@opengeni/worker-bundle 1.0.1 → 2.0.0

package/dist/artifact-materializer-entry.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/editable-artifact-materializer-service.ts","../src/editable-artifact-materializer.ts","../src/editable-artifact-materializer-storage.ts","../src/editable-artifact-materializer-subprocess.ts","../src/editable-artifact-materializer-launcher.ts","../src/artifact-materializer-entry.ts"],"sourcesContent":["import { dbSearchPath, getSettings, type Settings } from \"@opengeni/config\";\nimport {\n  createDb,\n  dbSql,\n  PostgresEditableArtifactMaterializationRepository,\n  type Database,\n} from \"@opengeni/db\";\nimport { createObservability, type Observability } from \"@opengeni/observability\";\nimport { createObjectStorage, type ObjectStorage } from \"@opengeni/storage\";\nimport { dirname } from \"node:path\";\n\nimport {\n  EDITABLE_ARTIFACT_MATERIALIZER_DATABASE_ROLE,\n  EDITABLE_ARTIFACT_MATERIALIZER_MAX_OUTPUT_BYTES,\n  EDITABLE_ARTIFACT_MATERIALIZER_MAX_SOURCE_BYTES,\n  EditableArtifactMaterializer,\n  createConfiguredEditableArtifactMaterializer,\n  systemEditableArtifactMaterializerClock,\n  systemEditableArtifactMaterializerScheduler,\n  type EditableArtifactMaterializerPassSummary,\n} from \"./editable-artifact-materializer\";\nimport {\n  createEditableArtifactObjectStorageReader,\n  createEditableArtifactObjectStorageVerifier,\n  createEditableArtifactObjectStorageWriter,\n} from \"./editable-artifact-materializer-storage\";\nimport {\n  createNativeEditableArtifactSubprocessPort,\n  type NativeEditableArtifactSubprocessOptions,\n} from \"./editable-artifact-materializer-subprocess\";\nimport {\n  createDevelopmentEditableArtifactProcessLauncher,\n  createLinuxEditableArtifactProcessLauncher,\n} from \"./editable-artifact-materializer-launcher\";\n\nexport type EditableArtifactRuntimeAuthority =\n  | Readonly<{\n      mode: \"production\";\n      environmentVariable: \"OPENGENI_ARTIFACT_RUNTIME_MANIFEST\";\n      manifestPath: string;\n    }>\n  | Readonly<{\n      mode: \"development-current-host\";\n      environmentVariable: \"OPENGENI_ARTIFACT_DEVELOPMENT_RUNTIME_MANIFEST\";\n      manifestPath: string;\n    }>;\n\nexport type EditableArtifactMaterializerServiceState =\n  | \"starting\"\n  | \"ready\"\n  | \"draining\"\n  | \"stopped\"\n  | \"failed\";\n\nexport type EditableArtifactMaterializerService = Readonly<{\n  state(): EditableArtifactMaterializerServiceState;\n  run(): Promise<void>;\n  drain(reason?: string): boolean;\n  close(): Promise<void>;\n  dispatchOnce(signal?: AbortSignal): Promise<EditableArtifactMaterializerPassSummary>;\n  fetch(request: Request): Promise<Response>;\n}>;\n\nexport type CreateEditableArtifactMaterializerServiceInput = Readonly<{\n  materializer: EditableArtifactMaterializer;\n  db: Database;\n  closeDatabase: () => Promise<void>;\n  observability: Observability;\n  serviceName: string;\n  environment: string;\n  deploymentRevision?: string;\n  readinessTimeoutMs?: number;\n  runtimeCapability?: Readonly<{\n    mode: EditableArtifactRuntimeAuthority[\"mode\"];\n    sandboxEnforced: boolean;\n  }>;\n}>;\n\nexport type ProductionEditableArtifactMaterializerServiceOptions = Readonly<{\n  settings: Settings;\n  /** Dedicated DSN; never defaults to settings.databaseUrl. */\n  databaseUrl: string;\n  declaredDatabaseRole: string;\n  executable: string;\n  bubblewrapExecutable: string | null;\n  prlimitExecutable: string | null;\n  runtimeAuthority: EditableArtifactRuntimeAuthority;\n  /** Explicit exception selected only by the validated local-dev sidecar config. */\n  allowUnsandboxedLocalDevelopment?: boolean;\n  skillFacadeEntrypoint: string;\n  owner: string;\n  objectStorage?: ObjectStorage;\n  batchSize?: number;\n  concurrency?: number;\n  leaseDurationMs?: number;\n  leaseRenewIntervalMs?: number;\n  pollIntervalMs?: number;\n  maxAttempts?: number;\n  memoryLimitBytes: number;\n  cpuTimeLimitMs: number;\n  fileDescriptorLimit: number;\n  processLimit: number;\n  fileSizeLimitBytes: number;\n  wallTimeoutMs: number;\n  nodeEnvironment?: string;\n  maxSourceBytes?: number;\n  maxOutputBytes?: number;\n}>;\n\n/**\n * Compose the distinct production sidecar. It creates its own connection pool\n * from the dedicated DSN and never reuses a control/turn worker handle.\n */\nexport async function createProductionEditableArtifactMaterializerService(\n  options: ProductionEditableArtifactMaterializerServiceOptions,\n): Promise<EditableArtifactMaterializerService> {\n  if (options.declaredDatabaseRole !== EDITABLE_ARTIFACT_MATERIALIZER_DATABASE_ROLE) {\n    throw new Error(\"Artifact materializer database role declaration is invalid\");\n  }\n  if (typeof options.databaseUrl !== \"string\" || options.databaseUrl.trim().length === 0) {\n    throw new Error(\"Artifact materializer requires its dedicated database DSN\");\n  }\n  const maxSourceBytes = options.maxSourceBytes ?? EDITABLE_ARTIFACT_MATERIALIZER_MAX_SOURCE_BYTES;\n  const maxOutputBytes = options.maxOutputBytes ?? EDITABLE_ARTIFACT_MATERIALIZER_MAX_OUTPUT_BYTES;\n  const concurrency = options.concurrency ?? 2;\n  const development = options.runtimeAuthority.mode === \"development-current-host\";\n  if (development !== (options.allowUnsandboxedLocalDevelopment === true)) {\n    throw new Error(\"Artifact materializer runtime authority and local-development gate differ\");\n  }\n  const launcher = development\n    ? await createDevelopmentEditableArtifactProcessLauncher({\n        materializerExecutable: options.executable,\n        explicitlyEnabled: options.allowUnsandboxedLocalDevelopment === true,\n        nodeEnvironment: options.nodeEnvironment,\n      })\n    : await createLinuxEditableArtifactProcessLauncher({\n        materializerExecutable: options.executable,\n        bubblewrapExecutable: requiredOption(options.bubblewrapExecutable, \"bubblewrap\"),\n        prlimitExecutable: requiredOption(options.prlimitExecutable, \"prlimit\"),\n        runtimeRoot: dirname(options.runtimeAuthority.manifestPath),\n        memoryLimitBytes: options.memoryLimitBytes,\n        cpuTimeLimitMs: options.cpuTimeLimitMs,\n        fileDescriptorLimit: options.fileDescriptorLimit,\n        processLimit: options.processLimit,\n        fileSizeLimitBytes: options.fileSizeLimitBytes,\n      });\n  const searchPath = dbSearchPath(options.settings);\n  const dbClient = createDb(options.databaseUrl, {\n    ...(searchPath ? { searchPath } : {}),\n    ...(options.settings.rlsStrategy ? { rlsStrategy: options.settings.rlsStrategy } : {}),\n    max: Math.max(2, concurrency + 1),\n  });\n  let created = false;\n  try {\n    await assertDedicatedMaterializerDatabaseRole(dbClient.db);\n    const objectStorage = options.objectStorage ?? createObjectStorage(options.settings);\n    if (!objectStorage) throw new Error(\"Artifact materializer object storage is unavailable\");\n    const subprocessOptions: NativeEditableArtifactSubprocessOptions = {\n      executable: options.executable,\n      launcher,\n      childEnvironment:\n        options.runtimeAuthority.mode === \"production\"\n          ? Object.freeze({\n              OPENGENI_ARTIFACT_RUNTIME_MANIFEST: options.runtimeAuthority.manifestPath,\n              OPENGENI_ARTIFACT_TOOL_ENTRY: options.skillFacadeEntrypoint,\n            })\n          : Object.freeze({\n              NODE_ENV: \"development\",\n              OPENGENI_ARTIFACT_DEVELOPMENT_RUNTIME_MANIFEST: options.runtimeAuthority.manifestPath,\n              OPENGENI_ARTIFACT_TOOL_ENTRY: options.skillFacadeEntrypoint,\n            }),\n      ...(development ? { allowUnsandboxedDevelopment: true } : {}),\n      wallTimeoutMs: options.wallTimeoutMs,\n      maxSourceBytes,\n      maxOutputBytes,\n    };\n    const kernel = await createNativeEditableArtifactSubprocessPort(subprocessOptions);\n    const repository = new PostgresEditableArtifactMaterializationRepository(dbClient.db, {\n      ...(options.settings.dbSchema.trim() ? { dataSchema: options.settings.dbSchema.trim() } : {}),\n    });\n    const observability = createObservability(options.settings, {\n      component: \"artifact-materializer\",\n    });\n    if (development) {\n      observability.warn(\"Artifact materializer is running without an OS sandbox\", {\n        errorClass: \"DevelopmentSecurityPosture\",\n        errorCode: \"artifact_materializer_unsandboxed_development\",\n        origin: \"worker\",\n        outcome: \"degraded\",\n      });\n    }\n    const materializer = createConfiguredEditableArtifactMaterializer({\n      enabled: true,\n      databaseRole: options.declaredDatabaseRole,\n      objectStorageConfigured: true,\n      ...(development ? { allowUnsandboxedDevelopment: true } : {}),\n      dependencies: {\n        store: repository,\n        sourceReader: createEditableArtifactObjectStorageReader(objectStorage),\n        outputWriter: createEditableArtifactObjectStorageWriter(objectStorage),\n        outputVerifier: createEditableArtifactObjectStorageVerifier(objectStorage, {\n          verify: kernel.verifyMaterialization,\n        }),\n        kernel,\n        scheduler: systemEditableArtifactMaterializerScheduler,\n        clock: systemEditableArtifactMaterializerClock,\n        logger: {\n          warn(message, attributes) {\n            observability.warn(message, {\n              errorClass: \"WorkerOperationError\",\n              errorCode: materializerFailureErrorCode(attributes) ?? \"worker_operation_failed\",\n              origin: \"worker\",\n              outcome: typeof attributes.code === \"string\" ? attributes.code : \"unknown\",\n            });\n          },\n        },\n        metrics: {\n          increment(outcome, count = 1) {\n            observability.incrementCounter({\n              name: \"opengeni_artifact_materializations_total\",\n              help: \"Editable artifact materialization attempts by closed outcome.\",\n              labels: { outcome },\n              amount: count,\n            });\n          },\n        },\n      },\n      options: {\n        owner: options.owner,\n        ...(options.batchSize !== undefined ? { batchSize: options.batchSize } : {}),\n        concurrency,\n        ...(options.leaseDurationMs !== undefined\n          ? { leaseDurationMs: options.leaseDurationMs }\n          : {}),\n        ...(options.leaseRenewIntervalMs !== undefined\n          ? { leaseRenewIntervalMs: options.leaseRenewIntervalMs }\n          : {}),\n        ...(options.pollIntervalMs !== undefined ? { pollIntervalMs: options.pollIntervalMs } : {}),\n        ...(options.maxAttempts !== undefined ? { maxAttempts: options.maxAttempts } : {}),\n        maxSourceBytes,\n        maxOutputBytes,\n      },\n    });\n    if (!materializer) throw new Error(\"Artifact materializer is unexpectedly disabled\");\n    created = true;\n    return createEditableArtifactMaterializerService({\n      materializer,\n      db: dbClient.db,\n      closeDatabase: dbClient.close,\n      observability,\n      serviceName: options.settings.serviceName,\n      environment: options.settings.environment,\n      deploymentRevision: options.settings.deploymentRevision,\n      runtimeCapability: Object.freeze({\n        mode: options.runtimeAuthority.mode,\n        sandboxEnforced: launcher.identity.sandboxEnforced,\n      }),\n    });\n  } finally {\n    if (!created) await dbClient.close();\n  }\n}\n\nfunction materializerFailureErrorCode(\n  attributes: Readonly<Record<string, unknown>>,\n):\n  | \"artifact_materializer_source_open_failed\"\n  | \"artifact_materializer_source_content_type_mismatch\"\n  | \"artifact_materializer_source_stream_identity_mismatch\"\n  | \"artifact_materializer_source_revalidation_failed\"\n  | \"artifact_materializer_native_input_framing_failed\"\n  | \"artifact_materializer_native_snapshot_open_failed\"\n  | \"artifact_materializer_native_state_mismatch\"\n  | undefined {\n  const key = `${String(attributes.failureStage)}:${String(attributes.failureSubcode)}`;\n  switch (key) {\n    case \"source_reader:open\":\n      return \"artifact_materializer_source_open_failed\";\n    case \"source_reader:content_type\":\n      return \"artifact_materializer_source_content_type_mismatch\";\n    case \"source_reader:stream_identity\":\n      return \"artifact_materializer_source_stream_identity_mismatch\";\n    case \"source_reader:revalidate\":\n      return \"artifact_materializer_source_revalidation_failed\";\n    case \"native:input_framing\":\n      return \"artifact_materializer_native_input_framing_failed\";\n    case \"native:snapshot_open\":\n      return \"artifact_materializer_native_snapshot_open_failed\";\n    case \"native:state_mismatch\":\n      return \"artifact_materializer_native_state_mismatch\";\n  }\n}\n\nexport function createEditableArtifactMaterializerService(\n  input: CreateEditableArtifactMaterializerServiceInput,\n): EditableArtifactMaterializerService {\n  let state: EditableArtifactMaterializerServiceState = \"starting\";\n  let runPromise: Promise<void> | null = null;\n  let closePromise: Promise<void> | null = null;\n  let databaseClosed = false;\n  const abort = new AbortController();\n  const readinessTimeoutMs = input.readinessTimeoutMs ?? 2_000;\n\n  const ready = async (): Promise<void> => {\n    await withTimeout(assertDedicatedMaterializerDatabaseRole(input.db), readinessTimeoutMs);\n  };\n\n  const run = (): Promise<void> => {\n    if (runPromise) return runPromise;\n    if (state !== \"starting\") {\n      return Promise.reject(new Error(\"Artifact materializer service cannot be restarted\"));\n    }\n    runPromise = (async () => {\n      try {\n        await ready();\n        if (abort.signal.aborted) {\n          state = \"stopped\";\n          return;\n        }\n        state = \"ready\";\n        await input.materializer.run(abort.signal);\n        const exitWasDraining = (state as EditableArtifactMaterializerServiceState) === \"draining\";\n        state = exitWasDraining ? \"stopped\" : \"failed\";\n        if (!exitWasDraining) {\n          throw new Error(\"Artifact materializer loop exited without a drain request\");\n        }\n      } catch (error) {\n        const caughtState = state as EditableArtifactMaterializerServiceState;\n        if (caughtState !== \"draining\" && caughtState !== \"stopped\") state = \"failed\";\n        throw error;\n      }\n    })();\n    return runPromise;\n  };\n\n  const drain = (_reason = \"shutdown\"): boolean => {\n    if (state === \"draining\" || state === \"stopped\" || state === \"failed\") return false;\n    state = \"draining\";\n    abort.abort();\n    return true;\n  };\n\n  const close = (): Promise<void> => {\n    if (closePromise) return closePromise;\n    closePromise = (async () => {\n      drain(\"close\");\n      if (runPromise) await runPromise.catch(() => undefined);\n      await input.materializer.drain();\n      if (!databaseClosed) {\n        databaseClosed = true;\n        await input.closeDatabase();\n      }\n      if (state !== \"failed\") state = \"stopped\";\n    })();\n    return closePromise;\n  };\n\n  const fetch = async (request: Request): Promise<Response> => {\n    const url = new URL(request.url);\n    if (request.method !== \"GET\") {\n      return Response.json({ error: \"method_not_allowed\" }, { status: 405 });\n    }\n    if (url.pathname === \"/healthz\") {\n      const ok = state !== \"failed\" && state !== \"stopped\";\n      return Response.json(\n        {\n          service: input.serviceName,\n          component: \"artifact-materializer\",\n          environment: input.environment,\n          ...(input.deploymentRevision ? { deploymentRevision: input.deploymentRevision } : {}),\n          runtime: input.runtimeCapability ?? {\n            mode: \"production\",\n            sandboxEnforced: true,\n          },\n          state,\n          ok,\n        },\n        { status: ok ? 200 : 503 },\n      );\n    }\n    if (url.pathname === \"/readyz\") {\n      if (state !== \"ready\") {\n        return Response.json(\n          { ok: false, state, checks: { databaseRole: { ok: false } } },\n          { status: 503 },\n        );\n      }\n      try {\n        await ready();\n        return Response.json({\n          ok: true,\n          state,\n          runtime: input.runtimeCapability ?? {\n            mode: \"production\",\n            sandboxEnforced: true,\n          },\n          checks: { databaseRole: { ok: true } },\n        });\n      } catch {\n        return Response.json(\n          { ok: false, state, checks: { databaseRole: { ok: false } } },\n          { status: 503 },\n        );\n      }\n    }\n    if (url.pathname === \"/metrics\") {\n      return new Response(await input.observability.prometheusMetrics(), {\n        status: 200,\n        headers: { \"content-type\": \"text/plain; version=0.0.4; charset=utf-8\" },\n      });\n    }\n    return Response.json({ error: \"not_found\" }, { status: 404 });\n  };\n\n  return Object.freeze({\n    state: () => state,\n    run,\n    drain,\n    close,\n    dispatchOnce: async (signal?: AbortSignal) => await input.materializer.dispatchOnce(signal),\n    fetch,\n  });\n}\n\nexport async function assertDedicatedMaterializerDatabaseRole(db: Database): Promise<void> {\n  const raw = await db.execute<{\n    current_role: string;\n    session_role: string;\n    can_select_jobs: boolean;\n    can_insert_jobs: boolean;\n    can_update_jobs: boolean;\n    can_delete_jobs: boolean;\n  }>(dbSql`\n    select\n      current_user::text as current_role,\n      session_user::text as session_role,\n      has_table_privilege(\n        current_user,\n        format('%I.editable_artifact_materialization_jobs', current_schema()),\n        'SELECT'\n      ) as can_select_jobs,\n      has_table_privilege(\n        current_user,\n        format('%I.editable_artifact_materialization_jobs', current_schema()),\n        'INSERT'\n      ) as can_insert_jobs,\n      has_table_privilege(\n        current_user,\n        format('%I.editable_artifact_materialization_jobs', current_schema()),\n        'UPDATE'\n      ) as can_update_jobs,\n      has_table_privilege(\n        current_user,\n        format('%I.editable_artifact_materialization_jobs', current_schema()),\n        'DELETE'\n      ) as can_delete_jobs\n  `);\n  const rows = Array.isArray(raw) ? raw : ((raw as unknown as { rows?: unknown[] }).rows ?? []);\n  const row = rows[0] as\n    | {\n        current_role?: unknown;\n        session_role?: unknown;\n        can_select_jobs?: unknown;\n        can_insert_jobs?: unknown;\n        can_update_jobs?: unknown;\n        can_delete_jobs?: unknown;\n      }\n    | undefined;\n  if (\n    row?.current_role !== EDITABLE_ARTIFACT_MATERIALIZER_DATABASE_ROLE ||\n    row.session_role !== EDITABLE_ARTIFACT_MATERIALIZER_DATABASE_ROLE ||\n    row.can_select_jobs !== false ||\n    row.can_insert_jobs !== false ||\n    row.can_update_jobs !== false ||\n    row.can_delete_jobs !== false\n  ) {\n    throw new Error(\"Artifact materializer database connection has an unsafe role posture\");\n  }\n}\n\nexport type EditableArtifactMaterializerSidecarEnvironment = Readonly<{\n  databaseUrl: string;\n  declaredDatabaseRole: string;\n  executable: string;\n  bubblewrapExecutable: string | null;\n  prlimitExecutable: string | null;\n  runtimeAuthority: EditableArtifactRuntimeAuthority;\n  skillFacadeEntrypoint: string;\n  owner: string;\n  httpHostname: string;\n  httpPort: number;\n  batchSize: number;\n  concurrency: number;\n  leaseDurationMs: number;\n  leaseRenewIntervalMs: number;\n  pollIntervalMs: number;\n  maxAttempts: number;\n  memoryLimitBytes: number;\n  cpuTimeLimitMs: number;\n  fileDescriptorLimit: number;\n  processLimit: number;\n  fileSizeLimitBytes: number;\n  wallTimeoutMs: number;\n  maxSourceBytes: number;\n  maxOutputBytes: number;\n  allowUnsandboxedLocalDevelopment: boolean;\n  nodeEnvironment?: string;\n}>;\n\nexport function readEditableArtifactMaterializerSidecarEnvironment(\n  environment: NodeJS.ProcessEnv = process.env,\n): EditableArtifactMaterializerSidecarEnvironment | null {\n  if (environment.OPENGENI_ARTIFACT_MATERIALIZER_ENABLED !== \"true\") return null;\n  const databaseUrl = required(environment, \"OPENGENI_ARTIFACT_MATERIALIZER_DATABASE_URL\");\n  const declaredDatabaseRole = required(\n    environment,\n    \"OPENGENI_ARTIFACT_MATERIALIZER_DATABASE_ROLE\",\n  );\n  if (declaredDatabaseRole !== EDITABLE_ARTIFACT_MATERIALIZER_DATABASE_ROLE) {\n    throw new Error(\"OPENGENI_ARTIFACT_MATERIALIZER_DATABASE_ROLE is invalid\");\n  }\n  const productionManifest = optional(environment, \"OPENGENI_ARTIFACT_RUNTIME_MANIFEST\");\n  const developmentManifest = optional(\n    environment,\n    \"OPENGENI_ARTIFACT_DEVELOPMENT_RUNTIME_MANIFEST\",\n  );\n  if (productionManifest && developmentManifest) {\n    throw new Error(\n      \"Production and development artifact runtime manifests cannot both be configured\",\n    );\n  }\n  if (!productionManifest && !developmentManifest) {\n    throw new Error(\n      \"An artifact runtime manifest is required when artifact materialization is enabled\",\n    );\n  }\n  const development = developmentManifest !== null;\n  if (development) {\n    if (environment.NODE_ENV === \"production\") {\n      throw new Error(\"Development artifact runtime is forbidden when NODE_ENV=production\");\n    }\n    if (\n      environment.OPENGENI_ARTIFACT_LOCAL_DEVELOPMENT !== \"true\" ||\n      environment.OPENGENI_ARTIFACT_MATERIALIZER_UNSANDBOXED_DEVELOPMENT !== \"true\"\n    ) {\n      throw new Error(\n        \"Unsandboxed artifact materialization requires explicit local-development gates\",\n      );\n    }\n    assertLoopbackDatabaseUrl(databaseUrl);\n    assertLoopbackObjectStorageUrl(required(environment, \"OPENGENI_OBJECT_STORAGE_ENDPOINT\"));\n  }\n  const httpHostname =\n    optional(environment, \"OPENGENI_ARTIFACT_MATERIALIZER_HTTP_HOST\") ?? \"0.0.0.0\";\n  if (development && !isLoopbackHostname(httpHostname)) {\n    throw new Error(\"Unsandboxed artifact materialization requires a loopback HTTP listener\");\n  }\n  const runtimeAuthority: EditableArtifactRuntimeAuthority = developmentManifest\n    ? Object.freeze({\n        mode: \"development-current-host\",\n        environmentVariable: \"OPENGENI_ARTIFACT_DEVELOPMENT_RUNTIME_MANIFEST\",\n        manifestPath: developmentManifest,\n      })\n    : Object.freeze({\n        mode: \"production\",\n        environmentVariable: \"OPENGENI_ARTIFACT_RUNTIME_MANIFEST\",\n        manifestPath: productionManifest!,\n      });\n  return Object.freeze({\n    databaseUrl,\n    declaredDatabaseRole,\n    executable: required(environment, \"OPENGENI_ARTIFACT_MATERIALIZER_EXECUTABLE\"),\n    bubblewrapExecutable: development\n      ? null\n      : required(environment, \"OPENGENI_ARTIFACT_MATERIALIZER_BWRAP\"),\n    prlimitExecutable: development\n      ? null\n      : required(environment, \"OPENGENI_ARTIFACT_MATERIALIZER_PRLIMIT\"),\n    runtimeAuthority,\n    allowUnsandboxedLocalDevelopment: development,\n    skillFacadeEntrypoint: required(environment, \"OPENGENI_ARTIFACT_TOOL_ENTRY\"),\n    owner:\n      environment.OPENGENI_ARTIFACT_MATERIALIZER_OWNER?.trim() ||\n      `materializer-${process.pid}-${crypto.randomUUID()}`,\n    httpHostname,\n    httpPort: integer(environment, \"OPENGENI_ARTIFACT_MATERIALIZER_HTTP_PORT\", 9465, 1, 65_535),\n    batchSize: integer(environment, \"OPENGENI_ARTIFACT_MATERIALIZER_BATCH_SIZE\", 8, 1, 64),\n    concurrency: integer(environment, \"OPENGENI_ARTIFACT_MATERIALIZER_CONCURRENCY\", 2, 1, 64),\n    leaseDurationMs: integer(\n      environment,\n      \"OPENGENI_ARTIFACT_MATERIALIZER_LEASE_MS\",\n      120_000,\n      10_000,\n      86_400_000,\n    ),\n    leaseRenewIntervalMs: integer(\n      environment,\n      \"OPENGENI_ARTIFACT_MATERIALIZER_RENEW_MS\",\n      30_000,\n      1_000,\n      43_199_999,\n    ),\n    pollIntervalMs: integer(\n      environment,\n      \"OPENGENI_ARTIFACT_MATERIALIZER_POLL_MS\",\n      1_000,\n      10,\n      60_000,\n    ),\n    maxAttempts: integer(environment, \"OPENGENI_ARTIFACT_MATERIALIZER_MAX_ATTEMPTS\", 20, 1, 1_000),\n    memoryLimitBytes: integer(\n      environment,\n      \"OPENGENI_ARTIFACT_MATERIALIZER_MEMORY_BYTES\",\n      512 * 1024 * 1024,\n      64 * 1024 * 1024,\n      8 * 1024 * 1024 * 1024,\n    ),\n    cpuTimeLimitMs: integer(\n      environment,\n      \"OPENGENI_ARTIFACT_MATERIALIZER_CPU_MS\",\n      60_000,\n      1_000,\n      3_600_000,\n    ),\n    fileDescriptorLimit: integer(\n      environment,\n      \"OPENGENI_ARTIFACT_MATERIALIZER_OPEN_FILES\",\n      64,\n      16,\n      4_096,\n    ),\n    processLimit: integer(environment, \"OPENGENI_ARTIFACT_MATERIALIZER_PROCESSES\", 64, 1, 1_024),\n    fileSizeLimitBytes: integer(\n      environment,\n      \"OPENGENI_ARTIFACT_MATERIALIZER_FILE_BYTES\",\n      512 * 1024 * 1024,\n      1024 * 1024,\n      8 * 1024 * 1024 * 1024,\n    ),\n    wallTimeoutMs: integer(\n      environment,\n      \"OPENGENI_ARTIFACT_MATERIALIZER_WALL_MS\",\n      120_000,\n      1_000,\n      3_600_000,\n    ),\n    maxSourceBytes: integer(\n      environment,\n      \"OPENGENI_ARTIFACT_MATERIALIZER_MAX_SOURCE_BYTES\",\n      EDITABLE_ARTIFACT_MATERIALIZER_MAX_SOURCE_BYTES,\n      1,\n      EDITABLE_ARTIFACT_MATERIALIZER_MAX_SOURCE_BYTES,\n    ),\n    maxOutputBytes: integer(\n      environment,\n      \"OPENGENI_ARTIFACT_MATERIALIZER_MAX_OUTPUT_BYTES\",\n      EDITABLE_ARTIFACT_MATERIALIZER_MAX_OUTPUT_BYTES,\n      1,\n      EDITABLE_ARTIFACT_MATERIALIZER_MAX_OUTPUT_BYTES,\n    ),\n    ...(environment.NODE_ENV === undefined ? {} : { nodeEnvironment: environment.NODE_ENV }),\n  });\n}\n\nexport async function createMaterializerSidecarFromEnvironment(\n  environment: NodeJS.ProcessEnv = process.env,\n): Promise<Readonly<{\n  service: EditableArtifactMaterializerService;\n  httpHostname: string;\n  httpPort: number;\n}> | null> {\n  const sidecar = readEditableArtifactMaterializerSidecarEnvironment(environment);\n  if (!sidecar) return null;\n  const settings = getSettings();\n  const service = await createProductionEditableArtifactMaterializerService({\n    settings,\n    databaseUrl: sidecar.databaseUrl,\n    declaredDatabaseRole: sidecar.declaredDatabaseRole,\n    executable: sidecar.executable,\n    bubblewrapExecutable: sidecar.bubblewrapExecutable,\n    prlimitExecutable: sidecar.prlimitExecutable,\n    runtimeAuthority: sidecar.runtimeAuthority,\n    ...(sidecar.allowUnsandboxedLocalDevelopment ? { allowUnsandboxedLocalDevelopment: true } : {}),\n    skillFacadeEntrypoint: sidecar.skillFacadeEntrypoint,\n    owner: sidecar.owner,\n    batchSize: sidecar.batchSize,\n    concurrency: sidecar.concurrency,\n    leaseDurationMs: sidecar.leaseDurationMs,\n    leaseRenewIntervalMs: sidecar.leaseRenewIntervalMs,\n    pollIntervalMs: sidecar.pollIntervalMs,\n    maxAttempts: sidecar.maxAttempts,\n    memoryLimitBytes: sidecar.memoryLimitBytes,\n    cpuTimeLimitMs: sidecar.cpuTimeLimitMs,\n    fileDescriptorLimit: sidecar.fileDescriptorLimit,\n    processLimit: sidecar.processLimit,\n    fileSizeLimitBytes: sidecar.fileSizeLimitBytes,\n    wallTimeoutMs: sidecar.wallTimeoutMs,\n    maxSourceBytes: sidecar.maxSourceBytes,\n    maxOutputBytes: sidecar.maxOutputBytes,\n    ...(sidecar.nodeEnvironment === undefined ? {} : { nodeEnvironment: sidecar.nodeEnvironment }),\n  });\n  return Object.freeze({\n    service,\n    httpHostname: sidecar.httpHostname,\n    httpPort: sidecar.httpPort,\n  });\n}\n\nasync function withTimeout<T>(promise: Promise<T>, milliseconds: number): Promise<T> {\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  try {\n    return await Promise.race([\n      promise,\n      new Promise<never>((_resolve, reject) => {\n        timer = setTimeout(() => reject(new Error(\"readiness check timed out\")), milliseconds);\n      }),\n    ]);\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n}\n\nfunction required(environment: NodeJS.ProcessEnv, name: string): string {\n  const value = environment[name]?.trim();\n  if (!value) throw new Error(`${name} is required when artifact materialization is enabled`);\n  return value;\n}\n\nfunction optional(environment: NodeJS.ProcessEnv, name: string): string | null {\n  const value = environment[name]?.trim();\n  return value ? value : null;\n}\n\nfunction requiredOption(value: string | null, name: string): string {\n  if (!value) throw new Error(`Artifact materializer ${name} is required in production`);\n  return value;\n}\n\nfunction assertLoopbackDatabaseUrl(databaseUrl: string): void {\n  let parsed: URL;\n  try {\n    parsed = new URL(databaseUrl);\n  } catch {\n    throw new Error(\"Local-development artifact materializer database DSN is invalid\");\n  }\n  if (parsed.protocol !== \"postgres:\" && parsed.protocol !== \"postgresql:\") {\n    throw new Error(\"Local-development artifact materializer database DSN is invalid\");\n  }\n  if (!isLoopbackHostname(parsed.hostname)) {\n    throw new Error(\"Unsandboxed artifact materialization requires a loopback database DSN\");\n  }\n}\n\nfunction assertLoopbackObjectStorageUrl(endpoint: string): void {\n  let parsed: URL;\n  try {\n    parsed = new URL(endpoint);\n  } catch {\n    throw new Error(\"Local-development artifact object-storage endpoint is invalid\");\n  }\n  if (\n    (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") ||\n    !isLoopbackHostname(parsed.hostname)\n  ) {\n    throw new Error(\"Unsandboxed artifact materialization requires loopback object storage\");\n  }\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  const normalized = hostname.toLowerCase();\n  return normalized === \"localhost\" || normalized === \"127.0.0.1\" || normalized === \"[::1]\";\n}\n\nfunction integer(\n  environment: NodeJS.ProcessEnv,\n  name: string,\n  fallback: number,\n  minimum: number,\n  maximum: number,\n): number {\n  const raw = environment[name];\n  const value = raw === undefined ? fallback : Number(raw);\n  if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {\n    throw new Error(`${name} is outside its allowed range`);\n  }\n  return value;\n}\n","import { createHash } from \"node:crypto\";\n\nimport { EDITABLE_ARTIFACT_KERNEL_VERSION_MAX_BYTES } from \"@opengeni/contracts/editable-artifacts\";\nimport {\n  COMMITTED_TRANSACTION_PROTOCOL_VERSION,\n  SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,\n  SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION,\n} from \"@opengeni/contracts/editable-artifact-versions\";\n\nimport type {\n  BoundedImmutableObjectWritePort,\n  BoundedObjectRead,\n  BoundedObjectReadPort,\n} from \"@opengeni/storage\";\nimport { BoundedObjectReadError, BoundedObjectWriteError } from \"@opengeni/storage\";\n\n/**\n * The database role allowed to poll the cross-tenant materialization queue.\n * It owns no table privileges; @opengeni/db exposes only fenced SECURITY\n * DEFINER functions to this role.\n */\nexport const EDITABLE_ARTIFACT_MATERIALIZER_DATABASE_ROLE =\n  \"opengeni_artifact_materializer\" as const;\n\nexport const EDITABLE_ARTIFACT_MATERIALIZER_MAX_SOURCE_BYTES = 512 * 1024 * 1024;\nexport const EDITABLE_ARTIFACT_MATERIALIZER_MAX_OUTPUT_BYTES = 512 * 1024 * 1024;\nexport const EDITABLE_ARTIFACT_MATERIALIZER_MAX_OPTIONS_BYTES = 256 * 1024;\nexport const EDITABLE_ARTIFACT_MATERIALIZER_MAX_ATTEMPTS = 20;\n\nexport type EditableArtifactMaterializationFormat =\n  | \"xlsx\"\n  | \"pptx\"\n  | \"docx\"\n  | \"pdf\"\n  | \"png\"\n  | \"webp\";\n\nexport type EditableArtifactMaterializationModality = \"spreadsheet\" | \"presentation\" | \"document\";\n\nexport type EditableArtifactMaterializationMimeType =\n  | \"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet\"\n  | \"application/vnd.openxmlformats-officedocument.presentationml.presentation\"\n  | \"application/vnd.openxmlformats-officedocument.wordprocessingml.document\"\n  | \"application/pdf\"\n  | \"image/png\"\n  | \"image/webp\";\n\nexport type EditableArtifactMaterializationScope = Readonly<{\n  accountId: string;\n  workspaceId: string;\n}>;\n\n/**\n * One immutable, self-contained input manifest returned by the global claim\n * function. The source snapshot covers exactly targetHeadSequence. There is\n * deliberately no \"current\" lookup after claim and no unbounded DB tail read.\n */\nexport type ClaimedEditableArtifactMaterialization = Readonly<{\n  scope: EditableArtifactMaterializationScope;\n  artifactId: string;\n  jobId: string;\n  versionId: string | null;\n  modality: EditableArtifactMaterializationModality;\n  inputSnapshotId: string;\n  targetHeadSequence: number;\n  stateHash: string;\n  sourceObjectReference: string;\n  sourceByteSize: number;\n  sourceContentHash: string;\n  sourceMimeType: string;\n  modelSchemaVersion: number;\n  operationProtocolVersion: number;\n  snapshotProtocolVersion: number;\n  format: EditableArtifactMaterializationFormat;\n  codecId: string;\n  /** Canonical UTF-8 JSON, bounded and hashed by optionsHash. */\n  normalizedOptions: string;\n  optionsHash: string;\n  codecVersion: string;\n  kernelVersion: string;\n  fontRegistryHash: string;\n  policyHash: string;\n  attemptCount: number;\n  leaseOwner: string;\n  leaseExpiresAt: string;\n}>;\n\nexport type EditableArtifactMaterializationLease = Readonly<{\n  scope: EditableArtifactMaterializationScope;\n  artifactId: string;\n  jobId: string;\n  owner: string;\n  attemptCount: number;\n}>;\n\nexport interface EditableArtifactMaterializationStorePort {\n  claim(input: {\n    owner: string;\n    leaseDurationMs: number;\n    limit: number;\n  }): Promise<readonly ClaimedEditableArtifactMaterialization[]>;\n  renew(input: EditableArtifactMaterializationLease & { leaseDurationMs: number }): Promise<string>;\n  succeed(\n    input: EditableArtifactMaterializationLease & {\n      resultId: string;\n      blobRefId: string;\n      objectReference: string;\n      byteSize: number;\n      contentHash: string;\n      mimeType: EditableArtifactMaterializationMimeType;\n      verifiedAt: string;\n    },\n  ): Promise<unknown>;\n  fail(input: EditableArtifactMaterializationLease & { errorCode: string }): Promise<unknown>;\n}\n\nexport type NativeEditableArtifactMaterializerIdentity = Readonly<{\n  kind: \"native\";\n  /** Parent-owned launcher facts, never copied from the codec child. */\n  isolation: \"subprocess\";\n  network: \"denied\" | \"host\";\n  officeAutomation: false;\n  processProtocolVersion: 1;\n  sandboxEnforced: boolean;\n  memoryLimitBytes: number;\n  cpuTimeLimitMs: number;\n  fileDescriptorLimit: number;\n  processLimit: number;\n  fileSizeLimitBytes: number;\n  maxOutputBytes: number;\n  kernelVersion: string;\n  codecVersions: Readonly<Record<string, string>>;\n  fontRegistryHash: string;\n  policyHash: string;\n  runtimeTarget: string;\n  supportedModelSchemaVersions: readonly [typeof SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION];\n  supportedOperationProtocolVersions: readonly [typeof COMMITTED_TRANSACTION_PROTOCOL_VERSION];\n  supportedSnapshotProtocolVersions: readonly [typeof SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION];\n}>;\n\nexport type NativeEditableArtifactMaterializationResult = Readonly<{\n  headSequence: number;\n  stateHash: string;\n  format: EditableArtifactMaterializationFormat;\n  mimeType: EditableArtifactMaterializationMimeType;\n  codecId: string;\n  codecVersion: string;\n  kernelVersion: string;\n  fontRegistryHash: string;\n  policyHash: string;\n  /** Optional precomputed facts; the independent writer/verifier still checks. */\n  byteSize?: number;\n  contentHash?: string;\n  /** Canonical semantics projected by the authoritative native source kernel. */\n  semanticHash: string;\n  chunks: AsyncIterable<Uint8Array>;\n}>;\n\n/**\n * Production implementations must be a native Rust subprocess adapter. The\n * adapter consumes a version-pinned stream, reconstructs and validates the\n * canonical snapshot, and exports without Office/COM or network access.\n */\nexport interface NativeEditableArtifactMaterializerPort {\n  readonly identity: NativeEditableArtifactMaterializerIdentity;\n  materialize(input: {\n    job: ClaimedEditableArtifactMaterialization;\n    normalizedOptions: Uint8Array;\n    snapshot: AsyncIterable<Uint8Array>;\n    signal: AbortSignal;\n  }): Promise<NativeEditableArtifactMaterializationResult>;\n}\n\nexport type VerifiedEditableArtifactMaterialization = Readonly<{\n  objectReference: string;\n  byteSize: number;\n  contentHash: string;\n  mimeType: EditableArtifactMaterializationMimeType;\n  format: EditableArtifactMaterializationFormat;\n  codecId: string;\n  codecVersion: string;\n}>;\n\n/** Independent reader/parser. It must not reuse the exporting codec process. */\nexport interface EditableArtifactMaterializationVerifierPort {\n  verify(input: {\n    objectReference: string;\n    expectedByteSize: number;\n    expectedContentHash: string;\n    expectedMimeType: EditableArtifactMaterializationMimeType;\n    format: EditableArtifactMaterializationFormat;\n    codecId: string;\n    codecVersion: string;\n    expectedSemanticHash: string;\n    maxBytes: number;\n    signal: AbortSignal;\n  }): Promise<VerifiedEditableArtifactMaterialization>;\n}\n\nexport interface EditableArtifactMaterializationSemanticVerifierPort {\n  verify(input: {\n    format: EditableArtifactMaterializationFormat;\n    codecId: string;\n    codecVersion: string;\n    expectedSemanticHash: string;\n    byteSize: number;\n    chunks: AsyncIterable<Uint8Array>;\n    signal: AbortSignal;\n  }): Promise<void>;\n}\n\nexport interface EditableArtifactMaterializerSchedulerPort {\n  sleep(milliseconds: number, signal: AbortSignal): Promise<void>;\n}\n\nexport interface EditableArtifactMaterializerClockPort {\n  now(): Date;\n}\n\nexport interface EditableArtifactMaterializerLoggerPort {\n  warn(message: string, attributes: Readonly<Record<string, unknown>>): void;\n}\n\nexport type EditableArtifactMaterializerMetricOutcome =\n  | \"claimed\"\n  | \"succeeded\"\n  | \"dead_lettered\"\n  | \"retry_deferred\"\n  | \"lease_lost\"\n  | \"cancelled\"\n  | \"claim_failed\";\n\nexport interface EditableArtifactMaterializerMetricsPort {\n  increment(outcome: EditableArtifactMaterializerMetricOutcome, count?: number): void;\n}\n\nexport type EditableArtifactMaterializerOptions = Readonly<{\n  owner: string;\n  batchSize?: number;\n  concurrency?: number;\n  leaseDurationMs?: number;\n  leaseRenewIntervalMs?: number;\n  pollIntervalMs?: number;\n  claimBackoffMs?: number;\n  maxAttempts?: number;\n  maxSourceBytes?: number;\n  maxOutputBytes?: number;\n}>;\n\nexport type EditableArtifactMaterializerDependencies = Readonly<{\n  store: EditableArtifactMaterializationStorePort;\n  sourceReader: BoundedObjectReadPort;\n  outputWriter: BoundedImmutableObjectWritePort;\n  outputVerifier: EditableArtifactMaterializationVerifierPort;\n  kernel: NativeEditableArtifactMaterializerPort;\n  scheduler: EditableArtifactMaterializerSchedulerPort;\n  clock: EditableArtifactMaterializerClockPort;\n  logger?: EditableArtifactMaterializerLoggerPort;\n  metrics?: EditableArtifactMaterializerMetricsPort;\n}>;\n\nexport type EditableArtifactMaterializerPassSummary = Readonly<{\n  claimed: number;\n  succeeded: number;\n  deadLettered: number;\n  retryDeferred: number;\n  leaseLost: number;\n  cancelled: number;\n  claimFailed: boolean;\n}>;\n\ntype MutableSummary = {\n  claimed: number;\n  succeeded: number;\n  deadLettered: number;\n  retryDeferred: number;\n  leaseLost: number;\n  cancelled: number;\n  claimFailed: boolean;\n};\n\ntype NormalizedOptions = Required<EditableArtifactMaterializerOptions>;\n\nconst DEFAULT_OPTIONS = Object.freeze({\n  batchSize: 8,\n  concurrency: 2,\n  leaseDurationMs: 120_000,\n  leaseRenewIntervalMs: 30_000,\n  pollIntervalMs: 1_000,\n  claimBackoffMs: 5_000,\n  maxAttempts: EDITABLE_ARTIFACT_MATERIALIZER_MAX_ATTEMPTS,\n  maxSourceBytes: EDITABLE_ARTIFACT_MATERIALIZER_MAX_SOURCE_BYTES,\n  maxOutputBytes: EDITABLE_ARTIFACT_MATERIALIZER_MAX_OUTPUT_BYTES,\n});\n\n/** Closed, diagnostics-free terminal failure codes persisted in Postgres. */\nexport type EditableArtifactMaterializerDeadLetterCode =\n  | \"invalid_job_manifest\"\n  | \"source_identity_mismatch\"\n  | \"source_size_limit\"\n  | \"kernel_incompatible\"\n  | \"kernel_result_mismatch\"\n  | \"unsupported_semantics\"\n  | \"output_size_limit\"\n  | \"output_verification_failed\"\n  | \"retry_exhausted\";\n\nexport type EditableArtifactMaterializerFailureDiagnostic = Readonly<{\n  stage: \"source_reader\" | \"native\";\n  subcode:\n    | \"open\"\n    | \"content_type\"\n    | \"stream_identity\"\n    | \"revalidate\"\n    | \"input_framing\"\n    | \"snapshot_open\"\n    | \"state_mismatch\";\n}>;\n\nexport class EditableArtifactMaterializerPermanentError extends Error {\n  constructor(\n    readonly code: EditableArtifactMaterializerDeadLetterCode,\n    readonly diagnostic?: EditableArtifactMaterializerFailureDiagnostic,\n  ) {\n    super(`Editable artifact materialization cannot continue: ${code}`);\n    this.name = \"EditableArtifactMaterializerPermanentError\";\n  }\n}\n\nexport class EditableArtifactMaterializerLeaseLostError extends Error {\n  constructor() {\n    super(\"Editable artifact materialization lease was lost\");\n    this.name = \"EditableArtifactMaterializerLeaseLostError\";\n  }\n}\n\n/**\n * At-least-once materialization loop. Immutable content-addressed output makes\n * recomputation safe; owner + attemptCount fences make DB settlement exact.\n */\nexport class EditableArtifactMaterializer {\n  readonly #options: NormalizedOptions;\n  #activePass: Promise<EditableArtifactMaterializerPassSummary> | null = null;\n\n  constructor(\n    private readonly dependencies: EditableArtifactMaterializerDependencies,\n    options: EditableArtifactMaterializerOptions,\n    securityPolicy: Readonly<{ allowUnsandboxedDevelopment?: boolean }> = {},\n  ) {\n    this.#options = normalizeOptions(options);\n    assertNativeKernelIdentity(\n      dependencies.kernel.identity,\n      securityPolicy.allowUnsandboxedDevelopment === true,\n    );\n  }\n\n  async run(signal: AbortSignal): Promise<void> {\n    let claimFailed = false;\n    while (!signal.aborted) {\n      const summary = await this.dispatchOnce(signal);\n      claimFailed = summary.claimFailed;\n      if (signal.aborted) break;\n      const delay = claimFailed\n        ? this.#options.claimBackoffMs\n        : summary.claimed === 0\n          ? this.#options.pollIntervalMs\n          : 0;\n      if (delay > 0 && !(await sleepOrAbort(this.dependencies.scheduler, delay, signal))) break;\n    }\n    await this.drain();\n  }\n\n  /** Concurrent triggers share one bounded claim pass. */\n  dispatchOnce(signal?: AbortSignal): Promise<EditableArtifactMaterializerPassSummary> {\n    if (this.#activePass) return this.#activePass;\n    const pass = this.#dispatchBatch(signal);\n    this.#activePass = pass;\n    void pass.then(\n      () => {\n        if (this.#activePass === pass) this.#activePass = null;\n      },\n      () => {\n        if (this.#activePass === pass) this.#activePass = null;\n      },\n    );\n    return pass;\n  }\n\n  async drain(): Promise<void> {\n    await this.#activePass;\n  }\n\n  async #dispatchBatch(\n    parentSignal: AbortSignal | undefined,\n  ): Promise<EditableArtifactMaterializerPassSummary> {\n    const summary = mutableSummary();\n    if (parentSignal?.aborted) {\n      return freezeSummary(summary);\n    }\n    let jobs: readonly ClaimedEditableArtifactMaterialization[];\n    try {\n      jobs = await this.dependencies.store.claim({\n        owner: this.#options.owner,\n        leaseDurationMs: this.#options.leaseDurationMs,\n        limit: this.#options.batchSize,\n      });\n      if (!Array.isArray(jobs) || jobs.length > this.#options.batchSize) {\n        throw new TypeError(\"Materialization store returned an invalid claim batch\");\n      }\n    } catch (error) {\n      summary.claimFailed = true;\n      this.#metric(\"claim_failed\");\n      this.#warn(\"Editable artifact materialization claim failed\", \"claim_failed\", error);\n      return freezeSummary(summary);\n    }\n    summary.claimed = jobs.length;\n    if (jobs.length > 0) this.#metric(\"claimed\", jobs.length);\n\n    let cursor = 0;\n    const worker = async (): Promise<void> => {\n      for (;;) {\n        const index = cursor;\n        cursor += 1;\n        const job = jobs[index];\n        if (!job) return;\n        await this.#processJob(job, summary, parentSignal);\n      }\n    };\n    await Promise.all(\n      Array.from({ length: Math.min(jobs.length, this.#options.concurrency) }, worker),\n    );\n    return freezeSummary(summary);\n  }\n\n  async #processJob(\n    job: ClaimedEditableArtifactMaterialization,\n    summary: MutableSummary,\n    parentSignal: AbortSignal | undefined,\n  ): Promise<void> {\n    let lease: EditableArtifactMaterializationLease;\n    try {\n      lease = validateClaimedJob(job, this.#options.owner, this.dependencies.kernel.identity);\n    } catch (error) {\n      await this.#deadLetterBestEffort(job, \"invalid_job_manifest\", summary, error);\n      return;\n    }\n\n    if (job.attemptCount >= this.#options.maxAttempts) {\n      await this.#settlePermanent(lease, \"retry_exhausted\", summary, null);\n      return;\n    }\n\n    const operationAbort = new AbortController();\n    const renewalAbort = new AbortController();\n    const combined = combineAbortSignals(parentSignal, operationAbort.signal);\n    let leaseLost = false;\n    const renewal = this.#renewLease(lease, renewalAbort.signal, operationAbort, () => {\n      leaseLost = true;\n    });\n\n    let source: BoundedObjectRead | null = null;\n    try {\n      throwIfAborted(combined.signal);\n      assertJobKernelCompatibility(job, this.dependencies.kernel.identity);\n      const optionsBytes = canonicalOptionsBytes(job.normalizedOptions, job.optionsHash);\n      if (job.sourceByteSize > this.#options.maxSourceBytes) {\n        throw new EditableArtifactMaterializerPermanentError(\"source_size_limit\");\n      }\n      try {\n        source = await this.dependencies.sourceReader.open({\n          opaqueReference: job.sourceObjectReference,\n          maxBytes: this.#options.maxSourceBytes,\n          expectedByteSize: job.sourceByteSize,\n          signal: combined.signal,\n        });\n      } catch (error) {\n        throw diagnoseSourceReaderFailure(error, \"open\");\n      }\n      if (source.contentType !== undefined && source.contentType !== job.sourceMimeType) {\n        throw new EditableArtifactMaterializerPermanentError(\"source_identity_mismatch\", {\n          stage: \"source_reader\",\n          subcode: \"content_type\",\n        });\n      }\n      let sourceChunks: AsyncIterable<Uint8Array>;\n      try {\n        sourceChunks = source.chunks({ signal: combined.signal });\n      } catch (error) {\n        throw diagnoseSourceReaderFailure(error, \"stream_identity\");\n      }\n      const trackedSource = trackExactStream(\n        sourceChunks,\n        job.sourceByteSize,\n        job.sourceContentHash,\n        \"source_identity_mismatch\",\n        { stage: \"source_reader\", subcode: \"stream_identity\" },\n      );\n      let output: NativeEditableArtifactMaterializationResult;\n      try {\n        output = await this.dependencies.kernel.materialize({\n          job,\n          normalizedOptions: optionsBytes,\n          snapshot: trackedSource.chunks,\n          signal: combined.signal,\n        });\n        await trackedSource.done;\n      } catch (error) {\n        // The source wrapper can reject concurrently with the native adapter\n        // that is consuming it. Observe both promises so corrupt input never\n        // becomes an unhandled rejection after the adapter exits.\n        void trackedSource.done.catch(() => undefined);\n        throw error;\n      }\n      try {\n        await source.assertUnchanged(combined.signal);\n      } catch (error) {\n        throw diagnoseSourceReaderFailure(error, \"revalidate\");\n      }\n      validateKernelResult(job, output);\n\n      const written = await this.dependencies.outputWriter.write({\n        chunks: output.chunks,\n        contentType: output.mimeType,\n        maxBytes: this.#options.maxOutputBytes,\n        ...(output.byteSize !== undefined ? { expectedByteSize: output.byteSize } : {}),\n        ...(output.contentHash !== undefined ? { expectedContentHash: output.contentHash } : {}),\n        signal: combined.signal,\n      });\n      let verified: VerifiedEditableArtifactMaterialization;\n      try {\n        verified = await this.dependencies.outputVerifier.verify({\n          objectReference: written.opaqueReference,\n          expectedByteSize: written.byteSize,\n          expectedContentHash: written.contentHash,\n          expectedMimeType: output.mimeType,\n          format: job.format,\n          codecId: job.codecId,\n          codecVersion: job.codecVersion,\n          expectedSemanticHash: output.semanticHash,\n          maxBytes: this.#options.maxOutputBytes,\n          signal: combined.signal,\n        });\n      } catch (error) {\n        if (error instanceof BoundedObjectReadError) {\n          throw new EditableArtifactMaterializerPermanentError(\"output_verification_failed\");\n        }\n        throw error;\n      }\n      validateIndependentVerification(job, written, verified);\n\n      renewalAbort.abort();\n      await renewal;\n      if (leaseLost) throw new EditableArtifactMaterializerLeaseLostError();\n      throwIfAborted(combined.signal);\n      await this.dependencies.store.renew({\n        ...lease,\n        leaseDurationMs: this.#options.leaseDurationMs,\n      });\n      const ids = deterministicResultIds(job, written.contentHash);\n      await this.dependencies.store.succeed({\n        ...lease,\n        ...ids,\n        objectReference: written.opaqueReference,\n        byteSize: written.byteSize,\n        contentHash: written.contentHash,\n        mimeType: output.mimeType,\n        verifiedAt: this.dependencies.clock.now().toISOString(),\n      });\n      summary.succeeded += 1;\n      this.#metric(\"succeeded\");\n    } catch (error) {\n      renewalAbort.abort();\n      await renewal;\n      if (leaseLost || isLeaseFence(error)) {\n        summary.leaseLost += 1;\n        this.#metric(\"lease_lost\");\n        this.#warn(\"Editable artifact materialization lease was lost\", \"lease_lost\", error);\n      } else if (combined.signal.aborted || isAbortError(error)) {\n        summary.cancelled += 1;\n        this.#metric(\"cancelled\");\n      } else {\n        const permanent = permanentDependencyFailure(error);\n        if (permanent) {\n          await this.#settlePermanent(lease, permanent, summary, error);\n        } else {\n          // Unknown provider/kernel failures are retryable. Do not terminally\n          // settle: expiry lets another owner reclaim the exact immutable input.\n          summary.retryDeferred += 1;\n          this.#metric(\"retry_deferred\");\n          this.#warn(\n            \"Editable artifact materialization will retry after lease expiry\",\n            \"retry_deferred\",\n            error,\n          );\n        }\n      }\n    } finally {\n      renewalAbort.abort();\n      combined.dispose();\n      if (source) await source.close();\n    }\n  }\n\n  async #renewLease(\n    lease: EditableArtifactMaterializationLease,\n    signal: AbortSignal,\n    operationAbort: AbortController,\n    onLeaseLost: () => void,\n  ): Promise<void> {\n    while (\n      await sleepOrAbort(this.dependencies.scheduler, this.#options.leaseRenewIntervalMs, signal)\n    ) {\n      try {\n        await this.dependencies.store.renew({\n          ...lease,\n          leaseDurationMs: this.#options.leaseDurationMs,\n        });\n      } catch (error) {\n        onLeaseLost();\n        operationAbort.abort(error);\n        return;\n      }\n    }\n  }\n\n  async #settlePermanent(\n    lease: EditableArtifactMaterializationLease,\n    code: EditableArtifactMaterializerDeadLetterCode,\n    summary: MutableSummary,\n    cause: unknown,\n  ): Promise<void> {\n    try {\n      await this.dependencies.store.renew({\n        ...lease,\n        leaseDurationMs: this.#options.leaseDurationMs,\n      });\n      await this.dependencies.store.fail({ ...lease, errorCode: code });\n      summary.deadLettered += 1;\n      this.#metric(\"dead_lettered\");\n      if (cause) this.#warn(\"Editable artifact materialization was dead-lettered\", code, cause);\n    } catch (error) {\n      summary.leaseLost += 1;\n      this.#metric(\"lease_lost\");\n      this.#warn(\"Editable artifact dead-letter settlement was fenced\", \"lease_lost\", error);\n    }\n  }\n\n  async #deadLetterBestEffort(\n    job: ClaimedEditableArtifactMaterialization,\n    code: EditableArtifactMaterializerDeadLetterCode,\n    summary: MutableSummary,\n    cause: unknown,\n  ): Promise<void> {\n    try {\n      const lease = rawLease(job, this.#options.owner);\n      await this.#settlePermanent(lease, code, summary, cause);\n    } catch (error) {\n      summary.leaseLost += 1;\n      this.#metric(\"lease_lost\");\n      this.