@opengeni/worker-bundle 3.1.2 → 3.2.2

package/dist/{activities-control-ROJJNNTJ.js.map → activities-control-LC7WXEIX.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/activities/knowledge-indexing.ts","../src/activities/codex-capacity.ts","../src/activities/browser-state-artifact-reaper.ts","../src/activities/automations.ts","../src/activities/file-upload-reaper.ts","../src/activities/model-call-fact-reconciler.ts","../src/activities/retained-screenshot-reaper.ts","../src/activities/rig-verification.ts","../src/activities/scheduled-tasks.ts","../src/scheduled-alert-occurrence.ts","../src/activities/session-state.ts","../src/activities/session-archive.ts","../src/activities/session-storage.ts","../src/activities/workflow-wake.ts","../src/activities-control.ts"],"sourcesContent":["import { configuredStaticUsageLimits } from \"@opengeni/config\";\nimport {\n  documentEmbeddingCostMicros,\n  paidDocumentEmbedding,\n  workspaceCreditsDisabled,\n} from \"@opengeni/core\";\nimport {\n  applyCreditDebitAfterUse,\n  appendKnowledgeIndexChunks,\n  claimKnowledgeIndexJobs,\n  checkWorkspaceAllowance,\n  completeKnowledgeIndexJob,\n  continueKnowledgeIndexJob,\n  creditDebitAttributionMetadata,\n  deferKnowledgeIndexJob,\n  freezeKnowledgeIndexBillingMode,\n  getSpendableCreditBalance,\n  guardPaidKnowledgeIndexPublication,\n  knowledgeIndexBillingActivationTime,\n  readKnowledgeIndexSource,\n  recordUsageEvent,\n  sumUsageQuantity,\n  withWorkspaceUsageLock,\n  waitKnowledgeIndexForFunding,\n} from \"@opengeni/db\";\nimport type { DocumentServices } from \"@opengeni/documents\";\nimport type { ControlActivityServices } from \"./types\";\n\n/** The configured monthly indexed-chunk limit, not a provider failure. */\nexport class KnowledgeIndexUsageLimitError extends Error {\n  constructor() {\n    super(\"monthly document indexing limit reached\");\n    this.name = \"KnowledgeIndexUsageLimitError\";\n  }\n}\n\nexport type KnowledgeIndexFailureStage = \"embedding\" | \"processing\";\n\n/**\n * Content-free classification for a deferred Knowledge index batch. Only\n * protocol constants, an HTTP status, and a PostgreSQL SQLSTATE are retained;\n * provider messages, bodies, SQL, and identifiers never leave the process.\n * Outside the embedding call, only a PostgreSQL error in the cause chain is\n * attributed to the database; any other failure stays a worker failure.\n */\nexport function knowledgeIndexFailureDiagnostic(\n  stage: KnowledgeIndexFailureStage,\n  error: unknown,\n): {\n  errorClass: \"KnowledgeIndexOperationError\";\n  errorCode:\n    | \"knowledge_index_usage_limit_reached\"\n    | \"knowledge_index_embedding_failed\"\n    | \"knowledge_index_persistence_failed\"\n    | \"knowledge_index_failed\";\n  origin: \"worker\" | \"db\";\n  status?: number;\n  sqlState?: string;\n} {\n  if (error instanceof KnowledgeIndexUsageLimitError) {\n    return {\n      errorClass: \"KnowledgeIndexOperationError\",\n      errorCode: \"knowledge_index_usage_limit_reached\",\n      origin: \"worker\",\n    };\n  }\n  if (stage === \"embedding\") {\n    const status = ownValue(error, \"status\");\n    return {\n      errorClass: \"KnowledgeIndexOperationError\",\n      errorCode: \"knowledge_index_embedding_failed\",\n      origin: \"worker\",\n      ...(typeof status === \"number\" && Number.isInteger(status) && status >= 100 && status <= 599\n        ? { status }\n        : {}),\n    };\n  }\n  const postgres = postgresErrorState(error);\n  if (!postgres) {\n    return {\n      errorClass: \"KnowledgeIndexOperationError\",\n      errorCode: \"knowledge_index_failed\",\n      origin: \"worker\",\n    };\n  }\n  return {\n    errorClass: \"KnowledgeIndexOperationError\",\n    errorCode: \"knowledge_index_persistence_failed\",\n    origin: \"db\",\n    ...(postgres.sqlState ? { sqlState: postgres.sqlState } : {}),\n  };\n}\n\nfunction ownValue(value: unknown, key: string): unknown {\n  try {\n    if (!value || typeof value !== \"object\") return undefined;\n    const descriptor = Object.getOwnPropertyDescriptor(value, key);\n    return descriptor && \"value\" in descriptor ? descriptor.value : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** The nearest PostgreSQL error in a short cause chain, with its SQLSTATE\n * when that is a well-formed five-character code. */\nfunction postgresErrorState(error: unknown): { sqlState?: string } | undefined {\n  let current = error;\n  for (let depth = 0; depth < 4 && current && typeof current === \"object\"; depth += 1) {\n    if (ownValue(current, \"name\") === \"PostgresError\") {\n      const code = ownValue(current, \"code\");\n      return typeof code === \"string\" && /^[0-9A-Z]{5}$/.test(code) ? { sqlState: code } : {};\n    }\n    current = ownValue(current, \"cause\");\n  }\n  return undefined;\n}\n\nexport function createKnowledgeIndexingActivities(\n  services: () => Promise<ControlActivityServices>,\n  resolveDocumentServices?: () => Promise<DocumentServices>,\n) {\n  // Unpaid modes retain a conservative first-poll cutoff; paid mode uses the\n  // operator's explicit timestamp so process restarts cannot change eligibility.\n  let activationTime: Promise<Date> | undefined;\n  return {\n    indexKnowledge: async () => {\n      const result = { completed: 0, advanced: 0, deferred: 0, unavailable: 0 };\n      if (!resolveDocumentServices) return result;\n      const { db, settings, observability } = await services();\n      let policyActivatedAt: Date;\n      if (paidDocumentEmbedding(settings)) {\n        if (!settings.documentEmbeddingCreditsActivatedAt)\n          throw new Error(\"paid Knowledge embedding requires an activation cutoff\");\n        policyActivatedAt = new Date(settings.documentEmbeddingCreditsActivatedAt);\n      } else {\n        activationTime ??= knowledgeIndexBillingActivationTime(db).catch((error) => {\n          activationTime = undefined;\n          throw error;\n        });\n        policyActivatedAt = await activationTime;\n      }\n      const { embedder } = await resolveDocumentServices();\n      // A claim would only record a failure and push the job's retry out; an\n      // embedder that cannot make any request leaves the queue untouched.\n      if (embedder.available === false) return result;\n      const { knowledgeIndexChunks } = await import(\"@opengeni/documents\");\n      const claims = await claimKnowledgeIndexJobs(db, {\n        model: embedder.model,\n        dimensions: embedder.dimensions,\n        limit: 2,\n      });\n      for (const claim of claims) {\n        let stage: KnowledgeIndexFailureStage = \"processing\";\n        try {\n          const source = await readKnowledgeIndexSource(db, claim);\n          if (!source) {\n            result.unavailable++;\n            continue;\n          }\n          // The checkpoint, usage and post-use debit commit together. A new\n          // generation requires funding once; committed batches may finish even\n          // if their accumulated cost takes the balance below zero.\n          await withWorkspaceUsageLock(db, source.billingWorkspaceId, async (lockedDb) => {\n            const current = await readKnowledgeIndexSource(lockedDb, claim);\n            if (!current) {\n              result.unavailable++;\n              return;\n            }\n            const chunks = [];\n            let more = false;\n            for (const chunk of knowledgeIndexChunks(current.entry)) {\n              if (chunk.index < current.nextIndex) continue;\n              if (chunks.length === 32) {\n                more = true;\n                break;\n              }\n              chunks.push(chunk);\n            }\n            if (chunks.length) {\n              const frozenPolicy = await freezeKnowledgeIndexBillingMode(\n                lockedDb,\n                claim,\n                // Deterministic embeddings incur no provider charge; a valid\n                // credits-mode config with zero tariff must still index them.\n                // OpenAI shadow keeps its price snapshot for internal estimates.\n                settings.documentEmbeddingProvider === \"openai\"\n                  ? (settings.documentEmbeddingBillingMode ?? \"usage_only\")\n                  : \"usage_only\",\n                policyActivatedAt,\n                settings.documentEmbeddingRateMicrosPerMillionBytes ?? 0,\n              );\n              if (frozenPolicy.mode === \"awaiting_review\") {\n                result.deferred++;\n                return;\n              }\n              if (frozenPolicy.mode === \"obsolete\") {\n                result.unavailable++;\n                return;\n              }\n              // An already-priced generation cannot become free when the\n              // operator turns off paid embedding. Retain its checkpoint and\n              // retry only after paid mode is restored; never call the provider\n              // or append a batch that the live policy would not debit.\n              if (frozenPolicy.mode === \"credits\" && !paidDocumentEmbedding(settings)) {\n                await deferKnowledgeIndexJob(lockedDb, claim);\n                result.deferred++;\n                return;\n              }\n              const paid = frozenPolicy.mode === \"credits\";\n              if (paid && claim.billingAttribution.kind === \"unknown\") {\n                // Unknown legacy/source-preparation causality is not service.\n                // Keep the checkpoint without making an uncountable paid call.\n                observability.warn(\"Paid Knowledge indexing awaits initiating attribution\", {\n                  errorCode: \"knowledge_index_attribution_unavailable\",\n                });\n                await deferKnowledgeIndexJob(lockedDb, claim);\n                result.deferred++;\n                return;\n              }\n              // A workspace that turned Opengeni credits off is never debited.\n              // Wait like an unfunded generation (no provider call, checkpoint\n              // kept); the job re-checks each minute and resumes once credits\n              // are turned back on.\n              if (paid && (await workspaceCreditsDisabled(lockedDb, current.billingWorkspaceId))) {\n                await waitKnowledgeIndexForFunding(lockedDb, claim);\n                result.deferred++;\n                return;\n              }\n              if (paid && current.nextIndex === 0) {\n                const balance = await getSpendableCreditBalance(lockedDb, claim.accountId);\n                if (balance.balanceMicros <= 0) {\n                  await waitKnowledgeIndexForFunding(lockedDb, claim);\n                  result.deferred++;\n                  return;\n                }\n              }\n              if (paid) {\n                const refusal = await checkWorkspaceAllowance(lockedDb, {\n                  accountId: claim.accountId,\n                  workspaceId: current.billingWorkspaceId,\n                  subjectId:\n                    claim.billingAttribution.kind === \"turn\" ||\n                    claim.billingAttribution.kind === \"human\"\n                      ? claim.billingAttribution.initiatingHumanSubjectId\n                      : null,\n                });\n                if (refusal) {\n                  await deferKnowledgeIndexJob(lockedDb, claim);\n                  result.deferred++;\n                  return;\n                }\n              }\n              if (settings.usageLimitsMode === \"static\" || settings.usageLimitsMode === \"managed\") {\n                const limit =\n                  configuredStaticUsageLimits(settings).maxDocumentIndexedChunksPerWorkspace;\n                if (limit) {\n                  const now = new Date();\n                  const used = await sumUsageQuantity(lockedDb, {\n                    workspaceId: current.billingWorkspaceId,\n                    eventType: \"document.indexed\",\n                    since: new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1)),\n                  });\n                  if (used + chunks.length > limit) throw new KnowledgeIndexUsageLimitError();\n                }\n              }\n              const inputs = chunks.map((chunk) => chunk.embeddingInput);\n              const bytes = inputs.reduce(\n                (sum, input) => sum + Buffer.byteLength(input, \"utf8\"),\n                0,\n              );\n              stage = \"embedding\";\n              const vectors = await embedder.embedMany(inputs);\n              if (vectors.length !== chunks.length)\n                throw new Error(\"Incomplete Knowledge embeddings\");\n              stage = \"processing\";\n              // A reviewer may have rejected this revision during the provider\n              // call. The DB guard holds its publication row through settlement.\n              if (paid) {\n                const publication = await guardPaidKnowledgeIndexPublication(lockedDb, claim);\n                if (publication !== \"published\") {\n                  if (publication === \"obsolete\") result.unavailable++;\n                  else result.deferred++;\n                  return;\n                }\n              }\n              const appended = await appendKnowledgeIndexChunks(\n                lockedDb,\n                claim,\n                current.nextIndex,\n                chunks.map((chunk, index) => ({ ...chunk, embedding: vectors[index]! })),\n              );\n              if (appended.status !== \"running\") {\n                result.unavailable++;\n                return;\n              }\n              await recordUsageEvent(lockedDb, {\n                accountId: claim.accountId,\n                workspaceId: current.billingWorkspaceId,\n                eventType: \"document.indexed\",\n                quantity: chunks.length,\n                unit: \"chunk\",\n                sourceResourceType: \"knowledge_revision\",\n                sourceResourceId: claim.revisionId,\n                idempotencyKey: `knowledge.indexed:${claim.revisionId}:${claim.generation}:${current.nextIndex}`,\n              });\n              await recordUsageEvent(lockedDb, {\n                accountId: claim.accountId,\n                workspaceId: current.billingWorkspaceId,\n                eventType: \"document.embedding_bytes\",\n                quantity: bytes,\n                unit: \"byte\",\n                sourceResourceType: \"knowledge_revision\",\n                sourceResourceId: claim.revisionId,\n                idempotencyKey: `knowledge.embedding_bytes:${claim.revisionId}:${claim.generation}:${current.nextIndex}`,\n              });\n              if (frozenPolicy.mode === \"shadow\" && frozenPolicy.rateMicrosPerMillionBytes > 0) {\n                const estimate = documentEmbeddingCostMicros(\n                  {\n                    ...settings,\n                    documentEmbeddingRateMicrosPerMillionBytes:\n                      frozenPolicy.rateMicrosPerMillionBytes,\n                  },\n                  bytes,\n                );\n                if (estimate > 0)\n                  await recordUsageEvent(lockedDb, {\n                    accountId: claim.accountId,\n                    workspaceId: current.billingWorkspaceId,\n                    eventType: \"document.embedding_shadow_estimate\",\n                    quantity: estimate,\n                    unit: \"micro_usd\",\n                    sourceResourceType: \"knowledge_revision\",\n                    sourceResourceId: claim.revisionId,\n                    idempotencyKey: `knowledge.embedding_shadow:${claim.revisionId}:${claim.generation}:${current.nextIndex}`,\n                  });\n              }\n              if (paid) {\n                const cost = documentEmbeddingCostMicros(\n                  {\n                    ...settings,\n                    documentEmbeddingRateMicrosPerMillionBytes:\n                      frozenPolicy.rateMicrosPerMillionBytes,\n                  },\n                  bytes,\n                );\n                if (cost > 0)\n                  await applyCreditDebitAfterUse(lockedDb, {\n                    accountId: claim.accountId,\n                    workspaceId: current.billingWorkspaceId,\n                    type: \"document_embedding_debit\",\n                    amountMicros: cost,\n                    sourceType: \"knowledge_revision\",\n                    sourceId: claim.revisionId,\n                    idempotencyKey: `knowledge.embedding:${claim.revisionId}:${claim.generation}:${current.nextIndex}`,\n                    metadata: {\n                      ...creditDebitAttributionMetadata(claim.billingAttribution),\n                      model: claim.model,\n                      bytes,\n                      chunks: chunks.length,\n                      rateMicrosPerMillionBytes: frozenPolicy.rateMicrosPerMillionBytes,\n                    },\n                  });\n              }\n            }\n            if (more) {\n              await continueKnowledgeIndexJob(lockedDb, claim);\n              result.advanced++;\n            } else {\n              const completed = await completeKnowledgeIndexJob(\n                lockedDb,\n                claim,\n                current.nextIndex + chunks.length,\n              );\n              if (completed.status === \"ready\") result.completed++;\n              else result.unavailable++;\n            }\n          });\n        } catch (error) {\n          // Provider failures retain the last completed projection. The durable\n          // queue owns retry/backoff; do not retry an entire activity implicitly.\n          // The stored reason stays the SQL lifecycle's fixed code; the log\n          // carries the content-free class/code of the actual cause.\n          observability.warn(\n            \"Knowledge indexing batch deferred\",\n            knowledgeIndexFailureDiagnostic(stage, error),\n          );\n          await deferKnowledgeIndexJob(db, claim).catch((deferError: unknown) => {\n            const deferDiagnostic = knowledgeIndexFailureDiagnostic(\"processing\", deferError);\n            observability.warn(\"Knowledge indexing batch deferral failed\", {\n              ...deferDiagnostic,\n              errorCode: \"knowledge_index_defer_failed\",\n            });\n          });\n          result.deferred++;\n        }\n      }\n      return result;\n    },\n  };\n}\n","import {\n  getSubscriptionCoreCapacityWaitForSession,\n  subscriptionCoreCapacityWaitRef,\n} from \"@opengeni/db\";\n\nimport { reconcileCoreCapacityWait } from \"./subscription-core-codex-waits\";\nimport { subscriptionCoreWaitBindings } from \"./subscription-core-wait-bindings\";\n\nimport type {\n  ControlActivityServices,\n  GetCodexCapacityWaitInput,\n  ReconcileCodexCapacityWaitInput,\n  ReconcileCodexCapacityWaitResult,\n} from \"./types\";\n\nexport function createCodexCapacityActivities(services: () => Promise<ControlActivityServices>) {\n  async function getCodexCapacityWait(input: GetCodexCapacityWaitInput) {\n    const { db } = await services();\n    // A core waiter (shared subscription core) is the only waiter written\n    // after its provider's cutover. A Codex one keeps the legacy Codex\n    // reference shape; a SuperGrok one carries `provider: \"xai\"` and a\n    // Claude one `provider: \"claude\"`, so their reconcile also looks the core\n    // up first.\n    const coreWaiter = await getSubscriptionCoreCapacityWaitForSession(\n      db,\n      input.workspaceId,\n      input.sessionId,\n    );\n    if (coreWaiter) return subscriptionCoreCapacityWaitRef(coreWaiter);\n    return null;\n  }\n\n  async function reconcileCodexCapacityWait(\n    input: ReconcileCodexCapacityWaitInput,\n  ): Promise<ReconcileCodexCapacityWaitResult> {\n    const resolved = await services();\n    // Histories without a provider keep the original Codex binding. Migrated\n    // waiters retain their ids/generations; lookup never infers new authority.\n    const binding = subscriptionCoreWaitBindings().find(\n      (candidate) => candidate.provider === (input.provider ?? \"codex\"),\n    );\n    if (!binding) return { action: \"stale\" };\n    const core = await reconcileCoreCapacityWait(resolved, binding, {\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      sessionId: input.sessionId,\n      waiterId: input.waiterId,\n      generation: input.generation,\n    });\n    return core ?? { action: \"stale\" };\n  }\n\n  return { getCodexCapacityWait, reconcileCodexCapacityWait };\n}\n","import {\n  claimBrowserStateArtifactCleanup,\n  claimBrowserStateUploadCleanup,\n  completeBrowserStateArtifactCleanup,\n  completeBrowserStateUploadCleanup,\n  type BrowserStateArtifactCleanupClaim,\n  type BrowserStateUploadCleanupClaim,\n} from \"@opengeni/db\";\nimport type { ObjectStorage } from \"@opengeni/storage\";\nimport type { ControlActivityServices } from \"./types\";\n\nexport const BROWSER_STATE_ARTIFACT_CLAIM_TIMEOUT_MS = 10 * 60 * 1_000;\nexport const BROWSER_STATE_ARTIFACT_CLEANUP_BATCH_SIZE = 100;\n\nconst SAFE_PROVIDER_ERROR_CODES = new Set([\n  \"aborted\",\n  \"conflict\",\n  \"network\",\n  \"not_found\",\n  \"permission_denied\",\n  \"provider\",\n  \"timeout\",\n  \"unavailable\",\n]);\n\nexport type MaintainBrowserStateArtifactsResult = {\n  claimed: number;\n  deleted: number;\n  retryable: number;\n};\n\nexport type BrowserStateArtifactMaintenanceOptions = {\n  claimTimeoutMs?: number;\n  batchSize?: number;\n  claimArtifacts?: typeof claimBrowserStateArtifactCleanup;\n  completeArtifact?: typeof completeBrowserStateArtifactCleanup;\n  claimUploads?: typeof claimBrowserStateUploadCleanup;\n  completeUpload?: typeof completeBrowserStateUploadCleanup;\n  /** Failure-injection seam; production uses the configured provider delete. */\n  deleteObject?: (storage: ObjectStorage, key: string) => Promise<void>;\n};\n\n/**\n * Reap retired encrypted private browser checkpoints. Provider deletion happens\n * before terminal settlement; a crash or provider failure leaves the durable\n * claim reclaimable and an already-deleted provider key is safe to retry.\n */\nexport function createBrowserStateArtifactMaintenanceActivities(\n  services: () => Promise<ControlActivityServices>,\n  options: BrowserStateArtifactMaintenanceOptions = {},\n) {\n  const claimTimeoutMs = options.claimTimeoutMs ?? BROWSER_STATE_ARTIFACT_CLAIM_TIMEOUT_MS;\n  const batchSize = options.batchSize ?? BROWSER_STATE_ARTIFACT_CLEANUP_BATCH_SIZE;\n  const claimArtifacts = options.claimArtifacts ?? claimBrowserStateArtifactCleanup;\n  const completeArtifact = options.completeArtifact ?? completeBrowserStateArtifactCleanup;\n  const claimUploads = options.claimUploads ?? claimBrowserStateUploadCleanup;\n  const completeUpload = options.completeUpload ?? completeBrowserStateUploadCleanup;\n  const deleteObject = options.deleteObject ?? ((storage, key) => storage.deleteObject(key));\n\n  async function maintainBrowserStateArtifacts(): Promise<MaintainBrowserStateArtifactsResult> {\n    const { db, objectStorage, observability } = await services();\n    if (!objectStorage) return { claimed: 0, deleted: 0, retryable: 0 };\n\n    const [artifactClaims, uploadClaims] = await Promise.all([\n      claimArtifacts(db, { claimTimeoutMs, limit: batchSize }),\n      claimUploads(db, { claimTimeoutMs, limit: batchSize }),\n    ]);\n    const result: MaintainBrowserStateArtifactsResult = {\n      claimed: artifactClaims.length + uploadClaims.length,\n      deleted: 0,\n      retryable: 0,\n    };\n    for (const cleanup of artifactClaims) {\n      try {\n        await deleteObject(objectStorage, cleanup.objectKey);\n        if (!(await completeArtifact(db, cleanup))) {\n          throw new Error(\"browser state artifact cleanup claim was superseded\");\n        }\n        result.deleted += 1;\n      } catch (error) {\n        result.retryable += 1;\n        observability.warn(\"browser state artifact cleanup failed; claim remains reclaimable\", {\n          workspaceId: cleanup.workspaceId,\n          artifactId: cleanup.artifactId,\n          errorCategory: cleanupErrorCategory(error),\n        });\n      }\n    }\n    for (const cleanup of uploadClaims) {\n      try {\n        await deleteObject(objectStorage, cleanup.objectKey);\n        if (!(await completeUpload(db, cleanup))) {\n          throw new Error(\"browser state upload cleanup claim was superseded\");\n        }\n        result.deleted += 1;\n      } catch (error) {\n        result.retryable += 1;\n        observability.warn(\"browser state upload cleanup failed; claim remains reclaimable\", {\n          workspaceId: cleanup.workspaceId,\n          uploadId: cleanup.uploadId,\n          errorCategory: cleanupErrorCategory(error),\n        });\n      }\n    }\n    if (result.claimed > 0) {\n      observability.info(\"browser state artifact maintenance swept\", result);\n    }\n    return result;\n  }\n\n  return { maintainBrowserStateArtifacts };\n}\n\nfunction cleanupErrorCategory(error: unknown): string {\n  if (!error || typeof error !