAU;AAAA,EACV,cAAc;AAChB,CAA0C;AAEnC,IAAM,4CAA4C,OAAO,OAAO;AAAA,EACrE,UAAU;AAAA,EACV,UAAU;AAAA,EACV,cAAc;AAChB,CAA0C;AAKnC,IAAM,+CAA+C,OAAO,OAAO;AAAA,EACxE,GAAG;AAAA,EACH,iBAAiB;AACnB,CAA0C;AAInC,SAAS,6BAA6B,OAAyB;AACpE,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAM,QAAQ;AACd,QAAM,YACJ,MAAM,SAAS,OAAO,MAAM,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM,KAAK,IACvE,MAAM,QACP;AACN,QAAM,eACJ,UAAU,gBACV,OAAO,UAAU,iBAAiB,YAClC,CAAC,MAAM,QAAQ,UAAU,YAAY,IAChC,UAAU,eACX;AACN,QAAM,gBACJ,aAAa,iBACb,OAAO,aAAa,kBAAkB,YACtC,CAAC,MAAM,QAAQ,aAAa,aAAa,IACpC,aAAa,gBACd;AACN,SAAO,eAAe,wBAAwB,aAAa;AAC7D;;;AC7HO,IAAM,iBAAuC;AAAA,EAClD,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,kBAAkB,CAAC,iBAAiB;AAAA,EACpC,wBAAwB,MAAM;AAAA,EAC9B,YAAY,uBAAuB;AAAA;AAAA;AAAA,EAGnC,oBAAoB;AAAA,EACpB,oBAAoB,UAAU;AAC5B,QAAI,CAAC,SAAS,cAAc;AAC1B,YAAM,IAAI,mBAAmB,UAAU,qCAAqC;AAAA,IAC9E;AAAA,EACF;AAAA,EACA,MAAM,EAAE,UAAU,YAAY,GAAG;AAK/B,UAAM,UAA6E;AAAA,MACjF,QAAQ,SAAS;AAAA,MACjB,KAAK;AAAA;AAAA;AAAA;AAAA,MAIL,UAAU,EAAE,uBAAuB,SAAS,yBAAyB;AAAA,IACvE;AACA,QAAI,SAAS,YAAa,SAAQ,QAAQ,SAAS;AACnD,QAAI,SAAS,aAAc,SAAQ,SAAS,SAAS;AACrD,QAAI,SAAS,4BAA4B,QAAW;AAClD,cAAQ,oBAAoB,SAAS;AAAA,IACvC;AACA,QAAI,SAAS,gCAAgC;AAC3C,cAAQ,qBAAqB,SAAS;AAAA,IACxC;AACA,QAAI,SAAS,eAAgB,SAAQ,SAAS,SAAS;AACvD,QAAI,SAAS,UAAW,SAAQ,MAAM,SAAS;AAC/C,WAAO,IAAI,oBAAoB,OAAO;AAAA,EACxC;AACF;;;ACvCO,IAAM,qBAA2C;AAAA,EACtD,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,kBAAkB,CAAC,WAAW;AAAA,EAC9B,wBAAwB,MAAM;AAAA,EAC9B,YAAY,uBAAuB;AAAA,EACnC,oBAAoB;AAAA,EACpB,oBAAoB,UAAU;AAG5B,QAAI,CAAC,SAAS,qBAAqB;AACjC,YAAM,IAAI,mBAAmB,cAAc,4CAA4C;AAAA,IACzF;AAAA,EACF;AAAA,EACA,MAAM,EAAE,UAAU,aAAa,GAAG;AAChC,UAAM,UAAiF;AAAA,MACrF,WAAW,SAAS;AAAA,MACpB;AAAA;AAAA;AAAA;AAAA,MAIA,UAAU,EAAE,kBAAkB,SAAS,yBAAyB;AAAA,IAClE;AACA,QAAI,SAAS,iBAAkB,SAAQ,SAAS,SAAS;AACzD,WAAO,IAAI,wBAAwB,OAAO;AAAA,EAC5C;AACF;;;AC5BA,SAAS,6BAA6B;;;ACuBtC,IAAM,kBAAwD,oBAAI,IAAI;AAAA,EACpE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAEM,IAAM,sBAAN,cAAkC,MAAM;AAAA,EACpC,OAAO;AAAA,EACP;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EAET,YAAY,OAKT;AACD,UAAM,MAAM,SAAS,MAAM,UAAU,SAAY,SAAY,EAAE,OAAO,MAAM,MAAM,CAAC;AACnF,SAAK,OAAO,MAAM;AAClB,SAAK,SAAS,MAAM;AACpB,SAAK,YAAY,gBAAgB,IAAI,MAAM,IAAI;AAAA,EACjD;AACF;AAEO,SAAS,yBAAyB,OAAyB;AAChE,SAAO,iBAAiB,uBAAuB,MAAM,SAAS;AAChE;AAIO,SAAS,qBAAqB,OAAyB;AAC5D,SACE,iBAAiB,wBAChB,MAAM,SAAS,eAAe,MAAM,SAAS;AAElD;AA6EA,IAAM,6BAA6B;AACnC,IAAM,uBAAuB;AAE7B,IAAM,cAAmC,oBAAI,IAAI;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,SAAS,QAAQC,SAAgB,MAAmD;AAClF,MAAIA,YAAW,OAAOA,YAAW,IAAK,QAAO;AAC7C,MAAI,QAAQ,YAAY,IAAI,IAAI,EAAG,QAAO;AAC1C,MAAIA,YAAW,IAAK,QAAO;AAC3B,MAAIA,YAAW,OAAOA,YAAW,IAAK,QAAO;AAC7C,MAAIA,YAAW,IAAK,QAAO;AAC3B,MAAIA,YAAW,IAAK,QAAO;AAC3B,MAAIA,YAAW,IAAK,QAAO;AAC3B,MAAIA,YAAW,IAAK,QAAO;AAC3B,MAAIA,YAAW,IAAK,QAAO;AAC3B,SAAO;AACT;AAGA,eAAe,UACb,UACAC,WAC6C;AAC7C,MAAI,OAAO;AACX,MAAI;AACF,WAAO,MAAMA,UAAS,QAAQ;AAAA,EAChC,QAAQ;AACN,WAAO,EAAE,SAAS,QAAQ,SAAS,MAAM,GAAG;AAAA,EAC9C;AACA,MAAI;AACF,UAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,UAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AACzD,QAAI,OAAO,KAAK,YAAY,YAAY,KAAK,SAAS;AACpD,aAAO,EAAE,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC,GAAI,SAAS,KAAK,QAAQ,MAAM,GAAG,GAAG,EAAE;AAAA,IAC1E;AACA,WAAO,EAAE,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC,GAAI,SAAS,QAAQ,SAAS,MAAM,GAAG;AAAA,EACzE,QAAQ;AACN,WAAO,EAAE,UAAU,QAAQ,QAAQ,SAAS,MAAM,IAAI,MAAM,GAAG,GAAG,EAAE;AAAA,EACtE;AACF;AAEO,IAAM,uBAAN,MAA2B;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,SAAsC;AAChD,SAAK,UAAU,QAAQ,QAAQ,QAAQ,SAAS,EAAE;AAClD,SAAK,SAAS,QAAQ;AACtB,SAAK,YAAY,QAAQ,SAAS;AAClC,SAAK,mBAAmB,QAAQ,oBAAoB;AACpD,SAAK,cAAc,KAAK,IAAI,GAAG,QAAQ,eAAe,oBAAoB;AAC1E,SAAK,QAAQ,QAAQ,UAAU,CAAC,OAAO,IAAI,QAAQ,CAACC,aAAY,WAAWA,UAAS,EAAE,CAAC;AACvF,SAAK,SAAS,QAAQ;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAO,MAAyD;AACpE,WAAO,MAAM,KAAK,QAA4B,QAAQ,iBAAiB,IAAI;AAAA,EAC7E;AAAA;AAAA;AAAA,EAIA,MAAM,KAAK,WAA8C;AACvD,WAAO,MAAM,KAAK;AAAA,MAChB;AAAA,MACA,iBAAiB,mBAAmB,SAAS,CAAC;AAAA,MAC9C,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,IAAI,WAAgD;AACxD,WAAO,MAAM,KAAK;AAAA,MAChB;AAAA,MACA,iBAAiB,mBAAmB,SAAS,CAAC;AAAA,IAChD;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,KAAK,WAAmC,CAAC,GAAkC;AAC/E,UAAM,QAAQ,IAAI,gBAAgB,QAAQ,EAAE,SAAS;AACrD,WAAO,MAAM,KAAK;AAAA,MAChB;AAAA,MACA,gBAAgB,QAAQ,IAAI,KAAK,KAAK,EAAE;AAAA,IAC1C;AAAA,EACF;AAAA;AAAA;AAAA,EAIA,MAAM,cAAcC,YAAkD;AACpE,QAAI;AACF,YAAM,UAAU,MAAM,KAAK;AAAA,QACzB;AAAA,QACA,gBAAgB,mBAAmBA,UAAS,CAAC;AAAA,MAC/C;AACA,aAAO,EAAE,OAAO,QAAQ,QAAQ;AAAA,IAClC,SAAS,OAAO;AACd,UAAI,iBAAiB,uBAAuB,MAAM,SAAS,aAAa;AACtE,eAAO,EAAE,OAAO,OAAO;AAAA,MACzB;AACA,UAAI,iBAAiB,uBAAuB,MAAM,SAAS,gBAAgB;AACzE,eAAO,EAAE,OAAO,OAAO;AAAA,MACzB;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,OAAO,WAAkC;AAC7C,QAAI;AACF,YAAM,KAAK,QAAiB,UAAU,iBAAiB,mBAAmB,SAAS,CAAC,EAAE;AAAA,IACxF,SAAS,OAAO;AACd,UAAI,qBAAqB,KAAK,EAAG;AACjC,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA,EAIA,MAAM,WAAqC;AACzC,WAAO,MAAM,KAAK,QAAyB,OAAO,eAAe;AAAA,EACnE;AAAA,EAEA,MAAc,QAAW,QAAgB,MAAc,MAA4B;AACjF,QAAI;AACJ,aAAS,UAAU,GAAG,UAAU,KAAK,aAAa,WAAW,GAAG;AAC9D,UAAI,UAAU,EAAG,OAAM,KAAK,QAAQ,KAAK,IAAI,KAAO,MAAM,KAAK,OAAO,CAAC;AACvE,UAAI,KAAK,QAAQ,QAAS;AAC1B,UAAI;AACF,eAAO,MAAM,KAAK,QAAW,QAAQ,MAAM,IAAI;AAAA,MACjD,SAAS,OAAO;AACd,YAAI,EAAE,iBAAiB,wBAAwB,CAAC,MAAM,UAAW,OAAM;AACvE,oBAAY;AAAA,MACd;AAAA,IACF;AACA,UACE,aACA,IAAI,oBAAoB;AAAA,MACtB,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,SAAS,2BAA2B,MAAM,IAAI,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC;AAAA,IAClE,CAAC;AAAA,EAEL;AAAA;AAAA,EAGA,MAAc,QAAQ,IAA2B;AAC/C,UAAM,SAAS,KAAK;AACpB,QAAI,CAAC,OAAQ,QAAO,MAAM,KAAK,MAAM,EAAE;AACvC,QAAI,OAAO,QAAS;AACpB,QAAI;AACJ,UAAM,UAAU,IAAI,QAAc,CAACD,aAAY;AAC7C,gBAAU,MAAMA,SAAQ;AACxB,aAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAAA,IAC1D,CAAC;AACD,QAAI;AACF,YAAM,QAAQ,KAAK,CAAC,KAAK,MAAM,EAAE,GAAG,OAAO,CAAC;AAAA,IAC9C,UAAE;AACA,UAAI,QAAS,QAAO,oBAAoB,SAAS,OAAO;AAAA,IAC1D;AAAA,EACF;AAAA,EAEA,MAAc,QAAW,QAAgB,MAAc,MAA4B;AACjF,UAAM,QAAQ,KAAK,MAAM,GAAG,EAAE,CAAC;AAC/B,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,gBAAgB;AACxE,UAAM,UAAU,MAAY,WAAW,MAAM;AAC7C,SAAK,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAC9D,QAAI,KAAK,QAAQ,QAAS,YAAW,MAAM;AAI3C,UAAM,aAAa,CAAC,UAClB,IAAI,oBAAoB;AAAA,MACtB,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,SAAS,2BAA2B,MAAM,IAAI,KAAK;AAAA,MACnD,GAAI,UAAU,SAAY,CAAC,IAAI,EAAE,MAAM;AAAA,IACzC,CAAC;AACH,UAAM,QAAQ,IAAI,QAAe,CAAC,GAAG,WAAW;AAC9C,YAAM,OAAO,MAAY,OAAO,WAAW,CAAC;AAC5C,UAAI,WAAW,OAAO,QAAS,MAAK;AAAA,UAC/B,YAAW,OAAO,iBAAiB,SAAS,MAAM,EAAE,MAAM,KAAK,CAAC;AAAA,IACvE,CAAC;AACD,UAAM,MAAM,MAAM;AAAA,IAAC,CAAC;AACpB,UAAMD,YAAW,CAAC,aAChB,QAAQ,KAAK,CAAC,SAAS,KAAK,GAAG,KAAK,CAAC;AACvC,QAAI;AACF,UAAI;AACJ,UAAI;AACF,mBAAW,MAAM,QAAQ,KAAK;AAAA,UAC5B,KAAK,UAAU,GAAG,KAAK,OAAO,GAAG,IAAI,IAAI;AAAA,YACvC;AAAA,YACA,SAAS;AAAA,cACP,aAAa,KAAK;AAAA,cAClB,QAAQ;AAAA,cACR,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;AAAA,YACrE;AAAA,YACA,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,IAAI,EAAE;AAAA,YAC3D,QAAQ,WAAW;AAAA,UACrB,CAAC;AAAA,UACD;AAAA,QACF,CAAC;AAAA,MACH,SAAS,OAAO;AAGd,cAAM,iBAAiB,sBAAsB,QAAQ,WAAW,KAAK;AAAA,MACvE;AACA,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,MAAM,QAAQ,IAAI,MAAM,UAAU,UAAUA,SAAQ;AAC5D,cAAM,IAAI,oBAAoB;AAAA,UAC5B,MAAM,QAAQ,SAAS,QAAQ,IAAI;AAAA,UACnC,QAAQ,SAAS;AAAA,UACjB,SAAS,2BAA2B,MAAM,IAAI,KAAK,KAAK,OAAO;AAAA,QACjE,CAAC;AAAA,MACH;AACA,UAAI;AACJ,UAAI;AACF,eAAO,MAAMA,UAAS,QAAQ;AAAA,MAChC,SAAS,OAAO;AACd,cAAM,iBAAiB,sBAAsB,QAAQ,WAAW,KAAK;AAAA,MACvE;AACA,UAAI,CAAC,KAAM,QAAO;AAClB,UAAI;AACF,eAAO,KAAK,MAAM,IAAI;AAAA,MACxB,SAAS,OAAO;AACd,cAAM,IAAI,oBAAoB;AAAA,UAC5B,MAAM;AAAA,UACN,QAAQ,SAAS;AAAA,UACjB,SAAS,2BAA2B,MAAM,IAAI,KAAK;AAAA,UACnD,OAAO;AAAA,QACT,CAAC;AAAA,MACH;AAAA,IACF,UAAE;AACA,mBAAa,KAAK;AAClB,WAAK,QAAQ,oBAAoB,SAAS,OAAO;AAAA,IACnD;AAAA,EACF;AACF;;;AC7XO,SAAS,mBAAmB,SAA6C;AAC9E,SAAO,YAAY,gBAAgB,YAAY;AACjD;AAkDA,IAAI;AAGG,SAAS,qBAAqB,OAA4C;AAC/E,kBAAgB;AAClB;AAEO,SAAS,uBAA0C;AACxD,MAAI,CAAC,eAAe;AAClB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;;;ACxEA,SAAS,cAAAG,mBAAkB;AAC3B,SAAS,SAAAC,cAAa;AA8BtB,SAAS,iBAA4D;;;AC9CrE;AAAA,EACE;AAAA,EACA,WAAW;AAAA,EACX;AAAA,EACA;AAAA,OAMK;AA8CP,SAAS,cAAAC,aAAY,kBAAkB;AACvC,SAAS,SAAAC,QAAO,YAAY,eAAe,WAAAC,gBAAe;AAC1D,SAAS,aAAa;;;ACtCtB,SAAS,uBAAAC,4BAA2B;;;ACPpC;AAAA,EACE,uBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA,qBAAqB;AAAA,OAEhB;AAuFP;AAAA,EACE,sBAAAC;AAAA,OAEK;AArFA,IAAM,mCAAmC;AAyChD,eAAsB,gBACpB,QACA,OACiB;AACjB,QAAM,aAAa,MAAM,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACnE,QAAM,aAAa,MAAM,cAAc;AACvC,QAAM,UAAkC,mBAAmB,MAAM;AAAA,IAC/D,aAAa,MAAM,cAAc,eAAe,MAAM;AAAA,IACtD,WAAW,MAAM;AAAA,IACjB,UAAU,MAAM;AAAA,IAChB,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM,QAAQ;AAAA,IACpB,MAAM,MAAM,QAAQD;AAAA,IACpB,KAAK,aAAa;AAAA,IAClB,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,IACxD,GAAI,MAAM,iBAAiB,EAAE,gBAAgB,MAAM,eAAe,IAAI,CAAC;AAAA,IACvE,GAAI,MAAM,eACN,EAAE,SAAS,MAAM,aAAa,SAAS,WAAW,MAAM,aAAa,UAAU,IAC/E,CAAC;AAAA,EACP,CAAC;AACD,SAAO,gBAAgB,QAAQ,OAAO;AACxC;AAYA,eAAsB,kBACpB,QACA,OACA,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GACD;AACxC,SAAO,0BAA0B,QAAQ,OAAO,UAAU;AAC5D;;;ADlFA,SAAS,oBAAoB;AA+BtB,IAAM,6BAAN,cAAyC,MAAM;AAAA,EACpD,YACE,SACS,OACT;AACA,UAAM,OAAO;AAFJ;AAGT,SAAK,OAAO;AAAA,EACd;AACF;AA6CA,IAAM,qBAAuC,CAAC,MAAM,GAAG;AAYhD,SAAS,eAAe,UAAuC;AACpE,MACE,OAAO,SAAS,SAAS,YACzB,SAAS,KAAK,WAAW,KACzB,OAAO,SAAS,SAAS,UACzB;AACA,UAAM,IAAI;AAAA,MACR,6DAA6D,OAAO,SAAS,IAAI,CAAC,UAAU,OAAO,SAAS,IAAI,CAAC;AAAA,IACnH;AAAA,EACF;AACA,QAAM,MAAM,SAAS,OAAO;AAC5B,QAAM,SAAS,MAAM,QAAQ;AAC7B,QAAM,cAAc,MAAM,MAAM;AAEhC,QAAM,OACJ,SAAS,KAAK,SAAS,GAAG,KAAK,CAAC,SAAS,KAAK,WAAW,GAAG,IACxD,IAAI,SAAS,IAAI,MACjB,SAAS;AAIf,QAAM,UACJ,OAAO,SAAS,SAAS,YAAY,SAAS,KAAK,SAAS,IAAI,SAAS,OAAO;AAClF,QAAM,OAAO,QAAQ,WAAW,GAAG,IAAI,UAAU,IAAI,OAAO;AAC5D,QAAM,SACJ,SAAS,SAAS,cAAc,GAAG,MAAM,MAAM,IAAI,KAAK,GAAG,MAAM,MAAM,IAAI,IAAI,SAAS,IAAI;AAC9F,QAAM,YAAY,GAAG,MAAM,GAAG,IAAI;AAClC,QAAM,QAAQ,SAAS,SAAS;AAChC,SAAO,QAAQ,GAAG,SAAS,IAAI,KAAK,KAAK;AAC3C;AAQO,SAAS,oBAAoB,cAAkC,aAA6B;AACjG,MACE,OAAO,gBAAgB,YACvB,CAAC,YAAY,WAAW,GAAG,KAC3B,YAAY,SAAS,IAAI,KACzB,YAAY,SAAS,GAAG,KACxB,YAAY,SAAS,GAAG,GACxB;AACA,UAAM,IAAI,2BAA2B,sCAAsC;AAAA,EAC7E;AACA,QAAM,MAAM,OAAO,iBAAiB,YAAY,aAAa,SAAS,IAAI,eAAe;AACzF,QAAM,UAAU,IAAI,WAAW,GAAG,IAAI,MAAM,IAAI,GAAG,IAAI,QAAQ,SAAS,EAAE,KAAK;AAC/E,SAAO,GAAG,MAAM,GAAG,WAAW;AAChC;AAEA,IAAM,mCAAmC;AAEzC,IAAM,8BACJ;AACF,IAAM,kCAAkC;AASjC,SAAS,gCAAgC,MAAuB;AACrE,SAAO,iCAAiC,KAAK,IAAI;AACnD;AAEO,SAAS,8BAA8B,MAA+C;AAC3F,QAAM,aAAa,KAAK,WAAW,GAAG,IAAI,OAAO,IAAI,IAAI;AACzD,QAAM,QAAQ,4BAA4B,KAAK,UAAU;AACzD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,OAAO,OAAO,MAAM,CAAC,CAAC;AAC5B,MAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,MAAQ,QAAO;AACjE,QAAM,mBAAmB,OAAO,SAAS,MAAM,CAAC,GAAI,EAAE;AACtD,MAAI,CAAC,OAAO,cAAc,gBAAgB,KAAK,mBAAmB,EAAG,QAAO;AAC5E,SAAO;AAAA,IACL,WAAW,MAAM,CAAC;AAAA,IAClB;AAAA,IACA;AAAA,IACA,WAAW,MAAM,CAAC;AAAA,EACpB;AACF;AAEA,SAAS,wBAAwB,UAAuD;AACtF,MAAI,OAAO,aAAa,UAAU;AAChC,QAAI;AACF,aAAO,IAAI,IAAI,QAAQ,EAAE;AAAA,IAC3B,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO,OAAO,SAAS,SAAS,YAAY,SAAS,KAAK,SAAS,IAAI,SAAS,OAAO;AACzF;AAOO,SAAS,2BAA2B,UAAiD;AAC1F,QAAM,OAAO,wBAAwB,QAAQ;AAC7C,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,gCAAgC,IAAI,EAAG,QAAO;AAClD,MAAI,SAAS,OAAO,SAAS,GAAI,QAAO;AACxC,SAAO,8BAA8B,IAAI,MAAM;AACjD;AAEO,SAAS,0BAA0B,MAA6B;AACrE,QAAM,SAAS,8BAA8B,IAAI;AACjD,SAAO,SAAS,OAAO,mBAAmB,MAAO;AACnD;AAEO,SAAS,2BACd,MACA,QAAQ,KAAK,IAAI,GACjB,SAAS,iCACA;AACT,QAAM,YAAY,0BAA0B,IAAI;AAChD,MAAI,cAAc,KAAM,QAAO;AAC/B,SAAO,QAAQ,UAAU;AAC3B;AAGO,SAAS,+BAA+B,MAAsB;AACnE,SAAO,KAAK,QAAQ,2CAA2C,eAAe;AAChF;AAIO,SAAS,2BAA2B,OAAoC;AAC7E,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,UAAM,IAAI,2BAA2B,6CAA6C;AAAA,EACpF;AACA,MACG,OAAO,aAAa,SAAS,OAAO,aAAa,UAClD,OAAO,aAAa,MACpB,OAAO,aAAa,MACpB,OAAO,SAAS,MAChB,OAAO,aAAa,IACpB;AACA,UAAM,IAAI,2BAA2B,mDAAmD;AAAA,EAC1F;AACA,QAAM,MAAM,OAAO,aAAa;AAChC,QAAM,OAAO,OAAO,SAAS,KAAM,MAAM,MAAM,KAAM,OAAO,OAAO,IAAI;AACvE,MAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,OAAQ;AACxD,UAAM,IAAI,2BAA2B,8CAA8C;AAAA,EACrF;AACA,SAAO;AAAA,IACL,MAAM,OAAO;AAAA,IACb;AAAA,IACA;AAAA,IACA,MAAM,OAAO,YAAY;AAAA,IACzB,OAAO,OAAO,OAAO,WAAW,GAAG,IAAI,OAAO,OAAO,MAAM,CAAC,IAAI,OAAO;AAAA,EACzE;AACF;AAYA,eAAsB,iBACpB,SACA,OACiC;AACjC,QAAM,IAAI;AACV,QAAM,OAAO,MAAM,QAAQE;AAC3B,MAAI,OAAO,GAAG,uBAAuB,YAAY;AAC/C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AAIF,eAAW,MAAM,EAAE,mBAAmB,IAAI;AAAA,EAC5C,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,8CAA8C,IAAI,KAAK,aAAa,KAAK,CAAC;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AAEA,QAAM,MAAM,eAAe,QAAQ;AACnC,QAAM,aAAa,MAAM,cAAc;AACvC,QAAM,aAAa,MAAM,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACnE,QAAM,QAAQ,MAAM,gBAAgB,MAAM,mBAAmB;AAAA,IAC3D,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,IACjB,UAAU,MAAM;AAAA,IAChB,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM,QAAQ;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,IACxD,GAAI,MAAM,iBAAiB,EAAE,gBAAgB,MAAM,eAAe,IAAI,CAAC;AAAA,IACvE,GAAI,SAAS,eAAe,EAAE,cAAc,SAAS,aAAa,IAAI,CAAC;AAAA,EACzE,CAAC;AAED,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,WAAW,IAAI,MAAM,aAAa,cAAc,GAAI,EAAE,YAAY;AAAA,IAClE,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,YAAY,MAAM,cAAc;AAAA,IAChC,YAAY,MAAM;AAAA,EACpB;AACF;;;AEpVA,SAAS,6BAAkD;AAC3D,SAAS,yBAAyB;AAGlC,IAAM,0BAA0B,sBAAsB,UAAU;AAChE,IAAM,uBAAuB,oBAAI,QAAuD;AACxF,IAAM,kBAAkB,IAAI,kBAA0C;AAI/D,IAAM,kCAAN,cAA8C,MAAM;AAAA,EACzD,YACW,eACT,OACA;AACA;AAAA,MACE,gBACI,2CACA;AAAA,MACJ,EAAE,MAAM;AAAA,IACV;AARS;AAST,SAAK,OAAO;AAAA,EACd;AACF;AAEA,eAAsB,oCACpB,UACA,QACY;AACZ,QAAM,QAAQ,qBAAqB,IAAI,QAAQ;AAC/C,QAAM,UACJ,UAAU,UAAa,MAAM,QAAQ,SAAS,OAAO,MAAM,cAAc,SAAS;AACpF,QAAM,QAAQ,EAAE,WAAW,MAAM;AACjC,SAAO,MAAM,gBAAgB,IAAI,OAAO,YAAY;AAClD,QAAI;AACF,aAAO,MAAM,OAAO;AAAA,IACtB,SAAS,OAAO;AAId,YAAM,IAAI,gCAAgC,WAAW,CAAC,MAAM,WAAW,KAAK;AAAA,IAC9E;AAAA,EACF,CAAC;AACH;AAIO,IAAM,gCAAN,cAA4C,MAAM;AAAA,EACvD,YAAY,SAAiB,OAAiB;AAC5C,UAAM,4CAA4C,OAAO,IAAI,EAAE,MAAM,CAAC;AACtE,SAAK,OAAO;AAAA,EACd;AACF;AAIA,gBAAgB,UAAU,QAAiD;AACzE,QAAMC,WAAU,IAAI,YAAY,SAAS,EAAE,OAAO,MAAM,WAAW,KAAK,CAAC;AACzE,MAAI,QAAsB,CAAC;AAC3B,MAAI,SAAS;AACb,MAAI,QAAQ;AACZ,QAAM,SAAS,MAAM;AACnB,QAAI,OAAOA,SAAQ,OAAO,OAAO,OAAO,KAAK,CAAC;AAC9C,YAAQ,CAAC;AACT,QAAI,MAAO,QAAO,KAAK,QAAQ,YAAY,EAAE;AAC7C,YAAQ;AACR,WAAO;AAAA,EACT;AACA,SAAO,MAAM;AACX,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,QAAI,KAAM;AACV,QAAI,QAAQ;AACZ,aAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,YAAM,OAAO,MAAM,KAAK;AACxB,UAAI,QAAQ;AACV,iBAAS;AACT,YAAI,SAAS,IAAI;AACf,kBAAQ,QAAQ;AAChB;AAAA,QACF;AAAA,MACF;AACA,UAAI,SAAS,MAAM,SAAS,GAAI;AAChC,YAAM,KAAK,MAAM,SAAS,OAAO,KAAK,CAAC;AACvC,YAAM,EAAE,MAAM,OAAO,GAAG,YAAY,KAAK;AACzC,eAAS,SAAS;AAClB,cAAQ,QAAQ;AAAA,IAClB;AACA,QAAI,QAAQ,MAAM,OAAQ,OAAM,KAAK,MAAM,SAAS,KAAK,CAAC;AAAA,EAC5D;AACA,MAAI,MAAM,OAAQ,OAAM,EAAE,MAAM,OAAO,GAAG,YAAY,MAAM;AAC9D;AAKA,SAAS,mBAAmB,OAAsB;AAChD,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK;AAC5D,UAAM,IAAI,MAAM,gCAAgC;AAClD,QAAM,QAAQ;AACd,MAAI,aAAa;AACjB,aAAW,CAAC,SAAS,KAAK,KAAK;AAAA,IAC7B,CAAC,SAAS,MAAM;AAAA,IAChB,CAAC,UAAU,OAAO;AAAA,EACpB,GAAY;AACV,eAAW,SAAS,CAAC,SAAS,KAAK,GAAG;AACpC,UAAI,MAAM,KAAK,MAAM,OAAW;AAChC,mBAAa;AACb,UAAI,OAAO,MAAM,KAAK,MAAM,SAAU,OAAM,IAAI,MAAM,6BAA6B;AAAA,IACrF;AACA,QACE,MAAM,OAAO,MAAM,UACnB,MAAM,KAAK,MAAM,UACjB,MAAM,OAAO,MAAM,MAAM,KAAK;AAE9B,YAAM,IAAI,MAAM,qCAAqC;AAAA,EACzD;AACA,MAAI,MAAM,cAAc,QAAW;AACjC,iBAAa;AACb,QAAI,CAAC,MAAM,QAAQ,MAAM,SAAS,KAAK,MAAM,UAAU,KAAK,CAAC,SAAS,OAAO,SAAS,QAAQ;AAC5F,YAAM,IAAI,MAAM,iCAAiC;AAAA,EACrD;AACA,MAAI,CAAC,WAAY,OAAM,IAAI,MAAM,yBAAyB;AAC5D;AAEA,gBAAgB,cAAc,UAAgD;AAC5E,MAAI,CAAC,SAAS,KAAM,OAAM,IAAI,8BAA8B,uBAAuB;AACnF,QAAM,SAAS,SAAS,KAAK,UAAU;AACvC,QAAMC,WAAU,IAAI,YAAY;AAChC,MAAI,OAAiB,CAAC;AACtB,MAAI,cAA6B;AACjC,MAAI,YAAY;AAChB,MAAI,MAAM;AAEV,MAAI,OAAgC;AACpC,QAAMC,SAAQ,CAAC,SAAiB;AAC9B,UAAM,QAAiB,KAAK,MAAM,IAAI;AACtC,QAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK;AAC5D,YAAM,IAAI,MAAM,gCAAgC;AAClD,UAAM,QAAQ;AACd,QAAI,OAAO,MAAM,SAAS,SAAU,OAAM,IAAI,MAAM,4BAA4B;AAChF,QAAI,MAAM,SAAS,QAAQ;AACzB,UAAI,OAAO,MAAM,SAAS,YAAY,CAAC,MAAM,KAAK,KAAK;AACrD,cAAM,IAAI,MAAM,4BAA4B;AAC9C,UAAI,gBAAgB,QAAQ,MAAM,SAAS;AACzC,cAAM,IAAI,MAAM,kCAAkC;AACpD,oBAAc,MAAM;AAAA,IACtB;AACA,eAAW,SAAS,CAAC,MAAM,gBAAgB,aAAa,GAAY;AAClE,UAAI,MAAM,KAAK,MAAM,UAAa,MAAM,KAAK,MAAM;AACjD,cAAM,IAAI,MAAM,8BAA8B;AAAA,IAClD;AACA,SAAK,MAAM,SAAS,YAAY,MAAM,SAAS,aAAa,OAAO,MAAM,SAAS;AAChF,YAAM,IAAI,MAAM,wBAAwB;AAC1C,QAAI,MAAM,SAAS,QAAS,oBAAmB,MAAM,KAAK;AAC1D,QAAI,MAAM,SAAS,sBAAsB;AACvC,UAAI,gBAAgB,KAAM,OAAM,IAAI,MAAM,uCAAuC;AACjF,kBAAY;AAAA,IACd;AAGA,WAAOD,SAAQ,OAAO,SAAS,KAAK,UAAU,KAAK,CAAC;AAAA;AAAA,CAAM;AAAA,EAC5D;AACA,MAAI;AACF,qBAAiB,EAAE,MAAM,WAAW,KAAK,UAAU,MAAM,GAAG;AAC1D,UAAI,SAAS,QAAQ,QAAQ,CAAC,KAAK,WAAW,GAAG;AAC/C,eAAO,KAAK,UAAU,EAAE,WAAW,GAAG,IAAI,WAAW;AACvD,UAAI,SAAS,UAAU;AACrB,YAAI,KAAK,KAAK,EAAG,OAAMC,OAAM,IAAI;AACjC;AAAA,MACF;AACA,UAAI,CAAC,cAAc,QAAQ,CAAC,KAAK,WAAW,GAAG,EAAG,OAAM,IAAI,MAAM,oBAAoB;AACtF,UAAI,SAAS,IAAI;AACf,YAAI,KAAK,QAAQ;AACf,gBAAM,OAAO,KAAK,KAAK,IAAI;AAC3B,iBAAO,CAAC;AACR,gBAAMA,OAAM,IAAI;AAAA,QAClB;AACA;AAAA,MACF;AACA,UAAI,KAAK,WAAW,GAAG,EAAG;AAC1B,YAAM,QAAQ,KAAK,QAAQ,GAAG;AAC9B,YAAM,QAAQ,UAAU,KAAK,OAAO,KAAK,MAAM,GAAG,KAAK;AACvD,YAAM,QAAQ,UAAU,KAAK,KAAK,KAAK,MAAM,QAAQ,CAAC,EAAE,QAAQ,OAAO,EAAE;AACzE,UAAI,UAAU,OAAQ,MAAK,KAAK,KAAK;AAAA,IAEvC;AACA,UAAM;AACN,QAAI,KAAK,OAAQ,OAAM,IAAI,MAAM,qBAAqB;AACtD,QAAI,CAAC,UAAW,OAAM,IAAI,MAAM,gCAAgC;AAAA,EAClE,SAAS,OAAO;AACd,UAAM,iBAAiB,gCACnB,QACA,IAAI,8BAA8B,gCAAgC,KAAK;AAAA,EAC7E,UAAE;AACA,QAAI,CAAC,IAAK,OAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AACrD,WAAO,YAAY;AAAA,EACrB;AACF;AAEA,SAAS,mBAAmB,UAAsC;AAChE,QAAM,UAAW,OAAO,OAAO,SAAS;AACtC,UAAM,MAAM,iBAAiB,UAAU,MAAM,MAAM,OAAO,KAAK;AAC/D,UAAM,aACH,MAAM,WAAW,iBAAiB,UAAU,MAAM,SAAS,QAAQ,YAAY,MAC9E,UAAU,IAAI,IAAI,GAAG,EAAE,SAAS,SAAS,UAAU;AAGvD,UAAM,WAAW,gBAAgB,SAAS;AAC1C,QAAI,aAAa,SAAU,UAAS,YAAY;AAChD,UAAM,WAAW,MAAM,SAAS,OAAO,IAAI;AAC3C,QAAI,CAAC,SAAS,MAAM,CAAC,UAAW,QAAO;AACvC,QAAI,CAAC,SAAS,KAAM,OAAM,IAAI,8BAA8B,uBAAuB;AACnF,UAAM,SAAS,cAAc,QAAQ;AACrC,UAAM,OAAO,IAAI;AAAA,MACf;AAAA,QACE,MAAM,KAAK,YAAY;AACrB,cAAI;AACF,kBAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,gBAAI,KAAK,KAAM,YAAW,MAAM;AAAA,gBAC3B,YAAW,QAAQ,KAAK,KAAK;AAAA,UACpC,SAAS,OAAO;AACd,uBAAW,MAAM,KAAK;AAAA,UACxB;AAAA,QACF;AAAA,QACA,MAAM,SAAS;AACb,gBAAM,OAAO,OAAO,MAAS;AAAA,QAC/B;AAAA,MACF;AAAA;AAAA,MAEA,EAAE,eAAe,EAAE;AAAA,IACrB;AACA,UAAM,UAAU,IAAI,QAAQ,SAAS,OAAO;AAC5C,YAAQ,OAAO,gBAAgB;AAC/B,YAAQ,OAAO,kBAAkB;AACjC,YAAQ,IAAI,gBAAgB,mBAAmB;AAC/C,WAAO,IAAI,SAAS,MAAM;AAAA,MACxB,QAAQ,SAAS;AAAA,MACjB,YAAY,SAAS;AAAA,MACrB;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAIO,SAAS,kCAAkC,SAAyC;AACzF,SAAO;AAAA,IACL,sBAAsB,CAAC,YAAY,QAAQ,qBAAqB,OAAO;AAAA,IACvE,mBAAmB,CAAC,YAAY,QAAQ,kBAAkB,OAAO;AAAA,IACjE,iBAAiB,SAAS;AACxB,YAAM,WAAW,mBAAmB,QAAQ,iBAAiB,QAAQ;AACrE,YAAM,mBAAmB,QAAQ;AACjC,YAAM,QAAQ,iBAAiB,KAAK,SAAS;AAAA,QAC3C,GAAG;AAAA,QACH,kBAAkB,IAAI,MAAM,QAAQ,kBAAkB;AAAA,UACpD,IAAI,QAAQ,UAAU;AACpB,mBAAO,aAAa,aAAa,WAAW,QAAQ,IAAI,QAAQ,UAAU,MAAM;AAAA,UAClF;AAAA,QACF,CAAC;AAAA,MACH,CAAC;AACD,UAAI,qBAAqB,yBAAyB;AAGhD,6BAAqB,IAAI,MAAM,UAAU;AAAA,UACvC,KAAK,MAAM,SAAS;AAAA,UACpB,WAAW,MAAM,SAAS;AAAA,QAC5B,CAAC;AAAA,MACH;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;AHlMA,SAAS,gBAAAC,qBAAoB;AAE7B,IAAM,iBAAiB;AACvB,IAAM,eAAe;AACrB,IAAM,gBAAgB;AACtB,IAAM,wBAAwB,CAAC,cAAc,aAAa;AAC1D,IAAM,6BAA6B;AAInC,IAAM,8BAA8B;AACpC,IAAM,oCAAoC;AAC1C,IAAM,4BAA4B;AAOlC,IAAI;AAEG,SAAS,wBAAwB,IAAgC;AACtE,sBAAoB;AACtB;AA8EA,SAAS,iBAAiB,OAAuB;AAC/C,QAAM,MAAM,IAAI,IAAI,KAAK;AACzB,MAAI,OAAO;AACX,MAAI,SAAS;AACb,MAAI,WAAW,IAAI,SAAS,QAAQ,SAAS,EAAE;AAC/C,SAAO,IAAI,SAAS,EAAE,QAAQ,QAAQ,EAAE;AAC1C;AAEA,SAAS,oBAAoB,SAAyB;AACpD,SAAOC,YAAW,QAAQ,EAAE,OAAO,iBAAiB,OAAO,CAAC,EAAE,OAAO,KAAK;AAC5E;AAEA,SAAS,kBAAkB,OAA0D;AACnF,SAAO;AAAA,IACL,QAAQ,iBAAiB,MAAM,OAAO;AAAA,IACtC,QAAQ,MAAM;AAAA,IACd,uBAAuB,MAAM;AAAA,IAC7B,gBAAgB,MAAM;AAAA,IACtB,gBAAgB;AAAA,EAClB;AACF;AAEA,eAAe,cACb,SACA,IACY;AACZ,QAAM,aAAa,IAAI,iBAAiB,kBAAkB,OAAO,CAAC,EAAE,uBAAuB;AAC3F,MAAI;AACF,UAAM,UAAU,QAAQ,kBAAkB,4BAA4B;AACtE,UAAM,QAAQ,QAAQ,qBAAqB;AAAA,MACzC,kBAAkB;AAAA,MAClB,kBAAkB,WAAW,WAAW;AAAA,IAC1C,CAAC;AACD,WAAO,MAAM,GAAG,MAAM,SAAS;AAAA,EACjC,UAAE;AACA,UAAM,WAAW,eAAe;AAAA,EAClC;AACF;AAEA,SAAS,WAAW,OAAyB;AAC3C,SAAO,iBAAiB,uBAAuB,MAAM,eAAe;AACtE;AAEA,SAAS,6BACP,MACA,WACM;AACN,QAAM,QAAQ,KAAK,QAAQ;AAC3B,MAAI,UAAU,aAAa,UAAU,YAAY;AAC/C,UAAM,IAAI,2CAA2C,eAAe,SAAS;AAAA,EAC/E;AACF;AAEA,SAAS,yBAAyB,OAAgD;AAChF,SAAO;AAAA,IACL,GAAG,IAAI;AAAA,OACJ,SAAS,CAAC,GAAG,OAAO,CAAC,SAAS,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,QAAQ,KAAM;AAAA,IACrF;AAAA,EACF,EAAE,KAAK,CAAC,MAAM,UAAU,OAAO,KAAK;AACtC;AAEA,SAAS,iBAAiB,MAAiE;AACzF,MAAI,KAAK,YAAa,KAAK,SAAgC,SAAS,QAAQ;AAC1E,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,2BACP,SACA,OACM;AACN,MAAI;AACF,aAAS,8BAA8B,KAAK;AAAA,EAC9C,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,cACP,SACA,aACsB;AACtB,QAAM,SAA+B;AAAA,IACnC,SAAS,QAAQ;AAAA,IACjB,KAAK;AAAA,IACL,UAAU,EAAE,UAAU,QAAQ,SAAS,cAAc;AAAA,IACrD,gBAAgB,QAAQ;AAAA,IACxB,kBAAkB,QAAQ;AAAA,IAC1B,GAAI,QAAQ,kBAAkB,EAAE,cAAc,KAAK,IAAI,CAAC;AAAA,EAC1D;AACA,MAAI,QAAQ,SAAS;AACnB,WAAO;AAAA,MACL,GAAG;AAAA,MACH,YAAY,EAAE,SAAS,QAAQ,QAAQ;AAAA,IACzC;AAAA,EACF;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,EAAE,KAAK,QAAQ,MAAM;AAAA,IAC5B,YAAY,CAAC,QAAQ,MAAM,WAAW;AAAA,EACxC;AACF;AAEA,SAAS,iBAAiB,OAAgB,OAAuB;AAC/D,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,GAAG;AAC1D,UAAM,IAAI,mBAAmB,eAAe,yBAAyB,KAAK,aAAa;AAAA,EACzF;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,OAAgB,OAA8B;AACzE,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,SAAO,iBAAiB,OAAO,KAAK;AACtC;AASA,SAAS,2BACP,OACA,SACM;AACN,MAAI,MAAM,wBAAwB,oBAAoB,QAAQ,OAAO,GAAG;AACtE,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,qBAAqB,UAA2B;AACvD,SAAO,sBAAsB,KAAK,CAAC,SAAS,aAAa,QAAQ,SAAS,WAAW,GAAG,IAAI,GAAG,CAAC;AAClG;AAEA,SAAS,cAAc,MAAc,UAAsC,CAAC,GAAW;AACrF,QAAM,MAAM,KAAK,KAAK;AACtB,MAAI,IAAI,SAAS,IAAI,KAAK,IAAI,SAAS,IAAI,GAAG;AAC5C,UAAM,IAAI,0BAA0B,6BAA6B,IAAI,EAAE;AAAA,EACzE;AACA,QAAM,WAAW,IAAI,WAAW,GAAG,IAAI,MAAM,UAAU,GAAG,IAAI,MAAM,KAAK,gBAAgB,GAAG;AAC5F,QAAM,UACJ,aAAa,kBACb,SAAS,WAAW,GAAG,cAAc,GAAG,KACvC,QAAQ,iBAAiB,QAAQ,qBAAqB,QAAQ;AACjE,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR,qCAAqC,cAAc,GAAG,QAAQ,eAAe,OAAO,sBAAsB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,IAAI;AAAA,IACxI;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,MAAsB;AAClD,QAAM,WAAW,cAAc,IAAI;AACnC,SAAO,aAAa,iBAAiB,KAAK,SAAS,MAAM,eAAe,SAAS,CAAC;AACpF;AAEA,SAAS,uBAAuB,OAAiC;AAC/D,MAAI,OAAO,KAAK,GAAG;AACjB,UAAM,IAAI;AAAA,MACR,8DAA8D,MAAM,KAAK,CAAC;AAAA,IAC5E;AAAA,EACF;AACF;AAEA,SAAS,eAAe,MAA+B;AACrD,QAAM,iBAAiB,KAAK,OAAO,KAAK;AACxC,MAAI,CAAC,eAAgB,QAAO,KAAK;AACjC,SAAO,GAAG,WAAW,cAAc,CAAC,GAAG,KAAK,UAAU,QAAQ,KAAK,KAAK,OAAO,WAAW,KAAK,GAAG,CAAC;AACrG;AAEA,SAAS,MAAM,IAA2B;AACxC,SAAO,IAAI,QAAQ,CAACC,aAAY,WAAWA,UAAS,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;AACtE;AAEA,SAAS,qBAAqBC,UAU5B;AACA,QAAM,SAASA,SAAQ,OAAO,MAAMA,SAAQ,MAAM;AAClD,EAAAA,SAAQ,SAASA,SAAQ,OAAO;AAChC,QAAM,gBAAgB,OACnB,OAAO,CAAC,UAAU,MAAM,WAAW,YAAY,MAAM,kBAAkB,KAAK,EAC5E,IAAI,CAAC,UAAU,MAAM,IAAI,EACzB,KAAK,EAAE;AACV,QAAM,gBAAgB,OACnB,OAAO,CAAC,UAAU,MAAM,WAAW,YAAY,MAAM,kBAAkB,KAAK,EAC5E,IAAI,CAAC,UAAU,MAAM,IAAI,EACzB,KAAK,EAAE;AACV,QAAM,WAAW,EAAE,GAAGA,SAAQ,aAAa;AAC3C,EAAAA,SAAQ,aAAa,UAAU,OAAO,WAAW,aAAa;AAC9D,EAAAA,SAAQ,aAAa,UAAU,OAAO,WAAW,aAAa;AAC9D,SAAO;AAAA,IACL,QAAQ,OAAO,IAAI,CAAC,UAAU,MAAM,IAAI,EAAE,KAAK,EAAE;AAAA,IACjD,QAAQ,OACL,OAAO,CAAC,UAAU,MAAM,WAAW,QAAQ,EAC3C,IAAI,CAAC,UAAU,MAAM,IAAI,EACzB,KAAK,EAAE;AAAA,IACV,QAAQ,OACL,OAAO,CAAC,UAAU,MAAM,WAAW,QAAQ,EAC3C,IAAI,CAAC,UAAU,MAAM,IAAI,EACzB,KAAK,EAAE;AAAA,IACV;AAAA,IACA;AAAA,IACA,cAAc,EAAE,UAAU,MAAM,EAAE,GAAGA,SAAQ,aAAa,EAAE;AAAA,EAC9D;AACF;AAEA,SAAS,gBAAgB,OAA8B;AACrD,SAAO,UAAU,OAAO,OAAO,OAAO,KAAK;AAC7C;AAEO,SAAS,uBAA+B;AAC7C,SAAO,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAoHhB;AAEO,IAAM,qBAAN,MAAyB;AAAA,EACrB,YAAY;AAAA,EACZ;AAAA,EACQ;AAAA,EACjB,IAAI,6BAAsC;AACxC,WAAO,KAAK,QAAQ,oBAAoB;AAAA,EAC1C;AAAA,EACA,IAAI,iBAAkD;AACpD,WAAO,KAAK,QAAQ;AAAA,EACtB;AAAA,EACQ,WAAmC;AAAA,EACnC,eAAgD;AAAA,EAChD;AAAA,EACA,gBAAgB;AAAA,EACP,qBAAqB,oBAAI,IAA6B;AAAA,EACtD,kBAAkB,oBAAI,IAA6B;AAAA,EACnD,qBAAqB,oBAAI,QAAwC;AAAA,EACjE,uBAAuB,oBAAI,QAAyB;AAAA,EACpD,qBAAqB,oBAAI,IAAoC;AAAA,EAE9E,YAAY,MAIT;AACD,SAAK,QAAQ,KAAK;AAClB,SAAK,UAAU,KAAK;AACpB,SAAK,iBAAiB,KAAK,aAAa;AAAA,EAC1C;AAAA,EAEA,iBAAiB,QAA4C;AAC3D,iCAA6B,MAAM;AACnC,SAAK,gBAAgB;AAAA,EACvB;AAAA,EAEA,MAAc,gBAA0C;AACtD,QAAI,KAAK,SAAU,QAAO,KAAK;AAC/B,QAAI,CAAC,KAAK,cAAc;AACtB,WAAK,eAAe,gBAAgB,QAAQ;AAAA,QAC1C,kBAAkB,kBAAkB,KAAK,OAAO;AAAA,QAChD,WAAW,KAAK,MAAM;AAAA,QACtB,qBAAqB,KAAK,QAAQ;AAAA,QAClC,gBAAgB;AAAA,UACd,KAAK,QAAQ,kBAAkB,4BAA4B;AAAA,QAC7D;AAAA,MACF,CAAC,EACE,KAAK,OAAO,aAAa;AACxB,cAAM,OAAO,MAAM,SAAS,QAAQ;AACpC,qCAA6B,MAAM,KAAK,MAAM,SAAS;AACvD,YAAI,KAAK,OAAO,KAAK,MAAM,WAAW;AACpC,gBAAM,SAAS,MAAM,EAAE,MAAM,MAAM,MAAS;AAC5C,gBAAM,IAAI,qBAAqB,qDAAqD;AAAA,YAClF,mBAAmB,KAAK,MAAM;AAAA,YAC9B,iBAAiB,KAAK;AAAA,UACxB,CAAC;AAAA,QACH;AACA,cAAM,QAAQ,KAAK,OAAO;AAG1B,cAAM,wBACJ,UAAU,KAAK,MAAM,YAAY,QAAQ,UAAU,aAAa,QAAQ;AAC1E,YAAI,yBAAyB,0BAA0B,KAAK,MAAM,OAAO;AACvE,gBAAM,SAAS,MAAM,EAAE,MAAM,MAAM,MAAS;AAC5C,gBAAM,IAAI,qBAAqB,uDAAuD;AAAA,YACpF,WAAW,KAAK,MAAM;AAAA,UACxB,CAAC;AAAA,QACH;AACA,cAAM,UACJ,KAAK,cAAc,OAAO,KAAK,WAAW,YAAY,WAClD,KAAK,WAAW,UAChB;AACN,YAAI,YAAY,QAAQ,YAAY,KAAK,MAAM,SAAS;AACtD,gBAAM,SAAS,MAAM,EAAE,MAAM,MAAM,MAAS;AAC5C,gBAAM,IAAI,qBAAqB,sDAAsD;AAAA,YACnF,WAAW,KAAK,MAAM;AAAA,UACxB,CAAC;AAAA,QACH;AACA,aAAK,WAAW;AAChB,aAAK,MAAM,YAAY,KAAK,WAAW,YAAY,KAAK,KAAK,MAAM;AACnE,eAAO;AAAA,MACT,CAAC,EACA,MAAM,CAAC,UAAU;AAChB,aAAK,eAAe;AACpB,YAAI,WAAW,KAAK,GAAG;AACrB,gBAAM,IAAI;AAAA,YACR;AAAA,YACA,KAAK,MAAM;AAAA,UACb;AAAA,QACF;AACA,cAAM;AAAA,MACR,CAAC;AAAA,IACL;AACA,WAAO,MAAM,KAAK;AAAA,EACpB;AAAA,EAEA,MAAM,QAAuB;AAC3B,UAAM,KAAK,kCAAkC;AAAA,EAC/C;AAAA,EAEA,MAAM,UAA4B;AAChC,QAAI;AACF,aAAO,MAAM,cAAc,KAAK,SAAS,OAAO,cAAc;AAC5D,cAAM,OAAO,MAAM,UAAU,WAAW,KAAK,MAAM,SAAS;AAC5D,eAAO,KAAK,MAAM,kBAAkB,KAAK,OAAO,UAAU;AAAA,MAC5D,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,WAAW,KAAK,EAAG,QAAO;AAC9B,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,kBAA0C;AAC9C,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,QAAQ,aAAa,GAAI,EAAE,YAAY;AACpF,UAAM,WAAW,MAAM;AAAA,MACrB,KAAK;AAAA,MACL,OAAO,cACL,MAAM,UAAU,uBAAuB,KAAK,MAAM,WAAW;AAAA,QAC3D;AAAA,MACF,CAAC;AAAA,IACL;AACA,SAAK,MAAM,YAAY,SAAS,WAAW,YAAY,KAAK;AAC5D,WAAO,KAAK,MAAM;AAAA,EACpB;AAAA,EAEA,MAAM,SAAwB;AAC5B,QAAI;AACF,YAAM,cAAc,KAAK,SAAS,OAAO,cAAc;AACrD,cAAM,UAAU,cAAc,KAAK,MAAM,SAAS;AAAA,MACpD,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,CAAC,WAAW,KAAK,EAAG,OAAM;AAAA,IAChC,UAAE;AACA,YAAM,KAAK,MAAM;AAAA,IACnB;AAAA,EACF;AAAA,EAEA,MAAM,QAAuB;AAC3B,UAAM,WAAW,KAAK;AACtB,SAAK,WAAW;AAChB,SAAK,eAAe;AACpB,QAAI,SAAU,OAAM,SAAS,MAAM;AAAA,EACrC;AAAA,EAEA,cAAuB;AACrB,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,+BAA4D;AAChE,WAAO;AAAA,EACT;AAAA;AAAA;AAAA,EAIA,4BAA4B,QAAgD;AAC1E,WAAO,OAAO,WAAW,WACpB,KAAK,mBAAmB,IAAI,MAAM,KAAK,OACxC,UAAU,OAAO,WAAW,WACzB,KAAK,mBAAmB,IAAI,MAAM,KAAK,OACxC;AAAA,EACR;AAAA,EAEA,MAAM,yBAAyB,QAA+B;AAC5D,UAAM,OAAO,KAAK,mBAAmB,IAAI,MAAM;AAC/C,QAAI,QAAQ,CAAC,KAAK,sBAAuB,MAAK,mBAAmB,OAAO,MAAM;AAAA,EAChF;AAAA,EAEQ,cACNA,UACA,UACA,QACmB;AACnB,QAAI,kBAAkBA,SAAS,MAAK,qBAAqB,IAAI,QAAQA,SAAQ,YAAY;AACzF,SAAK,mBAAmB,IAAI,QAAQ;AAAA,MAClC,QAAQ,SAAS;AAAA,MACjB,QAAQ,SAAS;AAAA,MACjB,UAAU,OAAO,cAAc,OAAO,QAAQ,IAAI,OAAO,WAAY;AAAA,MACrE,GAAI,OAAO,cAAc,SAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;AAAA,MACxE,iBAAiB,OAAO;AAAA,MACxB,GAAIA,SAAQ,oBAAoB,EAAE,uBAAuB,KAAK,IAAI,CAAC;AAAA,MACnE,cAAc;AAAA,QACZ,UAAU,KAAK,UAAU,CAAC,KAAK,MAAM,WAAWA,SAAQ,IAAI,CAAC;AAAA,QAC7D,GAAG,SAAS;AAAA,MACd;AAAA,IACF,CAAC;AACD,WAAO;AAAA,EACT;AAAA,EAEQ,cAAc,QAAmC;AACvD,QAAI,SAAS,mBAAmB,MAAM;AACtC,UAAM,OAAO,KAAK,mBAAmB,IAAI,MAAM;AAC/C,QAAI,MAAM;AAGR,aAAO,KAAK,mBAAmB,IAAI,MAAM,EAAG,UAAS,mBAAmB,MAAM;AAC9E,WAAK,mBAAmB,IAAI,QAAQ,IAAI;AAAA,IAC1C;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,oCAAmD;AAC/D,UAAM,WAAW,MAAM,KAAK,cAAc;AAC1C,QAAI,KAAK,MAAM,eAAgB;AAC/B,UAAM,SAAS,MAAM,kBAAkB,CAAC,EAAE,MAAM,eAAe,CAAC,CAAC;AACjE,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,KAAK,MAAM,SAAS,OAAO,GAAG;AACvE,YAAM,KAAK,YAAY,MAAM,KAAK;AAAA,IACpC;AACA,SAAK,MAAM,iBAAiB;AAAA,EAC9B;AAAA,EACQ,aAAa,MAAwC;AAC3D,UAAM,OAAO,gBAAgB,KAAK,QAAQ,WAAW,CAAC;AACtD,QAAI;AACJ,UAAM,mBAAmB,IAAI,QAAuB,CAACD,aAAY;AAC/D,2BAAqBA;AAAA,IACvB,CAAC;AACD,UAAMC,WAA2B;AAAA,MAC/B;AAAA,MACA,WAAW;AAAA,MACX,UAAU;AAAA,MACV,iBAAiB;AAAA,MACjB,WAAW,KAAK,IAAI;AAAA,MACpB,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,MACR,aAAa;AAAA,MACb;AAAA,MACA;AAAA,MACA,WAAW,QAAQ,QAAQ,EAAE,UAAU,EAAE,CAAC;AAAA,MAC1C,SAAS;AAAA,MACT,oBAAoB;AAAA,MACpB,mBAAmB;AAAA,MACnB,cAAc,EAAE,QAAQ,GAAG,QAAQ,EAAE;AAAA,IACvC;AACA,QAAI,iBAAiB;AACrB,SAAK,gBAAgB,IAAI,MAAMA,QAAO;AAGtC,2CAAuC;AAAA,MACrC,mBAAmB,OAAO,kBAAkB;AAC1C,aAAK,wBAAwBA,UAAS,aAAa;AACnD,eAAO,MAAM,KAAK,sBAAsBA,QAAO;AAAA,MACjD;AAAA,MACA,oBAAoB,OAAO,kBAAkB;AAC3C,aAAK,wBAAwBA,UAAS,aAAa;AACnD,eAAO,MAAM,KAAK,uBAAuBA,QAAO;AAAA,MAClD;AAAA,IACF,CAAC;AACD,IAAAA,SAAQ,YAAY,KAAK,kCAAkC,EACxD,KAAK,YAAY;AAChB,YAAM,WAAW,MAAM,KAAK,cAAc;AAC1C,MAAAA,SAAQ,WAAW;AACnB,uBAAiB;AACjB,YAAM,YAAY,MAAM;AAAA,QAAoC,SAAS;AAAA,QAAU,MAC7E,SAAS,SAAS;AAAA,UAChB,eAAe,IAAI;AAAA,UACnB;AAAA,YACE,kBAAkB,KAAK,UAAU,cAAc,KAAK,OAAO,IAAI;AAAA,YAC/D,MAAM,KAAK,MAAM;AAAA,UACnB;AAAA,UACA;AAAA,YACE,QAAQ,CAAC,SAAS;AAChB,mBAAK,sBAAsBA,UAAS,KAAK,EAAE;AAAA,YAC7C;AAAA,YACA,SAAS,CAAC,UAAU;AAClB,kBAAI,CAAC,SAAS,OAAO,UAAU,SAAU;AACzC,oBAAM,SAAS;AACf,kBAAI,OAAO,SAAS,OAAQ,MAAK,sBAAsBA,UAAS,OAAO,IAAI;AAC3E,yBAAW,SAAS,CAAC,MAAM,gBAAgB,aAAa,GAAY;AAClE,oBAAI,OAAO,KAAK,MAAM,UAAa,OAAO,KAAK,MAAMA,SAAQ;AAC3D,wBAAM,IAAI,qBAAqB,6CAA6C;AAAA,cAChF;AAAA,YACF;AAAA,YACA,UAAU,CAAC,YAAY;AACrB,cAAAA,SAAQ,OAAO,KAAK,EAAE,QAAQ,UAAU,MAAM,QAAQ,KAAK,CAAC;AAAA,YAC9D;AAAA,YACA,UAAU,CAAC,YAAY;AACrB,cAAAA,SAAQ,OAAO,KAAK,EAAE,QAAQ,UAAU,MAAM,QAAQ,KAAK,CAAC;AAAA,YAC9D;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,WAAK,sBAAsBA,UAAS,UAAU,EAAE;AAChD,YAAM,WAAW,UAAU;AAC3B,UAAI,CAAC,UAAU,YAAY,CAAC,OAAO,cAAc,QAAQ,GAAG;AAG1D,QAAAA,SAAQ,oBAAoB;AAC5B,QAAAA,SAAQ,qBAAqB;AAC7B,eAAO,EAAE,UAAU,MAAM,WAAW,KAAK;AAAA,MAC3C;AACA,YAAM,UAAU;AAAA,QACd;AAAA,QACA,GAAI,UAAU,QAAQ,EAAE,OAAO,UAAU,MAAM,IAAI,CAAC;AAAA,MACtD;AACA,MAAAA,SAAQ,kBAAkB;AAC1B,aAAO;AAAA,IACT,CAAC,EACA,MAAM,CAAC,UAAU;AAChB,YAAM,gBACJ,iBAAiB,mCAAmC,MAAM;AAC5D,YAAM,QAAQ,iBAAiB,kCAAkC,MAAM,QAAQ;AAC/E,MAAAA,SAAQ,eAAe;AACvB,MAAAA,SAAQ,OAAO,KAAK;AAAA,QAClB,QAAQ;AAAA,QACR,MAAM,GAAGH,cAAa,KAAK,CAAC;AAAA;AAAA,QAC5B,eAAe;AAAA,MACjB,CAAC;AACD,UACEG,SAAQ,eACR,iBAAiB,iCAChB,kBAAkB,CAAC,eACpB;AACA,QAAAA,SAAQ,qBAAqB;AAC7B,QAAAA,SAAQ,oBAAoB;AAC5B,QAAAA,SAAQ,mBAAmBA,SAAQ,WAAW;AAG9C,eAAO,EAAE,UAAU,MAAM,OAAO,OAAO,WAAW,KAAK;AAAA,MACzD;AACA,UAAI,cAAe,oCAAmC,IAAI;AAC1D,MAAAA,SAAQ,mBAAmB,IAAI;AAC/B,aAAO,EAAE,UAAU,GAAG,OAAO,MAAM;AAAA,IACrC,CAAC,EACA,QAAQ,MAAM;AACb,UAAI,CAACA,SAAQ,oBAAoB;AAC/B,QAAAA,SAAQ,UAAU;AAClB,aAAK,gBAAgB,OAAO,IAAI;AAAA,MAClC;AAAA,IACF,CAAC;AACH,WAAOA;AAAA,EACT;AAAA,EAEQ,sBAAsBA,UAA0B,IAAmB;AACzE,QAAI,OAAO,OAAO,YAAY,CAAC,GAAG,KAAK;AACrC,YAAM,IAAI,8BAA8B,uCAAuC;AACjF,QAAIA,SAAQ,gBAAgB,QAAQA,SAAQ,gBAAgB;AAC1D,YAAM,IAAI,8BAA8B,qCAAqC;AAC/E,QAAIA,SAAQ,gBAAgB,MAAM;AAChC,MAAAA,SAAQ,cAAc;AACtB,MAAAA,SAAQ,mBAAmB,EAAE;AAAA,IAC/B;AAAA,EACF;AAAA,EAEQ,qBAAqB,UAAmB,aAA2B;AACzE,QAAI,aAAa;AACf,YAAM,IAAI,qBAAqB,8CAA8C;AAAA,EACjF;AAAA,EAEQ,wBAAwBA,UAA0B,MAAoB;AAC5E,QAAI,SAASA,SAAQ;AACnB,YAAM,IAAI,qBAAqB,yCAAyC;AAAA,EAC5E;AAAA,EAEQ,eAAeA,UAA2C;AAChE,QAAI,CAACA,SAAQ;AACX,YAAM,IAAI,qBAAqB,qDAAqD;AACtF,WAAOA,SAAQ;AAAA,EACjB;AAAA,EAEA,MAAc,sBAAsBA,UAA4C;AAC9E,QAAIA,SAAQ,gBAAiB,QAAO;AACpC,UAAM,cAAcA,SAAQ,eAAgB,MAAMA,SAAQ;AAC1D,QAAI,CAAC,YAAa,QAAOA,SAAQ;AACjC,UAAM,KAAK,eAAeA,QAAO,EAAE,SAAS,UAAU,WAAW;AAEjE,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,uBACZA,UACqC;AACrC,QAAI,CAACA,SAAQ,iBAAiB;AAC5B,YAAM,cAAcA,SAAQ;AAC5B,UAAI,CAAC,YAAa,QAAO,EAAE,QAAQ,UAAU;AAC7C,YAAMC,UAAS,MAAM,KAAK,eAAeD,QAAO,EAAE,SAAS,iBAAiB,WAAW;AACvF,WAAK,qBAAqBC,QAAO,IAAI,WAAW;AAChD,UAAIA,QAAO,YAAY,SAAS,CAAC,OAAO,cAAcA,QAAO,QAAQ;AACnE,eAAO,EAAE,QAAQ,UAAU;AAC7B,MAAAD,SAAQ,kBAAkB,EAAE,UAAUC,QAAO,SAAU;AAAA,IACzD;AACA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ,EAAE,UAAUD,SAAQ,gBAAgB,SAAS;AAAA;AAAA;AAAA;AAAA,MAIrD,SAAS,IAAI;AAAA,QACXA,SAAQ;AAAA,QACR,EAAE,QAAQ,IAAI,QAAQ,GAAG;AAAA,QACzB,IAAI,MAAM,wEAAwE;AAAA,MACpF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,mBAAmB,MAAmD;AAC1E,UAAMA,WAAU,KAAK,gBAAgB,IAAI,IAAI;AAC7C,QAAI,CAACA,SAAS,OAAM,IAAI,qBAAqB,uCAAuC;AACpF,WAAO,MAAM,KAAK,uBAAuBA,QAAO;AAAA,EAClD;AAAA,EAEA,MAAc,gCAAgCA,UAAmD;AAC/F,UAAM,cAAcA,SAAQ,eAAgB,MAAMA,SAAQ;AAC1D,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAW,KAAK,eAAeA,QAAO;AAC5C,WAAO,MAAM;AACX,UAAI;AACF,cAAMC,UAAS,MAAM,SAAS,SAAS,iBAAiB,WAAW;AACnE,aAAK,qBAAqBA,QAAO,IAAI,WAAW;AAChD,YAAIA,QAAO,YAAY,SAAS,OAAO,cAAcA,QAAO,QAAQ,GAAG;AACrE,cAAIA,QAAO,OAAO;AAChB,YAAAD,SAAQ,OAAO,KAAK;AAAA,cAClB,QAAQ;AAAA,cACR,MAAM,GAAGC,QAAO,KAAK;AAAA;AAAA,cACrB,eAAe;AAAA,YACjB,CAAC;AAAA,UACH;AACA,UAAAD,SAAQ,UAAU;AAClB,UAAAA,SAAQ,qBAAqB;AAC7B,UAAAA,SAAQ,kBAAkB;AAAA,YACxB,UAAUC,QAAO;AAAA,YACjB,GAAIA,QAAO,QAAQ,EAAE,OAAOA,QAAO,MAAM,IAAI,CAAC;AAAA,UAChD;AACA,eAAK,gBAAgB,OAAOD,SAAQ,IAAI;AACxC,iBAAOA,SAAQ;AAAA,QACjB;AAAA,MACF,QAAQ;AAAA,MAIR;AACA,YAAM,MAAM,iCAAiC;AAAA,IAC/C;AAAA,EACF;AAAA,EAEA,MAAc,iBAAiB,MAAmD;AAChF,QAAI,KAAK,KAAK;AACZ,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,2BAAuB,KAAK,KAAK;AACjC,QAAI,KAAK,QAAS,eAAc,KAAK,OAAO;AAC5C,UAAMA,WAAU,KAAK,aAAa,IAAI;AACtC,QAAI,UAAU,MAAMA,SAAQ;AAC5B,QAAI,QAAQ,WAAW;AACrB,gBAAU,MAAM,KAAK,gCAAgCA,QAAO;AAAA,IAC9D;AACA,UAAM,WAAW,qBAAqBA,QAAO;AAC7C,UAAM,SAAS,eAAe,SAAS,QAAQ,KAAK,eAAe;AACnE,QAAI,QAAQ,SAAS,CAACA,SAAQ,YAAa,OAAM,QAAQ;AACzD,WAAO,KAAK,cAAcA,UAAS,UAAU;AAAA,MAC3C,QAAQ,OAAO;AAAA,MACf,QAAQ,SAAS;AAAA,MACjB,QAAQ,SAAS;AAAA,MACjB,iBAAiB,eAAeA,SAAQ,SAAS;AAAA,MACjD,UAAU,QAAQ;AAAA,MAClB,GAAI,OAAO,uBAAuB,SAC9B,EAAE,oBAAoB,OAAO,mBAAmB,IAChD,CAAC;AAAA,IACP,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,KAAK,MAAmD;AAC5D,QAAI,KAAK,KAAK;AACZ,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,2BAAuB,KAAK,KAAK;AACjC,QAAI,KAAK,QAAS,eAAc,KAAK,OAAO;AAC5C,UAAMA,WAAU,KAAK,aAAa,IAAI;AACtC,UAAM,mBAAmB,KAAK,eAAe;AAC7C,UAAM,cACJ,oBAAoB,6BAChB,mBAAmB,8BACnB;AACN,UAAM,UAAU,MAAM,QAAQ,KAAK;AAAA,MACjCA,SAAQ,UAAU,KAAK,CAAC,WAAW,EAAE,MAAM,MAAe,MAAM,EAAE;AAAA,MAClE,MAAM,WAAW,EAAE,KAAK,OAAO,EAAE,MAAM,MAAe,EAAE;AAAA,IAC1D,CAAC;AACD,UAAM,WAAW,qBAAqBA,QAAO;AAC7C,UAAM,SAAS,eAAe,SAAS,QAAQ,KAAK,eAAe;AACnE,QAAI,QAAQ,MAAM;AAChB,UAAI,QAAQ,MAAM,WAAW;AAC3B,cAAME,aAAY,KAAK;AACvB,QAAAF,SAAQ,YAAYE;AACpB,aAAK,mBAAmB,IAAIA,YAAWF,QAAO;AAC9C,eAAO,KAAK,cAAcA,UAAS,UAAU;AAAA,UAC3C,QAAQ,OAAO;AAAA,UACf,QAAQ,SAAS;AAAA,UACjB,QAAQ,SAAS;AAAA,UACjB,iBAAiB,eAAeA,SAAQ,SAAS;AAAA,UACjD,WAAAE;AAAA,UACA,GAAI,OAAO,uBAAuB,SAC9B,EAAE,oBAAoB,OAAO,mBAAmB,IAChD,CAAC;AAAA,QACP,CAAC;AAAA,MACH;AACA,UAAI,QAAQ,MAAM,SAAS,CAACF,SAAQ,YAAa,OAAM,QAAQ,MAAM;AACrE,aAAO,KAAK,cAAcA,UAAS,UAAU;AAAA,QAC3C,QAAQ,OAAO;AAAA,QACf,QAAQ,SAAS;AAAA,QACjB,QAAQ,SAAS;AAAA,QACjB,iBAAiB,eAAeA,SAAQ,SAAS;AAAA,QACjD,UAAU,QAAQ,MAAM;AAAA,QACxB,GAAI,OAAO,uBAAuB,SAC9B,EAAE,oBAAoB,OAAO,mBAAmB,IAChD,CAAC;AAAA,MACP,CAAC;AAAA,IACH;AACA,UAAM,YAAY,KAAK;AACvB,IAAAA,SAAQ,YAAY;AACpB,SAAK,mBAAmB,IAAI,WAAWA,QAAO;AAC9C,WAAO,KAAK,cAAcA,UAAS,UAAU;AAAA,MAC3C,QAAQ,OAAO;AAAA,MACf,QAAQ,SAAS;AAAA,MACjB,QAAQ,SAAS;AAAA,MACjB,iBAAiB,eAAeA,SAAQ,SAAS;AAAA,MACjD;AAAA,MACA,GAAI,OAAO,uBAAuB,SAC9B,EAAE,oBAAoB,OAAO,mBAAmB,IAChD,CAAC;AAAA,IACP,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,YAAY,MAAwC;AACxD,WAAO,KAAK,cAAc,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,EACjD;AAAA,EAEA,mBAAmB,mBAAoC;AACrD,WAAO,KAAK,mBAAmB,IAAI,iBAAiB;AAAA,EACtD;AAAA,EAEA,MAAM,kBAAkB,MAAgC;AACtD,UAAMA,WAAU,KAAK,gBAAgB,IAAI,IAAI;AAC7C,QAAI,CAACA,SAAS,QAAO;AACrB,WAAO,MAAM,KAAK,sBAAsBA,QAAO;AAAA,EACjD;AAAA,EAEA,MAAM,WAAW,MAAuC;AACtD,UAAMA,WAAU,KAAK,mBAAmB,IAAI,KAAK,SAAS;AAC1D,QAAI,CAACA,UAAS;AACZ,aAAO,mBAAmB;AAAA,QACxB,QAAQ,0CAA0C,KAAK,SAAS;AAAA,QAChE,iBAAiB;AAAA,QACjB,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AACA,UAAM,QAAQ,KAAK,SAAS;AAC5B,UAAM,mBAAmB,MAAM,WAAW,KAAU,EAAE;AACtD,QAAI,iBAAiB,SAAS,GAAG;AAC/B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,YAAY,KAAK,IAAI;AAC3B,QAAI,MAAM,SAAS,GAAQ,GAAG;AAC5B,YAAM,cAAcA,SAAQ,eAAgB,MAAMA,SAAQ;AAC1D,UAAI,aAAa;AACf,cAAM,WAAW,KAAK,eAAeA,QAAO;AAC5C,cAAM,SAAS,SAAS,UAAU,WAAW;AAAA,MAC/C;AAAA,IACF;AACA,QAAIA,SAAQ,oBAAoB;AAC9B,YAAM,cAAcA,SAAQ;AAC5B,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,YAAM,WAAW,KAAK,eAAeA,QAAO;AAC5C,YAAMC,UAAS,MAAM,SAAS,SAAS,iBAAiB,WAAW;AACnE,WAAK,qBAAqBA,QAAO,IAAI,WAAW;AAChD,UAAIA,QAAO,OAAO;AAChB,QAAAD,SAAQ,OAAO,KAAK,EAAE,QAAQ,UAAU,MAAM,GAAGC,QAAO,KAAK;AAAA,GAAM,eAAe,MAAM,CAAC;AAAA,MAC3F;AACA,YAAME,YAAW,qBAAqBH,QAAO;AAC7C,YAAMI,UAAS,eAAeD,UAAS,QAAQ,KAAK,eAAe;AACnE,UAAIF,QAAO,YAAY,SAAS,CAAC,OAAO,cAAcA,QAAO,QAAQ,GAAG;AACtE,eAAO,KAAK;AAAA,UACV,KAAK,cAAcD,UAASG,WAAU;AAAA,YACpC,QAAQC,QAAO;AAAA,YACf,QAAQD,UAAS;AAAA,YACjB,QAAQA,UAAS;AAAA,YACjB,iBAAiB,eAAe,SAAS;AAAA,YACzC,WAAW,KAAK;AAAA,YAChB,GAAIC,QAAO,uBAAuB,SAC9B,EAAE,oBAAoBA,QAAO,mBAAmB,IAChD,CAAC;AAAA,UACP,CAAC;AAAA,QACH;AAAA,MACF;AACA,MAAAJ,SAAQ,UAAU;AAClB,MAAAA,SAAQ,kBAAkB,EAAE,UAAUC,QAAO,SAAU;AACvD,WAAK,mBAAmB,OAAO,KAAK,SAAS;AAC7C,WAAK,gBAAgB,OAAOD,SAAQ,IAAI;AACxC,aAAO,KAAK;AAAA,QACV,KAAK,cAAcA,UAASG,WAAU;AAAA,UACpC,QAAQC,QAAO;AAAA,UACf,QAAQD,UAAS;AAAA,UACjB,QAAQA,UAAS;AAAA,UACjB,iBAAiB,eAAe,SAAS;AAAA,UACzC,UAAUF,QAAO;AAAA,UACjB,GAAIG,QAAO,uBAAuB,SAC9B,EAAE,oBAAoBA,QAAO,mBAAmB,IAChD,CAAC;AAAA,QACP,CAAC;AAAA,MACH;AAAA,IACF;AACA,UAAM,UAAU,MAAM,QAAQ,KAAK;AAAA,MACjCJ,SAAQ,UAAU,KAAK,CAAC,WAAW,EAAE,MAAM,MAAe,MAAM,EAAE;AAAA,MAClE,MAAM,KAAK,eAAe,iCAAiC,EAAE,KAAK,OAAO;AAAA,QACvE,MAAM;AAAA,MACR,EAAE;AAAA,IACJ,CAAC;AACD,UAAM,WAAW,qBAAqBA,QAAO;AAC7C,UAAM,SAAS,eAAe,SAAS,QAAQ,KAAK,eAAe;AACnE,QAAI,QAAQ,MAAM;AAGhB,UAAI,CAAC,QAAQ,MAAM,UAAW,MAAK,mBAAmB,OAAO,KAAK,SAAS;AAC3E,aAAO,KAAK;AAAA,QACV,KAAK,cAAcA,UAAS,UAAU;AAAA,UACpC,QAAQ,OAAO;AAAA,UACf,QAAQ,SAAS;AAAA,UACjB,QAAQ,SAAS;AAAA,UACjB,iBAAiB,eAAe,SAAS;AAAA,UACzC,GAAI,QAAQ,MAAM,YACd,EAAE,WAAW,KAAK,UAAU,IAC5B,EAAE,UAAU,QAAQ,MAAM,SAAS;AAAA,UACvC,GAAI,OAAO,uBAAuB,SAC9B,EAAE,oBAAoB,OAAO,mBAAmB,IAChD,CAAC;AAAA,QACP,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO,KAAK;AAAA,MACV,KAAK,cAAcA,UAAS,UAAU;AAAA,QACpC,QAAQ,OAAO;AAAA,QACf,QAAQ,SAAS;AAAA,QACjB,QAAQ,SAAS;AAAA,QACjB,iBAAiB,eAAe,SAAS;AAAA,QACzC,WAAW,KAAK;AAAA,QAChB,GAAI,OAAO,uBAAuB,SAC9B,EAAE,oBAAoB,OAAO,mBAAmB,IAChD,CAAC;AAAA,MACP,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,4BAA4B,MAAuC;AACvE,WAAO,MAAM,KAAK,WAAW,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,SAAS,MAAgF;AAC7F,2BAAuB,KAAK,KAAK;AACjC,UAAM,WAAW,cAAc,KAAK,MAAM,EAAE,cAAc,KAAK,CAAC;AAChE,UAAM,OAAO,CAAC,gBAAgB,GAAG,qBAAqB,EAAE;AAAA,MACtD,CAAC,cAAc,aAAa,aAAa,SAAS,WAAW,GAAG,SAAS,GAAG;AAAA,IAC9E;AACA,UAAM,WAAW,KAAK,YAAY,MAAM,OAAO;AAC/C,QAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,WAAW,KAAK,WAAW,MAAM,OAAO,MAAM;AACnF,YAAM,IAAI,0BAA0B,qCAAqC;AAAA,IAC3E;AACA,UAAM,SAAS,MAAM,KAAK,KAAK;AAAA,MAC7B,KAAK,wBAAwB,MAAM,SAAS,MAAM,KAAK,SAAS,CAAC,GAAG,QAAQ;AAAA,MAC5E,OAAO;AAAA,MACP,aAAa;AAAA,MACb,iBAAiB,KAAK,KAAM,WAAW,IAAK,CAAC,IAAI;AAAA,IACnD,CAAC;AACD,QAAI,OAAO,aAAa,IAAI;AAC1B,YAAM,IAAI,kCAAkC,sCAAsC;AAAA,IACpF;AACA,QAAI,OAAO,aAAa,IAAI;AAC1B,YAAM,IAAI,0BAA0B,uDAAuD;AAAA,IAC7F;AACA,UAAM,QACJ,OAAO,cAAc,UAAa,OAAO,aAAa,IAClD,sBAAsB,OAAO,QAAQ,QAAQ,IAC7C;AACN,QAAI,CAAC,OAAO;AAGV,UAAI,KAAK,qBAAqB,IAAI,MAAM,EAAG,OAAM,KAAK,qBAAqB,IAAI,MAAM;AACrF,YAAM,IAAI,qBAAqB,4CAA4C;AAAA,IAC7E;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,2BACZ,UACA,OACgB;AAChB,QAAI,WAAW,KAAK,GAAG;AAGrB,YAAM,OAAO,MAAM,SAAS,QAAQ;AACpC,mCAA6B,MAAM,KAAK,MAAM,SAAS;AACvD,UAAI,KAAK,OAAO,KAAK,MAAM,WAAW;AACpC,cAAM,IAAI,kCAAkC,sCAAsC;AAAA,MACpF;AAAA,IACF;AACA,UAAM;AAAA,EACR;AAAA,EAEA,MAAM,UAAU,MAKI;AAClB,QAAI,KAAK,QAAQ;AACf,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAW,MAAM,KAAK,cAAc;AAC1C,UAAM,SAAS,cAAc,KAAK,MAAM,EAAE,cAAc,KAAK,CAAC;AAC9D,QAAI,KAAK,iBAAiB,MAAM;AAC9B,YAAM,SAAS,MAAM,kBAAkB,CAAC,EAAE,MAAM,MAAM,QAAQ,MAAM,EAAE,CAAC,CAAC;AAAA,IAC1E;AACA,UAAM,SAAS,MAAM,WAAW,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,QAAQ,CAAC,CAAC;AACtE,WAAO,OAAO,KAAK,YAAY,WAC3B,IAAI,YAAY,EAAE,OAAO,KAAK,OAAO,EAAE,aACvC,KAAK,QAAQ;AAAA,EACnB;AAAA,EAEA,MAAM,WAAW,MAAc,OAAkC;AAC/D,2BAAuB,KAAK;AAC5B,UAAM,WAAW,MAAM,KAAK,cAAc;AAC1C,UAAM,SAAS,cAAc,MAAM,EAAE,cAAc,KAAK,CAAC;AACzD,QAAI;AACF,YAAM,OAAO,MAAM,SAAS,MAAM,YAAY,CAAC,MAAM,CAAC;AACtD,aAAO,QAAQ,KAAK,MAAM,CAAC;AAAA,IAC7B,SAAS,OAAO;AACd,UAAI,WAAW,KAAK,EAAG,QAAO;AAC9B,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,MAA0E;AACtF,2BAAuB,KAAK,KAAK;AACjC,UAAM,WAAW,MAAM,KAAK,cAAc;AAC1C,UAAM,WAAW,cAAc,KAAK,IAAI;AACxC,UAAM,iBAAiB,KAAK,KAAK,KAAK,EAAE,WAAW,GAAG;AACtD,UAAM,UAAU,MAAM,SAAS,MAC5B,cAAc;AAAA,MACb,MAAM;AAAA,MACN,OAAO;AAAA,IACT,CAAC,EACA,MAAM,CAAC,UAAU,KAAK,2BAA2B,UAAU,KAAK,CAAC;AACpE,WAAO,QAAQ,IAAI,CAAC,UAAU;AAC5B,YAAM,YAAY,cAAc,MAAM,IAAI;AAC1C,aAAO;AAAA,QACL,MAAM,MAAM,SAAS,SAAS;AAAA,QAC9B,MAAM,iBACF,YACA,cAAc,iBACZ,KACA,UAAU,MAAM,eAAe,SAAS,CAAC;AAAA,QAC/C,MAAM,MAAM,SAAS,cAAc,QAAQ,MAAM,SAAS,SAAS,SAAS;AAAA,MAC9E;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,UAAU,MAAqB;AACnC,2BAAuB,KAAK,KAAK;AACjC,UAAM,QAAQ,MAAM,KAAK,SAAS,EAAE,MAAM,KAAK,KAAK,CAAC;AACrD,WAAO,qBAAqB,KAAK,MAAM,KAAK;AAAA,EAC9C;AAAA,EAEA,MAAc,WAAW,MAA6B;AACpD,UAAM,WAAW,MAAM,KAAK,cAAc;AAC1C,UAAM,SAAS,cAAc,MAAM,EAAE,cAAc,KAAK,CAAC;AACzD,UAAM,OAAO,MAAM,SAAS,MAAM,YAAY,CAAC,MAAM,CAAC;AACtD,UAAM,QAAQ,KAAK,MAAM;AACzB,QAAI,CAAC,MAAO;AACZ,QAAI,MAAM,SAAS,YAAa,OAAM,SAAS,MAAM,kBAAkB,CAAC,MAAM,CAAC;AAAA,QAC1E,OAAM,SAAS,MAAM,YAAY,CAAC,MAAM,CAAC;AAAA,EAChD;AAAA,EAEA,aAAa,OAAmC;AAC9C,2BAAuB,KAAK;AAC5B,UAAM,YAAY;AAClB,QAAI,CAAC,WAAW;AACd,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAMK,YAAW,OAAO,SACtB,IAAI,YAAY,EAAE,OAAO,MAAM,KAAK,SAAS,EAAE,KAAK,CAAC,CAAC;AACxD,WAAO;AAAA,MACL,YAAY,OAAO,cAAc;AAC/B,YAAI,MAAM,KAAK,WAAW,UAAU,IAAI,GAAG;AACzC,gBAAM,IAAI,MAAM,gDAAgD,UAAU,IAAI,EAAE;AAAA,QAClF;AACA,cAAM,KAAK,UAAU;AAAA,UACnB,MAAM,UAAU;AAAA,UAChB,SAAS,UAAU,IAAI,UAAU,MAAM,QAAQ;AAAA,UAC/C,eAAe;AAAA,QACjB,CAAC;AACD,eAAO,CAAC;AAAA,MACV;AAAA,MACA,YAAY,OAAO,cAAc;AAC/B,cAAM,OAAO,UAAU,MAAMA,UAAS,UAAU,IAAI,GAAG,UAAU,IAAI;AACrE,cAAM,cAAc,UAAU,UAAU,UAAU;AAClD,cAAM,KAAK,UAAU;AAAA,UACnB,MAAM;AAAA,UACN,SAAS;AAAA,UACT,eAAe;AAAA,QACjB,CAAC;AACD,YAAI,UAAU,UAAU,UAAU,WAAW,UAAU,MAAM;AAC3D,gBAAM,KAAK,WAAW,UAAU,IAAI;AAAA,QACtC;AACA,eAAO,CAAC;AAAA,MACV;AAAA,MACA,YAAY,OAAO,cAAc;AAC/B,cAAM,KAAK,WAAW,UAAU,IAAI;AACpC,eAAO,CAAC;AAAA,MACV;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,iBAAiB,MAAc,OAA6B;AACxE,QAAI,MAAM,UAAU,QAAW;AAC7B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,MAAM,gBAAgB,OAAW;AACrC,UAAM,WAAW,MAAM,KAAK,cAAc;AAC1C,UAAM,SAAS,MAAM,eAAe;AAAA,MAClC,EAAE,MAAM,MAAM,IAAI,YAAY,MAAM,WAAW,EAAE,OAAO,IAAI,IAAM;AAAA,IACpE,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,mBAAmB,QAAgB,aAAoC;AACnF,UAAM,QAAQ,MAAMC,OAAM,MAAM;AAChC,QAAI,MAAM,eAAe,GAAG;AAC1B,YAAM,IAAI;AAAA,QACR,0DAA0D,MAAM;AAAA,MAClE;AAAA,IACF;AACA,QAAI,CAAC,MAAM,YAAY,GAAG;AACxB,YAAM,IAAI;AAAA,QACR,oDAAoD,MAAM;AAAA,MAC5D;AAAA,IACF;AACA,UAAM,WAAW,MAAM,KAAK,cAAc;AAC1C,UAAM,SAAS,MAAM,kBAAkB,CAAC,EAAE,MAAM,YAAY,CAAC,CAAC;AAC9D,UAAM,UAAU,MAAMC,SAAQ,QAAQ,EAAE,eAAe,KAAK,CAAC;AAC7D,eAAW,SAAS,SAAS;AAC3B,YAAM,aAAa,GAAG,OAAO,QAAQ,QAAQ,EAAE,CAAC,IAAI,MAAM,IAAI;AAC9D,YAAM,kBAAkB,MAAM,KAAK,aAAa,MAAM,IAAI;AAC1D,UAAI,MAAM,eAAe,GAAG;AAC1B,cAAM,IAAI;AAAA,UACR,0DAA0D,UAAU;AAAA,QACtE;AAAA,MACF;AACA,UAAI,MAAM,YAAY,GAAG;AACvB,cAAM,KAAK,mBAAmB,YAAY,eAAe;AAAA,MAC3D,WAAW,MAAM,OAAO,GAAG;AACzB,cAAM,SAAS,MAAM,WAAW;AAAA,UAC9B;AAAA,YACE,MAAM;AAAA,YACN,MAAM,IAAI,WAAW,MAAM,cAAc,UAAU,CAAC;AAAA,UACtD;AAAA,QACF,CAAC;AAAA,MACH,OAAO;AACL,cAAM,IAAI;AAAA,UACR,mEAAmE,UAAU;AAAA,QAC/E;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,YAAY,MAAc,OAA6B;AACnE,UAAM,SAAS,cAAc,IAAI;AACjC,UAAM,WAAW,MAAM,KAAK,cAAc;AAC1C,QAAI,MAAM,SAAS,OAAO;AACxB,YAAM,SAAS,MAAM,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,CAAC;AACzD,iBAAW,CAAC,WAAW,KAAK,KAAK,OAAO,QAAQ,MAAM,YAAY,CAAC,CAAC,GAAG;AACrE,cAAM,KAAK,YAAY,MAAM,KAAK,MAAM,SAAS,GAAG,KAAK;AAAA,MAC3D;AACA,YAAM,KAAK,iBAAiB,QAAQ,KAAK;AACzC;AAAA,IACF;AACA,QAAI,MAAM,SAAS,QAAQ;AACzB,YAAM,SAAS,MAAM,kBAAkB,CAAC,EAAE,MAAM,MAAM,QAAQ,MAAM,EAAE,CAAC,CAAC;AACxE,YAAM,SAAS,MAAM,WAAW,CAAC,EAAE,MAAM,QAAQ,MAAM,MAAM,QAAQ,CAAC,CAAC;AACvE,YAAM,KAAK,iBAAiB,QAAQ,KAAK;AACzC;AAAA,IACF;AACA,QAAI,MAAM,SAAS,cAAc;AAC/B,YAAM,QAAQ,MAAMD,OAAM,MAAM,GAAG;AACnC,UAAI,CAAC,MAAM,OAAO,KAAK,MAAM,eAAe,GAAG;AAC7C,cAAM,IAAI;AAAA,UACR,qEAAqE,MAAM,GAAG;AAAA,QAChF;AAAA,MACF;AACA,YAAM,SAAS,MAAM,kBAAkB,CAAC,EAAE,MAAM,MAAM,QAAQ,MAAM,EAAE,CAAC,CAAC;AACxE,YAAM,SAAS,MAAM,WAAW;AAAA,QAC9B,EAAE,MAAM,QAAQ,MAAM,IAAI,WAAW,MAAM,cAAc,MAAM,GAAG,CAAC,EAAE;AAAA,MACvE,CAAC;AACD,YAAM,KAAK,iBAAiB,QAAQ,KAAK;AACzC;AAAA,IACF;AACA,QAAI,MAAM,SAAS,aAAa;AAC9B,YAAM,KAAK,mBAAmB,MAAM,KAAK,MAAM;AAC/C,YAAM,KAAK,iBAAiB,QAAQ,KAAK;AACzC;AAAA,IACF;AACA,QAAI,MAAM,SAAS,YAAY;AAC7B,YAAM,OAAO,qBAAqB,WAAW,CAAC;AAC9C,YAAM,UAAU,MAAM,UAAU,sBAAsB,MAAM,OAAO,IAAI;AACvE,YAAM,SAAS;AAAA,QACb;AAAA,QACA,aAAa,WAAW,IAAI,CAAC,IAAI,WAAW,MAAM,CAAC;AAAA,QACnD,qCAAqC,WAAW,MAAM,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC;AAAA,QAC/E,GAAI,MAAM,MACN;AAAA,UACE,UAAU,WAAW,IAAI,CAAC,2BAA2B,WAAW,MAAM,GAAG,CAAC;AAAA,UAC1E,UAAU,WAAW,IAAI,CAAC;AAAA,QAC5B,IACA,CAAC,UAAU,WAAW,IAAI,CAAC,yBAAyB;AAAA,QACxD,UACI,eAAe,WAAW,MAAM,CAAC,gBAAgB,WAAW,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,WAAW,MAAM,CAAC,KACzG,SAAS,WAAW,IAAI,CAAC,IAAI,WAAW,MAAM,CAAC;AAAA,QACnD,UAAU,aAAa,WAAW,IAAI,CAAC,KAAK;AAAA,MAC9C,EAAE,KAAK,IAAI;AACX,YAAM,SAAS,MAAM,KAAK,iBAAiB;AAAA,QACzC,KAAK;AAAA,QACL,iBAAiB;AAAA,MACnB,CAAC;AACD,UAAI,OAAO,OAAO,aAAa,YAAY,OAAO,aAAa,GAAG;AAChE,cAAM,IAAI,qBAAqB,qDAAqD;AAAA,UAClF;AAAA,UACA,UAAU,OAAO,YAAY;AAAA,QAC/B,CAAC;AAAA,MACH;AACA,YAAM,KAAK,iBAAiB,QAAQ,KAAK;AACzC;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,8DAA8D,MAAM,IAAI;AAAA,IAC1E;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,MAA2C;AAChE,2BAAuB,KAAK,KAAK;AACjC,UAAM,cAAc,qBAAqB,KAAK,IAAI;AAClD,UAAM,KAAK,YAAY,aAAa,KAAK,KAAK;AAC9C,SAAK,MAAM,WAAW,wBAAwB,KAAK,MAAM,UAAU,aAAa,KAAK,KAAK;AAAA,EAC5F;AAAA,EAEA,MAAM,cAAc,UAAoB,OAA+B;AACrE,2BAAuB,KAAK;AAC5B,UAAM,KAAK,kCAAkC;AAC7C,QAAI,SAAS,SAAS,KAAK,MAAM,SAAS,MAAM;AAC9C,YAAM,IAAI;AAAA,QACR,yCAAyC,KAAK,MAAM,SAAS,IAAI;AAAA,MACnE;AAAA,IACF;AACA,QACE,SAAS,MAAM,SAAS,KACxB,SAAS,OAAO,SAAS,KACzB,SAAS,gBAAgB,SAAS,GAClC;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,SAAS,OAAO,GAAG;AAC5D,YAAM,KAAK,YAAY,MAAM,KAAK;AAAA,IACpC;AACA,UAAM,eAAe,mBAAmB,KAAK,MAAM,UAAU,QAAQ;AACrE,SAAK,MAAM,cAAc,MAAM;AAAA,MAC7B,KAAK,MAAM;AAAA,MACX;AAAA,MACA,KAAK,MAAM;AAAA,IACb;AACA,SAAK,MAAM,WAAW;AAAA,EACxB;AAAA,EAEQ,sBAAsB,SAAmC;AAC/D,WAAO;AAAA,MACL,SAAS,kBAAkB,SAAY,KAAK,gBAAgB,QAAQ;AAAA,IACtE;AAAA,EACF;AAAA,EAEA,MAAM,sBAA2C;AAC/C,UAAM,cAAc,GAAG,YAAY,YAAY,WAAW,CAAC;AAC3D,UAAM,WAAW;AAAA,MACf,GAAG,KAAK,MAAM,SAAS,0BAA0B;AAAA,MACjD;AAAA,MACA;AAAA,IACF,EAAE,KAAK;AACP,UAAM,cAAc,SAAS,QAAQ,CAAC,SAAS;AAAA,MAC7C,WAAW,aAAa,IAAI,EAAE;AAAA,MAC9B,WAAW,eAAe,IAAI,EAAE;AAAA,IAClC,CAAC;AACD,UAAM,SAAS,OAAO;AAAA,WACf,WAAW,YAAY,CAAC;AAAA,KAC9B,WAAW,cAAc,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQzB,YAAY,KAAK,GAAG,CAAC,qGAAqG,WAAW,WAAW,CAAC;AACnJ,QAAI;AACF,YAAM,SAAS,MAAM,KAAK,iBAAiB;AAAA,QACzC,KAAK;AAAA,QACL,iBAAiB;AAAA,MACnB,CAAC;AACD,UAAI,OAAO,aAAa,GAAG;AACzB,cAAM,IAAI,oBAAoB,gDAAgD;AAAA,UAC5E,WAAW,KAAK,MAAM;AAAA,UACtB,UAAU,OAAO,YAAY;AAAA,QAC/B,CAAC;AAAA,MACH;AACA,YAAM,QAAQ,MAAM,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AACvD,YAAM,SAAS,KAAK,sBAAsB;AAC1C,UAAI,UAAU,OAAO,kBAAkB,QAAQ,MAAM,aAAa,OAAO,eAAe;AACtF,cAAM,IAAI,oBAAoB,uDAAuD;AAAA,UACnF,cAAc,MAAM;AAAA,UACpB,eAAe,OAAO;AAAA,QACxB,CAAC;AAAA,MACH;AACA,aAAO;AAAA,IACT,UAAE;AACA,YAAM,KAAK,WAAW,WAAW,EAAE,MAAM,MAAM,MAAS;AAAA,IAC1D;AAAA,EACF;AAAA,EAEA,MAAM,mBAAwC;AAC5C,WAAO,MAAM,KAAK,oBAAoB;AAAA,EACxC;AAAA,EAEA,MAAM,iBACJ,MACA,UAAmC,CAAC,GACrB;AACf,UAAM,QAAQ,MAAM,aAAa,IAAI;AACrC,UAAM,SAAS,KAAK,sBAAsB,OAAO;AACjD,QAAI,UAAU,OAAO,kBAAkB,QAAQ,MAAM,aAAa,OAAO,eAAe;AACtF,YAAM,IAAI,oBAAoB,uDAAuD;AAAA,QACnF,cAAc,MAAM;AAAA,QACpB,eAAe,OAAO;AAAA,MACxB,CAAC;AAAA,IACH;AACA,UAAM,cAAc,GAAG,YAAY,YAAY,WAAW,CAAC;AAC3D,UAAM,cAAc,GAAG,cAAc,sBAAsB,WAAW,CAAC;AACvE,UAAM,aAAa,GAAG,cAAc,kBAAkB,WAAW,CAAC;AAClE,UAAM,KAAK,UAAU;AAAA,MACnB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,eAAe;AAAA,IACjB,CAAC;AACD,UAAM,WAAW,CAAC,GAAG,KAAK,MAAM,SAAS,0BAA0B,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI;AACtF,UAAM,UAAU;AAAA,MACd;AAAA,MACA;AAAA,MACA,WAAW,qBAAqB,CAAC;AAAA,MACjC,WAAW,WAAW;AAAA,MACtB,WAAW,cAAc;AAAA,MACzB,WAAW,WAAW;AAAA,MACtB,WAAW,UAAU;AAAA,MACrB,WAAW,gBAAgB,QAAQ,cAAc,IAAI,CAAC;AAAA,MACtD,WAAW,gBAAgB,QAAQ,qBAAqB,IAAI,CAAC;AAAA,MAC7D,WAAW,QAAQ;AAAA,IACrB,EAAE,KAAK,GAAG;AACV,QAAI;AACF,YAAM,SAAS,MAAM,KAAK,iBAAiB;AAAA,QACzC,KAAK;AAAA,QACL,iBAAiB;AAAA,MACnB,CAAC;AACD,UAAI,OAAO,aAAa,GAAG;AACzB,cAAM,IAAI,oBAAoB,gDAAgD;AAAA,UAC5E,WAAW,KAAK,MAAM;AAAA,UACtB,UAAU,OAAO,YAAY;AAAA,UAC7B,QAAQ,OAAO,OAAO,MAAM,IAAM;AAAA,QACpC,CAAC;AAAA,MACH;AACA,WAAK,MAAM,iBAAiB;AAAA,IAC9B,UAAE;AACA,YAAM,KAAK,WAAW,WAAW,EAAE,MAAM,MAAM,MAAS;AACxD,YAAM,KAAK,WAAW,WAAW,EAAE,MAAM,MAAM,MAAS;AACxD,YAAM,KAAK,WAAW,UAAU,EAAE,MAAM,MAAM,MAAS;AAAA,IACzD;AAAA,EACF;AAAA,EAEA,MAAM,mBAAmB,MAA4C;AACnE,QAAI,CAAC,OAAO,UAAU,IAAI,KAAK,QAAQ,KAAK,OAAO,OAAQ;AACzD,YAAM,IAAI,mCAAmC,6BAA6B,IAAI,EAAE;AAAA,IAClF;AACA,UAAM,SAAS,KAAK,QAAQ,oBAAoB;AAChD,QAAI;AACF,YAAM,WAAW,MAAM,cAAc,KAAK,SAAS,OAAO,cAAc;AACtE,YAAI,QAAQ;AACV,gBAAM,UACJ,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,KAAK,KAAK,QAAQ,4BAA4B;AAC5E,iBAAO,MAAM,UAAU,kBAAkB,KAAK,MAAM,WAAW,MAAM,OAAO;AAAA,QAC9E;AACA,eAAO,MAAM,UAAU;AAAA,UACrB,KAAK,MAAM;AAAA,UACX;AAAA,UACA,KAAK,QAAQ;AAAA,QACf;AAAA,MACF,CAAC;AACD,YAAM,UAAU,sBAAsB,KAAK,OAAO;AAClD,YAAM,WAAW;AAAA,QACf,KAAK;AAAA,QACL;AAAA,UACE,sBAAsB,UAAU,QAAQ,SAAS,QAAQ,gBAAgB;AAAA,UACzE;AAAA,UACA;AAAA,QACF;AAAA,QACA;AAAA,MACF;AACA,YAAM,SAAS,SACX,8BAA8B,OAAO,SAAS,SAAS,WAAW,SAAS,OAAO,EAAE,IACpF;AACJ,cAAQ,KAAK,iCAAiC;AAAA,QAC5C,MAAM,SAAS,WAAW;AAAA,QAC1B,WAAW,KAAK,MAAM;AAAA,QACtB;AAAA,QACA,kBAAkB,QAAQ,oBAAoB;AAAA,QAC9C,MACE,OAAO,SAAS,SAAS,WAAW,+BAA+B,SAAS,IAAI,IAAI;AAAA,MACxF,CAAC;AACD,UAAI,QAAQ;AACV,mCAA2B,KAAK,QAAQ,SAAS,EAAE,SAAS,UAAU,KAAK,CAAC;AAAA,MAC9E;AACA,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,QAAQ;AACV,mCAA2B,KAAK,QAAQ,SAAS,EAAE,SAAS,eAAe,KAAK,CAAC;AAAA,MACnF;AACA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAOA,IAAM,kCAAkC;AAExC,SAAS,sBAAsB,SAG7B;AACA,