#warn(\"Invalid materialization claim could not be settled\", \"lease_lost\", error);\n    }\n  }\n\n  #metric(outcome: EditableArtifactMaterializerMetricOutcome, count = 1): void {\n    try {\n      this.dependencies.metrics?.increment(outcome, count);\n    } catch {\n      // Observability is never part of the correctness boundary.\n    }\n  }\n\n  #warn(message: string, code: string, error: unknown): void {\n    try {\n      this.dependencies.logger?.warn(message, {\n        code,\n        errorClass: error instanceof Error ? error.name : \"UnknownError\",\n        ...(error instanceof EditableArtifactMaterializerPermanentError && error.diagnostic\n          ? {\n              failureStage: error.diagnostic.stage,\n              failureSubcode: error.diagnostic.subcode,\n            }\n          : {}),\n      });\n    } catch {\n      // Logging is never part of the correctness boundary.\n    }\n  }\n}\n\nexport type ConfiguredEditableArtifactMaterializerInput = Readonly<{\n  enabled: boolean;\n  databaseRole: string | null | undefined;\n  objectStorageConfigured: boolean;\n  dependencies?: Partial<EditableArtifactMaterializerDependencies>;\n  options?: EditableArtifactMaterializerOptions;\n  /** Explicit local-development exception; production callers must omit it. */\n  allowUnsandboxedDevelopment?: boolean;\n}>;\n\n/**\n * Production gate. Disabled is the default. Once enabled, every privileged\n * dependency and the dedicated database role are mandatory—there is no\n * reference-kernel, mutable-storage, or tenant-role fallback.\n */\nexport function createConfiguredEditableArtifactMaterializer(\n  input: ConfiguredEditableArtifactMaterializerInput,\n): EditableArtifactMaterializer | null {\n  if (!input.enabled) return null;\n  if (input.databaseRole !== EDITABLE_ARTIFACT_MATERIALIZER_DATABASE_ROLE) {\n    throw new Error(\"Editable artifact materializer requires its dedicated database role\");\n  }\n  if (!input.objectStorageConfigured) {\n    throw new Error(\"Editable artifact materializer requires immutable object storage\");\n  }\n  const dependencies = input.dependencies;\n  if (\n    !dependencies?.store ||\n    !dependencies.sourceReader ||\n    !dependencies.outputWriter ||\n    !dependencies.outputVerifier ||\n    !dependencies.kernel ||\n    !dependencies.scheduler ||\n    !dependencies.clock\n  ) {\n    throw new Error(\"Editable artifact materializer dependencies are incomplete\");\n  }\n  assertNativeKernelIdentity(\n    dependencies.kernel.identity,\n    input.allowUnsandboxedDevelopment === true,\n  );\n  if (!input.options) throw new Error(\"Editable artifact materializer options are required\");\n  return new EditableArtifactMaterializer(\n    dependencies as EditableArtifactMaterializerDependencies,\n    input.options,\n    input.allowUnsandboxedDevelopment === undefined\n      ? {}\n      : { allowUnsandboxedDevelopment: input.allowUnsandboxedDevelopment },\n  );\n}\n\nexport const systemEditableArtifactMaterializerScheduler: EditableArtifactMaterializerSchedulerPort =\n  Object.freeze({\n    sleep(milliseconds: number, signal: AbortSignal): Promise<void> {\n      return new Promise<void>((resolve, reject) => {\n        if (signal.aborted) {\n          reject(signal.reason ?? abortError());\n          return;\n        }\n        const complete = () => {\n          signal.removeEventListener(\"abort\", abort);\n          resolve();\n        };\n        const timer = setTimeout(complete, milliseconds);\n        timer.unref?.();\n        const abort = () => {\n          clearTimeout(timer);\n          signal.removeEventListener(\"abort\", abort);\n          reject(signal.reason ?? abortError());\n        };\n        signal.addEventListener(\"abort\", abort, { once: true });\n      });\n    },\n  });\n\nexport const systemEditableArtifactMaterializerClock: EditableArtifactMaterializerClockPort =\n  Object.freeze({ now: () => new Date() });\n\nfunction normalizeOptions(options: EditableArtifactMaterializerOptions): NormalizedOptions {\n  const normalized: NormalizedOptions = Object.freeze({\n    owner: validateOwner(options.owner),\n    batchSize: options.batchSize ?? DEFAULT_OPTIONS.batchSize,\n    concurrency: options.concurrency ?? DEFAULT_OPTIONS.concurrency,\n    leaseDurationMs: options.leaseDurationMs ?? DEFAULT_OPTIONS.leaseDurationMs,\n    leaseRenewIntervalMs: options.leaseRenewIntervalMs ?? DEFAULT_OPTIONS.leaseRenewIntervalMs,\n    pollIntervalMs: options.pollIntervalMs ?? DEFAULT_OPTIONS.pollIntervalMs,\n    claimBackoffMs: options.claimBackoffMs ?? DEFAULT_OPTIONS.claimBackoffMs,\n    maxAttempts: options.maxAttempts ?? DEFAULT_OPTIONS.maxAttempts,\n    maxSourceBytes: options.maxSourceBytes ?? DEFAULT_OPTIONS.maxSourceBytes,\n    maxOutputBytes: options.maxOutputBytes ?? DEFAULT_OPTIONS.maxOutputBytes,\n  });\n  for (const [label, value] of Object.entries(normalized)) {\n    if (label === \"owner\") continue;\n    positiveInteger(value, label);\n  }\n  if (normalized.batchSize > 64) throw new TypeError(\"materializer batch size exceeds 64\");\n  if (normalized.concurrency > normalized.batchSize) {\n    throw new TypeError(\"materializer concurrency exceeds its batch size\");\n  }\n  if (normalized.leaseDurationMs < 10_000 || normalized.leaseDurationMs > 86_400_000) {\n    throw new TypeError(\"materializer lease duration must be 10 seconds to 24 hours\");\n  }\n  if (normalized.leaseRenewIntervalMs * 2 >= normalized.leaseDurationMs) {\n    throw new TypeError(\"materializer renewal interval must be less than half its lease\");\n  }\n  if (normalized.maxAttempts > 1_000) throw new TypeError(\"materializer attempts exceed 1000\");\n  if (normalized.maxSourceBytes > EDITABLE_ARTIFACT_MATERIALIZER_MAX_SOURCE_BYTES) {\n    throw new TypeError(\"materializer source limit exceeds the protocol maximum\");\n  }\n  if (normalized.maxOutputBytes > EDITABLE_ARTIFACT_MATERIALIZER_MAX_OUTPUT_BYTES) {\n    throw new TypeError(\"materializer output limit exceeds the protocol maximum\");\n  }\n  return normalized;\n}\n\nfunction validateClaimedJob(\n  job: ClaimedEditableArtifactMaterialization,\n  owner: string,\n  kernel: NativeEditableArtifactMaterializerIdentity,\n): EditableArtifactMaterializationLease {\n  const lease = rawLease(job, owner);\n  if (job.leaseOwner !== owner) throw new TypeError(\"claimed job belongs to another owner\");\n  positiveInteger(job.targetHeadSequence + 1, \"target head sequence + 1\");\n  positiveInteger(job.sourceByteSize, \"source byte size\");\n  positiveInteger(job.modelSchemaVersion, \"model schema version\");\n  positiveInteger(job.operationProtocolVersion, \"operation protocol version\");\n  positiveInteger(job.snapshotProtocolVersion, \"snapshot protocol version\");\n  positiveInteger(job.attemptCount, \"attempt count\");\n  stableId(job.artifactId, \"artifact id\");\n  stableId(job.jobId, \"job id\");\n  stableId(job.inputSnapshotId, \"input snapshot id\");\n  if (job.versionId !== null) stableId(job.versionId, \"version id\");\n  canonicalHash(job.stateHash, \"state hash\");\n  canonicalHash(job.sourceContentHash, \"source content hash\");\n  canonicalHash(job.optionsHash, \"options hash\");\n  canonicalHash(job.fontRegistryHash, \"font registry hash\");\n  canonicalHash(job.policyHash, \"policy hash\");\n  boundedText(job.sourceObjectReference, \"source object reference\", 2_048);\n  boundedText(job.sourceMimeType, \"source mime type\", 256);\n  boundedText(job.codecId, \"codec id\", 128);\n  boundedText(job.codecVersion, \"codec version\", 128);\n  boundedText(job.kernelVersion, \"kernel version\", EDITABLE_ARTIFACT_KERNEL_VERSION_MAX_BYTES);\n  validateFormatForModality(job.modality, job.format);\n  assertJobKernelCompatibility(job, kernel);\n  return lease;\n}\n\nfunction rawLease(\n  job: ClaimedEditableArtifactMaterialization,\n  owner: string,\n): EditableArtifactMaterializationLease {\n  boundedText(job.scope?.accountId, \"account id\", 128);\n  boundedText(job.scope?.workspaceId, \"workspace id\", 128);\n  stableId(job.artifactId, \"artifact id\");\n  stableId(job.jobId, \"job id\");\n  positiveInteger(job.attemptCount, \"attempt count\");\n  validateOwner(owner);\n  return Object.freeze({\n    scope: Object.freeze({ ...job.scope }),\n    artifactId: job.artifactId,\n    jobId: job.jobId,\n    owner,\n    attemptCount: job.attemptCount,\n  });\n}\n\nfunction assertNativeKernelIdentity(\n  identity: NativeEditableArtifactMaterializerIdentity,\n  allowUnsandboxedDevelopment = false,\n): void {\n  if (\n    identity.kind !== \"native\" ||\n    identity.isolation !== \"subprocess\" ||\n    identity.officeAutomation !== false\n  ) {\n    throw new Error(\"Editable artifact materializer requires an isolated native kernel\");\n  }\n  if (identity.processProtocolVersion !== 1) {\n    throw new Error(\"Editable artifact materializer subprocess protocol is not enforced\");\n  }\n  if (identity.sandboxEnforced) {\n    if (identity.network !== \"denied\") {\n      throw new Error(\"Editable artifact materializer sandbox network policy is invalid\");\n    }\n    positiveInteger(identity.memoryLimitBytes, \"kernel memory limit\");\n    positiveInteger(identity.cpuTimeLimitMs, \"kernel CPU time limit\");\n    positiveInteger(identity.fileDescriptorLimit, \"kernel file descriptor limit\");\n    positiveInteger(identity.processLimit, \"kernel process limit\");\n    positiveInteger(identity.fileSizeLimitBytes, \"kernel file size limit\");\n  } else if (\n    !allowUnsandboxedDevelopment ||\n    identity.network !== \"host\" ||\n    identity.memoryLimitBytes !== 0 ||\n    identity.cpuTimeLimitMs !== 0 ||\n    identity.fileDescriptorLimit !== 0 ||\n    identity.processLimit !== 0 ||\n    identity.fileSizeLimitBytes !== 0\n  ) {\n    throw new Error(\"Editable artifact materializer subprocess protocol is not enforced\");\n  }\n  positiveInteger(identity.maxOutputBytes, \"kernel output limit\");\n  boundedText(identity.kernelVersion, \"kernel version\", EDITABLE_ARTIFACT_KERNEL_VERSION_MAX_BYTES);\n  boundedText(identity.runtimeTarget, \"kernel runtime target\", 128);\n  canonicalHash(identity.fontRegistryHash, \"font registry hash\");\n  canonicalHash(identity.policyHash, \"policy hash\");\n  if (!identity.codecVersions || typeof identity.codecVersions !== \"object\") {\n    throw new Error(\"Editable artifact materializer codec registry is unavailable\");\n  }\n  for (const [codecId, version] of Object.entries(identity.codecVersions)) {\n    boundedText(codecId, \"codec id\", 128);\n    boundedText(version, \"codec version\", 128);\n  }\n  for (const [label, values, expected] of [\n    [\n      \"model schema versions\",\n      identity.supportedModelSchemaVersions,\n      SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,\n    ],\n    [\n      \"operation protocol versions\",\n      identity.supportedOperationProtocolVersions,\n      COMMITTED_TRANSACTION_PROTOCOL_VERSION,\n    ],\n    [\n      \"snapshot protocol versions\",\n      identity.supportedSnapshotProtocolVersions,\n      SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION,\n    ],\n  ] as const) {\n    if (!Array.isArray(values) || values.length !== 1 || values[0] !== expected) {\n      throw new Error(`Editable artifact kernel ${label} are not current-only`);\n    }\n  }\n}\n\nfunction assertJobKernelCompatibility(\n  job: ClaimedEditableArtifactMaterialization,\n  identity: NativeEditableArtifactMaterializerIdentity,\n): void {\n  const compatible =\n    identity.kernelVersion === job.kernelVersion &&\n    identity.codecVersions[job.codecId] === job.codecVersion &&\n    identity.fontRegistryHash === job.fontRegistryHash &&\n    identity.policyHash === job.policyHash &&\n    job.modelSchemaVersion === identity.supportedModelSchemaVersions[0] &&\n    job.operationProtocolVersion === identity.supportedOperationProtocolVersions[0] &&\n    job.snapshotProtocolVersion === identity.supportedSnapshotProtocolVersions[0];\n  if (!compatible) throw new EditableArtifactMaterializerPermanentError(\"kernel_incompatible\");\n}\n\nfunction validateKernelResult(\n  job: ClaimedEditableArtifactMaterialization,\n  result: NativeEditableArtifactMaterializationResult,\n): void {\n  if (\n    result.headSequence !== job.targetHeadSequence ||\n    result.stateHash !== job.stateHash ||\n    result.format !== job.format ||\n    result.mimeType !== mimeTypeForFormat(job.format) ||\n    result.codecId !== job.codecId ||\n    result.codecVersion !== job.codecVersion ||\n    result.kernelVersion !== job.kernelVersion ||\n    result.fontRegistryHash !== job.fontRegistryHash ||\n    result.policyHash !== job.policyHash ||\n    !result.chunks ||\n    typeof result.chunks[Symbol.asyncIterator] !== \"function\"\n  ) {\n    throw new EditableArtifactMaterializerPermanentError(\"kernel_result_mismatch\");\n  }\n  if (result.byteSize !== undefined) positiveInteger(result.byteSize, \"kernel output bytes\");\n  if (result.contentHash !== undefined) canonicalHash(result.contentHash, \"kernel output hash\");\n  canonicalHash(result.semanticHash, \"kernel semantic hash\");\n}\n\nfunction validateIndependentVerification(\n  job: ClaimedEditableArtifactMaterialization,\n  written: {\n    opaqueReference: string;\n    byteSize: number;\n    contentHash: string;\n    contentType: string;\n  },\n  verified: VerifiedEditableArtifactMaterialization,\n): void {\n  if (\n    verified.objectReference !== written.opaqueReference ||\n    verified.byteSize !== written.byteSize ||\n    verified.contentHash !== written.contentHash ||\n    verified.mimeType !== written.contentType ||\n    verified.format !== job.format ||\n    verified.codecId !== job.codecId ||\n    verified.codecVersion !== job.codecVersion\n  ) {\n    throw new EditableArtifactMaterializerPermanentError(\"output_verification_failed\");\n  }\n}\n\nfunction canonicalOptionsBytes(value: string, expectedHash: string): Uint8Array {\n  if (typeof value !== \"string\") {\n    throw new EditableArtifactMaterializerPermanentError(\"invalid_job_manifest\");\n  }\n  const bytes = new TextEncoder().encode(value);\n  if (bytes.byteLength > EDITABLE_ARTIFACT_MATERIALIZER_MAX_OPTIONS_BYTES) {\n    throw new EditableArtifactMaterializerPermanentError(\"invalid_job_manifest\");\n  }\n  try {\n    const parsed = JSON.parse(value) as unknown;\n    if (JSON.stringify(parsed) !== value) {\n      throw new Error(\"non-canonical options\");\n    }\n  } catch {\n    throw new EditableArtifactMaterializerPermanentError(\"invalid_job_manifest\");\n  }\n  if (hashBytes(bytes) !== expectedHash) {\n    throw new EditableArtifactMaterializerPermanentError(\"invalid_job_manifest\");\n  }\n  return bytes;\n}\n\nfunction trackExactStream(\n  source: AsyncIterable<Uint8Array>,\n  expectedByteSize: number,\n  expectedContentHash: string,\n  code: EditableArtifactMaterializerDeadLetterCode,\n  diagnostic?: EditableArtifactMaterializerFailureDiagnostic,\n): { chunks: AsyncIterable<Uint8Array>; done: Promise<void> } {\n  let settle!: () => void;\n  let reject!: (error: unknown) => void;\n  const done = new Promise<void>((resolve, rejectPromise) => {\n    settle = resolve;\n    reject = rejectPromise;\n  });\n  let claimed = false;\n  const chunks: AsyncIterable<Uint8Array> = Object.freeze({\n    async *[Symbol.asyncIterator](): AsyncIterableIterator<Uint8Array> {\n      if (claimed) {\n        const error = new EditableArtifactMaterializerPermanentError(code, diagnostic);\n        reject(error);\n        throw error;\n      }\n      claimed = true;\n      const digest = createHash(\"sha256\");\n      let byteSize = 0;\n      try {\n        for await (const chunk of source) {\n          if (!(chunk instanceof Uint8Array) || chunk.byteLength === 0) {\n            throw new EditableArtifactMaterializerPermanentError(code, diagnostic);\n          }\n          byteSize += chunk.byteLength;\n          if (byteSize > expectedByteSize) {\n            throw new EditableArtifactMaterializerPermanentError(code, diagnostic);\n          }\n          digest.update(chunk);\n          yield chunk.slice();\n        }\n        if (byteSize !== expectedByteSize) {\n          throw new EditableArtifactMaterializerPermanentError(code, diagnostic);\n        }\n        const contentHash = `sha256:${digest.digest(\"hex\")}`;\n        if (contentHash !== expectedContentHash) {\n          throw new EditableArtifactMaterializerPermanentError(code, diagnostic);\n        }\n        settle();\n      } catch (error) {\n        const diagnosed = diagnoseSourceReaderFailure(error, \"stream_identity\");\n        reject(diagnosed);\n        throw diagnosed;\n      }\n    },\n  });\n  return { chunks, done };\n}\n\nfunction diagnoseSourceReaderFailure(\n  error: unknown,\n  subcode: Extract<\n    EditableArtifactMaterializerFailureDiagnostic[\"subcode\"],\n    \"open\" | \"stream_identity\" | \"revalidate\"\n  >,\n): unknown {\n  const code = permanentDependencyFailure(error);\n  return code\n    ? new EditableArtifactMaterializerPermanentError(code, { stage: \"source_reader\", subcode })\n    : error;\n}\n\nfunction deterministicResultIds(\n  job: ClaimedEditableArtifactMaterialization,\n  contentHash: string,\n): { resultId: string; blobRefId: string } {\n  return {\n    resultId: deterministicStableId(\"result\", job, contentHash),\n    blobRefId: deterministicStableId(\"blob\", job, contentHash),\n  };\n}\n\nfunction deterministicStableId(\n  kind: \"result\" | \"blob\",\n  job: ClaimedEditableArtifactMaterialization,\n  contentHash: string,\n): string {\n  const digest = createHash(\"sha256\");\n  digest.update(`OpenGeni editable artifact materialization ${kind}\\0v1\\0`, \"utf8\");\n  for (const value of [\n    job.scope.accountId,\n    job.scope.workspaceId,\n    job.artifactId,\n    job.jobId,\n    contentHash,\n  ]) {\n    const bytes = Buffer.from(value, \"utf8\");\n    const length = Buffer.allocUnsafe(4);\n    length.writeUInt32BE(bytes.byteLength);\n    digest.update(length);\n    digest.update(bytes);\n  }\n  const id = digest.digest(\"hex\").slice(0, 32);\n  return /^0+$/u.test(id) ? `1${id.slice(1)}` : id;\n}\n\nfunction hashBytes(bytes: Uint8Array): string {\n  return `sha256:${createHash(\"sha256\").update(bytes).digest(\"hex\")}`;\n}\n\nfunction validateFormatForModality(\n  modality: EditableArtifactMaterializationModality,\n  format: EditableArtifactMaterializationFormat,\n): void {\n  const allowed: Readonly<Record<EditableArtifactMaterializationModality, readonly string[]>> = {\n    spreadsheet: [\"xlsx\", \"pdf\", \"png\", \"webp\"],\n    presentation: [\"pptx\", \"pdf\", \"png\", \"webp\"],\n    document: [\"docx\", \"pdf\", \"png\", \"webp\"],\n  };\n  if (!allowed[modality]?.includes(format)) {\n    throw new TypeError(\"materialization format does not match artifact modality\");\n  }\n}\n\nexport function mimeTypeForFormat(\n  format: EditableArtifactMaterializationFormat,\n): EditableArtifactMaterializationMimeType {\n  switch (format) {\n    case \"xlsx\":\n      return \"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet\";\n    case \"pptx\":\n      return \"application/vnd.openxmlformats-officedocument.presentationml.presentation\";\n    case \"docx\":\n      return \"application/vnd.openxmlformats-officedocument.wordprocessingml.document\";\n    case \"pdf\":\n      return \"application/pdf\";\n    case \"png\":\n      return \"image/png\";\n    case \"webp\":\n      return \"image/webp\";\n  }\n}\n\nfunction validateOwner(value: unknown): string {\n  if (\n    typeof value !== \"string\" ||\n    value.length < 1 ||\n    value.length > 256 ||\n    value.trim() !== value ||\n    !/^[A-Za-z0-9._:-]+$/u.test(value)\n  ) {\n    throw new TypeError(\"materializer owner is invalid\");\n  }\n  return value;\n}\n\nfunction stableId(value: unknown, label: string): string {\n  if (typeof value !== \"string\" || !/^[0-9a-f]{32}$/u.test(value) || /^0+$/u.test(value)) {\n    throw new TypeError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction canonicalHash(value: unknown, label: string): string {\n  if (typeof value !== \"string\" || !/^sha256:[0-9a-f]{64}$/u.test(value)) {\n    throw new TypeError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction boundedText(value: unknown, label: string, maxBytes: number): string {\n  if (\n    typeof value !== \"string\" ||\n    value.length === 0 ||\n    new TextEncoder().encode(value).byteLength > maxBytes ||\n    value.trim() !== value ||\n    /[\\u0000-\\u001f\\u007f]/u.test(value)\n  ) {\n    throw new TypeError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction positiveInteger(value: unknown, label: string): number {\n  if (typeof value !== \"number\" || !Number.isSafeInteger(value) || value <= 0) {\n    throw new TypeError(`${label} must be a positive safe integer`);\n  }\n  return value;\n}\n\nfunction isLeaseFence(error: unknown): boolean {\n  return (\n    error instanceof EditableArtifactMaterializerLeaseLostError ||\n    (typeof error === \"object\" &&\n      error !== null &&\n      \"code\" in error &&\n      error.code === \"lease_fenced\")\n  );\n}\n\nfunction permanentDependencyFailure(\n  error: unknown,\n): EditableArtifactMaterializerDeadLetterCode | null {\n  if (error instanceof EditableArtifactMaterializerPermanentError) return error.code;\n  if (error instanceof BoundedObjectReadError) {\n    if (error.code === \"size_limit\") return \"source_size_limit\";\n    if (\n      error.code === \"object_changed\" ||\n      error.code === \"truncated\" ||\n      error.code === \"object_missing\" ||\n      error.code === \"invalid_request\"\n    ) {\n      return \"source_identity_mismatch\";\n    }\n  }\n  if (error instanceof BoundedObjectWriteError) {\n    if (error.code === \"size_limit\") return \"output_size_limit\";\n    if (\n      error.code === \"content_hash_mismatch\" ||\n      error.code === \"readback_mismatch\" ||\n      error.code === \"truncated\" ||\n      error.code === \"invalid_request\"\n    ) {\n      return \"output_verification_failed\";\n    }\n  }\n  return null;\n}\n\nfunction isAbortError(error: unknown): boolean {\n  return error instanceof DOMException\n    ? error.name === \"AbortError\"\n    : error instanceof Error && error.name === \"AbortError\";\n}\n\nfunction throwIfAborted(signal: AbortSignal): void {\n  if (signal.aborted) throw signal.reason ?? abortError();\n}\n\nfunction abortError(): DOMException {\n  return new DOMException(\"Operation aborted\", \"AbortError\");\n}\n\nfunction combineAbortSignals(\n  first: AbortSignal | undefined,\n  second: AbortSignal,\n): { signal: AbortSignal; dispose(): void } {\n  const controller = new AbortController();\n  const sources = first ? [first, second] : [second];\n  const listeners: Array<readonly [AbortSignal, () => void]> = [];\n  for (const source of sources) {\n    const listener = () => controller.abort(source.reason);\n    if (source.aborted) listener();\n    else {\n      source.addEventListener(\"abort\", listener, { once: true });\n      listeners.push([source, listener]);\n    }\n  }\n  return {\n    signal: controller.signal,\n    dispose() {\n      for (const [source, listener] of listeners) {\n        source.removeEventListener(\"abort\", listener);\n      }\n    },\n  };\n}\n\nasync function sleepOrAbort(\n  scheduler: EditableArtifactMaterializerSchedulerPort,\n  milliseconds: number,\n  signal: AbortSignal,\n): Promise<boolean> {\n  try {\n    await scheduler.sleep(milliseconds, signal);\n    return true;\n  } catch (error) {\n    if (signal.aborted || isAbortError(error)) return false;\n    throw error;\n  }\n}\n\nfunction mutableSummary(): MutableSummary {\n  return {\n    claimed: 0,\n    succeeded: 0,\n    deadLettered: 0,\n    retryDeferred: 0,\n    leaseLost: 0,\n    cancelled: 0,\n    claimFailed: false,\n  };\n}\n\nfunction freezeSummary(summary: MutableSummary): EditableArtifactMaterializerPassSummary {\n  return Object.freeze({ ...summary });\n}\n","import { createHash } from \"node:crypto\";\nimport { chmod, mkdtemp, open, rm, type FileHandle } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\n\nimport {\n  BoundedObjectReadError,\n  createObjectStorageBoundedPorts,\n  type BoundedImmutableObjectWritePort,\n  type BoundedObjectReadPort,\n  type ObjectStorage,\n} from \"@opengeni/storage\";\n\nimport {\n  EditableArtifactMaterializerPermanentError,\n  mimeTypeForFormat,\n  type EditableArtifactMaterializationFormat,\n  type EditableArtifactMaterializationMimeType,\n  type EditableArtifactMaterializationSemanticVerifierPort,\n  type EditableArtifactMaterializationVerifierPort,\n  type VerifiedEditableArtifactMaterialization,\n} from \"./editable-artifact-materializer\";\n\nconst SHA256 = /^sha256:[0-9a-f]{64}$/u;\nconst SNAPSHOT_KEY_PREFIX = \"editable-artifacts/snapshots/sha256/\";\nconst MATERIALIZATION_KEY_PREFIX = \"editable-artifacts/materializations/v1/sha256/\";\nconst SEMANTIC_VERIFIER_CHUNK_BYTES = 1024 * 1024;\nconst ZIP_EOCD_SEARCH_BYTES = 65_557;\nconst MAX_ZIP_ENTRY_NAME_BYTES = 4_096;\nconst MAX_ZIP_TOTAL_NAME_BYTES = 16 * 1024 * 1024;\n\n/** Provider-versioned, immutable range reader. No whole-object fallback. */\nexport function createEditableArtifactObjectStorageReader(\n  storage: ObjectStorage,\n): BoundedObjectReadPort {\n  return createObjectStorageBoundedPorts(storage, { keyPrefix: SNAPSHOT_KEY_PREFIX }).read;\n}\n\n/** Conditional-create digest writer with independent version-pinned readback. */\nexport function createEditableArtifactObjectStorageWriter(\n  storage: ObjectStorage,\n): BoundedImmutableObjectWritePort {\n  return createObjectStorageBoundedPorts(storage, {\n    keyPrefix: MATERIALIZATION_KEY_PREFIX,\n  }).write;\n}\n\n/**\n * Independent immutable readback + structural parser. When the native source\n * projection supplies a semantic digest, a second isolated codec process must\n * re-import the published Office bytes and prove that digest before success.\n */\nexport function createEditableArtifactObjectStorageVerifier(\n  storage: ObjectStorage,\n  semanticVerifier: EditableArtifactMaterializationSemanticVerifierPort,\n): EditableArtifactMaterializationVerifierPort {\n  const read = createObjectStorageBoundedPorts(storage, {\n    keyPrefix: MATERIALIZATION_KEY_PREFIX,\n  }).read;\n  return Object.freeze({\n    async verify(\n      input: Parameters<EditableArtifactMaterializationVerifierPort[\"verify\"]>[0],\n    ): Promise<VerifiedEditableArtifactMaterialization> {\n      validateReference(input.objectReference);\n      validateLimit(input.maxBytes);\n      if (\n        !Number.isSafeInteger(input.expectedByteSize) ||\n        input.expectedByteSize <= 0 ||\n        input.expectedByteSize > input.maxBytes ||\n        !SHA256.test(input.expectedContentHash)\n      ) {\n        throw new BoundedObjectReadError(\"invalid_request\");\n      }\n      throwIfAborted(input.signal);\n      const stagingDirectory = await mkdtemp(join(tmpdir(), \"opengeni-artifact-verify-\"));\n      const stagingPath = join(stagingDirectory, \"payload\");\n      let stagingHandle: FileHandle | null = null;\n      try {\n        await chmod(stagingDirectory, 0o700);\n        stagingHandle = await open(stagingPath, \"wx\", 0o600);\n        const reader = await read.open({\n          opaqueReference: input.objectReference,\n          maxBytes: input.maxBytes,\n          expectedByteSize: input.expectedByteSize,\n          signal: input.signal,\n        });\n        try {\n          if (reader.contentType !== undefined && reader.contentType !== input.expectedMimeType) {\n            throw new BoundedObjectReadError(\"object_changed\");\n          }\n          const digest = createHash(\"sha256\");\n          let offset = 0;\n          for await (const chunk of reader.chunks({ signal: input.signal })) {\n            if (offset + chunk.byteLength > input.expectedByteSize) {\n              throw new BoundedObjectReadError(\"object_changed\");\n            }\n            await writeAll(stagingHandle, chunk, offset);\n            digest.update(chunk);\n            offset += chunk.byteLength;\n          }\n          if (\n            offset !== input.expectedByteSize ||\n            `sha256:${digest.digest(\"hex\")}` !== input.expectedContentHash\n          ) {\n            throw new BoundedObjectReadError(\"object_changed\");\n          }\n          await reader.assertUnchanged(input.signal);\n        } finally {\n          await reader.close();\n        }\n        await stagingHandle.close();\n        stagingHandle = null;\n        await verifyFormat(\n          stagingPath,\n          input.expectedByteSize,\n          input.format,\n          input.expectedMimeType,\n          input.signal,\n        );\n        try {\n          await semanticVerifier.verify({\n            format: input.format,\n            codecId: input.codecId,\n            codecVersion: input.codecVersion,\n            expectedSemanticHash: input.expectedSemanticHash,\n            byteSize: input.expectedByteSize,\n            chunks: fileChunks(stagingPath, input.expectedByteSize, input.signal),\n            signal: input.signal,\n          });\n        } catch (error) {\n          throwIfAborted(input.signal);\n          preserveKernelCompatibilityFailure(error);\n          throw new BoundedObjectReadError(\"object_changed\");\n        }\n        throwIfAborted(input.signal);\n        return Object.freeze({\n          objectReference: input.objectReference,\n          byteSize: input.expectedByteSize,\n          contentHash: input.expectedContentHash,\n          mimeType: input.expectedMimeType,\n          format: input.format,\n          codecId: input.codecId,\n          codecVersion: input.codecVersion,\n        });\n      } finally {\n        if (stagingHandle) await stagingHandle.close().catch(() => undefined);\n        await rm(stagingDirectory, { recursive: true, force: true });\n      }\n    },\n  });\n}\n\nasync function verifyFormat(\n  path: string,\n  byteSize: number,\n  format: EditableArtifactMaterializationFormat,\n  mimeType: EditableArtifactMaterializationMimeType,\n  signal: AbortSignal | undefined,\n): Promise<void> {\n  if (mimeType !== mimeTypeForFormat(format)) {\n    throw new BoundedObjectReadError(\"object_changed\");\n  }\n  const handle = await open(path, \"r\");\n  try {\n    throwIfAborted(signal);\n    switch (format) {\n      case \"xlsx\":\n        await assertOfficePackage(handle, byteSize, \"xl/workbook.xml\", signal);\n        break;\n      case \"pptx\":\n        await assertOfficePackage(handle, byteSize, \"ppt/presentation.xml\", signal);\n        break;\n      case \"docx\":\n        await assertOfficePackage(handle, byteSize, \"word/document.xml\", signal);\n        break;\n      case \"pdf\": {\n        const start = await readExact(handle, 0, 5);\n        const end = await readExact(handle, byteSize - 5, 5);\n        if (!startsWithAscii(start, \"%PDF-\") || !startsWithAscii(end, \"%%EOF\")) {\n          throw new Error(\"invalid PDF framing\");\n        }\n        break;\n      }\n      case \"png\":\n        if (\n          !equalPrefix(\n            await readExact(handle, 0, 8),\n            [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a],\n          )\n        ) {\n          throw new Error(\"invalid PNG signature\");\n        }\n        break;\n      case \"webp\": {\n        const header = await readExact(handle, 0, 12);\n        if (!startsWithAscii(header, \"RIFF\") || !asciiAt(header, 8, \"WEBP\")) {\n          throw new Error(\"invalid WebP signature\");\n        }\n        break;\n      }\n    }\n  } catch {\n    throwIfAborted(signal);\n    throw new BoundedObjectReadError(\"object_changed\");\n  } finally {\n    await handle.close();\n  }\n}\n\nasync function assertOfficePackage(\n  handle: FileHandle,\n  byteSize: number,\n  requiredPart: string,\n  signal: AbortSignal | undefined,\n): Promise<void> {\n  if (!equalPrefix(await readExact(handle, 0, 4), [0x50, 0x4b, 0x03, 0x04])) {\n    throw new Error(\"invalid ZIP\");\n  }\n  const tailSize = Math.min(byteSize, ZIP_EOCD_SEARCH_BYTES);\n  const tail = await readExact(handle, byteSize - tailSize, tailSize);\n  const eocdInTail = findEndOfCentralDirectory(tail);\n  const eocd = byteSize - tailSize + eocdInTail;\n  const view = new DataView(tail.buffer, tail.byteOffset, tail.byteLength);\n  const disk = view.getUint16(eocdInTail + 4, true);\n  const centralDisk = view.getUint16(eocdInTail + 6, true);\n  const diskEntries = view.getUint16(eocdInTail + 8, true);\n  const entries = view.getUint16(eocdInTail + 10, true);\n  const centralSize = view.getUint32(eocdInTail + 12, true);\n  const centralOffset = view.getUint32(eocdInTail + 16, true);\n  const commentLength = view.getUint16(eocdInTail + 20, true);\n  if (\n    disk !== 0 ||\n    centralDisk !== 0 ||\n    diskEntries !== entries ||\n    entries === 0 ||\n    centralSize === 0xffffffff ||\n    centralOffset === 0xffffffff ||\n    eocd + 22 + commentLength !== byteSize ||\n    centralOffset + centralSize !== eocd ||\n    centralOffset > byteSize\n  ) {\n    throw new Error(\"invalid ZIP central directory\");\n  }\n  const names = new Set<string>();\n  let offset = centralOffset;\n  let totalNameBytes = 0;\n  for (let index = 0; index < entries; index += 1) {\n    throwIfAborted(signal);\n    if (offset + 46 > eocd) {\n      throw new Error(\"invalid ZIP entry\");\n    }\n    const header = await readExact(handle, offset, 46);\n    const headerView = new DataView(header.buffer, header.byteOffset, header.byteLength);\n    if (headerView.getUint32(0, true) !== 0x02014b50) throw new Error(\"invalid ZIP entry\");\n    if ((headerView.getUint16(8, true) & 1) !== 0) throw new Error(\"encrypted ZIP entry\");\n    const nameLength = headerView.getUint16(28, true);\n    const extraLength = headerView.getUint16(30, true);\n    const commentBytes = headerView.getUint16(32, true);\n    const next = offset + 46 + nameLength + extraLength + commentBytes;\n    totalNameBytes += nameLength;\n    if (\n      nameLength === 0 ||\n      nameLength > MAX_ZIP_ENTRY_NAME_BYTES ||\n      totalNameBytes > MAX_ZIP_TOTAL_NAME_BYTES ||\n      next > eocd\n    ) {\n      throw new Error(\"truncated ZIP entry\");\n    }\n    const name = new TextDecoder(\"utf-8\", { fatal: true }).decode(\n      await readExact(handle, offset + 46, nameLength),\n    );\n    if (!isSafeZipEntryName(name) || names.has(name)) {\n      throw new Error(\"unsafe ZIP entry name\");\n    }\n    names.add(name);\n    offset = next;\n  }\n  if (offset !== eocd || !names.has(\"[Content_Types].xml\") || !names.has(requiredPart)) {\n    throw new Error(\"Office package is missing required parts\");\n  }\n}\n\nfunction isSafeZipEntryName(name: string): boolean {\n  if (name.startsWith(\"/\") || name.includes(\"\\\\\")) return false;\n  const segments = name.split(\"/\");\n  // Office writers commonly include explicit directory entries. A single\n  // trailing slash is canonical for those entries; empty interior segments\n  // remain forbidden so no alternate path spelling reaches a parser.\n  if (segments.at(-1) === \"\") segments.pop();\n  return (\n    segments.length > 0 &&\n    segments.every((segment) => segment.length > 0 && segment !== \".\" && segment !== \"..\")\n  );\n}\n\nfunction findEndOfCentralDirectory(bytes: Uint8Array): number {\n  const minimum = Math.max(0, bytes.byteLength - 65_557);\n  for (let offset = bytes.byteLength - 22; offset >= minimum; offset -= 1) {\n    if (\n      bytes[offset] === 0x50 &&\n      bytes[offset + 1] === 0x4b &&\n      bytes[offset + 2] === 0x05 &&\n      bytes[offset + 3] === 0x06\n    )\n      return offset;\n  }\n  throw new Error(\"missing ZIP EOCD\");\n}\n\nasync function* fileChunks(\n  path: string,\n  byteSize: number,\n  signal: AbortSignal | undefined,\n): AsyncIterableIterator<Uint8Array> {\n  const handle = await open(path, \"r\");\n  try {\n    let offset = 0;\n    const buffer = new Uint8Array(SEMANTIC_VERIFIER_CHUNK_BYTES);\n    while (offset < byteSize) {\n      throwIfAborted(signal);\n      const length = Math.min(buffer.byteLength, byteSize - offset);\n      const { bytesRead } = await handle.read(buffer, 0, length, offset);\n      if (bytesRead !== length) throw new BoundedObjectReadError(\"object_changed\");\n      offset += bytesRead;\n      yield buffer.slice(0, bytesRead);\n    }\n  } finally {\n    await handle.close();\n  }\n}\n\nasync function writeAll(handle: FileHandle, bytes: Uint8Array, position: number): Promise<void> {\n  let offset = 0;\n  while (offset < bytes.byteLength) {\n    const { bytesWritten } = await handle.write(\n      bytes,\n      offset,\n      bytes.byteLength - offset,\n      position + offset,\n    );\n    if (bytesWritten <= 0) throw new BoundedObjectReadError(\"object_changed\");\n    offset += bytesWritten;\n  }\n}\n\nasync function readExact(\n  handle: FileHandle,\n  position: number,\n  length: number,\n): Promise<Uint8Array> {\n  if (\n    !Number.isSafeInteger(position) ||\n    position < 0 ||\n    !Number.isSafeInteger(length) ||\n    length < 0\n  ) {\n    throw new Error(\"invalid file range\");\n  }\n  const result = new Uint8Array(length);\n  let offset = 0;\n  while (offset < length) {\n    const { bytesRead } = await handle.read(result, offset, length - offset, position + offset);\n    if (bytesRead <= 0) throw new Error(\"truncated file range\");\n    offset += bytesRead;\n  }\n  return result;\n}\n\nfunction validateReference(value: string): void {\n  if (\n    typeof value !== \"string\" ||\n    value.length < 1 ||\n    value.length > 2_048 ||\n    value.trim() !== value ||\n    /[\\u0000-\\u001f\\u007f]/u.test(value)\n  )\n    throw new BoundedObjectReadError(\"invalid_request\");\n}\n\nfunction validateLimit(value: number): void {\n  if (!Number.isSafeInteger(value) || value <= 0) {\n    throw new BoundedObjectReadError(\"invalid_request\");\n  }\n}\n\nfunction throwIfAborted(signal: AbortSignal | undefined): void {\n  if (signal?.aborted) throw new BoundedObjectReadError(\"aborted\");\n}\n\nfunction preserveKernelCompatibilityFailure(error: unknown): void {\n  if (\n    error instanceof EditableArtifactMaterializerPermanentError &&\n    error.code === \"kernel_incompatible\"\n  ) {\n    throw error;\n  }\n}\n\nfunction startsWithAscii(bytes: Uint8Array, value: string): boolean {\n  return asciiAt(bytes, 0, value);\n}\n\nfunction asciiAt(bytes: Uint8Array, offset: number, value: string): boolean {\n  if (offset < 0 || offset + value.length > bytes.byteLength) return false;\n  for (let index = 0; index < value.length; index += 1) {\n    if (bytes[offset + index] !== value.charCodeAt(index)) return false;\n  }\n  return true;\n}\n\nfunction equalPrefix(bytes: Uint8Array, expected: readonly number[]): boolean {\n  return expected.every((value, index) => bytes[index] === value);\n}\n","import { once } from \"node:events\";\nimport { isAbsolute } from \"node:path\";\nimport type { ChildProcessWithoutNullStreams } from \"node:child_process\";\n\nimport { EDITABLE_ARTIFACT_KERNEL_VERSION_MAX_BYTES } from \"@opengeni/contracts/editable-artifacts\";\nimport {\n  COMMITTED_TRANSACTION_PROTOCOL_VERSION,\n  SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,\n  SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION,\n} from \"@opengeni/contracts/editable-artifact-versions\";\n\nimport {\n  EditableArtifactMaterializerPermanentError,\n  mimeTypeForFormat,\n  type ClaimedEditableArtifactMaterialization,\n  type EditableArtifactMaterializerFailureDiagnostic,\n  type NativeEditableArtifactMaterializationResult,\n  type NativeEditableArtifactMaterializerIdentity,\n  type NativeEditableArtifactMaterializerPort,\n} from \"./editable-artifact-materializer\";\n\nconst INPUT_MAGIC = new TextEncoder().encode(\"OGAMI001\");\nconst VERIFY_INPUT_MAGIC = new TextEncoder().encode(\"OGAVI001\");\nconst OUTPUT_MAGIC = new TextEncoder().encode(\"OGAMO001\");\nconst VERIFY_OUTPUT_MAGIC = new TextEncoder().encode(\"OGAVO001\");\nconst ERROR_MAGIC = new TextEncoder().encode(\"OGAME001\");\nconst IDENTITY_ARGUMENT = \"--opengeni-materializer-identity-v1\";\nconst MATERIALIZE_ARGUMENT = \"--opengeni-materialize-v1\";\nconst VERIFY_ARGUMENT = \"--opengeni-verify-materialization-v1\";\nconst MAX_IDENTITY_BYTES = 64 * 1024;\nconst MAX_METADATA_BYTES = 256 * 1024;\nconst MAX_STDERR_BYTES = 64 * 1024;\nconst STREAM_CHUNK_BYTES = 1024 * 1024;\n\nexport type NativeEditableArtifactSubprocessOptions = Readonly<{\n  /** Absolute path to the exact codec executable. Isolation belongs to launcher. */\n  executable: string;\n  launcher: VerifiedEditableArtifactProcessLauncher;\n  childEnvironment?: Readonly<Record<string, string>>;\n  /** Explicitly permits the current-host local-dev launcher; never set in production. */\n  allowUnsandboxedDevelopment?: boolean;\n  wallTimeoutMs: number;\n  maxSourceBytes: number;\n  maxOutputBytes: number;\n  probeTimeoutMs?: number;\n}>;\n\nexport type VerifiedEditableArtifactProcessLauncher = Readonly<{\n  identity: Readonly<{\n    platform: string;\n    isolation: \"subprocess\";\n    network: \"denied\" | \"host\";\n    officeAutomation: false;\n    sandboxEnforced: boolean;\n    memoryLimitBytes: number;\n    cpuTimeLimitMs: number;\n    fileDescriptorLimit: number;\n    processLimit: number;\n    fileSizeLimitBytes: number;\n  }>;\n  spawn(input: {\n    executable: string;\n    args: readonly string[];\n    environment: Readonly<Record<string, string>>;\n  }): ChildProcessWithoutNullStreams;\n}>;\n\ntype IdentityEnvelope = Readonly<{\n  protocol: \"OGAMC001\";\n  runtimeKind: \"native\";\n  runtimeTarget: string;\n  kernelVersion: string;\n  codecVersions: Readonly<Record<string, string>>;\n  fontRegistryHash: string;\n  policyHash: string;\n  maxOutputBytes: number;\n  supportedModelSchemaVersions: readonly [typeof SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION];\n  supportedOperationProtocolVersions: readonly [typeof COMMITTED_TRANSACTION_PROTOCOL_VERSION];\n  supportedSnapshotProtocolVersions: readonly [typeof SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION];\n}>;\n\nexport type NativeEditableArtifactSubprocessPort = NativeEditableArtifactMaterializerPort &\n  Readonly<{\n    verifyMaterialization(input: {\n      format: string;\n      codecId: string;\n      codecVersion: string;\n      expectedSemanticHash: string;\n      byteSize: number;\n      chunks: AsyncIterable<Uint8Array>;\n      signal: AbortSignal;\n    }): Promise<void>;\n  }>;\n\n/**\n * Probe exact codec/kernel capabilities and combine them with independently\n * verified parent-launcher isolation. The child is never trusted to attest its\n * own network namespace, resource limits, or platform sandbox.\n */\nexport async function createNativeEditableArtifactSubprocessPort(\n  options: NativeEditableArtifactSubprocessOptions,\n): Promise<NativeEditableArtifactSubprocessPort> {\n  validateOptions(options);\n  const childIdentity = await probeIdentity(options);\n  validateIdentity(childIdentity);\n  const identity = compositeIdentity(childIdentity, options);\n  return Object.freeze({\n    identity,\n    materialize: async (\n      input: Parameters<NativeEditableArtifactMaterializerPort[\"materialize\"]>[0],\n    ) => await executeMaterialization(options, childIdentity, input),\n    verifyMaterialization: async (\n      input: Parameters<NativeEditableArtifactSubprocessPort[\"verifyMaterialization\"]>[0],\n    ) => await executeVerification(options, childIdentity, input),\n  });\n}\n\nasync function executeMaterialization(\n  options: NativeEditableArtifactSubprocessOptions,\n  identity: IdentityEnvelope,\n  input: Parameters<NativeEditableArtifactMaterializerPort[\"materialize\"]>[0],\n): Promise<NativeEditableArtifactMaterializationResult> {\n  throwIfAborted(input.signal);\n  if (input.job.sourceByteSize > options.maxSourceBytes) {\n    throw new EditableArtifactMaterializerPermanentError(\"source_size_limit\");\n  }\n  const manifest = encodeManifest(input.job, input.normalizedOptions);\n  const child = spawnNative(options, [MATERIALIZE_ARGUMENT]);\n  const terminate = () => terminateChild(child);\n  const timeout = setTimeout(terminate, options.wallTimeoutMs);\n  timeout.unref?.();\n  const abort = () => terminate();\n  input.signal.addEventListener(\"abort\", abort, { once: true });\n\n  const stderrDone = drainStderr(child, terminate);\n  const exit = waitForExit(child);\n  const cancellation = createAbortWait(input.signal);\n  const inputDone = pumpInput(\n    child,\n    manifest,\n    input.job.sourceByteSize,\n    input.snapshot,\n    input.signal,\n    exit,\n    cancellation.promise,\n  );\n  void inputDone.catch(terminate);\n  const reader = new BoundedProcessReader(child, terminate, cancellation.promise);\n\n  try {\n    const magic = await reader.readExactly(OUTPUT_MAGIC.byteLength, input.signal);\n    if (equalBytes(magic, ERROR_MAGIC)) {\n      throw await readTypedError(reader, input.signal);\n    }\n    if (!equalBytes(magic, OUTPUT_MAGIC)) {\n      throw new Error(\"native materializer returned an invalid output protocol\");\n    }\n    const header = await reader.readExactly(12, input.signal);\n    const headerView = new DataView(header.buffer, header.byteOffset, header.byteLength);\n    const metadataBytes = headerView.getUint32(0, true);\n    const outputBytes = safeU64(headerView, 4, \"native materializer output length\");\n    if (metadataBytes < 2 || metadataBytes > MAX_METADATA_BYTES) {\n      throw new Error(\"native materializer metadata exceeds its bound\");\n    }\n    if (\n      outputBytes <= 0 ||\n      outputBytes > options.maxOutputBytes ||\n      outputBytes > identity.maxOutputBytes\n    ) {\n      throw new EditableArtifactMaterializerPermanentError(\"output_size_limit\");\n    }\n    const metadataText = new TextDecoder(\"utf-8\", { fatal: true }).decode(\n      await reader.readExactly(metadataBytes, input.signal),\n    );\n    const result = decodeOutputMetadata(metadataText, input.job, outputBytes);\n    let consumed = false;\n    return Object.freeze({\n      ...result,\n      chunks: Object.freeze({\n        async *[Symbol.asyncIterator](): AsyncIterableIterator<Uint8Array> {\n          if (consumed) throw new Error(\"native materializer output is single-use\");\n          consumed = true;\n          try {\n            yield* reader.streamExactly(outputBytes, input.signal);\n            await reader.assertEof(input.signal);\n            await inputDone;\n            await stderrDone;\n            const status = await exit;\n            if (status.code !== 0 || status.signal !== null) {\n              throw new Error(\"native materializer exited unsuccessfully\");\n            }\n          } finally {\n            cleanup();\n          }\n        },\n      }),\n    });\n  } catch (error) {\n    terminate();\n    await Promise.allSettled([inputDone, stderrDone, exit]);\n    cleanup();\n    throw mapSubprocessFailure(error, input.signal);\n  }\n\n  function cleanup(): void {\n    clearTimeout(timeout);\n    input.signal.removeEventListener(\"abort\", abort);\n    cancellation.dispose();\n    if (child.exitCode === null && child.signalCode === null) terminate();\n  }\n}\n\nasync function executeVerification(\n  options: NativeEditableArtifactSubprocessOptions,\n  identity: IdentityEnvelope,\n  input: Parameters<NativeEditableArtifactSubprocessPort[\"verifyMaterialization\"]>[0],\n): Promise<void> {\n  throwIfAborted(input.signal);\n  if (\n    !isHash(input.expectedSemanticHash) ||\n    !Number.isSafeInteger(input.byteSize) ||\n    input.byteSize <= 0 ||\n    input.byteSize > options.maxOutputBytes ||\n    identity.codecVersions[input.codecId] !== input.codecVersion\n  ) {\n    throw new EditableArtifactMaterializerPermanentError(\"output_verification_failed\");\n  }\n  const manifest = new TextEncoder().encode(\n    JSON.stringify({\n      codecId: input.codecId,\n      codecVersion: input.codecVersion,\n      expectedSemanticHash: input.expectedSemanticHash,\n      format: input.format,\n      protocol: \"OGAVJ001\",\n    }),\n  );\n  const child = spawnNative(options, [VERIFY_ARGUMENT]);\n  const terminate = () => terminateChild(child);\n  const timeout = setTimeout(terminate, options.wallTimeoutMs);\n  timeout.unref?.();\n  const abort = () => terminate();\n  input.signal.addEventListener(\"abort\", abort, { once: true });\n  const stderrDone = drainStderr(child, terminate);\n  const exit = waitForExit(child);\n  const cancellation = createAbortWait(input.signal);\n  const inputDone = pumpFrame(\n    child,\n    VERIFY_INPUT_MAGIC,\n    manifest,\n    input.byteSize,\n    input.chunks,\n    input.signal,\n    exit,\n    cancellation.promise,\n    \"output_verification_failed\",\n  );\n  void inputDone.catch(terminate);\n  const reader = new BoundedProcessReader(child, terminate, cancellation.promise);\n  try {\n    const magic = await reader.readExactly(VERIFY_OUTPUT_MAGIC.byteLength, input.signal);\n    if (equalBytes(magic, ERROR_MAGIC)) throw await readTypedError(reader, input.signal);\n    if (!equalBytes(magic, VERIFY_OUTPUT_MAGIC)) {\n      throw new EditableArtifactMaterializerPermanentError(\"output_verification_failed\");\n    }\n    const header = await reader.readExactly(12, input.signal);\n    const view = new DataView(header.buffer, header.byteOffset, header.byteLength);\n    const metadataBytes = view.getUint32(0, true);\n    const payloadBytes = safeU64(view, 4, \"verification payload length\");\n    if (metadataBytes < 2 || metadataBytes > MAX_METADATA_BYTES || payloadBytes !== 0) {\n      throw new EditableArtifactMaterializerPermanentError(\"output_verification_failed\");\n    }\n    const text = new TextDecoder(\"utf-8\", { fatal: true }).decode(\n      await reader.readExactly(metadataBytes, input.signal),\n    );\n    const value = JSON.parse(text) as unknown;\n    if (\n      JSON.stringify(value) !== text ||\n      typeof value !== \"object\" ||\n      value === null ||\n      Array.isArray(value) ||\n      Object.keys(value).sort().join(\"\\0\") !== \"protocol\\0semanticHash\" ||\n      (value as Record<string, unknown>).protocol !== \"OGAVR001\" ||\n      (value as Record<string, unknown>).semanticHash !== input.expectedSemanticHash\n    ) {\n      throw new EditableArtifactMaterializerPermanentError(\"output_verification_failed\");\n    }\n    await reader.assertEof(input.signal);\n    await inputDone;\n    await stderrDone;\n    const status = await exit;\n    if (status.code !== 0 || status.signal !== null) {\n      throw new EditableArtifactMaterializerPermanentError(\"output_verification_failed\");\n    }\n  } catch (error) {\n    terminate();\n    await Promise.allSettled([inputDone, stderrDone, exit]);\n    if (error instanceof EditableArtifactMaterializerPermanentError) throw error;\n    throw new EditableArtifactMaterializerPermanentError(\"output_verification_failed\");\n  } finally {\n    clearTimeout(timeout);\n    input.signal.removeEventListener(\"abort\", abort);\n    cancellation.dispose();\n    if (child.exitCode === null && child.signalCode === null) terminate();\n  }\n}\n\nasync function readTypedError(\n  reader: BoundedProcessReader,\n  signal: AbortSignal,\n): Promise<EditableArtifactMaterializerPermanentError> {\n  const header = await reader.readExactly(12, signal);\n  const view = new DataView(header.buffer, header.byteOffset, header.byteLength);\n  const metadataBytes = view.getUint32(0, true);\n  const payloadBytes = safeU64(view, 4, \"error payload length\");\n  if (metadataBytes < 2 || metadataBytes > MAX_METADATA_BYTES || payloadBytes !== 0) {\n    return new EditableArtifactMaterializerPermanentError(\"kernel_result_mismatch\");\n  }\n  const text = new TextDecoder(\"utf-8\", { fatal: true }).decode(\n    await reader.readExactly(metadataBytes, signal),\n  );\n  const value = JSON.parse(text) as unknown;\n  const keys =\n    typeof value === \"object\" && value !== null && !Array.isArray(value)\n      ? Object.keys(value).sort().join(\"\\0\")\n      : \"\";\n  if (\n    JSON.stringify(value) !== text ||\n    typeof value !== \"object\" ||\n    value === null ||\n    Array.isArray(value) ||\n    (keys !== \"code\\0protocol\" && keys !== \"code\\0protocol\\0subcode\") ||\n    (value as Record<string, unknown>).protocol !== \"OGAMERR1\"\n  ) {\n    return new EditableArtifactMaterializerPermanentError(\"kernel_result_mismatch\");\n  }\n  const code = (value as Record<string, unknown>).code;\n  const subcode = (value as Record<string, unknown>).subcode;\n  if (\n    code === \"unsupported_semantics\" ||\n    code === \"source_identity_mismatch\" ||\n    code === \"kernel_incompatible\" ||\n    code === \"output_verification_failed\"\n  ) {\n    const diagnostic = nativeFailureDiagnostic(code, subcode);\n    if (subcode !== undefined && !diagnostic) {\n      return new EditableArtifactMaterializerPermanentError(\"kernel_result_mismatch\");\n    }\n    return new EditableArtifactMaterializerPermanentError(code, diagnostic);\n  }\n  return new EditableArtifactMaterializerPermanentError(\"kernel_result_mismatch\");\n}\n\nfunction nativeFailureDiagnostic(\n  code: unknown,\n  subcode: unknown,\n): EditableArtifactMaterializerFailureDiagnostic | undefined {\n  if (code !