== \"object\") return \"unknown\";\n  const code = (error as { code?: unknown }).code;\n  return typeof code === \"string\" && SAFE_PROVIDER_ERROR_CODES.has(code) ? code : \"unknown\";\n}\n\nexport type { BrowserStateArtifactCleanupClaim, BrowserStateUploadCleanupClaim };\n","import {\n  resolveTurnExecutionPolicyV1,\n  WORKSPACE_GATEWAY_MODEL_ID_PREFIX,\n  WORKSPACE_OPENROUTER_MODEL_ID_PREFIX,\n  WORKSPACE_OPPER_MODEL_ID_PREFIX,\n} from \"@opengeni/config\";\nimport {\n  applySessionAgentConfigWriteThrough,\n  assertWorkspaceModelPolicyAllows,\n  canonicalConfiguredModel,\n  resolveSessionAgentConfigForCreate,\n  createAndStartSessionWithOutcome,\n  recordWorkspaceUsage,\n  resolveCatalogSettings,\n  resolveWorkspaceCatalogSettings,\n  isDeveloperSetupDelegatedPermissionAllowed,\n} from \"@opengeni/core\";\nimport {\n  AutomationAuthorityRevokedError,\n  assertAutomationRunAuthorityInTransaction,\n  claimAutomationRun,\n  settleAutomationRun,\n  requireWorkspace,\n} from \"@opengeni/db\";\nimport { SessionSkills } from \"@opengeni/contracts\";\nimport { agentRunAdmissionDenial } from \"./agent-run-admission\";\nimport type {\n  ControlActivityServices,\n  DispatchAutomationRunInput,\n  DispatchAutomationRunResult,\n} from \"./types\";\n\nexport type AutomationActivityOptions = {\n  claim?: typeof claimAutomationRun;\n  settle?: typeof settleAutomationRun;\n  assertAuthority?: typeof assertAutomationRunAuthorityInTransaction;\n  createSession?: typeof createAndStartSessionWithOutcome;\n  /** Workspace read for agent-configuration defaults (tests inject it). */\n  readWorkspace?: typeof requireWorkspace;\n  admit?: typeof agentRunAdmissionDenial;\n  assertModelPolicy?: typeof assertWorkspaceModelPolicyAllows;\n  recordUsage?: typeof recordWorkspaceUsage;\n};\n\nexport function createAutomationActivities(\n  services: () => Promise<ControlActivityServices>,\n  options: AutomationActivityOptions = {},\n) {\n  const claim = options.claim ?? claimAutomationRun;\n  const settle = options.settle ?? settleAutomationRun;\n  const assertAuthority = options.assertAuthority ?? assertAutomationRunAuthorityInTransaction;\n  const createSession = options.createSession ?? createAndStartSessionWithOutcome;\n  const readWorkspace = options.readWorkspace ?? requireWorkspace;\n  const admit = options.admit ?? agentRunAdmissionDenial;\n  const assertModelPolicy = options.assertModelPolicy ?? assertWorkspaceModelPolicyAllows;\n  const recordUsage = options.recordUsage ?? recordWorkspaceUsage;\n  return {\n    settleAutomationRunFailure: async (input: DispatchAutomationRunInput): Promise<void> => {\n      const service = await services();\n      await settle(service.db, {\n        workspaceId: input.workspaceId,\n        runId: input.runId,\n        status: \"failed\",\n        errorCode: \"dispatch_failed\",\n      });\n    },\n    dispatchAutomationRun: async (\n      input: DispatchAutomationRunInput,\n    ): Promise<DispatchAutomationRunResult> => {\n      const service = await services();\n      const catalogSourceSettings = service.catalogSourceSettings ?? service.settings;\n      const deploymentCatalogSettings = (\n        await resolveCatalogSettings(service.db, catalogSourceSettings)\n      ).settings;\n      const run = await claim(service.db, input);\n      if (!run) return { action: \"not_found\" };\n      if (run.status === \"dispatched\") {\n        if (!run.sessionId) throw new Error(\"dispatched automation run is missing its session\");\n        return { action: \"already_dispatched\", sessionId: run.sessionId };\n      }\n      if (run.status === \"skipped\") {\n        return {\n          action: \"skipped\",\n          reason: run.errorCode ?? \"authority_revoked\",\n        };\n      }\n      if (run.status === \"failed\") {\n        return { action: \"failed\", reason: run.errorCode ?? \"dispatch_failed\" };\n      }\n\n      try {\n        const accepted = run.acceptedExecution;\n        if (\n          accepted.accountId !== input.accountId ||\n          accepted.workspaceId !== input.workspaceId ||\n          accepted.sourceId !== run.sourceId ||\n          accepted.triggerId !== run.triggerId ||\n          accepted.triggerRevision !== run.triggerRevision ||\n          accepted.eventId !== run.eventId\n        ) {\n          await settle(service.db, {\n            workspaceId: input.workspaceId,\n            runId: run.id,\n            status: \"skipped\",\n            errorCode: \"accepted_execution_mismatch\",\n          });\n          return { action: \"skipped\", reason: \"accepted_execution_mismatch\" };\n        }\n\n        const template = accepted.sessionTemplate;\n        if (\n          template.credentialRestriction === \"developer_setup\" &&\n          template.firstPartyMcpPermissions.some(\n            (permission) => !isDeveloperSetupDelegatedPermissionAllowed(permission),\n          )\n        ) {\n          await settle(service.db, {\n            workspaceId: input.workspaceId,\n            runId: run.id,\n            status: \"failed\",\n            errorCode: \"credential_restriction_violation\",\n          });\n          return { action: \"failed\", reason: \"credential_restriction_violation\" };\n        }\n        const requestedModel = template.model ?? deploymentCatalogSettings.openaiModel;\n        const catalogSettings =\n          requestedModel.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX) ||\n          requestedModel.startsWith(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX) ||\n          requestedModel.startsWith(WORKSPACE_OPPER_MODEL_ID_PREFIX)\n            ? (\n                await resolveWorkspaceCatalogSettings(service.db, catalogSourceSettings, {\n                  accountId: input.accountId,\n                  workspaceId: input.workspaceId,\n                  retainedProductModelId: requestedModel,\n                })\n              ).settings\n            : deploymentCatalogSettings;\n        const catalogService = { ...service, settings: catalogSettings };\n        let model: string;\n        try {\n          const configuredModel = canonicalConfiguredModel(catalogSettings, requestedModel);\n          if (!configuredModel) throw new Error(\"automation has no configured model\");\n          await assertModelPolicy(service.db, catalogSettings, input.workspaceId, configuredModel);\n          model = configuredModel;\n        } catch (error) {\n          if (!isUnprocessableEntity(error)) throw error;\n          await settle(service.db, {\n            workspaceId: input.workspaceId,\n            runId: run.id,\n            status: \"failed\",\n            errorCode: \"dispatch_failed\",\n          });\n          return { action: \"failed\", reason: \"dispatch_failed\" };\n        }\n        const denial = await admit(catalogService, {\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          model,\n          requestedAgentRuns: 1,\n        });\n        if (denial) {\n          await settle(service.db, {\n            workspaceId: input.workspaceId,\n            runId: run.id,\n            status: \"failed\",\n            errorCode: denial,\n          });\n          return { action: \"failed\", reason: denial };\n        }\n        const reasoningEffort = template.reasoningEffort ?? catalogSettings.openaiReasoningEffort;\n        const sandboxBackend = template.sandboxBackend ?? catalogSettings.sandboxBackend;\n        if (sandboxBackend === \"selfhosted\") {\n          await settle(service.db, {\n            workspaceId: input.workspaceId,\n            runId: run.id,\n            status: \"skipped\",\n            errorCode: \"interactive_compute_not_allowed\",\n          });\n          return {\n            action: \"skipped\",\n            reason: \"interactive_compute_not_allowed\",\n          };\n        }\n        // Agent configuration for the generated session (null = legacy). The\n        // template's explicit tools are its baseline; capabilities only narrow.\n        let agentWriteThrough: {\n          config: import(\"@opengeni/contracts\").ResolvedAgentConfig | null;\n          instructions: string | undefined;\n          firstPartyMcpTools: typeof template.firstPartyMcpTools;\n          tools: typeof template.tools;\n        };\n        try {\n          const workspaceSettings = (await readWorkspace(service.db, input.workspaceId)).settings;\n          const resolution = resolveSessionAgentConfigForCreate({\n            settings: catalogSettings,\n            creator: \"automation\",\n            request: template.agent,\n            instructions: template.instructions ?? undefined,\n            workspaceSettings,\n            parent: null,\n            goal: false,\n          });\n          const written = applySessionAgentConfigWriteThrough({\n            config: resolution.config,\n            firstPartyMcpTools: template.firstPartyMcpTools,\n            tools: template.tools,\n            toolPolicy: { mode: \"explicit\", inheritedFromSessionId: null },\n            productServerIds: template.tools.map((tool) => tool.id),\n          });\n          agentWriteThrough = {\n            config: resolution.config,\n            instructions: resolution.instructions,\n            firstPartyMcpTools: written.firstPartyMcpTools,\n            tools: written.tools,\n          };\n        } catch (error) {\n          if (!isUnprocessableEntity(error)) throw error;\n          await settle(service.db, {\n            workspaceId: input.workspaceId,\n            runId: run.id,\n            status: \"failed\",\n            errorCode: \"dispatch_failed\",\n          });\n          return { action: \"failed\", reason: \"dispatch_failed\" };\n        }\n        const resolvedTurnExecutionPolicy = resolveTurnExecutionPolicyV1(catalogSettings, {\n          modelId: model,\n          requestedModelId: template.model,\n          modelSource: template.model ? \"explicit\" : \"deployment\",\n          reasoningEffort,\n          reasoningSource: template.reasoningEffort ? \"explicit\" : \"deployment\",\n          latencyMode: \"standard\",\n          latencyModeSource: \"deployment\",\n        });\n        const turnExecutionPolicy = template.credentialRestriction\n          ? {\n              ...resolvedTurnExecutionPolicy,\n              credentialRestriction: template.credentialRestriction,\n            }\n          : resolvedTurnExecutionPolicy;\n        const created = await createSession({\n          db: service.db,\n          bus: service.bus,\n          workflowClient: {\n            wakeSessionWorkflow: async (wake) => {\n              await service.wakeSessionWorkflow?.(wake);\n            },\n          },\n          beforeCreateCommit: async (tx, sessionId) => {\n            await assertAuthority(tx, {\n              workspaceId: input.workspaceId,\n              runId: run.id,\n              triggerId: accepted.triggerId,\n              triggerRevision: accepted.triggerRevision,\n              sourceId: accepted.sourceId,\n              sourceVersion: accepted.sourceVersion,\n              sessionId,\n            });\n          },\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          initialMessage: accepted.initialMessage,\n          surface: \"automation\",\n          metrics: service.observability,\n          resources: template.resources,\n          skills: SessionSkills.parse(template.skills),\n          bundledSkillIds: template.bundledSkillIds,\n          tools: agentWriteThrough.tools,\n          toolPolicy: { mode: \"explicit\", inheritedFromSessionId: null },\n          model,\n          reasoningEffort,\n          turnExecutionPolicy,\n          sandboxBackend,\n          metadata: {\n            ...template.metadata,\n            automationRunId: run.id,\n            automationSourceId: run.sourceId,\n            automationTriggerId: run.triggerId,\n            automationTriggerRevision: run.triggerRevision,\n          },\n          createdBy: {\n            kind: \"service\",\n            subjectId: accepted.serviceSubjectId,\n            label: accepted.serviceLabel,\n          },\n          createdByContext: accepted.provenance,\n          instructions: agentWriteThrough.instructions ?? template.instructions,\n          policyRole: template.policyRole,\n          firstPartyMcpPermissions: template.firstPartyMcpPermissions,\n          firstPartyMcpTools: agentWriteThrough.firstPartyMcpTools,\n          ...(agentWriteThrough.config ? { agentConfig: agentWriteThrough.config } : {}),\n          retainWorkspaceCustomModel:\n            model.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX) ||\n            model.startsWith(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX) ||\n            model.startsWith(WORKSPACE_OPPER_MODEL_ID_PREFIX),\n          createIdempotencyKey: `automation-run:${run.id}`,\n          subjectId: accepted.serviceSubjectId,\n        });\n        await recordUsage(\n          { db: service.db, settings: catalogSettings },\n          {\n            accountId: input.accountId,\n            workspaceId: input.workspaceId,\n            subjectId: accepted.serviceSubjectId,\n            eventType: \"agent_run.created\",\n            quantity: 1,\n            unit: \"run\",\n            sourceResourceType: \"automation_run\",\n            sourceResourceId: run.id,\n            sessionId: created.session.id,\n            initiator: created.session.createdBy,\n            initiatorContext: created.session.createdByContext,\n            origin: \"system\",\n            idempotencyKey: `agent_run.created:automation:${run.id}`,\n          },\n        ).catch((error) => {\n          service.observability.warn(\"automation usage recording failed\", {\n            workspaceId: input.workspaceId,\n            runId: run.id,\n            errorCategory: error instanceof Error ? error.name : \"unknown\",\n          });\n        });\n        return { action: \"started\", sessionId: created.session.id };\n      } catch (error) {\n        if (error instanceof AutomationAuthorityRevokedError) {\n          await settle(service.db, {\n            workspaceId: input.workspaceId,\n            runId: run.id,\n            status: \"skipped\",\n            errorCode: \"authority_revoked\",\n          });\n          return { action: \"skipped\", reason: \"authority_revoked\" };\n        }\n        throw error;\n      }\n    },\n  };\n}\n\nfunction isUnprocessableEntity(error: unknown): boolean {\n  return (\n    error instanceof Error &&\n    \"status\" in error &&\n    (error as Error & { status?: unknown }).status === 422\n  );\n}\n","import {\n  claimDueTranscriptionRecordingObjectCleanup,\n  claimExpiredFileUploadCleanup,\n  completeDueTranscriptionRecordingObjectCleanup,\n  completeExpiredFileUploadCleanup,\n  claimVideoGenerationOperations,\n  purgeExpiredTranscriptionRecordings,\n} from \"@opengeni/db\";\nimport type { ObjectStorage } from \"@opengeni/storage\";\nimport type { ControlActivityServices } from \"./types\";\nimport { randomUUID } from \"node:crypto\";\n\nexport const FILE_UPLOAD_CLEANUP_GRACE_MS = 60 * 60 * 1_000;\nexport const FILE_UPLOAD_CLEANUP_CLAIM_TIMEOUT_MS = 10 * 60 * 1_000;\nexport const FILE_UPLOAD_CLEANUP_BATCH_SIZE = 100;\nconst SAFE_CLEANUP_ERROR_CATEGORIES = new Set([\n  \"aborted\",\n  \"conflict\",\n  \"invalid_response\",\n  \"network\",\n  \"not_found\",\n  \"permission_denied\",\n  \"provider\",\n  \"timeout\",\n  \"unavailable\",\n]);\n\nfunction cleanupErrorAttributes(error: unknown): {\n  errorCategory: string;\n  errorStatus?: number;\n} {\n  let errorCategory = \"provider_error\";\n  let errorStatus: number | undefined;\n  if (error && typeof error === \"object\") {\n    const rawCode = (error as { code?: unknown }).code;\n    if (typeof rawCode === \"string\" && SAFE_CLEANUP_ERROR_CATEGORIES.has(rawCode)) {\n      errorCategory = rawCode;\n    } else if (rawCode !== undefined) {\n      errorCategory = \"unknown\";\n    }\n    const rawStatus = Number(\n      (error as { status?: unknown; statusCode?: unknown }).status ??\n        (error as { statusCode?: unknown }).statusCode,\n    );\n    if (Number.isInteger(rawStatus) && rawStatus >= 100 && rawStatus <= 599) {\n      errorStatus = rawStatus;\n    }\n  }\n  return { errorCategory, ...(errorStatus === undefined ? {} : { errorStatus }) };\n}\n\nexport type ReapExpiredFileUploadsResult = {\n  claimed: number;\n  deleted: number;\n  failed: number;\n};\n\nexport type FileUploadReaperActivityOptions = {\n  graceMs?: number;\n  claimTimeoutMs?: number;\n  batchSize?: number;\n  /** Failure-injection seam; production uses the configured provider delete. */\n  deleteObject?: (storage: ObjectStorage, key: string) => Promise<void>;\n  claimFileUploads?: typeof claimExpiredFileUploadCleanup;\n  completeFileUpload?: typeof completeExpiredFileUploadCleanup;\n  claimTranscriptionObjects?: typeof claimDueTranscriptionRecordingObjectCleanup;\n  completeTranscriptionObject?: typeof completeDueTranscriptionRecordingObjectCleanup;\n  purgeTranscriptionRecordings?: typeof purgeExpiredTranscriptionRecordings;\n};\n\n/**\n * Build the provider-neutral expired direct-upload reaper. Claims are durable\n * and reclaimable; object deletion is idempotent; only a successful delete is\n * settled terminally. One provider failure never aborts the rest of the batch.\n */\nexport function createFileUploadReaperActivities(\n  services: () => Promise<ControlActivityServices>,\n  options: FileUploadReaperActivityOptions = {},\n) {\n  const graceMs = options.graceMs ?? FILE_UPLOAD_CLEANUP_GRACE_MS;\n  const claimTimeoutMs = options.claimTimeoutMs ?? FILE_UPLOAD_CLEANUP_CLAIM_TIMEOUT_MS;\n  const batchSize = options.batchSize ?? FILE_UPLOAD_CLEANUP_BATCH_SIZE;\n  const deleteObject = options.deleteObject ?? (async (storage, key) => storage.deleteObject(key));\n  const claimFileUploads = options.claimFileUploads ?? claimExpiredFileUploadCleanup;\n  const completeFileUpload = options.completeFileUpload ?? completeExpiredFileUploadCleanup;\n  const claimTranscriptionObjects =\n    options.claimTranscriptionObjects ?? claimDueTranscriptionRecordingObjectCleanup;\n  const completeTranscriptionObject =\n    options.completeTranscriptionObject ?? completeDueTranscriptionRecordingObjectCleanup;\n  const purgeTranscriptionRecordings =\n    options.purgeTranscriptionRecordings ?? purgeExpiredTranscriptionRecordings;\n\n  async function reapExpiredFileUploads(): Promise<ReapExpiredFileUploadsResult> {\n    const { db, objectStorage, observability } = await services();\n    if (!objectStorage) {\n      try {\n        await purgeTranscriptionRecordings(db, { graceMs, limit: batchSize });\n      } catch (error) {\n        observability.warn(\"expired transcription recording metadata purge failed\", {\n          ...cleanupErrorAttributes(error),\n        });\n      }\n      return { claimed: 0, deleted: 0, failed: 0 };\n    }\n\n    const claims = await claimFileUploads(db, {\n      graceMs,\n      claimTimeoutMs,\n      limit: batchSize,\n    });\n    let deleted = 0;\n    let failed = 0;\n    for (const claim of claims) {\n      try {\n        await deleteObject(objectStorage, claim.objectKey);\n        const settled = await completeFileUpload(db, claim);\n        if (!settled) {\n          throw new Error(\"cleanup claim no longer owns a reclaimable upload\");\n        }\n        deleted += 1;\n      } catch (error) {\n        failed += 1;\n        observability.warn(\"expired file upload cleanup failed; claim remains reclaimable\", {\n          workspaceId: claim.workspaceId,\n          uploadId: claim.uploadId,\n          fileId: claim.fileId,\n          ...cleanupErrorAttributes(error),\n        });\n      }\n    }\n    const recordingClaims = await claimTranscriptionObjects(db, {\n      graceMs,\n      claimTimeoutMs,\n      limit: batchSize,\n    });\n    for (const claim of recordingClaims) {\n      try {\n        await deleteObject(objectStorage, claim.objectKey);\n        const settled = await completeTranscriptionObject(db, claim);\n        if (!settled) {\n          throw new Error(\"cleanup claim no longer owns a transcription recording object\");\n        }\n        deleted += 1;\n      } catch (error) {\n        failed += 1;\n        observability.warn(\n          \"expired transcription recording object cleanup failed; claim remains reclaimable\",\n          {\n            workspaceId: claim.workspaceId,\n            recordingId: claim.recordingId,\n            ...cleanupErrorAttributes(error),\n          },\n        );\n      }\n    }\n    let transcriptionRecordingsPurged = 0;\n    try {\n      transcriptionRecordingsPurged = await purgeTranscriptionRecordings(db, {\n        graceMs,\n        limit: batchSize,\n      });\n    } catch (error) {\n      observability.warn(\"expired transcription recording metadata purge failed\", {\n        ...cleanupErrorAttributes(error),\n      });\n    }\n    const claimed = claims.length + recordingClaims.length;\n    if (claimed > 0 || transcriptionRecordingsPurged > 0) {\n      observability.info(\"expired file upload cleanup swept\", {\n        claimed,\n        deleted,\n        failed,\n        fileUploads: claims.length,\n        transcriptionRecordingObjects: recordingClaims.length,\n        transcriptionRecordingsPurged,\n      });\n    }\n    return { claimed, deleted, failed };\n  }\n\n  async function recoverVideoGenerationWorkflows(): Promise<{\n    claimed: number;\n    started: number;\n    failed: number;\n  }> {\n    const { db, startVideoGenerationWorkflow, observability } = await services();\n    if (!startVideoGenerationWorkflow) return { claimed: 0, started: 0, failed: 0 };\n    const claims = await claimVideoGenerationOperations(db, {\n      owner: `video-workflow-recovery:${randomUUID()}`,\n      leaseSeconds: 120,\n      limit: 100,\n    });\n    let started = 0;\n    let failed = 0;\n    for (const claim of claims) {\n      try {\n        await startVideoGenerationWorkflow(claim);\n        started += 1;\n      } catch (error) {\n        failed += 1;\n        observability.warn(\"Video generation workflow recovery start failed\", {\n          operationId: claim.operationId,\n          errorClass: error instanceof Error ? error.name : \"UnknownError\",\n        });\n      }\n    }\n    return { claimed: claims.length, started, failed };\n  }\n\n  return { reapExpiredFileUploads, recoverVideoGenerationWorkflows };\n}\n","import { randomUUID } from \"node:crypto\";\nimport { listWorkspaceIdsAfter, reconcileModelCallFacts } from \"@opengeni/db\";\nimport type { ControlActivityServices } from \"./types\";\n\n/** Recent charged calls are rechecked on every run; older gaps use the backfill script. */\nexport const MODEL_CALL_FACT_RECONCILE_LOOKBACK_MS = 2 * 60 * 60 * 1_000;\n/** Skip the newest calls so a live fact write is not raced by its own repair. */\nexport const MODEL_CALL_FACT_RECONCILE_SETTLE_MS = 10 * 60 * 1_000;\nexport const MODEL_CALL_FACT_RECONCILE_WORKSPACE_LIMIT = 500;\nexport const MODEL_CALL_FACT_RECONCILE_RUN_BUDGET_MS = 3 * 60 * 1_000;\nconst WORKSPACE_PAGE_SIZE = 200;\n\nexport type ReconcileRecentModelCallFactsResult = {\n  workspaces: number;\n  missing: number;\n  repaired: number;\n  unrepaired: number;\n  /** Workspaces with more missing facts than one bounded pass examines. */\n  truncatedWorkspaces: number;\n  failedWorkspaces: number;\n  budgetExhausted: boolean;\n};\n\nexport type ModelCallFactReconcilerOptions = {\n  now?: () => number;\n  runBudgetMs?: number;\n  startAfterWorkspaceId?: () => string;\n  reconcile?: typeof reconcileModelCallFacts;\n  listWorkspaces?: typeof listWorkspaceIdsAfter;\n};\n\n/**\n * Rebuild missing Insights call facts for recently charged model calls. Each\n * workspace pass is bounded and idempotent, one failure never stops the rest,\n * and each run starts at a random workspace so a run that exhausts its budget\n * does not starve the same tail of workspaces every time.\n */\nexport function createModelCallFactReconcilerActivities(\n  services: () => Promise<ControlActivityServices>,\n  options: ModelCallFactReconcilerOptions = {},\n) {\n  const now = options.now ?? Date.now;\n  const runBudgetMs = options.runBudgetMs ?? MODEL_CALL_FACT_RECONCILE_RUN_BUDGET_MS;\n  const startAfterWorkspaceId = options.startAfterWorkspaceId ?? randomUUID;\n  const reconcile = options.reconcile ?? reconcileModelCallFacts;\n  const listWorkspaces = options.listWorkspaces ?? listWorkspaceIdsAfter;\n\n  async function reconcileRecentModelCallFacts(): Promise<ReconcileRecentModelCallFactsResult> {\n    const { db, observability } = await services();\n    const startedAt = now();\n    const until = new Date(startedAt - MODEL_CALL_FACT_RECONCILE_SETTLE_MS);\n    const since = new Date(until.getTime() - MODEL_CALL_FACT_RECONCILE_LOOKBACK_MS);\n    const result: ReconcileRecentModelCallFactsResult = {\n      workspaces: 0,\n      missing: 0,\n      repaired: 0,\n      unrepaired: 0,\n      truncatedWorkspaces: 0,\n      failedWorkspaces: 0,\n      budgetExhausted: false,\n    };\n    const start = startAfterWorkspaceId();\n    let cursor: string | null = start;\n    let wrapped = false;\n    while (true) {\n      const page = await listWorkspaces(db, { afterId: cursor, limit: WORKSPACE_PAGE_SIZE });\n      const ids = wrapped ? page.filter((id) => id <= start) : page;\n      for (const workspaceId of ids) {\n        if (now() - startedAt >= runBudgetMs) {\n          result.budgetExhausted = true;\n          break;\n        }\n        result.workspaces += 1;\n        try {\n          const outcome = await reconcile(db, {\n            workspaceId,\n            since,\n            until,\n            limit: MODEL_CALL_FACT_RECONCILE_WORKSPACE_LIMIT,\n          });\n          result.missing += outcome.missing;\n          result.repaired += outcome.repaired;\n          result.unrepaired += outcome.unrepaired;\n          if (outcome.truncated) result.truncatedWorkspaces += 1;\n        } catch (error) {\n          result.failedWorkspaces += 1;\n          observability.warn(\"model call fact reconciliation failed for a workspace\", {\n            workspaceId,\n            errorName: error instanceof Error ? error.name : \"unknown\",\n          });\n        }\n      }\n      if (result.budgetExhausted) break;\n      if (wrapped && ids.length < page.length) break;\n      if (page.length < WORKSPACE_PAGE_SIZE) {\n        if (wrapped) break;\n        wrapped = true;\n        cursor = null;\n        continue;\n      }\n      cursor = page[page.length - 1]!;\n    }\n    if (result.failedWorkspaces > 0 || result.truncatedWorkspaces > 0 || result.budgetExhausted) {\n      observability.warn(\"model call fact reconciliation incomplete\", { ...result });\n    } else if (result.missing > 0) {\n      observability.info(\"model call fact reconciliation\", { ...result });\n    }\n    return result;\n  }\n\n  return { reconcileRecentModelCallFacts };\n}\n","import type { FileAsset } from \"@opengeni/contracts\";\nimport {\n  claimRetainedScreenshotMaintenance,\n  completeRetainedScreenshotMaintenance,\n  promoteRetainedScreenshotMaintenanceCleanup,\n  type RetainedScreenshotMaintenanceClaim,\n} from \"@opengeni/db\";\nimport { retryWhileMissing, type ObjectHead, type ObjectStorage } from \"@opengeni/storage\";\nimport type { ControlActivityServices } from \"./types\";\n\nexport const RETAINED_SCREENSHOT_PENDING_GRACE_MS = 15 * 60 * 1_000;\nexport const RETAINED_SCREENSHOT_CLAIM_TIMEOUT_MS = 10 * 60 * 1_000;\nexport const RETAINED_SCREENSHOT_MAINTENANCE_BATCH_SIZE = 100;\n\nexport type MaintainRetainedScreenshotsResult = {\n  claimed: number;\n  ready: number;\n  deleted: number;\n  failed: number;\n  retryable: number;\n};\n\nexport type RetainedScreenshotMaintenanceActivityOptions = {\n  pendingGraceMs?: number;\n  claimTimeoutMs?: number;\n  batchSize?: number;\n  /** Provider seams used by deterministic unit tests. */\n  fileExists?: (storage: ObjectStorage, file: FileAsset) => Promise<boolean>;\n  headFile?: (storage: ObjectStorage, file: FileAsset) => Promise<ObjectHead>;\n  deleteObject?: (storage: ObjectStorage, key: string) => Promise<void>;\n};\n\n/**\n * Reconcile interrupted screenshot writes and reap expired screenshot objects.