MAAI,QAAQ,iBAAiB;AAC3B,QAAI,QAAQ,uBAAuB;AACjC,aAAO,EAAE,SAAS,QAAQ,uBAAuB,kBAAkB,KAAK;AAAA,IAC1E;AACA,WAAO,EAAE,SAAS,QAAQ,SAAS,kBAAkB,MAAM;AAAA,EAC7D;AACA,SAAO,EAAE,SAAS,QAAQ,SAAS,kBAAkB,QAAQ,eAAe;AAC9E;AAEA,SAAS,iCACP,UACA,MACA,iBACqB;AACrB,MAAI,gBAAiB,QAAO;AAC5B,MAAI,SAAS,gCAAiC,QAAO;AACrD,QAAM,UACJ,OAAO,SAAS,SAAS,YAAY,SAAS,KAAK,SAAS,IAAI,SAAS,OAAO;AAClF,QAAM,UAAU,QAAQ,WAAW,GAAG,IAAI,UAAU,IAAI,OAAO,IAAI,QAAQ,SAAS,EAAE;AACtF,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,MAAI,wBAAwB,KAAK,MAAM,KAAK,OAAO,SAAS,aAAa,GAAG;AAC1E,WAAO;AAAA,EACT;AACA,QAAM,OAAO,GAAG,MAAM;AACtB,QAAM,MACJ,OAAO,SAAS,QAAQ,YAAY,SAAS,IAAI,SAAS,IACtD,GAAG,SAAS,IAAI,QAAQ,SAAS,EAAE,CAAC,cACpC,SAAS;AACf,SAAO,EAAE,GAAG,UAAU,MAAM,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC,EAAG;AACtD;AAEA,SAAS,sBACP,UACA,SACA,kBACqB;AACrB,QAAM,OAAO,IAAI,IAAI,OAAO;AAC5B,QAAM,WAAW,IAAI,IAAI,GAAG,KAAK,QAAQ,KAAK,SAAS,QAAQ,EAAE;AAIjE,QAAM,MAAM,mBAAmB,IAAI,IAAI,GAAG,SAAS,QAAQ,GAAG,SAAS,MAAM,IAAI,IAAI,IAAI;AACzF,QAAM,MAAM,IAAI,aAAa,YAAY,IAAI,aAAa;AAC1D,SAAO;AAAA,IACL,MAAM,IAAI;AAAA,IACV,MAAM,IAAI,OAAO,OAAO,IAAI,IAAI,IAAI,MAAM,MAAM;AAAA,IAChD;AAAA,IACA,GAAI,IAAI,YAAY,IAAI,aAAa,MAAM,EAAE,MAAM,IAAI,SAAS,IAAI,CAAC;AAAA,IACrE,GAAI,IAAI,OAAO,SAAS,IAAI,EAAE,OAAO,IAAI,OAAO,MAAM,CAAC,EAAE,IAAI,CAAC;AAAA,IAC9D,UAAU,IAAI,SAAS,QAAQ,OAAO,EAAE;AAAA,IACxC,KAAK,IAAI,SAAS;AAAA,IAClB,GAAI,SAAS,UAAU,EAAE,SAAS,EAAE,GAAG,SAAS,QAAQ,EAAE,IAAI,CAAC;AAAA,EACjE;AACF;AAEO,IAAM,oBAAN,MAAwB;AAAA,EACpB,YAAY;AAAA,EACZ,yBAAyB;AAAA,EACjB;AAAA,EAEjB,YAAY,SAAmC;AAC7C,SAAK,UAAU;AAAA,MACb,GAAG;AAAA,MACH,SAAS,iBAAiB,QAAQ,OAAO;AAAA,MACzC,aAAa,EAAE,GAAI,QAAQ,eAAe,CAAC,EAAG;AAAA,MAC9C,cAAc,yBAAyB,QAAQ,YAAY;AAAA,MAC3D,gBAAgB,EAAE,GAAG,QAAQ,eAAe;AAAA,MAC5C,kBAAkB,EAAE,GAAG,QAAQ,iBAAiB;AAAA,IAClD;AAAA,EACF;AAAA,EAEA,MAAM,OACJ,MACA,iBAC6B;AAC7B,UAAM,aAAa,iCAAiC,MAAe,eAAe;AAClF,qBAAiB,UAAU;AAC3B,UAAM,WAAW,WAAW;AAC5B,QAAI,SAAS,SAAS,gBAAgB;AACpC,YAAM,IAAI,0BAA0B,qCAAqC,cAAc,GAAG;AAAA,IAC5F;AACA,QACE,SAAS,MAAM,SAAS,KACxB,SAAS,OAAO,SAAS,KACzB,SAAS,gBAAgB,SAAS,GAClC;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,cAAc;AAAA,MAClB,GAAI,KAAK,QAAQ,eAAe,CAAC;AAAA,MACjC,GAAI,MAAM,SAAS,mBAAmB;AAAA,IACxC;AACA,UAAM,UAAU,MAAM;AAAA,MACpB,KAAK;AAAA,MACL,OAAO,cAAc,MAAM,UAAU,cAAc,cAAc,KAAK,SAAS,WAAW,CAAC;AAAA,IAC7F;AACA,UAAM,QAAiC;AAAA,MACrC,cAAc;AAAA,MACd,WAAW,QAAQ;AAAA,MACnB;AAAA,MACA;AAAA,MACA,OAAO,KAAK,QAAQ;AAAA,MACpB,SAAS,KAAK,QAAQ,WAAW;AAAA,MACjC,qBAAqB,oBAAoB,KAAK,QAAQ,OAAO;AAAA,MAC7D,sBAAsB;AAAA,MACtB,wBAAwB,yBAAyB,KAAK,QAAQ,YAAY;AAAA,MAC1E,gBAAgB;AAAA,MAChB,WAAW,QAAQ,WAAW,YAAY,KAAK;AAAA,IACjD;AACA,WAAO,IAAI,mBAAmB;AAAA,MAC5B;AAAA,MACA,SAAS,KAAK;AAAA,MACd,GAAI,WAAW,kBAAkB,SAC7B,EAAE,eAAe,WAAW,cAAc,IAC1C,CAAC;AAAA,IACP,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,OACJ,OACA,UAAsC,CAAC,GACV;AAC7B,WAAO,MAAM,KAAK,YAAY,OAAO,OAAO;AAAA,EAC9C;AAAA,EAEA,MAAM,YACJ,OACA,UAAsC,CAAC,GACV;AAC7B,+BAA2B,OAAO,KAAK,OAAO;AAC9C,QAAI;AACF,YAAM,cAAc,KAAK,SAAS,OAAO,cAAc;AACrD,cAAM,OAAO,MAAM,UAAU,WAAW,MAAM,SAAS;AACvD,qCAA6B,MAAM,MAAM,SAAS;AAAA,MACpD,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,iBAAiB,8CAA8C,WAAW,KAAK,GAAG;AACpF,cAAM,IAAI,2CAA2C,eAAe,MAAM,SAAS;AAAA,MACrF;AACA,YAAM;AAAA,IACR;AACA,WAAO,IAAI,mBAAmB;AAAA,MAC5B;AAAA,MACA,SAAS,KAAK;AAAA,MACd,GAAI,QAAQ,kBAAkB,SAAY,EAAE,eAAe,QAAQ,cAAc,IAAI,CAAC;AAAA,IACxF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,OAAO,OAA+C;AAC1D,+BAA2B,OAAO,KAAK,OAAO;AAC9C,QAAI;AACF,YAAM,cAAc,KAAK,SAAS,OAAO,cAAc;AACrD,cAAM,UAAU,cAAc,MAAM,SAAS;AAAA,MAC/C,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,CAAC,WAAW,KAAK,EAAG,OAAM;AAAA,IAChC;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,WAAoC;AACxD,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,QAAQ,aAAa,GAAI,EAAE,YAAY;AACpF,UAAM,WAAW,MAAM;AAAA,MACrB,KAAK;AAAA,MACL,OAAO,cAAc,MAAM,UAAU,uBAAuB,WAAW,EAAE,UAAU,CAAC;AAAA,IACtF;AACA,WAAO,SAAS,WAAW,YAAY,KAAK;AAAA,EAC9C;AAAA,EAEA,MAAM,8BAAgD;AACpD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gCAAkD;AACtD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,sBAAsB,OAAkE;AAC5F,+BAA2B,OAAO,KAAK,OAAO;AAC9C,WAAO;AAAA,MACL,cAAc;AAAA,MACd,WAAW,MAAM;AAAA,MACjB,UAAU,wBAAwB,MAAM,QAAQ;AAAA,MAChD,aAAa,0CAA0C,MAAM,UAAU,MAAM,WAAW;AAAA,MACxF,OAAO,MAAM;AAAA,MACb,SAAS,MAAM;AAAA,MACf,qBAAqB,MAAM;AAAA,MAC3B,sBAAsB;AAAA,MACtB,wBAAwB,CAAC,GAAG,MAAM,sBAAsB;AAAA,MACxD,gBAAgB,MAAM;AAAA,MACtB,WAAW,MAAM;AAAA,MACjB,GAAI,KAAK,QAAQ,kBACb,CAAC,IACD,MAAM,eACJ,EAAE,cAAc,gBAAgB,MAAM,YAAY,EAAE,IACpD,CAAC;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,wBAAwB,OAAkE;AAC9F,QAAI,MAAM,iBAAiB,2BAA2B;AACpD,YAAM,IAAI;AAAA,QACR;AAAA,QACA,oDAAoD,OAAO,MAAM,YAAY,CAAC;AAAA,MAChF;AAAA,IACF;AACA,UAAM,WAAW;AAAA,MACf,MAAM,YAAY,OAAO,MAAM,aAAa,YAAY,CAAC,MAAM,QAAQ,MAAM,QAAQ,IAChF,MAAM,WACP;AAAA,IACN;AACA,QAAI,SAAS,SAAS,gBAAgB;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,mCAAmC,cAAc;AAAA,MACnD;AAAA,IACF;AACA,UAAM,QAAiC;AAAA,MACrC,cAAc;AAAA,MACd,WAAW,iBAAiB,MAAM,WAAW,WAAW;AAAA,MACxD;AAAA,MACA,aAAa,MAAM;AAAA,QACjB;AAAA,QACA,MAAM,eACJ,OAAO,MAAM,gBAAgB,YAC7B,CAAC,MAAM,QAAQ,MAAM,WAAW,IAC7B,MAAM,cACP;AAAA,QACJ,KAAK,QAAQ;AAAA,MACf;AAAA,MACA,OAAO,iBAAiB,MAAM,OAAO,OAAO;AAAA,MAC5C,SAAS,oBAAoB,MAAM,SAAS,SAAS;AAAA,MACrD,qBAAqB,iBAAiB,MAAM,qBAAqB,qBAAqB;AAAA,MACtF,sBAAsB;AAAA,MACtB,wBAAwB,MAAM,QAAQ,MAAM,sBAAsB,IAC9D;AAAA,QACE,MAAM,uBAAuB;AAAA,UAC3B,CAAC,UAA2B,OAAO,UAAU;AAAA,QAC/C;AAAA,MACF,IACA,CAAC;AAAA,MACL,gBAAgB,MAAM,mBAAmB;AAAA,MACzC,WAAW,oBAAoB,MAAM,WAAW,WAAW;AAAA,MAC3D,GAAI,MAAM,gBACV,OAAO,MAAM,iBAAiB,YAC9B,CAAC,MAAM,QAAQ,MAAM,YAAY,IAC7B;AAAA,QACE,cAAc;AAAA,UACZ,MAAM;AAAA,QACR;AAAA,MACF,IACA,CAAC;AAAA,IACP;AACA,+BAA2B,OAAO,KAAK,OAAO;AAC9C,WAAO;AAAA,EACT;AACF;;;AIl4DO,IAAM,0BAA0B,KAAK;AAGrC,IAAM,mBAAmB;AAAA,EAC9B,SAAS;AAAA,EACT,aAAa;AAAA,EACb,gBAAgB;AAAA,EAChB,cAAc;AAChB;AAWO,IAAM,6BAA6B;AAQ1C,IAAM,OAAO;AAEb,SAAS,WAAW,MAAyD;AAC3E,QAAM,cAAc,KAAK,WAAW,iBAAiB,WAAW;AAChE,QAAM,iBAAiB,KAAK,WAAW,iBAAiB,cAAc;AACtE,QAAM,eAAe,KAAK,WAAW,iBAAiB,YAAY;AAElE,MAAI,CAAC,CAAC,aAAa,gBAAgB,YAAY,EAAE,MAAM,CAAC,OAAO,MAAM,KAAK,KAAK,EAAE,CAAC,GAAG;AACnF,WAAO;AAAA,EACT;AACA,MAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,aAAc,QAAO;AAE7D,MAAI,KAAK,UAAU,KAAK,MAAM,UAAU,gBAAgB,KAAK,MAAM,cAAc,cAAc;AAC7F,WAAO;AAAA,EACT;AACA,SAAO,EAAE,WAAW,KAAK,IAAI,aAAa,gBAAgB,aAAa;AACzE;AAGO,IAAM,mCAAmC;AAGzC,IAAM,+BAA+B,KAAK;AAC1C,IAAM,8BAA8B,KAAK;AAczC,SAAS,mCAA+D;AAC7E,SAAO,EAAE,QAAQ,QAAW,UAAU,oBAAI,IAAI,EAAE;AAClD;AAGA,SAAS,aAAa,MAA6D;AACjF,SAAO,GAAG,OAAO,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,UAAU,CAAC,CAAC,EAAE,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE;AACzF;AAGA,SAAS,aAAwC,SAAc,QAAiC;AAC9F,QAAM,WAAW,WAAW,SAAY,IAAI,QAAQ,UAAU,CAAC,UAAU,MAAM,MAAM,MAAM;AAC3F,SAAO,YAAY,IAAI,UAAU,CAAC,GAAG,QAAQ,MAAM,QAAQ,GAAG,GAAG,QAAQ,MAAM,GAAG,QAAQ,CAAC;AAC7F;AAGA,SAAS,YAAY,UAAsC,IAAY,OAAqB;AAC1F,QAAM,SAAS,SAAS,SAAS,IAAI,EAAE,GAAG,SAAS,KAAK;AACxD,QAAME,SAAQ,KAAK;AAAA,IACjB;AAAA,IACA,+BAA+B,KAAK,KAAK,IAAI,QAAQ,GAAG,EAAE;AAAA,EAC5D;AACA,WAAS,SAAS,IAAI,IAAI,EAAE,OAAO,WAAW,QAAQA,OAAM,CAAC;AAC/D;AAGA,eAAe,aAAgB,MAAkB,QAA6C;AAC5F,MAAI,CAAC,OAAQ,QAAO,MAAM;AAC1B,OAAK,MAAM,MAAM;AAAA,EAAC,CAAC;AACnB,MAAI;AACJ,QAAM,UAAU,IAAI,QAAe,CAAC,GAAG,WAAW;AAChD,cAAU,MAAM,OAAO,IAAI,MAAM,uCAAuC,CAAC;AACzE,QAAI,OAAO,QAAS,SAAQ;AAAA,QACvB,QAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAAA,EAC/D,CAAC;AACD,UAAQ,MAAM,MAAM;AAAA,EAAC,CAAC;AACtB,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK,CAAC,MAAM,OAAO,CAAC;AAAA,EAC3C,UAAE;AACA,QAAI,QAAS,QAAO,oBAAoB,SAAS,OAAO;AAAA,EAC1D;AACF;AAoBA,eAAsB,oBAAoB,OAcJ;AACpC,QAAM,QAAQ,MAAM,SAAS,KAAK,IAAI;AACtC,QAAM,eAAe,MAAM,gBAAgB;AAC3C,QAAM,cAAc,KAAK,IAAI,GAAG,MAAM,eAAe,gCAAgC;AACrF,QAAM,SAAS,MAAM;AACrB,QAAM,WAAW,MAAM;AACvB,QAAM,SAAmC,EAAE,UAAU,GAAG,SAAS,CAAC,GAAG,QAAQ,EAAE;AAC/E,MAAI,QAAQ,QAAS,QAAO;AAC5B,QAAM,QAAQ,MAAM;AAAA,IAClB,MAAM,QAAQ,KAAK,EAAE,CAAC,iBAAiB,OAAO,GAAG,MAAM,QAAQ,CAAC;AAAA,IAChE;AAAA,EACF;AACA,QAAM,UAA+D,CAAC;AACtE,QAAM,SAAS,oBAAI,IAAY;AAC/B,aAAW,QAAQ,OAAO;AACxB,UAAM,WAAW,WAAW,IAAI;AAChC,QAAI,CAAC,SAAU;AACf,WAAO,YAAY;AACnB,WAAO,IAAI,SAAS,SAAS;AAC7B,QAAI,QAAQ,KAAK,aAAa,wBAAyB;AACvD,UAAM,UAAU,UAAU,SAAS,IAAI,SAAS,SAAS;AACzD,QAAI,WAAW,QAAQ,YAAY,MAAO;AAC1C,YAAQ,KAAK,EAAE,KAAK,aAAa,IAAI,GAAG,SAAS,CAAC;AAAA,EACpD;AACA,MAAI,UAAU;AAEZ,eAAW,aAAa,SAAS,SAAS,KAAK,GAAG;AAChD,UAAI,CAAC,OAAO,IAAI,SAAS,EAAG,UAAS,SAAS,OAAO,SAAS;AAAA,IAChE;AAAA,EACF;AACA,UAAQ,KAAK,CAAC,GAAG,MAAO,EAAE,MAAM,EAAE,MAAM,KAAK,EAAE,MAAM,EAAE,MAAM,IAAI,CAAE;AAEnE,QAAM,aAAa,aAAa,SAAS,UAAU,MAAM;AACzD,QAAM,gBAAgB,CAAC,cAA4B;AACjD,WAAO,UAAU;AACjB,QAAI,SAAU,aAAY,UAAU,WAAW,KAAK;AAAA,EACtD;AACA,MAAI,OAAO;AACX,MAAI,UAAU;AACd,QAAM,OAAO,YAA2B;AACtC,WAAO,OAAO,WAAW,UAAU,UAAU,gBAAgB,CAAC,MAAM,QAAQ,SAAS;AACnF,YAAM,EAAE,KAAK,SAAS,IAAI,WAAW,IAAI;AACzC,cAAQ;AACR,UAAI,SAAU,UAAS,SAAS;AAChC,UAAI;AACF,YAAI,MAAM,aAAa,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG;AACrD,oBAAU,SAAS,OAAO,SAAS,SAAS;AAC5C;AAAA,QACF;AACA,YAAI,QAAQ,QAAS;AACrB,mBAAW;AACX,cAAM;AAAA,UACJ,MAAM,iBAAiB;AAAA,YACrB,aAAa,SAAS;AAAA,YACtB,cAAc,SAAS;AAAA,UACzB,CAAC;AAAA,UACD;AAAA,QACF;AACA,cAAM,MAAM,QAAQ,OAAO,SAAS,SAAS;AAC7C,eAAO,QAAQ,KAAK,QAAQ;AAC5B,kBAAU,SAAS,OAAO,SAAS,SAAS;AAAA,MAC9C,QAAQ;AAEN,YAAI,QAAQ,QAAS;AACrB,sBAAc,SAAS,SAAS;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAQ,IAAI,MAAM,KAAK,EAAE,QAAQ,KAAK,IAAI,aAAa,WAAW,MAAM,EAAE,GAAG,IAAI,CAAC;AACxF,SAAO;AACT;AAyBA,eAAsB,iCAAiC,OAS8B;AACnF,QAAM,QAAQ,MAAM,SAAS,KAAK,IAAI;AACtC,QAAM,cAAc,KAAK,IAAI,GAAG,MAAM,eAAe,gCAAgC;AACrF,QAAM,EAAE,QAAQ,SAAS,IAAI;AAC7B,QAAM,SAAS,EAAE,UAAU,GAAG,SAAS,CAAC,GAA+B,QAAQ,EAAE;AACjF,MAAI,QAAQ,QAAS,QAAO;AAC5B,MAAI,QAAQ,UAAU;AACtB,MAAI,OAAO,MAAM,aAAa,MAAM,KAAK,KAAK,GAAG,MAAM;AACvD,MAAI,KAAK,WAAW,WAAW,KAAK,UAAU,QAAW;AAEvD,YAAQ;AACR,WAAO,MAAM,aAAa,MAAM,KAAK,MAAS,GAAG,MAAM;AAAA,EACzD;AACA,QAAM,SAAS,KAAK;AACpB,SAAO,WAAW,OAAO;AACzB,QAAM,OAAO,OAAO,GAAG,EAAE,GAAG;AAC5B,MAAI,UAAU;AAEZ,UAAM,MAAM,IAAI,IAAI,OAAO,IAAI,CAAC,cAAc,UAAU,YAAY,CAAC;AACrE,UAAM,UAAU,CAAC,QACd,UAAU,UAAa,KAAK,WAAW,CAAC,KAAK,QAAS,SAAS,UAAa,MAAM;AACrF,eAAW,MAAM,SAAS,SAAS,KAAK,GAAG;AACzC,UAAI,QAAQ,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,EAAG,UAAS,SAAS,OAAO,EAAE;AAAA,IAC9D;AAAA,EACF;AACA,MAAI,OAAO;AACX,QAAM,OAAO,YAA2B;AACtC,WAAO,OAAO,OAAO,UAAU,CAAC,MAAM,QAAQ,SAAS;AACrD,YAAM,YAAY,OAAO,IAAI;AAC7B,cAAQ;AACR,UAAI,SAAU,UAAS,SAAS,UAAU;AAC1C,YAAM,UAAU,UAAU,SAAS,IAAI,UAAU,YAAY;AAC7D,UAAI,WAAW,QAAQ,YAAY,MAAO;AAC1C,UAAI;AACF,YAAI,MAAM,aAAa,MAAM,OAAO,SAAS,GAAG,MAAM,EAAG,QAAO,QAAQ,KAAK,SAAS;AACtF,kBAAU,SAAS,OAAO,UAAU,YAAY;AAAA,MAClD,QAAQ;AAEN,YAAI,QAAQ,QAAS;AACrB,eAAO,UAAU;AACjB,YAAI,SAAU,aAAY,UAAU,UAAU,cAAc,KAAK;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAQ,IAAI,MAAM,KAAK,EAAE,QAAQ,KAAK,IAAI,aAAa,OAAO,MAAM,EAAE,GAAG,IAAI,CAAC;AAGpF,MAAI,YAAY,QAAQ,OAAO,UAAU,CAAC,QAAQ,SAAS;AACzD,aAAS,SAAS,KAAK,OAAO,OAAO;AAAA,EACvC;AACA,SAAO;AACT;;;ALnPO,IAAM,yBAAyB;AAC/B,IAAM,wBAAwB;AACrC,IAAM,uBAAuB;AAG7B,IAAM,mBAAmB;AAoDzB,SAAS,kBAAkB,SAAyC;AAClE,SAAO,IAAI,uBAAuB;AAAA,IAChC;AAAA,IACA,MAAM,UAAU;AAAA,IAChB,QAAQ;AAAA,IACR,WAAW;AAAA,IACX,cAAc;AAAA,EAChB,CAAC;AACH;AAEA,SAAS,cAAc,UAAoC;AACzD,SACE,SAAS,OAAO,SAAS,UAAU,4BACnC,SAAS,MAAM,SAAS,qBAAqB,MAAM;AAAA,EAEnD,SAAS,MAAM,SAAS,8BAA8B,MAAM;AAAA;AAAA,EAG5D,SAAS,MAAM,SAAS,mCAAmC,MAAM;AAErE;AAsBO,IAAM,kBAAN,MAAsB;AAAA,EAM3B,YAA6B,MAA2B;AAA3B;AAC3B,SAAK,MAAM,KAAK,OAAO,KAAK;AAC5B,SAAK,QAAQ,KAAK,UAAU,CAAC,OAAO,IAAI,QAAQ,CAACC,aAAY,WAAWA,UAAS,EAAE,CAAC;AAAA,EACtF;AAAA,EARQ,WAAmD;AAAA,EACnD,eAAe,OAAO;AAAA,EACb;AAAA,EACA;AAAA,EAOjB,IAAI,iBAAyB;AAC3B,WAAO,KAAK,KAAK;AAAA,EACnB;AAAA;AAAA,EAGA,MAAM,UAAkD;AACtD,WAAO,MAAM,KAAK,KAAK,kBAAkB;AAAA,EAC3C;AAAA;AAAA,EAGA,MAAM,QAAyC;AAC7C,UAAM,aAAa,MAAM,KAAK,KAAK,kBAAkB;AACrD,QAAI,WAAY,QAAO;AACvB,WAAO,MAAM,KAAK,QAAQ;AAAA,EAC5B;AAAA;AAAA,EAGA,MAAM,UAA2C;AAC/C,SAAK,aAAa,KAAK,YAAY,EAAE,QAAQ,MAAM;AACjD,WAAK,WAAW;AAAA,IAClB,CAAC;AACD,WAAO,MAAM,KAAK;AAAA,EACpB;AAAA;AAAA,EAGA,MAAM,OAAsB;AAC1B,QAAI,KAAK,IAAI,IAAI,KAAK,eAAe,iBAAkB;AACvD,SAAK,eAAe,KAAK,IAAI;AAC7B,QAAI;AACF,YAAM,KAAK,KAAK,QAAQ,KAAK,KAAK,KAAK,SAAS;AAAA,IAClD,SAAS,OAAO;AACd,UAAI,qBAAqB,KAAK,GAAG;AAC/B,cAAM,IAAI,2CAA2C,WAAW,KAAK,KAAK,SAAS;AAAA,MACrF;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,aAAa,UAAmD;AACpE,QAAI,UAAU;AACd,eAAS;AACP,YAAM,aAAa,MAAM,KAAK,KAAK,kBAAkB;AACrD,UAAI,cAAe,MAAM,KAAK,KAAK,MAAM,UAAU,EAAE,MAAM,MAAM,KAAK,GAAI;AACxE,eAAO;AAAA,MACT;AACA,UAAI,KAAK,IAAI,KAAK,UAAU;AAC1B,cAAM;AAAA,UACJ,gCAAgC,KAAK,KAAK,SAAS,0BAA0B,KAAK,MAAM,KAAK,KAAK,iBAAiB,GAAI,CAAC;AAAA,QAC1H;AAAA,MACF;AACA,YAAM,KAAK,MAAM,KAAK,IAAI,SAAS,KAAK,IAAI,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC;AACtE,gBAAU,KAAK,IAAI,KAAO,UAAU,CAAC;AAAA,IACvC;AAAA,EACF;AAAA,EAEA,MAAc,cAA+C;AAC3D,UAAM,WAAW,KAAK,IAAI,IAAI,KAAK,KAAK;AACxC,SAAK,eAAe,OAAO;AAC3B,UAAM,KAAK,KAAK;AAChB,WAAO,MAAM,KAAK,aAAa,QAAQ;AAAA,EACzC;AACF;AAUO,IAAM,0BAAN,MAAoD;AAAA,EACzD,YACmB,OACA,MACA,cACA,MAAoB,KAAK,KACzB,QAAuC,CAAC,OACvD,IAAI,QAAQ,CAACA,aAAY,WAAWA,UAAS,EAAE,CAAC,GAClD;AANiB;AACA;AACA;AACA;AACA;AAAA,EAEhB;AAAA,EAEH,MAAM,QACJ,SACA,KACA,MAC0B;AAC1B,QAAI,WAAW,MAAM,KAAK,MAAM,QAAQ,SAAS,KAAK,IAAI;AAC1D,QAAI,CAAC,cAAc,QAAQ,EAAG,QAAO;AACrC,UAAM,WAAW,KAAK,IAAI,IAAI,KAAK,KAAK;AACxC,QAAI,UAAU;AACd,WAAO,cAAc,QAAQ,KAAK,KAAK,IAAI,IAAI,UAAU;AAIvD,YAAM,OAAO,MAAM,KAAK,KAAK,QAAQ,EAAE,MAAM,MAAM,IAAI;AACvD,UACE,QACA,WAAW,KAAK,aAAa,KAAK,cAAc,KAAK,oBAAoB,MAAM,SAC/E;AACA,eAAO;AAAA,MACT;AAEA,YAAM,KAAK,KAAK,KAAK;AACrB,YAAM,aAAa,MAAM,KAAK,KAAK,MAAM,EAAE,MAAM,MAAM,IAAI;AAC3D,UAAI,YAAY;AACd,cAAM,UAAU;AAAA,UACd,WAAW;AAAA,UACX,KAAK;AAAA,UACL,WAAW;AAAA,QACb;AACA,YAAI,YAAY,QAAS,QAAO;AAAA,MAClC;AACA,YAAM,KAAK,MAAM,KAAK,IAAI,SAAS,KAAK,IAAI,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC;AACtE,gBAAU,KAAK,IAAI,KAAO,UAAU,CAAC;AACrC,iBAAW,MAAM,KAAK,MAAM,QAAQ,SAAS,KAAK,IAAI;AAAA,IACxD;AACA,WAAO;AAAA,EACT;AACF;AAEA,IAAM,oBAAoB;AAcnB,SAAS,iCAAiC,OASP;AACxC,QAAM,MAAM,MAAM,OAAO,KAAK;AAC9B,QAAM,YAAY,oBAAI,IAAoC;AAC1D,QAAM,eAAe,oBAAI,IAAoB;AAC7C,SAAO,OAAO,YAAY;AACxB,UAAM,QAAQ,kBAAkB,KAAK,OAAO;AAC5C,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,CAAE,MAAM,MAAM,kBAAkB,OAAO,EAAE,MAAM,MAAM,IAAI,EAAI,QAAO;AACxE,UAAM,QAAQ,EAAE,aAAa,MAAM,CAAC,GAAI,cAAc,MAAM,CAAC,EAAG;AAChE,UAAM,MAAM,GAAG,MAAM,WAAW,IAAI,MAAM,YAAY;AACtD,QAAI,SAAS,UAAU,IAAI,GAAG;AAC9B,QAAI,CAAC,QAAQ;AACX,eAAS,MAAM,UAAU,KAAK;AAC9B,gBAAU,IAAI,KAAK,MAAM;AAEzB,YAAM,UAAU;AAChB,WAAK,QAAQ,MAAM,MAAM;AACvB,YAAI,UAAU,IAAI,GAAG,MAAM,QAAS,WAAU,OAAO,GAAG;AAAA,MAC1D,CAAC;AAAA,IACH;AACA,UAAM,YAAY,MAAM,OAAO,MAAM,MAAM,IAAI;AAC/C,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,OAAO,IAAI;AACjB,QAAI,QAAQ,aAAa,IAAI,SAAS,KAAK,OAAO,qBAAqB,kBAAkB;AACvF,aAAO;AAAA,IACT;AACA,iBAAa,IAAI,WAAW,IAAI;AAChC,QAAI;AACF,YAAM,MAAM,QAAQ,KAAK,SAAS;AAAA,IACpC,SAAS,OAAO;AAEd,UAAI,qBAAqB,KAAK,EAAG,QAAO;AAAA,IAC1C;AACA,WAAO;AAAA,EACT;AACF;AAgBA,SAAS,cAA8B;AACrC,SAAO;AAAA,IACL,WAAWC,YAAW;AAAA,IACtB,OAAO;AAAA,IACP,gBAAgB;AAAA,IAChB,IAAI;AAAA,MACF,OAAO;AAAA,MACP,MAAM;AAAA,QACJ,OAAO,OAAO,KAAK,MAAM,KAAK,OAAO,IAAI,OAAO,gBAAgB,CAAC;AAAA,QACjE,uBAAuB;AAAA,MACzB;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAASC,eAAc,MAAsB;AAC3C,QAAM,WAAW,KAAK,WAAW,GAAG,IAChCC,OAAM,UAAU,IAAI,IACpBA,OAAM,KAAK,wBAAwB,sBAAsB,IAAI,CAAC;AAClE,MAAI,aAAa,0BAA0B,CAAC,SAAS,WAAW,GAAG,sBAAsB,GAAG,GAAG;AAC7F,UAAM,IAAI,0BAA0B,6CAA6C,IAAI,EAAE;AAAA,EACzF;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,UAA0B;AACzD,MAAI,SAAS,SAAS,wBAAwB;AAC5C,UAAM,IAAI,0BAA0B,iCAAiC,sBAAsB,GAAG;AAAA,EAChG;AACA,MACE,SAAS,MAAM,SAAS,KACxB,SAAS,OAAO,SAAS,KACzB,SAAS,gBAAgB,SAAS,GAClC;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEO,IAAM,wBAAN,MAAM,+BAA8B,kBAAkB;AAAA,EACzC,YAAY;AAAA,EAEb;AAAA,EACR;AAAA,EACQ;AAAA,EAEjB,YAAY,MAA0B;AACpC,UAAM,EAAE,OAAO,OAAO,QAAQ,IAAI;AAClC,UAAM,oBAAoB,MACxB,MAAM,kBAAkB,EAAE,aAAa,MAAM,aAAa,cAAc,MAAM,aAAa,CAAC;AAC9F,UAAM,SAAS,MAAM,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAO9B,gBAAgB,OAAO,YAAY;AACjC,cAAM,aAAa,MAAM,kBAAkB,EAAE,MAAM,MAAM,IAAI;AAC7D,YACE,cACA;AAAA,UACE,WAAW;AAAA,UACX,MAAM;AAAA,UACN,WAAW;AAAA,QACb,MAAM,SACN;AACA,iBAAO;AAAA,QACT;AACA,cAAM,KAAK,KAAK;AAChB,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AACD,UAAM,OACJ,KAAK,QACL,IAAI,gBAAgB;AAAA,MAClB;AAAA,MACA,WAAW,MAAM;AAAA,MACjB,cAAc,MAAM;AAAA,MACpB;AAAA,MACA,OAAO,OAAO,eAAe;AAC3B,cAAM,MAAM,MAAM,OAAO;AAAA,UACvB,WAAW,WAAW,aAAa,MAAM,cAAc,WAAW,oBAAoB;AAAA,UACtF,YAAY;AAAA,UACZ,EAAE,WAAW,IAAM;AAAA,QACrB;AACA,eAAO,CAAC,IAAI,SAAS,IAAI,QAAQ,UAAU;AAAA,MAC7C;AAAA,MACA,gBAAgB,KAAK;AAAA,IACvB,CAAC;AACH,UAAM,YAAY,MAAM,kBAAkB;AAC1C,UAAM,OAAO,KAAK,QAAQ,CAAC;AAC3B,UAAM,4BAA4B,YAAmD;AACnF,YAAM,aAAa,MAAM,KAAK,MAAM;AACpC,aAAO;AAAA,QACL,aAAa,WAAW;AAAA,QACxB,sBAAsB,WAAW;AAAA,QACjC,eAAe,WAAW,iBAAiB;AAAA,QAC3C,GAAI,WAAW,YAAY,YACvB;AAAA,UACE,UAAU;AAAA,YACR;AAAA,YACA,GAAI,KAAK,cAAc,SAAY,EAAE,SAAS,KAAK,UAAU,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,YAIlE,wBAAwB;AAAA,YACxB,sBAAsB,WAAW;AAAA,UACnC;AAAA,QACF,IACA,CAAC;AAAA,QACL,yBAAyB;AAAA,UACvB,gBAAgB;AAAA,UAChB,iBAAiB;AAAA,UACjB,kBAAkB;AAAA,UAClB,UAAU;AAAA,QACZ;AAAA,QACA,kCAAkC;AAAA,QAClC,4BAA4B;AAAA,QAC5B,+BAA+B,WAAW;AAAA,QAC1C,sCAAsC,WAAW;AAAA,QACjD,6BAA6B,WAAW;AAAA,QACxC,gBAAgB,WAAW;AAAA,MAC7B;AAAA,IACF;AACA,UAAM;AAAA,MACJ,aAAa,MAAM;AAAA,MACnB,SAAS,MAAM;AAAA;AAAA;AAAA,MAGf,sBAAsB;AAAA,MACtB,YAAY,IAAI,wBAAwB,QAAQ,MAAM,MAAM,YAAY;AAAA,MACxE,OAAO,KAAK;AAAA,MACZ,eAAe;AAAA,MACf,aAAa,MAAM;AAAA,MACnB;AAAA;AAAA;AAAA;AAAA,MAIA,wBAAwB,aAAa,MAAM,kBAAkB,IAAI,wBAAwB;AAAA,MACzF,GAAI,KAAK,qBAAqB,SAAY,EAAE,WAAW,KAAK,iBAAiB,IAAI,CAAC;AAAA,MAClF,GAAI,KAAK,kBAAkB,SAAY,EAAE,eAAe,KAAK,cAAc,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,MAKhF,GAAI,KAAK,oBAAoB,SAAY,EAAE,iBAAiB,KAAK,gBAAgB,IAAI,CAAC;AAAA,MACtF,GAAI,KAAK,yBACL,EAAE,wBAAwB,KAAK,uBAAuB,IACtD,CAAC;AAAA,MACL,GAAI,KAAK,iBAAiB,EAAE,gBAAgB,KAAK,eAAe,IAAI,CAAC;AAAA,MACrE,GAAI,KAAK,0BACL,EAAE,yBAAyB,KAAK,wBAAwB,IACxD,CAAC;AAAA,MACL,GAAI,KAAK,iCACL,EAAE,gCAAgC,KAAK,+BAA+B,IACtE,CAAC;AAAA,MACL,GAAI,KAAK,OAAO,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACvC,GAAI,KAAK,2BACL,EAAE,0BAA0B,KAAK,yBAAyB,IAC1D,CAAC;AAAA,IACP,CAAC;AAGD,IAAC,KAAgD,QAAQ;AACzD,SAAK,cAAc;AACnB,SAAK,OAAO;AACZ,SAAK,gBAAgB,KAAK;AAAA,EAC5B;AAAA,EAEA,IAAI,YAAoB;AACtB,WAAO,KAAK,MAAM;AAAA,EACpB;AAAA;AAAA,EAGA,SAAS,MAA8C;AACrD,WAAO,IAAI,uBAAsB,EAAE,GAAG,KAAK,aAAa,MAAM,KAAK,MAAM,KAAK,CAAC;AAAA,EACjF;AAAA;AAAA;AAAA,EAIA,MAAM,eAA8B;AAClC,UAAM,KAAK,KAAK,MAAM;AAAA,EACxB;AAAA;AAAA,EAGA,MAAM,QAAuB;AAAA,EAAC;AAAA,EAE9B,MAAM,UAA4B;AAChC,QAAI;AACF,YAAM,KAAK,YAAY,QAAQ,IAAI,KAAK,MAAM,SAAS;AACvD,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,qBAAqB,KAAK,EAAG,QAAO;AACxC,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA,EAIA,MAAM,SAAwB;AAC5B,UAAM,iBAAiB,KAAK,YAAY,SAAS,KAAK,YAAY,OAAO,KAAK,KAAK;AAAA,EACrF;AAAA;AAAA,EAGA,MAAM,QAAuB;AAAA,EAAC;AAAA;AAAA;AAAA,EAI9B,IAAuB,gBAAyB;AAC9C,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAc,qBAAqB,OAA0C;AAC3E,QAAI,SAAS,CAAE,MAAM,KAAK,mBAAmB,GAAI;AAC/C,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,IAAI,KAAa,OAAe,OAAgB;AAC5D,UAAM,SAAS,MAAM,KAAK,KAAK,EAAE,KAAK,iBAAiB,KAAO,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC,EAAG,CAAC;AAC3F,QAAI,OAAO,aAAa,GAAG;AACzB,YAAM,IAAI,qBAAqB,WAAW,KAAK,WAAW;AAAA,QACxD,WAAW,KAAK,MAAM;AAAA,QACtB,UAAU,OAAO,YAAY;AAAA,QAC7B,QAAQ,OAAO,OAAO,MAAM,IAAM;AAAA,MACpC,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,aAAa,MAAc,OAAmB,OAA+B;AACzF,UAAM,SAAS,QAAQ,EAAE,MAAM,IAAI,CAAC;AACpC,UAAM,KAAK,UAAU;AAAA,MACnB;AAAA,MACA,SAAS,MAAM,SAAS,GAAG,2BAA2B;AAAA,MACtD,GAAG;AAAA,IACL,CAAC;AACD,aACM,SAAS,6BACb,SAAS,MAAM,YACf,UAAU,6BACV;AACA,YAAM,KAAK,UAAU;AAAA,QACnB;AAAA,QACA,SAAS,MAAM,SAAS,QAAQ,SAAS,2BAA2B;AAAA,QACpE,QAAQ;AAAA,QACR,GAAG;AAAA,MACL,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAc,iBAAiB,QAAgB,OAAc,OAA+B;AAC1F,QAAI,MAAM,UAAU,QAAW;AAC7B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,MAAM,gBAAgB,OAAW;AACrC,UAAM,QAAQ,IAAI,YAAY,MAAM,WAAW,EAAE,OAAO,IAAI,KAAO,SAAS,CAAC;AAC7E,UAAM,KAAK,IAAI,SAAS,IAAI,OAAO,WAAW,MAAM,CAAC,IAAI,qBAAqB,KAAK;AAAA,EACrF;AAAA,EAEA,MAAc,YAAY,MAAc,OAAc,OAA+B;AACnF,UAAM,SAASD,eAAc,IAAI;AACjC,QAAI,MAAM,SAAS,OAAO;AACxB,YAAM,KAAK,IAAI,eAAe,WAAW,MAAM,CAAC,IAAI,6BAA6B,KAAK;AACtF,iBAAW,CAAC,WAAW,KAAK,KAAK,OAAO,QAAQ,MAAM,YAAY,CAAC,CAAC,GAAG;AACrE,cAAM,KAAK,YAAYC,OAAM,KAAK,MAAM,SAAS,GAAG,OAAO,KAAK;AAAA,MAClE;AACA,YAAM,KAAK,iBAAiB,QAAQ,OAAO,KAAK;AAChD;AAAA,IACF;AACA,QAAI,MAAM,SAAS,QAAQ;AACzB,YAAM,UACJ,OAAO,MAAM,YAAY,WAAW,IAAI,YAAY,EAAE,OAAO,MAAM,OAAO,IAAI,MAAM;AACtF,YAAM,KAAK,aAAa,QAAQ,SAAS,KAAK;AAC9C,YAAM,KAAK,iBAAiB,QAAQ,OAAO,KAAK;AAChD;AAAA,IACF;AACA,QAAI,MAAM,SAAS,YAAY;AAC7B,YAAM,OAAO,qBAAqBF,YAAW,CAAC;AAC9C,YAAM,UAAU,MAAM,UAAU,sBAAsB,MAAM,OAAO,IAAI;AACvE,YAAM,SAAS;AAAA,QACb;AAAA,QACA,aAAa,WAAW,IAAI,CAAC,IAAI,WAAW,MAAM,CAAC;AAAA,QACnD,eAAe,WAAWE,OAAM,QAAQ,MAAM,CAAC,CAAC;AAAA,QAChD,qCAAqC,WAAW,MAAM,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC;AAAA,QAC/E,GAAI,MAAM,MACN;AAAA,UACE,UAAU,WAAW,IAAI,CAAC,2BAA2B,WAAW,MAAM,GAAG,CAAC;AAAA,UAC1E,UAAU,WAAW,IAAI,CAAC;AAAA,QAC5B,IACA,CAAC,UAAU,WAAW,IAAI,CAAC,yBAAyB;AAAA,QACxD,UACI,eAAe,WAAW,MAAM,CAAC,gBAAgB,WAAW,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,WAAW,MAAM,CAAC,KACzG,SAAS,WAAW,IAAI,CAAC,IAAI,WAAW,MAAM,CAAC;AAAA,QACnD,UAAU,aAAa,WAAW,IAAI,CAAC,KAAK;AAAA,MAC9C,EAAE,KAAK,IAAI;AACX,YAAM,KAAK,IAAI,QAAQ,kCAAkC,KAAK;AAC9D,YAAM,KAAK,iBAAiB,QAAQ,OAAO,KAAK;AAChD;AAAA,IACF;AAGA,UAAM,IAAI;AAAA,MACR,yDAAyD,MAAM,IAAI;AAAA,IACrE;AAAA,EACF;AAAA,EAEA,MAAe,iBAAiB,MAA2C;AACzE,UAAM,KAAK,qBAAqB,KAAK,KAAK;AAC1C,UAAM,KAAK,YAAY,KAAK,MAAM,KAAK,OAAO,KAAK,KAAK;AACxD,SAAK,MAAM,WAAW,wBAAwB,KAAK,MAAM,UAAU,KAAK,MAAM,KAAK,KAAK;AAAA,EAC1F;AAAA,EAEA,MAAM,cAAc,UAAoB,OAA+B;AACrE,UAAM,KAAK,qBAAqB,KAAK;AACrC,4BAAwB,QAAQ;AAChC,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,SAAS,OAAO,GAAG;AAC5D,YAAM,KAAK,YAAY,MAAM,OAAO,KAAK;AAAA,IAC3C;AACA,UAAM,eAAe,mBAAmB,KAAK,MAAM,UAAU,QAAQ;AACrE,SAAK,MAAM,cAAc,MAAM;AAAA,MAC7B,KAAK,MAAM;AAAA,MACX;AAAA,MACA,KAAK,MAAM;AAAA,IACb;AACA,SAAK,MAAM,WAAW;AAAA,EACxB;AAAA,EAEQ,sBAAsB,SAAmC;AAC/D,WAAO;AAAA,MACL,SAAS,kBAAkB,SAAY,KAAK,gBAAgB,QAAQ;AAAA,IACtE;AAAA,EACF;AAAA;AAAA;AAAA,EAIA,MAAM,sBAA2C;AAC/C,UAAM,cAAc,GAAG,oBAAoB,YAAYF,YAAW,CAAC;AACnE,UAAM,WAAW;AAAA,MACf,GAAG,KAAK,MAAM,SAAS,0BAA0B;AAAA,MACjD;AAAA,MACA;AAAA,IACF,EAAE,KAAK;AACP,UAAM,cAAc,SAAS,QAAQ,CAAC,SAAS;AAAA,MAC7C,WAAW,aAAa,IAAI,EAAE;AAAA,MAC9B,WAAW,eAAe,IAAI,EAAE;AAAA,IAClC,CAAC;AACD,UAAM,SAAS,OAAO;AAAA,WACf,WAAW,oBAAoB,CAAC;AAAA,KACtC,WAAW,sBAAsB,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,MAKjC,YAAY,KAAK,GAAG,CAAC,qGAAqG,WAAW,WAAW,CAAC;AACnJ,QAAI;AACF,YAAM,SAAS,MAAM,KAAK,KAAK,EAAE,KAAK,QAAQ,iBAAiB,IAAM,CAAC;AACtE,UAAI,OAAO,aAAa,GAAG;AACzB,cAAM,IAAI,oBAAoB,4CAA4C;AAAA,UACxE,WAAW,KAAK,MAAM;AAAA,UACtB,UAAU,OAAO,YAAY;AAAA,QAC/B,CAAC;AAAA,MACH;AACA,YAAM,QAAQ,MAAM,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AACvD,YAAM,SAAS,KAAK,sBAAsB;AAC1C,UAAI,UAAU,OAAO,kBAAkB,QAAQ,MAAM,aAAa,OAAO,eAAe;AACtF,cAAM,IAAI,oBAAoB,mDAAmD;AAAA,UAC/E,cAAc,MAAM;AAAA,UACpB,eAAe,OAAO;AAAA,QACxB,CAAC;AAAA,MACH;AACA,aAAO;AAAA,IACT,UAAE;AACA,YAAM,KAAK,KAAK,EAAE,KAAK,YAAY,WAAW,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,IACvF;AAAA,EACF;AAAA,EAEA,MAAM,mBAAwC;AAC5C,WAAO,MAAM,KAAK,oBAAoB;AAAA,EACxC;AAAA,EAEA,MAAM,iBACJ,MACA,UAAmC,CAAC,GACrB;AACf,UAAM,QAAQ,MAAM,aAAa,IAAI;AACrC,UAAM,SAAS,KAAK,sBAAsB,OAAO;AACjD,QAAI,UAAU,OAAO,kBAAkB,QAAQ,MAAM,aAAa,OAAO,eAAe;AACtF,YAAM,IAAI,oBAAoB,mDAAmD;AAAA,QAC/E,cAAc,MAAM;AAAA,QACpB,eAAe,OAAO;AAAA,MACxB,CAAC;AAAA,IACH;AACA,UAAM,cAAc,GAAG,oBAAoB,YAAYA,YAAW,CAAC;AACnE,UAAM,cAAc,GAAG,sBAAsB,sBAAsBA,YAAW,CAAC;AAC/E,UAAM,aAAa,GAAG,sBAAsB,kBAAkBA,YAAW,CAAC;AAC1E,UAAM,KAAK,IAAI,eAAe,WAAW,oBAAoB,CAAC,IAAI,iBAAiB;AACnF,UAAM,KAAK,aAAa,aAAa,KAAK;AAC1C,UAAM,WAAW,CAAC,GAAG,KAAK,MAAM,SAAS,0BAA0B,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI;AACtF,UAAM,WAAW,CAAC,UAChB,UAAU,QAAQ,UAAU,SAAY,OAAO,OAAO,KAAK;AAC7D,UAAM,UAAU;AAAA,MACd;AAAA,MACA;AAAA,MACA,WAAW,qBAAqB,CAAC;AAAA,MACjC,WAAW,WAAW;AAAA,MACtB,WAAW,sBAAsB;AAAA,MACjC,WAAW,WAAW;AAAA,MACtB,WAAW,UAAU;AAAA,MACrB,WAAW,SAAS,QAAQ,UAAU,CAAC;AAAA,MACvC,WAAW,SAAS,QAAQ,iBAAiB,CAAC;AAAA,MAC9C,WAAW,QAAQ;AAAA,IACrB,EAAE,KAAK,GAAG;AACV,QAAI;AACF,YAAM,SAAS,MAAM,KAAK,KAAK,EAAE,KAAK,SAAS,iBAAiB,IAAM,CAAC;AACvE,UAAI,OAAO,aAAa,GAAG;AACzB,cAAM,IAAI,oBAAoB,4CAA4C;AAAA,UACxE,WAAW,KAAK,MAAM;AAAA,UACtB,UAAU,OAAO,YAAY;AAAA,UAC7B,QAAQ,OAAO,OAAO,MAAM,IAAM;AAAA,QACpC,CAAC;AAAA,MACH;AACA,WAAK,MAAM,iBAAiB;AAAA,IAC9B,UAAE;AACA,YAAM,KAAK,KAAK;AAAA,QACd,KAAK,aAAa,WAAW,WAAW,CAAC,IAAI,WAAW,WAAW,CAAC,IAAI,WAAW,UAAU,CAAC;AAAA,MAChG,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,IAC1B;AAAA,EACF;AAAA,EAEA,MAAe,wBAAwC;AACrD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,iBACpB,SACA,OACA,OACe;AACf,QAAM,QAAQ,OAAO,MAAM,SAAS;AACpC,QAAM,MAAM,iBAAiB;AAAA,IAC3B,aAAa,MAAM;AAAA,IACnB,cAAc,MAAM;AAAA,EACtB,CAAC;AACH;AAaA,eAAsB,qBACpB,SACA,OACA,OACA,QAAgB,KAAK,IAAI,GACP;AAClB,QAAM,QAAQ,MAAM,QAAQ,cAAc,MAAM,YAAY;AAC5D,MAAI,MAAM,UAAU,QAAQ;AAC1B,UAAM,QAAQ,OAAO,MAAM,QAAQ,EAAE;AAAA,EACvC,WAAW,MAAM,UAAU,UAAU,QAAQ,MAAM,cAAc,yBAAyB;AACxF,WAAO;AAAA,EACT;AACA,QAAM,MAAM,iBAAiB;AAAA,IAC3B,aAAa,MAAM;AAAA,IACnB,cAAc,MAAM;AAAA,EACtB,CAAC;AACD,SAAO;AACT;AAyBA,SAASG,kBAAiB,OAAgB,OAAuB;AAC/D,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI,mBAAmB,WAAW,kCAAkC,KAAK,EAAE;AAAA,EACnF;AACA,SAAO;AACT;AAEO,IAAM,uBAAN,MAA2B;AAAA,EACvB,YAAY;AAAA,EACZ,yBAAyB;AAAA,EACjB;AAAA,EAEjB,YAAY,SAAsC;AAChD,SAAK,UAAU,EAAE,GAAG,SAAS,aAAa,EAAE,GAAI,QAAQ,eAAe,CAAC,EAAG,EAAE;AAAA,EAC/E;AAAA,EAEQ,QAAQ,OAAyB,eAA6C;AACpF,WAAO,IAAI,sBAAsB;AAAA,MAC/B;AAAA,MACA,SAAS,KAAK,QAAQ;AAAA,MACtB,OAAO,KAAK,QAAQ,MAAM;AAAA,MAC1B,OAAO,KAAK,QAAQ;AAAA,MACpB,gBAAgB,KAAK,QAAQ;AAAA,MAC7B,GAAI,KAAK,QAAQ,qBAAqB,SAClC,EAAE,kBAAkB,KAAK,QAAQ,iBAAiB,IAClD,CAAC;AAAA,MACL,GAAI,KAAK,QAAQ,kBAAkB,SAC/B,EAAE,eAAe,KAAK,QAAQ,cAAc,IAC5C,CAAC;AAAA,MACL,GAAI,kBAAkB,SAAY,EAAE,cAAc,IAAI,CAAC;AAAA,IACzD,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,OACJ,MACA,SACgC;AAChC,UAAM,WAAW,SAAS;AAC1B,QAAI,CAAC,UAAU;AACb,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,EAAE,wBAAwB,WAAW,GAAG,gBAAgB,IAAI;AAClE,UAAM,aAAa,iCAAiC,MAAe,eAAe;AAClF,QAAI,WAAW,UAAU;AACvB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAW,WAAW;AAC5B,4BAAwB,QAAQ;AAChC,UAAM,cAAc;AAAA,MAClB,GAAI,KAAK,QAAQ,eAAe,CAAC;AAAA,MACjC,GAAI,MAAM,SAAS,mBAAmB;AAAA,IACxC;AACA,UAAM,QAAQ,KAAK,QAAQ,MAAM;AACjC,UAAM,eAAeH,YAAW;AAChC,UAAMI,aAAY;AAClB,UAAM,MAAM,iBAAiB;AAAA,MAC3B,WAAW,SAAS;AAAA,MACpB,aAAa,SAAS;AAAA,MACtB;AAAA,MACA,gBAAgB,SAAS;AAAA,MACzB,YAAY,KAAK,QAAQ;AAAA,MACzB,eAAe;AAAA,IACjB,CAAC;AACD,UAAM,OAA6B;AAAA,MACjC,YAAYA;AAAA,MACZ,GAAI,KAAK,QAAQ,QAAQ,EAAE,OAAO,KAAK,QAAQ,MAAM,IAAI,CAAC;AAAA,MAC1D,OAAO,KAAK,QAAQ;AAAA,MACpB,YAAY,KAAK,QAAQ;AAAA,MACzB,GAAI,KAAK,QAAQ,qBAAqB,SAClC,EAAE,oBAAoB,KAAK,QAAQ,iBAAiB,IACpD,CAAC;AAAA,MACL,GAAI,KAAK,QAAQ,qBAAqB,SAClC,EAAE,oBAAoB,KAAK,QAAQ,iBAAiB,IACpD,CAAC;AAAA,MACL,GAAI,KAAK,QAAQ,YAAY,SAAY,EAAE,UAAU,KAAK,QAAQ,QAAQ,IAAI,CAAC;AAAA,MAC/E,UAAU;AAAA,QACR,CAAC,iBAAiB,OAAO,GAAG,KAAK,QAAQ;AAAA,QACzC,CAAC,iBAAiB,WAAW,GAAG,SAAS;AAAA,QACzC,CAAC,iBAAiB,cAAc,GAAG,SAAS;AAAA,QAC5C,CAAC,iBAAiB,YAAY,GAAG;AAAA,MACnC;AAAA,MACA,MAAM;AAAA,QACJ,UAAU;AAAA,QACV,cAAc;AAAA,QACd,iBAAiB;AAAA,QACjB,OAAO;AAAA,UACL,cAAc,SAAS;AAAA,UACvB,UAAU;AAAA,UACV,gBAAgB;AAAA,UAChB,SAAS,KAAK,QAAQ;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AACA,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,KAAK,QAAQ,QAAQ,OAAO,IAAI;AAAA,IAC/C,SAAS,OAAO;AAId,YAAM,qBAAqB,KAAK,QAAQ,SAAS,OAAO;AAAA,QACtD,aAAa,SAAS;AAAA,QACtB;AAAA,QACA,aAAa,KAAK,IAAI;AAAA,MACxB,CAAC,EAAE,MAAM,MAAM,KAAK;AACpB,YAAM;AAAA,IACR;AACA,UAAM,QAA0B;AAAA,MAC9B,cAAc;AAAA,MACd,WAAW,KAAK;AAAA,MAChB;AAAA,MACA,aAAa,SAAS;AAAA,MACtB,WAAW,SAAS;AAAA,MACpB,gBAAgB,SAAS;AAAA,MACzB,WAAAA;AAAA,MACA,OAAO,KAAK,SAAS,KAAK,QAAQ;AAAA,MAClC;AAAA,MACA;AAAA,MACA,sBAAsB;AAAA,MACtB,gBAAgB;AAAA,MAChB,SAAS;AAAA,MACT,YAAY,KAAK;AAAA,IACnB;AACA,UAAM,UAAU,KAAK,QAAQ,OAAO,WAAW,aAAa;AAC5D,QAAI;AACF,YAAM,QAAQ,KAAK,aAAa,KAAK,IAAI,IAAI,KAAK,QAAQ,cAAc;AACxE,UAAI,OAAO,KAAK,SAAS,OAAO,EAAE,SAAS,GAAG;AAC5C,mBAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,SAAS,OAAO,GAAG;AAC5D,gBAAM,QAAQ,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAAA,QAChD;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AAGd,YAAM,iBAAiB,KAAK,QAAQ,SAAS,OAAO,KAAK,EAAE,MAAM,MAAM,MAAS;AAChF,YAAM;AAAA,IACR;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,OACJ,OACA,UAAsC,CAAC,GACP;AAChC,WAAO,MAAM,KAAK,YAAY,OAAO,OAAO;AAAA,EAC9C;AAAA;AAAA,EAGA,MAAM,YACJ,OACA,UAAsC,CAAC,GACP;AAChC,QAAI;AACF,YAAM,KAAK,QAAQ,QAAQ,IAAI,MAAM,SAAS;AAAA,IAChD,SAAS,OAAO;AACd,UAAI,qBAAqB,KAAK,GAAG;AAC/B,cAAM,IAAI,2CAA2C,WAAW,MAAM,SAAS;AAAA,MACjF;AACA,YAAM;AAAA,IACR;AACA,UAAM,OAAyB;AAAA,MAC7B,GAAG;AAAA,MACH,SAAS,MAAM;AAAA,MACf,YAAY,MAAM;AAAA,IACpB;AACA,WAAO,KAAK,QAAQ,MAAM,QAAQ,aAAa;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAO,OAA2C;AACtD,UAAM,iBAAiB,KAAK,QAAQ,SAAS,KAAK,QAAQ,MAAM,GAAG,KAAK;AAAA,EAC1E;AAAA,EAEA,MAAM,8BAAgD;AACpD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gCAAkD;AACtD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,sBAAsB,OAA8D;AACxF,WAAO;AAAA,MACL,cAAc;AAAA,MACd,WAAW,MAAM;AAAA,MACjB,cAAc,MAAM;AAAA,MACpB,aAAa,MAAM;AAAA,MACnB,WAAW,MAAM;AAAA,MACjB,gBAAgB,MAAM;AAAA,MACtB,WAAW,MAAM;AAAA,MACjB,OAAO,MAAM;AAAA,MACb,UAAU,wBAAwB,MAAM,QAAQ;AAAA,MAChD,aAAa,0CAA0C,MAAM,UAAU,MAAM,WAAW;AAAA,MACxF,sBAAsB;AAAA,MACtB,gBAAgB,MAAM;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,MAAM,wBAAwB,OAA8D;AAC1F,QAAI,MAAM,iBAAiB,uBAAuB;AAChD,YAAM,IAAI;AAAA,QACR;AAAA,QACA,gDAAgD,OAAO,MAAM,YAAY,CAAC;AAAA,MAC5E;AAAA,IACF;AACA,UAAM,WAAW;AAAA,MACf,MAAM,YAAY,OAAO,MAAM,aAAa,YAAY,CAAC,MAAM,QAAQ,MAAM,QAAQ,IAChF,MAAM,WACP;AAAA,IACN;AACA,QAAI,SAAS,SAAS,wBAAwB;AAC5C,YAAM,IAAI;AAAA,QACR;AAAA,QACA,mCAAmC,sBAAsB;AAAA,MAC3D;AAAA,IACF;AACA,WAAO;AAAA,MACL,cAAc;AAAA,MACd,WAAWD,kBAAiB,MAAM,WAAW,WAAW;AAAA,MACxD,cAAcA,kBAAiB,MAAM,cAAc,cAAc;AAAA,MACjE,aAAaA,kBAAiB,MAAM,aAAa,aAAa;AAAA,MAC9D,WAAWA,kBAAiB,MAAM,WAAW,WAAW;AAAA,MACxD,gBAAgBA,kBAAiB,MAAM,gBAAgB,gBAAgB;AAAA,MACvE,WAAWA,kBAAiB,MAAM,WAAW,WAAW;AAAA,MACxD,OAAO,OAAO,MAAM,UAAU,WAAW,MAAM,QAAQ;AAAA,MACvD;AAAA,MACA,aAAa,MAAM;AAAA,QACjB;AAAA,QACA,MAAM,eACJ,OAAO,MAAM,gBAAgB,YAC7B,CAAC,MAAM,QAAQ,MAAM,WAAW,IAC7B,MAAM,cACP;AAAA,QACJ,KAAK,QAAQ;AAAA,MACf;AAAA,MACA,sBAAsB;AAAA,MACtB,gBAAgB,MAAM,mBAAmB;AAAA,IAC3C;AAAA,EACF;AACF;;;AMllCO,SAAS,mBAAmB,UAA2C;AAC5E,QAAM,MAAM,SAAS,oBAAoB,KAAK;AAC9C,MAAI,CAAC,KAAK;AACR,WAAO,EAAE,MAAM,wBAAwB,MAAM,KAAK,KAAK,MAAM,MAAM,UAAU;AAAA,EAC/E;AACA,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,SAAS,KAAK,IAAI,MAAM,SAAS,GAAG,EAAE;AAC9D,UAAM,MAAM,IAAI,aAAa,UAAU,IAAI,aAAa;AACxD,UAAM,OAAO,IAAI,OAAO,OAAO,IAAI,IAAI,IAAI,MAAM,MAAM;AACvD,UAAM,OAAO,IAAI,YAAY,IAAI,aAAa,MAAM,IAAI,WAAW;AACnE,WAAO,EAAE,MAAM,IAAI,UAAU,MAAM,KAAK,KAAK;AAAA,EAC/C,QAAQ;AACN,WAAO,EAAE,MAAM,KAAK,MAAM,KAAK,KAAK,MAAM,MAAM,UAAU;AAAA,EAC5D;AACF;AAUA,SAAS,2BAAuC;AAC9C,SAAO,IAAI,eAAe,YAAmD,IAAI;AACnF;AAEO,IAAM,qBAA2C;AAAA,EACtD,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,kBAAkB,CAAC,SAAS;AAAA,EAC5B,wBAAwB,MAAM;AAAA,EAC9B,YAAY,uBAAuB;AAAA;AAAA,EAEnC,oBAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUpB,sBAAsB;AAAA,EAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQvB,MAAM,EAAE,SAAS,GAAG;AAClB,WAAO,IAAI,wBAAwB;AAAA;AAAA;AAAA;AAAA;AAAA,MAKjC,aAAa;AAAA;AAAA;AAAA,MAGb,eAAe;AAAA,MACf,OAAO,mBAAmB,QAAQ;AAAA,MAClC,mBAAmB;AAAA,IACrB,CAAC;AAAA,EACH;AACF;;;ATvFO,IAAM,iCAAiC;AAEvC,IAAM,kBAAwC;AAAA,EACnD,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,kBAAkB,CAAC,WAAW;AAAA;AAAA;AAAA,EAG9B,wBAAwB,MAAM;AAAA,EAC9B,YAAY,uBAAuB;AAAA;AAAA;AAAA;AAAA,EAInC,oBAAoB;AAAA,EACpB,oBAAoB,UAAU;AAC5B,UAAM,SAAS,sBAAsB,QAAQ;AAC7C,QAAI,OAAO,SAAS,EAAG,OAAM,IAAI,mBAAmB,WAAW,OAAO,KAAK,IAAI,CAAC;AAAA,EAClF;AAAA,EACA,MAAM,EAAE,UAAU,YAAY,GAAG;AAG/B,UAAM,UAAU,SAAS,0BAA0B;AACnD,WAAO,IAAI,qBAAqB;AAAA,MAC9B,SAAS,IAAI,qBAAqB;AAAA,QAChC,SAAS,SAAS;AAAA,QAClB,QAAQ,SAAS;AAAA,MACnB,CAAC;AAAA,MACD,OAAO;AAAA,MACP,OAAO,mBAAmB,QAAQ;AAAA,MAClC,SAAS,SAAS;AAAA,MAClB,QAAQ,UAAU,SAAS,sBAAsB,WAAc,SAAS,gBAAgB;AAAA,MACxF;AAAA,MACA,OAAO,SAAS;AAAA,MAChB,WAAW,SAAS;AAAA,MACpB,GAAI,SAAS,4BAA4B,SACrC,EAAE,kBAAkB,SAAS,wBAAwB,IACrD,CAAC;AAAA,MACL,GAAI,SAAS,4BAA4B,SACrC,EAAE,kBAAkB,SAAS,wBAAwB,IACrD,CAAC;AAAA,MACL,GAAI,SAAS,mBAAmB,SAAY,EAAE,SAAS,SAAS,eAAe,IAAI,CAAC;AAAA,MACpF,gBAAgB,SAAS;AAAA;AAAA;AAAA;AAAA,MAIzB,kBAAkB,KAAK;AAAA,QACrB,SAAS;AAAA,QACT;AAAA,MACF;AAAA,MACA,eAAe,SAAS;AAAA,MACxB;AAAA,IACF,CAAC;AAAA,EACH;AACF;;;AU7DO,IAAM,kBAAwC;AAAA,EACnD,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,kBAAkB,CAAC,WAAW;AAAA,EAC9B,wBAAwB,MAAM;AAAA,EAC9B,YAAY,uBAAuB;AAAA,EACnC,oBAAoB;AAAA,EACpB,oBAAoB,UAAU;AAC5B,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI,mBAAmB,WAAW,sCAAsC;AAAA,IAChF;AAAA,EACF;AAAA,EACA,MAAM,EAAE,UAAU,aAAa,aAAa,GAAG;AAC7C,UAAM,UAA8E;AAAA,MAClF,QAAQ,SAAS;AAAA,MACjB,KAAK;AAAA,MACL;AAAA,IACF;AACA,QAAI,SAAS,cAAe,SAAQ,SAAS,SAAS;AACtD,QAAI,SAAS,cAAe,SAAQ,SAAS,SAAS;AACtD,QAAI,SAAS,aAAc,SAAQ,QAAQ,SAAS;AACpD,QAAI,SAAS,oBAAqB,SAAQ,sBAAsB,SAAS;AAEzE,QAAI,SAAS,4BAA4B,QAAW;AAClD,cAAQ,mBAAmB,SAAS;AAAA,IACtC;AACA,QAAI,SAAS,sBAAuB,SAAQ,aAAa,SAAS;AAClE,QAAI,SAAS,iCAAiC;AAC5C,cAAQ,qBAAqB,SAAS;AAAA,IACxC;AACA,WAAO,0BAA0B,IAAI,qBAAqB,OAAO,GAAG,OAAO;AAAA,EAC7E;AACF;;;AChCA,SAAS,YAAAE,iBAAgB;AACzB,SAAS,SAAAC,cAAa;AACtB,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,aAAAC,kBAAiB;;;ACT1B,SAAS,gBAAgB;AACzB,SAAS,SAAS,cAAAC,aAAY,QAAAC,OAAM,WAAAC,gBAAe;AACnD,SAAS,aAAAC,kBAAiB;AAC1B,SAAS,OAAO,SAAAC,QAAO,QAAAC,OAAM,WAAAC,UAAS,YAAAC,WAAU,MAAAC,WAAU;AAC1D,SAAS,iBAAiB;AAS1B,SAAS,gBAAAC,qBAAoB;AAE7B,IAAM,gBAAgB,UAAU,QAAQ;AAKxC,IAAM,cAA2B,OAAO,MAAM,YAC5C,MAAM,cAAc,UAAU,CAAC,GAAG,IAAI,GAAG,EAAE,SAAS,WAAW,OAAO,KAAK,CAAC;AAC9E,IAAM,QAAQ;AACd,IAAM,KAAK;AACX,IAAMC,QAAO;AACb,IAAM,MAAM;AAYZ,IAAM,WAAW,oBAAI,QAA2B;AAIhD,IAAM,kBAAkB,oBAAI,QAAgB;AAC5C,IAAM,iBAAiB,oBAAI,QAAgB;AAGpC,SAAS,4BAA4B,OAAoB;AAC9D,iBAAe,IAAI,KAAK;AAC1B;AAEA,SAASC,SAAQ,SAAwB;AACvC,QAAM,IAAI,mBAAmB,UAAU,uCAAuC,OAAO;AACvF;AAUA,eAAe,uBAAuB,QAA6B,OAAc;AAC/E,SAAO,MAAM,OAAO,8BAA8B,OAAO;AAAA,IACvD,eAAe;AAAA,MACb,OAAO,MAAM;AAAA,MACb,cAAc,CAAC,GAAI,MAAM,0BAA0B,CAAC,CAAE;AAAA,IACxD;AAAA,EACF,CAAC;AACH;AAEA,SAAS,MAAM,OAAc;AAC3B,MACE,CAAC,GAAG,KAAK,MAAM,WAAW,KAC1B,CAACD,MAAK,KAAK,MAAM,mBAAmB,EAAE,KACtC,MAAM,uBAAuB,QAC7B,CAACE,YAAW,MAAM,iBAAiB,KACnCC,SAAQ,MAAM,iBAAiB,MAAM,MAAM,qBAC3C,MAAM,sBAAsB,OAC3B,MAAM,aAAa,QAAQ,MAAM,aAAa;AAE/C,IAAAF,SAAQ,gCAAgC;AAC1C,SAAO;AAAA,IACL,aAAa,MAAM;AAAA,IACnB,iBAAiB,MAAM;AAAA,IACvB,MAAM,MAAM;AAAA,EACd;AACF;AAEA,SAAS,cAAc,OAAgB,OAAgC;AACrE,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAM,IAAI;AACV,QAAM,IAAI,MAAM,KAAK;AACrB,MACE,EAAE,YAAY,KACd,EAAE,gBAAgB,EAAE,eACpB,EAAE,oBAAoB,EAAE,mBACxB,EAAE,eAAe,EAAE,QACnB,OAAO,EAAE,SAAS,YAClB,CAACC,YAAW,EAAE,IAAI,KAClBC,SAAQ,EAAE,IAAI,MAAM,EAAE,QACtB,EAAE,SAAS,OACX,OAAO,EAAE,aAAa,YACtB,CAAC,2BAA2B,KAAK,EAAE,QAAQ,KAC3C,CAAC,IAAI,KAAK,EAAE,gBAAgB,KAC5B,CAAC,EAAE,YACH,OAAO,EAAE,aAAa,YACtB,CAAC,CAAC,OAAO,OAAO,OAAO,OAAO,MAAM,EAAE;AAAA,IACpC,CAAC,QACC,OAAO,EAAE,SAAS,GAAsC,MAAM,YAC9D,sBAAsB,KAAK,EAAE,SAAS,GAAsC,CAAC;AAAA,EACjF;AAEA,IAAAF,SAAQ,qCAAqC;AAC/C,SAAO,OAAO,OAAO,EAAE,GAAG,GAAG,UAAU,OAAO,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;AAC3E;AAKO,SAAS,kCAAkC,OAAc,YAA2B;AACzF,QAAM,QACJ,cAAc,OAAO,eAAe,WAAW,QAAQ,IAAI,YAAY,KAAK,IAAI;AAClF,MAAI,UAAU,QAAW;AACvB,QACE,CAAC,cACD,OAAO,eAAe,YACtB,QAAQ,IAAI,YAAY,oBAAoB,MAAM,QAClD,QAAQ,IAAI,YAAY,aAAa,MAAM,MAAM,eACjD,QAAQ,IAAI,YAAY,iBAAiB,MAAM,MAAM,mBACrD,QAAQ,IAAI,YAAY,mBAAmB,MAAM,MAAM;AAEvD,MAAAA,SAAQ,sCAAsC;AAChD,UAAM,UAAU,cAAc,OAAO,KAAK;AAC1C,QAAI,CAAC,QAAS,CAAAA,SAAQ,wCAAwC;AAC9D,aAAS,IAAI,OAAO,OAAO;AAC3B,oBAAgB,IAAI,KAAK;AAAA,EAC3B;AACF;AAQO,SAAS,gCAAgC,UAA4B;AAC1E,MAAI,CAAC,YAAY,OAAO,aAAa,YAAY,MAAM,QAAQ,QAAQ,EAAG,QAAO;AACjF,QAAM,QAAQ;AACd,QAAM,eACJ,MAAM,gBAAgB,OAAO,MAAM,iBAAiB,WAC/C,MAAM,eACP;AACN,QAAM,gBACJ,aAAa,iBAAiB,OAAO,aAAa,kBAAkB,WAC/D,aAAa,gBACd;AACN,QAAM,UAAU,gBAAgB,KAAK;AACrC,SAAO,QAAQ,WAAW,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,CAAC;AAClF;AASA,eAAe,OAAO,OAAqC;AACzD,QAAM,SAAS,MAAM,MAAM,CAAC,QAAQ,YAAY,SAAS,GAAG,GAAM;AAClE,QAAM,KAAK,OAAO,OAAO,KAAK;AAC9B,MAAI,CAAC,2BAA2B,KAAK,EAAE,KAAK,OAAO,OAAO,KAAK;AAC7D,IAAAA,SAAQ,kCAAkC;AAC5C,SAAO;AACT;AAEA,eAAe,QAAQ,aAAqB,OAAiD;AAC3F,MAAI;AACF,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA;AAAA,IACF;AACA,QAAI,OAAO,OAAO,KAAK,EAAG,CAAAA,SAAQ,qCAAqC;AACvE,UAAM,QAAQ,KAAK,MAAM,OAAO,MAAM;AACtC,QACE,MAAM,OAAO,eACb,OAAO,MAAM,YAAY,aACzB,CAAC,MAAM,UACP,CAAC,MAAM,QAAQ,MAAM,MAAM;AAE3B,MAAAA,SAAQ,mCAAmC;AAC7C,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,SAAS,SAAS,OAAO,UAAU,WAAW,QAAQ,IAAI,OAAO,QAAQ,IAAI;AACnF,QACE,OAAO,WAAW,YAClB,QAAQ,IAAI,OAAiB,MAAM,MAAM,KACzC,CAAC,QAAQ,IAAI,OAAiB,QAAQ,KACtC,CAAC,QAAQ,IAAI,OAAiB,QAAQ,KACtC,IAAI;AAAA,MACF,0EAA0E,cAAc;AAAA,IAC1F,EAAE,KAAK,OAAO,KAAK,CAAC;AAEpB,aAAO;AACT,UAAM;AAAA,EACR;AACF;AAEA,eAAe,WACb,aACA,OACA,SACgD;AAChD,QAAM,IAAI,MAAM,KAAK;AACrB,QAAMG,eAAc,YAAY,OAAO,mDAAmD;AAC1F,MACE,YAAY,OAAO,uBAAuB,MAAM,UAChD,YAAY,OAAO,wCAAwC,MAAM,EAAE,mBACnE,CAAC,IAAI,KAAKA,gBAAe,EAAE,KAC1B,WAAWA,iBAAgB,QAAQ;AAEpC,IAAAH,SAAQ,oCAAoC;AAI9C,QAAM,OAAO,MAAMI,UAAS,EAAE,IAAI;AAClC,MACG,WAAW,SAAS,QAAQ,QAC7B,CAAC,YAAY,OAAO;AAAA,IAClB,CAAC,MACC,EAAE,SAAS,UACX,EAAE,WAAW,QACb,EAAE,gBAAgB,MAAM,SAAS,QACjC,EAAE,OAAO;AAAA,EACb;AAEA,IAAAJ,SAAQ,oCAAoC;AAC9C,SAAO,EAAE,aAAaG,cAAc,KAAK;AAC3C;AAKA,eAAsB,yBACpB,QACA,OACA,QAAqB,aACa;AAClC,MAAI,CAAC,eAAe,IAAI,KAAK,EAAG,QAAO,CAAC;AACxC,QAAM,IAAI,MAAM,KAAK;AACrB,QAAM,WAAW,MAAM,OAAO,KAAK;AACnC,QAAM,SAAS,MAAM,QAAQ,EAAE,aAAa,KAAK;AACjD,MAAI,CAAC,QAAQ,QAAS,CAAAH,SAAQ,0CAA0C;AACxE,QAAM,QAAQ,MAAM,WAAW,QAAQ,KAAK;AAC5C,QAAM,WAAW,MAAM,8BAA8B,MAAM,IAAI;AAC/D,MAAI,CAAE,MAAM,uBAAuB,QAAQ,KAAK;AAC9C,IAAAA,SAAQ,0CAA0C;AACpD,QAAM,8BAA8B,MAAM,MAAM,QAAQ;AACxD,MAAK,MAAM,OAAO,KAAK,MAAO,SAAU,CAAAA,SAAQ,gCAAgC;AAChF,QAAM,UAAU,OAAO,OAAO;AAAA,IAC5B,SAAS;AAAA,IACT,aAAa,EAAE;AAAA,IACf,iBAAiB,EAAE;AAAA,IACnB,YAAY,EAAE;AAAA,IACd,MAAM,MAAM;AAAA,IACZ;AAAA,IACA,kBAAkB,MAAM;AAAA,IACxB;AAAA,EACF,CAAC;AACD,WAAS,IAAI,OAAO,OAAO;AAC3B,SAAO,EAAE,CAAC,KAAK,GAAG,QAAQ;AAC5B;AAQA,eAAsB,8BACpB,OACA,QAAqB,aACH;AAClB,QAAM,UAAU,gBAAgB,IAAI,KAAK,IAAI,SAAS,IAAI,KAAK,IAAI;AACnE,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI;AACF,QAAK,MAAM,OAAO,KAAK,MAAO,QAAQ,SAAU,QAAO;AACvD,QAAK,MAAM,QAAQ,QAAQ,aAAa,KAAK,MAAO,KAAM,QAAO;AACjE,eAAW,QAAQ,oBAAI,IAAI,CAAC,QAAQ,MAAM,QAAQ,UAAU,CAAC,GAAG;AAC9D,YAAM,SAAS,MAAMK,OAAM,QAAQ,IAAI,CAAC,EAAE,MAAM,MAAM,IAAI;AAC1D,UAAI,CAAC,QAAQ,YAAY,EAAG,QAAO;AACnC,YAAM,QAAQ,MAAMA,OAAM,IAAI,EAAE;AAAA,QAC9B,MAAM;AAAA,QACN,CAAC,UACC,SAAS,OAAO,UAAU,YAAY,QAAQ,IAAI,OAAO,MAAM,MAAM,WAChE,WACA;AAAA,MACT;AACA,UAAI,UAAU,SAAU,QAAO;AAAA,IACjC;AACA,WAAQ,MAAM,OAAO,KAAK,MAAO,QAAQ;AAAA,EAC3C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAwBA,SAAS,UAAU,OAAyB;AAC1C,SAAO,SAAS,OAAO,UAAU,WAAW,QAAQ,IAAI,OAAO,MAAM,IAAI;AAC3E;AAEA,SAAS,SAAS,OAAwB;AACxC,SAAOP,cAAa,KAAK,EAAE,MAAM,GAAG,GAAG;AACzC;AAIA,eAAe,aAAa,YAAoB,eAAyC;AACvF,aAAW,QAAQ,CAAC,YAAY,aAAa,GAAG;AAC9C,QAAI;AACF,YAAMO,OAAM,IAAI;AAChB,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,UAAU,KAAK,MAAM,SAAU,QAAO;AAAA,IAC5C;AAAA,EACF;AACA,SAAO;AACT;AAMA,eAAe,yBAAyB,MAA6B;AACnE,QAAM,UAAU,CAAC,IAAI;AACrB,SAAO,QAAQ,SAAS,GAAG;AACzB,UAAM,YAAY,QAAQ,IAAI;AAC9B,eAAW,SAAS,MAAMC,SAAQ,WAAW,EAAE,eAAe,KAAK,CAAC,GAAG;AACrE,UAAI,CAAC,MAAM,YAAY,EAAG;AAC1B,YAAM,OAAOC,MAAK,WAAW,MAAM,IAAI;AACvC,YAAM,QAAQ,MAAMF,OAAM,IAAI;AAC9B,UAAI,CAAC,MAAM,YAAY,EAAG;AAC1B,WAAK,MAAM,OAAO,SAAW,IAAO,OAAM,iBAAiB,MAAM,KAAK;AACtE,cAAQ,KAAK,IAAI;AAAA,IACnB;AAAA,EACF;AACF;AAMA,eAAe,iBACb,MACA,OACe;AACf,QAAM,OAAQ,MAAM,OAAO,OAAU;AACrC,MAAI;AACJ,MAAI;AACF,aAAS,MAAMG,MAAK,MAAMC,WAAU,WAAWA,WAAU,cAAcA,WAAU,UAAU;AAAA,EAC7F,SAAS,OAAO;AACd,QAAI,UAAU,KAAK,MAAM,SAAU,OAAM;AACzC,UAAM,MAAM,MAAM,IAAI;AACtB;AAAA,EACF;AACA,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,KAAK;AACjC,QAAI,OAAO,QAAQ,MAAM,OAAO,OAAO,QAAQ,MAAM,KAAK;AACxD,YAAM,IAAI,MAAM,+CAA+C,IAAI,EAAE;AAAA,IACvE;AACA,UAAM,OAAO,MAAM,IAAI;AAAA,EACzB,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAEA,eAAe,gBAAgB,MAA6B;AAC1D,MAAI;AACF,UAAMC,IAAG,MAAM,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACjD,SAAS,OAAO;AACd,UAAM,OAAO,UAAU,KAAK;AAC5B,QAAI,SAAS,YAAY,SAAS,QAAS,OAAM;AACjD,UAAM,yBAAyB,IAAI;AACnC,UAAMA,IAAG,MAAM,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACjD;AACF;AAKA,eAAsB,8BACpB,QACA,OACA,sBACA,QAAqB,aACrB,eACsC;AACtC,QAAM,qBAAqB;AAC3B,QAAM,IAAI,MAAM,KAAK;AACrB,MAAI,UAAU,SAAS,IAAI,KAAK;AAChC,MAAI,CAAC,SAAS;AACZ,UAAM,SAAS,MAAM,QAAQ,EAAE,aAAa,KAAK;AAGjD,QAAI,CAAC,QAAQ,QAAS,CAAAV,SAAQ,4DAA4D;AAC1F,UAAM,WAAW,QAAQ,KAAK;AAC9B,QAAI,CAAE,MAAM,uBAAuB,QAAQ,KAAK;AAC9C,MAAAA,SAAQ,0CAA0C;AACpD,gCAA4B,KAAK;AACjC,UAAM,yBAAyB,QAAQ,OAAO,KAAK;AACnD,cAAU,SAAS,IAAI,KAAK;AAAA,EAC9B;AACA,QAAM,UAAU;AAChB,QAAM,UAAU,gBAAgB,IAAI,KAAK;AACzC,MAAI,MAAM,aAAa,EAAE,MAAM,QAAQ,IAAI,GAAG;AAM5C,UAAM,iBAAiB,YAAY;AACjC,UAAI,EAAE,MAAM,qBAAqB,GAAG;AAClC,QAAAA,SAAQ,yDAAyD;AACnE,UAAK,MAAM,OAAO,KAAK,MAAO,QAAQ,SAAU,CAAAA,SAAQ,gCAAgC;AACxF,UAAI,MAAM,QAAQ,EAAE,aAAa,KAAK;AACpC,QAAAA,SAAQ,+DAA+D;AAAA,IAC3E;AACA,UAAM,eAAe;AACrB,QAAIW,WAA6C;AACjD,UAAM,WAAW,MAAMX,SAAQ,uDAAuD;AACtF,WAAO;AAAA,MACL,OAAO,EAAE,mBAAmB,QAAQ,MAAM,UAAU,MAAM,SAAS;AAAA,MACnE,8BAA8B,QAAQ;AAAA,MACtC,iCAAiC,YAAY,SAAS;AAAA,MACtD,gBAAgB,YAAY,SAAS;AAAA,MACrC,kBAAkB,YAAY,SAAS;AAAA,MACvC,MAAM,SAAS;AACb,cAAM,eAAe;AACrB,QAAAW,WAAU,EAAE,QAAQ,mBAAmB;AAAA,MACzC;AAAA,MACA,IAAI,uBAAuB;AACzB,eAAOA;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACA,QAAM,kBAAkB,YAAY;AAClC,UAAM,qBAAqB;AAC3B,QAAK,MAAM,OAAO,KAAK,MAAO,QAAQ,SAAU,CAAAX,SAAQ,gCAAgC;AACxF,UAAM,SAAS,MAAM,QAAQ,EAAE,aAAa,KAAK;AACjD,QAAK,MAAMI,UAAS,EAAE,IAAI,MAAO,QAAQ,KAAM,CAAAJ,SAAQ,2BAA2B;AAClF,QAAI,OAAQ,OAAM,WAAW,QAAQ,OAAO,OAAO;AACnD,UAAM,8BAA8B,QAAQ,MAAM,QAAQ,QAAQ;AAAA,EACpE;AAGA,QAAM,uBAAuB,YAAiD;AAC5E,QAAI;AAMF,UAAI,EAAE,MAAM,qBAAqB,GAAG;AAClC,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AACF,UAAK,MAAM,OAAO,KAAK,MAAO,QAAQ;AACpC,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AACF,UAAI,MAAM,QAAQ,EAAE,aAAa,KAAK;AACpC,eAAO,EAAE,QAAQ,YAAY,QAAQ,+BAA+B;AACtE,UAAK,MAAMI,UAAS,EAAE,IAAI,MAAO,QAAQ;AACvC,eAAO,EAAE,QAAQ,YAAY,QAAQ,4BAA4B;AACnE,YAAM,8BAA8B,QAAQ,MAAM,QAAQ,QAAQ;AAClE,YAAM,gBAAgB,QAAQ,IAAI;AAClC,aAAO,EAAE,QAAQ,WAAW;AAAA,IAC9B,SAAS,OAAO;AACd,aAAO,EAAE,QAAQ,YAAY,QAAQ,SAAS,KAAK,EAAE;AAAA,IACvD;AAAA,EACF;AACA,MAAI,UAA6C;AACjD,QAAM,uBAAuB,YAA2B;AACtD,QAAI,MAAM,QAAQ,EAAE,aAAa,KAAK,GAAG;AAGvC,YAAM,SAAS,MAAM,MAAM,CAAC,MAAM,MAAM,EAAE,WAAW,GAAG,GAAM;AAC9D,UAAI,OAAO,OAAO,KAAK,KAAK,OAAO,OAAO,KAAK,MAAM,EAAE;AACrD,QAAAJ,SAAQ,6CAA6C;AAAA,IACzD;AAAA,EACF;AACA,QAAM,gBAAgB;AACtB,SAAO;AAAA,IACL,OAAO,EAAE,mBAAmB,QAAQ,MAAM,UAAU,MAAM,SAAS;AAAA,IACnE,8BAA8B,QAAQ;AAAA,IACtC,iCAAiC;AAAA,IACjC,MAAM,iBAAiB;AAGrB,UAAI,CAAC,QAAS,CAAAA,SAAQ,8DAA8D;AACpF,YAAM,gBAAgB;AACtB,YAAM,qBAAqB;AAC3B,YAAM,gBAAgB;AAAA,IACxB;AAAA,IACA,MAAM,mBAAmB;AACvB,YAAM,gBAAgB;AACtB,UAAI,QAAQ,aAAa,SAAS;AAGhC,cAAM,WAAW,IAAI,qBAAqB;AAAA,UACxC,OAAO,EAAE,GAAG,OAAO,mBAAmB,QAAQ,KAAK;AAAA,UACnD,GAAI,kBAAkB,SAAY,EAAE,cAAc,IAAI,CAAC;AAAA,QACzD,CAAC;AACD,cAAM,QAAQ,MAAM,SAAS,iBAAiB;AAC9C,cAAM,gBAAgB;AACtB,eAAO;AAAA,MACT;AACA,YAAM,UAAU,MAAM;AAAA,QACpB,QAAQ;AAAA,QACR,CAAC,GAAG,MAAM,SAAS,0BAA0B,CAAC;AAAA,QAC9C,QAAQ;AAAA,MACV;AACA,UAAI;AACF,cAAM,SAAuB,CAAC;AAC9B,yBAAiB,SAAS,QAAQ,MAAM,KAAK,EAAG,QAAO,KAAK,KAAK;AACjE,eAAO,OAAO,OAAO,MAAM;AAAA,MAC7B,UAAE;AACA,cAAM,QAAQ,MAAM,QAAQ;AAAA,MAC9B;AAAA,IACF;AAAA,IACA,MAAM,SAAS;AACb,UAAI,EAAE,MAAM,qBAAqB,GAAG;AAClC,QAAAA,SAAQ,wCAAwC;AAClD,YAAM,gBAAgB;AACtB,YAAM,qBAAqB;AAG3B,gBAAU,MAAM,qBAAqB;AAAA,IACvC;AAAA,IACA,IAAI,uBAAuB;AACzB,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ADjiBA,IAAMY,iBAAgBC,WAAUC,SAAQ;AAGxC,eAAe,YAAY,MAAiC;AAC1D,MAAI,OAAO,SAAS,SAAU,QAAO;AACrC,SAAO,MAAMC,OAAM,IAAI,EAAE;AAAA,IACvB,MAAM;AAAA,IACN,CAAC,UACC,EAAE,SAAS,OAAO,UAAU,YAAY,QAAQ,IAAI,OAAO,MAAM,MAAM;AAAA,EAC3E;AACF;AACA,IAAM,kCAAkC;AACxC,IAAM,qBAAqB;AAepB,SAAS,oCACd,OACA,iBACG;AACH,QAAM,QAAQ,iBAAiB,KAAK;AACpC,MAAI,CAAC,SAAS,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAClF,SAAO,EAAE,GAAG,OAAO,MAAM;AAC3B;AAEA,SAAS,oBAAoB,OAA+B;AAC1D,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAM,QAAQ;AAId,SAAO,OAAO,MAAM,sBAAsB,YACxCC,YAAW,MAAM,iBAAiB,KAClC,MAAM,uBAAuB,SAC5B,MAAM,aAAa,QAAQ,MAAM,aAAa,UAC7C,MAAM,oBACN;AACN;AAEA,SAAS,kCAAkC,SAAkB,cAA6B;AACxF,aAAW,aAAa,CAAE,SAAwC,OAAO,YAAY,GAAG;AACtF,QAAI,CAAC,aAAa,OAAO,cAAc,YAAY,MAAM,QAAQ,SAAS,EAAG;AAC7E,IAAC,UAA+C,qBAAqB;AAAA,EACvE;AACF;AAEA,SAAS,qBAAqB,OAAwB;AACpD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,SAAS,QAAQ,IAAI,OAAO,QAAQ;AAC1C,SAAO,OAAO,WAAW,WAAW,OAAO,KAAK,IAAI;AACtD;AAEO,SAAS,2BAA2B,OAAgB,aAA8B;AACvF,QAAM,UAAU,YAAY,QAAQ,uBAAuB,MAAM;AACjE,SAAO,IAAI;AAAA,IACT,wEAAwE,OAAO;AAAA,EACjF,EAAE,KAAK,qBAAqB,KAAK,CAAC;AACpC;AAEA,IAAM,8BAAN,cAA0C,oBAAoB;AAAA,EACnD;AAAA,EAET,YAAY,UAAsC,CAAC,GAAG;AACpD,UAAM,OAAO;AACb,SAAK,mBAAmB;AAAA,EAC1B;AAAA,EAEA,MAAe,UAAU,MAAiD;AACxE,UAAM,UAAU,MAAM,MAAM,OAAO,GAAG,IAAI;AAC1C,gCAA4B,QAAQ,KAAK;AACzC,WAAO,6BAA6B,SAAS,QAAQ;AAAA,EACvD;AAAA,EAEA,MAAe,wBACb,OACA;AACA,UAAM,WAAW,MAAM,MAAM,wBAAwB,KAAK;AAC1D,sCAAkC,UAAU,KAAK;AACjD,WAAO;AAAA,EACT;AAAA,EAEA,MAAe,sBACb,OACA,SACA;AACA,UAAM,YAAY,MAAM,yBAAyB,MAAM,KAAK;AAC5D,WAAO,EAAE,GAAI,MAAM,MAAM,sBAAsB,OAAO,OAAO,GAAI,GAAG,UAAU;AAAA,EAChF;AAAA;AAAA;AAAA,EAIA,MAAM,wBACJ,OACA,sBACA,SACA;AACA,UAAM,gBACJ,SAAS,kBAAkB,SACvB,KAAK,iBAAiB,gBACtB,QAAQ;AACd,WAAO,MAAM;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA,EAIA,MAAe,OACb,OACA,SACA;AAKA,QACE,CAAE,MAAM,YAAY,MAAM,iBAAiB,KAC1C,MAAM,8BAA8B,KAAK,GAC1C;AACA,YAAM,IAAI,oCAAoC,UAAU,MAAM,WAAW;AAAA,IAC3E;AACA,UAAM,UAAU,MAAM,MAAM;AAAA,MAC1B,oCAAoC,OAAO,KAAK,iBAAiB,KAAK;AAAA,MACtE;AAAA,IACF;AACA,gCAA4B,QAAQ,KAAK;AACzC,WAAO,6BAA6B,SAAS,QAAQ;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,YACJ,OACA,SACA;AACA,UAAM,cAAe,MAA4B;AACjD,QAAI,OAAO,gBAAgB,YAAY,CAAC,mBAAmB,KAAK,WAAW,GAAG;AAC5E,YAAM,IAAI,mBAAmB,UAAU,gDAAgD;AAAA,IACzF;AACA,QAAI;AACF,YAAM,SAAS,MAAMJ;AAAA,QACnB;AAAA,QACA,CAAC,WAAW,UAAU,aAAa,YAAY,sBAAsB,WAAW;AAAA,QAChF,EAAE,SAAS,iCAAiC,WAAW,KAAK,KAAK;AAAA,MACnE;AACA,UAAI,OAAO,OAAO,KAAK,MAAM,QAAQ;AACnC,cAAM,IAAI,2CAA2C,UAAU,WAAW;AAAA,MAC5E;AAAA,IACF,SAAS,OAAO;AACd,UACE,iBAAiB,8CACjB,2BAA2B,OAAO,WAAW,GAC7C;AACA,cAAM,IAAI,2CAA2C,UAAU,WAAW;AAAA,MAC5E;AACA,YAAM;AAAA,IACR;AAKA,UAAM,gBACJ,SAAS,kBAAkB,SACvB,KAAK,iBAAiB,gBACtB,QAAQ;AACd,UAAM,UAAU,IAAI,qBAAqB;AAAA,MACvC;AAAA,MACA,GAAI,kBAAkB,SAAY,EAAE,cAAc,IAAI,CAAC;AAAA,IACzD,CAAC;AACD,gCAA4B,QAAQ,KAAK;AAGzC,WAAO,6BAA6B,SAAS,QAAQ;AAAA,EACvD;AACF;AAEO,IAAM,iBAAuC;AAAA,EAClD,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,kBAAkB,CAAC,aAAa;AAAA,EAChC,wBAAwB,MAAM;AAAA,EAC9B,YAAY;AAAA,IACV,MAAM;AAAA,IACN,cAAc;AAAA,IACd,6BAA6B;AAAA,EAC/B;AAAA,EACA,YAAY,uBAAuB;AAAA,EACnC,oBAAoB;AAAA;AAAA;AAAA,EAGpB,oBAAoB,UAAU;AAC5B,UAAM,mBAAmB,SAAS,wBAAwB,KAAK;AAC/D,QAAI,oBAAoB,CAACI,YAAW,gBAAgB,GAAG;AACrD,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,EAAE,UAAU,aAAa,GAAG;AAChC,UAAM,mBAAmB,SAAS,wBAAwB,KAAK;AAC/D,WAAO,IAAI,4BAA4B;AAAA,MACrC,OAAO,SAAS;AAAA,MAChB;AAAA;AAAA;AAAA;AAAA,MAIA,UAAU,IAAI,iBAAiB;AAAA,MAC/B,GAAI,mBAAmB,EAAE,iBAAiB,IAAI,CAAC;AAAA,IACjD,CAAC;AAAA,EACH;AACF;;;AExPA,IAAI,sBAAyC;AAC7C,IAAI,UAA6C;AAG1C,SAAS,0BAAsD;AACpE,cAAY,OAAO,KAAK,EAAE;AAAA,IACxB,CAAC,WAAY,sBAAsB,OAAO;AAAA,IAC1C,MAAM;AAAA,EACR;AACA,SAAO;AACT;AAQO,SAAS,+BAA+B,OAAyB;AACtE,SAAO,wBAAwB,QAAQ,iBAAiB;AAC1D;AAGO,SAAS,uBAAuB,OAAyB;AAC9D,SAAO,iBAAiB;AAC1B;;;ACrBO,IAAM,cAAoC;AAAA,EAC/C,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,kBAAkB,CAAC,WAAW;AAAA,EAC9B,wBAAwB,CAAC,UACvB,6BAA6B,KAAK,MAAM,aACpC,4CACA;AAAA,EACN,YAAY,uBAAuB;AAAA;AAAA,EAEnC,oBAAoB;AAAA,EACpB,oBAAoB,UAAU;AAG5B,QAAI,CAAC,SAAS,WAAW;AACvB,YAAM,IAAI,mBAAmB,OAAO,kCAAkC;AAAA,IACxE;AAAA,EACF;AAAA,EACA,MAAM,EAAE,UAAU,aAAa,aAAa,GAAG;AAE7C,SAAK,wBAAwB;AAC7B,UAAM,UAA0E;AAAA,MAC9E,KAAK;AAAA,MACL;AAAA,IACF;AAGA,UAAM,aAAqD,CAAC;AAC5D,QAAI,SAAS,UAAW,YAAW,SAAS,SAAS;AACrD,QAAI,SAAS,UAAW,YAAW,SAAS,SAAS;AACrD,QAAI,SAAS,UAAW,YAAW,SAAS,SAAS;AACrD,QAAI,SAAS,cAAe,YAAW,aAAa,SAAS;AAC7D,YAAQ,aAAa;AACrB,QAAI,SAAS,YAAa,SAAQ,WAAW,SAAS;AAGtD,QAAI,SAAS,kBAAmB,SAAQ,UAAU,SAAS;AAC3D,QAAI,SAAS,iBAAkB,SAAQ,gBAAgB,SAAS;AAChE,QAAI,SAAS,2BAA2B,QAAW;AACjD,cAAQ,sBAAsB,SAAS;AAAA,IACzC;AACA,QAAI,SAAS,kBAAkB,OAAW,SAAQ,aAAa,SAAS;AACxE,QAAI,SAAS,yBAAyB;AACpC,cAAQ,uBAAuB,SAAS;AAAA,IAC1C;AACA,WAAO,IAAI,iBAAiB,OAAO;AAAA,EACrC;AACF;;;ACnDA,SAAS,SAAAC,cAAa;AACtB,SAAS,cAAAC,mBAAkB;AAM3B,SAAS,6BAA6B,OAAyB;AAC7D,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,OAAO,QAAQ,IAAI,OAAO,MAAM;AACtC,SAAO,SAAS,YAAY,SAAS;AACvC;AAEA,IAAM,iCAAN,cAA6C,uBAAuB;AAAA,EACzD;AAAA,EAET,YAAY,UAAyC,CAAC,GAAG;AACvD,UAAM,OAAO;AACb,SAAK,mBAAmB;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAe,UAAU,MAAoD;AAC3E,WAAO,6BAA6B,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG,OAAO;AAAA,EAC1E;AAAA,EAEA,MAAe,UAAU,MAAoD;AAC3E,WAAO,6BAA6B,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG,OAAO;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YACJ,OACA,UAA2D,CAAC,GAC1B;AAClC,QAAI,CAACC,YAAW,MAAM,iBAAiB,GAAG;AACxC,YAAM,IAAI,mBAAmB,SAAS,2CAA2C;AAAA,IACnF;AACA,QAAI;AACJ,QAAI;AACF,cAAQ,MAAMC,OAAM,MAAM,iBAAiB;AAAA,IAC7C,SAAS,OAAO;AACd,UAAI,6BAA6B,KAAK,GAAG;AACvC,cAAM,IAAI,2CAA2C,SAAS,MAAM,iBAAiB;AAAA,MACvF;AACA,YAAM;AAAA,IACR;AAGA,QAAI,CAAC,MAAM,YAAY,GAAG;AACxB,YAAM,IAAI,2CAA2C,SAAS,MAAM,iBAAiB;AAAA,IACvF;AACA,UAAM,gBACJ,SAAS,kBAAkB,SACvB,KAAK,iBAAiB,gBACtB,QAAQ;AACd,WAAO;AAAA,MACL,IAAI,wBAAwB;AAAA,QAC1B;AAAA,QACA,GAAI,KAAK,iBAAiB,iBAAiB,SACvC,EAAE,cAAc,KAAK,iBAAiB,aAAa,IACnD,CAAC;AAAA,QACL,GAAI,kBAAkB,SAAY,EAAE,cAAc,IAAI,CAAC;AAAA,MACzD,CAAC;AAAA,MACD;AAAA,IACF;AAAA,EACF;AACF;AAEO,IAAM,gBAAsC;AAAA,EACjD,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,kBAAkB,CAAC,mBAAmB;AAAA,EACtC,wBAAwB,MAAM;AAAA,EAC9B,YAAY,uBAAuB;AAAA,EACnC,oBAAoB;AAAA;AAAA,EAEpB,sBAAsB;AAAA,EAAC;AAAA,EACvB,QAAQ;AAIN,WAAO,IAAI,+BAA+B,EAAE,UAAU,IAAI,iBAAiB,EAAE,CAAC;AAAA,EAChF;AACF;;;SC/DS,SAAS,iBAAiB;;;ACH7B,IAAO,gCAAP,MAAoC;EAE/B,OAAO;EACP;EACA;EAET,YAAY,UAAgD,CAAA,GAAE;AAC5D,SAAK,aAAa,QAAQ;AAC1B,SAAK,wBAAwB,QAAQ;EACvC;;AAGI,SAAU,iCACd,OACA,UAAgD,CAAA,GAAE;AAElD,wBAAsB,OAAO,OAAO;AAEpC,MAAI,UAAU,KAAK,GAAG;AACpB,UAAM,cAAc,mBAAmB,OAAO,aAAa;AAC3D,UAAM,kBAAkB,mBAAmB,OAAO,iBAAiB;AACnE,UAAM,eAAe,mBAAmB,OAAO,cAAc;AAC7D,IAAAC,wBAAuB;MACrB;MACA;MACA,WAAW,MAAM;KAClB;AACD,oCAAgC;MAC9B;MACA;MACA;MACA,WAAW,MAAM;KAClB;AACD,UAAM,cAAc,mBAAmB;MACrC,mBAAmB;MACnB,uBAAuB;MACvB,mBAAmB;KACpB;AACD,wCAAoC,OAAO,aAAa,QAAQ,UAAU;AAC1E,WAAO;MACL,YAAY,MAAM;MAClB,mBAAmB,MAAM;MACzB,WAAW,MAAM;MACjB;MACA,YAAY,QAAQ;MACpB,uBAAuB,QAAQ;MAC/B,UAAU,MAAM,YAAY;;EAEhC;AAEA,MAAI,UAAU,KAAK,GAAG;AACpB,UAAM,cAAc,mBAAmB,OAAO,aAAa;AAC3D,UAAM,kBAAkB,mBAAmB,OAAO,iBAAiB;AACnE,IAAAA,wBAAuB;MACrB;MACA;MACA,WAAW,MAAM;KAClB;AACD,UAAM,cAAc,mBAAmB;MACrC,mBAAmB;MACnB,uBAAuB;KACxB;AACD,wCAAoC,OAAO,aAAa,QAAQ,UAAU;AAC1E,UAAM,eAAe,mBAAmB,OAAO,cAAc;AAC7D,QAAI,CAAC,gBAAgB,CAAC,MAAM,WAAW;AACrC,YAAM,IAAI,kBACR,6DACA;QACE,UAAU;QACV,WAAW,MAAM;OAClB;IAEL;AACA,WAAO;MACL,YAAY,MAAM;MAClB,mBACE,gBAAgB,WAAW,MAAM,SAAS;MAC5C,WAAW,MAAM;MACjB;MACA,YAAY,QAAQ;MACpB,uBAAuB,