== \"source_identity_mismatch\") return undefined;\n  if (subcode === \"input_framing\" || subcode === \"snapshot_open\" || subcode === \"state_mismatch\") {\n    return { stage: \"native\", subcode };\n  }\n  return undefined;\n}\n\nasync function probeIdentity(\n  options: NativeEditableArtifactSubprocessOptions,\n): Promise<IdentityEnvelope> {\n  const child = spawnNative(options, [IDENTITY_ARGUMENT]);\n  const terminate = () => terminateChild(child);\n  const timeout = setTimeout(terminate, options.probeTimeoutMs ?? 5_000);\n  timeout.unref?.();\n  const stdout = collectBounded(child.stdout, MAX_IDENTITY_BYTES, terminate);\n  const stderr = drainStderr(child, terminate);\n  try {\n    const [bytes, , status] = await Promise.all([stdout, stderr, waitForExit(child)]);\n    if (status.code !== 0 || status.signal !== null) {\n      throw new Error(\"native materializer identity probe failed\");\n    }\n    const text = new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes);\n    const parsed = JSON.parse(text) as unknown;\n    if (JSON.stringify(parsed) !== text) {\n      throw new Error(\"native materializer identity is not canonical JSON\");\n    }\n    return parsed as IdentityEnvelope;\n  } finally {\n    clearTimeout(timeout);\n    if (child.exitCode === null && child.signalCode === null) terminate();\n  }\n}\n\nfunction spawnNative(\n  options: NativeEditableArtifactSubprocessOptions,\n  args: readonly string[],\n): ChildProcessWithoutNullStreams {\n  return options.launcher.spawn({\n    executable: options.executable,\n    args,\n    environment: Object.freeze({\n      LANG: \"C\",\n      LC_ALL: \"C\",\n      TZ: \"UTC\",\n      ...(options.childEnvironment ?? {}),\n    }),\n  });\n}\n\nasync function pumpInput(\n  child: ChildProcessWithoutNullStreams,\n  manifest: Uint8Array,\n  expectedSourceBytes: number,\n  source: AsyncIterable<Uint8Array>,\n  signal: AbortSignal,\n  exit: Promise<{ code: number | null; signal: NodeJS.Signals | null }>,\n  cancellation: Promise<never>,\n): Promise<void> {\n  await pumpFrame(\n    child,\n    INPUT_MAGIC,\n    manifest,\n    expectedSourceBytes,\n    source,\n    signal,\n    exit,\n    cancellation,\n    \"source_identity_mismatch\",\n  );\n}\n\nasync function pumpFrame(\n  child: ChildProcessWithoutNullStreams,\n  magic: Uint8Array,\n  manifest: Uint8Array,\n  expectedSourceBytes: number,\n  source: AsyncIterable<Uint8Array>,\n  signal: AbortSignal,\n  exit: Promise<{ code: number | null; signal: NodeJS.Signals | null }>,\n  cancellation: Promise<never>,\n  mismatchCode: \"source_identity_mismatch\" | \"output_verification_failed\",\n): Promise<void> {\n  const header = new Uint8Array(12);\n  const view = new DataView(header.buffer);\n  view.setUint32(0, manifest.byteLength, true);\n  view.setBigUint64(4, BigInt(expectedSourceBytes), true);\n  await write(child, magic, signal, exit, cancellation);\n  await write(child, header, signal, exit, cancellation);\n  await write(child, manifest, signal, exit, cancellation);\n  let sourceBytes = 0;\n  for await (const chunk of source) {\n    throwIfAborted(signal);\n    if (\n      !(chunk instanceof Uint8Array) ||\n      chunk.byteLength === 0 ||\n      chunk.byteLength > 8 * 1024 * 1024\n    ) {\n      throw new EditableArtifactMaterializerPermanentError(mismatchCode);\n    }\n    sourceBytes += chunk.byteLength;\n    if (sourceBytes > expectedSourceBytes) {\n      throw new EditableArtifactMaterializerPermanentError(mismatchCode);\n    }\n    await write(child, chunk, signal, exit, cancellation);\n  }\n  if (sourceBytes !== expectedSourceBytes) {\n    throw new EditableArtifactMaterializerPermanentError(mismatchCode);\n  }\n  child.stdin.end();\n}\n\nasync function write(\n  child: ChildProcessWithoutNullStreams,\n  bytes: Uint8Array,\n  signal: AbortSignal,\n  exit: Promise<{ code: number | null; signal: NodeJS.Signals | null }>,\n  cancellation: Promise<never>,\n): Promise<void> {\n  throwIfAborted(signal);\n  if (!child.stdin.write(bytes)) {\n    await Promise.race([\n      once(child.stdin, \"drain\"),\n      cancellation,\n      exit.then(() => {\n        throw new Error(\"native materializer closed input early\");\n      }),\n    ]);\n  }\n}\n\nclass BoundedProcessReader {\n  readonly #iterator: AsyncIterator<Buffer | string>;\n  #buffer = new Uint8Array(0);\n  #done = false;\n\n  constructor(\n    child: ChildProcessWithoutNullStreams,\n    private readonly terminate: () => void,\n    private readonly cancellation: Promise<never>,\n  ) {\n    this.#iterator = child.stdout[Symbol.asyncIterator]();\n  }\n\n  async readExactly(length: number, signal: AbortSignal): Promise<Uint8Array> {\n    if (!Number.isSafeInteger(length) || length < 0) throw new Error(\"invalid framed length\");\n    const output = new Uint8Array(length);\n    let offset = 0;\n    while (offset < length) {\n      throwIfAborted(signal);\n      if (this.#buffer.byteLength === 0) await this.#fill(signal);\n      if (this.#buffer.byteLength === 0) throw new Error(\"truncated native materializer output\");\n      const count = Math.min(length - offset, this.#buffer.byteLength);\n      output.set(this.#buffer.subarray(0, count), offset);\n      this.#buffer = this.#buffer.subarray(count);\n      offset += count;\n    }\n    return output;\n  }\n\n  async *streamExactly(length: number, signal: AbortSignal): AsyncIterableIterator<Uint8Array> {\n    let remaining = length;\n    while (remaining > 0) {\n      throwIfAborted(signal);\n      const count = Math.min(remaining, STREAM_CHUNK_BYTES);\n      const chunk = await this.readExactly(count, signal);\n      remaining -= chunk.byteLength;\n      yield chunk;\n    }\n  }\n\n  async assertEof(signal: AbortSignal): Promise<void> {\n    throwIfAborted(signal);\n    if (this.#buffer.byteLength > 0) throw new Error(\"trailing native materializer output\");\n    if (!this.#done) await this.#fill(signal);\n    if (this.#buffer.byteLength > 0 || !this.#done) {\n      throw new Error(\"trailing native materializer output\");\n    }\n  }\n\n  async #fill(signal: AbortSignal): Promise<void> {\n    if (this.#done) return;\n    throwIfAborted(signal);\n    let next: IteratorResult<Buffer | string>;\n    try {\n      next = await Promise.race([this.#iterator.next(), this.cancellation]);\n    } catch (error) {\n      this.terminate();\n      throw error;\n    }\n    if (next.done) {\n      this.#done = true;\n      return;\n    }\n    if (typeof next.value === \"string\") throw new Error(\"native materializer emitted text stream\");\n    this.#buffer = new Uint8Array(\n      next.value.buffer,\n      next.value.byteOffset,\n      next.value.byteLength,\n    ).slice();\n  }\n}\n\nfunction encodeManifest(\n  job: ClaimedEditableArtifactMaterialization,\n  normalizedOptions: Uint8Array,\n): Uint8Array {\n  const options = new TextDecoder(\"utf-8\", { fatal: true }).decode(normalizedOptions);\n  const manifest = {\n    protocol: \"OGAMJ001\",\n    artifactId: job.artifactId,\n    jobId: job.jobId,\n    versionId: job.versionId,\n    modality: job.modality,\n    inputSnapshotId: job.inputSnapshotId,\n    targetHeadSequence: job.targetHeadSequence,\n    stateHash: job.stateHash,\n    sourceByteSize: job.sourceByteSize,\n    sourceContentHash: job.sourceContentHash,\n    modelSchemaVersion: job.modelSchemaVersion,\n    operationProtocolVersion: job.operationProtocolVersion,\n    snapshotProtocolVersion: job.snapshotProtocolVersion,\n    format: job.format,\n    codecId: job.codecId,\n    normalizedOptions: JSON.parse(options) as unknown,\n    optionsHash: job.optionsHash,\n    codecVersion: job.codecVersion,\n    kernelVersion: job.kernelVersion,\n    fontRegistryHash: job.fontRegistryHash,\n    policyHash: job.policyHash,\n  };\n  const bytes = new TextEncoder().encode(JSON.stringify(manifest));\n  if (bytes.byteLength > MAX_METADATA_BYTES) {\n    throw new EditableArtifactMaterializerPermanentError(\"invalid_job_manifest\");\n  }\n  return bytes;\n}\n\nfunction decodeOutputMetadata(\n  text: string,\n  job: ClaimedEditableArtifactMaterialization,\n  outputBytes: number,\n): Omit<NativeEditableArtifactMaterializationResult, \"chunks\"> {\n  const value = JSON.parse(text) as unknown;\n  if (JSON.stringify(value) !== text || typeof value !== \"object\" || value === null) {\n    throw new Error(\"native materializer metadata is not canonical JSON\");\n  }\n  const record = value as Record<string, unknown>;\n  const expectedKeys = [\n    \"byteSize\",\n    \"codecId\",\n    \"codecVersion\",\n    \"contentHash\",\n    \"fontRegistryHash\",\n    \"format\",\n    \"headSequence\",\n    \"kernelVersion\",\n    \"mimeType\",\n    \"policyHash\",\n    \"protocol\",\n    \"semanticHash\",\n    \"stateHash\",\n  ].sort();\n  if (Object.keys(record).sort().join(\"\\0\") !== expectedKeys.join(\"\\0\")) {\n    throw new Error(\"native materializer metadata fields are invalid\");\n  }\n  if (record.protocol !== \"OGAMR001\" || record.byteSize !== outputBytes) {\n    throw new Error(\"native materializer output length disagrees with metadata\");\n  }\n  const expectedMimeType = mimeTypeForFormat(job.format);\n  if (\n    !Number.isSafeInteger(record.headSequence) ||\n    record.headSequence !== job.targetHeadSequence ||\n    !isHash(record.stateHash) ||\n    record.stateHash !== job.stateHash ||\n    record.format !== job.format ||\n    record.mimeType !== expectedMimeType ||\n    !isBoundedVersion(record.codecId) ||\n    record.codecId !== job.codecId ||\n    !isBoundedVersion(record.codecVersion) ||\n    record.codecVersion !== job.codecVersion ||\n    !isBoundedKernelVersion(record.kernelVersion) ||\n    record.kernelVersion !== job.kernelVersion ||\n    !isHash(record.fontRegistryHash) ||\n    record.fontRegistryHash !== job.fontRegistryHash ||\n    !isHash(record.policyHash) ||\n    record.policyHash !== job.policyHash ||\n    !isHash(record.contentHash) ||\n    !isHash(record.semanticHash)\n  ) {\n    throw new Error(\"native materializer output metadata is incompatible\");\n  }\n  return Object.freeze({\n    headSequence: record.headSequence,\n    stateHash: record.stateHash,\n    format: job.format,\n    mimeType: expectedMimeType,\n    codecId: record.codecId,\n    codecVersion: record.codecVersion,\n    kernelVersion: record.kernelVersion,\n    fontRegistryHash: record.fontRegistryHash,\n    policyHash: record.policyHash,\n    byteSize: outputBytes,\n    contentHash: record.contentHash,\n    semanticHash: record.semanticHash,\n  });\n}\n\nfunction validateOptions(options: NativeEditableArtifactSubprocessOptions): void {\n  if (!isAbsolute(options.executable) || options.executable.length > 2_048) {\n    throw new TypeError(\"native materializer executable must be an absolute path\");\n  }\n  for (const [label, value] of [\n    [\"wall timeout\", options.wallTimeoutMs],\n    [\"source limit\", options.maxSourceBytes],\n    [\"output limit\", options.maxOutputBytes],\n  ] as const) {\n    if (!Number.isSafeInteger(value) || value <= 0) throw new TypeError(`${label} is invalid`);\n  }\n  const launcher = options.launcher.identity;\n  const sandboxed =\n    launcher.sandboxEnforced === true &&\n    launcher.network === \"denied\" &&\n    Number.isSafeInteger(launcher.memoryLimitBytes) &&\n    launcher.memoryLimitBytes > 0 &&\n    Number.isSafeInteger(launcher.cpuTimeLimitMs) &&\n    launcher.cpuTimeLimitMs > 0 &&\n    Number.isSafeInteger(launcher.fileDescriptorLimit) &&\n    launcher.fileDescriptorLimit > 0 &&\n    Number.isSafeInteger(launcher.processLimit) &&\n    launcher.processLimit > 0 &&\n    Number.isSafeInteger(launcher.fileSizeLimitBytes) &&\n    launcher.fileSizeLimitBytes > 0;\n  const developmentUnsandboxed =\n    options.allowUnsandboxedDevelopment === true &&\n    launcher.sandboxEnforced === false &&\n    launcher.network === \"host\" &&\n    launcher.memoryLimitBytes === 0 &&\n    launcher.cpuTimeLimitMs === 0 &&\n    launcher.fileDescriptorLimit === 0 &&\n    launcher.processLimit === 0 &&\n    launcher.fileSizeLimitBytes === 0;\n  if (\n    launcher.isolation !== \"subprocess\" ||\n    launcher.officeAutomation !== false ||\n    !isBoundedVersion(launcher.platform) ||\n    (!sandboxed && !developmentUnsandboxed)\n  ) {\n    throw new TypeError(\"materializer launcher isolation is not verified\");\n  }\n  if (options.childEnvironment !== undefined) {\n    const keys = Object.keys(options.childEnvironment).sort();\n    const productionKeys = [\"OPENGENI_ARTIFACT_RUNTIME_MANIFEST\", \"OPENGENI_ARTIFACT_TOOL_ENTRY\"];\n    const developmentKeys = [\n      \"NODE_ENV\",\n      \"OPENGENI_ARTIFACT_DEVELOPMENT_RUNTIME_MANIFEST\",\n      \"OPENGENI_ARTIFACT_TOOL_ENTRY\",\n    ];\n    const production = keys.join(\"\\0\") === productionKeys.join(\"\\0\");\n    const development = keys.join(\"\\0\") === developmentKeys.join(\"\\0\");\n    if (!production && !development) {\n      throw new TypeError(\"native materializer child environment is not exact\");\n    }\n    if (development !== developmentUnsandboxed) {\n      throw new TypeError(\"native materializer launcher and runtime authority modes differ\");\n    }\n    if (\n      development &&\n      (options.allowUnsandboxedDevelopment !== true ||\n        options.childEnvironment.NODE_ENV !== \"development\")\n    ) {\n      throw new TypeError(\"native materializer development child environment is forbidden\");\n    }\n    for (const [name, value] of Object.entries(options.childEnvironment)) {\n      if (name === \"NODE_ENV\") continue;\n      if (!isAbsolute(value) || value.length > 2_048 || /[\\u0000-\\u001f\\u007f]/u.test(value)) {\n        throw new TypeError(\"native materializer child environment path is invalid\");\n      }\n    }\n  }\n}\n\nfunction validateIdentity(identity: IdentityEnvelope): void {\n  const record = identity as unknown as Record<string, unknown>;\n  const expectedKeys = [\n    \"codecVersions\",\n    \"fontRegistryHash\",\n    \"kernelVersion\",\n    \"maxOutputBytes\",\n    \"policyHash\",\n    \"protocol\",\n    \"runtimeKind\",\n    \"runtimeTarget\",\n    \"supportedModelSchemaVersions\",\n    \"supportedOperationProtocolVersions\",\n    \"supportedSnapshotProtocolVersions\",\n  ].sort();\n  if (Object.keys(record).sort().join(\"\\0\") !== expectedKeys.join(\"\\0\")) {\n    throw new Error(\"native materializer identity fields are invalid\");\n  }\n  if (\n    identity.protocol !== \"OGAMC001\" ||\n    identity.runtimeKind !== \"native\" ||\n    !Number.isSafeInteger(identity.maxOutputBytes) ||\n    identity.maxOutputBytes <= 0\n  ) {\n    throw new Error(\"native materializer sandbox identity is incompatible\");\n  }\n  if (\n    !isBoundedKernelVersion(identity.kernelVersion) ||\n    !isBoundedVersion(identity.runtimeTarget) ||\n    !isHash(identity.fontRegistryHash) ||\n    !isHash(identity.policyHash) ||\n    !isCodecRegistry(identity.codecVersions) ||\n    !isCurrentSpreadsheetVersionList(\n      identity.supportedModelSchemaVersions,\n      SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,\n    ) ||\n    !isCurrentSpreadsheetVersionList(\n      identity.supportedOperationProtocolVersions,\n      COMMITTED_TRANSACTION_PROTOCOL_VERSION,\n    ) ||\n    !isCurrentSpreadsheetVersionList(\n      identity.supportedSnapshotProtocolVersions,\n      SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION,\n    )\n  ) {\n    throw new Error(\"native materializer capability identity is incomplete\");\n  }\n}\n\nfunction compositeIdentity(\n  child: IdentityEnvelope,\n  options: NativeEditableArtifactSubprocessOptions,\n): NativeEditableArtifactMaterializerIdentity {\n  const launcher = options.launcher.identity;\n  return Object.freeze({\n    kind: \"native\",\n    isolation: launcher.isolation,\n    network: launcher.network,\n    officeAutomation: launcher.officeAutomation,\n    processProtocolVersion: 1,\n    sandboxEnforced: launcher.sandboxEnforced,\n    memoryLimitBytes: launcher.memoryLimitBytes,\n    cpuTimeLimitMs: launcher.cpuTimeLimitMs,\n    fileDescriptorLimit: launcher.fileDescriptorLimit,\n    processLimit: launcher.processLimit,\n    fileSizeLimitBytes: launcher.fileSizeLimitBytes,\n    maxOutputBytes: Math.min(child.maxOutputBytes, options.maxOutputBytes),\n    kernelVersion: child.kernelVersion,\n    codecVersions: child.codecVersions,\n    fontRegistryHash: child.fontRegistryHash,\n    policyHash: child.policyHash,\n    runtimeTarget: child.runtimeTarget,\n    supportedModelSchemaVersions: child.supportedModelSchemaVersions,\n    supportedOperationProtocolVersions: child.supportedOperationProtocolVersions,\n    supportedSnapshotProtocolVersions: child.supportedSnapshotProtocolVersions,\n  });\n}\n\nfunction isCodecRegistry(value: unknown): value is Readonly<Record<string, string>> {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) return false;\n  const entries = Object.entries(value as Record<string, unknown>);\n  if (entries.length === 0 || entries.length > 64) return false;\n  let previous = \"\";\n  for (const [codecId, version] of entries) {\n    if (\n      !/^[a-z][a-z0-9._-]{0,127}$/u.test(codecId) ||\n      codecId <= previous ||\n      !isBoundedVersion(version)\n    ) {\n      return false;\n    }\n    previous = codecId;\n  }\n  return true;\n}\n\nfunction isCurrentSpreadsheetVersionList<const Version extends number>(\n  value: unknown,\n  expected: Version,\n): value is readonly [Version] {\n  return Array.isArray(value) && value.length === 1 && value[0] === expected;\n}\n\nfunction isBoundedVersion(value: unknown): value is string {\n  return (\n    typeof value === \"string\" &&\n    value.length >= 1 &&\n    value.length <= 128 &&\n    /^[\\x21-\\x7e]+$/u.test(value)\n  );\n}\n\nfunction isBoundedKernelVersion(value: unknown): value is string {\n  return (\n    typeof value === \"string\" &&\n    value.length >= 1 &&\n    new TextEncoder().encode(value).byteLength <= EDITABLE_ARTIFACT_KERNEL_VERSION_MAX_BYTES &&\n    /^[\\x21-\\x7e]+$/u.test(value)\n  );\n}\n\nfunction isHash(value: unknown): value is string {\n  return typeof value === \"string\" && /^sha256:[0-9a-f]{64}$/u.test(value);\n}\n\nasync function collectBounded(\n  stream: NodeJS.ReadableStream & AsyncIterable<Buffer | string>,\n  maximum: number,\n  terminate: () => void,\n): Promise<Uint8Array> {\n  const chunks: Uint8Array[] = [];\n  let total = 0;\n  for await (const value of stream) {\n    const chunk = typeof value === \"string\" ? Buffer.from(value) : value;\n    total += chunk.byteLength;\n    if (total > maximum) {\n      terminate();\n      throw new Error(\"native materializer diagnostic exceeded its bound\");\n    }\n    chunks.push(new Uint8Array(chunk.buffer, chunk.byteOffset, chunk.byteLength).slice());\n  }\n  const result = new Uint8Array(total);\n  let offset = 0;\n  for (const chunk of chunks) {\n    result.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return result;\n}\n\nasync function drainStderr(\n  child: ChildProcessWithoutNullStreams,\n  terminate: () => void,\n): Promise<void> {\n  await collectBounded(child.stderr, MAX_STDERR_BYTES, terminate);\n}\n\nfunction waitForExit(\n  child: ChildProcessWithoutNullStreams,\n): Promise<{ code: number | null; signal: NodeJS.Signals | null }> {\n  if (child.exitCode !== null || child.signalCode !== null) {\n    return Promise.resolve({ code: child.exitCode, signal: child.signalCode });\n  }\n  return new Promise((resolve, reject) => {\n    const onError = (error: Error) => {\n      child.removeListener(\"exit\", onExit);\n      reject(error);\n    };\n    const onExit = (code: number | null, signal: NodeJS.Signals | null) => {\n      child.removeListener(\"error\", onError);\n      resolve({ code, signal });\n    };\n    child.once(\"error\", onError);\n    child.once(\"exit\", onExit);\n  });\n}\n\nfunction terminateChild(child: ChildProcessWithoutNullStreams): void {\n  if (child.exitCode !== null || child.signalCode !== null) return;\n  child.stdin.destroy();\n  child.kill(\"SIGKILL\");\n}\n\nfunction createAbortWait(signal: AbortSignal): {\n  promise: Promise<never>;\n  dispose(): void;\n} {\n  let listener: (() => void) | null = null;\n  const promise = new Promise<never>((_resolve, reject) => {\n    if (signal.aborted) {\n      reject(signal.reason ?? abortError());\n      return;\n    }\n    listener = () => reject(signal.reason ?? abortError());\n    signal.addEventListener(\"abort\", listener, { once: true });\n  });\n  // The promise is deliberately shared by every stream race. Attach a handler\n  // once so a late abort after another branch failed cannot be unhandled.\n  void promise.catch(() => undefined);\n  return {\n    promise,\n    dispose() {\n      if (listener) signal.removeEventListener(\"abort\", listener);\n      listener = null;\n    },\n  };\n}\n\nfunction throwIfAborted(signal: AbortSignal): void {\n  if (signal.aborted) throw signal.reason ?? abortError();\n}\n\nfunction abortError(): DOMException {\n  return new DOMException(\"Operation aborted\", \"AbortError\");\n}\n\nfunction mapSubprocessFailure(error: unknown, signal: AbortSignal): unknown {\n  if (signal.aborted) return signal.reason ?? abortError();\n  return error;\n}\n\nfunction safeU64(view: DataView, offset: number, label: string): number {\n  const value = view.getBigUint64(offset, true);\n  if (value > BigInt(Number.MAX_SAFE_INTEGER)) throw new Error(`${label} exceeds safe integer`);\n  return Number(value);\n}\n\nfunction equalBytes(left: Uint8Array, right: Uint8Array): boolean {\n  return left.byteLength === right.byteLength && left.every((byte, index) => byte === right[index]);\n}\n","import { spawn, type ChildProcessWithoutNullStreams } from \"node:child_process\";\nimport { access, readlink, realpath, stat } from \"node:fs/promises\";\nimport { basename, dirname, isAbsolute, relative } from \"node:path\";\n\nimport type { VerifiedEditableArtifactProcessLauncher } from \"./editable-artifact-materializer-subprocess\";\n\nconst MAX_PROBE_BYTES = 16 * 1024;\nconst PROBE_TIMEOUT_MS = 5_000;\n\nexport type LinuxEditableArtifactLauncherOptions = Readonly<{\n  materializerExecutable: string;\n  bubblewrapExecutable: string;\n  prlimitExecutable: string;\n  runtimeRoot: string;\n  memoryLimitBytes: number;\n  cpuTimeLimitMs: number;\n  fileDescriptorLimit: number;\n  processLimit: number;\n  fileSizeLimitBytes: number;\n  probeExecutable?: string;\n}>;\n\nexport type DevelopmentEditableArtifactLauncherOptions = Readonly<{\n  materializerExecutable: string;\n  explicitlyEnabled: boolean;\n  nodeEnvironment: string | undefined;\n}>;\n\n/**\n * Current-host local development only. This deliberately reports that no OS\n * sandbox, network namespace, or process resource limit is enforced. The\n * caller must surface that degraded capability and can never select this path\n * in production.\n */\nexport async function createDevelopmentEditableArtifactProcessLauncher(\n  options: DevelopmentEditableArtifactLauncherOptions,\n): Promise<VerifiedEditableArtifactProcessLauncher> {\n  if (!options.explicitlyEnabled || options.nodeEnvironment === \"production\") {\n    throw new Error(\"Unsandboxed artifact materialization is forbidden outside development\");\n  }\n  const configuredMaterializerExecutable = options.materializerExecutable;\n  const materializerExecutable = await developmentExecutable(options.materializerExecutable);\n  return Object.freeze({\n    identity: Object.freeze({\n      platform: `${process.platform}-${process.arch}-development-unsandboxed-v1`,\n      isolation: \"subprocess\",\n      network: \"host\",\n      officeAutomation: false,\n      sandboxEnforced: false,\n      memoryLimitBytes: 0,\n      cpuTimeLimitMs: 0,\n      fileDescriptorLimit: 0,\n      processLimit: 0,\n      fileSizeLimitBytes: 0,\n    }),\n    spawn(input) {\n      if (\n        input.executable !== configuredMaterializerExecutable &&\n        input.executable !== materializerExecutable\n      ) {\n        throw new Error(\"Development materializer differs from its verified executable\");\n      }\n      return spawn(materializerExecutable, [...input.args], {\n        cwd: \"/\",\n        env: { ...input.environment },\n        stdio: [\"pipe\", \"pipe\", \"pipe\"],\n        windowsHide: true,\n      });\n    },\n  });\n}\n\n/**\n * Concrete production launcher for Linux. Isolation facts are established by\n * a parent-run behavioral probe of the actual bwrap+prlimit command, never by\n * the untrusted codec child. macOS/Windows require their own native launcher\n * implementation and therefore fail closed in production today.\n */\nexport async function createLinuxEditableArtifactProcessLauncher(\n  options: LinuxEditableArtifactLauncherOptions,\n): Promise<VerifiedEditableArtifactProcessLauncher> {\n  if (process.platform !== \"linux\") {\n    throw new Error(\"Linux artifact materializer sandbox is unavailable on this platform\");\n  }\n  if (\n    !Number.isSafeInteger(options.memoryLimitBytes) ||\n    options.memoryLimitBytes <= 0 ||\n    !Number.isSafeInteger(options.cpuTimeLimitMs) ||\n    options.cpuTimeLimitMs <= 0 ||\n    options.cpuTimeLimitMs % 1_000 !== 0 ||\n    !Number.isSafeInteger(options.fileDescriptorLimit) ||\n    options.fileDescriptorLimit <= 0 ||\n    !Number.isSafeInteger(options.processLimit) ||\n    options.processLimit <= 0 ||\n    !Number.isSafeInteger(options.fileSizeLimitBytes) ||\n    options.fileSizeLimitBytes <= 0\n  ) {\n    throw new Error(\"Artifact materializer launcher limits are invalid\");\n  }\n  const bubblewrap = await trustedExecutable(options.bubblewrapExecutable, \"bwrap\");\n  const prlimit = await trustedExecutable(options.prlimitExecutable, \"prlimit\");\n  const configuredMaterializerExecutable = options.materializerExecutable;\n  const materializerExecutable = await trustedExecutable(\n    options.materializerExecutable,\n    basename(options.materializerExecutable),\n  );\n  const runtimeRoot = await trustedRuntimeRoot(options.runtimeRoot);\n  const cpuSeconds = options.cpuTimeLimitMs / 1_000;\n\n  const spawnIsolated = (input: {\n    executable: string;\n    args: readonly string[];\n    environment: Readonly<Record<string, string>>;\n  }): ChildProcessWithoutNullStreams => {\n    if (!isAbsolute(input.executable)) throw new Error(\"Sandbox target must be absolute\");\n    const sandboxArguments = linuxEditableArtifactSandboxArguments({\n      executable: input.executable,\n      args: input.args,\n      runtimeRoot,\n      scratchLimitBytes: options.fileSizeLimitBytes,\n    });\n    return spawn(\n      prlimit,\n      [\n        ...linuxEditableArtifactPrlimitArguments({\n          memoryLimitBytes: options.memoryLimitBytes,\n          cpuSeconds,\n          fileDescriptorLimit: options.fileDescriptorLimit,\n          processLimit: options.processLimit,\n          fileSizeLimitBytes: options.fileSizeLimitBytes,\n        }),\n        \"--\",\n        bubblewrap,\n        ...sandboxArguments,\n      ],\n      {\n        cwd: \"/\",\n        env: { ...input.environment },\n        stdio: [\"pipe\", \"pipe\", \"pipe\"],\n        windowsHide: true,\n      },\n    );\n  };\n\n  const spawnMaterializer = (input: {\n    executable: string;\n    args: readonly string[];\n    environment: Readonly<Record<string, string>>;\n  }): ChildProcessWithoutNullStreams => {\n    if (\n      input.executable !== configuredMaterializerExecutable &&\n      input.executable !== materializerExecutable\n    ) {\n      throw new Error(\"Sandbox target differs from the verified materializer executable\");\n    }\n    assertRuntimeEnvironmentConfined(input.environment, runtimeRoot);\n    return spawnIsolated({ ...input, executable: materializerExecutable });\n  };\n\n  const probeExecutable = await trustedExecutable(\n    options.probeExecutable ?? process.execPath,\n    basename(process.execPath),\n  );\n  const parentNetworkNamespace = await readlink(\"/proc/self/ns/net\");\n  const probe = spawnIsolated({\n    executable: probeExecutable,\n    args: [\n      \"-e\",\n      [\n        'const fs=require(\"node:fs\")',\n        'const net=fs.readlinkSync(\"/proc/self/ns/net\")',\n        'const limits=fs.readFileSync(\"/proc/self/limits\",\"utf8\")',\n        'const rootEntries=fs.readdirSync(\"/\").sort()',\n        'let rootWritable=false;try{fs.writeFileSync(\"/opengeni-root-write-probe\",\"x\");rootWritable=true;fs.unlinkSync(\"/opengeni-root-write-probe\")}catch{}',\n        'let scratchWritable=false;try{fs.writeFileSync(\"/tmp/opengeni-scratch-write-probe\",\"x\");scratchWritable=true;fs.unlinkSync(\"/tmp/opengeni-scratch-write-probe\")}catch{}',\n        \"process.stdout.write(JSON.stringify({net,limits,rootEntries,rootWritable,scratchWritable}))\",\n      ].join(\";\"),\n    ],\n    environment: Object.freeze({ LANG: \"C\", LC_ALL: \"C\", TZ: \"UTC\" }),\n  });\n  probe.stdin.end();\n  const timeout = setTimeout(() => terminateChild(probe), PROBE_TIMEOUT_MS);\n  timeout.unref?.();\n  let stdout: Uint8Array;\n  let stderr: Uint8Array;\n  let status: { code: number | null; signal: NodeJS.Signals | null };\n  try {\n    [stdout, stderr, status] = await Promise.all([\n      boundedStream(probe.stdout),\n      boundedStream(probe.stderr),\n      waitForExit(probe),\n    ]);\n  } finally {\n    clearTimeout(timeout);\n    terminateChild(probe);\n  }\n  if (status.code !== 0 || status.signal !== null || stderr.byteLength !== 0) {\n    throw new Error(\"Artifact materializer sandbox behavioral probe failed\");\n  }\n  const parsed = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(stdout)) as unknown;\n  if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n    throw new Error(\"Artifact materializer sandbox probe returned invalid evidence\");\n  }\n  const evidence = parsed as Record<string, unknown>;\n  const expectedRootEntries = linuxEditableArtifactSandboxRootEntries({\n    executable: probeExecutable,\n    runtimeRoot,\n  });\n  if (\n    typeof evidence.net !== \"string\" ||\n    evidence.net === parentNetworkNamespace ||\n    typeof evidence.limits !== \"string\" ||\n    !hasResourceLimit(evidence.limits, \"Max cpu time\", String(cpuSeconds)) ||\n    !hasResourceLimit(evidence.limits, \"Max address space\", String(options.memoryLimitBytes)) ||\n    !hasResourceLimit(evidence.limits, \"Max open files\", String(options.fileDescriptorLimit)) ||\n    !hasResourceLimit(evidence.limits, \"Max processes\", String(options.processLimit)) ||\n    !hasResourceLimit(evidence.limits, \"Max file size\", String(options.fileSizeLimitBytes)) ||\n    !sameStringList(evidence.rootEntries, expectedRootEntries) ||\n    evidence.rootWritable !== false ||\n    evidence.scratchWritable !== true\n  ) {\n    throw new Error(\"Artifact materializer sandbox enforcement could not be proved\");\n  }\n\n  return Object.freeze({\n    identity: Object.freeze({\n      platform: `linux-${process.arch}-bwrap-prlimit-v1`,\n      isolation: \"subprocess\",\n      network: \"denied\",\n      officeAutomation: false,\n      sandboxEnforced: true,\n      memoryLimitBytes: options.memoryLimitBytes,\n      cpuTimeLimitMs: options.cpuTimeLimitMs,\n      fileDescriptorLimit: options.fileDescriptorLimit,\n      processLimit: options.processLimit,\n      fileSizeLimitBytes: options.fileSizeLimitBytes,\n    }),\n    spawn: spawnMaterializer,\n  });\n}\n\nexport function linuxEditableArtifactSandboxArguments(\n  input: Readonly<{\n    executable: string;\n    args: readonly string[];\n    runtimeRoot: string;\n    scratchLimitBytes: number;\n  }>,\n): readonly string[] {\n  if (\n    !isAbsolute(input.executable) ||\n    !isAbsolute(input.runtimeRoot) ||\n    !Number.isSafeInteger(input.scratchLimitBytes) ||\n    input.scratchLimitBytes <= 0\n  ) {\n    throw new Error(\"Artifact materializer sandbox paths must be absolute\");\n  }\n  const parentDirectories = sandboxParentDirectories([input.executable, input.runtimeRoot]);\n  return Object.freeze([\n    \"--die-with-parent\",\n    \"--new-session\",\n    \"--unshare-all\",\n    ...parentDirectories.flatMap((path) => [\"--dir\", path]),\n    \"--ro-bind\",\n    \"/usr/lib\",\n    \"/usr/lib\",\n    \"--ro-bind-try\",\n    \"/usr/lib64\",\n    \"/usr/lib64\",\n    \"--ro-bind-try\",\n    \"/usr/share\",\n    \"/usr/share\",\n    \"--symlink\",\n    \"usr/lib\",\n    \"/lib\",\n    \"--symlink\",\n    \"usr/lib64\",\n    \"/lib64\",\n    \"--dir\",\n    \"/etc\",\n    \"--ro-bind-try\",\n    \"/etc/ld.so.cache\",\n    \"/etc/ld.so.cache\",\n    \"--ro-bind-try\",\n    \"/etc/ld.so.conf\",\n    \"/etc/ld.so.conf\",\n    \"--ro-bind-try\",\n    \"/etc/ld.so.conf.d\",\n    \"/etc/ld.so.conf.d\",\n    \"--ro-bind\",\n    input.runtimeRoot,\n    input.runtimeRoot,\n    \"--ro-bind\",\n    input.executable,\n    input.executable,\n    \"--proc\",\n    \"/proc\",\n    \"--dev\",\n    \"/dev\",\n    \"--size\",\n    String(input.scratchLimitBytes),\n    \"--tmpfs\",\n    \"/tmp\",\n    \"--remount-ro\",\n    \"/\",\n    \"--chdir\",\n    \"/\",\n    \"--\",\n    input.executable,\n    ...input.args,\n  ]);\n}\n\nexport function linuxEditableArtifactPrlimitArguments(\n  input: Readonly<{\n    memoryLimitBytes: number;\n    cpuSeconds: number;\n    fileDescriptorLimit: number;\n    processLimit: number;\n    fileSizeLimitBytes: number;\n  }>,\n): readonly string[] {\n  return Object.freeze([\n    `--as=${input.memoryLimitBytes}`,\n    `--cpu=${input.cpuSeconds}`,\n    `--nofile=${input.fileDescriptorLimit}`,\n    `--nproc=${input.processLimit}`,\n    `--fsize=${input.fileSizeLimitBytes}`,\n  ]);\n}\n\nexport function linuxEditableArtifactSandboxRootEntries(\n  input: Readonly<{\n    executable: string;\n    runtimeRoot: string;\n  }>,\n): readonly string[] {\n  const entries = new Set([\"dev\", \"etc\", \"lib\", \"lib64\", \"proc\", \"tmp\", \"usr\"]);\n  for (const path of [input.executable, input.runtimeRoot]) {\n    const topLevel = path.split(\"/\").find((part) => part.length > 0);\n    if (topLevel) entries.add(topLevel);\n  }\n  return Object.freeze([...entries].sort());\n}\n\nasync function trustedExecutable(input: string, expectedBasename: string): Promise<string> {\n  if (!isAbsolute(input) || basename(input) !== expectedBasename) {\n    throw new Error(`Artifact materializer ${expectedBasename} path is invalid`);\n  }\n  const canonical = await realpath(input);\n  const metadata = await stat(canonical);\n  await access(canonical, 1);\n  if (!metadata.isFile() || metadata.uid !== 0 || (metadata.mode & 0o022) !== 0) {\n    throw new Error(`Artifact materializer ${expectedBasename} is not a trusted executable`);\n  }\n  return canonical;\n}\n\nasync function trustedRuntimeRoot(input: string): Promise<string> {\n  if (!isAbsolute(input) || broadRuntimeRoot(input)) {\n    throw new Error(\"Artifact materializer runtime root is invalid\");\n  }\n  const canonical = await realpath(input);\n  const metadata = await stat(canonical);\n  if (\n    canonical !== input ||\n    !metadata.isDirectory() ||\n    metadata.uid !== 0 ||\n    (metadata.mode & 0o022) !== 0\n  ) {\n    throw new Error(\"Artifact materializer runtime root is not a trusted directory\");\n  }\n  return canonical;\n}\n\nfunction broadRuntimeRoot(input: string): boolean {\n  if (input.split(\"/\").filter(Boolean).length < 2) return true;\n  return new Set([\n    \"/\",\n    \"/app\",\n    \"/bin\",\n    \"/dev\",\n    \"/etc\",\n    \"/home\",\n    \"/lib\",\n    \"/lib64\",\n    \"/media\",\n    \"/mnt\",\n    \"/opt\",\n    \"/proc\",\n    \"/root\",\n    \"/run\",\n    \"/sbin\",\n    \"/srv\",\n    \"/sys\",\n    \"/tmp\",\n    \"/usr\",\n    \"/usr/local\",\n    \"/var\",\n    \"/workspace\",\n  ]).has(input);\n}\n\nfunction assertRuntimeEnvironmentConfined(\n  environment: Readonly<Record<string, string>>,\n  runtimeRoot: string,\n): void {\n  for (const name of [\n    \"OPENGENI_ARTIFACT_RUNTIME_MANIFEST\",\n    \"OPENGENI_ARTIFACT_TOOL_ENTRY\",\n  ] as const) {\n    const path = environment[name];\n    if (!path || !isPathInside(runtimeRoot, path)) {\n      throw new Error(\"Artifact materializer runtime environment escapes its verified root\");\n    }\n  }\n}\n\nfunction isPathInside(root: string, path: string): boolean {\n  if (!isAbsolute(path)) return false;\n  const fromRoot = relative(root, path);\n  return (\n    fromRoot.length > 0 &&\n    fromRoot !== \"..\" &&\n    !fromRoot.startsWith(`..${process.platform === \"win32\" ? \"\\\\\" : \"/\"}`) &&\n    !isAbsolute(fromRoot)\n  );\n}\n\nfunction sandboxParentDirectories(paths: readonly string[]): readonly string[] {\n  const directories = new Set<string>();\n  for (const path of paths) {\n    let parent = dirname(path);\n    while (parent !== \"/\" && parent !== \".\") {\n      directories.add(parent);\n      parent = dirname(parent);\n    }\n  }\n  return [...directories].sort((left, right) => {\n    const depth = left.split(\"/\").length - right.split(\"/\").length;\n    return depth === 0 ? left.localeCompare(right) : depth;\n  });\n}\n\nfunction sameStringList(value: unknown, expected: readonly string[]): boolean {\n  return (\n    Array.isArray(value) &&\n    value.length === expected.length &&\n    value.every((entry, index) => entry === expected[index])\n  );\n}\n\nasync function developmentExecutable(input: string): Promise<string> {\n  if (!isAbsolute(input) || !/^opengeni-artifact-materializer(?:\\.exe)?$/u.test(basename(input))) {\n    throw new Error(\"Development artifact materializer path is invalid\");\n  }\n  const canonical = await realpath(input);\n  const metadata = await stat(canonical);\n  await access(canonical, 1);\n  if (!metadata.isFile()) throw new Error(\"Development artifact materializer is not executable\");\n  return canonical;\n}\n\nfunction hasResourceLimit(limits: string, name: string, expected: string): boolean {\n  const line = limits.split(\"\\n\").find((candidate) => candidate.startsWith(name));\n  if (!line) return false;\n  const fields = line.trim().split(/\\s{2,}/u);\n  return fields[1] === expected && fields[2] === expected;\n}\n\nasync function boundedStream(\n  stream: NodeJS.ReadableStream & AsyncIterable<Buffer | string>,\n): Promise<Uint8Array> {\n  const chunks: Uint8Array[] = [];\n  let total = 0;\n  for await (const value of stream) {\n    const chunk = typeof value === \"string\" ? Buffer.from(value) : value;\n    total += chunk.byteLength;\n    if (total > MAX_PROBE_BYTES) throw new Error(\"Artifact materializer sandbox probe overflowed\");\n    chunks.push(new Uint8Array(chunk.buffer, chunk.byteOffset, chunk.byteLength).slice());\n  }\n  const output = new Uint8Array(total);\n  let offset = 0;\n  for (const chunk of chunks) {\n    output.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return output;\n}\n\nfunction waitForExit(\n  child: ChildProcessWithoutNullStreams,\n): Promise<{ code: number | null; signal: NodeJS.Signals | null }> {\n  if (child.exitCode !== null || child.signalCode !== null) {\n    return Promise.resolve({ code: child.exitCode, signal: child.signalCode });\n  }\n  return new Promise((resolve, reject) => {\n    const onError = (error: Error) => {\n      child.removeListener(\"exit\", onExit);\n      reject(error);\n    };\n    const onExit = (code: number | null, signal: NodeJS.Signals | null) => {\n      child.removeListener(\"error\", onError);\n      resolve({ code, signal });\n    };\n    child.once(\"error\", onError);\n    child.once(\"exit\", onExit);\n  });\n}\n\nfunction terminateChild(child: ChildProcessWithoutNullStreams): void {\n  if (child.exitCode !== null || child.signalCode !== null) return;\n  child.stdin.destroy();\n  child.kill(\"SIGKILL\");\n}\n","import { createMaterializerSidecarFromEnvironment } from \"./editable-artifact-materializer-service\";\n\n/**\n * Dedicated editable-artifact materializer process. This entry deliberately\n * does not import/create a Temporal worker and is never called by control/turn\n * startup. Deploy it as a separate sidecar/service with its own DSN.\n */\nexport async function runEditableArtifactMaterializerSidecar(\n  environment: NodeJS.ProcessEnv = process.env,\n): Promise<void> {\n  const configured = await createMaterializerSidecarFromEnvironment(environment);\n  if (!configured) {\n    throw new Error(\"Editable artifact materializer sidecar is disabled\");\n  }\n  const server = Bun.serve({\n    hostname: configured.httpHostname,\n    port: configured.httpPort,\n    fetch: configured.service.fetch,\n  });\n  const stop = () => configured.service.drain(\"process signal\");\n  process.on(\"SIGTERM\", stop);\n  process.on(\"SIGINT\", stop);\n  try {\n    await configured.service.run();\n  } finally {\n    process.off(\"SIGTERM\", stop);\n    process.off(\"SIGINT\", stop);\n    server.stop(true);\n    await configured.service.close();\n  }\n}\n\nif (import.meta.main) {\n  await runEditableArtifactMaterializerSidecar();\n}\n"],"mappings":";;;AAAA,SAAS,cAAc,mBAAkC;AACzD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,2BAA+C;AACxD,SAAS,2BAA+C;AACxD,SAAS,WAAAA,gBAAe;;;ACTxB,SAAS,kBAAkB;AAE3B,SAAS,kDAAkD;AAC3D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOP,SAAS,wBAAwB,+BAA+B;AAOzD,IAAM,+CACX;AAEK,IAAM,kDAAkD,MAAM,OAAO;AACrE,IAAM,kDAAkD,MAAM,OAAO;AACrE,IAAM,mDAAmD,MAAM;AAC/D,IAAM,8CAA8C;AAgQ3D,IAAM,kBAAkB,OAAO,OAAO;AAAA,EACpC,WAAW;AAAA,EACX,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,sBAAsB;AAAA,EACtB,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,aAAa;AAAA,EACb,gBAAgB;AAAA,EAChB,gBAAgB;AAClB,CAAC;AA0BM,IAAM,6CAAN,cAAyD,MAAM;AAAA,EACpE,YACW,MACA,YACT;AACA,UAAM,sDAAsD,IAAI,EAAE;AAHzD;AACA;AAGT,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,6CAAN,cAAyD,MAAM;AAAA,EACpE,cAAc;AACZ,UAAM,kDAAkD;AACxD,SAAK,OAAO;AAAA,EACd;AACF;AAMO,IAAM,+BAAN,MAAmC;AAAA,EAIxC,YACmB,cACjB,SACA,iBAAsE,CAAC,GACvE;AAHiB;AAIjB,SAAK,WAAW,iBAAiB,OAAO;AACxC;AAAA,MACE,aAAa,OAAO;AAAA,MACpB,eAAe,gCAAgC;AAAA,IACjD;AAAA,EACF;AAAA,EAbS;AAAA,EACT,cAAuE;AAAA,EAcvE,MAAM,IAAI,QAAoC;AAC5C,QAAI,cAAc;AAClB,WAAO,CAAC,OAAO,SAAS;AACtB,YAAM,UAAU,MAAM,KAAK,aAAa,MAAM;AAC9C,oBAAc,QAAQ;AACtB,UAAI,OAAO,QAAS;AACpB,YAAM,QAAQ,cACV,KAAK,SAAS,iBACd,QAAQ,YAAY,IAClB,KAAK,SAAS,iBACd;AACN,UAAI,QAAQ,KAAK,CAAE,MAAM,aAAa,KAAK,aAAa,WAAW,OAAO,MAAM,EAAI;AAAA,IACtF;AACA,UAAM,KAAK,MAAM;AAAA,EACnB;AAAA;AAAA,EAGA,aAAa,QAAwE;AACnF,QAAI,KAAK,YAAa,QAAO,KAAK;AAClC,UAAM,OAAO,KAAK,eAAe,MAAM;AACvC,SAAK,cAAc;AACnB,SAAK,KAAK;AAAA,MACR,MAAM;AACJ,YAAI,KAAK,gBAAgB,KAAM,MAAK,cAAc;AAAA,MACpD;AAAA,MACA,MAAM;AACJ,YAAI,KAAK,gBAAgB,KAAM,MAAK,cAAc;AAAA,MACpD;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,QAAuB;AAC3B,UAAM,KAAK;AAAA,EACb;AAAA,EAEA,MAAM,eACJ,cACkD;AAClD,UAAM,UAAU,eAAe;AAC/B,QAAI,cAAc,SAAS;AACzB,aAAO,cAAc,OAAO;AAAA,IAC9B;AACA,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,KAAK,aAAa,MAAM,MAAM;AAAA,QACzC,OAAO,KAAK,SAAS;AAAA,QACrB,iBAAiB,KAAK,SAAS;AAAA,QAC/B,OAAO,KAAK,SAAS;AAAA,MACvB,CAAC;AACD,UAAI,CAAC,MAAM,QAAQ,IAAI,KAAK,KAAK,SAAS,KAAK,SAAS,WAAW;AACjE,cAAM,IAAI,UAAU,uDAAuD;AAAA,MAC7E;AAAA,IACF,SAAS,OAAO;AACd,cAAQ,cAAc;AACtB,WAAK,QAAQ,cAAc;AAC3B,WAAK,MAAM,kDAAkD,gBAAgB,KAAK;AAClF,aAAO,cAAc,OAAO;AAAA,IAC9B;AACA,YAAQ,UAAU,KAAK;AACvB,QAAI,KAAK,SAAS,EAAG,MAAK,QAAQ,WAAW,KAAK,MAAM;AAExD,QAAI,SAAS;AACb,UAAM,SAAS,YAA2B;AACxC,iBAAS;AACP,cAAM,QAAQ;AACd,kBAAU;AACV,cAAM,MAAM,KAAK,KAAK;AACtB,YAAI,CAAC,IAAK;AACV,cAAM,KAAK,YAAY,KAAK,SAAS,YAAY;AAAA,MACnD;AAAA,IACF;AACA,UAAM,QAAQ;AAAA,MACZ,MAAM,KAAK,EAAE,QAAQ,KAAK,IAAI,KAAK,QAAQ,KAAK,SAAS,WAAW,EAAE,GAAG,MAAM;AAAA,IACjF;AACA,WAAO,cAAc,OAAO;AAAA,EAC9B;AAAA,EAEA,MAAM,YACJ,KACA,SACA,cACe;AACf,QAAI;AACJ,QAAI;AACF,cAAQ,mBAAmB,KAAK,KAAK,SAAS,OAAO,KAAK,aAAa,OAAO,QAAQ;AAAA,IACxF,SAAS,OAAO;AACd,YAAM,KAAK,sBAAsB,KAAK,wBAAwB,SAAS,KAAK;AAC5E;AAAA,IACF;AAEA,QAAI,IAAI,gBAAgB,KAAK,SAAS,aAAa;AACjD,YAAM,KAAK,iBAAiB,OAAO,mBAAmB,SAAS,IAAI;AACnE;AAAA,IACF;AAEA,UAAM,iBAAiB,IAAI,gBAAgB;AAC3C,UAAM,eAAe,IAAI,gBAAgB;AACzC,UAAM,WAAW,oBAAoB,cAAc,eAAe,MAAM;AACxE,QAAI,YAAY;AAChB,UAAM,UAAU,KAAK,YAAY,OAAO,aAAa,QAAQ,gBAAgB,MAAM;AACjF,kBAAY;AAAA,IACd,CAAC;AAED,QAAI,SAAmC;AACvC,QAAI;AACF,qBAAe,SAAS,MAAM;AAC9B,mCAA6B,KAAK,KAAK,aAAa,OAAO,QAAQ;AACnE,YAAM,eAAe,sBAAsB,IAAI,mBAAmB,IAAI,WAAW;AACjF,UAAI,IAAI,iBAAiB,KAAK,SAAS,gBAAgB;AACrD,cAAM,IAAI,2CAA2C,mBAAmB;AAAA,MAC1E;AACA,UAAI;AACF,iBAAS,MAAM,KAAK,aAAa,aAAa,KAAK;AAAA,UACjD,iBAAiB,IAAI;AAAA,UACrB,UAAU,KAAK,SAAS;AAAA,UACxB,kBAAkB,IAAI;AAAA,UACtB,QAAQ,SAAS;AAAA,QACnB,CAAC;AAAA,MACH,SAAS,OAAO;AACd,cAAM,4BAA4B,OAAO,MAAM;AAAA,MACjD;AACA,UAAI,OAAO,gBAAgB,UAAa,OAAO,gBAAgB,IAAI,gBAAgB;AACjF,cAAM,IAAI,2CAA2C,4BAA4B;AAAA,UAC/E,OAAO;AAAA,UACP,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AACA,UAAI;AACJ,UAAI;AACF,uBAAe,OAAO,OAAO,EAAE,QAAQ,SAAS,OAAO,CAAC;AAAA,MAC1D,SAAS,OAAO;AACd,cAAM,4BAA4B,OAAO,iBAAiB;AAAA,MAC5D;AACA,YAAM,gBAAgB;AAAA,QACpB;AAAA,QACA,IAAI;AAAA,QACJ,IAAI;AAAA,QACJ;AAAA,QACA,EAAE,OAAO,iBAAiB,SAAS,kBAAkB;AAAA,MACvD;AACA,UAAI;AACJ,UAAI;AACF,iBAAS,MAAM,KAAK,aAAa,OAAO,YAAY;AAAA,UAClD;AAAA,UACA,mBAAmB;AAAA,UACnB,UAAU,cAAc;AAAA,UACxB,QAAQ,SAAS;AAAA,QACnB,CAAC;AACD,cAAM,cAAc;AAAA,MACtB,SAAS,OAAO;AAId,aAAK,cAAc,KAAK,MAAM,MAAM,MAAS;AAC7C,cAAM;AAAA,MACR;AACA,UAAI;AACF,cAAM,OAAO,gBAAgB,SAAS,MAAM;AAAA,MAC9C,SAAS,OAAO;AACd,cAAM,4BAA4B,OAAO,YAAY;AAAA,MACvD;AACA,2BAAqB,KAAK,MAAM;AAEhC,YAAM,UAAU,MAAM,KAAK,aAAa,aAAa,MAAM;AAAA,QACzD,QAAQ,OAAO;AAAA,QACf,aAAa,OAAO;AAAA,QACpB,UAAU,KAAK,SAAS;AAAA,QACxB,GAAI,OAAO,aAAa,SAAY,EAAE,kBAAkB,OAAO,SAAS,IAAI,CAAC;AAAA,QAC7E,GAAI,OAAO,gBAAgB,SAAY,EAAE,qBAAqB,OAAO,YAAY,IAAI,CAAC;AAAA,QACtF,QAAQ,SAAS;AAAA,MACnB,CAAC;AACD,UAAI;AACJ,UAAI;AACF,mBAAW,MAAM,KAAK,aAAa,eAAe,OAAO;AAAA,UACvD,iBAAiB,QAAQ;AAAA,UACzB,kBAAkB,QAAQ;AAAA,UAC1B,qBAAqB,QAAQ;AAAA,UAC7B,kBAAkB,OAAO;AAAA,UACzB,QAAQ,IAAI;AAAA,UACZ,SAAS,IAAI;AAAA,UACb,cAAc,IAAI;AAAA,UAClB,sBAAsB,OAAO;AAAA,UAC7B,UAAU,KAAK,SAAS;AAAA,UACxB,QAAQ,SAAS;AAAA,QACnB,CAAC;AAAA,MACH,SAAS,OAAO;AACd,YAAI,iBAAiB,wBAAwB;AAC3C,gBAAM,IAAI,2CAA2C,4BAA4B;AAAA,QACnF;AACA,cAAM;AAAA,MACR;AACA,sCAAgC,KAAK,SAAS,QAAQ;AAEtD,mBAAa,MAAM;AACnB,YAAM;AACN,UAAI,UAAW,OAAM,IAAI,2CAA2C;AACpE,qBAAe,SAAS,MAAM;AAC9B,YAAM,KAAK,aAAa,MAAM,MAAM;AAAA,QAClC,GAAG;AAAA,QACH,iBAAiB,KAAK,SAAS;AAAA,MACjC,CAAC;AACD,YAAM,MAAM,uBAAuB,KAAK,QAAQ,WAAW;AAC3D,YAAM,KAAK,aAAa,MAAM,QAAQ;AAAA,QACpC,GAAG;AAAA,QACH,GAAG;AAAA,QACH,iBAAiB,QAAQ;AAAA,QACzB,UAAU,QAAQ;AAAA,QAClB,aAAa,QAAQ;AAAA,QACrB,UAAU,OAAO;AAAA,QACjB,YAAY,KAAK,aAAa,MAAM,IAAI,EAAE,YAAY;AAAA,MACxD,CAAC;AACD,cAAQ,aAAa;AACrB,WAAK,QAAQ,WAAW;AAAA,IAC1B,SAAS,OAAO;AACd,mBAAa,MAAM;AACnB,YAAM;AACN,UAAI,aAAa,aAAa,KAAK,GAAG;AACpC,gBAAQ,aAAa;AACrB,aAAK,QAAQ,YAAY;AACzB,aAAK,MAAM,oDAAoD,cAAc,KAAK;AAAA,MACpF,WAAW,SAAS,OAAO,WAAW,aAAa,KAAK,GAAG;AACzD,gBAAQ,aAAa;AACrB,aAAK,QAAQ,WAAW;AAAA,MAC1B,OAAO;AACL,cAAM,YAAY,2BAA2B,KAAK;AAClD,YAAI,WAAW;AACb,gBAAM,KAAK,iBAAiB,OAAO,WAAW,SAAS,KAAK;AAAA,QAC9D,OAAO;AAGL,kBAAQ,iBAAiB;AACzB,eAAK,QAAQ,gBAAgB;AAC7B,eAAK;AAAA,YACH;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,UAAE;AACA,mBAAa,MAAM;AACnB,eAAS,QAAQ;AACjB,UAAI,OAAQ,OAAM,OAAO,MAAM;AAAA,IACjC;AAAA,EACF;AAAA,EAEA,MAAM,YACJ,OACA,QACA,gBACA,aACe;AACf,WACE,MAAM,aAAa,KAAK,aAAa,WAAW,KAAK,SAAS,sBAAsB,MAAM,GAC1F;AACA,UAAI;AACF,cAAM,KAAK,aAAa,MAAM,MAAM;AAAA,UAClC,GAAG;AAAA,UACH,iBAAiB,KAAK,SAAS;AAAA,QACjC,CAAC;AAAA,MACH,SAAS,OAAO;AACd,oBAAY;AACZ,uBAAe,MAAM,KAAK;AAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,iBACJ,OACA,MACA,SACA,OACe;AACf,QAAI;AACF,YAAM,KAAK,aAAa,MAAM,MAAM;AAAA,QAClC,GAAG;AAAA,QACH,iBAAiB,KAAK,SAAS;AAAA,MACjC,CAAC;AACD,YAAM,KAAK,aAAa,MAAM,KAAK,EAAE,GAAG,OAAO,WAAW,KAAK,CAAC;AAChE,cAAQ,gBAAgB;AACxB,WAAK,QAAQ,eAAe;AAC5B,UAAI,MAAO,MAAK,MAAM,uDAAuD,MAAM,KAAK;AAAA,IAC1F,SAAS,OAAO;AACd,cAAQ,aAAa;AACrB,WAAK,QAAQ,YAAY;AACzB,WAAK,MAAM,uDAAuD,cAAc,KAAK;AAAA,IACvF;AAAA,EACF;AAAA,EAEA,MAAM,sBACJ,KACA,MACA,SACA,OACe;AACf,QAAI;AACF,YAAM,QAAQ,SAAS,KAAK,KAAK,SAAS,KAAK;AAC/C,YAAM,KAAK,iBAAiB,OAAO,MAAM,SAAS,KAAK;AAAA,IACzD,SAAS,OAAO;AACd,cAAQ,aAAa;AACrB,WAAK,QAAQ,YAAY;AACzB,WAAK,MAAM,sDAAsD,cAAc,KAAK;AAAA,IACtF;AAAA,EACF;AAAA,EAEA,QAAQ,SAAoD,QAAQ,GAAS;AAC3E,QAAI;AACF,WAAK,aAAa,SAAS,UAAU,SAAS,KAAK;AAAA,IACrD,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAM,SAAiB,MAAc,OAAsB;AACzD,QAAI;AACF,WAAK,aAAa,QAAQ,KAAK,SAAS;AAAA,QACtC;AAAA,QACA,YAAY,iBAAiB,QAAQ,MAAM,OAAO;AAAA,QAClD,GAAI,iBAAiB,8CAA8C,MAAM,aACrE;AAAA,UACE,cAAc,MAAM,WAAW;AAAA,UAC/B,gBAAgB,MAAM,WAAW;AAAA,QACnC,IACA,CAAC;AAAA,MACP,CAAC;AAAA,IACH,QAAQ;AAAA,IAER;AAAA,EACF;AACF;AAiBO,SAAS,6CACd,OACqC;AACrC,MAAI,CAAC,MAAM,QAAS,QAAO;AAC3B,MAAI,MAAM,iBAAiB,8CAA8C;AACvE,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACA,MAAI,CAAC,MAAM,yBAAyB;AAClC,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,QAAM,eAAe,MAAM;AAC3B,MACE,CAAC,cAAc,SACf,CAAC,aAAa,gBACd,CAAC,aAAa,gBACd,CAAC,aAAa,kBACd,CAAC,aAAa,UACd,CAAC,aAAa,aACd,CAAC,aAAa,OACd;AACA,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AACA;AAAA,IACE,aAAa,OAAO;AAAA,IACpB,MAAM,gCAAgC;AAAA,EACxC;AACA,MAAI,CAAC,MAAM,QAAS,OAAM,IAAI,MAAM,qDAAqD;AACzF,SAAO,IAAI;AAAA,IACT;AAAA,IACA,MAAM;AAAA,IACN,MAAM,gCAAgC,SAClC,CAAC,IACD,EAAE,6BAA6B,MAAM,4BAA4B;AAAA,EACvE;AACF;AAEO,IAAM,8CACX,OAAO,OAAO;AAAA,EACZ,MAAM,cAAsB,QAAoC;AAC9D,WAAO,IAAI,QAAc,CAAC,SAAS,WAAW;AAC5C,UAAI,OAAO,SAAS;AAClB,eAAO,OAAO,UAAU,WAAW,CAAC;AACpC;AAAA,MACF;AACA,YAAM,WAAW,MAAM;AACrB,eAAO,oBAAoB,SAAS,KAAK;AACzC,gBAAQ;AAAA,MACV;AACA,YAAM,QAAQ,WAAW,UAAU,YAAY;AAC/C,YAAM,QAAQ;AACd,YAAM,QAAQ,MAAM;AAClB,qBAAa,KAAK;AAClB,eAAO,oBAAoB,SAAS,KAAK;AACzC,eAAO,OAAO,UAAU,WAAW,CAAC;AAAA,MACtC;AACA,aAAO,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AAAA,IACxD,CAAC;AAAA,EACH;AACF,CAAC;AAEI,IAAM,0CACX,OAAO,OAAO,EAAE,KAAK,MAAM,oBAAI,KAAK,EAAE,CAAC;AAEzC,SAAS,iBAAiB,SAAiE;AACzF,QAAM,aAAgC,OAAO,OAAO;AAAA,IAClD,OAAO,cAAc,QAAQ,KAAK;AAAA,IAClC,WAAW,QAAQ,aAAa,gBAAgB;AAAA,IAChD,aAAa,QAAQ,eAAe,gBAAgB;AAAA,IACpD,iBAAiB,QAAQ,mBAAmB,gBAAgB;AAAA,IAC5D,sBAAsB,QAAQ,wBAAwB,gBAAgB;AAAA,IACtE,gBAAgB,QAAQ,kBAAkB,gBAAgB;AAAA,IAC1D,gBAAgB,QAAQ,kBAAkB,gBAAgB;AAAA,IAC1D,aAAa,QAAQ,eAAe,gBAAgB;AAAA,IACpD,gBAAgB,QAAQ,kBAAkB,gBAAgB;AAAA,IAC1D,gBAAgB,QAAQ,kBAAkB,gBAAgB;AAAA,EAC5D,CAAC;AACD,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,UAAU,GAAG;AACvD,QAAI,UAAU,QAAS;AACvB,oBAAgB,OAAO,KAAK;AAAA,EAC9B;AACA,MAAI,WAAW,YAAY,GAAI,OAAM,IAAI,UAAU,oCAAoC;AACvF,MAAI,WAAW,cAAc,WAAW,WAAW;AACjD,UAAM,IAAI,UAAU,iDAAiD;AAAA,EACvE;AACA,MAAI,WAAW,kBAAkB,OAAU,WAAW,kBAAkB,OAAY;AAClF,UAAM,IAAI,UAAU,4DAA4D;AAAA,EAClF;AACA,MAAI,WAAW,uBAAuB,KAAK,WAAW,iBAAiB;AACrE,UAAM,IAAI,UAAU,gEAAgE;AAAA,EACtF;AACA,MAAI,WAAW,cAAc,IAAO,OAAM,IAAI,UAAU,mCAAmC;AAC3F,MAAI,WAAW,iBAAiB,iDAAiD;AAC/E,UAAM,IAAI,UAAU,wDAAwD;AAAA,EAC9E;AACA,MAAI,WAAW,iBAAiB,iDAAiD;AAC/E,UAAM,IAAI,UAAU,wDAAwD;AAAA,EAC9E;AACA,SAAO;AACT;AAEA,SAAS,mBACP,KACA,OACA,QACsC;AACtC,QAAM,QAAQ,SAAS,KAAK,KAAK;AACjC,MAAI,IAAI,eAAe,MAAO,OAAM,IAAI,UAAU,sCAAsC;AACxF,kBAAgB,IAAI,qBAAqB,GAAG,0BAA0B;AACtE,kBAAgB,IAAI,gBAAgB,kBAAkB;AACtD,kBAAgB,IAAI,oBAAoB,sBAAsB;AAC9D,kBAAgB,IAAI,0BAA0B,4BAA4B;AAC1E,kBAAgB,IAAI,yBAAyB,2BAA2B;AACxE,kBAAgB,IAAI,cAAc,eAAe;AACjD,WAAS,IAAI,YAAY,aAAa;AACtC,WAAS,IAAI,OAAO,QAAQ;AAC5B,WAAS,IAAI,iBAAiB,mBAAmB;AACjD,MAAI,IAAI,cAAc,KAAM,UAAS,IAAI,WAAW,YAAY;AAChE,gBAAc,IAAI,WAAW,YAAY;AACzC,gBAAc,IAAI,mBAAmB,qBAAqB;AAC1D,gBAAc,IAAI,aAAa,cAAc;AAC7C,gBAAc,IAAI,kBAAkB,oBAAoB;AACxD,gBAAc,IAAI,YAAY,aAAa;AAC3C,cAAY,IAAI,uBAAuB,2BAA2B,IAAK;AACvE,cAAY,IAAI,gBAAgB,oBAAoB,GAAG;AACvD,cAAY,IAAI,SAAS,YAAY,GAAG;AACxC,cAAY,IAAI,cAAc,iBAAiB,GAAG;AAClD,cAAY,IAAI,eAAe,kBAAkB,0CAA0C;AAC3F,4BAA0B,IAAI,UAAU,IAAI,MAAM;AAClD,+BAA6B,KAAK,MAAM;AACxC,SAAO;AACT;AAEA,SAAS,SACP,KACA,OACsC;AACtC,cAAY,IAAI,OAAO,WAAW,cAAc,GAAG;AACnD,cAAY,IAAI,OAAO,aAAa,gBAAgB,GAAG;AACvD,WAAS,IAAI,YAAY,aAAa;AACtC,WAAS,IAAI,OAAO,QAAQ;AAC5B,kBAAgB,IAAI,cAAc,eAAe;AACjD,gBAAc,KAAK;AACnB,SAAO,OAAO,OAAO;AAAA,IACnB,OAAO,OAAO,OAAO,EAAE,GAAG,IAAI,MAAM,CAAC;AAAA,IACrC,YAAY,IAAI;AAAA,IAChB,OAAO,IAAI;AAAA,IACX;AAAA,IACA,cAAc,IAAI;AAAA,EACpB,CAAC;AACH;AAEA,SAAS,2BACP,UACA,8BAA8B,OACxB;AACN,MACE,SAAS,SAAS,YAClB,SAAS,cAAc,gBACvB,SAAS,qBAAqB,OAC9B;AACA,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AACA,MAAI,SAAS,2BAA2B,GAAG;AACzC,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACtF;AACA,MAAI,SAAS,iBAAiB;AAC5B,QAAI,SAAS,YAAY,UAAU;AACjC,YAAM,IAAI,MAAM,kEAAkE;AAAA,IACpF;AACA,oBAAgB,SAAS,kBAAkB,qBAAqB;AAChE,oBAAgB,SAAS,gBAAgB,uBAAuB;AAChE,oBAAgB,SAAS,qBAAqB,8BAA8B;AAC5E,oBAAgB,SAAS,cAAc,sBAAsB;AAC7D,oBAAgB,SAAS,oBAAoB,wBAAwB;AAAA,EACvE,WACE,CAAC,+BACD,SAAS,YAAY,UACrB,SAAS,qBAAqB,KAC9B,SAAS,mBAAmB,KAC5B,SAAS,wBAAwB,KACjC,SAAS,iBAAiB,KAC1B,SAAS,uBAAuB,GAChC;AACA,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACtF;AACA,kBAAgB,SAAS,gBAAgB,qBAAqB;AAC9D,cAAY,SAAS,eAAe,kBAAkB,0CAA0C;AAChG,cAAY,SAAS,eAAe,yBAAyB,GAAG;AAChE,gBAAc,SAAS,kBAAkB,oBAAoB;AAC7D,gBAAc,SAAS,YAAY,aAAa;AAChD,MAAI,CAAC,SAAS,iBAAiB,OAAO,SAAS,kBAAkB,UAAU;AACzE,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AACA,aAAW,CAAC,SAAS,OAAO,KAAK,OAAO,QAAQ,SAAS,aAAa,GAAG;AACvE,gBAAY,SAAS,YAAY,GAAG;AACpC,gBAAY,SAAS,iBAAiB,GAAG;AAAA,EAC3C;AACA,aAAW,CAAC,OAAO,QAAQ,QAAQ,KAAK;AAAA,IACtC;AAAA,MACE;AAAA,MACA,SAAS;AAAA,MACT;AAAA,IACF;AAAA,IACA;AAAA,MACE;AAAA,MACA,SAAS;AAAA,MACT;AAAA,IACF;AAAA,IACA;AAAA,MACE;AAAA,MACA,SAAS;AAAA,MACT;AAAA,IACF;AAAA,EACF,GAAY;AACV,QAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,KAAK,OAAO,CAAC,MAAM,UAAU;AAC3E,YAAM,IAAI,MAAM,4BAA4B,KAAK,uBAAuB;AAAA,IAC1E;AAAA,EACF;AACF;AAEA,SAAS,6BACP,KACA,UACM;AACN,QAAM,aACJ,SAAS,kBAAkB,IAAI,iBAC/B,SAAS,cAAc,IAAI,OAAO,MAAM,IAAI,gBAC5C,SAAS,qBAAqB,IAAI,oBAClC,SAAS,eAAe,IAAI,cAC5B,IAAI,uBAAuB,SAAS,6BAA6B,CAAC,KAClE,IAAI,6BAA6B,SAAS,mCAAmC,CAAC,KAC9E,IAAI,4BAA4B,SAAS,kCAAkC,CAAC;AAC9E,MAAI,CAAC,WAAY,OAAM,IAAI,2CAA2C,qBAAqB;AAC7F;AAEA,SAAS,qBACP,KACA,QACM;AACN,MACE,OAAO,iBAAiB,IAAI,sBAC5B,OAAO,cAAc,IAAI,aACzB,OAAO,WAAW,IAAI,UACtB,OAAO,aAAa,kBAAkB,IAAI,MAAM,KAChD,OAAO,YAAY,IAAI,WACvB,OAAO,iBAAiB,IAAI,gBAC5B,OAAO,kBAAkB,IAAI,iBAC7B,OAAO,qBAAqB,IAAI,oBAChC,OAAO,eAAe,IAAI,cAC1B,CAAC,OAAO,UACR,OAAO,OAAO,OAAO,OAAO,aAAa,MAAM,YAC/C;AACA,UAAM,IAAI,2CAA2C,wBAAwB;AAAA,EAC/E;AACA,MAAI,OAAO,aAAa,OAAW,iBAAgB,OAAO,UAAU,qBAAqB;AACzF,MAAI,OAAO,gBAAgB,OAAW,eAAc,OAAO,aAAa,oBAAoB;AAC5F,gBAAc,OAAO,cAAc,sBAAsB;AAC3D;AAEA,SAAS,gCACP,KACA,SAMA,UACM;AACN,MACE,SAAS,oBAAoB,QAAQ,mBACrC,SAAS,aAAa,QAAQ,YAC9B,SAAS,gBAAgB,QAAQ,eACjC,SAAS,aAAa,QAAQ,eAC9B,SAAS,WAAW,IAAI,UACxB,SAAS,YAAY,IAAI,WACzB,SAAS,iBAAiB,IAAI,cAC9B;AACA,UAAM,IAAI,2CAA2C,4BAA4B;AAAA,EACnF;AACF;AAEA,SAAS,sBAAsB,OAAe,cAAkC;AAC9E,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI,2CAA2C,sBAAsB;AAAA,EAC7E;AACA,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,KAAK;AAC5C,MAAI,MAAM,aAAa,kDAAkD;AACvE,UAAM,IAAI,2CAA2C,sBAAsB;AAAA,EAC7E;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,QAAI,KAAK,UAAU,MAAM,MAAM,OAAO;AACpC,YAAM,IAAI,MAAM,uBAAuB;AAAA,IACzC;AAAA,EACF,QAAQ;AACN,UAAM,IAAI,2CAA2C,sBAAsB;AAAA,EAC7E;AACA,MAAI,UAAU,KAAK,MAAM,cAAc;AACrC,UAAM,IAAI,2CAA2C,sBAAsB;AAAA,EAC7E;AACA,SAAO;AACT;AAEA,SAAS,iBACP,QACA,kBACA,qBACA,MACA,YAC4D;AAC5D,MAAI;AACJ,MAAI;AACJ,QAAM,OAAO,IAAI,QAAc,CAAC,SAAS,kBAAkB;AACzD,aAAS;AACT,aAAS;AAAA,EACX,CAAC;AACD,MAAI,UAAU;AACd,QAAM,SAAoC,OAAO,OAAO;AAAA,IACtD,QAAQ,OAAO,aAAa,IAAuC;AACjE,UAAI,SAAS;AACX,cAAM,QAAQ,IAAI,2CAA2C,MAAM,UAAU;AAC7E,eAAO,KAAK;AACZ,cAAM;AAAA,MACR;AACA,gBAAU;AACV,YAAM,SAAS,WAAW,QAAQ;AAClC,UAAI,WAAW;AACf,UAAI;AACF,yBAAiB,SAAS,QAAQ;AAChC,cAAI,EAAE,iBAAiB,eAAe,MAAM,eAAe,GAAG;AAC5D,kBAAM,IAAI,2CAA2C,MAAM,UAAU;AAAA,UACvE;AACA,sBAAY,MAAM;AAClB,cAAI,WAAW,kBAAkB;AAC/B,kBAAM,IAAI,2CAA2C,MAAM,UAAU;AAAA,UACvE;AACA,iBAAO,OAAO,KAAK;AACnB,gBAAM,MAAM,MAAM;AAAA,QACpB;AACA,YAAI,aAAa,kBAAkB;AACjC,gBAAM,IAAI,2CAA2C,MAAM,UAAU;AAAA,QACvE;AACA,cAAM,cAAc,UAAU,OAAO,OAAO,KAAK,CAAC;AAClD,YAAI,gBAAgB,qBAAqB;AACvC,gBAAM,IAAI,2CAA2C,MAAM,UAAU;AAAA,QACvE;AACA,eAAO;AAAA,MACT,SAAS,OAAO;AACd,cAAM,YAAY,4BAA4B,OAAO,iBAAiB;AACtE,eAAO,SAAS;AAChB,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF,CAAC;AACD,SAAO,EAAE,QAAQ,KAAK;AACxB;AAEA,SAAS,4BACP,OACA,SAIS;AACT,QAAM,OAAO,2BAA2B,KAAK;AAC7C,SAAO,OACH,IAAI,2CAA2C,MAAM,EAAE,OAAO,iBAAiB,QAAQ,CAAC,IACxF;AACN;AAEA,SAAS,uBACP,KACA,aACyC;AACzC,SAAO;AAAA,IACL,UAAU,sBAAsB,UAAU,KAAK,WAAW;AAAA,IAC1D,WAAW,sBAAsB,QAAQ,KAAK,WAAW;AAAA,EAC3D;AACF;AAEA,SAAS,sBACP,MACA,KACA,aACQ;AACR,QAAM,SAAS,WAAW,QAAQ;AAClC,SAAO,OAAO,8CAA8C,IAAI,UAAU,MAAM;AAChF,aAAW,SAAS;AAAA,IAClB,IAAI,MAAM;AAAA,IACV,IAAI,MAAM;AAAA,IACV,IAAI;AAAA,IACJ,IAAI;AAAA,IACJ;AAAA,EACF,GAAG;AACD,UAAM,QAAQ,OAAO,KAAK,OAAO,MAAM;AACvC,UAAM,SAAS,OAAO,YAAY,CAAC;AACnC,WAAO,cAAc,MAAM,UAAU;AACrC,WAAO,OAAO,MAAM;AACpB,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,QAAM,KAAK,OAAO,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAC3C,SAAO,QAAQ,KAAK,EAAE,IAAI,IAAI,GAAG,MAAM,CAAC,CAAC,KAAK;AAChD;AAEA,SAAS,UAAU,OAA2B;AAC5C,SAAO,UAAU,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK,CAAC;AACnE;AAEA,SAAS,0BACP,UACA,QACM;AACN,QAAM,UAAwF;AAAA,IAC5F,aAAa,CAAC,QAAQ,OAAO,OAAO,MAAM;AAAA,IAC1C,cAAc,CAAC,QAAQ,OAAO,OAAO,MAAM;AAAA,IAC3C,UAAU,CAAC,QAAQ,OAAO,OAAO,MAAM;AAAA,EACzC;AACA,MAAI,CAAC,QAAQ,QAAQ,GAAG,SAAS,MAAM,GAAG;AACxC,UAAM,IAAI,UAAU,yDAAyD;AAAA,EAC/E;AACF;AAEO,SAAS,kBACd,QACyC;AACzC,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,EACX;AACF;AAEA,SAAS,cAAc,OAAwB;AAC7C,MACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,SAAS,OACf,MAAM,KAAK,MAAM,SACjB,CAAC,sBAAsB,KAAK,KAAK,GACjC;AACA,UAAM,IAAI,UAAU,+BAA+B;AAAA,EACrD;AACA,SAAO;AACT;AAEA,SAAS,SAAS,OAAgB,OAAuB;AACvD,MAAI,OAAO,UAAU,YAAY,CAAC,kBAAkB,KAAK,KAAK,KAAK,QAAQ,KAAK,KAAK,GAAG;AACtF,UAAM,IAAI,UAAU,GAAG,KAAK,aAAa;AAAA,EAC3C;AACA,SAAO;AACT;AAEA,SAAS,cAAc,OAAgB,OAAuB;AAC5D,MAAI,OAAO,UAAU,YAAY,CAAC,yBAAyB,KAAK,KAAK,GAAG;AACtE,UAAM,IAAI,UAAU,GAAG,KAAK,aAAa;AAAA,EAC3C;AACA,SAAO;AACT;AAEA,SAAS,YAAY,OAAgB,OAAe,UAA0B;AAC5E,MACE,OAAO,UAAU,YACjB,MAAM,WAAW,KACjB,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE,aAAa,YAC7C,MAAM,KAAK,MAAM,SACjB,yBAAyB,KAAK,KAAK,GACnC;AACA,UAAM,IAAI,UAAU,GAAG,KAAK,aAAa;AAAA,EAC3C;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAgB,OAAuB;AAC9D,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAAG;AAC3E,UAAM,IAAI,UAAU,GAAG,KAAK,kCAAkC;AAAA,EAChE;AACA,SAAO;AACT;AAEA,SAAS,aAAa,OAAyB;AAC7C,SACE,iBAAiB,8CAChB,OAAO,UAAU,YAChB,UAAU,QACV,UAAU,SACV,MAAM,SAAS;AAErB;AAEA,SAAS,2BACP,OACmD;AACnD,MAAI,iBAAiB,2CAA4C,QAAO,MAAM;AAC9E,MAAI,iBAAiB,wBAAwB;AAC3C,QAAI,MAAM,SAAS,aAAc,QAAO;AACxC,QACE,MAAM,SAAS,oBACf,MAAM,SAAS,eACf,MAAM,SAAS,oBACf,MAAM,SAAS,mBACf;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,iBAAiB,yBAAyB;AAC5C,QAAI,MAAM,SAAS,aAAc,QAAO;AACxC,QACE,MAAM,SAAS,2BACf,MAAM,SAAS,uBACf,MAAM,SAAS,eACf,MAAM,SAAS,mBACf;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,OAAyB;AAC7C,SAAO,iBAAiB,eACpB,MAAM,SAAS,eACf,iBAAiB,SAAS,MAAM,SAAS;AAC/C;AAEA,SAAS,eAAe,QAA2B;AACjD,MAAI,OAAO,QAAS,OAAM,OAAO,UAAU,WAAW;AACxD;AAEA,SAAS,aAA2B;AAClC,SAAO,IAAI,aAAa,qBAAqB,YAAY;AAC3D;AAEA,SAAS,oBACP,OACA,QAC0C;AAC1C,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,UAAU,QAAQ,CAAC,OAAO,MAAM,IAAI,CAAC,MAAM;AACjD,QAAM,YAAuD,CAAC;AAC9D,aAAW,UAAU,SAAS;AAC5B,UAAM,WAAW,MAAM,WAAW,MAAM,OAAO,MAAM;AACrD,QAAI,OAAO,QAAS,UAAS;AAAA,SACxB;AACH,aAAO,iBAAiB,SAAS,UAAU,EAAE,MAAM,KAAK,CAAC;AACzD,gBAAU,KAAK,CAAC,QAAQ,QAAQ,CAAC;AAAA,IACnC;AAAA,EACF;AACA,SAAO;AAAA,IACL,QAAQ,WAAW;AAAA,IACnB,UAAU;AACR,iBAAW,CAAC,QAAQ,QAAQ,KAAK,WAAW;AAC1C,eAAO,oBAAoB,SAAS,QAAQ;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,aACb,WACA,cACA,QACkB;AAClB,MAAI;AACF,UAAM,UAAU,MAAM,cAAc,MAAM;AAC1C,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,OAAO,WAAW,aAAa,KAAK,EAAG,QAAO;AAClD,UAAM;AAAA,EACR;AACF;AAEA,SAAS,iBAAiC;AACxC,SAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe;AAAA,IACf,WAAW;AAAA,IACX,WAAW;AAAA,IACX,aAAa;AAAA,EACf;AACF;AAEA,SAAS,cAAc,SAAkE;AACvF,SAAO,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC;AACrC;;;ACnxCA,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,OAAO,SAAS,MAAM,UAA2B;AAC1D,SAAS,cAAc;AACvB,SAAS,YAAY;AAErB;AAAA,EACE,0BAAAC;AAAA,EACA;AAAA,OAIK;AAYP,IAAM,SAAS;AACf,IAAM,sBAAsB;AAC5B,IAAM,6BAA6B;AACnC,IAAM,gCAAgC,OAAO;AAC7C,IAAM,wBAAwB;AAC9B,IAAM,2BAA2B;AACjC,IAAM,2BAA2B,KAAK,OAAO;AAGtC,SAAS,0CACd,SACuB;AACvB,SAAO,gCAAgC,SAAS,EAAE,WAAW,oBAAoB,CAAC,EAAE;AACtF;AAGO,SAAS,0CACd,SACiC;AACjC,SAAO,gCAAgC,SAAS;AAAA,IAC9C,WAAW;AAAA,EACb,CAAC,EAAE;AACL;AAOO,SAAS,4CACd,SACA,kBAC6C;AAC7C,QAAM,OAAO,gCAAgC,SAAS;AAAA,IACpD,WAAW;AAAA,EACb,CAAC,EAAE;AACH,SAAO,OAAO,OAAO;AAAA,IACnB,MAAM,OACJ,OACkD;AAClD,wBAAkB,MAAM,eAAe;AACvC,oBAAc,MAAM,QAAQ;AAC5B,UACE,CAAC,OAAO,cAAc,MAAM,gBAAgB,KAC5C,MAAM,oBAAoB,KAC1B,MAAM,mBAAmB,MAAM,YAC/B,CAAC,OAAO,KAAK,MAAM,mBAAmB,GACtC;AACA,cAAM,IAAIC,wBAAuB,iBAAiB;AAAA,MACpD;AACA,MAAAC,gBAAe,MAAM,MAAM;AAC3B,YAAM,mBAAmB,MAAM,QAAQ,KAAK,OAAO,GAAG,2BAA2B,CAAC;AAClF,YAAM,cAAc,KAAK,kBAAkB,SAAS;AACpD,UAAI,gBAAmC;AACvC,UAAI;AACF,cAAM,MAAM,kBAAkB,GAAK;AACnC,wBAAgB,MAAM,KAAK,aAAa,MAAM,GAAK;AACnD,cAAM,SAAS,MAAM,KAAK,KAAK;AAAA,UAC7B,iBAAiB,MAAM;AAAA,UACvB,UAAU,MAAM;AAAA,UAChB,kBAAkB,MAAM;AAAA,UACxB,QAAQ,MAAM;AAAA,QAChB,CAAC;AACD,YAAI;AACF,cAAI,OAAO,gBAAgB,UAAa,OAAO,gBAAgB,MAAM,kBAAkB;AACrF,kBAAM,IAAID,wBAAuB,gBAAgB;AAAA,UACnD;AACA,gBAAM,SAASE,YAAW,QAAQ;AAClC,cAAI,SAAS;AACb,2BAAiB,SAAS,OAAO,OAAO,EAAE,QAAQ,MAAM,OAAO,CAAC,GAAG;AACjE,gBAAI,SAAS,MAAM,aAAa,MAAM,kBAAkB;AACtD,oBAAM,IAAIF,wBAAuB,gBAAgB;AAAA,YACnD;AACA,kBAAM,SAAS,eAAe,OAAO,MAAM;AAC3C,mBAAO,OAAO,KAAK;AACnB,sBAAU,MAAM;AAAA,UAClB;AACA,cACE,WAAW,MAAM,oBACjB,UAAU,OAAO,OAAO,KAAK,CAAC,OAAO,MAAM,qBAC3C;AACA,kBAAM,IAAIA,wBAAuB,gBAAgB;AAAA,UACnD;AACA,gBAAM,OAAO,gBAAgB,MAAM,MAAM;AAAA,QAC3C,UAAE;AACA,gBAAM,OAAO,MAAM;AAAA,QACrB;AACA,cAAM,cAAc,MAAM;AAC1B,wBAAgB;AAChB,cAAM;AAAA,UACJ;AAAA,UACA,MAAM;AAAA,UACN,MAAM;AAAA,UACN,MAAM;AAAA,UACN,MAAM;AAAA,QACR;AACA,YAAI;AACF,gBAAM,iBAAiB,OAAO;AAAA,YAC5B,QAAQ,MAAM;AAAA,YACd,SAAS,MAAM;AAAA,YACf,cAAc,MAAM;AAAA,YACpB,sBAAsB,MAAM;AAAA,YAC5B,UAAU,MAAM;AAAA,YAChB,QAAQ,WAAW,aAAa,MAAM,kBAAkB,MAAM,MAAM;AAAA,YACpE,QAAQ,MAAM;AAAA,UAChB,CAAC;AAAA,QACH,SAAS,OAAO;AACd,UAAAC,gBAAe,MAAM,MAAM;AAC3B,6CAAmC,KAAK;AACxC,gBAAM,IAAID,wBAAuB,gBAAgB;AAAA,QACnD;AACA,QAAAC,gBAAe,MAAM,MAAM;AAC3B,eAAO,OAAO,OAAO;AAAA,UACnB,iBAAiB,MAAM;AAAA,UACvB,UAAU,MAAM;AAAA,UAChB,aAAa,MAAM;AAAA,UACnB,UAAU,MAAM;AAAA,UAChB,QAAQ,MAAM;AAAA,UACd,SAAS,MAAM;AAAA,UACf,cAAc,MAAM;AAAA,QACtB,CAAC;AAAA,MACH,UAAE;AACA,YAAI,cAAe,OAAM,cAAc,MAAM,EAAE,MAAM,MAAM,MAAS;AACpE,cAAM,GAAG,kBAAkB,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,MAC7D;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,eAAe,aACb,MACA,UACA,QACA,UACA,QACe;AACf,MAAI,aAAa,kBAAkB,MAAM,GAAG;AAC1C,UAAM,IAAID,wBAAuB,gBAAgB;AAAA,EACnD;AACA,QAAM,SAAS,MAAM,KAAK,MAAM,GAAG;AACnC,MAAI;AACF,IAAAC,gBAAe,MAAM;AACrB,YAAQ,QAAQ;AAAA,MACd,KAAK;AACH,cAAM,oBAAoB,QAAQ,UAAU,mBAAmB,MAAM;AACrE;AAAA,MACF,KAAK;AACH,cAAM,oBAAoB,QAAQ,UAAU,wBAAwB,MAAM;AAC1E;AAAA,MACF,KAAK;AACH,cAAM,oBAAoB,QAAQ,UAAU,qBAAqB,MAAM;AACvE;AAAA,MACF,KAAK,OAAO;AACV,cAAM,QAAQ,MAAM,UAAU,QAAQ,GAAG,CAAC;AAC1C,cAAM,MAAM,MAAM,UAAU,QAAQ,WAAW,GAAG,CAAC;AACnD,YAAI,CAAC,gBAAgB,OAAO,OAAO,KAAK,CAAC,gBAAgB,KAAK,OAAO,GAAG;AACtE,gBAAM,IAAI,MAAM,qBAAqB;AAAA,QACvC;AACA;AAAA,MACF;AAAA,MACA,KAAK;AACH,YACE,CAAC;AAAA,UACC,MAAM,UAAU,QAAQ,GAAG,CAAC;AAAA,UAC5B,CAAC,KAAM,IAAM,IAAM,IAAM,IAAM,IAAM,IAAM,EAAI;AAAA,QACjD,GACA;AACA,gBAAM,IAAI,MAAM,uBAAuB;AAAA,QACzC;AACA;AAAA,MACF,KAAK,QAAQ;AACX,cAAM,SAAS,MAAM,UAAU,QAAQ,GAAG,EAAE;AAC5C,YAAI,CAAC,gBAAgB,QAAQ,MAAM,KAAK,CAAC,QAAQ,QAAQ,GAAG,MAAM,GAAG;AACnE,gBAAM,IAAI,MAAM,wBAAwB;AAAA,QAC1C;AACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AACN,IAAAA,gBAAe,MAAM;AACrB,UAAM,IAAID,wBAAuB,gBAAgB;AAAA,EACnD,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAEA,eAAe,oBACb,QACA,UACA,cACA,QACe;AACf,MAAI,CAAC,YAAY,MAAM,UAAU,QAAQ,GAAG,CAAC,GAAG,CAAC,IAAM,IAAM,GAAM,CAAI,CAAC,GAAG;AACzE,UAAM,IAAI,MAAM,aAAa;AAAA,EAC/B;AACA,QAAM,WAAW,KAAK,IAAI,UAAU,qBAAqB;AACzD,QAAM,OAAO,MAAM,UAAU,QAAQ,WAAW,UAAU,QAAQ;AAClE,QAAM,aAAa,0BAA0B,IAAI;AACjD,QAAM,OAAO,WAAW,WAAW;AACnC,QAAM,OAAO,IAAI,SAAS,KAAK,QAAQ,KAAK,YAAY,KAAK,UAAU;AACvE,QAAM,OAAO,KAAK,UAAU,aAAa,GAAG,IAAI;AAChD,QAAM,cAAc,KAAK,UAAU,aAAa,GAAG,IAAI;AACvD,QAAM,cAAc,KAAK,UAAU,aAAa,GAAG,IAAI;AACvD,QAAM,UAAU,KAAK,UAAU,aAAa,IAAI,IAAI;AACpD,QAAM,cAAc,KAAK,UAAU,aAAa,IAAI,IAAI;AACxD,QAAM,gBAAgB,KAAK,UAAU,aAAa,IAAI,IAAI;AAC1D,QAAM,gBAAgB,KAAK,UAAU,aAAa,IAAI,IAAI;AAC1D,MACE,SAAS,KACT,gBAAgB,KAChB,gBAAgB,WAChB,YAAY,KACZ,gBAAgB,cAChB,kBAAkB,cAClB,OAAO,KAAK,kBAAkB,YAC9B,gBAAgB,gBAAgB,QAChC,gBAAgB,UAChB;AACA,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACjD;AACA,QAAM,QAAQ,oBAAI,IAAY;AAC9B,MAAI,SAAS;AACb,MAAI,iBAAiB;AACrB,WAAS,QAAQ,GAAG,QAAQ,SAAS,SAAS,GAAG;AAC/C,IAAAC,gBAAe,MAAM;AACrB,QAAI,SAAS,KAAK,MAAM;AACtB,YAAM,IAAI,MAAM,mBAAmB;AAAA,IACrC;AACA,UAAM,SAAS,MAAM,UAAU,QAAQ,QAAQ,EAAE;AACjD,UAAM,aAAa,IAAI,SAAS,OAAO,QAAQ,OAAO,YAAY,OAAO,UAAU;AACnF,QAAI,WAAW,UAAU,GAAG,IAAI,MAAM,SAAY,OAAM,IAAI,MAAM,mBAAmB;AACrF,SAAK,WAAW,UAAU,GAAG,IAAI,IAAI,OAAO,EAAG,OAAM,IAAI,MAAM,qBAAqB;AACpF,UAAM,aAAa,WAAW,UAAU,IAAI,IAAI;AAChD,UAAM,cAAc,WAAW,UAAU,IAAI,IAAI;AACjD,UAAM,eAAe,WAAW,UAAU,IAAI,IAAI;AAClD,UAAM,OAAO,SAAS,KAAK,aAAa,cAAc;AACtD,sBAAkB;AAClB,QACE,eAAe,KACf,aAAa,4BACb,iBAAiB,4BACjB,OAAO,MACP;AACA,YAAM,IAAI,MAAM,qBAAqB;AAAA,IACvC;AACA,UAAM,OAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE;AAAA,MACrD,MAAM,UAAU,QAAQ,SAAS,IAAI,UAAU;AAAA,IACjD;AACA,QAAI,CAAC,mBAAmB,IAAI,KAAK,MAAM,IAAI,IAAI,GAAG;AAChD,YAAM,IAAI,MAAM,uBAAuB;AAAA,IACzC;AACA,UAAM,IAAI,IAAI;AACd,aAAS;AAAA,EACX;AACA,MAAI,WAAW,QAAQ,CAAC,MAAM,IAAI,qBAAqB,KAAK,CAAC,MAAM,IAAI,YAAY,GAAG;AACpF,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACF;AAEA,SAAS,mBAAmB,MAAuB;AACjD,MAAI,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,IAAI,EAAG,QAAO;AACxD,QAAM,WAAW,KAAK,MAAM,GAAG;AAI/B,MAAI,SAAS,GAAG,EAAE,MAAM,GAAI,UAAS,IAAI;AACzC,SACE,SAAS,SAAS,KAClB,SAAS,MAAM,CAAC,YAAY,QAAQ,SAAS,KAAK,YAAY,OAAO,YAAY,IAAI;AAEzF;AAEA,SAAS,0BAA0B,OAA2B;AAC5D,QAAM,UAAU,KAAK,IAAI,GAAG,MAAM,aAAa,KAAM;AACrD,WAAS,SAAS,MAAM,aAAa,IAAI,UAAU,SAAS,UAAU,GAAG;AACvE,QACE,MAAM,MAAM,MAAM,MAClB,MAAM,SAAS,CAAC,MAAM,MACtB,MAAM,SAAS,CAAC,MAAM,KACtB,MAAM,SAAS,CAAC,MAAM;AAEtB,aAAO;AAAA,EACX;AACA,QAAM,IAAI,MAAM,kBAAkB;AACpC;AAEA,gBAAgB,WACd,MACA,UACA,QACmC;AACnC,QAAM,SAAS,MAAM,KAAK,MAAM,GAAG;AACnC,MAAI;AACF,QAAI,SAAS;AACb,UAAM,SAAS,IAAI,WAAW,6BAA6B;AAC3D,WAAO,SAAS,UAAU;AACxB,MAAAA,gBAAe,MAAM;AACrB,YAAM,SAAS,KAAK,IAAI,OAAO,YAAY,WAAW,MAAM;AAC5D,YAAM,EAAE,UAAU,IAAI,MAAM,OAAO,KAAK,QAAQ,GAAG,QAAQ,MAAM;AACjE,UAAI,cAAc,OAAQ,OAAM,IAAID,wBAAuB,gBAAgB;AAC3E,gBAAU;AACV,YAAM,OAAO,MAAM,GAAG,SAAS;AAAA,IACjC;AAAA,EACF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAEA,eAAe,SAAS,QAAoB,OAAmB,UAAiC;AAC9F,MAAI,SAAS;AACb,SAAO,SAAS,MAAM,YAAY;AAChC,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO;AAAA,MACpC;AAAA,MACA;AAAA,MACA,MAAM,aAAa;AAAA,MACnB,WAAW;AAAA,IACb;AACA,QAAI,gBAAgB,EAAG,OAAM,IAAIA,wBAAuB,gBAAgB;AACxE,cAAU;AAAA,EACZ;AACF;AAEA,eAAe,UACb,QACA,UACA,QACqB;AACrB,MACE,CAAC,OAAO,cAAc,QAAQ,KAC9B,WAAW,KACX,CAAC,OAAO,cAAc,MAAM,KAC5B,SAAS,GACT;AACA,UAAM,IAAI,MAAM,oBAAoB;AAAA,EACtC;AACA,QAAM,SAAS,IAAI,WAAW,MAAM;AACpC,MAAI,SAAS;AACb,SAAO,SAAS,QAAQ;AACtB,UAAM,EAAE,UAAU,IAAI,MAAM,OAAO,KAAK,QAAQ,QAAQ,SAAS,QAAQ,WAAW,MAAM;AAC1F,QAAI,aAAa,EAAG,OAAM,IAAI,MAAM,sBAAsB;AAC1D,cAAU;AAAA,EACZ;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,OAAqB;AAC9C,MACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,SAAS,QACf,MAAM,KAAK,MAAM,SACjB,yBAAyB,KAAK,KAAK;AAEnC,UAAM,IAAIA,wBAAuB,iBAAiB;AACtD;AAEA,SAAS,cAAc,OAAqB;AAC1C,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAAG;AAC9C,UAAM,IAAIA,wBAAuB,iBAAiB;AAAA,EACpD;AACF;AAEA,SAASC,gBAAe,QAAuC;AAC7D,MAAI,QAAQ,QAAS,OAAM,IAAID,wBAAuB,SAAS;AACjE;AAEA,SAAS,mCAAmC,OAAsB;AAChE,MACE,iBAAiB,8CACjB,MAAM,SAAS,uBACf;AACA,UAAM;AAAA,EACR;AACF;AAEA,SAAS,gBAAgB,OAAmB,OAAwB;AAClE,SAAO,QAAQ,OAAO,GAAG,KAAK;AAChC;AAEA,SAAS,QAAQ,OAAmB,QAAgB,OAAwB;AAC1E,MAAI,SAAS,KAAK,SAAS,MAAM,SAAS,MAAM,WAAY,QAAO;AACnE,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,QAAI,MAAM,SAAS,KAAK,MAAM,MAAM,WAAW,KAAK,EAAG,QAAO;AAAA,EAChE;AACA,SAAO;AACT;AAEA,SAAS,YAAY,OAAmB,UAAsC;AAC5E,SAAO,SAAS,MAAM,CAAC,OAAO,UAAU,MAAM,KAAK,MAAM,KAAK;AAChE;;;AC5ZA,SAAS,YAAY;AACrB,SAAS,kBAAkB;AAG3B,SAAS,8CAAAG,mDAAkD;AAC3D;AAAA,EACE,0CAAAC;AAAA,EACA,6CAAAC;AAAA,EACA,8CAAAC;AAAA,OACK;AAYP,IAAM,cAAc,IAAI,YAAY,EAAE,OAAO,UAAU;AACvD,IAAM,qBAAqB,IAAI,YAAY,EAAE,OAAO,UAAU;AAC9D,IAAM,eAAe,IAAI,YAAY,EAAE,OAAO,UAAU;AACxD,IAAM,sBAAsB,IAAI,YAAY,EAAE,OAAO,UAAU;AAC/D,IAAM,cAAc,IAAI,YAAY,EAAE,OAAO,UAAU;AACvD,IAAM,oBAAoB;AAC1B,IAAM,uBAAuB;AAC7B,IAAM,kBAAkB;AACxB,IAAM,qBAAqB,KAAK;AAChC,IAAM,qBAAqB,MAAM;AACjC,IAAM,mBAAmB,KAAK;AAC9B,IAAM,qBAAqB,OAAO;AAmElC,eAAsB,2CACpB,SAC+C;AAC/C,kBAAgB,OAAO;AACvB,QAAM,gBAAgB,MAAM,cAAc,OAAO;AACjD,mBAAiB,aAAa;AAC9B,QAAM,WAAW,kBAAkB,eAAe,OAAO;AACzD,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA,aAAa,OACX,UACG,MAAM,uBAAuB,SAAS,eAAe,KAAK;AAAA,IAC/D,uBAAuB,OACrB,UACG,MAAM,oBAAoB,SAAS,eAAe,KAAK;AAAA,EAC9D,CAAC;AACH;AAEA,eAAe,uBACb,SACA,UACA,OACsD;AACtD,EAAAC,gBAAe,MAAM,MAAM;AAC3B,MAAI,MAAM,IAAI,iBAAiB,QAAQ,gBAAgB;AACrD,UAAM,IAAI,2CAA2C,mBAAmB;AAAA,EAC1E;AACA,QAAM,WAAW,eAAe,MAAM,KAAK,MAAM,iBAAiB;AAClE,QAAM,QAAQ,YAAY,SAAS,CAAC,oBAAoB,CAAC;AACzD,QAAM,YAAY,MAAM,eAAe,KAAK;AAC5C,QAAM,UAAU,WAAW,WAAW,QAAQ,aAAa;AAC3D,UAAQ,QAAQ;AAChB,QAAM,QAAQ,MAAM,UAAU;AAC9B,QAAM,OAAO,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AAE5D,QAAM,aAAa,YAAY,OAAO,SAAS;AAC/C,QAAM,OAAO,YAAY,KAAK;AAC9B,QAAM,eAAe,gBAAgB,MAAM,MAAM;AACjD,QAAM,YAAY;AAAA,IAChB;AAAA,IACA;AAAA,IACA,MAAM,IAAI;AAAA,IACV,MAAM;AAAA,IACN,MAAM;AAAA,IACN;AAAA,IACA,aAAa;AAAA,EACf;AACA,OAAK,UAAU,MAAM,SAAS;AAC9B,QAAM,SAAS,IAAI,qBAAqB,OAAO,WAAW,aAAa,OAAO;AAE9E,MAAI;AACF,UAAM,QAAQ,MAAM,OAAO,YAAY,aAAa,YAAY,MAAM,MAAM;AAC5E,QAAI,WAAW,OAAO,WAAW,GAAG;AAClC,YAAM,MAAM,eAAe,QAAQ,MAAM,MAAM;AAAA,IACjD;AACA,QAAI,CAAC,WAAW,OAAO,YAAY,GAAG;AACpC,YAAM,IAAI,MAAM,yDAAyD;AAAA,IAC3E;AACA,UAAM,SAAS,MAAM,OAAO,YAAY,IAAI,MAAM,MAAM;AACxD,UAAM,aAAa,IAAI,SAAS,OAAO,QAAQ,OAAO,YAAY,OAAO,UAAU;AACnF,UAAM,gBAAgB,WAAW,UAAU,GAAG,IAAI;AAClD,UAAM,cAAc,QAAQ,YAAY,GAAG,mCAAmC;AAC9E,QAAI,gBAAgB,KAAK,gBAAgB,oBAAoB;AAC3D,YAAM,IAAI,MAAM,gDAAgD;AAAA,IAClE;AACA,QACE,eAAe,KACf,cAAc,QAAQ,kBACtB,cAAc,SAAS,gBACvB;AACA,YAAM,IAAI,2CAA2C,mBAAmB;AAAA,IAC1E;AACA,UAAM,eAAe,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE;AAAA,MAC7D,MAAM,OAAO,YAAY,eAAe,MAAM,MAAM;AAAA,IACtD;AACA,UAAM,SAAS,qBAAqB,cAAc,MAAM,KAAK,WAAW;AACxE,QAAI,WAAW;AACf,WAAO,OAAO,OAAO;AAAA,MACnB,GAAG;AAAA,MACH,QAAQ,OAAO,OAAO;AAAA,QACpB,QAAQ,OAAO,aAAa,IAAuC;AACjE,cAAI,SAAU,OAAM,IAAI,MAAM,0CAA0C;AACxE,qBAAW;AACX,cAAI;AACF,mBAAO,OAAO,cAAc,aAAa,MAAM,MAAM;AACrD,kBAAM,OAAO,UAAU,MAAM,MAAM;AACnC,kBAAM;AACN,kBAAM;AACN,kBAAM,SAAS,MAAM;AACrB,gBAAI,OAAO,SAAS,KAAK,OAAO,WAAW,MAAM;AAC/C,oBAAM,IAAI,MAAM,2CAA2C;AAAA,YAC7D;AAAA,UACF,UAAE;AACA,oBAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH,SAAS,OAAO;AACd,cAAU;AACV,UAAM,QAAQ,WAAW,CAAC,WAAW,YAAY,IAAI,CAAC;AACtD,YAAQ;AACR,UAAM,qBAAqB,OAAO,MAAM,MAAM;AAAA,EAChD;AAEA,WAAS,UAAgB;AACvB,iBAAa,OAAO;AACpB,UAAM,OAAO,oBAAoB,SAAS,KAAK;AAC/C,iBAAa,QAAQ;AACrB,QAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,KAAM,WAAU;AAAA,EACtE;AACF;AAEA,eAAe,oBACb,SACA,UACA,OACe;AACf,EAAAA,gBAAe,MAAM,MAAM;AAC3B,MACE,CAAC,OAAO,MAAM,oBAAoB,KAClC,CAAC,OAAO,cAAc,MAAM,QAAQ,KACpC,MAAM,YAAY,KAClB,MAAM,WAAW,QAAQ,kBACzB,SAAS,cAAc,MAAM,OAAO,MAAM,MAAM,cAChD;AACA,UAAM,IAAI,2CAA2C,4BAA4B;AAAA,EACnF;AACA,QAAM,WAAW,IAAI,YAAY,EAAE;AAAA,IACjC,KAAK,UAAU;AAAA,MACb,SAAS,MAAM;AAAA,MACf,cAAc,MAAM;AAAA,MACpB,sBAAsB,MAAM;AAAA,MAC5B,QAAQ,MAAM;AAAA,MACd,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,QAAM,QAAQ,YAAY,SAAS,CAAC,eAAe,CAAC;AACpD,QAAM,YAAY,MAAM,eAAe,KAAK;AAC5C,QAAM,UAAU,WAAW,WAAW,QAAQ,aAAa;AAC3D,UAAQ,QAAQ;AAChB,QAAM,QAAQ,MAAM,UAAU;AAC9B,QAAM,OAAO,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AAC5D,QAAM,aAAa,YAAY,OAAO,SAAS;AAC/C,QAAM,OAAO,YAAY,KAAK;AAC9B,QAAM,eAAe,gBAAgB,MAAM,MAAM;AACjD,QAAM,YAAY;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,IACN;AAAA,IACA,aAAa;AAAA,IACb;AAAA,EACF;AACA,OAAK,UAAU,MAAM,SAAS;AAC9B,QAAM,SAAS,IAAI,qBAAqB,OAAO,WAAW,aAAa,OAAO;AAC9E,MAAI;AACF,UAAM,QAAQ,MAAM,OAAO,YAAY,oBAAoB,YAAY,MAAM,MAAM;AACnF,QAAI,WAAW,OAAO,WAAW,EAAG,OAAM,MAAM,eAAe,QAAQ,MAAM,MAAM;AACnF,QAAI,CAAC,WAAW,OAAO,mBAAmB,GAAG;AAC3C,YAAM,IAAI,2CAA2C,4BAA4B;AAAA,IACnF;AACA,UAAM,SAAS,MAAM,OAAO,YAAY,IAAI,MAAM,MAAM;AACxD,UAAM,OAAO,IAAI,SAAS,OAAO,QAAQ,OAAO,YAAY,OAAO,UAAU;AAC7E,UAAM,gBAAgB,KAAK,UAAU,GAAG,IAAI;AAC5C,UAAM,eAAe,QAAQ,MAAM,GAAG,6BAA6B;AACnE,QAAI,gBAAgB,KAAK,gBAAgB,sBAAsB,iBAAiB,GAAG;AACjF,YAAM,IAAI,2CAA2C,4BAA4B;AAAA,IACnF;AACA,UAAM,OAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE;AAAA,MACrD,MAAM,OAAO,YAAY,eAAe,MAAM,MAAM;AAAA,IACtD;AACA,UAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,QACE,KAAK,UAAU,KAAK,MAAM,QAC1B,OAAO,UAAU,YACjB,UAAU,QACV,MAAM,QAAQ,KAAK,KACnB,OAAO,KAAK,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,MAAM,4BACxC,MAAkC,aAAa,cAC/C,MAAkC,iBAAiB,MAAM,sBAC1D;AACA,YAAM,IAAI,2CAA2C,4BAA4B;AAAA,IACnF;AACA,UAAM,OAAO,UAAU,MAAM,MAAM;AACnC,UAAM;AACN,UAAM;AACN,UAAM,SAAS,MAAM;AACrB,QAAI,OAAO,SAAS,KAAK,OAAO,WAAW,MAAM;AAC/C,YAAM,IAAI,2CAA2C,4BAA4B;AAAA,IACnF;AAAA,EACF,SAAS,OAAO;AACd,cAAU;AACV,UAAM,QAAQ,WAAW,CAAC,WAAW,YAAY,IAAI,CAAC;AACtD,QAAI,iBAAiB,2CAA4C,OAAM;AACvE,UAAM,IAAI,2CAA2C,4BAA4B;AAAA,EACnF,UAAE;AACA,iBAAa,OAAO;AACpB,UAAM,OAAO,oBAAoB,SAAS,KAAK;AAC/C,iBAAa,QAAQ;AACrB,QAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,KAAM,WAAU;AAAA,EACtE;AACF;AAEA,eAAe,eACb,QACA,QACqD;AACrD,QAAM,SAAS,MAAM,OAAO,YAAY,IAAI,MAAM;AAClD,QAAM,OAAO,IAAI,SAAS,OAAO,QAAQ,OAAO,YAAY,OAAO,UAAU;AAC7E,QAAM,gBAAgB,KAAK,UAAU,GAAG,IAAI;AAC5C,QAAM,eAAe,QAAQ,MAAM,GAAG,sBAAsB;AAC5D,MAAI,gBAAgB,KAAK,gBAAgB,sBAAsB,iBAAiB,GAAG;AACjF,WAAO,IAAI,2CAA2C,wBAAwB;AAAA,EAChF;AACA,QAAM,OAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE;AAAA,IACrD,MAAM,OAAO,YAAY,eAAe,MAAM;AAAA,EAChD;AACA,QAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,QAAM,OACJ,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,IAC/D,OAAO,KAAK,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,IACnC;AACN,MACE,KAAK,UAAU,KAAK,MAAM,QAC1B,OAAO,UAAU,YACjB,UAAU,QACV,MAAM,QAAQ,KAAK,KAClB,SAAS,oBAAoB,SAAS,6BACtC,MAAkC,aAAa,YAChD;AACA,WAAO,IAAI,2CAA2C,wBAAwB;AAAA,EAChF;AACA,QAAM,OAAQ,MAAkC;AAChD,QAAM,UAAW,MAAkC;AACnD,MACE,SAAS,2BACT,SAAS,8BACT,SAAS,yBACT,SAAS,8BACT;AACA,UAAM,aAAa,wBAAwB,MAAM,OAAO;AACxD,QAAI,YAAY,UAAa,CAAC,YAAY;AACxC,aAAO,IAAI,2CAA2C,wBAAwB;AAAA,IAChF;AACA,WAAO,IAAI,2CAA2C,MAAM,UAAU;AAAA,EACxE;AACA,SAAO,IAAI,2CAA2C,wBAAwB;AAChF;AAEA,SAAS,wBACP,MACA,SAC2D;AAC3D,MAAI,SAAS,2BAA4B,QAAO;AAChD,MAAI,YAAY,mBAAmB,YAAY,mBAAmB,YAAY,kBAAkB;AAC9F,WAAO,EAAE,OAAO,UAAU,QAAQ;AAAA,EACpC;AACA,SAAO;AACT;AAEA,eAAe,cACb,SAC2B;AAC3B,QAAM,QAAQ,YAAY,SAAS,CAAC,iBAAiB,CAAC;AACtD,QAAM,YAAY,MAAM,eAAe,KAAK;AAC5C,QAAM,UAAU,WAAW,WAAW,QAAQ,kBAAkB,GAAK;AACrE,UAAQ,QAAQ;AAChB,QAAM,SAAS,eAAe,MAAM,QAAQ,oBAAoB,SAAS;AACzE,QAAM,SAAS,YAAY,OAAO,SAAS;AAC3C,MAAI;AACF,UAAM,CAAC,OAAO,EAAE,MAAM,IAAI,MAAM,QAAQ,IAAI,CAAC,QAAQ,QAAQ,YAAY,KAAK,CAAC,CAAC;AAChF,QAAI,OAAO,SAAS,KAAK,OAAO,WAAW,MAAM;AAC/C,YAAM,IAAI,MAAM,2CAA2C;AAAA,IAC7D;AACA,UAAM,OAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,KAAK;AACnE,UAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,QAAI,KAAK,UAAU,MAAM,MAAM,MAAM;AACnC,YAAM,IAAI,MAAM,oDAAoD;AAAA,IACtE;AACA,WAAO;AAAA,EACT,UAAE;AACA,iBAAa,OAAO;AACpB,QAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,KAAM,WAAU;AAAA,EACtE;AACF;AAEA,SAAS,YACP,SACA,MACgC;AAChC,SAAO,QAAQ,SAAS,MAAM;AAAA,IAC5B,YAAY,QAAQ;AAAA,IACpB;AAAA,IACA,aAAa,OAAO,OAAO;AAAA,MACzB,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,GAAI,QAAQ,oBAAoB,CAAC;AAAA,IACnC,CAAC;AAAA,EACH,CAAC;AACH;AAEA,eAAe,UACb,OACA,UACA,qBACA,QACA,QACA,MACA,cACe;AACf,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAe,UACb,OACA,OACA,UACA,qBACA,QACA,QACA,MACA,cACA,cACe;AACf,QAAM,SAAS,IAAI,WAAW,EAAE;AAChC,QAAM,OAAO,IAAI,SAAS,OAAO,MAAM;AACvC,OAAK,UAAU,GAAG,SAAS,YAAY,IAAI;AAC3C,OAAK,aAAa,GAAG,OAAO,mBAAmB,GAAG,IAAI;AACtD,QAAM,MAAM,OAAO,OAAO,QAAQ,MAAM,YAAY;AACpD,QAAM,MAAM,OAAO,QAAQ,QAAQ,MAAM,YAAY;AACrD,QAAM,MAAM,OAAO,UAAU,QAAQ,MAAM,YAAY;AACvD,MAAI,cAAc;AAClB,mBAAiB,SAAS,QAAQ;AAChC,IAAAA,gBAAe,MAAM;AACrB,QACE,EAAE,iBAAiB,eACnB,MAAM,eAAe,KACrB,MAAM,aAAa,IAAI,OAAO,MAC9B;AACA,YAAM,IAAI,2CAA2C,YAAY;AAAA,IACnE;AACA,mBAAe,MAAM;AACrB,QAAI,cAAc,qBAAqB;AACrC,YAAM,IAAI,2CAA2C,YAAY;AAAA,IACnE;AACA,UAAM,MAAM,OAAO,OAAO,QAAQ,MAAM,YAAY;AAAA,EACtD;AACA,MAAI,gBAAgB,qBAAqB;AACvC,UAAM,IAAI,2CAA2C,YAAY;AAAA,EACnE;AACA,QAAM,MAAM,IAAI;AAClB;AAEA,eAAe,MACb,OACA,OACA,QACA,MACA,cACe;AACf,EAAAA,gBAAe,MAAM;AACrB,MAAI,CAAC,MAAM,MAAM,MAAM,KAAK,GAAG;AAC7B,UAAM,QAAQ,KAAK;AAAA,MACjB,KAAK,MAAM,OAAO,OAAO;AAAA,MACzB;AAAA,MACA,KAAK,KAAK,MAAM;AACd,cAAM,IAAI,MAAM,wCAAwC;AAAA,MAC1D,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AACF;AAEA,IAAM,uBAAN,MAA2B;AAAA,EAKzB,YACE,OACiB,WACA,cACjB;AAFiB;AACA;AAEjB,SAAK,YAAY,MAAM,OAAO,OAAO,aAAa,EAAE;AAAA,EACtD;AAAA,EAVS;AAAA,EACT,UAAU,IAAI,WAAW,CAAC;AAAA,EAC1B,QAAQ;AAAA,EAUR,MAAM,YAAY,QAAgB,QAA0C;AAC1E,QAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,EAAG,OAAM,IAAI,MAAM,uBAAuB;AACxF,UAAM,SAAS,IAAI,WAAW,MAAM;AACpC,QAAI,SAAS;AACb,WAAO,SAAS,QAAQ;AACtB,MAAAA,gBAAe,MAAM;AACrB,UAAI,KAAK,QAAQ,eAAe,EAAG,OAAM,KAAK,MAAM,MAAM;AAC1D,UAAI,KAAK,QAAQ,eAAe,EAAG,OAAM,IAAI,MAAM,sCAAsC;AACzF,YAAM,QAAQ,KAAK,IAAI,SAAS,QAAQ,KAAK,QAAQ,UAAU;AAC/D,aAAO,IAAI,KAAK,QAAQ,SAAS,GAAG,KAAK,GAAG,MAAM;AAClD,WAAK,UAAU,KAAK,QAAQ,SAAS,KAAK;AAC1C,gBAAU;AAAA,IACZ;AACA,WAAO;AAAA,EACT;AAAA,EAEA,OAAO,cAAc,QAAgB,QAAwD;AAC3F,QAAI,YAAY;AAChB,WAAO,YAAY,GAAG;AACpB,MAAAA,gBAAe,MAAM;AACrB,YAAM,QAAQ,KAAK,IAAI,WAAW,kBAAkB;AACpD,YAAM,QAAQ,MAAM,KAAK,YAAY,OAAO,MAAM;AAClD,mBAAa,MAAM;AACnB,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,UAAU,QAAoC;AAClD,IAAAA,gBAAe,MAAM;AACrB,QAAI,KAAK,QAAQ,aAAa,EAAG,OAAM,IAAI,MAAM,qCAAqC;AACtF,QAAI,CAAC,KAAK,MAAO,OAAM,KAAK,MAAM,MAAM;AACxC,QAAI,KAAK,QAAQ,aAAa,KAAK,CAAC,KAAK,OAAO;AAC9C,YAAM,IAAI,MAAM,qCAAqC;AAAA,IACvD;AAAA,EACF;AAAA,EAEA,MAAM,MAAM,QAAoC;AAC9C,QAAI,KAAK,MAAO;AAChB,IAAAA,gBAAe,MAAM;AACrB,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,QAAQ,KAAK,CAAC,KAAK,UAAU,KAAK,GAAG,KAAK,YAAY,CAAC;AAAA,IACtE,SAAS,OAAO;AACd,WAAK,UAAU;AACf,YAAM;AAAA,IACR;AACA,QAAI,KAAK,MAAM;AACb,WAAK,QAAQ;AACb;AAAA,IACF;AACA,QAAI,OAAO,KAAK,UAAU,SAAU,OAAM,IAAI,MAAM,yCAAyC;AAC7F,SAAK,UAAU,IAAI;AAAA,MACjB,KAAK,MAAM;AAAA,MACX,KAAK,MAAM;AAAA,MACX,KAAK,MAAM;AAAA,IACb,EAAE,MAAM;AAAA,EACV;AACF;AAEA,SAAS,eACP,KACA,mBACY;AACZ,QAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,iBAAiB;AAClF,QAAM,WAAW;AAAA,IACf,UAAU;AAAA,IACV,YAAY,IAAI;AAAA,IAChB,OAAO,IAAI;AAAA,IACX,WAAW,IAAI;AAAA,IACf,UAAU,IAAI;AAAA,IACd,iBAAiB,IAAI;AAAA,IACrB,oBAAoB,IAAI;AAAA,IACxB,WAAW,IAAI;AAAA,IACf,gBAAgB,IAAI;AAAA,IACpB,mBAAmB,IAAI;AAAA,IACvB,oBAAoB,IAAI;AAAA,IACxB,0BAA0B,IAAI;AAAA,IAC9B,yBAAyB,IAAI;AAAA,IAC7B,QAAQ,IAAI;AAAA,IACZ,SAAS,IAAI;AAAA,IACb,mBAAmB,KAAK,MAAM,OAAO;AAAA,IACrC,aAAa,IAAI;AAAA,IACjB,cAAc,IAAI;AAAA,IAClB,eAAe,IAAI;AAAA,IACnB,kBAAkB,IAAI;AAAA,IACtB,YAAY,IAAI;AAAA,EAClB;AACA,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,QAAQ,CAAC;AAC/D,MAAI,MAAM,aAAa,oBAAoB;AACzC,UAAM,IAAI,2CAA2C,sBAAsB;AAAA,EAC7E;AACA,SAAO;AACT;AAEA,SAAS,qBACP,MACA,KACA,aAC6D;AAC7D,QAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,MAAI,KAAK,UAAU,KAAK,MAAM,QAAQ,OAAO,UAAU,YAAY,UAAU,MAAM;AACjF,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACA,QAAM,SAAS;AACf,QAAM,eAAe;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK;AACP,MAAI,OAAO,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,IAAI,MAAM,aAAa,KAAK,IAAI,GAAG;AACrE,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,MAAI,OAAO,aAAa,cAAc,OAAO,aAAa,aAAa;AACrE,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,QAAM,mBAAmB,kBAAkB,IAAI,MAAM;AACrD,MACE,CAAC,OAAO,cAAc,OAAO,YAAY,KACzC,OAAO,iBAAiB,IAAI,sBAC5B,CAAC,OAAO,OAAO,SAAS,KACxB,OAAO,cAAc,IAAI,aACzB,OAAO,WAAW,IAAI,UACtB,OAAO,aAAa,oBACpB,CAAC,iBAAiB,OAAO,OAAO,KAChC,OAAO,YAAY,IAAI,WACvB,CAAC,iBAAiB,OAAO,YAAY,KACrC,OAAO,iBAAiB,IAAI,gBAC5B,CAAC,uBAAuB,OAAO,aAAa,KAC5C,OAAO,kBAAkB,IAAI,iBAC7B,CAAC,OAAO,OAAO,gBAAgB,KAC/B,OAAO,qBAAqB,IAAI,oBAChC,CAAC,OAAO,OAAO,UAAU,KACzB,OAAO,eAAe,IAAI,cAC1B,CAAC,OAAO,OAAO,WAAW,KAC1B,CAAC,OAAO,OAAO,YAAY,GAC3B;AACA,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AACA,SAAO,OAAO,OAAO;AAAA,IACnB,cAAc,OAAO;AAAA,IACrB,WAAW,OAAO;AAAA,IAClB,QAAQ,IAAI;AAAA,IACZ,UAAU;AAAA,IACV,SAAS,OAAO;AAAA,IAChB,cAAc,OAAO;AAAA,IACrB,eAAe,OAAO;AAAA,IACtB,kBAAkB,OAAO;AAAA,IACzB,YAAY,OAAO;AAAA,IACnB,UAAU;AAAA,IACV,aAAa,OAAO;AAAA,IACpB,cAAc,OAAO;AAAA,EACvB,CAAC;AACH;AAEA,SAAS,gBAAgB,SAAwD;AAC/E,MAAI,CAAC,WAAW,QAAQ,UAAU,KAAK,QAAQ,WAAW,SAAS,MAAO;AACxE,UAAM,IAAI,UAAU,yDAAyD;AAAA,EAC/E;AACA,aAAW,CAAC,OAAO,KAAK,KAAK;AAAA,IAC3B,CAAC,gBAAgB,QAAQ,aAAa;AAAA,IACtC,CAAC,gBAAgB,QAAQ,cAAc;AAAA,IACvC,CAAC,gBAAgB,QAAQ,cAAc;AAAA,EACzC,GAAY;AACV,QAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,EAAG,OAAM,IAAI,UAAU,GAAG,KAAK,aAAa;AAAA,EAC3F;AACA,QAAM,WAAW,QAAQ,SAAS;AAClC,QAAM,YACJ,SAAS,oBAAoB,QAC7B,SAAS,YAAY,YACrB,OAAO,cAAc,SAAS,gBAAgB,KAC9C,SAAS,mBAAmB,KAC5B,OAAO,cAAc,SAAS,cAAc,KAC5C,SAAS,iBAAiB,KAC1B,OAAO,cAAc,SAAS,mBAAmB,KACjD,SAAS,sBAAsB,KAC/B,OAAO,cAAc,SAAS,YAAY,KAC1C,SAAS,eAAe,KACxB,OAAO,cAAc,SAAS,kBAAkB,KAChD,SAAS,qBAAqB;AAChC,QAAM,yBACJ,QAAQ,gCAAgC,QACxC,SAAS,oBAAoB,SAC7B,SAAS,YAAY,UACrB,SAAS,qBAAqB,KAC9B,SAAS,mBAAmB,KAC5B,SAAS,wBAAwB,KACjC,SAAS,iBAAiB,KAC1B,SAAS,uBAAuB;AAClC,MACE,SAAS,cAAc,gBACvB,SAAS,qBAAqB,SAC9B,CAAC,iBAAiB,SAAS,QAAQ,KAClC,CAAC,aAAa,CAAC,wBAChB;AACA,UAAM,IAAI,UAAU,iDAAiD;AAAA,EACvE;AACA,MAAI,QAAQ,qBAAqB,QAAW;AAC1C,UAAM,OAAO,OAAO,KAAK,QAAQ,gBAAgB,EAAE,KAAK;AACxD,UAAM,iBAAiB,CAAC,sCAAsC,8BAA8B;AAC5F,UAAM,kBAAkB;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,UAAM,aAAa,KAAK,KAAK,IAAI,MAAM,eAAe,KAAK,IAAI;AAC/D,UAAM,cAAc,KAAK,KAAK,IAAI,MAAM,gBAAgB,KAAK,IAAI;AACjE,QAAI,CAAC,cAAc,CAAC,aAAa;AAC/B,YAAM,IAAI,UAAU,oDAAoD;AAAA,IAC1E;AACA,QAAI,gBAAgB,wBAAwB;AAC1C,YAAM,IAAI,UAAU,iEAAiE;AAAA,IACvF;AACA,QACE,gBACC,QAAQ,gCAAgC,QACvC,QAAQ,iBAAiB,aAAa,gBACxC;AACA,YAAM,IAAI,UAAU,gEAAgE;AAAA,IACtF;AACA,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,QAAQ,gBAAgB,GAAG;AACpE,UAAI,SAAS,WAAY;AACzB,UAAI,CAAC,WAAW,KAAK,KAAK,MAAM,SAAS,QAAS,yBAAyB,KAAK,KAAK,GAAG;AACtF,cAAM,IAAI,UAAU,uDAAuD;AAAA,MAC7E;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,iBAAiB,UAAkC;AAC1D,QAAM,SAAS;AACf,QAAM,eAAe;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK;AACP,MAAI,OAAO,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,IAAI,MAAM,aAAa,KAAK,IAAI,GAAG;AACrE,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,MACE,SAAS,aAAa,cACtB,SAAS,gBAAgB,YACzB,CAAC,OAAO,cAAc,SAAS,cAAc,KAC7C,SAAS,kBAAkB,GAC3B;AACA,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,MACE,CAAC,uBAAuB,SAAS,aAAa,KAC9C,CAAC,iBAAiB,SAAS,aAAa,KACxC,CAAC,OAAO,SAAS,gBAAgB,KACjC,CAAC,OAAO,SAAS,UAAU,KAC3B,CAAC,gBAAgB,SAAS,aAAa,KACvC,CAAC;AAAA,IACC,SAAS;AAAA,IACTC;AAAA,EACF,KACA,CAAC;AAAA,IACC,SAAS;AAAA,IACTC;AAAA,EACF,KACA,CAAC;AAAA,IACC,SAAS;AAAA,IACTC;AAAA,EACF,GACA;AACA,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACF;AAEA,SAAS,kBACP,OACA,SAC4C;AAC5C,QAAM,WAAW,QAAQ,SAAS;AAClC,SAAO,OAAO,OAAO;AAAA,IACnB,MAAM;AAAA,IACN,WAAW,SAAS;AAAA,IACpB,SAAS,SAAS;AAAA,IAClB,kBAAkB,SAAS;AAAA,IAC3B,wBAAwB;AAAA,IACxB,iBAAiB,SAAS;AAAA,IAC1B,kBAAkB,SAAS;AAAA,IAC3B,gBAAgB,SAAS;AAAA,IACzB,qBAAqB,SAAS;AAAA,IAC9B,cAAc,SAAS;AAAA,IACvB,oBAAoB,SAAS;AAAA,IAC7B,gBAAgB,KAAK,IAAI,MAAM,gBAAgB,QAAQ,cAAc;AAAA,IACrE,eAAe,MAAM;AAAA,IACrB,eAAe,MAAM;AAAA,IACrB,kBAAkB,MAAM;AAAA,IACxB,YAAY,MAAM;AAAA,IAClB,eAAe,MAAM;AAAA,IACrB,8BAA8B,MAAM;AAAA,IACpC,oCAAoC,MAAM;AAAA,IAC1C,mCAAmC,MAAM;AAAA,EAC3C,CAAC;AACH;AAEA,SAAS,gBAAgB,OAA2D;AAClF,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,UAAU,OAAO,QAAQ,KAAgC;AAC/D,MAAI,QAAQ,WAAW,KAAK,QAAQ,SAAS,GAAI,QAAO;AACxD,MAAI,WAAW;AACf,aAAW,CAAC,SAAS,OAAO,KAAK,SAAS;AACxC,QACE,CAAC,6BAA6B,KAAK,OAAO,KAC1C,WAAW,YACX,CAAC,iBAAiB,OAAO,GACzB;AACA,aAAO;AAAA,IACT;AACA,eAAW;AAAA,EACb;AACA,SAAO;AACT;AAEA,SAAS,gCACP,OACA,UAC6B;AAC7B,SAAO,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM;AACpE;AAEA,SAAS,iBAAiB,OAAiC;AACzD,SACE,OAAO,UAAU,YACjB,MAAM,UAAU,KAChB,MAAM,UAAU,OAChB,kBAAkB,KAAK,KAAK;AAEhC;AAEA,SAAS,uBAAuB,OAAiC;AAC/D,SACE,OAAO,UAAU,YACjB,MAAM,UAAU,KAChB,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE,cAAcC,+CAC9C,kBAAkB,KAAK,KAAK;AAEhC;AAEA,SAAS,OAAO,OAAiC;AAC/C,SAAO,OAAO,UAAU,YAAY,yBAAyB,KAAK,KAAK;AACzE;AAEA,eAAe,eACb,QACA,SACA,WACqB;AACrB,QAAM,SAAuB,CAAC;AAC9B,MAAI,QAAQ;AACZ,mBAAiB,SAAS,QAAQ;AAChC,UAAM,QAAQ,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAI;AAC/D,aAAS,MAAM;AACf,QAAI,QAAQ,SAAS;AACnB,gBAAU;AACV,YAAM,IAAI,MAAM,mDAAmD;AAAA,IACrE;AACA,WAAO,KAAK,IAAI,WAAW,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,EAAE,MAAM,CAAC;AAAA,EACtF;AACA,QAAM,SAAS,IAAI,WAAW,KAAK;AACnC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,WAAO,IAAI,OAAO,MAAM;AACxB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAEA,eAAe,YACb,OACA,WACe;AACf,QAAM,eAAe,MAAM,QAAQ,kBAAkB,SAAS;AAChE;AAEA,SAAS,YACP,OACiE;AACjE,MAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,MAAM;AACxD,WAAO,QAAQ,QAAQ,EAAE,MAAM,MAAM,UAAU,QAAQ,MAAM,WAAW,CAAC;AAAA,EAC3E;AACA,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,UAAU,CAAC,UAAiB;AAChC,YAAM,eAAe,QAAQ,MAAM;AACnC,aAAO,KAAK;AAAA,IACd;AACA,UAAM,SAAS,CAAC,MAAqB,WAAkC;AACrE,YAAM,eAAe,SAAS,OAAO;AACrC,cAAQ,EAAE,MAAM,OAAO,CAAC;AAAA,IAC1B;AACA,UAAM,KAAK,SAAS,OAAO;AAC3B,UAAM,KAAK,QAAQ,MAAM;AAAA,EAC3B,CAAC;AACH;AAEA,SAAS,eAAe,OAA6C;AACnE,MAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,KAAM;AAC1D,QAAM,MAAM,QAAQ;AACpB,QAAM,KAAK,SAAS;AACtB;AAEA,SAAS,gBAAgB,QAGvB;AACA,MAAI,WAAgC;AACpC,QAAM,UAAU,IAAI,QAAe,CAAC,UAAU,WAAW;AACvD,QAAI,OAAO,SAAS;AAClB,aAAO,OAAO,UAAUC,YAAW,CAAC;AACpC;AAAA,IACF;AACA,eAAW,MAAM,OAAO,OAAO,UAAUA,YAAW,CAAC;AACrD,WAAO,iBAAiB,SAAS,UAAU,EAAE,MAAM,KAAK,CAAC;AAAA,EAC3D,CAAC;AAGD,OAAK,QAAQ,MAAM,MAAM,MAAS;AAClC,SAAO;AAAA,IACL;AAAA,IACA,UAAU;AACR,UAAI,SAAU,QAAO,oBAAoB,SAAS,QAAQ;AAC1D,iBAAW;AAAA,IACb;AAAA,EACF;AACF;AAEA,SAASL,gBAAe,QAA2B;AACjD,MAAI,OAAO,QAAS,OAAM,OAAO,UAAUK,YAAW;AACxD;AAEA,SAASA,cAA2B;AAClC,SAAO,IAAI,aAAa,qBAAqB,YAAY;AAC3D;AAEA,SAAS,qBAAqB,OAAgB,QAA8B;AAC1E,MAAI,OAAO,QAAS,QAAO,OAAO,UAAUA,YAAW;AACvD,SAAO;AACT;AAEA,SAAS,QAAQ,MAAgB,QAAgB,OAAuB;AACtE,QAAM,QAAQ,KAAK,aAAa,QAAQ,IAAI;AAC5C,MAAI,QAAQ,OAAO,OAAO,gBAAgB,EAAG,OAAM,IAAI,MAAM,GAAG,KAAK,uBAAuB;AAC5F,SAAO,OAAO,KAAK;AACrB;AAEA,SAAS,WAAW,MAAkB,OAA4B;AAChE,SAAO,KAAK,eAAe,MAAM,cAAc,KAAK,MAAM,CAAC,MAAM,UAAU,SAAS,MAAM,KAAK,CAAC;AAClG;;;ACt8BA,SAAS,aAAkD;AAC3D,SAAS,QAAQ,UAAU,UAAU,YAAY;AACjD,SAAS,UAAU,SAAS,cAAAC,aAAY,gBAAgB;AAIxD,IAAM,kBAAkB,KAAK;AAC7B,IAAM,mBAAmB;AA2BzB,eAAsB,iDACpB,SACkD;AAClD,MAAI,CAAC,QAAQ,qBAAqB,QAAQ,oBAAoB,cAAc;AAC1E,UAAM,IAAI,MAAM,uEAAuE;AAAA,EACzF;AACA,QAAM,mCAAmC,QAAQ;AACjD,QAAM,yBAAyB,MAAM,sBAAsB,QAAQ,sBAAsB;AACzF,SAAO,OAAO,OAAO;AAAA,IACnB,UAAU,OAAO,OAAO;AAAA,MACtB,UAAU,GAAG,QAAQ,QAAQ,IAAI,QAAQ,IAAI;AAAA,MAC7C,WAAW;AAAA,MACX,SAAS;AAAA,MACT,kBAAkB;AAAA,MAClB,iBAAiB;AAAA,MACjB,kBAAkB;AAAA,MAClB,gBAAgB;AAAA,MAChB,qBAAqB;AAAA,MACrB,cAAc;AAAA,MACd,oBAAoB;AAAA,IACtB,CAAC;AAAA,IACD,MAAM,OAAO;AACX,UACE,MAAM,eAAe,oCACrB,MAAM,eAAe,wBACrB;AACA,cAAM,IAAI,MAAM,+DAA+D;AAAA,MACjF;AACA,aAAO,MAAM,wBAAwB,CAAC,GAAG,MAAM,IAAI,GAAG;AAAA,QACpD,KAAK;AAAA,QACL,KAAK,EAAE,GAAG,MAAM,YAAY;AAAA,QAC5B,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,QAC9B,aAAa;AAAA,MACf,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAQA,eAAsB,2CACpB,SACkD;AAClD,MAAI,QAAQ,aAAa,SAAS;AAChC,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACA,MACE,CAAC,OAAO,cAAc,QAAQ,gBAAgB,KAC9C,QAAQ,oBAAoB,KAC5B,CAAC,OAAO,cAAc,QAAQ,cAAc,KAC5C,QAAQ,kBAAkB,KAC1B,QAAQ,iBAAiB,QAAU,KACnC,CAAC,OAAO,cAAc,QAAQ,mBAAmB,KACjD,QAAQ,uBAAuB,KAC/B,CAAC,OAAO,cAAc,QAAQ,YAAY,KAC1C,QAAQ,gBAAgB,KACxB,CAAC,OAAO,cAAc,QAAQ,kBAAkB,KAChD,QAAQ,sBAAsB,GAC9B;AACA,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AACA,QAAM,aAAa,MAAM,kBAAkB,QAAQ,sBAAsB,OAAO;AAChF,QAAM,UAAU,MAAM,kBAAkB,QAAQ,mBAAmB,SAAS;AAC5E,QAAM,mCAAmC,QAAQ;AACjD,QAAM,yBAAyB,MAAM;AAAA,IACnC,QAAQ;AAAA,IACR,SAAS,QAAQ,sBAAsB;AAAA,EACzC;AACA,QAAM,cAAc,MAAM,mBAAmB,QAAQ,WAAW;AAChE,QAAM,aAAa,QAAQ,iBAAiB;AAE5C,QAAM,gBAAgB,CAAC,UAIe;AACpC,QAAI,CAACA,YAAW,MAAM,UAAU,EAAG,OAAM,IAAI,MAAM,iCAAiC;AACpF,UAAM,mBAAmB,sCAAsC;AAAA,MAC7D,YAAY,MAAM;AAAA,MAClB,MAAM,MAAM;AAAA,MACZ;AAAA,MACA,mBAAmB,QAAQ;AAAA,IAC7B,CAAC;AACD,WAAO;AAAA,MACL;AAAA,MACA;AAAA,QACE,GAAG,sCAAsC;AAAA,UACvC,kBAAkB,QAAQ;AAAA,UAC1B;AAAA,UACA,qBAAqB,QAAQ;AAAA,UAC7B,cAAc,QAAQ;AAAA,UACtB,oBAAoB,QAAQ;AAAA,QAC9B,CAAC;AAAA,QACD;AAAA,QACA;AAAA,QACA,GAAG;AAAA,MACL;AAAA,MACA;AAAA,QACE,KAAK;AAAA,QACL,KAAK,EAAE,GAAG,MAAM,YAAY;AAAA,QAC5B,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,QAC9B,aAAa;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAEA,QAAM,oBAAoB,CAAC,UAIW;AACpC,QACE,MAAM,eAAe,oCACrB,MAAM,eAAe,wBACrB;AACA,YAAM,IAAI,MAAM,kEAAkE;AAAA,IACpF;AACA,qCAAiC,MAAM,aAAa,WAAW;AAC/D,WAAO,cAAc,EAAE,GAAG,OAAO,YAAY,uBAAuB,CAAC;AAAA,EACvE;AAEA,QAAM,kBAAkB,MAAM;AAAA,IAC5B,QAAQ,mBAAmB,QAAQ;AAAA,IACnC,SAAS,QAAQ,QAAQ;AAAA,EAC3B;AACA,QAAM,yBAAyB,MAAM,SAAS,mBAAmB;AACjE,QAAM,QAAQ,cAAc;AAAA,IAC1B,YAAY;AAAA,IACZ,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,GAAG;AAAA,IACZ;AAAA,IACA,aAAa,OAAO,OAAO,EAAE,MAAM,KAAK,QAAQ,KAAK,IAAI,MAAM,CAAC;AAAA,EAClE,CAAC;AACD,QAAM,MAAM,IAAI;AAChB,QAAM,UAAU,WAAW,MAAMC,gBAAe,KAAK,GAAG,gBAAgB;AACxE,UAAQ,QAAQ;AAChB,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,KAAC,QAAQ,QAAQ,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC3C,cAAc,MAAM,MAAM;AAAA,MAC1B,cAAc,MAAM,MAAM;AAAA,MAC1BC,aAAY,KAAK;AAAA,IACnB,CAAC;AAAA,EACH,UAAE;AACA,iBAAa,OAAO;AACpB,IAAAD,gBAAe,KAAK;AAAA,EACtB;AACA,MAAI,OAAO,SAAS,KAAK,OAAO,WAAW,QAAQ,OAAO,eAAe,GAAG;AAC1E,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,QAAM,SAAS,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,MAAM,CAAC;AAClF,MAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG;AAC1E,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,QAAM,WAAW;AACjB,QAAM,sBAAsB,wCAAwC;AAAA,IAClE,YAAY;AAAA,IACZ;AAAA,EACF,CAAC;AACD,MACE,OAAO,SAAS,QAAQ,YACxB,SAAS,QAAQ,0BACjB,OAAO,SAAS,WAAW,YAC3B,CAAC,iBAAiB,SAAS,QAAQ,gBAAgB,OAAO,UAAU,CAAC,KACrE,CAAC,iBAAiB,SAAS,QAAQ,qBAAqB,OAAO,QAAQ,gBAAgB,CAAC,KACxF,CAAC,iBAAiB,SAAS,QAAQ,kBAAkB,OAAO,QAAQ,mBAAmB,CAAC,KACxF,CAAC,iBAAiB,SAAS,QAAQ,iBAAiB,OAAO,QAAQ,YAAY,CAAC,KAChF,CAAC,iBAAiB,SAAS,QAAQ,iBAAiB,OAAO,QAAQ,kBAAkB,CAAC,KACtF,CAAC,eAAe,SAAS,aAAa,mBAAmB,KACzD,SAAS,iBAAiB,SAC1B,SAAS,oBAAoB,MAC7B;AACA,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AAEA,SAAO,OAAO,OAAO;AAAA,IACnB,UAAU,OAAO,OAAO;AAAA,MACtB,UAAU,SAAS,QAAQ,IAAI;AAAA,MAC/B,WAAW;AAAA,MACX,SAAS;AAAA,MACT,kBAAkB;AAAA,MAClB,iBAAiB;AAAA,MACjB,kBAAkB,QAAQ;AAAA,MAC1B,gBAAgB,QAAQ;AAAA,MACxB,qBAAqB,QAAQ;AAAA,MAC7B,cAAc,QAAQ;AAAA,MACtB,oBAAoB,QAAQ;AAAA,IAC9B,CAAC;AAAA,IACD,OAAO;AAAA,EACT,CAAC;AACH;AAEO,SAAS,sCACd,OAMmB;AACnB,MACE,CAACD,YAAW,MAAM,UAAU,KAC5B,CAACA,YAAW,MAAM,WAAW,KAC7B,CAAC,OAAO,cAAc,MAAM,iBAAiB,KAC7C,MAAM,qBAAqB,GAC3B;AACA,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,QAAM,oBAAoB,yBAAyB,CAAC,MAAM,YAAY,MAAM,WAAW,CAAC;AACxF,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,kBAAkB,QAAQ,CAAC,SAAS,CAAC,SAAS,IAAI,CAAC;AAAA,IACtD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN,MAAM;AAAA,IACN;AAAA,IACA,MAAM;AAAA,IACN,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO,MAAM,iBAAiB;AAAA,IAC9B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN,GAAG,MAAM;AAAA,EACX,CAAC;AACH;AAEO,SAAS,sCACd,OAOmB;AACnB,SAAO,OAAO,OAAO;AAAA,IACnB,QAAQ,MAAM,gBAAgB;AAAA,IAC9B,SAAS,MAAM,UAAU;AAAA,IACzB,YAAY,MAAM,mBAAmB;AAAA,IACrC,WAAW,MAAM,YAAY;AAAA,IAC7B,WAAW,MAAM,kBAAkB;AAAA,EACrC,CAAC;AACH;AAEO,SAAS,wCACd,OAImB;AACnB,QAAM,UAAU,oBAAI,IAAI,CAAC,OAAO,OAAO,OAAO,SAAS,QAAQ,OAAO,KAAK,CAAC;AAC5E,aAAW,QAAQ,CAAC,MAAM,YAAY,MAAM,WAAW,GAAG;AACxD,UAAM,WAAW,KAAK,MAAM,GAAG,EAAE,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC;AAC/D,QAAI,SAAU,SAAQ,IAAI,QAAQ;AAAA,EACpC;AACA,SAAO,OAAO,OAAO,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC;AAC1C;AAEA,eAAe,kBAAkB,OAAe,kBAA2C;AACzF,MAAI,CAACA,YAAW,KAAK,KAAK,SAAS,KAAK,MAAM,kBAAkB;AAC9D,UAAM,IAAI,MAAM,yBAAyB,gBAAgB,kBAAkB;AAAA,EAC7E;AACA,QAAM,YAAY,MAAM,SAAS,KAAK;AACtC,QAAM,WAAW,MAAM,KAAK,SAAS;AACrC,QAAM,OAAO,WAAW,CAAC;AACzB,MAAI,CAAC,SAAS,OAAO,KAAK,SAAS,QAAQ,MAAM,SAAS,OAAO,QAAW,GAAG;AAC7E,UAAM,IAAI,MAAM,yBAAyB,gBAAgB,8BAA8B;AAAA,EACzF;AACA,SAAO;AACT;AAEA,eAAe,mBAAmB,OAAgC;AAChE,MAAI,CAACA,YAAW,KAAK,KAAK,iBAAiB,KAAK,GAAG;AACjD,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,QAAM,YAAY,MAAM,SAAS,KAAK;AACtC,QAAM,WAAW,MAAM,KAAK,SAAS;AACrC,MACE,cAAc,SACd,CAAC,SAAS,YAAY,KACtB,SAAS,QAAQ,MAChB,SAAS,OAAO,QAAW,GAC5B;AACA,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,OAAwB;AAChD,MAAI,MAAM,MAAM,GAAG,EAAE,OAAO,OAAO,EAAE,SAAS,EAAG,QAAO;AACxD,UAAO,oBAAI,IAAI;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,GAAE,IAAI,KAAK;AACd;AAEA,SAAS,iCACP,aACA,aACM;AACN,aAAW,QAAQ;AAAA,IACjB;AAAA,IACA;AAAA,EACF,GAAY;AACV,UAAM,OAAO,YAAY,IAAI;AAC7B,QAAI,CAAC,QAAQ,CAAC,aAAa,aAAa,IAAI,GAAG;AAC7C,YAAM,IAAI,MAAM,qEAAqE;AAAA,IACvF;AAAA,EACF;AACF;AAEA,SAAS,aAAa,MAAc,MAAuB;AACzD,MAAI,CAACA,YAAW,IAAI,EAAG,QAAO;AAC9B,QAAM,WAAW,SAAS,MAAM,IAAI;AACpC,SACE,SAAS,SAAS,KAClB,aAAa,QACb,CAAC,SAAS,WAAW,KAAK,QAAQ,aAAa,UAAU,OAAO,GAAG,EAAE,KACrE,CAACA,YAAW,QAAQ;AAExB;AAEA,SAAS,yBAAyB,OAA6C;AAC7E,QAAM,cAAc,oBAAI,IAAY;AACpC,aAAW,QAAQ,OAAO;AACxB,QAAI,SAAS,QAAQ,IAAI;AACzB,WAAO,WAAW,OAAO,WAAW,KAAK;AACvC,kBAAY,IAAI,MAAM;AACtB,eAAS,QAAQ,MAAM;AAAA,IACzB;AAAA,EACF;AACA,SAAO,CAAC,GAAG,WAAW,EAAE,KAAK,CAAC,MAAM,UAAU;AAC5C,UAAM,QAAQ,KAAK,MAAM,GAAG,EAAE,SAAS,MAAM,MAAM,GAAG,EAAE;AACxD,WAAO,UAAU,IAAI,KAAK,cAAc,KAAK,IAAI;AAAA,EACnD,CAAC;AACH;AAEA,SAAS,eAAe,OAAgB,UAAsC;AAC5E,SACE,MAAM,QAAQ,KAAK,KACnB,MAAM,WAAW,SAAS,UAC1B,MAAM,MAAM,CAAC,OAAO,UAAU,UAAU,SAAS,KAAK,CAAC;AAE3D;AAEA,eAAe,sBAAsB,OAAgC;AACnE,MAAI,CAACA,YAAW,KAAK,KAAK,CAAC,8CAA8C,KAAK,SAAS,KAAK,CAAC,GAAG;AAC9F,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AACA,QAAM,YAAY,MAAM,SAAS,KAAK;AACtC,QAAM,WAAW,MAAM,KAAK,SAAS;AACrC,QAAM,OAAO,WAAW,CAAC;AACzB,MAAI,CAAC,SAAS,OAAO,EAAG,OAAM,IAAI,MAAM,qDAAqD;AAC7F,SAAO;AACT;AAEA,SAAS,iBAAiB,QAAgB,MAAc,UAA2B;AACjF,QAAM,OAAO,OAAO,MAAM,IAAI,EAAE,KAAK,CAAC,cAAc,UAAU,WAAW,IAAI,CAAC;AAC9E,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,SAAS,KAAK,KAAK,EAAE,MAAM,SAAS;AAC1C,SAAO,OAAO,CAAC,MAAM,YAAY,OAAO,CAAC,MAAM;AACjD;AAEA,eAAe,cACb,QACqB;AACrB,QAAM,SAAuB,CAAC;AAC9B,MAAI,QAAQ;AACZ,mBAAiB,SAAS,QAAQ;AAChC,UAAM,QAAQ,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAI;AAC/D,aAAS,MAAM;AACf,QAAI,QAAQ,gBAAiB,OAAM,IAAI,MAAM,gDAAgD;AAC7F,WAAO,KAAK,IAAI,WAAW,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,EAAE,MAAM,CAAC;AAAA,EACtF;AACA,QAAM,SAAS,IAAI,WAAW,KAAK;AACnC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,WAAO,IAAI,OAAO,MAAM;AACxB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAEA,SAASE,aACP,OACiE;AACjE,MAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,MAAM;AACxD,WAAO,QAAQ,QAAQ,EAAE,MAAM,MAAM,UAAU,QAAQ,MAAM,WAAW,CAAC;AAAA,EAC3E;AACA,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,UAAU,CAAC,UAAiB;AAChC,YAAM,eAAe,QAAQ,MAAM;AACnC,aAAO,KAAK;AAAA,IACd;AACA,UAAM,SAAS,CAAC,MAAqB,WAAkC;AACrE,YAAM,eAAe,SAAS,OAAO;AACrC,cAAQ,EAAE,MAAM,OAAO,CAAC;AAAA,IAC1B;AACA,UAAM,KAAK,SAAS,OAAO;AAC3B,UAAM,KAAK,QAAQ,MAAM;AAAA,EAC3B,CAAC;AACH;AAEA,SAASD,gBAAe,OAA6C;AACnE,MAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,KAAM;AAC1D,QAAM,MAAM,QAAQ;AACpB,QAAM,KAAK,SAAS;AACtB;;;AJjZA,eAAsB,oDACpB,SAC8C;AAC9C,MAAI,QAAQ,yBAAyB,8CAA8C;AACjF,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AACA,MAAI,OAAO,QAAQ,gBAAgB,YAAY,QAAQ,YAAY,KAAK,EAAE,WAAW,GAAG;AACtF,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,cAAc,QAAQ,eAAe;AAC3C,QAAM,cAAc,QAAQ,iBAAiB,SAAS;AACtD,MAAI,iBAAiB,QAAQ,qCAAqC,OAAO;AACvE,UAAM,IAAI,MAAM,2EAA2E;AAAA,EAC7F;AACA,QAAM,WAAW,cACb,MAAM,iDAAiD;AAAA,IACrD,wBAAwB,QAAQ;AAAA,IAChC,mBAAmB,QAAQ,qCAAqC;AAAA,IAChE,iBAAiB,QAAQ;AAAA,EAC3B,CAAC,IACD,MAAM,2CAA2C;AAAA,IAC/C,wBAAwB,QAAQ;AAAA,IAChC,sBAAsB,eAAe,QAAQ,sBAAsB,YAAY;AAAA,IAC/E,mBAAmB,eAAe,QAAQ,mBAAmB,SAAS;AAAA,IACtE,aAAaE,SAAQ,QAAQ,iBAAiB,YAAY;AAAA,IAC1D,kBAAkB,QAAQ;AAAA,IAC1B,gBAAgB,QAAQ;AAAA,IACxB,qBAAqB,QAAQ;AAAA,IAC7B,cAAc,QAAQ;AAAA,IACtB,oBAAoB,QAAQ;AAAA,EAC9B,CAAC;AACL,QAAM,aAAa,aAAa,QAAQ,QAAQ;AAChD,QAAM,WAAW,SAAS,QAAQ,aAAa;AAAA,IAC7C,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,IACnC,GAAI,QAAQ,SAAS,cAAc,EAAE,aAAa,QAAQ,SAAS,YAAY,IAAI,CAAC;AAAA,IACpF,KAAK,KAAK,IAAI,GAAG,cAAc,CAAC;AAAA,EAClC,CAAC;AACD,MAAI,UAAU;AACd,MAAI;AACF,UAAM,wCAAwC,SAAS,EAAE;AACzD,UAAM,gBAAgB,QAAQ,iBAAiB,oBAAoB,QAAQ,QAAQ;AACnF,QAAI,CAAC,cAAe,OAAM,IAAI,MAAM,qDAAqD;AACzF,UAAM,oBAA6D;AAAA,MACjE,YAAY,QAAQ;AAAA,MACpB;AAAA,MACA,kBACE,QAAQ,iBAAiB,SAAS,eAC9B,OAAO,OAAO;AAAA,QACZ,oCAAoC,QAAQ,iBAAiB;AAAA,QAC7D,8BAA8B,QAAQ;AAAA,MACxC,CAAC,IACD,OAAO,OAAO;AAAA,QACZ,UAAU;AAAA,QACV,gDAAgD,QAAQ,iBAAiB;AAAA,QACzE,8BAA8B,QAAQ;AAAA,MACxC,CAAC;AAAA,MACP,GAAI,cAAc,EAAE,6BAA6B,KAAK,IAAI,CAAC;AAAA,MAC3D,eAAe,QAAQ;AAAA,MACvB;AAAA,MACA;AAAA,IACF;AACA,UAAM,SAAS,MAAM,2CAA2C,iBAAiB;AACjF,UAAM,aAAa,IAAI,kDAAkD,SAAS,IAAI;AAAA,MACpF,GAAI,QAAQ,SAAS,SAAS,KAAK,IAAI,EAAE,YAAY,QAAQ,SAAS,SAAS,KAAK,EAAE,IAAI,CAAC;AAAA,IAC7F,CAAC;AACD,UAAM,gBAAgB,oBAAoB,QAAQ,UAAU;AAAA,MAC1D,WAAW;AAAA,IACb,CAAC;AACD,QAAI,aAAa;AACf,oBAAc,KAAK,0DAA0D;AAAA,QAC3E,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,UAAM,eAAe,6CAA6C;AAAA,MAChE,SAAS;AAAA,MACT,cAAc,QAAQ;AAAA,MACtB,yBAAyB;AAAA,MACzB,GAAI,cAAc,EAAE,6BAA6B,KAAK,IAAI,CAAC;AAAA,MAC3D,cAAc;AAAA,QACZ,OAAO;AAAA,QACP,cAAc,0CAA0C,aAAa;AAAA,QACrE,cAAc,0CAA0C,aAAa;AAAA,QACrE,gBAAgB,4CAA4C,eAAe;AAAA,UACzE,QAAQ,OAAO;AAAA,QACjB,CAAC;AAAA,QACD;AAAA,QACA,WAAW;AAAA,QACX,OAAO;AAAA,QACP,QAAQ;AAAA,UACN,KAAK,SAAS,YAAY;AACxB,0BAAc,KAAK,SAAS;AAAA,cAC1B,YAAY;AAAA,cACZ,WAAW,6BAA6B,UAAU,KAAK;AAAA,cACvD,QAAQ;AAAA,cACR,SAAS,OAAO,WAAW,SAAS,WAAW,WAAW,OAAO;AAAA,YACnE,CAAC;AAAA,UACH;AAAA,QACF;AAAA,QACA,SAAS;AAAA,UACP,UAAU,SAAS,QAAQ,GAAG;AAC5B,0BAAc,iBAAiB;AAAA,cAC7B,MAAM;AAAA,cACN,MAAM;AAAA,cACN,QAAQ,EAAE,QAAQ;AAAA,cAClB,QAAQ;AAAA,YACV,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF;AAAA,MACA,SAAS;AAAA,QACP,OAAO,QAAQ;AAAA,QACf,GAAI,QAAQ,cAAc,SAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,QAC1E;AAAA,QACA,GAAI,QAAQ,oBAAoB,SAC5B,EAAE,iBAAiB,QAAQ,gBAAgB,IAC3C,CAAC;AAAA,QACL,GAAI,QAAQ,yBAAyB,SACjC,EAAE,sBAAsB,QAAQ,qBAAqB,IACrD,CAAC;AAAA,QACL,GAAI,QAAQ,mBAAmB,SAAY,EAAE,gBAAgB,QAAQ,eAAe,IAAI,CAAC;AAAA,QACzF,GAAI,QAAQ,gBAAgB,SAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,QAChF;AAAA,QACA;AAAA,MACF;AAAA,IACF,CAAC;AACD,QAAI,CAAC,aAAc,OAAM,IAAI,MAAM,gDAAgD;AACnF,cAAU;AACV,WAAO,0CAA0C;AAAA,MAC/C;AAAA,MACA,IAAI,SAAS;AAAA,MACb,eAAe,SAAS;AAAA,MACxB;AAAA,MACA,aAAa,QAAQ,SAAS;AAAA,MAC9B,aAAa,QAAQ,SAAS;AAAA,MAC9B,oBAAoB,QAAQ,SAAS;AAAA,MACrC,mBAAmB,OAAO,OAAO;AAAA,QAC/B,MAAM,QAAQ,iBAAiB;AAAA,QAC/B,iBAAiB,SAAS,SAAS;AAAA,MACrC,CAAC;AAAA,IACH,CAAC;AAAA,EACH,UAAE;AACA,QAAI,CAAC,QAAS,OAAM,SAAS,MAAM;AAAA,EACrC;AACF;AAEA,SAAS,6BACP,YASY;AACZ,QAAM,MAAM,GAAG,OAAO,WAAW,YAAY,CAAC,IAAI,OAAO,WAAW,cAAc,CAAC;AACnF,UAAQ,KAAK;AAAA,IACX,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,EACX;AACF;AAEO,SAAS,0CACd,OACqC;AACrC,MAAI,QAAkD;AACtD,MAAI,aAAmC;AACvC,MAAI,eAAqC;AACzC,MAAI,iBAAiB;AACrB,QAAM,QAAQ,IAAI,gBAAgB;AAClC,QAAM,qBAAqB,MAAM,sBAAsB;AAEvD,QAAM,QAAQ,YAA2B;AACvC,UAAM,YAAY,wCAAwC,MAAM,EAAE,GAAG,kBAAkB;AAAA,EACzF;AAEA,QAAM,MAAM,MAAqB;AAC/B,QAAI,WAAY,QAAO;AACvB,QAAI,UAAU,YAAY;AACxB,aAAO,QAAQ,OAAO,IAAI,MAAM,mDAAmD,CAAC;AAAA,IACtF;AACA,kBAAc,YAAY;AACxB,UAAI;AACF,cAAM,MAAM;AACZ,YAAI,MAAM,OAAO,SAAS;AACxB,kBAAQ;AACR;AAAA,QACF;AACA,gBAAQ;AACR,cAAM,MAAM,aAAa,IAAI,MAAM,MAAM;AACzC,cAAM,kBAAmB,UAAuD;AAChF,gBAAQ,kBAAkB,YAAY;AACtC,YAAI,CAAC,iBAAiB;AACpB,gBAAM,IAAI,MAAM,2DAA2D;AAAA,QAC7E;AAAA,MACF,SAAS,OAAO;AACd,cAAM,cAAc;AACpB,YAAI,gBAAgB,cAAc,gBAAgB,UAAW,SAAQ;AACrE,cAAM;AAAA,MACR;AAAA,IACF,GAAG;AACH,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,CAAC,UAAU,eAAwB;AAC/C,QAAI,UAAU,cAAc,UAAU,aAAa,UAAU,SAAU,QAAO;AAC9E,YAAQ;AACR,UAAM,MAAM;AACZ,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,MAAqB;AACjC,QAAI,aAAc,QAAO;AACzB,oBAAgB,YAAY;AAC1B,YAAM,OAAO;AACb,UAAI,WAAY,OAAM,WAAW,MAAM,MAAM,MAAS;AACtD,YAAM,MAAM,aAAa,MAAM;AAC/B,UAAI,CAAC,gBAAgB;AACnB,yBAAiB;AACjB,cAAM,MAAM,cAAc;AAAA,MAC5B;AACA,UAAI,UAAU,SAAU,SAAQ;AAAA,IAClC,GAAG;AACH,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,OAAO,YAAwC;AAC3D,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAI,QAAQ,WAAW,OAAO;AAC5B,aAAO,SAAS,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACvE;AACA,QAAI,IAAI,aAAa,YAAY;AAC/B,YAAM,KAAK,UAAU,YAAY,UAAU;AAC3C,aAAO,SAAS;AAAA,QACd;AAAA,UACE,SAAS,MAAM;AAAA,UACf,WAAW;AAAA,UACX,aAAa,MAAM;AAAA,UACnB,GAAI,MAAM,qBAAqB,EAAE,oBAAoB,MAAM,mBAAmB,IAAI,CAAC;AAAA,UACnF,SAAS,MAAM,qBAAqB;AAAA,YAClC,MAAM;AAAA,YACN,iBAAiB;AAAA,UACnB;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,QACA,EAAE,QAAQ,KAAK,MAAM,IAAI;AAAA,MAC3B;AAAA,IACF;AACA,QAAI,IAAI,aAAa,WAAW;AAC9B,UAAI,UAAU,SAAS;AACrB,eAAO,SAAS;AAAA,UACd,EAAE,IAAI,OAAO,OAAO,QAAQ,EAAE,cAAc,EAAE,IAAI,MAAM,EAAE,EAAE;AAAA,UAC5D,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI;AACF,cAAM,MAAM;AACZ,eAAO,SAAS,KAAK;AAAA,UACnB,IAAI;AAAA,UACJ;AAAA,UACA,SAAS,MAAM,qBAAqB;AAAA,YAClC,MAAM;AAAA,YACN,iBAAiB;AAAA,UACnB;AAAA,UACA,QAAQ,EAAE,cAAc,EAAE,IAAI,KAAK,EAAE;AAAA,QACvC,CAAC;AAAA,MACH,QAAQ;AACN,eAAO,SAAS;AAAA,UACd,EAAE,IAAI,OAAO,OAAO,QAAQ,EAAE,cAAc,EAAE,IAAI,MAAM,EAAE,EAAE;AAAA,UAC5D,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AACA,QAAI,IAAI,aAAa,YAAY;AAC/B,aAAO,IAAI,SAAS,MAAM,MAAM,cAAc,kBAAkB,GAAG;AAAA,QACjE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,2CAA2C;AAAA,MACxE,CAAC;AAAA,IACH;AACA,WAAO,SAAS,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9D;AAEA,SAAO,OAAO,OAAO;AAAA,IACnB,OAAO,MAAM;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc,OAAO,WAAyB,MAAM,MAAM,aAAa,aAAa,MAAM;AAAA,IAC1F;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,wCAAwC,IAA6B;AACzF,QAAM,MAAM,MAAM,GAAG,QAOlB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GAwBF;AACD,QAAM,OAAO,MAAM,QAAQ,GAAG,IAAI,MAAQ,IAAwC,QAAQ,CAAC;AAC3F,QAAM,MAAM,KAAK,CAAC;AAUlB,MACE,KAAK,iBAAiB,gDACtB,IAAI,iBAAiB,gDACrB,IAAI,oBAAoB,SACxB,IAAI,oBAAoB,SACxB,IAAI,oBAAoB,SACxB,IAAI,oBAAoB,OACxB;AACA,UAAM,IAAI,MAAM,sEAAsE;AAAA,EACxF;AACF;AA+BO,SAAS,mDACd,cAAiC,QAAQ,KACc;AACvD,MAAI,YAAY,2CAA2C,OAAQ,QAAO;AAC1E,QAAM,cAAc,SAAS,aAAa,6CAA6C;AACvF,QAAM,uBAAuB;AAAA,IAC3B;AAAA,IACA;AAAA,EACF;AACA,MAAI,yBAAyB,8CAA8C;AACzE,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,QAAM,qBAAqB,SAAS,aAAa,oCAAoC;AACrF,QAAM,sBAAsB;AAAA,IAC1B;AAAA,IACA;AAAA,EACF;AACA,MAAI,sBAAsB,qBAAqB;AAC7C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,sBAAsB,CAAC,qBAAqB;AAC/C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,cAAc,wBAAwB;AAC5C,MAAI,aAAa;AACf,QAAI,YAAY,aAAa,cAAc;AACzC,YAAM,IAAI,MAAM,oEAAoE;AAAA,IACtF;AACA,QACE,YAAY,wCAAwC,UACpD,YAAY,2DAA2D,QACvE;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,8BAA0B,WAAW;AACrC,mCAA+B,SAAS,aAAa,kCAAkC,CAAC;AAAA,EAC1F;AACA,QAAM,eACJ,SAAS,aAAa,0CAA0C,KAAK;AACvE,MAAI,eAAe,CAAC,mBAAmB,YAAY,GAAG;AACpD,UAAM,IAAI,MAAM,wEAAwE;AAAA,EAC1F;AACA,QAAM,mBAAqD,sBACvD,OAAO,OAAO;AAAA,IACZ,MAAM;AAAA,IACN,qBAAqB;AAAA,IACrB,cAAc;AAAA,EAChB,CAAC,IACD,OAAO,OAAO;AAAA,IACZ,MAAM;AAAA,IACN,qBAAqB;AAAA,IACrB,cAAc;AAAA,EAChB,CAAC;AACL,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA,YAAY,SAAS,aAAa,2CAA2C;AAAA,IAC7E,sBAAsB,cAClB,OACA,SAAS,aAAa,sCAAsC;AAAA,IAChE,mBAAmB,cACf,OACA,SAAS,aAAa,wCAAwC;AAAA,IAClE;AAAA,IACA,kCAAkC;AAAA,IAClC,uBAAuB,SAAS,aAAa,8BAA8B;AAAA,IAC3E,OACE,YAAY,sCAAsC,KAAK,KACvD,gBAAgB,QAAQ,GAAG,IAAI,OAAO,WAAW,CAAC;AAAA,IACpD;AAAA,IACA,UAAU,QAAQ,aAAa,4CAA4C,MAAM,GAAG,KAAM;AAAA,IAC1F,WAAW,QAAQ,aAAa,6CAA6C,GAAG,GAAG,EAAE;AAAA,IACrF,aAAa,QAAQ,aAAa,8CAA8C,GAAG,GAAG,EAAE;AAAA,IACxF,iBAAiB;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,sBAAsB;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,gBAAgB;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,aAAa,QAAQ,aAAa,+CAA+C,IAAI,GAAG,GAAK;AAAA,IAC7F,kBAAkB;AAAA,MAChB;AAAA,MACA;AAAA,MACA,MAAM,OAAO;AAAA,MACb,KAAK,OAAO;AAAA,MACZ,IAAI,OAAO,OAAO;AAAA,IACpB;AAAA,IACA,gBAAgB;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,qBAAqB;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,cAAc,QAAQ,aAAa,4CAA4C,IAAI,GAAG,IAAK;AAAA,IAC3F,oBAAoB;AAAA,MAClB;AAAA,MACA;AAAA,MACA,MAAM,OAAO;AAAA,MACb,OAAO;AAAA,MACP,IAAI,OAAO,OAAO;AAAA,IACpB;AAAA,IACA,eAAe;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,gBAAgB;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,gBAAgB;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,GAAI,YAAY,aAAa,SAAY,CAAC,IAAI,EAAE,iBAAiB,YAAY,SAAS;AAAA,EACxF,CAAC;AACH;AAEA,eAAsB,yCACpB,cAAiC,QAAQ,KAKhC;AACT,QAAM,UAAU,mDAAmD,WAAW;AAC9E,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,WAAW,YAAY;AAC7B,QAAM,UAAU,MAAM,oDAAoD;AAAA,IACxE;AAAA,IACA,aAAa,QAAQ;AAAA,IACrB,sBAAsB,QAAQ;AAAA,IAC9B,YAAY,QAAQ;AAAA,IACpB,sBAAsB,QAAQ;AAAA,IAC9B,mBAAmB,QAAQ;AAAA,IAC3B,kBAAkB,QAAQ;AAAA,IAC1B,GAAI,QAAQ,mCAAmC,EAAE,kCAAkC,KAAK,IAAI,CAAC;AAAA,IAC7F,uBAAuB,QAAQ;AAAA,IAC/B,OAAO,QAAQ;AAAA,IACf,WAAW,QAAQ;AAAA,IACnB,aAAa,QAAQ;AAAA,IACrB,iBAAiB,QAAQ;AAAA,IACzB,sBAAsB,QAAQ;AAAA,IAC9B,gBAAgB,QAAQ;AAAA,IACxB,aAAa,QAAQ;AAAA,IACrB,kBAAkB,QAAQ;AAAA,IAC1B,gBAAgB,QAAQ;AAAA,IACxB,qBAAqB,QAAQ;AAAA,IAC7B,cAAc,QAAQ;AAAA,IACtB,oBAAoB,QAAQ;AAAA,IAC5B,eAAe,QAAQ;AAAA,IACvB,gBAAgB,QAAQ;AAAA,IACxB,gBAAgB,QAAQ;AAAA,IACxB,GAAI,QAAQ,oBAAoB,SAAY,CAAC,IAAI,EAAE,iBAAiB,QAAQ,gBAAgB;AAAA,EAC9F,CAAC;AACD,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA,cAAc,QAAQ;AAAA,IACtB,UAAU,QAAQ;AAAA,EACpB,CAAC;AACH;AAEA,eAAe,YAAe,SAAqB,cAAkC;AACnF,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK;AAAA,MACxB;AAAA,MACA,IAAI,QAAe,CAAC,UAAU,WAAW;AACvC,gBAAQ,WAAW,MAAM,OAAO,IAAI,MAAM,2BAA2B,CAAC,GAAG,YAAY;AAAA,MACvF,CAAC;AAAA,IACH,CAAC;AAAA,EACH,UAAE;AACA,QAAI,MAAO,cAAa,KAAK;AAAA,EAC/B;AACF;AAEA,SAAS,SAAS,aAAgC,MAAsB;AACtE,QAAM,QAAQ,YAAY,IAAI,GAAG,KAAK;AACtC,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,GAAG,IAAI,uDAAuD;AAC1F,SAAO;AACT;AAEA,SAAS,SAAS,aAAgC,MAA6B;AAC7E,QAAM,QAAQ,YAAY,IAAI,GAAG,KAAK;AACtC,SAAO,QAAQ,QAAQ;AACzB;AAEA,SAAS,eAAe,OAAsB,MAAsB;AAClE,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,yBAAyB,IAAI,4BAA4B;AACrF,SAAO;AACT;AAEA,SAAS,0BAA0B,aAA2B;AAC5D,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,WAAW;AAAA,EAC9B,QAAQ;AACN,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,MAAI,OAAO,aAAa,eAAe,OAAO,aAAa,eAAe;AACxE,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,MAAI,CAAC,mBAAmB,OAAO,QAAQ,GAAG;AACxC,UAAM,IAAI,MAAM,uEAAuE;AAAA,EACzF;AACF;AAEA,SAAS,+BAA+B,UAAwB;AAC9D,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,QAAQ;AAAA,EAC3B,QAAQ;AACN,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,MACG,OAAO,aAAa,WAAW,OAAO,aAAa,YACpD,CAAC,mBAAmB,OAAO,QAAQ,GACnC;AACA,UAAM,IAAI,MAAM,uEAAuE;AAAA,EACzF;AACF;AAEA,SAAS,mBAAmB,UAA2B;AACrD,QAAM,aAAa,SAAS,YAAY;AACxC,SAAO,eAAe,eAAe,eAAe,eAAe,eAAe;AACpF;AAEA,SAAS,QACP,aACA,MACA,UACA,SACA,SACQ;AACR,QAAM,MAAM,YAAY,IAAI;AAC5B,QAAM,QAAQ,QAAQ,SAAY,WAAW,OAAO,GAAG;AACvD,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,WAAW,QAAQ,SAAS;AACtE,UAAM,IAAI,MAAM,GAAG,IAAI,+BAA+B;AAAA,EACxD;AACA,SAAO;AACT;;;AK3wBA,eAAsB,uCACpB,cAAiC,QAAQ,KAC1B;AACf,QAAM,aAAa,MAAM,yCAAyC,WAAW;AAC7E,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACA,QAAM,SAAS,IAAI,MAAM;AAAA,IACvB,UAAU,WAAW;AAAA,IACrB,MAAM,WAAW;AAAA,IACjB,OAAO,WAAW,QAAQ;AAAA,EAC5B,CAAC;AACD,QAAM,OAAO,MAAM,WAAW,QAAQ,MAAM,gBAAgB;AAC5D,UAAQ,GAAG,WAAW,IAAI;AAC1B,UAAQ,GAAG,UAAU,IAAI;AACzB,MAAI;AACF,UAAM,WAAW,QAAQ,IAAI;AAAA,EAC/B,UAAE;AACA,YAAQ,IAAI,WAAW,IAAI;AAC3B,YAAQ,IAAI,UAAU,IAAI;AAC1B,WAAO,KAAK,IAAI;AAChB,UAAM,WAAW,QAAQ,MAAM;AAAA,EACjC;AACF;AAEA,IAAI,YAAY,MAAM;AACpB,QAAM,uCAAuC;AAC/C;","names":["dirname","createHash","BoundedObjectReadError","BoundedObjectReadError","throwIfAborted","createHash","EDITABLE_ARTIFACT_KERNEL_VERSION_MAX_BYTES","COMMITTED_TRANSACTION_PROTOCOL_VERSION","SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION","SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION","throwIfAborted","SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION","COMMITTED_TRANSACTION_PROTOCOL_VERSION","SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION","EDITABLE_ARTIFACT_KERNEL_VERSION_MAX_BYTES","abortError","isAbsolute","terminateChild","waitForExit","dirname"]}