\n * Claims move rows out of the readable `ready`/writable `pending` states before\n * provider access. Provider failures leave the durable claim reclaimable; DB\n * completion happens only after exact metadata verification or an idempotent\n * object delete.\n */\nexport function createRetainedScreenshotMaintenanceActivities(\n  services: () => Promise<ControlActivityServices>,\n  options: RetainedScreenshotMaintenanceActivityOptions = {},\n) {\n  const pendingGraceMs = options.pendingGraceMs ?? RETAINED_SCREENSHOT_PENDING_GRACE_MS;\n  const claimTimeoutMs = options.claimTimeoutMs ?? RETAINED_SCREENSHOT_CLAIM_TIMEOUT_MS;\n  const batchSize = options.batchSize ?? RETAINED_SCREENSHOT_MAINTENANCE_BATCH_SIZE;\n  const fileExists = options.fileExists ?? ((storage, file) => storage.fileExists(file));\n  const headFile = options.headFile ?? ((storage, file) => storage.headFile(file));\n  const deleteObject = options.deleteObject ?? ((storage, key) => storage.deleteObject(key));\n\n  async function maintainRetainedScreenshots(): Promise<MaintainRetainedScreenshotsResult> {\n    const { db, objectStorage, observability } = await services();\n    if (!objectStorage) {\n      return { claimed: 0, ready: 0, deleted: 0, failed: 0, retryable: 0 };\n    }\n\n    const claims = await claimRetainedScreenshotMaintenance(db, {\n      pendingGraceMs,\n      claimTimeoutMs,\n      limit: batchSize,\n    });\n    const result: MaintainRetainedScreenshotsResult = {\n      claimed: claims.length,\n      ready: 0,\n      deleted: 0,\n      failed: 0,\n      retryable: 0,\n    };\n\n    for (const claim of claims) {\n      try {\n        if (claim.action === \"reconcile\") {\n          const outcome = await reconcileClaim(db, objectStorage, claim, {\n            fileExists,\n            headFile,\n            deleteObject,\n          });\n          if (outcome === \"ready\") {\n            result.ready += 1;\n          } else {\n            result.failed += 1;\n          }\n          continue;\n        }\n\n        await deleteObject(objectStorage, claim.objectKey);\n        const outcome = terminalDeleteOutcome(claim.cleanupReason);\n        const settled = await completeRetainedScreenshotMaintenance(db, {\n          accountId: claim.accountId,\n          workspaceId: claim.workspaceId,\n          artifactId: claim.artifactId,\n          claimId: claim.claimId,\n          outcome,\n        });\n        if (!settled) throw new Error(\"retained screenshot cleanup claim was superseded\");\n        result.deleted += 1;\n      } catch (error) {\n        result.retryable += 1;\n        observability.warn(\"retained screenshot maintenance failed; claim remains reclaimable\", {\n          workspaceId: claim.workspaceId,\n          sessionId: claim.sessionId,\n          artifactId: claim.artifactId,\n          action: claim.action,\n          error: error instanceof Error ? error.message : String(error),\n        });\n      }\n    }\n\n    if (claims.length > 0) {\n      observability.info(\"retained screenshot maintenance swept\", result);\n    }\n    return result;\n  }\n\n  return { maintainRetainedScreenshots };\n}\n\nasync function reconcileClaim(\n  db: Parameters<typeof completeRetainedScreenshotMaintenance>[0],\n  storage: ObjectStorage,\n  claim: RetainedScreenshotMaintenanceClaim,\n  provider: Required<\n    Pick<RetainedScreenshotMaintenanceActivityOptions, \"fileExists\" | \"headFile\" | \"deleteObject\">\n  >,\n): Promise<\"ready\" | \"failed\"> {\n  const observation = await observeClaimObject(storage, claim, provider);\n  if (observation === \"matches\") {\n    const settled = await completeRetainedScreenshotMaintenance(db, {\n      accountId: claim.accountId,\n      workspaceId: claim.workspaceId,\n      artifactId: claim.artifactId,\n      claimId: claim.claimId,\n      outcome: \"ready\",\n    });\n    if (!settled) throw new Error(\"retained screenshot reconcile claim was superseded\");\n    return \"ready\";\n  }\n\n  // A mismatch/missing observation cannot authorize provider deletion while\n  // the artifact is still eligible for a concurrent ready settlement. Promote\n  // the exact claim first; a ready winner clears the claim and makes this stale.\n  const promoted = await promoteRetainedScreenshotMaintenanceCleanup(db, {\n    accountId: claim.accountId,\n    workspaceId: claim.workspaceId,\n    artifactId: claim.artifactId,\n    claimId: claim.claimId,\n    cleanupReason: \"failed\",\n  });\n  if (!promoted) throw new Error(\"retained screenshot reconcile claim was superseded\");\n\n  // Deletes are idempotent. Calling it for an authoritative missing observation\n  // also closes a race with a late writer that began before cleanup ownership.\n  await provider.deleteObject(storage, claim.objectKey);\n  const settled = await completeRetainedScreenshotMaintenance(db, {\n    accountId: claim.accountId,\n    workspaceId: claim.workspaceId,\n    artifactId: claim.artifactId,\n    claimId: claim.claimId,\n    outcome: \"failed\",\n  });\n  if (!settled) throw new Error(\"retained screenshot reconcile claim was superseded\");\n  return \"failed\";\n}\n\nasync function observeClaimObject(\n  storage: ObjectStorage,\n  claim: RetainedScreenshotMaintenanceClaim,\n  provider: Required<Pick<RetainedScreenshotMaintenanceActivityOptions, \"fileExists\" | \"headFile\">>,\n): Promise<\"matches\" | \"mismatch\" | \"missing\"> {\n  const file = claimFile(storage, claim);\n  const head = await retryWhileMissing(async () => {\n    if (!(await provider.fileExists(storage, file))) return null;\n    return await provider.headFile(storage, file);\n  });\n  if (!head) return \"missing\";\n  return head.ContentLength === claim.sizeBytes &&\n    head.ContentType === claim.mediaType &&\n    head.Metadata?.sha256 === claim.sha256\n    ? \"matches\"\n    : \"mismatch\";\n}\n\nfunction claimFile(storage: ObjectStorage, claim: RetainedScreenshotMaintenanceClaim): FileAsset {\n  const timestamp = new Date(0).toISOString();\n  return {\n    id: claim.artifactId,\n    workspaceId: claim.workspaceId,\n    status: \"pending_upload\",\n    filename: `computer-screenshot-${claim.artifactId}.png`,\n    safeFilename: `computer-screenshot-${claim.artifactId}.png`,\n    contentType: claim.mediaType,\n    sizeBytes: claim.sizeBytes,\n    sha256: claim.sha256,\n    bucket: storage.bucket,\n    objectKey: claim.objectKey,\n    createdAt: timestamp,\n    updatedAt: timestamp,\n  };\n}\n\nfunction terminalDeleteOutcome(reason: string | null): \"failed\" | \"expired\" | \"deleted\" {\n  if (reason === \"expired\") return \"expired\";\n  if (reason === \"failed\") return \"failed\";\n  return \"deleted\";\n}\n","import type {\n  AccessGrant,\n  Rig,\n  RigChange,\n  RigCheck,\n  RigProviderImage,\n  RigVersion,\n  SandboxBackend,\n} from \"@opengeni/contracts\";\nimport { sandboxLifecycleTransitionWaitMs } from \"@opengeni/config\";\nimport {\n  appendRigSetupCommand,\n  recordRigAuditEvent,\n  classifyRigVerificationOutcome,\n  promoteSetupAppendChange,\n  rigProviderImageBuildRequestId,\n  rigProviderImageContentHash,\n  rigProviderImageProviderBindingKeyHash,\n  rigProviderImageSetupHash,\n  type RigProviderImageDefinition,\n} from \"@opengeni/core\";\nimport {\n  acquireLease,\n  beginRigChangeVerificationAttempt,\n  claimRigVersionProviderImageBuild,\n  commitWarmingToWarm,\n  failWarmingToCold,\n  finalizeRigVersionProviderImageBuild,\n  getRig,\n  getRigChange,\n  getRigVersionById,\n  markWarmLeaseInstanceLost,\n  markSandboxCheckpointArtifactDeletePending,\n  recordWarmingSandboxCreated,\n  registerSandboxCheckpointArtifact,\n  releaseLeaseHolder,\n  touchLeaseHolder,\n  updateRigChangeStatus,\n  SandboxCheckpointArtifactRegistrationConflictError,\n  type Database,\n} from \"@opengeni/db\";\nimport {\n  buildImmutableProviderImage,\n  createTurnToolCancellationController,\n  deleteModalCheckpointSnapshot,\n  describeNativeSnapshotArchive,\n  encodeNativeSnapshotRef,\n  establishSandboxSessionFromEnvelope,\n  sandboxCommandExitCode,\n  sandboxCommandOutput,\n  serializeEstablishedSandboxEnvelope,\n  providerSupportsImmutableImageBuild,\n  tagModalSandbox,\n  terminateManagedSandboxSession,\n  verifySandboxExecReadiness,\n  type EstablishedSandboxSession,\n  type TurnSandboxCommandArgs,\n  type TurnSandboxCommandSession,\n} from \"@opengeni/runtime/sandbox\";\nimport type { Context } from \"@temporalio/activity\";\nimport type { ControlActivityServices } from \"./types\";\nimport { rigProviderImageSourceImage } from \"./sandbox-images\";\nimport { currentActivityContext } from \"./streaming\";\n\ntype RigSetupHook = typeof import(\"@opengeni/runtime\").runRigSetupHook;\nlet rigSetupHookPromise: Promise<RigSetupHook> | null = null;\n\nasync function runRigSetupHook(...args: Parameters<RigSetupHook>): Promise<void> {\n  rigSetupHookPromise ??= import(\"@opengeni/runtime\").then((runtime) => runtime.runRigSetupHook);\n  const hook = await rigSetupHookPromise;\n  await hook(...args);\n}\n\ntype SandboxLifecycleCommandRunner = (\n  session: TurnSandboxCommandSession,\n  args: TurnSandboxCommandArgs,\n) => Promise<unknown>;\n\nexport type RigVerificationWorkflowInput =\n  | { workspaceId: string; changeId: string; versionId?: never }\n  | { workspaceId: string; versionId: string; changeId?: never };\n\ntype CommandResult = {\n  exitCode: number | null;\n  output: string;\n};\n\nexport type RigPlatformCheckResult = CommandResult & RigCheck;\n\n/**\n * Platform-owned checks run after Rig setup and independently of user-declared\n * checks. They prove that a Rig layered on the deployment image did not remove\n * or replace the Browser, Terminal, or Computer/Desktop services. The commands\n * start each enabled service on its canonical loopback port, wait for its own\n * readiness contract, probe it, and tear it down before provider snapshotting.\n */\nexport function rigPlatformChecksForSettings(\n  settings: ControlActivityServices[\"settings\"],\n): RigCheck[] {\n  const backend = settings.sandboxBackend as SandboxBackend;\n  if (!rigProviderImageSourceImage(settings, backend)) return [];\n\n  const checks: RigCheck[] = [\n    {\n      name: \"opengeni-platform-browser\",\n      command: [\n        \"set -eu\",\n        \"test -x /usr/local/bin/opengeni-browserd\",\n        \"test -x /usr/local/bin/opengeni-browserd-up\",\n        \"test -x /usr/local/bin/opengeni-browserd-down\",\n        \"test -r /etc/opengeni/browser-engine\",\n        '__og_browser_engine=\"$(head -n 1 /etc/opengeni/browser-engine)\"',\n        'test -n \"$__og_browser_engine\"',\n        'test -x \"$__og_browser_engine\"',\n        '__og_browser_token=\"$(mktemp)\"',\n        \"trap 'opengeni-browserd-down >/dev/null 2>&1 || true; rm -f \\\"$__og_browser_token\\\"' EXIT\",\n        \"__og_browser_token_value=\\\"$(od -An -N32 -tx1 /dev/urandom | tr -d '[:space:]')\\\"\",\n        'test \"${#__og_browser_token_value}\" -eq 64',\n        'printf \\'%s\\\\n\\' \"$__og_browser_token_value\" > \"$__og_browser_token\"',\n        'chmod 0600 \"$__og_browser_token\"',\n        'OPENGENI_BROWSERD_ADMIN_TOKEN_FILE=\"$__og_browser_token\" OPENGENI_BROWSERD_PORT=7682 OPENGENI_BROWSERD_ALLOWED_ORIGINS= opengeni-browserd-up',\n        \"curl --noproxy '*' -fsS http://127.0.0.1:7682/healthz >/dev/null\",\n        \"curl --noproxy '*' -fsS -H \\\"Authorization: Bearer $__og_browser_token_value\\\" http://127.0.0.1:7682/v1/browser-sessions >/dev/null\",\n      ].join(\"\\n\"),\n    },\n  ];\n\n  if (settings.sandboxTerminalEnabled) {\n    checks.push({\n      name: \"opengeni-platform-terminal\",\n      command: [\n        \"set -eu\",\n        \"test -x /usr/local/bin/opengeni-terminal-up\",\n        \"test -x /usr/local/bin/opengeni-terminal-down\",\n        \"command -v ttyd >/dev/null\",\n        \"trap 'opengeni-terminal-down >/dev/null 2>&1 || true' EXIT\",\n        \"TERMINAL_PORT=7681 opengeni-terminal-up\",\n        \"curl --noproxy '*' -fsS http://127.0.0.1:7681/ >/dev/null\",\n      ].join(\"\\n\"),\n    });\n  }\n\n  if (settings.sandboxDesktopEnabled) {\n    checks.push({\n      name: \"opengeni-platform-computer-desktop\",\n      command: [\n        \"set -eu\",\n        \"test -x /usr/local/bin/opengeni-desktop-up\",\n        \"test -x /usr/local/bin/opengeni-desktop-down\",\n        \"command -v Xvfb >/dev/null\",\n        \"command -v x11vnc >/dev/null\",\n        \"test -x /opt/noVNC/utils/novnc_proxy\",\n        \"command -v scrot >/dev/null\",\n        \"command -v xdotool >/dev/null\",\n        '__og_desktop_home=\"$(mktemp -d)\"',\n        \"trap 'opengeni-desktop-down >/dev/null 2>&1 || true; rm -rf \\\"$__og_desktop_home\\\"' EXIT\",\n        'HOME=\"$__og_desktop_home\" STREAM_PORT=6080 DESKTOP_W=1280 DESKTOP_H=800 opengeni-desktop-up',\n        \"curl --noproxy '*' -fsS http://127.0.0.1:6080/vnc.html >/dev/null\",\n        \"nc -z 127.0.0.1 5900\",\n      ].join(\"\\n\"),\n    });\n  }\n\n  return checks;\n}\n\nconst RIG_VERIFICATION_CLEANUP_RESERVE_MAX_MS = 2 * 60_000;\nconst RIG_VERIFICATION_CLEANUP_OPERATION_MAX_MS = 60_000;\nconst RIG_VERIFICATION_HEARTBEAT_MAX_INTERVAL_MS = 10_000;\nconst RIG_VERIFICATION_HEARTBEAT_MIN_INTERVAL_MS = 250;\n// The Temporal activity has a 15-minute start-to-close timeout. Keep ownership\n// through that complete contract plus five minutes for cancellation delivery\n// and finally cleanup; a dead process then becomes sweep-eligible without any\n// lease-holder fiction or manual recovery.\nexport const RIG_VERIFICATION_OWNER_TTL_MS = 20 * 60_000;\nexport const RIG_VERIFICATION_OWNERS_DISABLED_MESSAGE =\n  \"Sandbox Environment verification lease ownership is disabled; refusing to create an unowned verifier sandbox\";\nconst RIG_VERIFICATION_HOLDER_TOUCH_INTERVAL_MS = 10_000;\nconst RIG_VERIFICATION_RELEASE_GRACE_MS = 1;\n\nexport class RigVerificationActivityDeadlineError extends Error {\n  readonly name = \"RigVerificationActivityDeadlineError\";\n\n  constructor(\n    readonly startToCloseTimeoutMs: number,\n    readonly cleanupReserveMs: number,\n  ) {\n    super(\n      `Sandbox Environment verification activity-local deadline reached with ${cleanupReserveMs}ms reserved for cleanup before the ${startToCloseTimeoutMs}ms Temporal start-to-close timeout`,\n    );\n  }\n}\n\nexport type RigVerificationActivityLifecycle = {\n  signal: AbortSignal;\n  /** Absolute wall-clock boundary before which immediate cleanup may wait. */\n  cleanupDeadlineAtMs: number | null;\n  dispose(): void;\n};\n\nfunction computeCleanupReserveMs(startToCloseTimeoutMs: number): number {\n  return Math.min(\n    RIG_VERIFICATION_CLEANUP_RESERVE_MAX_MS,\n    Math.max(100, Math.floor(startToCloseTimeoutMs / 4)),\n    Math.max(1, startToCloseTimeoutMs - 1),\n  );\n}\n\n/**\n * Start the verifier's real Temporal liveness/cancellation contract.\n *\n * The activity-local deadline is deliberately earlier than start-to-close. In\n * production a 15-minute server deadline becomes a 13-minute work deadline,\n * retaining two minutes for command quiescence, exact deactivation, and\n * provider termination. Short integration-test deadlines use the same bounded\n * one-quarter rule instead of a production-only magic value.\n */\nexport function createRigVerificationActivityLifecycle(\n  context: Context | null = currentActivityContext(),\n): RigVerificationActivityLifecycle {\n  const controller = new AbortController();\n  const temporalSignal = context?.cancellationSignal;\n  const forwardTemporalCancellation = (): void => {\n    if (!controller.signal.aborted) {\n      controller.abort(\n        temporalSignal?.reason ?? new Error(\"Sandbox Environment verification cancelled\"),\n      );\n    }\n  };\n  if (temporalSignal?.aborted) {\n    forwardTemporalCancellation();\n  } else {\n    temporalSignal?.addEventListener(\"abort\", forwardTemporalCancellation, { once: true });\n  }\n\n  const startedAtMs = Date.now();\n  const startToCloseTimeoutMs = context?.info.startToCloseTimeoutMs;\n  const reserveMs =\n    typeof startToCloseTimeoutMs === \"number\" && startToCloseTimeoutMs > 0\n      ? computeCleanupReserveMs(startToCloseTimeoutMs)\n      : null;\n  const serverDeadlineAtMs =\n    reserveMs === null || startToCloseTimeoutMs === undefined\n      ? null\n      : startedAtMs + startToCloseTimeoutMs;\n  // Keep an additional margin after our bounded cleanup waits. If a DB or\n  // provider promise remains unresolved, the activity must still report its\n  // local deadline before Temporal imposes the hard timeout.\n  const serverReportingMarginMs =\n    reserveMs === null ? 0 : Math.min(30_000, Math.max(1, Math.floor(reserveMs / 4)));\n  const cleanupDeadlineAtMs =\n    serverDeadlineAtMs === null ? null : serverDeadlineAtMs - serverReportingMarginMs;\n\n  let deadlineTimer: ReturnType<typeof setTimeout> | null = null;\n  if (reserveMs !== null && startToCloseTimeoutMs !== undefined && !controller.signal.aborted) {\n    deadlineTimer = setTimeout(\n      () => {\n        if (!controller.signal.aborted) {\n          controller.abort(\n            new RigVerificationActivityDeadlineError(startToCloseTimeoutMs, reserveMs),\n          );\n        }\n      },\n      Math.max(1, startToCloseTimeoutMs - reserveMs),\n    );\n  }\n\n  const heartbeat = (): void => {\n    if (!context) return;\n    try {\n      context.heartbeat({\n        activity: \"rig_verification\",\n        at: new Date().toISOString(),\n        cleanup: controller.signal.aborted,\n        cleanupDeadlineAt: cleanupDeadlineAtMs ? new Date(cleanupDeadlineAtMs).toISOString() : null,\n      });\n    } catch (error) {\n      // Context.heartbeat reports delivered cancellation synchronously on some\n      // SDK paths. Feed that failure into the same cooperative abort fence, but\n      // keep the interval alive through bounded cleanup: the abort signal stops\n      // verifier work, not the activity's liveness reporting.\n      if (!controller.signal.aborted) controller.abort(error);\n    }\n  };\n  heartbeat();\n  const heartbeatTimeoutMs = context?.info.heartbeatTimeoutMs;\n  const heartbeatIntervalMs =\n    typeof heartbeatTimeoutMs === \"number\" && heartbeatTimeoutMs > 0\n      ? Math.min(\n          RIG_VERIFICATION_HEARTBEAT_MAX_INTERVAL_MS,\n          Math.max(RIG_VERIFICATION_HEARTBEAT_MIN_INTERVAL_MS, Math.floor(heartbeatTimeoutMs / 3)),\n        )\n      : RIG_VERIFICATION_HEARTBEAT_MAX_INTERVAL_MS;\n  const heartbeatTimer = context ? setInterval(heartbeat, heartbeatIntervalMs) : null;\n  if (heartbeatTimer && \"unref\" in heartbeatTimer && typeof heartbeatTimer.unref === \"function\") {\n    heartbeatTimer.unref();\n  }\n\n  return {\n    signal: controller.signal,\n    cleanupDeadlineAtMs,\n    dispose: () => {\n      temporalSignal?.removeEventListener(\"abort\", forwardTemporalCancellation);\n      if (deadlineTimer) clearTimeout(deadlineTimer);\n      if (heartbeatTimer) clearInterval(heartbeatTimer);\n      deadlineTimer = null;\n    },\n  };\n}\n\nfunction abortReason(signal: AbortSignal): unknown {\n  return signal.reason ?? new Error(\"Sandbox Environment verification cancelled\");\n}\n\nfunction throwIfAborted(signal: AbortSignal): void {\n  if (signal.aborted) throw abortReason(signal);\n}\n\nasync function waitForAbortable<T>(promise: Promise<T>, signal: AbortSignal): Promise<T> {\n  throwIfAborted(signal);\n  let removeAbortListener = (): void => undefined;\n  const cancellation = new Promise<never>((_resolve, reject) => {\n    const onAbort = (): void => reject(abortReason(signal));\n    removeAbortListener = () => signal.removeEventListener(\"abort\", onAbort);\n    signal.addEventListener(\"abort\", onAbort, { once: true });\n  });\n  try {\n    return await Promise.race([promise, cancellation]);\n  } finally {\n    removeAbortListener();\n  }\n}\n\ntype BoundedSettlement<T> = { status: \"completed\"; value: T } | { status: \"timed_out\" };\n\nasync function settleWithin<T>(\n  promise: Promise<T>,\n  timeoutMs: number,\n): Promise<BoundedSettlement<T>> {\n  if (timeoutMs <= 0) return { status: \"timed_out\" };\n  let timer: ReturnType<typeof setTimeout> | null = null;\n  try {\n    return await Promise.race([\n      promise.then((value) => ({ status: \"completed\" as const, value })),\n      new Promise<{ status: \"timed_out\" }>((resolve) => {\n        timer = setTimeout(() => resolve({ status: \"timed_out\" }), timeoutMs);\n      }),\n    ]);\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n}\n\nfunction cleanupWaitMs(lifecycle: RigVerificationActivityLifecycle | undefined): number {\n  if (lifecycle?.cleanupDeadlineAtMs == null) {\n    return RIG_VERIFICATION_CLEANUP_OPERATION_MAX_MS;\n  }\n  return Math.max(\n    0,\n    Math.min(RIG_VERIFICATION_CLEANUP_OPERATION_MAX_MS, lifecycle.cleanupDeadlineAtMs - Date.now()),\n  );\n}\n\nfunction systemGrant(rig: Rig): AccessGrant {\n  return {\n    accountId: rig.accountId,\n    workspaceId: rig.workspaceId,\n    subjectId: \"system:rig-verification\",\n    permissions: [\"rigs:use\", \"rigs:manage\"],\n  };\n}\n\nasync function terminateThrowaway(established: EstablishedSandboxSession | null): Promise<boolean> {\n  if (!established) return true;\n  try {\n    await terminateManagedSandboxSession(\n      established.client,\n      established.sessionState,\n      established.session,\n    );\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport type RigVerificationOwnershipDependencies = {\n  acquire: typeof acquireLease;\n  establish: typeof establishSandboxSessionFromEnvelope;\n  recordCreated: typeof recordWarmingSandboxCreated;\n  commitWarm: typeof commitWarmingToWarm;\n  touchHolder: typeof touchLeaseHolder;\n  releaseHolder: typeof releaseLeaseHolder;\n  failWarming: typeof failWarmingToCold;\n  markWarmLost: typeof markWarmLeaseInstanceLost;\n  serialize: typeof serializeEstablishedSandboxEnvelope;\n  tag: typeof tagModalSandbox;\n  terminate: typeof terminateThrowaway;\n  createCancellationController: typeof createTurnToolCancellationController;\n  randomUUID: () => string;\n};\n\nconst defaultOwnershipDependencies: RigVerificationOwnershipDependencies = {\n  acquire: acquireLease,\n  establish: establishSandboxSessionFromEnvelope,\n  recordCreated: recordWarmingSandboxCreated,\n  commitWarm: commitWarmingToWarm,\n  touchHolder: touchLeaseHolder,\n  releaseHolder: releaseLeaseHolder,\n  failWarming: failWarmingToCold,\n  markWarmLost: markWarmLeaseInstanceLost,\n  serialize: serializeEstablishedSandboxEnvelope,\n  tag: tagModalSandbox,\n  terminate: terminateThrowaway,\n  createCancellationController: createTurnToolCancellationController,\n  randomUUID: () => crypto.randomUUID(),\n};\n\nexport type RigVerificationSandboxRunContext = {\n  signal: AbortSignal;\n  commandRunner: SandboxLifecycleCommandRunner;\n  ownership: {\n    leaseId: string;\n    leaseEpoch: number;\n    workspaceGeneration: number;\n    instanceId: string;\n  };\n};\n\nexport class RigVerificationLeaseUnavailableError extends Error {\n  readonly name = \"RigVerificationLeaseUnavailableError\";\n\n  constructor(\n    readonly sandboxGroupId: string,\n    readonly role: \"attached\" | \"blocked\" | \"rearmed\" | \"fenced\",\n  ) {\n    super(\n      `Sandbox Environment verification requires a new clean sandbox, but lease ${sandboxGroupId} was ${role}`,\n    );\n  }\n}\n\n/**\n * Run one verifier against one exactly attributed standalone sandbox.\n *\n * Ordering is deliberate and source-of-truth safe:\n *   acquire spawner -> create callback -> warming instance record -> warm commit\n *   -> setup/checks. The canonical sandbox lease, not provider tags, is durable\n * ownership. Every exact create callback is retained before its DB write so an\n * ambiguous acknowledgement can still be terminated in finally. Provider\n * termination precedes clearing that exact durable pointer; when termination\n * fails the pointer is retained and the holder is released with a one-millisecond\n * drain grace so the normal reaper retries. Temporal cancellation first drains\n * every verifier command. Cleanup waits are bounded inside the server reserve;\n * lease expiry and the provider reaper remain the hard-worker-loss backstops.\n */\nexport async function runWithOwnedRigVerificationSandbox<T>(\n  input: {\n    settings: ControlActivityServices[\"settings\"];\n    db: Database;\n    observability: ControlActivityServices[\"observability\"];\n    accountId: string;\n    workspaceId: string;\n    sandboxGroupId: string;\n    rigVersionId: string;\n    sessionIdPrefix: string;\n    lifecycle?: RigVerificationActivityLifecycle;\n  },\n  run: (\n    established: EstablishedSandboxSession,\n    context: RigVerificationSandboxRunContext,\n  ) => Promise<T>,\n  dependencies: RigVerificationOwnershipDependencies = defaultOwnershipDependencies,\n): Promise<T> {\n  // Phase B must remain inert throughout its code rollout. A disabled or\n  // omitted flag rejects before establish() can invoke any provider create;\n  // falling back to the legacy unowned verifier is never safe.