QAAQ;MAC/B,UAAU,MAAM,YAAY;;EAEhC;AAEA,MAAI,WAAW,KAAK,GAAG;AACrB,UAAM,WAAW,mBAAmB,OAAO,UAAU;AACrD,UAAM,kBAAkB,mBAAmB,OAAO,iBAAiB;AACnE,UAAM,cAAc,mBAAmB,OAAO,aAAa;AAC3D,8BAA0B;MACxB;MACA;MACA,WAAW,MAAM;KAClB;AACD,SAAK,CAAC,YAAY,CAAC,oBAAoB,CAAC,QAAQ,YAAY;AAC1D,YAAM,IAAI,kBACR,+FACA;QACE,UAAU;QACV,WAAW,MAAM;OAClB;IAEL;AACA,UAAM,cACJ,YAAY,kBACR;MACE,sBAAsB;MACtB,0BAA0B;QAE5B;AACN,wCAAoC,OAAO,aAAa,QAAQ,UAAU;AAC1E,WAAO;MACL,YAAY,MAAM;MAClB,mBAAmB,eAAe;MAClC,WAAW,MAAM;MACjB;MACA,YAAY,QAAQ;MACpB,uBAAuB,QAAQ;MAC/B,UAAU,MAAM,YAAY;;EAEhC;AAEA,QAAM,IAAI,+BACR,oEACA;IACE,UAAU;IACV,SAAS;IACT,WAAW,OAAQ,MAA6B,QAAQ,SAAS;GAClE;AAEL;AAEM,SAAU,6BACd,OAAY;AAEZ,SACE,mBAAmB,KAAK,KACxB,MAAM,eAAe,SAAS;AAElC;AAEA,SAAS,sBACP,OACA,SAA6C;AAE7C,MAAI,QAAQ,eAAe,UAAa,QAAQ,WAAW,KAAI,MAAO,IAAI;AACxE,UAAM,IAAI,kBACR,6DACA;MACE,UAAU;MACV,WAAW,MAAM;KAClB;EAEL;AACA,MACE,QAAQ,0BAA0B,UAClC,QAAQ,sBAAsB,KAAI,MAAO,IACzC;AACA,UAAM,IAAI,kBACR,wEACA;MACE,UAAU;MACV,WAAW,MAAM;KAClB;EAEL;AACA,MAAI,QAAQ,0BAA0B,UAAa,CAAC,QAAQ,YAAY;AACtE,UAAM,IAAI,kBACR,iEACA;MACE,UAAU;MACV,WAAW,MAAM;KAClB;EAEL;AACF;AAEA,SAAS,oCACP,OACA,aACA,YAA8B;AAE9B,MAAI,cAAc,eAAe,OAAO,KAAK,WAAW,EAAE,SAAS,GAAG;AACpE,UAAM,IAAI,kBACR,oFACA;MACE,UAAU;MACV,WAAW,MAAM;KAClB;EAEL;AACF;AAEA,SAAS,mBACP,aAA+C;AAE/C,QAAM,UAAU,OAAO,YACrB,OAAO,QAAQ,WAAW,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,UAAU,MAAS,CAAC;AAExE,SAAO,OAAO,KAAK,OAAO,EAAE,SAAS,IAAI,UAAU;AACrD;AAEA,SAASA,wBAAuB,MAI/B;AACC,yBAA8B;IAC5B,aAAa,KAAK;IAClB,iBAAiB,KAAK;IACtB,SACE;IACF,SAAS;MACP,UAAU;MACV,WAAW,KAAK;;GAEnB;AACH;AAEA,SAAS,0BAA0B,MAIlC;AACC,MAAI,QAAQ,KAAK,QAAQ,MAAM,QAAQ,KAAK,eAAe,GAAG;AAC5D,UAAM,IAAI,kBACR,8FACA;MACE,UAAU;MACV,WAAW,KAAK;KACjB;EAEL;AACF;AAEA,SAAS,gCAAgC,MAKxC;AACC,MAAI,KAAK,iBAAiB,CAAC,KAAK,eAAe,CAAC,KAAK,kBAAkB;AACrE,UAAM,IAAI,kBACR,iGACA;MACE,UAAU;MACV,WAAW,KAAK;KACjB;EAEL;AACF;AAEA,SAAS,mBACP,OAAY;AAEZ,SACE,MAAM,SAAS,cACf,MAAM,SAAS,cACf,MAAM,SAAS;AAEnB;AAEA,SAAS,UAAU,OAAY;AAC7B,SAAO,MAAM,SAAS;AACxB;AAEA,SAAS,UAAU,OAAY;AAC7B,SAAO,MAAM,SAAS;AACxB;AAEA,SAAS,WAAW,OAAY;AAC9B,SAAO,MAAM,SAAS;AACxB;;;ADrNA,IAAM,0BAA0B;AAChC,IAAMC,8BAA6B;AACnC,IAAMC,qCAAoC;AAC1C,IAAM,kCAAkC,OAAO;AAC/C,IAAM,wCAAwC;AAqIxC,IAAO,qBAAP,MAAO,oBAAkB;EACpB;EACA;EAET,YACE,MACA,OAA8B;AAE9B,SAAK,OAAO;AACZ,SAAK,QAAQ;EACf;EAEA,OAAO,UAAU,OAAqB;AACpC,WAAO,IAAI,oBAAmB,SAAS,KAAK;EAC9C;EAEA,OAAO,OAAO,SAAe;AAC3B,WAAO,IAAI,oBAAmB,MAAM,OAAO;EAC7C;EAEA,OAAO,QAAQ,UAAgB;AAC7B,WAAO,IAAI,oBAAmB,OAAO,QAAQ;EAC/C;;AAwEI,IAAO,sBAAP,MAA0B;EACrB;EACQ;EACA;EACA;EACT;EACA,4BAA4B;EAC5B;EACA;EACA,SAAS;EACT;EACS,kBAAkB,oBAAI,IAAG;EACzB,qBAAgD,OAC/D,MACA,YACG,MAAM,KAAK,kBAAkB,MAAM,OAAO;EAC9B;EACT;EACA,gBAAgB;EAExB,YAAY,MAUX;AACC,SAAK,QAAQ,KAAK;AAClB,SAAK,QAAQ,KAAK;AAClB,SAAK,MAAM,KAAK;AAChB,SAAK,UAAU,KAAK;AACpB,SAAK,cAAc,KAAK,eAAe,KAAK,MAAM,eAAe;AACjE,SAAK,MAAM,cAAc,KAAK;AAC9B,SAAK,oBAAoB,KAAK;AAC9B,SAAK,4BAA4B,KAAK;AACtC,SAAK,oBAAoB,KAAK;AAC9B,SAAK,iBAAiB,KAAK,aAAa;AACxC,SAAK,4BACH,KAAK,sBAAsB,UAAa,CAAC,KAAK;EAClD;EAEA,iBAAiB,QAAoC;AACnD,iCAA6B,MAAM;AACnC,SAAK,gBAAgB;EACvB;EAEA,aAAa,OAAc;AACzB,QAAI,OAAO;AACT,aAAO,wBAAwB;QAC7B,cAAc;QACd,YAAY;QACZ;QACA,aAAa,KAAK;QAClB,YAAY,KAAK,mBAAmB,KAAK,IAAI;QAC7C,QAAQ,KAAK,OAAM;OACpB;IACH;AACA,WAAO,IAAI,oBAAoB;MAC7B,aAAa,KAAK;MAClB,YAAY,OAAO,SAAS,MAAM,KAAK,WAAW,IAAI;MACtD,UAAU,OAAO,SACf,IAAI,YAAW,EAAG,OAAO,MAAM,KAAK,gBAAgB,IAAI,CAAC;MAC3D,WAAW,OAAO,MAAM,YAAW;AACjC,cAAM,KAAK,iBAAiB,MAAM,OAAO;MAC3C;MACA,YAAY,OAAO,SAAQ;AACzB,cAAM,KAAK,kBAAkB,IAAI;MACnC;KACD;EACH;EAEA,cAAW;AACT,WAAO;EACT;EAEA,MAAM,YAAY,MAAqB;AACrC,UAAM,QAAQ,KAAK,IAAG;AACtB,UAAM,UAAU,kBAAkB;MAChC,GAAG;MACH,KAAK,wBAAwB,KAAK,KAAK,KAAK,KAAK;KAClD;AACD,UAAMC,WAAU,MAAM,KAAK,QAAQ,KAAK,SAAS;MAC/C,MAAM;MACN,SAAS,KAAK,eAAe,KAAK,OAAO;MACzC,KAAK,KAAK,MAAM;MAChB,KAAK,KAAK,OAAO;MACjB,QAAQ;MACR,QAAQ;KACT;AAED,UAAM,gBAAgB,oBAAoBA,QAAO;AACjD,UAAM,wBACJ,eACA,KAAK,eAAeC,2BAA0B;AAGhD,QAAI,cAAc,MAAM;AACtB,YAAMC,UAAS,eACb,qBAAqB,aAAa,GAClC,KAAK,eAAe;AAEtB,aAAO,mBAAmB;QACxB,QAAQA,QAAO;QACf,iBAAiB,eAAe,KAAK;QACrC,UAAU,cAAc,YAAY;QACpC,oBAAoBA,QAAO;OAC5B;IACH;AAEA,UAAM,YAAY,KAAK;AACvB,SAAK,sBAAsB,WAAW,aAAa;AACnD,UAAM,SAAS,eACb,qBAAqB,aAAa,GAClC,KAAK,eAAe;AAEtB,WAAO,mBAAmB;MACxB,QAAQ,OAAO;MACf,iBAAiB,eAAe,KAAK;MACrC;MACA,oBAAoB,OAAO;KAC5B;EACH;EAEA,MAAM,WAAW,MAAoB;AACnC,UAAM,gBAAgB,KAAK,gBAAgB,IAAI,KAAK,SAAS;AAC7D,QAAI,CAAC,eAAe;AAClB,aAAO,mBAAmB;QACxB,QAAQ,0CAA0C,KAAK,SAAS;QAChE,iBAAiB;QACjB,UAAU;OACX;IACH;AAEA,UAAM,QAAQ,KAAK,IAAG;AACtB,UAAM,QAAQ,KAAK,SAAS;AAC5B,QAAI,MAAM,SAAS,GAAG;AACpB,UAAI,CAAC,cAAc,QAAQ,OAAO,WAAW;AAC3C,cAAM,IAAI,UACR,gEAAgE;MAEpE;AACA,YAAM,cAAc,QAAQ,MAAM,UAAU,KAAK;IACnD;AAEA,UAAM,wBACJ,eACA,KAAK,eAAeC,kCAAiC;AAGvD,UAAM,SAAS,eACb,qBAAqB,aAAa,GAClC,KAAK,eAAe;AAEtB,QAAI,cAAc,MAAM;AACtB,WAAK,oBAAoB,KAAK,WAAW,aAAa;AACtD,aAAO,mBAAmB;QACxB,QAAQ,OAAO;QACf,iBAAiB,eAAe,KAAK;QACrC,UAAU,cAAc,YAAY;OACrC;IACH;AAEA,WAAO,mBAAmB;MACxB,QAAQ,OAAO;MACf,iBAAiB,eAAe,KAAK;MACrC,WAAW,KAAK;MAChB,oBAAoB,OAAO;KAC5B;EACH;EAEA,MAAM,UAAU,MAAmB;AACjC,UAAMC,gBAAe,MAAM,KAAK,kBAAkB,KAAK,IAAI;AAC3D,UAAM,QAAQ,KAAK,QACf,MAAM,oBAAoB;MACxB,cAAc;MACd,YAAY;MACZ,MAAMA;MACN,OAAO,KAAK;MACZ,YAAY,KAAK,mBAAmB,KAAK,IAAI;KAC9C,IACD,MAAM,KAAK,gBAAgBA,aAAY;AAC3C,WAAO,qBAAqB,KAAK,MAAM,KAAK;EAC9C;EAEA,MAAM,SAAS,MAAkB;AAC/B,UAAMA,gBAAe,MAAM,KAAK,kBAAkB,KAAK,IAAI;AAC3D,UAAM,QAAQ,KAAK,QACf,MAAM,oBAAoB;MACxB,cAAc;MACd,YAAY;MACZ,MAAMA;MACN,OAAO,KAAK;MACZ,YAAY,KAAK,mBAAmB,KAAK,IAAI;KAC9C,IACD,MAAM,KAAK,gBAAgBA,aAAY;AAC3C,QAAI,OAAO,KAAK,aAAa,YAAY,MAAM,aAAa,KAAK,UAAU;AACzE,aAAO,MAAM,SAAS,GAAG,KAAK,QAAQ;IACxC;AACA,WAAO;EACT;EAEA,MAAM,WAAW,MAAc,OAAc;AAC3C,UAAMA,gBAAe,MAAM,KAAK,kBAAkB,IAAI;AACtD,QAAI,CAAC,OAAO;AACV,aAAO,MAAM,6BAA6B;QACxC,cAAc;QACd,YAAY;QACZ,MAAMA;QACN,YAAY,OAAO,YAAW;AAC5B,gBAAM,OACJ,YAAY,WAAW,WAAWA,aAAY,CAAC,KAC3C,CAAC,QAAQ,MAAMA,aAAY,IAC3B,CAAC,WAAW,MAAM,OAAO;AAC/B,gBAAMJ,WAAU,MAAM,KAAK,QAAQ,KAAK,MAAM;YAC5C,MAAM;YACN,SAAS,KAAK,MAAM,SAAS;YAC7B,QAAQ;YACR,QAAQ;WACT;AACD,cAAI,SAAS;AACb,gBAAM,aAAa,oBAAoBA,SAAQ,QAAQ,CAAC,UAAS;AAC/D,sBAAU;UACZ,CAAC;AACD,cAAI;AACF,kBAAMK,UAAS,MAAML,SAAQ,KAAI;AACjC,kBAAM,WAAW;AACjB,mBAAO,EAAE,QAAAK,SAAQ,OAAM;UACzB,SAAS,OAAO;AACd,kBAAM,WAAW,OAAM;AACvB,kBAAM;UACR;QACF;OACD;IACH;AACA,WAAO,MAAM,sBACXD,eACA,OACA,KAAK,mBAAmB,KAAK,IAAI,GACjC;MACE,cAAc;MACd,YAAY;KACb;EAEL;EAEA,MAAM,UAAO;AACX,QAAI;AACF,aAAQ,MAAM,KAAK,QAAQ,KAAI,MAAQ;IACzC,QAAQ;AACN,aAAO;IACT;EACF;EAEA,MAAM,mBAAmB,MAAY;AACnC,UAAM,gBAAgB,4BAA4B;MAChD,cAAc;MACd;MACA,iBAAiB,KAAK,MAAM;KAC7B;AACD,UAAM,SAAS,6BAA6B,KAAK,OAAO,aAAa;AACrE,QAAI,QAAQ;AACV,aAAO;IACT;AACA,QAAI,CAAC,KAAK,QAAQ,SAAS;AACzB,YAAM,IAAI,qBACR,sFACA;QACE,UAAU;QACV,MAAM;OACP;IAEL;AAEA,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,KAAK,QAAQ,QAAQ,GAAM;IAC7C,SAAS,OAAO;AACd,YAAM,IAAI,qBACR,iEAAiE,aAAa,KAC9E;QACE,UAAU;QACV,MAAM;QACN,OAAO,qBAAqB,KAAK;OAClC;IAEL;AAEA,UAAM,SAAS,QAAQ,aAAa;AACpC,QACE,OAAO,QAAQ,SAAS,YACxB,OAAO,KAAK,WAAW,KACvB,OAAO,OAAO,SAAS,UACvB;AACA,YAAM,IAAI,qBACR,0CAA0C,aAAa,KACvD;QACE,UAAU;QACV,MAAM;OACP;IAEL;AAEA,WAAO,kCAAkC,KAAK,OAAO,eAAe;MAClE,MAAM,OAAO;MACb,MAAM,OAAO;MACb,KAAK;MACL,OAAO;KACR;EACH;EAEA,MAAM,iBAAiB,MAA0B;AAC/C,wCACE,sBACA,KAAK,MACL,KAAK,OACL,+BAA+B;AAEjC,0CACE,KAAK,OACL,KAAK,MACL,KAAK,MAAM,QAAQ;AAErB,UAAM,qCACJ,KAAK,OACL,KAAK,MACL,KAAK,OACL,SACA,KAAK,OAAM,GACX,KAAK,oBACL,KAAK,+BAA+B,KAAK,KAAK,CAAC;AAEjD,SAAK,4BAA2B;EAClC;EAEA,MAAM,cAAc,UAAoB,OAAc;AACpD,2CACE,sBACA,UACA,+BAA+B;AAEjC,6CAAyC,UAAU,KAAK,MAAM,QAAQ;AACtE,UAAM,gCACJ,KAAK,OACL,UACA,SACA,KAAK,OAAM,GACX,KAAK,oBACL,KAAK,+BAA+B,KAAK,CAAC;AAE5C,SAAK,4BAA2B;EAClC;EAEA,MAAM,mBAAgB;AACpB,QAAI,KAAK,MAAM,yBAAyB,uBAAuB;AAC7D,YAAM,UAAU,MAAM,KAAK,0BAAyB;AACpD,UAAI,SAAS;AACX,eAAO;MACT;IACF,WAAW,KAAK,MAAM,yBAAyB,sBAAsB;AACnE,YAAM,UAAU,MAAM,KAAK,yBAAwB;AACnD,UAAI,SAAS;AACX,eAAO;MACT;IACF,OAAO;AACL,oCACE,sBACA,KAAK,MAAM,oBAAoB;IAEnC;AAEA,sDAAkD,KAAK,MAAM,QAAQ;AACrE,WAAO,MAAM,0BAA0B;MACrC,cAAc;MACd,UAAU,KAAK,MAAM;MACrB,IAAI,KAAK,UAAS;KACnB;EACH;EAEA,MAAM,iBACJ,MACA,UAAmC,CAAA,GAAE;AAErC,UAAM,cAAc,wBAAwB,IAAI;AAChD,QAAI,aAAa,aAAa,6BAA6B;AACzD,WAAK,kCACH,YAAY,wBAAwB,uBACpC,qBAAqB;AAEvB,YAAM,KAAK,0BAA0B,YAAY,UAAU;AAC3D;IACF;AACA,QAAI,aAAa,aAAa,4BAA4B;AACxD,WAAK,kCACH,YAAY,wBAAwB,sBACpC,oBAAoB;AAEtB,YAAM,KAAK,yBAAyB,YAAY,UAAU;AAC1D;IACF;AAEA,QAAI,KAAK,MAAM,yBAAyB,OAAO;AAC7C,oCACE,sBACA,KAAK,MAAM,oBAAoB;IAEnC;AACA,sDAAkD,KAAK,MAAM,QAAQ;AACrE,UAAM,0BAA0B;MAC9B,cAAc;MACd,UAAU,KAAK,MAAM;MACrB,IAAI,KAAK,UAAS;MAClB;MACA,eACE,QAAQ,kBAAkB,SACtB,KAAK,gBACL,QAAQ;KACf;EACH;EAEQ,MAAM,4BAAyB;AACrC,QAAI,KAAK,kCAAiC,GAAI;AAC5C,aAAO;IACT;AACA,QAAI,CAAC,KAAK,QAAQ,oBAAoB;AACpC,aAAO;IACT;AAEA,UAAM,aAAa,0BACjB,MAAM,kBACJ,sBACA,SACA,+BACA,YACE,MAAM,KAAK,QAAQ,mBACjB,KAAK,MAAM,2BAA2B,GAE1C,EAAE,WAAW,KAAK,MAAM,UAAS,CAAE,CACpC;AAEH,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,qBACR,uEACA;QACE,UAAU;QACV,WAAW,KAAK,MAAM;OACvB;IAEL;AAEA,WAAO,wBAAwB;MAC7B,UAAU;MACV;MACA,sBAAsB;KACvB;EACH;EAEQ,MAAM,2BAAwB;AACpC,QAAI,KAAK,kCAAiC,GAAI;AAC5C,aAAO;IACT;AACA,QAAI,CAAC,KAAK,QAAQ,mBAAmB;AACnC,aAAO;IACT;AAEA,UAAM,aAAa,0BACjB,MAAM,kBACJ,sBACA,SACA,8BACA,YACE,MAAM,sBACJ,KAAK,QAAQ,kBAAmB,KAAK,MAAM,SAAS,IAAI,GACxD,KAAK,MAAM,6BACX,mDACA,OAAO,aAAY;AACjB,YAAM,KAAK,6BAA6B,QAAQ;IAClD,CAAC,GAEL,EAAE,WAAW,KAAK,MAAM,UAAS,CAAE,CACpC;AAEH,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,qBACR,sEACA;QACE,UAAU;QACV,WAAW,KAAK,MAAM;OACvB;IAEL;AAEA,WAAO,wBAAwB;MAC7B,UAAU;MACV;MACA,sBAAsB;KACvB;EACH;EAEQ,oCAAiC;AACvC,WAAO,KAAK,MAAM,SAAS,0BAAyB,EAAG,OAAO;EAChE;EAEQ,kCACN,QACA,UAAmC;AAEnC,QAAI,WAAW,YAAY,KAAK,MAAM,yBAAyB,UAAU;AACvE,YAAM,IAAI,qBACR,iCAAiC,MAAM,8BAA8B,KAAK,MAAM,oBAAoB,KACpG;QACE,UAAU;QACV,sBAAsB,KAAK,MAAM;QACjC,8BAA8B;OAC/B;IAEL;EACF;EAEQ,MAAM,0BAA0B,YAAkB;AACxD,UAAM,kBAAkB,KAAK;AAC7B,UAAM,oBAAoB,KAAK,MAAM;AACrC,UAAM,uBAAuB,KAAK;AAClC,UAAM,UAAU,MAAM,kBACpB,sBACA,SACA,+BACA,YACE,MAAM,uBACH,YAAW;AACV,YAAM,QAAQ,MAAM,KAAK,iBAAiB,UAAU;AACpD,aAAO,MAAM,KAAK,MAAM,UAAU,OAChC,KAAK,KACL,OACA,MAAM,KAAK,oBAAmB,CAAE;IAEpC,GAAE,GACF,KAAK,MAAM,oCACX,gDACA,iCAAiC,GAErC,EAAE,WAAW,mBAAmB,WAAU,CAAE;AAE9C,QAAI,sBAAsB;AACxB,UAAI;AACF,cAAM,gBAAgB,UAAS;MACjC,SAAS,OAAO;AACd,YAAI;AACJ,YAAI;AACF,gBAAM,QAAQ,UAAS;QACzB,SAAS,2BAA2B;AAClC,sCAA4B,qBAC1B,yBAAyB;QAE7B;AACA,cAAM,IAAI,qBACR,iHACA;UACE,UAAU;UACV,WAAW;UACX,sBAAsB,QAAQ;UAC9B,OAAO,qBAAqB,KAAK;UACjC,GAAI,4BAA4B,EAAE,0BAAyB,IAAK,CAAA;SACjE;MAEL;IACF;AACA,UAAM,KAAK,qBAAoB;AAC/B,SAAK,UAAU;AACf,SAAK,cAAc;AACnB,SAAK,MAAM,YAAY,QAAQ;AAC/B,SAAK,MAAM,cAAc;AACzB,WAAO,KAAK,MAAM;EACpB;EAEQ,MAAM,yBAAyB,YAAkB;AACvD,QAAI,CAAC,KAAK,QAAQ,YAAY;AAC5B,YAAM,IAAI,qBACR,sFACA;QACE,UAAU;QACV,WAAW,KAAK,MAAM;QACtB;OACD;IAEL;AACA,UAAM,UAAU,KAAK;AACrB,UAAM,cAAc,KAAK;AACzB,UAAM,kBACJ,sBACA,SACA,8BACA,YAAW;AACT,UAAI,CAAC,aAAa;AAChB,cAAM,QAAQ,MAAM,sBAClB,KAAK,iBAAiB,UAAU,GAChC,KAAK,MAAM,oCACX,6CAA6C;AAE/C,cAAM,QAAQ,WAAY,KAAK,MAAM,SAAS,MAAM,KAAK;AACzD;MACF;AACA,YAAM,uBACH,YAAW;AACV,cAAM,QAAQ,MAAM,KAAK,iBAAiB,UAAU;AACpD,cAAM,QAAQ,WAAY,KAAK,MAAM,SAAS,MAAM,KAAK;MAC3D,GAAE,GACF,KAAK,MAAM,oCACX,+CACA,YAAW;AACT,cAAM,kCAAkC,OAAO;MACjD,CAAC;IAEL,GACA,EAAE,WAAW,KAAK,MAAM,WAAW,WAAU,CAAE;EAEnD;EAEQ,MAAM,6BACZ,UAAuE;AAEvE,UAAM,aAAa,0BAA0B,QAAQ;AACrD,QAAI,CAAC,cAAc,CAAC,KAAK,MAAM,OAAO,QAAQ;AAC5C;IACF;AACA,UAAM,KAAK,MAAM,OAAO,OAAO,UAAU,EAAE,MAAM,MAAK;IAAE,CAAC;EAC3D;EAEQ,MAAM,iBAAiB,YAAkB;AAC/C,WAAO,KAAK,MAAM,OAAO,SACrB,MAAM,kBACJ,sBACA,SACA,iBACA,YAAY,MAAM,KAAK,MAAM,OAAO,OAAQ,UAAU,GACtD,EAAE,SAAS,WAAU,CAAE,IAEzB,EAAE,SAAS,WAAU;EAC3B;EAEQ,MAAM,sBAAmB;AAC/B,UAAM,oBAAoB,MAAM,KAAK,yBAAwB;AAC7D,WAAO;MACL,SAAS,KAAK,MAAM,SAAS;MAC7B,KAAK,KAAK,MAAM;MAChB,GAAI,KAAK,MAAM,cAAc,EAAE,SAAS,CAAC,SAAS,UAAU,EAAC,IAAK,CAAA;MAClE,GAAI,OAAO,KAAK,MAAM,cAAc,WAChC,EAAE,WAAW,KAAK,MAAM,UAAS,IACjC,CAAA;MACJ,GAAI,OAAO,KAAK,MAAM,kBAAkB,WACpC,EAAE,eAAe,KAAK,MAAM,cAAa,IACzC,CAAA;MACJ,GAAI,OAAK,KAAM,MAAM,QAAO,WAAW,EAAG,KAAK,KAAG,MAAA,IAAA,IAAA,CAAA;MAClD,GAAI,OAAK,KAAM,MAAA,cAAA,WACX,EAAE,WAAA,KAAgB,MAAK,UAAM,IAC7B,CAAA;MACJ,GAAI,KAAA,MAAA,MAAiB,EAAE,KAAG,KAAA,MAAA,IAAiB,IAAI,CAAC;MAChD,GAAA,KAAA,MAAA,yBACH,EAAA,gBAAA,KAAA,MAAA,uBAAA,IAEa,CAAA;MAGR,GAAI,oBAAC,EAAA,kBAA4B,IAAA,CAAA;;;QAGrC,2BAAyB;AACzB,QAAI,KAAC,2BAA4B;AACjC,aAAW,KAAC;IACb;AAED,SAAM,oBAAK,MAAA,KAAA,4BAAA;AACT,SAAI,4BAAc;WAChB,KAAO;;QAET,QAAS;QACP,KAAA,QAAW;AACX;IACF;AACA,QAAI,KAAC,cAAe;AAChB,YAAC,KAAA;AACH;;AAEF,SAAC,eAAA,KAAA,UAAA;;AACC,YAAK,KAAK;WACR,SAAK;cAET;AACD,UAAA,CAAA,KAAA,QAAA;AAEa,aAAS,eAAA;MACrB;IACA;;oBAKQ;sBACI,CAAA,GAAA,KAAa,gBAAe,OAAQ,CAAA;UAC3C,kBAAA,UAAA,OAAA,CAAA,kBAAA,CAAA,cAAA,IAAA;AACH,UACA,QAAA,IAAA,gBAAA,IAAA,OAAA,kBAAA;AACE,UAAI,cAAc,QAAC,OAAA,OAAA;AACrB,cAAU,cAAS,QAAY,MAAA,MAAA,EAAA,MAAA,MAAA;QAAA,CAAA;MAC/B;;QAGE,KACA,aAAA;AACH,YAAA,KAAA,QAAA,UAAA;YAAO,QAAA,IAAA,gBAAA,IAAA,OAAA,kBAAA;AACN,cAAM,cACJ,YAAgB,MAAI,MAAO;QAAA,CAAA;;WAI9B;AACD,YAAK,QAAa,IAAI,gBAAY,IAAA,OAAA,kBAAA;AAChC,cAAA,cAAA,kBAAmC,EAAA,MAAA,MAAA;QAAA,CAAA;MACpC,CAAA,CAAA;IACD;AACD,eAAAJ,YAAA,WAAA;AAEa,gCAAoBA,QAAA;IAChC;AACA,SAAK,gBAAgB,MAAK;;+BAGtB;UACA,YAAK,CAAA,GAAa,KAAK,gBAAI,OAAc,CAAA;yBACjC,MAAa;UACpB,QAAA,IAAA,UAAA,IAAA,OAAA,kBAAA;AACD,gCAA0B,aAAA;UACxB,CAAA,cAAM,QAAc,cAAiB,QAAQ,OAAM,OAAK;AACzD,cAAA,cAAA,QAAA,MAAA,MAAA,EAAA,MAAA,MAAA;QAAA,CAAA;MAEH;AACH,UAAA,CAAA,cAAA,MAAA;AAEO,cAAA,cAA+B,kBAAc,EAAA,MAAA,MAAA;QAAA,CAAA;MACnD;;;iCAGO,OAAA;WACL,wCAAyC;MACzC,cAAS;kBACP;;kBAKC,KAAA,mBAAA,KAAA,IAAA;eACD;QACD,kBAAA,OAAAI,eAAA,WAAA;AACM,0CAAiC,CAAAA,aAAA,CAAA;QACvC;QACJ,mBAAA,KAAA;MAEO;MACF,SAAM;;;gCAGe;AACzB,QAAI,CAAC,KAAA,2BAA4B;AAClC;IAED;AACE,SAAA,oBAAmB;AACpB,SAAA,4BAAA;EAED;QACE,WAAW;AACZ,UAAA,KAAA,MAAA;EAEO;QAIN,SAAK;AACL,UAAA,KAAA,MAAc;;wBAEI,WAAA,eAA0B;yBAC7B,IAAA,WAAmB,aAAW;kBACrC,oBACD,MAAA;AACH,oBAAG,eAAA,WAAqC,MAAE;AAC1C,YAAA,KAAW,gBAAc,IAAA,SAAc,MAAA,eAAA;AACvC,eAAA,gBAAA,OAAA,SAAA;QACD;MACJ,GAAA,qCAAA;AAEO,iBAAmB,cAEzB,YAAiC;IAEjC,CAAA,EACI,MAAK,MAAA;IAAA,CAAA;;sBAER,WAAA,eAAA;AACF,8BAAA,aAAA;AAED,QAAA,KAAA,gBAAiC,IAAA,SAAA,MAAA,eAAA;AAC/B,WAAO,gBAAA,OAAA,SAAgC;IACxC;EAED;sBAIe,MAAA;WACX,2BAA6B,KAAA,MAAA,SAAA,MAAA,IAAA;;0BAEtB,MAAA,UAAA,CAAA,GAAA;WACP,MAAA,qCAA8B;gBACtB,KAAA,MAAU;;;kBAGd,OAAQ,YAAM;cACdJ,WAAQ,MAAM,KAAA,QAAA,KAAA,CAAA,WAAA,MAAA,OAAA,GAAA;UACb,MAAA;UACH,SAAa,KAAE,MAAQ,SAAS;UAC9B,QAAA;UACA,QAAA;;cAEC,CAAA,QAAA,QAAA,QAAA,IAAA,MAAA,QAAA,IAAA;UACH,eAAiBA,SAAU,MAAM;UAClC,eAAAA,SAAA,MAAA;UACAA,SAAA,KAAA;QACJ,CAAA;AAED,eAA4B,EAAA,QAAA,UAAA,QAAA,OAAA;MAC1B;IACD,CAAA;EAED;iBACa,MAAA;AACZ,WAAA,sBAAA,KAAA,MAAA,SAAA,MAAA,IAAA;EAED;QAIE,gBAAkB,MAAC;AAIpB,UAAA,KAAA,iBAAA,CAAA,SAAA,MAAA,MAAA,IAAA,CAAA;EAED;QACE,iBAAkB,MAAK,SAAW;AACnC,UAAA,KAAA,QAAA,WAAA,WAAA,OAAA,YAAA,WAAA,IAAA,YAAA,EAAA,OAAA,OAAA,IAAA,SAAA,IAAA;EAED;QACE,gBAAW,MAAA;AACZ,WAAA,WAAA,KAAA,MAAA,KAAA,QAAA,WAAA,UAAA,IAAA,CAAA;EAEO;QAIN,kBAAgB,MAAU;UAGtB,KAAM,iBAAM,CAAA,MAAA,MAAA,MAAA,IAAA,CAAA;;2BAEI,SAAA,UAAW,CAAA,GAAA;UAC3BA,WAAQ,MAAM,KAAA,QAAA,KAAA,CAAA,WAAA,OAAA,wBAAA,SAAA,QAAA,KAAA,CAAA,GAAA;MACd,MAAM;MAER,SAAA,KAAA,MAAA,SAAA;MACF,KAAO,KAAM,MAAE;MACb,QAAA;MACA,QAAA;;UAEC,CAAA,QAAA,QAAA,QAAA,IAAA,MAAA,QAAA,IAAA;MACH,eAAOA,SAAA,MAAA;MACL,eAAQA,SAAQ,MAAA;MAChBA,SAAM,KAAA;;WAEN;MACH,QAAA;MAEa;MACZ;;;WAGG;WACD;aACE,OAAU,SAAC;AACZ,cAAA,KAAA,gBAAA,IAAA;MACD;MACH,WAAA,OAAA,MAAA,YAAA;AAEgB,cAAA,KAAA,iBAAA,MAAA,OAAA;MACf;;;;;kBAKS,OAAO,YAAM;cAChBA,WAAQ,MAAM,KAAA,QAAA,KAAA,CAAA,WAAA,MAAA,OAAA,GAAA;UACd,MAAM;UACL,SAAA,KAAA,MAAA,SAAA;UACH,KAAO,KAAM,MAAE;UACb,QAAA;UACA,QAAA;;cAEC,CAAA,QAAA,QAAA,QAAA,IAAA,MAAA,QAAA,IAAA;UACH,eAAiBA,SAAU,MAAM;UAClC,eAAAA,SAAA,MAAA;UACOA,SAAO,KAAc;QAC7B,CAAA;AACE,eAAM,EAAA,QAAK,UAAgB,QAAO,OAAQ;MAC5C;MACA,UAAO,OAAO,SAAgB,MAAA,KAAA,gBAAA,IAAA;iBACtB,OAAK,MAAA,YAAqB;AACjC,cAAA,KAAA,iBAAA,MAAA,OAAA;MACD;MACH,OAAA,OAAA,SAAA;AAEa,cAAA,KAAiB,gBAAiB,IAAA;MAC9C;;;yBAGU,SAAQ;UAChBA,WAAQ,MAAM,KAAA,QAAA,KAAA,SAAA;MACb,MAAA;MACH,SAAY,KAAG,MAAM,SAAA;MACrB,QAAM;MACF,QAAQ;;AAIZ,UAAC,SAAA,MAAA,eAAAA,SAAA,MAAA;AACF,UAAA,WAAA,MAAAA,SAAA,KAAA;AACF,QAAA,aAAA,GAAA;AAED,YAAA,IAAA,UAAA,iCAAA,QAAA,KAAA,GAAA,CAAA,MAAA,UAAA,QAAA,QAAA,EAAA,EAAA;;;;IAaS,2BAAkB;EACzB,YAAC;EAED;cAIQ,UAAU,CAAG,GAAA;AAInB,SAAA,UAAA;;QAEA,OAAM,MAAA,iBAAkB;AAIxB,UAAA,aAAgB,iCAAiB,MAAA,eAAA;AACjC,kCAAoB,sBAA+B,WAAK,QAAA;AACxD,UAAA,WAAA,WAAA;AAKA,UAAA,kBAAA,eACE,KAAQ,SACR,WAAgB,OAAA;AAElB,oBAAA,eAAA;AAKA,UAAA,cAAa,gBACX,eACA;2CAC4B,sBAAA,UAAA,+BAAA;uCAEjB,UAAA,gBAAA,2BAAA;8CACiB,UAAkB,gBAAA,OAAA;WAC5C,MAAM,gBAAQ,iBAA4B;MAC1C,YAAM,KAAA;mBAEG;YACP,cAAc,MAAA,gBAAuB;YACrC,QAAA,4BAAoB,aAAA,eAAA;YACpB,uBAAA,gBAAA,wBAAA;YACE,MAAM,sBAAe;qBACd,CAAA,gBAAA;;iBAGL,eAAkB;QAClB;QACA,SAAC,gBAAA;QACD,aAAc,gBAAM;QAIpB,iBAAa,CAAA,gBAAA;MACf,CAAA,IAEA,CAAA;AACJ,YAAI,cAAgB,MAAA,uBAAU,UAAA,gBAAA,GAAA;YAC5B,aAAU,2BACR,eACA;AAQJ,UAAC;;UACC,gBAAe,SAAS;AAIxB,kBAAU,MAAC,kBAAkB,sBAAA,SAAA,4BAAA,YAAA,MAAA,4BAAA,OAAA,gBAAA,OAAA,CAAA;aAE7B;cACE,EAAA,OAAK,SAAA,SAAA,IAAA,MAAA,kBAAA,OAAA,eAAA;mBACL,UAAQ;mBACR,WAAiB;4BAChB,MAAA,kCAAA;UACH;UACE;UACA,mBAAgB,gBAAA;;cAEhB,eAAW;mBACL,SAAS;eACZ;UACH,GAAI,cAAO,EAAA,SAAgB,CAAA,SAAA,UAAkB,EAAA,IAAQ,CAAA;aACnD,OAAI,gBAAe,cAAgB,WACjC,EAAE,WAAC,gBAAA,UAAA,IACH,CAAA;UACJ,GAAI,OAAA,gBAAgB,kBAAY,WAC5B,EAAE,eAAc,gBAAiB,cAAa,IAC9C,CAAA;UACJ,GAAI,OAAA,gBAAsB,QAAA,WAC1B,EAAA,KAAA,gBAAA,IAAA,IACQ,CAAA;UAaX,GAAA,OAAA,gBAAA,cAAA,WAEK,EAAA,WAAyC,gBAAA,UAAA,IACrC,CAAA;UACR,GAAA,gBAAmB,MAAS,EAAA,KAAA,gBAAA,IAAA,IAAA,CAAA;UAC5B,GAAA,gBAAc,eACL,EAAA,gBAAgB,gBAAO,aAAA,IACvB,CAAA;UACT,GAAQ,oBAAa,EAAQ,kBAAA,IAAA,CAAA;QAC7B;AACA,kBAAA,MAAA,oBAAoB,kBAAA,sBAAA,SAAA,kBAAA,YAAA,MAAA,MAAA,UAAA,OAAA,KAAA,OAAA,YAAA,GAAA,EAAA,SAAA,gBAAA,QAAA,CAAA,GAAA,gBAAA,uBAAA,qCAAA,iCAAA;;YAGpB,eAAA;QAEA;QACA,WAAW,QAAA;QACX,aAAa,CAAA,gBAAiB;QAC9B,SAAK,gBAAmB;QACxB,SAAA,WAAA;QACA,UAAA,WAAkB;QAClB,uBAAU,gBAAwB;QAClC;QACA,6BACE,gBAAgB;QAClB,oCAAW,gBAAA;QACX;QACF,WAAa,gBAAO;QAClB,eAAK,gBAAA;QACL,KAAG,gBAAA;QACH,WAAO,gBAAA;QACP,KAAA,gBAAc;QACd,wBAAmB,gBAAA;QACnB,kBAAiB,gBAAA;QACjB,UAAA,gBAAmB;QACnB,qBAAe,gBAAW;QAC1B,6BAA2B,gBACnB;;;sBAGJ,IAAA,oBAAmB;;QAEtB;QAEC;QACF,aAAa,CAAC,gBACZ;QAEH,OAAA;QAAC;QACA,mBAAmB,WAAW;uBACjB,WAAC;QACd,2BAAC,YAAA,MAAA,kCAAA;UACD;UACD,UAAA,aAAA;UACM,mBAAQ,gBAAA;QAEjB,CAAA;MACH,CAAA;AAEK,UAAA;AAGG,cAAA,QAAA,cAAA,iCAA0C,QAAA,CAAA;MAClD,SAED,OAAA;AACS,YAAK,gBAAC,SAAA;AACd,gBAAA;QAEK;AAGE,cAAA,kCAAkB,SAAA,SACtB,KAAK;MAGP;AACE,aAAG;;;8BAGiB,OAAO;WAC3B,mCAAmC,KAAA;;gCAGhC;;;gCAMH,OAAA;UAIA,YAAW,MAAA,yCAAsC,OAAA,KAAA,QAAA,GAAA;WACjD;MACA,GAAG;MACH,GAAA;MAGA,aAAA,MAAkB,gBAAA,QAAwB,QAAE;MAC5C,SAAQ,WAAE,OAAA,SAA0B;MACpC,SAAA,mBAA2B,OAAE,SAAA;MAI7B,UAAA,WAAqB,OAAA,YAAmB,uBAAO;MAC/C,sBACS,MAAM,wBACf;MACH,6BAAA,mBAAA,OAAA,6BAAA;MAEK,oCAAsC,mBAAA,OAAA,oCAAA;MAC1C,WAAA,mBAAA,OAAyC,WAAO;MAC5C,eAAO,mBAAY,OAAA,eAAA;MACrB,KAAA,mBACE,OAAA,KAAA;MAEH,WAAA,mBAAA,OAAA,WAAA;MACD,KAAM,mBAAkB,OAAU,KAAA;MAElC,wBAA0B,wBAAkB,MAAA,sBAAA;MAC5C,kBAAc,mBAA2B,OAAC,kBAAa;MACrD,UAAQ,mBAAO,OAAA,UAAA;MACf,6BAAsB,mBAAA,OAAA,6BAAA;MACtB,qBAAoB,mBAAA,OAAA,qBAAA;mBAChB,OAAA,MAAmB,gBAAa,YAAQ,MAAA,cAAA;;;eAG5C,OAAA;6CAC4B,KAAA;QAC5B,CAAA,MAAA,WAAA;AACA,YAAA,IAAA,UAAA,sDACQ;;UAER,YAAa,MAAO;UACpB,cAAc,MAAA,gBAAA;UACd,QAAA,4BAAoB,aAAsB;MAC1C,GAAA,KAAA;MACA,SAAQ,MAAO;MACf,OAAA,MAAA,UAEA,mBAAmB,OAAW,MAAA,OAAA,IAC7B;MACH,UAAa,MAAG;MAOhB,uBAA0B,MAAA;MAC1B,sBAAY,MAAA;MACV,6BAAW,MAAA;MACX,oCAA4B,MAAA;MAC5B,WAAA,MAAA;MACA,eAAQ,MAAA;WACJ,MAAK;iBACE,MAAE;WACT,MAAA;oBACA,MAAe;mBACf,MAAA,oBAAA,KAAA,QAAA;MACJ,UAAK,MAAA,YAAA,KAAA,QAAA;MACP,qBAAuB,MAAA,uBACrB,KAAA,QACA;MAKE,aAAa,MAAM;;AAIvB,UAAC,UAAA,MAAA,kBAAA,sBAAA,SAAA,kBAAA,YAAA,MAAA,MAAA,UAAA,OAAA,SAAA,GAAA,EAAA,UAAA,CAAA;AAED,UAAA,cAAW,MAAA,gBAAoB;UAC7B,MAAK,sBAAA;MACL;MACA,sBAAG,MAAA;SAEH,MAAA,eAAW;MACX;MAEI,SAAK,MAAA;MACL,aAAU,MAAM;MAChB,iBAAiB;SAGjB,CAAA;UACJ,WAAa,MAAM,kBAAS,sBAAa,SAAA,gBAAA,YAAA,MAAA,QAAA,KAAA,GAAA,EAAA,UAAA,CAAA;QACxC,aAAA,MAAA;AACJ,YAAA,IAAA,UAAA,iBAAA,MAAA,SAAA,wBAAA;IACF;AAEI,WAAU,IAAA,oBAAe;MACvB;MACH;MACD;MAAQ;MACP;MAGD,2BAAA,YAAA,MAAA,kCAAA;QACF;QAEc,UAAA,MAAe;QAMrB,mBACL,MAAA,+BAKI,KAAiB,QAAK;MAClB,CAAA;MAEN,eAAc,KAAO,QACvB;IACH,CAAA;EAED;;AAOA,eAAC,kBAAA;AAED,MAAA;AACE,WAAO,iBAAA,MAAA,OAAA,OAAA,CAAA;WAEL,OAAA;AACH,UAAA,IAAA,UAAA,yHAAA,MAAA,OAAA,EAAA;EAED;;eAKQ,eAAa,MAAY;SAC1B,MAAC,kBAAoB,sBAAwB,SAAQ,eAAA,YAAA,MAAA,KAAA,MAAA,KAAA,SAAA,KAAA,SAAA;IACxD,iBAAY,KAAA;IACZ,GAAI,KAAA,cAAmB,EAAE,aAAG,KAAa,YAAQ,IAAA,CAAW;MAC5D,EAAA,SAAW,KAAC,QAAW,CAAE;;SAEvB,sBAAQ,MAAmB;SAC7B,KAAM,eAAA,KAAA,yBAAqC;;SAG5C,iBAAA,OAAA;AACD,SAAO;IACR,aAAA,MAAA;EAED;;SASM,4BAA4B,aAAA,SAAA;QAC9B,EAAA,aAAAM,aAAc,IAAA;QACd,SAAO,IAAAA,aAAA;OACL,QAAK,UAAA,EAAA,SAAA,QAAA,QAAA,IAAA,CAAA;OACL,QAAO,cAAe,EAAA,aAAM,QAAA,YAAA,IAAA,CAAA;OAC5B,QAAQ,cAAU,EAAA,aAAY,QAAA,YAAuB,IAAA,CAAA;OACrD,QAAA,WAAA,EAAA,UAAA,QAAA,SAAA,IAAA,CAAA;EACJ,CAAC;AACD,MAAI,QAAQ,wBAAiB,UAAA,OAAA,qBAAA;AAC3B,UAAM,8BAAmC,OAAA,oBAAA,KAAA,MAAA;AACzC,WAAM,sBAAqB,CAAA,YAAM,4BAAA,WAAA,QAAA,mBAAA;;;;eAU/B,kBAAK,OAAA,SAAA;mBACE,8BAAA,OAAA;eACP,SAAU,SAAQ;UAClBC,SAAA,SAAA;AACH,WAAA;MACK,OAAAA;MACA,SAAQ,aAAMA,MAAA;MAOb,UAAA,QAAA,YAAA;IACL;;MAEA,SAAQ,SAAA,MAAA;AACR,UAAA,UAAA,SAAA;AACH,UAAAA,SAAA,MAAA,OAAA,SAEQ,MAAA,kBACP,sBAA8D,SAAA,iBAAA,YAAA,MAAA,MAAA,OAAA,OAAA,OAAA,GAAA,EAAA,QAAA,CAAA,IAKxD,EAAA,QAAW;AACb,WAAA;MACF,OAAAA;MACE;MACA,UAAU,QAAQ,YAAY;;EAElC;AACA,QAAI,WAAa,SAAS;QACxB,QAAO,MAAA,kBAAA,sBAAA,SAAA,iBAAA,YAAA,MAAA,OAAA,aAAA,QAAA,GAAA,EAAA,SAAA,CAAA;;;aAGL,aAAA,KAAA;IACH;EACD;;SAEE,2BAAA,SAAA;AACH,QAAA,WAAA,8BAAA,OAAA;AAED,MAAA,SAAS,SAAA,SAAA;AAGP,WACE;MACA,SAAA,aAA0B,SAAS,KAAA;MAEtC,UAAA,QAAA,YAAA;IAEI;EAIH;MACE,SAAO,SAAS,MAA0B;AAC3C,WAAA;MACM,SAAM,SAAA;MAOd,UAAA,QAAA,YAAA;IAED;EACE;AACD,SAAA;IAEI,UAAU,SAAA;EAKb;;SAEG,8BAAsB,SAAA;AACzB,SAAI,QAAY,SACd,mBAAiB,QAAA,QAAA,YAAA,uBAAA;;eAGb,4BAAkE,OAAA,UAAA;AACxE,MAAA,SAAa,SAAO,WAAW;AAC7B,WAAM,SAAS;;eAGX,kBAAK,sBAAiB,SAAA,mBAAA,YAAA,MAAA,MAAA,UAAA,OAAA,SAAA,KAAA,GAAA,EAAA,WAAA,SAAA,MAAA,CAAA;;SAKzB,aAAE,OAAA;SACH,MAAM,WAAc,MAAA;;iDAEc,MAAA;uBACzB,KAAA,sBACG,SACN,CAAA,EAAA,MAAO,MAAO,6BAAsB,KAAA,CAAA;mBAClC,WAAU,GAAA;;;QAGhB,oBAAA,CAAA;aACF,EAAA,OAAA,UAAkB,KAAa,cAAW;AAI3C,UAAA,SAAA,iCAAA,OAAA;MACM,YAAA,mBAAkB,MAAA,eAAA,YAAA,KAC1B,KAAA;MAEI,uBAAU,mBAEb,MAAmC,eAAA,uBAAA;IAE/B,CAAC;AACH,UAAA,cAAU;MACX,GAAA,OAAA,oBACK,EAAU,mBAAU,OAAW,kBAAA,IACvB,CAAA;MACZ,GAAO,OAAA,YAAA,EAAA,WAAA,OAAA,UAAA,IAAA,CAAA;MACL,GAAA,OAAQ,OAAM,aAAiB,YAMzB,EAAI,UAAO,OAAA,SAAA;eAEP,4BAAG,KAAA,OAAA,MAAA;;sBAGC,SAAS,IAAA,KAAA,MAAU,kBAAA,OAAA,OAAA,YAAA,WAAA;;;;eAKpC,4BAAA,OAAA,QAAA;AACD,MAAA,CAAA,OAAO,cAAA,CAAA,OAAA,aAAA;AACL,WAAM,CAAE;;AAQX,QAAA,aAAA,OAAA;AAED,MAAA,YAAS;AAIP,WAAW;MACT,QAAA,MAAA,kBAAoC,sBAAa,SAAkB,+BAAC,YAAA,MAAA,MAAA,QAAA,SAAA,YAAA;QACrE,GAAA,OAAA,wBACF,EAAA,aAAA,OAAA,sBAAA,IAEQ,CAAA;MAKF,CAAA,GAAA;QACG,YAAI,OAAA;QAGN;MACA,CAAA;;;;YAKF,MAAA,kBAAA,sBAAA,SAAA,8BAAA,YAAA,MAAA,MAAA,QAAA,WAAA,OAAA,eAAA,CAAA,CAAA,GAAA,EAAA,YAAA,OAAA,WAAA,CAAA;EACJ;;SAEE,mCAC0B,UAAC,mBAA4B;aACrD,EAAA,OAAA,UAAiB,KAAA,SAAA,aAAA,GAAA;AACnB,mCAAuB,OAAA,WACf,iBACN;;AAGN;AAEA,SAAS,+BAAA,OAAA,WAAiD,mBACtC;AAElB,MAAA,CAAA,6BAAmB,KAAA,GAAA;AACf,UAAA,IAAU,+BAAgB,iFAAA;MAC5B,UAAO;MACR,SAAA;MAEK,MAAI;MAGN,WAAU,MAAO;MACjB,cAAS,MAAA,eAA0B;IACnC,CAAA;;mCAGF,OAAA;IACH,YAAA,mBAAA,MAAA,eAAA,YAAA,KAEQ;IAGP,uBAAa,mBAAiC,MAAC,eAAA,uBAAA;EAC/C,CAAA;;SAGK,kDAA0C,UAAW;QACrD,aACE,yCAA8C,QAAE;AAGxD,MAAA,WAAA,WAAA,GAAA;AAED;EAIE;QACE,IAAG,+BAA+B,wGAA0B;IAC5D,UAAG;IAIF,SAAA;IACC,MAAA,SAAW;IACb;EACF,CAAC;;AAEH,SAAC,yCAAA,UAAA;AAED,QAAS,OAAA,mBAAA,SAAA,IACP;AAIA,SAAM,cAAa,SACjB,aAAG,EACH,IAAG,CAAA,EAAA,UAAA,MAAA,mBAAA,SACD,CAAA,EAGD,OAAA,CAAA,cAAA,4BAAA,MAAA,SAAA,MAAA,IAAA,CAAA,EAAA,KAAA,CAAA,MAAA,UAAA,KAAA,cAAA,KAAA,CAAA;;SAED,yCAAO,UAAA,iBAAA;AACT,QAAC,aAAA,cAAA;IACD,GAAA,SAAA,aAAA,EAA+B,IAAC,CAAA,EAAA,UAAY,MAAA,SAAA;IAC7C,GAAA,gDAAA,iBAAA,+BAAA,QAAA,CAAA;EAED,CAAA;AACE,MAAA,WAAW,WAAS,GAAA;AACrB;EAED;AAKE,kCAAoB,UAAA;;AAEtB,SAAC,sCAAA,OAAA,MAAA,iBAAA;AAED,QAAS,aAAA,cAAA;IAIH,GAAA,4BAA+B,OAAA,IAAW;IAC5C,GAAA,gDAA6C,iBAAA,uBAAA,OAAA,MAAA,gBAAA,IAAA,CAAA;EAC/C,CAAC;AACD,MAAA,WAAe,WAAA,GAAA;AACf;;AAOA,kCAAC,UAAA;;AAEH,SAAC,+BAAA,UAAA;AAED,SAAS,CAAA,GAAA,SAAA,YAA2B,CAAC,EAAA,IAAY,CAAE,EAAA,YAAY,MAAA,WAAA;;SAE3D,uBAAuB,OAAQ,MAAE,MAAA;AACnC,QAAC,cAAA,2BAAA,MAAA,IAAA;AACD,SAAI,mCAA+B,OAAW,WAAA;;SAE7C,mCAAA,OAAA,MAAA;AACD,MAAA,MAAM,SAAuB,SAAG,CAAA,MAAA,UAAA;AAChC,WAAW,CAAC,8BAA0B,IAAO,CAAA;;AAO7C,QAAC,QAAA,CAAA,8BAAA,IAAA,CAAA;AACD,aAAO,CAAA,WAAW,UAAA,KAAA,OAAA,QAAA,MAAA,QAAA,GAAA;AACnB,UAAA,KAAA,GAAA,mCAAA,YAAA,UAAA,KAAA,MAAA,SAAA,CAAA,CAAA;EAED;AAIE,SAAI;;SAEH,4BAAA,OAAA,MAAA;AACD,MAAA,QAAM,KAAA,GAAA;AACN,WAAM,CAAA,MAAU,aAAgB,IAAA;EAChC;MACE,MAAM,SAAA,SAAe,CAAA,MAAA,UAAA;WACnB,CAAA;;QAKA,aAAY,CAAkB;aAE9B,CAAA,WAAa,UAAM,KAAW,OAC5B,QAAA,MAAgB,QAAM,GAAI;eAK5B,KAAW,GAAI,4BAAmB,YAAA,UAAA,KAAA,MAAA,SAAA,CAAA,CAAA;;AAEtC,SAAC;;AAEH,SAAC,gDAAA,iBAAA,OAAA;AAED,MAAA,MAAS,WAAA,GAAA;AAIP,WAAO,CAAA;EAIR;AAED,QAAS,kBAAA,MAAA,IAA6B,6BAA2B;AAC/D,QAAM,aAAA,CAAc;AACpB,aAAM,UAAe,gBAAG,aAAA,GAA6B;AACjD,UAAA,eAAqB;MACvB,OAAW;MACZ,wCAAA,iBAAA,OAAA,SAAA;IACD,EAAA,OACE,CAAA,SAAc,SAAK,IAAA;AACnB,QAAA,aAAe,KAAA,CAAA,gBAAc,gBAAmB,KAAA,CAAA,SAAA,6BAAA,MAAA,WAAA,CAAA,CAAA,GAAA;AAChD,iBAAe,KAAC,OAAW,SAAG;IAEjC;EAED;AACE,SAAM;;AAER,SAAC,wCAAA,UAAA,WAAA;AAED,SAAS,4BAA8B,mBAAA,SAAA,IAAA,GAAA,mBAAA,SAAA,CAAA;;AAEvC,SAAC,6BAAA,MAAA,OAAA;AAED,QAAS,iBAAA,8BAAoD,IAAA;AAC3D,QAAM,kBAAI,8BACR,KAAA;MAEE,mBAAiB,MAAA,oBAAA,IAAA;AACjB,WAAO;;SAGT,mBAAA,mBACH,eAAA,WAAA,GAAA,eAAA,GAAA,KAED,gBAAS,WAAA,GAAA,cACP,GAAA;;SAIE,8BAAO,MAAA;AACT,QAAC,aAAA,mBAAA,IAAA;AAED,SAAM,eAAe,MAAA,KAAS;;SAE5B,cAAO,QAAA;AACT,SAAC,CAAA,GAAA,IAAA,IAAA,MAAA,CAAA;;SAKG,gCAAiB,YAAA;QACjB,IAAA,+BAA0B,uEAAA;IAC1B,UAAU;IAEZ,SAAA;IACH;EAED,CAAA;;SAKI,0CAAwC,UAAa,SAAA;MACrD,CAAA,SAAO;AACP;;QAEA,eAAA,SACE,aAAW;MACb,aAAA,WACE,GAAA;AACF;;QAGA,IAAA,+BACE,mFAA6C;cAC7C;IACF,SAAK;gBACC,aAAgB,IAAG,CAAA,EAAA,UAAA,MAAA,SAAA;;;SAGzB,eAAW,UAAW,WAAa;SACnC;IACA,SAAK,WAAc,WAAY,SAAI,WAAA;IACnC,OAAA,WAAc,SAAW,SAAA;IACzB,SAAA,WAAa,WAAW,SAAe;IACvC,UAAU,WAAW,YAAY,SAAS;IAC1C,uBAAoB,WAAW,yBAAgB,SAAA;IAC/C,sBAAsB,WAAE,wBAAwB,SAAW,wBAAA;IAC3D,6BACE,WAAW,+BACb,SAAA;wCAEW,WAA2B,sCACtC,SAAa;IACb,KAAA;MACH,GAAA,SAAA,OAAA,CAAA;MAEQ,GAAA,WAAgB,OAAkC,CAAA;IACrD;IACF,WAAU,WAAU,aAAA,SAAA;IACrB,eAAA,WAAA,iBAAA,SAAA;IAED,KAAM,WAAA,OAAoB,SAAU;IAElC,WAAS,WAAA,aAAuB,SAAA;IAIhC,KAAA,WAAU,OAAA,SAAA;kBAGI,WAAO,gBAAA,SAAA;iBACR,WAAA,eAAsB,SAAA;cAEjC,WAAA,YAAA,SAAA;IACH,SAAA,WAAA,WAAA,SAAA;IAGC,aAAQ,WAAA,eAA2B,SAAK;IACxC,qBAAQ,WAAA,uBACP,SAAA;IACD,6BAAU,WAA8B,+BAGpC,SAAQ;iBACC,WAAA,eAAA,SAA6B,eAAA;;;SAKxC,gBAAgB,SAAA;MAClB,CAAA,QAAA,WAAA,QAA2B,QAAQ,KAAM,EAAC,WAAA,GAAA;AAC3C,UAAA,IAAA,UAAA,kDAAA;EACD;QACE,uBAAA,QAA6B,wBAAiB;AAChD,MAAC,CAAA,CAAA,OAAA,uBAAA,oBAAA,EAAA,SAAA,oBAAA,GAAA;AACD,UAAK,IAAO,+BAAgB,0GAAA;MACzB,UAAA;MACA,SAAA;IACD,CAAA;;cAEE,gCAAQ,kBACT,4BAAA,KAAA,MAAA,IAAA;AACD,UAAC,IAAA,+BAA+B,iEAAA;MAC/B,UAAA;MACU,SAAA;IACX,CAAA;;cAIE,OAAU;AAGZ,+BAAC,QAAA,KAAA;EACH;AACD,MAAA,QAAA,SAAA;AAED,iCAAoC,QAA4B,OAAA;EAC9D;aACO,CAAA,MAAS,KAAK,KAAI;8BAEnB,QAAA,qBAAA;IAEJ,CAAC,+BAAA,QAAA,2BAAA;IACD;MACD;MAEE,QAAS;IACV;IAEA,CAAA,aAAU,QACR,SAAA;IAEH,CAAA,iBAAA,QAAA,aAAA;IACF,CAAA,OAAA,QAAA,GAAA;IAED,CAAS,aAAA,QAAA,SAA6B;EACpC,GAAA;AACE,QAAI,UAAU,WACZ,OAAM,UAAI,YACR,CAAA,OAAA,SAAA,KAAA,KAAA,SAAA,IAAA;AAEH,YAAA,IAAA,UAAA,sBAAA,IAAA,6BAAA;IACD;EACF;;SAGG,2BAA0B,UAAQ;MAEnC,SAAM,SAAI,SACR;AAEH,QAAA,CAAA,SAAA,SAAA,OAAA,SAAA,UAAA,UAAA;AACF,YAAA,IAAA,UAAA,kEAAA;IAED;AAGM;;AAEJ,OAAC,SAAA,SAAA,QAAA,SAAA,SAAA,WACD,OAAO,SAAS,UAAY,YAAS,SAAW,MAAS,KAAG,EAAA,WAAA,IAAA;AAC7D,UAAA,IAAA,UAAA,sEAAA;EAED;;SAEE,6BAAiC,UAAS;AAC1C,MAAA,SAAa,SAAQ,WAAY;AACjC,QAAQ,CAAA,SAAS,SAAQ,OAAS,SAAC,UAAA,UAAA;AACpC,YAAA,IAAA,UAAA,sEAAA;IAED;AAGE;;MAEE,SAAQ,SAAE,SACV,OAAQ,SAAE,UAAA,YAAA,SAAA,MAAA,KAAA,EAAA,WAAA,IAAA;AACV,UAAA,IAAA,UAAoB,sEAAC;;;SAGrB,0BAAc,UAAA;MACd,OAAA,aAAoB,UAAU;AAC9B,WAAA,YAAA;EAEF;SACE,SAAA,YAAA,SAA0B,WAAe,SAAO;;SAElD,kBAAmB,MAAA;QACjB,YAAA,KAAA,SAA0B;AAC5B,QAAG,QAAA,KAAA,QAAA,KAAA,SAAA,OAAA;AACH,QAAA,OAAa,QAAC,QAAe;SAC3B,CAAA,WAAc,MAAA,KAAY,GAAA;;SAG5B,oBAAyBP,UAAS;QAChC,gBAAK;;YAEH;IACF,QAAC;IAAC,oBAAe;wBACD;UACd;IACF,UAAC;iBAAU,QAAA,QAAA;YACT;;AAEJ,MAAI;AAEJ,gBAAO,iBAAc,IAAA,QAAA,CAAAQ,aAAA;AACtB,oBAAAA;EAED,CAAA;AAOE,QAAM,SAAS,CAAA;AACf,QAAM,gBAAgB,CAAA,UAAM;AAC1B,WAAK,KAAA,KAAA;kBACI,SAAO;kBACN,YAAQ,OAAU,WAAY,+BAE3B,CAAA,GAAA,MAAA,GAAA,mCAAA;kBACR;;qBAEC,oBAAeR,SAAA,QAAA,CAAA,UAAA;8BAChB,eAAA,OAAA,QAAA;;QAEJ,aAAA,oBAAAA,SAAA,QAAA,CAAA,UAAA;8BAAU,eAAA,OAAA,QAAA;;AAIb,QAAA,aAAO,WAAA,QAAA,MAAA,aAAA;QACL,aAAO,WAAA,QAAA,MAAA,aAAA;gBACC,kBAAW,YAAA;UACjB,QAAM,WAAe,CAAC,WAAW,OAAK,GAAA,WAAA,OAAA,CAAA,CAAA;;gBAEvC,eAAA,YAAA;AACD,QAAA;AACH,oBAAA,WAAA,MAAAA,SAAA,KAAA;IAED,SACM,OAAc;AAChB,oBAAa,KAAA;IACb;AACD,UAAA,QAAA,IAAA,CAAA,YAAA,UAAA,CAAA;AACF,kBAAA,OAAA;EAED,GAAA;AACE,SAAM;;AAER,SAAC,oBAAA,QAAA,SAAA;AAED,QAAK,SAAU,OAAA,UACiB;AAG9B,QAAM,WAAA,YAAoB;AAC3B,QAAA;AAEI,aAAU,MAAA;AACF,cAAG,EAAA,MAAA,MAAA,IAAA,MAAA,OAAA,KAAA;AACR,YAAA,MAAe;AACX;QACP;AACS,YAAA,OAAA,UAAA,UAAA;AACb,kBAAA,KAAA;QAEc;MAIT;IACA,UACF;AACE,aAAA,YAAc;;;;;YAKb,YAAA;AACJ,YAAA,OAAA,OAAA,EAAA,MAAA,MAAA;MAAA,CAAA;AAAS,YAAC,QAAA,MAAA,MAAA;MAAA,CAAA;IACT;;;SAGD,0BAAA,eAAA;AACD,MAAI,cAAc,cAAY;AAC5B,iBAAM,cAAc,YAAmB;AACvC,kBAAU,eAAA;;;oBAKC,OAAA;QAEV,aAAC;AACJ,aAAC,QAAA;AACH;AAEA,eAAS,eAAkB,QAAc,SAAA;AACvC,QAAA,oBAAO,QAA2B,OAAC,EAAA;AACrC;AAEA,eAAS,eAAkB,QAAA;AACzB,MAAA,OAAO;QACL,eAAA,QACE,CAAA,UAAA;AAGF,YAAA;GAID;SACE;;eAEK,wBAAM,eAAA,WAAA;AACf,MAAA;AAED,MAAA;AACE,UAAM,QAAS,KAAA;MACf,cAAoB;MACpB,cAAoB;MACpB,IAAA,QAAc,CAAAQ,aAAkB;AAChC,kBAAc,WAAkBA,UAAK,SAAA;AAC9B,mBAAO,OAAA;MACf,CAAA;IAID,CAAS;EAKP;AAEC,QAAA,SAAA;AAEG,mBAAW,OAAW;IACxB;;MAMA,cAAc,QAAA;AACd,UAAA,cAAO,kBAAA;AACR,UAAA,OAAA,OAAA,IAAA,qBAAA,6DAAA;MAEK,UAAS;MAKf,WAAc;MACd,OAAc,kBAAkB,cAAU,SAAa;IACxD,CAAA,GAAA,EAAA,OAAA,cAAA,UAAA,CAAA;EAED;;SAMM,kBAAc,OAAA;SAChB,qBAAO,KAAA;;2BAEO,eAAA;SACZ;IACH,wBAAA,cAAA,QAAA,cAAA,kBAAA;IAED,wBACE,cAAe,QAAU,cAAG,kBAAA;EAC9B,EACE,OAAO,CAAA,UAAA,MAAA,KAAA,EAAA,SAAA,CAAA,MACL,CAAA,UAAQ,MAAM,QAAO,CAAA,OACrB,IAAA;;SAEH,qBAAA,eAAA;AAED,QAAM,SAAA,kBAAsB,aAAA;AAC5B,gBAAO,SAAA;gBACG,SAAO;gBACf,qBAA8B;gBAC9B,qBAAA;AACH,SAAA;AAED;SACM,0BAAqB,eAAA,OAAA,QAAA;MACvB,MAAA,WAAc,GAAA;AACf;EAED;AACD,MAAA,WAAA,UAAA;AAEI,UAAA,SAAU,oBACM,cACnB,QACA,cACA,oBAAkD,KAAA;AAE9C,kBAAO,SAAc,OAAK;AAC5B,kBAAa,qBAAQ,OAAA;AACtB;EACD;AAMD,QAAA,SAAA,oBAAA,cAAA,QAAA,cAAA,oBAAA,KAAA;AAED,gBAAe,SAAA,OAAA;AAMb,gBAAW,qBAAwB,OAAC;;SAEnC,oBAAA,QAAA,cAAA,OAAA;AAED,QAAI,aAAe,OAAC,SAAA,MAAA;AACpB,MAAI,cAAqD,iCAAA;AACrD,WAAC;MACH,QAAO,SAAc;MACnB;;;2BAKqB,eAAA,aAAA;sBACV,iCAAQ;;MAEjB,QACD,MAAA,MAAA,CAAA,+BAAA;MACD,cAAiB;;;8BAGJ,kCAAA,MAAA;;mBAET,MAAO,CAAA,mBAAA,IAAA;;;;iCAIE,QAAS,cAAC;uBACnB,GAAO;;;SAGV,OAAA,YAAA;EAAA,MAAA;;eACM,oBAAA,SAAA,gBAAA,SAAA,eAAA;MACT,OAAI,mBAAY,UAAA;WACd,MAAA;;AAEJ,SAAC,MAAA,sBAAA,SAAA,iBAAA,KAAA,SAAA,aAAA;AACH;AAEA,eAAe,sBAAA,SAAA,WACY,SAAA,eAAA;AAEzB,MAAA,OAAM,cAAmB,UAAU;AACpC,WAAA,MAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AEp9ED,SAAS,wCAAwC;AAEjD;AAAA,EACE;AAAA,OAEK;;;ACXP,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,qBAAAC,0BAAyB;;;ACiBlC,IAAM,iBAAiB,oBAAI,IAAI,CAAC,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC;AAChD,IAAM,kBAAkB,oBAAI,IAAI;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,kBAAkB,oBAAI,IAAI,CAAC,OAAO,aAAa,sBAAsB,mBAAmB,CAAC;AAC/F,IAAM,YAAY;AASlB,IAAM,0BAA0B,OAAO,yBAAyB;AAEhE,SAAS,SAAS,QAAgB,KAAsB;AACtD,MAAI;AACF,UAAM,aAAa,OAAO,yBAAyB,QAAQ,GAAG;AAC9D,WAAO,aACH,WAAW,aACT,WAAW,QACX,0BACF;AAAA,EACN,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,eAAe,OAA8B;AACpD,QAAM,MAAoB,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,GAAG,UAAU,CAAC,GAAG,YAAY,MAAM;AACpF,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,OAAO,CAAC,QAAgB,QAAyB;AACrD,UAAM,SAAS,SAAS,QAAQ,GAAG;AACnC,QAAI,WAAW,wBAAyB,QAAO;AAC/C,QAAI,aAAa;AACjB,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,CAAC,SAAkB,UAAwB;AACvD,QAAI,YAAY,QAAQ,YAAY,OAAW;AAC/C,QAAI,QAAQ,KAAK,KAAK,QAAQ,IAAI;AAChC,UAAI,aAAa;AACjB;AAAA,IACF;AACA,QAAI,OAAO,YAAY,UAAU;AAC/B,UAAI,QAAQ,UAAU,IAAK,KAAI,SAAS,KAAK,OAAO;AACpD;AAAA,IACF;AACA,QAAI,OAAO,YAAY,YAAY,KAAK,IAAI,OAAO,EAAG;AACtD,SAAK,IAAI,OAAO;AAChB,eAAW,OAAO;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,GAAG;AACD,YAAM,SAAS,KAAK,SAAS,GAAG;AAChC,UAAI,OAAO,WAAW,YAAY,OAAO,SAAS,MAAM,EAAG,KAAI,QAAQ,KAAK,MAAM;AAClF,UAAI,OAAO,WAAW,UAAU;AAC9B,cAAM,OAAO,OAAO,KAAK,EAAE,YAAY;AACvC,YAAI,UAAU,KAAK,IAAI,EAAG,KAAI,MAAM,KAAK,IAAI;AAAA,MAC/C;AAAA,IACF;AACA,eAAW,OAAO,CAAC,QAAQ,WAAW,WAAW,OAAO,GAAG;AACzD,YAAM,SAAS,KAAK,SAAS,GAAG;AAChC,UAAI,OAAO,WAAW,YAAY,OAAO,UAAU,IAAK,KAAI,SAAS,KAAK,MAAM;AAAA,UAC3E,OAAM,QAAQ,QAAQ,CAAC;AAAA,IAC9B;AACA,UAAM,KAAK,SAAS,UAAU,GAAG,QAAQ,CAAC;AAC1C,UAAM,KAAK,SAAS,OAAO,GAAG,QAAQ,CAAC;AACvC,UAAM,SAAS,KAAK,SAAS,QAAQ;AACrC,QAAI,WAAW,QAAW;AACxB,UAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,CAAC,OAAO,UAAU,OAAO,SAAS,GAAI,KAAI,aAAa;AAAA;AAEnF,iBAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;AAClD,gBAAM,SAAS,KAAK,QAAQ,OAAO,KAAK,CAAC;AACzC,cAAI,CAAC,UAAU,OAAO,WAAW,SAAU,KAAI,aAAa;AAC5D,gBAAM,QAAQ,QAAQ,CAAC;AAAA,QACzB;AAAA,IACJ;AAAA,EACF;AACA,QAAM,OAAO,CAAC;AACd,SAAO;AACT;AAEA,SAAS,eAAe,SAA+B;AACrD,QAAM,OAAO,QAAQ,MAAM,KAAK,OAAO;AACvC,QAAM,UAAU,QAAQ,QAAQ,KAAK,CAAC,UAAU,OAAO,SAAS,KAAK,CAAC;AACtE,SAAO,CAAC,OAAO,QAAQ,IAAI,KAAK,IAAI,YAAY,SAAY,UAAU,OAAO,KAAK,EAAE,EACjF,OAAO,OAAO,EACd,KAAK,GAAG;AACb;AAEA,SAAS,mBAAmB,SAAgC;AAC1D,SACE,QAAQ,MAAM,KAAK,CAAC,SAAS,gBAAgB,IAAI,IAAI,CAAC,KACtD,QAAQ,QAAQ,KAAK,CAACC,YAAW,eAAe,IAAIA,OAAM,CAAC;AAE/D;AAEA,SAAS,+BAA+B,SAAgC;AACtE,SAAO,QAAQ,SAAS;AAAA,IACtB,CAAC,YACC,wDAAwD,KAAK,OAAO,KACpE,mEAAmE,KAAK,OAAO;AAAA,EACnF;AACF;AAEA,SAAS,qCAAqC,SAAgC;AAC5E,SAAO,QAAQ,SAAS;AAAA,IACtB;AAAA,EACF;AACF;AAEA,SAAS,kCAAkC,SAAgC;AACzE,SAAO,QAAQ,SAAS;AAAA,IACtB;AAAA,EACF;AACF;AAEA,SAAS,oCAAoC,SAAgC;AAC3E,SAAO,QAAQ,SAAS;AAAA,IAAK,CAAC,YAC5B,+DAA+D,KAAK,OAAO;AAAA,EAC7E;AACF;AAGO,SAAS,+BACd,WACA,OACwB;AACxB,MAAI,cAAc,gBAAgB,CAAC,OAAO;AACxC,WAAO,EAAE,MAAM,SAAS,YAAY,sBAAsB;AAAA,EAC5D;AACA,QAAM,UAAU,eAAe,KAAK;AACpC,QAAM,aAAa,eAAe,OAAO,KAAK;AAE9C,MAAI,mBAAmB,OAAO,GAAG;AAC/B,WAAO,EAAE,MAAM,uBAAuB,WAAW;AAAA,EACnD;AACA,MAAI,QAAQ,WAAY,QAAO,EAAE,MAAM,SAAS,WAAW;AAI3D,MAAI,cAAc,WAAW;AAC3B,WAAO,QAAQ,MAAM,SAAS,mBAAmB,IAC7C,EAAE,MAAM,aAAa,WAAW,IAChC,EAAE,MAAM,SAAS,WAAW;AAAA,EAClC;AACA,MACE,QAAQ,QAAQ,KAAK,CAACA,YAAWA,YAAW,GAAG,KAC/C,QAAQ,MAAM,KAAK,CAAC,SAAS,gBAAgB,IAAI,IAAI,CAAC,GACtD;AACA,WAAO,EAAE,MAAM,aAAa,WAAW;AAAA,EACzC;AAIA,MAAI,cAAc,WAAW,+BAA+B,OAAO,GAAG;AACpE,WAAO;AAAA,MACL,MAAM;AAAA,MACN,YACE,eAAe,kCACX,2BACA,GAAG,UAAU;AAAA,IACrB;AAAA,EACF;AAMA,MAAI,cAAc,gBAAgB,oCAAoC,OAAO,GAAG;AAC9E,WAAO;AAAA,MACL,MAAM;AAAA,MACN,YACE,eAAe,kCACX,gCACA,GAAG,UAAU;AAAA,IACrB;AAAA,EACF;AAQA,OACG,cAAc,WAAW,cAAc,iBACxC,qCAAqC,OAAO,GAC5C;AACA,WAAO;AAAA,MACL,MAAM;AAAA,MACN,YACE,eAAe,kCACX,iCACA,GAAG,UAAU;AAAA,IACrB;AAAA,EACF;AASA,MAAI,cAAc,YAAY,kCAAkC,OAAO,GAAG;AACxE,WAAO;AAAA,MACL,MAAM;AAAA,MACN,YACE,eAAe,kCACX,6BACA,GAAG,UAAU;AAAA,IACrB;AAAA,EACF;AAEA,SAAO,EAAE,MAAM,SAAS,WAAW;AACrC;AAEO,SAAS,+BAA+B,WAAmB,OAAyB;AACzF,SAAO,+BAA+B,WAAW,KAAK,EAAE,SAAS;AACnE;AAaO,SAAS,2CACd,WACA,OACS;AACT,MAAI,cAAc,gBAAgB,CAAC,MAAO,QAAO;AACjD,QAAM,UAAU,eAAe,KAAK;AACpC,MAAI,mBAAmB,OAAO,KAAK,QAAQ,WAAY,QAAO;AAC9D,MAAI,QAAQ,MAAM,SAAS,mBAAmB,EAAG,QAAO;AACxD,SAAO,cAAc,WAAW,+BAA+B,OAAO;AACxE;AAEO,SAAS,gCAAgC,WAAmB,OAAyB;AAC1F,SAAO,+BAA+B,WAAW,KAAK,EAAE,SAAS;AACnE;;;AC5RA,SAAS,qBAAAC,0BAAyB;AAClC,SAAS,cAAcC,cAAa;AAYpC,SAAS,gBAAAC,qBAAoB;AAE7B,IAAM,SAAS;AACf,IAAM,eAAe,KAAK;AAO1B,eAAsB,4BACpB,SACA,MACA,SACA,SACA,uBAAuB,KACR;AACf,QAAMC,SAAQ,CAAC,UAAkB,IAAI,MAAM,WAAW,KAAK,OAAO,CAAC;AACnE,QAAM,UAAU,WAAWA,OAAM,IAAI,CAAC,iBAAiBA,OAAM,MAAM,CAAC;AACpE,QAAM,eAAe,IAAI,gBAAgB;AACzC,QAAM,iBAAiB,IAAI,MAAM,0DAA0D;AAC3F,MAAI;AACJ,MAAI;AACJ,MAAI,SAAS;AACb,MAAI,SAAS;AACb,QAAM,aAAa,CACjB,QACA,WAA0B,UACiB;AAAA,IAC3C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS,SAAS,QAAQ,MAAM,GAAG,YAAY;AAAA,IAC/C;AAAA,IACA,mBAAmB;AAAA,IACnB,GAAI,kBACA;AAAA,MACE,mBAAmB;AAAA,QACjB,WAAW,gBAAgB;AAAA,QAC3B,QAAQ,gBAAgB;AAAA,QACxB,QAAQ,gBAAgB;AAAA,MAC1B;AAAA,IACF,IACA,CAAC;AAAA,EACP;AACA,QAAM,QAAQ,WAAW,MAAM;AAC7B,iBAAa,MAAM,cAAc;AAAA,EACnC,GAAG,oBAAoB;AACvB,QAAM,MAAM;AACZ,UAAQ,IAAI,YAAY;AACxB,MAAI;AACF,QAAI;AACF,wBAAkB,MAAM,QAAQ;AAAA,QAC9B,EAAE,KAAK,SAAS,SAAS,OAAO,MAAM,OAAO,OAAO,KAAK,MAAM;AAAA,QAC/D,aAAa;AAAA,MACf;AAAA,IACF,SAAS,OAAO;AAGd,UAAI,EAAE,iBAAiB,yCAA0C,OAAM;AACvE,wBAAkB,gBAAgB,MAAM,OAAO;AAC/C,qBAAe;AAAA,IACjB;AACA,eAAS;AACP,mBAAa,OAAO,eAAe;AACnC,UAAI;AACJ,UAAI;AACF,eAAO,MAAM,QAAQ,UAAU,iBAAiB,KAAO,YAAY;AAAA,MACrE,SAAS,OAAO;AACd,qBAAa,OAAO,eAAe;AACnC,YACE,EAAE,iBAAiB,+CACnB,CAAC,MAAM,kBACP;AACA,cAAI,CAAC,aAAc,OAAM;AAGzB,gBAAM,IAAI;AAAA,YACR,gBAAgB,eAAe;AAAA,YAC/B,IAAI;AAAA,cACF,CAAC,cAAc,KAAK;AAAA,cACpB;AAAA,YACF;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAGA,YAAI,CAACC,mBAAkB,MAAM,SAAS,eAAe;AACnD,gBAAM,IAAI,wCAAwC,WAAW,kBAAkB,GAAG;AAAA,YAChF,OAAO;AAAA,UACT,CAAC;AAGH,YAAI;AACF,gBAAMC,OAAM,KAAK,QAAW,EAAE,QAAQ,aAAa,OAAO,CAAC;AAAA,QAC7D,SAAS,aAAa;AACpB,uBAAa,OAAO,eAAe;AACnC,gBAAM;AAAA,QACR;AACA;AAAA,MACF;AAGA,mBAAa,OAAO,eAAe;AACnC,UACE,KAAK,QAAQ,cAAc,gBAAgB,aAC3C,KAAK,QAAQ,WAAW,gBAAgB,UACxC,KAAK,QAAQ,WAAW,gBAAgB,QACxC;AACA,cAAM,IAAI,wCAAwC,WAAW,kBAAkB,CAAC;AAAA,MAClF;AACA,wBAAkB,KAAK;AACvB,iBAAW,SAAS,KAAK,QAAQ;AAC/B,YAAI,MAAM,WAAW,SAAU,WAAU,MAAM;AAAA,YAC1C,WAAU,MAAM;AAAA,MACvB;AACA,UAAI,OAAO,SAAS,OAAO,SAAS,cAAc;AAChD,cAAM,IAAI,wCAAwC,WAAW,kBAAkB,CAAC;AAAA,MAClF;AACA,UAAI,KAAK,aAAa,MAAM;AAG1B,cAAM,IAAI,QAAc,CAACC,aAAY,aAAaA,QAAO,CAAC;AAC1D;AAAA,MACF;AACA,UAAI,KAAK,aAAa,KAAK,WAAW,OAAQ;AAC9C,YAAM,IAAI;AAAA,QACR;AAAA,UACE,KAAK,aAAa,IACd,qBACA,KAAK,aAAa,IAChB,qBACA;AAAA,UACN,KAAK;AAAA,QACP;AAAA,MACF;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,QAAI,aAAa,OAAO,WAAW,gBAAgB;AACjD,YAAM,IAAI;AAAA,QACR;AAAA,UACE,GAAG,WAAW,iBAAiB;AAAA,UAC/B,cAAc;AAAA,QAChB;AAAA,QACA;AAAA,UACE,OAAO,kBACH,IAAI;AAAA,YACF;AAAA,YACA,eACI,IAAI;AAAA,cACF,CAAC,cAAc,KAAK;AAAA,cACpB;AAAA,YACF,IACA;AAAA,UACN,IACA;AAAA,QACN;AAAA,MACF;AAAA,IACF;AACA,QAAI,EAAE,iBAAiB,0CAA0C;AAC/D,kDAA4C,OAAO;AAAA,QACjD,GAAG,WAAW,eAAe;AAAA,QAC7B,cAAcJ,cAAa,KAAK;AAAA,MAClC,CAAC;AAAA,IACH;AACA,UAAM;AAAA,EACR,UAAE;AACA,iBAAa,MAAM,IAAI,MAAM,iDAAiD,CAAC;AAC/E,iBAAa,KAAK;AAClB,YAAQ,OAAO,YAAY;AAAA,EAC7B;AACF;;;AF5JA,SAAS,cAAc,GAAyB,GAAkC;AAChF,SACE,EAAE,SAAS,EAAE,QACb,EAAE,cAAc,EAAE,aAClB,EAAE,WAAW,EAAE,UACf,EAAE,WAAW,EAAE,UACfK;AAAA,IACE,iBAAiB,IAAI,EAAE,cAAc;AAAA,IACrC,iBAAiB,IAAI,EAAE,cAAc;AAAA,EACvC,KACA,QAAQ,EAAE,GAAG,MAAM,QAAQ,EAAE,GAAG;AAEpC;AAEA,IAAM,iBAAiB;AAGvB,SAAS,gBAAgB,MAAsC;AAC7D,QAAM,EAAE,SAAS,SAAS,IAAI;AAC9B,SACE,QAAQ,SAAS,qBACjB,UAAU,SAAS,qBACnB,QAAQ,QAAQ,OAAO,eAAe,SAAS,QAAQ,OAAO,cAC9D,QAAQ,QAAQ,OAAO,eAAe,SAAS,QAAQ,OAAO,cAC9D,QAAQ,QAAQ,OAAO,kBAAkB,SAAS,QAAQ,OAAO,iBACjE,QAAQ,QAAQ,OAAO,kBAAkB,SAAS,QAAQ,OAAO;AAErE;AAKO,SAAS,2BACd,SAMA,SAOM;AACN,0BAAwB,OAAO;AAC/B,QAAM,eAAe,QAAQ,aAAa,KAAK,OAAO;AACtD,QAAM,gBAAgB,QAAQ,YAAY,KAAK,OAAO;AACtD,QAAM,oBAAoB,QAAQ,0BAA0B,KAAK,OAAO;AACxE,QAAM,gBAAgB,oBAAI,IAAqB;AAC/C,MAAI,QAAQ,qBAAqB;AAC/B,UAAM,SAAS,QAAQ,oBAAoB,KAAK,OAAO;AACvD,YAAQ,sBAAsB,OAAO,WAAwB;AAC3D,YAAM,eAAe,IAAI,gBAAgB;AACzC,YAAM,QAAQ,MAAM,aAAa,MAAM,OAAO,MAAM;AACpD,aAAO,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AACtD,UAAI,OAAO,QAAS,OAAM;AAC1B,oBAAc,IAAI,YAAY;AAC9B,UAAI;AACF,cAAM,OAAO,MAAM,OAAO,aAAa,MAAM;AAC7C,qBAAa,OAAO,eAAe;AACnC,eAAO;AAAA,MACT,UAAE;AACA,eAAO,oBAAoB,SAAS,KAAK;AACzC,sBAAc,OAAO,YAAY;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AACA,UAAQ,qCAAqC,YAAY;AACvD,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,MAAM,iEAAiE;AACnF,WAAO,MAAM,QAAQ,4BAA4B;AAAA,EACnD;AACA,UAAQ,yBAAyB,CAAC,MAAM,YACtC,4BAA4B,SAAS,MAAM,SAAS,aAAa;AACnE,QAAM,UAAU,oBAAI,IAAmB;AAIvC,QAAM,eAAe,oBAAI,IAAoB;AAC7C,MAAI,kBAAkB,8BAA8B;AACpD,QAAMC,YAAW,oBAAI,IAA6D;AAClF,QAAM,qBAAqB,oBAAI,QAA+B;AAE9D,QAAM,YAAY,OAAO,OAAc,UAAU,UAAyB;AACxE,QAAI,MAAM,QAAQ,SAAS,qBAAqB,CAAC,MAAM,QAAQ,YAAa;AAC5E,UAAM,cAAc,MAAM;AAC1B,QACE,CAAC,aAAa,4BACd,CAAC,YAAY,0BACb,CAAC,YAAY,yBACb,CAAC,QAAQ;AAET,YAAM,IAAI,MAAM,yDAAyD;AAC3E,QAAI,UAAU,MAAM,YAAY,uBAAuB;AACvD,QAAI,CAAC,SAAS;AACZ,YAAM,SAAU,MAAM,YAAY,sBAAsB,IACpD,WACA,UACE,YACA;AACN,YAAM,cAAc,MAAM,QAAQ,mBAAmB,MAAM,SAAS,MAAM;AAC1E,gBAAU,YAAY,WAAW;AACjC,UAAI,QAAS,OAAM,YAAY,yBAAyB,OAAO;AAAA,IACjE;AACA,QAAI,SAAS;AAIX,YAAM,QACH,mBAAmB,MAAM,SAAS,OAAO,QAAQ,SAAS,EAC1D,MAAM,MAAM,MAAS;AAAA,IAC1B;AAAA,EACF;AAEA,QAAM,oBAAoB,OAAO,OAAc,SAAkD;AAC/F,QACE,KAAK,QAAQ,SAAS,qBACtB,CAAC,KAAK,YACN,CAAC,MAAM,aAAa;AAEpB,YAAM,IAAI,MAAM,2DAA2D;AAC7E,UAAM,SAAS,MAAM,MAAM,YAAY,kBAAkB;AAAA,MACvD,UAAU,KAAK;AAAA,MACf,SAAS,KAAK;AAAA,MACd,QAAQ,KAAK,OACV,OAAO,CAAC,UAAU,MAAM,WAAW,QAAQ,EAC3C,IAAI,CAAC,UAAU,MAAM,IAAI,EACzB,KAAK,EAAE;AAAA,MACV,QAAQ,KAAK,OACV,OAAO,CAAC,UAAU,MAAM,WAAW,QAAQ,EAC3C,IAAI,CAAC,UAAU,MAAM,IAAI,EACzB,KAAK,EAAE;AAAA,IACZ,CAAC;AACD,QAAI,CAAC,cAAc,MAAM,SAAS,OAAO,OAAO;AAC9C,YAAM,IAAI,MAAM,iDAAiD;AACnE,UAAM,UAAU,OAAO;AACvB,QAAI,OAAO,SAAU,oBAAmB,IAAI,IAAI;AAChD,WAAO,OAAO;AAAA,EAChB;AAEA,QAAM,YAAY,CAAC,KAAa,QAAgB,cAA8B;AAC5E,UAAM,SAAS,wBAAwB,GAAG;AAC1C,QAAI,OAAO,SAAS,UAAU;AAC5B,mBAAa,OAAO,MAAM;AAC1B,aAAO;AAAA,IACT;AACA,QAAI,OAAO,SAAS,aAAa,OAAO,cAAc;AACpD,YAAM,IAAI,wCAAwC,MAAM;AAG1D,UAAM,UAAU,IAAI;AAAA,MAClB;AAAA,MACA,mCAAmC,MAAM;AAAA,IAC3C;AACA,wCAAoC,SAAS,KAAK,SAAS,MAAM;AACjE,WAAO;AAAA,EACT;AAEA,QAAM,aAAa,CACjB,QACA,MACA,oBACW;AACX,UAAM,SAAS;AAAA,MACb,4BAA4BC,YAAW,CAAC;AAAA,MACxC,KAAK,aAAa,OACd,mCAAmC,MAAM,KACzC,4BAA4B,KAAK,QAAQ;AAAA,MAC7C;AAAA,MACA,eAAe,KAAK,OAAO,IAAI,CAAC,UAAU,MAAM,IAAI,EAAE,KAAK,EAAE,GAAG,eAAe,EAAE;AAAA,IACnF,EAAE,KAAK,IAAI;AACX,QAAI,KAAK,aAAa,QAAQ,QAAQ,IAAI,MAAM,GAAG,aAAa;AAC9D,MAAAD,UAAS,IAAI,QAAQ,EAAE,QAAQ,KAAK,CAAC;AAAA,IACvC,OAAO;AACL,4CAAsC,SAAS,QAAQ,IAAI;AAC3D,cAAQ,OAAO,MAAM;AAAA,IACvB;AACA,WAAO;AAAA,EACT;AACA,QAAM,OAAO,OACX,QACA,OACA,aACA,iBACA,WACoB;AACpB,QAAI,MAAM,aAAa;AACrB,YAAM,WAAW,MAAM,MAAM,YAAY,KAAK;AAC9C,UAAI,CAAC,YAAY,CAAC,cAAc,MAAM,SAAS,QAAQ;AACrD,cAAM,IAAI,MAAM,gDAAgD;AAClE,YAAM,UAAU;AAGhB,YAAM,UAAU,KAAK,EAAE,MAAM,MAAM,MAAS;AAAA,IAC9C;AAIA,UAAM,WAAW,YAAY,IAAI,IAAI;AACrC,UAAM,YAAY,MAChB,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,KAAK;AAAA,QACH;AAAA,QACA,KAAK,IAAI,GAAG,KAAK,KAAK,WAAW,YAAY,IAAI,CAAC,CAAC;AAAA,MACrD;AAAA,MACA;AAAA,IACF;AACF,QAAI;AACJ,WAAO,MAAM;AACX,aAAO,MAAM,UAAU;AACvB,UAAI,MAAM,eAAe,KAAK,QAAQ,SAAS,mBAAmB;AAGhE,YAAI,WAAW;AACf,iBAAS,UAAU,GAAG,UAAU,GAAG,WAAW;AAC5C,cAAI,MAAM,kBAAkB,OAAO,IAAI,GAAG;AACxC,uBAAW;AACX;AAAA,UACF;AACA,cAAI,UAAU,EAAG,QAAO,MAAM,UAAU;AAAA,QAC1C;AACA,YAAI,CAAC;AACH,gBAAM,IAAI,MAAM,4DAA4D;AAAA,MAChF;AACA,UACE,KAAK,aAAa,QAClB,KAAK,OAAO,SAAS,KACrB,CAAC,gBAAgB,IAAI,KACrB,WAAW,YAAY,IAAI,KAAK;AAEhC;AAGF,YAAM,IAAI,QAAQ,CAACE,aAAY,WAAWA,UAAS,cAAc,CAAC;AAAA,IACpE;AACA,QAAI,KAAK,QAAQ,SAAS,qBAAqB,KAAK,QAAQ,aAAa;AACvE,YAAM,UAAU,MAAM,MAAM,aAAa,yBAAyB;AAGlE,aAAO,EAAE,GAAG,MAAM,UAAU,WAAW,KAAK,aAAa,IAAI,QAAQ,iBAAiB,KAAK;AAAA,IAC7F;AAGA,WAAO,WAAW,QAAQ,MAAM,eAAe;AAAA,EACjD;AAEA,UAAQ,cAAc,OAAO,SAAS;AACpC,UAAM,SAAS,8BAA8B;AAG7C,QAAI,WAAW,QAAW;AACxB,UAAI,CAAC,aAAc,OAAM,IAAI,MAAM,2CAA2C;AAC9E,UAAI,CAAC,OAAO,cAAc,eAAe,EAAG,OAAM,IAAI,MAAM,+BAA+B;AAC3F,YAAM,cAAc;AACpB,YAAM,MAAM,MAAM,aAAa,IAAI;AACnC,YAAM,SAAS,wBAAwB,GAAG;AAC1C,UAAI,OAAO,SAAS,UAAW,QAAO;AACtC,mBAAa,IAAI,aAAa,OAAO,SAAS;AAC9C,aAAO,UAAU,KAAK,aAAa,OAAO,SAAS;AAAA,IACrD;AACA,QAAI,QAAQ,IAAI,MAAM,EAAG,OAAM,IAAI,MAAM,uCAAuC;AAChF,UAAM,eAAe,IAAI,gBAAgB;AACzC,kBAAc,IAAI,YAAY;AAC9B,QAAI;AACF,YAAM,UAAU,MAAM,QAAQ,MAAM,MAAM,aAAa,MAAM;AAE7D,YAAM,QAAQ,QAAQ,IAAI,MAAM,KAAK,EAAE,QAAQ;AAC/C,UAAI,CAAC,cAAc,MAAM,SAAS,OAAO;AACvC,cAAM,IAAI,MAAM,gDAAgD;AAClE,cAAQ,IAAI,QAAQ,KAAK;AACzB,UAAI,MAAM,QAAQ,SAAS,qBAAqB,MAAM,QAAQ,aAAa;AAGzE,eAAO,WAAW,QAAQ,EAAE,SAAS,MAAM,SAAS,QAAQ,CAAC,GAAG,UAAU,KAAK,CAAC;AAAA,MAClF;AACA,UAAI;AACF,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA,KAAK,eAAe;AAAA,UACpB,KAAK;AAAA,UACL,aAAa;AAAA,QACf;AAAA,MACF,QAAQ;AAGN,eAAO,WAAW,QAAQ;AAAA,UACxB,SAAS,MAAM;AAAA,UACf,QAAQ,CAAC;AAAA,UACT,UAAU;AAAA,QACZ,CAAC;AAAA,MACH;AAAA,IACF,SAAS,OAAO;AACd,UAAI,iBAAiB,yCAAyC;AAC5D,cAAM,QAAQ,QAAQ,IAAI,MAAM;AAChC,YAAI,SAAS,CAAC,cAAc,MAAM,SAAS,MAAM,OAAO;AACtD,gBAAM,IAAI,MAAM,yDAAyD;AAAA,YACvE,OAAO;AAAA,UACT,CAAC;AACH,gBAAQ,IAAI,QAAQ,SAAS,EAAE,SAAS,MAAM,QAAQ,CAAC;AAAA,MACzD;AACA,YAAM;AAAA,IACR,UAAE;AACA,oBAAc,OAAO,YAAY;AAAA,IACnC;AAAA,EACF;AAEA,UAAQ,2BAA2B,YAAY;AAC7C,eAAW,SAAS;AAClB,YAAM;AAAA,QACJ,IAAI,MAAM,wEAAwE;AAAA,MACpF;AAGF,UAAM,oBAAoB;AAAA,EAC5B;AAEA,UAAQ,qBAAqB,CAAC,WAAW;AACvC,UAAM,QAAQ,QAAQ,IAAI,MAAM;AAChC,WAAO,QAAQ,gBAAgB,MAAM,OAAO,IAAI;AAAA,EAClD;AACA,UAAQ,2BAA2B,OAAO,WAAW;AACnD,UAAM,QAAQ,QAAQ,IAAI,MAAM;AAChC,QAAI,CAAC,SAAS,MAAM,QAAQ,SAAS,qBAAqB,CAAC,MAAM,QAAQ,YAAa;AACtF,UAAM,WAAW,MAAM,MAAM,aAAa,KAAK;AAC/C,QAAI,CAAC,YAAY,CAAC,cAAc,MAAM,SAAS,QAAQ;AACrD,YAAM,IAAI,MAAM,yDAAyD;AAC3E,UAAM,UAAU;AAChB,UAAM,UAAU,OAAO,IAAI;AAAA,EAC7B;AACA,UAAQ,0BAA0B,OAAO,QAAQ,WAAW;AAC1D,UAAM,QAAQ,QAAQ,IAAI,MAAM;AAChC,QAAI,CAAC,SAAS,MAAM,QAAQ,SAAS,qBAAqB,CAAC,MAAM,QAAQ;AACvE,aAAO;AACT,QAAI,CAAC,MAAM,aAAa;AACtB,YAAM,IAAI,MAAM,iDAAiD;AACnE,UAAM,MAAM,YAAY,oBAAoB,MAAM;AAClD,UAAM,UAAU,KAAK;AACrB,WAAO;AAAA,EACT;AACA,UAAQ,sBAAsB,CAAC,QAAQ,SAAS,gBAAgB;AAC9D,QAAI,CAAC,OAAO,cAAc,MAAM,KAAK,UAAU,KAAK,SAAS;AAC3D,YAAM,IAAI,MAAM,uCAAuC;AACzD,UAAM,WAAW,QAAQ,IAAI,MAAM;AACnC,QAAI,YAAY,CAAC,cAAc,SAAS,SAAS,OAAO;AACtD,YAAM,IAAI,MAAM,6DAA6D;AAC/E,YAAQ,IAAI,QAAQ,EAAE,SAAS,gBAAgB,OAAO,GAAG,YAAY,CAAC;AAAA,EACxE;AACA,UAAQ,2BAA2B,CAAC,WAClC,OAAO,WAAW,WACbF,UAAS,IAAI,MAAM,GAAG,QAAQ,gCAAgC,SAAS,MAAM,IAC9E;AACN,UAAQ,uBAAuB,OAAO,WAAW;AAC/C,UAAM,UAAUA,UAAS,IAAI,MAAM;AACnC,QAAI,CAAC,QAAS,QAAO;AACrB,QACE,CAAC,QAAQ,KAAK,YACd,QAAQ,KAAK,aAAa,QAC1B,QAAQ,KAAK,OAAO,WAAW,GAC/B;AAIA,MAAAA,UAAS,OAAO,MAAM;AACtB,aAAO;AAAA,IACT;AACA,QAAI,mBAAmB,IAAI,QAAQ,IAAI,GAAG;AACxC,MAAAA,UAAS,OAAO,MAAM;AACtB,aAAO;AAAA,IACT;AACA,UAAM,QAAQ,QAAQ,IAAI,QAAQ,MAAM;AACxC,QAAI,CAAC,OAAO,aAAa,qBAAqB,CAAC,QAAQ,KAAK;AAC1D,YAAM,IAAI,MAAM,2DAA2D;AAC7E,QAAI,CAAE,MAAM,kBAAkB,OAAO,QAAQ,IAAI,GAAI;AACnD,YAAM,SAAS,QAAQ,KAAK;AAC5B,YAAM,UAAU,MACb,CAAC,UAAU,QAAQ,EAAY,MAAM,CAAC,WAAW;AAChD,cAAM,UAAU,MAAM,QAAQ,QAAQ,MAAM;AAC5C,cAAM,SAAS,OAAO,QAAQ,MAAM;AACpC,eACE,QAAQ,cAAc,OAAO,eAC5B,CAAC,OAAO,OAAO,QAAQ,SACvB,OAAO,aAAa,QAAQ,QAAQ,aAAa,OAAO;AAAA,MAE7D,CAAC;AACH,eAAS,UAAU,GAAG,CAAC,QAAQ,KAAK,UAAU,GAAG,WAAW;AAI1D,cAAM,mBAAmB,MAAM,KAAK,QAAQ,QAAQ,OAAO,GAAG;AAC9D,cAAM,YAAYA,UAAS,IAAI,gBAAgB;AAC/C,YAAI,aAAa,mBAAmB,IAAI,UAAU,IAAI,EAAG,CAAAA,UAAS,OAAO,gBAAgB;AAAA,MAC3F;AACA,UAAI,CAAC,QAAQ;AACX,cAAM,IAAI,MAAM,qEAAqE;AAAA,IACzF;AACA,IAAAA,UAAS,OAAO,MAAM;AACtB,WAAO;AAAA,EACT;AACA,UAAQ,aAAa,OAAO,SAAS;AACnC,UAAM,YAAY,aAAa,IAAI,KAAK,SAAS;AACjD,QAAI,cAAc,UAAa,eAAe;AAC5C,YAAM,MAAM,MAAM,cAAc,EAAE,GAAG,MAAM,WAAW,UAAU,CAAC;AACjE,aAAO,UAAU,KAAK,KAAK,WAAW,SAAS;AAAA,IACjD;AACA,UAAM,QAAQ,QAAQ,IAAI,KAAK,SAAS;AACxC,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,wCAAwC,KAAK,WAAW;AAAA,QAChE,QAAQ;AAAA,MACV,CAAC;AACH,QAAI,KAAK,OAAO;AACd,YAAM,WAAW,MAAM,MAAM,YAAY,KAAK;AAC9C,UAAI,CAAC,YAAY,CAAC,cAAc,MAAM,SAAS,QAAQ;AACrD,cAAM,IAAI,MAAM,gDAAgD;AAClE,YAAM,QAAQ,MAAM,MAAM,YAAY,aAAa,OAAO,WAAW,KAAK,KAAK,CAAC;AAChF,UAAI;AACF,cAAM,QAAQ,MAAM,UAAU,KAAK,OAAO,KAAK;AAAA,MACjD,SAAS,OAAO;AAGd,YACE,SAAS,SAAS;AAAA;AAAA;AAAA,QAIlB,+BAA+B,SAAS,KAAK,EAAE,SAAS;AAExD,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,YACA,OAAO,WAAW,KAAK,KAAK;AAAA,YAC5B;AAAA,UACF;AACF,cAAM;AAAA,MACR;AAAA,IACF;AACA,WAAO,KAAK,KAAK,WAAW,OAAO,KAAK,eAAe,KAAK,KAAK,iBAAiB,KAAK,MAAM;AAAA,EAC/F;AACF;;;AGxdA,SAAS,cAAAG,aAAY,mBAAmB;AACxC,SAAS,SAAAC,cAAa;AACtB,SAAS,cAAc;AACvB,SAAS,cAAcC,cAAa;;;ACC7B,SAAS,iBAAiB,MAAkC;AACjE,QAAM,UAAU;AAAA,IACd,KAAK,SAAS;AAAA,IACd,KAAK,UAAU,KAAK,SAAS,QAAQ,QAAQ;AAAA,IAC7C,KAAK;AAAA,EACP;AACA,MAAI,CAAC,KAAK,MAAO,QAAO;AACxB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,KAAK;AAAA,IACL,GAAG;AAAA,EACL;AACF;;;ADdA;AAAA,EACE;AAAA,EACA;AAAA,EACA,8BAAAC;AAAA,OACK;;;AEPA,SAAS,wCAAwC,OAAyB;AAC/E,QAAM,OAAO,oBAAI,IAAqB;AACtC,MAAI,QAAQ;AACZ,QAAM,MAAM,CAAC,OAAe,QAAyB;AACnD,UAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,QAAI,cAAc,EAAE,WAAW,YAAa,OAAM,IAAI,MAAM,iCAAiC;AAC7F,WAAO,cAAc,WAAW,aAAa,WAAW,QAAQ;AAAA,EAClE;AACA,QAAM,QAAQ,CAAC,OAAgB,UAA2B;AACxD,QAAI,CAAC,SAAS,OAAO,UAAU,YAAY,QAAQ,KAAK,EAAE,QAAQ,GAAI,QAAO;AAC7E,QAAI,KAAK,IAAI,KAAK,EAAG,QAAO,KAAK,IAAI,KAAK;AAE1C,SAAK,IAAI,OAAO,KAAK;AACrB,QAAI;AACF,YAAM,OAAO,IAAI,OAAO,MAAM;AAC9B,YAAM,SAAoB,CAAC,IAAI,OAAO,OAAO,GAAG,IAAI,OAAO,OAAO,CAAC,EAAE;AAAA,QACnE,CAAC,SAAS,SAAS;AAAA,MACrB;AACA,YAAM,SAAS,IAAI,OAAO,QAAQ;AAClC,UAAI,WAAW,QAAW;AACxB,YAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,CAAC,OAAO,UAAU,OAAO,SAAS,GAAI,QAAO;AAC3E,iBAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,QAAS,QAAO,KAAK,IAAI,QAAQ,OAAO,KAAK,CAAC,CAAC;AAAA,MAC5F;AACA,UAAI,SAAS,QAAW;AACtB,cAAM,aAAa,OAAO,SAAS,WAAW,KAAK,KAAK,EAAE,YAAY,IAAI;AAC1E,YACE,CAAC;AAAA,UACC;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF,EAAE,SAAS,UAAmB;AAE9B,iBAAO;AACT,cAAMC,UAAS,OAAO,WAAW,KAAK,OAAO,MAAM,CAAC,SAAS,MAAM,MAAM,QAAQ,CAAC,CAAC;AACnF,aAAK,IAAI,OAAOA,OAAM;AACtB,eAAOA;AAAA,MACT;AACA,YAAM,SAAS,OAAO,SAAS,KAAK,OAAO,MAAM,CAAC,SAAS,MAAM,MAAM,QAAQ,CAAC,CAAC;AACjF,WAAK,IAAI,OAAO,MAAM;AACtB,aAAO;AAAA,IACT,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO,MAAM,OAAO,CAAC;AACvB;;;AChEA,SAAS,mBAAmB;AAcrB,IAAM,8BAA8C,iBAAiB,MAAM,SAAS;AACzF,UAAQ,QAAQ,eAAe;AAC/B,SAAO,OAAO,KAAK,KAAK,KAAK,SAAS,OAAO;AAC/C;AAQA,IAAM,kBAEmB;AACzB,IAAM,qBAAN,cAAiC,gBAAgB;AAAA,EAC/C,kBAAkC;AAChC,WAAO;AAAA,EACT;AACF;AACA,IAAM,iBAAiB,oBAAI,QAAmC;AAEvD,SAAS,oBAAoB,QAAqC;AAGvE,MAAI,CAAC,OAAO,QAAS,QAAO,OAAO;AACnC,MAAI,OAAO,QAAQ,IAAI,YAAY,WAAW,iBAAiB,MAAM;AACnE,UAAM,IAAI,MAAM,6DAA6D;AAC/E,MAAI,aAAa,eAAe,IAAI,MAAM;AAC1C,MAAI,CAAC,YAAY;AACf,UAAM,UAAU,OAAO;AACvB,QAAI,CAAC,QAAQ,WAAW,CAAC,QAAQ;AAC/B,YAAM,IAAI,MAAM,mEAAmE;AACrF,iBAAa,IAAI,mBAAmB;AAAA,MAClC,SAAS,QAAQ;AAAA,MACjB,aAAa,QAAQ;AAAA,MACrB,UAAU,QAAQ;AAAA,MAClB,aAAa,QAAQ,eAAe;AAAA,MACpC,GAAI,QAAQ,wBAAwB,SAChC,EAAE,qBAAqB,QAAQ,oBAAoB,IACnD,CAAC;AAAA,MACL,GAAI,OAAO,SAAS,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;AAAA,IACnD,CAAC;AACD,mBAAe,IAAI,QAAQ,UAAU;AAAA,EACvC;AACA,SAAO,WAAW;AACpB;;;AHdA,IAAM,kBAAkB;AAaxB,SAAS,iBACP,SACA,MACS;AACT,SACE,KAAK,OAAO,aAAa,QACxB,CAAC,UAAU,QAAQ,EAAY;AAAA,IAC9B,CAAC,WACC,KAAK,IAAI,QAAQ,MAAM,EAAE,MAAM,aAAa,KAC3C,KAAK,IAAI,QAAQ,MAAM,EAAE,OAAO,CAAC,QAAQ,QAAQ,MAAM,EAAE;AAAA,EAC9D;AAEJ;AAIA,SAAS,kBAAqB,SAAqB,QAAkC;AACnF,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,eAAe;AACtB,SAAO,IAAI,QAAW,CAACC,UAAS,WAAW;AACzC,UAAM,QAAQ,MAAM;AAClB,aAAO,oBAAoB,SAAS,KAAK;AACzC,aAAO,OAAO,MAAM;AAAA,IACtB;AACA,WAAO,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AACtD,SAAK,QAAQ,KAAKA,UAAS,MAAM,EAAE,QAAQ,MAAM,OAAO,oBAAoB,SAAS,KAAK,CAAC;AAAA,EAC7F,CAAC;AACH;AAOA,IAAM,sCACJ;AAEF,SAAS,0BAA0B,OAAyB;AAC1D,MAAI,EAAE,iBAAiB,OAAQ,QAAO;AACtC,QAAM,SAAS;AACf,SACE,OAAO,SAAS,OAAO,uBACvB,OAAO,OAAO,YAAY,YAC1B,oCAAoC,KAAK,OAAO,OAAO;AAE3D;AAWO,IAAM,mCAAN,cAA+C,MAAM;AAAA,EACjD,OAAO;AAAA,EAEhB,YAAY,OAAc;AACxB,UAAM,kEAAkE,EAAE,MAAM,CAAC;AAAA,EACnF;AACF;AAGO,IAAM,sBAAN,MAAM,qBAAoB;AAAA,EAWvB,YACN,QACiB,iBACA,MACA,aACjB;AAHiB;AACA;AACA;AAEjB,SAAK,SAAS,oBAAoB,MAAM;AAAA,EAC1C;AAAA,EAjBiB,UAAU,oBAAI,IAAkC;AAAA,EAChD,gBAAgB,oBAAI,IAAwC;AAAA;AAAA;AAAA;AAAA,EAI5D,UAAU,oBAAI,IAA6B;AAAA,EAC3C,iBAAiB,oBAAI,IAA2B;AAAA,EAChD;AAAA,EACT,SAAS;AAAA,EAWjB,OAAO,WACL,QACA,WACA,MACA,cAAuE,CAAC,GACnD;AACrB,QAAI,OAAO,QAAQ,MAAM;AACvB,YAAM,IAAI,MAAM,gEAAgE;AAClF,WAAO,IAAI,qBAAoB,QAAQ,WAAW,MAAM,WAAW;AAAA,EACrE;AAAA,EAEA,IAAY,YAAoB;AAC9B,WAAO,OAAO,KAAK,oBAAoB,aACnC,KAAK,gBAAgB,IACrB,KAAK;AAAA,EACX;AAAA,EAEA,MAAc,WACZ,QACA,QACAC,MACY;