+{"version":3,"sources":["../src/editable-artifact-materializer-service.ts","../src/editable-artifact-materializer.ts","../src/editable-artifact-materializer-storage.ts","../src/editable-artifact-materializer-subprocess.ts","../src/editable-artifact-materializer-launcher.ts","../src/artifact-materializer-entry.ts"],"sourcesContent":["import {\n  dbSearchPath,\n  getArtifactMaterializerSettings,\n  type ArtifactMaterializerSettings,\n} from \"@opengeni/config\";\nimport {\n  createDb,\n  dbSql,\n  PostgresEditableArtifactMaterializationRepository,\n  type Database,\n} from \"@opengeni/db\";\nimport { createObservability, type Observability } from \"@opengeni/observability\";\nimport { createObjectStorage, type ObjectStorage } from \"@opengeni/storage\";\nimport { dirname } from \"node:path\";\n\nimport {\n  EDITABLE_ARTIFACT_MATERIALIZER_DATABASE_ROLE,\n  EDITABLE_ARTIFACT_MATERIALIZER_MAX_OUTPUT_BYTES,\n  EDITABLE_ARTIFACT_MATERIALIZER_MAX_SOURCE_BYTES,\n  EditableArtifactMaterializer,\n  createConfiguredEditableArtifactMaterializer,\n  systemEditableArtifactMaterializerClock,\n  systemEditableArtifactMaterializerScheduler,\n  type EditableArtifactMaterializerPassSummary,\n} from \"./editable-artifact-materializer\";\nimport {\n  createEditableArtifactObjectStorageReader,\n  createEditableArtifactObjectStorageVerifier,\n  createEditableArtifactObjectStorageWriter,\n} from \"./editable-artifact-materializer-storage\";\nimport {\n  createNativeEditableArtifactSubprocessPort,\n  type NativeEditableArtifactSubprocessOptions,\n} from \"./editable-artifact-materializer-subprocess\";\nimport {\n  createDevelopmentEditableArtifactProcessLauncher,\n  createLinuxEditableArtifactProcessLauncher,\n} from \"./editable-artifact-materializer-launcher\";\n\nexport type EditableArtifactRuntimeAuthority =\n  | Readonly<{\n      mode: \"production\";\n      environmentVariable: \"OPENGENI_ARTIFACT_RUNTIME_MANIFEST\";\n      manifestPath: string;\n    }>\n  | Readonly<{\n      mode: \"development-current-host\";\n      environmentVariable: \"OPENGENI_ARTIFACT_DEVELOPMENT_RUNTIME_MANIFEST\";\n      manifestPath: string;\n    }>;\n\nexport type EditableArtifactMaterializerServiceState =\n  | \"starting\"\n  | \"ready\"\n  | \"draining\"\n  | \"stopped\"\n  | \"failed\";\n\nexport type EditableArtifactMaterializerService = Readonly<{\n  state(): EditableArtifactMaterializerServiceState;\n  run(): Promise<void>;\n  drain(reason?: string): boolean;\n  close(): Promise<void>;\n  dispatchOnce(signal?: AbortSignal): Promise<EditableArtifactMaterializerPassSummary>;\n  fetch(request: Request): Promise<Response>;\n}>;\n\nexport type CreateEditableArtifactMaterializerServiceInput = Readonly<{\n  materializer: EditableArtifactMaterializer;\n  db: Database;\n  closeDatabase: () => Promise<void>;\n  observability: Observability;\n  serviceName: string;\n  environment: string;\n  deploymentRevision?: string;\n  readinessTimeoutMs?: number;\n  runtimeCapability?: Readonly<{\n    mode: EditableArtifactRuntimeAuthority[\"mode\"];\n    sandboxEnforced: boolean;\n  }>;\n}>;\n\nexport type ProductionEditableArtifactMaterializerServiceOptions = Readonly<{\n  settings: ArtifactMaterializerSettings;\n  /** Dedicated DSN; never defaults to settings.databaseUrl. */\n  databaseUrl: string;\n  declaredDatabaseRole: string;\n  executable: string;\n  bubblewrapExecutable: string | null;\n  prlimitExecutable: string | null;\n  runtimeAuthority: EditableArtifactRuntimeAuthority;\n  /** Explicit exception selected only by the validated local-dev sidecar config. */\n  allowUnsandboxedLocalDevelopment?: boolean;\n  skillFacadeEntrypoint: string;\n  owner: string;\n  objectStorage?: ObjectStorage;\n  batchSize?: number;\n  concurrency?: number;\n  leaseDurationMs?: number;\n  leaseRenewIntervalMs?: number;\n  pollIntervalMs?: number;\n  maxAttempts?: number;\n  memoryLimitBytes: number;\n  cpuTimeLimitMs: number;\n  fileDescriptorLimit: number;\n  processLimit: number;\n  fileSizeLimitBytes: number;\n  wallTimeoutMs: number;\n  nodeEnvironment?: string;\n  maxSourceBytes?: number;\n  maxOutputBytes?: number;\n}>;\n\n/**\n * Compose the distinct production sidecar. It creates its own connection pool\n * from the dedicated DSN and never reuses a control/turn worker handle.\n */\nexport async function createProductionEditableArtifactMaterializerService(\n  options: ProductionEditableArtifactMaterializerServiceOptions,\n): Promise<EditableArtifactMaterializerService> {\n  if (options.declaredDatabaseRole !== EDITABLE_ARTIFACT_MATERIALIZER_DATABASE_ROLE) {\n    throw new Error(\"Artifact materializer database role declaration is invalid\");\n  }\n  if (typeof options.databaseUrl !== \"string\" || options.databaseUrl.trim().length === 0) {\n    throw new Error(\"Artifact materializer requires its dedicated database DSN\");\n  }\n  const maxSourceBytes = options.maxSourceBytes ?? EDITABLE_ARTIFACT_MATERIALIZER_MAX_SOURCE_BYTES;\n  const maxOutputBytes = options.maxOutputBytes ?? EDITABLE_ARTIFACT_MATERIALIZER_MAX_OUTPUT_BYTES;\n  const concurrency = options.concurrency ?? 2;\n  const development = options.runtimeAuthority.mode === \"development-current-host\";\n  if (development !== (options.allowUnsandboxedLocalDevelopment === true)) {\n    throw new Error(\"Artifact materializer runtime authority and local-development gate differ\");\n  }\n  const launcher = development\n    ? await createDevelopmentEditableArtifactProcessLauncher({\n        materializerExecutable: options.executable,\n        explicitlyEnabled: options.allowUnsandboxedLocalDevelopment === true,\n        nodeEnvironment: options.nodeEnvironment,\n      })\n    : await createLinuxEditableArtifactProcessLauncher({\n        materializerExecutable: options.executable,\n        bubblewrapExecutable: requiredOption(options.bubblewrapExecutable, \"bubblewrap\"),\n        prlimitExecutable: requiredOption(options.prlimitExecutable, \"prlimit\"),\n        runtimeRoot: dirname(options.runtimeAuthority.manifestPath),\n        memoryLimitBytes: options.memoryLimitBytes,\n        cpuTimeLimitMs: options.cpuTimeLimitMs,\n        fileDescriptorLimit: options.fileDescriptorLimit,\n        processLimit: options.processLimit,\n        fileSizeLimitBytes: options.fileSizeLimitBytes,\n      });\n  const searchPath = dbSearchPath(options.settings);\n  const dbClient = createDb(options.databaseUrl, {\n    ...(searchPath ? { searchPath } : {}),\n    ...(options.settings.rlsStrategy ? { rlsStrategy: options.settings.rlsStrategy } : {}),\n    max: Math.max(2, concurrency + 1),\n  });\n  let created = false;\n  try {\n    await assertDedicatedMaterializerDatabaseRole(dbClient.db);\n    const objectStorage = options.objectStorage ?? createObjectStorage(options.settings);\n    if (!objectStorage) throw new Error(\"Artifact materializer object storage is unavailable\");\n    const subprocessOptions: NativeEditableArtifactSubprocessOptions = {\n      executable: options.executable,\n      launcher,\n      childEnvironment:\n        options.runtimeAuthority.mode === \"production\"\n          ? Object.freeze({\n              OPENGENI_ARTIFACT_RUNTIME_MANIFEST: options.runtimeAuthority.manifestPath,\n              OPENGENI_ARTIFACT_TOOL_ENTRY: options.skillFacadeEntrypoint,\n            })\n          : Object.freeze({\n              NODE_ENV: \"development\",\n              OPENGENI_ARTIFACT_DEVELOPMENT_RUNTIME_MANIFEST: options.runtimeAuthority.manifestPath,\n              OPENGENI_ARTIFACT_TOOL_ENTRY: options.skillFacadeEntrypoint,\n            }),\n      ...(development ? { allowUnsandboxedDevelopment: true } : {}),\n      wallTimeoutMs: options.wallTimeoutMs,\n      maxSourceBytes,\n      maxOutputBytes,\n    };\n    const kernel = await createNativeEditableArtifactSubprocessPort(subprocessOptions);\n    const repository = new PostgresEditableArtifactMaterializationRepository(dbClient.db, {\n      ...(options.settings.dbSchema.trim() ? { dataSchema: options.settings.dbSchema.trim() } : {}),\n    });\n    const observability = createObservability(options.settings, {\n      component: \"artifact-materializer\",\n    });\n    if (development) {\n      observability.warn(\"Artifact materializer is running without an OS sandbox\", {\n        errorClass: \"DevelopmentSecurityPosture\",\n        errorCode: \"artifact_materializer_unsandboxed_development\",\n        origin: \"worker\",\n        outcome: \"degraded\",\n      });\n    }\n    const materializer = createConfiguredEditableArtifactMaterializer({\n      enabled: true,\n      databaseRole: options.declaredDatabaseRole,\n      objectStorageConfigured: true,\n      ...(development ? { allowUnsandboxedDevelopment: true } : {}),\n      dependencies: {\n        store: repository,\n        sourceReader: createEditableArtifactObjectStorageReader(objectStorage),\n        outputWriter: createEditableArtifactObjectStorageWriter(objectStorage),\n        outputVerifier: createEditableArtifactObjectStorageVerifier(objectStorage, {\n          verify: kernel.verifyMaterialization,\n        }),\n        kernel,\n        scheduler: systemEditableArtifactMaterializerScheduler,\n        clock: systemEditableArtifactMaterializerClock,\n        logger: {\n          warn(message, attributes) {\n            observability.warn(message, {\n              errorClass: \"WorkerOperationError\",\n              errorCode: materializerFailureErrorCode(attributes) ?? \"worker_operation_failed\",\n              origin: \"worker\",\n              outcome: typeof attributes.code === \"string\" ? attributes.code : \"unknown\",\n            });\n          },\n        },\n        metrics: {\n          increment(outcome, count = 1) {\n            observability.incrementCounter({\n              name: \"opengeni_artifact_materializations_total\",\n              help: \"Editable artifact materialization attempts by closed outcome.\",\n              labels: { outcome },\n              amount: count,\n            });\n          },\n        },\n      },\n      options: {\n        owner: options.owner,\n        ...(options.batchSize !== undefined ? { batchSize: options.batchSize } : {}),\n        concurrency,\n        ...(options.leaseDurationMs !== undefined\n          ? { leaseDurationMs: options.leaseDurationMs }\n          : {}),\n        ...(options.leaseRenewIntervalMs !== undefined\n          ? { leaseRenewIntervalMs: options.leaseRenewIntervalMs }\n          : {}),\n        ...(options.pollIntervalMs !== undefined ? { pollIntervalMs: options.pollIntervalMs } : {}),\n        ...(options.maxAttempts !== undefined ? { maxAttempts: options.maxAttempts } : {}),\n        maxSourceBytes,\n        maxOutputBytes,\n      },\n    });\n    if (!materializer) throw new Error(\"Artifact materializer is unexpectedly disabled\");\n    created = true;\n    return createEditableArtifactMaterializerService({\n      materializer,\n      db: dbClient.db,\n      closeDatabase: dbClient.close,\n      observability,\n      serviceName: options.settings.serviceName,\n      environment: options.settings.environment,\n      deploymentRevision: options.settings.deploymentRevision,\n      runtimeCapability: Object.freeze({\n        mode: options.runtimeAuthority.mode,\n        sandboxEnforced: launcher.identity.sandboxEnforced,\n      }),\n    });\n  } finally {\n    if (!created) await dbClient.close();\n  }\n}\n\nfunction materializerFailureErrorCode(\n  attributes: Readonly<Record<string, unknown>>,\n):\n  | \"artifact_materializer_source_open_failed\"\n  | \"artifact_materializer_source_content_type_mismatch\"\n  | \"artifact_materializer_source_stream_identity_mismatch\"\n  | \"artifact_materializer_source_revalidation_failed\"\n  | \"artifact_materializer_native_input_framing_failed\"\n  | \"artifact_materializer_native_snapshot_open_failed\"\n  | \"artifact_materializer_native_state_mismatch\"\n  | undefined {\n  const key = `${String(attributes.failureStage)}:${String(attributes.failureSubcode)}`;\n  switch (key) {\n    case \"source_reader:open\":\n      return \"artifact_materializer_source_open_failed\";\n    case \"source_reader:content_type\":\n      return \"artifact_materializer_source_content_type_mismatch\";\n    case \"source_reader:stream_identity\":\n      return \"artifact_materializer_source_stream_identity_mismatch\";\n    case \"source_reader:revalidate\":\n      return \"artifact_materializer_source_revalidation_failed\";\n    case \"native:input_framing\":\n      return \"artifact_materializer_native_input_framing_failed\";\n    case \"native:snapshot_open\":\n      return \"artifact_materializer_native_snapshot_open_failed\";\n    case \"native:state_mismatch\":\n      return \"artifact_materializer_native_state_mismatch\";\n  }\n}\n\nexport function createEditableArtifactMaterializerService(\n  input: CreateEditableArtifactMaterializerServiceInput,\n): EditableArtifactMaterializerService {\n  let state: EditableArtifactMaterializerServiceState = \"starting\";\n  let runPromise: Promise<void> | null = null;\n  let closePromise: Promise<void> | null = null;\n  let databaseClosed = false;\n  const abort = new AbortController();\n  const readinessTimeoutMs = input.readinessTimeoutMs ?? 2_000;\n\n  const ready = async (): Promise<void> => {\n    await withTimeout(assertDedicatedMaterializerDatabaseRole(input.db), readinessTimeoutMs);\n  };\n\n  const run = (): Promise<void> => {\n    if (runPromise) return runPromise;\n    if (state !== \"starting\") {\n      return Promise.reject(new Error(\"Artifact materializer service cannot be restarted\"));\n    }\n    runPromise = (async () => {\n      try {\n        await ready();\n        if (abort.signal.aborted) {\n          state = \"stopped\";\n          return;\n        }\n        state = \"ready\";\n        await input.materializer.run(abort.signal);\n        const exitWasDraining = (state as EditableArtifactMaterializerServiceState) === \"draining\";\n        state = exitWasDraining ? \"stopped\" : \"failed\";\n        if (!exitWasDraining) {\n          throw new Error(\"Artifact materializer loop exited without a drain request\");\n        }\n      } catch (error) {\n        const caughtState = state as EditableArtifactMaterializerServiceState;\n        if (caughtState !== \"draining\" && caughtState !== \"stopped\") state = \"failed\";\n        throw error;\n      }\n    })();\n    return runPromise;\n  };\n\n  const drain = (_reason = \"shutdown\"): boolean => {\n    if (state === \"draining\" || state === \"stopped\" || state === \"failed\") return false;\n    state = \"draining\";\n    abort.abort();\n    return true;\n  };\n\n  const close = (): Promise<void> => {\n    if (closePromise) return closePromise;\n    closePromise = (async () => {\n      drain(\"close\");\n      if (runPromise) await runPromise.catch(() => undefined);\n      await input.materializer.drain();\n      if (!databaseClosed) {\n        databaseClosed = true;\n        await input.closeDatabase();\n      }\n      if (state !== \"failed\") state = \"stopped\";\n    })();\n    return closePromise;\n  };\n\n  const fetch = async (request: Request): Promise<Response> => {\n    const url = new URL(request.url);\n    if (request.method !== \"GET\") {\n      return Response.json({ error: \"method_not_allowed\" }, { status: 405 });\n    }\n    if (url.pathname === \"/healthz\") {\n      const ok = state !== \"failed\" && state !== \"stopped\";\n      return Response.json(\n        {\n          service: input.serviceName,\n          component: \"artifact-materializer\",\n          environment: input.environment,\n          ...(input.deploymentRevision ? { deploymentRevision: input.deploymentRevision } : {}),\n          runtime: input.runtimeCapability ?? {\n            mode: \"production\",\n            sandboxEnforced: true,\n          },\n          state,\n          ok,\n        },\n        { status: ok ? 200 : 503 },\n      );\n    }\n    if (url.pathname === \"/readyz\") {\n      if (state !== \"ready\") {\n        return Response.json(\n          { ok: false, state, checks: { databaseRole: { ok: false } } },\n          { status: 503 },\n        );\n      }\n      try {\n        await ready();\n        return Response.json({\n          ok: true,\n          state,\n          runtime: input.runtimeCapability ?? {\n            mode: \"production\",\n            sandboxEnforced: true,\n          },\n          checks: { databaseRole: { ok: true } },\n        });\n      } catch {\n        return Response.json(\n          { ok: false, state, checks: { databaseRole: { ok: false } } },\n          { status: 503 },\n        );\n      }\n    }\n    if (url.pathname === \"/metrics\") {\n      return new Response(await input.observability.prometheusMetrics(), {\n        status: 200,\n        headers: { \"content-type\": \"text/plain; version=0.0.4; charset=utf-8\" },\n      });\n    }\n    return Response.json({ error: \"not_found\" }, { status: 404 });\n  };\n\n  return Object.freeze({\n    state: () => state,\n    run,\n    drain,\n    close,\n    dispatchOnce: async (signal?: AbortSignal) => await input.materializer.dispatchOnce(signal),\n    fetch,\n  });\n}\n\nexport async function assertDedicatedMaterializerDatabaseRole(db: Database): Promise<void> {\n  const raw = await db.execute<{\n    current_role: string;\n    session_role: string;\n    can_select_jobs: boolean;\n    can_insert_jobs: boolean;\n    can_update_jobs: boolean;\n    can_delete_jobs: boolean;\n  }>(dbSql`\n    select\n      current_user::text as current_role,\n      session_user::text as session_role,\n      has_table_privilege(\n        current_user,\n        format('%I.editable_artifact_materialization_jobs', current_schema()),\n        'SELECT'\n      ) as can_select_jobs,\n      has_table_privilege(\n        current_user,\n        format('%I.editable_artifact_materialization_jobs', current_schema()),\n        'INSERT'\n      ) as can_insert_jobs,\n      has_table_privilege(\n        current_user,\n        format('%I.editable_artifact_materialization_jobs', current_schema()),\n        'UPDATE'\n      ) as can_update_jobs,\n      has_table_privilege(\n        current_user,\n        format('%I.editable_artifact_materialization_jobs', current_schema()),\n        'DELETE'\n      ) as can_delete_jobs\n  `);\n  const rows = Array.isArray(raw) ? raw : ((raw as unknown as { rows?: unknown[] }).rows ?? []);\n  const row = rows[0] as\n    | {\n        current_role?: unknown;\n        session_role?: unknown;\n        can_select_jobs?: unknown;\n        can_insert_jobs?: unknown;\n        can_update_jobs?: unknown;\n        can_delete_jobs?: unknown;\n      }\n    | undefined;\n  if (\n    row?.current_role !== EDITABLE_ARTIFACT_MATERIALIZER_DATABASE_ROLE ||\n    row.session_role !== EDITABLE_ARTIFACT_MATERIALIZER_DATABASE_ROLE ||\n    row.can_select_jobs !== false ||\n    row.can_insert_jobs !== false ||\n    row.can_update_jobs !== false ||\n    row.can_delete_jobs !== false\n  ) {\n    throw new Error(\"Artifact materializer database connection has an unsafe role posture\");\n  }\n}\n\nexport type EditableArtifactMaterializerSidecarEnvironment = Readonly<{\n  databaseUrl: string;\n  declaredDatabaseRole: string;\n  executable: string;\n  bubblewrapExecutable: string | null;\n  prlimitExecutable: string | null;\n  runtimeAuthority: EditableArtifactRuntimeAuthority;\n  skillFacadeEntrypoint: string;\n  owner: string;\n  httpHostname: string;\n  httpPort: number;\n  batchSize: number;\n  concurrency: number;\n  leaseDurationMs: number;\n  leaseRenewIntervalMs: number;\n  pollIntervalMs: number;\n  maxAttempts: number;\n  memoryLimitBytes: number;\n  cpuTimeLimitMs: number;\n  fileDescriptorLimit: number;\n  processLimit: number;\n  fileSizeLimitBytes: number;\n  wallTimeoutMs: number;\n  maxSourceBytes: number;\n  maxOutputBytes: number;\n  allowUnsandboxedLocalDevelopment: boolean;\n  nodeEnvironment?: string;\n}>;\n\nexport function readEditableArtifactMaterializerSidecarEnvironment(\n  environment: NodeJS.ProcessEnv = process.env,\n): EditableArtifactMaterializerSidecarEnvironment | null {\n  if (environment.OPENGENI_ARTIFACT_MATERIALIZER_ENABLED !== \"true\") return null;\n  const databaseUrl = required(environment, \"OPENGENI_ARTIFACT_MATERIALIZER_DATABASE_URL\");\n  const declaredDatabaseRole = required(\n    environment,\n    \"OPENGENI_ARTIFACT_MATERIALIZER_DATABASE_ROLE\",\n  );\n  if (declaredDatabaseRole !== EDITABLE_ARTIFACT_MATERIALIZER_DATABASE_ROLE) {\n    throw new Error(\"OPENGENI_ARTIFACT_MATERIALIZER_DATABASE_ROLE is invalid\");\n  }\n  const productionManifest = optional(environment, \"OPENGENI_ARTIFACT_RUNTIME_MANIFEST\");\n  const developmentManifest = optional(\n    environment,\n    \"OPENGENI_ARTIFACT_DEVELOPMENT_RUNTIME_MANIFEST\",\n  );\n  if (productionManifest && developmentManifest) {\n    throw new Error(\n      \"Production and development artifact runtime manifests cannot both be configured\",\n    );\n  }\n  if (!productionManifest && !developmentManifest) {\n    throw new Error(\n      \"An artifact runtime manifest is required when artifact materialization is enabled\",\n    );\n  }\n  const development = developmentManifest !== null;\n  if (development) {\n    if (environment.NODE_ENV === \"production\") {\n      throw new Error(\"Development artifact runtime is forbidden when NODE_ENV=production\");\n    }\n    if (\n      environment.OPENGENI_ARTIFACT_LOCAL_DEVELOPMENT !== \"true\" ||\n      environment.OPENGENI_ARTIFACT_MATERIALIZER_UNSANDBOXED_DEVELOPMENT !== \"true\"\n    ) {\n      throw new Error(\n        \"Unsandboxed artifact materialization requires explicit local-development gates\",\n      );\n    }\n    assertLoopbackDatabaseUrl(databaseUrl);\n    assertLoopbackObjectStorageUrl(required(environment, \"OPENGENI_OBJECT_STORAGE_ENDPOINT\"));\n  }\n  const httpHostname =\n    optional(environment, \"OPENGENI_ARTIFACT_MATERIALIZER_HTTP_HOST\") ?? \"0.0.0.0\";\n  if (development && !isLoopbackHostname(httpHostname)) {\n    throw new Error(\"Unsandboxed artifact materialization requires a loopback HTTP listener\");\n  }\n  const runtimeAuthority: EditableArtifactRuntimeAuthority = developmentManifest\n    ? Object.freeze({\n        mode: \"development-current-host\",\n        environmentVariable: \"OPENGENI_ARTIFACT_DEVELOPMENT_RUNTIME_MANIFEST\",\n        manifestPath: developmentManifest,\n      })\n    : Object.freeze({\n        mode: \"production\",\n        environmentVariable: \"OPENGENI_ARTIFACT_RUNTIME_MANIFEST\",\n        manifestPath: productionManifest!,\n      });\n  return Object.freeze({\n    databaseUrl,\n    declaredDatabaseRole,\n    executable: required(environment, \"OPENGENI_ARTIFACT_MATERIALIZER_EXECUTABLE\"),\n    bubblewrapExecutable: development\n      ? null\n      : required(environment, \"OPENGENI_ARTIFACT_MATERIALIZER_BWRAP\"),\n    prlimitExecutable: development\n      ? null\n      : required(environment, \"OPENGENI_ARTIFACT_MATERIALIZER_PRLIMIT\"),\n    runtimeAuthority,\n    allowUnsandboxedLocalDevelopment: development,\n    skillFacadeEntrypoint: required(environment, \"OPENGENI_ARTIFACT_TOOL_ENTRY\"),\n    owner:\n      environment.OPENGENI_ARTIFACT_MATERIALIZER_OWNER?.trim() ||\n      `materializer-${process.pid}-${crypto.randomUUID()}`,\n    httpHostname,\n    httpPort: integer(environment, \"OPENGENI_ARTIFACT_MATERIALIZER_HTTP_PORT\", 9465, 1, 65_535),\n    batchSize: integer(environment, \"OPENGENI_ARTIFACT_MATERIALIZER_BATCH_SIZE\", 8, 1, 64),\n    concurrency: integer(environment, \"OPENGENI_ARTIFACT_MATERIALIZER_CONCURRENCY\", 2, 1, 64),\n    leaseDurationMs: integer(\n      environment,\n      \"OPENGENI_ARTIFACT_MATERIALIZER_LEASE_MS\",\n      120_000,\n      10_000,\n      86_400_000,\n    ),\n    leaseRenewIntervalMs: integer(\n      environment,\n      \"OPENGENI_ARTIFACT_MATERIALIZER_RENEW_MS\",\n      30_000,\n      1_000,\n      43_199_999,\n    ),\n    pollIntervalMs: integer(\n      environment,\n      \"OPENGENI_ARTIFACT_MATERIALIZER_POLL_MS\",\n      1_000,\n      10,\n      60_000,\n    ),\n    maxAttempts: integer(environment, \"OPENGENI_ARTIFACT_MATERIALIZER_MAX_ATTEMPTS\", 20, 1, 1_000),\n    memoryLimitBytes: integer(\n      environment,\n      \"OPENGENI_ARTIFACT_MATERIALIZER_MEMORY_BYTES\",\n      512 * 1024 * 1024,\n      64 * 1024 * 1024,\n      8 * 1024 * 1024 * 1024,\n    ),\n    cpuTimeLimitMs: integer(\n      environment,\n      \"OPENGENI_ARTIFACT_MATERIALIZER_CPU_MS\",\n      60_000,\n      1_000,\n      3_600_000,\n    ),\n    fileDescriptorLimit: integer(\n      environment,\n      \"OPENGENI_ARTIFACT_MATERIALIZER_OPEN_FILES\",\n      64,\n      16,\n      4_096,\n    ),\n    processLimit: integer(environment, \"OPENGENI_ARTIFACT_MATERIALIZER_PROCESSES\", 64, 1, 1_024),\n    fileSizeLimitBytes: integer(\n      environment,\n      \"OPENGENI_ARTIFACT_MATERIALIZER_FILE_BYTES\",\n      512 * 1024 * 1024,\n      1024 * 1024,\n      8 * 1024 * 1024 * 1024,\n    ),\n    wallTimeoutMs: integer(\n      environment,\n      \"OPENGENI_ARTIFACT_MATERIALIZER_WALL_MS\",\n      120_000,\n      1_000,\n      3_600_000,\n    ),\n    maxSourceBytes: integer(\n      environment,\n      \"OPENGENI_ARTIFACT_MATERIALIZER_MAX_SOURCE_BYTES\",\n      EDITABLE_ARTIFACT_MATERIALIZER_MAX_SOURCE_BYTES,\n      1,\n      EDITABLE_ARTIFACT_MATERIALIZER_MAX_SOURCE_BYTES,\n    ),\n    maxOutputBytes: integer(\n      environment,\n      \"OPENGENI_ARTIFACT_MATERIALIZER_MAX_OUTPUT_BYTES\",\n      EDITABLE_ARTIFACT_MATERIALIZER_MAX_OUTPUT_BYTES,\n      1,\n      EDITABLE_ARTIFACT_MATERIALIZER_MAX_OUTPUT_BYTES,\n    ),\n    ...(environment.NODE_ENV === undefined ? {} : { nodeEnvironment: environment.NODE_ENV }),\n  });\n}\n\nexport async function createMaterializerSidecarFromEnvironment(\n  environment: NodeJS.ProcessEnv = process.env,\n): Promise<Readonly<{\n  service: EditableArtifactMaterializerService;\n  httpHostname: string;\n  httpPort: number;\n}> | null> {\n  const sidecar = readEditableArtifactMaterializerSidecarEnvironment(environment);\n  if (!sidecar) return null;\n  const settings = getArtifactMaterializerSettings(environment);\n  const service = await createProductionEditableArtifactMaterializerService({\n    settings,\n    databaseUrl: sidecar.databaseUrl,\n    declaredDatabaseRole: sidecar.declaredDatabaseRole,\n    executable: sidecar.executable,\n    bubblewrapExecutable: sidecar.bubblewrapExecutable,\n    prlimitExecutable: sidecar.prlimitExecutable,\n    runtimeAuthority: sidecar.runtimeAuthority,\n    ...(sidecar.allowUnsandboxedLocalDevelopment ? { allowUnsandboxedLocalDevelopment: true } : {}),\n    skillFacadeEntrypoint: sidecar.skillFacadeEntrypoint,\n    owner: sidecar.owner,\n    batchSize: sidecar.batchSize,\n    concurrency: sidecar.concurrency,\n    leaseDurationMs: sidecar.leaseDurationMs,\n    leaseRenewIntervalMs: sidecar.leaseRenewIntervalMs,\n    pollIntervalMs: sidecar.pollIntervalMs,\n    maxAttempts: sidecar.maxAttempts,\n    memoryLimitBytes: sidecar.memoryLimitBytes,\n    cpuTimeLimitMs: sidecar.cpuTimeLimitMs,\n    fileDescriptorLimit: sidecar.fileDescriptorLimit,\n    processLimit: sidecar.processLimit,\n    fileSizeLimitBytes: sidecar.fileSizeLimitBytes,\n    wallTimeoutMs: sidecar.wallTimeoutMs,\n    maxSourceBytes: sidecar.maxSourceBytes,\n    maxOutputBytes: sidecar.maxOutputBytes,\n    ...(sidecar.nodeEnvironment === undefined ? {} : { nodeEnvironment: sidecar.nodeEnvironment }),\n  });\n  return Object.freeze({\n    service,\n    httpHostname: sidecar.httpHostname,\n    httpPort: sidecar.httpPort,\n  });\n}\n\nasync function withTimeout<T>(promise: Promise<T>, milliseconds: number): Promise<T> {\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  try {\n    return await Promise.race([\n      promise,\n      new Promise<never>((_resolve, reject) => {\n        timer = setTimeout(() => reject(new Error(\"readiness check timed out\")), milliseconds);\n      }),\n    ]);\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n}\n\nfunction required(environment: NodeJS.ProcessEnv, name: string): string {\n  const value = environment[name]?.trim();\n  if (!value) throw new Error(`${name} is required when artifact materialization is enabled`);\n  return value;\n}\n\nfunction optional(environment: NodeJS.ProcessEnv, name: string): string | null {\n  const value = environment[name]?.trim();\n  return value ? value : null;\n}\n\nfunction requiredOption(value: string | null, name: string): string {\n  if (!value) throw new Error(`Artifact materializer ${name} is required in production`);\n  return value;\n}\n\nfunction assertLoopbackDatabaseUrl(databaseUrl: string): void {\n  let parsed: URL;\n  try {\n    parsed = new URL(databaseUrl);\n  } catch {\n    throw new Error(\"Local-development artifact materializer database DSN is invalid\");\n  }\n  if (parsed.protocol !== \"postgres:\" && parsed.protocol !== \"postgresql:\") {\n    throw new Error(\"Local-development artifact materializer database DSN is invalid\");\n  }\n  if (!isLoopbackHostname(parsed.hostname)) {\n    throw new Error(\"Unsandboxed artifact materialization requires a loopback database DSN\");\n  }\n}\n\nfunction assertLoopbackObjectStorageUrl(endpoint: string): void {\n  let parsed: URL;\n  try {\n    parsed = new URL(endpoint);\n  } catch {\n    throw new Error(\"Local-development artifact object-storage endpoint is invalid\");\n  }\n  if (\n    (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") ||\n    !isLoopbackHostname(parsed.hostname)\n  ) {\n    throw new Error(\"Unsandboxed artifact materialization requires loopback object storage\");\n  }\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  const normalized = hostname.toLowerCase();\n  return normalized === \"localhost\" || normalized === \"127.0.0.1\" || normalized === \"[::1]\";\n}\n\nfunction integer(\n  environment: NodeJS.ProcessEnv,\n  name: string,\n  fallback: number,\n  minimum: number,\n  maximum: number,\n): number {\n  const raw = environment[name];\n  const value = raw === undefined ? fallback : Number(raw);\n  if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {\n    throw new Error(`${name} is outside its allowed range`);\n  }\n  return value;\n}\n","import { createHash } from \"node:crypto\";\n\nimport { EDITABLE_ARTIFACT_KERNEL_VERSION_MAX_BYTES } from \"@opengeni/contracts/editable-artifacts\";\nimport {\n  COMMITTED_TRANSACTION_PROTOCOL_VERSION,\n  SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,\n  SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION,\n} from \"@opengeni/contracts/editable-artifact-versions\";\n\nimport type {\n  BoundedImmutableObjectWritePort,\n  BoundedObjectRead,\n  BoundedObjectReadPort,\n} from \"@opengeni/storage\";\nimport { BoundedObjectReadError, BoundedObjectWriteError } from \"@opengeni/storage\";\n\n/**\n * The database role allowed to poll the cross-tenant materialization queue.\n * It owns no table privileges; @opengeni/db exposes only fenced SECURITY\n * DEFINER functions to this role.\n */\nexport const EDITABLE_ARTIFACT_MATERIALIZER_DATABASE_ROLE =\n  \"opengeni_artifact_materializer\" as const;\n\nexport const EDITABLE_ARTIFACT_MATERIALIZER_MAX_SOURCE_BYTES = 512 * 1024 * 1024;\nexport const EDITABLE_ARTIFACT_MATERIALIZER_MAX_OUTPUT_BYTES = 512 * 1024 * 1024;\nexport const EDITABLE_ARTIFACT_MATERIALIZER_MAX_OPTIONS_BYTES = 256 * 1024;\nexport const EDITABLE_ARTIFACT_MATERIALIZER_MAX_ATTEMPTS = 20;\n\nexport type EditableArtifactMaterializationFormat =\n  | \"xlsx\"\n  | \"pptx\"\n  | \"docx\"\n  | \"pdf\"\n  | \"png\"\n  | \"webp\";\n\nexport type EditableArtifactMaterializationModality = \"spreadsheet\" | \"presentation\" | \"document\";\n\nexport type EditableArtifactMaterializationMimeType =\n  | \"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet\"\n  | \"application/vnd.openxmlformats-officedocument.presentationml.presentation\"\n  | \"application/vnd.openxmlformats-officedocument.wordprocessingml.document\"\n  | \"application/pdf\"\n  | \"image/png\"\n  | \"image/webp\";\n\nexport type EditableArtifactMaterializationScope = Readonly<{\n  accountId: string;\n  workspaceId: string;\n}>;\n\n/**\n * One immutable, self-contained input manifest returned by the global claim\n * function. The source snapshot covers exactly targetHeadSequence. There is\n * deliberately no \"current\" lookup after claim and no unbounded DB tail read.\n */\nexport type ClaimedEditableArtifactMaterialization = Readonly<{\n  scope: EditableArtifactMaterializationScope;\n  artifactId: string;\n  jobId: string;\n  versionId: string | null;\n  modality: EditableArtifactMaterializationModality;\n  inputSnapshotId: string;\n  targetHeadSequence: number;\n  stateHash: string;\n  sourceObjectReference: string;\n  sourceByteSize: number;\n  sourceContentHash: string;\n  sourceMimeType: string;\n  modelSchemaVersion: number;\n  operationProtocolVersion: number;\n  snapshotProtocolVersion: number;\n  format: EditableArtifactMaterializationFormat;\n  codecId: string;\n  /** Canonical UTF-8 JSON, bounded and hashed by optionsHash. */\n  normalizedOptions: string;\n  optionsHash: string;\n  codecVersion: string;\n  kernelVersion: string;\n  fontRegistryHash: string;\n  policyHash: string;\n  attemptCount: number;\n  leaseOwner: string;\n  leaseExpiresAt: string;\n}>;\n\nexport type EditableArtifactMaterializationLease = Readonly<{\n  scope: EditableArtifactMaterializationScope;\n  artifactId: string;\n  jobId: string;\n  owner: string;\n  attemptCount: number;\n}>;\n\nexport interface EditableArtifactMaterializationStorePort {\n  claim(input: {\n    owner: string;\n    leaseDurationMs: number;\n    limit: number;\n  }): Promise<readonly ClaimedEditableArtifactMaterialization[]>;\n  renew(input: EditableArtifactMaterializationLease & { leaseDurationMs: number }): Promise<string>;\n  succeed(\n    input: EditableArtifactMaterializationLease & {\n      resultId: string;\n      blobRefId: string;\n      objectReference: string;\n      byteSize: number;\n      contentHash: string;\n      mimeType: EditableArtifactMaterializationMimeType;\n      verifiedAt: string;\n    },\n  ): Promise<unknown>;\n  fail(input: EditableArtifactMaterializationLease & { errorCode: string }): Promise<unknown>;\n}\n\nexport type NativeEditableArtifactMaterializerIdentity = Readonly<{\n  kind: \"native\";\n  /** Parent-owned launcher facts, never copied from the codec child. */\n  isolation: \"subprocess\";\n  network: \"denied\" | \"host\";\n  officeAutomation: false;\n  processProtocolVersion: 1;\n  sandboxEnforced: boolean;\n  memoryLimitBytes: number;\n  cpuTimeLimitMs: number;\n  fileDescriptorLimit: number;\n  processLimit: number;\n  fileSizeLimitBytes: number;\n  maxOutputBytes: number;\n  kernelVersion: string;\n  codecVersions: Readonly<Record<string, string>>;\n  fontRegistryHash: string;\n  policyHash: string;\n  runtimeTarget: string;\n  supportedModelSchemaVersions: readonly [typeof SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION];\n  supportedOperationProtocolVersions: readonly [typeof COMMITTED_TRANSACTION_PROTOCOL_VERSION];\n  supportedSnapshotProtocolVersions: readonly [typeof SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION];\n}>;\n\nexport type NativeEditableArtifactMaterializationResult = Readonly<{\n  headSequence: number;\n  stateHash: string;\n  format: EditableArtifactMaterializationFormat;\n  mimeType: EditableArtifactMaterializationMimeType;\n  codecId: string;\n  codecVersion: string;\n  kernelVersion: string;\n  fontRegistryHash: string;\n  policyHash: string;\n  /** Optional precomputed facts; the independent writer/verifier still checks. */\n  byteSize?: number;\n  contentHash?: string;\n  /** Canonical semantics projected by the authoritative native source kernel. */\n  semanticHash: string;\n  chunks: AsyncIterable<Uint8Array>;\n}>;\n\n/**\n * Production implementations must be a native Rust subprocess adapter. The\n * adapter consumes a version-pinned stream, reconstructs and validates the\n * canonical snapshot, and exports without Office/COM or network access.\n */\nexport interface NativeEditableArtifactMaterializerPort {\n  readonly identity: NativeEditableArtifactMaterializerIdentity;\n  materialize(input: {\n    job: ClaimedEditableArtifactMaterialization;\n    normalizedOptions: Uint8Array;\n    snapshot: AsyncIterable<Uint8Array>;\n    signal: AbortSignal;\n  }): Promise<NativeEditableArtifactMaterializationResult>;\n}\n\nexport type VerifiedEditableArtifactMaterialization = Readonly<{\n  objectReference: string;\n  byteSize: number;\n  contentHash: string;\n  mimeType: EditableArtifactMaterializationMimeType;\n  format: EditableArtifactMaterializationFormat;\n  codecId: string;\n  codecVersion: string;\n}>;\n\n/** Independent reader/parser. It must not reuse the exporting codec process. */\nexport interface EditableArtifactMaterializationVerifierPort {\n  verify(input: {\n    objectReference: string;\n    expectedByteSize: number;\n    expectedContentHash: string;\n    expectedMimeType: EditableArtifactMaterializationMimeType;\n    format: EditableArtifactMaterializationFormat;\n    codecId: string;\n    codecVersion: string;\n    expectedSemanticHash: string;\n    maxBytes: number;\n    signal: AbortSignal;\n  }): Promise<VerifiedEditableArtifactMaterialization>;\n}\n\nexport interface EditableArtifactMaterializationSemanticVerifierPort {\n  verify(input: {\n    format: EditableArtifactMaterializationFormat;\n    codecId: string;\n    codecVersion: string;\n    expectedSemanticHash: string;\n    byteSize: number;\n    chunks: AsyncIterable<Uint8Array>;\n    signal: AbortSignal;\n  }): Promise<void>;\n}\n\nexport interface EditableArtifactMaterializerSchedulerPort {\n  sleep(milliseconds: number, signal: AbortSignal): Promise<void>;\n}\n\nexport interface EditableArtifactMaterializerClockPort {\n  now(): Date;\n}\n\nexport interface EditableArtifactMaterializerLoggerPort {\n  warn(message: string, attributes: Readonly<Record<string, unknown>>): void;\n}\n\nexport type EditableArtifactMaterializerMetricOutcome =\n  | \"claimed\"\n  | \"succeeded\"\n  | \"dead_lettered\"\n  | \"retry_deferred\"\n  | \"lease_lost\"\n  | \"cancelled\"\n  | \"claim_failed\";\n\nexport interface EditableArtifactMaterializerMetricsPort {\n  increment(outcome: EditableArtifactMaterializerMetricOutcome, count?: number): void;\n}\n\nexport type EditableArtifactMaterializerOptions = Readonly<{\n  owner: string;\n  batchSize?: number;\n  concurrency?: number;\n  leaseDurationMs?: number;\n  leaseRenewIntervalMs?: number;\n  pollIntervalMs?: number;\n  claimBackoffMs?: number;\n  maxAttempts?: number;\n  maxSourceBytes?: number;\n  maxOutputBytes?: number;\n}>;\n\nexport type EditableArtifactMaterializerDependencies = Readonly<{\n  store: EditableArtifactMaterializationStorePort;\n  sourceReader: BoundedObjectReadPort;\n  outputWriter: BoundedImmutableObjectWritePort;\n  outputVerifier: EditableArtifactMaterializationVerifierPort;\n  kernel: NativeEditableArtifactMaterializerPort;\n  scheduler: EditableArtifactMaterializerSchedulerPort;\n  clock: EditableArtifactMaterializerClockPort;\n  logger?: EditableArtifactMaterializerLoggerPort;\n  metrics?: EditableArtifactMaterializerMetricsPort;\n}>;\n\nexport type EditableArtifactMaterializerPassSummary = Readonly<{\n  claimed: number;\n  succeeded: number;\n  deadLettered: number;\n  retryDeferred: number;\n  leaseLost: number;\n  cancelled: number;\n  claimFailed: boolean;\n}>;\n\ntype MutableSummary = {\n  claimed: number;\n  succeeded: number;\n  deadLettered: number;\n  retryDeferred: number;\n  leaseLost: number;\n  cancelled: number;\n  claimFailed: boolean;\n};\n\ntype NormalizedOptions = Required<EditableArtifactMaterializerOptions>;\n\nconst DEFAULT_OPTIONS = Object.freeze({\n  batchSize: 8,\n  concurrency: 2,\n  leaseDurationMs: 120_000,\n  leaseRenewIntervalMs: 30_000,\n  pollIntervalMs: 1_000,\n  claimBackoffMs: 5_000,\n  maxAttempts: EDITABLE_ARTIFACT_MATERIALIZER_MAX_ATTEMPTS,\n  maxSourceBytes: EDITABLE_ARTIFACT_MATERIALIZER_MAX_SOURCE_BYTES,\n  maxOutputBytes: EDITABLE_ARTIFACT_MATERIALIZER_MAX_OUTPUT_BYTES,\n});\n\n/** Closed, diagnostics-free terminal failure codes persisted in Postgres. */\nexport type EditableArtifactMaterializerDeadLetterCode =\n  | \"invalid_job_manifest\"\n  | \"source_identity_mismatch\"\n  | \"source_size_limit\"\n  | \"kernel_incompatible\"\n  | \"kernel_result_mismatch\"\n  | \"unsupported_semantics\"\n  | \"output_size_limit\"\n  | \"output_verification_failed\"\n  | \"retry_exhausted\";\n\nexport type EditableArtifactMaterializerFailureDiagnostic = Readonly<{\n  stage: \"source_reader\" | \"native\";\n  subcode:\n    | \"open\"\n    | \"content_type\"\n    | \"stream_identity\"\n    | \"revalidate\"\n    | \"input_framing\"\n    | \"snapshot_open\"\n    | \"state_mismatch\";\n}>;\n\nexport class EditableArtifactMaterializerPermanentError extends Error {\n  constructor(\n    readonly code: EditableArtifactMaterializerDeadLetterCode,\n    readonly diagnostic?: EditableArtifactMaterializerFailureDiagnostic,\n  ) {\n    super(`Editable artifact materialization cannot continue: ${code}`);\n    this.name = \"EditableArtifactMaterializerPermanentError\";\n  }\n}\n\nexport class EditableArtifactMaterializerLeaseLostError extends Error {\n  constructor() {\n    super(\"Editable artifact materialization lease was lost\");\n    this.name = \"EditableArtifactMaterializerLeaseLostError\";\n  }\n}\n\n/**\n * At-least-once materialization loop. Immutable content-addressed output makes\n * recomputation safe; owner + attemptCount fences make DB settlement exact.\n */\nexport class EditableArtifactMaterializer {\n  readonly #options: NormalizedOptions;\n  #activePass: Promise<EditableArtifactMaterializerPassSummary> | null = null;\n\n  constructor(\n    private readonly dependencies: EditableArtifactMaterializerDependencies,\n    options: EditableArtifactMaterializerOptions,\n    securityPolicy: Readonly<{ allowUnsandboxedDevelopment?: boolean }> = {},\n  ) {\n    this.#options = normalizeOptions(options);\n    assertNativeKernelIdentity(\n      dependencies.kernel.identity,\n      securityPolicy.allowUnsandboxedDevelopment === true,\n    );\n  }\n\n  async run(signal: AbortSignal): Promise<void> {\n    let claimFailed = false;\n    while (!signal.aborted) {\n      const summary = await this.dispatchOnce(signal);\n      claimFailed = summary.claimFailed;\n      if (signal.aborted) break;\n      const delay = claimFailed\n        ? this.#options.claimBackoffMs\n        : summary.claimed === 0\n          ? this.#options.pollIntervalMs\n          : 0;\n      if (delay > 0 && !(await sleepOrAbort(this.dependencies.scheduler, delay, signal))) break;\n    }\n    await this.drain();\n  }\n\n  /** Concurrent triggers share one bounded claim pass. */\n  dispatchOnce(signal?: AbortSignal): Promise<EditableArtifactMaterializerPassSummary> {\n    if (this.#activePass) return this.#activePass;\n    const pass = this.#dispatchBatch(signal);\n    this.#activePass = pass;\n    void pass.then(\n      () => {\n        if (this.#activePass === pass) this.#activePass = null;\n      },\n      () => {\n        if (this.#activePass === pass) this.#activePass = null;\n      },\n    );\n    return pass;\n  }\n\n  async drain(): Promise<void> {\n    await this.#activePass;\n  }\n\n  async #dispatchBatch(\n    parentSignal: AbortSignal | undefined,\n  ): Promise<EditableArtifactMaterializerPassSummary> {\n    const summary = mutableSummary();\n    if (parentSignal?.aborted) {\n      return freezeSummary(summary);\n    }\n    let jobs: readonly ClaimedEditableArtifactMaterialization[];\n    try {\n      jobs = await this.dependencies.store.claim({\n        owner: this.#options.owner,\n        leaseDurationMs: this.#options.leaseDurationMs,\n        limit: this.#options.batchSize,\n      });\n      if (!Array.isArray(jobs) || jobs.length > this.#options.batchSize) {\n        throw new TypeError(\"Materialization store returned an invalid claim batch\");\n      }\n    } catch (error) {\n      summary.claimFailed = true;\n      this.#metric(\"claim_failed\");\n      this.#warn(\"Editable artifact materialization claim failed\", \"claim_failed\", error);\n      return freezeSummary(summary);\n    }\n    summary.claimed = jobs.length;\n    if (jobs.length > 0) this.#metric(\"claimed\", jobs.length);\n\n    let cursor = 0;\n    const worker = async (): Promise<void> => {\n      for (;;) {\n        const index = cursor;\n        cursor += 1;\n        const job = jobs[index];\n        if (!job) return;\n        await this.#processJob(job, summary, parentSignal);\n      }\n    };\n    await Promise.all(\n      Array.from({ length: Math.min(jobs.length, this.#options.concurrency) }, worker),\n    );\n    return freezeSummary(summary);\n  }\n\n  async #processJob(\n    job: ClaimedEditableArtifactMaterialization,\n    summary: MutableSummary,\n    parentSignal: AbortSignal | undefined,\n  ): Promise<void> {\n    let lease: EditableArtifactMaterializationLease;\n    try {\n      lease = validateClaimedJob(job, this.#options.owner, this.dependencies.kernel.identity);\n    } catch (error) {\n      await this.#deadLetterBestEffort(job, \"invalid_job_manifest\", summary, error);\n      return;\n    }\n\n    if (job.attemptCount >= this.#options.maxAttempts) {\n      await this.#settlePermanent(lease, \"retry_exhausted\", summary, null);\n      return;\n    }\n\n    const operationAbort = new AbortController();\n    const renewalAbort = new AbortController();\n    const combined = combineAbortSignals(parentSignal, operationAbort.signal);\n    let leaseLost = false;\n    const renewal = this.#renewLease(lease, renewalAbort.signal, operationAbort, () => {\n      leaseLost = true;\n    });\n\n    let source: BoundedObjectRead | null = null;\n    try {\n      throwIfAborted(combined.signal);\n      assertJobKernelCompatibility(job, this.dependencies.kernel.identity);\n      const optionsBytes = canonicalOptionsBytes(job.normalizedOptions, job.optionsHash);\n      if (job.sourceByteSize > this.#options.maxSourceBytes) {\n        throw new EditableArtifactMaterializerPermanentError(\"source_size_limit\");\n      }\n      try {\n        source = await this.dependencies.sourceReader.open({\n          opaqueReference: job.sourceObjectReference,\n          maxBytes: this.#options.maxSourceBytes,\n          expectedByteSize: job.sourceByteSize,\n          signal: combined.signal,\n        });\n      } catch (error) {\n        throw diagnoseSourceReaderFailure(error, \"open\");\n      }\n      if (source.contentType !== undefined && source.contentType !== job.sourceMimeType) {\n        throw new EditableArtifactMaterializerPermanentError(\"source_identity_mismatch\", {\n          stage: \"source_reader\",\n          subcode: \"content_type\",\n        });\n      }\n      let sourceChunks: AsyncIterable<Uint8Array>;\n      try {\n        sourceChunks = source.chunks({ signal: combined.signal });\n      } catch (error) {\n        throw diagnoseSourceReaderFailure(error, \"stream_identity\");\n      }\n      const trackedSource = trackExactStream(\n        sourceChunks,\n        job.sourceByteSize,\n        job.sourceContentHash,\n        \"source_identity_mismatch\",\n        { stage: \"source_reader\", subcode: \"stream_identity\" },\n      );\n      let output: NativeEditableArtifactMaterializationResult;\n      try {\n        output = await this.dependencies.kernel.materialize({\n          job,\n          normalizedOptions: optionsBytes,\n          snapshot: trackedSource.chunks,\n          signal: combined.signal,\n        });\n        await trackedSource.done;\n      } catch (error) {\n        // The source wrapper can reject concurrently with the native adapter\n        // that is consuming it. Observe both promises so corrupt input never\n        // becomes an unhandled rejection after the adapter exits.\n        void trackedSource.done.catch(() => undefined);\n        throw error;\n      }\n      try {\n        await source.assertUnchanged(combined.signal);\n      } catch (error) {\n        throw diagnoseSourceReaderFailure(error, \"revalidate\");\n      }\n      validateKernelResult(job, output);\n\n      const written = await this.dependencies.outputWriter.write({\n        chunks: output.chunks,\n        contentType: output.mimeType,\n        maxBytes: this.#options.maxOutputBytes,\n        ...(output.byteSize !== undefined ? { expectedByteSize: output.byteSize } : {}),\n        ...(output.contentHash !== undefined ? { expectedContentHash: output.contentHash } : {}),\n        signal: combined.signal,\n      });\n      let verified: VerifiedEditableArtifactMaterialization;\n      try {\n        verified = await this.dependencies.outputVerifier.verify({\n          objectReference: written.opaqueReference,\n          expectedByteSize: written.byteSize,\n          expectedContentHash: written.contentHash,\n          expectedMimeType: output.mimeType,\n          format: job.format,\n          codecId: job.codecId,\n          codecVersion: job.codecVersion,\n          expectedSemanticHash: output.semanticHash,\n          maxBytes: this.#options.maxOutputBytes,\n          signal: combined.signal,\n        });\n      } catch (error) {\n        if (error instanceof BoundedObjectReadError) {\n          throw new EditableArtifactMaterializerPermanentError(\"output_verification_failed\");\n        }\n        throw error;\n      }\n      validateIndependentVerification(job, written, verified);\n\n      renewalAbort.abort();\n      await renewal;\n      if (leaseLost) throw new EditableArtifactMaterializerLeaseLostError();\n      throwIfAborted(combined.signal);\n      await this.dependencies.store.renew({\n        ...lease,\n        leaseDurationMs: this.#options.leaseDurationMs,\n      });\n      const ids = deterministicResultIds(job, written.contentHash);\n      await this.dependencies.store.succeed({\n        ...lease,\n        ...ids,\n        objectReference: written.opaqueReference,\n        byteSize: written.byteSize,\n        contentHash: written.contentHash,\n        mimeType: output.mimeType,\n        verifiedAt: this.dependencies.clock.now().toISOString(),\n      });\n      summary.succeeded += 1;\n      this.#metric(\"succeeded\");\n    } catch (error) {\n      renewalAbort.abort();\n      await renewal;\n      if (leaseLost || isLeaseFence(error)) {\n        summary.leaseLost += 1;\n        this.#metric(\"lease_lost\");\n        this.#warn(\"Editable artifact materialization lease was lost\", \"lease_lost\", error);\n      } else if (combined.signal.aborted || isAbortError(error)) {\n        summary.cancelled += 1;\n        this.#metric(\"cancelled\");\n      } else {\n        const permanent = permanentDependencyFailure(error);\n        if (permanent) {\n          await this.#settlePermanent(lease, permanent, summary, error);\n        } else {\n          // Unknown provider/kernel failures are retryable. Do not terminally\n          // settle: expiry lets another owner reclaim the exact immutable input.\n          summary.retryDeferred += 1;\n          this.#metric(\"retry_deferred\");\n          this.#warn(\n            \"Editable artifact materialization will retry after lease expiry\",\n            \"retry_deferred\",\n            error,\n          );\n        }\n      }\n    } finally {\n      renewalAbort.abort();\n      combined.dispose();\n      if (source) await source.close();\n    }\n  }\n\n  async #renewLease(\n    lease: EditableArtifactMaterializationLease,\n    signal: AbortSignal,\n    operationAbort: AbortController,\n    onLeaseLost: () => void,\n  ): Promise<void> {\n    while (\n      await sleepOrAbort(this.dependencies.scheduler, this.#options.leaseRenewIntervalMs, signal)\n    ) {\n      try {\n        await this.dependencies.store.renew({\n          ...lease,\n          leaseDurationMs: this.#options.leaseDurationMs,\n        });\n      } catch (error) {\n        onLeaseLost();\n        operationAbort.abort(error);\n        return;\n      }\n    }\n  }\n\n  async #settlePermanent(\n    lease: EditableArtifactMaterializationLease,\n    code: EditableArtifactMaterializerDeadLetterCode,\n    summary: MutableSummary,\n    cause: unknown,\n  ): Promise<void> {\n    try {\n      await this.dependencies.store.renew({\n        ...lease,\n        leaseDurationMs: this.#options.leaseDurationMs,\n      });\n      await this.dependencies.store.fail({ ...lease, errorCode: code });\n      summary.deadLettered += 1;\n      this.#metric(\"dead_lettered\");\n      if (cause) this.#warn(\"Editable artifact materialization was dead-lettered\", code, cause);\n    } catch (error) {\n      summary.leaseLost += 1;\n      this.#metric(\"lease_lost\");\n      this.#warn(\"Editable artifact dead-letter settlement was fenced\", \"lease_lost\", error);\n    }\n  }\n\n  async #deadLetterBestEffort(\n    job: ClaimedEditableArtifactMaterialization,\n    code: EditableArtifactMaterializerDeadLetterCode,\n    summary: MutableSummary,\n    cause: unknown,\n  ): Promise<void> {\n    try {\n      const lease = rawLease(job, this.#options.owner);\n      await this.#settlePermanent(lease, code, summary, cause);\n    } catch (error) {\n      summary.leaseLost += 1;\n      this.#metric(\"lease_lost\");\n      this.