\n  if (!input.settings.rigVerificationLeaseOwnershipEnabled) {\n    throw new Error(RIG_VERIFICATION_OWNERS_DISABLED_MESSAGE);\n  }\n\n  const holderId = `rig-verification:${dependencies.randomUUID()}`;\n  const fallbackController = new AbortController();\n  const signal = input.lifecycle?.signal ?? fallbackController.signal;\n  const commandController = dependencies.createCancellationController(signal);\n  const commandRunner = commandController.runSandboxCommand.bind(commandController);\n  let cleanupTarget: EstablishedSandboxSession | null = null;\n  let acquired = false;\n  let ownsWarmingEpoch = false;\n  let expectedEpoch: number | null = null;\n  let holderLivenessTimer: ReturnType<typeof setInterval> | null = null;\n  let establishmentSettled = false;\n  let establishmentPromise: Promise<EstablishedSandboxSession> | null = null;\n\n  const warnCleanupTimeout = (operation: string, instanceId: string | null): void => {\n    input.observability.warn(\"sandbox environment verifier: ownership cleanup timed out\", {\n      holderId,\n      instanceId,\n      operation,\n      error:\n        \"cleanup did not settle inside the activity reserve; exact owner expiry and the global provider reaper are the bounded delayed backstop\",\n    });\n  };\n\n  const warnCleanupFailure = (\n    operation: string,\n    instanceId: string | null,\n    error: unknown,\n  ): void => {\n    input.observability.warn(\"sandbox environment verifier: ownership cleanup failed\", {\n      holderId,\n      instanceId,\n      operation,\n      error: error instanceof Error ? error.message : String(error),\n    });\n  };\n\n  const clearTerminatedLeasePointer = async (instanceId: string): Promise<void> => {\n    if (expectedEpoch === null) return;\n    const cleanupEpoch = expectedEpoch;\n    // Exactly one transition can match. Running both covers a commit whose DB\n    // acknowledgement was lost: expectedEpoch is still warming, while\n    // expectedEpoch+1 is the only possible committed warm epoch.\n    const results = await Promise.allSettled([\n      Promise.resolve().then(() =>\n        dependencies.markWarmLost(input.db, {\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          sandboxGroupId: input.sandboxGroupId,\n          expectedEpoch: cleanupEpoch + 1,\n          expectedInstanceId: instanceId,\n        }),\n      ),\n      Promise.resolve().then(() =>\n        dependencies.failWarming(input.db, {\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          sandboxGroupId: input.sandboxGroupId,\n          expectedEpoch: cleanupEpoch,\n        }),\n      ),\n    ]);\n    for (const [index, result] of results.entries()) {\n      if (result.status === \"rejected\") {\n        warnCleanupFailure(\n          index === 0 ? \"mark_warm_lost\" : \"fail_warming\",\n          instanceId,\n          result.reason,\n        );\n      }\n    }\n  };\n\n  const terminateAndClear = async (created: EstablishedSandboxSession): Promise<boolean> => {\n    let terminated = false;\n    try {\n      terminated = await dependencies.terminate(created);\n    } catch (error) {\n      warnCleanupFailure(\"terminate\", created.instanceId, error);\n    }\n    if (!terminated) {\n      warnCleanupFailure(\n        \"terminate\",\n        created.instanceId,\n        new Error(\"provider termination was not confirmed; durable lease cleanup remains pending\"),\n      );\n      return false;\n    }\n    await clearTerminatedLeasePointer(created.instanceId);\n    return true;\n  };\n\n  try {\n    throwIfAborted(signal);\n    const lease = await dependencies.acquire(input.db, {\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      sandboxGroupId: input.sandboxGroupId,\n      kind: \"turn\",\n      holderId,\n      subjectId: null,\n      backend: input.settings.sandboxBackend,\n      image: rigProviderImageSourceImage(input.settings, input.settings.sandboxBackend),\n      rigVersionId: input.rigVersionId,\n      leaseTtlMs: RIG_VERIFICATION_OWNER_TTL_MS,\n      warmingLeaseTtlMs: RIG_VERIFICATION_OWNER_TTL_MS,\n      captureWaitMs: sandboxLifecycleTransitionWaitMs(input.settings),\n      waitSignal: signal,\n    });\n    acquired = true;\n    expectedEpoch = lease.lease.leaseEpoch;\n    holderLivenessTimer = setInterval(() => {\n      void dependencies\n        .touchHolder(input.db, {\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          sandboxGroupId: input.sandboxGroupId,\n          kind: \"turn\",\n          holderId,\n        })\n        .catch(() => undefined);\n    }, RIG_VERIFICATION_HOLDER_TOUCH_INTERVAL_MS);\n    if (\"unref\" in holderLivenessTimer && typeof holderLivenessTimer.unref === \"function\") {\n      holderLivenessTimer.unref();\n    }\n    if (lease.role !== \"spawner\") {\n      throw new RigVerificationLeaseUnavailableError(input.sandboxGroupId, lease.role);\n    }\n    ownsWarmingEpoch = true;\n\n    establishmentPromise = Promise.resolve().then(() =>\n      dependencies.establish(input.settings, null, {\n        sessionId: `${input.sessionIdPrefix}-${holderId}`,\n        recovery: \"create-or-restore\",\n        environment: {},\n        onSandboxCreated: async (created) => {\n          // Retain the exact handle before the durable write. If registration\n          // throws after commit, finally still has the provider identity.\n          cleanupTarget = created;\n          const resumeState =\n            created.backendId === \"modal\" ? null : await dependencies.serialize(created);\n          const recorded = await dependencies.recordCreated(input.db, {\n            accountId: input.accountId,\n            workspaceId: input.workspaceId,\n            sandboxGroupId: input.sandboxGroupId,\n            expectedEpoch: lease.lease.leaseEpoch,\n            instanceId: created.instanceId,\n            resumeBackendId: created.backendId,\n            resumeState,\n            leaseTtlMs: RIG_VERIFICATION_OWNER_TTL_MS,\n            warmingLeaseTtlMs: RIG_VERIFICATION_OWNER_TTL_MS,\n          });\n          if (!recorded.recorded) {\n            throw new RigVerificationLeaseUnavailableError(input.sandboxGroupId, \"fenced\");\n          }\n\n          if (created.backendId === \"modal\" && !signal.aborted) {\n            try {\n              await waitForAbortable(\n                dependencies.tag(input.settings, created.instanceId, {\n                  leaseId: lease.lease.id,\n                  workspaceId: input.workspaceId,\n                  sandboxGroupId: input.sandboxGroupId,\n                }),\n                signal,\n              );\n            } catch (error) {\n              if (!signal.aborted) {\n                input.observability.warn(\n                  \"sandbox environment verifier: Modal ownership tag failed\",\n                  {\n                    holderId,\n                    instanceId: created.instanceId,\n                    error: error instanceof Error ? error.message : String(error),\n                  },\n                );\n              }\n            }\n          }\n\n          // Provider create is not abortable. If it returns after cancellation\n          // won the outer race, the callback owns an independent exact cleanup\n          // path before it throws and triggers the runtime's fail-closed delete.\n          if (signal.aborted) {\n            await terminateAndClear(created);\n            throw abortReason(signal);\n          }\n        },\n      }),\n    );\n    void establishmentPromise.then(\n      () => {\n        establishmentSettled = true;\n      },\n      () => {\n        establishmentSettled = true;\n      },\n    );\n    // The losing provider promise retains the callback above and a rejection\n    // handler, so a late create can still deactivate/terminate without an\n    // unhandled rejection after the activity has reported cancellation.\n    void establishmentPromise.catch(() => undefined);\n    const established = await waitForAbortable(establishmentPromise, signal);\n    cleanupTarget = established;\n    await waitForAbortable(verifySandboxExecReadiness(established), signal);\n    const resumeState =\n      established.backendId === \"modal\" ? null : await dependencies.serialize(established);\n    const committed = await dependencies.commitWarm(input.db, {\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      sandboxGroupId: input.sandboxGroupId,\n      expectedEpoch: lease.lease.leaseEpoch,\n      instanceId: established.instanceId,\n      dataPlaneUrl: null,\n      resumeBackendId: established.backendId,\n      resumeState,\n      leaseTtlMs: RIG_VERIFICATION_OWNER_TTL_MS,\n    });\n    if (!committed.committed || !committed.lease) {\n      throw new RigVerificationLeaseUnavailableError(input.sandboxGroupId, \"fenced\");\n    }\n    const result = await run(established, {\n      signal,\n      commandRunner,\n      ownership: {\n        leaseId: committed.lease.id,\n        leaseEpoch: committed.lease.leaseEpoch,\n        workspaceGeneration: committed.lease.workspaceGeneration,\n        instanceId: established.instanceId,\n      },\n    });\n    throwIfAborted(signal);\n    return result;\n  } catch (error) {\n    if (signal.aborted) throw abortReason(signal);\n    throw error;\n  } finally {\n    if (signal.aborted && establishmentPromise && !establishmentSettled) {\n      const lateEstablishment = await settleWithin(\n        Promise.allSettled([establishmentPromise]),\n        cleanupWaitMs(input.lifecycle),\n      );\n      if (lateEstablishment.status === \"timed_out\") {\n        warnCleanupTimeout(\"establish_after_abort\", cleanupTarget?.instanceId ?? null);\n      }\n    }\n\n    if (holderLivenessTimer) {\n      clearInterval(holderLivenessTimer);\n      holderLivenessTimer = null;\n    }\n\n    // Physical command quiescence precedes provider teardown. If the provider\n    // control plane itself hangs, bound the wait so termination still starts\n    // inside the server reserve; terminating the throwaway box is then the\n    // stronger final process fence.\n    commandController.cancel(signal.aborted ? abortReason(signal) : new Error(\"Verifier complete\"));\n    const quiescence = commandController.waitForQuiescence();\n    void quiescence.catch(() => undefined);\n    const quiescenceResult = await settleWithin(quiescence, cleanupWaitMs(input.lifecycle));\n    if (quiescenceResult.status === \"timed_out\") {\n      warnCleanupTimeout(\"command_quiescence\", cleanupTarget?.instanceId ?? null);\n    }\n\n    const providerCleanup = Promise.resolve().then(async () => {\n      if (!cleanupTarget) {\n        // A provider create that rejects before onSandboxCreated leaves no box\n        // pointer to terminate. Roll back only our exact warming epoch so the\n        // next verification does not wait for the 20-minute death reaper. If a\n        // non-abortable create returns after this transition, its callback is\n        // fenced and the runtime's create-failure path terminates that box.\n        if (ownsWarmingEpoch && expectedEpoch !== null) {\n          await dependencies.failWarming(input.db, {\n            accountId: input.accountId,\n            workspaceId: input.workspaceId,\n            sandboxGroupId: input.sandboxGroupId,\n            expectedEpoch,\n          });\n        }\n        return true;\n      }\n      return await terminateAndClear(cleanupTarget);\n    });\n    void providerCleanup.catch(() => undefined);\n    const providerSettlement = await settleWithin(\n      Promise.allSettled([providerCleanup]),\n      cleanupWaitMs(input.lifecycle),\n    );\n    if (providerSettlement.status === \"timed_out\") {\n      warnCleanupTimeout(\"terminate_and_clear\", cleanupTarget?.instanceId ?? null);\n    } else if (providerSettlement.value[0]?.status === \"rejected\") {\n      warnCleanupFailure(\n        \"terminate_and_clear\",\n        cleanupTarget?.instanceId ?? null,\n        providerSettlement.value[0].reason,\n      );\n    }\n\n    // Release is independent from provider/DB cleanup. A failed direct\n    // termination therefore leaves the exact pointer intact and immediately\n    // makes the zero-holder lease eligible for the normal drain/reaper path.\n    if (acquired) {\n      const release = Promise.resolve().then(() =>\n        dependencies.releaseHolder(input.db, {\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          sandboxGroupId: input.sandboxGroupId,\n          kind: \"turn\",\n          holderId,\n          idleGraceMs: RIG_VERIFICATION_RELEASE_GRACE_MS,\n        }),\n      );\n      void release.catch(() => undefined);\n      const released = await settleWithin(\n        Promise.allSettled([release]),\n        cleanupWaitMs(input.lifecycle),\n      );\n      if (released.status === \"timed_out\") {\n        warnCleanupTimeout(\"release_holder\", cleanupTarget?.instanceId ?? null);\n      } else if (released.value[0]?.status === \"rejected\") {\n        warnCleanupFailure(\n          \"release_holder\",\n          cleanupTarget?.instanceId ?? null,\n          released.value[0].reason,\n        );\n      }\n    }\n    // Cancellation may be delivered by a heartbeat while finally is already\n    // draining. WAIT_CANCELLATION_COMPLETED must observe cancellation only\n    // after cleanup, but it must not turn that late cancellation into success.\n    throwIfAborted(signal);\n  }\n}\n\nasync function runCommand(\n  session: TurnSandboxCommandSession,\n  command: string,\n  timeoutMs: number,\n  commandRunner: SandboxLifecycleCommandRunner,\n): Promise<CommandResult> {\n  const args = {\n    cmd: command,\n    workdir: \"/workspace\",\n    runAs: \"root\",\n    yieldTimeMs: timeoutMs,\n    maxOutputTokens: 40_000,\n  };\n  const result = await commandRunner(session, args);\n  return {\n    exitCode: sandboxCommandExitCode(result),\n    output: sandboxCommandOutput(result),\n  };\n}\n\nasync function runRigChecks(\n  session: TurnSandboxCommandSession,\n  checks: readonly RigCheck[],\n  timeoutMs: number,\n  commandRunner: SandboxLifecycleCommandRunner,\n): Promise<RigPlatformCheckResult[]> {\n  const results: RigPlatformCheckResult[] = [];\n  for (const check of checks) {\n    results.push({\n      name: check.name,\n      command: check.command,\n      ...(await runCommand(session, check.command, timeoutMs, commandRunner)),\n    });\n  }\n  return results;\n}\n\nfunction setupAppendCommand(change: RigChange): string | null {\n  if (change.kind !== \"setup_append\") {\n    return null;\n  }\n  const command = (change.payload as { command?: unknown }).command;\n  return typeof command === \"string\" ? command : null;\n}\n\nfunction candidateVersionForChange(baseVersion: RigVersion, change: RigChange): RigVersion {\n  if (change.kind !== \"definition_edit\") {\n    return { ...baseVersion, image: null, providerImages: {} };\n  }\n  const payload = change.payload as {\n    setupScript?: unknown;\n    checks?: unknown;\n    credentialHooks?: unknown;\n    defaultVariableSetIds?: unknown;\n    changelog?: unknown;\n  };\n  return {\n    ...baseVersion,\n    image: null,\n    setupScript:\n      payload.setupScript === undefined\n        ? baseVersion.setupScript\n        : (payload.setupScript as string | null),\n    checks: Array.isArray(payload.checks)\n      ? (payload.checks as RigVersion[\"checks\"])\n      : baseVersion.checks,\n    credentialHooks: Array.isArray(payload.credentialHooks)\n      ? (payload.credentialHooks as string[])\n      : baseVersion.credentialHooks,\n    defaultVariableSetIds: Array.isArray(payload.defaultVariableSetIds)\n      ? (payload.defaultVariableSetIds as string[])\n      : baseVersion.defaultVariableSetIds,\n    changelog: typeof payload.changelog === \"string\" ? payload.changelog : baseVersion.changelog,\n    providerImages: {},\n  };\n}\n\nfunction providerImageDefinitionForChange(\n  baseVersion: RigVersion,\n  change: RigChange,\n  candidateVersion: RigVersion,\n): RigProviderImageDefinition {\n  if (change.kind !== \"setup_append\") return candidateVersion;\n  const command = setupAppendCommand(change);\n  return {\n    setupScript: command\n      ? appendRigSetupCommand(baseVersion.setupScript, command)\n      : baseVersion.setupScript,\n    checks: baseVersion.checks,\n    credentialHooks: baseVersion.credentialHooks,\n    defaultVariableSetIds: baseVersion.defaultVariableSetIds,\n  };\n}\n\nexport function rigProviderImageContentMarkerCommand(\n  contentHash: string,\n  markerRoot = \"/var/opengeni\",\n): string {\n  const { marker, normalizedRoot } = rigProviderImageContentMarker(contentHash, markerRoot);\n  return `mkdir -p '${normalizedRoot}' && touch '${marker}'`;\n}\n\nfunction rigProviderImageContentMarker(\n  contentHash: string,\n  markerRoot = \"/var/opengeni\",\n): { marker: string; normalizedRoot: string } {\n  if (!/^sha256:[0-9a-f]{64}$/u.test(contentHash)) {\n    throw new Error(\n      \"Sandbox Environment provider image content marker requires a canonical SHA-256 value\",\n    );\n  }\n  if (!/^\\/[A-Za-z0-9._/-]+$/u.test(markerRoot)) {\n    throw new Error(\"Sandbox Environment provider image marker root must be a safe absolute path\");\n  }\n  const normalizedRoot = markerRoot.replace(/\\/+$/u, \"\") || \"/\";\n  const marker = `${normalizedRoot === \"/\" ? \"\" : normalizedRoot}/rig-setup-content-${contentHash.slice(\"sha256:\".length)}.done`;\n  return { marker, normalizedRoot };\n}\n\nexport type RigProviderImageColdBootDependencies = {\n  runOwnedSandbox: typeof runWithOwnedRigVerificationSandbox;\n  now: () => Date;\n};\n\nconst defaultRigProviderImageColdBootDependencies: RigProviderImageColdBootDependencies = {\n  runOwnedSandbox: runWithOwnedRigVerificationSandbox,\n  now: () => new Date(),\n};\n\n/** Prove a provider image from a second clean sandbox before runtime selection. */\nexport async function verifyRigProviderImageColdBoot(\n  input: {\n    settings: ControlActivityServices[\"settings\"];\n    db: Database;\n    observability: ControlActivityServices[\"observability\"];\n    accountId: string;\n    workspaceId: string;\n    buildRequestId: string;\n    rigVersionId: string;\n    sessionIdPrefix: string;\n    imageId: string;\n    contentHash: string;\n    checks: RigProviderImageDefinition[\"checks\"];\n    lifecycle: RigVerificationActivityLifecycle;\n  },\n  dependencies: RigProviderImageColdBootDependencies = defaultRigProviderImageColdBootDependencies,\n): Promise<string> {\n  const { marker } = rigProviderImageContentMarker(input.contentHash);\n  await dependencies.runOwnedSandbox(\n    {\n      settings: {\n        ...input.settings,\n        modalImageId: input.imageId,\n        // The full-machine provider image is the immutable rig base. Any future\n        // workspace recovery must layer /workspace onto it, never replace it.\n        modalWorkspacePersistence: \"snapshot_directory\",\n      },\n      db: input.db,\n      observability: input.observability,\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      sandboxGroupId: input.buildRequestId,\n      rigVersionId: input.rigVersionId,\n      sessionIdPrefix: input.sessionIdPrefix,\n      lifecycle: input.lifecycle,\n    },\n    async (established, runContext) => {\n      const markerResult = await runCommand(\n        established.session as TurnSandboxCommandSession,\n        `test -f '${marker}'`,\n        input.settings.rigSetupTimeoutMs,\n        runContext.commandRunner,\n      );\n      if (markerResult.exitCode !== 0) {\n        throw new Error(\n          \"built provider image is missing its exact sandbox environment-content marker\",\n        );\n      }\n      for (const check of rigPlatformChecksForSettings(input.settings)) {\n        const result = await runCommand(\n          established.session as TurnSandboxCommandSession,\n          check.command,\n          input.settings.rigSetupTimeoutMs,\n          runContext.commandRunner,\n        );\n        if (result.exitCode !== 0) {\n          throw new Error(\n            `built provider image failed mandatory platform check ${JSON.stringify(check.name)}: ${result.output.slice(-2000)}`,\n          );\n        }\n      }\n      for (const check of input.checks) {\n        const result = await runCommand(\n          established.session as TurnSandboxCommandSession,\n          check.command,\n          input.settings.rigSetupTimeoutMs,\n          runContext.commandRunner,\n        );\n        if (result.exitCode !== 0) {\n          throw new Error(\n            `built provider image failed check ${JSON.stringify(check.name)}: ${result.output.slice(-2000)}`,\n          );\n        }\n      }\n    },\n  );\n  return dependencies.now().toISOString();\n}\n\nexport async function buildVerifiedRigProviderImage(input: {\n  settings: ControlActivityServices[\"settings\"];\n  db: Database;\n  observability: ControlActivityServices[\"observability\"];\n  accountId: string;\n  workspaceId: string;\n  existingVersionId?: string;\n  definition: RigProviderImageDefinition;\n  target: { kind: \"change\" | \"version\"; id: string };\n  established: EstablishedSandboxSession;\n  ownership: RigVerificationSandboxRunContext[\"ownership\"];\n  lifecycle: RigVerificationActivityLifecycle;\n  signal: AbortSignal;\n}): Promise<RigProviderImage> {\n  const backend = input.settings.sandboxBackend as SandboxBackend;\n  const providerSupportsBuild = providerSupportsImmutableImageBuild(backend);\n  const sourceImage = rigProviderImageSourceImage(input.settings, backend);\n  const contentHash = rigProviderImageContentHash({\n    backend,\n    sourceImage,\n    definition: input.definition,\n  });\n  const startedAt = new Date().toISOString();\n  let building: RigProviderImage = {\n    backend,\n    provider: backend,\n    status: \"building\",\n    contentHash,\n    setupHash: rigProviderImageSetupHash(input.definition),\n    sourceImage,\n    buildRequestId: rigProviderImageBuildRequestId({\n      targetId: input.target.id,\n      backend,\n      contentHash,\n    }),\n    imageId: null,\n    imageDigest: null,\n    artifactId: null,\n    providerBindingKeyHash: null,\n    provenance: {\n      kind: \"rig_verification\",\n      targetKind: input.target.kind,\n      targetId: input.target.id,\n    },\n    startedAt,\n    finishedAt: null,\n    error: null,\n  };\n\n  if (input.existingVersionId) {\n    const claim = await claimRigVersionProviderImageBuild(input.db, {\n      workspaceId: input.workspaceId,\n      versionId: input.existingVersionId,\n      image: building,\n      staleAfterMs: RIG_VERIFICATION_OWNER_TTL_MS,\n      retryUnsupported: providerSupportsBuild,\n    });\n    if (\n      claim.status === \"ready\" ||\n      claim.status === \"in_progress\" ||\n      claim.status === \"unsupported\"\n    ) {\n      return claim.image;\n    }\n    if (claim.status === \"conflict\") {\n      return {\n        ...building,\n        status: \"failed\",\n        finishedAt: new Date().toISOString(),\n        error: {\n          code: \"provider_image_content_conflict\",\n          message:\n            \"this exact sandbox environment version already records a provider image for different effective content; mint and verify a new version\",\n          retryable: false,\n        },\n      };\n    }\n    building = claim.image;\n  }\n\n  const finalize = async (image: RigProviderImage): Promise<RigProviderImage> => {\n    if (input.existingVersionId) {\n      const persisted = await finalizeRigVersionProviderImageBuild(input.db, {\n        workspaceId: input.workspaceId,\n        versionId: input.existingVersionId,\n        image,\n      });\n      if (!persisted) {\n        if (image.artifactId) {\n          await markSandboxCheckpointArtifactDeletePending(input.db, {\n            accountId: input.accountId,\n            workspaceId: input.workspaceId,\n            artifactId: image.artifactId,\n            reason: \"rig_provider_image_publication_fenced\",\n          }).catch(() => false);\n        }\n        return {\n          ...image,\n          status: \"failed\",\n          imageId: null,\n          imageDigest: null,\n          artifactId: null,\n          providerBindingKeyHash: null,\n          finishedAt: new Date().toISOString(),\n          error: {\n            code: \"provider_image_publication_fenced\",\n            message: \"provider image ownership changed before this build could be published\",\n            retryable: true,\n          },\n        };\n      }\n    }\n    return image;\n  };\n\n  if (!providerSupportsBuild) {\n    return await finalize({\n      ...building,\n      status: \"unsupported\",\n      finishedAt: new Date().toISOString(),\n      error: {\n        code: \"provider_image_build_unsupported\",\n        message: `sandbox backend ${backend} does not support immutable provider image builds`,\n        retryable: false,\n      },\n    });\n  }\n\n  throwIfAborted(input.signal);\n  let builtIdentity: {\n    imageId: string;\n    providerBindingKey: string;\n  } | null = null;\n  let artifactId: string | null = null;\n  let coldBootValidatedAt: string | null = null;\n  try {\n    const built = await buildImmutableProviderImage({\n      backend,\n      settings: input.settings,\n      session: input.established.session,\n      requestId: building.buildRequestId,\n      timeoutMs: input.settings.sandboxSnapshotTimeoutMs,\n    });\n    if (!built || (!built.imageId && !built.imageDigest)) {\n      throw new Error(\"provider image builder returned no immutable image identity\");\n    }\n    if (backend === \"modal\") {\n      if (!built.imageId || !built.providerBindingKey || !built.providerBinding) {\n        throw new Error(\"Modal provider image build returned incomplete ownership identity\");\n      }\n      builtIdentity = {\n        imageId: built.imageId,\n        providerBindingKey: built.providerBindingKey,\n      };\n      const archiveBytes = encodeNativeSnapshotRef({\n        provider: \"modal_snapshot_filesystem\",\n        snapshotId: built.imageId,\n        workspacePersistence: \"snapshot_filesystem\",\n      });\n      const descriptor = describeNativeSnapshotArchive(archiveBytes);\n      if (!descriptor) {\n        throw new Error(\"Modal provider image build returned an invalid snapshot identity\");\n      }\n      const artifact = await registerSandboxCheckpointArtifact(input.db, {\n        accountId: input.accountId,\n        workspaceId: input.workspaceId,\n        sandboxGroupId: input.target.id,\n        sourceLeaseId: input.ownership.leaseId,\n        sourceLeaseEpoch: input.ownership.leaseEpoch,\n        sourceInstanceId: input.ownership.instanceId,\n        sourceWorkspaceGeneration: input.ownership.workspaceGeneration,\n        providerBindingKey: built.providerBindingKey,\n        providerBinding: built.providerBinding,\n        workspaceArchive: Buffer.from(archiveBytes).toString(\"base64\"),\n        workspaceArchiveMeta: descriptor,\n        registrationIdentity: \"provider_object\",\n      });\n      artifactId = artifact.id;\n\n      // A snapshot receipt is not proof that the artifact can cold-start. Boot\n      // a second, independently owned sandbox from the exact image before it\n      // can become runtime-selectable.