AACZ,YAAQ,eAAe;AACvB,QAAI,KAAK,OAAQ,OAAM,IAAI,MAAM,iCAAiC;AAClE,QAAI,UAAU,KAAK,QAAQ,IAAI,MAAM;AACrC,UAAM,SAAS,QAAQ,OAAO;AAC9B,QAAI,CAAC,SAAS;AACZ,YAAMC,UAAuB;AAAA,QAC3B,YAAY,IAAI,gBAAgB;AAAA,QAChC,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AACA,iBAAW,YAAY;AACrB,cAAM,SAAS,MAAM;AAAA,UACnB,KAAK,OAAO,2BAA2B,EAAE,OAAO,GAAG,EAAE,QAAQA,QAAO,WAAW,OAAO,CAAC;AAAA,UACvFA,QAAO,WAAW;AAAA,QACpB;AACA,YAAI,YAAY,KAAK,IAAI,IAAI;AAC7B,YAAI;AAEF,gBAAM,UAAU,KAAK;AAAA,YACnB,OAAO,KAAK,OAAO,IAAI,MAAM,GAAG,EAAE,CAAC,KAAK,IAAI,WAAW,EAAE,SAAS;AAAA,UACpE;AACA,cAAI,OAAO,QAAQ,QAAQ,YAAY,OAAO,SAAS,QAAQ,GAAG;AAChE,wBAAY,KAAK,IAAI,WAAW,QAAQ,MAAM,MAAO,IAAM;AAAA,QAC/D,QAAQ;AAAA,QAER;AACA,eAAO,EAAE,QAAQ,IAAI,uBAAuB,MAAM,GAAG,OAAO,GAAG,UAAU;AAAA,MAC3E,GAAG;AACH,WAAK,QAAQ,IAAI,QAAQ,OAAO;AAChC,WAAK,cAAc,IAAI,SAASA,OAAM;AACtC,YAAM,UAAU,MAAM;AACpB,QAAAA,QAAO,UAAU;AACjB,aAAK,cAAc,OAAO,OAAQ;AAAA,MACpC;AACA,WAAK,QAAQ,KAAK,SAAS,MAAM;AAC/B,gBAAQ;AACR,YAAI,KAAK,QAAQ,IAAI,MAAM,MAAM,QAAS,MAAK,QAAQ,OAAO,MAAM;AAAA,MACtE,CAAC;AAAA,IACH;AACA,UAAM,SAAS,KAAK,cAAc,IAAI,OAAO;AAC7C,QAAI,OAAQ,QAAO;AACnB,QAAI;AACJ,QAAI;AACF,cAAQ,MAAM,kBAAkB,SAAS,MAAM;AAAA,IACjD,UAAE;AACA,UAAI,UAAU,EAAE,OAAO,YAAY,KAAK,CAAC,OAAO,SAAS;AAGvD,YAAI,KAAK,QAAQ,IAAI,MAAM,MAAM,QAAS,MAAK,QAAQ,OAAO,MAAM;AACpE,eAAO,WAAW,MAAM,IAAI,MAAM,8CAA8C,CAAC;AAAA,MACnF;AAAA,IACF;AAEA,QAAI,UAAU,CAAC,MAAM,SAAS,KAAK,IAAI,IAAI,MAAM,WAAW;AAI1D,UAAI,KAAK,QAAQ,IAAI,MAAM,MAAM,SAAS;AACxC,aAAK,QAAQ,OAAO,MAAM;AAC1B,qBAAa,MAAM,IAAI;AACvB,cAAM,OAAO,MAAM;AAAA,MACrB;AACA,aAAO,MAAM,KAAK,WAAW,QAAQ,QAAQD,IAAG;AAAA,IAClD;AACA,iBAAa,MAAM,IAAI;AACvB,UAAM;AACN,QAAI;AACF,cAAQ,eAAe;AACvB,aAAO,MAAMA,KAAI,MAAM,MAAM;AAAA,IAC/B,UAAE;AACA,YAAM;AACN,UAAI,CAAC,MAAM,OAAO;AAChB,cAAM,OAAO,WAAW,MAAM;AAC5B,cAAI,KAAK,QAAQ,IAAI,MAAM,MAAM,WAAW,CAAC,MAAM,OAAO;AACxD,iBAAK,QAAQ,OAAO,MAAM;AAC1B,kBAAM,OAAO,MAAM;AAAA,UACrB;AAAA,QACF,GAAG,GAAM;AACT,cAAM,KAAK,QAAQ;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,QAAuB;AAC3B,SAAK,SAAS;AACd,SAAK,QAAQ,MAAM;AACnB,eAAW,UAAU,KAAK,cAAc,OAAO;AAC7C,aAAO,WAAW,MAAM,IAAI,MAAM,iCAAiC,CAAC;AACtE,UAAM,UAAU,MAAM,QAAQ,WAAW,KAAK,QAAQ,OAAO,CAAC;AAC9D,SAAK,QAAQ,MAAM;AACnB,eAAW,SAAS;AAClB,UAAI,MAAM,WAAW,aAAa;AAChC,qBAAa,MAAM,MAAM,IAAI;AAC7B,cAAM,MAAM,OAAO,MAAM;AAAA,MAC3B;AAAA,EACJ;AAAA;AAAA;AAAA,EAIA,MAAc,gBACZ,QACA,QACAA,MACY;AACZ,QAAI,UAAU;AACd,QAAI;AACF,aAAO,MAAM,KAAK,WAAW,QAAQ,QAAQ,OAAO,WAAW;AAC7D,kBAAU;AACV,eAAO,MAAMA,KAAI,MAAM;AAAA,MACzB,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,QAAS,OAAM;AACnB,aAAO,MAAM,6CAA6C,eAAe,YAAY;AACnF,cAAM;AAAA,MACR,GAAG,MAAM;AAAA,IACX;AAAA,EACF;AAAA,EAEA,MAAM,MAAM,MAAwB,QAA2D;AAC7F,YAAQ,eAAe;AACvB,UAAM,aAAa,gCAAgC,KAAK,CAAC,KAAK,OAAO,CAAC,KAAK;AAC3E,QAAI,WAAY,8BAA6B;AAC7C,UAAM,YAAY,KAAK;AACvB,UAAM,UAAUE,OAAM,QAAQ,KAAK,MAAM,KAAK,WAAW,KAAK,IAAI;AAClE,QAAI,YAAY,KAAK,QAAQ,CAAC,QAAQ,WAAW,GAAG,KAAK,KAAK,QAAQ,QAAQ,EAAE,CAAC,GAAG;AAClF,YAAM,IAAI,MAAM,kDAAkD;AACpE,UAAM,aAAa,KAAK,YAAY,SAAS;AAC7C,UAAM,SAAS,MAAM,6CAA6C;AAAA,MAChE,MAAM,kBAAkB,YAAY,MAAM;AAAA,MAC1C;AAAA,IACF;AACA,QAAI,KAAK,cAAc;AACrB,YAAM,IAAI,MAAM,kDAAkD;AACpE,QAAI;AACF,aAAO,MAAM,KAAK,YAAY,MAAM,QAAQ,YAAY,WAAW,SAAS,MAAM;AAAA,IACpF,SAAS,OAAO;AACd,UAAI,KAAK,QAAQ,IAAI,SAAS,MAAM,WAAY,MAAK,QAAQ,OAAO,SAAS;AAC7E,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEQ,YAAY,WAAoC;AACtD,QAAI,UAAU,KAAK,QAAQ,IAAI,SAAS;AACxC,QAAI,QAAS,QAAO;AAEpB,eAAW,YAAY;AACrB,YAAM,OAAO,MAAM,KAAK,OAAO;AAAA,QAC7B,EAAE,UAAU;AAAA,QACZ,EAAE,QAAQ,YAAY,QAAQ,GAAM,EAAE;AAAA,MACxC;AACA,UAAI,CAAC,KAAK,UAAU,KAAK,WAAY,OAAM,IAAI,MAAM,mCAAmC;AACxF,aAAO,KAAK;AAAA,IACd,GAAG;AACH,SAAK,QAAQ,IAAI,WAAW,OAAO;AACnC,SAAK,QAAQ,MAAM,MAAM;AACvB,UAAI,KAAK,QAAQ,IAAI,SAAS,MAAM,QAAS,MAAK,QAAQ,OAAO,SAAS;AAAA,IAC5E,CAAC;AACD,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,YACZ,MACA,QACA,YACA,WACA,SACA,QACqC;AACrC,UAAM,SAASC,YAAW;AAG1B,UAAM,eAAeA,YAAW;AAChC,UAAM,cAAc,aAChB;AAAA,MACE,UAAU;AAAA,MACV;AAAA,MACA,OAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AAAA,MACrC,aAAa,6BAA6B,YAAY;AAAA,IACxD,IACA;AACJ,QAAI,cAAc,iBAAiB,IAAI;AACvC,UAAM,MAAM,OAAO,KAAK,gBAAgB,aAAa,KAAK,YAAY,IAAI,KAAK;AAC/E,QAAI;AACF,oBAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY;AAAA,QACZ;AAAA,QACA,YAAY;AAAA,QACZ;AAAA,QACA,YAAY;AAAA,QACZ;AAAA,QACA,GAAG;AAAA,MACL;AACF,UAAM,UAAsC;AAAA,MAC1C,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAI,KAAK,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC;AAAA,MAChC,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;AAAA,MACrC,SAAS;AAAA,QACP,QAAQ,EAAE,YAAY,GAAG,eAAe,IAAI,KAAK,OAAO,UAAU,KAAK;AAAA,QACvE,QAAQ,EAAE,YAAY,GAAG,eAAe,IAAI,KAAK,OAAO,UAAU,KAAK;AAAA,MACzE;AAAA,IACF;AACA,QAAI,YAAa,OAAM,wBAAwB,OAAO;AACtD,QAAI,iBAAiB;AACrB,QAAI;AACF,YAAM,KAAK,gBAAgB,QAAQ,QAAQ,OAAO,WAAW;AAC3D,yBAAiB;AACjB,cAAM,OAAO;AAAA,UACX;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA,GAAI,KAAK,MACL;AAAA,cACE,SAAS;AAAA,gBACP,SAAS;AAAA,gBACT,WAAW;AAAA,gBACX,WAAW;AAAA,gBACX,SAAS;AAAA,gBACT,SAAS;AAAA,gBACT,wBAAwB;AAAA,cAC1B;AAAA,YACF,IACA,CAAC;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AAId,UACE,CAAC,kBACD,iBAAiB,uCACjB,iBAAiB,kCACjB,iBAAiB;AAEjB,cAAM;AACR,YAAM,IAAI,wCAAwC,SAAS,KAAK;AAAA,IAClE;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,8BAA8E;AAClF,UAAM,YAAY,KAAK;AACvB,UAAM,SAAS,YAAY,QAAQ,GAAK;AACxC,UAAM,OAAO,MAAM,6CAA6C;AAAA,MAC9D,MAAM,KAAK,OAAO,iBAAiB,EAAE,UAAU,GAAG,EAAE,OAAO,CAAC;AAAA,MAC5D;AAAA,IACF;AACA,QAAI,CAAC,KAAK,UAAU,KAAK,WAAY,OAAM,IAAI,MAAM,mCAAmC;AACxF,UAAM,KAAK,gBAAgB,KAAK,QAAQ,QAAQ,OAAO,WAAW;AAChE,YAAM,WAAW,EAAE,QAAQ,KAAK,QAAS,QAAQA,YAAW,EAAE;AAC9D,YAAM,cAAkC;AAAA,QACtC,SAAS;AAAA,UACP,MAAM;AAAA,UACN;AAAA,UACA,GAAG;AAAA,UACH,SAAS;AAAA,YACP,QAAQ,EAAE,YAAY,GAAG,eAAe,IAAI,KAAK,OAAO,UAAU,KAAK;AAAA,YACvE,QAAQ,EAAE,YAAY,GAAG,eAAe,IAAI,KAAK,OAAO,UAAU,KAAK;AAAA,UACzE;AAAA,QACF;AAAA,QACA,QAAQ;AAAA,MACV;AACA,UAAI;AACJ,UAAI;AACF,cAAM,OAAO;AAAA,UACX;AAAA,YACE,GAAG;AAAA,YACH,aAAa,CAAC,8CAA8C,cAAc;AAAA,YAC1E,SAAS;AAAA,YACT,KAAK,CAAC;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF,SAAS,OAAO;AAId,YAAI,EAAE,iBAAiB,sCAAuC,OAAM;AACpE,YAAI,MAAM,WAAW,SAAS,UAAU,MAAM,WAAW,SAAS,OAAQ,OAAM;AAChF,uBAAe;AAAA,MACjB;AACA,UAAI;AACJ,UAAI;AACF,iBAAS,MAAM,KAAK,kBAAkB,UAAU,KAAK,QAAQ,WAAW;AAAA,MAC1E,SAAS,OAAO;AACd,YAAI,CAAC,aAAc,OAAM;AAGzB,cAAM,IAAI;AAAA,UACR,gBAAgB,YAAY,OAAO;AAAA,UACnC,IAAI;AAAA,YACF,CAAC,cAAc,KAAK;AAAA,YACpB;AAAA,UACF;AAAA,UACA,iBAAiB,8CAA8C,MAAM;AAAA,QACvE;AAAA,MACF;AACA,aAAO,eAAe;AACtB,YAAM,EAAE,QAAQ,KAAK,IAAI;AACzB,UAAI,SAAS,KAAK,WAAW;AAC3B,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,IACJ,CAAC;AACD,QAAI,cAAc,KAAK;AACrB,YAAM,IAAI,MAAM,mEAAmE;AACrF,WAAO,EAAE,WAAW,QAAQ,KAAK,OAAO;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAAsC;AAC9D,WAAO,eAAe;AACtB,UAAM,YAAY,KAAK;AACvB,UAAM,OAAO,MAAM,6CAA6C;AAAA,MAC9D,MAAM,KAAK,OAAO,iBAAiB,EAAE,UAAU,GAAG,EAAE,OAAO,CAAC;AAAA,MAC5D;AAAA,IACF;AACA,QAAI,CAAC,KAAK,UAAU,KAAK,WAAY,OAAM,IAAI,MAAM,mCAAmC;AACxF,QAAI,cAAc,KAAK;AACrB,YAAM,IAAI,MAAM,oDAAoD;AACtE,UAAM,WAAW,EAAE,QAAQ,KAAK,QAAQ,QAAQA,YAAW,EAAE;AAC7D,UAAM,uBAAuB,CAAC,UAC5B,CAAC,OAAO,aAAa,OAAO,iBAAiB,EAAE;AAAA,MAC5C,OAAoC,QAAQ;AAAA,IAC/C;AACF,UAAM,QAAQ,MAAMC,OAAM,KAAK,QAAW,EAAE,OAAO,CAAC;AACpD,WAAO,MAAM,KAAK,gBAAgB,KAAK,QAAQ,QAAQ,OAAO,WAAW;AACvE,iBAAS;AACP,eAAO,eAAe;AACtB,YAAI;AACF,gBAAM,OAAO;AAAA,YACX,EAAE,GAAG,UAAU,aAAa,CAAC,WAAW,GAAG,SAAS,QAAQ,KAAK,CAAC,EAAE;AAAA,YACpE;AAAA,UACF;AACA;AAAA,QACF,SAAS,OAAO;AACd,iBAAO,eAAe;AACtB,cAAI,iBAAiB,8CAA8C;AACjE,kBAAM,MAAM;AACZ;AAAA,UACF;AAIA,cACE,iBAAiB,kCACjB,iBAAiB;AAEjB,kBAAM;AACR;AAAA,QACF;AAAA,MACF;AACA,YAAM,UAAU;AAAA,QACd,QAAQ,EAAE,QAAQ,GAAG,KAAK,MAAM;AAAA,QAChC,QAAQ,EAAE,QAAQ,GAAG,KAAK,MAAM;AAAA,MAClC;AACA,iBAAS;AACP,eAAO,eAAe;AACtB,YAAI;AACF,qBAAW,UAAU,CAAC,UAAU,QAAQ,GAAY;AAClD,kBAAM,SAAS,QAAQ,MAAM;AAC7B,gBAAI,OAAO,IAAK;AAChB,kBAAM,OAAO,MAAM,OAAO,KAAK,UAAU,QAAQ,OAAO,QAAQ,KAAO,MAAM;AAC7E,mBAAO,UAAU,KAAK,MAAM;AAC5B,mBAAO,MAAM,KAAK;AAAA,UACpB;AACA,gBAAM,OAAO,MAAM,OAAO,KAAK,UAAU,MAAM;AAC/C,iBAAO,eAAe;AACtB,cAAI,SAAS,QAAQ,QAAQ,OAAO,OAAO,QAAQ,OAAO,IAAK,QAAO;AAAA,QACxE,SAAS,OAAO;AACd,iBAAO,eAAe;AACtB,cAAI,0BAA0B,KAAK;AACjC,kBAAM,IAAI,iCAAiC,KAAc;AAC3D,cAAI,CAAC,qBAAqB,KAAK,EAAG,OAAM;AAAA,QAC1C;AACA,cAAM,MAAM;AAAA,MACd;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA,EAIA,MAAM,mBACJ,SACA,QACA,WACmC;AACnC,2BAAuB,MAAM,OAAO;AACpC,UAAM,aAAa,QAAQ;AAC3B,QAAI,CAAC,cAAc,QAAQ,cAAc,KAAK;AAC5C,YAAM,IAAI,MAAM,4CAA4C;AAC9D,UAAM,MAAM,KAAK,UAAU;AAAA,MACzB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,WAAW;AAAA,MACX,WAAW;AAAA,MACX;AAAA,MACA,aAAa;AAAA,IACf,CAAC;AACD,QAAI,SAAS,KAAK,eAAe,IAAI,GAAG;AACxC,QAAI,CAAC,QAAQ;AACX,eAAS;AAAA,QACP,cAAc;AAAA,QACd,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,MAAM;AAAA,UACN,WAAW,QAAQ;AAAA,UACnB,QAAQ,QAAQ;AAAA,UAChB,QAAQD,YAAW;AAAA,UACnB,SAAS;AAAA,YACP,QAAQ,EAAE,YAAY,GAAG,eAAe,IAAI,KAAK,OAAO,UAAU,KAAK;AAAA,YACvE,QAAQ,EAAE,YAAY,GAAG,eAAe,IAAI,KAAK,OAAO,UAAU,KAAK;AAAA,UACzE;AAAA,QACF;AAAA,MACF;AACA,WAAK,eAAe,IAAI,KAAK,MAAM;AAAA,IACrC;AACA,UAAM,cAAc;AACpB,UAAMH,OAAM,YAA+C;AACzD,YAAM,SAAS,YAAY,QAAQ,GAAK;AACxC,UAAI,YAAY,cAAc;AAC5B,YAAI;AACF,gBAAM,KAAK,gBAAgB,QAAQ,QAAQ,QAAQ,OAAO,WAAW;AAGnE,wBAAY,eAAe;AAC3B,kBAAM,OAAO;AAAA,cACX;AAAA,gBACE,QAAQ,YAAY,QAAQ;AAAA,gBAC5B,QAAQ,YAAY,QAAQ;AAAA,gBAC5B,aAAa;AAAA,kBACX;AAAA,kBACA;AAAA,kBACA;AAAA,kBACA,WAAW;AAAA,kBACX;AAAA,kBACA,WAAW;AAAA,kBACX;AAAA,kBACA,WAAW;AAAA,kBACX;AAAA,kBACA;AAAA,kBACA,GAAI,YAAY,CAAC,aAAa,SAAS,IAAI,CAAC;AAAA,gBAC9C;AAAA,gBACA,SAAS;AAAA,gBACT,KAAK,CAAC;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF,CAAC;AAAA,QACH,SAAS,OAAO;AACd,cACE,YAAY,gBACZ,iBAAiB,uCACjB,iBAAiB,kCACjB,iBAAiB,8CACjB;AACA,iBAAK,eAAe,OAAO,GAAG;AAC9B,kBAAM;AAAA,UACR;AAGA,sBAAY,eAAe;AAC3B,gBAAM;AAAA,QACR;AAAA,MACF;AACA,UAAI;AACJ,UAAI;AACF,mBAAW,MAAM,KAAK,kBAAkB,YAAY,SAAS,MAAM,QAAQ,WAAW;AAAA,MACxF,SAAS,OAAO;AACd,YACE,YAAY,iBAAiB,UAC7B,iBAAiB;AAEjB,gBAAM,IAAI;AAAA,YACR,MAAM;AAAA,YACN,IAAI;AAAA,cACF,CAAC,YAAY,cAAc,KAAK;AAAA,cAChC;AAAA,YACF;AAAA,YACA,MAAM;AAAA,UACR;AACF,cAAM;AAAA,MACR;AACA,YAAM,EAAE,QAAQ,KAAK,IAAI;AAGzB,WAAK,eAAe,OAAO,GAAG;AAC9B,UAAI,SAAS,EAAG,OAAM,IAAI,MAAM,mCAAmC;AACnE,YAAM,SAAS,KAAK,MAAM,MAAM;AAChC,UAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,WAAW,WAAW,EAAE,SAAS,OAAO,KAAK;AACpE,cAAM,IAAI,MAAM,qCAAqC;AACvD,UAAI,OAAO,YAAY,QAAW;AAChC,eAAO,UAAU,0BAA0B,MAAM,OAAO,OAAO;AAC/D,YAAI,OAAO,QAAQ,iBAAiB,WAAW;AAC7C,gBAAM,IAAI,MAAM,wCAAwC;AAAA,MAC5D;AACA,UAAK,OAAO,UAAU,gBAAiB,QAAQ,OAAO,OAAO;AAC3D,cAAM,IAAI,MAAM,kDAAkD;AACpE,aAAO;AAAA,IACT;AACA,gBAAY,aAAaA,KAAI,EAAE,QAAQ,MAAM;AAC3C,aAAO,YAAY;AAAA,IACrB,CAAC;AACD,WAAO,MAAM,YAAY;AAAA,EAC3B;AAAA;AAAA;AAAA,EAIA,MAAc,kBACZ,UACA,OACA,QACA,aAC2C;AAC3C,UAAM,QAA4B,eAAe;AAAA,MAC/C,SAAS;AAAA,QACP,MAAM;AAAA,QACN,WAAW,KAAK;AAAA,QAChB,GAAG;AAAA,QACH,SAAS;AAAA,UACP,QAAQ,EAAE,YAAY,GAAG,eAAe,IAAI,KAAK,OAAO,UAAU,KAAK;AAAA,UACvE,QAAQ,EAAE,YAAY,GAAG,eAAe,IAAI,KAAK,OAAO,UAAU,KAAK;AAAA,QACzE;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,IACV;AACA,eAAS;AACP,UAAI;AACF,eAAO,eAAe;AACtB,cAAM,OAAO,MAAM,KAAK,KAAK,MAAM,SAAS,KAAK,MAAM;AACvD,cAAM,UAAU,KAAK;AACrB,YACE,MAAM,QAAQ,QAAQ,OAAO,aAAa,MAAM,QAAQ,QAAQ,OAAO,aACvE;AAEA,gBAAM,IAAI,MAAM,+CAA+C;AACjE,cAAM,UAAU,KAAK,OAClB,OAAO,CAAC,UAAU,MAAM,WAAW,QAAQ,EAC3C,IAAI,CAAC,UAAU,MAAM,IAAI,EACzB,KAAK,EAAE;AACV,YAAI,KAAK,aAAa,KAAM,QAAO,EAAE,QAAQ,MAAM,QAAQ,MAAM,KAAK,SAAS;AAAA,MACjF,SAAS,OAAO;AACd,YAAI,OAAO;AACT,gBAAM,IAAI;AAAA,YACR,gBAAgB,MAAM,OAAO;AAAA,YAC7B;AAAA,UACF;AACF,YACE,EAAE,iBAAiB,+CACnB,CAAC,MAAM;AAEP,gBAAM;AAAA,MACV;AACA,UAAI;AACF,cAAMI,OAAM,KAAK,QAAW,EAAE,OAAO,CAAC;AAAA,MACxC,SAAS,OAAO;AACd,cAAM,IAAI,2CAA2C,gBAAgB,MAAM,OAAO,GAAG,KAAK;AAAA,MAC5F;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,KACJ,SACA,QACA,QACkC;AAClC,2BAAuB,MAAM,OAAO;AACpC,QAAI,QAAQ,cAAc,KAAK;AAC7B,YAAM,IAAI,MAAM,+CAA+C;AACjE,YAAQ,MAAM,KAAK,WAAW,SAAS,QAAQ,MAAM,GAAG;AAAA,EAC1D;AAAA;AAAA;AAAA,EAIA,MAAM,QACJ,SACA,QACA,QAC6B;AAC7B,YAAQ,MAAM,KAAK,WAAW,SAAS,QAAQ,MAAM,GAAG;AAAA,EAC1D;AAAA,EAEA,MAAc,WACZ,OACA,QACA,QACuD;AACvD,UAAM,UAAU,gBAAgBC,4BAA2B,MAAM,KAAK,CAAC;AACvE,QAAI,QAAQ,cAAc,KAAK;AAC7B,YAAM,IAAI,MAAM,+CAA+C;AACjE,QAAI,CAAC,OAAO,SAAS,MAAM,KAAK,SAAS,KAAK,SAAS;AACrD,YAAM,IAAI,MAAM,kCAAkC;AACpD,YAAQ,eAAe;AACvB,UAAM,SAAS,QAAQ,QAAQ;AAC/B,UAAM,SAAS,QAAQ,QAAQ;AAC/B,QACE,OAAO,OACP,OAAO,OACP,OAAO,kBAAkB,MACzB,OAAO,kBAAkB,MACzB,OAAO,aAAa,QACpB,OAAO,aAAa,OAAO,UAC3B;AAIA,aAAO;AAAA,QACL;AAAA,QACA;AAAA,UACE,QAAQ,EAAE,OAAO,OAAO,MAAM,CAAC,GAAG,KAAK,KAAK;AAAA,UAC5C,QAAQ,EAAE,OAAO,OAAO,MAAM,CAAC,GAAG,KAAK,KAAK;AAAA,QAC9C;AAAA,QACA,EAAE,QAAQ,qBAAqB,MAAM,OAAO,SAAS;AAAA,MACvD;AAAA,IACF;AACA,UAAM,SAAS,IAAI,gBAAgB;AACnC,UAAM,QAAQ,MAAM,OAAO,MAAM,QAAQ,MAAM;AAC/C,YAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AACvD,QAAI,QAAQ,QAAS,OAAM;AAK3B,UAAM,WAAW,YAAY,IAAI,IAAI,KAAK,IAAI,GAAG,MAAM;AACvD,UAAM,UAAU;AAAA,MACd,MAAM,OAAO,MAAM,IAAI,MAAM,qCAAqC,CAAC;AAAA,MACnE,KAAK,IAAI,GAAG,MAAM,IAAI;AAAA,IACxB;AACA,QAAI;AACJ,QAAI;AACF,eAAS,UAAU,GAAG,UAAU,GAAG,WAAW;AAC5C,gBAAQ,eAAe;AACvB,YAAI,UAAU,KAAK,YAAY,IAAI,KAAK,SAAU;AAClD,YAAI;AACJ,YAAI;AACF,iBAAO,MAAM,KAAK;AAAA,YAChB;AAAA,YACA,KAAK,IAAI,KAAK,IAAI,GAAG,MAAM,GAAG,KAAK,IAAI,GAAG,WAAW,YAAY,IAAI,CAAC,CAAC;AAAA,YACvE,OAAO;AAAA,YACP;AAAA,UACF;AAAA,QACF,SAAS,OAAO;AACd,kBAAQ,eAAe;AACvB,cAAI,0BAA0B,KAAK,GAAG;AAKpC,kBAAM,IAAI;AAAA,cACR,gBAAgB,OAAO;AAAA,cACvB;AAAA,cACA;AAAA,YACF;AAAA,UACF;AACA,cAAI,CAAC,OAAO,OAAO,WAAW,CAAC,wCAAwC,KAAK,GAAG;AAI7E,gBAAI,+BAA+B,SAAS,KAAK,EAAE,SAAS;AAC1D,oBAAM,IAAI;AAAA,gBACR,gBAAgB,OAAO;AAAA,gBACvB;AAAA,gBACA;AAAA,cACF;AACF,kBAAM;AAAA,UACR;AACA,sBAAY;AACZ,cAAI,OAAO,OAAO,WAAW,YAAY,IAAI,KAAK,YAAY,YAAY,EAAG;AAC7E,cAAI;AACF,kBAAMD,OAAM,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG,WAAW,YAAY,IAAI,CAAC,CAAC,GAAG,QAAW;AAAA,cAC/E,QAAQ,OAAO;AAAA,YACjB,CAAC;AAAA,UACH,QAAQ;AACN,oBAAQ,eAAe;AACvB;AAAA,UACF;AACA;AAAA,QACF;AAQA,YAAI,cAAc,UAAa,iBAAiB,SAAS,IAAI,EAAG,QAAO;AACvE;AAAA,MACF;AACA,YAAM,IAAI,2CAA2C,gBAAgB,OAAO,GAAG,SAAS;AAAA,IAC1F,UAAE;AACA,mBAAa,OAAO;AACpB,cAAQ,oBAAoB,SAAS,KAAK;AAAA,IAC5C;AAAA,EACF;AAAA,EAEA,MAAc,eACZ,SACA,QACA,QACA,UACuD;AACvD,UAAM,eAAe,IAAI,gBAAgB;AACzC,UAAM,qBAAqB,IAAI,gBAAgB;AAC/C,UAAM,QAAQ,MAAM;AAClB,mBAAa,MAAM,OAAO,MAAM;AAChC,yBAAmB,MAAM,OAAO,MAAM;AAAA,IACxC;AACA,YAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AACvD,QAAI,QAAQ,QAAS,OAAM;AAC3B,UAAM,gBAAgB;AAAA,MACpB,MACE,mBAAmB;AAAA,QACjB,IAAI;AAAA,UACF,gBAAgB,OAAO;AAAA,UACvB,IAAI,MAAM,4CAA4C;AAAA,QACxD;AAAA,MACF;AAAA,MACF,KAAK,IAAI,GAAG,WAAW,YAAY,IAAI,CAAC;AAAA,IAC1C;AACA,QAAI;AACF,aAAO,MAAM,KAAK,WAAW,QAAQ,QAAQ,mBAAmB,QAAQ,OAAO,WAAW;AACxF,qBAAa,aAAa;AAC1B,2BAAmB,OAAO,eAAe;AACzC,eAAO,eAAe;AACtB,YAAI,YAAY,IAAI,KAAK;AACvB,gBAAM,IAAI;AAAA,YACR,gBAAgB,OAAO;AAAA,YACvB,IAAI,MAAM,qCAAqC;AAAA,UACjD;AACF,cAAM,gBAAgB,KAAK,IAAI,GAAG,KAAK,IAAI,QAAQ,WAAW,YAAY,IAAI,CAAC,CAAC;AAChF,cAAM,aAAa;AAAA,UACjB,GAAI,CAAC,UAAU,QAAQ,EAAY;AAAA,YAAI,OAAO,WAC5C,QAAQ,QAAQ,MAAM,EAAE,MACpB,EAAE,OAAO,OAAO,MAAM,CAAC,GAAG,KAAK,KAAK,IACpC,MAAM,OAAO;AAAA,cACX;AAAA,cACA;AAAA,cACA,QAAQ,QAAQ,MAAM,EAAE;AAAA,cACxB;AAAA,cACA,aAAa;AAAA,YACf;AAAA,UACN;AAAA,UACA,OAAO,KAAK,SAAS,aAAa,MAAM;AAAA,QAC1C;AACA,cAAM,UAAU,MAAM,QAAQ;AAAA,UAC5B,WAAW;AAAA,YAAI,CAAC,cACd,UAAU,MAAM,CAAC,UAAU;AACzB,2BAAa,MAAM,KAAK;AACxB,oBAAM;AAAA,YACR,CAAC;AAAA,UACH;AAAA,QACF;AACA,cAAM,SAAS,QAAQ,KAAK,CAAC,WAAW,OAAO,WAAW,UAAU;AAGpE,YAAI,QAAQ,WAAW,WAAY,OAAM,aAAa,OAAO,UAAU,OAAO;AAC9E,cAAM,SAAU,QAAQ,CAAC,EACtB;AACH,cAAM,SAAU,QAAQ,CAAC,EACtB;AACH,YAAI,OAAQ,QAAQ,CAAC,EAA4C;AACjE,YAAI,SAAS,QAAQ,OAAO,OAAO,OAAO;AACxC,iBAAO,MAAM,KAAK,aAAa,QAAQ,SAAS,aAAa,QAAQ,QAAQ;AAC/E,eAAO;AAAA,UACL;AAAA,UACA,EAAE,QAAQ,OAAO;AAAA,UACjB,EAAE,QAAQ,eAAe,MAAM,KAAK;AAAA,QACtC;AAAA,MACF,CAAC;AAAA,IACH,UAAE;AACA,mBAAa,aAAa;AAC1B,cAAQ,oBAAoB,SAAS,KAAK;AAAA,IAC5C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAc,aACZ,QACA,SACA,QACA,UACwB;AACxB,QAAI,QAAQ;AACZ,eAAS;AACP,aAAO,eAAe;AACtB,YAAM,SAAS,WAAW,YAAY,IAAI;AAC1C,UAAI,UAAU,EAAG,QAAO;AACxB,UAAI;AACJ,UAAI;AACF,eAAO,MAAM,OAAO;AAAA,UAClB;AAAA,UACA,YAAY,IAAI,CAAC,QAAQ,YAAY,QAAQ,KAAK,KAAK,MAAM,IAAI,eAAe,CAAC,CAAC;AAAA,QACpF;AAAA,MACF,QAAQ;AACN,eAAO,eAAe;AACtB,eAAO;AAAA,MACT;AACA,UAAI,SAAS,KAAM,QAAO;AAC1B,YAAM,YAAY,WAAW,YAAY,IAAI;AAC7C,UAAI,aAAa,EAAG,QAAO;AAC3B,UAAI;AACF,cAAMA,OAAM,KAAK,IAAI,OAAO,SAAS,GAAG,QAAW,EAAE,OAAO,CAAC;AAAA,MAC/D,QAAQ;AACN,eAAO,eAAe;AACtB,eAAO;AAAA,MACT;AACA,cAAQ,KAAK,IAAI,QAAQ,GAAG,GAAG;AAAA,IACjC;AAAA,EACF;AAAA,EAEA,MAAM,UACJ,SACA,QACA,cACkC;AAClC,WAAO,MAAM,KAAK,KAAK,SAAS,QAAQ,aAAa,MAAM;AAAA,EAC7D;AAAA,EAEA,MAAM,MAAM,SAA+B,OAAe,OAA8B;AACtF,2BAAuB,MAAM,OAAO;AACpC,QAAI,QAAQ,cAAc,KAAK;AAC7B,YAAM,IAAI,MAAM,+CAA+C;AACjE,UAAM,KAAK;AAAA,MAAW,QAAQ;AAAA,MAAQ;AAAA,MAAW,CAAC,WAChD,OAAO,MAAM,SAAS,OAAO,OAAO,KAAK,KAAK,CAAC;AAAA,IACjD;AAAA,EACF;AACF;;;AIr+BA,SAAS,eAAoE;;;ACtB7E,SAAS,cAAAE,mBAAkB;AAO3B,IAAM,cAAc;AACpB,IAAM,gBAAgB;AAUf,SAAS,yBAAyB,aAA6B;AACpE,MAAI,CAAC,kEAAkE,KAAK,WAAW,GAAG;AACxF,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,SAAO,mBAAmB,WAAW;AACvC;AAcO,SAAS,kCAAkC,OAI9B;AAClB,QAAM,OAAO,yBAAyB,MAAM,WAAW;AACvD,MAAI,YAAY;AAChB,SAAO,gBAAgB,4BAA4B,MAAM,SAAS;AAChE,QAAI,KAAK,OAAO,SAAS,YAAa,QAAO,OAAO,KAAK,KAAK,KAAK,SAAS,OAAO;AACnF,QAAI,KAAK,iBAAiB,KAAK,gBAAgB;AAC7C,YAAM,IAAI,MAAM,yDAAyD;AAAA,IAC3E;AACA,QAAI;AACF,YAAM,IAAI,MAAM,oEAAoE;AACtF,UAAM,UAAU,KAAK;AAKrB,QACE,OAAO,QAAQ,UAAU,YACzB,CAAC,QAAQ,SACT,OAAO,QAAQ,YAAY,YAAY,YACvC,CAAC,QAAQ,WAAW,WACnB,QAAQ,WAAW,QAAQ,QAAQ,WAAW,SAAS,QACxD,CAAC,MAAM,QAAQ,QAAQ,IAAI,KAC3B,QAAQ,KAAK;AAAA,MACX,CAAC,QAAQ,IAAI,YAAY,iBAAiB,IAAI,aAAa,MAAM;AAAA,IACnE,GACA;AACA,YAAM,IAAI,MAAM,sEAAsE;AAAA,IACxF;AACA,UAAM,cAAc;AAAA,MAClB,GAAG;AAAA,MACH,YAAY,EAAE,GAAG,QAAQ,YAAY,KAAK;AAAA,MAC1C,MAAM;AAAA,QACJ,GAAG,QAAQ,KAAK,OAAO,CAAC,QAAQ,IAAI,YAAY,aAAa;AAAA,QAC7D,EAAE,SAAS,eAAe,UAAU,MAAM,YAAY;AAAA,MACxD;AAAA,IACF;AACA,UAAM,SAA4B;AAAA,MAChC,aAAa,MAAM;AAAA,MACnB;AAAA,MACA,OAAO,QAAQ;AAAA,MACf,SAAS,QAAQ,WAAW;AAAA,MAC5B,eAAeA,YAAW,QAAQ,EAAE,OAAO,KAAK,UAAU,WAAW,CAAC,EAAE,OAAO,KAAK;AAAA,IACtF;AACA,gBAAY;AACZ,UAAM,MAAM,eAAe,MAAM;AAGjC,UAAM,kBAAkB,EAAE,GAAG,SAAS,SAAS,EAAE;AACjD,UAAM,WAAW,OAAO,KAAK,KAAK,aAAoC,eAAe;AACrF,UAAM,aAAc,UAA6C;AACjE,QAAI,OAAO,eAAe,YAAY,CAAC,WAAW,WAAW,KAAK,GAAG;AACnE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAGA,UAAM,MAAM,UAAU,EAAE,GAAG,QAAQ,WAAW,CAAC;AAC/C,WAAO;AAAA,EACT;AACF;;;ACrGA,SAAS,qBAAAC,0BAAyB;AAClC,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,eAAAC,oBAAyC;AAMlD,IAAMC,eAAc;AAYpB,IAAM,mBAAmB,IAAIH,mBAAiC;AAUvD,IAAM,wBAAyC,iBAAiB,MAAM,SAAS;AACpF,QAAM,QAAQ,iBAAiB,SAAS;AACxC,MAAI,OAAO,OAAQ,QAAO,OAAO,MAAM,WAAW,MAAM,OAAO;AAC/D,MAAI,KAAK,OAAO,SAASG,cAAa;AACpC,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACA,SAAO,OAAO,KAAK,KAAK,KAAK,SAAS,OAAO;AAC/C;AAEA,IAAM,UAAU,oBAAI,IAAyB;AAE7C,SAAS,UAAU,SAA2C;AAC5D,SAAO,KAAK,UAAU;AAAA,IACpB,QAAQ,WAAW;AAAA,IACnB,QAAQ,cAAcF,YAAW,QAAQ,EAAE,OAAO,QAAQ,WAAW,EAAE,OAAO,KAAK,IAAI;AAAA,IACvF,QAAQ,eAAe;AAAA,IACvB,QAAQ,YAAY;AAAA,IACpB,QAAQ,uBAAuB;AAAA,EACjC,CAAC;AACH;AAUO,SAAS,kBAAkB,SAAgD;AAChF,QAAM,MAAM,UAAU,OAAO;AAC7B,QAAM,WAAW,QAAQ,IAAI,GAAG;AAChC,MAAI,SAAU,QAAO;AACrB,QAAM,SAAS,IAAIC,aAAY;AAAA,IAC7B,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;AAAA,IACtD,GAAI,QAAQ,cAAc,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,IAClE,GAAI,QAAQ,cAAc,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,IAClE,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,IACzD,gBAAgB,CAAC,qBAAqB;AAAA,EACxC,CAAC;AAED,QAAM,YAAY;AAGlB,MAAI,QAAQ,wBAAwB,UAAa,UAAU,qBAAqB;AAC9E,UAAM,WAAW,UAAU,oBAAoB,KAAK,MAAM;AAC1D,cAAU,sBAAsB,CAAC,YAC/B,SAAS,WAAW,QAAQ,mBAAmB;AAAA,EACnD;AACA,UAAQ,IAAI,KAAK,MAAM;AACvB,SAAO;AACT;AAOA,eAAsB,wBACpB,YACAE,MACY;AACZ,QAAM,QAAuB,EAAE,YAAY,QAAQ,KAAK;AACxD,MAAI;AACF,WAAO,MAAM,iBAAiB,IAAI,OAAOA,IAAG;AAAA,EAC9C,UAAE;AACA,UAAM,SAAS;AAAA,EACjB;AACF;AAEA,IAAM,mBAAmB,KAAK;AAC9B,IAAM,OAAO,oBAAI,QAA4E;AAI7F,eAAsB,eACpB,QACA,SACA,QACc;AACd,MAAI,SAAS,KAAK,IAAI,MAAM;AAC5B,MAAI,CAAC,OAAQ,MAAK,IAAI,QAAS,SAAS,oBAAI,IAAI,CAAE;AAClD,QAAM,MAAM,KAAK,UAAU,CAAC,SAAS,OAAO,eAAe,IAAI,OAAO,oBAAoB,IAAI,CAAC;AAC/F,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,MAAM,OAAO,IAAI,GAAG;AAC1B,MAAI,OAAO,IAAI,YAAY,IAAK,QAAO,MAAM,IAAI;AACjD,QAAM,MAAM,OAAO,KAAK,SAAS,SAAS;AAAA,IACxC,GAAI,OAAO,cAAc,EAAE,aAAa,OAAO,YAAY,IAAI,CAAC;AAAA,IAChE,GAAI,OAAO,oBAAoB,SAAY,EAAE,iBAAiB,OAAO,gBAAgB,IAAI,CAAC;AAAA,EAC5F,CAAC;AACD,QAAM,QAAQ,EAAE,WAAW,MAAM,kBAAkB,IAAI;AACvD,SAAO,IAAI,KAAK,KAAK;AACrB,MAAI;AACF,WAAO,MAAM;AAAA,EACf,SAAS,OAAO;AACd,QAAI,OAAO,IAAI,GAAG,MAAM,MAAO,QAAO,OAAO,GAAG;AAChD,UAAM;AAAA,EACR;AACF;AAEA,IAAM,SAAS,oBAAI,QAAkD;AAQrE,eAAsB,iBACpB,QACA,KACA,UACgB;AAChB,MAAI,QAAQ,OAAO,IAAI,MAAM;AAC7B,MAAI,CAAC,MAAO,QAAO,IAAI,QAAS,QAAQ,oBAAI,IAAI,CAAE;AAClD,QAAM,MAAM,GAAG,SAAS,IAAI,IAAI,IAAI,mBAAmB,EAAE,IAAI,SAAS,KAAK;AAC3E,QAAM,MAAM,MAAM,IAAI,GAAG;AACzB,MAAI,IAAK,QAAO,MAAM;AACtB,QAAM,QACJ,SAAS,SAAS,OACd,OAAO,OAAO,OAAO,SAAS,KAAK,IACnC,OAAO,OAAO,aAAa,SAAS,KAAK,EAAE,MAAM,GAAG;AAC1D,QAAM,IAAI,KAAK,KAAK;AACpB,MAAI;AACF,WAAO,MAAM;AAAA,EACf,SAAS,OAAO;AACd,QAAI,MAAM,IAAI,GAAG,MAAM,MAAO,OAAM,OAAO,GAAG;AAC9C,UAAM;AAAA,EACR;AACF;;;AFhIA,SAAS,gBAAAC,qBAAoB;AAG7B,IAAM,0BAAsD,EAAE,QAAQ;AAAC,EAAE;AAgBzE,eAAsB,0BACpB,SACA,OACA,OACgB;AAChB,MAAI;AACF,QAAI,WAAW,+BAA+B,KAAK,GAAG;AACpD,UAAI;AACF,cAAM,QAAQ,MAAM;AAAA,MACtB,SAAS,cAAc;AAErB,cAAM,IAAI;AAAA,UACR,CAAC,OAAO,YAAY;AAAA,UACpB;AAAA,UACA,EAAE,OAAO,aAAa;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAAA,EACF,UAAE;AACA,UAAM,MAAM;AAAA,EACd;AACA,QAAM;AACR;AAEA,SAAS,QACP,OAGA;AACA,SAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,UAAU,MAAS,CAAC;AAG5F;AAEA,SAAS,YAAY,SAAwB;AAC3C,QAAM,IAAI,+BAA+B,iCAAiC,OAAO,IAAI;AAAA,IACnF,UAAU;AAAA,IACV;AAAA,EACF,CAAC;AACH;AAEA,SAAS,iBAAiB,UAA0B;AAClD,MAAI,SAAS,MAAM,OAAQ,aAAY,gBAAgB;AACvD,MAAI,SAAS,OAAO,OAAQ,aAAY,iBAAiB;AACzD,MAAI,SAAS,gBAAgB,OAAQ,aAAY,0BAA0B;AAC3E,aAAW,EAAE,MAAM,KAAK,SAAS,YAAY,GAAG;AAC9C,QAAI,MAAM,gBAAgB,OAAW,aAAY,mBAAmB;AACpE,QAAI,MAAM,UAAU,OAAW,aAAY,aAAa;AACxD,QAAI,QAAQ,KAAK,KAAK,CAAC,6BAA6B,KAAK,EAAG,aAAY,qBAAqB;AAAA,EAC/F;AACF;AAEA,SAAS,cAAc,UAA8B;AACnD,QAAM,UAAU,CAAC,WACf,OAAO;AAAA,IACL,OAAO,QAAQ,MAAM,EAClB,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,QAAQ,KAAK,CAAC,EACrC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;AAAA,MACtB;AAAA,MACA,MAAM,SAAS,SAAS,MAAM,WAC1B,EAAE,GAAG,gBAAgB,KAAK,GAAG,UAAU,QAAQ,MAAM,QAAQ,EAAE,IAC/D,gBAAgB,KAAK;AAAA,IAC3B,CAAC;AAAA,EACL;AACF,SAAO,IAAI,SAAS;AAAA,IAClB,SAAS,SAAS;AAAA,IAClB,MAAM,SAAS;AAAA,IACf,SAAS,QAAQ,SAAS,OAAO;AAAA,IACjC,aAAa,OAAO;AAAA,MAClB,OAAO,QAAQ,SAAS,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,MAAM,KAAK,CAAC,CAAC;AAAA,IAChF;AAAA,IACA,OAAO,gBAAgB,SAAS,KAAK;AAAA,IACrC,QAAQ,gBAAgB,SAAS,MAAM;AAAA,IACvC,iBAAiB,gBAAgB,SAAS,eAAe;AAAA,IACzD,6BAA6B,CAAC,GAAG,SAAS,2BAA2B;AAAA,EACvE,CAAC;AACH;AAGA,eAAsB,8BACpB,OACA,QACA,mBAEA,gBAAmC,UACoB;AACvD,QAAM,SAA2C,CAAC;AAClD,aAAW,EAAE,OAAO,UAAU,KAAK,OAAO,aAAa,GAAG;AACxD,QAAI,CAAC,6BAA6B,KAAK,GAAG;AACxC,UAAI,kBAAkB,OAAQ;AAC9B,kBAAY,qBAAqB;AAAA,IACnC;AACA,UAAM,SAAS;AAAA,MACb;AAAA,MACA,QAAQ;AAAA,QACN,YAAY,mBAAmB,MAAM,eAAe,YAAY,KAAK;AAAA,QACrE,uBAAuB,mBAAmB,MAAM,eAAe,uBAAuB;AAAA,MACxF,CAAC;AAAA,IACH;AACA,UAAM,SAAS,OAAO,aAClB,MAAM,MAAM,QAAQ;AAAA,MAClB,OAAO;AAAA,MACP,QAAQ;AAAA,QACN,aAAa,OAAO;AAAA,MACtB,CAAC;AAAA,IACH,IACA,OAAO,cACL,MAAM,MAAM,QAAQ,WAAW,OAAO,WAAW,IACjD;AACN,WAAO,SAAS,IAAI,MAAM,kBAAkB;AAAA,MAC1C,OAAO;AAAA,MACP,QAAQ;AAAA,QACN,mBAAmB,OAAO;AAAA,QAC1B,WAAW,OAAO;AAAA,QAClB,UAAU,OAAO;AAAA,QACjB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO,OAAO,KAAK,MAAM,EAAE,SAAS,SAAS;AAC/C;AAMA,eAAsB,gCACpB,UACA,MACA,WACA,eAC8B;AAC9B,QAAM,SAAS,iCAAiC,IAAI;AACpD,MAAI,OAAO,aAAa,OAAW,aAAY,UAAU;AACzD,QAAM,YAAY,OAAO;AACzB,QAAM,UAAU,EAAE,GAAG,SAAS;AAC9B,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,aAAa,CAAC,CAAC,GAAG;AAC1D,QAAI,UAAU,QAAQ,UAAU,OAAW,QAAO,OAAO,SAAS,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC;AAAA,EACpF;AACA,UAAQ,MAAM,EAAE,GAAG,SAAS,KAAK,GAAG,WAAW,IAAI;AACnD,MAAI,QAAQ,QAAS,aAAY,8CAA8C;AAC/E,MAAI,CAAC,QAAQ,SAAS,KAAK,EAAG,OAAM,IAAI,MAAM,2CAA2C;AACzF,MACE,QAAQ,gCAAgC,UACxC,CAAC,QAAQ,4BAA4B,KAAK,GAC1C;AACA,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AACA,QAAM,uBAAuB,QAAQ,wBAAwB;AAC7D,MAAI,CAAC,CAAC,OAAO,uBAAuB,oBAAoB,EAAE,SAAS,oBAAoB;AACrF,gBAAY,sBAAsB;AACpC,aAAW,OAAO;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAAY;AACV,UAAM,QAAQ,QAAQ,GAAG;AACzB,QAAI,UAAU,WAAc,CAAC,OAAO,SAAS,KAAK,KAAK,SAAS;AAC9D,YAAM,IAAI,MAAM,SAAS,GAAG,mBAAmB;AAAA,EACnD;AACA,MACE,QAAQ,YAAY,WACnB,CAAC,MAAM,QAAQ,QAAQ,OAAO,KAC7B,QAAQ,QAAQ,WAAW,KAC3B,QAAQ,QAAQ,KAAK,CAAC,WAAW,OAAO,WAAW,YAAY,CAAC,OAAO,KAAK,CAAC,IAC/E;AACA,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,QAAM,WAAW,OAAO;AACxB,mBAAiB,QAAQ;AAEzB,aAAW,EAAE,MAAM,KAAK,SAAS,aAAa,GAAG;AAC/C;AAAA,MACE;AAAA,MACA,QAAQ;AAAA,QACN,YACE,mBAAmB,MAAM,eAAe,YAAY,KACpD,QAAQ;AAAA,QACV,uBAAuB,mBAAmB,MAAM,eAAe,uBAAuB;AAAA,MACxF,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI;AACJ,MAAI,WAAW;AACf,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,QAAM,QAAQ;AAAA,IACZ,QAAQ;AAAA,MACN,SAAS,QAAQ;AAAA,MACjB,aAAa,QAAQ;AAAA,MACrB,aAAa,QAAQ;AAAA,MACrB,UAAU,QAAQ;AAAA,MAClB,qBAAqB,QAAQ;AAAA,IAC/B,CAAC;AAAA,EACH;AAGA,QAAM,iBAAiB,kCAAkC;AAAA,IACvD,aAAa,OAAO,WAAW;AAAA,IAC/B,gBAAgB,OAAO,WAAW;AAChC,UAAI,SAAU,OAAM,IAAI,MAAM,+CAA+C;AAC7E,YAAM,UAAU,eAAe,QAAQ,EAAE,MAAM,CAAC;AAAA,IAClD;AAAA,IACA,WAAW,OAAO,YAAY;AAC5B,YAAM,kBAAkB;AAAA,QACtB;AAAA,QACA;AAAA,QACA,SAAS,IAAI,QAAQ,OAAO,QAAQ,UAAU;AAAA,QAC9C,aAAa;AAAA,QACb,OAAO,EAAE,GAAG,OAAO,WAAW,QAAQ,YAAY,SAAS,QAAQ,QAAQ;AAAA,QAC3E;AAAA,QACA,2BAA2B,YACzB,MAAM,cAAc,SAAS,MAAM,YAAY,QAAQ;AAAA,QACzD,mBAAmB,OAAO;AAAA,QAC1B,eAAe,OAAO;AAAA,MACxB;AAGA,gBAAU;AAAA,QACR,IAAI;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,YAAM,UAAU,UAAU,SAAS,OAAO;AAAA,IAC5C;AAAA,EACF,CAAC;AACD,QAAM,gBAAgB,OAAO,WAC3B,MAAM,8BAA8B,OAAO,QAAQ,QAAQ,2BAA2B;AACxF,MAAI;AACF,UAAM,MAAM;AAAA,MACV;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN,iBAAiB;AAAA,QACjB,aAAa,QAAQ;AAAA,MACvB,CAAC;AAAA,IACH;AACA,UAAM,cAAc,MAAM,uBAAuB,UAAU,QAAQ,GAAG;AACtE,UAAM,WACJ,QAAQ,SAAS,mBAAmB,QAAQ,QAAQ,YAAY,sBAAsB;AACxF,QAAI;AACJ,QAAI,SAAS,SAAS,QAAS,SAAQ,SAAS;AAAA,aACvC,OAAO,SAAS,UAAU,YAAY,CAAC,SAAS,MAAM,KAAK;AAClE,YAAM,IAAI,MAAM,wCAAwC;AAAA,aACjD,SAAS,SAAS,QAAQ,SAAS,SAAS;AACnD,cAAQ,MAAM,iBAAiB,OAAO,KAAK,EAAE,MAAM,SAAS,MAAM,OAAO,SAAS,MAAM,CAAC;AAAA,QACtF,OAAM,IAAI,MAAM,kCAAkC;AACvD,QAAI,OAAO,OAAO,UAAU;AAC1B,YAAM,IAAI,MAAM,8CAA8C;AAChE,wBAAoB,MAAM,cAAc,QAAQ;AAChD,YAAQ;AAAA,MACN;AAAA,MACA,aAAa;AAAA,MACb,SAAS,QAAQ;AAAA,MACjB,UACE,SAAS,SAAS,QACb,SAAS,QACT,QAAQ,YAAY;AAAA,MAC3B,uBAAuB,QAAQ;AAAA,MAC/B;AAAA,MACA,6BAA6B,QAAQ;AAAA,MACrC,oCAAoC,QAAQ;AAAA,MAC5C;AAAA,MACA,WAAW,QAAQ;AAAA,MACnB,eAAe,QAAQ;AAAA,MACvB,KAAK,QAAQ;AAAA,MACb,WAAW,QAAQ;AAAA,MACnB,KAAK,QAAQ;AAAA,MACb,wBAAwB,QAAQ;AAAA,MAChC,kBAAkB,QAAQ;AAAA,MAC1B,UAAU,QAAQ;AAAA,MAClB,qBAAqB,QAAQ;AAAA,MAC7B,6BAA6B,QAAQ;AAAA,MACrC,aAAa,QAAQ,eAAe;AAAA,IACtC;AAGA,UAAM,iBAAiB;AAAA,MAAwB;AAAA,MAAgB,MAC7D,MAAM,UAAU;AAAA,QACd;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,UACN,SAAS,SAAS;AAAA,UAClB,KAAK;AAAA,UACL,SAAS,MAAM,cAAc,CAAC,SAAS,UAAU,IAAI;AAAA,UACrD,WAAW,QAAQ;AAAA,UACnB,eAAe,QAAQ;AAAA,UACvB,KAAK,QAAQ;AAAA,UACb,WAAW,QAAQ;AAAA,UACnB,KAAK,QAAQ;AAAA,UACb,gBAAgB,QAAQ;AAAA,UACxB;AAAA,UACA,SAAS,QAAQ,UAAU,CAAC,GAAG,QAAQ,OAAO,IAAI;AAAA,QACpD,CAAC;AAAA,MACH;AAAA,IACF;AACA,QAAI;AACJ,QAAI;AACF,aAAO,QAAQ,0BAA0B,SACrC,iBACA,QAAQ,KAAK;AAAA,QACX;AAAA,QACA,IAAI,QAAe,CAAC,GAAG,WAAW;AAChC,kBAAQ,WAAW,MAAM;AACvB,uBAAW;AACX;AAAA,cACE,IAAI,MAAM,mEAAmE;AAAA,YAC/E;AAAA,UACF,GAAG,QAAQ,wBAAyB,GAAI;AAAA,QAC1C,CAAC;AAAA,MACH,CAAC;AAAA,IACP,UAAE;AACA,UAAI,MAAO,cAAa,KAAK;AAG7B,UAAI;AACF,aAAK,eACF;AAAA,UACC,YAAY;AACV,kBAAM,SAAS,MAAM;AAAA,UACvB;AAAA,UACA,YAAY;AACV,kBAAM,SAAS,MAAM;AAAA,UACvB;AAAA,QACF,EACC,MAAM,MAAM;AACX,gBAAM,OAAO;AAAA,YACX;AAAA,UACF;AAAA,QACF,CAAC;AAAA,IACP;AACA,QAAI,CAAC,QAAS,OAAM,IAAI,MAAM,8DAA8D;AAC5F,UAAM,QAAQ,cAAc,cAAc,QAAQ,CAAC;AACnD,WAAO;AAAA,EACT,SAAS,OAAO;AAGd,QAAI,CAAC,UAAU;AACb,aAAO,MAAM,0BAA0B,SAAS,yBAAyB,KAAK;AAAA,IAChF;AACA,UAAM;AAAA,EACR;AACF;AAKA,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAC5B,OAAO;AAC3B;AAIA,eAAe,uBACb,WACA,SACAC,MACY;AACZ,MAAI;AACF,WAAO,MAAMA,KAAI;AAAA,EACnB,SAAS,OAAO;AACd,QAAI,iBAAiB,4BAA6B,OAAM;AACxD,UAAM,QAAQD,cAAa,KAAK;AAChC,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF,gCAAgC,SAAS,GAAG,QAAQ,KAAK,KAAK,KAAK,EAAE;AAAA,QACrE,EAAE,UAAU,SAAS,WAAW,GAAG,SAAS,MAAM;AAAA,MACpD;AAAA,MACA,EAAE,OAAO,MAAM;AAAA,IACjB;AAAA,EACF;AACF;AAQA,eAAsB,iCACpB,UACA,OAC8B;AAC9B,8BAA4B,KAAK;AACjC,MAAI,CAAC,MAAM,WAAW;AACpB,UAAM,IAAI,4BAA4B,sDAAsD;AAAA,EAC9F;AACA,QAAM,YAAY,MAAM;AACxB,QAAM,QAAQ;AAAA,IACZ,QAAQ;AAAA,MACN,SAAS,SAAS;AAAA,MAClB,aAAa,SAAS;AAAA,MACtB,aAAa,MAAM,oBAAoB,SAAS;AAAA,MAChD,UAAU,MAAM,YAAY,SAAS;AAAA,MACrC,qBAAqB,MAAM,uBAAuB,SAAS;AAAA,IAC7D,CAAC;AAAA,EACH;AACA,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA,EAAE,UAAU;AAAA,IACZ,YAAY,MAAM,MAAM,UAAU,OAAO,SAAS;AAAA,EACpD;AACA,QAAM,cAAc,MAAM,gBAAgB;AAC1C,QAAM,MACJ,eAAe,MAAM,yBAAyB,wBAC1C,MAAM;AAAA,IACJ;AAAA,IACA,EAAE,SAAS,MAAM,QAAQ;AAAA,IACzB,YACE,MAAM;AAAA,MACJ;AAAA,MACA,MAAM;AAAA,MACN,QAAQ,EAAE,iBAAiB,aAAa,aAAa,MAAM,iBAAiB,CAAC;AAAA,IAC/E;AAAA,EACJ,IACA,CAAC;AACP,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA,EAAE,UAAU;AAAA,IACZ,YAAY,MAAM,QAAQ,KAAK;AAAA,EACjC;AACA,MAAI,aAAa,MAAM;AACrB,UAAM,IAAI,4BAA4B,iBAAiB,MAAM,SAAS,wBAAwB;AAAA,EAChG;AACA,QAAM,kBAAkB;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,2BAA2B,YACzB,MAAM;AAAA,MACJ;AAAA,MACA,MAAM;AAAA,MACN,MAAM,+BAA+B,SAAS;AAAA,MAC9C;AAAA,IACF;AAAA,IACF,eAAe,SAAS;AAAA,EAC1B;AACA,SAAO,IAAI;AAAA,IACT;AAAA,EACF;AACF;;;AR9bA,IAAM,2BAA2B;AACjC,IAAM,6BAA6B;AACnC,IAAM,6BAA6B;AAQnC,IAAM,qCAAqC,IAAI;AA6CxC,SAAS,mCACd,OACwB;AACxB,SAAO;AAAA,IACL,2BAA2B,MAAM;AAAA,IACjC,2BAA2B,MAAM;AAAA,IACjC,uBAAuB,MAAM;AAAA,EAC/B;AACF;AAEO,SAAS,4BACd,OACwB;AACxB,SAAO;AAAA,IACL,UAAU;AAAA,IACV,mBAAmB,MAAM;AAAA,IACzB,uBAAuB,MAAM;AAAA,IAC7B,2BAA2B,MAAM;AAAA,EACnC;AACF;AAiDA,IAAM,gCAAgC,oBAAI,QAAgB;AAC1D,IAAM,mCAAmC,oBAAI,QAAgB;AAC7D,IAAM,2CAA2C,oBAAI,QAAgB;AACrE,IAAM,0CAA0C,oBAAI,QAAgB;AACpE,IAAM,0BAA0B,oBAAI,QAAwB;AAC5D,IAAM,iCAAiC,oBAAI,QAAoC;AAC/E,IAAM,0BAA0B;AAYhC,SAAS,2BAA2B,MAAcE,gBAA+B;AAC/E,MAAI,CAAC,KAAK,WAAW,GAAG,EAAG,QAAO;AAClC,QAAM,OAAOA,eAAc,QAAQ,QAAQ,EAAE,KAAK;AAClD,QAAM,aAAa,KAAK,QAAQ,QAAQ,EAAE,KAAK;AAC/C,MAAI,eAAe,KAAM,QAAO;AAChC,MAAI,SAAS,IAAK,QAAO,WAAW,MAAM,CAAC;AAC3C,MAAI,WAAW,WAAW,GAAG,IAAI,GAAG,EAAG,QAAO,WAAW,MAAM,KAAK,SAAS,CAAC;AAC9E,QAAM,IAAI,MAAM,qDAAqD,IAAI,EAAE;AAC7E;AAEA,SAAS,2BAA2B,MAAcA,gBAA+B;AAC/E,QAAM,OAAOA,eAAc,QAAQ,QAAQ,EAAE,KAAK;AAClD,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,SAAS,MAAM,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,IAAI;AACpD;AAEA,SAAS,iCAAiC,SAA2C;AACnF,MAAI,OAAO,QAAQ,YAAY,WAAY;AAC3C,QAAM,cAAc,QAAQ;AAC5B,QAAM,aAAa,QAAQ,YAAY,KAAK,OAAO;AACnD,QAAM,YAAY,QAAQ,6BAA6B,KAAK,OAAO;AACnE,MAAI,OAAO,gBAAgB,cAAc,OAAO,QAAQ,aAAa,WAAY;AACjF,QAAMA,iBAAgB,QAAQ,OAAO,UAAU;AAC/C,MAAI,CAACA,gBAAe;AAClB,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACA,UAAQ,UAAU,OAAO,MAAM,kBAAkB;AAC/C,UAAM,sBAAsB,KAAK,KAAK,WAAW,GAAG;AACpD,UAAM,eAAe,2BAA2B,KAAK,MAAMA,cAAa;AAIxE,UAAM,UAAU,IAAI,uBAAuB;AAAA,MACzC,SAAS;AAAA,QACP,aAAa,YAAY,KAAK,OAAO;AAAA,QACrC,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,QACnC,GAAI,YAAY,EAAE,6BAA6B,UAAU,IAAI,CAAC;AAAA,QAC9D,GAAI,QAAQ,2BACR,EAAE,0BAA0B,QAAQ,yBAAyB,KAAK,OAAO,EAAE,IAC3E,CAAC;AAAA,MACP;AAAA,MACA,GAAI,gBAAgB,EAAE,cAAc,IAAI,CAAC;AAAA,MACzC,eAAAA;AAAA,MACA,GAAI,KAAK,QAAQ,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,IAC5C,CAAC;AACD,UAAM,SAAS,MAAM;AAAA,MAAuC;AAAA,MAA4B,MACtF,QAAQ,OAAO;AAAA,QACb,MAAM;AAAA,QACN,OAAO;AAAA,QACP,YAAY;AAAA,QACZ,eAAe;AAAA,MACjB,CAAC;AAAA,IACH;AACA,QAAI,OAAO,aAAa,OAAO,KAAK,WAAW;AAC7C,YAAM,IAAI;AAAA,QACR,8BAA8B,0BAA0B;AAAA,MAC1D;AAAA,IACF;AACA,YAAQ,OAAO,KAAK,YAAY,CAAC,GAAG,IAAI,CAAC,WAAW;AAAA,MAClD,MAAM,MAAM;AAAA,MACZ,MAAM,sBACF,2BAA2B,MAAM,MAAMA,cAAa,IACpD,MAAM;AAAA,MACV,MAAM,MAAM,SAAS,UAAU,MAAM,SAAS,QAAQ,MAAM,OAAO;AAAA,IACrE,EAAE;AAAA,EACJ;AACF;AAEA,IAAM,8BACJ;AACF,IAAM,uCACJ;AACF,IAAM,wCAAwC;AAC9C,IAAM,wCAAwC;AAC9C,IAAM,mDAAmD;AAEzD,SAAS,gBAAgB,OAA+B;AACtD,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,SAAU,QAAO;AACnE,QAAMC,UAAS,OAAO,KAAK;AAC3B,SAAO,OAAO,UAAUA,OAAM,KAAKA,WAAU,OAAOA,WAAU,MAAMA,UAAS;AAC/E;AAEA,SAAS,gCAAgC,QAA0C;AACjF,QAAM,OAAO,CAAC,UAAU,cAAc,cAAc,gBAAgB;AACpE,QAAM,SAAS,KAAK,IAAI,CAAC,QAAQ,yBAAyB,QAAQ,GAAG,CAAC;AACtE,QAAM,WAAW,yBAAyB,QAAQ,UAAU;AAC5D,MAAI,YAAY,OAAO,aAAa,UAAU;AAC5C,WAAO,KAAK,GAAG,KAAK,IAAI,CAAC,QAAQ,yBAAyB,UAAU,GAAG,CAAC,CAAC;AAAA,EAC3E;AACA,SAAO,OAAO,KAAK,CAAC,UAAU,gBAAgB,KAAK,MAAM,IAAI;AAC/D;AAQO,SAAS,gDAAgD,OAAyB;AACvF,QAAM,UAAoD,CAAC,EAAE,OAAO,GAAG,OAAO,MAAM,CAAC;AACrF,QAAM,OAAO,oBAAI,QAAgB;AACjC,MAAI,YAAY;AAChB,MAAI,iBAAiB;AAErB,SAAO,QAAQ,SAAS,GAAG;AACzB,QAAI,aAAa,sCAAuC,QAAO;AAC/D,UAAM,UAAU,QAAQ,MAAM;AAC9B,iBAAa;AACb,QAAI,CAAC,QAAQ,SAAS,OAAO,QAAQ,UAAU,YAAY,KAAK,IAAI,QAAQ,KAAK,GAAG;AAClF,aAAO;AAAA,IACT;AACA,QAAI,QAAQ,QAAQ,sCAAuC,QAAO;AAClE,SAAK,IAAI,QAAQ,KAAK;AAEtB,QAAI;AACJ,QAAI;AACF,YAAM,SAAS,QAAQ;AACvB,UACE;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,CAAC,QAAQ,gCAAgC,QAAQ,GAAG,CAAC;AAE5D,eAAO;AACT,UAAI,qCAAqC,QAAQ,KAAK,EAAG,QAAO;AAChE,UAAI,6BAA6B,QAAQ,OAAO,iBAAiB,EAAG,QAAO;AAC3E,UAAI,QAAQ,iBAAiB,oCAAqC,QAAO;AACzE,UAAI,gCAAgC,MAAM,EAAG,QAAO;AAIpD,UACE,QAAQ,iBAAiB,gDACzB,6BAA6B,QAAQ,OAAO,0BAA0B,GACtE;AACA,0BAAkB;AAClB;AAAA,MACF;AAEA,eAAS,CAAC;AACV,iBAAW,OAAO,CAAC,SAAS,OAAO,GAAY;AAC7C,cAAM,QAAQ,yBAAyB,QAAQ,GAAG;AAClD,YAAI,UAAU,OAAW,QAAO,KAAK,KAAK;AAAA,MAC5C;AAEA,YAAM,SAAS,yBAAyB,QAAQ,QAAQ;AACxD,UAAI,WAAW,QAAW;AACxB,YACE,CAAC,MAAM,QAAQ,MAAM,KACrB,OAAO,WAAW,KAClB,OAAO,SAAS,kDAChB;AACA,iBAAO;AAAA,QACT;AACA,iBAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ;AACzC,iBAAO,KAAK,yBAAyB,QAAQ,OAAO,KAAK,CAAC,CAAC;AAAA,MAC/D;AAEA,UAAI,OAAO,WAAW,EAAG,QAAO;AAAA,IAClC,QAAQ;AACN,aAAO;AAAA,IACT;AAEA,QAAI,QAAQ,SAAS,sCAAuC,QAAO;AACnE,eAAW,SAAS,QAAQ;AAC1B,cAAQ,KAAK,EAAE,OAAO,QAAQ,QAAQ,GAAG,MAAM,CAAC;AAAA,IAClD;AAAA,EACF;AAEA,SAAO,iBAAiB;AAC1B;AAIO,SAAS,uCAAuC,OAAyB;AAC9E,SAAO,2CAA2C,KAAK;AACzD;AAQO,SAAS,iCAAiC,OAAyB;AACxE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,SAAS;AAMf,SACE,OAAO,SAAS,iBAChB,OAAO,SAAS,+BAChB,OAAO,SAAS,KAChB,OAAO,OAAO,YAAY,YAC1B,qCAAqC,KAAK,OAAO,OAAO;AAE5D;AAEA,SAAS,qBAAqB,SAA2C;AACvE,QAAM,gBAAgB,QAAQ,OAAO,UAAU;AAC/C,MAAI,kBAAkB,4BAA4B;AAChD,UAAM,IAAI;AAAA,MACR,wDAAwD,0BAA0B,iCACjD,iBAAiB,YAAY;AAAA,IAChE;AAAA,EACF;AACF;AAEA,eAAe,wBACb,WACiB;AAGjB,QAAM,WAAW,MAAM,UAAU,EAAE,MAAM,KAAK,CAAC;AAC/C,MAAI,OAAO,aAAa,YAAY,CAAC,OAAO,UAAU,QAAQ,GAAG;AAC/D,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AACA,SAAO;AACT;AAEA,SAAS,oCAAoC,SAA2C;AACtF,MAAI,OAAO,QAAQ,UAAU,WAAY;AACzC,QAAM,QAAQ,QAAQ,MAAM,KAAK,OAAO;AACxC,UAAQ,QAAQ,YAAY;AAG1B,UAAM,UAAU,QAAQ;AACxB,QAAI,CAAC,WAAW,OAAO,QAAQ,cAAc,YAAY;AACvD,YAAM,IAAI,MAAM,oDAAoD;AAAA,IACtE;AACA,QAAI,CAAC,iCAAiC,IAAI,OAAO,GAAG;AAClD,YAAM,YAAY,QAAQ,UAAU,KAAK,OAAO;AAChD,cAAQ,YAAY,YAAY,wBAAwB,SAAS;AACjE,uCAAiC,IAAI,OAAO;AAAA,IAC9C;AACA,UAAM,MAAM;AAAA,EACd;AACF;AAEA,SAAS,oCAAoC,SAA2C;AACtF,QAAM,cAAc,QAAQ,OAAO;AACnC,MAAI,gBAAgB,yBAAyB,gBAAgB,sBAAsB;AACjF;AAAA,EACF;AACA,QAAM,UAAU,QAAQ;AACxB,MAAI,CAAC,WAAW,OAAO,YAAY,UAAU;AAC3C,UAAM,IAAI,MAAM,SAAS,WAAW,6CAA6C;AAAA,EACnF;AAEA,MAAI,gBAAgB,uBAAuB;AACzC,QAAI,yCAAyC,IAAI,OAAO,EAAG;AAC3D,UAAM,qBAAqB,QAAQ;AACnC,QAAI,OAAO,uBAAuB,YAAY;AAC5C,YAAM,IAAI,MAAM,sDAAsD;AAAA,IACxE;AAMA,YAAQ,qBAAqB,OAAO,iBAA2B;AAC7D,UAAI,iBAAiB,UAAa,OAAO,iBAAiB,UAAU;AAClE,cAAM,IAAI,MAAM,yDAAyD;AAAA,MAC3E;AACA,YAAMC,aAAY,wBAAwB,IAAI,OAAO;AACrD,UAAI,CAACA,YAAW;AACd,cAAM,IAAI,MAAM,8DAA8D;AAAA,MAChF;AACA,aAAO,MAAM,mBAAmB,KAAK,SAAS;AAAA,QAC5C,GAAI,iBAAiB,SAAY,CAAC,IAAI,EAAE,WAAW,aAAa;AAAA,QAChE,OAAO;AAAA,QACP,YAAYA;AAAA,MACd,CAAC;AAAA,IACH;AACA,6CAAyC,IAAI,OAAO;AACpD;AAAA,EACF;AAEA,MAAI,wCAAwC,IAAI,OAAO,EAAG;AAC1D,QAAM,oBAAoB,QAAQ;AAClC,MAAI,OAAO,sBAAsB,YAAY;AAC3C,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AACA,UAAQ,oBAAoB,OAAO,MAAgB,iBAA2B;AAC5E,QAAI,OAAO,SAAS,YAAY,iBAAiB,QAAW;AAC1D,YAAM,IAAI,MAAM,wDAAwD;AAAA,IAC1E;AACA,UAAMA,aAAY,wBAAwB,IAAI,OAAO;AACrD,QAAI,CAACA,YAAW;AACd,YAAM,IAAI,MAAM,8DAA8D;AAAA,IAChF;AAKA,UAAM,YAAY,+BAA+B,IAAI,OAAO;AAC5D,WAAO,MAAM,kBAAkB,KAAK,SAAS,MAAM;AAAA,MACjD,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,UAAU;AAAA,MAC/C,OAAO;AAAA,MACP,YAAYA;AAAA,IACd,CAAC;AAAA,EACH;AACA,0CAAwC,IAAI,OAAO;AACrD;AAEA,SAAS,mCAAmC,SAA2C;AACrF,QAAM,aAAa,QAAQ;AAC3B,MAAI,OAAO,eAAe,WAAY;AACtC,QAAMC,WAAU,OAAO,SAA2C;AAMhE,QAAI,EAAE,QAAQ,2BAA2B,MAAM;AAC7C,YAAM,IAAI,wCAAwC,KAAK,WAAW;AAAA,QAChE,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AACA,QAAI,CAAC,QAAQ,gBAAgB,IAAI,KAAK,SAAS,GAAG;AAChD,YAAM,IAAI,wCAAwC,KAAK,WAAW;AAAA,QAChE,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AACA,WAAO,MAAM,WAAW,KAAK,SAAS,IAAI;AAAA,EAC5C;AACA,0BAAwB,OAAO;AAC/B,UAAQ,aAAa,OAAO,SAAS;AACnC,QAAI;AACF,aAAO,MAAMA,SAAQ,IAAI;AAAA,IAC3B,SAAS,OAAO;AACd,UACE,CAAC,iCAAiC,KAAK,KACvC,CAAC,OAAO,cAAc,KAAK,SAAS,KACpC,KAAK,aAAa,GAClB;AACA,cAAM;AAAA,MACR;AAIA,UAAI;AACF,eAAO,MAAMA,SAAQ,EAAE,GAAG,MAAM,OAAO,GAAG,CAAC;AAAA,MAC7C,SAAS,OAAO;AACd,cAAM,IAAI,wCAAwC,KAAK,WAAW,EAAE,MAAM,CAAC;AAAA,MAC7E;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,oCAAoC,SAA2C;AACtF,MAAI,QAAQ,yBAA0B;AACtC,MACE,OAAO,QAAQ,gBAAgB,cAC/B,OAAO,QAAQ,SAAS,WAAW,cACnC,OAAO,QAAQ,OAAO,WAAW,WAAW,cAC5C,CAAC,QAAQ,OAAO,WAChB;AACA;AAAA,EACF;AACA,QAAM,QAAoC;AAAA,IACxC,SAAS,oBAAI,IAAI;AAAA,IACjB,cAAc;AAAA,EAChB;AACA,QAAM,cAAc,QAAQ,YAAY,KAAK,OAAO;AACpD,UAAQ,cAAc,OAAO,SAAS;AACpC,UAAM,UACJ,QAAQ,OAAO,SAAS,YAAY,OAAQ,KAA2B,QAAQ,WAC1E,KAAyB,MAC1B;AACN,QAAI,CAAC,SAAS,SAAS,uBAAuB,GAAG;AAC/C,aAAO,MAAM,YAAY,IAAI;AAAA,IAC/B;AAKA,UAAM,UAAiC;AAAA,MACrC,SAAS;AAAA,MACT,uBAAuB;AAAA,IACzB;AACA,UAAM,QAAQ,IAAI,OAAO;AACzB,QAAI;AACF,YAAM,UAAU,MAAM,QAAQ,MAAO,UAAW,OAAQ,QAAQ,MAAO,SAAU;AACjF,cAAQ,UAAU;AAClB,UAAI,QAAQ,uBAAuB;AACjC,gBAAQ,SAAS;AACjB,cAAM,IAAI,MAAM,sDAAsD;AAAA,MACxE;AACA,cAAQ,UAAU;AAClB,aAAO,MAAM,YAAY,IAAI;AAAA,IAC/B,UAAE;AACA,YAAM,QAAQ,OAAO,OAAO;AAAA,IAC9B;AAAA,EACF;AAEA,UAAQ,2BAA2B,YAAY;AAC7C,QAAI,CAAC,MAAM,cAAc;AACvB,YAAM,gBAAgB,YAAY;AAChC,cAAM,gBAAgB,CAAC,GAAG,MAAM,OAAO;AACvC,cAAM,WAAW,oBAAI,IAAiC;AACtD,mBAAW,SAAS,eAAe;AACjC,gBAAM,wBAAwB;AAC9B,cAAI,MAAM,SAAS;AACjB,kBAAM,QAAQ,SAAS;AACvB,qBAAS,IAAI,MAAM,OAAO;AAAA,UAC5B;AAAA,QACF;AAGA,YAAI,QAAQ,WAAW,SAAS,IAAI,QAAQ,OAAO,GAAG;AACpD,gBAAM,cAAc,MAAM,QAAQ,MAAO,UAAW,OAAQ,QAAQ,MAAO,SAAU;AACrF,cAAI,QAAQ,WAAW,SAAS,IAAI,QAAQ,OAAO,GAAG;AACpD,oBAAQ,UAAU;AAClB,gDAAoC,OAAO;AAAA,UAC7C,OAAO;AACL,wBAAY,SAAS;AAAA,UACvB;AAAA,QACF;AAAA,MACF,GAAG,EAAE,QAAQ,MAAM;AACjB,cAAM,eAAe;AAAA,MACvB,CAAC;AAAA,IACH;AACA,UAAM,MAAM;AAAA,EACd;AACF;AAOO,SAAS,mCAAqD,SAAe;AAClF,QAAM,UAAU;AAChB,MAAI,8BAA8B,IAAI,OAAO,EAAG,QAAO;AACvD,MAAI,OAAO,QAAQ,qBAAqB,YAAY;AAClD,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AACA,uBAAqB,OAAO;AAC5B,MAAI,QAAQ,MAAO,iCAAgC,QAAQ,KAAK;AAChE,sCAAoC,OAAO;AAC3C,sCAAoC,OAAO;AAC3C,qCAAmC,OAAO;AAC1C,sCAAoC,OAAO;AAC3C,2CAAyC,SAAS,MAAM,QAAQ,OAAO;AACvE,mCAAiC,OAAO;AACxC,MACE,QAAQ,OAAO,YACf,QAAQ,MAAM,WACd,QAAQ,OAAO,aACf,QAAQ,MAAM,UAAU,MACxB;AACA,QAAI,CAAC,QAAQ,MAAM;AACjB,YAAM,IAAI,MAAM,uEAAuE;AACzF;AAAA,MACE;AAAA,MACA,oBAAoB;AAAA,QAClB;AAAA,UACE,UAAU,QAAQ,MAAM;AAAA,UACxB,SAAS,QAAQ,MAAM,QAAQ,KAAK,QAAQ,KAAK;AAAA,UACjD,SAAS,QAAQ,MAAM;AAAA,UACvB,GAAI,QAAQ,MAAM,SAAS,EAAE,QAAQ,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,QACjE;AAAA,QACA,MAAM;AACJ,gBAAM,YAAY,QAAQ,OAAO;AACjC,cAAI,CAAC,UAAW,OAAM,IAAI,MAAM,+CAA+C;AAC/E,iBAAO;AAAA,QACT;AAAA,QACA,QAAQ,MAAM,SAAS;AAAA,QACvB,MAAM,QAAQ,OAAO,eAAe,CAAC;AAAA,MACvC;AAAA,IACF;AAAA,EACF;AACA,QAAM,mBAAmB,QAAQ,iBAAiB,KAAK,OAAO;AAC9D,UAAQ,mBAAmB,OAAO,YAA2C;AAC3E,yBAAqB,OAAO;AAC5B,wCAAoC,OAAO;AAC3C,SACG,QAAQ,OAAO,yBAAyB,yBACvC,QAAQ,OAAO,yBAAyB,0BACzC,CAAC,WACA,CAAC,8EAA8E;AAAA,MAC7E,QAAQ;AAAA,IACV,IACF;AACA,YAAM,IAAI,MAAM,iEAAiE;AAAA,IACnF;AACA,UAAM,oBACJ,QAAQ,OAAO,yBAAyB,yBACxC,QAAQ,OAAO,yBAAyB;AAC1C,QAAI,WAAW,mBAAmB;AAChC,8BAAwB,IAAI,SAAS,QAAQ,SAAS;AAAA,IACxD;AACA,UAAM,mBACJ,QAAQ,OAAO,yBAAyB,uBACpC,QAAQ,MAAM,8BACd;AACN,UAAM,6BACJ,QAAQ,OAAO,yBAAyB,wBACxC,OAAO,OAAO,QAAQ,OAAO,6BAA6B;AAC5D,QAAI,QAAQ,OAAO,yBAAyB,sBAAsB;AAChE,qCAA+B,IAAI,SAAS,gBAAgB;AAI5D,aAAO,QAAQ,MAAM;AAAA,IACvB;AACA,QAAI;AACF,aAAO,MAAM,iBAAiB;AAAA,IAChC,UAAE;AACA,8BAAwB,OAAO,OAAO;AACtC,UAAI,QAAQ,OAAO,yBAAyB,sBAAsB;AAChE,YAAI,4BAA4B;AAC9B,kBAAQ,IAAI,QAAQ,OAAO,+BAA+B,gBAAgB;AAAA,QAC5E,OAAO;AACL,iBAAO,QAAQ,MAAM;AAAA,QACvB;AACA,uCAA+B,OAAO,OAAO;AAAA,MAC/C;AAAA,IACF;AAAA,EACF;AACA,gCAA8B,IAAI,OAAO;AACzC,oCAAkC,OAAO;AACzC,SAAO;AACT;AAEO,IAAM,6BAAN,cAAyC,mBAAmB;AAAA,EACxD;AAAA,EACA;AAAA,EAET,YAAY,SAA6C;AACvD,UAAM,OAAO;AACb,SAAK,+BAA+B,SAAS;AAC7C,SAAK,iBAAiB,EAAE,GAAG,QAAQ;AAAA,EACrC;AAAA,EAEA,MAAe,OACb,MACA,iBAC8B;AAC9B,UAAM,UAAU,MAAM,MAAM,OAAO,MAAM,eAAe;AACxD,WAAO,mCAAmC,OAAO;AAAA,EACnD;AAAA,EAEA,MAAM,oBACJ,MACA,WAC8B;AAC9B,WAAO,MAAM;AAAA,MACX,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAe,OAAO,OAA+D;AAOnF,UAAM,iBACJ,KAAK,iCAAiC,UACtC,MAAM,gCAAgC,KAAK,+BACvC,QACA;AAAA,MACE,GAAG;AAAA,MACH,6BAA6B,KAAK;AAAA,IACpC;AACN,UAAM,UAAU,MAAM,KAAK,qBAAqB,cAAc;AAC9D,WAAO,mCAAmC,OAAO;AAAA,EACnD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,OAA+D;AACxF,WAAO,MAAM,iCAAiC,KAAK,gBAAgB,KAAK;AAAA,EAC1E;AACF;AAEO,IAAM,gBAAsC;AAAA,EACjD,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,kBAAkB,CAAC,WAAW;AAAA,EAC9B,uBAAuB,OAAO;AAC5B,UAAM,cAAc,6BAA6B,KAAK;AACtD,QAAI,gBAAgB,yBAAyB,gBAAgB,sBAAsB;AACjF,aAAO;AAAA,QACL,UAAU;AAAA,QACV,UAAU;AAAA,QACV,cAAc;AAAA,MAChB;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EACA,MAAM,oBAAoB,EAAE,UAAU,SAAS,WAAAD,YAAW,UAAU,GAAG;AACrE,UAAM,UAAU;AAChB,UAAM,YAAY,QAAQ,OAAO;AACjC,UAAM,YAAY,QAAQ,OAAO;AACjC,QAAI,CAAC,aAAa,OAAO,WAAW,WAAW,YAAY;AACzD,YAAM,IAAI,MAAM,oEAAoE;AAAA,IACtF;AACA,UAAM,iBAAiB,MAAM,UAAU,OAAO,SAAS;AACvD,QAAI;AACF,UAAI,OAAO,eAAe,uBAAuB,YAAY;AAC3D,cAAM,IAAI,MAAM,gEAAgE;AAAA,MAClF;AACA,YAAM,QAAS,MAAM,eAAe,mBAAmB;AAAA,QACrD,YAAYA;AAAA,QACZ;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AACD,YAAM,UACJ,OAAO,MAAM,YAAY,WACrB,MAAM,UACN,OAAO,MAAM,aAAa,WACxB,MAAM,WACN;AACR,UAAI,CAAC,SAAS;AACZ,cAAM,IAAI,MAAM,8DAA8D;AAAA,MAChF;AACA,YAAME,WAAU,MAAM,gDAAgD,UAAU,OAAO;AACvF,aAAO;AAAA,QACL,UAAU;AAAA,QACV,SAAS;AAAA,QACT;AAAA,QACA,aAAa;AAAA,QACb,oBAAoBA,SAAQ;AAAA,QAC5B,iBAAiBA,SAAQ;AAAA,MAC3B;AAAA,IACF,UAAE;AACA,qBAAe,SAAS;AAAA,IAC1B;AAAA,EACF;AAAA,EACA,YAAY,uBAAuB;AAAA,EACnC,oBAAoB;AAAA,EACpB,oBAAoB,UAAU;AAE5B,QAAI,QAAQ,SAAS,YAAY,MAAM,QAAQ,SAAS,gBAAgB,GAAG;AACzE,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,cAAc;AAC1B,YAAM,IAAI,mBAAmB,SAAS,qCAAqC;AAAA,IAC7E;AAAA,EACF;AAAA,EACA,MAAM,EAAE,UAAU,aAAa,aAAa,GAAG;AAC7C,UAAM,UAA6C;AAAA,MACjD,SAAS,SAAS;AAAA,MAClB,WAAW,SAAS,sBAAsB;AAAA,MAC1C,uBAAuB,KAAK,KAAK,SAAS,0BAA0B,GAAI;AAAA;AAAA;AAAA;AAAA,MAIxE,6BAA6B,SAAS;AAAA,MACtC;AAAA,MACA,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,MAKL,aAAa;AAAA,IACf;AASA,YAAQ,gBAAgB,iCAAiC,QAAQ,IAAI;AACrE,QAAI,SAAS,oBAAoB,QAAW;AAC1C,cAAQ,MAAM,SAAS;AAAA,IACzB;AACA,QAAI,SAAS,0BAA0B,QAAW;AAChD,cAAQ,YAAY,SAAS;AAAA,IAC/B;AACA,QAAI,SAAS,iBAAiB,QAAW;AACvC,cAAQ,UAAU,CAAC,GAAG,SAAS,YAAY;AAAA,IAC7C;AACA,QAAI,SAAS,2BAA2B;AACtC,cAAQ,uBAAuB,SAAS;AAAA,IAC1C;AACA,UAAM,gBAAgB,0BAA0B,QAAQ;AACxD,QAAI,eAAe;AACjB,cAAQ,QAAQ;AAAA,IAClB;AACA,QAAI,SAAS,cAAc;AACzB,cAAQ,UAAU,SAAS;AAAA,IAC7B;AACA,QAAI,SAAS,kBAAkB;AAC7B,cAAQ,cAAc,SAAS;AAAA,IACjC;AACA,QAAI,SAAS,kBAAkB;AAC7B,cAAQ,cAAc,SAAS;AAAA,IACjC;AACA,WAAO,IAAI,2BAA2B,OAAO;AAAA,EAC/C;AACF;AA0BA,IAAM,qBAAwC,MAAM,OAAO,OAAO;AAGlE,IAAM,yBAAyB,oBAAI,IAAqB;AAExD,IAAM,yBAAyB,oBAAI,IAA2B;AAC9D,IAAM,qCAAqC;AAE3C,SAAS,sBAAsB,UAA4B;AACzD,SAAO;AAAA,IACL,SAAS,iBAAiB;AAAA,IAC1B,SAAS,4BAA4B;AAAA,IACrC,SAAS,oBAAoB;AAAA,EAC/B,EAAE,KAAK,GAAG;AACZ;AAEA,eAAsB,yBACpB,UACA,YAA+B,oBAChB;AAIf,MAAI,SAAS,cAAc;AACzB;AAAA,EACF;AACA,MAAI,CAAC,SAAS,4BAA4B,CAAC,SAAS,eAAe;AACjE;AAAA,EACF;AACA,QAAM,MAAM,sBAAsB,QAAQ;AAC1C,MAAI,uBAAuB,IAAI,GAAG,GAAG;AACnC;AAAA,EACF;AACA,MAAI,UAAU,uBAAuB,IAAI,GAAG;AAC5C,MAAI,CAAC,SAAS;AACZ,eAAW,YAAY;AACrB,YAAM,QAAQ,MAAM,UAAU;AAC9B,YAAM,SAAS,IAAI,MAAM,YAAY,mBAAmB,QAAQ,CAAC;AAMjE,YAAM,SAAS,MAAM,OAAO,QAAQ;AAAA,QAClC,SAAS;AAAA,QACT,SAAS,mBAAmB,EAAE,aAAa,SAAS,iBAAiB,IAAI;AAAA,MAC3E;AAQA,YAAM,MAAM,MAAM,OAAO,KAAK,SAAS,SAAS,cAAc;AAAA,QAC5D,GAAI,SAAS,mBAAmB,EAAE,aAAa,SAAS,iBAAiB,IAAI,CAAC;AAAA,QAC9E,iBAAiB;AAAA,MACnB,CAAC;AACD,YAAM,gBAAgB,CAAC,eACrB,OAAO,OACJ,aAAa,SAAS,eAAgB,MAAM,EAC5C,mBAAmB,CAAC,kCAAkC,GAAG;AAAA,QACxD,GAAI,aAAa,EAAE,YAAY,KAAK,IAAI,CAAC;AAAA,MAC3C,CAAC;AACL,UAAI;AACJ,UAAI;AACF,qBAAa,MAAM,cAAc,KAAK,EAAE,MAAM,GAAG;AAAA,MACnD,QAAQ;AAMN,qBAAa,MAAM,cAAc,IAAI,EAAE,MAAM,GAAG;AAAA,MAClD;AACA,6BAAuB,IAAI,KAAK,UAAU;AAAA,IAC5C,GAAG,EAAE,QAAQ,MAAM;AACjB,6BAAuB,OAAO,GAAG;AAAA,IACnC,CAAC;AACD,2BAAuB,IAAI,KAAK,OAAO;AAAA,EACzC;AACA,QAAM;AACR;AAGA,SAAS,yBAAyB,UAAyC;AACzE,MAAI,CAAC,SAAS,4BAA4B,CAAC,SAAS,eAAe;AACjE,WAAO;AAAA,EACT;AACA,SAAO,uBAAuB,IAAI,sBAAsB,QAAQ,CAAC;AACnE;AAYO,SAAS,0BAA0B,UAAoD;AAC5F,MAAI,SAAS,cAAc;AACzB,WAAO,mBAAmB,OAAO,SAAS,YAAY;AAAA,EACxD;AACA,MAAI,CAAC,SAAS,eAAe;AAC3B,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,yBAAyB,QAAQ;AACvD,SAAO,gBACH,mBAAmB;AAAA,IACjB;AAAA,EACF,IACA,mBAAmB,QAAQ,SAAS,aAAa;AACvD;AAQA,SAAS,mBACP,UACsD;AACtD,SAAO;AAAA,IACL,GAAI,SAAS,eAAe,EAAE,SAAS,SAAS,aAAa,IAAI,CAAC;AAAA,IAClE,GAAI,SAAS,mBAAmB,EAAE,aAAa,SAAS,iBAAiB,IAAI,CAAC;AAAA,IAC9E,GAAI,SAAS,mBAAmB,EAAE,aAAa,SAAS,iBAAiB,IAAI,CAAC;AAAA,EAChF;AACF;AAEA,eAAe,kBAAkB,UAA8C;AAC7E,QAAM,QAAQ,MAAM,OAAO,OAAO;AAClC,SAAO,IAAI,MAAM,YAAY,mBAAmB,QAAQ,CAAC;AAC3D;AAEA,SAAS,qBAAqB,OAAyB;AACrD,QAAM,YAAY;AAQlB,SAAO,WAAW,SAAS,mBAAmB,WAAW,SAAS;AACpE;AAEA,eAAe,wCACb,UACA,OACyC;AACzC,QAAM,WAAW,MAAM,MAAM,SAAS,oBAAoB,CAAC,CAAC;AAC5D,QAAM,gBAAgB,SAAS,iBAAiB,SAAS;AACzD,MAAI,CAAC,eAAe;AAClB,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,QAAM,WAAW,wCAAwC;AAAA,IACvD,SAAS;AAAA,IACT,WAAW,MAAM,QAAQ;AAAA,IACzB;AAAA;AAAA;AAAA;AAAA,IAIA,aAAa,MAAM,gBAAgB,SAAS,gBAAgB;AAAA,EAC9D,CAAC;AACD,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AACA,SAAO,SAAS;AAClB;AAIA,IAAM,gCAAgC,oBAAI,QAGxC;AASF,eAAsB,gDACpB,UACA,SACmE;AACnE,MAAI,CAAC,WAAW,OAAO,YAAY,UAAU;AAC3C,UAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AACA,QAAM,QAAS,QAAgC;AAC/C,MACE,CAAC,SACD,OAAO,MAAM,UAAU,wBAAwB,cAC/C,OAAO,MAAM,SAAS,cAAc,YACpC,OAAO,MAAM,oBAAoB,YACjC;AACA,UAAM,IAAI,MAAM,8EAA8E;AAAA,EAChG;AACA,MAAI,gBAAgB,8BAA8B,IAAI,KAAK;AAC3D,MAAI,CAAC,cAAe,+BAA8B,IAAI,OAAQ,gBAAgB,oBAAI,IAAI,CAAE;AACxF,QAAM,iBAAiB,SAAS,oBAAoB;AACpD,QAAM,SAAS,cAAc,IAAI,cAAc;AAC/C,MAAI,OAAQ,QAAO,MAAM;AACzB,QAAM,UAAU,wCAAwC,UAAU,KAAK,EAAE;AAAA,IACvE,CAACC,aAAY,wCAAwCA,QAAO;AAAA,EAC9D;AACA,gBAAc,IAAI,gBAAgB,OAAO;AACzC,MAAI;AACF,WAAO,MAAM;AAAA,EACf,SAAS,OAAO;AACd,QAAI,cAAc,IAAI,cAAc,MAAM,QAAS,eAAc,OAAO,cAAc;AACtF,UAAM;AAAA,EACR;AACF;AAKA,eAAsB,6CACpB,UACA,SACA,oBACkB;AAClB,QAAM,WAAW,MAAM,gDAAgD,UAAU,OAAO;AACxF,SAAO,SAAS,QAAQ;AAC1B;AAMA,eAAsB,sCACpB,UACA,eAAiE,mBACE;AACnE,QAAM,QAAQ,MAAM,aAAa,QAAQ;AACzC,MAAI;AACF,UAAMA,WAAU,MAAM,wCAAwC,UAAU,KAAK;AAC7E,WAAO,wCAAwCA,QAAO;AAAA,EACxD,UAAE;AACA,UAAM,MAAM;AAAA,EACd;AACF;AAIA,eAAsB,+BACpB,UACA,SAOA,eAAiE,mBACzC;AACxB,MACE,CAAC,QAAQ,WACT,CAAC,QAAQ,SACT,QAAQ,iBAAiB,mBAAmB,QAAQ,WAAW;AAE/D,UAAM,IAAI,MAAM,kEAAkE;AACpF,QAAM,QAAQ,MAAM,aAAa,QAAQ;AACzC,MAAI;AACF,UAAMA,WAAU;AAAA,MACd,MAAM,wCAAwC,UAAU,KAAK;AAAA,IAC/D;AACA,QAAIA,UAAS,QAAQ,QAAQ;AAC3B,YAAM,IAAI,MAAM,mEAAmE;AACrF,QAAI;AACJ,UAAM,QAAQ,oBAAI,IAAY;AAG9B,aAAS,OAAO,GAAG,OAAO,IAAI,QAAQ;AACpC,YAAM,WAAW,MAAM,MAAM,SAAS,YAAY;AAAA,QAChD,OAAO,QAAQ;AAAA,QACf,iBAAiB,MAAM,gBAAgB,SAAS,gBAAgB;AAAA,QAChE,iBAAiB;AAAA,QACjB,MAAM,CAAC,EAAE,SAAS,yCAAyC,UAAU,QAAQ,YAAY,CAAC;AAAA,QAC1F,GAAI,oBAAoB,SAAY,CAAC,IAAI,EAAE,gBAAgB;AAAA,MAC7D,CAAC;AACD,UAAI,CAAC,SAAS,UAAU,OAAQ,QAAO,MAAM,SAAS,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,IAAK;AAC3E,iBAAW,QAAQ,SAAS,WAAW;AACrC,YACE,CAAC,KAAK,GAAG,WAAW,KAAK,KACzB,KAAK,UAAU,QAAQ,SACvB,KAAK,SAAS,QAAQ,gBACtB,KAAK,YAAY,QAAQ,WACzB,KAAK,KAAK,OAAO,CAAC,QAAQ,IAAI,YAAY,uCAAuC,EAC9E,WAAW,KACd,CAAC,KAAK,KAAK;AAAA,UACT,CAAC,QACC,IAAI,YAAY,2CAChB,IAAI,aAAa,QAAQ;AAAA,QAC7B;AAEA,gBAAM,IAAI,MAAM,iEAAiE;AACnF,cAAM,IAAI,KAAK,EAAE;AACjB,YAAI,MAAM,OAAO,EAAG,OAAM,IAAI,MAAM,qDAAqD;AAAA,MAC3F;AACA,YAAM,SAAS,KAAK,IAAI,GAAG,SAAS,UAAU,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC;AAC3E,UACE,CAAC,OAAO,SAAS,MAAM,KACvB,UAAU,KACT,oBAAoB,UAAa,UAAU;AAE5C,cAAM,IAAI,MAAM,mDAAmD;AACrE,wBAAkB;AAAA,IACpB;AACA,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE,UAAE;AACA,UAAM,MAAM;AAAA,EACd;AACF;AAIA,eAAsB,oDACpB,UACA,WACA,eAAiE,mBACE;AACnE,MAAI,CAAC,UAAW,OAAM,IAAI,MAAM,mDAAmD;AACnF,QAAM,QAAQ,MAAM,aAAa,QAAQ;AACzC,MAAI;AACF,UAAMA,WAAU,MAAM,wCAAwC,UAAU,KAAK;AAC7E,UAAM,UAAU,MAAM,MAAM,UAAU,OAAO,SAAS;AACtD,UAAM,WAAW,MAAM,QAAQ,KAAK;AACpC,QAAI,aAAa,MAAM;AACrB,YAAM,IAAI,MAAM,iBAAiB,SAAS,uBAAuB;AAAA,IACnE;AACA,WAAO,wCAAwCA,QAAO;AAAA,EACxD,UAAE;AACA,UAAM,MAAM;AAAA,EACd;AACF;AASA,eAAsB,6BACpB,UACA,WACA,oBACA,eAAiE,mBAkBjE;AACA,MAAI,CAAC,UAAW,OAAM,IAAI,MAAM,kDAAkD;AAClF,QAAM,QAAQ,MAAM,aAAa,QAAQ;AACzC,MAAI;AACF,UAAMA,WAAU;AAAA,MACd,MAAM,wCAAwC,UAAU,KAAK;AAAA,IAC/D;AACA,QAAI,sBAAsBA,SAAQ,QAAQ,oBAAoB;AAC5D,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI;AACF,YAAM,UAAU,MAAM,MAAM,UAAU,OAAO,SAAS;AACtD,YAAM,WAAW,MAAM,QAAQ,KAAK;AACpC,aAAO,aAAa,OAChB;AAAA,QACE,QAAQ;AAAA,QACR,oBAAoBA,SAAQ;AAAA,QAC5B,iBAAiBA,SAAQ;AAAA,MAC3B,IACA;AAAA,QACE,QAAQ;AAAA,QACR;AAAA,QACA,oBAAoBA,SAAQ;AAAA,QAC5B,iBAAiBA,SAAQ;AAAA,MAC3B;AAAA,IACN,SAAS,OAAO;AACd,UAAI,qBAAqB,KAAK,GAAG;AAC/B,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,oBAAoBA,SAAQ;AAAA,UAC5B,iBAAiBA,SAAQ;AAAA,QAC3B;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAAA,EACF,UAAE;AACA,UAAM,MAAM;AAAA,EACd;AACF;AAEA,eAAsB,8BACpB,UACA,oBACA,YACA,eAAiE,mBAC/B;AAClC,MAAI,CAAC,WAAY,OAAM,IAAI,MAAM,kDAAkD;AAInF,QAAM,QAAQ,MAAM,aAAa,QAAQ;AACzC,MAAI;AACF,UAAMA,WAAU,MAAM,wCAAwC,UAAU,KAAK;AAC7E,UAAM,WAAW,wCAAwCA,QAAO;AAChE,QAAI,uBAAuB,SAAS,KAAK;AACvC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI;AACF,YAAM,MAAM,OAAO,OAAO,UAAU;AACpC,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,qBAAqB,KAAK,EAAG,QAAO;AACxC,YAAM;AAAA,IACR;AAAA,EACF,UAAE;AACA,UAAM,MAAM;AAAA,EACd;AACF;AAEA,eAAsB,gBACpB,UACA,WACA,aACkB;AAClB,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,MAAM,kBAAkB,QAAQ;AAC9C,MAAI;AACF,UAAM,UAAU,MAAM,MAAM,UAAU,OAAO,SAAS;AACtD,UAAM,QAAQ,QAAQ,4BAA4B,WAAW,CAAC;AAC9D,WAAO;AAAA,EACT,UAAE;AACA,UAAM,MAAM;AAAA,EACd;AACF;AAEA,eAAsB,0BACpB,UACA,WACA,eAAiE,mBACjE,4BACkB;AAClB,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,MAAM,aAAa,QAAQ;AACzC,MAAI;AACF,QAAI,4BAA4B;AAC9B,YAAMA,WAAU;AAAA,QACd,MAAM,wCAAwC,UAAU,KAAK;AAAA,MAC/D;AACA,UAAIA,UAAS,QAAQ;AACnB,cAAM,IAAI,MAAM,kEAAkE;AAAA,IACtF;AACA,UAAM,UAAU,MAAM,MAAM,UAAU,OAAO,SAAS;AACtD,UAAM,wBAAwB,QAAQ,UAAU,KAAK,OAAO,CAAC;AAC7D,WAAO;AAAA,EACT,UAAE;AACA,UAAM,MAAM;AAAA,EACd;AACF;AAoBA,SAAS,aAAa,MAAgD;AACpE,QAAM,OAA+B,CAAC;AACtC,aAAW,OAAO,KAAK,QAAQ,CAAC,GAAG;AACjC,QAAI,OAAO,IAAI,YAAY,YAAY,OAAO,IAAI,aAAa,UAAU;AACvE,WAAK,IAAI,OAAO,IAAI,IAAI;AAAA,IAC1B;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,MAAuC;AACjE,MACE,OAAO,KAAK,cAAc,YAC1B,CAAC,OAAO,SAAS,KAAK,SAAS,KAC/B,KAAK,aAAa,GAClB;AACA,WAAO;AAAA,EACT;AAEA,SAAO,KAAK,YAAY,OACpB,KAAK,MAAM,KAAK,YAAY,GAAI,IAChC,KAAK,MAAM,KAAK,SAAS;AAC/B;AAEA,SAAS,eACP,OACQ;AACR,SAAO,GAAG,MAAM,WAAW,IAAI,MAAM,cAAc,IAAI,MAAM,OAAO;AACtE;AAQA,eAAsB,4BACpB,UACA,UAAwC,CAAC,GACvB;AAClB,QAAM,cAAc,QAAQ,SAAS,OAAO,MAAM,kBAAkB,QAAQ;AAC5E,QAAM,QAAS,QAAQ,UAAU;AACjC,MAAI;AACF,QAAI;AACJ,QAAI;AACF,eACE,MAAM,MAAM,KAAK,SAAS,SAAS,cAAc;AAAA,QAC/C,iBAAiB;AAAA,QACjB,GAAI,SAAS,mBAAmB,EAAE,aAAa,SAAS,iBAAiB,IAAI,CAAC;AAAA,MAChF,CAAC,GACD;AAAA,IACJ,SAAS,OAAO;AACd,UAAI,qBAAqB,KAAK,EAAG,QAAO;AACxC,YAAM;AAAA,IACR;AACA,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,WAAW,MAAM,MAAM,SAAS,YAAY;AAAA,MAChD;AAAA,MACA,iBAAiB;AAAA,MACjB,GAAI,SAAS,mBAAmB,EAAE,iBAAiB,SAAS,iBAAiB,IAAI,CAAC;AAAA,MAClF,MAAM,CAAC;AAAA,IACT,CAAC;AACD,YAAQ,SAAS,aAAa,CAAC,GAAG,SAAS;AAAA,EAC7C,UAAE;AACA,iBAAa,MAAM;AAAA,EACrB;AACF;AAEA,eAAsB,0BACpB,UACA,YACA,UAQI,CAAC,GAC4B;AACjC,QAAM,QAAQ,QAAQ,KAAK,QAAQ,KAAK,KAAK,IAAI;AACjD,QAAM,kBAAkB,QAAQ,mBAAmB;AACnD,QAAM,sBAAsB,QAAQ,uBAAuB;AAC3D,QAAM,oBAAoB,IAAI,IAAI,WAAW,IAAI,CAAC,UAAU,CAAC,eAAe,KAAK,GAAG,KAAK,CAAC,CAAC;AAQ3F,QAAM,mBAAmB,IAAI;AAAA,IAC3B,WACG,OAAO,CAAC,UAAU,MAAM,UAAU,EAClC,IAAI,CAAC,UAAU,CAAC,MAAM,YAAsB,KAAK,CAAC;AAAA,EACvD;AACA,QAAM,cAAc,QAAQ,SAAS,OAAO,MAAM,kBAAkB,QAAQ;AAC5E,QAAM,QAAS,QAAQ,UAAU;AACjC,MAAI;AACF,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,MAAM,KAAK,SAAS,SAAS,cAAc;AAAA,QACrD,iBAAiB;AAAA,QACjB,GAAI,SAAS,mBAAmB,EAAE,aAAa,SAAS,iBAAiB,IAAI,CAAC;AAAA,MAChF,CAAC;AAAA,IACH,SAAS,OAAO;AAGd,UAAI,qBAAqB,KAAK,GAAG;AAC/B,eAAO,4BAA4B,UAAU;AAAA,MAC/C;AACA,YAAM;AAAA,IACR;AACA,UAAM,QAAQ,IAAI;AAClB,QAAI,CAAC,OAAO;AACV,aAAO,4BAA4B,UAAU;AAAA,IAC/C;AAEA,QAAI,WAAW;AACf,QAAI,UAAU;AACd,UAAM,eAA8C,CAAC;AACrD,QAAI,WAAW;AACf,UAAM,kBAAkB,oBAAI,IAAY;AACxC,UAAM,aAA4C,CAAC;AACnD,QAAI;AACJ,WAAO,WAAW,SAAS,iBAAiB;AAC1C,YAAM,WAAW,MAAM,MAAM,SAAS,YAAY;AAAA,QAChD;AAAA,QACA,GAAI,oBAAoB,SAAY,EAAE,gBAAgB,IAAI,CAAC;AAAA,QAC3D,iBAAiB;AAAA,QACjB,GAAI,SAAS,mBAAmB,EAAE,iBAAiB,SAAS,iBAAiB,IAAI,CAAC;AAAA,QAClF,MAAM,CAAC;AAAA,MACT,CAAC;AACD,YAAM,YAAY,SAAS,aAAa,CAAC;AACzC,UAAI,UAAU,WAAW,GAAG;AAC1B,mBAAW;AACX;AAAA,MACF;AACA,iBAAW,QAAQ,WAAW;AAC5B,oBAAY;AACZ,YAAI,KAAK,IAAI;AACX,0BAAgB,IAAI,KAAK,EAAE;AAAA,QAC7B;AACA,cAAM,OAAO,aAAa,IAAI;AAC9B,cAAM,UAAU,KAAK;AACrB,cAAM,cAAc,KAAK;AACzB,cAAM,iBAAiB,KAAK;AAC5B,cAAM,iBAAiB,KAAK,KAAK,iBAAiB,IAAI,KAAK,EAAE,IAAI;AACjE,YAAI,gBAAgB;AAMlB,cACE,YAAY,eAAe,WAC3B,gBAAgB,eAAe,eAC/B,mBAAmB,eAAe,gBAClC;AACA,gBAAI;AACF,oBAAMC,WAAU,MAAM,MAAM,UAAU,OAAO,KAAK,EAAE;AACpD,oBAAMA,SAAQ;AAAA,gBACZ,4BAA4B;AAAA,kBAC1B,SAAS,eAAe;AAAA,kBACxB,aAAa,eAAe;AAAA,kBAC5B,gBAAgB,eAAe;AAAA,gBACjC,CAAC;AAAA,cACH;AAAA,YACF,QAAQ;AAAA,YAGR;AAAA,UACF;AACA,qBAAW;AACX;AAAA,QACF;AACA,YAAI,SAAuD;AAC3D,YAAI,WAAW,eAAe,gBAAgB;AAC5C,gBAAM,OAAO,kBAAkB;AAAA,YAC7B,eAAe,EAAE,SAAS,aAAa,eAAe,CAAC;AAAA,UACzD;AACA,cAAI,CAAC,QAAS,KAAK,cAAc,KAAK,eAAe,KAAK,IAAK;AAC7D,qBAAS;AAAA,UACX;AAAA,QACF,OAAO;AACL,gBAAM,cAAc,mBAAmB,IAAI;AAC3C,cAAI,gBAAgB,QAAQ,QAAQ,eAAe,qBAAqB;AACtE,qBAAS;AAAA,UACX;AAAA,QACF;AAEA,YAAI,CAAC,QAAQ;AACX,qBAAW;AACX;AAAA,QACF;AACA,cAAM,YAAY,EAAE,WAAW,KAAK,IAAI,QAAQ,KAAK;AACrD,YAAI;AACJ,YAAI;AACF,oBAAU,MAAM,MAAM,UAAU,OAAO,KAAK,EAAE;AAAA,QAChD,QAAQ;AACN,qBAAW;AACX,uBAAa,KAAK,SAAS;AAC3B;AAAA,QACF;AACA,YAAI,QAAQ,uBAAuB;AACjC,cAAI;AACF,gBAAI,CAAE,MAAM,QAAQ,sBAAsB,SAAS,GAAI;AACrD,yBAAW;AACX,2BAAa,KAAK,SAAS;AAC3B;AAAA,YACF;AAAA,UACF,QAAQ;AAGN,uBAAW;AACX,yBAAa,KAAK,SAAS;AAC3B;AAAA,UACF;AAAA,QACF;AACA,YAAI;AACF,gBAAM,wBAAwB,QAAQ,UAAU,KAAK,OAAO,CAAC;AAC7D,qBAAW,KAAK,SAAS;AAAA,QAC3B,QAAQ;AACN,qBAAW;AACX,uBAAa,KAAK,SAAS;AAAA,QAC7B;AACA,YAAI,WAAW,UAAU,iBAAiB;AACxC;AAAA,QACF;AAAA,MACF;AACA,wBAAkB,UAAU,UAAU,SAAS,CAAC,GAAG;AACnD,UAAI,oBAAoB,QAAW;AACjC,mBAAW;AACX;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW;AAAA,QACT;AAAA,QACA,SAAS;AAAA,QACT;AAAA;AAAA;AAAA;AAAA,QAIA,6BAA6B,WACzB,WAAW;AAAA,UAAQ,CAAC,UAClB,MAAM,cAAc,CAAC,gBAAgB,IAAI,MAAM,UAAU,IAAI,CAAC,MAAM,UAAU,IAAI,CAAC;AAAA,QACrF,IACA,CAAC;AAAA,MACP;AAAA,IACF;AAAA,EACF,UAAE;AACA,iBAAa,MAAM;AAAA,EACrB;AACF;AAEA,SAAS,4BACP,YACwB;AACxB,SAAO;AAAA,IACL,UAAU;AAAA,IACV,YAAY,CAAC;AAAA,IACb,SAAS;AAAA,IACT,WAAW;AAAA,MACT,UAAU;AAAA,MACV,SAAS;AAAA,MACT,cAAc,CAAC;AAAA,MACf,6BAA6B,WAAW;AAAA,QAAQ,CAAC,UAC/C,MAAM,aAAa,CAAC,MAAM,UAAU,IAAI,CAAC;AAAA,MAC3C;AAAA,IACF;AAAA,EACF;AACF;;;AWhrDO,IAAM,eAAqC;AAAA,EAChD,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,kBAAkB,CAAC;AAAA,EACnB,wBAAwB,MAAM;AAAA,EAC9B,YAAY,uBAAuB;AAAA,EACnC,oBAAoB;AAAA;AAAA;AAAA,EAGpB,sBAAsB;AAAA,EAAC;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACXA,IAAM,sBAAsB;AAErB,IAAM,qCAAqC,OAAO,OAAO,EAAE,KAAK,KAAK,QAAQ,MAAM,CAAC;AACpF,IAAM,uCAAuC,OAAO,OAAO;AAAA,EAChE,KAAK;AAAA,EACL,QAAQ;AACV,CAAC;AAED,SAAS,cACP,UACA,cAAsC,CAAC,GACvC,eAAyB,CAAC,GAC1B,SACA;AACA,SAAO;AAAA,IACL,SAAS,SAAS;AAAA,IAClB,QAAQ,SAAS;AAAA,IACjB,OAAO,SAAS;AAAA,IAChB,YAAY,SAAS;AAAA,IACrB,gBAAgB,SAAS;AAAA,IACzB,iBAAiB,SAAS;AAAA,IAC1B,0BAA0B,SAAS;AAAA,IACnC,GAAI,SAAS,mCACT,EAAE,uBAAuB,SAAS,iCAAiC,IACnE,CAAC;AAAA,IACL,qBAAqB,KAAK,KAAK,SAAS,0BAA0B,GAAI;AAAA,IACtE,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB;AAAA,IACA;AAAA,IACA,GAAI,SAAS,qBAAqB,EAAE,SAAS,SAAS,mBAAmB,IAAI,CAAC;AAAA,IAC9E,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/B;AACF;AAEO,IAAM,sBAA4C;AAAA,EACvD,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,kBAAkB,CAAC,WAAW;AAAA,EAC9B,wBAAwB,MAAM;AAAA,EAC9B,YAAY,uBAAuB;AAAA,EACnC,oBAAoB;AAAA,EACpB,oBAAoB,UAAU;AAC5B,QAAI,CAAC,SAAS,oBAAoB;AAChC,YAAM,IAAI,mBAAmB,eAAe,2CAA2C;AAAA,IACzF;AACA,QAAI,CAAC,SAAS,mBAAmB;AAC/B,YAAM,IAAI,mBAAmB,eAAe,0CAA0C;AAAA,IACxF;AACA,QAAI,CAAC,SAAS,oBAAoB,CAAC,oBAAoB,KAAK,SAAS,gBAAgB,GAAG;AACtF,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,gBAAgB,EAAE,UAAU,WAAW,GAAG;AAC9C,UAAM,IAAI,kBAAkB,cAAc,QAAQ,CAAC,EAAE,gBAAgB,UAAU;AAAA,EACjF;AAAA,EACA,MAAM,EAAE,UAAU,aAAa,cAAc,QAAQ,GAAG;AACtD,WAAO,IAAI,kBAAkB,cAAc,UAAU,aAAa,cAAc,OAAO,CAAC;AAAA,EAC1F;AACF;;;AC9DO,IAAM,kBAAwC;AAAA,EACnD,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,kBAAkB,CAAC,UAAU;AAAA;AAAA;AAAA;AAAA,EAI7B,wBAAwB,MAAM;AAAA,EAC9B,YAAY,uBAAuB;AAAA,EACnC,oBAAoB;AAAA,EACpB,oBAAoB,UAAU;AAC5B,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI,mBAAmB,WAAW,sCAAsC;AAAA,IAChF;AAAA,EACF;AAAA,EACA,MAAM,EAAE,UAAU,aAAa,aAAa,GAAG;AAC7C,UAAM,UAA8E;AAAA,MAClF,QAAQ,SAAS;AAAA,MACjB,KAAK;AAAA,MACL;AAAA;AAAA,MAEA,QAAQ,SAAS;AAAA,IACnB;AACA,QAAI,SAAS,eAAgB,SAAQ,UAAU,SAAS;AACxD,QAAI,SAAS,qBAAsB,SAAQ,gBAAgB,SAAS;AACpE,QAAI,SAAS,mBAAoB,SAAQ,cAAc,SAAS;AAMhE,YAAQ,WAAW;AAAA,MACjB,mBAAmB,SAAS;AAAA,MAC5B,GAAI,SAAS,0BACT,EAAE,oBAAoB,SAAS,0BAA0B,IAAK,IAC9D,CAAC;AAAA,IACP;AACA,WAAO,IAAI,qBAAqB,OAAO;AAAA,EACzC;AACF;;;AClCO,IAAM,iBAAuC;AAAA,EAClD,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,kBAAkB,CAAC,WAAW;AAAA,EAC9B,wBAAwB,CAAC,UACvB,6BAA6B,KAAK,MAAM,aACpC,4CACA;AAAA,EACN,+BAA+B,SAAS;AACtC,UAAM,QAAS,SAAmE;AAClF,QAAI,OAAO,yBAAyB,YAAY;AAI9C,YAAM,uBAAuB;AAAA,IAC/B;AAAA,EACF;AAAA,EACA,YAAY,uBAAuB;AAAA,EACnC,oBAAoB;AAAA,EACpB,oBAAoB,UAAU;AAE5B,QAAI,CAAC,SAAS,aAAa;AACzB,YAAM,IAAI,mBAAmB,UAAU,mCAAmC;AAAA,IAC5E;AACA,QAAI,CAAC,SAAS,iBAAiB;AAC7B,YAAM,IAAI,mBAAmB,UAAU,wCAAwC;AAAA,IACjF;AAAA,EACF;AAAA,EACA,MAAM,EAAE,UAAU,aAAa,aAAa,GAAG;AAC7C,UAAM,UAA6E;AAAA,MACjF,OAAO,SAAS;AAAA,MAChB,WAAW,SAAS;AAAA,MACpB,KAAK;AAAA,MACL;AAAA,IACF;AACA,QAAI,SAAS,aAAc,SAAQ,SAAS,SAAS;AACrD,QAAI,SAAS,cAAe,SAAQ,UAAU,SAAS;AACvD,WAAO,IAAI,oBAAoB,OAAO;AAAA,EACxC;AACF;;;ArCbO,IAAM,oBAAkE;AAAA,EAC7E,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,OAAO;AAAA,EACP,MAAM;AAAA,EACN,SAAS;AAAA,EACT,SAAS;AAAA,EACT,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,SAAS;AACX;AAQA,IAAM,0BAA0B;AAAA,EAC9B,aAAa;AAAA,EACb,cAAc;AAAA,EACd,qBAAqB;AAAA,EACrB,eAAe;AAAA,EACf,eAAe;AAAA,EACf,eAAe;AAAA,EACf,WAAW;AAAA,EACX,cAAc;AAAA,EACd,qBAAqB;AAAA,EACrB,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,oBAAoB;AAAA,EACpB,mBAAmB;AAAA,EACnB,kBACE;AAAA,EACF,eAAe;AAAA,EACf,eAAe;AAAA,EACf,cAAc;AAAA,EACd,kBAAkB;AAAA,EAClB,4BAA4B;AAAA,EAC5B,eAAe;AAAA,EACf,yBAAyB;AAAA,EACzB,0BAA0B;AAAA,EAC1B,mBAAmB;AAAA,EACnB,sBAAsB;AACxB;AAQO,SAAS,mCAAyC;AACvD,qCAAmC;AACnC,QAAM,sBAAsB,IAAI,IAAY,0CAA0C;AACtF,aAAW,WAAWC,gBAAe,SAAS;AAC5C,UAAM,eAAe,kBAAkB,OAAO;AAC9C,QAAI,aAAa,YAAY,SAAS;AACpC,YAAM,IAAI;AAAA,QACR,sBAAsB,OAAO,6BAA6B,aAAa,OAAO;AAAA,MAChF;AAAA,IACF;AACA,QAAI,aAAa,WAAW,YAAY,SAAS;AAC/C,YAAM,IAAI;AAAA,QACR,sBAAsB,OAAO,wCAAwC,aAAa,WAAW,OAAO;AAAA,MACtG;AAAA,IACF;AACA,UAAM,iBAAiB,CAAC,GAAG,aAAa,gBAAgB;AACxD,UAAM,yBAAyB,CAAC,GAAG,+CAA+C,OAAO,CAAC;AAC1F,QACE,IAAI,IAAI,cAAc,EAAE,SAAS,eAAe,UAChD,eAAe,KAAK,CAAC,UAAU,CAAC,oBAAoB,IAAI,KAAK,CAAC,KAC9D,eAAe,WAAW,uBAAuB,UACjD,eAAe,KAAK,CAAC,OAAO,UAAU,UAAU,uBAAuB,KAAK,CAAC,GAC7E;AACA,YAAM,IAAI,MAAM,aAAa,OAAO,qDAAqD;AAAA,IAC3F;AACA,QAAI,YAAY,QAAQ;AAGtB,UAAI,aAAa,WAAW,cAAc,QAAQ;AAChD,cAAM,IAAI;AAAA,UACR,oDAAoD,aAAa,WAAW,SAAS;AAAA,QACvF;AAAA,MACF;AACA,UAAI,aAAa,oBAAoB,QAAQ;AAC3C,cAAM,IAAI,MAAM,qDAAqD;AAAA,MACvE;AACA;AAAA,IACF;AACA,QAAI,aAAa,oBAAoB,QAAQ;AAC3C,YAAM,IAAI,MAAM,aAAa,OAAO,yCAAyC;AAAA,IAC/E;AACA,UAAM,SAAS,aAAa,MAAM;AAAA,MAChC,UAAU;AAAA,MACV,aAAa,CAAC;AAAA,MACd,cAAc,CAAC;AAAA,IACjB,CAAC;AACD,UAAM,eAAgB,QAAgD;AACtE,QAAI,OAAO,iBAAiB,UAAU;AACpC,YAAM,IAAI,MAAM,aAAa,OAAO,sCAAsC;AAAA,IAC5E;AACA,QAAI,iBAAiB,aAAa,WAAW,WAAW;AACtD,YAAM,IAAI;AAAA,QACR,aAAa,OAAO,+CAA+C,aAAa,WAAW,SAAS,+BAA+B,YAAY;AAAA,MACjJ;AAAA,IACF;AACA,QAAI,OAAQ,OAAgC,WAAW,YAAY;AACjE,YAAM,IAAI,MAAM,aAAa,OAAO,kCAAkC;AAAA,IACxE;AACA,QACE,aAAa,oBAAoB,YACjC,OAAQ,OAAqC,gBAAgB,YAC7D;AACA,YAAM,IAAI,MAAM,aAAa,OAAO,uDAAuD;AAAA,IAC7F;AACA,QAAI,aAAa,cAAc,aAAa,oBAAoB,UAAU;AACxE,YAAM,IAAI,MAAM,aAAa,OAAO,2CAA2C;AAAA,IACjF;AACA,UAAM,gBAAgB,aAAa,uBAAuB,CAAC,CAAC;AAC5D,QAAK,YAAY,kBAAmB,kBAAkB,OAAO;AAC3D,YAAM,IAAI;AAAA,QACR,aAAa,OAAO,qBAClB,YAAY,eAAe,SAAS,SACtC;AAAA,MACF;AAAA,IACF;AACA,QAAI,eAAe,aAAa,kBAAkB,cAAc,iBAAiB,aAAa;AAC5F,YAAM,IAAI,MAAM,aAAa,OAAO,mDAAmD;AAAA,IACzF;AAAA,EACF;AACF;AAEO,SAAS,+BACd,SACA,OACuC;AACvC,QAAM,eAAe,kBAAkB,OAAyB;AAChE,SAAO,cAAc,uBAAuB,KAAK,KAAK;AACxD;AAMO,SAAS,sCAAsC,SAAiB,OAAyB;AAC9F,MAAI,YAAY,QAAS,QAAO;AAChC,QAAM,cAAc,6BAA6B,KAAK;AACtD,SAAO,gBAAgB,yBAAyB,gBAAgB;AAClE;AAOO,SAAS,kCAAkC,SAAiB,UAA4B;AAC7F,MAAI,sCAAsC,SAAS,QAAQ,EAAG,QAAO;AACrE,SAAO,YAAY,YAAY,gCAAgC,QAAQ;AACzE;AAEO,SAAS,uCAAuC,SAAiB,SAAwB;AAC9F,oBAAkB,OAAyB,GAAG,iCAAiC,OAAO;AACxF;AAEO,SAAS,oCAAoC,SAAkC;AACpF,SAAO,OAAO,kBAAkB,OAAO,EAAE,wBAAwB;AACnE;AAEA,eAAsB,+BAA+B,OAKhC;AACnB,QAAM,eAAe,kBAAkB,MAAM,OAAO;AACpD,QAAM,QAAQ,aAAa;AAC3B,MAAI,CAAC,MAAO,QAAO;AACnB,eAAa,oBAAoB,MAAM,QAAQ;AAC/C,MAAI;AACF,UAAM,MAAM,EAAE,UAAU,MAAM,UAAU,YAAY,MAAM,WAAW,CAAC;AACtE,gCAA4B,MAAM,SAAS,MAAM,SAAS,WAAW;AACrE,WAAO;AAAA,EACT,SAAS,OAAO;AACd,gCAA4B,MAAM,SAAS,MAAM,SAAS,QAAQ;AAClE,QAAI,2BAA2B,KAAK,GAAG;AACrC,UAAI;AACF,cAAM,SAAS,+BAA+B;AAAA,UAC5C,SAAS,MAAM;AAAA,UACf,WAAW;AAAA,QACb,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;AAEO,SAAS,2BAA2B,OAAyB;AAClE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,YAAY;AAKlB,SACE,UAAU,WAAW,OAAO,UAAU,eAAe,OAAO,UAAU,UAAU,WAAW;AAE/F;AAEA,SAAS,4BACP,SACA,SACA,SACM;AACN,MAAI;AACF,aAAS,sBAAsB,EAAE,SAAS,QAAQ,CAAC;AAAA,EACrD,QAAQ;AAAA,EAER;AACF;AAEA,eAAsB,4BAA4B,OAMI;AACpD,QAAM,QAAQ,kBAAkB,MAAM,OAAO,EAAE;AAC/C,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,MAAM,MAAM;AAAA,IACjB,UAAU,MAAM;AAAA,IAChB,SAAS,MAAM;AAAA,IACf,WAAW,MAAM;AAAA,IACjB,WAAW,MAAM;AAAA,EACnB,CAAC;AACH;AAQA,iCAAiC;;;AsC7R1B,SAAS,uBAAuB,QAAgC;AACrE,MAAI,OAAO,WAAW,UAAU;AAC9B,UAAM,QAAQ,OAAO,MAAM,kCAAkC;AAC7D,WAAO,QAAQ,OAAO,MAAM,CAAC,CAAC,IAAI;AAAA,EACpC;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,YAAY;AAMlB,aAAW,SAAS,CAAC,UAAU,UAAU,UAAU,WAAW,UAAU,MAAM,UAAU,MAAM,GAAG;AAC/F,QAAI,OAAO,UAAU,SAAU,QAAO;AAAA,EACxC;AACA,SAAO;AACT;AAEO,SAAS,qBAAqB,QAAyB;AAC5D,MAAI,OAAO,WAAW,UAAU;AAC9B,UAAM,cAAc,OAAO,QAAQ,SAAS;AAC5C,WAAO,eAAe,IAAI,OAAO,MAAM,cAAc,UAAU,MAAM,EAAE,KAAK,IAAI,OAAO,KAAK;AAAA,EAC9F;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,YAAY;AAClB,SAAO,CAAC,UAAU,QAAQ,UAAU,QAAQ,UAAU,MAAM,EACzD,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,EAChF,KAAK,IAAI;AACd;AAGO,SAAS,qBAAqB,QAAyB;AAC5D,MAAI,OAAO,WAAW,SAAU,QAAO,qBAAqB,MAAM;AAClE,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,YAAY;AAClB,MAAI,OAAO,UAAU,WAAW,YAAY,UAAU,OAAO,SAAS,GAAG;AACvE,WAAO,UAAU;AAAA,EACnB;AACA,SAAO,OAAO,UAAU,WAAW,WAAW,UAAU,SAAS;AACnE;AAEO,SAAS,2BAA2B,QAA0B;AACnE,MAAI,OAAO,WAAW,SAAU,QAAO,uCAAuC,KAAK,MAAM;AACzF,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,YAAY;AAClB,SAAO,OAAO,UAAU,cAAc,YAAY,OAAO,UAAU,eAAe;AACpF;;;A3CiFA,SAAS,gBAAAC,eAAc,YAAAC,iBAAgB;AAMvC,SAAS,6BAAAC,4BAA2B,qBAAAC,0BAAyB;;;A4ClItD,SAAS,0BAA0B,MAAc,YAAkB;AACxE,QAAM,OAAO,KAAK,YAAY,QAAQ,mBAAmB,GAAG,EAAE,MAAM,GAAG,GAAG;AAC1E,SAAO;AAAA,IACL,SAAS;AAAA,IACT,UAAU,KAAK;AAAA,IACf,GAAI,KAAK,4BAA4B,EAAE,2BAA2B,KAAK,IAAI,CAAC;AAAA,IAC5E,QAAQ,OACJ,cAAc,IAAI,KAClB,KAAK,YACH,iBACA,KAAK,WACH,iBACA;AAAA,IACR,GAAI,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,KAAK,eAAe,WAAW,MAAe,EAAE,IAAI,CAAC;AAAA,IAC3F;AAAA,EACF;AACF;AAIA,eAAsB,6BACpB,QACA,MACA,eACA,SACA,YACkE;AAClE,QAAM,gBAAgB,MAAM;AAC1B,QAAI,eAAe,UAAa,KAAK,IAAI,KAAK;AAC5C,YAAM,IAAI,MAAM,+DAA+D;AAAA,EACnF;AACA,QAAM,iBACJ,eAAe,SACX,UACA,OAAO,WAAW;AAChB,eAAWC,UAAS,QAAQ;AAC1B,oBAAc;AACd,YAAM,QAAQ,CAACA,MAAK,CAAC;AAAA,IACvB;AACA,kBAAc;AAAA,EAChB;AACN,MAAI,kBAAkB;AACtB,SAAO,MAAM;AAGX,kBAAc;AACd,UAAM,SAAS;AACf,UAAM,SAAS,MAAM,OAAO,aAAa,MAAM,gBAAgB,MAAQ,KAAK,cAAc;AAC1F,kBAAc;AACd,QAAI,CAAC,iBAAiB,OAAO,WAAW,eAAe,OAAO,SAAU,QAAO;AAG/E,sBAAkB,OAAO,OAAO,cAAc;AAC9C,QAAI,oBAAoB;AACtB,YAAM,IAAI,MAAM,4EAA4E;AAAA,EAChG;AACF;;;ACzDO,IAAM,0BAA0B;AAEvC,IAAM,YAAY;AAClB,IAAM,YAAY;AAQX,IAAM,iCAAN,cAA6C,MAAM;AAAA,EAC/C;AAAA,EAET,YAAY,QAAgB,OAAgB;AAC1C,UAAM,uCAAuC,EAAE,MAAM,CAAC;AACtD,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAaO,SAAS,+BAAwD,MAAY;AAClF,MAAI,KAAK,SAAS,cAAc,KAAK,SAAS,2BAA2B,CAAC,KAAK,QAAQ;AACrF,WAAO;AAAA,EACT;AACA,QAAM,SAAS,KAAK;AACpB,SAAO;AAAA,IACL,GAAG;AAAA,IACH,QAAQ,OAAO,SAAgB,OAAe,YAAoB;AAChE,UAAI;AACF,eAAO,MAAM,OAAO,SAAS,OAAO,OAAO;AAAA,MAC7C,SAAS,OAAO;AACd,cAAM,SAAU,SAA6D,UACzE;AACJ,YACE,OAAO,WAAW,YAClB,OAAO,SAAS,KAChB,gDAAgD,KAAK,GACrD;AACA,gBAAM,IAAI,+BAA+B,QAAQ,KAAK;AAAA,QACxD;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAOO,SAAS,iCAAiC,OAA0B;AACzE,MAAI,CAAC,gDAAgD,KAAK,EAAG,QAAO,CAAC;AACrE,QAAM,UAAU,oBAAI,IAAY;AAChC,QAAM,UAAoD,CAAC,EAAE,OAAO,GAAG,OAAO,MAAM,CAAC;AACrF,QAAM,OAAO,oBAAI,QAAgB;AACjC,MAAI,YAAY;AAChB,SAAO,QAAQ,SAAS,KAAK,YAAY,WAAW;AAClD,UAAM,UAAU,QAAQ,MAAM;AAC9B,iBAAa;AACb,QAAI,CAAC,QAAQ,SAAS,OAAO,QAAQ,UAAU,YAAY,KAAK,IAAI,QAAQ,KAAK,EAAG;AACpF,QAAI,QAAQ,QAAQ,UAAW;AAC/B,SAAK,IAAI,QAAQ,KAAK;AACtB,QAAI,QAAQ,iBAAiB,gCAAgC;AAC3D,UAAI,gDAAgD,QAAQ,MAAM,KAAK,GAAG;AACxE,gBAAQ,IAAI,QAAQ,MAAM,MAAM;AAAA,MAClC;AACA;AAAA,IACF;AACA,UAAM,SAAS,QAAQ;AACvB,eAAW,OAAO,CAAC,SAAS,OAAO,GAAY;AAC7C,YAAM,aAAa,OAAO,yBAAyB,QAAQ,GAAG;AAC9D,UAAI,cAAc,WAAW,YAAY;AACvC,gBAAQ,KAAK,EAAE,OAAO,QAAQ,QAAQ,GAAG,OAAO,WAAW,MAAM,CAAC;AAAA,MACpE;AAAA,IACF;AACA,UAAM,SAAS,OAAO,yBAAyB,QAAQ,QAAQ;AAC/D,QAAI,UAAU,WAAW,UAAU,MAAM,QAAQ,OAAO,KAAK,GAAG;AAC9D,iBAAW,UAAU,OAAO,MAAM,MAAM,GAAG,EAAE,GAAG;AAC9C,gBAAQ,KAAK,EAAE,OAAO,QAAQ,QAAQ,GAAG,OAAO,OAAO,CAAC;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AACA,SAAO,CAAC,GAAG,OAAO;AACpB;;;ACnGA,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,aAAa;AAEtB,SAAS,2CAAAC,gDAA+C;AAExD,IAAM,OAAO,iBAAE,OAAO,EAAE,MAAM,iEAAiE;AAC/F,IAAM,QAAQ,iBAAE,OAAO,CAAC,CAAC,EAAE,OAAO;AAClC,IAAM,UAAU,iBACb,OAAO;AAAA,EACN,SAAS,iBAAE,QAAQ,CAAC;AAAA,EACpB,WAAW,iBAAE,OAAO,EAAE,IAAI,IAAI;AAAA,EAC9B,eAAe,iBAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACxC,aAAa,iBAAE,OAAO,EAAE,IAAI,GAAG;AACjC,CAAC,EACA,OAAO;AACV,IAAM,YAAY,iBACf,OAAO;AAAA,EACN,SAAS,iBAAE,QAAQ,CAAC;AAAA,EACpB,WAAW,iBAAE,QAAQ,2CAA2C;AAAA,EAChE,QAAQ,iBACL,OAAO;AAAA,IACN,aAAa;AAAA,IACb,OAAO,iBAAE,OAAO,EAAE,MAAM,4BAA4B;AAAA,IACpD,SAAS,iBAAE,OAAO,EAAE,MAAM,4BAA4B;AAAA,IACtD,KAAK,iBACF,OAAO,EACP,SAAS,EACT,IAAI,GAAG,EACP,OAAO,CAAC,UAAU;AACjB,YAAM,QAAQ,KAAK,MAAM,MAAO,KAAK;AACrC,aAAO,OAAO,cAAc,KAAK,KAAK,SAAS,KAAK,QAAQ,QAAS;AAAA,IACvE,CAAC;AAAA,IACH,WAAW,iBAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,IAAI,OAAS;AAAA,IACzD,gBAAgB,iBAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,KAAM;AAAA,IACzD,KAAK;AAAA,IACL,QAAQ,iBAAE,MAAM,CAAC,CAAC;AAAA,EACpB,CAAC,EACA,OAAO;AAAA,EACV,SAAS,iBAAE,KAAK;AAAA,EAChB,WAAW,iBACR,OAAO;AAAA,IACN,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa,iBAAE,MAAM,CAAC,iBAAE,QAAQ,WAAW,CAAC,CAAC;AAAA,IAC7C,SAAS,iBAAE,QAAQ,MAAM;AAAA,IACzB,KAAK;AAAA,EACP,CAAC,EACA,OAAO;AAAA,EACV,oBAAoB;AAAA,EACpB,SAAS,iBACN,OAAO,EAAE,aAAa,MAAM,UAAU,iBAAE,QAAQ,yBAAyB,EAAE,CAAC,EAC5E,OAAO;AACZ,CAAC,EACA,OAAO;AAIV,IAAM,aAAa,iBAChB,OAAO;AAAA,EACN,SAAS,iBAAE,QAAQ,CAAC;AAAA,EACpB,UAAU,iBAAE,QAAQ,uBAAuB;AAAA,EAC3C,gBAAgB,iBAAE,QAAQ,CAAC;AAAA,EAC3B,eAAe,iBAAE,QAAQ,MAAM;AAAA,EAC/B,YAAY,iBAAE,MAAM,CAAC,iBAAE,QAAQ,OAAO,GAAG,iBAAE,QAAQ,UAAU,CAAC,CAAC;AAAA,EAC/D,QAAQ,iBACL,OAAO;AAAA,IACN,SAAS,iBAAE,QAAQ,CAAC;AAAA,IACpB,QAAQ;AAAA,IACR,WAAW;AAAA,IACX,WAAW;AAAA,IACX,aAAa;AAAA,IACb,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,WAAW;AAAA,IACX,qBAAqB,iBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,IACtD,gBAAgB;AAAA,IAChB,gBAAgB;AAAA,IAChB,WAAW,iBAAE,QAAQ,MAAM;AAAA,IAC3B,eAAe,iBAAE,KAAK;AAAA,IACtB,YAAY,iBAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK;AAAA,IAChD,oBAAoB,iBAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,IAC9C,iBAAiB;AAAA,EACnB,CAAC,EACA,OAAO;AAAA,EACV;AACF,CAAC,EACA,OAAO;AASV,IAAM,gBAAgB;AAAA,EACpB,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,YAAY;AAAA;AAAA;AAAA,EAGZ,iBAAiB;AAAA,EACjB,YAAY,CAAC,SAAS,UAAU;AAAA,EAChC,eAAe;AAAA,EACf,KAAK,CAAC;AAAA,EACN,QAAQ,CAAC;AAAA,EACT,SAAS;AAAA,EACT,aAAa;AAAA,EACb,KAAK;AAAA,EACL,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG;AAAA,EAC3C,UAAU;AAAA,EACV,aAAa;AAAA,EACb,KAAK;AAAA,EACL,SAAS;AAAA,EACT,OAAO;AAAA,EACP,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,SAAS;AAAA,IACP,QAAQ;AAAA,IACR,eAAe,CAAC;AAAA,IAChB,iBAAiB,CAAC;AAAA,IAClB,cAAc,CAAC;AAAA,IACf,MAAM;AAAA,EACR;AAAA,EACA,SAAS,CAAC;AAAA,EACV,mBAAmB,CAAC;AAAA,EACpB,SAAS,CAAC;AAAA,EACV,OAAO,CAAC;AAAA,EACR,OAAO;AAAA,EACP,SAAS;AAAA,EACT,0BAA0B;AAAA,EAC1B,qBAAqB,CAAC;AAAA,EACtB,uBAAuB,CAAC;AAAA,EACxB,cAAc;AAChB;AACA,IAAMC,UAAS,CAAC,UAAkBC,YAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACjF,IAAM,sBAAsBD,QAAO,KAAK,UAAU,aAAa,CAAC;AAEhE,SAAS,OAAU,OAAwB;AACzC,MAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC/C,eAAW,SAAS,OAAO,OAAO,KAAK,EAAG,QAAO,KAAK;AACtD,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,SAAO;AACT;AACA,OAAO,aAAa;AAIpB,SAAS,QAAQ,OAAgB,QAAQ,GAAS;AAChD,MAAI,QAAQ,GAAI,OAAM,IAAI,MAAM,+CAA+C;AAC/E,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW;AAC/E,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,OAAO,SAAS,KAAK,KAAK,CAAC,OAAO,GAAG,OAAO,EAAE,EAAG;AACrD,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAEA,MAAI,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK;AAClD,UAAM,IAAI,MAAM,+CAA+C;AACjE,QAAM,QAAQ,MAAM,QAAQ,KAAK;AACjC,QAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,MAAI,QAAQ,cAAc,MAAM,YAAY,cAAc,OAAO,aAAa,cAAc;AAC1F,UAAM,IAAI,MAAM,+CAA+C;AACjE,QAAM,cAAc,OAAO,0BAA0B,KAAK;AAC1D,QAAM,OAAO,QAAQ,QAAQ,WAAW,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,QAAQ,SAAS;AACtF,MAAI,SAAS,KAAK,WAAY,MAAoB;AAChD,UAAM,IAAI,MAAM,+CAA+C;AACjE,aAAW,OAAO,MAAM;AACtB,QAAI,OAAO,QAAQ,YAAa,SAAS,CAAC,qBAAqB,KAAK,GAAG;AACrE,YAAM,IAAI,MAAM,+CAA+C;AACjE,UAAM,aAAa,YAAY,GAAG;AAClC,QAAI,CAAC,WAAW,cAAc,EAAE,WAAW;AACzC,YAAM,IAAI,MAAM,+CAA+C;AACjE,YAAQ,WAAW,OAAO,QAAQ,CAAC;AAAA,EACrC;AACF;AAMA,SAAS,kBAAkB,MAA6B;AACtD,QAAM,SAAS,KAAK,UAAU;AAC9B,SAAO;AAAA,IACL,OAAO,OAAO;AAAA,IACd,YAAY;AAAA,MACV,gBAAgB,CAAC,GAAG,KAAK,UAAU;AAAA,MACnC,UAAU,CAAC;AAAA,MACX,SAAS,OAAO;AAAA,MAChB,WAAW,CAAC;AAAA,MACZ,WAAW;AAAA,QACT,UAAU,OAAO;AAAA,QACjB,UAAU,KAAK,MAAM,MAAO,OAAO,GAAG;AAAA,QACtC,WAAW,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG;AAAA,QAC5C,aAAa;AAAA,QACb,iBAAiB;AAAA,QACjB,aAAa;AAAA,QACb,MAAM;AAAA,MACR;AAAA,MACA,eAAe;AAAA,MACf,aAAc,OAAO,iBAAiB,MAAQ;AAAA,MAC9C,SAAS,KAAK;AAAA,MACd,WAAW,CAAC;AAAA,MACZ,cAAc;AAAA,MACd,cAAc;AAAA,MACd,UAAU,CAAC;AAAA,MACX,mBAAmB,CAAC;AAAA,MACpB,cAAc,CAAC;AAAA,MACf,SAAS;AAAA,MACT,oBAAoB;AAAA,MACpB,UAAU;AAAA,MACV,WAAW,EAAE,OAAO,CAAC,EAAE;AAAA,MACvB,aAAa;AAAA,MACb,eAAe,EAAE,mBAAmB,GAAG,cAAc,CAAC,GAAG,gBAAgB,CAAC,EAAE;AAAA,MAC5E,SAAS;AAAA,MACT,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,MACjB,kBAAkB;AAAA,MAClB,qBAAqB;AAAA,MACrB,SAAS;AAAA,MACT,SAAS;AAAA,MACT,MAAM,mBAAmB,OAAO,WAAW;AAAA,MAC3C,qBAAqB,CAAC;AAAA,MACtB,uBAAuB,CAAC;AAAA,MACxB,qBAAqB,CAAC;AAAA,MACtB,iBAAiB;AAAA,MACjB,8BAA8B;AAAA,MAC9B,qBAAqB;AAAA,MACrB,cAAc;AAAA,MACd,0BAA0B;AAAA,MAC1B,gBAAgB;AAAA,MAChB,sBAAsB,CAAC;AAAA,MACvB,sBAAsB;AAAA,IACxB;AAAA,IACA,iBAAiB;AAAA,IACjB,MAAM,CAAC,EAAE,SAAS,yCAAyC,UAAU,OAAO,YAAY,CAAC;AAAA,EAC3F;AACF;AAsBA,IAAM,WAAW,oBAAI,QAA8C;AAK5D,SAAS,yBACd,OAC8B;AAC9B,MAAI;AACF,YAAQ,KAAK;AACb,UAAM,SAAkB,gBAAgB,KAAK;AAC7C,QAAI,OAAO,WAAW,KAAK,UAAU,MAAM,CAAC,IAAI;AAC9C,YAAM,IAAI,MAAM,+CAA+C;AACjE,UAAM,OAAO,WAAW,MAAM,MAAM;AACpC,UAAM,EAAE,QAAQ,WAAW,KAAK,IAAI;AACpC,UAAM,YAAYD,yCAAwC,OAAO,eAAe;AAChF,UAAM,YAAY,IAAI,IAAI,OAAO,gBAAgB,SAAS;AAC1D,QACE,CAAC,aACD,UAAU,QAAQ,OAAO,sBACxB,CAAC,aAAa,iBAAiB,aAAa,EAAY;AAAA,MACvD,CAAC,UAAU,UAAU,QAAQ,KAAK,MAAM,OAAO,gBAAgB,KAAK;AAAA,IACtE,KACA,CAAC,CAAC,UAAU,OAAO,EAAE,SAAS,UAAU,QAAQ,KAChD,UAAU,YACV,UAAU,YACV,UAAU,UACV,UAAU,QACV,OAAO,cAAc,OAAO;AAE5B,YAAM,IAAI,MAAM,+CAA+C;AACjE,UAAM,MAAM;AAAA,MACV,OAAO;AAAA,MACP,OAAO;AAAA,MACP,KAAK,OAAO;AAAA,MACZ,KAAK,UAAU;AAAA,MACf,KAAK,UAAU;AAAA,MACf,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,IACf;AACA,QAAI,IAAI,IAAI,GAAG,EAAE,SAAS,EAAG,OAAM,IAAI,MAAM,+CAA+C;AAC5F,UAAM,UAAU,kBAAkB,IAAI;AACtC,UAAM,cAAc,KAAK,UAAU,OAAO;AAC1C,UAAM,cAA4C,OAAO;AAAA,MACvD,SAAS;AAAA,MACT,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB;AAAA,MACA,SAAS;AAAA,QACP,UAAU;AAAA,QACV,QAAQC,QAAO,WAAW;AAAA,QAC1B,YAAY,OAAO,WAAW,WAAW;AAAA,QACzC,oBAAoB;AAAA,MACtB;AAAA,IACF,CAAC;AACD,UAAM,SAAS,OAAO,OAAO,CAAC,CAAC;AAC/B,aAAS,IAAI,QAAQ,WAAW;AAChC,WAAO;AAAA,EACT,QAAQ;AAEN,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACF;AAIO,SAAS,0BACd,QAC8B;AAC9B,QAAM,cAAc,SAAS,IAAI,MAAM;AACvC,MAAI,CAAC,YAAa,OAAM,IAAI,MAAM,yCAAyC;AAC3E,SAAO;AACT;;;AC9TA;AAAA,EACE,uBAAAE;AAAA,EACA,8CAAAC;AAAA,EACA;AAAA,OACK;AAMA,IAAM,cAAcC;AAOpB,IAAM,2BAA2B;AAMxC,IAAM,kCAAkC;AACxC,IAAM,iCAAiC;AACvC,IAAM,qCAAqC;AAK3C,IAAM,gCAAgC;AACtC,IAAM,+BAA+B;AAIrC,IAAM,uBAAuB;AAC7B,IAAM,yBAAyB;AAwB/B,IAAM,kBAAkB;AAgBxB,IAAM,2BAA2B;AAU1B,IAAM,2BAA4C,EAAE,OAAO,MAAM,QAAQ,KAAK,KAAK,GAAG;AAOtF,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAClC;AAAA,EACA;AAAA,EAET,YAAY,UAAkB,QAAgB;AAC5C,UAAM,QACJ,aAAa,KACT,SACA,aAAa,KACX,WACA,aAAa,KACX,eACA,aAAa,KACX,UACA,aAAa,KACX,SACA,aAAa,OAAO,4BAA4B,KAAK,MAAM,IACzD,YACA;AAChB;AAAA,MACE,0CAA0C,KAAK,WAAW,QAAQ,IAAI,SAAS;AAAA,EAAM,MAAM,KAAK,EAAE;AAAA,IACpG;AACA,SAAK,OAAO;AACZ,SAAK,WAAW;AAChB,SAAK,QAAQ;AAAA,EACf;AACF;AAKO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EACtD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AA6FO,SAAS,wBAAwB,UAAqC,CAAC,GAAW;AACvF,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,OAAO,QAAQ,QAAQA;AAC7B,QAAM,MACJ,aAAa,SAAS,KAAK,cAAc,SAAS,MAAM,gBACzC,SAAS,GAAG,gBAAgB,IAAI;AAmCjD,QAAM,iBACJ,0TAIO,GAAG;AACZ,QAAM,UACJ,sBAAsB,IAAI,kJAEQ,IAAI,aAAa,SAAS,KAAK,IAAI,SAAS,MAAM,QAAQ,SAAS,GAAG,uOAS7FC,YAAW,cAAc,CAAC;AAUvC,QAAM,YACJ;AAcF,QAAM,aACJ,GAAG,SAAS,mGAEQ,oBAAoB,+IAUtB,eAAe,uBAAuB,eAAe,wEAAwE,wBAAwB,wEAIvJ,oBAAoB,oFAAoF,eAAe,+DAC9H,sBAAsB;AAEjC,QAAM,QACJ;AAGF,SAAO,GAAG,KAAK,uCAAuC,OAAO,aAAa,UAAU;AACtF;AAEA,SAAS,iBAAiB,QAAyC;AACjE,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO;AAAA,EACT;AACA,SAAO,CAAC,OAAO,QAAQ,OAAO,QAAQ,OAAO,MAAM,EAChD,OAAO,CAAC,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS,CAAC,EAChE,KAAK,IAAI;AACd;AAEA,SAAS,mBAAmB,QAAgD;AAC1E,MAAI,OAAO,WAAW,UAAU;AAC9B,UAAM,SAAS,wBAAwB,MAAM;AAC7C,QAAI,OAAO,SAAS,SAAU,QAAO,OAAO;AAG5C,WAAO,OAAO,SAAS,YAAY,KAAK;AAAA,EAC1C;AACA,SAAO,OAAO,OAAO,aAAa,WAAW,OAAO,WAAW;AACjE;AAEA,SAAS,oBAAoB,QAAgD;AAC3E,MAAI,OAAO,WAAW,UAAU;AAC9B,UAAM,SAAS,wBAAwB,MAAM;AAC7C,WAAO,OAAO,SAAS,YAAY,OAAO,YAAY;AAAA,EACxD;AACA,QAAM,QAAQ,OAAO,aAAa,OAAO;AACzC,SAAO,OAAO,UAAU,WAAW,QAAQ;AAC7C;AAEA,SAASA,YAAW,OAAuB;AACzC,SAAO,IAAI,MAAM,WAAW,KAAK,OAAO,CAAC;AAC3C;AAKA,SAAS,2BACP,SACA,WACA,YACA,aACQ;AACR,QAAM,UAAU,KAAK;AAAA,IACnB;AAAA,IACA,KAAK,IAAI,IAAI,KAAK,MAAM,YAAY,CAAC,CAAC;AAAA,EACxC;AACA,QAAM,mBAAmB,KAAK,IAAI,GAAG,YAAY,OAAO;AACxD,QAAM,cAAc,KAAK,IAAI,GAAG,KAAK,MAAM,UAAU,CAAC,CAAC;AACvD,QAAM,yBAAyB,mBAAmB,KAAO,QAAQ,CAAC;AAClE,QAAM,oBAAoB,cAAc,KAAO,QAAQ,CAAC;AACxD,QAAM,iBACJ,UAAUA,YAAW,UAAU,CAAC,WAAWA,YAAW,WAAW,CAAC,sZAUvDA,YAAW,OAAO,CAAC;AAChC;AAAA;AAAA;AAAA;AAAA;AAAA,IAKE,sCAAsC,gBAAgB,KAAK,qBAAqB,aACrEA,YAAW,cAAc,CAAC,iFAMQ,gBAAgB;AAAA;AAEjE;AAEA,IAAM,+BAAN,cAA2C,MAAM;AAAC;AAClD,IAAM,mCAAN,cAA+C,MAAM;AAAC;AAgCtD,IAAM,oCAAoC,oBAAI,IAAwC;AACtF,IAAM,oCAAoC,oBAAI,QAA4C;AAC1F,IAAM,8BAA8B,oBAAI,QAA4C;AAEpF,SAAS,SAAS,OAAgD;AAChE,SAAO,UAAU,QAAQ,OAAO,UAAU,WAAY,QAAoC;AAC5F;AAEA,SAAS,eAAe,OAA+B;AACrD,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AACjE;AAEA,SAAS,iBAAiB,SAA2B;AACnD,MAAI;AACF,WAAO,SAAS,OAAO,GAAG;AAAA,EAC5B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,sBACP,SACA,SACe;AACf,QAAM,WAAW,eAAe,QAAQ,kBAAkB,SAAS;AACnE,MAAI,SAAU,QAAO,WAAW,QAAQ;AAExC,QAAM,gBAAgB,SAAS,OAAO;AACtC,QAAM,QAAQ,SAAS,iBAAiB,OAAO,CAAC;AAChD,QAAM,gBAAgB,QAAQ,SAAS,MAAM,aAAa,IAAI;AAC9D,QAAM,aAAa,CAAC,eAAe,OAAO,aAAa;AAKvD,QAAM,SAAS;AAAA,IACb;AAAA,IACA,GAAGC;AAAA,EACL;AACA,aAAW,aAAa,YAAY;AAClC,QAAI,CAAC,UAAW;AAChB,eAAW,SAAS,QAAQ;AAC1B,YAAM,QAAQ,eAAe,UAAU,KAAK,CAAC;AAC7C,UAAI,MAAO,QAAO,WAAW,KAAK;AAAA,IACpC;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,oBAAgD;AACvD,SAAO;AAAA,IACL,OAAO;AAAA,IACP,OAAO;AAAA,IACP,SAAS,CAAC;AAAA,IACV,UAAU,oBAAI,IAAI;AAAA,IAClB,OAAO;AAAA,IACP,gBAAgB,oBAAI,IAAI;AAAA,IACxB,qBAAqB;AAAA,EACvB;AACF;AAEA,SAAS,eACP,SACA,SACmC;AACnC,OAAK,OAAO,YAAY,YAAY,YAAY,SAAS,OAAO,YAAY,YAAY;AACtF,WAAO;AAAA,EACT;AACA,QAAM,YAAY,sBAAsB,SAAS,OAAO;AACxD,MAAI,WAAW;AACb,QAAIC,SAAQ,kCAAkC,IAAI,SAAS;AAC3D,QAAI,CAACA,QAAO;AACV,MAAAA,SAAQ,kBAAkB;AAC1B,wCAAkC,IAAI,WAAWA,MAAK;AAAA,IACxD;AACA,WAAOA;AAAA,EACT;AAKA,QAAM,gBAAgB,iBAAiB,OAAO;AAC9C,MAAI,kBAAkB,OAAO,kBAAkB,YAAY,OAAO,kBAAkB,aAAa;AAC/F,UAAM,WAAW;AACjB,QAAIA,SAAQ,kCAAkC,IAAI,QAAQ;AAC1D,QAAI,CAACA,QAAO;AACV,MAAAA,SAAQ,kBAAkB;AAC1B,wCAAkC,IAAI,UAAUA,MAAK;AAAA,IACvD;AACA,WAAOA;AAAA,EACT;AAEA,QAAM,MAAM;AACZ,MAAI,QAAQ,4BAA4B,IAAI,GAAG;AAC/C,MAAI,CAAC,OAAO;AACV,YAAQ,kBAAkB;AAC1B,gCAA4B,IAAI,KAAK,KAAK;AAAA,EAC5C;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,QAAqC,OAAuB;AACzF,MAAI,OAAO,QAAS;AACpB,SAAO,UAAU;AACjB,MAAI,OAAO,MAAO,cAAa,OAAO,KAAK;AAC3C,MAAI,UAAU,OAAW,QAAO,QAAQ;AAAA,MACnC,QAAO,OAAO,KAAK;AAC1B;AAEA,SAAS,qBAAqB,OAAyC;AACrE,MAAI,MAAM,MAAO;AACjB,SAAO,MAAM,QAAQ,SAAS,GAAG;AAC/B,UAAM,SAAS,MAAM,QAAQ,MAAM;AACnC,QAAI,OAAO,QAAS;AACpB,QAAI,OAAO,UAAU,MAAM,OAAO;AAChC,4BAAsB,QAAQ,IAAI,iCAAiC,CAAC;AACpE;AAAA,IACF;AACA,UAAM,QAAQ;AACd,0BAAsB,MAAM;AAC5B;AAAA,EACF;AACF;AAEA,SAAS,iBACP,OACA,UACqB;AACrB,SAAO,IAAI,QAAoB,CAACC,UAAS,WAAW;AAClD,UAAM,SAAsC;AAAA,MAC1C,OAAO,MAAM;AAAA,MACb,SAAS;AAAA,MACT,SAAS,MAAM;AACb,QAAAA,SAAQ,MAAM;AACZ,cAAI,MAAM,UAAU,OAAQ;AAC5B,gBAAM,QAAQ;AACd,+BAAqB,KAAK;AAAA,QAC5B,CAAC;AAAA,MACH;AAAA,MACA;AAAA,IACF;AACA,UAAM,QAAQ,KAAK,MAAM;AACzB,UAAM,cAAc,WAAW,aAAa;AAC5C,QAAI,eAAe,GAAG;AACpB,aAAO,UAAU;AACjB,YAAM,UAAU,MAAM,QAAQ,OAAO,CAAC,cAAc,cAAc,MAAM;AACxE,aAAO,IAAI,6BAA6B,CAAC;AACzC;AAAA,IACF;AACA,WAAO,QAAQ,WAAW,MAAM;AAC9B,UAAI,OAAO,QAAS;AACpB,aAAO,UAAU;AACjB,YAAM,UAAU,MAAM,QAAQ,OAAO,CAAC,cAAc,cAAc,MAAM;AACxE,aAAO,IAAI,6BAA6B,CAAC;AAAA,IAC3C,GAAG,WAAW;AACd,WAAO,MAAM,QAAQ;AACrB,yBAAqB,KAAK;AAAA,EAC5B,CAAC;AACH;AAEA,SAAS,2BAA2B,OAAmC,OAAqB;AAC1F,QAAM,WAA0C,CAAC;AACjD,aAAW,UAAU,MAAM,SAAS;AAClC,QAAI,OAAO,UAAU;AACnB,4BAAsB,QAAQ,IAAI,iCAAiC,CAAC;AAAA,QACjE,UAAS,KAAK,MAAM;AAAA,EAC3B;AACA,QAAM,UAAU;AAClB;AAEA,SAAS,eAAuB;AAC9B,SAAO,YAAY,IAAI;AACzB;AAEA,eAAe,uBACb,OACA,UACkB;AAClB,QAAM,QAAQ,MAAM;AACpB,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,UAAM,eAAe,OAAO,QAAQ;AAAA,EACtC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,MAAM,UAAU,MAAO,OAAM,QAAQ;AACzC,SAAO;AACT;AAEA,SAAS,kBACP,OACA,SACY;AACZ,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,SAAS,IAAI,OAAO;AAC1B,OAAK,QAAQ;AAAA,IACX,MAAM,MAAM,SAAS,OAAO,OAAO;AAAA,IACnC,MAAM,MAAM,SAAS,OAAO,OAAO;AAAA,EACrC;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,SAA4C;AACxE,MAAI,QAAQ,WAAW,EAAG,QAAO,QAAQ,QAAQ;AACjD,SAAO,IAAI,QAAc,CAACA,aAAY;AACpC,QAAI,YAAY,QAAQ;AACxB,QAAI;AACJ,UAAM,SAAS,MAAM;AACnB,UAAI,MAAO,cAAa,KAAK;AAC7B,MAAAA,SAAQ;AAAA,IACV;AACA,YAAQ,WAAW,QAAQ,4BAA4B;AACvD,UAAM,QAAQ;AACd,eAAW,WAAW,SAAS;AAC7B,WAAK,QAAQ;AAAA,QACX,MAAM;AACJ,uBAAa;AACb,cAAI,cAAc,EAAG,QAAO;AAAA,QAC9B;AAAA,QACA,MAAM;AACJ,uBAAa;AACb,cAAI,cAAc,EAAG,QAAO;AAAA,QAC9B;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,SAAS,eACP,OACA,OACA,iBACA,SACM;AACN,kBAAgB,MAAM,IAAI,6BAA6B,CAAC;AACxD,MAAI,CAAC,MAAO;AAEZ,MAAI,MAAM,UAAU,MAAO;AAE3B,QAAM,eAAe,IAAI,QAAQ,aAAa,OAAO;AACrD,QAAM,sBAAsB;AAC5B,6BAA2B,OAAO,KAAK;AAKvC,QAAM,SAAS;AACf,QAAM,UAAU,CAAC,GAAG,MAAM,QAAQ;AAClC,QAAM,QAAQ,qBAAqB,OAAO;AAC1C,QAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAI,CAAC,MAAM,OAAO,KAAK,CAAC,EAAE,KAAK,MAAM,MAAS,IAAI;AAItF,OAAK,MAAM,KAAK,MAAM;AACpB,eAAW,WAAW,QAAS,OAAM,SAAS,OAAO,OAAO;AAAA,EAC9D,CAAC;AACH;AAEA,SAAS,uBAAuB,OAA0C,OAAqB;AAC7F,MAAI,SAAS,MAAM,UAAU,MAAO,OAAM,IAAI,iCAAiC;AACjF;AAEA,eAAe,eACb,SACA,UACA,MAAoB,cACR;AACZ,QAAM,cAAc,WAAW,IAAI;AACnC,MAAI,eAAe,EAAG,OAAM,IAAI,6BAA6B;AAC7D,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK;AAAA,MACxB;AAAA,MACA,IAAI,QAAW,CAAC,UAAU,WAAW;AACnC,gBAAQ,WAAW,MAAM,OAAO,IAAI,6BAA6B,CAAC,GAAG,WAAW;AAChF,cAAM,QAAQ;AAAA,MAChB,CAAC;AAAA,IACH,CAAC;AAAA,EACH,UAAE;AACA,QAAI,MAAO,cAAa,KAAK;AAAA,EAC/B;AACF;AAEA,SAAS,2BAA2B,YAAoB,aAA6B;AACnF,QAAM,SAASH,YAAW,UAAU;AACpC,QAAM,QAAQA,YAAW,WAAW;AAMpC,QAAM,SACJ,UAAU,MAAM,WAAW,KAAK;AAoBlC,SAAO,wDAAwDA,YAAW,MAAM,CAAC;AACnF;AAEA,eAAe,6BACb,SACA,SACA,UACkC;AAClC,QAAM,aAAa,IAAI,gBAAgB;AACvC,MAAI,SAAkC,MAAM;AAAA,IAC1C,QAAQ;AAAA,MACN,OAAO,QAAQ,SAAS,aACpB,QAAQ,KAAK;AAAA,QACX,KAAK;AAAA,QACL,aAAa,KAAK,IAAI,KAAK,6BAA6B;AAAA,QACxD,iBAAiB;AAAA,QACjB,QAAQ,WAAW;AAAA,MACrB,CAAC,IACD,QAAQ,YAAa;AAAA,QACnB,KAAK;AAAA,QACL,aAAa,KAAK,IAAI,KAAK,6BAA6B;AAAA,QACxD,iBAAiB;AAAA,QACjB,QAAQ,WAAW;AAAA,MACrB,CAAC;AAAA,IACP;AAAA,IACA;AAAA,EACF;AAEA,MAAI,oBAAoB,oBAAoB,MAAM;AAClD,SAAO,sBAAsB,MAAM;AACjC,QAAI,OAAO,QAAQ,eAAe,YAAY;AAC5C,YAAM,IAAI,MAAM,qDAAqD;AAAA,IACvE;AACA,UAAM,cAAc,WAAW,aAAa;AAC5C,QAAI,eAAe,EAAG,OAAM,IAAI,6BAA6B;AAC7D,aAAS,MAAM;AAAA,MACb,QAAQ,WAAW;AAAA,QACjB,WAAW;AAAA,QACX,OAAO;AAAA,QACP,aAAa,KAAK,IAAI,GAAG,KAAK,IAAI,KAAK,cAAc,CAAC,CAAC;AAAA,QACvD,iBAAiB;AAAA,QACjB,QAAQ,WAAW;AAAA,MACrB,CAAC;AAAA,MACD;AAAA,IACF;AACA,wBAAoB,oBAAoB,MAAM;AAAA,EAChD;AACA,SAAO;AACT;AAEA,eAAe,yBACb,SACA,mBACA,UACe;AACf,MAAI,sBAAsB,QAAQ,OAAO,QAAQ,eAAe,WAAY;AAC5E,MAAI;AAGF,UAAM;AAAA,MACJ,QAAQ,WAAW;AAAA,QACjB,WAAW;AAAA,QACX,OAAO;AAAA,QACP,aAAa;AAAA,QACb,iBAAiB;AAAA,MACnB,CAAC;AAAA,MACD;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AACF;AAEA,eAAe,2BACb,SACA,SACA,UACkB;AAClB,MAAI;AACF,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA,2BAA2B,QAAQ,YAAY,QAAQ,WAAW;AAAA,MAClE;AAAA,IACF;AACA,UAAM,SAAS,iBAAiB,MAAM;AACtC,UAAMI,UAAS,kEAAkE;AAAA,MAC/E;AAAA,IACF,IAAI,CAAC;AACL,WAAOA,YAAW;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,wBACb,SACA,OACA,UACkB;AAClB,QAAM,UAAU,CAAC,GAAG,MAAM,eAAe,OAAO,CAAC;AACjD,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM,sBAAsB;AAC5B,WAAO;AAAA,EACT;AACA,QAAM,UAAU,MAAM,QAAQ;AAAA,IAC5B,QAAQ,IAAI,OAAO,aAAa;AAAA,MAC9B;AAAA,MACA,SAAS,MAAM,2BAA2B,SAAS,SAAS,QAAQ;AAAA,IACtE,EAAE;AAAA,EACJ;AACA,aAAW,EAAE,SAAS,QAAQ,KAAK,SAAS;AAC1C,QAAI,QAAS,OAAM,eAAe,OAAO,QAAQ,WAAW;AAAA,EAC9D;AACA,QAAM,sBAAsB,MAAM,eAAe,SAAS;AAC1D,SAAO,MAAM;AACf;AAEA,SAAS,YAAoB;AAC3B,SAAO,GAAG,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC;AAC9E;AAEA,SAAS,kBACP,SACA,SACA,MAAoB,cACpB;AACA,QAAM,KAAK,UAAU;AACrB,QAAM,UAAU,QAAQ;AACxB,QAAM,OACJ,QAAQ,gBACP,UACG,CAAC,UACC,QAAQ,KAAK,mBAAmB,KAAK,UAAU,KAAK,CAAC,EAAE,IACzD;AACN,QAAM,uBAAuB,oBAAI,IAAY;AAE7C,QAAM,OAAO,CACX,OACAA,SACA,SAKI,CAAC,MACF;AACH,QAAI,CAAC,KAAM;AACX,UAAM,QAAoC;AAAA,MACxC,MAAM;AAAA,MACN,WAAW;AAAA,MACX;AAAA,MACA,QAAAA;AAAA,MACA,WAAW,OAAO,aAAa,IAAI,IAAI;AAAA,MACvC,QAAQ,OAAO,UAAU;AAAA,MACzB,gBAAgB,OAAO,kBAAkB;AAAA,MACzC,YAAY,SAAS,cAAc;AAAA,MACnC,GAAI,SAAS,YAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,MAC7D,GAAI,SAAS,eAAe,SAAY,EAAE,YAAY,QAAQ,WAAW,IAAI,CAAC;AAAA,MAC9E,GAAI,OAAO,sBAAsB,SAC7B,EAAE,mBAAmB,OAAO,kBAAkB,IAC9C,CAAC;AAAA,IACP;AACA,QAAI;AACF,WAAK,QAAQ,QAAQ,KAAK,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,IACzD,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,oBAAoB,CAAC,WAAmB;AAC5C,eAAW,SAAS,OAAO;AAAA,MACzB;AAAA,IACF,GAAG;AACD,YAAM,CAAC,MAAM,OAAO,SAAS,cAAc,IAAI;AAC/C,UAAI,CAAC,SAAS,CAAC,WAAW,qBAAqB,IAAI,IAAI,EAAG;AAC1D,2BAAqB,IAAI,IAAI;AAC7B,WAAK,OAAO,aAAa;AAAA,QACvB,QAAQ;AAAA,QACR,WAAW,OAAO,OAAO;AAAA,QACzB,gBAAiB,kBAA6D;AAAA,MAChF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,EAAE,MAAM,kBAAkB;AACnC;AAMA,SAAS,oBAAoB,QAAwB;AACnD,MAAI,2BAA2B,KAAK,MAAM,GAAG;AAC3C,WAAO;AAAA,EACT;AACA,MAAI,gCAAgC,KAAK,MAAM,GAAG;AAChD,WAAO;AAAA,EACT;AAKA,MAAI,gCAAgC,KAAK,MAAM,GAAG;AAChD,WAAO;AAAA,EACT;AACA,MAAI,wBAAwB,KAAK,MAAM,GAAG;AACxC,WAAO;AAAA,EACT;AACA,MAAI,yBAAyB,KAAK,MAAM,GAAG;AACzC,WAAO;AAAA,EACT;AACA,MAAI,mBAAmB,KAAK,MAAM,GAAG;AACnC,WAAO;AAAA,EACT;AACA,MAAI,uBAAuB,KAAK,MAAM,GAAG;AACvC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAeA,eAAsB,mBACpB,SACA,UAAqC,CAAC,GACH;AACnC,QAAM,IAAI;AACV,MAAI,OAAO,GAAG,SAAS,cAAc,OAAO,GAAG,gBAAgB,YAAY;AACzE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,OAAO,QAAQ,QAAQL;AAC7B,QAAM,YAAY,QAAQ,aAAa;AACvC,MAAI,CAAC,OAAO,SAAS,SAAS,KAAK,aAAa,GAAG;AACjD,UAAM,IAAI,WAAW,+DAA+D;AAAA,EACtF;AACA,QAAM,UAAU,aAAa;AAC7B,QAAM,WAAW,UAAU;AAC3B,QAAM,YAAY,kBAAkB,SAAS,SAAS,YAAY;AAClE,QAAM,iBAAiB,UAAU;AACjC,QAAM,aAAa,uCAAuC,cAAc;AACxE,QAAM,MAAM;AAAA,IACV,wBAAwB,EAAE,UAAU,KAAK,CAAC;AAAA,IAC1C;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,cAAwB,CAAC;AAC/B,QAAM,QAAQ,eAAe,SAAS,OAAO;AAC7C,MAAI;AACJ,MAAI,OAAO;AACT,QAAI;AACF,gBAAU,MAAM,iBAAiB,OAAO,QAAQ;AAAA,IAClD,SAAS,OAAO;AACd,UACE,iBAAiB,gCACjB,iBAAiB,kCACjB;AACA,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAEA,MAAI;AACF,QAAI,SAAS,CAAC,MAAM,qBAAqB;AACvC,YAAM,kBAAkB,aAAa,IAAI;AACzC,YAAM,WAAW,MAAM,wBAAwB,GAAG,OAAO,eAAe;AACxE,UAAI,CAAC,UAAU;AAIb,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,UAAM,QAAQ,OAAO,SAAS;AAC9B,UAAM,kBAAkB,IAAI,gBAAgB;AAC5C,QAAI,0BAAyC;AAC7C,cAAU,KAAK,iBAAiB,SAAS;AACzC,cAAU,KAAK,eAAe,SAAS;AAEvC,QAAI;AACF,YAAM,iBAAiB,KAAK,IAAI,GAAG,KAAK,IAAI,iCAAiC,YAAY,CAAC,CAAC;AAC3F,YAAM,cAAgD;AAAA,QAGpD;AAAA,QACA,QAAQ;AAAA,UACN,OAAO,EAAE,SAAS,aACd,EAAE,KAAK;AAAA,YACL;AAAA,YACA,aAAa;AAAA,YACb,iBAAiB;AAAA,YACjB,QAAQ,gBAAgB;AAAA,UAC1B,CAAC,IACD,EAAE,YAAa;AAAA,YACb;AAAA,YACA,aAAa;AAAA,YACb,iBAAiB;AAAA,YACjB,QAAQ,gBAAgB;AAAA,UAC1B,CAAC;AAAA,QACP;AAAA,MACF;AACA,UAAI,SAAkC,MAAM;AAAA,QAC1C;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,6BAAuB,OAAO,KAAK;AACnC,UAAI,QAAQ,iBAAiB,MAAM;AACnC,kBAAY,KAAK,KAAK;AACtB,gBAAU,kBAAkB,KAAK;AACjC,gBAAU,KAAK,yBAAyB,WAAW;AAEnD,UAAI,oBAAoB,oBAAoB,MAAM;AAClD,gCAA0B;AAC1B,aAAO,sBAAsB,MAAM;AACjC,kBAAU,KAAK,kBAAkB,WAAW,EAAE,kBAAkB,CAAC;AACjE,YAAI,OAAO,EAAE,eAAe,YAAY;AACtC,gBAAM,IAAI;AAAA,YACR;AAAA,YACA,GAAG,YAAY,KAAK,IAAI,CAAC;AAAA,2BAA8B,iBAAiB;AAAA,UAC1E;AAAA,QACF;AACA,+BAAuB,OAAO,KAAK;AACnC,cAAM,cAAc,WAAW,aAAa;AAC5C,YAAI,eAAe,EAAG,OAAM,IAAI,6BAA6B;AAC7D,cAAM,cAAc,KAAK,IAAI,GAAG,KAAK,IAAI,gCAAgC,cAAc,CAAC,CAAC;AACzF,iBAAS,MAAM;AAAA,UACb;AAAA,YACE;AAAA,YACA,EAAE,WAAW;AAAA,cACX,WAAW;AAAA,cACX,OAAO;AAAA,cACP,aAAa;AAAA,cACb,iBAAiB;AAAA,cACjB,QAAQ,gBAAgB;AAAA,YAC1B,CAAC;AAAA,UACH;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA,+BAAuB,OAAO,KAAK;AACnC,gBAAQ,iBAAiB,MAAM;AAC/B,oBAAY,KAAK,KAAK;AACtB,kBAAU,kBAAkB,KAAK;AACjC,4BAAoB,oBAAoB,MAAM;AAC9C,kCAA0B;AAAA,MAC5B;AAEA,YAAM,SAAS,YAAY,KAAK,IAAI;AACpC,YAAM,WAAW,mBAAmB,MAAM,KAAK,oBAAoB,MAAM;AACzE,gBAAU,KAAK,oBAAoB,aAAa,IAAI,cAAc,QAAQ;AAC1E,UAAI,aAAa,GAAG;AAClB,cAAM,IAAI,kBAAkB,UAAU,MAAM;AAAA,MAC9C;AAEA,YAAM,UAAU,OAAO,MAAM,2BAA2B,KAAK,CAAC,EAAE,GAAG,CAAC;AACpE,gBAAU,KAAK,sBAAsB,WAAW;AAChD,aAAO,EAAE,MAAM,UAAU,OAAO;AAAA,IAClC,SAAS,OAAO;AACd,UACE,iBAAiB,gCACjB,iBAAiB,kCACjB;AACA,cAAM,iBAA6C;AAAA,UACjD;AAAA,UACA,aAAa;AAAA,QACf;AACA,uBAAe,OAAO,OAAO,iBAAiB,cAAc;AAC5D,cAAM,kBAAkB,aAAa,IAAI;AACzC,kBAAU,KAAK,mBAAmB,SAAS;AAC3C,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,UACA,KAAK,IAAI,iBAAiB,aAAa,IAAI,EAAE;AAAA,QAC/C;AACA,YAAI,WAAW;AACf,YAAI,OAAO;AACT,qBAAW,MAAM,wBAAwB,GAAG,OAAO,eAAe;AAClE,cAAI,CAAC,UAAU;AACb,kBAAM;AAAA,cACJ;AAAA,cACA,KAAK,IAAI,iBAAiB,aAAa,IAAI,4BAA4B;AAAA,YACzE;AAAA,UACF;AAAA,QACF,OAAO;AACL,qBAAW,MAAM,2BAA2B,GAAG,gBAAgB,eAAe;AAAA,QAChF;AACA,kBAAU,KAAK,mBAAmB,WAAW,cAAc,QAAQ;AACnE,cAAM,SAAS,GAAG,YAAY,KAAK,IAAI,CAAC;AAAA,mCAAsC,SAAS;AACvF,kBAAU,KAAK,iBAAiB,QAAQ;AACxC,cAAM,IAAI,kBAAkB,KAAK,MAAM;AAAA,MACzC;AACA,gBAAU,KAAK,kBAAkB,QAAQ;AACzC,YAAM;AAAA,IACR;AAAA,EACF,UAAE;AACA,cAAU;AAAA,EACZ;AACF;AAIA,eAAsB,qBAAqB,SAAiC;AAC1E,QAAM,IAAI;AACV,MAAI,OAAO,GAAG,SAAS,YAAY;AACjC,UAAM,EAAE,KAAK,EAAE,KAAK,yBAAyB,aAAa,KAAQ,iBAAiB,IAAM,CAAC;AAC1F;AAAA,EACF;AACA,MAAI,OAAO,GAAG,gBAAgB,YAAY;AACxC,UAAM,EAAE,YAAY;AAAA,MAClB,KAAK;AAAA,MACL,aAAa;AAAA,MACb,iBAAiB;AAAA,IACnB,CAAC;AAAA,EACH;AACF;;;ACpqCA,SAAS,4BAA4B;AAU9B,IAAM,6BAA6B;AAMnC,IAAM,sBAAN,cAAkC,MAAM;AAAA,EACpC;AAAA,EACA;AAAA,EAET,YAAY,UAAkB,QAAgB;AAC5C,UAAM,QAAQ,aAAa,KAAK,SAAS;AACzC;AAAA,MACE,oCAAoC,KAAK,WAAW,QAAQ,IAAI,SAAS;AAAA,EAAM,MAAM,KAAK,EAAE;AAAA,IAC9F;AACA,SAAK,OAAO;AACZ,SAAK,WAAW;AAChB,SAAK,QAAQ;AAAA,EACf;AACF;AAMO,IAAM,iCAAN,cAA6C,MAAM;AAAA,EACxD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAuDO,SAAS,0BAA0B,UAAuC,CAAC,GAAW;AAC3F,QAAM,OAAO,QAAQ,QAAQ;AAI7B,SACE,iHAKqB,IAAI;AAE7B;AAEA,SAASM,kBAAiB,QAAyC;AACjE,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO;AAAA,EACT;AACA,SAAO,CAAC,OAAO,QAAQ,OAAO,QAAQ,OAAO,MAAM,EAChD,OAAO,CAAC,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS,CAAC,EAChE,KAAK,IAAI;AACd;AAEA,SAASC,oBAAmB,QAAgD;AAC1E,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO;AAAA,EACT;AACA,SAAO,OAAO,OAAO,aAAa,WAAW,OAAO,WAAW;AACjE;AAOA,SAASC,qBAAoB,QAAwB;AACnD,MAAI,yBAAyB,KAAK,MAAM,GAAG;AACzC,WAAO;AAAA,EACT;AACA,MAAI,yBAAyB,KAAK,MAAM,GAAG;AACzC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAeA,eAAsB,qBACpB,SACA,UAAuC,CAAC,GACH;AACrC,QAAM,IAAI;AACV,MAAI,OAAO,GAAG,SAAS,cAAc,OAAO,GAAG,gBAAgB,YAAY;AACzE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAO,QAAQ,QAAQ;AAC7B,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,MAAM,0BAA0B,EAAE,KAAK,CAAC;AAE9C,QAAM,SACJ,OAAO,EAAE,SAAS,aACd,MAAM,EAAE,KAAK,EAAE,KAAK,aAAa,WAAW,iBAAiB,IAAO,CAAC,IACrE,MAAM,EAAE,YAAa,EAAE,KAAK,aAAa,WAAW,iBAAiB,IAAO,CAAC;AAEnF,QAAM,SAASF,kBAAiB,MAAM;AACtC,QAAM,WAAWC,oBAAmB,MAAM,KAAKC,qBAAoB,MAAM;AAEzE,MAAI,aAAa,GAAG;AAClB,UAAM,IAAI,oBAAoB,UAAU,MAAM;AAAA,EAChD;AAEA,QAAM,UAAU,OAAO,MAAM,4BAA4B,KAAK,CAAC,EAAE,GAAG,CAAC;AACrE,SAAO,EAAE,MAAM,OAAO;AACxB;AAIA,eAAsB,uBAAuB,SAAiC;AAC5E,QAAM,IAAI;AACV,MAAI,OAAO,GAAG,SAAS,YAAY;AACjC,UAAM,EAAE,KAAK,EAAE,KAAK,0BAA0B,aAAa,KAAQ,iBAAiB,IAAM,CAAC;AAC3F;AAAA,EACF;AACA,MAAI,OAAO,GAAG,gBAAgB,YAAY;AACxC,UAAM,EAAE,YAAY;AAAA,MAClB,KAAK;AAAA,MACL,aAAa;AAAA,MACb,iBAAiB;AAAA,IACnB,CAAC;AAAA,EACH;AACF;;;AC/NA,SAAS,SAAS,iBAAiB;AACnC,SAAS,4BAA4B;AAI9B,IAAM,oCAAoC;AAC1C,IAAM,kCAAkC;AACxC,IAAM,6BAA6B;AACnC,IAAM,kCAAkC;AAExC,IAAM,4BAAN,cAAwC,MAAM;AAAA,EAC1C;AAAA,EACA;AAAA,EAET,YAAY,UAAkB,QAAgB;AAC5C,UAAM,QAAQ,4BAA4B,UAAU,MAAM;AAC1D;AAAA,MACE,2CAA2C,KAAK,WAAW,QAAQ,IAAI,SAAS;AAAA,EAAM,MAAM,KAAK,EAAE;AAAA,IACrG;AACA,SAAK,OAAO;AACZ,SAAK,WAAW;AAChB,SAAK,QAAQ;AAAA,EACf;AACF;AAEO,IAAM,uCAAN,cAAmD,MAAM;AAAA,EAC9D,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AA4BA,IAAM,+BAA+B;AAc9B,SAAS,gCACd,SAEQ;AACR,QAAM,OAAO,YAAY,QAAQ,QAAQ,oBAAoB;AAC7D,QAAM,YAAY,aAAa,QAAQ,gBAAgB,qCAAqC;AAC5F,QAAM,iBAAiB,iBAAiB,QAAQ,kBAAkB,CAAC,CAAC;AACpE,SAAO;AAAA,IACL;AAAA,IACA,gBAAgB,0BAA0B;AAAA,IAC1C;AAAA,IACA,8BAA8B,IAAI;AAAA,IAClC,0BAA0BC,YAAW,+BAA+B,CAAC;AAAA,IACrE,sCAAsCA,YAAW,SAAS,CAAC;AAAA,IAC3D,qCAAqCA,YAAW,eAAe,KAAK,GAAG,CAAC,CAAC;AAAA,IACzE;AAAA,IACA;AAAA,EACF,EAAE,KAAK,GAAG;AACZ;AAEA,eAAsB,2BACpB,SACA,SAC2C;AAC3C,QAAM,SAAS;AACf,MAAI,OAAO,QAAQ,SAAS,cAAc,OAAO,QAAQ,gBAAgB,YAAY;AACnF,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,OAAO,YAAY,QAAQ,QAAQ,oBAAoB;AAC7D,QAAM,YAAY,eAAe,QAAQ,aAAa,iCAAiC;AACvF,QAAM,MAAM,gCAAgC;AAAA,IAC1C;AAAA,IACA,gBAAgB,QAAQ;AAAA,IACxB,GAAI,QAAQ,iBAAiB,EAAE,gBAAgB,QAAQ,eAAe,IAAI,CAAC;AAAA,EAC7E,CAAC;AACD,QAAM,SAAS,OAAO,OAClB,MAAM,OAAO,KAAK;AAAA,IAChB;AAAA,IACA,SAAS;AAAA,IACT,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB,CAAC,IACD,MAAM,OAAO,YAAa;AAAA,IACxB;AAAA,IACA,SAAS;AAAA,IACT,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB,CAAC;AACL,QAAM,SAAS,SAAS,MAAM;AAC9B,QAAM,WAAW,WAAW,MAAM,KAAK,cAAc,MAAM;AAC3D,MAAI,aAAa,EAAG,OAAM,IAAI,0BAA0B,UAAU,MAAM;AACxE,QAAM,UAAU,OAAO,MAAM,4BAA4B,KAAK,CAAC,EAAE,GAAG,CAAC;AACrE,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,MACA,UAAU;AAAA,IACZ;AAAA,EACF;AACA,SAAO,EAAE,MAAM,OAAO;AACxB;AAEA,eAAsB,6BAA6B,SAAiC;AAClF,QAAM,SAAS;AACf,MAAI,QAAQ,MAAM;AAChB,UAAM,OAAO,KAAK;AAAA,MAChB,KAAK;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,iBAAiB;AAAA,IACnB,CAAC;AAAA,EACH,WAAW,QAAQ,aAAa;AAC9B,UAAM,OAAO,YAAY;AAAA,MACvB,KAAK;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,iBAAiB;AAAA,IACnB,CAAC;AAAA,EACH;AACF;AAEA,SAAS,SAAS,QAAyC;AACzD,MAAI,OAAO,WAAW,SAAU,QAAO;AACvC,SAAO,CAAC,OAAO,QAAQ,OAAO,QAAQ,OAAO,MAAM,EAChD,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,EAChF,KAAK,IAAI;AACd;AAEA,SAAS,WAAW,QAAgD;AAClE,SAAO,OAAO,WAAW,YAAY,OAAO,OAAO,aAAa,WAAW,OAAO,OAAO;AAC3F;AAEA,SAAS,4BACP,UACA,QACoC;AACpC,MAAI,aAAa,GAAI,QAAO;AAC5B,MAAI,aAAa,GAAI,QAAO;AAC5B,MAAI,aAAa,MAAM,8BAA8B,UAAU,MAAM,GAAG;AACtE,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,8BAA8B,UAAkB,QAAyB;AAChF,MAAI,aAAa,IAAK,QAAO;AAC7B,SAAO,mHAAmH;AAAA,IACxH;AAAA,EACF;AACF;AAEA,SAAS,cAAc,QAAwB;AAC7C,MAAI,0BAA0B,KAAK,MAAM,EAAG,QAAO;AACnD,MAAI,oCAAoC,KAAK,MAAM,EAAG,QAAO;AAC7D,MAAI,gCAAgC,KAAK,MAAM,KAAK,8BAA8B,IAAI,MAAM,GAAG;AAC7F,WAAO;AAAA,EACT;AACA,MAAI,gDAAgD,KAAK,MAAM,EAAG,QAAO;AACzE,SAAO;AACT;AAEA,SAAS,YAAY,OAAuB;AAC1C,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,OAAQ;AAC/D,UAAM,IAAI,WAAW,oCAAoC;AAAA,EAC3D;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAAuB;AAC7C,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,KAAK,KAAQ;AACpE,UAAM,IAAI,WAAW,uCAAuC;AAAA,EAC9D;AACA,SAAO;AACT;AAEA,SAAS,aAAa,OAAe,OAAuB;AAC1D,MAAI,CAAC,SAAS,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU,WAAW,KAAK,GAAG;AAClE,UAAM,IAAI,MAAM,GAAG,KAAK,mBAAmB;AAAA,EAC7C;AACA,SAAO,UAAU,UAAU,KAAK;AAClC;AAEA,SAAS,iBAAiB,QAAqC;AAC7D,MAAI,OAAO,SAAS,GAAI,OAAM,IAAI,MAAM,qCAAqC;AAC7E,SAAO,OAAO,IAAI,CAAC,UAAU;AAC3B,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QAAI,IAAI,WAAW,UAAU,IAAI,aAAa,OAAO,IAAI,UAAU,IAAI,MAAM;AAC3E,YAAM,IAAI,MAAM,sDAAsD;AAAA,IACxE;AACA,WAAO,IAAI;AAAA,EACb,CAAC;AACH;AAEA,SAASA,YAAW,OAAuB;AACzC,SAAO,IAAI,MAAM,WAAW,KAAK,OAAO,CAAC;AAC3C;;;ACpOA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,cAAAC,aAAY,cAAAC,mBAAkB;AACvC,SAAS,SAASC,kBAAiB;AACnC,SAAS,iCAA4D;;;ACuB9D,IAAM,+BAAoE;AAAA,EAC/E;AAAA;AAAA,IAEE,aAAa;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,MAAM;AAAA,IACN,SAAS;AAAA,IACT,aAAa;AAAA,IACb,QAAQ,CAAC,WAAW,WAAW,QAAQ,CAAC,UAAU,MAAM,SAAS,gBAAgB;AAAA,EACnF;AACF;AAwBO,SAAS,8BAA8B,QAAiB,mBAAoC;AACjG,QAAM,OAAO,6BAA6B,OAAO,CAAC,WAAW,OAAO,OAAO,MAAM,CAAC;AAClF,QAAM,UAAU,oBACZ,mEACA;AACJ,QAAM,SAAS,oBACX,qCACA;AACJ,MAAI,KAAK,WAAW,GAAG;AACrB,WAAO,GAAG,OAAO,mGAAmG,MAAM;AAAA,EAC5H;AACA,QAAM,WAAW,KAAK,IAAI,CAAC,WAAW,GAAG,OAAO,IAAI,OAAO,OAAO,OAAO,EAAE,EAAE,KAAK,MAAM;AACxF,QAAM,QAAQ,KAAK,IAAI,CAAC,WAAW,OAAO,IAAI,EAAE,KAAK,MAAM;AAC3D,QAAM,eAAe,CAAC,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,WAAW,OAAO,WAAW,CAAC,CAAC;AAC1E,SAAO,GAAG,OAAO,oBAAoB,QAAQ,gCAAgC,KAAK,QAAQ,aAAa,KAAK,OAAO,CAAC,KAAK,MAAM;AACjI;AAEA,SAAS,WAAW,OAAgB,SAA+D;AACjG,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,KAAK,CAAC,SAAS,WAAW,MAAM,OAAO,CAAC;AAC/E,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,QAAM,SAAS;AACf,SAAO,QAAQ,MAAM,KAAK,OAAO,OAAO,MAAM,EAAE,KAAK,CAAC,SAAS,WAAW,MAAM,OAAO,CAAC;AAC1F;;;ADhFA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,wBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAoCK;;;AElGA,IAAM,8BAA8B,MAAM;AACjD,IAAM,mBAAmB,KAAK;AAQ9B,IAAMC,UAAS;AAMf,IAAM,wBAAwB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,wDAAwDA,OAAM;AAAA,EAC9D;AAAA,EACA;AACF,EAAE,KAAK,GAAG;AAMH,SAAS,wBAAwB,OAQ8B;AACpE,QAAMC,SAAQ,CAAC,UAA0B;AACvC,QAAI,YAAY,KAAK,KAAK,EAAG,OAAM,IAAI,MAAM,kCAAkC;AAC/E,WAAO,IAAI,MAAM,WAAW,MAAM,MAAM,EAAE,WAAW,KAAK,KAAK,CAAC;AAAA,EAClE;AACA,QAAM,UAAU,KAAK,IAAI,GAAG,KAAK,KAAK,MAAM,YAAY,GAAK,CAAC;AAC9D,QAAM,SAASD;AACf,QAAM,SAAS;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,qBAAqB,KAAK,IAAI,SAAS,EAAE,CAAC;AAAA,IAC1C,cAAc,OAAO;AAAA,IACrB,kBAAkB,MAAM,QAAQ;AAAA,IAChC,aAAaC,OAAM,MAAM,MAAM,CAAC;AAAA,IAChC,SAASA,OAAM,MAAM,GAAG,CAAC;AAAA,IACzB,YAAYA,OAAM,yBAAyB,MAAM,KAAK,EAAE,CAAC;AAAA,IACzD,GAAI,MAAM,SAAS,SACf,CAAC,IACD,CAAC,6CAA6C,iBAAiBA,OAAM,MAAM,IAAI,CAAC,EAAE;AAAA,IACtF;AAAA,EACF,EAAE,KAAK,IAAI;AACX,QAAM,QAAQ,OAAO,KAAK,MAAM;AAChC,MAAI,MAAM,aAAa,6BAA6B;AAClD,UAAM,IAAI,WAAW,uCAAuC;AAAA,EAC9D;AACA,MAAI,MAAM,SAAS,WAAW;AAC5B,WAAO,EAAE,KAAK,uBAAuB,OAAO,cAAc,OAAO,OAAO;AAAA,EAC1E;AACA,SAAO;AAAA,IACL,KAAK,8DAA8D,MAAM;AAAA,IACzE,OAAO;AAAA,IACP;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,8BACd,QACA,QACA,UACoE;AACpE,QAAM,eAAe,WAAW,mBAAmB,OAAO,SAAS;AAGnE,MAAI,OAAO,SAAS,KAAK,KAAK,eAAe,CAAC,IAAI,IAAI,OAAO,GAAG;AAC9D,UAAM,IAAI,WAAW,4CAA4C;AAAA,EACnE;AACA,QAAM,UAAU,OAAO,QAAQ,YAAY,EAAE;AAC7C,MAAI,QAAQ,SAAS,MAAM,KAAK,CAAC,0BAA0B,KAAK,OAAO,GAAG;AACxE,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AACA,QAAM,QAAQ,OAAO,KAAK,SAAS,QAAQ;AAC3C,QAAM,UAAU,OAAO,KAAK;AAAA,EAAK,MAAM,EAAE;AACzC,QAAM,MAAM,MAAM,YAAY,OAAO;AACrC,MAAI,MAAM,EAAG,OAAM,IAAI,MAAM,mCAAmC;AAChE,QAAM,OAAO,MAAM,SAAS,MAAM,QAAQ,MAAM,EAAE,SAAS,OAAO;AAClE,MAAI,CAAC,aAAa,KAAK,IAAI,KAAK,SAAS,KAAK;AAC5C,UAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AACA,MAAI,SAAS;AACb,SAAO,SAAS,KAAK;AACnB,UAAM,YAAY,MAAM,QAAQ,YAAY,MAAM;AAClD,QAAI,YAAY,UAAU,YAAY,IAAI,OAAO,YAAY,IAAI,kBAAkB;AACjF,YAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AACA,UAAM,QAAQ,MAAM,SAAS,QAAQ,SAAS,EAAE,SAAS,QAAQ,EAAE,MAAM,MAAM;AAC/E,UAAM,QAAQ,qCAAqC,KAAK,MAAM,MAAM,KAAK,EAAE;AAC3E,QAAI,CAAC,MAAO,OAAM,IAAI,MAAM,uCAAuC;AACnE,UAAMC,UAAS,OAAO,MAAM,CAAC,CAAC;AAC9B,aAAS,YAAY;AACrB,QAAIA,WAAU,OAAOA,UAAS,OAAOA,YAAW,IAAK;AACrD,QAAIA,UAAS,OAAOA,UAAS,IAAK,OAAM,IAAI,MAAM,uCAAuC;AACzF,UAAM,UAAU,oBAAI,IAAoB;AACxC,eAAW,QAAQ,OAAO;AACxB,YAAM,YAAY,KAAK,QAAQ,GAAG;AAClC,UAAI,aAAa,EAAG,OAAM,IAAI,MAAM,uCAAuC;AAC3E,cAAQ,IAAI,KAAK,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,YAAY,GAAG,KAAK,MAAM,YAAY,CAAC,EAAE,KAAK,CAAC;AAAA,IAC7F;AACA,UAAM,OAAO,MAAM,SAAS,QAAQ,GAAG;AACvC,QAAI,KAAK,aAAa;AACpB,YAAM,IAAI,WAAW,4CAA4C;AACnE,WAAO,EAAE,QAAAA,SAAQ,SAAS,KAAK;AAAA,EACjC;AACA,QAAM,IAAI,MAAM,mCAAmC;AACrD;;;AFjBA,SAAS,gBAAgB;AAEzB,IAAM,cAAc;AACpB,IAAM,uCAAuC;AAC7C,IAAM,sCAAsC;AACrC,IAAM,mCAAmC;AAChD,IAAM,aAAa;AACnB,IAAM,gBAAgB;AACtB,IAAM,yBAAyB;AAC/B,IAAM,oCAAoC,KAAK;AAE/C,IAAM,oCAAoC,IAAI;AAE9C,IAAM,8CAA8C;AACpD,IAAM,2BAA2B,MAAM;AACvC,IAAM,iBAAiB;AAOvB,IAAM,wBAAwB,oBAAI,IAAoB;AAiJtD,SAAS,2BAA2B,SAAiD;AACnF,MAAI,CAAC,QAAQ,qBAAsB,QAAO;AAG1C,SAAO,QAAQ,mBAAmB,MAAM,YAAY,MAAM;AAC5D;AA4KO,IAAM,gCAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,uCAAuC;AAAA,EAClD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAuDO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EAC7C,OAAO;AAAA,EACP,YAAY;AACvB;AAQO,IAAM,oCAAN,cAAgD,MAAM;AAAA,EAI3D,YACW,SACA,YACT,SACA;AACA,UAAM,GAAG,OAAO,qCAAqC,UAAU,gBAAgB,OAAO;AAJ7E;AACA;AAAA,EAIX;AAAA,EATS,OAAO;AAAA,EACP,YAAY;AASvB;AAMA,IAAM,qCAAqC;AAG3C,IAAM,+BAA+B,KAAK;AAG1C,SAAS,sBAAsB,YAAoB,WAAkC;AACnF,MAAI,aAAa,aAAa,mCAAoC,QAAO;AACzE,MACE,aAAa,gCACb,aAAa,+BAA+B;AAE5C,WAAO;AACT,SAAO;AACT;AAEA,eAAe,mBACb,SACA,YACA,SACY;AACZ,QAAM,YAAY,KAAK,IAAI;AAC3B,MAAI;AACF,WAAO,MAAM,QAAQ,UAAU;AAAA,EACjC,SAAS,OAAO;AACd,UAAM,UACJ,iBAAiB,+BACb,sBAAsB,YAAY,KAAK,IAAI,IAAI,SAAS,IACxD;AACN,QAAI,YAAY,MAAM;AACpB,YAAM,IAAI,kCAAkC,SAAS,SAAS,EAAE,OAAO,MAAM,CAAC;AAAA,IAChF;AACA,UAAM;AAAA,EACR;AACF;AAEO,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAC5C,OAAO;AAAA,EACP,YAAY;AACvB;AAEO,IAAM,qCAAN,cAAiD,4BAA4B;AAAA,EAClF,YAAqB,QAA6C;AAChE,UAAM,oDAAoD;AADvC;AAAA,EAErB;AACF;AAEO,IAAM,6BAAN,cAAyC,MAAM;AAAA,EAIpD,YACWC,SACA,OAGA,aAAiD,MAC1D;AACA,UAAM,MAAM,OAAO;AANV,kBAAAA;AACA;AAGA;AAGT,SAAK,YAAY,MAAM;AAAA,EACzB;AAAA,EAZS,OAAO;AAAA,EACP;AAYX;AAEO,IAAM,iCAAN,cAA6C,MAAM;AAAA,EAC/C,OAAO;AAClB;AAEA,SAAS,oCACP,SACA,mBAC4B;AAC5B,SAAO,IAAI,2BAA2B,KAAK;AAAA,IACzC,MAAM;AAAA;AAAA;AAAA,IAGN,SAAS,oBACL,uCAAuC,OAAO,8EAC9C,uCAAuC,OAAO;AAAA,IAClD,WAAW;AAAA,EACb,CAAC;AACH;AAIA,SAAS,kBAAkB,OAAyB;AAClD,SACE,iBAAiB,8BACjB,MAAM,WAAW,OACjB,MAAM,MAAM,SAAS,wBACrB,MAAM,MAAM,YAAY;AAE5B;AAGA,eAAsB,8BACpB,SACA,OAC8C;AAC9C,sCAAoC,OAAO;AAC3C,QAAM,aAAa,aAAa,MAAM,YAAY,gCAAgC;AAClF,MAAI,QAAQ,sBAAsB;AAChC,QAAI,CAAC,MAAM,iBAAiB;AAC1B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,UAAU,MAAM,QAAQ,qBAAqB;AAAA,MACjD,SAAS,MAAM,gBAAgB;AAAA,MAC/B,iBAAiB,MAAM,gBAAgB;AAAA,MACvC;AAAA,MACA,gBAAgB,CAAC,GAAI,MAAM,kBAAkB,CAAC,CAAE;AAAA,IAClD,CAAC;AACD,UAAM,OAAOC,aAAY,QAAQ,IAAI;AACrC,0BAAsB,IAAI,oBAAoB,MAAM,eAAe,GAAG,IAAI;AAC1E,WAAO;AAAA,MACL,QAAQ,IAAI,qBAAqB,SAAS;AAAA,QACxC;AAAA,QACA;AAAA,QACA,iBAAiB,MAAM;AAAA,QACvB,GAAI,MAAM,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,MAAM,UAAU;AAAA,MACxE,CAAC;AAAA,MACD,QAAQ,EAAE,MAAM,QAAQ,SAAS,QAAQ,iBAAiB,GAAG;AAAA,IAC/D;AAAA,EACF;AACA,QAAM,iBAAiB;AAAA,IACrB,MAAM,kBAAkB;AAAA,IACxB;AAAA,EACF;AACA,QAAM,qBAAqB,GAAG,cAAc,QAAQC,YAAW,CAAC;AAChE,QAAM,SAAS,eAAe,MAAM,GAAG,eAAe,YAAY,GAAG,CAAC,KAAK;AAC3E,MAAI;AACF,UAAM;AAAA,MACJ;AAAA,MACA,oCAAoCC,YAAW,MAAM,CAAC,oBAAoBA,YAAW,UAAU,CAAC;AAAA,MAChG,MAAM;AAAA,IACR;AACA,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,SAAS,GAAG,UAAU;AAAA;AAAA,QACtB,eAAe;AAAA,MACjB;AAAA,MACA,MAAM;AAAA,IACR;AACA,UAAM;AAAA,MACJ;AAAA,MACA,iBAAiBA,YAAW,kBAAkB,CAAC,cAAcA,YAAW,kBAAkB,CAAC,IAAIA,YAAW,cAAc,CAAC,oBAAoBA,YAAW,UAAU,CAAC;AAAA,MACnK,MAAM;AAAA,IACR;AACA,UAAM,SAAS,MAAM,2BAA2B,SAAS;AAAA,MACvD;AAAA,MACA,GAAI,MAAM,iBAAiB,EAAE,gBAAgB,MAAM,eAAe,IAAI,CAAC;AAAA,MACvE,GAAI,MAAM,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;AAAA,MACvD,GAAI,MAAM,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,MAAM,UAAU;AAAA,IACxE,CAAC;AACD,UAAM,SAAS,IAAI,qBAAqB,SAAS;AAAA,MAC/C;AAAA,MACA,MAAM,OAAO;AAAA,MACb,GAAI,MAAM,kBAAkB,EAAE,iBAAiB,MAAM,gBAAgB,IAAI,CAAC;AAAA,MAC1E,GAAI,MAAM,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,MAAM,UAAU;AAAA,IACxE,CAAC;AACD,QAAI,MAAM,kBAAkB,MAAM,eAAe,SAAS,GAAG;AAC3D,YAAM,OAAO,kBAAkB,MAAM,cAAc;AAAA,IACrD;AACA,WAAO,EAAE,QAAQ,OAAO;AAAA,EAC1B,UAAE;AACA,UAAM,cAAc,SAAS,YAAYA,YAAW,kBAAkB,CAAC,EAAE;AACzE,UAAM,QAAQ,sBAAsB,EAAE,MAAM,MAAM,MAAS;AAAA,EAC7D;AACF;AAEO,IAAM,uBAAN,MAA2B;AAAA,EACvB;AAAA,EACQ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YACE,SACA,SAMA;AACA,mCAA+B,OAAO;AACtC,SAAK,UAAU;AACf,SAAK,aAAa,aAAa,QAAQ,YAAY,gCAAgC;AACnF,SAAK,OAAOF,aAAY,QAAQ,QAAQG,qBAAoB;AAC5D,SAAK,YAAYC,gBAAe,QAAQ,aAAa,GAAM;AAC3D,SAAK,kBAAkB,QAAQ;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA,EAKA,wBAAiC;AAC/B,WAAO,OAAO,KAAK,QAAQ,yBAAyB;AAAA,EACtD;AAAA,EAEA,MAAM,kBAAkB,SAAwD;AAC9E,QAAI,QAAQ,WAAW,KAAK,QAAQ,SAAS,IAAI;AAC/C,YAAM,IAAI,WAAW,gDAAgD;AAAA,IACvE;AACA,UAAM,aAAa,QAAQ,IAAI,eAAe;AAC9C,UAAM,OAAO,MAAM,KAAK,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,OAAO,KAAK;AAAA,MACZ,MAAM,EAAE,SAAS,WAAW;AAAA,IAC9B,CAAC;AACD,QAAI,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,QAAQ,KAAK,OAAO,GAAG;AACnD,YAAM,IAAI,4BAA4B,+CAA+C;AAAA,IACvF;AACA,WAAO,KAAK,QAAQ,IAAI,CAAC,WAAW,gBAAgB,MAAM,CAAC;AAAA,EAC7D;AAAA,EAEA,MAAM,cAAc,OAA6E;AAC/F,UAAM,YAAY,eAAe,KAAK;AACtC,QACE,MAAM,oCAAoC,WACzC,MAAM,oCAAoC,QACzC,MAAM,WACN,MAAM,eAAe,SACvB;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,UAAU,MAAM,UAAU,2BAA2B,MAAM,OAAO,IAAI;AAC5E,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,KAAK,YAAY;AAAA,QAC5B,QAAQ;AAAA,QACR,MAAM,wBAAwB,wCAAwC;AAAA,QACtE,OAAO,KAAK;AAAA,QACZ,MAAM;AAAA,UACJ,GAAG;AAAA,UACH,iBAAiB,oBAAoB,MAAM,iBAAiB,kBAAkB;AAAA,UAC9E,cAAc,aAAa,MAAM,cAAc,uBAAuB;AAAA,UACtE,WAAW,aAAa,MAAM,WAAW,oBAAoB;AAAA,UAC7D,QAAQ,MAAM;AAAA,UACd,GAAI,MAAM,kCACN,EAAE,iCAAiC,KAAK,IACxC,CAAC;AAAA,UACL,GAAI,MAAM,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,WAAW,MAAM,UAAU,EAAE;AAAA,UACrF,GAAI,MAAM,YAAY,EAAE,WAAW,0BAA0B,MAAM,SAAS,EAAE,IAAI,CAAC;AAAA,UACnF,GAAI,MAAM,iBACN,EAAE,gBAAgB,uBAAuB,MAAM,cAAc,EAAE,IAC/D,CAAC;AAAA,UACL,GAAI,MAAM,eACN,EAAE,cAAc,6BAA6B,MAAM,YAAY,EAAE,IACjE,CAAC;AAAA,UACL,GAAI,UAAU,EAAE,SAAS,QAAQ,KAAK,IAAI,CAAC;AAAA,QAC7C;AAAA,QACA,GAAI,UAAU,EAAE,WAAW,kCAAkC,IAAI,CAAC;AAAA,MACpE,CAAC;AAAA,IACH,UAAE;AACA,eAAS,QAAQ,KAAK,CAAC;AACvB,eAAS,IAAI,KAAK,CAAC;AAAA,IACrB;AACA,QAAI,CAAC,SAAS,IAAI,GAAG;AACnB,YAAM,IAAI,4BAA4B,oDAAoD;AAAA,IAC5F;AACA,UAAM,oBAAoB,eAAe,IAAI;AAC7C,QACE,kBAAkB,qBAAqB,UAAU,oBACjD,kBAAkB,yBAAyB,UAAU,sBACrD;AACA,YAAM,IAAI,4BAA4B,qDAAqD;AAAA,IAC7F;AACA,WAAO;AAAA,MACL,GAAG;AAAA,MACH,aAAa,KAAK,gBAAgB,OAAO,OAAO,mBAAmB,MAAM,KAAK,WAAW;AAAA,MACzF,GAAG,gBAAgB,KAAK,SAAS,iBAAiB;AAAA,MAClD,GAAG,eAAe,KAAK,MAAM;AAAA,MAC7B,GAAG,gBAAgB,KAAK,OAAO;AAAA,IACjC;AAAA,EACF;AAAA,EAEA,MAAM,sBACJ,OACmC;AACnC,UAAM,YAAY,uBAAuB,KAAK;AAC9C,UAAM,UAAU;AAAA,MACd,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,OAAO,KAAK;AAAA,MACZ,MAAM;AAAA,QACJ,GAAG;AAAA,QACH,iBAAiB,oBAAoB,MAAM,iBAAiB,kBAAkB;AAAA,QAC9E,cAAc,aAAa,MAAM,cAAc,wBAAwB;AAAA,QACvE,WAAW,aAAa,MAAM,WAAW,qBAAqB;AAAA,QAC9D,GAAI,MAAM,iBAAiB,EAAE,gBAAgB,MAAM,eAAe,IAAI,CAAC;AAAA,MACzE;AAAA,IACF;AACA,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,KAAK,YAAY,OAAO;AAAA,IACvC,SAAS,OAAO;AAId,UACE,CAAC,MAAM,kBACP,EAAE,iBAAiB,+BACnB,MAAM,WAAW,OACjB,MAAM,MAAM,SAAS,oBACrB,MAAM,MAAM,YAAY;AAExB,cAAM;AACR,YAAM,EAAE,gBAAgB,WAAW,GAAG,KAAK,IAAI,QAAQ;AACvD,aAAO,MAAM,KAAK,YAAY,EAAE,GAAG,SAAS,KAAK,CAAC;AAAA,IACpD;AACA,QAAI,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,QAAQ,KAAK,OAAO,GAAG;AACnD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAW,uBAAuB,IAAI;AAC5C,QACE,SAAS,sBAAsB,UAAU,qBACzC,SAAS,yBAAyB,UAAU,sBAC5C;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAW,KAAK;AACtB,QAAI,aAAa,WAAW,aAAa,WAAW,aAAa,WAAW;AAC1E,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL,GAAG;AAAA,MACH;AAAA,MACA,SAAS,gBAAgB,KAAK,SAAS,kBAAkB;AAAA,MACzD,QAAQ,gBAAgB,KAAK,QAAQ,kBAAkB;AAAA,MACvD,WAAW,gBAAgB,KAAK,WAAW,qBAAqB;AAAA,MAChE,cAAc,4BAA4B,MAAM,KAAK,YAAY;AAAA,MACjE,SAAS,KAAK,QAAQ,IAAI,CAAC,WAAW,eAAe,MAAM,MAAM,CAAC;AAAA,IACpE;AAAA,EACF;AAAA,EAEA,MAAM,WACJ,WACA,SAKe;AACf,UAAMC,WAAU,eAAe,SAAS;AACxC,UAAM,OAAO,MAAM,KAAK,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,MAAM,wBAAwBA,SAAQ,gBAAgB;AAAA,MACtD,OAAO,KAAK;AAAA,MACZ,MAAM;AAAA,QACJ,sBAAsBA,SAAQ;AAAA,QAC9B,aAAa,QAAQ;AAAA;AAAA,QAErB,GAAI,QAAQ,wBAAwB,EAAE,uBAAuB,KAAK,IAAI,CAAC;AAAA,QACvE,GAAI,QAAQ,4BAA4B,EAAE,2BAA2B,KAAK,IAAI,CAAC;AAAA,MACjF;AAAA,IACF,CAAC;AACD,QAAI,CAAC,SAAS,IAAI,KAAK,KAAK,UAAU,MAAM;AAC1C,YAAM,IAAI,4BAA4B,mDAAmD;AAAA,IAC3F;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,YAAY,WAA6C,OAA+B;AAC5F,UAAMA,WAAU,eAAe,SAAS;AACxC,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,KAAK,YAAY;AAAA,QAC5B,QAAQ;AAAA,QACR,MAAM,wBAAwBA,SAAQ,gBAAgB;AAAA,QACtD,OAAO,KAAK;AAAA,QACZ,MAAM;AAAA,UACJ,sBAAsBA,SAAQ;AAAA,UAC9B,OAAO,MAAM,YAAY;AAAA,QAC3B;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,kBAAkB,KAAK,EAAG,QAAO;AACrC,YAAM;AAAA,IACR;AACA,QAAI,CAAC,SAAS,IAAI,KAAK,OAAO,KAAK,SAAS,WAAW;AACrD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAM,mBACJ,WACA,SACe;AACf,UAAMA,WAAU,uBAAuB,SAAS;AAChD,UAAM,OAAO,MAAM,KAAK,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,MAAM,yBAAyBA,SAAQ,iBAAiB;AAAA,MACxD,OAAO,KAAK;AAAA,MACZ,MAAM;AAAA,QACJ,sBAAsBA,SAAQ;AAAA,QAC9B,aAAa,QAAQ;AAAA,MACvB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,SAAS,IAAI,KAAK,KAAK,UAAU,MAAM;AAC1C,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBACJ,WACA,OAC2B;AAC3B,UAAMA,WAAU,eAAe,SAAS;AACxC,UAAM,UAAU,YAAY,MAAM,SAAS,eAAe;AAC1D,UAAM,YAAY,UAAU,MAAM,WAAW,mBAAmB;AAChE,UAAM,OAAO,MAAM,KAAK,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,MAAM,wBAAwBA,SAAQ,gBAAgB;AAAA,MACtD,OAAO,KAAK;AAAA,MACZ,MAAM;AAAA,QACJ;AAAA,QACA,sBAAsBA,SAAQ;AAAA,QAC9B,OAAO,aAAa,MAAM,OAAO,kBAAkB;AAAA,QACnD;AAAA,MACF;AAAA,IACF,CAAC;AACD,QAAI,CAAC,SAAS,IAAI,KAAK,KAAK,YAAY,WAAW,KAAK,cAAc,WAAW;AAC/E,YAAM,IAAI,4BAA4B,kDAAkD;AAAA,IAC1F;AACA,QAAI,KAAK,uBAAuB,UAAa,KAAK,uBAAuB,MAAM;AAC7E,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,KAAK,6BAA6B,UAAa,KAAK,6BAA6B,MAAM;AACzF,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,GAAI,KAAK,uBAAuB,OAAO,EAAE,oBAAoB,KAAK,IAAI,CAAC;AAAA,MACvE,GAAI,KAAK,6BAA6B,OAAO,EAAE,0BAA0B,KAAK,IAAI,CAAC;AAAA,IACrF;AAAA,EACF;AAAA,EAEA,MAAM,wBACJ,WACA,OAM4B;AAC5B,UAAMA,WAAU,uBAAuB,SAAS;AAChD,UAAM,UAAU,YAAY,MAAM,SAAS,wBAAwB;AACnE,UAAM,YAAY,UAAU,MAAM,WAAW,4BAA4B;AACzE,UAAM,OAAO,MAAM,KAAK,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,MAAM,yBAAyBA,SAAQ,iBAAiB;AAAA,MACxD,OAAO,KAAK;AAAA,MACZ,MAAM;AAAA,QACJ;AAAA,QACA,sBAAsBA,SAAQ;AAAA,QAC9B,OAAO,aAAa,MAAM,OAAO,2BAA2B;AAAA,QAC5D;AAAA,QACA,GAAI,MAAM,WACN;AAAA,UACE,UAAU,gBAAgB,MAAM,SAAS,UAAU,eAAe;AAAA,UAClE,kBAAkB,kBAAkB,MAAM,SAAS,gBAAgB;AAAA,UACnE,cAAc,MAAM,SAAS;AAAA,QAC/B,IACA,CAAC;AAAA,MACP;AAAA,IACF,CAAC;AACD,QAAI,CAAC,SAAS,IAAI,KAAK,KAAK,YAAY,WAAW,KAAK,cAAc,WAAW;AAC/E,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,KAAK,mBAAmB,UAAa,OAAO,KAAK,mBAAmB,WAAW;AACjF,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,MAAM,aACL,KAAK,mBAAmB,QACvB,KAAK,aAAa,MAAM,SAAS,YACjC,KAAK,qBAAqB,MAAM,SAAS,oBACzC,KAAK,iBAAiB,MAAM,SAAS,eACvC;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,SAAS,WAAW,gBAAgB,KAAK,mBAAmB,KAAK;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aACJ,OAC8C;AAC9C,UAAM,YAAY,eAAe,KAAK;AACtC,UAAM,cAAc,YAAY,MAAM,aAAa,4BAA4B;AAC/E,UAAM,YAAY,sBAAsB,MAAM,SAAS;AACvD,UAAM,UAAU,WAAW,MAAM,SAAS,IAAI,wBAAwB;AACtE,UAAM,MAAM,aAAa,MAAM,KAAK,GAAG,KAAK,MAAM,+BAA+B;AACjF,UAAM,SAAS,wBAAwB,MAAM,MAAM;AACnD,UAAM,OAAO,MAAM,KAAK,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,MAAM,wBAAwB,UAAU,gBAAgB;AAAA,MACxD,OAAO,KAAK;AAAA,MACZ,MAAM;AAAA,QACJ;AAAA,QACA,sBAAsB,UAAU;AAAA,QAChC;AAAA,QACA,cAAc,MAAM;AAAA,QACpB,eAAe,OAAO,KAAK,OAAO,EAAE,SAAS,QAAQ;AAAA,QACrD,WAAW,OAAO,KAAK,GAAG,EAAE,SAAS,QAAQ;AAAA,QAC7C;AAAA,MACF;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,UAAM,UAAU,yBAAyB,IAAI;AAC7C,QACE,QAAQ,gBAAgB,eACxB,QAAQ,qBAAqB,UAAU,oBACvC,QAAQ,yBAAyB,UAAU,wBAC3C,QAAQ,cAAc,WACtB;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,mBACJ,OACgD;AAChD,UAAM,YAAY,eAAe,KAAK;AACtC,UAAM,OAAO,MAAM,KAAK,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,MAAM,wBAAwB,UAAU,gBAAgB;AAAA,MACxD,OAAO,KAAK;AAAA,MACZ,MAAM,yBAAyB,WAAW,KAAK;AAAA,MAC/C,WAAW;AAAA,IACb,CAAC;AACD,WAAO,2BAA2B,MAAM,SAAS;AAAA,EACnD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,iBACJ,OAC8C;AAC9C,UAAM,YAAY,eAAe,KAAK;AACtC,UAAM,cAAc,YAAY,MAAM,aAAa,0BAA0B;AAC7E,UAAM,OAAO,MAAM,KAAK,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,MAAM,wBAAwB,UAAU,gBAAgB;AAAA,MACxD,OAAO,KAAK;AAAA,MACZ,MAAM;AAAA,QACJ,GAAG,yBAAyB,WAAW,KAAK;AAAA,QAC5C;AAAA,QACA,gBAAgBC,QAAO,MAAM,gBAAgB,8BAA8B;AAAA,MAC7E;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,UAAM,WAAW,yBAAyB,MAAM,WAAW,SAAS;AACpE,QAAI,SAAS,gBAAgB,aAAa;AACxC,YAAM,IAAI,4BAA4B,8CAA8C;AAAA,IACtF;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,oBACJ,WACA,aACsF;AACtF,UAAMD,WAAU,eAAe,SAAS;AACxC,UAAM,KAAK,YAAY,aAAa,0BAA0B;AAC9D,UAAM,OAAO,MAAM,KAAK,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,MAAM,wBAAwBA,SAAQ,gBAAgB,2BAA2B,EAAE;AAAA,MACnF,OAAO,KAAK;AAAA,IACd,CAAC;AACD,QAAI,CAAC,SAAS,IAAI,KAAK,OAAO,KAAK,aAAa,WAAW;AACzD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,WACJ,KAAK,aAAa,OAAO,OAAO,yBAAyB,KAAK,UAAUA,UAAS,UAAU;AAC7F,QAAI,YAAY,SAAS,gBAAgB,IAAI;AAC3C,YAAM,IAAI,4BAA4B,8CAA8C;AAAA,IACtF;AACA,WAAO,EAAE,UAAU,KAAK,UAAU,SAAS;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,0BACJ,OACsF;AACtF,UAAM,YAAY,eAAe,KAAK;AACtC,UAAM,KAAK,YAAY,MAAM,aAAa,0BAA0B;AACpE,UAAM,OAAO,MAAM,KAAK,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,MAAM,wBAAwB,UAAU,gBAAgB,2BAA2B,EAAE;AAAA,MACrF,OAAO,KAAK;AAAA,MACZ,MAAM,yBAAyB,WAAW,KAAK;AAAA,MAC/C,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,SAAS,IAAI,KAAK,OAAO,KAAK,aAAa,WAAW;AACzD,YAAM,IAAI,4BAA4B,qDAAqD;AAAA,IAC7F;AACA,UAAM,WACJ,KAAK,aAAa,OACd,OACA,yBAAyB,KAAK,UAAU,WAAW,UAAU;AACnE,QAAI,YAAY,SAAS,gBAAgB,IAAI;AAC3C,YAAM,IAAI,4BAA4B,8CAA8C;AAAA,IACtF;AACA,WAAO,EAAE,UAAU,KAAK,UAAU,SAAS;AAAA,EAC7C;AAAA,EAEA,cAAc,OAIkB;AAC9B,WAAO,IAAI,4BAA4B,MAAM,KAAK;AAAA,EACpD;AAAA,EAEA,sBAAsB,OAIW;AAC/B,WAAO,IAAI,6BAA6B,MAAM,KAAK;AAAA,EACrD;AAAA,EAEA,MAAM,eACJ,WACA,UACA,SAMI,CAAC,GACY;AACjB,UAAMA,WAAU,eAAe,SAAS;AACxC,QAAI,CAAC,KAAK,QAAQ,oBAAoB;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAW,MAAM,KAAK,QAAQ,mBAAmB,KAAK,IAAI;AAChE,UAAM,OAAO;AAAA,MACX,SAAS;AAAA,MACT,wBAAwBA,SAAQ,gBAAgB,YAAY,mBAAmB,gBAAgB,UAAU,WAAW,CAAC,CAAC;AAAA,IACxH;AACA,WAAO,0BAA0B,eAAe,EAAE,GAAG,UAAU,KAAK,CAAC,GAAG,MAAM;AAAA,EAChF;AAAA,EAEA,MAAM,uBACJ,WACA,UACA,SAMI,CAAC,GACY;AACjB,UAAMA,WAAU,uBAAuB,SAAS;AAChD,QAAI,CAAC,KAAK,QAAQ,oBAAoB;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAW,MAAM,KAAK,QAAQ,mBAAmB,KAAK,IAAI;AAChE,UAAM,OAAO;AAAA,MACX,SAAS;AAAA,MACT,yBAAyBA,SAAQ,iBAAiB,YAAY,mBAAmB,gBAAgB,UAAU,oBAAoB,CAAC,CAAC;AAAA,IACnI;AACA,WAAO,0BAA0B,eAAe,EAAE,GAAG,UAAU,KAAK,CAAC,GAAG,MAAM;AAAA,EAChF;AAAA,EAEA,MAAM,qBACJ,WACA,UACiB;AACjB,UAAMA,WAAU,uBAAuB,SAAS;AAChD,QAAI,CAAC,KAAK,QAAQ,oBAAoB;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAW,MAAM,KAAK,QAAQ,mBAAmB,KAAK,IAAI;AAChE,UAAM,OAAO;AAAA,MACX,SAAS;AAAA,MACT,yBAAyBA,SAAQ,iBAAiB,YAAY,mBAAmB,gBAAgB,UAAU,oBAAoB,CAAC,CAAC;AAAA,IACnI;AACA,WAAO,eAAe,EAAE,GAAG,UAAU,KAAK,CAAC;AAAA,EAC7C;AAAA;AAAA;AAAA,EAIA,MAAM,uBAAuB,OAenB;AACR,QAAI,CAAC,KAAK,QAAQ,kBAAmB,QAAO;AAC5C,QAAI,CAAC,KAAK,iBAAiB;AACzB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,YAAY,eAAe,MAAM,SAAS;AAChD,UAAM,cAAc,KAAK,MAAM,MAAM,SAAS;AAC9C,QAAI,CAAC,OAAO,cAAc,WAAW,GAAG;AACtC,YAAM,IAAI,4BAA4B,sCAAsC;AAAA,IAC9E;AACA,UAAM,SAAS,MAAM,UAAU,CAAC;AAChC,WAAO,MAAM,KAAK,QAAQ,kBAAkB;AAAA,MAC1C,SAAS,KAAK,gBAAgB;AAAA,MAC9B,iBAAiB,KAAK,gBAAgB;AAAA,MACtC,kBAAkB,UAAU;AAAA,MAC5B,sBAAsB,UAAU;AAAA,MAChC,UAAU,gBAAgB,MAAM,UAAU,WAAW;AAAA,MACrD,WAAW,aAAa,MAAM,WAAW,oBAAoB;AAAA,MAC7D,aAAa,OAAO,WAAW;AAAA,MAC/B,QAAQ,OAAO,UAAU;AAAA,MACzB,SAAS,eAAe,OAAO,WAAW,IAAI,GAAG,KAAK,uBAAuB;AAAA,MAC7E,UAAU,eAAe,OAAO,YAAY,MAAO,GAAG,MAAO,qBAAqB;AAAA,MAClF,WAAW,eAAe,OAAO,aAAa,KAAK,GAAG,MAAO,sBAAsB;AAAA,MACnF,eAAe;AAAA,QACb,OAAO,iBAAiB;AAAA,QACxB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA,EAIA,MAAM,+BAA+B,OAe3B;AACR,QAAI,CAAC,KAAK,QAAQ,mBAAoB,QAAO;AAC7C,QAAI,CAAC,KAAK,iBAAiB;AACzB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,YAAY,uBAAuB,MAAM,SAAS;AACxD,UAAM,cAAc,KAAK,MAAM,MAAM,SAAS;AAC9C,QAAI,CAAC,OAAO,cAAc,WAAW,GAAG;AACtC,YAAM,IAAI,4BAA4B,uCAAuC;AAAA,IAC/E;AACA,UAAM,SAAS,MAAM,UAAU,CAAC;AAChC,WAAO,MAAM,KAAK,QAAQ,mBAAmB;AAAA,MAC3C,SAAS,KAAK,gBAAgB;AAAA,MAC9B,iBAAiB,KAAK,gBAAgB;AAAA,MACtC,mBAAmB,UAAU;AAAA,MAC7B,sBAAsB,UAAU;AAAA,MAChC,UAAU,gBAAgB,MAAM,UAAU,oBAAoB;AAAA,MAC9D,WAAW,aAAa,MAAM,WAAW,qBAAqB;AAAA,MAC9D,aAAa,OAAO,WAAW;AAAA,MAC/B,QAAQ,OAAO,UAAU;AAAA,MACzB,SAAS,eAAe,OAAO,WAAW,IAAI,GAAG,KAAK,wBAAwB;AAAA,MAC9E,UAAU,eAAe,OAAO,YAAY,MAAO,GAAG,MAAO,sBAAsB;AAAA,MACnF,WAAW,eAAe,OAAO,aAAa,MAAO,GAAG,MAAO,uBAAuB;AAAA,MACtF,eAAe;AAAA,QACb,OAAO,iBAAiB;AAAA,QACxB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,kBAAkB,OAMH;AACnB,WAAO,MAAM,KAAK,YAAY,KAAK;AAAA,EACrC;AAAA,EAEA,MAAM,uBAAuB,OAMK;AAChC,WAAQ,MAAM,KAAK,aAAa,EAAE,GAAG,OAAO,SAAS,WAAW,CAAC;AAAA,EACnE;AAAA,EAEA,MAAM,8BAA8B,OAMH;AAC/B,WAAQ,MAAM,KAAK,aAAa,EAAE,GAAG,OAAO,SAAS,UAAU,CAAC;AAAA,EAClE;AAAA,EAEA,MAAc,YACZ,OAOA,sBAAsB,MACJ;AAKlB,UAAM,mBAAmB,KAAK,QAAQ,+BAA+B;AACrE,QAAI,KAAK,QAAQ,sBAAsB,CAAC,KAAK,QAAQ,sBAAsB;AACzE,UAAI;AACF,cAAM,WAAW,MAAM,KAAK,QAAQ,mBAAmB,KAAK,IAAI;AAQhE,cAAM,mBAAmB,2BAA2B,QAAQ;AAC5D,cAAM,UAAU,QAAQ,KAAK,QAAQ,QAAQ,KAAK,QAAQ,WAAW;AACrE,YAAI,CAAC,qBAAqB,oBAAoB,CAAC,UAAU;AACvD,gBAAM,IAAI;AAAA,YACR,mBACI,oDACA;AAAA,UACN;AAAA,QACF;AACA,YAAI,kBAAkB;AACpB,cAAI;AACF,mBAAO,MAAM;AAAA,cACX;AAAA,cACA;AAAA,cACA,KAAK;AAAA,cACL,KAAK,QAAQ;AAAA,YACf;AAAA,UACF,SAAS,OAAO;AACd,gBACE,uBACA,CAAC,oBACD,MAAM,WAAW,SACjB,iBAAiB,8BACjB;AACA,qBAAO,MAAM,KAAK,YAAY,OAAO,KAAK;AAAA,YAC5C;AACA,kBAAM;AAAA,UACR;AAAA,QACF;AAAA,MACF,SAAS,OAAO;AACd,YACE,iBAAiB,8BACjB,iBAAiB,+BACjB,iBAAiB,gCACjB,iBAAiB,YACjB;AACA,gBAAM;AAAA,QACR;AACA,YAAI,oBAAqB,CAAC,KAAK,QAAQ,QAAQ,CAAC,KAAK,QAAQ,aAAc;AACzE,gBAAM,IAAI;AAAA,YACR,mBACI,uCACA;AAAA,YACJ,EAAE,OAAO,MAAM;AAAA,UACjB;AAAA,QACF;AAAA,MAIF;AAAA,IACF,WAAW,kBAAkB;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,KAAK,cAAc,OAAO,8BAA8B;AAC7E,QAAI,QAAQ;AACV,UAAI;AACJ,UAAI;AACF,eAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,OAAO,IAAI;AAAA,MACrE,SAAS,OAAO;AACd,cAAM,IAAI,4BAA4B,4CAA4C;AAAA,UAChF,OAAO;AAAA,QACT,CAAC;AAAA,MACH;AACA,aAAO,cAAc,MAAM,OAAO,MAAM;AAAA,IAC1C;AAEA,QACE,KAAK,QAAQ,kBACZ,MAAM,SAAS,UAAa,OAAO,WAAW,KAAK,UAAU,MAAM,IAAI,CAAC,KAAK,KAAK,OACnF;AACA,UAAI;AACF,cAAM,WAAW,MAAM,KAAK,cAAc,OAAO,8BAA8B;AAC/E,eAAO;AAAA,UACL,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,SAAS,IAAI;AAAA,UAC9D,SAAS;AAAA,QACX;AAAA,MACF,SAAS,OAAO;AACd,YACE,uBACA,MAAM,WAAW,SACjB,KAAK,mBACL,KAAK,QAAQ,wBACb,iBAAiB,8BACjB;AACA,gCAAsB,OAAO,oBAAoB,KAAK,eAAe,CAAC;AACtE,gBAAM,KAAK,eAAe;AAC1B,iBAAO,MAAM,KAAK,YAAY,OAAO,KAAK;AAAA,QAC5C;AACA,cAAM;AAAA,MACR,UAAE;AACA,cAAM,KAAK,QAAQ,sBAAsB,EAAE,MAAM,MAAM,MAAS;AAAA,MAClE;AAAA,IACF;AAEA,UAAM,iBAAiB,MAAM,KAAK,eAAe;AACjD,UAAM,YAAY,GAAG,WAAW,IAAIJ,YAAW,CAAC;AAChD,UAAM,aAAa,GAAG,SAAS;AAC/B,UAAM,cAAc,GAAG,SAAS;AAChC,UAAM,eAAe,GAAG,SAAS;AACjC,UAAM,aAAa,GAAG,SAAS;AAC/B,UAAM,WAAW,GAAG,SAAS;AAC7B,UAAM,QAAQ,aAAa,MAAM,OAAO,0BAA0B;AAClE,UAAM,YAAYG,gBAAe,MAAM,aAAa,KAAK,SAAS;AAClE,UAAM,MAAM,mBAAmB,gBAAgB,MAAM,IAAI;AACzD,UAAM,OAAO,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,MAAM,IAAI;AAC7E,QAAI;AACF,YAAM;AAAA,QACJ,KAAK;AAAA,QACL,oCAAoCF,YAAW,SAAS,CAAC,oBAAoBA,YAAW,UAAU,CAAC;AAAA,QACnG;AAAA,MACF;AACA,UAAI,SAAS,QAAW;AACtB,YAAI,OAAO,WAAW,IAAI,IAAI,gCAAgC;AAC5D,gBAAM,IAAI,WAAW,8CAA8C;AAAA,QACrE;AACA,cAAM;AAAA,UACJ,KAAK;AAAA,UACL,EAAE,MAAM,aAAa,SAAS,MAAM,eAAe,MAAM;AAAA,UACzD;AAAA,QACF;AAAA,MACF;AACA,YAAM;AAAA,QACJ,KAAK;AAAA,QACL;AAAA,UACE,MAAM;AAAA,UACN,SAAS,WAAW;AAAA,YAClB,QAAQ,MAAM;AAAA,YACd;AAAA,YACA;AAAA,YACA;AAAA,YACA,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,YAAY;AAAA,YAC5C;AAAA,UACF,CAAC;AAAA,UACD,eAAe;AAAA,QACjB;AAAA,QACA;AAAA,MACF;AACA,YAAM;AAAA,QACJ,KAAK;AAAA,QACL,iBAAiBA,YAAW,UAAU,CAAC,GAAG,SAAS,SAAY,KAAK,IAAIA,YAAW,WAAW,CAAC,EAAE,SAASA,YAAW,UAAU,CAAC,6BAA6BA,YAAW,UAAU,CAAC,MAAMA,YAAW,UAAU,CAAC,8CAA8CA,YAAW,QAAQ,CAAC,oBAAoBA,YAAW,UAAU,CAAC;AAAA,QAC3T;AAAA,MACF;AACA,YAAM,WAAW;AAAA,QACf,MAAM,SAAS,KAAK,SAAS,UAAU,IAAI,SAAS;AAAA,QACpD;AAAA,MACF;AACA,UAAI,aAAa,GAAG;AAClB,cAAM,IAAI;AAAA,UACR,kDAAkD,QAAQ;AAAA,QAC5D;AAAA,MACF;AACA,YAAMH,UAAS,gBAAgB,MAAM,SAAS,KAAK,SAAS,YAAY,IAAI,SAAS,CAAC;AACtF,YAAM,eAAe,MAAM;AAAA,QACzB,KAAK;AAAA,QACL;AAAA,QACA,iCAAiC;AAAA,QACjC;AAAA,MACF;AACA,UAAI,OAAO,WAAW,YAAY,IAAI,gCAAgC;AACpE,cAAM,IAAI,4BAA4B,0CAA0C;AAAA,MAClF;AACA,aAAO,cAAc,cAAcA,OAAM;AAAA,IAC3C,SAAS,OAAO;AACd,UACE,iBAAiB,8BACjB,iBAAiB,+BACjB,iBAAiB,YACjB;AACA,cAAM;AAAA,MACR;AACA,UAAI,iBAAiB,8BAA8B;AACjD,YACE,uBACA,MAAM,WAAW,SACjB,KAAK,mBACL,KAAK,QAAQ,sBACb;AACA,gCAAsB,OAAO,oBAAoB,KAAK,eAAe,CAAC;AACtE,gBAAM,KAAK,eAAe;AAC1B,iBAAO,MAAM,KAAK,YAAY,OAAO,KAAK;AAAA,QAC5C;AACA,cAAM;AAAA,MACR;AACA,YAAM,IAAI,6BAA6B,+CAA+C;AAAA,QACpF,OAAO;AAAA,MACT,CAAC;AAAA,IACH,UAAE;AACA,YAAM,cAAc,KAAK,SAAS,aAAaG,YAAW,SAAS,CAAC,EAAE;AACtE,YAAM,KAAK,QAAQ,sBAAsB,EAAE,MAAM,MAAM,MAAS;AAAA,IAClE;AAAA,EACF;AAAA,EAEA,MAAc,aACZ,OACA,sBAAsB,MAC+B;AACrD,UAAM,mBAAmB,KAAK,QAAQ,+BAA+B;AACrE,QAAI,KAAK,QAAQ,sBAAsB,CAAC,KAAK,QAAQ,sBAAsB;AACzE,UAAI;AACF,cAAM,WAAW,MAAM,KAAK,QAAQ,mBAAmB,KAAK,IAAI;AAChE,cAAM,mBAAmB,2BAA2B,QAAQ;AAC5D,cAAM,UAAU,QAAQ,KAAK,QAAQ,QAAQ,KAAK,QAAQ,WAAW;AACrE,YAAI,CAAC,qBAAqB,oBAAoB,CAAC,UAAU;AACvD,gBAAM,IAAI;AAAA,YACR,mBACI,oDACA;AAAA,UACN;AAAA,QACF;AACA,YAAI,kBAAkB;AACpB,cAAI;AACF,mBAAO,MAAM,8BAA8B,UAAU,OAAO,KAAK,SAAS;AAAA,UAC5E,SAAS,OAAO;AACd,gBACE,uBACA,CAAC,oBACD,iBAAiB,8BACjB;AACA,qBAAO,MAAM,KAAK,aAAa,OAAO,KAAK;AAAA,YAC7C;AACA,kBAAM;AAAA,UACR;AAAA,QACF;AAAA,MACF,SAAS,OAAO;AACd,YACE,iBAAiB,8BACjB,iBAAiB,+BACjB,iBAAiB,gCACjB,iBAAiB,YACjB;AACA,gBAAM;AAAA,QACR;AACA,YAAI,oBAAqB,CAAC,KAAK,QAAQ,QAAQ,CAAC,KAAK,QAAQ,aAAc;AACzE,gBAAM,IAAI;AAAA,YACR,mBACI,uCACA;AAAA,YACJ,EAAE,OAAO,MAAM;AAAA,UACjB;AAAA,QACF;AAAA,MACF;AAAA,IACF,WAAW,kBAAkB;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,cAAc,MAAM,KAAK;AAAA,MAC7B;AAAA,MACA,MAAM,YAAY,YAAY,KAAK,OAAO,OAAO;AAAA,IACnD;AACA,QAAI,aAAa;AACf,UAAI,YAAY,SAAS,OAAO,YAAY,UAAU,KAAK;AACzD,sBAAc,IAAI,YAAY,EAAE,OAAO,YAAY,IAAI,GAAG,YAAY,MAAM;AAC5E,cAAM,IAAI,4BAA4B,8CAA8C;AAAA,MACtF;AACA,aAAO,qBAAqB,YAAY,MAAM,YAAY,SAAS,KAAK;AAAA,IAC1E;AAEA,QAAI,KAAK,QAAQ,eAAe;AAC9B,UAAI;AACF,cAAM,WAAW,MAAM,KAAK;AAAA,UAC1B;AAAA,UACA,MAAM,YAAY,YAAY,KAAK,OAAO,OAAO;AAAA,QACnD;AACA,YAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;AACnD,wBAAc,IAAI,YAAY,EAAE,OAAO,SAAS,IAAI,GAAG,SAAS,MAAM;AACtE,gBAAM,IAAI,4BAA4B,8CAA8C;AAAA,QACtF;AACA,eAAO,qBAAqB,SAAS,MAAM,SAAS,SAAS,KAAK;AAAA,MACpE,SAAS,OAAO;AACd,YACE,uBACA,KAAK,mBACL,KAAK,QAAQ,wBACb,iBAAiB,8BACjB;AACA,gCAAsB,OAAO,oBAAoB,KAAK,eAAe,CAAC;AACtE,gBAAM,KAAK,eAAe;AAC1B,iBAAO,MAAM,KAAK,aAAa,OAAO,KAAK;AAAA,QAC7C;AACA,cAAM;AAAA,MACR,UAAE;AACA,cAAM,KAAK,QAAQ,sBAAsB,EAAE,MAAM,MAAM,MAAS;AAAA,MAClE;AAAA,IACF;AAEA,UAAM,iBAAiB,MAAM,KAAK,eAAe;AACjD,UAAM,YAAY,GAAG,WAAW,IAAID,YAAW,CAAC;AAChD,UAAM,aAAa,GAAG,SAAS;AAC/B,UAAM,eAAe,GAAG,SAAS;AACjC,UAAM,sBAAsB,GAAG,SAAS;AACxC,UAAM,aAAa,GAAG,SAAS;AAC/B,UAAM,WAAW,GAAG,SAAS;AAC7B,UAAM,QAAQ,aAAa,MAAM,OAAO,0BAA0B;AAClE,UAAM,YAAYG,gBAAe,MAAM,aAAa,KAAK,SAAS;AAClE,UAAM,MAAM,mBAAmB,gBAAgB,MAAM,IAAI;AACzD,QAAI;AACF,YAAM;AAAA,QACJ,KAAK;AAAA,QACL,oCAAoCF,YAAW,SAAS,CAAC;AAAA,IAAmBA,YAAW,UAAU,CAAC;AAAA,QAClG;AAAA,MACF;AACA,YAAM;AAAA,QACJ,KAAK;AAAA,QACL;AAAA,UACE,MAAM;AAAA,UACN,SAAS,WAAW;AAAA,YAClB,QAAQ,MAAM;AAAA,YACd;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF,CAAC;AAAA,UACD,eAAe;AAAA,QACjB;AAAA,QACA;AAAA,MACF;AACA,YAAM;AAAA,QACJ,KAAK;AAAA,QACL,iBAAiBA,YAAW,UAAU,CAAC,SAASA,YAAW,UAAU,CAAC,6BAA6BA,YAAW,UAAU,CAAC,MAAMA,YAAW,UAAU,CAAC,8CAA8CA,YAAW,QAAQ,CAAC;AAAA,IAAmBA,YAAW,UAAU,CAAC;AAAA,QAChQ;AAAA,MACF;AACA,YAAM,WAAW;AAAA,QACf,MAAM,SAAS,KAAK,SAAS,UAAU,IAAI,SAAS;AAAA,QACpD;AAAA,MACF;AACA,UAAI,aAAa,GAAG;AAClB,cAAM,IAAI;AAAA,UACR,kDAAkD,QAAQ;AAAA,QAC5D;AAAA,MACF;AACA,YAAMH,UAAS,gBAAgB,MAAM,SAAS,KAAK,SAAS,YAAY,IAAI,SAAS,CAAC;AACtF,UAAIA,UAAS,OAAOA,WAAU,KAAK;AACjC,cAAM,eAAe,MAAM;AAAA,UACzB,KAAK;AAAA,UACL;AAAA,UACA,iCAAiC;AAAA,UACjC;AAAA,QACF;AACA,sBAAc,cAAcA,OAAM;AAClC,cAAM,IAAI,4BAA4B,8CAA8C;AAAA,MACtF;AACA,YAAM,UAAU;AAAA,QACd,MAAM,SAAS,KAAK,SAAS,qBAAqB,KAAK,MAAM,SAAS;AAAA,MACxE;AACA,YAAM,OAAO,MAAM;AAAA,QACjB,KAAK;AAAA,QACL;AAAA,QACA,MAAM,YAAY,YAAY,KAAK,OAAO,OAAO;AAAA,QACjD;AAAA,MACF;AACA,aAAO,qBAAqB,MAAM,SAAS,KAAK;AAAA,IAClD,SAAS,OAAO;AACd,UACE,iBAAiB,8BACjB,iBAAiB,+BACjB,iBAAiB,YACjB;AACA,cAAM;AAAA,MACR;AACA,UAAI,iBAAiB,8BAA8B;AACjD,YAAI,uBAAuB,KAAK,mBAAmB,KAAK,QAAQ,sBAAsB;AACpF,gCAAsB,OAAO,oBAAoB,KAAK,eAAe,CAAC;AACtE,gBAAM,KAAK,eAAe;AAC1B,iBAAO,MAAM,KAAK,aAAa,OAAO,KAAK;AAAA,QAC7C;AACA,cAAM;AAAA,MACR;AACA,YAAM,IAAI,6BAA6B,6CAA6C;AAAA,QAClF,OAAO;AAAA,MACT,CAAC;AAAA,IACH,UAAE;AACA,YAAM,cAAc,KAAK,SAAS,aAAaG,YAAW,SAAS,CAAC,EAAE;AACtE,YAAM,KAAK,QAAQ,sBAAsB,EAAE,MAAM,MAAM,MAAS;AAAA,IAClE;AAAA,EACF;AAAA,EAEA,MAAc,cACZ,OACA,UAC2D;AAC3D,UAAM,OAAO,MAAM,KAAK,eAAe;AACvC,UAAM,UAAU,wBAAwB;AAAA,MACtC,QAAQ,MAAM;AAAA,MACd,KAAK,mBAAmB,MAAM,MAAM,IAAI;AAAA,MACxC,OAAO,aAAa,MAAM,OAAO,0BAA0B;AAAA,MAC3D,GAAI,MAAM,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,MAAM,IAAI,EAAE;AAAA,MACvE,WAAWE,gBAAe,MAAM,aAAa,KAAK,SAAS;AAAA,MAC3D;AAAA,MACA,MAAM,KAAK,QAAQ,mBAAmB,KAAK;AAAA,IAC7C,CAAC;AACD,QAAI;AACF,YAAM,SAAS,MAAM,KAAK,QAAQ,cAAe;AAAA,QAC/C,KAAK,QAAQ;AAAA,QACb,OAAO,QAAQ;AAAA,QACf,OAAO,QAAQ;AAAA,QACf,OAAO;AAAA,QACP,SAAS,2BAA2B,KAAK,OAAO;AAAA,MAClD,CAAC;AACD,UAAI,OAAO,aAAa,KAAK,OAAO,WAAW,QAAW;AACxD,cAAM,IAAI,6BAA6B,mCAAmC;AAAA,MAC5E;AACA,aAAO,8BAA8B,OAAO,QAAQ,QAAQ,QAAQ,QAAQ;AAAA,IAC9E,SAAS,OAAO;AACd,UAAI,iBAAiB,cAAc,iBAAiB,6BAA8B,OAAM;AACxF,YAAM,IAAI,6BAA6B,+CAA+C;AAAA,QACpF,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAc,iBAAkC;AAC9C,QAAI,CAAC,KAAK,mBAAmB,CAAC,KAAK,QAAQ,qBAAsB,QAAO,KAAK;AAC7E,WAAO,MAAM,KAAK,qBAAqB,KAAK;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,cACZ,OACA,kBACA,QAAQ,MAC4E;AACpF,UAAM,YAAY,KAAK;AACvB,QAAI,CAAC,aAAa,CAAC,KAAK,QAAQ,sBAAsB,CAAC,KAAK,QAAQ,sBAAsB;AACxF,aAAO;AAAA,IACT;AACA,UAAM,SAAS,MAAM;AACrB,QAAI,WAAW,SAAS,WAAW,UAAU,WAAW,SAAS,WAAW,UAAU;AACpF,YAAM,IAAI,4BAA4B,8CAA8C;AAAA,IACtF;AAEA,uBAAmB,KAAK,MAAM,MAAM,IAAI;AACxC,UAAM,OACJ,MAAM,SAAS,SAAY,SAAY,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,MAAM,IAAI,CAAC;AAC5F,QAAI,SAAS,UAAa,KAAK,aAAa,gCAAgC;AAC1E,YAAM,IAAI,WAAW,8CAA8C;AAAA,IACrE;AACA,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,KAAK,QAAQ,mBAAmB;AAAA,QAC9C,SAAS,UAAU;AAAA,QACnB,iBAAiB,UAAU;AAAA,QAC3B;AAAA,QACA,MAAM,MAAM;AAAA,QACZ,aAAa,aAAa,MAAM,OAAO,0BAA0B;AAAA,QACjE,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,QACrC,WAAWA,gBAAe,MAAM,aAAa,KAAK,SAAS;AAAA,QAC3D;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,SAAS,WAAW,OAAO;AAC7B,cAAM,KAAK,qBAAqB,IAAI;AACpC,eAAO,MAAM,KAAK,cAAc,OAAO,kBAAkB,KAAK;AAAA,MAChE;AACA,YAAM,IAAI,6BAA6B,+CAA+C;AAAA,QACpF,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,QAAI,QAAQ,SAAS,cAAe,QAAO;AAC3C,QAAI,QAAQ,SAAS,qBAAqB;AACxC,UAAI,CAAC,MAAO,OAAM,IAAI,6BAA6B,mCAAmC;AACtF,YAAM,KAAK,qBAAqB,IAAI;AACpC,aAAO,MAAM,KAAK,cAAc,OAAO,kBAAkB,KAAK;AAAA,IAChE;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,qBAAqB,SAAmC;AACpE,QAAI,CAAC,KAAK,mBAAmB,CAAC,KAAK,QAAQ,qBAAsB,QAAO,KAAK;AAC7E,UAAM,MAAM,oBAAoB,KAAK,eAAe;AACpD,QAAI,QAAS,uBAAsB,OAAO,GAAG;AAC7C,UAAM,SAAS,sBAAsB,IAAI,GAAG;AAC5C,QAAI,WAAW,OAAW,QAAO;AACjC,UAAM,UAAU,MAAM,KAAK,QAAQ,qBAAqB;AAAA,MACtD,SAAS,KAAK,gBAAgB;AAAA,MAC9B,iBAAiB,KAAK,gBAAgB;AAAA,MACtC,YAAY,KAAK;AAAA,MACjB,gBAAgB,CAAC;AAAA,IACnB,CAAC;AACD,UAAM,OAAOJ,aAAY,QAAQ,IAAI;AACrC,0BAAsB,IAAI,KAAK,IAAI;AACnC,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBAAoB,WAAiE;AAC5F,SAAO,GAAG,UAAU,OAAO,KAAS,UAAU,eAAe;AAC/D;AAEO,IAAM,8BAAN,MAAkC;AAAA,EAC9B;AAAA,EACQ;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YACE,QACA,OAKA;AACA,SAAK,SAAS;AACd,SAAK,YAAY,eAAe,MAAM,SAAS;AAC/C,SAAK,eAAe,aAAa,MAAM,cAAc,uBAAuB;AAC5E,SAAK,YAAY,aAAa,MAAM,WAAW,oBAAoB;AAAA,EACrE;AAAA,EAEA,MAAM,cAA6C;AACjD,UAAM,OAAO,MAAM,KAAK,OAAO,kBAAkB;AAAA,MAC/C,QAAQ;AAAA,MACR,MAAM,KAAK,KAAK,SAAS;AAAA,MACzB,OAAO,KAAK;AAAA,IACd,CAAC;AACD,QAAI,CAAC,MAAM,QAAQ,IAAI,GAAG;AACxB,YAAM,IAAI,4BAA4B,+CAA+C;AAAA,IACvF;AACA,WAAO,KAAK,IAAI,CAAC,WAAW,cAAc,MAAM,MAAM,CAAC;AAAA,EACzD;AAAA,EAEA,MAAM,gBAA2D;AAC/D,UAAM,OAAO,MAAM,KAAK,OAAO,kBAAkB;AAAA,MAC/C,QAAQ;AAAA,MACR,MAAM,KAAK,KAAK,WAAW;AAAA,MAC3B,OAAO,KAAK;AAAA,IACd,CAAC;AACD,UAAM,WAAW,4BAA4B,MAAM,IAAI;AACvD,QACE,SAAS,qBAAqB,KAAK,UAAU,oBAC7C,SAAS,yBAAyB,KAAK,UAAU,sBACjD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,SAAS,YAAmD;AAChE,UAAM,KAAK,YAAY,YAAY,aAAa;AAChD,UAAM,OAAO,MAAM,KAAK,OAAO,kBAAkB;AAAA,MAC/C,QAAQ;AAAA,MACR,MAAM,KAAK,KAAK,aAAa,EAAE,EAAE;AAAA,MACjC,OAAO,KAAK;AAAA,IACd,CAAC;AACD,UAAM,WAAW,gBAAgB,MAAM,IAAI;AAC3C,QACE,SAAS,OAAO,MAChB,SAAS,qBAAqB,KAAK,UAAU,oBAC7C,SAAS,yBAAyB,KAAK,UAAU,sBACjD;AACA,YAAM,IAAI,4BAA4B,sDAAsD;AAAA,IAC9F;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,eACJ,YACA,cAC4C;AAC5C,UAAM,KAAK,YAAY,YAAY,aAAa;AAChD,UAAM,UAAU,6BAA6B,MAAM,YAAY;AAC/D,QAAI,QAAQ,eAAe,IAAI;AAC7B,YAAM,IAAI,4BAA4B,0CAA0C;AAAA,IAClF;AACA,UAAM,UAAU,6BAA6B;AAAA,MAC3C,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,KAAK,aAAa,EAAE,UAAU;AAAA,QACzC,OAAO,KAAK;AAAA,QACZ,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AACA,QAAI,QAAQ,gBAAgB,QAAQ,eAAe,QAAQ,eAAe,IAAI;AAC5E,YAAM,IAAI,4BAA4B,oDAAoD;AAAA,IAC5F;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,eAAe,UAAyD;AAC5E,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,KAAK,OAAO,kBAAkB;AAAA,QACzC,QAAQ;AAAA,QACR,MAAM,KAAK,KAAK,YAAY;AAAA,QAC5B,OAAO,KAAK;AAAA,QACZ,MAAM,6BAA6B,MAAM,EAAE,SAAS,CAAC;AAAA,MACvD,CAAC;AAAA,IACH,SAAS,OAAO;AAGd,UAAI,kBAAkB,KAAK;AACzB,cAAM;AAAA,UACJ;AAAA,UACA,KAAK,OAAO,sBAAsB;AAAA,QACpC;AACF,YAAM;AAAA,IACR;AACA,WAAO,wBAAwB,MAAM,IAAI;AAAA,EAC3C;AAAA,EAEA,MAAM,UAAU,aAA4D;AAC1E,UAAM,KAAK,YAAY,aAAa,cAAc;AAClD,WAAO,wBAAwB;AAAA,MAC7B,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,KAAK,cAAc,EAAE,EAAE;AAAA,QAClC,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,aAA4D;AAC9E,UAAM,KAAK,YAAY,aAAa,cAAc;AAClD,WAAO,wBAAwB;AAAA,MAC7B,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,KAAK,cAAc,EAAE,OAAO;AAAA,QACvC,OAAO,KAAK;AAAA,QACZ,MAAM,CAAC;AAAA,QACP,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA,EAIA,MAAM,gBACJ,cACA,UAAkC,CAAC,GACU;AAC7C,UAAM,UAAU,8BAA8B,MAAM,YAAY;AAChE,UAAM,UAAU,8BAA8B;AAAA,MAC5C,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,KAAK,cAAc,QAAQ,WAAW,UAAU;AAAA,QAC3D,OAAO,KAAK;AAAA,QACZ,MAAM;AAAA,QACN,GAAI,QAAQ,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,QAAQ,UAAU;AAAA,MAC5E,CAAC;AAAA,IACH;AACA,QAAI,QAAQ,gBAAgB,QAAQ,aAAa;AAC/C,YAAM,IAAI,4BAA4B,+CAA+C;AAAA,IACvF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA,EAIA,MAAM,gBACJ,cACmD;AACnD,UAAM,UAAU,8BAA8B,MAAM,YAAY;AAChE,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,KAAK,OAAO,kBAAkB;AAAA,QACzC,QAAQ;AAAA,QACR,MAAM,KAAK,KAAK,cAAc,QAAQ,WAAW,UAAU;AAAA,QAC3D,OAAO,KAAK;AAAA,QACZ,MAAM;AAAA,QACN,WAAW,QAAQ,SAAS;AAAA,MAC9B,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,kBAAkB,KAAK,EAAG,QAAO;AACrC,YAAM;AAAA,IACR;AACA,UAAMD,UAAS,6BAA6B,MAAM,IAAI;AACtD,QAAIA,QAAO,gBAAgB,QAAQ,aAAa;AAC9C,YAAM,IAAI,4BAA4B,+CAA+C;AAAA,IACvF;AACA,WAAOA;AAAA,EACT;AAAA,EAEA,MAAM,WAAW,KAAgD;AAC/D,WAAO,mBAAmB;AAAA,MACxB,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,KAAK,SAAS;AAAA,QACzB,OAAO,KAAK;AAAA,QACZ,MAAM,QAAQ,SAAY,CAAC,IAAI,EAAE,KAAK,WAAW,GAAG,EAAE;AAAA,MACxD,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,wBAAwB,KAAuD;AACnF,QAAI;AACJ,QAAI;AACF,iBAAW,0BAA0B;AAAA,QACnC,MAAM,KAAK,OAAO,kBAAkB;AAAA,UAClC,QAAQ;AAAA,UACR,MAAM,KAAK,KAAK,6BAA6B;AAAA,UAC7C,OAAO,KAAK;AAAA,UACZ,MAAM,QAAQ,SAAY,CAAC,IAAI,EAAE,KAAK,WAAW,GAAG,EAAE;AAAA,QACxD,CAAC;AAAA,MACH;AAAA,IACF,SAAS,OAAO;AAKd,UAAI,CAAC,kBAAkB,KAAK,EAAG,OAAM;AACrC,YAAM,SAAS,MAAM,KAAK,WAAW,GAAG;AACxC,UACE,OAAO,OAAO,qBAAqB,KAAK,UAAU,oBAClD,OAAO,OAAO,yBAAyB,KAAK,UAAU,sBACtD;AACA,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,UAAI;AACJ,UAAI;AACF,kBAAU,MAAM,KAAK,YAAY;AAAA,MACnC,QAAQ;AAGN,cAAM,IAAI,2BAA2B,KAAK;AAAA,UACxC,MAAM;AAAA,UACN,SACE;AAAA,UACF,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,iBAAW;AAAA,QACT,kBAAkB,KAAK,UAAU;AAAA,QACjC,sBAAsB,KAAK,UAAU;AAAA,QACrC;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,qBAAqB,KAAK,UAAU,oBAC7C,SAAS,yBAAyB,KAAK,UAAU,wBACjD,SAAS,QAAQ;AAAA,MACf,CAAC,WACC,OAAO,qBAAqB,KAAK,UAAU,oBAC3C,OAAO,yBAAyB,KAAK,UAAU;AAAA,IACnD,GACA;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA,EAIA,MAAM,aACJ,UACA,UAA2C,CAAC,GACV;AAClC,WAAO,mBAAmB;AAAA,MACxB,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,uBAAuB,KAAK,WAAW,UAAU,QAAQ,GAAG,OAAO;AAAA,QACzE,OAAO,KAAK;AAAA,QACZ,MAAM,CAAC;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,UAAiD;AACjE,UAAM,OAAO,MAAM,KAAK,OAAO,kBAAkB;AAAA,MAC/C,QAAQ;AAAA,MACR,MAAM,KAAK,WAAW,QAAQ;AAAA,MAC9B,OAAO,KAAK;AAAA,IACd,CAAC;AACD,QAAI,CAAC,MAAM,QAAQ,IAAI,GAAG;AACxB,YAAM,IAAI,4BAA4B,+CAA+C;AAAA,IACvF;AACA,WAAO,KAAK,IAAI,CAAC,WAAW,cAAc,MAAM,MAAM,CAAC;AAAA,EACzD;AAAA,EAEA,MAAM,QACJ,UACA,UAA2C,CAAC,GACV;AAClC,WAAO,mBAAmB;AAAA,MACxB,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,uBAAuB,KAAK,WAAW,UAAU,aAAa,GAAG,OAAO;AAAA,QAC9E,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,UAAoD;AACpE,QAAI;AACJ,QAAI;AACF,cAAQ,mBAAmB;AAAA,QACzB,MAAM,KAAK,OAAO,kBAAkB;AAAA,UAClC,QAAQ;AAAA,UACR,MAAM,KAAK,WAAW,UAAU,OAAO;AAAA,UACvC,OAAO,KAAK;AAAA,QACd,CAAC;AAAA,MACH;AAAA,IACF,SAAS,OAAO;AAId,UACE,EAAE,iBAAiB,+BACnB,MAAM,WAAW,OACjB,MAAM,MAAM,SAAS,wBACrB,MAAM,MAAM,YAAY,mBACxB;AACA,cAAM;AAAA,MACR;AACA,YAAM,cAAc,MAAM,KAAK,QAAQ,QAAQ;AAC/C,cAAQ,mBAAmB,MAAM;AAAA,QAC/B,kBAAkB,YAAY;AAAA,QAC9B,sBAAsB,YAAY,OAAO;AAAA,QACzC,UAAU,YAAY,OAAO;AAAA,QAC7B,kBAAkB,YAAY,OAAO;AAAA,QACrC,oBAAoB,YAAY,OAAO;AAAA,QACvC,SAAS,YAAY;AAAA,MACvB,CAAC;AAAA,IACH;AACA,QACE,MAAM,qBAAqB,KAAK,UAAU,oBAC1C,MAAM,yBAAyB,KAAK,UAAU,wBAC9C,MAAM,aAAa,UACnB;AACA,YAAM,IAAI,4BAA4B,iDAAiD;AAAA,IACzF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,QACJ,UACA,cACsC;AACtC,UAAM,UAAU,sBAAsB,MAAM,YAAY;AACxD,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,KAAK,OAAO,kBAAkB;AAAA,QACzC,QAAQ;AAAA,QACR,MAAM,KAAK,WAAW,UAAU,UAAU;AAAA,QAC1C,OAAO,KAAK;AAAA,QACZ,MAAM;AAAA,MACR,CAAC;AAAA,IACH,SAAS,OAAO;AAGd,UAAI,kBAAkB,KAAK,GAAG;AAC5B,cAAM;AAAA,UACJ;AAAA,UACA,KAAK,OAAO,sBAAsB;AAAA,QACpC;AAAA,MACF;AACA,YAAM;AAAA,IACR;AACA,UAAM,SAAS,uBAAuB,MAAM,IAAI;AAChD,QACE,OAAO,qBAAqB,KAAK,UAAU,oBAC3C,OAAO,yBAAyB,KAAK,UAAU,wBAC/C,OAAO,aAAa,YACpB,OAAO,qBAAqB,QAAQ,4BACpC,OAAO,uBAAuB,QAAQ,8BACtC,OAAO,YAAY,QAAQ,mBAC3B,OAAO,SAAS,QAAQ,MACxB;AACA,YAAM,IAAI,4BAA4B,6CAA6C;AAAA,IACrF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,QACJ,UACA,UAA2C,CAAC,GACd;AAC9B,UAAM,QAAQ,IAAI,gBAAgB;AAAA,MAChC,QAAQ,QAAQ,UAAU;AAAA,MAC1B,SAAS,OAAO,eAAe,QAAQ,WAAW,IAAI,GAAG,KAAK,4BAA4B,CAAC;AAAA,IAC7F,CAAC;AACD,QAAI,QAAQ,WAAW,UAAa,QAAQ,WAAW,UAAU,QAAQ,WAAW,OAAO;AACzF,YAAM,IAAI,WAAW,sCAAsC;AAAA,IAC7D;AACA,QAAI,QAAQ,aAAa,QAAW;AAClC,UAAI,OAAO,QAAQ,aAAa,WAAW;AACzC,cAAM,IAAI,WAAW,wCAAwC;AAAA,MAC/D;AACA,YAAM,IAAI,YAAY,OAAO,QAAQ,QAAQ,CAAC;AAAA,IAChD;AACA,WAAO,MAAM,KAAK,OAAO,8BAA8B;AAAA,MACrD,QAAQ;AAAA,MACR,MAAM,KAAK,WAAW,UAAU,cAAc,KAAK,EAAE;AAAA,MACrD,OAAO,KAAK;AAAA,MACZ,uBAAuB;AAAA,QACrB,kBAAkB,KAAK,UAAU;AAAA,QACjC,sBAAsB,KAAK,UAAU;AAAA,QACrC,UAAU,gBAAgB,UAAU,mBAAmB;AAAA,MACzD;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,gBAAgD;AACpD,WAAO,iBAAiB;AAAA,MACtB,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,KAAK,WAAW;AAAA,QAC3B,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,OACJ,SACA,UAA2C,CAAC,GACR;AACpC,UAAM,SAAS,qBAAqB,MAAM,OAAO;AACjD,QACE,OAAO,qBAAqB,KAAK,UAAU,oBAC3C,OAAO,yBAAyB,KAAK,UAAU,sBAC/C;AACA,YAAM,IAAI,4BAA4B,mDAAmD;AAAA,IAC3F;AACA,QAAI;AACJ,QAAI;AACF,aAAO,MAAM;AAAA,QACX;AAAA,QACA,wBAAwB,OAAO,MAAM;AAAA,QACrC,OAAO,cACL,MAAM,KAAK,OAAO,kBAAkB;AAAA,UAClC,QAAQ;AAAA;AAAA;AAAA,UAGR,MAAM;AAAA,YACJ,GAAG,KAAK,KAAK,SAAS,CAAC,IAAI,wCAAwC,MAAM,sCAAsC,IAAI,oCAAoC;AAAA,YACvJ;AAAA,UACF;AAAA,UACA,OAAO,KAAK;AAAA,UACZ,MAAM;AAAA,UACN;AAAA,QACF,CAAC;AAAA,MACL;AAAA,IACF,SAAS,OAAO;AAMd,UACE,iBAAiB,8BACjB,MAAM,WAAW,OACjB,MAAM,MAAM,SAAS,oBACrB,MAAM,MAAM,YAAY,6BACxB;AACA,cAAM,IAAI,2BAA2B,KAAK;AAAA,UACxC,MAAM;AAAA,UACN,SAAS;AAAA,YACP,OAAO;AAAA,YACP,KAAK,OAAO,sBAAsB;AAAA,UACpC;AAAA,UACA,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM;AAAA,IACR;AACA,WAAO,qBAAqB,MAAM,IAAI;AAAA,EACxC;AAAA;AAAA;AAAA,EAIA,MAAM,oBACJ,SACiD;AACjD,UAAM,SAAS,iCAAiC,MAAM,OAAO;AAC7D,WAAO,kCAAkC;AAAA,MACvC,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,KAAK,cAAc,OAAO,WAAW,kBAAkB;AAAA,QAClE,OAAO,KAAK;AAAA,QACZ,MAAM;AAAA,QACN,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,aAAyD;AACrE,WAAO,qBAAqB;AAAA,MAC1B,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,KAAK,cAAc,YAAY,aAAa,cAAc,CAAC,EAAE;AAAA,QACxE,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YACJ,SAC0C;AAC1C,UAAM,SAAS,0BAA0B,MAAM,OAAO;AACtD,QACE,OAAO,qBAAqB,KAAK,UAAU,oBAC3C,OAAO,yBAAyB,KAAK,UAAU,sBAC/C;AACA,YAAM,IAAI,4BAA4B,iDAAiD;AAAA,IACzF;AACA,WAAO,2BAA2B;AAAA,MAChC,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,KAAK,6BAA6B;AAAA,QAC7C,OAAO,KAAK;AAAA,QACZ,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA,EAIA,MAAM,aACJ,cACyC;AACzC,UAAM,UAAU,2BAA2B,MAAM,YAAY;AAC7D,QACE,QAAQ,qBAAqB,KAAK,UAAU,oBAC5C,QAAQ,yBAAyB,KAAK,UAAU,sBAChD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,0BAA0B;AAAA,MAC/B,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,KAAK,eAAe;AAAA,QAC/B,OAAO,KAAK;AAAA,QACZ,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,YACJ,UACA,UAII,CAAC,GACiC;AACtC,UAAM,QAAQ,IAAI,gBAAgB;AAClC,QAAI,QAAQ,MAAO,OAAM,IAAI,SAAS,CAAC,GAAG,IAAI,IAAI,QAAQ,KAAK,CAAC,EAAE,KAAK,GAAG,CAAC;AAC3E,QAAI,QAAQ,kBAAkB,QAAW;AACvC,YAAM;AAAA,QACJ;AAAA,QACA,uBAAuB,QAAQ,eAAe,mBAAmB,EAAE,SAAS;AAAA,MAC9E;AAAA,IACF;AACA,QAAI,QAAQ,UAAU,QAAW;AAC/B,YAAM,QAAQ,oBAAoB,QAAQ,OAAO,kBAAkB;AACnE,UAAI,QAAQ,IAAO,OAAM,IAAI,WAAW,+BAA+B;AACvE,YAAM,IAAI,SAAS,MAAM,SAAS,CAAC;AAAA,IACrC;AACA,UAAM,SAAS,MAAM,SAAS,IAAI,KAAK,IAAI,MAAM,SAAS,CAAC;AAC3D,WAAO,uBAAuB;AAAA,MAC5B,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,GAAG,KAAK,WAAW,UAAU,aAAa,CAAC,GAAG,MAAM;AAAA,QAC1D,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEQ,KAAK,QAAwB;AACnC,WAAO,wBAAwB,KAAK,UAAU,gBAAgB,IAAI,MAAM;AAAA,EAC1E;AAAA,EAEQ,WAAW,UAAkB,QAAyB;AAC5D,UAAM,OAAO,KAAK,KAAK,WAAW,mBAAmB,gBAAgB,UAAU,WAAW,CAAC,CAAC,EAAE;AAC9F,WAAO,SAAS,GAAG,IAAI,IAAI,MAAM,KAAK;AAAA,EACxC;AACF;AAEO,IAAM,+BAAN,MAAmC;AAAA,EAC/B;AAAA,EACQ;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YACE,QACA,OAKA;AACA,SAAK,SAAS;AACd,SAAK,YAAY,uBAAuB,MAAM,SAAS;AACvD,SAAK,eAAe,aAAa,MAAM,cAAc,wBAAwB;AAC7E,SAAK,YAAY,aAAa,MAAM,WAAW,qBAAqB;AAAA,EACtE;AAAA,EAEA,MAAM,cAA8C;AAClD,UAAM,OAAO,MAAM,KAAK,OAAO,kBAAkB;AAAA,MAC/C,QAAQ;AAAA,MACR,MAAM,KAAK,KAAK,SAAS;AAAA,MACzB,OAAO,KAAK;AAAA,IACd,CAAC;AACD,QAAI,CAAC,MAAM,QAAQ,IAAI,GAAG;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,KAAK,IAAI,CAAC,WAAW,eAAe,MAAM,MAAM,CAAC;AAAA,EAC1D;AAAA,EAEA,MAAM,QAAQ,UAAqD;AACjE,WAAO,oBAAoB;AAAA,MACzB,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,WAAW,UAAU,aAAa;AAAA,QAC7C,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,QACJ,UACA,UAKI,CAAC,GAC0B;AAC/B,UAAM,QAAQ,IAAI,gBAAgB;AAClC,QAAI,QAAQ,WAAW,OAAW,OAAM,IAAI,UAAU,QAAQ,MAAM;AACpE,QAAI,QAAQ,YAAY,OAAW,OAAM,IAAI,WAAW,OAAO,QAAQ,OAAO,CAAC;AAC/E,QAAI,QAAQ,aAAa,OAAW,OAAM,IAAI,YAAY,OAAO,QAAQ,QAAQ,CAAC;AAClF,QAAI,QAAQ,cAAc,OAAW,OAAM,IAAI,aAAa,OAAO,QAAQ,SAAS,CAAC;AACrF,UAAM,SAAS,MAAM,OAAO,IAAI,cAAc,KAAK,KAAK;AACxD,WAAO,MAAM,KAAK,OAAO,uBAAuB;AAAA,MAC9C,QAAQ;AAAA,MACR,MAAM,KAAK,WAAW,UAAU,MAAM;AAAA,MACtC,OAAO,KAAK;AAAA,MACZ,uBAAuB;AAAA,QACrB,mBAAmB,KAAK,UAAU;AAAA,QAClC,sBAAsB,KAAK,UAAU;AAAA,QACrC,UAAU,gBAAgB,UAAU,oBAAoB;AAAA,MAC1D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,gBAAiD;AACrD,WAAO,kBAAkB;AAAA,MACvB,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,KAAK,WAAW;AAAA,QAC3B,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,SAAgE;AAC/E,UAAM,SAAS,sBAAsB,MAAM,OAAO;AAClD,QACE,OAAO,sBAAsB,KAAK,UAAU,qBAC5C,OAAO,yBAAyB,KAAK,UAAU;AAE/C,YAAM,IAAI,4BAA4B,gDAAgD;AACxF,WAAO,sBAAsB;AAAA,MAC3B,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,KAAK,cAAc;AAAA,QAC9B,OAAO,KAAK;AAAA,QACZ,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,SAA0E;AACrF,UAAM,SAAS,sBAAsB,MAAM,OAAO;AAClD,QACE,OAAO,sBAAsB,KAAK,UAAU,qBAC5C,OAAO,yBAAyB,KAAK,UAAU,sBAC/C;AACA,YAAM,IAAI,4BAA4B,oDAAoD;AAAA,IAC5F;AACA,WAAO,sBAAsB;AAAA,MAC3B,MAAM;AAAA,QACJ;AAAA,QACA,yBAAyB,OAAO,MAAM;AAAA,QACtC,OAAO,cACL,MAAM,KAAK,OAAO,kBAAkB;AAAA,UAClC,QAAQ;AAAA;AAAA;AAAA,UAGR,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,IAAI,2CAA2C,MAAM,mDAAmD;AAAA,UACrI,OAAO,KAAK;AAAA,UACZ,MAAM;AAAA,UACN;AAAA,QACF,CAAC;AAAA,MACL;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,aAAwD;AACpE,WAAO,yBAAyB;AAAA,MAC9B,MAAM,KAAK,OAAO,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,KAAK,cAAc,YAAY,aAAa,cAAc,CAAC,EAAE;AAAA,QACxE,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,YAA2B;AAC/B,UAAM,OAAO,MAAM,KAAK,OAAO,kBAAkB;AAAA,MAC/C,QAAQ;AAAA,MACR,MAAM,KAAK,KAAK,WAAW;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,MAAM,CAAC;AAAA,IACT,CAAC;AACD,QAAI,CAAC,SAAS,IAAI,KAAK,KAAK,UAAU,MAAM;AAC1C,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,KAAK,QAAwB;AACnC,WAAO,yBAAyB,KAAK,UAAU,iBAAiB,IAAI,MAAM;AAAA,EAC5E;AAAA,EAEQ,WAAW,UAAkB,QAAyB;AAC5D,UAAM,OAAO,KAAK;AAAA,MAChB,WAAW,mBAAmB,gBAAgB,UAAU,oBAAoB,CAAC,CAAC;AAAA,IAChF;AACA,WAAO,SAAS,GAAG,IAAI,IAAI,MAAM,KAAK;AAAA,EACxC;AACF;AAEA,SAAS,WAAW,OAQT;AACT,QAAM,UAAU,KAAK,IAAI,GAAG,KAAK,KAAK,MAAM,YAAY,GAAK,CAAC;AAC9D,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,aAAa,gBAAgB,GAAG,CAAC;AAAA,IACjC,qBAAqB,KAAK,IAAI,SAAS,EAAE,CAAC;AAAA,IAC1C,cAAc,OAAO;AAAA,IACrB,aAAa,gBAAgB,MAAM,MAAM,CAAC;AAAA,IAC1C,SAAS,gBAAgB,MAAM,GAAG,CAAC;AAAA,IACnC,YAAY,gBAAgB,yBAAyB,MAAM,KAAK,EAAE,CAAC;AAAA,IACnE,GAAI,MAAM,cACN;AAAA,MACE,YAAY,gBAAgB,gCAAgC,CAAC;AAAA,MAC7D,iBAAiB,gBAAgB,IAAI,MAAM,WAAW,EAAE,CAAC;AAAA,IAC3D,IACA,CAAC;AAAA,IACL,YAAY,gBAAgB,MAAM,YAAY,CAAC;AAAA,IAC/C,GAAI,MAAM,sBACN,CAAC,iBAAiB,gBAAgB,MAAM,mBAAmB,CAAC,EAAE,IAC9D,CAAC;AAAA,IACL,eAAe,gBAAgB,cAAc,CAAC;AAAA,IAC9C;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,mBAAmB,cAAkC,aAA6B;AACzF,MAAI;AACF,WAAO,oBAAoB,cAAc,WAAW;AAAA,EACtD,SAAS,OAAO;AACd,QAAI,iBAAiB,4BAA4B;AAC/C,YAAM,IAAI,4BAA4B,MAAM,OAAO;AAAA,IACrD;AACA,UAAM;AAAA,EACR;AACF;AAEA,SAAS,mBAAmB,UAAuD;AACjF,QAAM,MAAM,SAAS;AACrB,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,EAAG,QAAO,CAAC;AACnE,QAAM,UAAkC,CAAC;AACzC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,GAA8B,GAAG;AACzE,QAAI,OAAO,QAAQ,YAAY,OAAO,UAAU,SAAU;AAC1D,QAAI,IAAI,YAAY,MAAM,gBAAiB;AAC3C,YAAQ,GAAG,IAAI;AAAA,EACjB;AACA,SAAO;AACT;AAEA,eAAe,yBACb,UACA,OAOA,kBACA,SAMkB;AAClB,QAAM,QAAQ,aAAa,MAAM,OAAO,0BAA0B;AAClE,QAAM,YAAYK,gBAAe,MAAM,aAAa,gBAAgB;AACpE,QAAM,YAAY,qBAAqB,UAAU,MAAM,IAAI;AAC3D,YAAU,WAAW,UAAU,aAAa,SAAS,WAAW;AAChE,QAAM,OAAO,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,MAAM,IAAI;AAC7E,MAAI,SAAS,UAAa,OAAO,WAAW,IAAI,IAAI,gCAAgC;AAClF,UAAM,IAAI,WAAW,8CAA8C;AAAA,EACrE;AACA,QAAM,WAAW,MAAM;AAAA,IACrB,YACE,MAAM,MAAM,WAAW;AAAA,MACrB,QAAQ,MAAM;AAAA,MACd,SAAS;AAAA,QACP,GAAG,mBAAmB,QAAQ;AAAA,QAC9B,eAAe,UAAU,KAAK;AAAA,QAC9B,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;AAAA,MACrE;AAAA,MACA,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,MACrC,UAAU;AAAA,MACV,QAAQ,YAAY,QAAQ,SAAS;AAAA;AAAA;AAAA;AAAA,MAIrC,SAAS;AAAA,IACX,CAAC;AAAA,EACL;AACA,QAAM,eAAe,MAAM,oBAAoB,YAAY,MAAM,SAAS,KAAK,CAAC;AAChF,MAAI,OAAO,WAAW,YAAY,IAAI,gCAAgC;AACpE,UAAM,IAAI,4BAA4B,0CAA0C;AAAA,EAClF;AACA,gCAA8B,cAAc,SAAS,MAAM;AAC3D,OACG,SAAS,WAAW,OAAO,SAAS,WAAW,QAChD,CAAC,gCAAgC,YAAY,GAC7C;AACA,UAAM,SAAS,8BAA8B,SAAS,QAAQ,EAAE;AAChE,QAAI,QAAQ;AACV,UAAI;AACF,iBAAS,8BAA8B;AAAA,UACrC,SAAS;AAAA,UACT,MAAM,OAAO;AAAA,QACf,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,IAAI,6BAA6B,oCAAoC,SAAS,MAAM,EAAE;AAAA,EAC9F;AACA,SAAO,cAAc,cAAc,SAAS,MAAM;AACpD;AAEA,eAAe,8BACb,UACA,OACA,kBACqD;AACrD,QAAM,QAAQ,aAAa,MAAM,OAAO,0BAA0B;AAClE,QAAM,YAAYA,gBAAe,MAAM,aAAa,gBAAgB;AACpE,QAAM,YAAY,qBAAqB,UAAU,MAAM,IAAI;AAC3D,YAAU,WAAW,UAAU,aAAa,SAAS,WAAW;AAChE,QAAM,WAAW,MAAM;AAAA,IACrB,YACE,MAAM,MAAM,WAAW;AAAA,MACrB,QAAQ,MAAM;AAAA,MACd,SAAS;AAAA,QACP,GAAG,mBAAmB,QAAQ;AAAA,QAC9B,eAAe,UAAU,KAAK;AAAA,QAC9B,QAAQ;AAAA,MACV;AAAA,MACA,UAAU;AAAA,MACV,QAAQ,YAAY,QAAQ,SAAS;AAAA,IACvC,CAAC;AAAA,EACL;AACA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,eAAe,MAAM,oBAAoB,YAAY,MAAM,SAAS,KAAK,CAAC;AAChF,QAAI,OAAO,WAAW,YAAY,IAAI,gCAAgC;AACpE,YAAM,IAAI,4BAA4B,0CAA0C;AAAA,IAClF;AACA,kCAA8B,cAAc,SAAS,MAAM;AAC3D,kBAAc,cAAc,SAAS,MAAM;AAC3C,UAAM,IAAI,4BAA4B,8CAA8C;AAAA,EACtF;AACA,QAAM,iBAAiB,OAAO,SAAS,QAAQ,IAAI,gBAAgB,CAAC;AACpE,QAAM,WAAW,MAAM,YAAY,YAAY,KAAK,OAAO,OAAO;AAClE,MAAI,OAAO,SAAS,cAAc,KAAK,iBAAiB,UAAU;AAChE,UAAM,SAAS,MAAM,OAAO,8BAA8B,EAAE,MAAM,MAAM,MAAS;AACjF,UAAM,IAAI,WAAW,8BAA8B;AAAA,EACrD;AACA,QAAM,OAAO,MAAM;AAAA,IACjB,YAAY,MAAM,yBAAyB,UAAU,QAAQ;AAAA,EAC/D;AACA,SAAO,qBAAqB,MAAM,SAAS,SAAS,KAAK;AAC3D;AAEA,eAAe,oBAAuB,gBAA8C;AAClF,MAAI;AACF,WAAO,MAAM,eAAe;AAAA,EAC9B,SAAS,OAAO;AACd,QACE,iBAAiB,+BACjB,iBAAiB,gCACjB,iBAAiB,YACjB;AACA,YAAM;AAAA,IACR;AAIA,UAAM,IAAI,6BAA6B,wCAAwC;AAAA,MAC7E,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEA,eAAe,yBAAyB,UAAoB,UAAuC;AACjG,MAAI,CAAC,SAAS,KAAM,OAAM,IAAI,4BAA4B,mCAAmC;AAC7F,QAAM,SAAS,SAAS,KAAK,UAAU;AACvC,QAAM,SAAuB,CAAC;AAC9B,MAAI,OAAO;AACX,MAAI;AACF,eAAS;AACP,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,KAAM;AACV,cAAQ,MAAM;AACd,UAAI,OAAO,UAAU;AACnB,cAAM,OAAO,OAAO,8BAA8B,EAAE,MAAM,MAAM,MAAS;AACzE,cAAM,IAAI,WAAW,8BAA8B;AAAA,MACrD;AACA,aAAO,KAAK,KAAK;AAAA,IACnB;AAAA,EACF,UAAE;AACA,WAAO,YAAY;AAAA,EACrB;AACA,QAAM,OAAO,IAAI,WAAW,IAAI;AAChC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,SAAK,IAAI,OAAO,MAAM;AACtB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAEA,SAAS,qBACP,MACA,SACA,OAC4C;AAC5C,SAAO,MAAM,YAAY,YACrB,oBAAoB,MAAM,SAAS,MAAM,qBAAqB,IAC9D,qBAAqB,MAAM,SAAS,MAAM,qBAAqB;AACrE;AAEA,SAAS,oBACP,MACA,SACA,UACqB;AACrB,MAAI,KAAK,aAAa,KAAK,KAAK,aAAa,KAAK,OAAO,MAAM;AAC7D,UAAM,IAAI,WAAW,sCAAsC;AAAA,EAC7D;AACA,QAAM,MAAM,CAAC,SAAgC,QAAQ,IAAI,KAAK,YAAY,CAAC,KAAK;AAChF,QAAM,YAAY,IAAI,cAAc,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,YAAY;AAC5E,MAAI,cAAc,gBAAgB,cAAc,aAAa;AAC3D,UAAM,IAAI,4BAA4B,qCAAqC;AAAA,EAC7E;AACA,QAAM,iBAAiB,IAAI,0BAA0B;AACrD,MACE,CAAC,kBACD,eAAe,SAAS,KAAK,QAC7B,CAAC,oBAAoB,KAAK,cAAc,GACxC;AACA,UAAM,IAAI,4BAA4B,mCAAmC;AAAA,EAC3E;AACA,MAAI;AACJ,MAAI;AACF,eAAW;AAAA,MACT,KAAK,MAAM,OAAO,KAAK,gBAAgB,WAAW,EAAE,SAAS,MAAM,CAAC;AAAA,IACtE;AAAA,EACF,QAAQ;AACN,UAAM,IAAI,4BAA4B,mCAAmC;AAAA,EAC3E;AACA,MACE,SAAS,qBAAqB,SAAS,oBACvC,SAAS,yBAAyB,SAAS,wBAC3C,SAAS,aAAa,SAAS,YAC/B,SAAS,cAAc,WACvB;AACA,UAAM,IAAI,4BAA4B,mDAAmD;AAAA,EAC3F;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,IAAI,+BAA+B,MAAM,uBACzC,EAAE,mBAAmB,KAAc,IACnC,CAAC;AAAA,EACP;AACF;AAEA,SAAS,qBACP,MACA,SACA,UACsB;AACtB,MAAI,KAAK,aAAa,KAAK,KAAK,aAAa,+BAA+B;AAC1E,UAAM,IAAI,WAAW,uCAAuC;AAAA,EAC9D;AACA,QAAM,MAAM,CAAC,SAAgC,QAAQ,IAAI,KAAK,YAAY,CAAC,KAAK;AAChF,QAAM,YAAY,IAAI,cAAc,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,YAAY;AAC5E,MAAI,cAAc,gBAAgB,cAAc,aAAa;AAC3D,UAAM,IAAI,4BAA4B,sCAAsC;AAAA,EAC9E;AACA,QAAM,iBAAiB,IAAI,2BAA2B;AACtD,MACE,CAAC,kBACD,eAAe,SAAS,KAAK,QAC7B,CAAC,oBAAoB,KAAK,cAAc,GACxC;AACA,UAAM,IAAI,4BAA4B,oCAAoC;AAAA,EAC5E;AACA,SAAO,qCAAqC,EAAE,MAAM,WAAW,eAAe,GAAG,QAAQ;AAC3F;AAEO,SAAS,qCACdG,QACA,UACsB;AACtB,QAAM,WAAW,yCAAyCA,OAAM,cAAc;AAC9E,MAAI,SAAS,sBAAsB,SAAS,mBAAmB;AAC7D,UAAM,IAAI,mCAAmC,wBAAwB;AAAA,EACvE;AACA,MAAI,SAAS,aAAa,SAAS,UAAU;AAC3C,UAAM,IAAI,mCAAmC,uBAAuB;AAAA,EACtE;AACA,MAAI,SAAS,yBAAyB,SAAS,sBAAsB;AACnE,UAAM,IAAI,mCAAmC,2BAA2B;AAAA,EAC1E;AACA,MAAI,SAAS,cAAcA,OAAM,WAAW;AAC1C,UAAM,IAAI,mCAAmC,sBAAsB;AAAA,EACrE;AACA,QAAM,SAASC,YAAW,QAAQ,EAAE,OAAOD,OAAM,IAAI,EAAE,OAAO,KAAK;AACnE,MAAI,SAAS,WAAW,QAAQ;AAC9B,UAAM,IAAI,mCAAmC,uBAAuB;AAAA,EACtE;AACA,SAAO,EAAE,GAAGA,QAAO,SAAS;AAC9B;AAEO,SAAS,yCACd,OAC8B;AAC9B,MAAI,CAAC,SAAS,MAAM,SAAS,KAAK,QAAQ,CAAC,oBAAoB,KAAK,KAAK,GAAG;AAC1E,UAAM,IAAI,4BAA4B,oCAAoC;AAAA,EAC5E;AACA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,MAAM,CAAC;AAAA,EACvE,QAAQ;AACN,UAAM,IAAI,4BAA4B,oCAAoC;AAAA,EAC5E;AACA,MAAI,CAAC,SAAS,OAAO,GAAG;AACtB,UAAM,IAAI,4BAA4B,oCAAoC;AAAA,EAC5E;AACA,QAAM,UAAU,oBAAI,IAAI;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,IAAI,GAAG,CAAC,GAAG;AACzD,UAAM,IAAI,4BAA4B,oCAAoC;AAAA,EAC5E;AACA,aAAW,OAAO;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAAY;AACV,UAAM,OAAO,QAAQ,GAAG;AACxB,UAAM,WAAW,QAAQ,aAAa,MAAM,QAAQ,eAAe,MAAM;AACzE,QAAI,OAAO,SAAS,YAAY,KAAK,SAAS,KAAK,OAAO,WAAW,IAAI,IAAI,UAAU;AACrF,YAAM,IAAI,4BAA4B,oCAAoC;AAAA,IAC5E;AAAA,EACF;AACA,MAAI,OAAO,QAAQ,WAAW,YAAY,CAAC,eAAe,KAAK,QAAQ,MAAM,GAAG;AAC9E,UAAM,IAAI,mCAAmC,uBAAuB;AAAA,EACtE;AACA,MACE,CAAC,OAAO,cAAc,QAAQ,QAAQ,KACtC,OAAO,QAAQ,QAAQ,IAAI,KAC3B,CAAC,8BAA8B,QAAQ,OAAO,QAAQ,MAAM,GAC5D;AACA,UAAM,IAAI,4BAA4B,oCAAoC;AAAA,EAC5E;AACA,MAAI,QAAQ,cAAc,gBAAgB,QAAQ,cAAc,aAAa;AAC3E,UAAM,IAAI,4BAA4B,oCAAoC;AAAA,EAC5E;AACA,MAAI,CAAC,aAAa,QAAQ,iBAAiB,GAAG;AAC5C,UAAM,IAAI,4BAA4B,oCAAoC;AAAA,EAC5E;AACA,QAAM,uBAAuB,QAAQ;AACrC,MACE,OAAO,yBAAyB,YAChC,CAAC,iCAAiC,KAAK,oBAAoB,GAC3D;AACA,UAAM,IAAI,4BAA4B,oCAAoC;AAAA,EAC5E;AACA,QAAM,aAAa,QAAQ;AAC3B,MAAI,OAAO,eAAe,YAAY,CAAC,OAAO,SAAS,IAAI,KAAK,UAAU,EAAE,QAAQ,CAAC,GAAG;AACtF,UAAM,IAAI,4BAA4B,oCAAoC;AAAA,EAC5E;AACA,SAAO;AACT;AAEA,SAAS,8BAA8B,OAAgB,QAA0B;AAC/E,SACE,OAAO,cAAc,KAAK,KAC1B,OAAO,cAAc,MAAM,KAC3B,OAAO,KAAK,IAAI,KAChB,OAAO,MAAM,IAAI,KACjB,OAAO,KAAK,KAAK,SACjB,OAAO,MAAM,KAAK,SAClB,OAAO,KAAK,IAAI,OAAO,MAAM,KAAK;AAEtC;AAEA,SAAS,aAAa,OAAiC;AACrD,SACE,OAAO,UAAU,YACjB,8EAA8E,KAAK,KAAK;AAE5F;AAEA,SAAS,qBAAqB,UAA+B,aAA0B;AACrF,QAAM,YAAY,YAAY,QAAQ,GAAG;AACzC,QAAM,OAAO,cAAc,KAAK,cAAc,YAAY,MAAM,GAAG,SAAS;AAC5E,QAAM,eAAe,cAAc,KAAK,KAAK,YAAY,MAAM,YAAY,CAAC;AAC5E,QAAM,MAAM,IAAI;AAAA,IACd,eAAe,EAAE,GAAG,UAAU,MAAM,mBAAmB,SAAS,MAAM,IAAI,EAAE,CAAC;AAAA,EAC/E;AACA,aAAW,CAAC,MAAM,KAAK,KAAK,IAAI,gBAAgB,YAAY,GAAG;AAC7D,QAAI,aAAa,OAAO,MAAM,KAAK;AAAA,EACrC;AACA,SAAO;AACT;AAEA,SAAS,yBAAyB,OAAoC;AACpE,QAAM,UAAU,oBAAI,IAAoB;AACxC,aAAW,QAAQ,MAAM,MAAM,QAAQ,GAAG;AACxC,QAAI,WAAW,KAAK,IAAI,GAAG;AACzB,cAAQ,MAAM;AACd;AAAA,IACF;AACA,UAAM,YAAY,KAAK,QAAQ,GAAG;AAClC,QAAI,aAAa,EAAG;AACpB,UAAM,OAAO,KAAK,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,YAAY;AACzD,UAAM,cAAc,KAAK,MAAM,YAAY,CAAC,EAAE,KAAK;AACnD,QAAI,QAAQ,YAAa,SAAQ,IAAI,MAAM,WAAW;AAAA,EACxD;AACA,SAAO;AACT;AAEA,SAAS,gCAAgC,MAAuB;AAC9D,MAAI;AACF,UAAM,QAAiB,KAAK,MAAM,IAAI;AACtC,WAAO,SAAS,KAAK,KAAK,MAAM,oBAAoB;AAAA,EACtD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,8BAA8B,MAAcR,SAAsB;AAIzE,MAAI,CAAC,KAAK,KAAK,GAAG,EAAE,SAASA,OAAM,KAAK,CAAC,gCAAgC,IAAI,GAAG;AAC9E,UAAM,IAAI,6BAA6B,oCAAoCA,OAAM,EAAE;AAAA,EACrF;AACF;AAEA,SAAS,cAAc,MAAcA,SAAyB;AAC5D,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,MAAM,IAAI;AAAA,EACzB,QAAQ;AACN,UAAM,IAAI,4BAA4B,6CAA6C;AAAA,EACrF;AACA,MAAI,CAAC,SAAS,KAAK,KAAK,MAAM,oBAAoB,kCAAkC;AAClF,UAAM,IAAI,4BAA4B,gDAAgD;AAAA,EACxF;AACA,MAAI,MAAM,OAAO,QAAQA,WAAU,OAAOA,UAAS,OAAO,UAAU,MAAO,QAAO,MAAM;AACxF,MAAI,MAAM,OAAO,SAASA,WAAU,OAAOA,WAAU,KAAK;AACxD,UAAM,SAAS,iBAAiB,UAAU,MAAM,KAAK;AACrD,QAAI,OAAO,SAAS;AAClB,YAAM,IAAI;AAAA,QACRA;AAAA,QACA,OAAO;AAAA;AAAA;AAAA,QAGP,OAAO,KAAK,SAAS,mBAAmB,OAAO,KAAK,SAAS,yBACzD,iCAAiC,MAAM,UAAU,IACjD;AAAA,MACN;AAAA,IACF;AAAA,EACF;AACA,QAAM,IAAI,4BAA4B,iDAAiD;AACzF;AAEA,SAAS,mBAAmB,MAAc,MAAsB;AAC9D,MAAI,CAAC,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,GAAG,GAAG;AACtE,UAAM,IAAI,4BAA4B,4CAA4C;AAAA,EACpF;AACA,SAAO,oBAAoB,IAAI,GAAG,IAAI;AACxC;AAEA,SAAS,eAAe,OAAkD;AACxE,MAAI,CAAC,SAAS,KAAK,EAAG,OAAM,IAAI,4BAA4B,oCAAoC;AAChG,SAAO;AAAA,IACL,kBAAkB,YAAY,MAAM,kBAAkB,oBAAoB;AAAA,IAC1E,sBAAsB,kBAAkB,MAAM,oBAAoB;AAAA,EACpE;AACF;AAKA,SAAS,gBACP,OACA,WACoC;AACpC,MAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,IAAQ,QAAO,CAAC;AAC5D,QAAM,UAAgC,CAAC;AACvC,aAAW,SAAS,OAAO;AACzB,UAAM,SAAS,cAAc,UAAU,KAAK;AAC5C,QACE,CAAC,OAAO,WACR,OAAO,KAAK,qBAAqB,UAAU,oBAC3C,OAAO,KAAK,yBAAyB,UAAU;AAE/C,aAAO,CAAC;AACV,YAAQ,KAAK,OAAO,IAAI;AAAA,EAC1B;AACA,SAAO,EAAE,QAAQ;AACnB;AAIA,SAAS,eAAe,OAAqC;AAC3D,MAAI,OAAO,UAAU,SAAU,QAAO,CAAC;AACvC,QAAM,SAAS,MAAM,QAAQ,SAAS,GAAG,EAAE,KAAK;AAChD,SAAO,OAAO,SAAS,KAAK,OAAO,UAAU,OAAQ,EAAE,OAAO,IAAI,CAAC;AACrE;AAIA,SAAS,gBAAgB,OAAsD;AAC7E,SAAO,UAAU,YAAY,UAAU,cAAc,EAAE,SAAS,MAAM,IAAI,CAAC;AAC7E;AAEA,SAAS,uBAAuB,OAAmD;AACjF,MAAI,CAAC,SAAS,KAAK,GAAG;AACpB,UAAM,IAAI,4BAA4B,qCAAqC;AAAA,EAC7E;AACA,SAAO;AAAA,IACL,mBAAmB,YAAY,MAAM,mBAAmB,qBAAqB;AAAA,IAC7E,sBAAsB,kBAAkB,MAAM,oBAAoB;AAAA,EACpE;AACF;AAEA,SAAS,0BAA0B,OAA6D;AAC9F,MAAI,MAAM,SAAS,WAAW;AAC5B,QACE,MAAM,WAAW,UACjB,MAAM,WAAW,cACjB,MAAM,WAAW,cACjB;AACA,YAAM,IAAI,4BAA4B,mCAAmC;AAAA,IAC3E;AACA,QAAI,MAAM,uBAAuB,UAAa,CAAC,eAAe,KAAK,MAAM,kBAAkB;AACzF,YAAM,IAAI,MAAM,wCAAwC;AAC1D,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ,MAAM,UAAU;AAAA,MACxB,GAAI,MAAM,qBAAqB,EAAE,oBAAoB,MAAM,mBAAmB,IAAI,CAAC;AAAA,IACrF;AAAA,EACF;AACA,MAAI,MAAM,SAAS,qBAAqB;AACtC,QAAI,MAAM,eAAe,iBAAiB,MAAM,eAAe,UAAU;AACvE,YAAM,IAAI,4BAA4B,0CAA0C;AAAA,IAClF;AACA,UAAM,WAAW,MAAM,UAAU,WAC7B,eAAe,MAAM,UAAU,UAAU,oCAAoC,IAC7E;AACJ,WAAO;AAAA,MACL,MAAM;AAAA,MACN,YAAY,MAAM;AAAA,MAClB,aAAa,gBAAgB,MAAM,aAAa,+BAA+B;AAAA,MAC/E,WAAW;AAAA,QACT,QAAQ;AAAA,UACN,MAAM,UAAU;AAAA,UAChB;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,QACA,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MACjC;AAAA,MACA,GAAI,MAAM,mBAAmB,SACzB,CAAC,IACD;AAAA,QACE,gBAAgB,8BAA8B,MAAM,cAAc;AAAA,MACpE;AAAA,MACJ,GAAI,MAAM,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,IAClE;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,UAAU,YAAY,MAAM,UAAU,qBAAqB;AAAA,IAC3D,sBAAsB,wBAAwB,MAAM,oBAAoB;AAAA,IACxE,aAAa,mBAAmB,MAAM,aAAa,GAAG,KAAK,uBAAuB;AAAA,IAClF,gBAAgB,mBAAmB,MAAM,gBAAgB,GAAG,KAAK,0BAA0B;AAAA,EAC7F;AACF;AAEA,SAAS,8BAA8B,OAAuB;AAC5D,QAAM,UAAU,oBAAoB,OAAO,0BAA0B;AACrE,MAAI,UAAU,OAAQ;AACpB,UAAM,IAAI,4BAA4B,qCAAqC;AAAA,EAC7E;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAAe,OAAuB;AAC5D,MAAI,OAAO,WAAW,KAAK,IAAI,OAAQ;AACrC,UAAM,IAAI,4BAA4B,GAAG,KAAK,aAAa;AAAA,EAC7D;AACA,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,UAAM,IAAI,4BAA4B,GAAG,KAAK,aAAa;AAAA,EAC7D;AACA,MACG,OAAO,aAAa,YAAY,OAAO,aAAa,WACrD,OAAO,YACP,OAAO,YACP,OAAO,MACP;AACA,UAAM,IAAI,4BAA4B,GAAG,KAAK,aAAa;AAAA,EAC7D;AACA,SAAO,OAAO,SAAS,EAAE,QAAQ,QAAQ,EAAE;AAC7C;AAEA,SAAS,6BACP,OAC8B;AAC9B,QAAM,OAAO,MAAM;AACnB,MAAI,SAAS,YAAY,SAAS,WAAW,SAAS,aAAa,SAAS,UAAU;AACpF,UAAM,IAAI,4BAA4B,uCAAuC;AAAA,EAC/E;AACA,MAAI,CAAC,6BAA6B,KAAK,MAAM,eAAe,GAAG;AAC7D,UAAM,IAAI,4BAA4B,4CAA4C;AAAA,EACpF;AACA,QAAM,WAAW,MAAM,aAAa,SAAY,SAAY,gBAAgB,MAAM,QAAQ;AAC1F,MAAI,SAAS,WAAW,aAAa,QAAW;AAC9C,UAAM,IAAI,4BAA4B,kDAAkD;AAAA,EAC1F;AACA,QAAM,gBACJ,MAAM,kBAAkB,SAAY,SAAY,uBAAuB,MAAM,aAAa;AAC5F,MAAI,SAAS,aAAa,kBAAkB,QAAW;AACrD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,aAAa,kBAAkB,QAAW;AACrD,UAAM,IAAI,4BAA4B,qDAAqD;AAAA,EAC7F;AACA,SAAO;AAAA,IACL,SAAS,YAAY,MAAM,SAAS,kBAAkB;AAAA,IACtD,cAAc,oBAAoB,MAAM,