#warn(\"Invalid materialization claim could not be settled\", \"lease_lost\", error);\n    }\n  }\n\n  #metric(outcome: EditableArtifactMaterializerMetricOutcome, count = 1): void {\n    try {\n      this.dependencies.metrics?.increment(outcome, count);\n    } catch {\n      // Observability is never part of the correctness boundary.\n    }\n  }\n\n  #warn(message: string, code: string, error: unknown): void {\n    try {\n      this.dependencies.logger?.warn(message, {\n        code,\n        errorClass: error instanceof Error ? error.name : \"UnknownError\",\n        ...(error instanceof EditableArtifactMaterializerPermanentError && error.diagnostic\n          ? {\n              failureStage: error.diagnostic.stage,\n              failureSubcode: error.diagnostic.subcode,\n            }\n          : {}),\n      });\n    } catch {\n      // Logging is never part of the correctness boundary.\n    }\n  }\n}\n\nexport type ConfiguredEditableArtifactMaterializerInput = Readonly<{\n  enabled: boolean;\n  databaseRole: string | null | undefined;\n  objectStorageConfigured: boolean;\n  dependencies?: Partial<EditableArtifactMaterializerDependencies>;\n  options?: EditableArtifactMaterializerOptions;\n  /** Explicit local-development exception; production callers must omit it. */\n  allowUnsandboxedDevelopment?: boolean;\n}>;\n\n/**\n * Production gate. Disabled is the default. Once enabled, every privileged\n * dependency and the dedicated database role are mandatory—there is no\n * reference-kernel, mutable-storage, or tenant-role fallback.\n */\nexport function createConfiguredEditableArtifactMaterializer(\n  input: ConfiguredEditableArtifactMaterializerInput,\n): EditableArtifactMaterializer | null {\n  if (!input.enabled) return null;\n  if (input.databaseRole !== EDITABLE_ARTIFACT_MATERIALIZER_DATABASE_ROLE) {\n    throw new Error(\"Editable artifact materializer requires its dedicated database role\");\n  }\n  if (!input.objectStorageConfigured) {\n    throw new Error(\"Editable artifact materializer requires immutable object storage\");\n  }\n  const dependencies = input.dependencies;\n  if (\n    !dependencies?.store ||\n    !dependencies.sourceReader ||\n    !dependencies.outputWriter ||\n    !dependencies.outputVerifier ||\n    !dependencies.kernel ||\n    !dependencies.scheduler ||\n    !dependencies.clock\n  ) {\n    throw new Error(\"Editable artifact materializer dependencies are incomplete\");\n  }\n  assertNativeKernelIdentity(\n    dependencies.kernel.identity,\n    input.allowUnsandboxedDevelopment === true,\n  );\n  if (!input.options) throw new Error(\"Editable artifact materializer options are required\");\n  return new EditableArtifactMaterializer(\n    dependencies as EditableArtifactMaterializerDependencies,\n    input.options,\n    input.allowUnsandboxedDevelopment === undefined\n      ? {}\n      : { allowUnsandboxedDevelopment: input.allowUnsandboxedDevelopment },\n  );\n}\n\nexport const systemEditableArtifactMaterializerScheduler: EditableArtifactMaterializerSchedulerPort =\n  Object.freeze({\n    sleep(milliseconds: number, signal: AbortSignal): Promise<void> {\n      return new Promise<void>((resolve, reject) => {\n        if (signal.aborted) {\n          reject(signal.reason ?? abortError());\n          return;\n        }\n        const complete = () => {\n          signal.removeEventListener(\"abort\", abort);\n          resolve();\n        };\n        const timer = setTimeout(complete, milliseconds);\n        timer.unref?.();\n        const abort = () => {\n          clearTimeout(timer);\n          signal.removeEventListener(\"abort\", abort);\n          reject(signal.reason ?? abortError());\n        };\n        signal.addEventListener(\"abort\", abort, { once: true });\n      });\n    },\n  });\n\nexport const systemEditableArtifactMaterializerClock: EditableArtifactMaterializerClockPort =\n  Object.freeze({ now: () => new Date() });\n\nfunction normalizeOptions(options: EditableArtifactMaterializerOptions): NormalizedOptions {\n  const normalized: NormalizedOptions = Object.freeze({\n    owner: validateOwner(options.owner),\n    batchSize: options.batchSize ?? DEFAULT_OPTIONS.batchSize,\n    concurrency: options.concurrency ?? DEFAULT_OPTIONS.concurrency,\n    leaseDurationMs: options.leaseDurationMs ?? DEFAULT_OPTIONS.leaseDurationMs,\n    leaseRenewIntervalMs: options.leaseRenewIntervalMs ?? DEFAULT_OPTIONS.leaseRenewIntervalMs,\n    pollIntervalMs: options.pollIntervalMs ?? DEFAULT_OPTIONS.pollIntervalMs,\n    claimBackoffMs: options.claimBackoffMs ?? DEFAULT_OPTIONS.claimBackoffMs,\n    maxAttempts: options.maxAttempts ?? DEFAULT_OPTIONS.maxAttempts,\n    maxSourceBytes: options.maxSourceBytes ?? DEFAULT_OPTIONS.maxSourceBytes,\n    maxOutputBytes: options.maxOutputBytes ?? DEFAULT_OPTIONS.maxOutputBytes,\n  });\n  for (const [label, value] of Object.entries(normalized)) {\n    if (label === \"owner\") continue;\n    positiveInteger(value, label);\n  }\n  if (normalized.batchSize > 64) throw new TypeError(\"materializer batch size exceeds 64\");\n  if (normalized.concurrency > normalized.batchSize) {\n    throw new TypeError(\"materializer concurrency exceeds its batch size\");\n  }\n  if (normalized.leaseDurationMs < 10_000 || normalized.leaseDurationMs > 86_400_000) {\n    throw new TypeError(\"materializer lease duration must be 10 seconds to 24 hours\");\n  }\n  if (normalized.leaseRenewIntervalMs * 2 >= normalized.leaseDurationMs) {\n    throw new TypeError(\"materializer renewal interval must be less than half its lease\");\n  }\n  if (normalized.maxAttempts > 1_000) throw new TypeError(\"materializer attempts exceed 1000\");\n  if (normalized.maxSourceBytes > EDITABLE_ARTIFACT_MATERIALIZER_MAX_SOURCE_BYTES) {\n    throw new TypeError(\"materializer source limit exceeds the protocol maximum\");\n  }\n  if (normalized.maxOutputBytes > EDITABLE_ARTIFACT_MATERIALIZER_MAX_OUTPUT_BYTES) {\n    throw new TypeError(\"materializer output limit exceeds the protocol maximum\");\n  }\n  return normalized;\n}\n\nfunction validateClaimedJob(\n  job: ClaimedEditableArtifactMaterialization,\n  owner: string,\n  kernel: NativeEditableArtifactMaterializerIdentity,\n): EditableArtifactMaterializationLease {\n  const lease = rawLease(job, owner);\n  if (job.leaseOwner !== owner) throw new TypeError(\"claimed job belongs to another owner\");\n  positiveInteger(job.targetHeadSequence + 1, \"target head sequence + 1\");\n  positiveInteger(job.sourceByteSize, \"source byte size\");\n  positiveInteger(job.modelSchemaVersion, \"model schema version\");\n  positiveInteger(job.operationProtocolVersion, \"operation protocol version\");\n  positiveInteger(job.snapshotProtocolVersion, \"snapshot protocol version\");\n  positiveInteger(job.attemptCount, \"attempt count\");\n  stableId(job.artifactId, \"artifact id\");\n  stableId(job.jobId, \"job id\");\n  stableId(job.inputSnapshotId, \"input snapshot id\");\n  if (job.versionId !== null) stableId(job.versionId, \"version id\");\n  canonicalHash(job.stateHash, \"state hash\");\n  canonicalHash(job.sourceContentHash, \"source content hash\");\n  canonicalHash(job.optionsHash, \"options hash\");\n  canonicalHash(job.fontRegistryHash, \"font registry hash\");\n  canonicalHash(job.policyHash, \"policy hash\");\n  boundedText(job.sourceObjectReference, \"source object reference\", 2_048);\n  boundedText(job.sourceMimeType, \"source mime type\", 256);\n  boundedText(job.codecId, \"codec id\", 128);\n  boundedText(job.codecVersion, \"codec version\", 128);\n  boundedText(job.kernelVersion, \"kernel version\", EDITABLE_ARTIFACT_KERNEL_VERSION_MAX_BYTES);\n  validateFormatForModality(job.modality, job.format);\n  assertJobKernelCompatibility(job, kernel);\n  return lease;\n}\n\nfunction rawLease(\n  job: ClaimedEditableArtifactMaterialization,\n  owner: string,\n): EditableArtifactMaterializationLease {\n  boundedText(job.scope?.accountId, \"account id\", 128);\n  boundedText(job.scope?.workspaceId, \"workspace id\", 128);\n  stableId(job.artifactId, \"artifact id\");\n  stableId(job.jobId, \"job id\");\n  positiveInteger(job.attemptCount, \"attempt count\");\n  validateOwner(owner);\n  return Object.freeze({\n    scope: Object.freeze({ ...job.scope }),\n    artifactId: job.artifactId,\n    jobId: job.jobId,\n    owner,\n    attemptCount: job.attemptCount,\n  });\n}\n\nfunction assertNativeKernelIdentity(\n  identity: NativeEditableArtifactMaterializerIdentity,\n  allowUnsandboxedDevelopment = false,\n): void {\n  if (\n    identity.kind !== \"native\" ||\n    identity.isolation !== \"subprocess\" ||\n    identity.officeAutomation !== false\n  ) {\n    throw new Error(\"Editable artifact materializer requires an isolated native kernel\");\n  }\n  if (identity.processProtocolVersion !== 1) {\n    throw new Error(\"Editable artifact materializer subprocess protocol is not enforced\");\n  }\n  if (identity.sandboxEnforced) {\n    if (identity.network !== \"denied\") {\n      throw new Error(\"Editable artifact materializer sandbox network policy is invalid\");\n    }\n    positiveInteger(identity.memoryLimitBytes, \"kernel memory limit\");\n    positiveInteger(identity.cpuTimeLimitMs, \"kernel CPU time limit\");\n    positiveInteger(identity.fileDescriptorLimit, \"kernel file descriptor limit\");\n    positiveInteger(identity.processLimit, \"kernel process limit\");\n    positiveInteger(identity.fileSizeLimitBytes, \"kernel file size limit\");\n  } else if (\n    !allowUnsandboxedDevelopment ||\n    identity.network !== \"host\" ||\n    identity.memoryLimitBytes !== 0 ||\n    identity.cpuTimeLimitMs !== 0 ||\n    identity.fileDescriptorLimit !== 0 ||\n    identity.processLimit !== 0 ||\n    identity.fileSizeLimitBytes !== 0\n  ) {\n    throw new Error(\"Editable artifact materializer subprocess protocol is not enforced\");\n  }\n  positiveInteger(identity.maxOutputBytes, \"kernel output limit\");\n  boundedText(identity.kernelVersion, \"kernel version\", EDITABLE_ARTIFACT_KERNEL_VERSION_MAX_BYTES);\n  boundedText(identity.runtimeTarget, \"kernel runtime target\", 128);\n  canonicalHash(identity.fontRegistryHash, \"font registry hash\");\n  canonicalHash(identity.policyHash, \"policy hash\");\n  if (!identity.codecVersions || typeof identity.codecVersions !== \"object\") {\n    throw new Error(\"Editable artifact materializer codec registry is unavailable\");\n  }\n  for (const [codecId, version] of Object.entries(identity.codecVersions)) {\n    boundedText(codecId, \"codec id\", 128);\n    boundedText(version, \"codec version\", 128);\n  }\n  for (const [label, values, expected] of [\n    [\n      \"model schema versions\",\n      identity.supportedModelSchemaVersions,\n      SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,\n    ],\n    [\n      \"operation protocol versions\",\n      identity.supportedOperationProtocolVersions,\n      COMMITTED_TRANSACTION_PROTOCOL_VERSION,\n    ],\n    [\n      \"snapshot protocol versions\",\n      identity.supportedSnapshotProtocolVersions,\n      SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION,\n    ],\n  ] as const) {\n    if (!Array.isArray(values) || values.length !== 1 || values[0] !== expected) {\n      throw new Error(`Editable artifact kernel ${label} are not current-only`);\n    }\n  }\n}\n\nfunction assertJobKernelCompatibility(\n  job: ClaimedEditableArtifactMaterialization,\n  identity: NativeEditableArtifactMaterializerIdentity,\n): void {\n  const compatible =\n    identity.kernelVersion === job.kernelVersion &&\n    identity.codecVersions[job.codecId] === job.codecVersion &&\n    identity.fontRegistryHash === job.fontRegistryHash &&\n    identity.policyHash === job.policyHash &&\n    job.modelSchemaVersion === identity.supportedModelSchemaVersions[0] &&\n    job.operationProtocolVersion === identity.supportedOperationProtocolVersions[0] &&\n    job.snapshotProtocolVersion === identity.supportedSnapshotProtocolVersions[0];\n  if (!compatible) throw new EditableArtifactMaterializerPermanentError(\"kernel_incompatible\");\n}\n\nfunction validateKernelResult(\n  job: ClaimedEditableArtifactMaterialization,\n  result: NativeEditableArtifactMaterializationResult,\n): void {\n  if (\n    result.headSequence !== job.targetHeadSequence ||\n    result.stateHash !== job.stateHash ||\n    result.format !== job.format ||\n    result.mimeType !== mimeTypeForFormat(job.format) ||\n    result.codecId !== job.codecId ||\n    result.codecVersion !== job.codecVersion ||\n    result.kernelVersion !== job.kernelVersion ||\n    result.fontRegistryHash !== job.fontRegistryHash ||\n    result.policyHash !== job.policyHash ||\n    !result.chunks ||\n    typeof result.chunks[Symbol.asyncIterator] !== \"function\"\n  ) {\n    throw new EditableArtifactMaterializerPermanentError(\"kernel_result_mismatch\");\n  }\n  if (result.byteSize !== undefined) positiveInteger(result.byteSize, \"kernel output bytes\");\n  if (result.contentHash !== undefined) canonicalHash(result.contentHash, \"kernel output hash\");\n  canonicalHash(result.semanticHash, \"kernel semantic hash\");\n}\n\nfunction validateIndependentVerification(\n  job: ClaimedEditableArtifactMaterialization,\n  written: {\n    opaqueReference: string;\n    byteSize: number;\n    contentHash: string;\n    contentType: string;\n  },\n  verified: VerifiedEditableArtifactMaterialization,\n): void {\n  if (\n    verified.objectReference !== written.opaqueReference ||\n    verified.byteSize !== written.byteSize ||\n    verified.contentHash !== written.contentHash ||\n    verified.mimeType !== written.contentType ||\n    verified.format !== job.format ||\n    verified.codecId !== job.codecId ||\n    verified.codecVersion !== job.codecVersion\n  ) {\n    throw new EditableArtifactMaterializerPermanentError(\"output_verification_failed\");\n  }\n}\n\nfunction canonicalOptionsBytes(value: string, expectedHash: string): Uint8Array {\n  if (typeof value !== \"string\") {\n    throw new EditableArtifactMaterializerPermanentError(\"invalid_job_manifest\");\n  }\n  const bytes = new TextEncoder().encode(value);\n  if (bytes.byteLength > EDITABLE_ARTIFACT_MATERIALIZER_MAX_OPTIONS_BYTES) {\n    throw new EditableArtifactMaterializerPermanentError(\"invalid_job_manifest\");\n  }\n  try {\n    const parsed = JSON.parse(value) as unknown;\n    if (JSON.stringify(parsed) !== value) {\n      throw new Error(\"non-canonical options\");\n    }\n  } catch {\n    throw new EditableArtifactMaterializerPermanentError(\"invalid_job_manifest\");\n  }\n  if (hashBytes(bytes) !== expectedHash) {\n    throw new EditableArtifactMaterializerPermanentError(\"invalid_job_manifest\");\n  }\n  return bytes;\n}\n\nfunction trackExactStream(\n  source: AsyncIterable<Uint8Array>,\n  expectedByteSize: number,\n  expectedContentHash: string,\n  code: EditableArtifactMaterializerDeadLetterCode,\n  diagnostic?: EditableArtifactMaterializerFailureDiagnostic,\n): { chunks: AsyncIterable<Uint8Array>; done: Promise<void> } {\n  let settle!: () => void;\n  let reject!: (error: unknown) => void;\n  const done = new Promise<void>((resolve, rejectPromise) => {\n    settle = resolve;\n    reject = rejectPromise;\n  });\n  let claimed = false;\n  const chunks: AsyncIterable<Uint8Array> = Object.freeze({\n    async *[Symbol.asyncIterator](): AsyncIterableIterator<Uint8Array> {\n      if (claimed) {\n        const error = new EditableArtifactMaterializerPermanentError(code, diagnostic);\n        reject(error);\n        throw error;\n      }\n      claimed = true;\n      const digest = createHash(\"sha256\");\n      let byteSize = 0;\n      try {\n        for await (const chunk of source) {\n          if (!(chunk instanceof Uint8Array) || chunk.byteLength === 0) {\n            throw new EditableArtifactMaterializerPermanentError(code, diagnostic);\n          }\n          byteSize += chunk.byteLength;\n          if (byteSize > expectedByteSize) {\n            throw new EditableArtifactMaterializerPermanentError(code, diagnostic);\n          }\n          digest.update(chunk);\n          yield chunk.slice();\n        }\n        if (byteSize !== expectedByteSize) {\n          throw new EditableArtifactMaterializerPermanentError(code, diagnostic);\n        }\n        const contentHash = `sha256:${digest.digest(\"hex\")}`;\n        if (contentHash !== expectedContentHash) {\n          throw new EditableArtifactMaterializerPermanentError(code, diagnostic);\n        }\n        settle();\n      } catch (error) {\n        const diagnosed = diagnoseSourceReaderFailure(error, \"stream_identity\");\n        reject(diagnosed);\n        throw diagnosed;\n      }\n    },\n  });\n  return { chunks, done };\n}\n\nfunction diagnoseSourceReaderFailure(\n  error: unknown,\n  subcode: Extract<\n    EditableArtifactMaterializerFailureDiagnostic[\"subcode\"],\n    \"open\" | \"stream_identity\" | \"revalidate\"\n  >,\n): unknown {\n  const code = permanentDependencyFailure(error);\n  return code\n    ? new EditableArtifactMaterializerPermanentError(code, { stage: \"source_reader\", subcode })\n    : error;\n}\n\nfunction deterministicResultIds(\n  job: ClaimedEditableArtifactMaterialization,\n  contentHash: string,\n): { resultId: string; blobRefId: string } {\n  return {\n    resultId: deterministicStableId(\"result\", job, contentHash),\n    blobRefId: deterministicStableId(\"blob\", job, contentHash),\n  };\n}\n\nfunction deterministicStableId(\n  kind: \"result\" | \"blob\",\n  job: ClaimedEditableArtifactMaterialization,\n  contentHash: string,\n): string {\n  const digest = createHash(\"sha256\");\n  digest.update(`OpenGeni editable artifact materialization ${kind}\\0v1\\0`, \"utf8\");\n  for (const value of [\n    job.scope.accountId,\n    job.scope.workspaceId,\n    job.artifactId,\n    job.jobId,\n    contentHash,\n  ]) {\n    const bytes = Buffer.from(value, \"utf8\");\n    const length = Buffer.allocUnsafe(4);\n    length.writeUInt32BE(bytes.byteLength);\n    digest.update(length);\n    digest.update(bytes);\n  }\n  const id = digest.digest(\"hex\").slice(0, 32);\n  return /^0+$/u.test(id) ? `1${id.slice(1)}` : id;\n}\n\nfunction hashBytes(bytes: Uint8Array): string {\n  return `sha256:${createHash(\"sha256\").update(bytes).digest(\"hex\")}`;\n}\n\nfunction validateFormatForModality(\n  modality: EditableArtifactMaterializationModality,\n  format: EditableArtifactMaterializationFormat,\n): void {\n  const allowed: Readonly<Record<EditableArtifactMaterializationModality, readonly string[]>> = {\n    spreadsheet: [\"xlsx\", \"pdf\", \"png\", \"webp\"],\n    presentation: [\"pptx\", \"pdf\", \"png\", \"webp\"],\n    document: [\"docx\", \"pdf\", \"png\", \"webp\"],\n  };\n  if (!allowed[modality]?.includes(format)) {\n    throw new TypeError(\"materialization format does not match artifact modality\");\n  }\n}\n\nexport function mimeTypeForFormat(\n  format: EditableArtifactMaterializationFormat,\n): EditableArtifactMaterializationMimeType {\n  switch (format) {\n    case \"xlsx\":\n      return \"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet\";\n    case \"pptx\":\n      return \"application/vnd.openxmlformats-officedocument.presentationml.presentation\";\n    case \"docx\":\n      return \"application/vnd.openxmlformats-officedocument.wordprocessingml.document\";\n    case \"pdf\":\n      return \"application/pdf\";\n    case \"png\":\n      return \"image/png\";\n    case \"webp\":\n      return \"image/webp\";\n  }\n}\n\nfunction validateOwner(value: unknown): string {\n  if (\n    typeof value !== \"string\" ||\n    value.length < 1 ||\n    value.length > 256 ||\n    value.trim() !== value ||\n    !/^[A-Za-z0-9._:-]+$/u.test(value)\n  ) {\n    throw new TypeError(\"materializer owner is invalid\");\n  }\n  return value;\n}\n\nfunction stableId(value: unknown, label: string): string {\n  if (typeof value !== \"string\" || !/^[0-9a-f]{32}$/u.test(value) || /^0+$/u.test(value)) {\n    throw new TypeError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction canonicalHash(value: unknown, label: string): string {\n  if (typeof value !== \"string\" || !/^sha256:[0-9a-f]{64}$/u.test(value)) {\n    throw new TypeError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction boundedText(value: unknown, label: string, maxBytes: number): string {\n  if (\n    typeof value !== \"string\" ||\n    value.length === 0 ||\n    new TextEncoder().encode(value).byteLength > maxBytes ||\n    value.trim() !== value ||\n    /[\\u0000-\\u001f\\u007f]/u.test(value)\n  ) {\n    throw new TypeError(`${label} is invalid`);\n  }\n  return value;\n}\n\nfunction positiveInteger(value: unknown, label: string): number {\n  if (typeof value !== \"number\" || !Number.isSafeInteger(value) || value <= 0) {\n    throw new TypeError(`${label} must be a positive safe integer`);\n  }\n  return value;\n}\n\nfunction isLeaseFence(error: unknown): boolean {\n  return (\n    error instanceof EditableArtifactMaterializerLeaseLostError ||\n    (typeof error === \"object\" &&\n      error !== null &&\n      \"code\" in error &&\n      error.code === \"lease_fenced\")\n  );\n}\n\nfunction permanentDependencyFailure(\n  error: unknown,\n): EditableArtifactMaterializerDeadLetterCode | null {\n  if (error instanceof EditableArtifactMaterializerPermanentError) return error.code;\n  if (error instanceof BoundedObjectReadError) {\n    if (error.code === \"size_limit\") return \"source_size_limit\";\n    if (\n      error.code === \"object_changed\" ||\n      error.code === \"truncated\" ||\n      error.code === \"object_missing\" ||\n      error.code === \"invalid_request\"\n    ) {\n      return \"source_identity_mismatch\";\n    }\n  }\n  if (error instanceof BoundedObjectWriteError) {\n    if (error.code === \"size_limit\") return \"output_size_limit\";\n    if (\n      error.code === \"content_hash_mismatch\" ||\n      error.code === \"readback_mismatch\" ||\n      error.code === \"truncated\" ||\n      error.code === \"invalid_request\"\n    ) {\n      return \"output_verification_failed\";\n    }\n  }\n  return null;\n}\n\nfunction isAbortError(error: unknown): boolean {\n  return error instanceof DOMException\n    ? error.name === \"AbortError\"\n    : error instanceof Error && error.name === \"AbortError\";\n}\n\nfunction throwIfAborted(signal: AbortSignal): void {\n  if (signal.aborted) throw signal.reason ?? abortError();\n}\n\nfunction abortError(): DOMException {\n  return new DOMException(\"Operation aborted\", \"AbortError\");\n}\n\nfunction combineAbortSignals(\n  first: AbortSignal | undefined,\n  second: AbortSignal,\n): { signal: AbortSignal; dispose(): void } {\n  const controller = new AbortController();\n  const sources = first ? [first, second] : [second];\n  const listeners: Array<readonly [AbortSignal, () => void]> = [];\n  for (const source of sources) {\n    const listener = () => controller.abort(source.reason);\n    if (source.aborted) listener();\n    else {\n      source.addEventListener(\"abort\", listener, { once: true });\n      listeners.push([source, listener]);\n    }\n  }\n  return {\n    signal: controller.signal,\n    dispose() {\n      for (const [source, listener] of listeners) {\n        source.removeEventListener(\"abort\", listener);\n      }\n    },\n  };\n}\n\nasync function sleepOrAbort(\n  scheduler: EditableArtifactMaterializerSchedulerPort,\n  milliseconds: number,\n  signal: AbortSignal,\n): Promise<boolean> {\n  try {\n    await scheduler.sleep(milliseconds, signal);\n    return true;\n  } catch (error) {\n    if (signal.aborted || isAbortError(error)) return false;\n    throw error;\n  }\n}\n\nfunction mutableSummary(): MutableSummary {\n  return {\n    claimed: 0,\n    succeeded: 0,\n    deadLettered: 0,\n    retryDeferred: 0,\n    leaseLost: 0,\n    cancelled: 0,\n    claimFailed: false,\n  };\n}\n\nfunction freezeSummary(summary: MutableSummary): EditableArtifactMaterializerPassSummary {\n  return Object.freeze({ ...summary });\n}\n","import { createHash } from \"node:crypto\";\nimport { chmod, mkdtemp, open, rm, type FileHandle } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\n\nimport {\n  BoundedObjectReadError,\n  createObjectStorageBoundedPorts,\n  type BoundedImmutableObjectWritePort,\n  type BoundedObjectReadPort,\n  type ObjectStorage,\n} from \"@opengeni/storage\";\n\nimport {\n  EditableArtifactMaterializerPermanentError,\n  mimeTypeForFormat,\n  type EditableArtifactMaterializationFormat,\n  type EditableArtifactMaterializationMimeType,\n  type EditableArtifactMaterializationSemanticVerifierPort,\n  type EditableArtifactMaterializationVerifierPort,\n  type VerifiedEditableArtifactMaterialization,\n} from \"./editable-artifact-materializer\";\n\nconst SHA256 = /^sha256:[0-9a-f]{64}$/u;\nconst SNAPSHOT_KEY_PREFIX = \"editable-artifacts/snapshots/sha256/\";\nconst MATERIALIZATION_KEY_PREFIX = \"editable-artifacts/materializations/v1/sha256/\";\nconst SEMANTIC_VERIFIER_CHUNK_BYTES = 1024 * 1024;\nconst ZIP_EOCD_SEARCH_BYTES = 65_557;\nconst MAX_ZIP_ENTRY_NAME_BYTES = 4_096;\nconst MAX_ZIP_TOTAL_NAME_BYTES = 16 * 1024 * 1024;\n\n/** Provider-versioned, immutable range reader. No whole-object fallback. */\nexport function createEditableArtifactObjectStorageReader(\n  storage: ObjectStorage,\n): BoundedObjectReadPort {\n  return createObjectStorageBoundedPorts(storage, { keyPrefix: SNAPSHOT_KEY_PREFIX }).read;\n}\n\n/** Conditional-create digest writer with independent version-pinned readback. */\nexport function createEditableArtifactObjectStorageWriter(\n  storage: ObjectStorage,\n): BoundedImmutableObjectWritePort {\n  return createObjectStorageBoundedPorts(storage, {\n    keyPrefix: MATERIALIZATION_KEY_PREFIX,\n  }).write;\n}\n\n/**\n * Independent immutable readback + structural parser. When the native source\n * projection supplies a semantic digest, a second isolated codec process must\n * re-import the published Office bytes and prove that digest before success.\n */\nexport function createEditableArtifactObjectStorageVerifier(\n  storage: ObjectStorage,\n  semanticVerifier: EditableArtifactMaterializationSemanticVerifierPort,\n): EditableArtifactMaterializationVerifierPort {\n  const read = createObjectStorageBoundedPorts(storage, {\n    keyPrefix: MATERIALIZATION_KEY_PREFIX,\n  }).read;\n  return Object.freeze({\n    async verify(\n      input: Parameters<EditableArtifactMaterializationVerifierPort[\"verify\"]>[0],\n    ): Promise<VerifiedEditableArtifactMaterialization> {\n      validateReference(input.objectReference);\n      validateLimit(input.maxBytes);\n      if (\n        !Number.isSafeInteger(input.expectedByteSize) ||\n        input.expectedByteSize <= 0 ||\n        input.expectedByteSize > input.maxBytes ||\n        !SHA256.test(input.expectedContentHash)\n      ) {\n        throw new BoundedObjectReadError(\"invalid_request\");\n      }\n      throwIfAborted(input.signal);\n      const stagingDirectory = await mkdtemp(join(tmpdir(), \"opengeni-artifact-verify-\"));\n      const stagingPath = join(stagingDirectory, \"payload\");\n      let stagingHandle: FileHandle | null = null;\n      try {\n        await chmod(stagingDirectory, 0o700);\n        stagingHandle = await open(stagingPath, \"wx\", 0o600);\n        const reader = await read.open({\n          opaqueReference: input.objectReference,\n          maxBytes: input.maxBytes,\n          expectedByteSize: input.expectedByteSize,\n          signal: input.signal,\n        });\n        try {\n          if (reader.contentType !== undefined && reader.contentType !== input.expectedMimeType) {\n            throw new BoundedObjectReadError(\"object_changed\");\n          }\n          const digest = createHash(\"sha256\");\n          let offset = 0;\n          for await (const chunk of reader.chunks({ signal: input.signal })) {\n            if (offset + chunk.byteLength > input.expectedByteSize) {\n              throw new BoundedObjectReadError(\"object_changed\");\n            }\n            await writeAll(stagingHandle, chunk, offset);\n            digest.update(chunk);\n            offset += chunk.byteLength;\n          }\n          if (\n            offset !== input.expectedByteSize ||\n            `sha256:${digest.digest(\"hex\")}` !== input.expectedContentHash\n          ) {\n            throw new BoundedObjectReadError(\"object_changed\");\n          }\n          await reader.assertUnchanged(input.signal);\n        } finally {\n          await reader.close();\n        }\n        await stagingHandle.close();\n        stagingHandle = null;\n        await verifyFormat(\n          stagingPath,\n          input.expectedByteSize,\n          input.format,\n          input.expectedMimeType,\n          input.signal,\n        );\n        try {\n          await semanticVerifier.verify({\n            format: input.format,\n            codecId: input.codecId,\n            codecVersion: input.codecVersion,\n            expectedSemanticHash: input.expectedSemanticHash,\n            byteSize: input.expectedByteSize,\n            chunks: fileChunks(stagingPath, input.expectedByteSize, input.signal),\n            signal: input.signal,\n          });\n        } catch (error) {\n          throwIfAborted(input.signal);\n          preserveKernelCompatibilityFailure(error);\n          throw new BoundedObjectReadError(\"object_changed\");\n        }\n        throwIfAborted(input.signal);\n        return Object.freeze({\n          objectReference: input.objectReference,\n          byteSize: input.expectedByteSize,\n          contentHash: input.expectedContentHash,\n          mimeType: input.expectedMimeType,\n          format: input.format,\n          codecId: input.codecId,\n          codecVersion: input.codecVersion,\n        });\n      } finally {\n        if (stagingHandle) await stagingHandle.close().catch(() => undefined);\n        await rm(stagingDirectory, { recursive: true, force: true });\n      }\n    },\n  });\n}\n\nasync function verifyFormat(\n  path: string,\n  byteSize: number,\n  format: EditableArtifactMaterializationFormat,\n  mimeType: EditableArtifactMaterializationMimeType,\n  signal: AbortSignal | undefined,\n): Promise<void> {\n  if (mimeType !== mimeTypeForFormat(format)) {\n    throw new BoundedObjectReadError(\"object_changed\");\n  }\n  const handle = await open(path, \"r\");\n  try {\n    throwIfAborted(signal);\n    switch (format) {\n      case \"xlsx\":\n        await assertOfficePackage(handle, byteSize, \"xl/workbook.xml\", signal);\n        break;\n      case \"pptx\":\n        await assertOfficePackage(handle, byteSize, \"ppt/presentation.xml\", signal);\n        break;\n      case \"docx\":\n        await assertOfficePackage(handle, byteSize, \"word/document.xml\", signal);\n        break;\n      case \"pdf\": {\n        const start = await readExact(handle, 0, 5);\n        const end = await readExact(handle, byteSize - 5, 5);\n        if (!startsWithAscii(start, \"%PDF-\") || !startsWithAscii(end, \"%%EOF\")) {\n          throw new Error(\"invalid PDF framing\");\n        }\n        break;\n      }\n      case \"png\":\n        if (\n          !equalPrefix(\n            await readExact(handle, 0, 8),\n            [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a],\n          )\n        ) {\n          throw new Error(\"invalid PNG signature\");\n        }\n        break;\n      case \"webp\": {\n        const header = await readExact(handle, 0, 12);\n        if (!startsWithAscii(header, \"RIFF\") || !asciiAt(header, 8, \"WEBP\")) {\n          throw new Error(\"invalid WebP signature\");\n        }\n        break;\n      }\n    }\n  } catch {\n    throwIfAborted(signal);\n    throw new BoundedObjectReadError(\"object_changed\");\n  } finally {\n    await handle.close();\n  }\n}\n\nasync function assertOfficePackage(\n  handle: FileHandle,\n  byteSize: number,\n  requiredPart: string,\n  signal: AbortSignal | undefined,\n): Promise<void> {\n  if (!equalPrefix(await readExact(handle, 0, 4), [0x50, 0x4b, 0x03, 0x04])) {\n    throw new Error(\"invalid ZIP\");\n  }\n  const tailSize = Math.min(byteSize, ZIP_EOCD_SEARCH_BYTES);\n  const tail = await readExact(handle, byteSize - tailSize, tailSize);\n  const eocdInTail = findEndOfCentralDirectory(tail);\n  const eocd = byteSize - tailSize + eocdInTail;\n  const view = new DataView(tail.buffer, tail.byteOffset, tail.byteLength);\n  const disk = view.getUint16(eocdInTail + 4, true);\n  const centralDisk = view.getUint16(eocdInTail + 6, true);\n  const diskEntries = view.getUint16(eocdInTail + 8, true);\n  const entries = view.getUint16(eocdInTail + 10, true);\n  const centralSize = view.getUint32(eocdInTail + 12, true);\n  const centralOffset = view.getUint32(eocdInTail + 16, true);\n  const commentLength = view.getUint16(eocdInTail + 20, true);\n  if (\n    disk !== 0 ||\n    centralDisk !== 0 ||\n    diskEntries !== entries ||\n    entries === 0 ||\n    centralSize === 0xffffffff ||\n    centralOffset === 0xffffffff ||\n    eocd + 22 + commentLength !== byteSize ||\n    centralOffset + centralSize !== eocd ||\n    centralOffset > byteSize\n  ) {\n    throw new Error(\"invalid ZIP central directory\");\n  }\n  const names = new Set<string>();\n  let offset = centralOffset;\n  let totalNameBytes = 0;\n  for (let index = 0; index < entries; index += 1) {\n    throwIfAborted(signal);\n    if (offset + 46 > eocd) {\n      throw new Error(\"invalid ZIP entry\");\n    }\n    const header = await readExact(handle, offset, 46);\n    const headerView = new DataView(header.buffer, header.byteOffset, header.byteLength);\n    if (headerView.getUint32(0, true) !== 0x02014b50) throw new Error(\"invalid ZIP entry\");\n    if ((headerView.getUint16(8, true) & 1) !== 0) throw new Error(\"encrypted ZIP entry\");\n    const nameLength = headerView.getUint16(28, true);\n    const extraLength = headerView.getUint16(30, true);\n    const commentBytes = headerView.getUint16(32, true);\n    const next = offset + 46 + nameLength + extraLength + commentBytes;\n    totalNameBytes += nameLength;\n    if (\n      nameLength === 0 ||\n      nameLength > MAX_ZIP_ENTRY_NAME_BYTES ||\n      totalNameBytes > MAX_ZIP_TOTAL_NAME_BYTES ||\n      next > eocd\n    ) {\n      throw new Error(\"truncated ZIP entry\");\n    }\n    const name = new TextDecoder(\"utf-8\", { fatal: true }).decode(\n      await readExact(handle, offset + 46, nameLength),\n    );\n    if (!isSafeZipEntryName(name) || names.has(name)) {\n      throw new Error(\"unsafe ZIP entry name\");\n    }\n    names.add(name);\n    offset = next;\n  }\n  if (offset !== eocd || !names.has(\"[Content_Types].xml\") || !names.has(requiredPart)) {\n    throw new Error(\"Office package is missing required parts\");\n  }\n}\n\nfunction isSafeZipEntryName(name: string): boolean {\n  if (name.startsWith(\"/\") || name.includes(\"\\\\\")) return false;\n  const segments = name.split(\"/\");\n  // Office writers commonly include explicit directory entries. A single\n  // trailing slash is canonical for those entries; empty interior segments\n  // remain forbidden so no alternate path spelling reaches a parser.\n  if (segments.at(-1) === \"\") segments.pop();\n  return (\n    segments.length > 0 &&\n    segments.every((segment) => segment.length > 0 && segment !== \".\" && segment !== \"..\")\n  );\n}\n\nfunction findEndOfCentralDirectory(bytes: Uint8Array): number {\n  const minimum = Math.max(0, bytes.byteLength - 65_557);\n  for (let offset = bytes.byteLength - 22; offset >= minimum; offset -= 1) {\n    if (\n      bytes[offset] === 0x50 &&\n      bytes[offset + 1] === 0x4b &&\n      bytes[offset + 2] === 0x05 &&\n      bytes[offset + 3] === 0x06\n    )\n      return offset;\n  }\n  throw new Error(\"missing ZIP EOCD\");\n}\n\nasync function* fileChunks(\n  path: string,\n  byteSize: number,\n  signal: AbortSignal | undefined,\n): AsyncIterableIterator<Uint8Array> {\n  const handle = await open(path, \"r\");\n  try {\n    let offset = 0;\n    const buffer = new Uint8Array(SEMANTIC_VERIFIER_CHUNK_BYTES);\n    while (offset < byteSize) {\n      throwIfAborted(signal);\n      const length = Math.min(buffer.byteLength, byteSize - offset);\n      const { bytesRead } = await handle.read(buffer, 0, length, offset);\n      if (bytesRead !== length) throw new BoundedObjectReadError(\"object_changed\");\n      offset += bytesRead;\n      yield buffer.slice(0, bytesRead);\n    }\n  } finally {\n    await handle.close();\n  }\n}\n\nasync function writeAll(handle: FileHandle, bytes: Uint8Array, position: number): Promise<void> {\n  let offset = 0;\n  while (offset < bytes.byteLength) {\n    const { bytesWritten } = await handle.write(\n      bytes,\n      offset,\n      bytes.byteLength - offset,\n      position + offset,\n    );\n    if (bytesWritten <= 0) throw new BoundedObjectReadError(\"object_changed\");\n    offset += bytesWritten;\n  }\n}\n\nasync function readExact(\n  handle: FileHandle,\n  position: number,\n  length: number,\n): Promise<Uint8Array> {\n  if (\n    !Number.isSafeInteger(position) ||\n    position < 0 ||\n    !Number.isSafeInteger(length) ||\n    length < 0\n  ) {\n    throw new Error(\"invalid file range\");\n  }\n  const result = new Uint8Array(length);\n  let offset = 0;\n  while (offset < length) {\n    const { bytesRead } = await handle.read(result, offset, length - offset, position + offset);\n    if (bytesRead <= 0) throw new Error(\"truncated file range\");\n    offset += bytesRead;\n  }\n  return result;\n}\n\nfunction validateReference(value: string): void {\n  if (\n    typeof value !== \"string\" ||\n    value.length < 1 ||\n    value.length > 2_048 ||\n    value.trim() !== value ||\n    /[\\u0000-\\u001f\\u007f]/u.test(value)\n  )\n    throw new BoundedObjectReadError(\"invalid_request\");\n}\n\nfunction validateLimit(value: number): void {\n  if (!Number.isSafeInteger(value) || value <= 0) {\n    throw new BoundedObjectReadError(\"invalid_request\");\n  }\n}\n\nfunction throwIfAborted(signal: AbortSignal | undefined): void {\n  if (signal?.aborted) throw new BoundedObjectReadError(\"aborted\");\n}\n\nfunction preserveKernelCompatibilityFailure(error: unknown): void {\n  if (\n    error instanceof EditableArtifactMaterializerPermanentError &&\n    error.code === \"kernel_incompatible\"\n  ) {\n    throw error;\n  }\n}\n\nfunction startsWithAscii(bytes: Uint8Array, value: string): boolean {\n  return asciiAt(bytes, 0, value);\n}\n\nfunction asciiAt(bytes: Uint8Array, offset: number, value: string): boolean {\n  if (offset < 0 || offset + value.length > bytes.byteLength) return false;\n  for (let index = 0; index < value.length; index += 1) {\n    if (bytes[offset + index] !== value.charCodeAt(index)) return false;\n  }\n  return true;\n}\n\nfunction equalPrefix(bytes: Uint8Array, expected: readonly number[]): boolean {\n  return expected.every((value, index) => bytes[index] === value);\n}\n","import { once } from \"node:events\";\nimport { isAbsolute } from \"node:path\";\nimport type { ChildProcessWithoutNullStreams } from \"node:child_process\";\n\nimport { EDITABLE_ARTIFACT_KERNEL_VERSION_MAX_BYTES } from \"@opengeni/contracts/editable-artifacts\";\nimport {\n  COMMITTED_TRANSACTION_PROTOCOL_VERSION,\n  SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,\n  SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION,\n} from \"@opengeni/contracts/editable-artifact-versions\";\n\nimport {\n  EditableArtifactMaterializerPermanentError,\n  mimeTypeForFormat,\n  type ClaimedEditableArtifactMaterialization,\n  type EditableArtifactMaterializerFailureDiagnostic,\n  type NativeEditableArtifactMaterializationResult,\n  type NativeEditableArtifactMaterializerIdentity,\n  type NativeEditableArtifactMaterializerPort,\n} from \"./editable-artifact-materializer\";\n\nconst INPUT_MAGIC = new TextEncoder().encode(\"OGAMI001\");\nconst VERIFY_INPUT_MAGIC = new TextEncoder().encode(\"OGAVI001\");\nconst OUTPUT_MAGIC = new TextEncoder().encode(\"OGAMO001\");\nconst VERIFY_OUTPUT_MAGIC = new TextEncoder().encode(\"OGAVO001\");\nconst ERROR_MAGIC = new TextEncoder().encode(\"OGAME001\");\nconst IDENTITY_ARGUMENT = \"--opengeni-materializer-identity-v1\";\nconst MATERIALIZE_ARGUMENT = \"--opengeni-materialize-v1\";\nconst VERIFY_ARGUMENT = \"--opengeni-verify-materialization-v1\";\nconst MAX_IDENTITY_BYTES = 64 * 1024;\nconst MAX_METADATA_BYTES = 256 * 1024;\nconst MAX_STDERR_BYTES = 64 * 1024;\nconst STREAM_CHUNK_BYTES = 1024 * 1024;\n\nexport type NativeEditableArtifactSubprocessOptions = Readonly<{\n  /** Absolute path to the exact codec executable. Isolation belongs to launcher. */\n  executable: string;\n  launcher: VerifiedEditableArtifactProcessLauncher;\n  childEnvironment?: Readonly<Record<string, string>>;\n  /** Explicitly permits the current-host local-dev launcher; never set in production. */\n  allowUnsandboxedDevelopment?: boolean;\n  wallTimeoutMs: number;\n  maxSourceBytes: number;\n  maxOutputBytes: number;\n  probeTimeoutMs?: number;\n}>;\n\nexport type VerifiedEditableArtifactProcessLauncher = Readonly<{\n  identity: Readonly<{\n    platform: string;\n    isolation: \"subprocess\";\n    network: \"denied\" | \"host\";\n    officeAutomation: false;\n    sandboxEnforced: boolean;\n    memoryLimitBytes: number;\n    cpuTimeLimitMs: number;\n    fileDescriptorLimit: number;\n    processLimit: number;\n    fileSizeLimitBytes: number;\n  }>;\n  spawn(input: {\n    executable: string;\n    args: readonly string[];\n    environment: Readonly<Record<string, string>>;\n  }): ChildProcessWithoutNullStreams;\n}>;\n\ntype IdentityEnvelope = Readonly<{\n  protocol: \"OGAMC001\";\n  runtimeKind: \"native\";\n  runtimeTarget: string;\n  kernelVersion: string;\n  codecVersions: Readonly<Record<string, string>>;\n  fontRegistryHash: string;\n  policyHash: string;\n  maxOutputBytes: number;\n  supportedModelSchemaVersions: readonly [typeof SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION];\n  supportedOperationProtocolVersions: readonly [typeof COMMITTED_TRANSACTION_PROTOCOL_VERSION];\n  supportedSnapshotProtocolVersions: readonly [typeof SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION];\n}>;\n\nexport type NativeEditableArtifactSubprocessPort = NativeEditableArtifactMaterializerPort &\n  Readonly<{\n    verifyMaterialization(input: {\n      format: string;\n      codecId: string;\n      codecVersion: string;\n      expectedSemanticHash: string;\n      byteSize: number;\n      chunks: AsyncIterable<Uint8Array>;\n      signal: AbortSignal;\n    }): Promise<void>;\n  }>;\n\n/**\n * Probe exact codec/kernel capabilities and combine them with independently\n * verified parent-launcher isolation. The child is never trusted to attest its\n * own network namespace, resource limits, or platform sandbox.\n */\nexport async function createNativeEditableArtifactSubprocessPort(\n  options: NativeEditableArtifactSubprocessOptions,\n): Promise<NativeEditableArtifactSubprocessPort> {\n  validateOptions(options);\n  const childIdentity = await probeIdentity(options);\n  validateIdentity(childIdentity);\n  const identity = compositeIdentity(childIdentity, options);\n  return Object.freeze({\n    identity,\n    materialize: async (\n      input: Parameters<NativeEditableArtifactMaterializerPort[\"materialize\"]>[0],\n    ) => await executeMaterialization(options, childIdentity, input),\n    verifyMaterialization: async (\n      input: Parameters<NativeEditableArtifactSubprocessPort[\"verifyMaterialization\"]>[0],\n    ) => await executeVerification(options, childIdentity, input),\n  });\n}\n\nasync function executeMaterialization(\n  options: NativeEditableArtifactSubprocessOptions,\n  identity: IdentityEnvelope,\n  input: Parameters<NativeEditableArtifactMaterializerPort[\"materialize\"]>[0],\n): Promise<NativeEditableArtifactMaterializationResult> {\n  throwIfAborted(input.signal);\n  if (input.job.sourceByteSize > options.maxSourceBytes) {\n    throw new EditableArtifactMaterializerPermanentError(\"source_size_limit\");\n  }\n  const manifest = encodeManifest(input.job, input.normalizedOptions);\n  const child = spawnNative(options, [MATERIALIZE_ARGUMENT]);\n  const terminate = () => terminateChild(child);\n  const timeout = setTimeout(terminate, options.wallTimeoutMs);\n  timeout.unref?.();\n  const abort = () => terminate();\n  input.signal.addEventListener(\"abort\", abort, { once: true });\n\n  const stderrDone = drainStderr(child, terminate);\n  const exit = waitForExit(child);\n  const cancellation = createAbortWait(input.signal);\n  const inputDone = pumpInput(\n    child,\n    manifest,\n    input.job.sourceByteSize,\n    input.snapshot,\n    input.signal,\n    exit,\n    cancellation.promise,\n  );\n  void inputDone.catch(terminate);\n  const reader = new BoundedProcessReader(child, terminate, cancellation.promise);\n\n  try {\n    const magic = await reader.readExactly(OUTPUT_MAGIC.byteLength, input.signal);\n    if (equalBytes(magic, ERROR_MAGIC)) {\n      throw await readTypedError(reader, input.signal);\n    }\n    if (!equalBytes(magic, OUTPUT_MAGIC)) {\n      throw new Error(\"native materializer returned an invalid output protocol\");\n    }\n    const header = await reader.readExactly(12, input.signal);\n    const headerView = new DataView(header.buffer, header.byteOffset, header.byteLength);\n    const metadataBytes = headerView.getUint32(0, true);\n    const outputBytes = safeU64(headerView, 4, \"native materializer output length\");\n    if (metadataBytes < 2 || metadataBytes > MAX_METADATA_BYTES) {\n      throw new Error(\"native materializer metadata exceeds its bound\");\n    }\n    if (\n      outputBytes <= 0 ||\n      outputBytes > options.maxOutputBytes ||\n      outputBytes > identity.maxOutputBytes\n    ) {\n      throw new EditableArtifactMaterializerPermanentError(\"output_size_limit\");\n    }\n    const metadataText = new TextDecoder(\"utf-8\", { fatal: true }).decode(\n      await reader.readExactly(metadataBytes, input.signal),\n    );\n    const result = decodeOutputMetadata(metadataText, input.job, outputBytes);\n    let consumed = false;\n    return Object.freeze({\n      ...result,\n      chunks: Object.freeze({\n        async *[Symbol.asyncIterator](): AsyncIterableIterator<Uint8Array> {\n          if (consumed) throw new Error(\"native materializer output is single-use\");\n          consumed = true;\n          try {\n            yield* reader.streamExactly(outputBytes, input.signal);\n            await reader.assertEof(input.signal);\n            await inputDone;\n            await stderrDone;\n            const status = await exit;\n            if (status.code !== 0 || status.signal !== null) {\n              throw new Error(\"native materializer exited unsuccessfully\");\n            }\n          } finally {\n            cleanup();\n          }\n        },\n      }),\n    });\n  } catch (error) {\n    terminate();\n    await Promise.allSettled([inputDone, stderrDone, exit]);\n    cleanup();\n    throw mapSubprocessFailure(error, input.signal);\n  }\n\n  function cleanup(): void {\n    clearTimeout(timeout);\n    input.signal.removeEventListener(\"abort\", abort);\n    cancellation.dispose();\n    if (child.exitCode === null && child.signalCode === null) terminate();\n  }\n}\n\nasync function executeVerification(\n  options: NativeEditableArtifactSubprocessOptions,\n  identity: IdentityEnvelope,\n  input: Parameters<NativeEditableArtifactSubprocessPort[\"verifyMaterialization\"]>[0],\n): Promise<void> {\n  throwIfAborted(input.signal);\n  if (\n    !isHash(input.expectedSemanticHash) ||\n    !Number.isSafeInteger(input.byteSize) ||\n    input.byteSize <= 0 ||\n    input.byteSize > options.maxOutputBytes ||\n    identity.codecVersions[input.codecId] !== input.codecVersion\n  ) {\n    throw new EditableArtifactMaterializerPermanentError(\"output_verification_failed\");\n  }\n  const manifest = new TextEncoder().encode(\n    JSON.stringify({\n      codecId: input.codecId,\n      codecVersion: input.codecVersion,\n      expectedSemanticHash: input.expectedSemanticHash,\n      format: input.format,\n      protocol: \"OGAVJ001\",\n    }),\n  );\n  const child = spawnNative(options, [VERIFY_ARGUMENT]);\n  const terminate = () => terminateChild(child);\n  const timeout = setTimeout(terminate, options.wallTimeoutMs);\n  timeout.unref?.();\n  const abort = () => terminate();\n  input.signal.addEventListener(\"abort\", abort, { once: true });\n  const stderrDone = drainStderr(child, terminate);\n  const exit = waitForExit(child);\n  const cancellation = createAbortWait(input.signal);\n  const inputDone = pumpFrame(\n    child,\n    VERIFY_INPUT_MAGIC,\n    manifest,\n    input.byteSize,\n    input.chunks,\n    input.signal,\n    exit,\n    cancellation.promise,\n    \"output_verification_failed\",\n  );\n  void inputDone.catch(terminate);\n  const reader = new BoundedProcessReader(child, terminate, cancellation.promise);\n  try {\n    const magic = await reader.readExactly(VERIFY_OUTPUT_MAGIC.byteLength, input.signal);\n    if (equalBytes(magic, ERROR_MAGIC)) throw await readTypedError(reader, input.signal);\n    if (!equalBytes(magic, VERIFY_OUTPUT_MAGIC)) {\n      throw new EditableArtifactMaterializerPermanentError(\"output_verification_failed\");\n    }\n    const header = await reader.readExactly(12, input.signal);\n    const view = new DataView(header.buffer, header.byteOffset, header.byteLength);\n    const metadataBytes = view.getUint32(0, true);\n    const payloadBytes = safeU64(view, 4, \"verification payload length\");\n    if (metadataBytes < 2 || metadataBytes > MAX_METADATA_BYTES || payloadBytes !== 0) {\n      throw new EditableArtifactMaterializerPermanentError(\"output_verification_failed\");\n    }\n    const text = new TextDecoder(\"utf-8\", { fatal: true }).decode(\n      await reader.readExactly(metadataBytes, input.signal),\n    );\n    const value = JSON.parse(text) as unknown;\n    if (\n      JSON.stringify(value) !== text ||\n      typeof value !== \"object\" ||\n      value === null ||\n      Array.isArray(value) ||\n      Object.keys(value).sort().join(\"\\0\") !== \"protocol\\0semanticHash\" ||\n      (value as Record<string, unknown>).protocol !== \"OGAVR001\" ||\n      (value as Record<string, unknown>).semanticHash !== input.expectedSemanticHash\n    ) {\n      throw new EditableArtifactMaterializerPermanentError(\"output_verification_failed\");\n    }\n    await reader.assertEof(input.signal);\n    await inputDone;\n    await stderrDone;\n    const status = await exit;\n    if (status.code !== 0 || status.signal !== null) {\n      throw new EditableArtifactMaterializerPermanentError(\"output_verification_failed\");\n    }\n  } catch (error) {\n    terminate();\n    await Promise.allSettled([inputDone, stderrDone, exit]);\n    if (error instanceof EditableArtifactMaterializerPermanentError) throw error;\n    throw new EditableArtifactMaterializerPermanentError(\"output_verification_failed\");\n  } finally {\n    clearTimeout(timeout);\n    input.signal.removeEventListener(\"abort\", abort);\n    cancellation.dispose();\n    if (child.exitCode === null && child.signalCode === null) terminate();\n  }\n}\n\nasync function readTypedError(\n  reader: BoundedProcessReader,\n  signal: AbortSignal,\n): Promise<EditableArtifactMaterializerPermanentError> {\n  const header = await reader.readExactly(12, signal);\n  const view = new DataView(header.buffer, header.byteOffset, header.byteLength);\n  const metadataBytes = view.getUint32(0, true);\n  const payloadBytes = safeU64(view, 4, \"error payload length\");\n  if (metadataBytes < 2 || metadataBytes > MAX_METADATA_BYTES || payloadBytes !== 0) {\n    return new EditableArtifactMaterializerPermanentError(\"kernel_result_mismatch\");\n  }\n  const text = new TextDecoder(\"utf-8\", { fatal: true }).decode(\n    await reader.readExactly(metadataBytes, signal),\n  );\n  const value = JSON.parse(text) as unknown;\n  const keys =\n    typeof value === \"object\" && value !== null && !Array.isArray(value)\n      ? Object.keys(value).sort().join(\"\\0\")\n      : \"\";\n  if (\n    JSON.stringify(value) !== text ||\n    typeof value !== \"object\" ||\n    value === null ||\n    Array.isArray(value) ||\n    (keys !== \"code\\0protocol\" && keys !== \"code\\0protocol\\0subcode\") ||\n    (value as Record<string, unknown>).protocol !== \"OGAMERR1\"\n  ) {\n    return new EditableArtifactMaterializerPermanentError(\"kernel_result_mismatch\");\n  }\n  const code = (value as Record<string, unknown>).code;\n  const subcode = (value as Record<string, unknown>).subcode;\n  if (\n    code === \"unsupported_semantics\" ||\n    code === \"source_identity_mismatch\" ||\n    code === \"kernel_incompatible\" ||\n    code === \"output_verification_failed\"\n  ) {\n    const diagnostic = nativeFailureDiagnostic(code, subcode);\n    if (subcode !== undefined && !diagnostic) {\n      return new EditableArtifactMaterializerPermanentError(\"kernel_result_mismatch\");\n    }\n    return new EditableArtifactMaterializerPermanentError(code, diagnostic);\n  }\n  return new EditableArtifactMaterializerPermanentError(\"kernel_result_mismatch\");\n}\n\nfunction nativeFailureDiagnostic(\n  code: unknown,\n  subcode: unknown,\n): EditableArtifactMaterializerFailureDiagnostic | undefined {\n  if (code !