\n      coldBootValidatedAt = await verifyRigProviderImageColdBoot({\n        settings: input.settings,\n        db: input.db,\n        observability: input.observability,\n        accountId: input.accountId,\n        workspaceId: input.workspaceId,\n        buildRequestId: building.buildRequestId,\n        rigVersionId: input.target.id,\n        sessionIdPrefix: `rig-provider-image-${input.target.id}`,\n        imageId: built.imageId,\n        contentHash,\n        checks: input.definition.checks,\n        lifecycle: input.lifecycle,\n      });\n    }\n    if (!coldBootValidatedAt) {\n      throw new Error(`${backend} provider image build has no independent cold-boot validator`);\n    }\n    if (input.signal.aborted) {\n      if (artifactId) {\n        await markSandboxCheckpointArtifactDeletePending(input.db, {\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          artifactId,\n          reason: \"rig_provider_image_build_cancelled\",\n        }).catch(() => false);\n      }\n      throw abortReason(input.signal);\n    }\n    return await finalize({\n      ...building,\n      provider: built.provider,\n      status: \"ready\",\n      imageId: built.imageId,\n      imageDigest: built.imageDigest,\n      artifactId,\n      providerBindingKeyHash: built.providerBindingKey\n        ? rigProviderImageProviderBindingKeyHash(built.providerBindingKey)\n        : null,\n      coldBootValidation: {\n        version: 1,\n        checkedAt: coldBootValidatedAt,\n      },\n      finishedAt: new Date().toISOString(),\n      error: null,\n    });\n  } catch (error) {\n    if (input.signal.aborted) throw abortReason(input.signal);\n    if (artifactId) {\n      await markSandboxCheckpointArtifactDeletePending(input.db, {\n        accountId: input.accountId,\n        workspaceId: input.workspaceId,\n        artifactId,\n        reason: \"rig_provider_image_build_failed\",\n      }).catch(() => false);\n    } else if (\n      backend === \"modal\" &&\n      builtIdentity &&\n      !(error instanceof SandboxCheckpointArtifactRegistrationConflictError)\n    ) {\n      await deleteModalCheckpointSnapshot(\n        input.settings,\n        builtIdentity.providerBindingKey,\n        builtIdentity.imageId,\n      ).catch(() => \"not_found\" as const);\n    }\n    const message = (error instanceof Error ? error.message : String(error)).slice(0, 2000);\n    return await finalize({\n      ...building,\n      status: \"failed\",\n      artifactId: null,\n      finishedAt: new Date().toISOString(),\n      error: {\n        code: \"provider_image_build_failed\",\n        message: message || \"provider image build failed\",\n        retryable: true,\n      },\n    });\n  }\n}\n\nexport function settingsForRigVerification(\n  settings: ControlActivityServices[\"settings\"],\n  rigImage: string | null,\n): ControlActivityServices[\"settings\"] {\n  // Rig verification must prove setup and provider-image materialization on\n  // the deployment-owned platform base. Historical Rig image values are ignored.\n  void rigImage;\n  return settings;\n}\n\nasync function loadChangeTarget(\n  db: Database,\n  workspaceId: string,\n  changeId: string,\n): Promise<{ rig: Rig; baseVersion: RigVersion; change: RigChange }> {\n  const change = await getRigChange(db, workspaceId, changeId);\n  if (!change) {\n    throw new Error(`Sandbox Environment change not found: ${changeId}`);\n  }\n  const rig = await getRig(db, workspaceId, change.rigId);\n  if (!rig) {\n    throw new Error(`Sandbox Environment not found for change: ${change.rigId}`);\n  }\n  if (!change.baseVersionId) {\n    throw new Error(`Sandbox Environment change ${change.id} has no base version`);\n  }\n  const baseVersion = await getRigVersionById(db, workspaceId, change.baseVersionId);\n  if (!baseVersion || baseVersion.rigId !== rig.id) {\n    throw new Error(`Base sandbox environment version not found: ${change.baseVersionId}`);\n  }\n  return { rig, baseVersion, change };\n}\n\nasync function loadVersionTarget(\n  db: Database,\n  workspaceId: string,\n  versionId: string,\n): Promise<{ rig: Rig; version: RigVersion }> {\n  const version = await getRigVersionById(db, workspaceId, versionId);\n  if (!version) {\n    throw new Error(`Sandbox Environment version not found: ${versionId}`);\n  }\n  const rig = await getRig(db, workspaceId, version.rigId);\n  if (!rig) {\n    throw new Error(`Sandbox Environment not found for version: ${version.rigId}`);\n  }\n  return { rig, version };\n}\n\nasync function withRigVerificationActivityLifecycle<T>(\n  run: (lifecycle: RigVerificationActivityLifecycle) => Promise<T>,\n): Promise<T> {\n  // Context.current() and the immediate heartbeat happen before lazy service\n  // construction, so Temporal can deliver cancellation even while the worker\n  // is opening its first database/provider dependencies.\n  const lifecycle = createRigVerificationActivityLifecycle();\n  try {\n    throwIfAborted(lifecycle.signal);\n    return await run(lifecycle);\n  } finally {\n    lifecycle.dispose();\n  }\n}\n\nexport function createRigVerificationActivities(services: () => Promise<ControlActivityServices>) {\n  return {\n    verifyRigChange: (input: { workspaceId: string; changeId: string }) =>\n      withRigVerificationActivityLifecycle(async (lifecycle) => {\n        const { settings, db, observability } = await services();\n        throwIfAborted(lifecycle.signal);\n        const { rig, baseVersion, change } = await loadChangeTarget(\n          db,\n          input.workspaceId,\n          input.changeId,\n        );\n        const grant = systemGrant(rig);\n        const startedAt = new Date().toISOString();\n        await beginRigChangeVerificationAttempt(db, input.workspaceId, change.id, {\n          startedAt,\n          allowAlreadyVerifying: true,\n        });\n        await recordRigAuditEvent(db, {\n          grant,\n          action: \"rig.verification.started\",\n          rigId: rig.id,\n          metadata: { changeId: change.id },\n        });\n\n        const verification: Record<string, unknown> = { startedAt, checkResults: [] };\n        try {\n          const candidateVersion = candidateVersionForChange(baseVersion, change);\n          const providerImageDefinition = providerImageDefinitionForChange(\n            baseVersion,\n            change,\n            candidateVersion,\n          );\n          const runSettings = settingsForRigVerification(settings, candidateVersion.image);\n          const providerImageContentHash = rigProviderImageContentHash({\n            backend: runSettings.sandboxBackend,\n            sourceImage: rigProviderImageSourceImage(runSettings, runSettings.sandboxBackend),\n            definition: providerImageDefinition,\n          });\n          return await runWithOwnedRigVerificationSandbox(\n            {\n              settings: runSettings,\n              db,\n              observability,\n              accountId: rig.accountId,\n              workspaceId: input.workspaceId,\n              sandboxGroupId: change.id,\n              rigVersionId: candidateVersion.id,\n              sessionIdPrefix: `rig-verification-${change.id}`,\n              lifecycle,\n            },\n            async (established, runContext) => {\n              if ((candidateVersion.setupScript ?? \"\").trim()) {\n                await runRigSetupHook(established.session as never, {\n                  environment: {},\n                  runAs: \"root\",\n                  commandRunner: runContext.commandRunner,\n                  rigSetup: {\n                    rigId: rig.id,\n                    rigName: rig.name,\n                    versionId: candidateVersion.id,\n                    script: candidateVersion.setupScript ?? \"\",\n                    timeoutMs: settings.rigSetupTimeoutMs,\n                    contentHash: providerImageContentHash,\n                  },\n                });\n                verification.setupResult = { exitCode: 0, output: \"\" };\n              }\n              const command = setupAppendCommand(change);\n              if (command) {\n                const commandResult = await runCommand(\n                  established.session as TurnSandboxCommandSession,\n                  command,\n                  settings.rigSetupTimeoutMs,\n                  runContext.commandRunner,\n                );\n                verification.commandResult = commandResult;\n                if (commandResult.exitCode !== 0) {\n                  verification.finishedAt = new Date().toISOString();\n                  verification.passed = false;\n                  const updated = await updateRigChangeStatus(db, input.workspaceId, change.id, {\n                    status: \"rejected\",\n                    verification,\n                  });\n                  await recordRigAuditEvent(db, {\n                    grant,\n                    action: \"rig.verification.failed\",\n                    rigId: rig.id,\n                    metadata: { changeId: change.id, status: \"rejected\" },\n                  });\n                  await recordRigAuditEvent(db, {\n                    grant,\n                    action: \"rig.change.rejected\",\n                    rigId: rig.id,\n                    metadata: { changeId: change.id },\n                  });\n                  return updated;\n                }\n              }\n              const markerResult = await runCommand(\n                established.session as TurnSandboxCommandSession,\n                rigProviderImageContentMarkerCommand(providerImageContentHash),\n                settings.rigSetupTimeoutMs,\n                runContext.commandRunner,\n              );\n              if (markerResult.exitCode !== 0) {\n                throw new Error(\n                  `Failed to seal sandbox environment provider image content marker: ${markerResult.output.slice(-2000)}`,\n                );\n              }\n              const platformCheckResults = await runRigChecks(\n                established.session as TurnSandboxCommandSession,\n                rigPlatformChecksForSettings(runSettings),\n                settings.rigSetupTimeoutMs,\n                runContext.commandRunner,\n              );\n              verification.platformCheckResults = platformCheckResults;\n              const checkResults = await runRigChecks(\n                established.session as TurnSandboxCommandSession,\n                candidateVersion.checks,\n                settings.rigSetupTimeoutMs,\n                runContext.commandRunner,\n              );\n              verification.checkResults = checkResults;\n              const passed =\n                platformCheckResults.every((result) => result.exitCode === 0) &&\n                checkResults.every((result) => result.exitCode === 0);\n              if (passed) {\n                verification.providerImage = await buildVerifiedRigProviderImage({\n                  settings: runSettings,\n                  db,\n                  observability,\n                  accountId: rig.accountId,\n                  workspaceId: input.workspaceId,\n                  definition: providerImageDefinition,\n                  target: { kind: \"change\", id: change.id },\n                  established,\n                  ownership: runContext.ownership,\n                  lifecycle,\n                  signal: runContext.signal,\n                });\n              }\n              verification.finishedAt = new Date().toISOString();\n              verification.passed = passed;\n              const classified = classifyRigVerificationOutcome({ kind: change.kind, passed });\n              if (classified.action === \"auto_promote\") {\n                // Keep the change `verifying` (NOT `proposed`) across the write→promote\n                // gap: promoteSetupAppendChange accepts `verifying`, and leaving it\n                // `verifying` keeps beginRigChangeVerificationAttempt blocking a\n                // concurrent /verify — resetting to `proposed` would reopen that race\n                // (a second run could reject a change whose first verification passed).\n                await updateRigChangeStatus(db, input.workspaceId, change.id, {\n                  status: \"verifying\",\n                  verification,\n                });\n                const { change: merged } = await promoteSetupAppendChange({ db }, grant, rig, {\n                  ...change,\n                  verification,\n                });\n                await recordRigAuditEvent(db, {\n                  grant,\n                  action: \"rig.verification.passed\",\n                  rigId: rig.id,\n                  metadata: { changeId: change.id },\n                });\n                return merged;\n              }\n              const updated = await updateRigChangeStatus(db, input.workspaceId, change.id, {\n                status: classified.status,\n                verification,\n              });\n              await recordRigAuditEvent(db, {\n                grant,\n                action: passed ? \"rig.verification.passed\" : \"rig.verification.failed\",\n                rigId: rig.id,\n                metadata: { changeId: change.id, status: classified.status },\n              });\n              if (!passed) {\n                await recordRigAuditEvent(db, {\n                  grant,\n                  action: \"rig.change.rejected\",\n                  rigId: rig.id,\n                  metadata: { changeId: change.id },\n                });\n              }\n              return updated;\n            },\n          );\n        } catch (error) {\n          verification.finishedAt = new Date().toISOString();\n          verification.passed = false;\n          verification.error = error instanceof Error ? error.message : String(error);\n          const updated = await updateRigChangeStatus(db, input.workspaceId, change.id, {\n            status: \"failed\",\n            verification,\n          });\n          await recordRigAuditEvent(db, {\n            grant,\n            action: \"rig.verification.failed\",\n            rigId: rig.id,\n            metadata: { changeId: change.id, status: \"failed\" },\n          });\n          await recordRigAuditEvent(db, {\n            grant,\n            action: \"rig.change.failed\",\n            rigId: rig.id,\n            metadata: { changeId: change.id },\n          });\n          if (lifecycle.signal.aborted) throw abortReason(lifecycle.signal);\n          return updated;\n        }\n      }),\n\n    verifyRigVersion: (input: { workspaceId: string; versionId: string }) =>\n      withRigVerificationActivityLifecycle(async (lifecycle) => {\n        const { settings, db, observability } = await services();\n        throwIfAborted(lifecycle.signal);\n        const { rig, version } = await loadVersionTarget(db, input.workspaceId, input.versionId);\n        const grant = systemGrant(rig);\n        const startedAt = new Date().toISOString();\n        await recordRigAuditEvent(db, {\n          grant,\n          action: \"rig.verification.started\",\n          rigId: rig.id,\n          metadata: { versionId: version.id },\n        });\n        try {\n          const runSettings = settingsForRigVerification(settings, version.image);\n          const providerImageContentHash = rigProviderImageContentHash({\n            backend: runSettings.sandboxBackend,\n            sourceImage: rigProviderImageSourceImage(runSettings, runSettings.sandboxBackend),\n            definition: version,\n          });\n          return await runWithOwnedRigVerificationSandbox(\n            {\n              settings: runSettings,\n              db,\n              observability,\n              accountId: rig.accountId,\n              workspaceId: input.workspaceId,\n              sandboxGroupId: version.id,\n              rigVersionId: version.id,\n              sessionIdPrefix: `rig-version-verification-${version.id}`,\n              lifecycle,\n            },\n            async (established, runContext) => {\n              if ((version.setupScript ?? \"\").trim()) {\n                await runRigSetupHook(established.session as never, {\n                  environment: {},\n                  runAs: \"root\",\n                  commandRunner: runContext.commandRunner,\n                  rigSetup: {\n                    rigId: rig.id,\n                    rigName: rig.name,\n                    versionId: version.id,\n                    script: version.setupScript ?? \"\",\n                    timeoutMs: settings.rigSetupTimeoutMs,\n                    contentHash: providerImageContentHash,\n                  },\n                });\n              }\n              const markerResult = await runCommand(\n                established.session as TurnSandboxCommandSession,\n                rigProviderImageContentMarkerCommand(providerImageContentHash),\n                settings.rigSetupTimeoutMs,\n                runContext.commandRunner,\n              );\n              if (markerResult.exitCode !== 0) {\n                throw new Error(\n                  `Failed to seal sandbox environment provider image content marker: ${markerResult.output.slice(-2000)}`,\n                );\n              }\n              const platformCheckResults = await runRigChecks(\n                established.session as TurnSandboxCommandSession,\n                rigPlatformChecksForSettings(runSettings),\n                settings.rigSetupTimeoutMs,\n                runContext.commandRunner,\n              );\n              const checkResults = await runRigChecks(\n                established.session as TurnSandboxCommandSession,\n                version.checks,\n                settings.rigSetupTimeoutMs,\n                runContext.commandRunner,\n              );\n              const passed =\n                platformCheckResults.every((result) => result.exitCode === 0) &&\n                checkResults.every((result) => result.exitCode === 0);\n              const providerImage = passed\n                ? await buildVerifiedRigProviderImage({\n                    settings: runSettings,\n                    db,\n                    observability,\n                    accountId: rig.accountId,\n                    workspaceId: input.workspaceId,\n                    existingVersionId: version.id,\n                    definition: version,\n                    target: { kind: \"version\", id: version.id },\n                    established,\n                    ownership: runContext.ownership,\n                    lifecycle,\n                    signal: runContext.signal,\n                  })\n                : null;\n              await recordRigAuditEvent(db, {\n                grant,\n                action: passed ? \"rig.verification.passed\" : \"rig.verification.failed\",\n                rigId: rig.id,\n                metadata: {\n                  versionId: version.id,\n                  startedAt,\n                  finishedAt: new Date().toISOString(),\n                  passed,\n                  platformCheckResults,\n                  checkResults,\n                  providerImage,\n                },\n              });\n              return {\n                versionId: version.id,\n                passed,\n                platformCheckResults,\n                checkResults,\n                providerImage,\n              };\n            },\n          );\n        } catch (error) {\n          // Infra failure (sandbox establish / setup / check exec threw) — record\n          // rig.verification.failed so activeVersionHealth reflects the failed\n          // re-run instead of staying stale, symmetric to verifyRigChange. Then\n          // rethrow so the Temporal activity still surfaces the failure.\n          const detail = error instanceof Error ? error.message : String(error);\n          await recordRigAuditEvent(db, {\n            grant,\n            action: \"rig.verification.failed\",\n            rigId: rig.id,\n            metadata: {\n              versionId: version.id,\n              startedAt,\n              finishedAt: new Date().toISOString(),\n              passed: false,\n              error: detail,\n            },\n          });\n          throw error;\n        }\n      }),\n  };\n}\n","import { getScheduledTaskClaudeProviderAccountAuthoritySnapshot } from \"@opengeni/db\";\nimport {\n  ATLASSIAN_NATIVE_RETIRED_REASON,\n  isRetiredNativeAtlassianTask,\n} from \"@opengeni/contracts/atlassian-native-retirement\";\nimport { GOOGLE_DRIVE_PUBLICATION_SERVER_ID } from \"@opengeni/contracts/google-drive\";\nimport { PERSONAL_GITHUB_CONNECTION_SURFACE_ID } from \"@opengeni/contracts/personal-github\";\nimport {\n  AUTOMATIC_SESSION_TITLE_FALLBACK,\n  DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,\n  OPENGENI_SLACK_BOT_CREDENTIAL_LABEL,\n  OPENGENI_SLACK_BOT_CREDENTIAL_ROLE,\n  OPENGENI_SLACK_BOT_SESSION_METADATA_KEY,\n  resolveWorkspaceCodexCompactionDefault,\n  SCHEDULED_TASK_OCCURRENCE_PAYLOAD_MAX_BYTES,\n  ScheduledTaskRunAcceptedExecution,\n  SessionAgentAccess,\n  SessionMemoryScope,\n  normalizeAutomaticSessionTitle,\n  metadataWithTurnExecutionPolicyV1,\n  mergeResourceRefs,\n  resolveWorkspaceSessionToolDefaults,\n  scheduledOccurrencePayloadUtf8Bytes,\n  stableJson,\n  TurnExecutionPolicyV1,\n  type McpConnectionAccountSelection,\n  type ScheduledTask,\n  type ScheduledTaskDegradedAccount,\n  type ScheduledTaskRun,\n  type ResolvedAgentConfig,\n} from \"@opengeni/contracts\";\nimport {\n  openGeniSlackBotMetadata,\n  requireOpenGeniSlackBotConnection,\n  withScheduledSlackBotPostingTools,\n  resolveWorkspaceCatalogSettings,\n  resolveScheduledTaskDefaultModel,\n  resolveSessionToolPolicy,\n  workspaceCustomModelReference,\n  lockActiveCustomModelForAdmission,\n  scheduledSlackBotConnectionId,\n  freezeConnectionAccounts,\n  ConnectionAccountSelectionError,\n  scheduledConnectionSurfaceEligibility,\n  scheduledConnectionTools,\n  scheduledTaskRunTools,\n  settingsWithEnabledCapabilityMcpServers,\n  settingsWithSessionMcpServerMetadata,\n  swapActiveSandbox,\n  applySessionAgentConfigWriteThrough,\n  resolveSessionAgentConfigForCreate,\n  recordSessionCreated,\n  recordUserMessageAccepted,\n  type ProductUsageMetricsSink,\n} from \"@opengeni/core\";\nimport {\n  appendSessionEvents,\n  addSessionSystemUpdateWithSourceMutation,\n  bindScheduledTaskRunSessionInTransaction,\n  checkSessionUsageLimitAdmission,\n  createScheduledTaskRun,\n  recordScheduledTaskAdmissionFailure,\n  recordScheduledTaskAdmissionRefusal,\n  type ScheduledTaskAdmissionRefusalReason,\n  createSession,\n  createSessionWithIdempotencyKeyResult,\n  enqueueSessionWorkflowWakeIfRunnable,\n  failScheduledGeneratedSessionRoute,\n  getScheduledTask,\n  getScheduledTaskCreatorPolicy,\n  getScheduledTaskRunAcceptedExecution,\n  getScheduledTaskRunByProducerKey,\n  getScheduledTargetSessionExecution,\n  getScheduledTaskRunPersonalResourceAuthority,\n  getScheduledTaskPersonalResourceAuthoritySubject,\n  getScheduledTaskRevisionAuthority,\n  getScheduledTaskSubscriptionAuthority,\n  getScheduledTaskXaiProviderAccountAuthoritySnapshot,\n  getEnrollment,\n  getSandbox,\n  getSessionAuthorityEpoch,\n  issueSelfUserResourceGrant,\n  listSelfUserResourceAuthorities,\n  getRig,\n  getScheduledScopedRigVersionMetadata,\n  getNestedAgentDepthDeploymentPolicy,\n  getSessionByCreateIdempotencyKey,\n  getSessionCreationExecutionPolicy,\n  metadataWithAgentConfigCreateIdentity,\n  getVariableSet,\n  isCodexBilledModel,\n  initializeSessionStartAtomically,\n  materializeScheduledTaskReusableSessionFromRun,\n  listInstalledApiIntegrationServerIdsForDelegations,\n  markScheduledTaskRunFailedIfQueued,\n  markScheduledTaskRunSkippedIfQueued,\n  recordUsageEvent,\n  requireScheduledTaskIncidentAuthorityInTransaction,\n  requireSession,\n  requireWorkspace,\n  settleScheduledTaskRunInTransaction,\n  SessionSpawnDeniedDbError,\n  updateSessionTitleWithEvent,\n  upsertScheduledSessionGoalForRun,\n  withSessionActivityRlsContext,\n  withWorkspaceSubjectRls,\n} from \"@opengeni/db\";\nimport { publishDurableSessionEvents } from \"@opengeni/events\";\nimport {\n  allowedFirstPartyMcpToolsForSession,\n  resolveSessionFirstPartyMcpTools,\n  resolveFirstPartyMcpToolPolicy,\n  resolveTurnExecutionPolicyV1,\n  TurnExecutionPolicyModelUnavailableError,\n} from \"@opengeni/config\";\nimport { Context } from \"@temporalio/activity\";\nimport { createHash } from \"node:crypto\";\nimport {\n  assertReusableSessionRevivable,\n  scheduledUserMessagePayload,\n  workflowIdForSession,\n} from \"./common\";\nimport { withFirstPartyTools } from \"./goals\";\nimport { agentRunAdmissionDenial } from \"./agent-run-admission\";\nimport {\n  scheduledAlertOccurrenceIdentity,\n  scheduledAlertResponderSessionCreateIdempotencyKey,\n} from \"../scheduled-alert-occurrence\";\nimport {\n  evaluateIncidentTelemetryPreflight,\n  incidentTelemetryAuthorityFence,\n  incidentTelemetryPreflightDeclaration,\n  INCIDENT_TELEMETRY_AUTHORITY_FENCE_LINEAGE_KEY,\n  type IncidentTelemetryPreflightBlockReason,\n} from \"./incident-telemetry-preflight\";\nimport { resolveIncidentTelemetryResponderMetadata } from \"./incident-telemetry-authority\";\nimport type {\n  ControlActivityServices,\n  DispatchScheduledTaskRunInput,\n  DispatchScheduledTaskRunResult,\n  WakeSessionWorkflowSignal,\n} from \"./types\";\nimport type { Database } from \"@opengeni/db\";\n\ntype ScheduledTemporalActivityIdentity = {\n  namespace: string;\n  workflowExecution?: { workflowId: string; runId: string };\n  activityId: string;\n};\n\nexport function scheduledTaskRunExecutionPolicy(\n  policy: TurnExecutionPolicyV1,\n  input: DispatchScheduledTaskRunInput,\n  creatorRestriction?: \"developer_setup\",\n): TurnExecutionPolicyV1 {\n  return creatorRestriction === \"developer_setup\" ||\n    (input.triggerType !