cAAc,uBAAuB;AAAA,IAC7E,iBAAiB,MAAM;AAAA,IACvB;AAAA,IACA,aAAa,wBAAwB,MAAM,MAAM,WAAW;AAAA,IAC5D,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS;AAAA,IAC7C,GAAI,kBAAkB,SAAY,CAAC,IAAI,EAAE,cAAc;AAAA,EACzD;AACF;AAEA,SAAS,uBACP,OAC4D;AAC5D,MAAI,MAAM,eAAe,iBAAiB,MAAM,eAAe,UAAU;AACvE,UAAM,IAAI,4BAA4B,+CAA+C;AAAA,EACvF;AACA,MACE,MAAM,gBAAgB,gBACtB,MAAM,gBAAgB,iBACtB,MAAM,gBAAgB,OACtB;AACA,UAAM,IAAI,4BAA4B,+CAA+C;AAAA,EACvF;AACA,SAAO;AAAA,IACL,YAAY,MAAM;AAAA,IAClB,SAAS,gBAAgB,MAAM,SAAS,mCAAmC;AAAA,IAC3E,aAAa,MAAM;AAAA,IACnB,QACE,MAAM,WAAW,OACb,OACA,mBAAmB,MAAM,QAAQ,GAAG,KAAK,8BAA8B;AAAA,EAC/E;AACF;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,MAAI,OAAO,WAAW,KAAK,IAAI,OAAQ;AACrC,UAAM,IAAI,4BAA4B,sCAAsC;AAAA,EAC9E;AACA,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,KAAK;AAAA,EACrB,QAAQ;AACN,UAAM,IAAI,4BAA4B,oCAAoC;AAAA,EAC5E;AACA,MACE,CAAC,CAAC,SAAS,UAAU,SAAS,EAAE,SAAS,IAAI,QAAQ,KACrD,CAAC,IAAI,YACJ,CAAC,IAAI,QAAQ,IAAI,aAAa,WAAW,IAAI,aAAa,YAC1D,IAAI,aAAa,MAAM,IAAI,aAAa,OACzC,IAAI,UACJ,IAAI,MACJ;AACA,UAAM,IAAI,4BAA4B,oCAAoC;AAAA,EAC5E;AACA,SAAO,IAAI,SAAS;AACtB;AAEA,SAAS,yBACP,WACA,OACA;AACA,SAAO;AAAA,IACL,sBAAsB,UAAU;AAAA,IAChC,iBAAiB,oBAAoB,MAAM,iBAAiB,kBAAkB;AAAA,IAC9E,cAAc,aAAa,MAAM,cAAc,eAAe;AAAA,IAC9D,WAAW,aAAa,MAAM,WAAW,YAAY;AAAA,EACvD;AACF;AAWA,SAAS,yBACP,OACA,WACA,YACqC;AACrC,MACE,CAAC,SAAS,KAAK,KACf,MAAM,qBAAqB,UAAU,oBACpC,eAAe,aAAa,MAAM,yBAAyB,UAAU,wBACtE,CAAC,qCAAqC;AAAA,IACpC,MAAM;AAAA,EACR,KACA,EAAE,MAAM,gBAAgB,QAAQ,OAAO,MAAM,gBAAgB,aAC7D,CAAC,MAAM,QAAQ,MAAM,mBAAmB,KACxC,MAAM,oBAAoB,SAAS,MACnC,CAAC,MAAM,oBAAoB;AAAA,IACzB,CAAC,SAAS,OAAO,SAAS,YAAY,sCAAsC,KAAK,IAAI;AAAA,EACvF,GACA;AACA,UAAM,IAAI,4BAA4B,kDAAkD;AAAA,EAC1F;AACA,SAAO;AAAA,IACL,kBAAkB,UAAU;AAAA,IAC5B,sBACE,eAAe,YACX,UAAU,uBACV,kBAAkB,MAAM,oBAAoB;AAAA,IAClD,aAAa,YAAY,MAAM,aAAa,0BAA0B;AAAA,IACtE,gBAAgBO,QAAO,MAAM,gBAAgB,8BAA8B;AAAA,IAC3E,OAAO,MAAM;AAAA,IACb,aACE,MAAM,gBAAgB,OAAO,OAAO,gBAAgB,MAAM,aAAa,cAAc;AAAA,IACvF,qBAAqB,MAAM;AAAA,IAC3B,WAAW,UAAU,MAAM,WAAW,qBAAqB;AAAA,IAC3D,WAAW,UAAU,MAAM,WAAW,qBAAqB;AAAA,EAC7D;AACF;AAEA,SAAS,2BACP,OACA,WACuC;AACvC,MACE,CAAC,SAAS,KAAK,KACf,MAAM,qBAAqB,UAAU,oBACrC,MAAM,yBAAyB,UAAU,wBACzC,OAAO,MAAM,sBAAsB,aACnC,OAAO,MAAM,2BAA2B,aACxC,EAAE,MAAM,iBAAiB,QAAQ,OAAO,MAAM,iBAAiB,cAC/D,EACE,MAAM,YAAY,QAClB,8BAA8B,SAAS,MAAM,OAA6C,IAE5F;AACA,UAAM,IAAI,4BAA4B,oDAAoD;AAAA,EAC5F;AACA,MAAI,WAA8D;AAClE,MAAI,MAAM,aAAa,MAAM;AAC3B,QAAI,CAAC,SAAS,MAAM,QAAQ,GAAG;AAC7B,YAAM,IAAI,4BAA4B,kDAAkD;AAAA,IAC1F;AACA,eAAW;AAAA,MACT,QAAQA,QAAO,MAAM,SAAS,QAAQ,8BAA8B;AAAA,MACpE,SAAS,uBAAuB,MAAM,SAAS,SAAS,sBAAsB;AAAA,MAC9E,OAAO,uBAAuB,MAAM,SAAS,OAAO,oBAAoB;AAAA,MACxE,UAAU,2BAA2B,MAAM,SAAS,QAAQ;AAAA,IAC9D;AAAA,EACF;AACA,MAAI,UAA4D;AAChE,MAAI,MAAM,YAAY,MAAM;AAC1B,UAAM,MAAM,MAAM;AAClB,QACE,CAAC,SAAS,GAAG,KACb,CAAC,CAAC,UAAU,WAAW,UAAU,OAAO,EAAE,SAAS,IAAI,MAAgB,KACvE,OAAO,IAAI,UAAU,YACrB,OAAO,IAAI,2BAA2B,aACtC,OAAO,IAAI,qBAAqB,aAChC,EAAE,IAAI,2BAA2B,QAAQ,OAAO,IAAI,2BAA2B,aAC/E,EAAE,IAAI,aAAa,QAAQ,SAAS,IAAI,QAAQ,IAChD;AACA,YAAM,IAAI,4BAA4B,iDAAiD;AAAA,IACzF;AACA,cAAU;AAAA,MACR,aAAa,YAAY,IAAI,aAAa,4BAA4B;AAAA,MACtE,QAAQ,IAAI;AAAA,MACZ,OAAO,gBAAgB,IAAI,OAAO,+BAA+B;AAAA,MACjE,wBAAwB,IAAI;AAAA,MAC5B,kBAAkB,IAAI;AAAA,MACtB,wBAAwB,IAAI,2BAA2B;AAAA,MACvD,UAAU,SAAS,IAAI,QAAQ,IAC3B;AAAA,QACE,aAAa,YAAY,IAAI,SAAS,aAAa,0BAA0B;AAAA,QAC7E,gBAAgBA,QAAO,IAAI,SAAS,gBAAgB,8BAA8B;AAAA,MACpF,IACA;AAAA,IACN;AAAA,EACF;AACA,SAAO;AAAA,IACL,kBAAkB,UAAU;AAAA,IAC5B,sBAAsB,UAAU;AAAA,IAChC,mBAAmB,MAAM;AAAA,IACzB,SAAS,MAAM;AAAA,IACf;AAAA,IACA,wBAAwB,MAAM;AAAA,IAC9B,cAAc,MAAM;AAAA,IACpB;AAAA,IACA,gBACE,MAAM,mBAAmB,QAAQ,MAAM,mBAAmB,SACtD,OACA,yBAAyB,MAAM,gBAAgB,WAAW,UAAU;AAAA,EAC5E;AACF;AAEA,SAAS,yBAAyB,OAAqD;AACrF,MAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,MAAM,QAAQ,GAAG;AACjD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,WAAW,MAAM;AACvB,MAAI,CAAC,MAAM,QAAQ,SAAS,IAAI,GAAG;AACjC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,mBAAmB,YAAY,MAAM,kBAAkB,oBAAoB;AACjF,QAAM,uBAAuB,kBAAkB,MAAM,oBAAoB;AACzE,QAAM,oBAAoB;AAAA,IACxB,SAAS;AAAA,IACT;AAAA,EACF;AACA,QAAM,+BAA+B,kBAAkB,SAAS,oBAAoB;AACpF,MACE,sBAAsB,oBACtB,iCAAiC,sBACjC;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MACE,MAAM,WAAW,mCACjB,SAAS,kBAAkB,KAC1B,SAAS,WAAW,cAAc,SAAS,WAAW,YACtD,SAAS,aAAa,WACrB,SAAS,aAAa,WACtB,SAAS,aAAa,aACvB,SAAS,iBAAiB,SAAS,SAAS,iBAAiB,SAC9D;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MACE,SAAS,kBAAkB,oBAC3B,SAAS,kBAAkB,4BAC3B,SAAS,kBAAkB,kBAC3B;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,OAAO,SAAS,KAAK,IAAI,CAAC,QAAQ;AACtC,QAAI,CAAC,SAAS,GAAG,KAAK,OAAO,IAAI,aAAa,WAAW;AACvD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,KAAK,WAAW,IAAI,GAAG,GAAG,UAAU,IAAI,SAAS;AAAA,EAC5D,CAAC;AACD,MAAI,KAAK,SAAS,OAAS,KAAK,OAAO,CAAC,QAAQ,IAAI,QAAQ,EAAE,SAAS,GAAG;AACxE,UAAM,IAAI,4BAA4B,wDAAwD;AAAA,EAChG;AACA,SAAO;AAAA,IACL,aAAa,YAAY,MAAM,aAAa,4BAA4B;AAAA,IACxE;AAAA,IACA;AAAA,IACA,WAAW,sBAAsB,MAAM,SAAS;AAAA,IAChD,QAAQ;AAAA,IACR,gBAAgBA,QAAO,MAAM,gBAAgB,+BAA+B;AAAA,IAC5E,eAAeA,QAAO,MAAM,eAAe,8BAA8B;AAAA,IACzE,WAAW,oBAAoB,MAAM,WAAW,6BAA6B;AAAA,IAC7E,WAAW,uBAAuB,MAAM,WAAW,0BAA0B;AAAA,IAC7E,cAAc,uBAAuB,MAAM,cAAc,4BAA4B;AAAA,IACrF,UAAU;AAAA,MACR,eAAe;AAAA,MACf,kBAAkB;AAAA,MAClB,sBAAsB;AAAA,MACtB,YAAY,UAAU,SAAS,YAAY,4BAA4B;AAAA,MACvE,QAAQ,SAAS;AAAA,MACjB,eACE,SAAS,kBAAkB,OACvB,OACA,gBAAgB,SAAS,eAAe,wBAAwB;AAAA,MACtE,UAAU,gBAAgB,SAAS,UAAU,mBAAmB;AAAA,MAChE,qBAAqB;AAAA,QACnB,SAAS;AAAA,QACT;AAAA,MACF;AAAA,MACA,eAAe,SAAS;AAAA,MACxB,UAAU,SAAS;AAAA,MACnB,cAAc,SAAS;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,OAAwB;AACrD,MACE,OAAO,UAAU,YACjB,OAAO,WAAW,KAAK,IAAI,QAC3B,CAAC,kJAAkJ;AAAA,IACjJ;AAAA,EACF,GACA;AACA,UAAM,IAAI,WAAW,qCAAqC;AAAA,EAC5D;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,OAAyC;AACxE,MAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,MAAM,eAAe,GAAG;AACxD,UAAM,IAAI,WAAW,uCAAuC;AAAA,EAC9D;AACA,QAAM,MAAM,WAAW,MAAM,GAAG;AAChC,QAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,MACG,OAAO,aAAa,YAAY,OAAO,aAAa,WACrD,OAAO,YACP,OAAO,YACP,OAAO,MACP;AACA,UAAM,IAAI,WAAW,qCAAqC;AAAA,EAC5D;AACA,QAAM,UAAkC,CAAC;AACzC,aAAW,CAAC,MAAM,WAAW,KAAK,OAAO,QAAQ,MAAM,eAAe,GAAG;AACvE,QACG,SAAS,kBAAkB,SAAS,oBACrC,OAAO,gBAAgB,YACvB,UAAU,KAAK,WAAW,GAC1B;AACA,YAAM,IAAI,WAAW,wCAAwC;AAAA,IAC/D;AACA,YAAQ,IAAI,IAAI;AAAA,EAClB;AACA,MAAI,OAAO,KAAK,OAAO,EAAE,SAAS,KAAK,OAAO,KAAK,OAAO,EAAE,SAAS,GAAG;AACtE,UAAM,IAAI,WAAW,8CAA8C;AAAA,EACrE;AACA,MAAI,QAAQ,cAAc,MAAM,qCAAqC;AACnE,UAAM,IAAI,WAAW,8CAA8C;AAAA,EACrE;AACA,SAAO;AAAA,IACL,KAAK,OAAO,SAAS;AAAA,IACrB,iBAAiB;AAAA,IACjB,WAAW,UAAU,MAAM,WAAW,6BAA6B;AAAA,EACrE;AACF;AAEA,SAAS,0BAA0B,OAA2C;AAC5E,MAAI,CAAC,SAAS,KAAK,GAAG;AACpB,UAAM,IAAI,WAAW,yCAAyC;AAAA,EAChE;AACA,QAAM,MAAM,WAAW,MAAM,GAAG;AAChC,QAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,MACG,OAAO,aAAa,YAAY,OAAO,aAAa,WACrD,OAAO,YACP,OAAO,YACP,OAAO,MACP;AACA,UAAM,IAAI,WAAW,uCAAuC;AAAA,EAC9D;AACA,SAAO;AAAA,IACL,KAAK,OAAO,SAAS;AAAA,IACrB,WAAW,UAAU,MAAM,WAAW,+BAA+B;AAAA,EACvE;AACF;AAEA,SAAS,2BAA2B,OAIlC;AACA,MAAI,MAAM,WAAW,iCAAiC;AACpD,UAAM,IAAI,WAAW,6CAA6C;AAAA,EACpE;AACA,QAAM,UAAU,OAAO,KAAK,WAAW,MAAM,SAAS,IAAI,wBAAwB,CAAC;AACnF,QAAM,MAAM,OAAO,KAAK,aAAa,MAAM,KAAK,GAAG,KAAK,MAAM,+BAA+B,CAAC;AAC9F,MAAI;AACF,WAAO;AAAA,MACL,MAAM;AAAA,QACJ,WAAW,sBAAsB,MAAM,SAAS;AAAA,QAChD,QAAQ;AAAA,QACR,gBAAgBA,QAAO,MAAM,gBAAgB,+BAA+B;AAAA,QAC5E,eAAeA,QAAO,MAAM,eAAe,8BAA8B;AAAA,QACzE,gBAAgBA,QAAO,MAAM,gBAAgB,+BAA+B;AAAA,QAC5E,WAAW,oBAAoB,MAAM,WAAW,6BAA6B;AAAA,QAC7E,eAAe,QAAQ,SAAS,QAAQ;AAAA,QACxC,WAAW,IAAI,SAAS,QAAQ;AAAA,QAChC,iBAAiB,+BAA+B,MAAM,MAAM,eAAe;AAAA,QAC3E,UAAU,0BAA0B,MAAM,QAAQ;AAAA,MACpD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,KAAK,CAAC;AACd,QAAI,KAAK,CAAC;AACV,UAAM;AAAA,EACR;AACF;AAEA,SAAS,WAAW,OAAmB,QAAgB,OAA2B;AAChF,SAAO,aAAa,OAAO,QAAQ,QAAQ,KAAK;AAClD;AAEA,SAAS,aACP,OACA,SACA,SACA,OACY;AACZ,MAAI,EAAE,iBAAiB,eAAe,MAAM,aAAa,WAAW,MAAM,aAAa,SAAS;AAC9F,UAAM,IAAI,WAAW,GAAG,KAAK,aAAa;AAAA,EAC5C;AACA,SAAO;AACT;AAEA,SAASA,QAAO,OAAgB,OAAuB;AACrD,MAAI,OAAO,UAAU,YAAY,CAAC,eAAe,KAAK,KAAK,GAAG;AAC5D,UAAM,IAAI,4BAA4B,GAAG,KAAK,aAAa;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,SAAS,oCAAoC,SAA+C;AAC1F,QAAM,kBACJ,OAAO,QAAQ,0BAA0B,cACzC,OAAO,QAAQ,cAAc,eAC3B,OAAO,QAAQ,SAAS,cAAc,OAAO,QAAQ,gBAAgB,eACrE,OAAO,QAAQ,eAAe;AAClC,MACG,OAAO,QAAQ,SAAS,cAAc,OAAO,QAAQ,gBAAgB,cACtE,CAAC,iBACD;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,+BAA+B,SAA+C;AACrF,QAAM,UAAU,OAAO,QAAQ,SAAS,cAAc,OAAO,QAAQ,gBAAgB;AACrF,QAAM,kBACJ,OAAO,QAAQ,0BAA0B,cACzC,OAAO,QAAQ,cAAc,cAC5B,WAAW,OAAO,QAAQ,eAAe;AAC5C,MACE,OAAO,QAAQ,kBAAkB,cACjC,OAAO,QAAQ,uBAAuB,eACrC,CAAC,WAAW,CAAC,kBACd;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,yBAAyB,OAAyB;AACzD,SACE,iBAAiB,SACjB,kGAAkG;AAAA,IAChG,MAAM;AAAA,EACR;AAEJ;AAEA,eAAe,iBACb,SACA,OAKA,YAAY,KACG;AACf,MAAI,QAAQ,uBAAuB;AACjC,UAAM,QAAQ,sBAAsB,KAAK;AACzC;AAAA,EACF;AACA,MAAI,QAAQ,WAAW;AACrB,QAAI;AACF,YAAM,QAAQ,UAAU,KAAK;AAC7B;AAAA,IACF,SAAS,OAAO;AACd,UACE,CAAC,yBAAyB,KAAK,KAC9B,CAAC,QAAQ,QAAQ,CAAC,QAAQ,eAC3B,CAAC,QAAQ,YACT;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAK,CAAC,QAAQ,QAAQ,CAAC,QAAQ,eAAgB,CAAC,QAAQ,YAAY;AAClE,UAAM,IAAI,+BAA+B,iDAAiD;AAAA,EAC5F;AACA,QAAM,OAAO,oBAAoB,MAAM,MAAM,2BAA2B;AACxE,QAAM,QAAQ,OAAO,MAAM,YAAY,WAAW,OAAO,KAAK,MAAM,OAAO,IAAI,MAAM;AACrF,MAAI,MAAM,aAAa,gCAAgC;AACrD,UAAM,IAAI,WAAW,mCAAmC;AAAA,EAC1D;AACA,QAAM,SAASG,WAAU,QAAQ,IAAI;AACrC,MAAI,MAAM,eAAe;AACvB,UAAM;AAAA,MACJ;AAAA,MACA,oCAAoCP,YAAW,MAAM,CAAC;AAAA,IAAmBA,YAAW,UAAU,CAAC;AAAA,MAC/F;AAAA,IACF;AAAA,EACF;AACA,MAAI,MAAM,eAAe,GAAG;AAC1B,UAAM;AAAA,MACJ;AAAA,MACA,kBAAkBA,YAAW,IAAI,CAAC,mBAAmBA,YAAW,IAAI,CAAC;AAAA,IAAmBA,YAAW,UAAU,CAAC;AAAA,MAC9G;AAAA,IACF;AACA;AAAA,EACF;AAMA,QAAM,UAAU,OAAO,KAAK,KAAK,EAAE,SAAS,QAAQ;AACpD,QAAM,UAAU;AAAA,IACd;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB,QAAQ,MAAM,0CAA0CA,YAAW,IAAI,CAAC;AAAA,IACzF,iBAAiBA,YAAW,IAAI,CAAC;AAAA,IACjC;AAAA,IAAiBA,YAAW,UAAU,CAAC;AAAA,EACzC,EAAE,KAAK,GAAG;AACV,QAAM,UAAU,QAAQ,OACpB,MAAM,QAAQ,KAAK;AAAA,IACjB,KAAK;AAAA,IACL,SAAS,2BAA2B,OAAO;AAAA,IAC3C,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB,CAAC,IACD,MAAM,QAAQ,YAAa;AAAA,IACzB,KAAK;AAAA,IACL,SAAS,2BAA2B,OAAO;AAAA,IAC3C,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB,CAAC;AACL,QAAM,mBACJ,OAAO,YAAY,YACd,MAAM;AACL,UAAM,SAAS,wBAAwB,OAAO;AAC9C,WAAO,OAAO,SAAS,YAAY,OAAO,YAAY;AAAA,EACxD,GAAG,IACH,OAAO,cAAc,QAAQ,SAAS,MAAM,QAAQ,aAAa,OAAO,IACtE,QAAQ,YACR;AACR,MAAI,qBAAqB,MAAM;AAC7B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,MAAM,QAAQ,WAAW;AAAA,IACtC,WAAW;AAAA,IACX,OAAO;AAAA,IACP,aAAaE,gBAAe,SAAS;AAAA,IACrC,iBAAiB;AAAA,EACnB,CAAC;AACD,QAAM,WAAW,wBAAwB,MAAM;AAC/C,MACE,SAAS,SAAS,aAClB,SAAS,SAAS,aACjB,SAAS,SAAS,YAAY,SAAS,aAAa,KACrD,CAAC,OAAO,SAAS,UAAU,GAC3B;AACA,UAAM,IAAI,6BAA6B,uCAAuC;AAAA,EAChF;AACF;AAEA,eAAe,WACb,SACA,SACA,YAAY,KACG;AACf,QAAM,UAAUA,gBAAe,SAAS;AACxC,QAAM,SAAS,QAAQ,OACnB,MAAM,QAAQ,KAAK;AAAA,IACjB,KAAK;AAAA,IACL,SAAS,2BAA2B,OAAO;AAAA,IAC3C,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB,CAAC,IACD,MAAM,QAAQ,YAAa;AAAA,IACzB,KAAK;AAAA,IACL,SAAS,2BAA2B,OAAO;AAAA,IAC3C,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB,CAAC;AACL,QAAM,SAAS,cAAc,MAAM;AACnC,QAAM,WAAW,OAAO,WAAW,YAAY,SAAS,OAAO,WAAW;AAC1E,MAAK,OAAO,aAAa,YAAY,aAAa,KAAM,CAAC,OAAO,SAAS,UAAU,GAAG;AACpF,UAAM,IAAI,6BAA6B,kCAAkC;AAAA,EAC3E;AACF;AAEA,eAAe,cACb,SACA,SACe;AACf,MAAI;AACF,QAAI,QAAQ,MAAM;AAChB,YAAM,QAAQ,KAAK;AAAA,QACjB,KAAK;AAAA,QACL,SAAS,2BAA2B,OAAO;AAAA,QAC3C,aAAa;AAAA,QACb,iBAAiB;AAAA,MACnB,CAAC;AAAA,IACH,WAAW,QAAQ,aAAa;AAC9B,YAAM,QAAQ,YAAY;AAAA,QACxB,KAAK;AAAA,QACL,SAAS,2BAA2B,OAAO;AAAA,QAC3C,aAAa;AAAA,QACb,iBAAiB;AAAA,MACnB,CAAC;AAAA,IACH;AAAA,EACF,QAAQ;AAAA,EAER;AACF;AAEA,eAAe,SACb,SACA,MACA,UACA,WACiB;AACjB,QAAM,cAAc,oBAAoB,MAAM,+BAA+B;AAC7E,MACE,CAAC,OAAO,cAAc,QAAQ,KAC9B,WAAW,KACX,WAAW,iCAAiC,GAC5C;AACA,UAAM,IAAI,WAAW,2CAA2C;AAAA,EAClE;AACA,MAAI,QAAQ,UAAU;AACpB,QAAI;AACF,YAAM,QAAQ,MAAM,QAAQ,SAAS,EAAE,MAAM,aAAa,SAAS,CAAC;AACpE,aAAO,OAAO,UAAU,WACpB,QACA,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,KAAK;AAAA,IAC5D,QAAQ;AAAA,IAIR;AAAA,EACF;AAEA,QAAM,aAAa,iCAAiCH,YAAW,CAAC;AAChE,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,MACE;AAAA,MACA,kBAAkBC,YAAW,WAAW,CAAC;AAAA,MACzC,mBAAmBA,YAAW,UAAU,CAAC,YAAYA,YAAW,UAAU,CAAC;AAAA,IAC7E,EAAE,KAAK,GAAG;AAAA,IACV;AAAA,IACA;AAAA,EACF;AACA,QAAM,WAAW,mBAAmB,YAAY,UAAU;AAC1D,QAAM,OAAO,qBAAqB,UAAU,+BAA+B;AAC3E,QAAM,iBAAiB,KAAK,IAAI,MAAM,QAAQ;AAC9C,MAAI,mBAAmB,EAAG,QAAO;AAEjC,QAAM,SAAmB,CAAC;AAC1B,WAAS,SAAS,GAAG,SAAS,gBAAgB,UAAU,0BAA0B;AAChF,UAAM,aAAa,KAAK,MAAM,SAAS,wBAAwB;AAC/D,UAAM,gBAAgB,KAAK,IAAI,0BAA0B,iBAAiB,MAAM;AAChF,UAAM,SAAS,kCAAkCD,YAAW,CAAC;AAC7D,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,QACE;AAAA,QACA,eAAeC,YAAW,MAAM,CAAC;AAAA,QACjC,SAASA,YAAW,WAAW,CAAC,OAAO,wBAAwB,SAAS,UAAU;AAAA,QAClF,eAAeA,YAAW,MAAM,CAAC;AAAA,MACnC,EAAE,KAAK,GAAG;AAAA,MACV,KAAK,KAAM,gBAAgB,IAAK,CAAC,IAAI;AAAA,MACrC;AAAA,IACF;AACA,UAAM,UAAU,mBAAmB,QAAQ,MAAM;AACjD,QAAI,CAAC,oEAAoE,KAAK,OAAO,GAAG;AACtF,YAAM,IAAI,6BAA6B,8CAA8C;AAAA,IACvF;AACA,UAAM,UAAU,OAAO,KAAK,SAAS,QAAQ;AAC7C,QAAI,QAAQ,aAAa,eAAe;AACtC,YAAM,IAAI,6BAA6B,8CAA8C;AAAA,IACvF;AACA,WAAO,KAAK,QAAQ,SAAS,GAAG,aAAa,CAAC;AAAA,EAChD;AACA,SAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,OAAO,OAAO,MAAM,CAAC;AAC/E;AAEA,eAAe,UACb,SACA,MACA,UACA,WACqB;AACrB,QAAM,cAAc,oBAAoB,MAAM,sCAAsC;AACpF,MACE,CAAC,OAAO,cAAc,QAAQ,KAC9B,WAAW,KACX,WAAW,KAAK,IAAI,KAAK,OAAO,MAAM,6BAA6B,GACnE;AACA,UAAM,IAAI,WAAW,kDAAkD;AAAA,EACzE;AACA,QAAM,aAAa,iCAAiCD,YAAW,CAAC;AAChE,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,MACE;AAAA,MACA,kBAAkBC,YAAW,WAAW,CAAC;AAAA,MACzC,mBAAmBA,YAAW,UAAU,CAAC,YAAYA,YAAW,UAAU,CAAC;AAAA,IAC7E,EAAE,KAAK,GAAG;AAAA,IACV;AAAA,IACA;AAAA,EACF;AACA,QAAM,OAAO;AAAA,IACX,mBAAmB,YAAY,UAAU;AAAA,IACzC;AAAA,EACF;AACA,MAAI,OAAO,KAAK,OAAO,UAAU;AAC/B,UAAM,IAAI,WAAW,8BAA8B;AAAA,EACrD;AACA,QAAM,SAAmB,CAAC;AAC1B,WAAS,SAAS,GAAG,SAAS,MAAM,UAAU,0BAA0B;AACtE,UAAM,aAAa,KAAK,MAAM,SAAS,wBAAwB;AAC/D,UAAM,gBAAgB,KAAK,IAAI,0BAA0B,OAAO,MAAM;AACtE,UAAM,SAAS,kCAAkCD,YAAW,CAAC;AAC7D,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,QACE;AAAA,QACA,eAAeC,YAAW,MAAM,CAAC;AAAA,QACjC,SAASA,YAAW,WAAW,CAAC,OAAO,wBAAwB,SAAS,UAAU;AAAA,QAClF,eAAeA,YAAW,MAAM,CAAC;AAAA,MACnC,EAAE,KAAK,GAAG;AAAA,MACV,KAAK,KAAM,gBAAgB,IAAK,CAAC,IAAI;AAAA,MACrC;AAAA,IACF;AACA,UAAM,UAAU,mBAAmB,QAAQ,MAAM;AACjD,QAAI,CAAC,oEAAoE,KAAK,OAAO,GAAG;AACtF,YAAM,IAAI,6BAA6B,qDAAqD;AAAA,IAC9F;AACA,UAAM,UAAU,OAAO,KAAK,SAAS,QAAQ;AAC7C,QAAI,QAAQ,eAAe,eAAe;AACxC,YAAM,IAAI,6BAA6B,qDAAqD;AAAA,IAC9F;AACA,WAAO,KAAK,OAAO;AAAA,EACrB;AACA,SAAO,WAAW,KAAK,OAAO,OAAO,MAAM,CAAC;AAC9C;AAEA,eAAe,sBACb,SACA,SACA,iBACA,WACiB;AACjB,QAAM,UAAUE,gBAAe,SAAS;AACxC,QAAM,SAAS,QAAQ,OACnB,MAAM,QAAQ,KAAK;AAAA,IACjB,KAAK;AAAA,IACL,SAAS,2BAA2B,OAAO;AAAA,IAC3C,aAAa;AAAA,IACb;AAAA,EACF,CAAC,IACD,MAAM,QAAQ,YAAa;AAAA,IACzB,KAAK;AAAA,IACL,SAAS,2BAA2B,OAAO;AAAA,IAC3C,aAAa;AAAA,IACb;AAAA,EACF,CAAC;AACL,QAAM,WAAW,OAAO,WAAW,YAAY,SAAS,OAAO,WAAW;AAC1E,MAAI,OAAO,WAAW,YAAY,QAAQ,cAAc,QAAW;AACjE,UAAM,IAAI,6BAA6B,sCAAsC;AAAA,EAC/E;AACA,MAAI,OAAO,WAAW,UAAU;AAC9B,UAAM,WAAW,wBAAwB,MAAM;AAC/C,QACE,SAAS,SAAS,aAClB,SAAS,SAAS,aACjB,SAAS,SAAS,YAAY,SAAS,aAAa,GACrD;AACA,YAAM,IAAI,6BAA6B,sCAAsC;AAAA,IAC/E;AACA,WAAO;AAAA,EACT;AACA,MAAI,OAAO,aAAa,YAAY,aAAa,GAAG;AAClD,UAAM,IAAI,6BAA6B,sCAAsC;AAAA,EAC/E;AACA,SAAO,OAAO,UAAU,OAAO,UAAU;AAC3C;AAEA,SAAS,mBAAmB,QAAgB,QAAwB;AAClE,QAAM,QAAQ,OAAO,QAAQ,MAAM;AACnC,MAAI,QAAQ,GAAG;AACb,UAAM,IAAI,6BAA6B,2CAA2C;AAAA,EACpF;AACA,QAAM,aAAa,QAAQ,OAAO;AAClC,QAAM,MAAM,OAAO,QAAQ,QAAQ,UAAU;AAC7C,MAAI,MAAM,GAAG;AACX,UAAM,IAAI,6BAA6B,+CAA+C;AAAA,EACxF;AACA,SAAO,OAAO,MAAM,YAAY,GAAG;AACrC;AAEA,SAAS,cAAc,QAAyC;AAC9D,MAAI,OAAO,WAAW,SAAU,QAAO;AACvC,SAAO,CAAC,OAAO,QAAQ,OAAO,QAAQ,OAAO,MAAM,EAChD,OAAO,CAAC,SAAyB,OAAO,SAAS,QAAQ,EACzD,KAAK,IAAI;AACd;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,MAAI,YAAY,KAAK,KAAK,EAAG,OAAM,IAAI,4BAA4B,uBAAuB;AAC1F,SAAO,IAAI,MAAM,WAAW,MAAM,MAAM,EAAE,WAAW,KAAK,KAAK,CAAC;AAClE;AAEA,SAASF,YAAW,OAAuB;AACzC,SAAO,IAAI,MAAM,WAAW,KAAK,OAAO,CAAC;AAC3C;AAEA,SAAS,aAAa,OAAgB,OAAuB;AAC3D,MAAI,OAAO,UAAU,YAAY,CAAC,cAAc,KAAK,KAAK,GAAG;AAC3D,UAAM,IAAI,4BAA4B,GAAG,KAAK,aAAa;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,SAAS,YAAY,OAAgB,OAAuB;AAC1D,MACE,OAAO,UAAU,YACjB,CAAC,8EAA8E,KAAK,KAAK,GACzF;AACA,UAAM,IAAI,4BAA4B,GAAG,KAAK,aAAa;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,OAAwB;AACjD,MACE,OAAO,UAAU,YACjB,MAAM,SAAS,OACf,CAAC,iCAAiC,KAAK,KAAK,GAC5C;AACA,UAAM,IAAI,4BAA4B,kCAAkC;AAAA,EAC1E;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAgB,OAAuB;AAC9D,MACE,OAAO,UAAU,YACjB,MAAM,WAAW,KACjB,OAAO,WAAW,KAAK,IAAI,OAC3B,yBAAyB,KAAK,KAAK,GACnC;AACA,UAAM,IAAI,4BAA4B,GAAG,KAAK,aAAa;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,OAAwB;AACvD,MACE,OAAO,UAAU,YACjB,MAAM,SAAS,OACf,CAAC,iCAAiC,KAAK,KAAK,GAC5C;AACA,UAAM,IAAI,4BAA4B,mDAAmD;AAAA,EAC3F;AACA,SAAO;AACT;AAEA,SAAS,mBACP,OACA,SACA,SACA,OACQ;AACR,MACE,OAAO,UAAU,YACjB,OAAO,WAAW,KAAK,IAAI,WAC3B,OAAO,WAAW,KAAK,IAAI,WAC3B,yBAAyB,KAAK,KAAK,GACnC;AACA,UAAM,IAAI,4BAA4B,GAAG,KAAK,aAAa;AAAA,EAC7D;AACA,SAAO;AACT;AAMA,SAAS,uBAAuB,MAAc,SAAkD;AAC9F,MAAI,CAAC,QAAQ,QAAS,QAAO;AAC7B,SAAO,GAAG,IAAI,GAAG,KAAK,SAAS,GAAG,IAAI,MAAM,GAAG,GAAG,qCAAqC;AACzF;AAEA,SAAS,WAAW,OAAwB;AAC1C,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,KAAK,OAAO,WAAW,KAAK,IAAI,OAAQ;AACxF,UAAM,IAAI,4BAA4B,wBAAwB;AAAA,EAChE;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAwB;AAC/C,MAAI,OAAO,UAAU,SAAU,OAAM,IAAI,4BAA4B,2BAA2B;AAChG,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QAAI,IAAI,WAAW,UAAU,IAAI,aAAa,OAAO,IAAI,UAAU,IAAI,KAAM,OAAM,IAAI,MAAM;AAC7F,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,UAAM,IAAI,4BAA4B,2CAA2C;AAAA,EACnF;AACF;AAEA,SAAS,UAAU,OAAgB,OAAuB;AACxD,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,OAAO,CAAC,OAAO,SAAS,KAAK,MAAM,KAAK,CAAC,GAAG;AAC1F,UAAM,IAAI,4BAA4B,GAAG,KAAK,aAAa;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,OAAe,OAAuB;AACjE,MACE,CAAC,MAAM,WAAW,GAAG,KACrB,MAAM,SAAS,IAAI,KACnB,MAAM,SAAS,GAAG,KAClBO,WAAU,UAAU,KAAK,MAAM,OAC/B;AACA,UAAM,IAAI,4BAA4B,GAAG,KAAK,aAAa;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,SAAST,aAAY,OAAuB;AAC1C,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,OAAQ;AAC/D,UAAM,IAAI,WAAW,oCAAoC;AAAA,EAC3D;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAAe,SAAiB,SAAiB,OAAuB;AAC9F,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,WAAW,QAAQ,SAAS;AACtE,UAAM,IAAI,WAAW,GAAG,KAAK,aAAa;AAAA,EAC5C;AACA,SAAO;AACT;AAEA,SAAS,0BACP,OACA,QAOQ;AACR,QAAM,MAAM,IAAI,IAAI,KAAK;AACzB,MAAI,OAAO,WAAW,OAAW,KAAI,aAAa,IAAI,UAAU,OAAO,MAAM;AAC7E,MAAI,OAAO,YAAY,QAAW;AAChC,QAAI,aAAa;AAAA,MACf;AAAA,MACA,OAAO,eAAe,OAAO,SAAS,GAAG,KAAK,uBAAuB,CAAC;AAAA,IACxE;AAAA,EACF;AACA,MAAI,OAAO,aAAa,QAAW;AACjC,QAAI,aAAa;AAAA,MACf;AAAA,MACA,OAAO,eAAe,OAAO,UAAU,GAAG,MAAO,qBAAqB,CAAC;AAAA,IACzE;AAAA,EACF;AACA,MAAI,OAAO,cAAc,QAAW;AAClC,QAAI,aAAa;AAAA,MACf;AAAA,MACA,OAAO,eAAe,OAAO,WAAW,GAAG,MAAO,sBAAsB,CAAC;AAAA,IAC3E;AAAA,EACF;AACA,MAAI,OAAO,kBAAkB,QAAW;AACtC,QAAI,aAAa;AAAA,MACf;AAAA,MACA,OAAO,eAAe,OAAO,eAAe,GAAG,IAAI,iCAAiC,CAAC;AAAA,IACvF;AAAA,EACF;AACA,SAAO,IAAI,SAAS;AACtB;AAEA,SAASI,gBAAe,OAAuB;AAC7C,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,wBAAwB;AAC/E,UAAM,IAAI,WAAW,uCAAuC;AAAA,EAC9D;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,OAAgB,OAAuB;AAClE,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAAG;AAC1E,UAAM,IAAI,WAAW,GAAG,KAAK,aAAa;AAAA,EAC5C;AACA,SAAO;AACT;AAEA,SAAS,uBAAuB,OAAgB,OAAuB;AACrE,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAAG;AAC1E,UAAM,IAAI,WAAW,GAAG,KAAK,aAAa;AAAA,EAC5C;AACA,SAAO;AACT;AAEA,SAAS,2BAA2B,OAA0B;AAC5D,MACE,CAAC,MAAM,QAAQ,KAAK,KACpB,MAAM,SAAS,MACf,CAAC,MAAM,MAAM,CAAC,UAAU,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,MAAM,UAAU,GAAG,GAC5F;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,CAAC,GAAG,KAAK;AAClB;AAEA,SAAS,qBAAqB,OAAe,OAAuB;AAClE,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,qBAAqB,KAAK,OAAO,GAAG;AACvC,UAAM,IAAI,4BAA4B,GAAG,KAAK,aAAa;AAAA,EAC7D;AACA,QAAM,SAAS,OAAO,OAAO;AAC7B,MAAI,CAAC,OAAO,cAAc,MAAM,GAAG;AACjC,UAAM,IAAI,4BAA4B,GAAG,KAAK,aAAa;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,QAAML,UAAS,qBAAqB,OAAO,aAAa;AACxD,MAAIA,UAAS,OAAOA,UAAS,KAAK;AAChC,UAAM,IAAI,4BAA4B,wBAAwB;AAAA,EAChE;AACA,SAAOA;AACT;;;AGn0IA;AAAA,EACE;AAAA,OAKK;AAQP,SAAS,YAAAW,iBAAgB;AAEzB,IAAM,0BAA0B;AAChC,IAAM,8BAA8B,KAAK;AACzC,IAAM,uBAAuB;AAC7B,IAAM,4BAA4B,OAAO;AACzC,IAAM,2BAA2B,IAAI,OAAO;AAC5C,IAAM,0BAA0B;AAIhC,IAAM,oBAAoB;AAK1B,IAAM,4BAA4B,KAAK;AACvC,IAAM,oBAAoB;AAC1B,IAAM,sBAAsB,oBAAI,IAAI;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,8BAA8B;AA0B7B,IAAM,+BAAN,cAA2C,MAAM;AAAA,EACtD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,WAAW,OAAuB;AACzC,SAAO,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE;AACzC;AAEA,SAAS,oBAAoB,OAAgB,OAAe,UAAwB;AAClF,MAAI,UAAU,OAAW;AACzB,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI,6BAA6B,GAAG,KAAK,mBAAmB;AAAA,EACpE;AACA,MAAI,WAAW,KAAK,IAAI,UAAU;AAChC,UAAM,IAAI,6BAA6B,GAAG,KAAK,YAAY,QAAQ,QAAQ;AAAA,EAC7E;AACA,MAAI,OAAO,SAAS,IAAI,GAAG;AACzB,UAAM,IAAI,6BAA6B,GAAG,KAAK,sBAAsB;AAAA,EACvE;AACF;AAEA,SAAS,sBAAsB,OAAgB,OAAe,UAA0B;AACtF,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI,6BAA6B,GAAG,KAAK,mBAAmB;AAAA,EACpE;AACA,sBAAoB,OAAO,OAAO,QAAQ;AAC1C,SAAO;AACT;AAEA,SAAS,6BAA6B,OAAgB,OAAe,UAAwB;AAC3F,sBAAoB,OAAO,OAAO,QAAQ;AAC1C,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,KAAK,GAAG;AAC9C,UAAM,IAAI,6BAA6B,GAAG,KAAK,oBAAoB;AAAA,EACrE;AACF;AAEA,SAAS,oBAAoB,SAAkB,UAA8C;AAC3F,MAAI,YAAY,UAAa,CAAC,MAAM,QAAQ,OAAO,GAAG;AACpD,UAAM,IAAI,6BAA6B,6BAA6B;AAAA,EACtE;AACA,QAAM,aAAa,WAAW,CAAC;AAC/B,QAAM,aAAwC,CAAC;AAC/C,MAAI,YAAY,WAAW,WAAW,GAAG;AACvC,UAAM,IAAI,6BAA6B,8CAA8C;AAAA,EACvF;AACA,MAAI,WAAW,SAAS,yBAAyB;AAC/C,UAAM,IAAI;AAAA,MACR,oCAAoC,uBAAuB;AAAA,IAC7D;AAAA,EACF;AACA,aAAW,CAAC,OAAO,MAAM,KAAK,WAAW,QAAQ,GAAG;AAClD,QAAI,CAACA,UAAS,MAAM,GAAG;AACrB,YAAM,IAAI,6BAA6B,cAAc,KAAK,qBAAqB;AAAA,IACjF;AACA,UAAM,SAAS,OAAO;AACtB,QAAI,OAAO,WAAW,YAAY,CAAC,oBAAoB,IAAI,MAAM,GAAG;AAClE,YAAM,IAAI,6BAA6B,cAAc,KAAK,qBAAqB;AAAA,IACjF;AACA,iCAA6B,OAAO,gBAAgB,cAAc,KAAK,oBAAoB,GAAG;AAC9F,iCAA6B,OAAO,cAAc,cAAc,KAAK,kBAAkB,GAAG;AAC1F,iCAA6B,OAAO,UAAU,cAAc,KAAK,cAAc,IAAK;AACpF,iCAA6B,OAAO,SAAS,cAAc,KAAK,aAAa,IAAK;AAClF,QAAI,OAAO,WAAW,UAAa,CAAC,MAAM,QAAQ,OAAO,MAAM,GAAG;AAChE,YAAM,IAAI,6BAA6B,cAAc,KAAK,2BAA2B;AAAA,IACvF;AACA,UAAM,SAAS,OAAO,UAAU,CAAC;AACjC,QAAI,OAAO,SAAS,KAAK;AACvB,YAAM,IAAI,6BAA6B,cAAc,KAAK,8BAA8B;AAAA,IAC1F;AACA,eAAW,SAAS,QAAQ;AAC1B,4BAAsB,OAAO,cAAc,KAAK,WAAW,GAAG;AAC9D,UAAI,CAAC,MAAM,KAAK,GAAG;AACjB,cAAM,IAAI,6BAA6B,cAAc,KAAK,2BAA2B;AAAA,MACvF;AAAA,IACF;AACA,QAAI,OAAO,qBAAqB,QAAW;AACzC,YAAM,mBAAmB;AAAA,QACvB,OAAO;AAAA,QACP,cAAc,KAAK;AAAA,QACnB;AAAA,MACF;AACA,UAAI;AACJ,UAAI;AACF,cAAM,IAAI,IAAI,gBAAgB;AAAA,MAChC,QAAQ;AACN,cAAM,IAAI,6BAA6B,cAAc,KAAK,+BAA+B;AAAA,MAC3F;AACA,UAAI,IAAI,aAAa,YAAY,IAAI,aAAa,SAAS;AACzD,cAAM,IAAI;AAAA,UACR,cAAc,KAAK;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AACA,eAAW,KAAK;AAAA,MACd;AAAA,MACA,GAAI,OAAO,OAAO,mBAAmB,WACjC,EAAE,gBAAgB,OAAO,eAAe,IACxC,CAAC;AAAA,MACL,GAAI,OAAO,OAAO,iBAAiB,WAAW,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;AAAA,MACvF,GAAI,OAAO,SAAS,IAAI,EAAE,OAA2B,IAAI,CAAC;AAAA,MAC1D,GAAI,OAAO,OAAO,aAAa,WAAW,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;AAAA,MAC3E,GAAI,OAAO,OAAO,qBAAqB,WACnC,EAAE,kBAAkB,OAAO,iBAAiB,IAC5C,CAAC;AAAA,MACL,GAAI,OAAO,OAAO,YAAY,WAAW,EAAE,SAAS,OAAO,QAAQ,IAAI,CAAC;AAAA,IAC1E,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,SAAS,sBACP,YACA,UACM;AACN,MACE,WAAW,cAAc,SAAS,aAClC,WAAW,gBAAgB,SAAS,eACpC,WAAW,cAAc,SAAS,WAClC;AACA,UAAM,IAAI,6BAA6B,mDAAmD;AAAA,EAC5F;AACF;AAEA,SAAS,0BAA0B,MAAsB;AACvD,MACE,KAAK,WAAW,KAChB,KAAK,SAAS,OACd,KAAK,WAAW,GAAG,KACnB,KAAK,SAAS,IAAI,KAClB,KAAK,SAAS,IAAI,GAClB;AACA,UAAM,IAAI,6BAA6B,qCAAqC,IAAI,EAAE;AAAA,EACpF;AACA,QAAM,WAAW,KAAK,MAAM,GAAG;AAC/B,MAAI,SAAS,KAAK,CAAC,YAAY,QAAQ,WAAW,KAAK,YAAY,OAAO,YAAY,IAAI,GAAG;AAC3F,UAAM,IAAI,6BAA6B,qCAAqC,IAAI,EAAE;AAAA,EACpF;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,MAAc,OAAqB;AAChE,MAAI,CAAC,2BAA2B,KAAK,IAAI,GAAG;AAC1C,UAAM,IAAI,6BAA6B,WAAW,KAAK,KAAK,IAAI,EAAE;AAAA,EACpE;AACF;AAsBO,SAAS,kCACd,YACA,UACA,MAAY,oBAAI,KAAK,GACmB;AACxC,MAAI,CAACA,UAAS,UAAU,GAAG;AACzB,UAAM,IAAI,6BAA6B,6CAA6C;AAAA,EACtF;AACA,QAAM,YAAY;AAClB,MACE,UAAU,WAAW,QACrB,UAAU,WAAW,iBACrB,UAAU,WAAW,kBACrB;AACA,UAAM,IAAI,6BAA6B,6CAA6C;AAAA,EACtF;AACA,wBAAsB,WAAW,QAAQ;AACzC,MAAI,UAAU,WAAW,iBAAkB,QAAO;AAClD,QAAM,aAAa,oBAAoB,UAAU,YAAY,UAAU,WAAW,aAAa;AAC/F,MAAI,UAAU,WAAW,eAAe;AACtC,WAAO;AAAA,MACL,aAAa,CAAC;AAAA,MACd,OAAO,CAAC;AAAA,MACR,iBAAiB,CAAC;AAAA,MAClB,WAAW;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAACA,UAAS,UAAU,WAAW,GAAG;AACpC,UAAM,IAAI,6BAA6B,8CAA8C;AAAA,EACvF;AACA,QAAM,qBAAqB,OAAO,QAAQ,UAAU,WAAW;AAC/D,MAAI,mBAAmB,SAAS,yBAAyB;AACvD,UAAM,IAAI;AAAA,MACR,sCAAsC,uBAAuB;AAAA,IAC/D;AAAA,EACF;AACA,MAAI,aAAa;AACjB,QAAM,cAAsC,CAAC;AAC7C,aAAW,CAAC,MAAM,QAAQ,KAAK,oBAAoB;AACjD,0BAAsB,MAAM,iCAAiC;AAC7D,UAAM,QAAQ;AAAA,MACZ;AAAA,MACA,qCAAqC,IAAI;AAAA,MACzC;AAAA,IACF;AACA,UAAM,aAAa,WAAW,KAAK;AACnC,kBAAc;AACd,WAAO,eAAe,aAAa,MAAM;AAAA,MACvC;AAAA,MACA,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AAEA,MAAI,UAAU,UAAU,UAAa,CAAC,MAAM,QAAQ,UAAU,KAAK,GAAG;AACpE,UAAM,IAAI,6BAA6B,uCAAuC;AAAA,EAChF;AACA,QAAM,QAAQ,UAAU,SAAS,CAAC;AAClC,MAAI,MAAM,SAAS,sBAAsB;AACvC,UAAM,IAAI;AAAA,MACR,qCAAqC,oBAAoB;AAAA,IAC3D;AAAA,EACF;AACA,QAAM,QAAQ,oBAAI,IAAoB;AACtC,QAAM,kBAAkB,MAAM,IAAI,CAAC,MAAM,UAAU;AACjD,QAAI,CAACA,UAAS,IAAI,GAAG;AACnB,YAAM,IAAI,6BAA6B,uBAAuB,KAAK,oBAAoB;AAAA,IACzF;AACA,UAAM,OAAO;AAAA,MACX,sBAAsB,KAAK,MAAM,uBAAuB,KAAK,SAAS,GAAG;AAAA,IAC3E;AACA,UAAM,SAAS,KAAK,kBAAkB,OAAO;AAC7C,UAAM,YAAY,MAAM,IAAI,MAAM;AAClC,QAAI,cAAc,QAAW;AAC3B,YAAM,IAAI;AAAA,QACR,uCAAuC,SAAS,QAAQ,IAAI;AAAA,MAC9D;AAAA,IACF;AACA,UAAM,IAAI,QAAQ,IAAI;AACtB,UAAM,UAAU;AAAA,MACd,KAAK;AAAA,MACL,gCAAgC,IAAI;AAAA,MACpC;AAAA,IACF;AACA,UAAM,eAAe,WAAW,OAAO;AACvC,QAAI,KAAK,SAAS,UAAa,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AAC3E,YAAM,IAAI,6BAA6B,wCAAwC,IAAI,EAAE;AAAA,IACvF;AACA,kBAAc;AACd,WAAO,EAAE,MAAM,SAAS,MAAM,KAAK,QAAQ,OAAO;AAAA,EACpD,CAAC;AAED,MAAI,UAAU,oBAAoB,UAAa,CAACA,UAAS,UAAU,eAAe,GAAG;AACnF,UAAM,IAAI,6BAA6B,kDAAkD;AAAA,EAC3F;AACA,QAAM,kBAA0C,CAAC;AACjD,aAAW,CAAC,MAAM,cAAc,KAAK,OAAO,QAAQ,UAAU,mBAAmB,CAAC,CAAC,GAAG;AACpF,0BAAsB,MAAM,sCAAsC;AAClE,QAAI,OAAO,UAAU,eAAe,KAAK,aAAa,IAAI,GAAG;AAC3D,YAAM,IAAI;AAAA,QACR,sDAAsD,IAAI;AAAA,MAC5D;AAAA,IACF;AACA,UAAM,OAAO;AAAA,MACX,sBAAsB,gBAAgB,yCAAyC,IAAI,IAAI,GAAG;AAAA,IAC5F;AACA,QAAI,CAAC,MAAM,IAAI,KAAK,kBAAkB,OAAO,CAAC,GAAG;AAC/C,YAAM,IAAI;AAAA,QACR,+DAA+D,IAAI;AAAA,MACrE;AAAA,IACF;AACA,WAAO,eAAe,iBAAiB,MAAM;AAAA,MAC3C,OAAO;AAAA,MACP,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,MAAI,mBAAmB,SAAS,OAAO,KAAK,eAAe,EAAE,SAAS,yBAAyB;AAC7F,UAAM,IAAI;AAAA,MACR,+CAA+C,uBAAuB;AAAA,IACxE;AAAA,EACF;AACA,MAAI,aAAa,0BAA0B;AACzC,UAAM,IAAI;AAAA,MACR,mCAAmC,wBAAwB;AAAA,IAC7D;AAAA,EACF;AAEA,MAAI,YAAyB;AAC7B,MAAI,UAAU,cAAc,UAAa,UAAU,cAAc,MAAM;AACrE,UAAM,SAAS,sBAAsB,UAAU,WAAW,yBAAyB,GAAG;AACtF,gBAAY,IAAI,KAAK,MAAM;AAC3B,QAAI,CAAC,OAAO,SAAS,UAAU,QAAQ,CAAC,KAAK,UAAU,QAAQ,KAAK,IAAI,QAAQ,GAAG;AACjF,YAAM,IAAI,6BAA6B,qDAAqD;AAAA,IAC9F;AAAA,EACF;AACA,QAAM,YAAY,8BAA8B;AAAA,IAC9C,UAAU,QAAQ,SAAY,CAAC,IAAI,UAAU;AAAA,EAC/C;AACA,MAAI,CAAC,UAAU,SAAS;AAGtB,UAAM,IAAI,6BAA6B,wCAAwC;AAAA,EACjF;AAGA,SAAO;AAAA,IACL;AAAA,IACA,OAAO;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,UAAU,KAAK,SAAS,EAAE,KAAK,UAAU,KAAK,IAAI,CAAC;AAAA,EACzD;AACF;AAEA,SAAS,mBAAmB,OAAe,OAAuB;AAChE,MAAI,CAAC,yBAAyB,KAAK,KAAK,GAAG;AACzC,UAAM,IAAI,6BAA6B,GAAG,KAAK,oCAAoC;AAAA,EACrF;AACA,SAAO;AACT;AAEO,SAAS,kBAAkB,WAA2B;AAC3D,SAAO,iCAAiC,mBAAmB,WAAW,WAAW,CAAC;AACpF;AAEO,SAAS,yBAAyB,WAA2B;AAClE,SAAO,GAAG,kBAAkB,SAAS,CAAC;AACxC;AAEA,SAASC,YAAW,OAAuB;AACzC,SAAO,IAAI,MAAM,QAAQ,MAAM,OAAO,CAAC;AACzC;AAEA,SAAS,OAAO,OAAuB;AACrC,SAAO,OAAO,KAAK,OAAO,MAAM,EAAE,SAAS,QAAQ;AACrD;AAEA,SAAS,8BAAsC;AAC7C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAGA,SAAS,2BAA2B,MAAwB;AAC1D,QAAM,WAAWA,YAAW,GAAG,IAAI,gBAAgB;AACnD,QAAM,gBAAgBA,YAAW,GAAG,IAAI,mBAAmB;AAC3D,SAAO;AAAA,IACL;AAAA,IACA,YAAY,QAAQ;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,IACA,gCAAgC,aAAa;AAAA,IAC7C;AAAA,IACA;AAAA,IACA,2DAA2D,2BAA2B;AAAA,IACtF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB,aAAa;AAAA,IAC9B;AAAA,EACF;AACF;AAEA,SAAS,6BAAuC;AAC9C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAASC,UAAS,QAAyB;AACzC,MAAI,OAAO,WAAW,SAAU,QAAO;AACvC,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,YAAY;AAKlB,SAAO,CAAC,UAAU,QAAQ,UAAU,QAAQ,UAAU,MAAM,EACzD,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ,EAC5D,KAAK,IAAI;AACd;AAEA,eAAe,qBACb,SACA,KACA,eACe;AACf,QAAM,SAAS;AAAA;AAAA,EAAoB,GAAG;AAAA,aAAgB,iBAAiB;AACvE,QAAM,OAAwB;AAAA,IAC5B,KAAK;AAAA,6CAAsDD,YAAW,MAAM,CAAC;AAAA,IAC7E,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AACA,QAAM,SAAS,gBACX,MAAM,cAAc,SAAS,IAAI,IACjC,QAAQ,OACN,MAAM,QAAQ,KAAK,IAAI,IACvB,QAAQ,cACN,MAAM,QAAQ,YAAY,IAAI,IAC9B;AACR,MAAI,CAACC,UAAS,MAAM,EAAE,SAAS,iBAAiB,GAAG;AACjD,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACF;AAIA,eAAe,mBACb,SACA,OACA,eACe;AACf,MAAI,QAAkB,CAAC;AACvB,MAAI,aAAa;AACjB,QAAM,QAAQ,YAAY;AACxB,QAAI,MAAM,WAAW,EAAG;AACxB,UAAM,MAAM,MAAM,IAAI,CAAC,SAAS;AAAA,EAAM,IAAI;AAAA,EAAK,EAAE,KAAK,IAAI;AAC1D,YAAQ,CAAC;AACT,iBAAa;AACb,UAAM,qBAAqB,SAAS,KAAK,aAAa;AAAA,EACxD;AACA,aAAW,QAAQ,OAAO;AACxB,UAAM,YAAY,WAAW,IAAI,IAAI;AACrC,QAAI,MAAM,SAAS,KAAK,aAAa,YAAY,0BAA2B,OAAM,MAAM;AACxF,UAAM,KAAK,IAAI;AACf,kBAAc;AAAA,EAChB;AACA,QAAM,MAAM;AACd;AAEA,SAAS,yBACP,WACA,cACA,SACU;AACV,QAAM,QAAQ;AAAA,IACZ,sBAAsB,WAAW,cAAc,kCAAkC;AAAA,EACnF;AACA,QAAM,UAAU,OAAO,OAAO;AAC9B,WAAS,SAAS,GAAG,SAAS,QAAQ,QAAQ,UAAU,mBAAmB;AACzE,UAAM,QAAQ,QAAQ,MAAM,QAAQ,SAAS,iBAAiB;AAC9D,UAAM;AAAA,MACJ;AAAA,QACE;AAAA,QACA;AAAA,QACA,aAAaD,YAAW,KAAK,CAAC,MAAM,4BAA4B,CAAC;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AACA,QAAM;AAAA,IACJ;AAAA,MACE;AAAA,MACA;AAAA,MACA,qEAAqEA,YAAW,OAAO,WAAW,OAAO,CAAC,CAAC,CAAC;AAAA,IAC9G;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,WAAmB,cAAsB,SAAyB;AAI/F,QAAM,cAAc,CAAC,GAAG,OAAO,KAAK,cAAc,MAAM,CAAC,EACtD,IAAI,CAAC,SAAS,MAAM,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,EACxD,KAAK,EAAE;AACV,SAAO;AAAA,IACL,0CAA0CA,YAAW,WAAW,CAAC;AAAA,IACjE,6BAA6BA,YAAW,SAAS,CAAC;AAAA,IAClD;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAgBA,eAAsB,0BACpB,SACA,UACA,SACe;AACf,QAAM;AAAA,IAA4B;AAAA,IAAmB,MACnD,kCAAkC,SAAS,UAAU,OAAO;AAAA,EAC9D;AACF;AAEA,eAAe,kCACb,SACA,UACA,SACe;AACf,QAAM,OAAO,kBAAkB,QAAQ,SAAS;AAChD,QAAM,YAAY,mBAAmB,QAAQ,WAAW,WAAW;AACnE,MAAI,CAAC,OAAO,cAAc,QAAQ,mBAAmB,KAAK,QAAQ,sBAAsB,GAAG;AACzF,UAAM,IAAI,6BAA6B,oDAAoD;AAAA,EAC7F;AACA,QAAM,QAAQ,OAAO,WAAW;AAChC,QAAM,SAAS,GAAG,SAAS,IAAI,QAAQ,mBAAmB;AAC1D,QAAM,cAAc,GAAG,SAAS,IAAI,QAAQ,mBAAmB,IAAI,KAAK;AACxE,QAAM,QAAQ,GAAG,IAAI,oBAAoB,WAAW;AACpD,QAAM,UAAU,GAAG,IAAI,aAAa,WAAW;AAC/C,aAAW,QAAQ,SAAS,OAAO;AACjC,UAAM,OAAO,KAAK,QAAQ;AAC1B,QAAI,SAAS,UAAU,SAAS,QAAQ;AACtC,YAAM,IAAI,6BAA6B,wCAAwC,KAAK,IAAI,EAAE;AAAA,IAC5F;AAAA,EACF;AACA,QAAM,QAAkB;AAAA,IACtB;AAAA,MACE;AAAA,MACA,eAAeA,YAAW,GAAG,IAAI,WAAW,CAAC;AAAA,MAC7C,iBAAiBA,YAAW,IAAI,CAAC,IAAIA,YAAW,GAAG,IAAI,WAAW,CAAC;AAAA,MACnE,aAAaA,YAAW,KAAK,CAAC;AAAA,MAC9B,eAAeA,YAAW,GAAG,KAAK,QAAQ,CAAC;AAAA,IAC7C,EAAE,KAAK,IAAI;AAAA,EACb;AAEA,QAAM,mBAAmB;AAAA,IACvB,GAAG,OAAO,QAAQ,SAAS,WAAW,EAAE;AAAA,MACtC,CAAC,CAAC,MAAM,KAAK,MAAM,UAAU,IAAI,IAAIA,YAAW,KAAK,CAAC;AAAA,IACxD;AAAA,IACA,GAAG,OAAO,QAAQ,SAAS,eAAe,EAAE;AAAA,MAC1C,CAAC,CAAC,MAAM,IAAI,MAAM,UAAU,IAAI,IAAIA,YAAW,GAAG,OAAO,UAAU,IAAI,EAAE,CAAC;AAAA,IAC5E;AAAA,EACF;AACA,QAAM;AAAA,IACJ,GAAG;AAAA,MACD;AAAA,MACA;AAAA,MACA,iBAAiB,SAAS,IAAI,GAAG,iBAAiB,KAAK,IAAI,CAAC;AAAA,IAAO;AAAA,IACrE;AAAA,IACA,iBAAiBA,YAAW,GAAG,KAAK,MAAM,CAAC;AAAA,EAC7C;AAEA,aAAW,QAAQ,SAAS,OAAO;AACjC,UAAM,YAAY,GAAG,KAAK;AAC1B,UAAM;AAAA,MACJ,sBAAsB,WAAW,KAAK,MAAM,+CAA+C;AAAA,MAC3F,GAAG,yBAAyB,WAAW,KAAK,MAAM,KAAK,OAAO;AAAA,MAC9D;AAAA,QACE;AAAA,QACA,KAAK;AAAA,QACL,YAAYA,YAAW,KAAK,QAAQ,MAAM,CAAC;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AAEA,QAAM;AAAA,IACJ;AAAA;AAAA;AAAA,MAGE,6BAA6BA,YAAW,IAAI,CAAC;AAAA,MAC7C,qCAAqCA,YAAW,WAAW,CAAC;AAAA,MAC5D,+BAA+BA,YAAW,MAAM,CAAC;AAAA,MACjD,GAAG,2BAA2B,IAAI;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAI,QAAQ,2BACR;AAAA,QACE;AAAA,MACF,IACA,QAAQ,qBACN;AAAA,QACE;AAAA,MACF,IACA,QAAQ,6BACN;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,IACA,CAAC;AAAA,MACT,GAAG,2BAA2B;AAAA,IAChC,EAAE,KAAK,IAAI;AAAA,EACb;AACA,QAAM,mBAAmB,SAAS,OAAO,QAAQ,aAAa;AAChE;AAEA,eAAsB,oBACpB,SACA,WACA,eACe;AACf,QAAM,OAAO,kBAAkB,SAAS;AACxC,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,MACE,WAAWA,YAAW,IAAI,CAAC;AAAA,MAC3B,GAAG,2BAA2B,IAAI,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE;AAAA,MAC7D,cAAcA,YAAW,GAAG,IAAI,UAAU,CAAC,IAAIA,YAAW,GAAG,IAAI,QAAQ,CAAC;AAAA,MAC1E,eAAeA,YAAW,GAAG,IAAI,WAAW,CAAC;AAAA,MAC7C,GAAG,2BAA2B,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE;AAAA,MACzD;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,IACX;AAAA,EACF;AACF;AAOA,eAAsB,8BACpB,SACA,SAIA,eACe;AACf,QAAM,OAAO,kBAAkB,QAAQ,SAAS;AAChD,QAAM,YAAY,mBAAmB,QAAQ,WAAW,WAAW;AACnE,MAAI,CAAC,OAAO,cAAc,QAAQ,mBAAmB,KAAK,QAAQ,sBAAsB,GAAG;AACzF,UAAM,IAAI,6BAA6B,oDAAoD;AAAA,EAC7F;AACA,QAAM,SAAS,GAAG,SAAS,IAAI,QAAQ,mBAAmB;AAC1D,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,MACE,WAAWA,YAAW,IAAI,CAAC;AAAA,MAC3B,GAAG,2BAA2B,IAAI,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE;AAAA,MAC7D,aAAaA,YAAW,GAAG,IAAI,UAAU,CAAC;AAAA,MAC1C,wBAAwBA,YAAW,GAAG,IAAI,UAAU,CAAC;AAAA,MACrD,0BAA0BA,YAAW,MAAM,CAAC,eAAeA,YAAW,GAAG,IAAI,UAAU,CAAC;AAAA,MACxF;AAAA,MACA,aAAaA,YAAW,GAAG,IAAI,WAAW,CAAC;AAAA,MAC3C,YAAYA,YAAW,GAAG,IAAI,WAAW,CAAC,kCAAkCA,YAAW,GAAG,MAAM,GAAG,CAAC;AAAA,MACpG,YAAYA,YAAW,GAAG,IAAI,WAAW,CAAC,kCAAkCA,YAAW,UAAU,MAAM,GAAG,CAAC;AAAA,MAC3G;AAAA,MACA,GAAG,2BAA2B,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE;AAAA,MACzD;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,IACX;AAAA,EACF;AACF;AAGO,SAAS,6BAA6B,KAAa,WAA2B;AACnF,QAAM,OAAO,kBAAkB,SAAS;AACxC,QAAM,cAAc,yBAAyB,SAAS;AACtD,SAAO;AAAA,IACL,WAAWA,YAAW,WAAW,CAAC;AAAA,IAClC,2CAA2CA,YAAW,WAAW,CAAC;AAAA,IAClE;AAAA,IACA;AAAA,IACA;AAAA,IACA,kCAAkCA,YAAW,GAAG,IAAI,WAAW,CAAC;AAAA,IAChE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAOO,SAAS,0BAA4C,SAAY,WAAsB;AAC5F,SAAO,IAAI,MAAM,SAAS;AAAA,IACxB,IAAI,QAAQ,UAAU,UAAU;AAC9B,UAAI,aAAa,UAAU,aAAa,eAAe;AACrD,cAAM,UAAU,QAAQ,IAAI,QAAQ,UAAU,MAAM;AAGpD,YAAI,CAAC,QAAS,QAAO;AACrB,eAAO,OAAO,SAA0B,aACtC,MAAM,QAAQ;AAAA,UACZ;AAAA,UACA,EAAE,GAAG,MAAM,KAAK,6BAA6B,KAAK,KAAK,SAAS,EAAE;AAAA,UAClE,GAAG;AAAA,QACL;AAAA,MACJ;AACA,YAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,QAAQ;AACpD,aAAO,OAAO,UAAU,aAAa,MAAM,KAAK,MAAM,IAAI;AAAA,IAC5D;AAAA,EACF,CAAC;AACH;AAGO,SAAS,yBACd,QACA,WACA,gBACe;AACf,QAAM,YAAY,oBAAI,QAAoC;AAC1D,QAAM,OAAO,OAAqC,YAA2B;AAC3E,UAAM,WAAW,UAAU,IAAI,OAAO;AACtC,QAAI,SAAU,QAAO;AACrB,UAAM,iBAAiB,OAAO;AAC9B,UAAM,UAAU,0BAA0B,SAAS,SAAS;AAC5D,cAAU,IAAI,SAAS,OAAO;AAC9B,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,WAAW,OAAO;AAAA,IAClB,GAAI,OAAO,2BAA2B,SAClC,EAAE,wBAAwB,OAAO,uBAAuB,IACxD,CAAC;AAAA,IACL,GAAI,OAAO,SACP;AAAA,MACE,QAAQ,UAAU,SAAgB,MAAM,KAAK,MAAO,OAAO,OAAe,GAAG,IAAI,CAAC;AAAA,IACpF,IACA,CAAC;AAAA,IACL,GAAI,OAAO,SACP;AAAA,MACE,QAAQ,UAAU,SAAgB,MAAM,KAAK,MAAO,OAAO,OAAe,GAAG,IAAI,CAAC;AAAA,IACpF,IACA,CAAC;AAAA,IACL,GAAI,OAAO,SACP;AAAA,MACE,QAAQ,OAAO,UAA+B,MAAM,OAAO,OAAQ,KAAK;AAAA,IAC1E,IACA,CAAC;AAAA,IACL,GAAI,OAAO,wBACP;AAAA,MACE,uBAAuB,OAAO,OAA4B,YACxD,MAAM,OAAO,sBAAuB,OAAO,OAAO;AAAA,IACtD,IACA,CAAC;AAAA,IACL,GAAI,OAAO,8BACP;AAAA,MACE,6BAA6B,OAAO,UAClC,MAAM,OAAO,4BAA6B,KAAK;AAAA,IACnD,IACA,CAAC;AAAA,IACL,GAAI,OAAO,gCACP;AAAA,MACE,+BAA+B,OAAO,UACpC,MAAM,OAAO,8BAA+B,KAAK;AAAA,IACrD,IACA,CAAC;AAAA,IACL,GAAI,OAAO,0BACP;AAAA,MACE,yBAAyB,OAAO,UAC9B,MAAM,OAAO,wBAAyB,KAAK;AAAA,IAC/C,IACA,CAAC;AAAA,EACP;AACF;;;AC51BA,SAAS,cAAAE,mBAAkB;AAC3B,SAAS,SAASC,kBAAiB;;;ACDnC,SAAS,cAAAC,aAAY,cAAAC,mBAAkB;AACvC,SAAS,YAAY,oBAAoB;AACzC,SAAS,WAAAC,UAAS,QAAAC,OAAM,SAAAC,QAAO,WAAAC,gBAAe;AAC9C,SAAS,qBAAqB;AAUvB,SAAS,4BAA4B,QAAuC;AACjF,SAAOC,YAAW,QAAQ,EAAE,OAAO,KAAK,UAAU,MAAM,CAAC,EAAE,OAAO,KAAK;AACzE;AAGO,SAAS,2BAA2B,QAAuC;AAChF,SAAO,KAAK,UAAU,MAAM;AAC9B;AAUO,SAAS,+BACd,QACAC,iBAAgB,cACR;AACR,MAAI,CAACC,OAAM,WAAWD,cAAa,KAAKA,eAAc,SAAS,IAAI,GAAG;AACpE,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,SAAOC,OAAM;AAAA,IACXD;AAAA,IACA;AAAA,IACA,4BAA4B,MAAM;AAAA,EACpC;AACF;AAEA,eAAsB,2BAA2B,MAA8C;AAC7F,QAAM,SAAS,OAAO,OAAe,QAAuB,WAAoB;AAC9E,UAAM,SAAS,MAAM,IAAI,MAAM;AAAA,MAC7B,aAAa,CAACE,MAAK,MAAM,KAAK,CAAC;AAAA,MAC/B,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC7B,CAAC;AACD,QAAI,CAAC,OAAO,WAAW,OAAO,QAAQ,WAAW,GAAG;AAClD,YAAM,IAAI,MAAM,yCAAyC,KAAK,EAAE;AAAA,IAClE;AACA,WAAO,MAAM,OAAO,QAAQ,CAAC,EAAG,KAAK;AAAA,EACvC;AACA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,OAAO;AAAA,MACL,QAAQ,MAAM,OAAO,8BAA8B,OAAO,qBAAqB;AAAA,MAC/E,cAAc,MAAM,OAAO,kCAAkC,KAAK;AAAA;AAAA,MAElE,gBAAgB;AAAA,IAClB;AAAA,EACF;AACF;AAEA,IAAI;AACG,SAAS,4BAA4D;AAC1E,SAAQ,mBAAmB,YAAY;AACrC,UAAM,YAAYC,SAAQ,cAAc,YAAY,GAAG,CAAC;AAExD,UAAM,OAAOC,SAAQ,WAAW,aAAa;AAC7C,QACE,YAAY,IAAI,SAAS,iCAAiC,KAC1D,WAAWF,MAAK,MAAM,4BAA4B,CAAC,GACnD;AACA,aAAO,MAAM,2BAA2B,IAAI;AAAA,IAC9C;AACA,UAAM,aAAa;AAAA,MACjBA,MAAK,WAAW,6BAA6B;AAAA,MAC7CA,MAAK,WAAW,gCAAgC;AAAA,MAChDA,MAAK,WAAW,wCAAwC;AAAA,IAC1D;AACA,eAAW,QAAQ,YAAY;AAC7B,UAAI,CAAC,WAAW,IAAI,EAAG;AACvB,YAAM,QAAQ,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AACnD,UACE,CAAC,SACD,OAAO,UAAU,YACjB,MAAM,YAAY,KAClB,OAAO,KAAK,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,MAAM,mBACxC,OAAO,MAAM,OAAO,WAAW,YAC/B,OAAO,MAAM,QAAQ,YAAY,MAAM,YACvC,MAAM,QAAQ,cAAc,MAAM,2BAClC,OAAO,KAAK,MAAM,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,MAAM,kCAC9C;AACA,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAEA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF,GAAG;AACL;AAEA,SAAS,MAAM,OAAuB;AACpC,SAAO,IAAI,MAAM,QAAQ,MAAM,OAAO,CAAC;AACzC;AAGA,eAAsB,6BACpB,SACA,QACAG,MACA,OACAL,iBAAgB,cAChB,UACe;AACf,QAAM,YAAY,+BAA+B,QAAQA,cAAa;AACtE,QAAM,SAAS,4BAA4B,MAAM;AACjD,QAAM,SAAS;AAAA;AAAA,eAEF,KAAK,UAAU,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gGAOwD,KAAK,UAAU,MAAM,CAAC;AAAA;AAIpH,QAAM,UAAU;AAAA;AAAA;AAAA;AAAA,qEAImD,OAAO,WAAW,2BAA2B,MAAM,CAAC,CAAC;AAAA;AAAA,gEAE1D,KAAK,UAAU,MAAM,CAAC;AAAA,uCAC/C,KAAK,UAAU,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAS9D,MAAI,UAAU;AAKZ,UAAM,eAAe;AAAA,MACnB;AAAA,MACA,cAAc,MAAM,MAAM,CAAC;AAAA,MAC3B;AAAA,MACA;AAAA,MACA,+HAA+H,MAAM,SAAS,GAAG,CAAC;AAAA,MAClJ,WAAW,MAAM,OAAO,CAAC,wBAAwB,MAAM,MAAM,CAAC;AAAA,MAC9D;AAAA,IACF,EAAE,KAAK,IAAI;AACX,QAAI;AACF,UAAI,uBAAuB,MAAMK,KAAI,YAAY,CAAC,MAAM,EAAG;AAAA,IAC7D,QAAQ;AAAA,IAER;AAEA,YAAQ,KAAK,8EAA8E;AAAA,MACzF;AAAA,IACF,CAAC;AAAA,EACH,WAAW,uBAAuB,MAAMA,KAAI,WAAW,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG;AAC1F;AAAA,EACF;AACA,QAAM,SAAS,QAAQ,eAAe,KAAK;AAC3C,MAAI,CAAC;AACH,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AACF,QAAM,QAAQ,GAAGJ,OAAM,QAAQ,SAAS,CAAC,UAAUK,YAAW,CAAC;AAC/D,MAAI;AACJ,MAAI;AACF,UAAM,OAAO,WAAW;AAAA,MACtB,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM,IAAI,2BAA2B,MAAM,CAAC;AAAA,IAC9C,CAAC;AACD,UAAM,SAAS,MAAMD;AAAA,MACnB,WAAW,MAAM,OAAO,CAAC,IAAI,MAAM,KAAK,CAAC,eAAe,MAAM,MAAM,CAAC;AAAA,IACvE;AACA,QAAI,uBAAuB,MAAM,MAAM,GAAG;AACxC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,0BAAsB,EAAE,MAAM;AAAA,EAChC;AACA,MAAI;AACF,UAAM,OAAO,WAAW,EAAE,MAAM,eAAe,MAAM,MAAM,CAAC;AAAA,EAC9D,QAAQ;AAGN,QAAI;AACF,YAAM,UAAU,MAAMA;AAAA,QACpB,WAAW,MAAM,6BAA6B,KAAK,UAAU,KAAK,CAAC,kBAAkB,CAAC;AAAA,MACxF;AACA,UAAI,uBAAuB,OAAO,MAAM,GAAG;AACzC,cAAM,IAAI,MAAM,6BAA6B;AAAA,MAC/C;AAAA,IACF,QAAQ;AAKN,UAAI;AACF,gBAAQ;AAAA,UACN;AAAA,UACA;AAAA,YACE,WAAWJ,OAAM,SAAS,KAAK;AAAA,YAC/B,cAAc,sBAAsB,WAAW;AAAA,UACjD;AAAA,QACF;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACA,MAAI,oBAAqB,OAAM,oBAAoB;AACrD;AAEO,SAAS,iCAAiC,WAA6B;AAC5E,SAAO;AAAA;AAAA;AAAA,IAGL;AAAA,IACA,iBAAiB,MAAM,SAAS,CAAC;AAAA,IACjC,4CAA4C,MAAM,GAAG,SAAS,aAAa,CAAC;AAAA,IAC5E;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;ADhPA,IAAM,gCAAgC;AAE/B,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAASM,YAAW,OAAuB;AACzC,SAAO,IAAI,MAAM,QAAQ,MAAM,OAAO,CAAC;AACzC;AAEA,SAAS,wBAAwB,WAA2B;AAC1D,MACE,CAAC,aACD,UAAU,KAAK,MAAM,aACrB,IAAI,YAAY,EAAE,OAAO,SAAS,EAAE,aAAa,iCACjD,UAAU,SAAS,IAAI,GACvB;AACA,UAAM,IAAI,uBAAuB,gCAAgC;AAAA,EACnE;AACA,SAAO;AACT;AAEA,SAAS,uBAAuB,OAAe,OAAuB;AACpE,MAAI,CAAC,SAAS,MAAM,SAAS,IAAI,KAAK,CAACC,WAAU,WAAW,KAAK,GAAG;AAClE,UAAM,IAAI,uBAAuB,GAAG,KAAK,mBAAmB;AAAA,EAC9D;AACA,SAAOA,WAAU,UAAU,KAAK;AAClC;AAEO,SAAS,kBAAkB,OAAuB;AACvD,SAAOD,YAAW,uBAAuB,OAAO,qBAAqB,CAAC;AACxE;AAYO,SAAS,4BAA4B,mBAA2B,WAA2B;AAChG,QAAM,yBAAyB;AAAA,IAC7B;AAAA,IACA;AAAA,EACF;AACA,QAAM,SAASE,YAAW,QAAQ,EAAE,OAAO,wBAAwB,SAAS,CAAC,EAAE,OAAO,KAAK;AAC3F,SAAOD,WAAU,KAAKA,WAAU,QAAQ,sBAAsB,GAAG,mBAAmB,MAAM;AAC5F;AAEO,SAAS,iCACd,aACA,WACQ;AACR,QAAM,oBACJ,YAAY,gCACZ,GAAG,YAAY,QAAQ,YAAY;AACrC,SAAO,4BAA4B,mBAAmB,SAAS;AACjE;AAWO,SAAS,6BACd,KACA,WACA,aACA,iBACQ;AACR,SAAO;AAAA,IACL,uCAAuC,kBAAkB,SAAS,CAAC;AAAA,IACnE,GAAI,cAAc,CAAC,gCAAgCD,YAAW,WAAW,CAAC,EAAE,IAAI,CAAC;AAAA,IACjF,GAAI,kBAAkB,iCAAiC,eAAe,IAAI,CAAC;AAAA,IAC3E;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAGO,SAAS,yBACd,SACA,WACA,aACA,iBACG;AACH,SAAO,IAAI,MAAM,SAAS;AAAA,IACxB,IAAI,QAAQ,UAAU,UAAU;AAC9B,UAAI,aAAa,UAAU,aAAa,eAAe;AACrD,cAAM,UAAU,QAAQ,IAAI,QAAQ,UAAU,MAAM;AAGpD,YAAI,CAAC,QAAS,QAAO;AACrB,eAAO,OAAO,SAA0B,aACtC,MAAM,QAAQ;AAAA,UACZ;AAAA,UACA;AAAA,YACE,GAAG;AAAA,YACH,KAAK,6BAA6B,KAAK,KAAK,WAAW,aAAa,eAAe;AAAA,UACrF;AAAA,UACA,GAAG;AAAA,QACL;AAAA,MACJ;AACA,YAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,QAAQ;AACpD,aAAO,OAAO,UAAU,aAAa,MAAM,KAAK,MAAM,IAAI;AAAA,IAC5D;AAAA,EACF,CAAC;AACH;AAGO,SAAS,wBACd,QACA,WACA,aACA,iBACe;AACf,QAAM,YAAY,oBAAI,QAAoC;AAC1D,QAAM,OAAO,CAA+B,YAAkB;AAC5D,UAAM,WAAW,UAAU,IAAI,OAAO;AACtC,QAAI,SAAU,QAAO;AACrB,UAAM,UAAU,yBAAyB,SAAS,WAAW,aAAa,eAAe;AACzF,cAAU,IAAI,SAAS,OAAO;AAC9B,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,WAAW,OAAO;AAAA,IAClB,GAAI,OAAO,2BAA2B,SAClC,EAAE,wBAAwB,OAAO,uBAAuB,IACxD,CAAC;AAAA,IACL,GAAI,OAAO,SACP,EAAE,QAAQ,UAAU,SAAgB,KAAK,MAAO,OAAO,OAAe,GAAG,IAAI,CAAC,EAAE,IAChF,CAAC;AAAA,IACL,GAAI,OAAO,SACP,EAAE,QAAQ,UAAU,SAAgB,KAAK,MAAO,OAAO,OAAe,GAAG,IAAI,CAAC,EAAE,IAChF,CAAC;AAAA,IACL,GAAI,OAAO,SACP,EAAE,QAAQ,OAAO,UAA+B,MAAM,OAAO,OAAQ,KAAK,EAAE,IAC5E,CAAC;AAAA,IACL,GAAI,OAAO,wBACP;AAAA,MACE,uBAAuB,OAAO,OAA4B,YACxD,MAAM,OAAO,sBAAuB,OAAO,OAAO;AAAA,IACtD,IACA,CAAC;AAAA,IACL,GAAI,OAAO,8BACP;AAAA,MACE,6BAA6B,OAAO,UAClC,MAAM,OAAO,4BAA6B,KAAK;AAAA,IACnD,IACA,CAAC;AAAA,IACL,GAAI,OAAO,gCACP;AAAA,MACE,+BAA+B,OAAO,UACpC,MAAM,OAAO,8BAA+B,KAAK;AAAA,IACrD,IACA,CAAC;AAAA,IACL,GAAI,OAAO,0BACP;AAAA,MACE,yBAAyB,OAAO,UAC9B,MAAM,OAAO,wBAAyB,KAAK;AAAA,IAC/C,IACA,CAAC;AAAA,EACP;AACF;;;AEvLA,SAAS,yCAAwD;AACjE,SAAS,gCAAgC;AAElC,IAAM,6BAA6B,KAAK;AA6B/C,eAAsB,yBACpB,UACA,OACA,WACA,QAAQ,KAAK,IAAI,GACgC;AACjD,QAAM,mBAAmB,kCAAkC,QAAQ;AACnE,MAAI,CAAC,iBAAkB,QAAO;AAC9B,QAAM,mBAAmB,KAAK,MAAM,QAAQ,GAAI,IAAI;AACpD,QAAM,QAAQ,MAAM,yBAAyB,kBAAkB;AAAA,IAC7D,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,WAAW,WAAW,UAAU,SAAS;AAAA,IACzC,cAAc;AAAA,IACd,aAAa,CAAC,eAAe;AAAA,IAC7B,WAAW,UAAU;AAAA,IACrB,QAAQ,UAAU;AAAA,IAClB,WAAW,UAAU;AAAA,IACrB,qBAAqB,UAAU;AAAA,IAC/B,GAAI,UAAU,wBACV,EAAE,uBAAuB,UAAU,sBAAsB,IACzD,CAAC;AAAA,IACL,GAAI,UAAU,qBAAqB,EAAE,oBAAoB,UAAU,mBAAmB,IAAI,CAAC;AAAA,IAC3F,eAAe;AAAA,IACf,KAAK;AAAA,EACP,CAAC;AACD,SAAO,EAAE,OAAO,WAAW,IAAI,KAAK,mBAAmB,GAAI,EAAE;AAC/D;;;ACnCA,SAAS,uBAAAG,4BAA2B;AAOpC,IAAM,sBAAsB;AAC5B,IAAM,oBAAoB;AAC1B,IAAM,oBAAoB;AAC1B,IAAM,qBAAuC,CAAC,MAAM,GAAG;AAEvD,IAAM,gBAAgB;AACtB,IAAM,gBAAgB;AAEf,SAAS,oBAAoB,OAA6C;AAC/E,SAAO,UAAU,aAAa,eAAe;AAC/C;AACO,SAAS,YAAY,OAA+B;AACzD,SAAO,UAAU,aAAa,SAAS;AACzC;AAGO,IAAM,4BAAN,cAAwC,MAAM;AAAA,EACnD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YACE,SACS,QACT;AACA,UAAM,OAAO;AAFJ;AAGT,SAAK,OAAO;AAAA,EACd;AACF;AA0BA,SAAS,IAAI,GAAmB;AAC9B,SAAO,IAAI,EAAE,QAAQ,MAAM,OAAO,CAAC;AACrC;AAEA,SAAS,aAAa,QAAyC;AAC7D,MAAI,OAAO,WAAW,SAAU,QAAO;AACvC,SAAO,CAAC,OAAO,QAAQ,OAAO,QAAQ,OAAO,MAAM,EAChD,OAAO,CAAC,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS,CAAC,EAChE,KAAK,IAAI;AACd;AAGA,IAAM,4BAA4B;AAElC,eAAe,IACb,SACA,KACA,OACA,cAAc,eACd,kBAAkB,2BACD;AACjB,QAAM,OAKF,EAAE,KAAK,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC,GAAI,aAAa,gBAAgB;AACrE,MAAI,OAAO,QAAQ,SAAS,YAAY;AACtC,WAAO,aAAa,MAAM,QAAQ,KAAK,IAAI,CAAC;AAAA,EAC9C;AACA,MAAI,OAAO,QAAQ,gBAAgB,YAAY;AAC7C,WAAO,aAAa,MAAM,QAAQ,YAAY,IAAI,CAAC;AAAA,EACrD;AACA,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAMA,SAAS,gBAAgB,KAAqB;AAC5C,QAAM,SAAS,IAAI,YAAY,aAAa;AAC5C,MAAI,UAAU,EAAG,QAAO,IAAI,MAAM,SAAS,cAAc,MAAM;AAC/D,MAAI,IAAI,WAAW,WAAW,EAAG,QAAO,IAAI,MAAM,YAAY,MAAM;AACpE,SAAO;AACT;AAgCA,eAAsB,eACpB,SACA,OAC2B;AAC3B,QAAM,IAAI;AACV,QAAM,QAAQ,MAAM,SAAS;AAC7B,QAAM,aAAa,MAAM,cAAc;AACvC,QAAM,YAAY,MAAM,aAAa;AACrC,QAAM,aAAa,MAAM,cAAc;AACvC,QAAM,UAAU,MAAM,WAAW;AACjC,QAAM,MAAM,MAAM,UAAU;AAC5B,QAAM,MAAM,YAAY,KAAK;AAC7B,QAAM,UAAU,GAAG,GAAG,WAAW,MAAM,WAAW,IAAI,GAAG;AACzD,QAAM,UAAU,GAAG,GAAG,WAAW,MAAM,WAAW;AAClD,QAAM,UAAU,GAAG,GAAG,WAAW,MAAM,WAAW;AAClD,QAAM,CAAC,GAAG,CAAC,IAAI;AACf,QAAM,MACJ,UAAU,aACN,6CACA;AACN,QAAM,SACJ,iFAAiF,SAAS,gBAC3E,CAAC,IAAI,CAAC,OAAO,OAAO,SAAS,UAAU,IAAI,GAAG,IAAI,OAAO,gBACzD,OAAO,qBAAqB,OAAO;AACpD,QAAM,IAAI,GAAG,YAAY,IAAI,MAAM,CAAC,IAAI,MAAM,KAAK;AACnD,SAAO;AAAA,IACL,aAAa,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,KAAK,IAAI;AAAA,IACpB;AAAA,IACA,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,EAC9C;AACF;AAOA,eAAsB,cAAc,SAAkB,MAAuC;AAC3F,QAAM,IAAI;AACV,QAAM,OAAO,oBAAoB,KAAK,OAAO,2DAA2D,KAAK,OAAO;AACpH,QAAM,IAAI,GAAG,YAAY,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,aAAa,EAAE,MAAM,MAAM,MAAS;AACxF;AAYA,eAAsB,yBACpB,SACA,MACA,WAAW,mBACyB;AACpC,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,SAAS,cAAc,OAAO,EAAE,gBAAgB,YAAY;AACvE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WACJ,MAAM;AAAA,IACJ;AAAA,IACA,YAAY,IAAI,cAAc,KAAK,OAAO,8BAA8B,CAAC;AAAA,IACzE,KAAK;AAAA,EACP,GACA,KAAK;AACP,QAAM,WACJ,QACG,MAAM,IAAI,EACV,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO,EACd,IAAI,KAAK;AACd,MAAI,aAAa,aAAa,aAAa,IAAI;AAC7C,UAAM,IAAI,eAAe,kCAAkC,KAAK,OAAO,IAAI,WAAW;AAAA,EACxF;AACA,QAAM,OAAO,OAAO,QAAQ;AAC5B,MAAI,CAAC,OAAO,SAAS,IAAI,KAAK,QAAQ,GAAG;AACvC,UAAM,IAAI,eAAe,gCAAgC,KAAK,OAAO,IAAI,cAAc;AAAA,EACzF;AACA,MAAI,OAAO,UAAU;AACnB,UAAM,IAAI,eAAe,aAAa,IAAI,iBAAiB,QAAQ,KAAK,oBAAoB;AAAA,EAC9F;AACA,SAAO;AAAA,IACL,aAAa,oBAAoB,KAAK,KAAK;AAAA,IAC3C,WAAW;AAAA,IACX,iBAAiB,KAAK,IAAI,GAAG,KAAK,OAAO,KAAK,IAAI,IAAI,KAAK,aAAa,GAAI,CAAC;AAAA,EAC/E;AACF;AAEA,IAAM,sBAAsB;AAC5B,IAAM,+BAA+B;AASrC,eAAsB,wBACpB,SACA,MACA,OAMoC;AACpC,QAAM,aAAa,MAAM,cAAc;AACvC,MAAI,CAAC,OAAO,cAAc,UAAU,KAAK,cAAc,KAAK,aAAa,KAAK;AAC5E,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,QAAM,WAAW,MAAM,yBAAyB,SAAS,MAAM,MAAM,QAAQ;AAC7E,QAAM,UAAU,OAAO,QAAQ,MAAM,eAAe,EACjD,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,cAAc,KAAK,CAAC,EACnD,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,YAAY,IAAI,GAAG,IAAI,KAAK,KAAK,EAAE,CAAC,EAAE,EAC7D,KAAK,GAAG;AACX,QAAM,SAAS;AAAA,IACb;AAAA,IACA,qEAAqE,UAAU,kBAAkB,OAAO,kBAAkB,IAAI,KAAK,OAAO,CAAC,IAAI,IAAI,MAAM,GAAG,CAAC;AAAA,IAC7J,WAAW,mBAAmB;AAAA,EAChC,EAAE,KAAK,IAAI;AACX,QAAM,SAAS;AAAA,IACb,MAAM;AAAA,MACJ;AAAA,MACA,YAAY,IAAI,MAAM,CAAC;AAAA,MACvB,KAAK;AAAA,OACJ,aAAa,MAAM;AAAA,IACtB;AAAA,EACF;AACA,MAAI,CAAC,OAAO,SAAS,mBAAmB,GAAG;AACzC,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACA,SAAO;AACT;AAMA,eAAsB,yBACpB,SACA,MACe;AACf,QAAM,IAAI;AACV,QAAM,UAAU,KAAK,QAAQ,QAAQ,iBAAiB,MAAM;AAC5D,QAAM,IAAI,GAAG,SAAS,KAAK,OAAO,IAAI,KAAK,OAAO,IAAI,OAAO,IAAI,KAAK,KAAK,EAAE;AAAA,IAC3E,MAAM;AAAA,EACR;AACF;AAGO,SAAS,oBACd,aACA,WACA,aACA,OACQ;AACR,SAAO,cAAc,WAAW,IAAI,SAAS,IAAI,WAAW,IAAI,YAAY,KAAK,CAAC;AACpF;;;ACzQO,IAAM,iCAAiC;AAevC,SAAS,mBAAmB,OAMP;AAC1B,QAAM,EAAE,WAAW,IAAI;AACvB,MAAI,CAAC,cAAc,WAAW,WAAW,UAAU;AACjD,WAAO,EAAE,OAAO,WAAW,WAAW,OAAO,YAAY,MAAM;AAAA,EACjE;AACA,QAAM,YAAY,WAAW,aAAa,mBAAmB,WAAW;AACxE,QAAM,aAAa,WAAW;AAO9B,MAAI,WAAW,eAAe;AAC5B,WAAO,EAAE,OAAO,WAAW,WAAW,WAAW;AAAA,EACnD;AACA,MAAI,MAAM,gBAAgB;AACxB,WAAO,EAAE,OAAO,UAAU,WAAW,WAAW;AAAA,EAClD;AAEA,QAAM,OAAO,MAAM,OAAO,oBAAI,KAAK,GAAG,QAAQ;AAC9C,QAAM,WAAW,WAAW,aAAa,IAAI,KAAK,WAAW,UAAU,EAAE,QAAQ,IAAI;AACrF,MAAI,aAAa,QAAQ,MAAM,YAAY,gCAAgC;AACzE,WAAO,EAAE,OAAO,gBAAgB,WAAW,WAAW;AAAA,EACxD;AACA,SAAO,EAAE,OAAO,WAAW,WAAW,WAAW;AACnD;AAQO,SAAS,4BAA4B,OAGhB;AAC1B,QAAM,EAAE,WAAW,IAAI;AACvB,MAAI,CAAC,cAAc,WAAW,WAAW,UAAU;AACjD,WAAO,EAAE,OAAO,WAAW,WAAW,OAAO,YAAY,MAAM;AAAA,EACjE;AACA,QAAM,MAAM,MAAM,OAAO,oBAAI,KAAK;AAClC,QAAM,WAAW,WAAW,aAAa,IAAI,KAAK,WAAW,UAAU,EAAE,QAAQ,IAAI;AACrF,QAAM,iBACJ,aAAa,QAAQ,IAAI,QAAQ,IAAI,YAAY;AACnD,SAAO,mBAAmB;AAAA,IACxB;AAAA,IACA,gBAAgB;AAAA,IAChB;AAAA,EACF,CAAC;AACH;AAgCA,eAAsB,gCACpB,OAC8B;AAC9B,QAAM,iBACJ,MAAM,mBAAmB,MAAM,UAAU,MAAM,MAAM,QAAQ,KAAK,IAAI;AACxE,QAAM,WAAW,mBAAmB;AAAA,IAClC,YAAY,MAAM;AAAA,IAClB;AAAA,IACA,GAAI,MAAM,MAAM,EAAE,KAAK,MAAM,IAAI,IAAI,CAAC;AAAA,EACxC,CAAC;AAMD,QAAM,eACJ,SAAS,UAAU,WAAW,SAAS;AACzC,QAAM,OAA2B;AAAA,IAC/B,WAAW,MAAM;AAAA,IACjB,SAAS;AAAA,IACT,IAAI,MAAM,MAAM;AAAA,IAChB,UAAU;AAAA,IACV,YAAY,MAAM;AAAA,IAClB,gBAAgB,MAAM,kBAAkB;AAAA,IACxC,oBAAoB,MAAM,sBAAsB;AAAA,IAChD,iBAAiB,MAAM,mBAAmB;AAAA,IAC1C,4BAA4B,MAAM,8BAA8B;AAAA,IAChE,GAAI,MAAM,wBAAwB,SAC9B,EAAE,qBAAqB,MAAM,oBAAoB,IACjD,CAAC;AAAA,IACL,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IAC7D,GAAI,MAAM,qBAAqB,SAAY,EAAE,kBAAkB,MAAM,iBAAiB,IAAI,CAAC;AAAA,IAC3F,GAAI,MAAM,MAAM,EAAE,KAAK,MAAM,IAAI,IAAI,CAAC;AAAA,EACxC;AACA,QAAM,aAAa,sBAAsB,IAAI;AAC7C,QAAM,OAA4B;AAAA,IAChC,GAAG;AAAA,IACH,YAAY;AAAA,MACV,GAAG,WAAW;AAAA,MACd,MAAM,MAAM,YAAY,iBAAiB;AAAA,IAC3C;AAAA,EACF;AAQA,MAAI,SAAS,UAAU,UAAU;AAC/B,UAAM,SACJ,SAAS,UAAU,YAAY,kBAAkB;AACnD,WAAO;AAAA,MACL,GAAG;AAAA,MACH,YAAY,EAAE,GAAG,KAAK,YAAY,WAAW,OAAO,UAAU,MAAM,OAAO;AAAA,MAC3E,UAAU;AAAA,QACR,GAAG,KAAK;AAAA,QACR,WAAW;AAAA,QACX,KAAK;AAAA,QACL,OAAO;AAAA,QACP,WAAW;AAAA,QACX;AAAA,MACF;AAAA,MACA,KAAK,EAAE,GAAG,KAAK,KAAK,WAAW,OAAO,OAAO;AAAA,MAC7C,eAAe;AAAA,QACb,GAAG,KAAK;AAAA,QACR,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,KAAK;AAAA,QACL,OAAO;AAAA,QACP,WAAW;AAAA,QACX,wBAAwB;AAAA,QACxB,cAAc;AAAA,QACd,QAAQ;AAAA,QACR,kBAAkB,CAAC;AAAA,QACnB;AAAA,MACF;AAAA,MACA,WAAW,EAAE,GAAG,KAAK,WAAW,WAAW,OAAO,OAAO,CAAC,GAAG,QAAQ,CAAC,GAAG,OAAO;AAAA,IAClF;AAAA,EACF;AAgBA,MAAI,CAAC,SAAS,YAAY;AACxB,UAAM,SAAsC;AAC5C,WAAO;AAAA,MACL,GAAG;AAAA,MACH,eACE,KAAK,cAAc,cAAc,OAC7B;AAAA,QACE,GAAG,KAAK;AAAA,QACR,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,KAAK;AAAA,QACL,OAAO;AAAA,QACP,WAAW;AAAA,QACX,wBAAwB;AAAA,QACxB,cAAc;AAAA,QACd,QAAQ;AAAA,QACR,kBAAkB,CAAC;AAAA,QACnB;AAAA,MACF,IACA,KAAK;AAAA,MACX,WAAW,KAAK,UAAU,YACtB,EAAE,GAAG,KAAK,WAAW,WAAW,OAAO,OAAO,CAAC,GAAG,QAAQ,CAAC,GAAG,OAAO,IACrE,KAAK;AAAA,IACX;AAAA,EACF;AAEA,MAAI,CAAC,SAAS,WAAW;AAIvB,