== \"source_identity_mismatch\") return undefined;\n  if (subcode === \"input_framing\" || subcode === \"snapshot_open\" || subcode === \"state_mismatch\") {\n    return { stage: \"native\", subcode };\n  }\n  return undefined;\n}\n\nasync function probeIdentity(\n  options: NativeEditableArtifactSubprocessOptions,\n): Promise<IdentityEnvelope> {\n  const child = spawnNative(options, [IDENTITY_ARGUMENT]);\n  const terminate = () => terminateChild(child);\n  const timeout = setTimeout(terminate, options.probeTimeoutMs ?? 5_000);\n  timeout.unref?.();\n  const stdout = collectBounded(child.stdout, MAX_IDENTITY_BYTES, terminate);\n  const stderr = drainStderr(child, terminate);\n  try {\n    const [bytes, , status] = await Promise.all([stdout, stderr, waitForExit(child)]);\n    if (status.code !== 0 || status.signal !== null) {\n      throw new Error(\"native materializer identity probe failed\");\n    }\n    const text = new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes);\n    const parsed = JSON.parse(text) as unknown;\n    if (JSON.stringify(parsed) !== text) {\n      throw new Error(\"native materializer identity is not canonical JSON\");\n    }\n    return parsed as IdentityEnvelope;\n  } finally {\n    clearTimeout(timeout);\n    if (child.exitCode === null && child.signalCode === null) terminate();\n  }\n}\n\nfunction spawnNative(\n  options: NativeEditableArtifactSubprocessOptions,\n  args: readonly string[],\n): ChildProcessWithoutNullStreams {\n  return options.launcher.spawn({\n    executable: options.executable,\n    args,\n    environment: Object.freeze({\n      LANG: \"C\",\n      LC_ALL: \"C\",\n      TZ: \"UTC\",\n      ...(options.childEnvironment ?? {}),\n    }),\n  });\n}\n\nasync function pumpInput(\n  child: ChildProcessWithoutNullStreams,\n  manifest: Uint8Array,\n  expectedSourceBytes: number,\n  source: AsyncIterable<Uint8Array>,\n  signal: AbortSignal,\n  exit: Promise<{ code: number | null; signal: NodeJS.Signals | null }>,\n  cancellation: Promise<never>,\n): Promise<void> {\n  await pumpFrame(\n    child,\n    INPUT_MAGIC,\n    manifest,\n    expectedSourceBytes,\n    source,\n    signal,\n    exit,\n    cancellation,\n    \"source_identity_mismatch\",\n  );\n}\n\nasync function pumpFrame(\n  child: ChildProcessWithoutNullStreams,\n  magic: Uint8Array,\n  manifest: Uint8Array,\n  expectedSourceBytes: number,\n  source: AsyncIterable<Uint8Array>,\n  signal: AbortSignal,\n  exit: Promise<{ code: number | null; signal: NodeJS.Signals | null }>,\n  cancellation: Promise<never>,\n  mismatchCode: \"source_identity_mismatch\" | \"output_verification_failed\",\n): Promise<void> {\n  const header = new Uint8Array(12);\n  const view = new DataView(header.buffer);\n  view.setUint32(0, manifest.byteLength, true);\n  view.setBigUint64(4, BigInt(expectedSourceBytes), true);\n  await write(child, magic, signal, exit, cancellation);\n  await write(child, header, signal, exit, cancellation);\n  await write(child, manifest, signal, exit, cancellation);\n  let sourceBytes = 0;\n  for await (const chunk of source) {\n    throwIfAborted(signal);\n    if (\n      !(chunk instanceof Uint8Array) ||\n      chunk.byteLength === 0 ||\n      chunk.byteLength > 8 * 1024 * 1024\n    ) {\n      throw new EditableArtifactMaterializerPermanentError(mismatchCode);\n    }\n    sourceBytes += chunk.byteLength;\n    if (sourceBytes > expectedSourceBytes) {\n      throw new EditableArtifactMaterializerPermanentError(mismatchCode);\n    }\n    await write(child, chunk, signal, exit, cancellation);\n  }\n  if (sourceBytes !== expectedSourceBytes) {\n    throw new EditableArtifactMaterializerPermanentError(mismatchCode);\n  }\n  child.stdin.end();\n}\n\nasync function write(\n  child: ChildProcessWithoutNullStreams,\n  bytes: Uint8Array,\n  signal: AbortSignal,\n  exit: Promise<{ code: number | null; signal: NodeJS.Signals | null }>,\n  cancellation: Promise<never>,\n): Promise<void> {\n  throwIfAborted(signal);\n  if (!child.stdin.write(bytes)) {\n    await Promise.race([\n      once(child.stdin, \"drain\"),\n      cancellation,\n      exit.then(() => {\n        throw new Error(\"native materializer closed input early\");\n      }),\n    ]);\n  }\n}\n\nclass BoundedProcessReader {\n  readonly #iterator: AsyncIterator<Buffer | string>;\n  #buffer = new Uint8Array(0);\n  #done = false;\n\n  constructor(\n    child: ChildProcessWithoutNullStreams,\n    private readonly terminate: () => void,\n    private readonly cancellation: Promise<never>,\n  ) {\n    this.#iterator = child.stdout[Symbol.asyncIterator]();\n  }\n\n  async readExactly(length: number, signal: AbortSignal): Promise<Uint8Array> {\n    if (!Number.isSafeInteger(length) || length < 0) throw new Error(\"invalid framed length\");\n    const output = new Uint8Array(length);\n    let offset = 0;\n    while (offset < length) {\n      throwIfAborted(signal);\n      if (this.#buffer.byteLength === 0) await this.#fill(signal);\n      if (this.#buffer.byteLength === 0) throw new Error(\"truncated native materializer output\");\n      const count = Math.min(length - offset, this.#buffer.byteLength);\n      output.set(this.#buffer.subarray(0, count), offset);\n      this.#buffer = this.#buffer.subarray(count);\n      offset += count;\n    }\n    return output;\n  }\n\n  async *streamExactly(length: number, signal: AbortSignal): AsyncIterableIterator<Uint8Array> {\n    let remaining = length;\n    while (remaining > 0) {\n      throwIfAborted(signal);\n      const count = Math.min(remaining, STREAM_CHUNK_BYTES);\n      const chunk = await this.readExactly(count, signal);\n      remaining -= chunk.byteLength;\n      yield chunk;\n    }\n  }\n\n  async assertEof(signal: AbortSignal): Promise<void> {\n    throwIfAborted(signal);\n    if (this.#buffer.byteLength > 0) throw new Error(\"trailing native materializer output\");\n    if (!this.#done) await this.#fill(signal);\n    if (this.#buffer.byteLength > 0 || !this.#done) {\n      throw new Error(\"trailing native materializer output\");\n    }\n  }\n\n  async #fill(signal: AbortSignal): Promise<void> {\n    if (this.#done) return;\n    throwIfAborted(signal);\n    let next: IteratorResult<Buffer | string>;\n    try {\n      next = await Promise.race([this.#iterator.next(), this.cancellation]);\n    } catch (error) {\n      this.terminate();\n      throw error;\n    }\n    if (next.done) {\n      this.#done = true;\n      return;\n    }\n    if (typeof next.value === \"string\") throw new Error(\"native materializer emitted text stream\");\n    this.#buffer = new Uint8Array(\n      next.value.buffer,\n      next.value.byteOffset,\n      next.value.byteLength,\n    ).slice();\n  }\n}\n\nfunction encodeManifest(\n  job: ClaimedEditableArtifactMaterialization,\n  normalizedOptions: Uint8Array,\n): Uint8Array {\n  const options = new TextDecoder(\"utf-8\", { fatal: true }).decode(normalizedOptions);\n  const manifest = {\n    protocol: \"OGAMJ001\",\n    artifactId: job.artifactId,\n    jobId: job.jobId,\n    versionId: job.versionId,\n    modality: job.modality,\n    inputSnapshotId: job.inputSnapshotId,\n    targetHeadSequence: job.targetHeadSequence,\n    stateHash: job.stateHash,\n    sourceByteSize: job.sourceByteSize,\n    sourceContentHash: job.sourceContentHash,\n    modelSchemaVersion: job.modelSchemaVersion,\n    operationProtocolVersion: job.operationProtocolVersion,\n    snapshotProtocolVersion: job.snapshotProtocolVersion,\n    format: job.format,\n    codecId: job.codecId,\n    normalizedOptions: JSON.parse(options) as unknown,\n    optionsHash: job.optionsHash,\n    codecVersion: job.codecVersion,\n    kernelVersion: job.kernelVersion,\n    fontRegistryHash: job.fontRegistryHash,\n    policyHash: job.policyHash,\n  };\n  const bytes = new TextEncoder().encode(JSON.stringify(manifest));\n  if (bytes.byteLength > MAX_METADATA_BYTES) {\n    throw new EditableArtifactMaterializerPermanentError(\"invalid_job_manifest\");\n  }\n  return bytes;\n}\n\nfunction decodeOutputMetadata(\n  text: string,\n  job: ClaimedEditableArtifactMaterialization,\n  outputBytes: number,\n): Omit<NativeEditableArtifactMaterializationResult, \"chunks\"> {\n  const value = JSON.parse(text) as unknown;\n  if (JSON.stringify(value) !== text || typeof value !== \"object\" || value === null) {\n    throw new Error(\"native materializer metadata is not canonical JSON\");\n  }\n  const record = value as Record<string, unknown>;\n  const expectedKeys = [\n    \"byteSize\",\n    \"codecId\",\n    \"codecVersion\",\n    \"contentHash\",\n    \"fontRegistryHash\",\n    \"format\",\n    \"headSequence\",\n    \"kernelVersion\",\n    \"mimeType\",\n    \"policyHash\",\n    \"protocol\",\n    \"semanticHash\",\n    \"stateHash\",\n  ].sort();\n  if (Object.keys(record).sort().join(\"\\0\") !== expectedKeys.join(\"\\0\")) {\n    throw new Error(\"native materializer metadata fields are invalid\");\n  }\n  if (record.protocol !== \"OGAMR001\" || record.byteSize !== outputBytes) {\n    throw new Error(\"native materializer output length disagrees with metadata\");\n  }\n  const expectedMimeType = mimeTypeForFormat(job.format);\n  if (\n    !Number.isSafeInteger(record.headSequence) ||\n    record.headSequence !== job.targetHeadSequence ||\n    !isHash(record.stateHash) ||\n    record.stateHash !== job.stateHash ||\n    record.format !== job.format ||\n    record.mimeType !== expectedMimeType ||\n    !isBoundedVersion(record.codecId) ||\n    record.codecId !== job.codecId ||\n    !isBoundedVersion(record.codecVersion) ||\n    record.codecVersion !== job.codecVersion ||\n    !isBoundedKernelVersion(record.kernelVersion) ||\n    record.kernelVersion !== job.kernelVersion ||\n    !isHash(record.fontRegistryHash) ||\n    record.fontRegistryHash !== job.fontRegistryHash ||\n    !isHash(record.policyHash) ||\n    record.policyHash !== job.policyHash ||\n    !isHash(record.contentHash) ||\n    !isHash(record.semanticHash)\n  ) {\n    throw new Error(\"native materializer output metadata is incompatible\");\n  }\n  return Object.freeze({\n    headSequence: record.headSequence,\n    stateHash: record.stateHash,\n    format: job.format,\n    mimeType: expectedMimeType,\n    codecId: record.codecId,\n    codecVersion: record.codecVersion,\n    kernelVersion: record.kernelVersion,\n    fontRegistryHash: record.fontRegistryHash,\n    policyHash: record.policyHash,\n    byteSize: outputBytes,\n    contentHash: record.contentHash,\n    semanticHash: record.semanticHash,\n  });\n}\n\nfunction validateOptions(options: NativeEditableArtifactSubprocessOptions): void {\n  if (!isAbsolute(options.executable) || options.executable.length > 2_048) {\n    throw new TypeError(\"native materializer executable must be an absolute path\");\n  }\n  for (const [label, value] of [\n    [\"wall timeout\", options.wallTimeoutMs],\n    [\"source limit\", options.maxSourceBytes],\n    [\"output limit\", options.maxOutputBytes],\n  ] as const) {\n    if (!Number.isSafeInteger(value) || value <= 0) throw new TypeError(`${label} is invalid`);\n  }\n  const launcher = options.launcher.identity;\n  const sandboxed =\n    launcher.sandboxEnforced === true &&\n    launcher.network === \"denied\" &&\n    Number.isSafeInteger(launcher.memoryLimitBytes) &&\n    launcher.memoryLimitBytes > 0 &&\n    Number.isSafeInteger(launcher.cpuTimeLimitMs) &&\n    launcher.cpuTimeLimitMs > 0 &&\n    Number.isSafeInteger(launcher.fileDescriptorLimit) &&\n    launcher.fileDescriptorLimit > 0 &&\n    Number.isSafeInteger(launcher.processLimit) &&\n    launcher.processLimit > 0 &&\n    Number.isSafeInteger(launcher.fileSizeLimitBytes) &&\n    launcher.fileSizeLimitBytes > 0;\n  const developmentUnsandboxed =\n    options.allowUnsandboxedDevelopment === true &&\n    launcher.sandboxEnforced === false &&\n    launcher.network === \"host\" &&\n    launcher.memoryLimitBytes === 0 &&\n    launcher.cpuTimeLimitMs === 0 &&\n    launcher.fileDescriptorLimit === 0 &&\n    launcher.processLimit === 0 &&\n    launcher.fileSizeLimitBytes === 0;\n  if (\n    launcher.isolation !== \"subprocess\" ||\n    launcher.officeAutomation !== false ||\n    !isBoundedVersion(launcher.platform) ||\n    (!sandboxed && !developmentUnsandboxed)\n  ) {\n    throw new TypeError(\"materializer launcher isolation is not verified\");\n  }\n  if (options.childEnvironment !== undefined) {\n    const keys = Object.keys(options.childEnvironment).sort();\n    const productionKeys = [\"OPENGENI_ARTIFACT_RUNTIME_MANIFEST\", \"OPENGENI_ARTIFACT_TOOL_ENTRY\"];\n    const developmentKeys = [\n      \"NODE_ENV\",\n      \"OPENGENI_ARTIFACT_DEVELOPMENT_RUNTIME_MANIFEST\",\n      \"OPENGENI_ARTIFACT_TOOL_ENTRY\",\n    ];\n    const production = keys.join(\"\\0\") === productionKeys.join(\"\\0\");\n    const development = keys.join(\"\\0\") === developmentKeys.join(\"\\0\");\n    if (!production && !development) {\n      throw new TypeError(\"native materializer child environment is not exact\");\n    }\n    if (development !== developmentUnsandboxed) {\n      throw new TypeError(\"native materializer launcher and runtime authority modes differ\");\n    }\n    if (\n      development &&\n      (options.allowUnsandboxedDevelopment !== true ||\n        options.childEnvironment.NODE_ENV !== \"development\")\n    ) {\n      throw new TypeError(\"native materializer development child environment is forbidden\");\n    }\n    for (const [name, value] of Object.entries(options.childEnvironment)) {\n      if (name === \"NODE_ENV\") continue;\n      if (!isAbsolute(value) || value.length > 2_048 || /[\\u0000-\\u001f\\u007f]/u.test(value)) {\n        throw new TypeError(\"native materializer child environment path is invalid\");\n      }\n    }\n  }\n}\n\nfunction validateIdentity(identity: IdentityEnvelope): void {\n  const record = identity as unknown as Record<string, unknown>;\n  const expectedKeys = [\n    \"codecVersions\",\n    \"fontRegistryHash\",\n    \"kernelVersion\",\n    \"maxOutputBytes\",\n    \"policyHash\",\n    \"protocol\",\n    \"runtimeKind\",\n    \"runtimeTarget\",\n    \"supportedModelSchemaVersions\",\n    \"supportedOperationProtocolVersions\",\n    \"supportedSnapshotProtocolVersions\",\n  ].sort();\n  if (Object.keys(record).sort().join(\"\\0\") !== expectedKeys.join(\"\\0\")) {\n    throw new Error(\"native materializer identity fields are invalid\");\n  }\n  if (\n    identity.protocol !== \"OGAMC001\" ||\n    identity.runtimeKind !== \"native\" ||\n    !Number.isSafeInteger(identity.maxOutputBytes) ||\n    identity.maxOutputBytes <= 0\n  ) {\n    throw new Error(\"native materializer sandbox identity is incompatible\");\n  }\n  if (\n    !isBoundedKernelVersion(identity.kernelVersion) ||\n    !isBoundedVersion(identity.runtimeTarget) ||\n    !isHash(identity.fontRegistryHash) ||\n    !isHash(identity.policyHash) ||\n    !isCodecRegistry(identity.codecVersions) ||\n    !isCurrentSpreadsheetVersionList(\n      identity.supportedModelSchemaVersions,\n      SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,\n    ) ||\n    !isCurrentSpreadsheetVersionList(\n      identity.supportedOperationProtocolVersions,\n      COMMITTED_TRANSACTION_PROTOCOL_VERSION,\n    ) ||\n    !isCurrentSpreadsheetVersionList(\n      identity.supportedSnapshotProtocolVersions,\n      SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION,\n    )\n  ) {\n    throw new Error(\"native materializer capability identity is incomplete\");\n  }\n}\n\nfunction compositeIdentity(\n  child: IdentityEnvelope,\n  options: NativeEditableArtifactSubprocessOptions,\n): NativeEditableArtifactMaterializerIdentity {\n  const launcher = options.launcher.identity;\n  return Object.freeze({\n    kind: \"native\",\n    isolation: launcher.isolation,\n    network: launcher.network,\n    officeAutomation: launcher.officeAutomation,\n    processProtocolVersion: 1,\n    sandboxEnforced: launcher.sandboxEnforced,\n    memoryLimitBytes: launcher.memoryLimitBytes,\n    cpuTimeLimitMs: launcher.cpuTimeLimitMs,\n    fileDescriptorLimit: launcher.fileDescriptorLimit,\n    processLimit: launcher.processLimit,\n    fileSizeLimitBytes: launcher.fileSizeLimitBytes,\n    maxOutputBytes: Math.min(child.maxOutputBytes, options.maxOutputBytes),\n    kernelVersion: child.kernelVersion,\n    codecVersions: child.codecVersions,\n    fontRegistryHash: child.fontRegistryHash,\n    policyHash: child.policyHash,\n    runtimeTarget: child.runtimeTarget,\n    supportedModelSchemaVersions: child.supportedModelSchemaVersions,\n    supportedOperationProtocolVersions: child.supportedOperationProtocolVersions,\n    supportedSnapshotProtocolVersions: child.supportedSnapshotProtocolVersions,\n  });\n}\n\nfunction isCodecRegistry(value: unknown): value is Readonly<Record<string, string>> {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) return false;\n  const entries = Object.entries(value as Record<string, unknown>);\n  if (entries.length === 0 || entries.length > 64) return false;\n  let previous = \"\";\n  for (const [codecId, version] of entries) {\n    if (\n      !/^[a-z][a-z0-9._-]{0,127}$/u.test(codecId) ||\n      codecId <= previous ||\n      !isBoundedVersion(version)\n    ) {\n      return false;\n    }\n    previous = codecId;\n  }\n  return true;\n}\n\nfunction isCurrentSpreadsheetVersionList<const Version extends number>(\n  value: unknown,\n  expected: Version,\n): value is readonly [Version] {\n  return Array.isArray(value) && value.length === 1 && value[0] === expected;\n}\n\nfunction isBoundedVersion(value: unknown): value is string {\n  return (\n    typeof value === \"string\" &&\n    value.length >= 1 &&\n    value.length <= 128 &&\n    /^[\\x21-\\x7e]+$/u.test(value)\n  );\n}\n\nfunction isBoundedKernelVersion(value: unknown): value is string {\n  return (\n    typeof value === \"string\" &&\n    value.length >= 1 &&\n    new TextEncoder().encode(value).byteLength <= EDITABLE_ARTIFACT_KERNEL_VERSION_MAX_BYTES &&\n    /^[\\x21-\\x7e]+$/u.test(value)\n  );\n}\n\nfunction isHash(value: unknown): value is string {\n  return typeof value === \"string\" && /^sha256:[0-9a-f]{64}$/u.test(value);\n}\n\nasync function collectBounded(\n  stream: NodeJS.ReadableStream & AsyncIterable<Buffer | string>,\n  maximum: number,\n  terminate: () => void,\n): Promise<Uint8Array> {\n  const chunks: Uint8Array[] = [];\n  let total = 0;\n  for await (const value of stream) {\n    const chunk = typeof value === \"string\" ? Buffer.from(value) : value;\n    total += chunk.byteLength;\n    if (total > maximum) {\n      terminate();\n      throw new Error(\"native materializer diagnostic exceeded its bound\");\n    }\n    chunks.push(new Uint8Array(chunk.buffer, chunk.byteOffset, chunk.byteLength).slice());\n  }\n  const result = new Uint8Array(total);\n  let offset = 0;\n  for (const chunk of chunks) {\n    result.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return result;\n}\n\nasync function drainStderr(\n  child: ChildProcessWithoutNullStreams,\n  terminate: () => void,\n): Promise<void> {\n  await collectBounded(child.stderr, MAX_STDERR_BYTES, terminate);\n}\n\nfunction waitForExit(\n  child: ChildProcessWithoutNullStreams,\n): Promise<{ code: number | null; signal: NodeJS.Signals | null }> {\n  if (child.exitCode !== null || child.signalCode !== null) {\n    return Promise.resolve({ code: child.exitCode, signal: child.signalCode });\n  }\n  return new Promise((resolve, reject) => {\n    const onError = (error: Error) => {\n      child.removeListener(\"exit\", onExit);\n      reject(error);\n    };\n    const onExit = (code: number | null, signal: NodeJS.Signals | null) => {\n      child.removeListener(\"error\", onError);\n      resolve({ code, signal });\n    };\n    child.once(\"error\", onError);\n    child.once(\"exit\", onExit);\n  });\n}\n\nfunction terminateChild(child: ChildProcessWithoutNullStreams): void {\n  if (child.exitCode !== null || child.signalCode !== null) return;\n  child.stdin.destroy();\n  child.kill(\"SIGKILL\");\n}\n\nfunction createAbortWait(signal: AbortSignal): {\n  promise: Promise<never>;\n  dispose(): void;\n} {\n  let listener: (() => void) | null = null;\n  const promise = new Promise<never>((_resolve, reject) => {\n    if (signal.aborted) {\n      reject(signal.reason ?? abortError());\n      return;\n    }\n    listener = () => reject(signal.reason ?? abortError());\n    signal.addEventListener(\"abort\", listener, { once: true });\n  });\n  // The promise is deliberately shared by every stream race. Attach a handler\n  // once so a late abort after another branch failed cannot be unhandled.\n  void promise.catch(() => undefined);\n  return {\n    promise,\n    dispose() {\n      if (listener) signal.removeEventListener(\"abort\", listener);\n      listener = null;\n    },\n  };\n}\n\nfunction throwIfAborted(signal: AbortSignal): void {\n  if (signal.aborted) throw signal.reason ?? abortError();\n}\n\nfunction abortError(): DOMException {\n  return new DOMException(\"Operation aborted\", \"AbortError\");\n}\n\nfunction mapSubprocessFailure(error: unknown, signal: AbortSignal): unknown {\n  if (signal.aborted) return signal.reason ?? abortError();\n  return error;\n}\n\nfunction safeU64(view: DataView, offset: number, label: string): number {\n  const value = view.getBigUint64(offset, true);\n  if (value > BigInt(Number.MAX_SAFE_INTEGER)) throw new Error(`${label} exceeds safe integer`);\n  return Number(value);\n}\n\nfunction equalBytes(left: Uint8Array, right: Uint8Array): boolean {\n  return left.byteLength === right.byteLength && left.every((byte, index) => byte === right[index]);\n}\n","import { spawn, type ChildProcessWithoutNullStreams } from \"node:child_process\";\nimport { access, readlink, realpath, stat } from \"node:fs/promises\";\nimport { basename, dirname, isAbsolute, relative } from \"node:path\";\n\nimport type { VerifiedEditableArtifactProcessLauncher } from \"./editable-artifact-materializer-subprocess\";\n\nconst MAX_PROBE_BYTES = 16 * 1024;\nconst PROBE_TIMEOUT_MS = 5_000;\n\nexport type LinuxEditableArtifactLauncherOptions = Readonly<{\n  materializerExecutable: string;\n  bubblewrapExecutable: string;\n  prlimitExecutable: string;\n  runtimeRoot: string;\n  memoryLimitBytes: number;\n  cpuTimeLimitMs: number;\n  fileDescriptorLimit: number;\n  processLimit: number;\n  fileSizeLimitBytes: number;\n  probeExecutable?: string;\n}>;\n\nexport type DevelopmentEditableArtifactLauncherOptions = Readonly<{\n  materializerExecutable: string;\n  explicitlyEnabled: boolean;\n  nodeEnvironment: string | undefined;\n}>;\n\n/**\n * Current-host local development only. This deliberately reports that no OS\n * sandbox, network namespace, or process resource limit is enforced. The\n * caller must surface that degraded capability and can never select this path\n * in production.\n */\nexport async function createDevelopmentEditableArtifactProcessLauncher(\n  options: DevelopmentEditableArtifactLauncherOptions,\n): Promise<VerifiedEditableArtifactProcessLauncher> {\n  if (!options.explicitlyEnabled || options.nodeEnvironment === \"production\") {\n    throw new Error(\"Unsandboxed artifact materialization is forbidden outside development\");\n  }\n  const configuredMaterializerExecutable = options.materializerExecutable;\n  const materializerExecutable = await developmentExecutable(options.materializerExecutable);\n  return Object.freeze({\n    identity: Object.freeze({\n      platform: `${process.platform}-${process.arch}-development-unsandboxed-v1`,\n      isolation: \"subprocess\",\n      network: \"host\",\n      officeAutomation: false,\n      sandboxEnforced: false,\n      memoryLimitBytes: 0,\n      cpuTimeLimitMs: 0,\n      fileDescriptorLimit: 0,\n      processLimit: 0,\n      fileSizeLimitBytes: 0,\n    }),\n    spawn(input) {\n      if (\n        input.executable !== configuredMaterializerExecutable &&\n        input.executable !== materializerExecutable\n      ) {\n        throw new Error(\"Development materializer differs from its verified executable\");\n      }\n      return spawn(materializerExecutable, [...input.args], {\n        cwd: \"/\",\n        env: { ...input.environment },\n        stdio: [\"pipe\", \"pipe\", \"pipe\"],\n        windowsHide: true,\n      });\n    },\n  });\n}\n\n/**\n * Concrete production launcher for Linux. Isolation facts are established by\n * a parent-run behavioral probe of the actual bwrap+prlimit command, never by\n * the untrusted codec child. macOS/Windows require their own native launcher\n * implementation and therefore fail closed in production today.\n */\nexport async function createLinuxEditableArtifactProcessLauncher(\n  options: LinuxEditableArtifactLauncherOptions,\n): Promise<VerifiedEditableArtifactProcessLauncher> {\n  if (process.platform !== \"linux\") {\n    throw new Error(\"Linux artifact materializer sandbox is unavailable on this platform\");\n  }\n  if (\n    !Number.isSafeInteger(options.memoryLimitBytes) ||\n    options.memoryLimitBytes <= 0 ||\n    !Number.isSafeInteger(options.cpuTimeLimitMs) ||\n    options.cpuTimeLimitMs <= 0 ||\n    options.cpuTimeLimitMs % 1_000 !== 0 ||\n    !Number.isSafeInteger(options.fileDescriptorLimit) ||\n    options.fileDescriptorLimit <= 0 ||\n    !Number.isSafeInteger(options.processLimit) ||\n    options.processLimit <= 0 ||\n    !Number.isSafeInteger(options.fileSizeLimitBytes) ||\n    options.fileSizeLimitBytes <= 0\n  ) {\n    throw new Error(\"Artifact materializer launcher limits are invalid\");\n  }\n  const bubblewrap = await trustedExecutable(options.bubblewrapExecutable, \"bwrap\");\n  const prlimit = await trustedExecutable(options.prlimitExecutable, \"prlimit\");\n  const configuredMaterializerExecutable = options.materializerExecutable;\n  const materializerExecutable = await trustedExecutable(\n    options.materializerExecutable,\n    basename(options.materializerExecutable),\n  );\n  const runtimeRoot = await trustedRuntimeRoot(options.runtimeRoot);\n  const cpuSeconds = options.cpuTimeLimitMs / 1_000;\n\n  const spawnIsolated = (input: {\n    executable: string;\n    args: readonly string[];\n    environment: Readonly<Record<string, string>>;\n  }): ChildProcessWithoutNullStreams => {\n    if (!isAbsolute(input.executable)) throw new Error(\"Sandbox target must be absolute\");\n    const sandboxArguments = linuxEditableArtifactSandboxArguments({\n      executable: input.executable,\n      args: input.args,\n      runtimeRoot,\n      scratchLimitBytes: options.fileSizeLimitBytes,\n    });\n    return spawn(\n      prlimit,\n      [\n        ...linuxEditableArtifactPrlimitArguments({\n          memoryLimitBytes: options.memoryLimitBytes,\n          cpuSeconds,\n          fileDescriptorLimit: options.fileDescriptorLimit,\n          processLimit: options.processLimit,\n          fileSizeLimitBytes: options.fileSizeLimitBytes,\n        }),\n        \"--\",\n        bubblewrap,\n        ...sandboxArguments,\n      ],\n      {\n        cwd: \"/\",\n        env: { ...input.environment },\n        stdio: [\"pipe\", \"pipe\", \"pipe\"],\n        windowsHide: true,\n      },\n    );\n  };\n\n  const spawnMaterializer = (input: {\n    executable: string;\n    args: readonly string[];\n    environment: Readonly<Record<string, string>>;\n  }): ChildProcessWithoutNullStreams => {\n    if (\n      input.executable !== configuredMaterializerExecutable &&\n      input.executable !== materializerExecutable\n    ) {\n      throw new Error(\"Sandbox target differs from the verified materializer executable\");\n    }\n    assertRuntimeEnvironmentConfined(input.environment, runtimeRoot);\n    return spawnIsolated({ ...input, executable: materializerExecutable });\n  };\n\n  const probeExecutable = await trustedExecutable(\n    options.probeExecutable ?? process.execPath,\n    basename(process.execPath),\n  );\n  const parentNetworkNamespace = await readlink(\"/proc/self/ns/net\");\n  const probe = spawnIsolated({\n    executable: probeExecutable,\n    args: [\n      \"-e\",\n      [\n        'const fs=require(\"node:fs\")',\n        'const net=fs.readlinkSync(\"/proc/self/ns/net\")',\n        'const limits=fs.readFileSync(\"/proc/self/limits\",\"utf8\")',\n        'const rootEntries=fs.readdirSync(\"/\").sort()',\n        'let rootWritable=false;try{fs.writeFileSync(\"/opengeni-root-write-probe\",\"x\");rootWritable=true;fs.unlinkSync(\"/opengeni-root-write-probe\")}catch{}',\n        'let scratchWritable=false;try{fs.writeFileSync(\"/tmp/opengeni-scratch-write-probe\",\"x\");scratchWritable=true;fs.unlinkSync(\"/tmp/opengeni-scratch-write-probe\")}catch{}',\n        \"process.stdout.write(JSON.stringify({net,limits,rootEntries,rootWritable,scratchWritable}))\",\n      ].join(\";\"),\n    ],\n    environment: Object.freeze({ LANG: \"C\", LC_ALL: \"C\", TZ: \"UTC\" }),\n  });\n  probe.stdin.end();\n  const timeout = setTimeout(() => terminateChild(probe), PROBE_TIMEOUT_MS);\n  timeout.unref?.();\n  let stdout: Uint8Array;\n  let stderr: Uint8Array;\n  let status: { code: number | null; signal: NodeJS.Signals | null };\n  try {\n    [stdout, stderr, status] = await Promise.all([\n      boundedStream(probe.stdout),\n      boundedStream(probe.stderr),\n      waitForExit(probe),\n    ]);\n  } finally {\n    clearTimeout(timeout);\n    terminateChild(probe);\n  }\n  if (status.code !== 0 || status.signal !== null || stderr.byteLength !== 0) {\n    throw new Error(\"Artifact materializer sandbox behavioral probe failed\");\n  }\n  const parsed = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(stdout)) as unknown;\n  if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n    throw new Error(\"Artifact materializer sandbox probe returned invalid evidence\");\n  }\n  const evidence = parsed as Record<string, unknown>;\n  const expectedRootEntries = linuxEditableArtifactSandboxRootEntries({\n    executable: probeExecutable,\n    runtimeRoot,\n  });\n  if (\n    typeof evidence.net !== \"string\" ||\n    evidence.net === parentNetworkNamespace ||\n    typeof evidence.limits !== \"string\" ||\n    !hasResourceLimit(evidence.limits, \"Max cpu time\", String(cpuSeconds)) ||\n    !hasResourceLimit(evidence.limits, \"Max address space\", String(options.memoryLimitBytes)) ||\n    !hasResourceLimit(evidence.limits, \"Max open files\", String(options.fileDescriptorLimit)) ||\n    !hasResourceLimit(evidence.limits, \"Max processes\", String(options.processLimit)) ||\n    !hasResourceLimit(evidence.limits, \"Max file size\", String(options.fileSizeLimitBytes)) ||\n    !sameStringList(evidence.rootEntries, expectedRootEntries) ||\n    evidence.rootWritable !== false ||\n    evidence.scratchWritable !== true\n  ) {\n    throw new Error(\"Artifact materializer sandbox enforcement could not be proved\");\n  }\n\n  return Object.freeze({\n    identity: Object.freeze({\n      platform: `linux-${process.arch}-bwrap-prlimit-v1`,\n      isolation: \"subprocess\",\n      network: \"denied\",\n      officeAutomation: false,\n      sandboxEnforced: true,\n      memoryLimitBytes: options.memoryLimitBytes,\n      cpuTimeLimitMs: options.cpuTimeLimitMs,\n      fileDescriptorLimit: options.fileDescriptorLimit,\n      processLimit: options.processLimit,\n      fileSizeLimitBytes: options.fileSizeLimitBytes,\n    }),\n    spawn: spawnMaterializer,\n  });\n}\n\nexport function linuxEditableArtifactSandboxArguments(\n  input: Readonly<{\n    executable: string;\n    args: readonly string[];\n    runtimeRoot: string;\n    scratchLimitBytes: number;\n  }>,\n): readonly string[] {\n  if (\n    !isAbsolute(input.executable) ||\n    !isAbsolute(input.runtimeRoot) ||\n    !Number.isSafeInteger(input.scratchLimitBytes) ||\n    input.scratchLimitBytes <= 0\n  ) {\n    throw new Error(\"Artifact materializer sandbox paths must be absolute\");\n  }\n  const parentDirectories = sandboxParentDirectories([input.executable, input.runtimeRoot]);\n  return Object.freeze([\n    \"--die-with-parent\",\n    \"--new-session\",\n    \"--unshare-all\",\n    ...parentDirectories.flatMap((path) => [\"--dir\", path]),\n    \"--ro-bind\",\n    \"/usr/lib\",\n    \"/usr/lib\",\n    \"--ro-bind-try\",\n    \"/usr/lib64\",\n    \"/usr/lib64\",\n    \"--ro-bind-try\",\n    \"/usr/share\",\n    \"/usr/share\",\n    \"--symlink\",\n    \"usr/lib\",\n    \"/lib\",\n    \"--symlink\",\n    \"usr/lib64\",\n    \"/lib64\",\n    \"--dir\",\n    \"/etc\",\n    \"--ro-bind-try\",\n    \"/etc/ld.so.cache\",\n    \"/etc/ld.so.cache\",\n    \"--ro-bind-try\",\n    \"/etc/ld.so.conf\",\n    \"/etc/ld.so.conf\",\n    \"--ro-bind-try\",\n    \"/etc/ld.so.conf.d\",\n    \"/etc/ld.so.conf.d\",\n    \"--ro-bind\",\n    input.runtimeRoot,\n    input.runtimeRoot,\n    \"--ro-bind\",\n    input.executable,\n    input.executable,\n    \"--proc\",\n    \"/proc\",\n    \"--dev\",\n    \"/dev\",\n    \"--size\",\n    String(input.scratchLimitBytes),\n    \"--tmpfs\",\n    \"/tmp\",\n    \"--remount-ro\",\n    \"/\",\n    \"--chdir\",\n    \"/\",\n    \"--\",\n    input.executable,\n    ...input.args,\n  ]);\n}\n\nexport function linuxEditableArtifactPrlimitArguments(\n  input: Readonly<{\n    memoryLimitBytes: number;\n    cpuSeconds: number;\n    fileDescriptorLimit: number;\n    processLimit: number;\n    fileSizeLimitBytes: number;\n  }>,\n): readonly string[] {\n  return Object.freeze([\n    `--as=${input.memoryLimitBytes}`,\n    `--cpu=${input.cpuSeconds}`,\n    `--nofile=${input.fileDescriptorLimit}`,\n    `--nproc=${input.processLimit}`,\n    `--fsize=${input.fileSizeLimitBytes}`,\n  ]);\n}\n\nexport function linuxEditableArtifactSandboxRootEntries(\n  input: Readonly<{\n    executable: string;\n    runtimeRoot: string;\n  }>,\n): readonly string[] {\n  const entries = new Set([\"dev\", \"etc\", \"lib\", \"lib64\", \"proc\", \"tmp\", \"usr\"]);\n  for (const path of [input.executable, input.runtimeRoot]) {\n    const topLevel = path.split(\"/\").find((part) => part.length > 0);\n    if (topLevel) entries.add(topLevel);\n  }\n  return Object.freeze([...entries].sort());\n}\n\nasync function trustedExecutable(input: string, expectedBasename: string): Promise<string> {\n  if (!isAbsolute(input) || basename(input) !== expectedBasename) {\n    throw new Error(`Artifact materializer ${expectedBasename} path is invalid`);\n  }\n  const canonical = await realpath(input);\n  const metadata = await stat(canonical);\n  await access(canonical, 1);\n  if (!metadata.isFile() || metadata.uid !== 0 || (metadata.mode & 0o022) !== 0) {\n    throw new Error(`Artifact materializer ${expectedBasename} is not a trusted executable`);\n  }\n  return canonical;\n}\n\nasync function trustedRuntimeRoot(input: string): Promise<string> {\n  if (!isAbsolute(input) || broadRuntimeRoot(input)) {\n    throw new Error(\"Artifact materializer runtime root is invalid\");\n  }\n  const canonical = await realpath(input);\n  const metadata = await stat(canonical);\n  if (\n    canonical !== input ||\n    !metadata.isDirectory() ||\n    metadata.uid !== 0 ||\n    (metadata.mode & 0o022) !== 0\n  ) {\n    throw new Error(\"Artifact materializer runtime root is not a trusted directory\");\n  }\n  return canonical;\n}\n\nfunction broadRuntimeRoot(input: string): boolean {\n  if (input.split(\"/\").filter(Boolean).length < 2) return true;\n  return new Set([\n    \"/\",\n    \"/app\",\n    \"/bin\",\n    \"/dev\",\n    \"/etc\",\n    \"/home\",\n    \"/lib\",\n    \"/lib64\",\n    \"/media\",\n    \"/mnt\",\n    \"/opt\",\n    \"/proc\",\n    \"/root\",\n    \"/run\",\n    \"/sbin\",\n    \"/srv\",\n    \"/sys\",\n    \"/tmp\",\n    \"/usr\",\n    \"/usr/local\",\n    \"/var\",\n    \"/workspace\",\n  ]).has(input);\n}\n\nfunction assertRuntimeEnvironmentConfined(\n  environment: Readonly<Record<string, string>>,\n  runtimeRoot: string,\n): void {\n  for (const name of [\n    \"OPENGENI_ARTIFACT_RUNTIME_MANIFEST\",\n    \"OPENGENI_ARTIFACT_TOOL_ENTRY\",\n  ] as const) {\n    const path = environment[name];\n    if (!path || !isPathInside(runtimeRoot, path)) {\n      throw new Error(\"Artifact materializer runtime environment escapes its verified root\");\n    }\n  }\n}\n\nfunction isPathInside(root: string, path: string): boolean {\n  if (!isAbsolute(path)) return false;\n  const fromRoot = relative(root, path);\n  return (\n    fromRoot.length > 0 &&\n    fromRoot !== \"..\" &&\n    !fromRoot.startsWith(`..${process.platform === \"win32\" ? \"\\\\\" : \"/\"}`) &&\n    !isAbsolute(fromRoot)\n  );\n}\n\nfunction sandboxParentDirectories(paths: readonly string[]): readonly string[] {\n  const directories = new Set<string>();\n  for (const path of paths) {\n    let parent = dirname(path);\n    while (parent !== \"/\" && parent !== \".\") {\n      directories.add(parent);\n      parent = dirname(parent);\n    }\n  }\n  return [...directories].sort((left, right) => {\n    const depth = left.split(\"/\").length - right.split(\"/\").length;\n    return depth === 0 ? left.localeCompare(right) : depth;\n  });\n}\n\nfunction sameStringList(value: unknown, expected: readonly string[]): boolean {\n  return (\n    Array.isArray(value) &&\n    value.length === expected.length &&\n    value.every((entry, index) => entry === expected[index])\n  );\n}\n\nasync function developmentExecutable(input: string): Promise<string> {\n  if (!isAbsolute(input) || !/^opengeni-artifact-materializer(?:\\.exe)?$/u.test(basename(input))) {\n    throw new Error(\"Development artifact materializer path is invalid\");\n  }\n  const canonical = await realpath(input);\n  const metadata = await stat(canonical);\n  await access(canonical, 1);\n  if (!metadata.isFile()) throw new Error(\"Development artifact materializer is not executable\");\n  return canonical;\n}\n\nfunction hasResourceLimit(limits: string, name: string, expected: string): boolean {\n  const line = limits.split(\"\\n\").find((candidate) => candidate.startsWith(name));\n  if (!line) return false;\n  const fields = line.trim().split(/\\s{2,}/u);\n  return fields[1] === expected && fields[2] === expected;\n}\n\nasync function boundedStream(\n  stream: NodeJS.ReadableStream & AsyncIterable<Buffer | string>,\n): Promise<Uint8Array> {\n  const chunks: Uint8Array[] = [];\n  let total = 0;\n  for await (const value of stream) {\n    const chunk = typeof value === \"string\" ? Buffer.from(value) : value;\n    total += chunk.byteLength;\n    if (total > MAX_PROBE_BYTES) throw new Error(\"Artifact materializer sandbox probe overflowed\");\n    chunks.push(new Uint8Array(chunk.buffer, chunk.byteOffset, chunk.byteLength).slice());\n  }\n  const output = new Uint8Array(total);\n  let offset = 0;\n  for (const chunk of chunks) {\n    output.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return output;\n}\n\nfunction waitForExit(\n  child: ChildProcessWithoutNullStreams,\n): Promise<{ code: number | null; signal: NodeJS.Signals | null }> {\n  if (child.exitCode !== null || child.signalCode !== null) {\n    return Promise.resolve({ code: child.exitCode, signal: child.signalCode });\n  }\n  return new Promise((resolve, reject) => {\n    const onError = (error: Error) => {\n      child.removeListener(\"exit\", onExit);\n      reject(error);\n    };\n    const onExit = (code: number | null, signal: NodeJS.Signals | null) => {\n      child.removeListener(\"error\", onError);\n      resolve({ code, signal });\n    };\n    child.once(\"error\", onError);\n    child.once(\"exit\", onExit);\n  });\n}\n\nfunction terminateChild(child: ChildProcessWithoutNullStreams): void {\n  if (child.exitCode !== null || child.signalCode !== null) return;\n  child.stdin.destroy();\n  child.kill(\"SIGKILL\");\n}\n","import { createMaterializerSidecarFromEnvironment } from \"./editable-artifact-materializer-service\";\n\n/**\n * Dedicated editable-artifact materializer process. This entry deliberately\n * does not import/create a Temporal worker and is never called by control/turn\n * startup. Deploy it as a separate sidecar/service with its own DSN.\n */\nexport async function runEditableArtifactMaterializerSidecar(\n  environment: NodeJS.ProcessEnv = process.env,\n): Promise<void> {\n  const configured = await createMaterializerSidecarFromEnvironment(environment);\n  if (!configured) {\n    throw new Error(\"Editable artifact materializer sidecar is disabled\");\n  }\n  const server = Bun.serve({\n    hostname: configured.httpHostname,\n    port: configured.httpPort,\n    fetch: configured.service.fetch,\n  });\n  const stop = () => configured.service.drain(\"process signal\");\n  process.on(\"SIGTERM\", stop);\n  process.on(\"SIGINT\", stop);\n  try {\n    await configured.service.run();\n  } finally {\n    process.off(\"SIGTERM\", stop);\n    process.off(\"SIGINT\", stop);\n    server.stop(true);\n    await configured.service.close();\n  }\n}\n\nif (import.meta.main) {\n  await runEditableArtifactMaterializerSidecar();\n}\n"],"mappings":";;;AAAA;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,2BAA+C;AACxD,SAAS,2BAA+C;AACxD,SAAS,WAAAA,gBAAe;;;ACbxB,SAAS,kBAAkB;AAE3B,SAAS,kDAAkD;AAC3D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOP,SAAS,wBAAwB,+BAA+B;AAOzD,IAAM,+CACX;AAEK,IAAM,kDAAkD,MAAM,OAAO;AACrE,IAAM,kDAAkD,MAAM,OAAO;AACrE,IAAM,mDAAmD,MAAM;AAC/D,IAAM,8CAA8C;AAgQ3D,IAAM,kBAAkB,OAAO,OAAO;AAAA,EACpC,WAAW;AAAA,EACX,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,sBAAsB;AAAA,EACtB,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,aAAa;AAAA,EACb,gBAAgB;AAAA,EAChB,gBAAgB;AAClB,CAAC;AA0BM,IAAM,6CAAN,cAAyD,MAAM;AAAA,EACpE,YACW,MACA,YACT;AACA,UAAM,sDAAsD,IAAI,EAAE;AAHzD;AACA;AAGT,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,6CAAN,cAAyD,MAAM;AAAA,EACpE,cAAc;AACZ,UAAM,kDAAkD;AACxD,SAAK,OAAO;AAAA,EACd;AACF;AAMO,IAAM,+BAAN,MAAmC;AAAA,EAIxC,YACmB,cACjB,SACA,iBAAsE,CAAC,GACvE;AAHiB;AAIjB,SAAK,WAAW,iBAAiB,OAAO;AACxC;AAAA,MACE,aAAa,OAAO;AAAA,MACpB,eAAe,gCAAgC;AAAA,IACjD;AAAA,EACF;AAAA,EAbS;AAAA,EACT,cAAuE;AAAA,EAcvE,MAAM,IAAI,QAAoC;AAC5C,QAAI,cAAc;AAClB,WAAO,CAAC,OAAO,SAAS;AACtB,YAAM,UAAU,MAAM,KAAK,aAAa,MAAM;AAC9C,oBAAc,QAAQ;AACtB,UAAI,OAAO,QAAS;AACpB,YAAM,QAAQ,cACV,KAAK,SAAS,iBACd,QAAQ,YAAY,IAClB,KAAK,SAAS,iBACd;AACN,UAAI,QAAQ,KAAK,CAAE,MAAM,aAAa,KAAK,aAAa,WAAW,OAAO,MAAM,EAAI;AAAA,IACtF;AACA,UAAM,KAAK,MAAM;AAAA,EACnB;AAAA;AAAA,EAGA,aAAa,QAAwE;AACnF,QAAI,KAAK,YAAa,QAAO,KAAK;AAClC,UAAM,OAAO,KAAK,eAAe,MAAM;AACvC,SAAK,cAAc;AACnB,SAAK,KAAK;AAAA,MACR,MAAM;AACJ,YAAI,KAAK,gBAAgB,KAAM,MAAK,cAAc;AAAA,MACpD;AAAA,MACA,MAAM;AACJ,YAAI,KAAK,gBAAgB,KAAM,MAAK,cAAc;AAAA,MACpD;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,QAAuB;AAC3B,UAAM,KAAK;AAAA,EACb;AAAA,EAEA,MAAM,eACJ,cACkD;AAClD,UAAM,UAAU,eAAe;AAC/B,QAAI,cAAc,SAAS;AACzB,aAAO,cAAc,OAAO;AAAA,IAC9B;AACA,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,KAAK,aAAa,MAAM,MAAM;AAAA,QACzC,OAAO,KAAK,SAAS;AAAA,QACrB,iBAAiB,KAAK,SAAS;AAAA,QAC/B,OAAO,KAAK,SAAS;AAAA,MACvB,CAAC;AACD,UAAI,CAAC,MAAM,QAAQ,IAAI,KAAK,KAAK,SAAS,KAAK,SAAS,WAAW;AACjE,cAAM,IAAI,UAAU,uDAAuD;AAAA,MAC7E;AAAA,IACF,SAAS,OAAO;AACd,cAAQ,cAAc;AACtB,WAAK,QAAQ,cAAc;AAC3B,WAAK,MAAM,kDAAkD,gBAAgB,KAAK;AAClF,aAAO,cAAc,OAAO;AAAA,IAC9B;AACA,YAAQ,UAAU,KAAK;AACvB,QAAI,KAAK,SAAS,EAAG,MAAK,QAAQ,WAAW,KAAK,MAAM;AAExD,QAAI,SAAS;AACb,UAAM,SAAS,YAA2B;AACxC,iBAAS;AACP,cAAM,QAAQ;AACd,kBAAU;AACV,cAAM,MAAM,KAAK,KAAK;AACtB,YAAI,CAAC,IAAK;AACV,cAAM,KAAK,YAAY,KAAK,SAAS,YAAY;AAAA,MACnD;AAAA,IACF;AACA,UAAM,QAAQ;AAAA,MACZ,MAAM,KAAK,EAAE,QAAQ,KAAK,IAAI,KAAK,QAAQ,KAAK,SAAS,WAAW,EAAE,GAAG,MAAM;AAAA,IACjF;AACA,WAAO,cAAc,OAAO;AAAA,EAC9B;AAAA,EAEA,MAAM,YACJ,KACA,SACA,cACe;AACf,QAAI;AACJ,QAAI;AACF,cAAQ,mBAAmB,KAAK,KAAK,SAAS,OAAO,KAAK,aAAa,OAAO,QAAQ;AAAA,IACxF,SAAS,OAAO;AACd,YAAM,KAAK,sBAAsB,KAAK,wBAAwB,SAAS,KAAK;AAC5E;AAAA,IACF;AAEA,QAAI,IAAI,gBAAgB,KAAK,SAAS,aAAa;AACjD,YAAM,KAAK,iBAAiB,OAAO,mBAAmB,SAAS,IAAI;AACnE;AAAA,IACF;AAEA,UAAM,iBAAiB,IAAI,gBAAgB;AAC3C,UAAM,eAAe,IAAI,gBAAgB;AACzC,UAAM,WAAW,oBAAoB,cAAc,eAAe,MAAM;AACxE,QAAI,YAAY;AAChB,UAAM,UAAU,KAAK,YAAY,OAAO,aAAa,QAAQ,gBAAgB,MAAM;AACjF,kBAAY;AAAA,IACd,CAAC;AAED,QAAI,SAAmC;AACvC,QAAI;AACF,qBAAe,SAAS,MAAM;AAC9B,mCAA6B,KAAK,KAAK,aAAa,OAAO,QAAQ;AACnE,YAAM,eAAe,sBAAsB,IAAI,mBAAmB,IAAI,WAAW;AACjF,UAAI,IAAI,iBAAiB,KAAK,SAAS,gBAAgB;AACrD,cAAM,IAAI,2CAA2C,mBAAmB;AAAA,MAC1E;AACA,UAAI;AACF,iBAAS,MAAM,KAAK,aAAa,aAAa,KAAK;AAAA,UACjD,iBAAiB,IAAI;AAAA,UACrB,UAAU,KAAK,SAAS;AAAA,UACxB,kBAAkB,IAAI;AAAA,UACtB,QAAQ,SAAS;AAAA,QACnB,CAAC;AAAA,MACH,SAAS,OAAO;AACd,cAAM,4BAA4B,OAAO,MAAM;AAAA,MACjD;AACA,UAAI,OAAO,gBAAgB,UAAa,OAAO,gBAAgB,IAAI,gBAAgB;AACjF,cAAM,IAAI,2CAA2C,4BAA4B;AAAA,UAC/E,OAAO;AAAA,UACP,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AACA,UAAI;AACJ,UAAI;AACF,uBAAe,OAAO,OAAO,EAAE,QAAQ,SAAS,OAAO,CAAC;AAAA,MAC1D,SAAS,OAAO;AACd,cAAM,4BAA4B,OAAO,iBAAiB;AAAA,MAC5D;AACA,YAAM,gBAAgB;AAAA,QACpB;AAAA,QACA,IAAI;AAAA,QACJ,IAAI;AAAA,QACJ;AAAA,QACA,EAAE,OAAO,iBAAiB,SAAS,kBAAkB;AAAA,MACvD;AACA,UAAI;AACJ,UAAI;AACF,iBAAS,MAAM,KAAK,aAAa,OAAO,YAAY;AAAA,UAClD;AAAA,UACA,mBAAmB;AAAA,UACnB,UAAU,cAAc;AAAA,UACxB,QAAQ,SAAS;AAAA,QACnB,CAAC;AACD,cAAM,cAAc;AAAA,MACtB,SAAS,OAAO;AAId,aAAK,cAAc,KAAK,MAAM,MAAM,MAAS;AAC7C,cAAM;AAAA,MACR;AACA,UAAI;AACF,cAAM,OAAO,gBAAgB,SAAS,MAAM;AAAA,MAC9C,SAAS,OAAO;AACd,cAAM,4BAA4B,OAAO,YAAY;AAAA,MACvD;AACA,2BAAqB,KAAK,MAAM;AAEhC,YAAM,UAAU,MAAM,KAAK,aAAa,aAAa,MAAM;AAAA,QACzD,QAAQ,OAAO;AAAA,QACf,aAAa,OAAO;AAAA,QACpB,UAAU,KAAK,SAAS;AAAA,QACxB,GAAI,OAAO,aAAa,SAAY,EAAE,kBAAkB,OAAO,SAAS,IAAI,CAAC;AAAA,QAC7E,GAAI,OAAO,gBAAgB,SAAY,EAAE,qBAAqB,OAAO,YAAY,IAAI,CAAC;AAAA,QACtF,QAAQ,SAAS;AAAA,MACnB,CAAC;AACD,UAAI;AACJ,UAAI;AACF,mBAAW,MAAM,KAAK,aAAa,eAAe,OAAO;AAAA,UACvD,iBAAiB,QAAQ;AAAA,UACzB,kBAAkB,QAAQ;AAAA,UAC1B,qBAAqB,QAAQ;AAAA,UAC7B,kBAAkB,OAAO;AAAA,UACzB,QAAQ,IAAI;AAAA,UACZ,SAAS,IAAI;AAAA,UACb,cAAc,IAAI;AAAA,UAClB,sBAAsB,OAAO;AAAA,UAC7B,UAAU,KAAK,SAAS;AAAA,UACxB,QAAQ,SAAS;AAAA,QACnB,CAAC;AAAA,MACH,SAAS,OAAO;AACd,YAAI,iBAAiB,wBAAwB;AAC3C,gBAAM,IAAI,2CAA2C,4BAA4B;AAAA,QACnF;AACA,cAAM;AAAA,MACR;AACA,sCAAgC,KAAK,SAAS,QAAQ;AAEtD,mBAAa,MAAM;AACnB,YAAM;AACN,UAAI,UAAW,OAAM,IAAI,2CAA2C;AACpE,qBAAe,SAAS,MAAM;AAC9B,YAAM,KAAK,aAAa,MAAM,MAAM;AAAA,QAClC,GAAG;AAAA,QACH,iBAAiB,KAAK,SAAS;AAAA,MACjC,CAAC;AACD,YAAM,MAAM,uBAAuB,KAAK,QAAQ,WAAW;AAC3D,YAAM,KAAK,aAAa,MAAM,QAAQ;AAAA,QACpC,GAAG;AAAA,QACH,GAAG;AAAA,QACH,iBAAiB,QAAQ;AAAA,QACzB,UAAU,QAAQ;AAAA,QAClB,aAAa,QAAQ;AAAA,QACrB,UAAU,OAAO;AAAA,QACjB,YAAY,KAAK,aAAa,MAAM,IAAI,EAAE,YAAY;AAAA,MACxD,CAAC;AACD,cAAQ,aAAa;AACrB,WAAK,QAAQ,WAAW;AAAA,IAC1B,SAAS,OAAO;AACd,mBAAa,MAAM;AACnB,YAAM;AACN,UAAI,aAAa,aAAa,KAAK,GAAG;AACpC,gBAAQ,aAAa;AACrB,aAAK,QAAQ,YAAY;AACzB,aAAK,MAAM,oDAAoD,cAAc,KAAK;AAAA,MACpF,WAAW,SAAS,OAAO,WAAW,aAAa,KAAK,GAAG;AACzD,gBAAQ,aAAa;AACrB,aAAK,QAAQ,WAAW;AAAA,MAC1B,OAAO;AACL,cAAM,YAAY,2BAA2B,KAAK;AAClD,YAAI,WAAW;AACb,gBAAM,KAAK,iBAAiB,OAAO,WAAW,SAAS,KAAK;AAAA,QAC9D,OAAO;AAGL,kBAAQ,iBAAiB;AACzB,eAAK,QAAQ,gBAAgB;AAC7B,eAAK;AAAA,YACH;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,UAAE;AACA,mBAAa,MAAM;AACnB,eAAS,QAAQ;AACjB,UAAI,OAAQ,OAAM,OAAO,MAAM;AAAA,IACjC;AAAA,EACF;AAAA,EAEA,MAAM,YACJ,OACA,QACA,gBACA,aACe;AACf,WACE,MAAM,aAAa,KAAK,aAAa,WAAW,KAAK,SAAS,sBAAsB,MAAM,GAC1F;AACA,UAAI;AACF,cAAM,KAAK,aAAa,MAAM,MAAM;AAAA,UAClC,GAAG;AAAA,UACH,iBAAiB,KAAK,SAAS;AAAA,QACjC,CAAC;AAAA,MACH,SAAS,OAAO;AACd,oBAAY;AACZ,uBAAe,MAAM,KAAK;AAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,iBACJ,OACA,MACA,SACA,OACe;AACf,QAAI;AACF,YAAM,KAAK,aAAa,MAAM,MAAM;AAAA,QAClC,GAAG;AAAA,QACH,iBAAiB,KAAK,SAAS;AAAA,MACjC,CAAC;AACD,YAAM,KAAK,aAAa,MAAM,KAAK,EAAE,GAAG,OAAO,WAAW,KAAK,CAAC;AAChE,cAAQ,gBAAgB;AACxB,WAAK,QAAQ,eAAe;AAC5B,UAAI,MAAO,MAAK,MAAM,uDAAuD,MAAM,KAAK;AAAA,IAC1F,SAAS,OAAO;AACd,cAAQ,aAAa;AACrB,WAAK,QAAQ,YAAY;AACzB,WAAK,MAAM,uDAAuD,cAAc,KAAK;AAAA,IACvF;AAAA,EACF;AAAA,EAEA,MAAM,sBACJ,KACA,MACA,SACA,OACe;AACf,QAAI;AACF,YAAM,QAAQ,SAAS,KAAK,KAAK,SAAS,KAAK;AAC/C,YAAM,KAAK,iBAAiB,OAAO,MAAM,SAAS,KAAK;AAAA,IACzD,SAAS,OAAO;AACd,cAAQ,aAAa;AACrB,WAAK,QAAQ,YAAY;AACzB,WAAK,MAAM,sDAAsD,cAAc,KAAK;AAAA,IACtF;AAAA,EACF;AAAA,EAEA,QAAQ,SAAoD,QAAQ,GAAS;AAC3E,QAAI;AACF,WAAK,aAAa,SAAS,UAAU,SAAS,KAAK;AAAA,IACrD,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAM,SAAiB,MAAc,OAAsB;AACzD,QAAI;AACF,WAAK,aAAa,QAAQ,KAAK,SAAS;AAAA,QACtC;AAAA,QACA,YAAY,iBAAiB,QAAQ,MAAM,OAAO;AAAA,QAClD,GAAI,iBAAiB,8CAA8C,MAAM,aACrE;AAAA,UACE,cAAc,MAAM,WAAW;AAAA,UAC/B,gBAAgB,MAAM,WAAW;AAAA,QACnC,IACA,CAAC;AAAA,MACP,CAAC;AAAA,IACH,QAAQ;AAAA,IAER;AAAA,EACF;AACF;AAiBO,SAAS,6CACd,OACqC;AACrC,MAAI,CAAC,MAAM,QAAS,QAAO;AAC3B,MAAI,MAAM,iBAAiB,8CAA8C;AACvE,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACA,MAAI,CAAC,MAAM,yBAAyB;AAClC,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,QAAM,eAAe,MAAM;AAC3B,MACE,CAAC,cAAc,SACf,CAAC,aAAa,gBACd,CAAC,aAAa,gBACd,CAAC,aAAa,kBACd,CAAC,aAAa,UACd,CAAC,aAAa,aACd,CAAC,aAAa,OACd;AACA,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AACA;AAAA,IACE,aAAa,OAAO;AAAA,IACpB,MAAM,gCAAgC;AAAA,EACxC;AACA,MAAI,CAAC,MAAM,QAAS,OAAM,IAAI,MAAM,qDAAqD;AACzF,SAAO,IAAI;AAAA,IACT;AAAA,IACA,MAAM;AAAA,IACN,MAAM,gCAAgC,SAClC,CAAC,IACD,EAAE,6BAA6B,MAAM,4BAA4B;AAAA,EACvE;AACF;AAEO,IAAM,8CACX,OAAO,OAAO;AAAA,EACZ,MAAM,cAAsB,QAAoC;AAC9D,WAAO,IAAI,QAAc,CAAC,SAAS,WAAW;AAC5C,UAAI,OAAO,SAAS;AAClB,eAAO,OAAO,UAAU,WAAW,CAAC;AACpC;AAAA,MACF;AACA,YAAM,WAAW,MAAM;AACrB,eAAO,oBAAoB,SAAS,KAAK;AACzC,gBAAQ;AAAA,MACV;AACA,YAAM,QAAQ,WAAW,UAAU,YAAY;AAC/C,YAAM,QAAQ;AACd,YAAM,QAAQ,MAAM;AAClB,qBAAa,KAAK;AAClB,eAAO,oBAAoB,SAAS,KAAK;AACzC,eAAO,OAAO,UAAU,WAAW,CAAC;AAAA,MACtC;AACA,aAAO,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AAAA,IACxD,CAAC;AAAA,EACH;AACF,CAAC;AAEI,IAAM,0CACX,OAAO,OAAO,EAAE,KAAK,MAAM,oBAAI,KAAK,EAAE,CAAC;AAEzC,SAAS,iBAAiB,SAAiE;AACzF,QAAM,aAAgC,OAAO,OAAO;AAAA,IAClD,OAAO,cAAc,QAAQ,KAAK;AAAA,IAClC,WAAW,QAAQ,aAAa,gBAAgB;AAAA,IAChD,aAAa,QAAQ,eAAe,gBAAgB;AAAA,IACpD,iBAAiB,QAAQ,mBAAmB,gBAAgB;AAAA,IAC5D,sBAAsB,QAAQ,wBAAwB,gBAAgB;AAAA,IACtE,gBAAgB,QAAQ,kBAAkB,gBAAgB;AAAA,IAC1D,gBAAgB,QAAQ,kBAAkB,gBAAgB;AAAA,IAC1D,aAAa,QAAQ,eAAe,gBAAgB;AAAA,IACpD,gBAAgB,QAAQ,kBAAkB,gBAAgB;AAAA,IAC1D,gBAAgB,QAAQ,kBAAkB,gBAAgB;AAAA,EAC5D,CAAC;AACD,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,UAAU,GAAG;AACvD,QAAI,UAAU,QAAS;AACvB,oBAAgB,OAAO,KAAK;AAAA,EAC9B;AACA,MAAI,WAAW,YAAY,GAAI,OAAM,IAAI,UAAU,oCAAoC;AACvF,MAAI,WAAW,cAAc,WAAW,WAAW;AACjD,UAAM,IAAI,UAAU,iDAAiD;AAAA,EACvE;AACA,MAAI,WAAW,kBAAkB,OAAU,WAAW,kBAAkB,OAAY;AAClF,UAAM,IAAI,UAAU,4DAA4D;AAAA,EAClF;AACA,MAAI,WAAW,uBAAuB,KAAK,WAAW,iBAAiB;AACrE,UAAM,IAAI,UAAU,gEAAgE;AAAA,EACtF;AACA,MAAI,WAAW,cAAc,IAAO,OAAM,IAAI,UAAU,mCAAmC;AAC3F,MAAI,WAAW,iBAAiB,iDAAiD;AAC/E,UAAM,IAAI,UAAU,wDAAwD;AAAA,EAC9E;AACA,MAAI,WAAW,iBAAiB,iDAAiD;AAC/E,UAAM,IAAI,UAAU,wDAAwD;AAAA,EAC9E;AACA,SAAO;AACT;AAEA,SAAS,mBACP,KACA,OACA,QACsC;AACtC,QAAM,QAAQ,SAAS,KAAK,KAAK;AACjC,MAAI,IAAI,eAAe,MAAO,OAAM,IAAI,UAAU,sCAAsC;AACxF,kBAAgB,IAAI,qBAAqB,GAAG,0BAA0B;AACtE,kBAAgB,IAAI,gBAAgB,kBAAkB;AACtD,kBAAgB,IAAI,oBAAoB,sBAAsB;AAC9D,kBAAgB,IAAI,0BAA0B,4BAA4B;AAC1E,kBAAgB,IAAI,yBAAyB,2BAA2B;AACxE,kBAAgB,IAAI,cAAc,eAAe;AACjD,WAAS,IAAI,YAAY,aAAa;AACtC,WAAS,IAAI,OAAO,QAAQ;AAC5B,WAAS,IAAI,iBAAiB,mBAAmB;AACjD,MAAI,IAAI,cAAc,KAAM,UAAS,IAAI,WAAW,YAAY;AAChE,gBAAc,IAAI,WAAW,YAAY;AACzC,gBAAc,IAAI,mBAAmB,qBAAqB;AAC1D,gBAAc,IAAI,aAAa,cAAc;AAC7C,gBAAc,IAAI,kBAAkB,oBAAoB;AACxD,gBAAc,IAAI,YAAY,aAAa;AAC3C,cAAY,IAAI,uBAAuB,2BAA2B,IAAK;AACvE,cAAY,IAAI,gBAAgB,oBAAoB,GAAG;AACvD,cAAY,IAAI,SAAS,YAAY,GAAG;AACxC,cAAY,IAAI,cAAc,iBAAiB,GAAG;AAClD,cAAY,IAAI,eAAe,kBAAkB,0CAA0C;AAC3F,4BAA0B,IAAI,UAAU,IAAI,MAAM;AAClD,+BAA6B,KAAK,MAAM;AACxC,SAAO;AACT;AAEA,SAAS,SACP,KACA,OACsC;AACtC,cAAY,IAAI,OAAO,WAAW,cAAc,GAAG;AACnD,cAAY,IAAI,OAAO,aAAa,gBAAgB,GAAG;AACvD,WAAS,IAAI,YAAY,aAAa;AACtC,WAAS,IAAI,OAAO,QAAQ;AAC5B,kBAAgB,IAAI,cAAc,eAAe;AACjD,gBAAc,KAAK;AACnB,SAAO,OAAO,OAAO;AAAA,IACnB,OAAO,OAAO,OAAO,EAAE,GAAG,IAAI,MAAM,CAAC;AAAA,IACrC,YAAY,IAAI;AAAA,IAChB,OAAO,IAAI;AAAA,IACX;AAAA,IACA,cAAc,IAAI;AAAA,EACpB,CAAC;AACH;AAEA,SAAS,2BACP,UACA,8BAA8B,OACxB;AACN,MACE,SAAS,SAAS,YAClB,SAAS,cAAc,gBACvB,SAAS,qBAAqB,OAC9B;AACA,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AACA,MAAI,SAAS,2BAA2B,GAAG;AACzC,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACtF;AACA,MAAI,SAAS,iBAAiB;AAC5B,QAAI,SAAS,YAAY,UAAU;AACjC,YAAM,IAAI,MAAM,kEAAkE;AAAA,IACpF;AACA,oBAAgB,SAAS,kBAAkB,qBAAqB;AAChE,oBAAgB,SAAS,gBAAgB,uBAAuB;AAChE,oBAAgB,SAAS,qBAAqB,8BAA8B;AAC5E,oBAAgB,SAAS,cAAc,sBAAsB;AAC7D,oBAAgB,SAAS,oBAAoB,wBAAwB;AAAA,EACvE,WACE,CAAC,+BACD,SAAS,YAAY,UACrB,SAAS,qBAAqB,KAC9B,SAAS,mBAAmB,KAC5B,SAAS,wBAAwB,KACjC,SAAS,iBAAiB,KAC1B,SAAS,uBAAuB,GAChC;AACA,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACtF;AACA,kBAAgB,SAAS,gBAAgB,qBAAqB;AAC9D,cAAY,SAAS,eAAe,kBAAkB,0CAA0C;AAChG,cAAY,SAAS,eAAe,yBAAyB,GAAG;AAChE,gBAAc,SAAS,kBAAkB,oBAAoB;AAC7D,gBAAc,SAAS,YAAY,aAAa;AAChD,MAAI,CAAC,SAAS,iBAAiB,OAAO,SAAS,kBAAkB,UAAU;AACzE,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AACA,aAAW,CAAC,SAAS,OAAO,KAAK,OAAO,QAAQ,SAAS,aAAa,GAAG;AACvE,gBAAY,SAAS,YAAY,GAAG;AACpC,gBAAY,SAAS,iBAAiB,GAAG;AAAA,EAC3C;AACA,aAAW,CAAC,OAAO,QAAQ,QAAQ,KAAK;AAAA,IACtC;AAAA,MACE;AAAA,MACA,SAAS;AAAA,MACT;AAAA,IACF;AAAA,IACA;AAAA,MACE;AAAA,MACA,SAAS;AAAA,MACT;AAAA,IACF;AAAA,IACA;AAAA,MACE;AAAA,MACA,SAAS;AAAA,MACT;AAAA,IACF;AAAA,EACF,GAAY;AACV,QAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,KAAK,OAAO,CAAC,MAAM,UAAU;AAC3E,YAAM,IAAI,MAAM,4BAA4B,KAAK,uBAAuB;AAAA,IAC1E;AAAA,EACF;AACF;AAEA,SAAS,6BACP,KACA,UACM;AACN,QAAM,aACJ,SAAS,kBAAkB,IAAI,iBAC/B,SAAS,cAAc,IAAI,OAAO,MAAM,IAAI,gBAC5C,SAAS,qBAAqB,IAAI,oBAClC,SAAS,eAAe,IAAI,cAC5B,IAAI,uBAAuB,SAAS,6BAA6B,CAAC,KAClE,IAAI,6BAA6B,SAAS,mCAAmC,CAAC,KAC9E,IAAI,4BAA4B,SAAS,kCAAkC,CAAC;AAC9E,MAAI,CAAC,WAAY,OAAM,IAAI,2CAA2C,qBAAqB;AAC7F;AAEA,SAAS,qBACP,KACA,QACM;AACN,MACE,OAAO,iBAAiB,IAAI,sBAC5B,OAAO,cAAc,IAAI,aACzB,OAAO,WAAW,IAAI,UACtB,OAAO,aAAa,kBAAkB,IAAI,MAAM,KAChD,OAAO,YAAY,IAAI,WACvB,OAAO,iBAAiB,IAAI,gBAC5B,OAAO,kBAAkB,IAAI,iBAC7B,OAAO,qBAAqB,IAAI,oBAChC,OAAO,eAAe,IAAI,cAC1B,CAAC,OAAO,UACR,OAAO,OAAO,OAAO,OAAO,aAAa,MAAM,YAC/C;AACA,UAAM,IAAI,2CAA2C,wBAAwB;AAAA,EAC/E;AACA,MAAI,OAAO,aAAa,OAAW,iBAAgB,OAAO,UAAU,qBAAqB;AACzF,MAAI,OAAO,gBAAgB,OAAW,eAAc,OAAO,aAAa,oBAAoB;AAC5F,gBAAc,OAAO,cAAc,sBAAsB;AAC3D;AAEA,SAAS,gCACP,KACA,SAMA,UACM;AACN,MACE,SAAS,oBAAoB,QAAQ,mBACrC,SAAS,aAAa,QAAQ,YAC9B,SAAS,gBAAgB,QAAQ,eACjC,SAAS,aAAa,QAAQ,eAC9B,SAAS,WAAW,IAAI,UACxB,SAAS,YAAY,IAAI,WACzB,SAAS,iBAAiB,IAAI,cAC9B;AACA,UAAM,IAAI,2CAA2C,4BAA4B;AAAA,EACnF;AACF;AAEA,SAAS,sBAAsB,OAAe,cAAkC;AAC9E,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI,2CAA2C,sBAAsB;AAAA,EAC7E;AACA,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,KAAK;AAC5C,MAAI,MAAM,aAAa,kDAAkD;AACvE,UAAM,IAAI,2CAA2C,sBAAsB;AAAA,EAC7E;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,QAAI,KAAK,UAAU,MAAM,MAAM,OAAO;AACpC,YAAM,IAAI,MAAM,uBAAuB;AAAA,IACzC;AAAA,EACF,QAAQ;AACN,UAAM,IAAI,2CAA2C,sBAAsB;AAAA,EAC7E;AACA,MAAI,UAAU,KAAK,MAAM,cAAc;AACrC,UAAM,IAAI,2CAA2C,sBAAsB;AAAA,EAC7E;AACA,SAAO;AACT;AAEA,SAAS,iBACP,QACA,kBACA,qBACA,MACA,YAC4D;AAC5D,MAAI;AACJ,MAAI;AACJ,QAAM,OAAO,IAAI,QAAc,CAAC,SAAS,kBAAkB;AACzD,aAAS;AACT,aAAS;AAAA,EACX,CAAC;AACD,MAAI,UAAU;AACd,QAAM,SAAoC,OAAO,OAAO;AAAA,IACtD,QAAQ,OAAO,aAAa,IAAuC;AACjE,UAAI,SAAS;AACX,cAAM,QAAQ,IAAI,2CAA2C,MAAM,UAAU;AAC7E,eAAO,KAAK;AACZ,cAAM;AAAA,MACR;AACA,gBAAU;AACV,YAAM,SAAS,WAAW,QAAQ;AAClC,UAAI,WAAW;AACf,UAAI;AACF,yBAAiB,SAAS,QAAQ;AAChC,cAAI,EAAE,iBAAiB,eAAe,MAAM,eAAe,GAAG;AAC5D,kBAAM,IAAI,2CAA2C,MAAM,UAAU;AAAA,UACvE;AACA,sBAAY,MAAM;AAClB,cAAI,WAAW,kBAAkB;AAC/B,kBAAM,IAAI,2CAA2C,MAAM,UAAU;AAAA,UACvE;AACA,iBAAO,OAAO,KAAK;AACnB,gBAAM,MAAM,MAAM;AAAA,QACpB;AACA,YAAI,aAAa,kBAAkB;AACjC,gBAAM,IAAI,2CAA2C,MAAM,UAAU;AAAA,QACvE;AACA,cAAM,cAAc,UAAU,OAAO,OAAO,KAAK,CAAC;AAClD,YAAI,gBAAgB,qBAAqB;AACvC,gBAAM,IAAI,2CAA2C,MAAM,UAAU;AAAA,QACvE;AACA,eAAO;AAAA,MACT,SAAS,OAAO;AACd,cAAM,YAAY,4BAA4B,OAAO,iBAAiB;AACtE,eAAO,SAAS;AAChB,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF,CAAC;AACD,SAAO,EAAE,QAAQ,KAAK;AACxB;AAEA,SAAS,4BACP,OACA,SAIS;AACT,QAAM,OAAO,2BAA2B,KAAK;AAC7C,SAAO,OACH,IAAI,2CAA2C,MAAM,EAAE,OAAO,iBAAiB,QAAQ,CAAC,IACxF;AACN;AAEA,SAAS,uBACP,KACA,aACyC;AACzC,SAAO;AAAA,IACL,UAAU,sBAAsB,UAAU,KAAK,WAAW;AAAA,IAC1D,WAAW,sBAAsB,QAAQ,KAAK,WAAW;AAAA,EAC3D;AACF;AAEA,SAAS,sBACP,MACA,KACA,aACQ;AACR,QAAM,SAAS,WAAW,QAAQ;AAClC,SAAO,OAAO,8CAA8C,IAAI,UAAU,MAAM;AAChF,aAAW,SAAS;AAAA,IAClB,IAAI,MAAM;AAAA,IACV,IAAI,MAAM;AAAA,IACV,IAAI;AAAA,IACJ,IAAI;AAAA,IACJ;AAAA,EACF,GAAG;AACD,UAAM,QAAQ,OAAO,KAAK,OAAO,MAAM;AACvC,UAAM,SAAS,OAAO,YAAY,CAAC;AACnC,WAAO,cAAc,MAAM,UAAU;AACrC,WAAO,OAAO,MAAM;AACpB,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,QAAM,KAAK,OAAO,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAC3C,SAAO,QAAQ,KAAK,EAAE,IAAI,IAAI,GAAG,MAAM,CAAC,CAAC,KAAK;AAChD;AAEA,SAAS,UAAU,OAA2B;AAC5C,SAAO,UAAU,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK,CAAC;AACnE;AAEA,SAAS,0BACP,UACA,QACM;AACN,QAAM,UAAwF;AAAA,IAC5F,aAAa,CAAC,QAAQ,OAAO,OAAO,MAAM;AAAA,IAC1C,cAAc,CAAC,QAAQ,OAAO,OAAO,MAAM;AAAA,IAC3C,UAAU,CAAC,QAAQ,OAAO,OAAO,MAAM;AAAA,EACzC;AACA,MAAI,CAAC,QAAQ,QAAQ,GAAG,SAAS,MAAM,GAAG;AACxC,UAAM,IAAI,UAAU,yDAAyD;AAAA,EAC/E;AACF;AAEO,SAAS,kBACd,QACyC;AACzC,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,EACX;AACF;AAEA,SAAS,cAAc,OAAwB;AAC7C,MACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,SAAS,OACf,MAAM,KAAK,MAAM,SACjB,CAAC,sBAAsB,KAAK,KAAK,GACjC;AACA,UAAM,IAAI,UAAU,+BAA+B;AAAA,EACrD;AACA,SAAO;AACT;AAEA,SAAS,SAAS,OAAgB,OAAuB;AACvD,MAAI,OAAO,UAAU,YAAY,CAAC,kBAAkB,KAAK,KAAK,KAAK,QAAQ,KAAK,KAAK,GAAG;AACtF,UAAM,IAAI,UAAU,GAAG,KAAK,aAAa;AAAA,EAC3C;AACA,SAAO;AACT;AAEA,SAAS,cAAc,OAAgB,OAAuB;AAC5D,MAAI,OAAO,UAAU,YAAY,CAAC,yBAAyB,KAAK,KAAK,GAAG;AACtE,UAAM,IAAI,UAAU,GAAG,KAAK,aAAa;AAAA,EAC3C;AACA,SAAO;AACT;AAEA,SAAS,YAAY,OAAgB,OAAe,UAA0B;AAC5E,MACE,OAAO,UAAU,YACjB,MAAM,WAAW,KACjB,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE,aAAa,YAC7C,MAAM,KAAK,MAAM,SACjB,yBAAyB,KAAK,KAAK,GACnC;AACA,UAAM,IAAI,UAAU,GAAG,KAAK,aAAa;AAAA,EAC3C;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAgB,OAAuB;AAC9D,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAAG;AAC3E,UAAM,IAAI,UAAU,GAAG,KAAK,kCAAkC;AAAA,EAChE;AACA,SAAO;AACT;AAEA,SAAS,aAAa,OAAyB;AAC7C,SACE,iBAAiB,8CAChB,OAAO,UAAU,YAChB,UAAU,QACV,UAAU,SACV,MAAM,SAAS;AAErB;AAEA,SAAS,2BACP,OACmD;AACnD,MAAI,iBAAiB,2CAA4C,QAAO,MAAM;AAC9E,MAAI,iBAAiB,wBAAwB;AAC3C,QAAI,MAAM,SAAS,aAAc,QAAO;AACxC,QACE,MAAM,SAAS,oBACf,MAAM,SAAS,eACf,MAAM,SAAS,oBACf,MAAM,SAAS,mBACf;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,iBAAiB,yBAAyB;AAC5C,QAAI,MAAM,SAAS,aAAc,QAAO;AACxC,QACE,MAAM,SAAS,2BACf,MAAM,SAAS,uBACf,MAAM,SAAS,eACf,MAAM,SAAS,mBACf;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,OAAyB;AAC7C,SAAO,iBAAiB,eACpB,MAAM,SAAS,eACf,iBAAiB,SAAS,MAAM,SAAS;AAC/C;AAEA,SAAS,eAAe,QAA2B;AACjD,MAAI,OAAO,QAAS,OAAM,OAAO,UAAU,WAAW;AACxD;AAEA,SAAS,aAA2B;AAClC,SAAO,IAAI,aAAa,qBAAqB,YAAY;AAC3D;AAEA,SAAS,oBACP,OACA,QAC0C;AAC1C,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,UAAU,QAAQ,CAAC,OAAO,MAAM,IAAI,CAAC,MAAM;AACjD,QAAM,YAAuD,CAAC;AAC9D,aAAW,UAAU,SAAS;AAC5B,UAAM,WAAW,MAAM,WAAW,MAAM,OAAO,MAAM;AACrD,QAAI,OAAO,QAAS,UAAS;AAAA,SACxB;AACH,aAAO,iBAAiB,SAAS,UAAU,EAAE,MAAM,KAAK,CAAC;AACzD,gBAAU,KAAK,CAAC,QAAQ,QAAQ,CAAC;AAAA,IACnC;AAAA,EACF;AACA,SAAO;AAAA,IACL,QAAQ,WAAW;AAAA,IACnB,UAAU;AACR,iBAAW,CAAC,QAAQ,QAAQ,KAAK,WAAW;AAC1C,eAAO,oBAAoB,SAAS,QAAQ;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,aACb,WACA,cACA,QACkB;AAClB,MAAI;AACF,UAAM,UAAU,MAAM,cAAc,MAAM;AAC1C,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,OAAO,WAAW,aAAa,KAAK,EAAG,QAAO;AAClD,UAAM;AAAA,EACR;AACF;AAEA,SAAS,iBAAiC;AACxC,SAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe;AAAA,IACf,WAAW;AAAA,IACX,WAAW;AAAA,IACX,aAAa;AAAA,EACf;AACF;AAEA,SAAS,cAAc,SAAkE;AACvF,SAAO,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC;AACrC;;;ACnxCA,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,OAAO,SAAS,MAAM,UAA2B;AAC1D,SAAS,cAAc;AACvB,SAAS,YAAY;AAErB;AAAA,EACE,0BAAAC;AAAA,EACA;AAAA,OAIK;AAYP,IAAM,SAAS;AACf,IAAM,sBAAsB;AAC5B,IAAM,6BAA6B;AACnC,IAAM,gCAAgC,OAAO;AAC7C,IAAM,wBAAwB;AAC9B,IAAM,2BAA2B;AACjC,IAAM,2BAA2B,KAAK,OAAO;AAGtC,SAAS,0CACd,SACuB;AACvB,SAAO,gCAAgC,SAAS,EAAE,WAAW,oBAAoB,CAAC,EAAE;AACtF;AAGO,SAAS,0CACd,SACiC;AACjC,SAAO,gCAAgC,SAAS;AAAA,IAC9C,WAAW;AAAA,EACb,CAAC,EAAE;AACL;AAOO,SAAS,4CACd,SACA,kBAC6C;AAC7C,QAAM,OAAO,gCAAgC,SAAS;AAAA,IACpD,WAAW;AAAA,EACb,CAAC,EAAE;AACH,SAAO,OAAO,OAAO;AAAA,IACnB,MAAM,OACJ,OACkD;AAClD,wBAAkB,MAAM,eAAe;AACvC,oBAAc,MAAM,QAAQ;AAC5B,UACE,CAAC,OAAO,cAAc,MAAM,gBAAgB,KAC5C,MAAM,oBAAoB,KAC1B,MAAM,mBAAmB,MAAM,YAC/B,CAAC,OAAO,KAAK,MAAM,mBAAmB,GACtC;AACA,cAAM,IAAIC,wBAAuB,iBAAiB;AAAA,MACpD;AACA,MAAAC,gBAAe,MAAM,MAAM;AAC3B,YAAM,mBAAmB,MAAM,QAAQ,KAAK,OAAO,GAAG,2BAA2B,CAAC;AAClF,YAAM,cAAc,KAAK,kBAAkB,SAAS;AACpD,UAAI,gBAAmC;AACvC,UAAI;AACF,cAAM,MAAM,kBAAkB,GAAK;AACnC,wBAAgB,MAAM,KAAK,aAAa,MAAM,GAAK;AACnD,cAAM,SAAS,MAAM,KAAK,KAAK;AAAA,UAC7B,iBAAiB,MAAM;AAAA,UACvB,UAAU,MAAM;AAAA,UAChB,kBAAkB,MAAM;AAAA,UACxB,QAAQ,MAAM;AAAA,QAChB,CAAC;AACD,YAAI;AACF,cAAI,OAAO,gBAAgB,UAAa,OAAO,gBAAgB,MAAM,kBAAkB;AACrF,kBAAM,IAAID,wBAAuB,gBAAgB;AAAA,UACnD;AACA,gBAAM,SAASE,YAAW,QAAQ;AAClC,cAAI,SAAS;AACb,2BAAiB,SAAS,OAAO,OAAO,EAAE,QAAQ,MAAM,OAAO,CAAC,GAAG;AACjE,gBAAI,SAAS,MAAM,aAAa,MAAM,kBAAkB;AACtD,oBAAM,IAAIF,wBAAuB,gBAAgB;AAAA,YACnD;AACA,kBAAM,SAAS,eAAe,OAAO,MAAM;AAC3C,mBAAO,OAAO,KAAK;AACnB,sBAAU,MAAM;AAAA,UAClB;AACA,cACE,WAAW,MAAM,oBACjB,UAAU,OAAO,OAAO,KAAK,CAAC,OAAO,MAAM,qBAC3C;AACA,kBAAM,IAAIA,wBAAuB,gBAAgB;AAAA,UACnD;AACA,gBAAM,OAAO,gBAAgB,MAAM,MAAM;AAAA,QAC3C,UAAE;AACA,gBAAM,OAAO,MAAM;AAAA,QACrB;AACA,cAAM,cAAc,MAAM;AAC1B,wBAAgB;AAChB,cAAM;AAAA,UACJ;AAAA,UACA,MAAM;AAAA,UACN,MAAM;AAAA,UACN,MAAM;AAAA,UACN,MAAM;AAAA,QACR;AACA,YAAI;AACF,gBAAM,iBAAiB,OAAO;AAAA,YAC5B,QAAQ,MAAM;AAAA,YACd,SAAS,MAAM;AAAA,YACf,cAAc,MAAM;AAAA,YACpB,sBAAsB,MAAM;AAAA,YAC5B,UAAU,MAAM;AAAA,YAChB,QAAQ,WAAW,aAAa,MAAM,kBAAkB,MAAM,MAAM;AAAA,YACpE,QAAQ,MAAM;AAAA,UAChB,CAAC;AAAA,QACH,SAAS,OAAO;AACd,UAAAC,gBAAe,MAAM,MAAM;AAC3B,6CAAmC,KAAK;AACxC,gBAAM,IAAID,wBAAuB,gBAAgB;AAAA,QACnD;AACA,QAAAC,gBAAe,MAAM,MAAM;AAC3B,eAAO,OAAO,OAAO;AAAA,UACnB,iBAAiB,MAAM;AAAA,UACvB,UAAU,MAAM;AAAA,UAChB,aAAa,MAAM;AAAA,UACnB,UAAU,MAAM;AAAA,UAChB,QAAQ,MAAM;AAAA,UACd,SAAS,MAAM;AAAA,UACf,cAAc,MAAM;AAAA,QACtB,CAAC;AAAA,MACH,UAAE;AACA,YAAI,cAAe,OAAM,cAAc,MAAM,EAAE,MAAM,MAAM,MAAS;AACpE,cAAM,GAAG,kBAAkB,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,MAC7D;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,eAAe,aACb,MACA,UACA,QACA,UACA,QACe;AACf,MAAI,aAAa,kBAAkB,MAAM,GAAG;AAC1C,UAAM,IAAID,wBAAuB,gBAAgB;AAAA,EACnD;AACA,QAAM,SAAS,MAAM,KAAK,MAAM,GAAG;AACnC,MAAI;AACF,IAAAC,gBAAe,MAAM;AACrB,YAAQ,QAAQ;AAAA,MACd,KAAK;AACH,cAAM,oBAAoB,QAAQ,UAAU,mBAAmB,MAAM;AACrE;AAAA,MACF,KAAK;AACH,cAAM,oBAAoB,QAAQ,UAAU,wBAAwB,MAAM;AAC1E;AAAA,MACF,KAAK;AACH,cAAM,oBAAoB,QAAQ,UAAU,qBAAqB,MAAM;AACvE;AAAA,MACF,KAAK,OAAO;AACV,cAAM,QAAQ,MAAM,UAAU,QAAQ,GAAG,CAAC;AAC1C,cAAM,MAAM,MAAM,UAAU,QAAQ,WAAW,GAAG,CAAC;AACnD,YAAI,CAAC,gBAAgB,OAAO,OAAO,KAAK,CAAC,gBAAgB,KAAK,OAAO,GAAG;AACtE,gBAAM,IAAI,MAAM,qBAAqB;AAAA,QACvC;AACA;AAAA,MACF;AAAA,MACA,KAAK;AACH,YACE,CAAC;AAAA,UACC,MAAM,UAAU,QAAQ,GAAG,CAAC;AAAA,UAC5B,CAAC,KAAM,IAAM,IAAM,IAAM,IAAM,IAAM,IAAM,EAAI;AAAA,QACjD,GACA;AACA,gBAAM,IAAI,MAAM,uBAAuB;AAAA,QACzC;AACA;AAAA,MACF,KAAK,QAAQ;AACX,cAAM,SAAS,MAAM,UAAU,QAAQ,GAAG,EAAE;AAC5C,YAAI,CAAC,gBAAgB,QAAQ,MAAM,KAAK,CAAC,QAAQ,QAAQ,GAAG,MAAM,GAAG;AACnE,gBAAM,IAAI,MAAM,wBAAwB;AAAA,QAC1C;AACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AACN,IAAAA,gBAAe,MAAM;AACrB,UAAM,IAAID,wBAAuB,gBAAgB;AAAA,EACnD,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAEA,eAAe,oBACb,QACA,UACA,cACA,QACe;AACf,MAAI,CAAC,YAAY,MAAM,UAAU,QAAQ,GAAG,CAAC,GAAG,CAAC,IAAM,IAAM,GAAM,CAAI,CAAC,GAAG;AACzE,UAAM,IAAI,MAAM,aAAa;AAAA,EAC/B;AACA,QAAM,WAAW,KAAK,IAAI,UAAU,qBAAqB;AACzD,QAAM,OAAO,MAAM,UAAU,QAAQ,WAAW,UAAU,QAAQ;AAClE,QAAM,aAAa,0BAA0B,IAAI;AACjD,QAAM,OAAO,WAAW,WAAW;AACnC,QAAM,OAAO,IAAI,SAAS,KAAK,QAAQ,KAAK,YAAY,KAAK,UAAU;AACvE,QAAM,OAAO,KAAK,UAAU,aAAa,GAAG,IAAI;AAChD,QAAM,cAAc,KAAK,UAAU,aAAa,GAAG,IAAI;AACvD,QAAM,cAAc,KAAK,UAAU,aAAa,GAAG,IAAI;AACvD,QAAM,UAAU,KAAK,UAAU,aAAa,IAAI,IAAI;AACpD,QAAM,cAAc,KAAK,UAAU,aAAa,IAAI,IAAI;AACxD,QAAM,gBAAgB,KAAK,UAAU,aAAa,IAAI,IAAI;AAC1D,QAAM,gBAAgB,KAAK,UAAU,aAAa,IAAI,IAAI;AAC1D,MACE,SAAS,KACT,gBAAgB,KAChB,gBAAgB,WAChB,YAAY,KACZ,gBAAgB,cAChB,kBAAkB,cAClB,OAAO,KAAK,kBAAkB,YAC9B,gBAAgB,gBAAgB,QAChC,gBAAgB,UAChB;AACA,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACjD;AACA,QAAM,QAAQ,oBAAI,IAAY;AAC9B,MAAI,SAAS;AACb,MAAI,iBAAiB;AACrB,WAAS,QAAQ,GAAG,QAAQ,SAAS,SAAS,GAAG;AAC/C,IAAAC,gBAAe,MAAM;AACrB,QAAI,SAAS,KAAK,MAAM;AACtB,YAAM,IAAI,MAAM,mBAAmB;AAAA,IACrC;AACA,UAAM,SAAS,MAAM,UAAU,QAAQ,QAAQ,EAAE;AACjD,UAAM,aAAa,IAAI,SAAS,OAAO,QAAQ,OAAO,YAAY,OAAO,UAAU;AACnF,QAAI,WAAW,UAAU,GAAG,IAAI,MAAM,SAAY,OAAM,IAAI,MAAM,mBAAmB;AACrF,SAAK,WAAW,UAAU,GAAG,IAAI,IAAI,OAAO,EAAG,OAAM,IAAI,MAAM,qBAAqB;AACpF,UAAM,aAAa,WAAW,UAAU,IAAI,IAAI;AAChD,UAAM,cAAc,WAAW,UAAU,IAAI,IAAI;AACjD,UAAM,eAAe,WAAW,UAAU,IAAI,IAAI;AAClD,UAAM,OAAO,SAAS,KAAK,aAAa,cAAc;AACtD,sBAAkB;AAClB,QACE,eAAe,KACf,aAAa,4BACb,iBAAiB,4BACjB,OAAO,MACP;AACA,YAAM,IAAI,MAAM,qBAAqB;AAAA,IACvC;AACA,UAAM,OAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE;AAAA,MACrD,MAAM,UAAU,QAAQ,SAAS,IAAI,UAAU;AAAA,IACjD;AACA,QAAI,CAAC,mBAAmB,IAAI,KAAK,MAAM,IAAI,IAAI,GAAG;AAChD,YAAM,IAAI,MAAM,uBAAuB;AAAA,IACzC;AACA,UAAM,IAAI,IAAI;AACd,aAAS;AAAA,EACX;AACA,MAAI,WAAW,QAAQ,CAAC,MAAM,IAAI,qBAAqB,KAAK,CAAC,MAAM,IAAI,YAAY,GAAG;AACpF,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACF;AAEA,SAAS,mBAAmB,MAAuB;AACjD,MAAI,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,IAAI,EAAG,QAAO;AACxD,QAAM,WAAW,KAAK,MAAM,GAAG;AAI/B,MAAI,SAAS,GAAG,EAAE,MAAM,GAAI,UAAS,IAAI;AACzC,SACE,SAAS,SAAS,KAClB,SAAS,MAAM,CAAC,YAAY,QAAQ,SAAS,KAAK,YAAY,OAAO,YAAY,IAAI;AAEzF;AAEA,SAAS,0BAA0B,OAA2B;AAC5D,QAAM,UAAU,KAAK,IAAI,GAAG,MAAM,aAAa,KAAM;AACrD,WAAS,SAAS,MAAM,aAAa,IAAI,UAAU,SAAS,UAAU,GAAG;AACvE,QACE,MAAM,MAAM,MAAM,MAClB,MAAM,SAAS,CAAC,MAAM,MACtB,MAAM,SAAS,CAAC,MAAM,KACtB,MAAM,SAAS,CAAC,MAAM;AAEtB,aAAO;AAAA,EACX;AACA,QAAM,IAAI,MAAM,kBAAkB;AACpC;AAEA,gBAAgB,WACd,MACA,UACA,QACmC;AACnC,QAAM,SAAS,MAAM,KAAK,MAAM,GAAG;AACnC,MAAI;AACF,QAAI,SAAS;AACb,UAAM,SAAS,IAAI,WAAW,6BAA6B;AAC3D,WAAO,SAAS,UAAU;AACxB,MAAAA,gBAAe,MAAM;AACrB,YAAM,SAAS,KAAK,IAAI,OAAO,YAAY,WAAW,MAAM;AAC5D,YAAM,EAAE,UAAU,IAAI,MAAM,OAAO,KAAK,QAAQ,GAAG,QAAQ,MAAM;AACjE,UAAI,cAAc,OAAQ,OAAM,IAAID,wBAAuB,gBAAgB;AAC3E,gBAAU;AACV,YAAM,OAAO,MAAM,GAAG,SAAS;AAAA,IACjC;AAAA,EACF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAEA,eAAe,SAAS,QAAoB,OAAmB,UAAiC;AAC9F,MAAI,SAAS;AACb,SAAO,SAAS,MAAM,YAAY;AAChC,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO;AAAA,MACpC;AAAA,MACA;AAAA,MACA,MAAM,aAAa;AAAA,MACnB,WAAW;AAAA,IACb;AACA,QAAI,gBAAgB,EAAG,OAAM,IAAIA,wBAAuB,gBAAgB;AACxE,cAAU;AAAA,EACZ;AACF;AAEA,eAAe,UACb,QACA,UACA,QACqB;AACrB,MACE,CAAC,OAAO,cAAc,QAAQ,KAC9B,WAAW,KACX,CAAC,OAAO,cAAc,MAAM,KAC5B,SAAS,GACT;AACA,UAAM,IAAI,MAAM,oBAAoB;AAAA,EACtC;AACA,QAAM,SAAS,IAAI,WAAW,MAAM;AACpC,MAAI,SAAS;AACb,SAAO,SAAS,QAAQ;AACtB,UAAM,EAAE,UAAU,IAAI,MAAM,OAAO,KAAK,QAAQ,QAAQ,SAAS,QAAQ,WAAW,MAAM;AAC1F,QAAI,aAAa,EAAG,OAAM,IAAI,MAAM,sBAAsB;AAC1D,cAAU;AAAA,EACZ;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,OAAqB;AAC9C,MACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,SAAS,QACf,MAAM,KAAK,MAAM,SACjB,yBAAyB,KAAK,KAAK;AAEnC,UAAM,IAAIA,wBAAuB,iBAAiB;AACtD;AAEA,SAAS,cAAc,OAAqB;AAC1C,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAAG;AAC9C,UAAM,IAAIA,wBAAuB,iBAAiB;AAAA,EACpD;AACF;AAEA,SAASC,gBAAe,QAAuC;AAC7D,MAAI,QAAQ,QAAS,OAAM,IAAID,wBAAuB,SAAS;AACjE;AAEA,SAAS,mCAAmC,OAAsB;AAChE,MACE,iBAAiB,8CACjB,MAAM,SAAS,uBACf;AACA,UAAM;AAAA,EACR;AACF;AAEA,SAAS,gBAAgB,OAAmB,OAAwB;AAClE,SAAO,QAAQ,OAAO,GAAG,KAAK;AAChC;AAEA,SAAS,QAAQ,OAAmB,QAAgB,OAAwB;AAC1E,MAAI,SAAS,KAAK,SAAS,MAAM,SAAS,MAAM,WAAY,QAAO;AACnE,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,QAAI,MAAM,SAAS,KAAK,MAAM,MAAM,WAAW,KAAK,EAAG,QAAO;AAAA,EAChE;AACA,SAAO;AACT;AAEA,SAAS,YAAY,OAAmB,UAAsC;AAC5E,SAAO,SAAS,MAAM,CAAC,OAAO,UAAU,MAAM,KAAK,MAAM,KAAK;AAChE;;;AC5ZA,SAAS,YAAY;AACrB,SAAS,kBAAkB;AAG3B,SAAS,8CAAAG,mDAAkD;AAC3D;AAAA,EACE,0CAAAC;AAAA,EACA,6CAAAC;AAAA,EACA,8CAAAC;AAAA,OACK;AAYP,IAAM,cAAc,IAAI,YAAY,EAAE,OAAO,UAAU;AACvD,IAAM,qBAAqB,IAAI,YAAY,EAAE,OAAO,UAAU;AAC9D,IAAM,eAAe,IAAI,YAAY,EAAE,OAAO,UAAU;AACxD,IAAM,sBAAsB,IAAI,YAAY,EAAE,OAAO,UAAU;AAC/D,IAAM,cAAc,IAAI,YAAY,EAAE,OAAO,UAAU;AACvD,IAAM,oBAAoB;AAC1B,IAAM,uBAAuB;AAC7B,IAAM,kBAAkB;AACxB,IAAM,qBAAqB,KAAK;AAChC,IAAM,qBAAqB,MAAM;AACjC,IAAM,mBAAmB,KAAK;AAC9B,IAAM,qBAAqB,OAAO;AAmElC,eAAsB,2CACpB,SAC+C;AAC/C,kBAAgB,OAAO;AACvB,QAAM,gBAAgB,MAAM,cAAc,OAAO;AACjD,mBAAiB,aAAa;AAC9B,QAAM,WAAW,kBAAkB,eAAe,OAAO;AACzD,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA,aAAa,OACX,UACG,MAAM,uBAAuB,SAAS,eAAe,KAAK;AAAA,IAC/D,uBAAuB,OACrB,UACG,MAAM,oBAAoB,SAAS,eAAe,KAAK;AAAA,EAC9D,CAAC;AACH;AAEA,eAAe,uBACb,SACA,UACA,OACsD;AACtD,EAAAC,gBAAe,MAAM,MAAM;AAC3B,MAAI,MAAM,IAAI,iBAAiB,QAAQ,gBAAgB;AACrD,UAAM,IAAI,2CAA2C,mBAAmB;AAAA,EAC1E;AACA,QAAM,WAAW,eAAe,MAAM,KAAK,MAAM,iBAAiB;AAClE,QAAM,QAAQ,YAAY,SAAS,CAAC,oBAAoB,CAAC;AACzD,QAAM,YAAY,MAAM,eAAe,KAAK;AAC5C,QAAM,UAAU,WAAW,WAAW,QAAQ,aAAa;AAC3D,UAAQ,QAAQ;AAChB,QAAM,QAAQ,MAAM,UAAU;AAC9B,QAAM,OAAO,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AAE5D,QAAM,aAAa,YAAY,OAAO,SAAS;AAC/C,QAAM,OAAO,YAAY,KAAK;AAC9B,QAAM,eAAe,gBAAgB,MAAM,MAAM;AACjD,QAAM,YAAY;AAAA,IAChB;AAAA,IACA;AAAA,IACA,MAAM,IAAI;AAAA,IACV,MAAM;AAAA,IACN,MAAM;AAAA,IACN;AAAA,IACA,aAAa;AAAA,EACf;AACA,OAAK,UAAU,MAAM,SAAS;AAC9B,QAAM,SAAS,IAAI,qBAAqB,OAAO,WAAW,aAAa,OAAO;AAE9E,MAAI;AACF,UAAM,QAAQ,MAAM,OAAO,YAAY,aAAa,YAAY,MAAM,MAAM;AAC5E,QAAI,WAAW,OAAO,WAAW,GAAG;AAClC,YAAM,MAAM,eAAe,QAAQ,MAAM,MAAM;AAAA,IACjD;AACA,QAAI,CAAC,WAAW,OAAO,YAAY,GAAG;AACpC,YAAM,IAAI,MAAM,yDAAyD;AAAA,IAC3E;AACA,UAAM,SAAS,MAAM,OAAO,YAAY,IAAI,MAAM,MAAM;AACxD,UAAM,aAAa,IAAI,SAAS,OAAO,QAAQ,OAAO,YAAY,OAAO,UAAU;AACnF,UAAM,gBAAgB,WAAW,UAAU,GAAG,IAAI;AAClD,UAAM,cAAc,QAAQ,YAAY,GAAG,mCAAmC;AAC9E,QAAI,gBAAgB,KAAK,gBAAgB,oBAAoB;AAC3D,YAAM,IAAI,MAAM,gDAAgD;AAAA,IAClE;AACA,QACE,eAAe,KACf,cAAc,QAAQ,kBACtB,cAAc,SAAS,gBACvB;AACA,YAAM,IAAI,2CAA2C,mBAAmB;AAAA,IAC1E;AACA,UAAM,eAAe,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE;AAAA,MAC7D,MAAM,OAAO,YAAY,eAAe,MAAM,MAAM;AAAA,IACtD;AACA,UAAM,SAAS,qBAAqB,cAAc,MAAM,KAAK,WAAW;AACxE,QAAI,WAAW;AACf,WAAO,OAAO,OAAO;AAAA,MACnB,GAAG;AAAA,MACH,QAAQ,OAAO,OAAO;AAAA,QACpB,QAAQ,OAAO,aAAa,IAAuC;AACjE,cAAI,SAAU,OAAM,IAAI,MAAM,0CAA0C;AACxE,qBAAW;AACX,cAAI;AACF,mBAAO,OAAO,cAAc,aAAa,MAAM,MAAM;AACrD,kBAAM,OAAO,UAAU,MAAM,MAAM;AACnC,kBAAM;AACN,kBAAM;AACN,kBAAM,SAAS,MAAM;AACrB,gBAAI,OAAO,SAAS,KAAK,OAAO,WAAW,MAAM;AAC/C,oBAAM,IAAI,MAAM,2CAA2C;AAAA,YAC7D;AAAA,UACF,UAAE;AACA,oBAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH,SAAS,OAAO;AACd,cAAU;AACV,UAAM,QAAQ,WAAW,CAAC,WAAW,YAAY,IAAI,CAAC;AACtD,YAAQ;AACR,UAAM,qBAAqB,OAAO,MAAM,MAAM;AAAA,EAChD;AAEA,WAAS,UAAgB;AACvB,iBAAa,OAAO;AACpB,UAAM,OAAO,oBAAoB,SAAS,KAAK;AAC/C,iBAAa,QAAQ;AACrB,QAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,KAAM,WAAU;AAAA,EACtE;AACF;AAEA,eAAe,oBACb,SACA,UACA,OACe;AACf,EAAAA,gBAAe,MAAM,MAAM;AAC3B,MACE,CAAC,OAAO,MAAM,oBAAoB,KAClC,CAAC,OAAO,cAAc,MAAM,QAAQ,KACpC,MAAM,YAAY,KAClB,MAAM,WAAW,QAAQ,kBACzB,SAAS,cAAc,MAAM,OAAO,MAAM,MAAM,cAChD;AACA,UAAM,IAAI,2CAA2C,4BAA4B;AAAA,EACnF;AACA,QAAM,WAAW,IAAI,YAAY,EAAE;AAAA,IACjC,KAAK,UAAU;AAAA,MACb,SAAS,MAAM;AAAA,MACf,cAAc,MAAM;AAAA,MACpB,sBAAsB,MAAM;AAAA,MAC5B,QAAQ,MAAM;AAAA,MACd,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,QAAM,QAAQ,YAAY,SAAS,CAAC,eAAe,CAAC;AACpD,QAAM,YAAY,MAAM,eAAe,KAAK;AAC5C,QAAM,UAAU,WAAW,WAAW,QAAQ,aAAa;AAC3D,UAAQ,QAAQ;AAChB,QAAM,QAAQ,MAAM,UAAU;AAC9B,QAAM,OAAO,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AAC5D,QAAM,aAAa,YAAY,OAAO,SAAS;AAC/C,QAAM,OAAO,YAAY,KAAK;AAC9B,QAAM,eAAe,gBAAgB,MAAM,MAAM;AACjD,QAAM,YAAY;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,IACN;AAAA,IACA,aAAa;AAAA,IACb;AAAA,EACF;AACA,OAAK,UAAU,MAAM,SAAS;AAC9B,QAAM,SAAS,IAAI,qBAAqB,OAAO,WAAW,aAAa,OAAO;AAC9E,MAAI;AACF,UAAM,QAAQ,MAAM,OAAO,YAAY,oBAAoB,YAAY,MAAM,MAAM;AACnF,QAAI,WAAW,OAAO,WAAW,EAAG,OAAM,MAAM,eAAe,QAAQ,MAAM,MAAM;AACnF,QAAI,CAAC,WAAW,OAAO,mBAAmB,GAAG;AAC3C,YAAM,IAAI,2CAA2C,4BAA4B;AAAA,IACnF;AACA,UAAM,SAAS,MAAM,OAAO,YAAY,IAAI,MAAM,MAAM;AACxD,UAAM,OAAO,IAAI,SAAS,OAAO,QAAQ,OAAO,YAAY,OAAO,UAAU;AAC7E,UAAM,gBAAgB,KAAK,UAAU,GAAG,IAAI;AAC5C,UAAM,eAAe,QAAQ,MAAM,GAAG,6BAA6B;AACnE,QAAI,gBAAgB,KAAK,gBAAgB,sBAAsB,iBAAiB,GAAG;AACjF,YAAM,IAAI,2CAA2C,4BAA4B;AAAA,IACnF;AACA,UAAM,OAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE;AAAA,MACrD,MAAM,OAAO,YAAY,eAAe,MAAM,MAAM;AAAA,IACtD;AACA,UAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,QACE,KAAK,UAAU,KAAK,MAAM,QAC1B,OAAO,UAAU,YACjB,UAAU,QACV,MAAM,QAAQ,KAAK,KACnB,OAAO,KAAK,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,MAAM,4BACxC,MAAkC,aAAa,cAC/C,MAAkC,iBAAiB,MAAM,sBAC1D;AACA,YAAM,IAAI,2CAA2C,4BAA4B;AAAA,IACnF;AACA,UAAM,OAAO,UAAU,MAAM,MAAM;AACnC,UAAM;AACN,UAAM;AACN,UAAM,SAAS,MAAM;AACrB,QAAI,OAAO,SAAS,KAAK,OAAO,WAAW,MAAM;AAC/C,YAAM,IAAI,2CAA2C,4BAA4B;AAAA,IACnF;AAAA,EACF,SAAS,OAAO;AACd,cAAU;AACV,UAAM,QAAQ,WAAW,CAAC,WAAW,YAAY,IAAI,CAAC;AACtD,QAAI,iBAAiB,2CAA4C,OAAM;AACvE,UAAM,IAAI,2CAA2C,4BAA4B;AAAA,EACnF,UAAE;AACA,iBAAa,OAAO;AACpB,UAAM,OAAO,oBAAoB,SAAS,KAAK;AAC/C,iBAAa,QAAQ;AACrB,QAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,KAAM,WAAU;AAAA,EACtE;AACF;AAEA,eAAe,eACb,QACA,QACqD;AACrD,QAAM,SAAS,MAAM,OAAO,YAAY,IAAI,MAAM;AAClD,QAAM,OAAO,IAAI,SAAS,OAAO,QAAQ,OAAO,YAAY,OAAO,UAAU;AAC7E,QAAM,gBAAgB,KAAK,UAAU,GAAG,IAAI;AAC5C,QAAM,eAAe,QAAQ,MAAM,GAAG,sBAAsB;AAC5D,MAAI,gBAAgB,KAAK,gBAAgB,sBAAsB,iBAAiB,GAAG;AACjF,WAAO,IAAI,2CAA2C,wBAAwB;AAAA,EAChF;AACA,QAAM,OAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE;AAAA,IACrD,MAAM,OAAO,YAAY,eAAe,MAAM;AAAA,EAChD;AACA,QAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,QAAM,OACJ,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,IAC/D,OAAO,KAAK,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,IACnC;AACN,MACE,KAAK,UAAU,KAAK,MAAM,QAC1B,OAAO,UAAU,YACjB,UAAU,QACV,MAAM,QAAQ,KAAK,KAClB,SAAS,oBAAoB,SAAS,6BACtC,MAAkC,aAAa,YAChD;AACA,WAAO,IAAI,2CAA2C,wBAAwB;AAAA,EAChF;AACA,QAAM,OAAQ,MAAkC;AAChD,QAAM,UAAW,MAAkC;AACnD,MACE,SAAS,2BACT,SAAS,8BACT,SAAS,yBACT,SAAS,8BACT;AACA,UAAM,aAAa,wBAAwB,MAAM,OAAO;AACxD,QAAI,YAAY,UAAa,CAAC,YAAY;AACxC,aAAO,IAAI,2CAA2C,wBAAwB;AAAA,IAChF;AACA,WAAO,IAAI,2CAA2C,MAAM,UAAU;AAAA,EACxE;AACA,SAAO,IAAI,2CAA2C,wBAAwB;AAChF;AAEA,SAAS,wBACP,MACA,SAC2D;AAC3D,MAAI,SAAS,2BAA4B,QAAO;AAChD,MAAI,YAAY,mBAAmB,YAAY,mBAAmB,YAAY,kBAAkB;AAC9F,WAAO,EAAE,OAAO,UAAU,QAAQ;AAAA,EACpC;AACA,SAAO;AACT;AAEA,eAAe,cACb,SAC2B;AAC3B,QAAM,QAAQ,YAAY,SAAS,CAAC,iBAAiB,CAAC;AACtD,QAAM,YAAY,MAAM,eAAe,KAAK;AAC5C,QAAM,UAAU,WAAW,WAAW,QAAQ,kBAAkB,GAAK;AACrE,UAAQ,QAAQ;AAChB,QAAM,SAAS,eAAe,MAAM,QAAQ,oBAAoB,SAAS;AACzE,QAAM,SAAS,YAAY,OAAO,SAAS;AAC3C,MAAI;AACF,UAAM,CAAC,OAAO,EAAE,MAAM,IAAI,MAAM,QAAQ,IAAI,CAAC,QAAQ,QAAQ,YAAY,KAAK,CAAC,CAAC;AAChF,QAAI,OAAO,SAAS,KAAK,OAAO,WAAW,MAAM;AAC/C,YAAM,IAAI,MAAM,2CAA2C;AAAA,IAC7D;AACA,UAAM,OAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,KAAK;AACnE,UAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,QAAI,KAAK,UAAU,MAAM,MAAM,MAAM;AACnC,YAAM,IAAI,MAAM,oDAAoD;AAAA,IACtE;AACA,WAAO;AAAA,EACT,UAAE;AACA,iBAAa,OAAO;AACpB,QAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,KAAM,WAAU;AAAA,EACtE;AACF;AAEA,SAAS,YACP,SACA,MACgC;AAChC,SAAO,QAAQ,SAAS,MAAM;AAAA,IAC5B,YAAY,QAAQ;AAAA,IACpB;AAAA,IACA,aAAa,OAAO,OAAO;AAAA,MACzB,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,GAAI,QAAQ,oBAAoB,CAAC;AAAA,IACnC,CAAC;AAAA,EACH,CAAC;AACH;AAEA,eAAe,UACb,OACA,UACA,qBACA,QACA,QACA,MACA,cACe;AACf,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAe,UACb,OACA,OACA,UACA,qBACA,QACA,QACA,MACA,cACA,cACe;AACf,QAAM,SAAS,IAAI,WAAW,EAAE;AAChC,QAAM,OAAO,IAAI,SAAS,OAAO,MAAM;AACvC,OAAK,UAAU,GAAG,SAAS,YAAY,IAAI;AAC3C,OAAK,aAAa,GAAG,OAAO,mBAAmB,GAAG,IAAI;AACtD,QAAM,MAAM,OAAO,OAAO,QAAQ,MAAM,YAAY;AACpD,QAAM,MAAM,OAAO,QAAQ,QAAQ,MAAM,YAAY;AACrD,QAAM,MAAM,OAAO,UAAU,QAAQ,MAAM,YAAY;AACvD,MAAI,cAAc;AAClB,mBAAiB,SAAS,QAAQ;AAChC,IAAAA,gBAAe,MAAM;AACrB,QACE,EAAE,iBAAiB,eACnB,MAAM,eAAe,KACrB,MAAM,aAAa,IAAI,OAAO,MAC9B;AACA,YAAM,IAAI,2CAA2C,YAAY;AAAA,IACnE;AACA,mBAAe,MAAM;AACrB,QAAI,cAAc,qBAAqB;AACrC,YAAM,IAAI,2CAA2C,YAAY;AAAA,IACnE;AACA,UAAM,MAAM,OAAO,OAAO,QAAQ,MAAM,YAAY;AAAA,EACtD;AACA,MAAI,gBAAgB,qBAAqB;AACvC,UAAM,IAAI,2CAA2C,YAAY;AAAA,EACnE;AACA,QAAM,MAAM,IAAI;AAClB;AAEA,eAAe,MACb,OACA,OACA,QACA,MACA,cACe;AACf,EAAAA,gBAAe,MAAM;AACrB,MAAI,CAAC,MAAM,MAAM,MAAM,KAAK,GAAG;AAC7B,UAAM,QAAQ,KAAK;AAAA,MACjB,KAAK,MAAM,OAAO,OAAO;AAAA,MACzB;AAAA,MACA,KAAK,KAAK,MAAM;AACd,cAAM,IAAI,MAAM,wCAAwC;AAAA,MAC1D,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AACF;AAEA,IAAM,uBAAN,MAA2B;AAAA,EAKzB,YACE,OACiB,WACA,cACjB;AAFiB;AACA;AAEjB,SAAK,YAAY,MAAM,OAAO,OAAO,aAAa,EAAE;AAAA,EACtD;AAAA,EAVS;AAAA,EACT,UAAU,IAAI,WAAW,CAAC;AAAA,EAC1B,QAAQ;AAAA,EAUR,MAAM,YAAY,QAAgB,QAA0C;AAC1E,QAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,EAAG,OAAM,IAAI,MAAM,uBAAuB;AACxF,UAAM,SAAS,IAAI,WAAW,MAAM;AACpC,QAAI,SAAS;AACb,WAAO,SAAS,QAAQ;AACtB,MAAAA,gBAAe,MAAM;AACrB,UAAI,KAAK,QAAQ,eAAe,EAAG,OAAM,KAAK,MAAM,MAAM;AAC1D,UAAI,KAAK,QAAQ,eAAe,EAAG,OAAM,IAAI,MAAM,sCAAsC;AACzF,YAAM,QAAQ,KAAK,IAAI,SAAS,QAAQ,KAAK,QAAQ,UAAU;AAC/D,aAAO,IAAI,KAAK,QAAQ,SAAS,GAAG,KAAK,GAAG,MAAM;AAClD,WAAK,UAAU,KAAK,QAAQ,SAAS,KAAK;AAC1C,gBAAU;AAAA,IACZ;AACA,WAAO;AAAA,EACT;AAAA,EAEA,OAAO,cAAc,QAAgB,QAAwD;AAC3F,QAAI,YAAY;AAChB,WAAO,YAAY,GAAG;AACpB,MAAAA,gBAAe,MAAM;AACrB,YAAM,QAAQ,KAAK,IAAI,WAAW,kBAAkB;AACpD,YAAM,QAAQ,MAAM,KAAK,YAAY,OAAO,MAAM;AAClD,mBAAa,MAAM;AACnB,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,UAAU,QAAoC;AAClD,IAAAA,gBAAe,MAAM;AACrB,QAAI,KAAK,QAAQ,aAAa,EAAG,OAAM,IAAI,MAAM,qCAAqC;AACtF,QAAI,CAAC,KAAK,MAAO,OAAM,KAAK,MAAM,MAAM;AACxC,QAAI,KAAK,QAAQ,aAAa,KAAK,CAAC,KAAK,OAAO;AAC9C,YAAM,IAAI,MAAM,qCAAqC;AAAA,IACvD;AAAA,EACF;AAAA,EAEA,MAAM,MAAM,QAAoC;AAC9C,QAAI,KAAK,MAAO;AAChB,IAAAA,gBAAe,MAAM;AACrB,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,QAAQ,KAAK,CAAC,KAAK,UAAU,KAAK,GAAG,KAAK,YAAY,CAAC;AAAA,IACtE,SAAS,OAAO;AACd,WAAK,UAAU;AACf,YAAM;AAAA,IACR;AACA,QAAI,KAAK,MAAM;AACb,WAAK,QAAQ;AACb;AAAA,IACF;AACA,QAAI,OAAO,KAAK,UAAU,SAAU,OAAM,IAAI,MAAM,yCAAyC;AAC7F,SAAK,UAAU,IAAI;AAAA,MACjB,KAAK,MAAM;AAAA,MACX,KAAK,MAAM;AAAA,MACX,KAAK,MAAM;AAAA,IACb,EAAE,MAAM;AAAA,EACV;AACF;AAEA,SAAS,eACP,KACA,mBACY;AACZ,QAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,iBAAiB;AAClF,QAAM,WAAW;AAAA,IACf,UAAU;AAAA,IACV,YAAY,IAAI;AAAA,IAChB,OAAO,IAAI;AAAA,IACX,WAAW,IAAI;AAAA,IACf,UAAU,IAAI;AAAA,IACd,iBAAiB,IAAI;AAAA,IACrB,oBAAoB,IAAI;AAAA,IACxB,WAAW,IAAI;AAAA,IACf,gBAAgB,IAAI;AAAA,IACpB,mBAAmB,IAAI;AAAA,IACvB,oBAAoB,IAAI;AAAA,IACxB,0BAA0B,IAAI;AAAA,IAC9B,yBAAyB,IAAI;AAAA,IAC7B,QAAQ,IAAI;AAAA,IACZ,SAAS,IAAI;AAAA,IACb,mBAAmB,KAAK,MAAM,OAAO;AAAA,IACrC,aAAa,IAAI;AAAA,IACjB,cAAc,IAAI;AAAA,IAClB,eAAe,IAAI;AAAA,IACnB,kBAAkB,IAAI;AAAA,IACtB,YAAY,IAAI;AAAA,EAClB;AACA,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,QAAQ,CAAC;AAC/D,MAAI,MAAM,aAAa,oBAAoB;AACzC,UAAM,IAAI,2CAA2C,sBAAsB;AAAA,EAC7E;AACA,SAAO;AACT;AAEA,SAAS,qBACP,MACA,KACA,aAC6D;AAC7D,QAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,MAAI,KAAK,UAAU,KAAK,MAAM,QAAQ,OAAO,UAAU,YAAY,UAAU,MAAM;AACjF,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACA,QAAM,SAAS;AACf,QAAM,eAAe;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK;AACP,MAAI,OAAO,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,IAAI,MAAM,aAAa,KAAK,IAAI,GAAG;AACrE,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,MAAI,OAAO,aAAa,cAAc,OAAO,aAAa,aAAa;AACrE,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,QAAM,mBAAmB,kBAAkB,IAAI,MAAM;AACrD,MACE,CAAC,OAAO,cAAc,OAAO,YAAY,KACzC,OAAO,iBAAiB,IAAI,sBAC5B,CAAC,OAAO,OAAO,SAAS,KACxB,OAAO,cAAc,IAAI,aACzB,OAAO,WAAW,IAAI,UACtB,OAAO,aAAa,oBACpB,CAAC,iBAAiB,OAAO,OAAO,KAChC,OAAO,YAAY,IAAI,WACvB,CAAC,iBAAiB,OAAO,YAAY,KACrC,OAAO,iBAAiB,IAAI,gBAC5B,CAAC,uBAAuB,OAAO,aAAa,KAC5C,OAAO,kBAAkB,IAAI,iBAC7B,CAAC,OAAO,OAAO,gBAAgB,KAC/B,OAAO,qBAAqB,IAAI,oBAChC,CAAC,OAAO,OAAO,UAAU,KACzB,OAAO,eAAe,IAAI,cAC1B,CAAC,OAAO,OAAO,WAAW,KAC1B,CAAC,OAAO,OAAO,YAAY,GAC3B;AACA,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AACA,SAAO,OAAO,OAAO;AAAA,IACnB,cAAc,OAAO;AAAA,IACrB,WAAW,OAAO;AAAA,IAClB,QAAQ,IAAI;AAAA,IACZ,UAAU;AAAA,IACV,SAAS,OAAO;AAAA,IAChB,cAAc,OAAO;AAAA,IACrB,eAAe,OAAO;AAAA,IACtB,kBAAkB,OAAO;AAAA,IACzB,YAAY,OAAO;AAAA,IACnB,UAAU;AAAA,IACV,aAAa,OAAO;AAAA,IACpB,cAAc,OAAO;AAAA,EACvB,CAAC;AACH;AAEA,SAAS,gBAAgB,SAAwD;AAC/E,MAAI,CAAC,WAAW,QAAQ,UAAU,KAAK,QAAQ,WAAW,SAAS,MAAO;AACxE,UAAM,IAAI,UAAU,yDAAyD;AAAA,EAC/E;AACA,aAAW,CAAC,OAAO,KAAK,KAAK;AAAA,IAC3B,CAAC,gBAAgB,QAAQ,aAAa;AAAA,IACtC,CAAC,gBAAgB,QAAQ,cAAc;AAAA,IACvC,CAAC,gBAAgB,QAAQ,cAAc;AAAA,EACzC,GAAY;AACV,QAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,EAAG,OAAM,IAAI,UAAU,GAAG,KAAK,aAAa;AAAA,EAC3F;AACA,QAAM,WAAW,QAAQ,SAAS;AAClC,QAAM,YACJ,SAAS,oBAAoB,QAC7B,SAAS,YAAY,YACrB,OAAO,cAAc,SAAS,gBAAgB,KAC9C,SAAS,mBAAmB,KAC5B,OAAO,cAAc,SAAS,cAAc,KAC5C,SAAS,iBAAiB,KAC1B,OAAO,cAAc,SAAS,mBAAmB,KACjD,SAAS,sBAAsB,KAC/B,OAAO,cAAc,SAAS,YAAY,KAC1C,SAAS,eAAe,KACxB,OAAO,cAAc,SAAS,kBAAkB,KAChD,SAAS,qBAAqB;AAChC,QAAM,yBACJ,QAAQ,gCAAgC,QACxC,SAAS,oBAAoB,SAC7B,SAAS,YAAY,UACrB,SAAS,qBAAqB,KAC9B,SAAS,mBAAmB,KAC5B,SAAS,wBAAwB,KACjC,SAAS,iBAAiB,KAC1B,SAAS,uBAAuB;AAClC,MACE,SAAS,cAAc,gBACvB,SAAS,qBAAqB,SAC9B,CAAC,iBAAiB,SAAS,QAAQ,KAClC,CAAC,aAAa,CAAC,wBAChB;AACA,UAAM,IAAI,UAAU,iDAAiD;AAAA,EACvE;AACA,MAAI,QAAQ,qBAAqB,QAAW;AAC1C,UAAM,OAAO,OAAO,KAAK,QAAQ,gBAAgB,EAAE,KAAK;AACxD,UAAM,iBAAiB,CAAC,sCAAsC,8BAA8B;AAC5F,UAAM,kBAAkB;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,UAAM,aAAa,KAAK,KAAK,IAAI,MAAM,eAAe,KAAK,IAAI;AAC/D,UAAM,cAAc,KAAK,KAAK,IAAI,MAAM,gBAAgB,KAAK,IAAI;AACjE,QAAI,CAAC,cAAc,CAAC,aAAa;AAC/B,YAAM,IAAI,UAAU,oDAAoD;AAAA,IAC1E;AACA,QAAI,gBAAgB,wBAAwB;AAC1C,YAAM,IAAI,UAAU,iEAAiE;AAAA,IACvF;AACA,QACE,gBACC,QAAQ,gCAAgC,QACvC,QAAQ,iBAAiB,aAAa,gBACxC;AACA,YAAM,IAAI,UAAU,gEAAgE;AAAA,IACtF;AACA,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,QAAQ,gBAAgB,GAAG;AACpE,UAAI,SAAS,WAAY;AACzB,UAAI,CAAC,WAAW,KAAK,KAAK,MAAM,SAAS,QAAS,yBAAyB,KAAK,KAAK,GAAG;AACtF,cAAM,IAAI,UAAU,uDAAuD;AAAA,MAC7E;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,iBAAiB,UAAkC;AAC1D,QAAM,SAAS;AACf,QAAM,eAAe;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK;AACP,MAAI,OAAO,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,IAAI,MAAM,aAAa,KAAK,IAAI,GAAG;AACrE,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,MACE,SAAS,aAAa,cACtB,SAAS,gBAAgB,YACzB,CAAC,OAAO,cAAc,SAAS,cAAc,KAC7C,SAAS,kBAAkB,GAC3B;AACA,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,MACE,CAAC,uBAAuB,SAAS,aAAa,KAC9C,CAAC,iBAAiB,SAAS,aAAa,KACxC,CAAC,OAAO,SAAS,gBAAgB,KACjC,CAAC,OAAO,SAAS,UAAU,KAC3B,CAAC,gBAAgB,SAAS,aAAa,KACvC,CAAC;AAAA,IACC,SAAS;AAAA,IACTC;AAAA,EACF,KACA,CAAC;AAAA,IACC,SAAS;AAAA,IACTC;AAAA,EACF,KACA,CAAC;AAAA,IACC,SAAS;AAAA,IACTC;AAAA,EACF,GACA;AACA,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACF;AAEA,SAAS,kBACP,OACA,SAC4C;AAC5C,QAAM,WAAW,QAAQ,SAAS;AAClC,SAAO,OAAO,OAAO;AAAA,IACnB,MAAM;AAAA,IACN,WAAW,SAAS;AAAA,IACpB,SAAS,SAAS;AAAA,IAClB,kBAAkB,SAAS;AAAA,IAC3B,wBAAwB;AAAA,IACxB,iBAAiB,SAAS;AAAA,IAC1B,kBAAkB,SAAS;AAAA,IAC3B,gBAAgB,SAAS;AAAA,IACzB,qBAAqB,SAAS;AAAA,IAC9B,cAAc,SAAS;AAAA,IACvB,oBAAoB,SAAS;AAAA,IAC7B,gBAAgB,KAAK,IAAI,MAAM,gBAAgB,QAAQ,cAAc;AAAA,IACrE,eAAe,MAAM;AAAA,IACrB,eAAe,MAAM;AAAA,IACrB,kBAAkB,MAAM;AAAA,IACxB,YAAY,MAAM;AAAA,IAClB,eAAe,MAAM;AAAA,IACrB,8BAA8B,MAAM;AAAA,IACpC,oCAAoC,MAAM;AAAA,IAC1C,mCAAmC,MAAM;AAAA,EAC3C,CAAC;AACH;AAEA,SAAS,gBAAgB,OAA2D;AAClF,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,UAAU,OAAO,QAAQ,KAAgC;AAC/D,MAAI,QAAQ,WAAW,KAAK,QAAQ,SAAS,GAAI,QAAO;AACxD,MAAI,WAAW;AACf,aAAW,CAAC,SAAS,OAAO,KAAK,SAAS;AACxC,QACE,CAAC,6BAA6B,KAAK,OAAO,KAC1C,WAAW,YACX,CAAC,iBAAiB,OAAO,GACzB;AACA,aAAO;AAAA,IACT;AACA,eAAW;AAAA,EACb;AACA,SAAO;AACT;AAEA,SAAS,gCACP,OACA,UAC6B;AAC7B,SAAO,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM;AACpE;AAEA,SAAS,iBAAiB,OAAiC;AACzD,SACE,OAAO,UAAU,YACjB,MAAM,UAAU,KAChB,MAAM,UAAU,OAChB,kBAAkB,KAAK,KAAK;AAEhC;AAEA,SAAS,uBAAuB,OAAiC;AAC/D,SACE,OAAO,UAAU,YACjB,MAAM,UAAU,KAChB,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE,cAAcC,+CAC9C,kBAAkB,KAAK,KAAK;AAEhC;AAEA,SAAS,OAAO,OAAiC;AAC/C,SAAO,OAAO,UAAU,YAAY,yBAAyB,KAAK,KAAK;AACzE;AAEA,eAAe,eACb,QACA,SACA,WACqB;AACrB,QAAM,SAAuB,CAAC;AAC9B,MAAI,QAAQ;AACZ,mBAAiB,SAAS,QAAQ;AAChC,UAAM,QAAQ,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAI;AAC/D,aAAS,MAAM;AACf,QAAI,QAAQ,SAAS;AACnB,gBAAU;AACV,YAAM,IAAI,MAAM,mDAAmD;AAAA,IACrE;AACA,WAAO,KAAK,IAAI,WAAW,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,EAAE,MAAM,CAAC;AAAA,EACtF;AACA,QAAM,SAAS,IAAI,WAAW,KAAK;AACnC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,WAAO,IAAI,OAAO,MAAM;AACxB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAEA,eAAe,YACb,OACA,WACe;AACf,QAAM,eAAe,MAAM,QAAQ,kBAAkB,SAAS;AAChE;AAEA,SAAS,YACP,OACiE;AACjE,MAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,MAAM;AACxD,WAAO,QAAQ,QAAQ,EAAE,MAAM,MAAM,UAAU,QAAQ,MAAM,WAAW,CAAC;AAAA,EAC3E;AACA,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,UAAU,CAAC,UAAiB;AAChC,YAAM,eAAe,QAAQ,MAAM;AACnC,aAAO,KAAK;AAAA,IACd;AACA,UAAM,SAAS,CAAC,MAAqB,WAAkC;AACrE,YAAM,eAAe,SAAS,OAAO;AACrC,cAAQ,EAAE,MAAM,OAAO,CAAC;AAAA,IAC1B;AACA,UAAM,KAAK,SAAS,OAAO;AAC3B,UAAM,KAAK,QAAQ,MAAM;AAAA,EAC3B,CAAC;AACH;AAEA,SAAS,eAAe,OAA6C;AACnE,MAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,KAAM;AAC1D,QAAM,MAAM,QAAQ;AACpB,QAAM,KAAK,SAAS;AACtB;AAEA,SAAS,gBAAgB,QAGvB;AACA,MAAI,WAAgC;AACpC,QAAM,UAAU,IAAI,QAAe,CAAC,UAAU,WAAW;AACvD,QAAI,OAAO,SAAS;AAClB,aAAO,OAAO,UAAUC,YAAW,CAAC;AACpC;AAAA,IACF;AACA,eAAW,MAAM,OAAO,OAAO,UAAUA,YAAW,CAAC;AACrD,WAAO,iBAAiB,SAAS,UAAU,EAAE,MAAM,KAAK,CAAC;AAAA,EAC3D,CAAC;AAGD,OAAK,QAAQ,MAAM,MAAM,MAAS;AAClC,SAAO;AAAA,IACL;AAAA,IACA,UAAU;AACR,UAAI,SAAU,QAAO,oBAAoB,SAAS,QAAQ;AAC1D,iBAAW;AAAA,IACb;AAAA,EACF;AACF;AAEA,SAASL,gBAAe,QAA2B;AACjD,MAAI,OAAO,QAAS,OAAM,OAAO,UAAUK,YAAW;AACxD;AAEA,SAASA,cAA2B;AAClC,SAAO,IAAI,aAAa,qBAAqB,YAAY;AAC3D;AAEA,SAAS,qBAAqB,OAAgB,QAA8B;AAC1E,MAAI,OAAO,QAAS,QAAO,OAAO,UAAUA,YAAW;AACvD,SAAO;AACT;AAEA,SAAS,QAAQ,MAAgB,QAAgB,OAAuB;AACtE,QAAM,QAAQ,KAAK,aAAa,QAAQ,IAAI;AAC5C,MAAI,QAAQ,OAAO,OAAO,gBAAgB,EAAG,OAAM,IAAI,MAAM,GAAG,KAAK,uBAAuB;AAC5F,SAAO,OAAO,KAAK;AACrB;AAEA,SAAS,WAAW,MAAkB,OAA4B;AAChE,SAAO,KAAK,eAAe,MAAM,cAAc,KAAK,MAAM,CAAC,MAAM,UAAU,SAAS,MAAM,KAAK,CAAC;AAClG;;;ACt8BA,SAAS,aAAkD;AAC3D,SAAS,QAAQ,UAAU,UAAU,YAAY;AACjD,SAAS,UAAU,SAAS,cAAAC,aAAY,gBAAgB;AAIxD,IAAM,kBAAkB,KAAK;AAC7B,IAAM,mBAAmB;AA2BzB,eAAsB,iDACpB,SACkD;AAClD,MAAI,CAAC,QAAQ,qBAAqB,QAAQ,oBAAoB,cAAc;AAC1E,UAAM,IAAI,MAAM,uEAAuE;AAAA,EACzF;AACA,QAAM,mCAAmC,QAAQ;AACjD,QAAM,yBAAyB,MAAM,sBAAsB,QAAQ,sBAAsB;AACzF,SAAO,OAAO,OAAO;AAAA,IACnB,UAAU,OAAO,OAAO;AAAA,MACtB,UAAU,GAAG,QAAQ,QAAQ,IAAI,QAAQ,IAAI;AAAA,MAC7C,WAAW;AAAA,MACX,SAAS;AAAA,MACT,kBAAkB;AAAA,MAClB,iBAAiB;AAAA,MACjB,kBAAkB;AAAA,MAClB,gBAAgB;AAAA,MAChB,qBAAqB;AAAA,MACrB,cAAc;AAAA,MACd,oBAAoB;AAAA,IACtB,CAAC;AAAA,IACD,MAAM,OAAO;AACX,UACE,MAAM,eAAe,oCACrB,MAAM,eAAe,wBACrB;AACA,cAAM,IAAI,MAAM,+DAA+D;AAAA,MACjF;AACA,aAAO,MAAM,wBAAwB,CAAC,GAAG,MAAM,IAAI,GAAG;AAAA,QACpD,KAAK;AAAA,QACL,KAAK,EAAE,GAAG,MAAM,YAAY;AAAA,QAC5B,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,QAC9B,aAAa;AAAA,MACf,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAQA,eAAsB,2CACpB,SACkD;AAClD,MAAI,QAAQ,aAAa,SAAS;AAChC,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACA,MACE,CAAC,OAAO,cAAc,QAAQ,gBAAgB,KAC9C,QAAQ,oBAAoB,KAC5B,CAAC,OAAO,cAAc,QAAQ,cAAc,KAC5C,QAAQ,kBAAkB,KAC1B,QAAQ,iBAAiB,QAAU,KACnC,CAAC,OAAO,cAAc,QAAQ,mBAAmB,KACjD,QAAQ,uBAAuB,KAC/B,CAAC,OAAO,cAAc,QAAQ,YAAY,KAC1C,QAAQ,gBAAgB,KACxB,CAAC,OAAO,cAAc,QAAQ,kBAAkB,KAChD,QAAQ,sBAAsB,GAC9B;AACA,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AACA,QAAM,aAAa,MAAM,kBAAkB,QAAQ,sBAAsB,OAAO;AAChF,QAAM,UAAU,MAAM,kBAAkB,QAAQ,mBAAmB,SAAS;AAC5E,QAAM,mCAAmC,QAAQ;AACjD,QAAM,yBAAyB,MAAM;AAAA,IACnC,QAAQ;AAAA,IACR,SAAS,QAAQ,sBAAsB;AAAA,EACzC;AACA,QAAM,cAAc,MAAM,mBAAmB,QAAQ,WAAW;AAChE,QAAM,aAAa,QAAQ,iBAAiB;AAE5C,QAAM,gBAAgB,CAAC,UAIe;AACpC,QAAI,CAACA,YAAW,MAAM,UAAU,EAAG,OAAM,IAAI,MAAM,iCAAiC;AACpF,UAAM,mBAAmB,sCAAsC;AAAA,MAC7D,YAAY,MAAM;AAAA,MAClB,MAAM,MAAM;AAAA,MACZ;AAAA,MACA,mBAAmB,QAAQ;AAAA,IAC7B,CAAC;AACD,WAAO;AAAA,MACL;AAAA,MACA;AAAA,QACE,GAAG,sCAAsC;AAAA,UACvC,kBAAkB,QAAQ;AAAA,UAC1B;AAAA,UACA,qBAAqB,QAAQ;AAAA,UAC7B,cAAc,QAAQ;AAAA,UACtB,oBAAoB,QAAQ;AAAA,QAC9B,CAAC;AAAA,QACD;AAAA,QACA;AAAA,QACA,GAAG;AAAA,MACL;AAAA,MACA;AAAA,QACE,KAAK;AAAA,QACL,KAAK,EAAE,GAAG,MAAM,YAAY;AAAA,QAC5B,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,QAC9B,aAAa;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAEA,QAAM,oBAAoB,CAAC,UAIW;AACpC,QACE,MAAM,eAAe,oCACrB,MAAM,eAAe,wBACrB;AACA,YAAM,IAAI,MAAM,kEAAkE;AAAA,IACpF;AACA,qCAAiC,MAAM,aAAa,WAAW;AAC/D,WAAO,cAAc,EAAE,GAAG,OAAO,YAAY,uBAAuB,CAAC;AAAA,EACvE;AAEA,QAAM,kBAAkB,MAAM;AAAA,IAC5B,QAAQ,mBAAmB,QAAQ;AAAA,IACnC,SAAS,QAAQ,QAAQ;AAAA,EAC3B;AACA,QAAM,yBAAyB,MAAM,SAAS,mBAAmB;AACjE,QAAM,QAAQ,cAAc;AAAA,IAC1B,YAAY;AAAA,IACZ,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,GAAG;AAAA,IACZ;AAAA,IACA,aAAa,OAAO,OAAO,EAAE,MAAM,KAAK,QAAQ,KAAK,IAAI,MAAM,CAAC;AAAA,EAClE,CAAC;AACD,QAAM,MAAM,IAAI;AAChB,QAAM,UAAU,WAAW,MAAMC,gBAAe,KAAK,GAAG,gBAAgB;AACxE,UAAQ,QAAQ;AAChB,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,KAAC,QAAQ,QAAQ,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC3C,cAAc,MAAM,MAAM;AAAA,MAC1B,cAAc,MAAM,MAAM;AAAA,MAC1BC,aAAY,KAAK;AAAA,IACnB,CAAC;AAAA,EACH,UAAE;AACA,iBAAa,OAAO;AACpB,IAAAD,gBAAe,KAAK;AAAA,EACtB;AACA,MAAI,OAAO,SAAS,KAAK,OAAO,WAAW,QAAQ,OAAO,eAAe,GAAG;AAC1E,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,QAAM,SAAS,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,MAAM,CAAC;AAClF,MAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG;AAC1E,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,QAAM,WAAW;AACjB,QAAM,sBAAsB,wCAAwC;AAAA,IAClE,YAAY;AAAA,IACZ;AAAA,EACF,CAAC;AACD,MACE,OAAO,SAAS,QAAQ,YACxB,SAAS,QAAQ,0BACjB,OAAO,SAAS,WAAW,YAC3B,CAAC,iBAAiB,SAAS,QAAQ,gBAAgB,OAAO,UAAU,CAAC,KACrE,CAAC,iBAAiB,SAAS,QAAQ,qBAAqB,OAAO,QAAQ,gBAAgB,CAAC,KACxF,CAAC,iBAAiB,SAAS,QAAQ,kBAAkB,OAAO,QAAQ,mBAAmB,CAAC,KACxF,CAAC,iBAAiB,SAAS,QAAQ,iBAAiB,OAAO,QAAQ,YAAY,CAAC,KAChF,CAAC,iBAAiB,SAAS,QAAQ,iBAAiB,OAAO,QAAQ,kBAAkB,CAAC,KACtF,CAAC,eAAe,SAAS,aAAa,mBAAmB,KACzD,SAAS,iBAAiB,SAC1B,SAAS,oBAAoB,MAC7B;AACA,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AAEA,SAAO,OAAO,OAAO;AAAA,IACnB,UAAU,OAAO,OAAO;AAAA,MACtB,UAAU,SAAS,QAAQ,IAAI;AAAA,MAC/B,WAAW;AAAA,MACX,SAAS;AAAA,MACT,kBAAkB;AAAA,MAClB,iBAAiB;AAAA,MACjB,kBAAkB,QAAQ;AAAA,MAC1B,gBAAgB,QAAQ;AAAA,MACxB,qBAAqB,QAAQ;AAAA,MAC7B,cAAc,QAAQ;AAAA,MACtB,oBAAoB,QAAQ;AAAA,IAC9B,CAAC;AAAA,IACD,OAAO;AAAA,EACT,CAAC;AACH;AAEO,SAAS,sCACd,OAMmB;AACnB,MACE,CAACD,YAAW,MAAM,UAAU,KAC5B,CAACA,YAAW,MAAM,WAAW,KAC7B,CAAC,OAAO,cAAc,MAAM,iBAAiB,KAC7C,MAAM,qBAAqB,GAC3B;AACA,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,QAAM,oBAAoB,yBAAyB,CAAC,MAAM,YAAY,MAAM,WAAW,CAAC;AACxF,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,kBAAkB,QAAQ,CAAC,SAAS,CAAC,SAAS,IAAI,CAAC;AAAA,IACtD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN,MAAM;AAAA,IACN;AAAA,IACA,MAAM;AAAA,IACN,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO,MAAM,iBAAiB;AAAA,IAC9B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN,GAAG,MAAM;AAAA,EACX,CAAC;AACH;AAEO,SAAS,sCACd,OAOmB;AACnB,SAAO,OAAO,OAAO;AAAA,IACnB,QAAQ,MAAM,gBAAgB;AAAA,IAC9B,SAAS,MAAM,UAAU;AAAA,IACzB,YAAY,MAAM,mBAAmB;AAAA,IACrC,WAAW,MAAM,YAAY;AAAA,IAC7B,WAAW,MAAM,kBAAkB;AAAA,EACrC,CAAC;AACH;AAEO,SAAS,wCACd,OAImB;AACnB,QAAM,UAAU,oBAAI,IAAI,CAAC,OAAO,OAAO,OAAO,SAAS,QAAQ,OAAO,KAAK,CAAC;AAC5E,aAAW,QAAQ,CAAC,MAAM,YAAY,MAAM,WAAW,GAAG;AACxD,UAAM,WAAW,KAAK,MAAM,GAAG,EAAE,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC;AAC/D,QAAI,SAAU,SAAQ,IAAI,QAAQ;AAAA,EACpC;AACA,SAAO,OAAO,OAAO,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC;AAC1C;AAEA,eAAe,kBAAkB,OAAe,kBAA2C;AACzF,MAAI,CAACA,YAAW,KAAK,KAAK,SAAS,KAAK,MAAM,kBAAkB;AAC9D,UAAM,IAAI,MAAM,yBAAyB,gBAAgB,kBAAkB;AAAA,EAC7E;AACA,QAAM,YAAY,MAAM,SAAS,KAAK;AACtC,QAAM,WAAW,MAAM,KAAK,SAAS;AACrC,QAAM,OAAO,WAAW,CAAC;AACzB,MAAI,CAAC,SAAS,OAAO,KAAK,SAAS,QAAQ,MAAM,SAAS,OAAO,QAAW,GAAG;AAC7E,UAAM,IAAI,MAAM,yBAAyB,gBAAgB,8BAA8B;AAAA,EACzF;AACA,SAAO;AACT;AAEA,eAAe,mBAAmB,OAAgC;AAChE,MAAI,CAACA,YAAW,KAAK,KAAK,iBAAiB,KAAK,GAAG;AACjD,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,QAAM,YAAY,MAAM,SAAS,KAAK;AACtC,QAAM,WAAW,MAAM,KAAK,SAAS;AACrC,MACE,cAAc,SACd,CAAC,SAAS,YAAY,KACtB,SAAS,QAAQ,MAChB,SAAS,OAAO,QAAW,GAC5B;AACA,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,OAAwB;AAChD,MAAI,MAAM,MAAM,GAAG,EAAE,OAAO,OAAO,EAAE,SAAS,EAAG,QAAO;AACxD,UAAO,oBAAI,IAAI;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,GAAE,IAAI,KAAK;AACd;AAEA,SAAS,iCACP,aACA,aACM;AACN,aAAW,QAAQ;AAAA,IACjB;AAAA,IACA;AAAA,EACF,GAAY;AACV,UAAM,OAAO,YAAY,IAAI;AAC7B,QAAI,CAAC,QAAQ,CAAC,aAAa,aAAa,IAAI,GAAG;AAC7C,YAAM,IAAI,MAAM,qEAAqE;AAAA,IACvF;AAAA,EACF;AACF;AAEA,SAAS,aAAa,MAAc,MAAuB;AACzD,MAAI,CAACA,YAAW,IAAI,EAAG,QAAO;AAC9B,QAAM,WAAW,SAAS,MAAM,IAAI;AACpC,SACE,SAAS,SAAS,KAClB,aAAa,QACb,CAAC,SAAS,WAAW,KAAK,QAAQ,aAAa,UAAU,OAAO,GAAG,EAAE,KACrE,CAACA,YAAW,QAAQ;AAExB;AAEA,SAAS,yBAAyB,OAA6C;AAC7E,QAAM,cAAc,oBAAI,IAAY;AACpC,aAAW,QAAQ,OAAO;AACxB,QAAI,SAAS,QAAQ,IAAI;AACzB,WAAO,WAAW,OAAO,WAAW,KAAK;AACvC,kBAAY,IAAI,MAAM;AACtB,eAAS,QAAQ,MAAM;AAAA,IACzB;AAAA,EACF;AACA,SAAO,CAAC,GAAG,WAAW,EAAE,KAAK,CAAC,MAAM,UAAU;AAC5C,UAAM,QAAQ,KAAK,MAAM,GAAG,EAAE,SAAS,MAAM,MAAM,GAAG,EAAE;AACxD,WAAO,UAAU,IAAI,KAAK,cAAc,KAAK,IAAI;AAAA,EACnD,CAAC;AACH;AAEA,SAAS,eAAe,OAAgB,UAAsC;AAC5E,SACE,MAAM,QAAQ,KAAK,KACnB,MAAM,WAAW,SAAS,UAC1B,MAAM,MAAM,CAAC,OAAO,UAAU,UAAU,SAAS,KAAK,CAAC;AAE3D;AAEA,eAAe,sBAAsB,OAAgC;AACnE,MAAI,CAACA,YAAW,KAAK,KAAK,CAAC,8CAA8C,KAAK,SAAS,KAAK,CAAC,GAAG;AAC9F,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AACA,QAAM,YAAY,MAAM,SAAS,KAAK;AACtC,QAAM,WAAW,MAAM,KAAK,SAAS;AACrC,QAAM,OAAO,WAAW,CAAC;AACzB,MAAI,CAAC,SAAS,OAAO,EAAG,OAAM,IAAI,MAAM,qDAAqD;AAC7F,SAAO;AACT;AAEA,SAAS,iBAAiB,QAAgB,MAAc,UAA2B;AACjF,QAAM,OAAO,OAAO,MAAM,IAAI,EAAE,KAAK,CAAC,cAAc,UAAU,WAAW,IAAI,CAAC;AAC9E,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,SAAS,KAAK,KAAK,EAAE,MAAM,SAAS;AAC1C,SAAO,OAAO,CAAC,MAAM,YAAY,OAAO,CAAC,MAAM;AACjD;AAEA,eAAe,cACb,QACqB;AACrB,QAAM,SAAuB,CAAC;AAC9B,MAAI,QAAQ;AACZ,mBAAiB,SAAS,QAAQ;AAChC,UAAM,QAAQ,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAI;AAC/D,aAAS,MAAM;AACf,QAAI,QAAQ,gBAAiB,OAAM,IAAI,MAAM,gDAAgD;AAC7F,WAAO,KAAK,IAAI,WAAW,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,EAAE,MAAM,CAAC;AAAA,EACtF;AACA,QAAM,SAAS,IAAI,WAAW,KAAK;AACnC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,WAAO,IAAI,OAAO,MAAM;AACxB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAEA,SAASE,aACP,OACiE;AACjE,MAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,MAAM;AACxD,WAAO,QAAQ,QAAQ,EAAE,MAAM,MAAM,UAAU,QAAQ,MAAM,WAAW,CAAC;AAAA,EAC3E;AACA,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,UAAU,CAAC,UAAiB;AAChC,YAAM,eAAe,QAAQ,MAAM;AACnC,aAAO,KAAK;AAAA,IACd;AACA,UAAM,SAAS,CAAC,MAAqB,WAAkC;AACrE,YAAM,eAAe,SAAS,OAAO;AACrC,cAAQ,EAAE,MAAM,OAAO,CAAC;AAAA,IAC1B;AACA,UAAM,KAAK,SAAS,OAAO;AAC3B,UAAM,KAAK,QAAQ,MAAM;AAAA,EAC3B,CAAC;AACH;AAEA,SAASD,gBAAe,OAA6C;AACnE,MAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,KAAM;AAC1D,QAAM,MAAM,QAAQ;AACpB,QAAM,KAAK,SAAS;AACtB;;;AJ7YA,eAAsB,oDACpB,SAC8C;AAC9C,MAAI,QAAQ,yBAAyB,8CAA8C;AACjF,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AACA,MAAI,OAAO,QAAQ,gBAAgB,YAAY,QAAQ,YAAY,KAAK,EAAE,WAAW,GAAG;AACtF,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,cAAc,QAAQ,eAAe;AAC3C,QAAM,cAAc,QAAQ,iBAAiB,SAAS;AACtD,MAAI,iBAAiB,QAAQ,qCAAqC,OAAO;AACvE,UAAM,IAAI,MAAM,2EAA2E;AAAA,EAC7F;AACA,QAAM,WAAW,cACb,MAAM,iDAAiD;AAAA,IACrD,wBAAwB,QAAQ;AAAA,IAChC,mBAAmB,QAAQ,qCAAqC;AAAA,IAChE,iBAAiB,QAAQ;AAAA,EAC3B,CAAC,IACD,MAAM,2CAA2C;AAAA,IAC/C,wBAAwB,QAAQ;AAAA,IAChC,sBAAsB,eAAe,QAAQ,sBAAsB,YAAY;AAAA,IAC/E,mBAAmB,eAAe,QAAQ,mBAAmB,SAAS;AAAA,IACtE,aAAaE,SAAQ,QAAQ,iBAAiB,YAAY;AAAA,IAC1D,kBAAkB,QAAQ;AAAA,IAC1B,gBAAgB,QAAQ;AAAA,IACxB,qBAAqB,QAAQ;AAAA,IAC7B,cAAc,QAAQ;AAAA,IACtB,oBAAoB,QAAQ;AAAA,EAC9B,CAAC;AACL,QAAM,aAAa,aAAa,QAAQ,QAAQ;AAChD,QAAM,WAAW,SAAS,QAAQ,aAAa;AAAA,IAC7C,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,IACnC,GAAI,QAAQ,SAAS,cAAc,EAAE,aAAa,QAAQ,SAAS,YAAY,IAAI,CAAC;AAAA,IACpF,KAAK,KAAK,IAAI,GAAG,cAAc,CAAC;AAAA,EAClC,CAAC;AACD,MAAI,UAAU;AACd,MAAI;AACF,UAAM,wCAAwC,SAAS,EAAE;AACzD,UAAM,gBAAgB,QAAQ,iBAAiB,oBAAoB,QAAQ,QAAQ;AACnF,QAAI,CAAC,cAAe,OAAM,IAAI,MAAM,qDAAqD;AACzF,UAAM,oBAA6D;AAAA,MACjE,YAAY,QAAQ;AAAA,MACpB;AAAA,MACA,kBACE,QAAQ,iBAAiB,SAAS,eAC9B,OAAO,OAAO;AAAA,QACZ,oCAAoC,QAAQ,iBAAiB;AAAA,QAC7D,8BAA8B,QAAQ;AAAA,MACxC,CAAC,IACD,OAAO,OAAO;AAAA,QACZ,UAAU;AAAA,QACV,gDAAgD,QAAQ,iBAAiB;AAAA,QACzE,8BAA8B,QAAQ;AAAA,MACxC,CAAC;AAAA,MACP,GAAI,cAAc,EAAE,6BAA6B,KAAK,IAAI,CAAC;AAAA,MAC3D,eAAe,QAAQ;AAAA,MACvB;AAAA,MACA;AAAA,IACF;AACA,UAAM,SAAS,MAAM,2CAA2C,iBAAiB;AACjF,UAAM,aAAa,IAAI,kDAAkD,SAAS,IAAI;AAAA,MACpF,GAAI,QAAQ,SAAS,SAAS,KAAK,IAAI,EAAE,YAAY,QAAQ,SAAS,SAAS,KAAK,EAAE,IAAI,CAAC;AAAA,IAC7F,CAAC;AACD,UAAM,gBAAgB,oBAAoB,QAAQ,UAAU;AAAA,MAC1D,WAAW;AAAA,IACb,CAAC;AACD,QAAI,aAAa;AACf,oBAAc,KAAK,0DAA0D;AAAA,QAC3E,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,UAAM,eAAe,6CAA6C;AAAA,MAChE,SAAS;AAAA,MACT,cAAc,QAAQ;AAAA,MACtB,yBAAyB;AAAA,MACzB,GAAI,cAAc,EAAE,6BAA6B,KAAK,IAAI,CAAC;AAAA,MAC3D,cAAc;AAAA,QACZ,OAAO;AAAA,QACP,cAAc,0CAA0C,aAAa;AAAA,QACrE,cAAc,0CAA0C,aAAa;AAAA,QACrE,gBAAgB,4CAA4C,eAAe;AAAA,UACzE,QAAQ,OAAO;AAAA,QACjB,CAAC;AAAA,QACD;AAAA,QACA,WAAW;AAAA,QACX,OAAO;AAAA,QACP,QAAQ;AAAA,UACN,KAAK,SAAS,YAAY;AACxB,0BAAc,KAAK,SAAS;AAAA,cAC1B,YAAY;AAAA,cACZ,WAAW,6BAA6B,UAAU,KAAK;AAAA,cACvD,QAAQ;AAAA,cACR,SAAS,OAAO,WAAW,SAAS,WAAW,WAAW,OAAO;AAAA,YACnE,CAAC;AAAA,UACH;AAAA,QACF;AAAA,QACA,SAAS;AAAA,UACP,UAAU,SAAS,QAAQ,GAAG;AAC5B,0BAAc,iBAAiB;AAAA,cAC7B,MAAM;AAAA,cACN,MAAM;AAAA,cACN,QAAQ,EAAE,QAAQ;AAAA,cAClB,QAAQ;AAAA,YACV,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF;AAAA,MACA,SAAS;AAAA,QACP,OAAO,QAAQ;AAAA,QACf,GAAI,QAAQ,cAAc,SAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,QAC1E;AAAA,QACA,GAAI,QAAQ,oBAAoB,SAC5B,EAAE,iBAAiB,QAAQ,gBAAgB,IAC3C,CAAC;AAAA,QACL,GAAI,QAAQ,yBAAyB,SACjC,EAAE,sBAAsB,QAAQ,qBAAqB,IACrD,CAAC;AAAA,QACL,GAAI,QAAQ,mBAAmB,SAAY,EAAE,gBAAgB,QAAQ,eAAe,IAAI,CAAC;AAAA,QACzF,GAAI,QAAQ,gBAAgB,SAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,QAChF;AAAA,QACA;AAAA,MACF;AAAA,IACF,CAAC;AACD,QAAI,CAAC,aAAc,OAAM,IAAI,MAAM,gDAAgD;AACnF,cAAU;AACV,WAAO,0CAA0C;AAAA,MAC/C;AAAA,MACA,IAAI,SAAS;AAAA,MACb,eAAe,SAAS;AAAA,MACxB;AAAA,MACA,aAAa,QAAQ,SAAS;AAAA,MAC9B,aAAa,QAAQ,SAAS;AAAA,MAC9B,oBAAoB,QAAQ,SAAS;AAAA,MACrC,mBAAmB,OAAO,OAAO;AAAA,QAC/B,MAAM,QAAQ,iBAAiB;AAAA,QAC/B,iBAAiB,SAAS,SAAS;AAAA,MACrC,CAAC;AAAA,IACH,CAAC;AAAA,EACH,UAAE;AACA,QAAI,CAAC,QAAS,OAAM,SAAS,MAAM;AAAA,EACrC;AACF;AAEA,SAAS,6BACP,YASY;AACZ,QAAM,MAAM,GAAG,OAAO,WAAW,YAAY,CAAC,IAAI,OAAO,WAAW,cAAc,CAAC;AACnF,UAAQ,KAAK;AAAA,IACX,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,EACX;AACF;AAEO,SAAS,0CACd,OACqC;AACrC,MAAI,QAAkD;AACtD,MAAI,aAAmC;AACvC,MAAI,eAAqC;AACzC,MAAI,iBAAiB;AACrB,QAAM,QAAQ,IAAI,gBAAgB;AAClC,QAAM,qBAAqB,MAAM,sBAAsB;AAEvD,QAAM,QAAQ,YAA2B;AACvC,UAAM,YAAY,wCAAwC,MAAM,EAAE,GAAG,kBAAkB;AAAA,EACzF;AAEA,QAAM,MAAM,MAAqB;AAC/B,QAAI,WAAY,QAAO;AACvB,QAAI,UAAU,YAAY;AACxB,aAAO,QAAQ,OAAO,IAAI,MAAM,mDAAmD,CAAC;AAAA,IACtF;AACA,kBAAc,YAAY;AACxB,UAAI;AACF,cAAM,MAAM;AACZ,YAAI,MAAM,OAAO,SAAS;AACxB,kBAAQ;AACR;AAAA,QACF;AACA,gBAAQ;AACR,cAAM,MAAM,aAAa,IAAI,MAAM,MAAM;AACzC,cAAM,kBAAmB,UAAuD;AAChF,gBAAQ,kBAAkB,YAAY;AACtC,YAAI,CAAC,iBAAiB;AACpB,gBAAM,IAAI,MAAM,2DAA2D;AAAA,QAC7E;AAAA,MACF,SAAS,OAAO;AACd,cAAM,cAAc;AACpB,YAAI,gBAAgB,cAAc,gBAAgB,UAAW,SAAQ;AACrE,cAAM;AAAA,MACR;AAAA,IACF,GAAG;AACH,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,CAAC,UAAU,eAAwB;AAC/C,QAAI,UAAU,cAAc,UAAU,aAAa,UAAU,SAAU,QAAO;AAC9E,YAAQ;AACR,UAAM,MAAM;AACZ,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,MAAqB;AACjC,QAAI,aAAc,QAAO;AACzB,oBAAgB,YAAY;AAC1B,YAAM,OAAO;AACb,UAAI,WAAY,OAAM,WAAW,MAAM,MAAM,MAAS;AACtD,YAAM,MAAM,aAAa,MAAM;AAC/B,UAAI,CAAC,gBAAgB;AACnB,yBAAiB;AACjB,cAAM,MAAM,cAAc;AAAA,MAC5B;AACA,UAAI,UAAU,SAAU,SAAQ;AAAA,IAClC,GAAG;AACH,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,OAAO,YAAwC;AAC3D,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAI,QAAQ,WAAW,OAAO;AAC5B,aAAO,SAAS,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACvE;AACA,QAAI,IAAI,aAAa,YAAY;AAC/B,YAAM,KAAK,UAAU,YAAY,UAAU;AAC3C,aAAO,SAAS;AAAA,QACd;AAAA,UACE,SAAS,MAAM;AAAA,UACf,WAAW;AAAA,UACX,aAAa,MAAM;AAAA,UACnB,GAAI,MAAM,qBAAqB,EAAE,oBAAoB,MAAM,mBAAmB,IAAI,CAAC;AAAA,UACnF,SAAS,MAAM,qBAAqB;AAAA,YAClC,MAAM;AAAA,YACN,iBAAiB;AAAA,UACnB;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,QACA,EAAE,QAAQ,KAAK,MAAM,IAAI;AAAA,MAC3B;AAAA,IACF;AACA,QAAI,IAAI,aAAa,WAAW;AAC9B,UAAI,UAAU,SAAS;AACrB,eAAO,SAAS;AAAA,UACd,EAAE,IAAI,OAAO,OAAO,QAAQ,EAAE,cAAc,EAAE,IAAI,MAAM,EAAE,EAAE;AAAA,UAC5D,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI;AACF,cAAM,MAAM;AACZ,eAAO,SAAS,KAAK;AAAA,UACnB,IAAI;AAAA,UACJ;AAAA,UACA,SAAS,MAAM,qBAAqB;AAAA,YAClC,MAAM;AAAA,YACN,iBAAiB;AAAA,UACnB;AAAA,UACA,QAAQ,EAAE,cAAc,EAAE,IAAI,KAAK,EAAE;AAAA,QACvC,CAAC;AAAA,MACH,QAAQ;AACN,eAAO,SAAS;AAAA,UACd,EAAE,IAAI,OAAO,OAAO,QAAQ,EAAE,cAAc,EAAE,IAAI,MAAM,EAAE,EAAE;AAAA,UAC5D,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AACA,QAAI,IAAI,aAAa,YAAY;AAC/B,aAAO,IAAI,SAAS,MAAM,MAAM,cAAc,kBAAkB,GAAG;AAAA,QACjE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,2CAA2C;AAAA,MACxE,CAAC;AAAA,IACH;AACA,WAAO,SAAS,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9D;AAEA,SAAO,OAAO,OAAO;AAAA,IACnB,OAAO,MAAM;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc,OAAO,WAAyB,MAAM,MAAM,aAAa,aAAa,MAAM;AAAA,IAC1F;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,wCAAwC,IAA6B;AACzF,QAAM,MAAM,MAAM,GAAG,QAOlB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GAwBF;AACD,QAAM,OAAO,MAAM,QAAQ,GAAG,IAAI,MAAQ,IAAwC,QAAQ,CAAC;AAC3F,QAAM,MAAM,KAAK,CAAC;AAUlB,MACE,KAAK,iBAAiB,gDACtB,IAAI,iBAAiB,gDACrB,IAAI,oBAAoB,SACxB,IAAI,oBAAoB,SACxB,IAAI,oBAAoB,SACxB,IAAI,oBAAoB,OACxB;AACA,UAAM,IAAI,MAAM,sEAAsE;AAAA,EACxF;AACF;AA+BO,SAAS,mDACd,cAAiC,QAAQ,KACc;AACvD,MAAI,YAAY,2CAA2C,OAAQ,QAAO;AAC1E,QAAM,cAAc,SAAS,aAAa,6CAA6C;AACvF,QAAM,uBAAuB;AAAA,IAC3B;AAAA,IACA;AAAA,EACF;AACA,MAAI,yBAAyB,8CAA8C;AACzE,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,QAAM,qBAAqB,SAAS,aAAa,oCAAoC;AACrF,QAAM,sBAAsB;AAAA,IAC1B;AAAA,IACA;AAAA,EACF;AACA,MAAI,sBAAsB,qBAAqB;AAC7C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,sBAAsB,CAAC,qBAAqB;AAC/C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,cAAc,wBAAwB;AAC5C,MAAI,aAAa;AACf,QAAI,YAAY,aAAa,cAAc;AACzC,YAAM,IAAI,MAAM,oEAAoE;AAAA,IACtF;AACA,QACE,YAAY,wCAAwC,UACpD,YAAY,2DAA2D,QACvE;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,8BAA0B,WAAW;AACrC,mCAA+B,SAAS,aAAa,kCAAkC,CAAC;AAAA,EAC1F;AACA,QAAM,eACJ,SAAS,aAAa,0CAA0C,KAAK;AACvE,MAAI,eAAe,CAAC,mBAAmB,YAAY,GAAG;AACpD,UAAM,IAAI,MAAM,wEAAwE;AAAA,EAC1F;AACA,QAAM,mBAAqD,sBACvD,OAAO,OAAO;AAAA,IACZ,MAAM;AAAA,IACN,qBAAqB;AAAA,IACrB,cAAc;AAAA,EAChB,CAAC,IACD,OAAO,OAAO;AAAA,IACZ,MAAM;AAAA,IACN,qBAAqB;AAAA,IACrB,cAAc;AAAA,EAChB,CAAC;AACL,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA,YAAY,SAAS,aAAa,2CAA2C;AAAA,IAC7E,sBAAsB,cAClB,OACA,SAAS,aAAa,sCAAsC;AAAA,IAChE,mBAAmB,cACf,OACA,SAAS,aAAa,wCAAwC;AAAA,IAClE;AAAA,IACA,kCAAkC;AAAA,IAClC,uBAAuB,SAAS,aAAa,8BAA8B;AAAA,IAC3E,OACE,YAAY,sCAAsC,KAAK,KACvD,gBAAgB,QAAQ,GAAG,IAAI,OAAO,WAAW,CAAC;AAAA,IACpD;AAAA,IACA,UAAU,QAAQ,aAAa,4CAA4C,MAAM,GAAG,KAAM;AAAA,IAC1F,WAAW,QAAQ,aAAa,6CAA6C,GAAG,GAAG,EAAE;AAAA,IACrF,aAAa,QAAQ,aAAa,8CAA8C,GAAG,GAAG,EAAE;AAAA,IACxF,iBAAiB;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,sBAAsB;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,gBAAgB;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,aAAa,QAAQ,aAAa,+CAA+C,IAAI,GAAG,GAAK;AAAA,IAC7F,kBAAkB;AAAA,MAChB;AAAA,MACA;AAAA,MACA,MAAM,OAAO;AAAA,MACb,KAAK,OAAO;AAAA,MACZ,IAAI,OAAO,OAAO;AAAA,IACpB;AAAA,IACA,gBAAgB;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,qBAAqB;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,cAAc,QAAQ,aAAa,4CAA4C,IAAI,GAAG,IAAK;AAAA,IAC3F,oBAAoB;AAAA,MAClB;AAAA,MACA;AAAA,MACA,MAAM,OAAO;AAAA,MACb,OAAO;AAAA,MACP,IAAI,OAAO,OAAO;AAAA,IACpB;AAAA,IACA,eAAe;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,gBAAgB;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,gBAAgB;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,GAAI,YAAY,aAAa,SAAY,CAAC,IAAI,EAAE,iBAAiB,YAAY,SAAS;AAAA,EACxF,CAAC;AACH;AAEA,eAAsB,yCACpB,cAAiC,QAAQ,KAKhC;AACT,QAAM,UAAU,mDAAmD,WAAW;AAC9E,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,WAAW,gCAAgC,WAAW;AAC5D,QAAM,UAAU,MAAM,oDAAoD;AAAA,IACxE;AAAA,IACA,aAAa,QAAQ;AAAA,IACrB,sBAAsB,QAAQ;AAAA,IAC9B,YAAY,QAAQ;AAAA,IACpB,sBAAsB,QAAQ;AAAA,IAC9B,mBAAmB,QAAQ;AAAA,IAC3B,kBAAkB,QAAQ;AAAA,IAC1B,GAAI,QAAQ,mCAAmC,EAAE,kCAAkC,KAAK,IAAI,CAAC;AAAA,IAC7F,uBAAuB,QAAQ;AAAA,IAC/B,OAAO,QAAQ;AAAA,IACf,WAAW,QAAQ;AAAA,IACnB,aAAa,QAAQ;AAAA,IACrB,iBAAiB,QAAQ;AAAA,IACzB,sBAAsB,QAAQ;AAAA,IAC9B,gBAAgB,QAAQ;AAAA,IACxB,aAAa,QAAQ;AAAA,IACrB,kBAAkB,QAAQ;AAAA,IAC1B,gBAAgB,QAAQ;AAAA,IACxB,qBAAqB,QAAQ;AAAA,IAC7B,cAAc,QAAQ;AAAA,IACtB,oBAAoB,QAAQ;AAAA,IAC5B,eAAe,QAAQ;AAAA,IACvB,gBAAgB,QAAQ;AAAA,IACxB,gBAAgB,QAAQ;AAAA,IACxB,GAAI,QAAQ,oBAAoB,SAAY,CAAC,IAAI,EAAE,iBAAiB,QAAQ,gBAAgB;AAAA,EAC9F,CAAC;AACD,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA,cAAc,QAAQ;AAAA,IACtB,UAAU,QAAQ;AAAA,EACpB,CAAC;AACH;AAEA,eAAe,YAAe,SAAqB,cAAkC;AACnF,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK;AAAA,MACxB;AAAA,MACA,IAAI,QAAe,CAAC,UAAU,WAAW;AACvC,gBAAQ,WAAW,MAAM,OAAO,IAAI,MAAM,2BAA2B,CAAC,GAAG,YAAY;AAAA,MACvF,CAAC;AAAA,IACH,CAAC;AAAA,EACH,UAAE;AACA,QAAI,MAAO,cAAa,KAAK;AAAA,EAC/B;AACF;AAEA,SAAS,SAAS,aAAgC,MAAsB;AACtE,QAAM,QAAQ,YAAY,IAAI,GAAG,KAAK;AACtC,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,GAAG,IAAI,uDAAuD;AAC1F,SAAO;AACT;AAEA,SAAS,SAAS,aAAgC,MAA6B;AAC7E,QAAM,QAAQ,YAAY,IAAI,GAAG,KAAK;AACtC,SAAO,QAAQ,QAAQ;AACzB;AAEA,SAAS,eAAe,OAAsB,MAAsB;AAClE,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,yBAAyB,IAAI,4BAA4B;AACrF,SAAO;AACT;AAEA,SAAS,0BAA0B,aAA2B;AAC5D,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,WAAW;AAAA,EAC9B,QAAQ;AACN,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,MAAI,OAAO,aAAa,eAAe,OAAO,aAAa,eAAe;AACxE,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,MAAI,CAAC,mBAAmB,OAAO,QAAQ,GAAG;AACxC,UAAM,IAAI,MAAM,uEAAuE;AAAA,EACzF;AACF;AAEA,SAAS,+BAA+B,UAAwB;AAC9D,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,QAAQ;AAAA,EAC3B,QAAQ;AACN,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,MACG,OAAO,aAAa,WAAW,OAAO,aAAa,YACpD,CAAC,mBAAmB,OAAO,QAAQ,GACnC;AACA,UAAM,IAAI,MAAM,uEAAuE;AAAA,EACzF;AACF;AAEA,SAAS,mBAAmB,UAA2B;AACrD,QAAM,aAAa,SAAS,YAAY;AACxC,SAAO,eAAe,eAAe,eAAe,eAAe,eAAe;AACpF;AAEA,SAAS,QACP,aACA,MACA,UACA,SACA,SACQ;AACR,QAAM,MAAM,YAAY,IAAI;AAC5B,QAAM,QAAQ,QAAQ,SAAY,WAAW,OAAO,GAAG;AACvD,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,WAAW,QAAQ,SAAS;AACtE,UAAM,IAAI,MAAM,GAAG,IAAI,+BAA+B;AAAA,EACxD;AACA,SAAO;AACT;;;AK/wBA,eAAsB,uCACpB,cAAiC,QAAQ,KAC1B;AACf,QAAM,aAAa,MAAM,yCAAyC,WAAW;AAC7E,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACA,QAAM,SAAS,IAAI,MAAM;AAAA,IACvB,UAAU,WAAW;AAAA,IACrB,MAAM,WAAW;AAAA,IACjB,OAAO,WAAW,QAAQ;AAAA,EAC5B,CAAC;AACD,QAAM,OAAO,MAAM,WAAW,QAAQ,MAAM,gBAAgB;AAC5D,UAAQ,GAAG,WAAW,IAAI;AAC1B,UAAQ,GAAG,UAAU,IAAI;AACzB,MAAI;AACF,UAAM,WAAW,QAAQ,IAAI;AAAA,EAC/B,UAAE;AACA,YAAQ,IAAI,WAAW,IAAI;AAC3B,YAAQ,IAAI,UAAU,IAAI;AAC1B,WAAO,KAAK,IAAI;AAChB,UAAM,WAAW,QAAQ,MAAM;AAAA,EACjC;AACF;AAEA,IAAI,YAAY,MAAM;AACpB,QAAM,uCAAuC;AAC/C;","names":["dirname","createHash","BoundedObjectReadError","BoundedObjectReadError","throwIfAborted","createHash","EDITABLE_ARTIFACT_KERNEL_VERSION_MAX_BYTES","COMMITTED_TRANSACTION_PROTOCOL_VERSION","SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION","SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION","throwIfAborted","SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION","COMMITTED_TRANSACTION_PROTOCOL_VERSION","SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION","EDITABLE_ARTIFACT_KERNEL_VERSION_MAX_BYTES","abortError","isAbsolute","terminateChild","waitForExit","dirname"]}