== \"scheduled\" && input.credentialRestriction === \"developer_setup\")\n    ? { ...policy, credentialRestriction: \"developer_setup\" }\n    : policy;\n}\n\n/** Only a creator ceiling is standing; a manual caller ceiling is per-run. */\nexport function scheduledSessionExecutionPolicyMetadata(\n  policy: unknown,\n  creatorRestriction?: \"developer_setup\",\n): Record<string, unknown> {\n  if (policy === undefined || policy === null) return {};\n  const acceptedPolicy = TurnExecutionPolicyV1.parse(policy);\n  return creatorRestriction === \"developer_setup\" &&\n    acceptedPolicy.credentialRestriction === \"developer_setup\"\n    ? metadataWithTurnExecutionPolicyV1({}, acceptedPolicy)\n    : {};\n}\n\nexport function scheduledTaskRunProducerKey(\n  input: DispatchScheduledTaskRunInput,\n  suppliedActivityIdentity?: ScheduledTemporalActivityIdentity,\n): string {\n  if (input.producerKey) return input.producerKey;\n  if (input.triggerType !== \"scheduled\") return input.agentRunUsageIdempotencyKey;\n\n  let info = suppliedActivityIdentity;\n  if (!info) {\n    try {\n      info = Context.current().info;\n    } catch {\n      throw new Error(\n        \"scheduled task delivery without a producer key requires a Temporal activity execution\",\n      );\n    }\n  }\n  if (!info.workflowExecution) {\n    throw new Error(\"scheduled task Temporal activity is missing its workflow execution identity\");\n  }\n  return `scheduled-temporal:${stableJson({\n    namespace: info.namespace,\n    workflowId: info.workflowExecution.workflowId,\n  })}`;\n}\n\nexport function scheduledTaskGeneratedSessionCreateIdempotencyKey(producerKey: string): string {\n  const digest = createHash(\"sha256\")\n    .update(\"scheduled-task-run\\0\", \"utf8\")\n    .update(producerKey, \"utf8\")\n    .digest(\"hex\");\n  return `scheduled-task-run:${digest}`;\n}\n\n/**\n * Display title for a session the scheduler generates for a task.\n *\n * A scheduled session's `initialMessage` is the task prompt, byte-identical for\n * every run. The task name is the short human-chosen label that actually\n * identifies it, so that is the title.\n *\n * The title is the task name and NOTHING else. It deliberately does not name the\n * run's fire instant, for two independent reasons:\n *\n *   - No run mode guarantees one run per session. `reusable_session` generates\n *     its session on the first fire and then reuses it forever, and even under\n *     `new_session_per_run` alert-occurrence redelivery converges several runs\n *     onto one canonical responder session. `existing_session` never generates a\n *     session at all, so the scheduler never titles one. A run-specific fact\n *     frozen into the title is therefore right for the generating run and a lie\n *     for every run that lands in the same session afterwards.\n *   - A title is one stored string shown to every viewer, while every surface\n *     that renders a run's fire instant renders it viewer-local: the rail row\n *     prints the title beside `relativeTimeLabel(session.updatedAt)`, and the\n *     Schedules run list prints `formatTimestamp(run.firedAt)`, which is\n *     `toLocaleString()`. A wall clock stored in the title therefore disagrees\n *     with the time printed next to it for every viewer outside whichever zone\n *     it was rendered in. The task's own `timeZone` is no escape: it labels the\n *     schedule rule (\"Mon Wed 09:00 Europe/Oslo\"), not the rendering of a run,\n *     which stays viewer-local. No stored clock can agree with a viewer-local\n *     one, so the title carries none and the instant stays on the surfaces that\n *     already render it correctly.\n *\n * Dropping the clock settles the determinism constraint outright rather than\n * working around it: the same run titled by the normal dispatch or by a later\n * recovery in a different worker process derives one string from `task.name`\n * alone, with no Intl call and so no host ICU or tzdata build to make the two\n * texts differ.\n */\n/** A scheduler-generated run session: a service-created root session. */\nfunction recordScheduledSessionCreated(observability: ProductUsageMetricsSink | undefined): void {\n  recordSessionCreated(observability, {\n    surface: \"scheduled\",\n    createdByKind: \"service\",\n    parentSessionId: null,\n  });\n}\n\nexport function scheduledTaskSessionTitle(taskName: string): string {\n  return normalizeAutomaticSessionTitle(taskName) ?? \"Scheduled run\";\n}\n\n/**\n * Title a session the scheduler generated, and emit the same `session.title_set`\n * event every other title write in the product emits.\n *\n * This uses the same database operation as `@opengeni/core`\n * `updateSessionTitle`: the clobber/CAS guarded row update and its identical\n * `session.title_set` append commit together under the session event lock. A\n * newer writer therefore cannot land between the authoritative row change and\n * an older event. Without the event a live subscriber sees nothing:\n * `packages/react/src/hooks/use-session.ts` patches an open session's title\n * exclusively on `session.title_set`, so a bare row write leaves the viewer on\n * the stale title until an unrelated refetch.\n *\n * The core wrapper itself is not called, because its only additional behavior is\n * `requireSessionAuthorization(grant, ...)` - a check on an HTTP/MCP caller's\n * grant. The scheduler has no such grant; it is naming a session it just created\n * itself moments earlier. Satisfying that gate would mean fabricating a subject,\n * and the gate would then answer for it: a session later transitioned to\n * `user_private` denies any actor whose subject is not the owner\n * (`packages/core/src/session-authorization.ts`), which would turn naming a\n * session into a way to fail a dispatch. Authorization belongs to callers with\n * grants; the durable write and its event are the part that is shared.\n *\n * Only the neutral create fallback is replaced. A keyed create replay can hand\n * back a session that has already run, and recovery re-enters this path for a\n * session the dead dispatch may already have titled; in both cases whatever the\n * agent or a human chose is newer truth than this stamp. The fallback check is\n * part of the UPDATE itself, not a stale session-object precheck, so a title\n * committed between dispatch read and stamp cannot be overwritten.\n *\n * `source: \"agent\"` is deliberate, and is the only system-assigned value the\n * schema offers (`Session.titleSource` is \"user\" | \"agent\" | null). The database\n * clobber guard pins only a `user` title, so this title still lets the agent\n * rename its own session through set_session_title, and a human rename still\n * wins permanently. Writing \"user\" here would quietly make every scheduled\n * session unrenameable by the agent that runs in it.\n *\n * Returns the appended events so the caller can route them through the same\n * defer-or-publish path as every other event this dispatch produces.\n */\nexport async function stampScheduledSessionTitle(\n  db: Database,\n  input: {\n    workspaceId: string;\n    sessionId: string;\n    taskName: string;\n  },\n): Promise<Awaited<ReturnType<typeof updateSessionTitleWithEvent>>[\"events\"]> {\n  const title = scheduledTaskSessionTitle(input.taskName);\n  const result = await updateSessionTitleWithEvent(db, {\n    workspaceId: input.workspaceId,\n    sessionId: input.sessionId,\n    title,\n    source: \"agent\",\n    expectedCurrent: {\n      title: AUTOMATIC_SESSION_TITLE_FALLBACK,\n      source: \"agent\",\n    },\n  });\n  return result.events;\n}\n\nexport function createScheduledTaskActivities(services: () => Promise<ControlActivityServices>) {\n  return {\n    dispatchScheduledTaskRun: async (\n      input: DispatchScheduledTaskRunInput,\n    ): Promise<DispatchScheduledTaskRunResult> => {\n      const baseService = await services();\n      // Histories created before the manual-initiator workflow patch already\n      // contain this activity command. Reject their incomplete wire input here\n      // so replay consumes the recorded command and the retry loop settles.\n      if (input.triggerType !== \"scheduled\" && !input.initiator) {\n        return { action: \"blocked\", reason: \"malformed_manual_trigger\" };\n      }\n      const { db, bus, wakeSessionWorkflow } = baseService;\n      const settingsForTask = async (task: ScheduledTask, retainedProductModelId?: string | null) =>\n        (\n          await resolveWorkspaceCatalogSettings(\n            db,\n            baseService.catalogSourceSettings ?? baseService.settings,\n            {\n              accountId: task.accountId,\n              workspaceId: task.workspaceId,\n              ...(retainedProductModelId !== undefined ? { retainedProductModelId } : {}),\n            },\n          )\n        ).settings;\n      const stableProducerKey = scheduledTaskRunProducerKey(input);\n      const priorRun = await getScheduledTaskRunByProducerKey(db, {\n        workspaceId: input.workspaceId,\n        taskId: input.taskId,\n        triggerType: input.triggerType,\n        producerKey: stableProducerKey,\n      });\n      if (priorRun?.actionKind === \"agent_turn\") {\n        if (priorRun.admissionDiagnostic || priorRun.admissionRefusal) {\n          return scheduledAdmissionRefusalResult(priorRun);\n        }\n        const acceptedExecution = await getScheduledTaskRunAcceptedExecution(db, {\n          workspaceId: input.workspaceId,\n          runId: priorRun.id,\n        });\n        if (!acceptedExecution) {\n          if (\n            priorRun.status === \"succeeded\" ||\n            priorRun.status === \"failed\" ||\n            priorRun.status === \"skipped\"\n          ) {\n            return scheduledRunTerminalResult(priorRun.error);\n          }\n          throw new Error(\"scheduled agent run is missing accepted execution truth\");\n        }\n        if (priorRun.status === \"queued\" && isRetiredNativeAtlassianTask(acceptedExecution.task)) {\n          await markScheduledTaskRunFailedIfQueued(\n            db,\n            priorRun.workspaceId,\n            priorRun.id,\n            ATLASSIAN_NATIVE_RETIRED_REASON,\n          );\n          return scheduledRunTerminalResult(ATLASSIAN_NATIVE_RETIRED_REASON);\n        }\n        await recordScheduledTaskFiredUsage(db, acceptedExecution, priorRun);\n        if (priorRun.status === \"dispatched\") {\n          return await replayScheduledTaskDispatch({\n            db,\n            wakeSessionWorkflow,\n            task: acceptedExecution.task,\n            run: priorRun,\n            acceptedExecution,\n          });\n        }\n        if (priorRun.status === \"queued\") {\n          const acceptedPolicy = acceptedExecution.turnExecutionPolicy\n            ? TurnExecutionPolicyV1.parse(acceptedExecution.turnExecutionPolicy)\n            : null;\n          const settings = await settingsForTask(\n            acceptedExecution.task,\n            acceptedPolicy?.productModelId ??\n              acceptedExecution.targetSessionExecution?.model ??\n              acceptedExecution.resolvedModel,\n          );\n          try {\n            return await recoverBoundScheduledTaskDispatch({\n              db,\n              observability: baseService.observability,\n              bus,\n              settings,\n              wakeSessionWorkflow,\n              run: priorRun,\n              acceptedExecution,\n              input,\n            });\n          } catch (error) {\n            const terminalError = scheduledRunRecoveryTerminalError(error);\n            if (!terminalError) throw error;\n            await markScheduledTaskRunFailedIfQueued(\n              db,\n              priorRun.workspaceId,\n              priorRun.id,\n              terminalError.code,\n            );\n            return scheduledRunTerminalResult(terminalError.code);\n          }\n        }\n        if (priorRun.status === \"succeeded\") {\n          if (!priorRun.sessionId || !priorRun.triggerEventId) {\n            throw new Error(\"succeeded scheduled run is missing its delivery identity\");\n          }\n          return {\n            action: acceptedExecution.task.runMode === \"new_session_per_run\" ? \"start\" : \"signal\",\n            accountId: acceptedExecution.task.accountId,\n            workspaceId: acceptedExecution.task.workspaceId,\n            sessionId: priorRun.sessionId,\n            triggerEventId: priorRun.triggerEventId,\n            workflowId: workflowIdForSession(priorRun.sessionId),\n            workflowWakeRevision: null,\n          };\n        }\n        if (priorRun.status === \"failed\" || priorRun.status === \"skipped\") {\n          return scheduledRunTerminalResult(priorRun.error);\n        }\n      }\n      const task = await getScheduledTask(db, input.workspaceId, input.taskId);\n      // Deleting a schedule is authoritative. A fire workflow that was already\n      // created may still start afterward; completing it as a no-op prevents an\n      // unbounded retry loop for work that no longer exists.\n      if (!task) {\n        return { action: \"deleted\" };\n      }\n      if (isRetiredNativeAtlassianTask(task))\n        return { action: \"blocked\", reason: ATLASSIAN_NATIVE_RETIRED_REASON };\n      if (task.action.kind !== \"agent_turn\") {\n        return { action: \"blocked\", reason: \"legacy_source_schedule_requires_migration\" };\n      }\n      if (task.status !== \"active\") {\n        return { action: \"blocked\", reason: \"scheduled_task_paused\" };\n      }\n      if (task.agentConfig.knowledgeSource && knowledgeSourceSyncEffectivelyPaused(task)) {\n        return { action: \"blocked\", reason: \"knowledge_source_paused\" };\n      }\n      const structuredAlertOccurrence = scheduledAlertOccurrenceIdentity({\n        workspaceId: task.workspaceId,\n        scheduledTaskId: task.id,\n        metadata: task.metadata,\n      });\n      const alertOccurrence =\n        task.runMode === \"new_session_per_run\" ? structuredAlertOccurrence : null;\n      const alertResponderSessionCreateIdempotencyKey = alertOccurrence\n        ? scheduledAlertResponderSessionCreateIdempotencyKey({\n            occurrence: alertOccurrence,\n            taskAuthorityRevision: task.authorityRevision,\n            taskExecutionDigest: task.executionDigest,\n          })\n        : null;\n      const incidentDeclaration = incidentTelemetryPreflightDeclaration(\n        task.agentConfig,\n        structuredAlertOccurrence !== null,\n      );\n      if (incidentDeclaration.action === \"blocked\") {\n        return incidentDeclaration;\n      }\n      const taskPersonalResourceAuthoritySubjectId =\n        await getScheduledTaskPersonalResourceAuthoritySubject(db, {\n          accountId: task.accountId,\n          workspaceId: task.workspaceId,\n          taskId: task.id,\n          taskAuthorityRevision: task.authorityRevision,\n        });\n      const taskRevisionAuthority = await getScheduledTaskRevisionAuthority(db, {\n        accountId: task.accountId,\n        workspaceId: task.workspaceId,\n        taskId: task.id,\n        taskAuthorityRevision: task.authorityRevision,\n      });\n      const taskAuthoritySubjectId = task.ownerSubjectId;\n      // Every pre-admission refusal below is recorded as a visible run receipt\n      // under this producer identity instead of throwing (a thrown activity is\n      // retried to exhaustion and leaves no run) or returning a bare blocked\n      // result (the occurrence silently disappears). Terminal refusals are\n      // deterministic for this task revision and digest; transient ones\n      // (`retryable`) are skipped and a later occurrence is admitted normally.\n      // Redelivery replays the same receipt, so no occurrence gets two runs.\n      const refuseAdmission = async (\n        reason: ScheduledTaskAdmissionRefusalReason,\n        retryable: boolean,\n        detail: string,\n      ): Promise<DispatchScheduledTaskRunResult> => {\n        console.warn(\n          `[scheduled-task] refused occurrence of ${task.id} (revision ${task.authorityRevision}): ${reason}: ${detail}`,\n        );\n        const receipt = await recordScheduledTaskAdmissionRefusal(db, {\n          workspaceId: task.workspaceId,\n          taskId: task.id,\n          taskAuthorityRevision: task.authorityRevision,\n          taskExecutionDigest: task.executionDigest,\n          triggerType: input.triggerType,\n          producerKey: stableProducerKey,\n          reason,\n          retryable,\n        });\n        if (!receipt.admissionRefusal) {\n          // A concurrent delivery accepted this producer first. Follow the\n          // existing exact-receipt recovery path, never replace its outcome.\n          return createScheduledTaskActivities(services).dispatchScheduledTaskRun(input);\n        }\n        return scheduledAdmissionRefusalResult(receipt);\n      };\n      if (\n        task.action.kind === \"agent_turn\" &&\n        ((taskRevisionAuthority?.subjectId ?? null) !== taskAuthoritySubjectId ||\n          [taskPersonalResourceAuthoritySubjectId].some(\n            (subject) => subject !== null && subject !== taskAuthoritySubjectId,\n          ))\n      ) {\n        return await refuseAdmission(\n          \"scheduled_authority_unavailable\",\n          false,\n          \"scheduled authority differs from its immutable execution owner\",\n        );\n      }\n      const acceptedTargetSessionId =\n        task.runMode === \"existing_session\"\n          ? task.targetSessionId\n          : task.runMode === \"reusable_session\"\n            ? task.reusableSessionId\n            : null;\n      // A targeted task whose exact session was deleted has no target to\n      // resolve; database admission settles that occurrence terminally\n      // (`scheduled_target_session_unavailable`) instead of retrying forever.\n      // Resolve this before the catalog so an existing session's retired\n      // custom Gateway model remains executable without becoming selectable\n      // for a new scheduled session.\n      const targetSessionExecutionBase = acceptedTargetSessionId\n        ? await getScheduledTargetSessionExecution(\n            db,\n            task.workspaceId,\n            acceptedTargetSessionId,\n            taskAuthoritySubjectId,\n          )\n        : null;\n      const settings = await settingsForTask(task, targetSessionExecutionBase?.model);\n      // A task that names no model resolves the new-chat default at each fresh\n      // occurrence (saved workspace default, then a usable connected\n      // subscription under the task's frozen SuperGrok authority, then the\n      // credits default while the organization holds a credit balance, then the\n      // deployment default). A frozen SuperGrok pool that is gone only means\n      // SuperGrok is not ready. The accepted execution freezes the result, so\n      // retries and recovery never resolve again. Existing-session runs keep\n      // that session's model.\n      const resolvedDefault =\n        task.agentConfig.model || targetSessionExecutionBase\n          ? null\n          : await resolveScheduledTaskDefaultModel(db, settings, task);\n      const model = task.agentConfig.model ?? resolvedDefault?.model ?? settings.openaiModel;\n      const reasoningEffort =\n        task.agentConfig.reasoningEffort ??\n        resolvedDefault?.reasoningEffort ??\n        settings.openaiReasoningEffort;\n      let sandboxBackend = task.agentConfig.sandboxBackend ?? settings.sandboxBackend;\n      let sandboxOs: \"linux\" | \"macos\" | \"windows\" = \"linux\";\n      // A schedule that follows the workspace defaults gets them as they are\n      // now, from the owner's registry; nothing about them was saved with it.\n      const runTools = task.agentConfig.toolPolicy\n        ? scheduledTaskRunTools({\n            agentConfig: task.agentConfig,\n            settings,\n            runtimeSettings: await settingsWithEnabledCapabilityMcpServers(\n              db,\n              task.workspaceId,\n              settings,\n              taskAuthoritySubjectId ? { subjectId: taskAuthoritySubjectId } : {},\n            ),\n            workspaceDefaults: resolveWorkspaceSessionToolDefaults(\n              (await requireWorkspace(db, task.workspaceId)).settings,\n            ),\n          })\n        : task.agentConfig.tools;\n      let taskTools = withFirstPartyTools(settings, runTools);\n      // A task created by a live agent attempt froze its creator's effective\n      // first-party selection, permission set, and session access policy;\n      // its generated sessions inherit that boundary under today's\n      // deployment ceiling. A human/API-created task (null policy) keeps the\n      // deployment default exactly as before.\n      const creatorPolicy = await getScheduledTaskCreatorPolicy(db, task.workspaceId, task.id);\n      // A person-chosen Slack channel adds only the two bot posting tools;\n      // they post nowhere else, whatever the creator's own selection was.\n      let firstPartyMcpTools = withScheduledSlackBotPostingTools(\n        creatorPolicy?.firstPartyMcpTools\n          ? allowedFirstPartyMcpToolsForSession(settings, creatorPolicy.firstPartyMcpTools)\n          : resolveFirstPartyMcpToolPolicy(settings).default,\n        task.agentConfig,\n        resolveFirstPartyMcpToolPolicy(settings).allowed,\n      );\n      // Agent configuration for generated sessions (null = legacy). The\n      // scheduled baseline above (creator policy or deployment default) is\n      // what \"all\" reproduces; capabilities only narrow it. Frozen into the\n      // accepted execution so retries and recovery never resolve again.\n      let resolvedAgentConfig: ResolvedAgentConfig | null = null;\n      let resolvedAgentInstructions: string | undefined;\n      const generatedTarget =\n        task.runMode === \"new_session_per_run\" ||\n        (task.runMode === \"reusable_session\" && task.reusableSessionId === null);\n      if (generatedTarget) {\n        try {\n          const agentResolution = resolveSessionAgentConfigForCreate({\n            settings,\n            creator: \"scheduled\",\n            request: task.agentConfig.agent,\n            instructions: undefined,\n            workspaceSettings: (await requireWorkspace(db, task.workspaceId)).settings,\n            parent: null,\n            goal: task.agentConfig.goal !== undefined,\n          });\n          resolvedAgentConfig = agentResolution.config;\n          resolvedAgentInstructions = agentResolution.instructions;\n          const written = applySessionAgentConfigWriteThrough({\n            config: resolvedAgentConfig,\n            firstPartyMcpTools,\n            tools: taskTools,\n            toolPolicy: { mode: \"explicit\", inheritedFromSessionId: null },\n            productServerIds: runTools.map((tool) => tool.id),\n          });\n          firstPartyMcpTools = written.firstPartyMcpTools;\n          taskTools = written.tools;\n        } catch (error) {\n          const status =\n            error instanceof Error ? (error as Error & { status?: unknown }).status : undefined;\n          if (!(error instanceof Error) || status !== 422) throw error;\n          return await refuseAdmission(\n            \"scheduled_authority_unavailable\",\n            false,\n            `scheduled agent configuration is not admissible: ${error.message}`,\n          );\n        }\n      }\n      const firstPartyMcpPermissions = creatorPolicy?.firstPartyMcpPermissions\n        ? [...creatorPolicy.firstPartyMcpPermissions]\n        : [...DEFAULT_FIRST_PARTY_MCP_PERMISSIONS];\n      // A fresh occurrence resolves the immutable owner's current accounts.\n      // Retry/recovery above uses the already accepted occurrence snapshot.\n      const connectionSettings = await settingsWithEnabledCapabilityMcpServers(\n        db,\n        task.workspaceId,\n        settings,\n        taskAuthoritySubjectId ? { subjectId: taskAuthoritySubjectId } : {},\n      );\n      const connectionTarget =\n        acceptedTargetSessionId && targetSessionExecutionBase\n          ? await requireSession(db, task.workspaceId, acceptedTargetSessionId)\n          : null;\n      const toolWorkspaceSettings = (await requireWorkspace(db, task.workspaceId)).settings;\n      let connectionTools = await scheduledConnectionTools(\n        db,\n        task.workspaceId,\n        connectionSettings,\n        connectionTarget,\n        taskTools,\n        taskAuthoritySubjectId ?? undefined,\n      );\n      // Connector accounts resolve live at each fresh occurrence: every\n      // connector uses the owner's current accounts. Only an account a person\n      // pinned on a schedule that starts its own session narrows its\n      // connector. An existing-chat schedule never pins; that chat supplies\n      // its connectors and the owner's current accounts.\n      let runPins: McpConnectionAccountSelection[] =\n        task.runMode === \"existing_session\" ? [] : [...