WAAO;AAAA,MACL,GAAG;AAAA,MACH,eACE,KAAK,cAAc,cAAc,OAC7B,EAAE,GAAG,KAAK,eAAe,MAAM,YAAY,IAC3C,KAAK;AAAA,IACb;AAAA,EACF;AAIA,SAAO;AACT;;;AClTA;AAAA,EAIE,aAAAC;AAAA,EACA;AAAA,OAOK;AAGP,IAAM,UAAU,IAAI,YAAY;AAChC,IAAM,UAAU,IAAI,YAAY;AA8BzB,IAAM,qBAAN,MAA+C;AAAA,EAC5C;AAAA,EACS;AAAA,EACA;AAAA,EACA,QAAQ,oBAAI,IAAwB;AAAA,EACpC;AAAA,EACR;AAAA;AAAA,EAGA,WAA4D,CAAC;AAAA,EAEtE,YAAY,OAAkC,CAAC,GAAG;AAChD,SAAK,SAAS,KAAK,UAAU;AAC7B,SAAK,YAAY,KAAK,aAAa;AACnC,SAAK,WAAW,KAAK,YAAY;AACjC,SAAK,WAAW,KAAK,YAAY;AACjC,SAAK,cAAc,KAAK,SAAS,CAAC,QAAQ,YAAY,KAAK,KAAK,QAAQ;AACxE,eAAW,CAAC,MAAM,OAAO,KAAK,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,GAAG;AAC9D,WAAK,MAAM;AAAA,QACT,UAAU,IAAI;AAAA,QACd,OAAO,YAAY,WAAW,QAAQ,OAAO,OAAO,IAAI;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,UAAU,QAAuB;AAC/B,SAAK,SAAS;AAAA,EAChB;AAAA;AAAA,EAGA,SAAS,MAAkC;AACzC,UAAM,QAAQ,KAAK,MAAM,IAAI,UAAU,IAAI,CAAC;AAC5C,WAAO,QAAQ,QAAQ,OAAO,KAAK,IAAI;AAAA,EACzC;AAAA;AAAA,EAGA,MAAM,QAAQ,KAAyC;AACrD,WAAO,MAAM,KAAK,YAAY,GAAG;AAAA,EACnC;AAAA,EAEA,MAAM,QACJ,SACA,KACA,OAC0B;AAC1B,SAAK,SAAS,KAAK,EAAE,SAAS,IAAI,CAAC;AACnC,QAAI,CAAC,KAAK,QAAQ;AAChB,aAAO;AAAA,QACL,IAAI;AAAA,QACJA,WAAU;AAAA,QACV;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,KAAK,UAAU;AACjB,aAAO;AAAA,QACL,IAAI;AAAA,QACJA,WAAU;AAAA,QACV;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,KAAK,IAAI;AACf,QAAI,CAAC,IAAI;AACP,aAAO,cAAc,IAAI,WAAWA,WAAU,qBAAqB,YAAY,KAAK;AAAA,IACtF;AACA,UAAM,eAAe,QAAQ,MAAM,GAAG;AACtC,UAAM,cAAc,aAAa,CAAC,KAAK;AACvC,UAAM,UAAU,aAAa,CAAC,KAAK;AACnC,YAAQ,GAAG,OAAO;AAAA,MAChB,KAAK;AACH,eAAO,GAAG,IAAI,WAAW;AAAA,UACvB,OAAO;AAAA,UACP,MAAM,EAAE,OAAO,GAAG,KAAK,OAAO,kBAAkB,KAAK,qBAAqB,CAAC,EAAE;AAAA,QAC/E,CAAC;AAAA,MACH,KAAK,UAAU;AACb,cAAM,QAAQ,KAAK,MAAM,IAAI,UAAU,GAAG,OAAO,IAAI,CAAC;AACtD,YAAI,CAAC,OAAO;AACV,iBAAO;AAAA,YACL,IAAI;AAAA,YACJA,WAAU;AAAA,YACV,iBAAiB,GAAG,OAAO,IAAI;AAAA,YAC/B;AAAA,UACF;AAAA,QACF;AACA,cAAM,MAAsB,EAAE,SAAS,OAAO,WAAW,OAAO,MAAM,MAAM,EAAE;AAC9E,eAAO,GAAG,IAAI,WAAW,EAAE,OAAO,UAAU,QAAQ,IAAI,CAAC;AAAA,MAC3D;AAAA,MACA,KAAK,WAAW;AACd,cAAM,OAAO,UAAU,GAAG,QAAQ,IAAI;AACtC,cAAM,OAAO,GAAG,QAAQ,SACpB,OAAO,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,WAAW,CAAC,GAAG,GAAG,QAAQ,OAAO,IACpE,GAAG,QAAQ;AACf,aAAK,MAAM,IAAI,MAAM,IAAI;AACzB,cAAM,MAAuB,EAAE,cAAc,OAAO,GAAG,QAAQ,QAAQ,MAAM,EAAE;AAC/E,eAAO,GAAG,IAAI,WAAW,EAAE,OAAO,WAAW,SAAS,IAAI,CAAC;AAAA,MAC7D;AAAA,MACA,KAAK,YAAY;AACf,cAAM,OAAO,UAAU,GAAG,SAAS,IAAI;AACvC,YAAI,CAAC,KAAK,MAAM,OAAO,IAAI,GAAG;AAC5B,iBAAO;AAAA,YACL,IAAI;AAAA,YACJA,WAAU;AAAA,YACV,iBAAiB,GAAG,SAAS,IAAI;AAAA,YACjC;AAAA,UACF;AAAA,QACF;AACA,eAAO,GAAG,IAAI,WAAW,EAAE,OAAO,YAAY,UAAU,CAAC,EAAE,CAAC;AAAA,MAC9D;AAAA,MACA,KAAK,UAAU;AACb,cAAM,SAAS,UAAU,GAAG,OAAO,IAAI,EAAE,QAAQ,QAAQ,GAAG;AAC5D,cAAM,MAAsB;AAAA,UAC1B,SAAS,CAAC,GAAG,KAAK,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,MAAM,EAAE,WAAW,MAAM,CAAC,EAClC,IAAI,CAAC,MAAM;AACV,kBAAM,QAAQ,KAAK,MAAM,IAAI,CAAC;AAC9B,kBAAM,MAAM,EAAE,MAAM,OAAO,MAAM;AACjC,mBAAO;AAAA,cACL,MAAM,IAAI,MAAM,GAAG,EAAE,IAAI,KAAK;AAAA,cAC9B,MAAM;AAAA,cACN,MAAM,YAAY;AAAA,cAClB,MAAM,OAAO,MAAM,MAAM;AAAA,cACzB,YAAY;AAAA,cACZ,MAAM;AAAA,YACR;AAAA,UACF,CAAC;AAAA,QACL;AACA,eAAO,GAAG,IAAI,WAAW,EAAE,OAAO,UAAU,QAAQ,IAAI,CAAC;AAAA,MAC3D;AAAA,MACA,KAAK,UAAU;AACb,cAAM,QAAQ,KAAK,MAAM,IAAI,UAAU,GAAG,OAAO,IAAI,CAAC;AACtD,cAAM,MAAsB,QACxB;AAAA,UACE,QAAQ;AAAA,UACR,OAAO;AAAA,YACL,MAAM,UAAU,GAAG,OAAO,IAAI,EAAE,MAAM,GAAG,EAAE,IAAI,KAAK;AAAA,YACpD,MAAM,GAAG,OAAO;AAAA,YAChB,MAAM,YAAY;AAAA,YAClB,MAAM,OAAO,MAAM,MAAM;AAAA,YACzB,YAAY;AAAA,YACZ,MAAM;AAAA,UACR;AAAA,QACF,IACA,EAAE,QAAQ,OAAO,OAAO,OAAU;AACtC,eAAO,GAAG,IAAI,WAAW,EAAE,OAAO,UAAU,QAAQ,IAAI,CAAC;AAAA,MAC3D;AAAA,MACA,KAAK,iBAAiB;AAOpB,eAAO,GAAG,IAAI,WAAW;AAAA,UACvB,OAAO;AAAA,UACP,eAAe;AAAA,YACb,SAAS;AAAA,cACP,WAAW;AAAA,cACX;AAAA,cACA;AAAA,cACA,MAAM;AAAA,cACN,MAAM;AAAA,YACR;AAAA,YACA,SAAS,EAAE,IAAI,OAAO,OAAO,MAAM,QAAQ,KAAK,SAAS,KAAK;AAAA,UAChE;AAAA,QACF,CAAC;AAAA,MACH;AAAA,MACA,KAAK,WAAW;AAId,eAAO,GAAG,IAAI,WAAW;AAAA,UACvB,OAAO;AAAA,UACP,SAAS;AAAA,YACP,OAAO;AAAA,YACP,SAAS,EAAE,WAAW,YAAY,aAAa,SAAS,MAAM,GAAG,MAAM,KAAK;AAAA,UAC9E;AAAA,QACF,CAAC;AAAA,MACH;AAAA,MACA,KAAK;AACH,eAAO,GAAG,IAAI,WAAW;AAAA,UACvB,OAAO;AAAA,UACP,sBAAsB,EAAE,MAAM,OAAQ,mBAAmB,iBAAiB;AAAA,QAC5E,CAAC;AAAA,MACH,KAAK,qBAAqB;AACxB,eAAO,GAAG,IAAI,WAAW;AAAA,UACvB,OAAO;AAAA,UACP,mBAAmB;AAAA,YACjB,SAAS;AAAA,cACP,WAAW,gBAAgB,GAAG,kBAAkB,QAAQ;AAAA,cACxD;AAAA,cACA;AAAA,cACA,MAAM;AAAA,cACN,MAAM;AAAA,YACR;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH;AAAA,MACA,KAAK,sBAAsB;AACzB,eAAO,GAAG,IAAI,WAAW;AAAA,UACvB,OAAO;AAAA,UACP,oBAAoB;AAAA,YAClB,SAAS;AAAA,cACP,WAAW,iBAAiB,GAAG,mBAAmB,QAAQ;AAAA,cAC1D;AAAA,cACA;AAAA,cACA,MAAM;AAAA,cACN,MAAM;AAAA,YACR;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH;AAAA,MACA;AACE,eAAO;AAAA,UACL,IAAI;AAAA,UACJA,WAAU;AAAA,UACV,2BAA2B,GAAG,KAAK;AAAA,UACnC;AAAA,QACF;AAAA,IACJ;AAAA,EACF;AACF;AAEA,SAAS,YAAY,KAAkB,UAAgC;AACrE,QAAM,SAAS,IAAI,QAAQ,KAAK,GAAG;AACnC,QAAM,SAAS,oBAAoB,KAAK,MAAM,IAAI,WAAW;AAC7D,SAAO;AAAA,IACL,UAAU;AAAA,IACV,QAAQ,QAAQ,OAAO,GAAG,MAAM;AAAA,CAAI;AAAA,IACpC,QAAQ,IAAI,WAAW,CAAC;AAAA,IACxB,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,2BAA2B;AAAA,EAC7B;AACF;AAEA,SAAS,GAAGC,YAAmB,QAAiE;AAC9F,SAAO,EAAE,WAAAA,YAAW,OAAO,QAAW,OAAO;AAC/C;AAEA,SAAS,cACPA,YACA,MACA,SACA,WACiB;AACjB,QAAM,QAAoB,EAAE,MAAM,SAAS,WAAW,QAAQ,CAAC,EAAE;AACjE,SAAO,EAAE,WAAAA,YAAW,OAAO,QAAQ,OAAU;AAC/C;AAEA,SAAS,UAAU,MAAsB;AAEvC,QAAM,UAAU,KAAK,QAAQ,QAAQ,EAAE;AACvC,SAAO,QAAQ,WAAW,GAAG,IAAI,UAAU,IAAI,OAAO;AACxD;AAEA,SAAS,OAAO,GAAe,GAA2B;AACxD,QAAM,MAAM,IAAI,WAAW,EAAE,SAAS,EAAE,MAAM;AAC9C,MAAI,IAAI,GAAG,CAAC;AACZ,MAAI,IAAI,GAAG,EAAE,MAAM;AACnB,SAAO;AACT;;;AC5SA,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B;AAAA,EAGE,aAAAC;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAKK;AAgBA,IAAM,4BAAN,MAA6D;AAAA,EAClE,YAAY;AAAA,EACH,YAA6D,CAAC;AAAA,EACvE;AAAA,EACiB,WAAW,oBAAI,IAAgD;AAAA,EAEhF,MAAM,UACJ,SACA,WAC+B;AAC/B,QAAI,CAAC,KAAK,WAAW;AACnB,YAAM,IAAI,yBAAyB,wCAAwC;AAAA,IAC7E;AACA,QAAI,MAAM,KAAK,SAAS,IAAI,OAAO;AACnC,QAAI,CAAC,KAAK;AACR,YAAM,oBAAI,IAAI;AACd,WAAK,SAAS,IAAI,SAAS,GAAG;AAAA,IAChC;AACA,QAAI,IAAI,SAAS;AACjB,WAAO;AAAA,MACL,aAAa,MAAM;AACjB,YAAI,OAAO,SAAS;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,SAAiB,SAAoC;AACjE,QAAI,CAAC,KAAK,WAAW;AACnB,YAAM,IAAI,yBAAyB,wCAAwC;AAAA,IAC7E;AACA,SAAK,UAAU,KAAK,EAAE,SAAS,QAAQ,CAAC;AACxC,SAAK,YAAY,SAAS,OAAO;AAAA,EACnC;AAAA;AAAA,EAGA,QAAQ,SAAiB,SAA2B;AAClD,eAAW,WAAW,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,GAAG;AACtD,cAAQ,OAAO;AAAA,IACjB;AAAA,EACF;AAAA;AAAA,EAGA,cAAuB;AACrB,WAAO,KAAK,UAAU,IAAI,CAAC,EAAE,QAAQ,MAAM,MAAM,OAAO,OAAO,CAAC;AAAA,EAClE;AACF;AAgDA,IAAMC,WAAU,IAAI,YAAY;AAMzB,IAAM,eAAN,MAAyC;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAGA,UAAU,oBAAI,IAA0B;AAAA,EAChD,OAAO,oBAAI,IAAuB;AAAA,EAClC,SAAqD,CAAC;AAAA;AAAA;AAAA,EAGtD,UAAU,oBAAI,IAAY;AAAA;AAAA;AAAA,EAG1B,cAAc,oBAAI,IAAY;AAAA,EACtB,uBAAuB,oBAAI,IAAY;AAAA,EAExD,YAAY,MAMT;AACD,SAAK,YAAY,KAAK;AACtB,SAAK,cAAc,KAAK;AACxB,SAAK,UAAU,KAAK;AACpB,SAAK,uBAAuB,KAAK;AACjC,SAAK,gBAAgB,KAAK;AAC1B,SAAK,UAAU,YAAY,CAAC,UAAU,YAAY,KAAK,MAAM,OAAO;AAAA,EACtE;AAAA;AAAA,EAGA,OAAO,MAAc,QAA4B;AAC/C,SAAK,QAAQ,IAAI,MAAM,MAAM;AAAA,EAC/B;AAAA,EAEQ,MAAM,SAA2B;AACvC,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,OAAO,OAAO;AAAA,IAC5B,QAAQ;AACN;AAAA,IACF;AACA,UAAMC,OAAM,KAAK,KAAK,IAAI,IAAI,IAAI;AAClC,QAAI,CAACA,MAAK;AACR;AAAA,IACF;AAGA,UAAM,aAAa,OAAO,IAAI,gBAAgB;AAC9C,QAAI,eAAe,MAAM,eAAeA,KAAI,mBAAmB;AAC7D;AAAA,IACF;AACA,IAAAA,KAAI,KAAK,KAAK,GAAG;AACjB,QAAI,IAAI,SAAS,OAAO,IAAI,QAAQ,KAAKA,KAAI,SAAS;AACpD,MAAAA,KAAI,aAAa;AAAA,IACnB;AAAA,EACF;AAAA,EAEA,MAAM,QACJ,SACA,KACA,OAC0B;AAC1B,UAAM,uBAAuB,gCAAgC,OAAO;AACpE,QAAI,CAAC,sBAAsB;AACzB,aAAOC;AAAA,QACL,IAAI;AAAA,QACJC,WAAU;AAAA,QACV;AAAA,MACF;AAAA,IACF;AACA,UAAM,KAAK,IAAI;AACf,QAAI,CAAC,IAAI;AACP,aAAOD,eAAc,IAAI,WAAWC,WAAU,qBAAqB,OAAO;AAAA,IAC5E;AACA,YAAQ,GAAG,OAAO;AAAA,MAChB,KAAK;AACH,eAAO,MAAM,KAAK,YAAY,IAAI,WAAW,GAAG,SAAS,oBAAoB;AAAA,MAC/E,KAAK;AACH,eAAO,KAAK;AAAA,UACV,IAAI;AAAA,UACJ,GAAG,SAAS;AAAA,UACZ,OAAO,GAAG,SAAS,OAAO;AAAA,UAC1B,GAAG,SAAS;AAAA,UACZ;AAAA,QACF;AAAA,MACF,KAAK;AACH,eAAO,KAAK,YAAY,IAAI,WAAW,GAAG,QAAQ,MAAM,oBAAoB;AAAA,MAC9E,KAAK;AACH,eAAO,KAAK,aAAa,IAAI,WAAW,GAAG,SAAS,MAAM,oBAAoB;AAAA,MAChF,KAAK;AACH,eAAO,KAAK;AAAA,UACV,IAAI;AAAA,UACJ,GAAG,UAAU;AAAA,UACb,OAAO,GAAG,UAAU,OAAO;AAAA,UAC3B;AAAA,QACF;AAAA,MACF,SAAS;AACP,eAAOD;AAAA,UACL,IAAI;AAAA,UACJC,WAAU;AAAA,UACV,8BAA8B,GAAG,KAAK;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,YACZ,MACA,OACA,sBAC0B;AAC1B,QAAI,KAAK,qBAAqB,IAAI,IAAI,GAAG;AACvC,aAAO,cAAc,MAAM,gBAAgB,IAAI,GAAG,KAAK;AAAA,IACzD;AACA,UAAM,WAAW,KAAK,KAAK,IAAI,IAAI;AACnC,QAAI,UAAU;AACZ,UAAI,SAAS,yBAAyB,sBAAsB;AAC1D,eAAOD;AAAA,UACL;AAAA,UACAC,WAAU;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAGA,eAAS,cAAc;AACvB,aAAO,cAAc,MAAM,KAAK,SAAS,MAAM,QAAQ,CAAC;AAAA,IAC1D;AACA,UAAM,OAAO,MAAM,IAAI,UAAU,SAAS,MAAM,GAAG,OAAO;AAC1D,QAAI,CAAC,MAAM;AACT,aAAOD;AAAA,QACL;AAAA,QACAC,WAAU;AAAA,QACV;AAAA,MACF;AAAA,IACF;AACA,SAAK,OAAO,KAAK,EAAE,MAAM,KAAK,CAAC;AAC/B,UAAM,WAAW,KAAK,QAAQ,IAAI,IAAI,KAAM,MAAM,KAAK,gBAAgB,MAAM,IAAI;AACjF,QAAI,YAAY,CAAC,KAAK,QAAQ,IAAI,IAAI,EAAG,MAAK,QAAQ,IAAI,MAAM,QAAQ;AACxE,UAAM,SAAS,KAAK,QAAQ,IAAI,IAAI;AACpC,QAAI,CAAC,QAAQ;AACX,aAAOD;AAAA,QACL;AAAA,QACAC,WAAU;AAAA,QACV,iCAAiC,IAAI;AAAA,MACvC;AAAA,IACF;AACA,QAAI,OAAO,YAAY;AACrB,aAAO,EAAE,WAAW,MAAM,OAAO,OAAO,YAAY,QAAQ,OAAU;AAAA,IACxE;AACA,UAAM,UAAU,KAAK,QAAQ,IAAI,IAAI;AACrC,SAAK,QAAQ,kBAAkB,KAAK,GAAG;AAErC,WAAK,QAAQ,IAAI,MAAM,EAAE,GAAG,SAAS,iBAAiB,QAAQ,kBAAkB,KAAK,EAAE,CAAC;AACxF,aAAO;AAAA,QACL,WAAW;AAAA,QACX,OAAO;AAAA,UACL,MAAMA,WAAU;AAAA,UAChB,SAAS;AAAA,UACT,WAAW;AAAA,UACX,QAAQ,CAAC;AAAA,QACX;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF;AACA,UAAMF,OAAM,KAAK,SAAS,MAAM,KAAK,QAAQ,IAAI,IAAI,GAAmB,oBAAoB;AAC5F,IAAAA,KAAI,aAAa;AACjB,SAAK,KAAK,IAAI,MAAMA,IAAG;AACvB,WAAO,cAAc,MAAM,KAAK,SAAS,MAAMA,IAAG,CAAC;AAAA,EACrD;AAAA,EAEQ,aACNG,YACA,MACA,SACA,YACA,sBACiB;AACjB,QAAI,KAAK,YAAY,IAAI,IAAI,GAAG;AAC9B,aAAO,WAAWA,YAAW,eAAe,IAAI,CAAC;AAAA,IACnD;AACA,QAAI,KAAK,QAAQ,IAAI,IAAI,GAAG;AAC1B,aAAO,WAAWA,YAAW,WAAW,IAAI,CAAC;AAAA,IAC/C;AACA,UAAMH,OAAM,KAAK,KAAK,IAAI,IAAI;AAC9B,QAAI,CAACA,MAAK;AACR,aAAO;AAAA,QACLG;AAAA,QACA,KAAK,qBAAqB,IAAI,IAAI,IAAI,gBAAgB,IAAI,IAAI,WAAW,IAAI;AAAA,MAC/E;AAAA,IACF;AACA,QAAIH,KAAI,yBAAyB,sBAAsB;AACrD,aAAOC;AAAA,QACLE;AAAA,QACAD,WAAU;AAAA,QACV;AAAA,MACF;AAAA,IACF;AACA,IAAAF,KAAI,eAAe;AACnB,UAAM,mBAAmB,OAAO,UAAU;AAG1C,QAAI,qBAAqB,MAAM,mBAAmBA,KAAI,mBAAmB;AACvE,aAAO,WAAWG,YAAW,KAAK,SAAS,MAAMH,IAAG,CAAC;AAAA,IACvD;AACA,QAAI,mBAAmBA,KAAI,mBAAmB;AAC5C,MAAAA,KAAI,oBAAoB;AAAA,IAC1B;AACA,UAAM,UAAU,eAAe,KAAK,aAAa,KAAK,SAAS,MAAMA,KAAI,oBAAoB;AAC7F,QAAIA,KAAI,OAAO,QAAQ,CAACA,KAAI,aAAa;AAGvC,UAAI,CAACA,KAAI,OAAO,gBAAiB,MAAK,SAAS,MAAMA,MAAK,OAAO;AACjE,aAAO,WAAWG,YAAW,KAAK,SAAS,MAAMH,IAAG,CAAC;AAAA,IACvD;AAIA,UAAM,SAASA,KAAI,OAAO,OAAO,CAACI,WAAU,OAAOA,OAAM,GAAG,IAAI,OAAO;AACvE,mBAAe,MAAM;AACnB,iBAAWA,UAAS,QAAQ;AAC1B,aAAK,UAAU,QAAQ,SAAS,QAAQ,OAAOA,MAAK,EAAE,OAAO,CAAC;AAAA,MAChE;AAAA,IACF,CAAC;AACD,WAAO,WAAWD,YAAW,KAAK,SAAS,MAAMH,IAAG,CAAC;AAAA,EACvD;AAAA,EAEQ,YACNG,YACA,MACA,sBACiB;AACjB,QAAI,KAAK,YAAY,IAAI,IAAI,GAAG;AAC9B,aAAO,WAAWA,YAAW,eAAe,IAAI,CAAC;AAAA,IACnD;AACA,QAAI,KAAK,QAAQ,IAAI,IAAI,GAAG;AAC1B,aAAO,WAAWA,YAAW,WAAW,IAAI,CAAC;AAAA,IAC/C;AACA,UAAMH,OAAM,KAAK,KAAK,IAAI,IAAI;AAC9B,QAAI,CAACA,MAAK;AACR,aAAO;AAAA,QACLG;AAAA,QACA,KAAK,qBAAqB,IAAI,IAAI,IAAI,gBAAgB,IAAI,IAAI,WAAW,IAAI;AAAA,MAC/E;AAAA,IACF;AACA,QAAIH,KAAI,yBAAyB,sBAAsB;AACrD,aAAOC;AAAA,QACLE;AAAA,QACAD,WAAU;AAAA,QACV;AAAA,MACF;AAAA,IACF;AACA,WAAO,WAAWC,YAAW,KAAK,SAAS,MAAMH,IAAG,CAAC;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA,EAKQ,cACNG,YACA,MACA,SACA,sBACiB;AACjB,UAAM,SAAS,KAAK,YAAYA,YAAW,MAAM,oBAAoB;AACrE,UAAMH,OAAM,KAAK,KAAK,IAAI,IAAI;AAC9B,QACE,CAACA,QACD,KAAK,YAAY,IAAI,IAAI,KACzB,KAAK,QAAQ,IAAI,IAAI,KACrB,OAAO,QAAQ,UAAU,cACzB,OAAO,OAAO,SAAS,UAAU,QAAQ,qBACzCA,KAAI,YAAY,SAChB;AACA,aAAO;AAAA,IACT;AACA,SAAK,YAAY,IAAI,IAAI;AACzB,IAAAA,KAAI,aAAa;AACjB,WAAO,WAAWG,YAAW,eAAe,IAAI,CAAC;AAAA,EACnD;AAAA,EAEQ,aACNA,YACA,MACA,sBACiB;AACjB,UAAMH,OAAM,KAAK,KAAK,IAAI,IAAI;AAC9B,QAAI,CAACA,MAAK;AACR,WAAK,qBAAqB,IAAI,IAAI;AAClC,aAAO,WAAWG,YAAW,gBAAgB,IAAI,CAAC;AAAA,IACpD;AACA,QAAIH,KAAI,yBAAyB,sBAAsB;AACrD,aAAOC;AAAA,QACLE;AAAA,QACAD,WAAU;AAAA,QACV;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAACF,KAAI,eAAeA,KAAI,OAAO,iBAAiB;AAClD,MAAAA,KAAI,KAAK,WAAW;AACpB,MAAAA,KAAI,KAAK,YAAY;AACrB,MAAAA,KAAI,cAAc;AAClB,YAAM,UAAU;AAAA,QACd,KAAK;AAAA,QACL,KAAK;AAAA,QACL;AAAA,QACAA,KAAI;AAAA,MACN;AACA,qBAAe,MAAM;AACnB,mBAAWI,UAASJ,KAAI,QAAQ;AAC9B,eAAK,UAAU,QAAQ,SAAS,QAAQ,OAAOI,MAAK,EAAE,OAAO,CAAC;AAAA,QAChE;AAAA,MACF,CAAC;AAAA,IACH;AACA,WAAO,WAAWD,YAAW,KAAK,SAAS,MAAMH,IAAG,CAAC;AAAA,EACvD;AAAA;AAAA;AAAA,EAIQ,SAAS,MAAcA,MAAgB,SAAuB;AACpE,IAAAA,KAAI,cAAc;AAClB,UAAM,EAAE,cAAc,mBAAmB,iBAAiB,IAAIA,KAAI;AAClE,QAAI,WAAW,CAAC,GAAGA,KAAI,MAAM;AAC7B,QAAI,kBAAkB;AACpB,eAAS,IAAI,GAAG,IAAI,IAAI,SAAS,QAAQ,KAAK,GAAG;AAC/C,cAAM,IAAI,SAAS,CAAC;AACpB,iBAAS,CAAC,IAAI,SAAS,IAAI,CAAC;AAC5B,iBAAS,IAAI,CAAC,IAAI;AAAA,MACpB;AAAA,IACF;AACA,eAAW,SAAS,OAAO,CAACI,WAAU,CAAC,cAAc,IAAI,OAAOA,OAAM,GAAG,CAAC,CAAC;AAC3E,mBAAe,MAAM;AACnB,iBAAWA,UAAS,UAAU;AAC5B,cAAM,UAAU,QAAQ,OAAOA,MAAK,EAAE,OAAO;AAC7C,aAAK,UAAU,QAAQ,SAAS,OAAO;AACvC,YAAI,mBAAmB,IAAI,OAAOA,OAAM,GAAG,CAAC,GAAG;AAC7C,eAAK,UAAU,QAAQ,SAAS,OAAO;AAAA,QACzC;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEQ,SAAS,MAAcJ,MAA0B;AAMvD,UAAM,WAAW,CAACA,KAAI,OAAO,QAAQA,KAAI;AACzC,WAAO;AAAA,MACL;AAAA,MACA,OAAO,WAAW,QAAQ,oBAAoB,QAAQ;AAAA,MACtD,SAAS,YAAYA,KAAI,UAAU,IAAI,SAAS,IAAI;AAAA,MACpD,aAAa;AAAA,MACb,MAAM,WAAWA,KAAI,OAAO;AAAA,MAC5B,YAAY,aAAa;AAAA,IAC3B;AAAA,EACF;AAAA,EAEQ,SAAS,MAAc,QAAsB,sBAAyC;AAC5F,UAAM,SAAoB,CAAC;AAC3B,UAAM,eAA0D,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,EAAE;AACzF,QAAI,MAAM;AACV,eAAW,QAAQ,OAAO,QAAQ;AAChC,aAAO;AACP,UAAI,SAAS,YAAY;AACvB,eAAO,KAAK,EAAE,MAAM,KAAK,IAAI,SAAS,GAAG,MAAM,EAAE,OAAO,YAAY,UAAU,CAAC,EAAE,EAAE,CAAC;AACpF;AAAA,MACF;AACA,YAAM,QAAQ,OAAO,KAAK,UAAU,WAAWD,SAAQ,OAAO,KAAK,KAAK,IAAI,KAAK;AACjF,mBAAa,KAAK,OAAO,EAAE,KAAK,KAAK;AACrC,aAAO,KAAK;AAAA,QACV;AAAA,QACA,KAAK,IAAI,SAAS;AAAA,QAClB,MAAM;AAAA,UACJ,OAAO;AAAA,UACP,MAAM;AAAA,YACJ,SACE,KAAK,YAAY,WAAW,UAAU,oBAAoB,UAAU;AAAA,YACtE;AAAA,UACF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AACA,WAAO;AACP,UAAM,UAAkC,CAAC;AACzC,UAAM,SAAiC,CAAC;AACxC,eAAW,WAAW,CAAC,UAAU,QAAQ,GAAY;AACnD,YAAM,SAASM,QAAO,aAAa,OAAO,CAAC;AAC3C,cAAQ,OAAO,IAAI,WAAW,OAAO,MAAM,CAAC;AAC5C,aAAO,OAAO,IAAI,OAAO,OAAO,UAAU;AAAA,IAC5C;AACA,UAAM,OAAe;AAAA,MACnB,UAAU;AAAA,MACV,UAAU;AAAA,MACV,WAAW;AAAA,MACX,YAAY;AAAA,MACZ;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,eAAe,CAAC;AAAA,MAChB,2BAA2B;AAAA,MAC3B,GAAG,OAAO;AAAA,IACZ;AACA,WAAO,KAAK,EAAE,MAAM,KAAK,IAAI,SAAS,GAAG,MAAM,EAAE,OAAO,QAAQ,KAAK,EAAE,CAAC;AACxE,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT;AAAA,MACA,YAAY;AAAA,MACZ,aAAa;AAAA,MACb,mBAAmB,OAAO,kBAAkB;AAAA,MAC5C,aAAa;AAAA,MACb,YAAY;AAAA,MACZ,MAAM,CAAC;AAAA,MACP,mBAAmB;AAAA,IACrB;AAAA,EACF;AACF;AAEO,SAAS,6BAA6B,OAK1C;AACD,QAAM,YAAY,IAAI,0BAA0B;AAChD,QAAM,SAAS,IAAI,aAAa;AAAA,IAC9B;AAAA,IACA,aAAa,MAAM;AAAA,IACnB,SAAS,MAAM;AAAA,IACf,sBAAsB,MAAM;AAAA,IAC5B,eAAe,OAAO,SAAS;AAC7B,YAAM,WAAW,MAAM,MAAM,UAAU,QAAQ,IAAI;AACnD,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,GAAI,SAAS,OAAO,SAAS,IACzB,CAAC,EAAE,SAAS,UAAmB,OAAO,SAAS,OAAO,CAAC,IACvD,CAAC;AAAA,UACL,GAAI,SAAS,OAAO,SAAS,IACzB,CAAC,EAAE,SAAS,UAAmB,OAAO,SAAS,OAAO,CAAC,IACvD,CAAC;AAAA,QACP;AAAA,QACA,MAAM;AAAA,UACJ,UAAU,SAAS;AAAA,UACnB,UAAU,SAAS;AAAA,UACnB,YAAY,SAAS;AAAA,UACrB,2BAA2B,SAAS;AAAA,QACtC;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACD,QAAM,aAAyB;AAAA,IAC7B,SAAS,OAAO,SAAS,SAAS,SAAS;AACzC,YAAM,OAAO,MAAM,MAAM,UAAU,QAAQ,SAAS,SAAS,IAAI;AACjE,UAAI,KAAK,OAAO,SAASH,WAAU,uBAAwB,QAAO;AAClE,aAAO,MAAM,OAAO,QAAQ,SAAS,SAAS,IAAI;AAAA,IACpD;AAAA,EACF;AACA,SAAO;AAAA,IACL;AAAA,IACA,UAAU,EAAE,UAAU;AAAA,IACtB;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAASG,QAAO,QAAkC;AAChD,QAAM,QAAQ,OAAO,OAAO,CAAC,KAAK,MAAM,MAAM,EAAE,YAAY,CAAC;AAC7D,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,QAAI,IAAI,OAAO,MAAM;AACrB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAEA,SAAS,gCAAgC,SAAqC;AAC5E,QAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,QAAM,kBAAkB,MAAM,QAAQ,YAAY;AAClD,SAAO,mBAAmB,IAAI,MAAM,kBAAkB,CAAC,IAAI;AAC7D;AAEA,SAASJ,eAAcE,YAAmB,MAAiB,SAAkC;AAC3F,SAAO;AAAA,IACL,WAAAA;AAAA,IACA,OAAO,EAAE,MAAM,SAAS,WAAW,OAAO,QAAQ,CAAC,EAAE;AAAA,IACrD,QAAQ;AAAA,EACV;AACF;AAEA,SAAS,cAAcA,YAAmBG,SAAkB,WAAW,MAAuB;AAC5F,SAAO;AAAA,IACL,WAAAH;AAAA,IACA,OAAO;AAAA,IACP,QAAQ,EAAE,OAAO,WAAW,SAAS,EAAE,UAAU,QAAAG,QAAO,EAAE;AAAA,EAC5D;AACF;AAEA,SAAS,WAAWH,YAAmBG,SAAmC;AACxE,SAAO;AAAA,IACL,WAAAH;AAAA,IACA,OAAO;AAAA,IACP,QAAQ,EAAE,OAAO,YAAY,UAAUG,QAAO;AAAA,EAChD;AACF;AAEA,SAAS,WAAW,MAAwB;AAC1C,SAAO;AAAA,IACL;AAAA,IACA,OAAO,QAAQ;AAAA,IACf,aAAa;AAAA,IACb,SAAS;AAAA,IACT,MAAM;AAAA,IACN,YAAY,aAAa;AAAA,EAC3B;AACF;AAEA,SAAS,eAAe,MAAwB;AAC9C,SAAO,EAAE,GAAG,WAAW,IAAI,GAAG,YAAY,aAAa,wBAAwB;AACjF;AAIA,SAAS,gBAAgB,MAAwB;AAC/C,SAAO,EAAE,GAAG,gBAAgB,IAAI,GAAG,SAAS,IAAI;AAClD;AAEA,SAAS,gBAAgB,MAAwB;AAC/C,SAAO;AAAA,IACL;AAAA,IACA,OAAO,QAAQ;AAAA,IACf,aAAa;AAAA,IACb,SAAS;AAAA,IACT,MAAM;AAAA,MACJ,UAAU;AAAA,MACV,UAAU;AAAA,MACV,WAAW;AAAA,MACX,YAAY;AAAA,MACZ,SAAS,CAAC;AAAA,MACV,QAAQ,CAAC;AAAA,MACT,aAAa;AAAA,MACb,eAAe,CAAC;AAAA,MAChB,2BAA2B;AAAA,IAC7B;AAAA,IACA,YAAY,aAAa;AAAA,EAC3B;AACF;;;A5DgHO,SAAS,oBACd,UACA,cAAc,0BAA0B,QAAQ,GACvC;AACT,SAAO;AAAA,IACL,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AAaO,SAAS,+BAA+B,UAAoB,SAA+B;AAChG,MAAI,0BAA0B,UAAU,OAAO,GAAG;AAChD,UAAM,IAAI,6BAA6B,SAAS,yBAAyB,QAAQ,CAAC;AAAA,EACpF;AACF;AAcO,SAAS,8BACd,SACA,UACA,cAAc,0BAA0B,QAAQ,GAChD,SACS;AACT,QAAM,eAAe,kBAAkB,OAAO;AAC9C,MAAI,CAAC,cAAc;AACjB,UAAM,IAAI,mBAAmB,SAAS,4BAA4B,OAAO,GAAG;AAAA,EAC9E;AACA,MAAI,aAAa,YAAY,QAAQ;AACnC,WAAO;AAAA,EACT;AACA,iCAA+B,UAAU,aAAa,OAAO;AAC7D,eAAa,oBAAoB,QAAQ;AAEzC,QAAM,eAAe,kBAAkB,SAAS,kBAAkB;AAKlE,QAAM,UAAU,aAAa,WAAW,aAAa;AACrD,MACE,QAAQ,aACR,SAAS,yBACT,CAAC,aAAa,WAAW,aAAa,yBACtC,CAAC,aAAa,SAASC,oBAAmB,GAC1C;AACA,iBAAa,KAAKA,oBAAmB;AAAA,EACvC;AAKA,MACE,QAAQ,aACR,SAAS,0BACT,CAAC,aAAa,WAAW,aAAa,yBACtC,CAAC,aAAa,SAASC,qBAAoB,GAC3C;AACA,iBAAa,KAAKA,qBAAoB;AAAA,EACxC;AAIA,MACE,CAAC,aAAa,WAAW,aAAa,yBACtC,CAAC,aAAa,SAASC,qBAAoB,GAC3C;AACA,iBAAa,KAAKA,qBAAoB;AAAA,EACxC;AAEA,QAAM,QAAQ,aAAa,MAAM;AAAA,IAC/B;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/B,CAAC;AACD,MAAI,SAAS,yBAAyB;AACpC;AAAA,MACE;AAAA,MACA,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AACA,QAAM,MAAM,gCAAgC,cAAc,KAAK;AAE/D,SAAO,aAAa,YAAY,WAC5B,kBAAkB,KAAsB,SAAS,aAAa,IAC9D;AACN;AAEA,SAAS,gCACP,cACA,KACS;AACT,MAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,UAAM,IAAI;AAAA,MACR,aAAa;AAAA,MACb,oBAAoB,aAAa,OAAO;AAAA,IAC1C;AAAA,EACF;AACA,QAAM,SAAS;AAIf,MAAI,OAAO,OAAO,WAAW,YAAY;AACvC,UAAM,IAAI;AAAA,MACR,aAAa;AAAA,MACb,oBAAoB,aAAa,OAAO;AAAA,IAC1C;AAAA,EACF;AACA,MAAI,aAAa,oBAAoB,UAAU;AAC7C,QAAI,OAAO,OAAO,gBAAgB,YAAY;AAC5C,YAAM,IAAI;AAAA,QACR,aAAa;AAAA,QACb,oBAAoB,aAAa,OAAO;AAAA,MAC1C;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,MAAI,aAAa,oBAAoB,YAAY;AAC/C,UAAM,IAAI;AAAA,MACR,aAAa;AAAA,MACb,oBAAoB,aAAa,OAAO;AAAA,IAC1C;AAAA,EACF;AACA,QAAM,SAAS,OAAO;AACtB,SAAO,eAAe,QAAQ,eAAe;AAAA,IAC3C,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,UAAU;AAAA,IACV,OAAO,OAAO,UAAmB,MAAM,OAAO,KAAK,QAAQ,KAAK;AAAA,EAClE,CAAC;AACD,SAAO;AACT;AAEA,SAAS,kBAAkB,QAAuB,SAA4C;AAC5F,QAAM,UAAU,SAAS,KAAK;AAC9B,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AACA,QAAM,cACJ,OAGA;AACF,QAAM,cAAc,OAAqC,YAA2B;AAClF,UAAM,cAAe,QAAkD,OAAO;AAC9E,QAAI,OAAO,gBAAgB,YAAY,YAAY,SAAS,GAAG;AAC7D,YAAM,qBAAqB,SAAS,WAAW;AAC/C,YAAM,eACJ,QAGA;AACF,UAAI,OAAO,iBAAiB,YAAY;AACtC,eAAO,eAAe,SAAS,sBAAsB;AAAA,UACnD,cAAc;AAAA,UACd,YAAY;AAAA,UACZ,UAAU;AAAA,UACV,OAAO,OAAO,SACZ;AAAA,YACE;AAAA,YACA;AAAA,YACA,MAAM,aAAa,KAAK,SAAS,IAAI;AAAA,UACvC;AAAA,QACJ,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,WAAW,OAAO;AAAA,IAClB,GAAI,OAAO,2BAA2B,SAClC,EAAE,wBAAwB,OAAO,uBAAuB,IACxD,CAAC;AAAA,IACL,GAAI,OAAO,SACP;AAAA,MACE,QAAQ,UAAU,SAChB,MAAM,YAAY,MAAO,OAAO,OAAe,GAAG,IAAI,CAAC;AAAA,IAC3D,IACA,CAAC;AAAA,IACL,GAAI,OAAO,SACP;AAAA,MACE,QAAQ,OAAO,UACb,MAAM,YAAY,MAAM,OAAO,OAAQ,KAAK,CAAC;AAAA,IACjD,IACA,CAAC;AAAA,IACL,GAAI,cACA;AAAA;AAAA;AAAA;AAAA;AAAA,MAKE,aAAa,OAAO,UAClB,MAAM,YAAY,MAAM,YAAY,KAAK,QAAQ,KAAK,CAAC;AAAA,IAC3D,IACA,CAAC;AAAA,IACL,GAAI,6BAA6B,UAAU,OAAO,OAAO,4BAA4B,aACjF;AAAA;AAAA,MAEE,yBAAyB,OAAO,wBAAwB,KAAK,MAAM;AAAA,IACrE,IACA,CAAC;AAAA,IACL,GAAI,OAAO,SACP;AAAA,MACE,QAAQ,OAAO,UAA+B,MAAM,OAAO,OAAQ,KAAK;AAAA,IAC1E,IACA,CAAC;AAAA,IACL,GAAI,OAAO,wBACP;AAAA,MACE,uBAAuB,OAAO,OAA4B,YACxD,MAAM,OAAO,sBAAuB,OAAO,OAAO;AAAA,IACtD,IACA,CAAC;AAAA,IACL,GAAI,OAAO,8BACP;AAAA,MACE,6BAA6B,OAAO,UAClC,MAAM,OAAO,4BAA6B,KAAK;AAAA,IACnD,IACA,CAAC;AAAA,IACL,GAAI,OAAO,gCACP;AAAA,MACE,+BAA+B,OAAO,UACpC,MAAM,OAAO,8BAA+B,KAAK;AAAA,IACrD,IACA,CAAC;AAAA,IACL,GAAI,OAAO,0BACP;AAAA,MACE,yBAAyB,OAAO,UAC9B,MAAM,OAAO,wBAAyB,KAAK;AAAA,IAC/C,IACA,CAAC;AAAA,EACP;AACF;AASO,SAAS,iCACd,aACA,eACA,UACqB;AACrB,QAAM,OAAO,kBAAkB,KAAK,WAAW,IAAI,YAAY,MAAM,GAAG,EAAE,IAAI;AAC9E,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,MAAM;AAAA,EACR;AACF;AAEA,eAAe,qBAAqB,SAAiB,aAAoC;AACvF,QAAM,EAAE,UAAU,IAAI,MAAM,OAAO,eAAoB;AACvD,QAAM,SAAS,UAAU,UAAU,CAAC,WAAW,WAAW,SAAS,WAAW,GAAG;AAAA,IAC/E,UAAU;AAAA,EACZ,CAAC;AACD,MAAI,OAAO,WAAW,GAAG;AACvB;AAAA,EACF;AACA,QAAM,SAAS,OAAO,UAAU,OAAO,OAAO,WAAW;AACzD,MAAI,OAAO,SAAS,gBAAgB,GAAG;AACrC;AAAA,EACF;AACA,QAAM,IAAI;AAAA,IACR,yDAAyD,OAAO,KAAK,OAAO,KAAK,CAAC;AAAA,EACpF;AACF;AAOO,SAAS,8BACd,OACA,UAKI,CAAC,GAC2B;AAChC,QAAM,eAAgB,OAAe;AACrC,MAAI,CAAC,cAAc;AACjB,WAAO;AAAA,EACT;AACA,QAAM,QACJ,aAAa,kBAAkB,aAAa,eAAe,MAC1D,aAAa,mBAAmB,aAAa,eAC1C;AAAA,IACE,WAAW,aAAa;AAAA,IACxB,iBAAiB,aAAa;AAAA,IAC9B,kBAAkB,aAAa;AAAA,IAC/B,cAAc,aAAa;AAAA,EAC7B,IACA;AACN,MAAI,CAAC,SAAS,CAAC,MAAM,cAAc;AACjC,WAAO;AAAA,EACT;AACA,QAAM,YAAY,2BAA2B,KAAgC;AAC7E,SAAO;AAAA,IACL,QAAQ,sBACJ,oCAAoC,WAAW,QAAQ,mBAAmB,IAC1E;AAAA,IACJ;AAAA,EACF;AACF;AAEA,SAAS,wBAAwB,OAAgB,MAA0C;AACzF,MAAI,CAAC,eAAe,KAAK,EAAG,QAAO;AACnC,SAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC;AAChF;AAKO,SAAS,oCACd,OACA,MACyB;AACzB,QAAM,eAAe,MAAM;AAC3B,MAAI,CAAC,eAAe,YAAY,EAAG,QAAO;AAC1C,QAAM,OAAgC,EAAE,GAAG,aAAa;AACxD,QAAM,WAAW,aAAa;AAC9B,MAAI,eAAe,QAAQ,KAAK,OAAO,OAAO,UAAU,aAAa,GAAG;AACtE,UAAM,QACJ,OAAO,eAAe,QAAQ,MAAM,OAAO,aAC3C,OAAO,eAAe,QAAQ,MAAM,OAChC,WACC,gCAAgC,QAAQ;AAC/C,SAAK,WAAW,EAAE,GAAG,OAAO,aAAa,wBAAwB,MAAM,aAAa,IAAI,EAAE;AAAA,EAC5F;AACA,MAAI,OAAO,OAAO,cAAc,aAAa,GAAG;AAC9C,SAAK,cAAc,wBAAwB,aAAa,aAAa,IAAI;AAAA,EAC3E;AACA,QAAM,gBAAgB,aAAa;AACnC,MAAI,eAAe,aAAa,KAAK,OAAO,OAAO,eAAe,aAAa,GAAG;AAChF,SAAK,gBAAgB;AAAA,MACnB,GAAG;AAAA,MACH,aAAa,wBAAwB,cAAc,aAAa,IAAI;AAAA,IACtE;AAAA,EACF;AACA,SAAO,EAAE,GAAG,OAAO,cAAc,KAAK;AACxC;AAUA,SAAS,2BAA2B,OAAyD;AAC3F,QAAM,eAAe,MAAM;AAC3B,MAAI,CAAC,eAAe,YAAY,KAAK,CAAC,OAAO,OAAO,cAAc,UAAU,GAAG;AAC7E,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,aAAa;AACnC,MAAI,CAAC,eAAe,aAAa,KAAK,CAAC,OAAO,OAAO,eAAe,UAAU,GAAG;AAC/E,WAAO;AAAA,EACT;AACA,QAAM,EAAE,UAAU,oBAAoB,GAAG,uBAAuB,IAAI;AACpE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,cAAc;AAAA,MACZ,GAAG;AAAA,MACH,eAAe;AAAA,IACjB;AAAA,EACF;AACF;AAEA,SAAS,eAAe,OAAkD;AACxE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,sCAAsC,OAAwC;AACrF,QAAM,EAAE,UAAU,WAAW,GAAG,cAAc,IAAI;AAClD,SAAO;AACT;AAEA,SAAS,gCAAgC,OAAyB;AAChE,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,MAAI,cAAc,OAAO,aAAa,cAAc,KAAM,QAAO;AACjE,SAAO,wBAAwB,KAAiB;AAClD;AAOA,eAAsB,qCACpB,OACA,QAC0C;AAC1C,MAAI,CAAC,UAAU,CAAC,SAAS,OAAO,UAAU,YAAY,EAAE,kBAAkB,QAAQ;AAChF,WAAO;AAAA,EACT;AACA,MAAI,MAAM,aAAc,OAAyB,cAAc,MAAM,WAAW;AAC9E,UAAM,IAAI,MAAM,8EAA8E;AAAA,EAChG;AACA,SAAO,MAAM,uCAAuC,QAAyB,MAAM,YAAY;AACjG;AAiBO,SAAS,6CACd,cACwB;AACxB,MAAI,CAAC,gBAAgB,OAAO,iBAAiB,UAAU;AACrD,WAAO;AAAA,EACT;AACA,QAAM,MAAO,aAAgD;AAC7D,MAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,GAAG;AAC/C,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,WAAW,KAAK,OAAO,KAAK,KAAK,QAAQ,CAAC;AAAA,EACnD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIO,SAAS,sBAAsB,SAAyC;AAC7E,QAAM,MAAMC,yBAAwB,OAAO;AAC3C,SAAO,KAAK,aAAa,+BACvB,KAAK,aAAa,6BAChB,IAAI,aACJ;AACN;AAIA,SAAS,2BAA2B,OAAqD;AACvF,SAAOC,UAAS,KAAK,IAAI,gBAAgB,KAAK,IAAI;AACpD;AAEA,eAAsB,uCACpB,QACA,UACA,oBAC0C;AAC1C,MAAI,CAAC,YAAY,OAAO,aAAa,UAAU;AAC7C,WAAO;AAAA,EACT;AACA,MAAI,CAAC,OAAO,yBAAyB;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAQ;AASd,QAAM,gBAAgB,EAAE,GAAI,MAAM,iBAAiB,CAAC,EAAG;AACvD,MAAI,oBAAoB;AACtB,UAAM,UAAU,8BAA8B,OAAO,SAAS,KAAK,OAAO;AAC1E,UAAM,qBAAqB,gCAAgC,SAAS,aAAa;AACjF,QAAI,sBAAsB,uBAAuB,oBAAoB;AACnE,YAAM,IAAI,mCAAmC,SAAS,oBAAoB,kBAAkB;AAAA,IAC9F;AACA,QAAI,CAAC,oBAAoB;AACvB,YAAM,kBAAkB,kBAAkB,OAAyB,GAAG,iBAAiB,CAAC;AACxF,UAAI,iBAAiB;AAKnB,sBAAc,eAAe,IAAI;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AACA,QAAM,eAAe,2BAA2B,MAAM,YAAY;AAClE,SAAO,MAAM,OAAO,wBAAwB;AAAA,IAC1C,GAAG;AAAA,IACH,UAAU,MAAM;AAAA,IAChB,GAAI,MAAM,aAAa,SAAY,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;AAAA,IACnE,GAAI,MAAM,wBAAwB,SAC9B,EAAE,qBAAqB,MAAM,oBAAoB,IACjD,CAAC;AAAA,IACL,GAAI,MAAM,+BAA+B,SACrC,EAAE,4BAA4B,MAAM,2BAA2B,IAC/D,CAAC;AAAA,IACL,gBAAgB,MAAM;AAAA,IACtB,GAAI,iBAAiB,SAAY,EAAE,aAAa,IAAI,CAAC;AAAA,EACvD,CAAC;AACH;AAuDA,eAAsB,+BACpB,QACA,cACA,SACe;AACf,QAAM,kBAAkB;AAIxB,QAAM,mBAAmB;AACzB,QAAM,UAAU,EAAE,QAAQ,UAAU;AACpC,MAAI;AACJ,QAAM,UAAU,OAAO,cAAgE;AACrF,QAAI,CAAC,UAAW;AAChB,QAAI;AACF,YAAM,UAAU;AAAA,IAClB,SAAS,OAAO;AACd,qBAAe;AAAA,IACjB;AAAA,EACF;AACA,QAAM,kBACJ,OAAO,iBAAiB,oBAAoB,aACxC,iBAAiB,gBAAgB,KAAK,gBAAgB,IACtD;AACN,QAAM,UACJ,OAAO,iBAAiB,YAAY,aAChC,iBAAiB,QAAQ,KAAK,gBAAgB,IAC9C;AACN,QAAM,OACJ,OAAO,iBAAiB,SAAS,aAC7B,iBAAiB,KAAK,KAAK,gBAAgB,IAC3C;AACN,QAAM,WACJ,OAAO,iBAAiB,aAAa,aACjC,iBAAiB,SAAS,KAAK,gBAAgB,IAC/C;AACN,QAAM,gBACJ,OAAO,iBAAiB,WAAW,aAC/B,iBAAiB,OAAO,KAAK,gBAAgB,IAC7C;AACN,QAAM,QACJ,OAAO,iBAAiB,UAAU,aAC9B,iBAAiB,MAAM,KAAK,gBAAgB,IAC5C;AAQN,QAAM,QAAQ,eAAe;AAC7B,QAAM,QAAQ,UAAU,YAAY,MAAM,QAAQ,OAAO,IAAI,MAAS;AACtE,QAAM,QAAQ,OAAO,YAAY,MAAM,KAAK,OAAO,IAAI,MAAS;AAChE,QAAM,QAAQ,WAAW,YAAY,MAAM,SAAS,OAAO,IAAI,MAAS;AACxE,QAAM,QAAQ,gBAAgB,YAAY,MAAM,cAAc,OAAO,IAAI,MAAS;AAClF,QAAM,sBAAsB,QAAQ,QAAQ,YAAY,aAAa;AACrE,MAAI,CAAC,uBAAuB,OAAO;AACjC,UAAM,QAAQ,KAAK;AAAA,EACrB,WACE,CAAC,uBACD,CAAC,SACD,OAAO,gBAAgB,WAAW,cAClC,iBAAiB,UACjB,iBAAiB,MACjB;AACA,UAAM,QAAQ,YAAY,MAAM,gBAAgB,OAAQ,YAAqB,CAAC;AAAA,EAChF;AACA,MAAI,WAAY,OAAM;AACtB,MACE,uBACA,SACC,OAAO,gBAAgB,WAAW,cACjC,iBAAiB,UACjB,iBAAiB,MACnB;AACA;AAAA,EACF;AAEA,QAAM,YACJ,OAAO,gBAAgB,cAAc,WAAW,gBAAgB,YAAY;AAC9E,QAAM,IAAI,MAAM,mBAAmB,SAAS,0CAA0C;AACxF;AAEO,IAAM,4BAAN,cAAwC,MAAM;AAAA,EAGnD,YACkB,SAIA,MAKA,WACA,WAA0B,MAC1B,aAA4B,MAC5C,SACA;AACA,UAAM,SAAS,aAAa,GAAG,OAAO,YAAY,UAAU,KAAK,GAAG,OAAO;AAC3E;AAAA,MACE,SAAS,uBACL,GAAG,MAAM,kDAAkD,SAAS,OACpE,SAAS,2BACP,GAAG,MAAM,qDACT,SAAS,oBACP,GAAG,MAAM,uFACT,aAAa,OACX,GAAG,MAAM,6DACT,GAAG,MAAM,+CAA+C,QAAQ;AAAA,MAC1E,WAAW,WAAW,UAAU,EAAE,OAAO,QAAQ,MAAM,IAAI;AAAA,IAC7D;AA1BgB;AAIA;AAKA;AACA;AACA;AAAA,EAgBlB;AAAA,EA9BS,OAAO;AA+BlB;AAGO,SAAS,qCACd,OACkE;AAClE,SAAO,iBAAiB,6BAA6B,MAAM,SAAS;AACtE;AAKO,IAAM,kCAAkC;AAE/C,SAAS,0BAA0B,QAAgC;AACjE,MAAI,OAAO,WAAW,SAAU,QAAO,yBAAyB,MAAM;AACtE,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,YAAY;AAClB,aAAW,SAAS,CAAC,UAAU,WAAW,UAAU,UAAU,GAAG;AAC/D,QAAI,OAAO,UAAU,YAAY,OAAO,cAAc,KAAK,KAAK,SAAS,EAAG,QAAO;AAAA,EACrF;AACA,SAAO;AACT;AAKA,eAAsB,2BACpB,aACA,YAAY,iCACZ,QACe;AACf,UAAQ,eAAe;AACvB,MAAI,YAAY,cAAc,WAAW,YAAY,cAAc,cAAe;AAClF,QAAM,UAAU,YAAY;AAmB5B,QAAMC,OAAM,QAAQ,QAAQ,QAAQ;AACpC,QAAM,mBACJ,YAAY,cAAc,UAAU,QAAQ,sBAAsB;AACpE,MAAI,CAACA,QAAO,CAAC,kBAAkB;AAC7B,UAAM,IAAI;AAAA,MACR,YAAY;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA,YAAY;AAAA,IACd;AAAA,EACF;AACA,QAAM,eAAe,MACnB,IAAI;AAAA,IACF,YAAY;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY;AAAA,EACd;AACF,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,QAAM,iBAAiB,OAAU,cAA4C;AAC3E,YAAQ,eAAe;AACvB,UAAM,cAAc,WAAW,KAAK,IAAI;AACxC,QAAI,eAAe,EAAG,OAAM,aAAa;AACzC,QAAI;AACJ,QAAI;AACJ,QAAI;AACF,YAAM,cAAc,IAAI,QAAe,CAAC,GAAG,WAAW;AACpD,gBAAQ,MAAM,OAAO,QAAQ,MAAM;AACnC,gBAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AACvD,YAAI,QAAQ,QAAS,OAAM;AAC3B,gBAAQ,WAAW,MAAM,OAAO,aAAa,CAAC,GAAG,WAAW;AAC5D,YAAI,SAAS,WAAW,SAAS,OAAO,MAAM,UAAU,WAAY,OAAM,MAAM;AAAA,MAClF,CAAC;AACD,YAAMC,UAAS,MAAM,QAAQ,KAAK,CAAC,UAAU,GAAG,WAAW,CAAC;AAC5D,cAAQ,eAAe;AACvB,aAAOA;AAAA,IACT,UAAE;AACA,UAAI,MAAO,cAAa,KAAK;AAC7B,UAAI,MAAO,SAAQ,oBAAoB,SAAS,KAAK;AAAA,IACvD;AAAA,EACF;AACA,MAAI,kBAAkB;AACpB,UAAM,eAAe,IAAI,gBAAgB;AACzC,UAAM,QAAQ,MAAM,aAAa,MAAM,QAAQ,MAAM;AACrD,YAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AACvD,QAAI,QAAQ,QAAS,OAAM;AAC3B,QAAI;AACF,UAAI;AACJ,UAAI;AACF,mBAAW,MAAM,eAAe,MAAM,iBAAiB,KAAK,SAAS,aAAa,MAAM,CAAC;AAAA,MAC3F,SAAS,OAAO;AACd,YAAI,EAAE,iBAAiB,kCAAmC,OAAM;AAChE,cAAM,IAAI;AAAA,UACR,YAAY;AAAA,UACZ;AAAA,UACA;AAAA,UACA;AAAA,UACA,YAAY;AAAA,UACZ,EAAE,OAAO,MAAM;AAAA,QACjB;AAAA,MACF;AACA,UAAI,aAAa;AACf,cAAM,IAAI;AAAA,UACR,YAAY;AAAA,UACZ;AAAA,UACA;AAAA,UACA;AAAA,UACA,YAAY;AAAA,QACd;AACF;AAAA,IACF,UAAE;AACA,cAAQ,oBAAoB,SAAS,KAAK;AAC1C,mBAAa,MAAM,IAAI,MAAM,wCAAwC,CAAC;AAAA,IACxE;AAAA,EACF;AACA,QAAM,YAAY,MAChB;AAAA,IAAe,MACbD,KAAK,KAAK,SAAS;AAAA,MACjB,KAAK;AAAA,MACL,aAAa,KAAK,IAAI,KAAO,KAAK,IAAI,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC;AAAA,MAC/D,iBAAiB;AAAA,IACnB,CAAC;AAAA,EACH;AAEF,MAAI,SAAS,MAAM,UAAU;AAC7B,SAAO,MAAM;AACX,UAAM,WAAW,uBAAuB,MAAM;AAC9C,QAAI,aAAa,MAAM;AACrB,UAAI,aAAa,EAAG;AACpB,YAAM,IAAI;AAAA,QACR,YAAY;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY;AAAA,MACd;AAAA,IACF;AAEA,UAAM,YAAY,2BAA2B,MAAM,IAAI,0BAA0B,MAAM,IAAI;AAC3F,UAAM,aAAa,QAAQ;AAC3B,QAAI,cAAc,QAAQ,YAAY;AACpC,eAAS,MAAM;AAAA,QAAe,MAC5B,WAAW,KAAK,SAAS;AAAA,UACvB;AAAA,UACA,OAAO;AAAA,UACP,aAAa,KAAK,IAAI,KAAO,KAAK,IAAI,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC;AAAA,UAC/D,iBAAiB;AAAA,QACnB,CAAC;AAAA,MACH;AACA;AAAA,IACF;AAEA,UAAM,cAAc,WAAW,KAAK,IAAI;AACxC,QAAI,eAAe,EAAG,OAAM,aAAa;AACzC,UAAM,IAAI,QAAQ,CAACE,aAAY,WAAWA,UAAS,KAAK,IAAI,KAAK,WAAW,CAAC,CAAC;AAC9E,aAAS,MAAM,UAAU;AAAA,EAC3B;AACF;AAuCA,SAAS,gCACP,SACA,OACe;AACf,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAM,eAAe,kBAAkB,OAAyB;AAChE,MAAI,CAAC,gBAAgB,aAAa,YAAY,QAAS,QAAO;AAC9D,QAAM,SAAS;AACf,aAAW,SAAS,aAAa,kBAAkB;AACjD,UAAM,QAAQ,OAAO,KAAK;AAC1B,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAAA,EAC5D;AACA,SAAO;AACT;AAEA,SAAS,4CACP,UACA,SACe;AACf,QAAM,eACJ,UAAU,gBAAgB,OAAO,SAAS,iBAAiB,WACtD,SAAS,eACV;AACN,QAAM,gBACJ,cAAc,iBAAiB,OAAO,aAAa,kBAAkB,WACjE,aAAa,gBACb,UAAU;AAChB,QAAM,oBACJ,OAAO,UAAU,cAAc,YAAY,SAAS,UAAU,SAAS,IACnE,SAAS,YACT;AACN,QAAM,kBACJ,YACC,oBACI,8BAA8B,iBAAiB,KAAK,oBACrD;AACN,SAAO,kBAAkB,gCAAgC,iBAAiB,aAAa,IAAI;AAC7F;AAKO,SAAS,sCACd,UACA,SACe;AACf,QAAM,WAAW,WAAWC,4CAA2C;AACvE,MAAI,OAAO,aAAa,YAAY,SAAS,SAAS,EAAG,QAAO;AAChE,SAAO,4CAA4C,UAAU,OAAO;AACtE;AAKO,SAAS,wCACd,SACA,UACe;AACf,QAAM,WAAW,WAAWA,4CAA2C;AACvE,QAAM,SAAS,OAAO,aAAa,YAAY,SAAS,SAAS,IAAI,WAAW;AAChF,QAAM,SAAS,4CAA4C,UAAU,OAAO;AAC5E,MAAI,UAAU,UAAU,WAAW,QAAQ;AACzC,UAAM,IAAI,mCAAmC,SAAS,QAAQ,MAAM;AAAA,EACtE;AACA,SAAO,UAAU;AACnB;AAEA,SAAS,2BAA2B,SAAiB,OAAyB;AAC5E,MAAI,YAAY,YAAY,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvF,WAAO;AAAA,EACT;AAKA,QAAM,aAAa,EAAE,GAAI,MAAkC;AAC3D,SAAO,WAAW;AAClB,SAAO;AACT;AAEA,SAAS,+BAA+B,SAAkC;AACxE,QAAM,eAAe,kBAAkB,OAAyB;AAChE,SAAO,cAAc,YAAY,UAAU,aAAa,aAAa;AACvE;AAEO,SAAS,kCACd,SACA,OACA,kBAC0C;AAC1C,QAAM,aAAa,+BAA+B,OAAO;AACzD,QAAM,gBAAgB,YAAY,aAAa,KAAK,KAAK;AACzD,MAAI,CAAC,cAAc,CAAC,iBAAiB,iBAAiB,WAAW,EAAG,QAAO;AAC3E,SAAO;AAAA,IACL,SAAS;AAAA,IACT;AAAA,IACA,MAAM,WAAW;AAAA,IACjB;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,yBACP,SACA,UACA,OACA,oBAC0C;AAC1C,QAAM,WACJ,UAAU,oBAAoB,OAAO,SAAS,qBAAqB,WAC9D,SAAS,mBACV;AACN,QAAM,QAAQ,UAAU;AACxB,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAM,YAAY;AAClB,QAAM,UAAU,kCAAkC,SAAS,OAAO,kBAAkB;AACpF,SAAO,WACL,UAAU,YAAY,QAAQ,WAC9B,UAAU,YAAY,QAAQ,WAC9B,UAAU,SAAS,QAAQ,QAC3B,UAAU,qBAAqB,QAAQ,oBACvC,UAAU,kBAAkB,QAAQ,gBAClC,UACA;AACN;AAEA,SAAS,uBACP,SACA,OACS;AACT,QAAM,aAAa,+BAA+B,QAAQ,OAAO;AACjE,SACE,YAAY,SAAS,QAAQ,QAAQ,WAAW,aAAa,KAAK,MAAM,QAAQ;AAEpF;AAEA,SAAS,sCACP,SACA,gBACA,SACA,cACS;AACT,QAAM,aAAa,+BAA+B,OAAO;AACzD,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,eAAe,WAAW,aAAa,cAAc;AAC3D,QAAM,iBAAiB,WAAW,aAAa,YAAY;AAC3D,MAAI,CAAC,gBAAgB,iBAAiB,eAAgB,QAAO;AAC7D,aAAW,4BAA4B,SAAS,YAAY;AAC5D,SAAO;AACT;AAEA,eAAsB,0BACpB,aACA,SACA,OACA,oBACA,SAMC;AACD,QAAM,SAAS;AACf,MAAI,CAAC,OAAO,QAAQ;AAClB,UAAM,IAAI,mBAAmB,SAAS,oBAAoB,OAAO,6BAA6B;AAAA,EAChG;AACA,QAAM,aAAa,2BAA2B,OAAO,WAAW,KAAK;AACrE,QAAM,aAAa,SAAS;AAC5B,MACE,eACC,WAAW,YAAY,WACtB,WAAW,qBAAqB,sBAChC,CAAC,uBAAuB,YAAY,UAAU,IAChD;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb;AAAA,EACF;AACA,MAAI,CAAC,cAAc,CAAC,OAAO,aAAa;AACtC,UAAM,IAAI;AAAA,MACR;AAAA,MACA,oBAAoB,OAAO;AAAA,IAC7B;AAAA,EACF;AAIA,QAAM,UAAU,aACZ,MAAM,OAAO,OAAO,UAAU,IAC9B,MAAM,OAAO,YAAa,UAAU;AACxC,QAAM,mBAAmB,eAAe,SAAS,OAAO;AACxD,MAAI,CAAC,kBAAkB;AAIrB,UAAM,IAAI,sCAAsC,SAAS,kBAAkB;AAAA,EAC7E;AACA,MAAI,qBAAqB,oBAAoB;AAC3C,UAAM,mBAAoB,QAAgC,SAAS;AACnE,QAAI,cAAc,uBAAuB,YAAY,gBAAgB,GAAG;AACtE,aAAO;AAAA,QACL;AAAA,QACA,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,oBAAoB;AAAA,MACtB;AAAA,IACF;AAIA,0CAAsC,SAAS,YAAY,SAAS,gBAAgB;AACpF,QAAI;AACF,YAAM,+BAA+B,QAAQ,kBAAkB,OAAO;AAAA,IACxE,SAAS,cAAc;AACrB,YAAM,IAAI,mCAAmC,SAAS,oBAAoB,kBAAkB;AAAA,QAC1F,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,UAAM,IAAI,gCAAgC,SAAS,oBAAoB,gBAAgB;AAAA,EACzF;AACA,SAAO;AAAA,IACL;AAAA,IACA,cAAe,QAAgC,SAAS;AAAA,IACxD,YAAY;AAAA,IACZ,GAAI,aAAa,EAAE,oBAAoB,WAAW,IAAI,CAAC;AAAA,EACzD;AACF;AAKA,eAAsB,mCACpB,aACe;AACf,MAAI,YAAY,oBAAoB;AAClC,UAAM,aAAa,+BAA+B,YAAY,mBAAmB,OAAO;AACxF,QACE,YAAY,SAAS,YAAY,mBAAmB,QACpD,WAAW,aAAa,YAAY,YAAY,MAC9C,YAAY,mBAAmB,eACjC;AACA,iBAAW,4BAA4B,YAAY,SAAS,YAAY,YAAY;AAAA,IACtF;AAAA,EACF;AACA,QAAM;AAAA,IACJ,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,YAAY;AAAA,EACd;AACF;AAIO,SAAS,+BACd,UACgC;AAChC,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,8BAA8B,EAAE,GAAG,SAAS;AAClD,SAAO,4BAA4BA,4CAA2C;AAK9E,SAAO,4BAA4B;AACnC,QAAM,eACJ,SAAS,gBAAgB,OAAO,SAAS,iBAAiB,WACrD,SAAS,eACV;AACN,MAAI,CAAC,cAAc;AACjB,WAAO;AAAA,EACT;AACA,QAAM,EAAE,eAAe,gBAAgB,GAAG,yBAAyB,IAAI;AACvE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,cAAc;AAAA,EAChB;AACF;AAEA,SAAS,eAAe,SAAkC,SAA0B;AAClF,SAAO,gCAAgC,SAAU,QAAgC,KAAK,KAAK;AAC7F;AAEA,eAAe,wBACb,QACA,SACA,cACe;AACf,MAAI;AACF,UAAM,+BAA+B,QAAQ,cAAc,OAAO;AAAA,EACpE,QAAQ;AAAA,EAER;AACF;AAWA,SAAS,oCACP,SACwC;AACxC,MAAI,SAAS,SAAS,oBAAqB,QAAO;AAClD,QAAM,WAAW,QAAQ;AACzB,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,MACA,6CAA6C,QAAQ,WAAW,QAAQ;AAAA,IAC1E;AAAA,EACF;AACA,QAAM,WACJ,SAAS,aAAa,8BAClB,wBACA,SAAS,aAAa,6BACpB,uBACA;AACR,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI,SAAS,yBAAyB,UAAa,SAAS,yBAAyB,UAAU;AAC7F,UAAM,IAAI;AAAA,MACR;AAAA,MACA,4CAA4C,QAAQ,WAAW,QAAQ;AAAA,IACzE;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mCACP,SACA,UACA,SACU;AACV,MAAI,YAAY,QAAS,QAAO;AAChC,QAAM,uBAAuB,oCAAoC,OAAO;AACxE,MAAI,yBAAyB,yBAAyB,SAAS,SAAS,qBAAqB;AAI3F,WAAO;AAAA,MACL,GAAG;AAAA,MACH,2BAA2B;AAAA,MAC3B,cAAc,QAAQ,eAAgB;AAAA,IACxC;AAAA,EACF;AACA,SAAO,wBAAwB,SAAS,8BAA8B,uBAClE,EAAE,GAAG,UAAU,2BAA2B,qBAAqB,IAC/D;AACN;AAeA,eAAsB,oCACpB,UACA,UACA,MAqCoC;AACpC,QAAM,kBACJ,OAAO,UAAU,cAAc,WAAY,SAAS,YAA+B;AACrF,QAAM,UACJ,KAAK,mBAAmB,mBAAoB,SAAS;AACvD,QAAM,oBACJ,YAAY,WAAW,SAAS,eAAe,uBAAuB;AACxE,QAAM,cAAc,KAAK,eAAe,0BAA0B,QAAQ;AAC1E,QAAM,SACJ,KAAK,gBACD,KAAK,cAAc,SAAS,UAAU,WAAW,IACjD,8BAA8B,SAAS,UAAU,aAAa,KAAK,OAAO;AAEhF,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,MACA,mDAAmD,OAAO;AAAA,IAC5D;AAAA,EACF;AACA,MAAI,KAAK,aAAa,uBAAuB,CAAC,OAAO,QAAQ;AAC3D,UAAM,IAAI,mBAAmB,SAAS,oBAAoB,OAAO,6BAA6B;AAAA,EAChG;AAaA,QAAM,iBAAiB,EAAE,YAAY;AAKrC,QAAM,uBACJ,YAAY,OAAO,aAAa,WAC3B,SAAwC,eACzC;AAQN,QAAM,eACJ,wBAAwB,OAAO,yBAAyB,WACnD,uBAKD;AAKN,QAAM,yBAAyB,cAAc;AAC7C,QAAM,2BAA2B,cAAc;AAO/C,QAAM,cAAc,OAAO,wBAAsE;AAI/F,QAAI,mBAAmD;AAAA,MACrD;AAAA,MACA;AAAA,IACF;AACA,UAAM,YAAYC,gCAA+B,cAAc,mBAAmB;AAClF,UAAM,mBAAmBC,iCAAgC,wBAAwB;AACjF,QACE,QAAQ,aAAa,WACrB,aACA,kBAAkB,YAAY,KAC9B,iBAAiB,UAAU,eAAe,0BAC1C,KAAK,0BACL;AAIA,UACE,UAAU,WAAW,iBAAiB,iBACtC,UAAU,UAAU,iBAAiB,cACrC;AACA,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,yBAAmB,EAAE,MAAM,cAAc,YAAY,kBAAkB,KAAK,UAAU;AAAA,IACxF;AACA,UAAM,oBAAoB,YAAY,WAAW,YAAY;AAC7D,QAAI,aAAa,CAAC,kBAAkB;AAClC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI;AACJ,QAAI;AAGF,UAAI,kBAAkB,SAAS,cAAc;AAC3C,oBAAY,MAAM,KAAK,yBAA0B,iBAAiB,GAAG;AACrE,YACE,UAAU,WAAW,iBAAiB,WAAW,iBACjD,UAAU,aAAa,iBAAiB,WAAW,cACnD;AACA,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAIA,YAAM,kBAAkB;AAAA,QACtB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM,gCACJ,YAAY,WACZ,kBAAkB,SAAS,uBAC3B,iBAAiB,gBAAgB,aAAa;AAChD,YAAM,qBAAqB,gCACvB,uBACA;AAKJ,UAAI,YAAY,WAAW,CAAC,KAAK,eAAe;AAC9C,cAAM,yBAAyB,eAAe;AAAA,MAChD;AACA,YAAM,gBACJ,oBAAoB,aAAa,YAAY,WAAW,KAAK,iBACzD,SACE,KAAK,gBACH,KAAK,cAAc,SAAS,iBAAiB,WAAW,IACxD;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA,KAAK;AAAA,MACP;AACV,UAAI,CAAC,eAAe,QAAQ;AAC1B,cAAM,IAAI;AAAA,UACR;AAAA,UACA,oBAAoB,OAAO;AAAA,QAC7B;AAAA,MACF;AACA,UAAI,gBAAgB;AACpB,UAAI,yBAAyB;AAC7B,UAAI,4BAA4B;AAChC,YAAM,wBAAwB,OAC5B,WACA,mBACG;AACH,YAAI,UAAU,uBAAuB,KAAK,uBAAuB;AAC/D,iBAAO,MAAM,UAAU;AAAA,YACrB,EAAE,UAAU,eAAe;AAAA,YAC3B;AAAA,cACE,gBAAgB,OAAO,QAAQ,oBAAoB;AACjD,4CAA4B;AAC5B,sBAAM,KAAK,sBAAuB,gBAAgB,QAAQ,eAAe;AAAA,cAC3E;AAAA,cACA,WAAW,OAAO,YAAY;AAC5B,sBAAM,aAAa,eAAe,SAAS,OAAO;AAClD,oBAAI,CAAC,WAAY,OAAM,IAAI,MAAM,iDAAiD;AAClF,sBAAM,KAAK,mBAAmB;AAAA,kBAC5B,QAAQ;AAAA,kBACR;AAAA,kBACA,cAAe,QAAgC,SAAS;AAAA,kBACxD;AAAA,kBACA,WAAW,UAAU;AAAA,gBACvB,CAAC;AACD,yCAAyB;AAAA,cAC3B;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAGA,cAAM,KAAK,wBAAwB,cAAc;AACjD,YAAI,YAAY,WAAW;AACzB,iBAAO,MAAM,UAAU;AAAA,YACrB,EAAE,UAAU,eAAe;AAAA,YAC3B,KAAK,iBAAiB,EAAE,wBAAwB,KAAK,eAAe,IAAI;AAAA,UAC1E;AAAA,QACF;AACA,eAAO,MAAM,UAAU,OAAQ,EAAE,UAAU,eAAe,CAAC;AAAA,MAC7D;AACA,YAAM,gBAAgB,KAAK,IAAI;AAC/B,UAAI;AACJ,UAAI;AACF,mBAAW,MAAM,sBAAsB,eAAe,eAAe;AACrE;AAAA,UACE,KAAK;AAAA,UACL,cAAc;AAAA,UACd;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF,SAAS,OAAO;AACd;AAAA,UACE,KAAK;AAAA,UACL,cAAc;AAAA,UACd;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA;AAAA,UACE,KAAK;AAAA,UACL,cAAc;AAAA,UACd;AAAA,UACA;AAAA,QACF;AACA,YAAI,2BAA2B;AAG7B,gBAAM;AAAA,QACR;AACA,YACE,iCACA,sBAAsB,wBACtB,YAAY,WACZ,CAAC,+BAA+B,cAAc,WAAW,KAAK,GAC9D;AACA,gBAAM;AAAA,QACR;AACA,cAAM,uBACJ,KAAK,4BACJ,SAAS,gBAAgB,EAAE,GAAG,UAAU,cAAc,OAAU,IAAI;AACvE,YAAI,CAAC,sBAAsB;AAIzB,gBAAM;AAAA,QACR;AACA,cAAM,mBAAmB;AAAA,UACvB;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA,cAAM,yBAAyB,gBAAgB;AAC/C,cAAM,iBACJ,KAAK,gBACD,KAAK,cAAc,SAAS,kBAAkB,WAAW,IACzD,8BAA8B,SAAS,kBAAkB,aAAa,KAAK,OAAO;AAExF,YAAI,CAAC,gBAAgB,QAAQ;AAC3B,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AAAA,QACF;AACA,cAAM,kBAAkB,KAAK,IAAI;AACjC,YAAI;AACF,qBAAW,MAAM,sBAAsB,gBAAgB,gBAAgB;AACvE;AAAA,YACE,KAAK;AAAA,YACL,eAAe;AAAA,YACf;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA,0BAAgB;AAAA,QAClB,SAAS,eAAe;AACtB;AAAA,YACE,KAAK;AAAA,YACL,eAAe;AAAA,YACf;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA;AAAA,YACE,KAAK;AAAA,YACL,eAAe;AAAA,YACf;AAAA,YACA;AAAA,UACF;AACA,gBAAM;AAAA,QACR;AAAA,MACF;AACA,UAAI,gBAAiB,SAAiC;AACtD,YAAM,qBAAqB,eAAe,SAAS,QAAQ;AAC3D,UAAI,CAAC,oBAAoB;AACvB,cAAM,wBAAwB,eAAe,UAAU,aAAa;AACpE,cAAM,IAAI;AAAA,UACR;AAAA,UACA,oBAAoB,OAAO;AAAA,QAC7B;AAAA,MACF;AACA,UAAI,cAAyC;AAAA,QAC3C,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,cAAc,iBAAiB;AAAA,QAC/B,YAAY;AAAA,QACZ,WAAW,cAAc;AAAA,MAC3B;AACA,UAAI,KAAK,oBAAoB,CAAC,wBAAwB;AACpD,YAAI;AACF,gBAAM,KAAK,iBAAiB,WAAW;AAAA,QACzC,SAAS,qBAAqB;AAC5B,gBAAM,wBAAwB,eAAe,UAAU,aAAa;AACpE,gBAAM;AAAA,QACR;AAAA,MACF;AACA,UAAI,mBAAmB;AAIvB,UAAI,mBAA4D;AAChE,UAAI,kBAAkB;AACpB,cAAM,UAAW,SACd;AACH,YACE,CAAC,kCACA,iBAAiB,SAAS,gBAAgB,CAAC,sBAC5C,OAAO,YAAY,YACnB;AACA,gBAAM,wBAAwB,eAAe,UAAU,aAAa;AACpE,gBAAM,IAAI;AAAA,YACR;AAAA,YACA,mBAAmB,cAAc,SAAS,6CAA6C,iBAAiB,WAAW,QAAQ;AAAA,UAC7H;AAAA,QACF;AACA,YAAI;AACF,cACE,iCACC,eAAqD,YACpD,gBAAgB,cAClB;AACA,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAEA,cAAI,iBAAiB,SAAS,gBAAgB,mBAAmB;AAI/D,kBAAM,OAAQ,SAAyD,OACnE;AACJ,gBAAI,OAAO,SAAS;AAClB,oBAAM,IAAI;AAAA,gBACR;AAAA,gBACA;AAAA,cACF;AACF,kBAAM,4BAA4B,MAAM,WAAY;AAAA,cAClD,eAAe,QAAQ,IAAI,UAAoB,eAAe;AAAA,YAChE,CAAC;AAAA,UACH,WAAW,iBAAiB,SAAS,cAAc;AACjD,kBAAM,WAAW,MAAM,iCAAiC,WAAY;AAAA,cAClE,eAAe,8BAA8B,QAAQ;AAAA,cACrD,cAAc,KAAK,MAAM,iBAAiB,WAAW,UAAU,IAAI;AAAA,YACrE,CAAC;AAGD,kBAAM,WAAW,iBAAiB,WAAW;AAC7C,gBACE,SAAS,YAAY,WAAW,SAAS,UACzC,SAAS,YAAY,eAAe,SAAS,cAC7C,SAAS,YAAY,cAAc,SAAS,aAC5C,SAAS,YAAY,mBAAmB,SAAS,gBACjD;AACA,oBAAM,IAAI;AAAA,gBACR;AAAA,gBACA,8BAA8B,iBAAiB,WAAW,QAAQ;AAAA,cACpE;AAAA,YACF;AACA,kBAAM,QAAS,KAAK,UAAU,SAAS,KAAK;AAC5C,+BAAmB,SAAS;AAAA,UAC9B,WAAW,CAAC,+BAA+B;AACzC,kBAAM,QAAS,KAAK,UAAU,iBAAiB,KAAK;AAAA,UACtD;AAAA,QACF,SAAS,OAAO;AACd,gBAAM;AAAA,YACJ;AAAA,YACA;AAAA,YACC,SAAiC;AAAA,UACpC;AACA,cAAI,iBAAiB,+BAAgC,OAAM;AAC3D,gBAAM,IAAI;AAAA,YACR;AAAA,YACA,yDAAyD,iBAAiB,WAAW,QAAQ;AAAA,YAC7F,EAAE,WAAW,MAAM,OAAO,MAAM;AAAA,UAClC;AAAA,QACF;AAOA,cAAM,gBAAiB,SAAiC;AACxD,cAAM,qBAAqB,eAAe,SAAS,QAAQ;AAC3D,YAAI,CAAC,oBAAoB;AACvB,gBAAM,wBAAwB,eAAe,UAAU,aAAa;AACpE,gBAAM,IAAI;AAAA,YACR;AAAA,YACA,oBAAoB,OAAO;AAAA,UAC7B;AAAA,QACF;AACA,YAAI,uBAAuB,YAAY,YAAY;AACjD,wBAAc;AAAA,YACZ,QAAQ;AAAA,YACR,SAAS;AAAA,YACT,cAAc,iBAAiB;AAAA,YAC/B,YAAY;AAAA,YACZ,WAAW,cAAc;AAAA,UAC3B;AACA,cAAI,KAAK,kBAAkB;AACzB,gBAAI;AACF,oBAAM,KAAK,iBAAiB,WAAW;AAAA,YACzC,SAAS,qBAAqB;AAC5B,oBAAM,wBAAwB,eAAe,UAAU,aAAa;AACpE,oBAAM;AAAA,YACR;AAAA,UACF;AAAA,QACF;AACA,YAAI,KAAK,6BAA6B;AACpC,cAAI;AACF,kBAAM,KAAK,4BAA4B,iBAAiB,UAAU;AAAA,UACpE,SAAS,OAAO;AACd,kBAAM;AAAA,cACJ;AAAA,cACA;AAAA,cACC,SAAiC;AAAA,YACpC;AACA,kBAAM;AAAA,UACR;AAAA,QACF;AAKA,YAAI,iBAAiB,SAAS,SAAS,iBAAiB,SAAS,cAAc;AAC7E,cAAI;AACF,gBAAI,kBAAkB;AACpB,oBAAM;AAAA,gBACJ;AAAA,gBACA;AAAA,gBACA,iBAAiB,WAAW;AAAA,cAC9B;AAAA,YACF,OAAO;AACL,oBAAM,wBAAwB,UAAU,iBAAiB,UAAU;AAAA,YACrE;AAAA,UACF,SAAS,OAAO;AACd,kBAAM;AAAA,cACJ;AAAA,cACA;AAAA,cACC,SAAiC;AAAA,YACpC;AACA,gBAAI,iBAAiB,+BAAgC,OAAM;AAC3D,kBAAM,IAAI;AAAA,cACR;AAAA,cACA,wDAAwD,iBAAiB,WAAW,QAAQ;AAAA,cAC5F,EAAE,WAAW,KAAK;AAAA,YACpB;AAAA,UACF;AAAA,QACF;AACA,2BAAmB;AACnB,gBAAQ;AAAA,UACN,kCAAkC,iBAAiB,SAAS,sBAAsB,4BAA4B,sBAAsB,aAAa,iBAAiB,WAAW,QAAQ;AAAA,QACvL;AAAA,MACF;AACA,sBAAiB,SAAiC;AAClD,YAAM,kBAAkB,eAAe,SAAS,QAAQ;AACxD,UAAI,CAAC,iBAAiB;AACpB,cAAM,wBAAwB,eAAe,UAAU,aAAa;AACpE,cAAM,IAAI;AAAA,UACR;AAAA,UACA,oBAAoB,OAAO;AAAA,QAC7B;AAAA,MACF;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,cAAc,iBAAiB;AAAA,QAC/B,YAAY;AAAA,QACZ,WAAW,cAAc;AAAA,QACzB,QAAQ,mBAAoB,aAAwB;AAAA,QACpD,GAAI,mBAAmB,EAAE,iBAAiB,iBAAiB,WAAW,IAAI,CAAC;AAAA,MAC7E;AAAA,IACF,UAAE;AACA,YAAM,WAAW,QAAQ,EAAE,MAAM,MAAM;AAGrC,gBAAQ,KAAK,iDAAiD;AAAA,MAChE,CAAC;AAAA,IACH;AAAA,EACF;AAOA,QAAM,sBAAsB,wCAAwC,SAAS,QAAQ;AACrF,QAAM,uBAAuB,wBAAwB;AAGrD,MACE,wBACA,wBACA,OAAO,UACP,OAAO,yBACP;AACA,QAAI;AACJ,QAAI;AACF,qBAAe,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR;AAAA,QACA,8DAA8D,OAAO,MAAMC,cAAa,KAAK,CAAC;AAAA,MAChG;AAAA,IACF;AACA,QAAI,iBAAiB,QAAW;AAC9B,YAAM,qBACJ,KAAK,aAAa,sBACd,yBAAyB,SAAS,UAAU,cAAc,mBAAmB,IAC7E;AACN,UAAI;AACF,cAAM,UAAU,MAAM;AAAA,UACpB;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,qBAAqB,EAAE,YAAY,mBAAmB,IAAI;AAAA,QAC5D;AACA,cAAM,cAAyC;AAAA,UAC7C;AAAA,UACA,SAAS,QAAQ;AAAA,UACjB,cAAc,QAAQ;AAAA,UACtB,YAAY,QAAQ;AAAA,UACpB,WAAW,OAAO;AAAA,UAClB,QAAQ;AAAA,UACR,GAAI,QAAQ,qBAAqB,EAAE,oBAAoB,QAAQ,mBAAmB,IAAI,CAAC;AAAA,UACvF,GAAI,QAAQ,eAAe,sBACvB,EAAE,gBAAgB,oBAAoB,IACtC,CAAC;AAAA,QACP;AAKA,YAAI,QAAQ,sBAAsB,KAAK,kBAAkB;AACvD,cAAI;AACF,kBAAM,KAAK,iBAAiB,WAAW;AAAA,UACzC,SAAS,OAAO;AACd,kBAAM,mCAAmC,WAAW,EAAE,MAAM,MAAM,MAAS;AAC3E,kBAAM;AAAA,UACR;AAAA,QACF;AACA,eAAO;AAAA,MACT,SAAS,OAAO;AAKd,YACE,CAAC,+BAA+B,OAAO,WAAW,KAAK,KACvD,KAAK,aAAa,eAClB;AACA,gBAAM;AAAA,QACR;AASA,YACE,uBACC,OAAO,2BAA2B,YAAY,uBAAuB,WAAW,IACjF;AACA,gBAAM,IAAI,0CAA0C,SAAS,qBAAqB,OAAO;AAAA,YACvF,OAAO;AAAA,UACT,CAAC;AAAA,QACH;AACA,YAAI;AACJ,YAAI;AACF,4BAAkB,MAAM,YAAY,YAAY;AAAA,QAClD,SAAS,cAAc;AACrB,cAAI,CAAC,mBAAoB,OAAM;AAC/B,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,YACA,wBAAwB,iCAAiC,aAAa,YAAY;AAAA,YAClF,EAAE,OAAO,aAAa;AAAA,UACxB;AAAA,QACF;AACA,eAAO,sBACH,EAAE,GAAG,iBAAiB,gBAAgB,oBAAoB,IAC1D;AAAA,MACN;AAAA,IACF;AAAA,EACF;AAOA,MAAI,KAAK,aAAa,eAAe;AACnC,UAAM,IAAI,mCAAmC,OAAO;AAAA,EACtD;AACA,SAAO,MAAM,YAAY;AAC3B;AAEA,SAAS,0BACP,SACA,SACA,aACA,SACA,WACM;AACN,MAAI;AACF,aAAS,kBAAkB;AAAA,MACzB;AAAA,MACA;AAAA,MACA;AAAA,MACA,iBAAiB,KAAK,IAAI,IAAI,KAAK,IAAI,IAAI,aAAa,GAAI;AAAA,IAC9D,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,uCACP,SACA,SACA,WACA,OACM;AACN,MAAI,CAAC,2BAA2B,KAAK,EAAG;AACxC,MAAI;AACF,aAAS,+BAA+B,EAAE,SAAS,UAAU,CAAC;AAAA,EAChE,QAAQ;AAAA,EAER;AACF;AAsBA,eAAsB,oCACpB,aACyC;AACzC,QAAM,SAAS,YAAY;AAC3B,MAAI,CAAC,UAAU,OAAO,OAAO,0BAA0B,YAAY;AACjE,WAAO;AAAA,EACT;AACA,MAAI,YAAY,iBAAiB,UAAa,YAAY,iBAAiB,MAAM;AAC/E,WAAO;AAAA,EACT;AACA,MAAI;AAIF,UAAM,aAAa,MAAM,OAAO,sBAAsB,YAAY,YAAY;AAa9E,UAAM,OAAO;AACb,UAAM,UAAU,8BAA8B,YAAY,SAAS,KAAK,YAAY;AACpF,UAAM,uBAAuB,gCAAgC,SAAS,IAAI;AAC1E,QAAI,CAAC,wBAAwB,yBAAyB,YAAY,YAAY;AAC5E,aAAO;AAAA,IACT;AACA,UAAM,WAAW,gCAAgC,KAAK,QAAQ;AAC9D,UAAM,eAAe,2BAA2B,KAAK,YAAY;AACjE,UAAM,eAAwC;AAAA,MAC5C,eAAe,sCAAsC,IAAI;AAAA,MACzD,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,MAC7C,GAAI,iBAAiB,SAAY,EAAE,aAAa,IAAI,CAAC;AAAA,MACrD,gBAAgB;AAAA,IAClB;AACA,WAAO;AAAA,MACL,WAAW,YAAY;AAAA,MACvB,CAACH,4CAA2C,GAAG,YAAY;AAAA,MAC3D;AAAA,IACF;AAAA,EACF,QAAQ;AAGN,WAAO;AAAA,EACT;AACF;AAOO,SAAS,sCACd,UACA,SACqC;AACrC,MAAI;AACF,UAAM,kBACJ,YACC,OAAO,UAAU,cAAc,WAC3B,8BAA8B,SAAS,SAAS,KAAK,SAAS,YAC/D;AACN,WAAO,kBACH,wCAAwC,iBAAiB,QAAQ,MAAM,OACvE,sCAAsC,QAAQ,MAAM;AAAA,EAC1D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAKO,IAAM,uCAAN,cAAmD,MAAM;AAAA,EAG9D,YAA4B,SAAiB;AAC3C;AAAA,MACE,oBAAoB,OAAO;AAAA,IAC7B;AAH0B;AAI1B,SAAK,OAAO;AAAA,EACd;AAAA,EAPS,OAAO;AAQlB;AAEO,SAAS,6CACd,UACA,SACyB;AACzB,QAAM,qBAAqB,wCAAwC,SAAS,QAAQ;AACpF,MAAI,CAAC,YAAY,CAAC,oBAAoB;AACpC,UAAM,IAAI,qCAAqC,OAAO;AAAA,EACxD;AACA,SAAO;AACT;AAEA,IAAM,mCAAmC;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,8BACP,UACgC;AAChC,QAAM,eACJ,UAAU,gBAAgB,OAAO,SAAS,iBAAiB,WACtD,SAAS,eACV;AACN,MAAI,CAAC,aAAc,QAAO;AAC1B,QAAM,aAAaC,gCAA+B,aAAa,mBAAmB;AAClF,QAAM,cAAcA,gCAA+B,aAAa,uBAAuB;AACvF,QAAM,YACJ,OAAO,aAAa,qBAAqB,YAAY,aAAa,iBAAiB,SAAS;AAC9F,QAAM,oBACJ,OAAO,aAAa,yBAAyB,YAC7C,aAAa,qBAAqB,SAAS;AAC7C,MAAI,CAAC,aAAa,CAAC,cAAc,CAAC,qBAAqB,CAAC,aAAa;AACnE,WAAO;AAAA,EACT;AACA,QAAM,SAAkC,CAAC;AACzC,aAAW,OAAO,kCAAkC;AAClD,QAAI,aAAa,GAAG,MAAM,UAAa,aAAa,GAAG,MAAM,MAAM;AACjE,aAAO,GAAG,IAAI,aAAa,GAAG;AAAA,IAChC;AAAA,EACF;AACA,SAAO,+CAA+C,MAAM;AAC9D;AAWA,eAAsB,oCACpB,aACA,eACyC;AACzC,QAAM,aAAa,MAAM,oCAAoC,WAAW;AACxE,QAAM,gBAAgB,8BAA8B,aAAa;AACjE,MAAI,CAAC,cAAc,CAAC,eAAe;AACjC,WAAO;AAAA,EACT;AACA,QAAM,yBACJ,YAAY,gBAAgB,OAAO,WAAW,iBAAiB,WAC1D,WAAW,eACZ,CAAC;AACP,QAAM,eAAwC;AAAA,IAC5C,GAAG;AAAA,IACH,GAAI,iBAAiB,CAAC;AAAA,EACxB;AAGA,MAAIA,gCAA+B,aAAa,mBAAmB,GAAG;AACpE,WAAO,aAAa;AAAA,EACtB;AACA,MAAIA,gCAA+B,aAAa,uBAAuB,GAAG;AACxE,WAAO,aAAa;AAAA,EACtB;AACA,SAAO;AAAA,IACL,GAAI,cAAc,CAAC;AAAA;AAAA;AAAA;AAAA,IAInB,WAAW,YAAY;AAAA,IACvB;AAAA,EACF;AACF;","names":["createHash","constants","lstat","open","readdir","realpath","isAbsolute","join","lstat","readdir","join","decodeNativeSnapshotRef","WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION","decodeNativeSnapshotRef","encodeNativeSnapshotRef","parseWorkspaceArchiveDescriptor","base64","status","shellQuote","lstat","readdir","join","run","resolve","descriptor","constants","isAbsolute","open","realpath","handle","readdir","lstat","createHash","sha256","join","encoder","decoder","BROWSER_CONTROL_PORT","DESKTOP_STREAM_PORT","OPENGENI_SANDBOX_PROVIDER_INSTANCE_ID_FIELD","TERMINAL_STREAM_PORT","parseWorkspaceArchiveObjectRef","parseWorkspaceArchiveDescriptor","SandboxBackend","status","readText","resolve","requestId","randomUUID","posix","createHash","lstat","readdir","DESKTOP_STREAM_PORT","DESKTOP_STREAM_PORT","StreamTokenPayload","DESKTOP_STREAM_PORT","decoder","encoder","frame","errorMessage","createHash","resolve","process","status","sessionId","consumed","output","readText","lstat","readdir","delay","resolve","randomUUID","workspacePath","posix","parseStateString","requestId","execFile","lstat","isAbsolute","promisify","isAbsolute","join","resolve","constants","lstat","open","readdir","realpath","rm","errorMessage","UUID","invalid","isAbsolute","resolve","fingerprint","realpath","lstat","readdir","join","open","constants","rm","release","execFileAsync","promisify","execFile","lstat","isAbsolute","lstat","isAbsolute","isAbsolute","lstat","validateCredentialPair","DEFAULT_EXEC_YIELD_TIME_MS","DEFAULT_WRITE_STDIN_YIELD_TIME_MS","process","DEFAULT_EXEC_YIELD_TIME_MS","output","DEFAULT_WRITE_STDIN_YIELD_TIME_MS","absolutePath","status","ModalClient","image","resolve","randomUUID","isDeepStrictEqual","status","isDeepStrictEqual","delay","errorMessage","quote","isDeepStrictEqual","delay","resolve","isDeepStrictEqual","receipts","randomUUID","resolve","randomUUID","posix","delay","ModalRouterProviderCommand","result","resolve","run","lookup","posix","randomUUID","delay","ModalRouterProviderCommand","createHash","AsyncLocalStorage","createHash","ModalClient","CREATE_PATH","run","errorMessage","run","workspaceRoot","status","requestId","observe","binding","binding","sandbox","SandboxBackend","errorMessage","isRecord","collectSandboxEnvironment","parseExposedPorts","frame","createHash","canonicalModalCheckpointProviderBinding","sha256","createHash","DESKTOP_STREAM_PORT","LEGACY_SANDBOX_PROVIDER_INSTANCE_ID_FIELDS","DESKTOP_STREAM_PORT","shellQuote","LEGACY_SANDBOX_PROVIDER_INSTANCE_ID_FIELDS","state","resolve","status","execResultOutput","execResultExitCode","inferExitFromOutput","shellQuote","createHash","randomUUID","posixPath","BROWSER_CONTROL_PORT","MARKER","quote","status","status","boundedPort","randomUUID","shellQuote","BROWSER_CONTROL_PORT","boundedTimeout","binding","sha256","frame","createHash","posixPath","isRecord","shellQuote","outputOf","createHash","posixPath","createHash","randomUUID","dirname","join","posix","resolve","createHash","workspaceRoot","posix","join","dirname","resolve","run","randomUUID","shellQuote","posixPath","createHash","DESKTOP_STREAM_PORT","ErrorCode","requestId","ErrorCode","encoder","run","errorResponse","ErrorCode","requestId","frame","concat","status","DESKTOP_STREAM_PORT","TERMINAL_STREAM_PORT","BROWSER_CONTROL_PORT","decodeNativeSnapshotRef","isRecord","run","result","resolve","OPENGENI_SANDBOX_PROVIDER_INSTANCE_ID_FIELD","parseWorkspaceArchiveObjectRef","parseWorkspaceArchiveDescriptor","errorMessage"]}