(task.agentConfig.pinnedAccounts ?? [])];\n      const surfaceEligibility = scheduledConnectionSurfaceEligibility(\n        settings,\n        connectionTarget ?? {\n          firstPartyMcpTools,\n          firstPartyMcpPermissions,\n        },\n        toolWorkspaceSettings,\n      );\n      const resolveTaskConnections = () =>\n        freezeConnectionAccounts({\n          db,\n          accountId: task.accountId,\n          workspaceId: task.workspaceId,\n          settings: connectionTarget\n            ? settingsWithSessionMcpServerMetadata(connectionSettings, connectionTarget.mcpServers)\n            : connectionSettings,\n          tools: connectionTools,\n          resources: mergeResourceRefs(\n            connectionTarget?.resources ?? [],\n            task.agentConfig.resources,\n          ),\n          source: taskAuthoritySubjectId\n            ? { kind: \"subject\", subjectId: taskAuthoritySubjectId, accountId: task.accountId }\n            : { kind: \"none\" },\n          authoritySelections: runPins,\n          ...surfaceEligibility,\n        }).catch((error: unknown) => {\n          if (error instanceof ConnectionAccountSelectionError) return error;\n          throw error;\n        });\n      let taskConnections = await resolveTaskConnections();\n      // A pinned account that can no longer be used is never replaced by\n      // another account. Unless the schedule requires its pinned accounts,\n      // the occurrence goes ahead without that connector and records what it\n      // ran without, so its owner can be told; a connector keeps any of its\n      // pins that still work.\n      const degradedAccounts: ScheduledTaskDegradedAccount[] = [];\n      while (\n        taskConnections instanceof ConnectionAccountSelectionError &&\n        task.agentConfig.pinnedAccountsRequired !== true\n      ) {\n        const failure: ConnectionAccountSelectionError = taskConnections;\n        const stale = scheduledStalePins(runPins, failure);\n        // A personal repository pin is bound to the schedule's repository\n        // resources; there is no connector to leave out, so it cannot degrade.\n        if (\n          stale.length === 0 ||\n          stale.some((pin) => pin.serverId === PERSONAL_GITHUB_CONNECTION_SURFACE_ID)\n        ) {\n          break;\n        }\n        degradedAccounts.push(...stale);\n        const staleKeys = new Set(stale.map(scheduledPinKey));\n        const staleServerIds = new Set(stale.map((pin) => pin.serverId));\n        runPins = runPins.filter((pin) => !staleKeys.has(scheduledPinKey(pin)));\n        const droppedServerIds = new Set(\n          [...staleServerIds].filter(\n            (serverId) => !runPins.some((pin) => pin.serverId === serverId),\n          ),\n        );\n        if (droppedServerIds.has(GOOGLE_DRIVE_PUBLICATION_SERVER_ID)) {\n          surfaceEligibility.googleDrivePublicationEnabled = false;\n        }\n        connectionTools = connectionTools.filter(\n          (tool) => !(tool.kind === \"mcp\" && droppedServerIds.has(tool.id)),\n        );\n        taskTools = taskTools.filter(\n          (tool) => !(tool.kind === \"mcp\" && droppedServerIds.has(tool.id)),\n        );\n        taskConnections = await resolveTaskConnections();\n      }\n      if (taskConnections instanceof ConnectionAccountSelectionError) {\n        const receipt = await recordScheduledTaskAdmissionFailure(db, {\n          workspaceId: task.workspaceId,\n          taskId: task.id,\n          taskAuthorityRevision: task.authorityRevision,\n          taskExecutionDigest: task.executionDigest,\n          triggerType: input.triggerType,\n          producerKey: stableProducerKey,\n          diagnostic: taskConnections.diagnostic,\n        });\n        if (!receipt.admissionDiagnostic) {\n          // A concurrent delivery accepted this producer first. Follow the\n          // existing exact-receipt recovery path, never replace its outcome.\n          return createScheduledTaskActivities(services).dispatchScheduledTaskRun(input);\n        }\n        return scheduledAdmissionRefusalResult(receipt);\n      }\n      const {\n        personalConnectionDelegations: taskPersonalConnectionDelegations,\n        mcpAccountBindings: taskMcpAccountBindings,\n        connectionAccountIntent: taskConnectionAccountIntent,\n      } = taskConnections;\n      const taskConnectionAuthoritySubjectId =\n        taskPersonalConnectionDelegations.length > 0 ? taskAuthoritySubjectId : null;\n      const creatorSessionPolicy = scheduledCreatorSessionPolicyInput(\n        creatorPolicy?.sessionPolicy ?? null,\n      );\n      let acceptedPersonalMachine = false;\n      if (generatedTarget && task.agentConfig.machineTarget) {\n        const access = {\n          accountId: task.accountId,\n          workspaceId: task.workspaceId,\n          subjectId: taskAuthoritySubjectId ?? task.createdBy.subjectId,\n        };\n        const machine = await getSandbox(\n          db,\n          access,\n          task.agentConfig.machineTarget.targetSandboxId,\n        );\n        // A personal machine runs only its owner's Only me schedule. The scoped\n        // lookup returns a personal machine to its owner alone, and every attempt\n        // re-proves the owner's membership, workspace access and grant in the\n        // database before the machine is used.\n        if (\n          !machine ||\n          machine.kind !== \"selfhosted\" ||\n          !machine.enrollmentId ||\n          (machine.scope === \"user\" && !personalMachineScheduleOwner(task, access.subjectId))\n        ) {\n          return await refuseAdmission(\n            \"machine_target_unavailable\",\n            false,\n            \"scheduled Connected Machine target is unavailable\",\n          );\n        }\n        const enrollment = await getEnrollment(db, access, machine.enrollmentId);\n        if (!enrollment) {\n          return await refuseAdmission(\n            \"machine_target_unavailable\",\n            false,\n            \"scheduled Connected Machine enrollment is gone\",\n          );\n        }\n        if (enrollment.status !== \"active\") {\n          // A paused/suspended enrollment can be re-activated; skip this\n          // occurrence rather than failing the schedule.\n          return await refuseAdmission(\n            \"machine_enrollment_inactive\",\n            true,\n            `scheduled Connected Machine enrollment is ${enrollment.status}`,\n          );\n        }\n        sandboxBackend = \"selfhosted\";\n        sandboxOs = enrollment.os;\n        acceptedPersonalMachine = machine.scope === \"user\";\n      } else if (generatedTarget && sandboxBackend === \"selfhosted\") {\n        return await refuseAdmission(\n          \"machine_target_unavailable\",\n          false,\n          \"self-hosted scheduled task has no Connected Machine target\",\n        );\n      }\n      const generatedSessionDepthPolicy = generatedTarget\n        ? await (async () => {\n            const workspace = await requireWorkspace(db, task.workspaceId);\n            const deployment = await getNestedAgentDepthDeploymentPolicy(db);\n            const taskOverride = task.agentConfig.maxNestedAgentDepth ?? null;\n            const workspaceOverride =\n              typeof workspace.settings.maxNestedAgentDepth === \"number\"\n                ? workspace.settings.maxNestedAgentDepth\n                : null;\n            return taskOverride !== null\n              ? {\n                  effectiveMaxNestedAgentDepth: taskOverride,\n                  nestedAgentDepthPolicySource: \"session\" as const,\n                  codexCompactionMode: isCodexBilledModel(model)\n                    ? resolveWorkspaceCodexCompactionDefault(workspace.settings)\n                    : (\"portable\" as const),\n                }\n              : workspaceOverride !== null\n                ? {\n                    effectiveMaxNestedAgentDepth: workspaceOverride,\n                    nestedAgentDepthPolicySource: \"workspace\" as const,\n                    codexCompactionMode: isCodexBilledModel(model)\n                      ? resolveWorkspaceCodexCompactionDefault(workspace.settings)\n                      : (\"portable\" as const),\n                  }\n                : {\n                    effectiveMaxNestedAgentDepth: deployment.maxNestedAgentDepth,\n                    nestedAgentDepthPolicySource: deployment.policySource,\n                    codexCompactionMode: isCodexBilledModel(model)\n                      ? resolveWorkspaceCodexCompactionDefault(workspace.settings)\n                      : (\"portable\" as const),\n                  };\n          })()\n        : null;\n      const targetSessionExecution = targetSessionExecutionBase\n        ? await (async () => {\n            const apiIntegrationServerIds =\n              await listInstalledApiIntegrationServerIdsForDelegations(\n                db,\n                task.workspaceId,\n                taskPersonalConnectionDelegations,\n              );\n            const availableMcpServerIds = new Set([\n              ...connectionSettings.mcpServers.map((server) => server.id),\n              ...apiIntegrationServerIds,\n            ]);\n            for (const id of targetSessionExecutionBase.mcpServerIds) {\n              availableMcpServerIds.add(id);\n            }\n            const effective = resolveSessionToolPolicy({\n              toolPolicy: targetSessionExecutionBase.toolPolicy,\n              sessionTools: targetSessionExecutionBase.tools,\n              availableMcpServerIds,\n              defaultMcpServerIds: [\n                ...connectionTools.map((tool) => tool.id),\n                ...apiIntegrationServerIds,\n              ],\n            });\n            return {\n              ...targetSessionExecutionBase,\n              effectiveFirstPartyMcpTools: resolveSessionFirstPartyMcpTools(\n                settings,\n                {\n                  ...targetSessionExecutionBase,\n                  ...(connectionTarget ? { agent: connectionTarget.agent } : {}),\n                },\n                toolWorkspaceSettings,\n              ),\n              effectiveMcpServerIds: [\n                ...new Set(\n                  effective.toolRefs.flatMap((tool) => (tool.kind === \"mcp\" ? [tool.id] : [])),\n                ),\n              ].sort(),\n            };\n          })()\n        : null;\n      const acceptedVariableSet =\n        generatedTarget && task.variableSetId\n          ? await getVariableSet(\n              db,\n              {\n                accountId: task.accountId,\n                workspaceId: task.workspaceId,\n                // Organization/workspace sets have no personal-resource causal\n                // subject. The scoped resolver still permits those common\n                // scopes for a service/legacy actor, while a user-owned set can\n                // only resolve through the exact frozen 0252 subject.\n                subjectId: taskAuthoritySubjectId ?? task.createdBy.subjectId,\n              },\n              task.variableSetId,\n            )\n          : null;\n      if (generatedTarget && task.variableSetId && !acceptedVariableSet) {\n        return await refuseAdmission(\n          \"variable_set_unavailable\",\n          false,\n          `variable set not found: ${task.variableSetId}`,\n        );\n      }\n      const acceptedRig =\n        generatedTarget && task.rigId\n          ? await getRig(\n              db,\n              {\n                accountId: task.accountId,\n                workspaceId: task.workspaceId,\n                subjectId: taskAuthoritySubjectId ?? task.createdBy.subjectId,\n              },\n              task.rigId,\n            )\n          : null;\n      if (generatedTarget && task.rigId && (!acceptedRig || !acceptedRig.activeVersion)) {\n        return await refuseAdmission(\n          \"rig_version_unavailable\",\n          false,\n          `sandbox environment has no active version to bind: ${task.rigId}`,\n        );\n      }\n      const acceptedRigDefaultVariableSetRows = acceptedRig?.activeVersion\n        ? await Promise.all(\n            acceptedRig.activeVersion.defaultVariableSetIds.map(async (variableSetId) => ({\n              variableSetId,\n              variableSet: await getVariableSet(\n                db,\n                {\n                  accountId: task.accountId,\n                  workspaceId: task.workspaceId,\n                  subjectId: taskAuthoritySubjectId ?? task.createdBy.subjectId,\n                },\n                variableSetId,\n              ),\n            })),\n          )\n        : [];\n      const missingRigDefaultVariableSet = acceptedRigDefaultVariableSetRows.find(\n        (row) => !row.variableSet,\n      );\n      if (missingRigDefaultVariableSet) {\n        return await refuseAdmission(\n          \"variable_set_unavailable\",\n          false,\n          `sandbox environment default Variable Set not found: ${missingRigDefaultVariableSet.variableSetId}`,\n        );\n      }\n      const acceptedRigDefaultVariableSets = acceptedRigDefaultVariableSetRows.map(\n        ({ variableSet }) => ({ id: variableSet!.id, generation: variableSet!.generation }),\n      );\n      let incidentPreflightRequired = incidentDeclaration.action === \"required\";\n      if (incidentPreflightRequired) {\n        const existingSessionId =\n          task.runMode === \"existing_session\" ? task.targetSessionId : task.reusableSessionId;\n        const canonicalAlertSession =\n          task.runMode === \"new_session_per_run\" && alertOccurrence\n            ? await getSessionByCreateIdempotencyKey(\n                db,\n                task.workspaceId,\n                alertResponderSessionCreateIdempotencyKey!,\n              )\n            : null;\n        const responderSession = existingSessionId\n          ? await requireSession(db, task.workspaceId, existingSessionId)\n          : canonicalAlertSession;\n        const responder = await resolveIncidentTelemetryResponderMetadata({\n          db,\n          settings,\n          task,\n          session: responderSession,\n          personalConnectionDelegations: taskPersonalConnectionDelegations,\n          plannedTools: taskTools,\n          personalResourceAuthoritySubjectId: taskAuthoritySubjectId,\n          executionPolicy: targetSessionExecution\n            ? {\n                tools: targetSessionExecution.tools,\n                firstPartyMcpTools:\n                  targetSessionExecution.effectiveFirstPartyMcpTools ??\n                  targetSessionExecution.firstPartyMcpTools,\n                firstPartyMcpPermissions: targetSessionExecution.firstPartyMcpPermissions,\n                rigId: targetSessionExecution.rigId,\n                rigVersionId: targetSessionExecution.rigVersionId,\n                toolPolicy: targetSessionExecution.toolPolicy,\n                mcpServerIds: targetSessionExecution.mcpServerIds,\n                toolPolicyVersion: targetSessionExecution.toolPolicyVersion,\n              }\n            : {\n                tools: taskTools,\n                firstPartyMcpTools,\n                firstPartyMcpPermissions,\n                rigId: acceptedRig?.id ?? null,\n                rigVersionId: acceptedRig?.activeVersion?.id ?? null,\n                toolPolicy: responderSession?.toolPolicy ?? {\n                  mode: \"explicit\",\n                  inheritedFromSessionId: null,\n                },\n                mcpServerIds: [],\n                toolPolicyVersion: responderSession?.toolPolicyVersion ?? null,\n              },\n        });\n        const preflight = evaluateIncidentTelemetryPreflight({\n          agentConfig: task.agentConfig,\n          incidentTriggered: structuredAlertOccurrence !== null,\n          alertOccurrenceLabels: structuredAlertOccurrence?.labels ?? null,\n          responder,\n        });\n        if (preflight.action === \"blocked\") return preflight;\n        incidentPreflightRequired = preflight.action === \"ready\";\n      }\n      const taskXaiProviderAccountAuthoritySnapshot =\n        await getScheduledTaskXaiProviderAccountAuthoritySnapshot(db, task.workspaceId, task.id);\n      const taskClaudeProviderAccountAuthoritySnapshot =\n        await getScheduledTaskClaudeProviderAccountAuthoritySnapshot(db, task.workspaceId, task.id);\n      // Codex v2 (M3 PR 3b, EP-T15): the task's value frozen at creation,\n      // copied by every firing; empty when another person authorized the\n      // current revision. Never recomputed from current membership.\n      const taskSubscriptionAuthority = await getScheduledTaskSubscriptionAuthority(db, {\n        workspaceId: task.workspaceId,\n        taskId: task.id,\n        revisionAuthorizerSubjectId: taskRevisionAuthority?.subjectId ?? null,\n        taskAuthorityRevision: task.authorityRevision,\n      });\n      // A scheduled bot selection was authorized when the task was written,\n      // but connection status and tenant/role binding are mutable. Revalidate\n      // before any session/model cost and never fall back to a personal Slack\n      // OAuth grant when the selected bot has been revoked or changed.\n      const slackBotConnection = task.agentConfig.slackBotConnectionId\n        ? await requireOpenGeniSlackBotConnection(\n            db,\n            task.workspaceId,\n            task.agentConfig.slackBotConnectionId,\n          )\n        : null;\n      const slackBotMetadata = slackBotConnection\n        ? openGeniSlackBotMetadata(slackBotConnection.metadata)\n        : null;\n      if (slackBotConnection && !slackBotMetadata) {\n        throw new Error(\"Opengeni Slack bot connection metadata is invalid\");\n      }\n      const xaiAuthoritySubjectId =\n        taskXaiProviderAccountAuthoritySnapshot.scope === \"user\" &&\n        task.createdBy.kind === \"subject\"\n          ? task.createdBy.subjectId\n          : null;\n      if (taskXaiProviderAccountAuthoritySnapshot.scope === \"user\" && !xaiAuthoritySubjectId) {\n        return await refuseAdmission(\n          \"scheduled_authority_unavailable\",\n          false,\n          \"scheduled user-scoped xAI authority has no causal human\",\n        );\n      }\n      if (\n        xaiAuthoritySubjectId &&\n        taskAuthoritySubjectId &&\n        xaiAuthoritySubjectId !== taskAuthoritySubjectId\n      ) {\n        return await refuseAdmission(\n          \"scheduled_authority_unavailable\",\n          false,\n          \"scheduled authority classes have different causal humans\",\n        );\n      }\n      const claudeAuthoritySubjectId =\n        taskClaudeProviderAccountAuthoritySnapshot.scope === \"user\" && task.ownerSubjectId\n          ? task.ownerSubjectId\n          : null;\n      if (\n        taskClaudeProviderAccountAuthoritySnapshot.scope === \"user\" &&\n        !claudeAuthoritySubjectId\n      ) {\n        return await refuseAdmission(\n          \"scheduled_authority_unavailable\",\n          false,\n          \"scheduled user-scoped Claude authority has no causal human\",\n        );\n      }\n      if (\n        claudeAuthoritySubjectId &&\n        taskAuthoritySubjectId &&\n        claudeAuthoritySubjectId !== taskAuthoritySubjectId\n      ) {\n        return await refuseAdmission(\n          \"scheduled_authority_unavailable\",\n          false,\n          \"scheduled authority classes have different causal humans\",\n        );\n      }\n      const causalHumanSubjectId =\n        taskAuthoritySubjectId ?? xaiAuthoritySubjectId ?? claudeAuthoritySubjectId;\n      if (\n        xaiAuthoritySubjectId &&\n        claudeAuthoritySubjectId &&\n        xaiAuthoritySubjectId !== claudeAuthoritySubjectId\n      )\n        return await refuseAdmission(\n          \"scheduled_authority_unavailable\",\n          false,\n          \"scheduled subscription pools have different causal humans\",\n        );\n      if (\n        task.agentConfig.knowledgeSource &&\n        causalHumanSubjectId !== task.agentConfig.knowledgeSource.initiatingSubjectId\n      ) {\n        return await refuseAdmission(\n          \"scheduled_authority_unavailable\",\n          false,\n          \"Source schedule requires its connection owner's current human authorization; update the source schedule to authorize it\",\n        );\n      }\n      // Workspace/organization Variable Sets and Rigs run through ordinary\n      // workspace authority; only a user-owned resource needs the exact frozen\n      // human, and the database admission fence re-proves the same rule for\n      // existing/warm targets.\n      // A personal machine additionally needs that human to be the machine's owner.\n      const personalResourceSelected =\n        acceptedVariableSet?.scope === \"user\" ||\n        acceptedRig?.scope === \"user\" ||\n        acceptedPersonalMachine;\n      if (\n        (personalResourceSelected && !causalHumanSubjectId) ||\n        (acceptedPersonalMachine && causalHumanSubjectId !== task.ownerSubjectId)\n      ) {\n        return await refuseAdmission(\n          \"scheduled_authority_unavailable\",\n          false,\n          \"scheduled personal-resource execution has no causal human\",\n        );\n      }\n      const admissionDenial = await agentRunAdmissionDenial(\n        { ...baseService, settings },\n        {\n          accountId: task.accountId,\n          workspaceId: task.workspaceId,\n          model: targetSessionExecution?.model ?? model,\n          requestedAgentRuns: input.agentRunUsageIdempotencyKey ? 0 : 1,\n          initiatingHumanSubjectId: causalHumanSubjectId,\n        },\n      );\n      if (admissionDenial) {\n        // Credits and monthly limits clear on their own (top-up, new period):\n        // skip this occurrence visibly; a later one is admitted normally.\n        return await refuseAdmission(admissionDenial, true, \"agent run admission denied\");\n      }\n      if (acceptedTargetSessionId && targetSessionExecutionBase) {\n        // An occurrence that targets an existing task tree counts against\n        // that task's usage limit. A reached limit skips the occurrence\n        // visibly (no message, turn or wake is appended) until a person raises\n        // or clears the limit; an unreadable state throws for activity retry,\n        // never admitting as unlimited.\n        const usageLimit = await checkSessionUsageLimitAdmission(db, {\n          accountId: task.accountId,\n          workspaceId: task.workspaceId,\n          sessionId: acceptedTargetSessionId,\n          runtime: true,\n        });\n        if (!usageLimit.allowed) {\n          return await refuseAdmission(\n            \"session_usage_limit\",\n            true,\n            \"the target task reached its usage limit\",\n          );\n        }\n      }\n      const acceptedModel = targetSessionExecution?.model ?? model;\n      const acceptedReasoningEffort = targetSessionExecution?.reasoningEffort ?? reasoningEffort;\n      const acceptedLatencyMode = targetSessionExecution?.latencyMode ?? \"standard\";\n      const acceptedCustomModel = generatedTarget\n        ? workspaceCustomModelReference(settings, acceptedModel)\n        : null;\n      const beforeFreshAgentRunCommit = acceptedCustomModel\n        ? async (tx: Database): Promise<void> => {\n            // Admission reads the task's accepted Claude authority (its\n            // carrier) as the person accountable for the task. The subject is\n            // scoped to this check and restored afterwards.\n            const active = await withWorkspaceSubjectRls(\n              tx,\n              task.workspaceId,\n              causalHumanSubjectId ?? task.ownerSubjectId ?? task.createdBy.subjectId,\n              async (scoped) =>\n                await lockActiveCustomModelForAdmission(scoped, {\n                  accountId: task.accountId,\n                  workspaceId: task.workspaceId,\n                  reference: acceptedCustomModel,\n                  claudeAuthority: {\n                    authoritySnapshot: taskClaudeProviderAccountAuthoritySnapshot,\n                    scheduledTaskId: task.id,\n                  },\n                }),\n            );\n            if (!active) {\n              throw new ScheduledRunTerminalAuthorityError(\n                \"scheduled_model_unavailable\",\n                `model is not available: ${acceptedModel}`,\n              );\n            }\n          }\n        : undefined;\n      let acceptedTurnExecutionPolicy: ReturnType<typeof resolveTurnExecutionPolicyV1>;\n      try {\n        acceptedTurnExecutionPolicy = resolveTurnExecutionPolicyV1(settings, {\n          modelId: acceptedModel,\n          requestedModelId:\n            generatedTarget && task.agentConfig.model ? task.agentConfig.model : null,\n          modelSource: generatedTarget\n            ? task.agentConfig.model\n              ? \"explicit\"\n              : \"deployment\"\n            : \"session\",\n          reasoningEffort: acceptedReasoningEffort,\n          reasoningSource: generatedTarget\n            ? task.agentConfig.reasoningEffort\n              ? \"explicit\"\n              : \"deployment\"\n            : \"session\",\n          latencyMode: acceptedLatencyMode,\n          latencyModeSource: generatedTarget ? \"deployment\" : \"session\",\n        });\n      } catch (error) {\n        // A retired or removed model refuses every occurrence until the task\n        // (or its target session) names an available model: record that as a\n        // visible terminal run instead of exhausting activity retries.\n        if (!(error instanceof TurnExecutionPolicyModelUnavailableError)) throw error;\n        return await refuseAdmission(\n          \"scheduled_model_unavailable\",\n          false,\n          `${error.message}: ${acceptedModel}`,\n        );\n      }\n      const turnExecutionPolicy = scheduledTaskRunExecutionPolicy(\n        acceptedTurnExecutionPolicy,\n        input,\n        creatorPolicy?.credentialRestriction,\n      );\n      const deferredEvents: Array<{\n        sessionId: string;\n        events: Awaited<ReturnType<typeof appendSessionEvents>>;\n      }> = [];\n      const executeDispatch = async (dispatchDb: Database, deferPublications: boolean) => {\n        const admittedRunId = crypto.randomUUID();\n        const generatedSessionBinding = generatedTarget\n          ? {\n              createIdempotencyKey:\n                alertResponderSessionCreateIdempotencyKey ??\n                (task.runMode === \"reusable_session\"\n                  ? `scheduled-task-reusable:${task.id}:${task.authorityRevision}:${task.executionDigest}`\n                  : scheduledTaskGeneratedSessionCreateIdempotencyKey(stableProducerKey)),\n              effectiveMaxNestedAgentDepth:\n                generatedSessionDepthPolicy!.effectiveMaxNestedAgentDepth,\n              nestedAgentDepthPolicySource:\n                generatedSessionDepthPolicy!.nestedAgentDepthPolicySource,\n              codexCompactionMode: generatedSessionDepthPolicy!.codexCompactionMode,\n            }\n          : null;\n        const acceptedExecution: ScheduledTaskRunAcceptedExecution = {\n          version: 1,\n          task,\n          resolvedModel: model,\n          resolvedReasoningEffort: reasoningEffort,\n          resolvedLatencyMode: \"standard\",\n          turnExecutionPolicy,\n          resolvedSandboxBackend: sandboxBackend,\n          resolvedSandboxOs: sandboxOs,\n          resolvedTools: taskTools,\n          resolvedFirstPartyMcpTools: firstPartyMcpTools,\n          resolvedFirstPartyMcpPermissions: firstPartyMcpPermissions,\n          ...(resolvedAgentConfig\n            ? {\n                resolvedAgentConfig,\n                ...(resolvedAgentInstructions !== undefined ? { resolvedAgentInstructions } : {}),\n              }\n            : {}),\n          resolvedVariableSet: acceptedVariableSet\n            ? { id: acceptedVariableSet.id, generation: acceptedVariableSet.generation }\n            : null,\n          resolvedRig: acceptedRig?.activeVersion\n            ? {\n                id: acceptedRig.id,\n                versionId: acceptedRig.activeVersion.id,\n                defaultVariableSets: acceptedRigDefaultVariableSets,\n              }\n            : null,\n          resolvedSlackBotConnection:\n            slackBotConnection && slackBotMetadata && slackBotConnection.verifiedInstallVersion\n              ? {\n                  id: slackBotConnection.id,\n                  version: slackBotConnection.version,\n                  verifiedInstallVersion: slackBotConnection.verifiedInstallVersion,\n                  metadata: slackBotMetadata,\n                }\n              : null,\n          targetSessionExecution,\n          generatedSessionBinding,\n          personalConnectionDelegations: taskPersonalConnectionDelegations,\n          mcpAccountBindings: taskMcpAccountBindings,\n          personalResourceAuthoritySubjectId: taskPersonalResourceAuthoritySubjectId,\n          causalHumanSubjectId,\n          causalHumanAuthority: taskRevisionAuthority,\n          xaiProviderAccountAuthoritySnapshot: taskXaiProviderAccountAuthoritySnapshot,\n          claudeProviderAccountAuthoritySnapshot: taskClaudeProviderAccountAuthoritySnapshot,\n          xaiAuthoritySubjectId,\n          claudeAuthoritySubjectId,\n          connectionAuthoritySubjectId: taskConnectionAuthoritySubjectId,\n          ...(degradedAccounts.length > 0 ? { degradedAccounts } : {}),\n          connectionAccountIntent: taskConnectionAccountIntent,\n          triggerInitiator: input.initiator ?? { kind: \"service\", subjectId: \"scheduler\" },\n          agentRunUsageIdempotencyKey: input.agentRunUsageIdempotencyKey ?? null,\n          incidentPreflightRequired,\n          alertOccurrenceLabels: structuredAlertOccurrence?.labels ?? null,\n        };\n        // The accepted snapshot is immutable execution truth. A legacy task\n        // whose stored shape can no longer be represented as a bounded\n        // accepted execution is a deterministic, operator-visible block, not a\n        // retryable activity failure that would silently drop the occurrence.\n        const acceptedExecutionParse =\n          ScheduledTaskRunAcceptedExecution.safeParse(acceptedExecution);\n        if (\n          !acceptedExecutionParse.success ||\n          scheduledOccurrencePayloadUtf8Bytes({\n            prompt: task.agentConfig.prompt,\n            resources: task.agentConfig.resources,\n            tools: taskTools,\n          }) > SCHEDULED_TASK_OCCURRENCE_PAYLOAD_MAX_BYTES\n        ) {\n          return {\n            kind: \"blocked\" as const,\n            result: {\n              action: \"blocked\" as const,\n              reason: \"scheduled_execution_unrepresentable\" as const,\n            },\n          };\n        }\n        let run = await createScheduledTaskRun(dispatchDb, {\n          runId: admittedRunId,\n          workspaceId: task.workspaceId,\n          taskId: task.id,\n          taskAuthorityRevision: task.authorityRevision,\n          taskExecutionDigest: task.executionDigest,\n          triggerType: input.triggerType,\n          producerKey: stableProducerKey,\n          scheduledAt: null,\n          acceptedExecutionSnapshot: acceptedExecution,\n          ...(beforeFreshAgentRunCommit ? { beforeFreshAgentRunCommit } : {}),\n        });\n        await recordScheduledTaskFiredUsage(dispatchDb, acceptedExecution, run);\n        if (run.status === \"failed\" && run.error === \"scheduled_authority_exhausted\") {\n          return {\n            kind: \"blocked\" as const,\n            result: {\n              action: \"blocked\" as const,\n              reason: \"scheduled_authority_exhausted\" as const,\n            },\n            run,\n          };\n        }\n        if (run.status === \"failed\" || run.status === \"skipped\") {\n          return {\n            kind: \"blocked\" as const,\n            result: scheduledRunTerminalResult(run.error),\n            run,\n          };\n        }\n        const runPersonalResourceAuthority = await getScheduledTaskRunPersonalResourceAuthority(\n          dispatchDb,\n          {\n            accountId: task.accountId,\n            workspaceId: task.workspaceId,\n            runId: run.id,\n          },\n        );\n        if (run?.status === \"dispatched\" && run.sessionId && run.triggerEventId) {\n          if (deferPublications) {\n            return { kind: \"replay\" as const, run, acceptedExecution };\n          }\n          await recordUsageEvent(dispatchDb, {\n            accountId: task.accountId,\n            workspaceId: task.workspaceId,\n            eventType: \"agent_run.created\",\n            quantity: 1,\n            unit: \"run\",\n            sourceResourceType: \"scheduled_task_run\",\n            sourceResourceId: run.id,\n            sessionId: run.sessionId,\n            initiator: acceptedExecution.triggerInitiator,\n            initiatorContext: {\n              scheduledTaskId: task.id,\n              scheduledTaskRunId: run.id,\n            },\n            origin: \"scheduled_task\",\n            idempotencyKey:\n              acceptedExecution.agentRunUsageIdempotencyKey ??\n              `usage:agent_run.created:scheduled:${run.id}`,\n          });\n          const workflowId = workflowIdForSession(run.sessionId);\n          const workflowWakeRevision = await enqueueSessionWorkflowWakeIfRunnable(dispatchDb, {\n            accountId: task.accountId,\n            workspaceId: task.workspaceId,\n            sessionId: run.sessionId,\n            temporalWorkflowId: workflowId,\n            reason: \"scheduled_retry\",\n          });\n          const result = {\n            action: task.runMode === \"new_session_per_run\" ? \"start\" : \"signal\",\n            accountId: task.accountId,\n            workspaceId: task.workspaceId,\n            sessionId: run.sessionId,\n            triggerEventId: run.triggerEventId,\n            workflowId,\n            workflowWakeRevision,\n          } as const;\n          return { kind: \"complete\" as const, result, run };\n        }\n        let result: DispatchScheduledTaskRunResult;\n        try {\n          if (incidentPreflightRequired) {\n            const exactAuthority = await requireScheduledTaskIncidentAuthorityInTransaction(\n              dispatchDb,\n              {\n                workspaceId: task.workspaceId,\n                taskId: task.id,\n              },\n            );\n            if (stableJson(exactAuthority) !== stableJson(task)) {\n              throw new IncidentTelemetryPreflightBlockedError(\n                \"incident_preflight_metadata_missing\",\n              );\n            }\n          }\n          const goalSpec = task.agentConfig.goal ?? null;\n          // Every dispatch carries the first-party MCP server; runtime visibility\n          // still follows the session's exact selection and authorization.\n          const existingSessionId =\n            task.runMode === \"existing_session\" ? task.targetSessionId : task.reusableSessionId;\n          if (task.runMode === \"existing_session\" && !existingSessionId) {\n            throw new Error(\"scheduled task target session is unavailable\");\n          }\n          if (\n            task.runMode === \"new_session_per_run\" ||\n            (task.runMode === \"reusable_session\" && !existingSessionId)\n          ) {\n            // The FK on scheduled_tasks.variable_set_id is ON DELETE RESTRICT, so\n            // an attached variableSet must still exist here; fail closed if not.\n            const variableSet = acceptedVariableSet;\n            if (task.variableSetId && !variableSet) {\n              throw new Error(`variable set not found: ${task.variableSetId}`);\n            }\n            // RIG BINDING (M3): resolve the task's rig to its CURRENTLY-ACTIVE\n            // version at FIRE time (not task-create time) and freeze that version\n            // onto the new session — a task always runs the rig's latest active\n            // version. A deleted rig FK-nulls task.rigId (rig-less run); a rig that\n            // somehow has no active version fails the fire closed.\n            let frozenRigId: string | null = null;\n            let frozenRigVersionId: string | null = null;\n            if (task.rigId) {\n              const rig = acceptedRig;\n              if (!rig || !rig.activeVersion) {\n                throw new Error(`sandbox environment has no active version to bind: ${task.rigId}`);\n              }\n              frozenRigId = rig.id;\n              frozenRigVersionId =\n                runPersonalResourceAuthority?.resources.find(\n                  (resource) => resource.resourceKind === \"rig\" && resource.resourceId === rig.id,\n                )?.resourceVersionId ?? rig.activeVersion.id;\n              if (frozenRigVersionId !== rig.activeVersion.id) {\n                throw new Error(\n                  \"scheduled run sandbox environment version changed during admission\",\n                );\n              }\n            }\n            let session: Awaited<ReturnType<typeof createSession>>;\n            let sessionCreated = true;\n            const taskMetadata = { ...task.agentConfig.metadata };\n            delete taskMetadata[OPENGENI_SLACK_BOT_SESSION_METADATA_KEY];\n            try {\n              const sessionInput: Parameters<typeof createSession>[1] = {\n                accountId: task.accountId,\n                workspaceId: task.workspaceId,\n                initialMessage: task.agentConfig.prompt,\n                resources: task.agentConfig.resources,\n                bundledSkillIds: task.agentConfig.bundledSkillIds,\n                tools: taskTools,\n                firstPartyMcpTools,\n                firstPartyMcpPermissions,\n                ...(resolvedAgentConfig ? { agentConfig: resolvedAgentConfig } : {}),\n                ...(resolvedAgentInstructions !== undefined\n                  ? { instructions: resolvedAgentInstructions }\n                  : {}),\n                ...creatorSessionPolicy,\n                ...(task.agentConfig.knowledgeSource?.destination.kind === \"personal\" ||\n                task.visibility === \"private\"\n                  ? {\n                      visibility: \"user_private\" as const,\n                      scheduledSourceRunId: run.id,\n                    }\n                  : {}),\n                metadata: {\n                  ...taskMetadata,\n                  ...scheduledSessionExecutionPolicyMetadata(\n                    turnExecutionPolicy,\n                    creatorPolicy?.credentialRestriction,\n                  ),\n                  model,\n                  reasoningEffort,\n                  scheduledTaskId: task.id,\n                  scheduledTaskRunMode: task.runMode,\n                  ...(goalSpec ? { scheduledTaskGoal: goalSpec } : {}),\n                  ...(run ? { scheduledTaskRunId: run.id } : {}),\n                  ...(slackBotConnection\n                    ? {\n                        [OPENGENI_SLACK_BOT_SESSION_METADATA_KEY]: slackBotConnection.id,\n                      }\n                    : {}),\n                },\n                createdBy: {\n                  kind: \"service\",\n                  subjectId: \"scheduler\",\n                  label: \"OpenGeni scheduler\",\n                },\n                createdByContext: {\n                  scheduledTaskId: task.id,\n                  ...(run ? { scheduledTaskRunId: run.id } : {}),\n                },\n                model,\n                reasoningEffort,\n                latencyMode: \"standard\",\n                sandboxBackend,\n                sandboxOs,\n                variableSetId: task.variableSetId ?? null,\n                // The schedule's vault narrowing lives on the run session so every\n                // later turn and every child inherits it through the policy chain.\n                ...(task.vaultPolicy ? { vaultPolicy: task.vaultPolicy } : {}),\n                rigId: frozenRigId,\n                rigVersionId: frozenRigVersionId,\n                personalConnectionDelegations: [],\n                initialXaiProviderAccountAuthoritySnapshot: taskXaiProviderAccountAuthoritySnapshot,\n                initialClaudeProviderAccountAuthoritySnapshot:\n                  taskClaudeProviderAccountAuthoritySnapshot,\n                maxNestedAgentDepthOverride: task.agentConfig.maxNestedAgentDepth ?? null,\n                frozenNestedAgentDepthPolicy: {\n                  effectiveMaxNestedAgentDepth:\n                    generatedSessionBinding!.effectiveMaxNestedAgentDepth,\n                  nestedAgentDepthPolicySource:\n                    generatedSessionBinding!.nestedAgentDepthPolicySource,\n                },\n                frozenCodexCompactionMode: generatedSessionBinding!.codexCompactionMode,\n                // The durable agent config was privilege-checked when the task\n                // was created/updated. Preserve that explicit policy if a broader\n                // workspace/deployment limit is narrowed before a later fire.\n                allowNestedAgentDepthIncrease: true,\n                subjectId: `scheduled_task:${task.id}`,\n                beforeCreateCommit: async (tx, sessionId) => {\n                  if (incidentPreflightRequired) {\n                    const exactSession = await requireSession(tx, task.workspaceId, sessionId);\n                    const exactResponder = await resolveIncidentTelemetryResponderMetadata({\n                      db: tx,\n                      settings,\n                      task: acceptedExecution.task,\n                      session: exactSession,\n                      personalConnectionDelegations:\n                        acceptedExecution.personalConnectionDelegations,\n                      personalResourceAuthoritySubjectId:\n                        acceptedExecution.personalResourceAuthoritySubjectId,\n                      executionPolicy: {\n                        tools: exactSession.tools,\n                        firstPartyMcpTools: exactSession.firstPartyMcpTools,\n                        firstPartyMcpPermissions: exactSession.firstPartyMcpPermissions,\n                        rigId: exactSession.rigId,\n                        rigVersionId: exactSession.rigVersionId,\n                        toolPolicy: exactSession.toolPolicy,\n                        mcpServerIds: exactSession.mcpServers.map((server) => server.id),\n                        toolPolicyVersion: exactSession.toolPolicyVersion,\n                      },\n                    });\n                    const exactPreflight = evaluateIncidentTelemetryPreflight({\n                      agentConfig: acceptedExecution.task.agentConfig,\n                      incidentTriggered: structuredAlertOccurrence !== null,\n                      alertOccurrenceLabels: structuredAlertOccurrence?.labels ?? null,\n                      responder: exactResponder,\n                    });\n                    if (exactPreflight.action === \"blocked\") {\n                      throw new IncidentTelemetryPreflightBlockedError(exactPreflight.reason);\n                    }\n                  }\n                  await bindScheduledTaskRunSessionInTransaction(tx, {\n                    accountId: task.accountId,\n                    workspaceId: task.workspaceId,\n                    runId: run.id,\n                    sessionId,\n                  });\n                },\n              };\n              const created = await createSessionWithIdempotencyKeyResult(dispatchDb, {\n                ...sessionInput,\n                createIdempotencyKey: generatedSessionBinding!.createIdempotencyKey,\n              });\n              if (created.denied) {\n                throw new SessionSpawnDeniedDbError(created.denial);\n              }\n              session = created.session;\n              sessionCreated = created.created;\n              if (sessionCreated) recordScheduledSessionCreated(baseService.observability);\n              if (!sessionCreated) {\n                await bindScheduledTaskRunSessionInTransaction(dispatchDb, {\n                  accountId: task.accountId,\n                  workspaceId: task.workspaceId,\n                  runId: run.id,\n                  sessionId: session.id,\n                });\n                run = { ...run, sessionId: session.id };\n              }\n            } catch (error) {\n              if (error instanceof IncidentTelemetryPreflightBlockedError) {\n                throw error;\n              }\n              if (error instanceof SessionSpawnDeniedDbError) {\n                throw new Error(`${error.denial.code}: denial=${error.denial.id}`, {\n                  cause: error,\n                });\n              }\n              throw error;\n            }\n            const scheduledRun = run;\n            if (!sessionCreated) {\n              assertReusableSessionRevivable(session.status);\n              if ((session.variableSetId ?? null) !== (task.variableSetId ?? null)) {\n                throw new Error(\n                  \"scheduled alert occurrence variableSet attachment does not match its canonical session\",\n                );\n              }\n              if (\n                scheduledSlackBotConnectionId(session.metadata) !==\n                (task.agentConfig.slackBotConnectionId ?? null)\n              ) {\n                throw new Error(\n                  \"scheduled alert occurrence Opengeni Slack bot binding does not match its canonical session\",\n                );\n              }\n            }\n            session = await seedScheduledGeneratedSessionRoute({\n              db: dispatchDb,\n              bus,\n              settings,\n              task,\n              runId: run.id,\n              session,\n              deferPublications,\n              deferredEvents,\n            });\n            let workflowId: string;\n            if (alertOccurrence) {\n              const started = await initializeSessionStartAtomically(dispatchDb, {\n                accountId: task.accountId,\n                workspaceId: task.workspaceId,\n                sessionId: session.id,\n                reasoningEffortFallback: reasoningEffort,\n                initialSubscriptionAuthority: taskSubscriptionAuthority,\n                createdEventPayload: {\n                  scheduledTaskId:\n                    typeof session.metadata.scheduledTaskId === \"string\"\n                      ? session.metadata.scheduledTaskId\n                      : task.id,\n                  scheduledTaskRunId:\n                    typeof session.metadata.scheduledTaskRunId === \"string\"\n                      ? session.metadata.scheduledTaskRunId\n                      : run.id,\n                  // Names/ids only; never values.\n                  ...(variableSet\n                    ? {\n                        variableSetId: variableSet.id,\n                        variableSetName: variableSet.name,\n                      }\n                    : {}),\n                  ...(slackBotConnection && slackBotMetadata\n                    ? {\n                        slackBotConnection: {\n                          credentialRole: OPENGENI_SLACK_BOT_CREDENTIAL_ROLE,\n                          credentialLabel: OPENGENI_SLACK_BOT_CREDENTIAL_LABEL,\n                          connectionId: slackBotConnection.id,\n                          slackTeamId: slackBotMetadata.slackTeamId,\n                        },\n                      }\n                    : {}),\n                },\n                goal: goalSpec\n                  ? {\n                      text: goalSpec.text,\n                      successCriteria: goalSpec.successCriteria ?? null,\n                      maxAutoContinuations: goalSpec.maxAutoContinuations ?? null,\n                      ...(goalSpec.mutationPolicy\n                        ? { mutationPolicy: goalSpec.mutationPolicy }\n                        : {}),\n                      createdBy: \"scheduled_task\",\n                    }\n                  : null,\n                deferInitialTurn: true,\n                deferredStatus: \"queued\",\n              });\n              workflowId = started.temporalWorkflowId;\n              if (started.events.length > 0) {\n                if (deferPublications) {\n                  deferredEvents.push({\n                    sessionId: session.id,\n                    events: started.events,\n                  });\n                } else {\n                  await publishDurableSessionEvents(\n                    bus,\n                    task.workspaceId,\n                    session.id,\n                    started.events,\n                  );\n                }\n              }\n            } else {\n              const started = await initializeSessionStartAtomically(dispatchDb, {\n                accountId: task.accountId,\n                workspaceId: task.workspaceId,\n                sessionId: session.id,\n                reasoningEffortFallback: reasoningEffort,\n                initialSubscriptionAuthority: taskSubscriptionAuthority,\n                createdEventPayload: {\n                  scheduledTaskId:\n                    typeof session.metadata.scheduledTaskId === \"string\"\n                      ? session.metadata.scheduledTaskId\n                      : task.id,\n                  scheduledTaskRunId:\n                    typeof session.metadata.scheduledTaskRunId === \"string\"\n                      ? session.metadata.scheduledTaskRunId\n                      : run.id,\n                  // Names/ids only; never values.\n                  ...(variableSet\n                    ? { variableSetId: variableSet.id, variableSetName: variableSet.name }\n                    : {}),\n                  ...(slackBotConnection && slackBotMetadata\n                    ? {\n                        slackBotConnection: {\n                          credentialRole: OPENGENI_SLACK_BOT_CREDENTIAL_ROLE,\n                          credentialLabel: OPENGENI_SLACK_BOT_CREDENTIAL_LABEL,\n                          connectionId: slackBotConnection.id,\n                          slackTeamId: slackBotMetadata.slackTeamId,\n                        },\n                      }\n                    : {}),\n                },\n                goal: goalSpec\n                  ? {\n                      text: goalSpec.text,\n                      successCriteria: goalSpec.successCriteria ?? null,\n                      maxAutoContinuations: goalSpec.maxAutoContinuations ?? null,\n                      ...(goalSpec.mutationPolicy\n                        ? { mutationPolicy: goalSpec.mutationPolicy }\n                        : {}),\n                      createdBy: \"scheduled_task\",\n                    }\n                  : null,\n                deferInitialTurn: true,\n                deferredStatus: \"queued\",\n              });\n              workflowId = started.temporalWorkflowId;\n              if (started.events.length > 0) {\n                if (deferPublications) {\n                  deferredEvents.push({ sessionId: session.id, events: started.events });\n                } else {\n                  await publishDurableSessionEvents(\n                    bus,\n                    task.workspaceId,\n                    session.id,\n                    started.events,\n                  );\n                }\n              }\n              if (task.runMode === \"reusable_session\") {\n                await materializeScheduledTaskReusableSessionFromRun(dispatchDb, {\n                  accountId: task.accountId,\n                  workspaceId: task.workspaceId,\n                  taskId: task.id,\n                  runId: run.id,\n                  sessionId: session.id,\n                  sourceTaskAuthorityRevision:\n                    runPersonalResourceAuthority?.taskAuthorityRevision ??\n                    run.taskAuthorityRevision!,\n                  sourceExecutionDigest:\n                    runPersonalResourceAuthority?.executionDigest ?? run.taskExecutionDigest!,\n                });\n              }\n            }\n            // After both start branches, so the timeline reads session.created\n            // then session.title_set rather than titling a session that has not\n            // announced itself yet. `session.created` is what carries the row\n            // into the rail, and this lands on its heels.\n            const titleEvents = await stampScheduledSessionTitle(dispatchDb, {\n              workspaceId: task.workspaceId,\n              sessionId: session.id,\n              taskName: task.name,\n            });\n            if (titleEvents.length > 0) {\n              if (deferPublications) {\n                deferredEvents.push({ sessionId: session.id, events: titleEvents });\n              } else {\n                await publishDurableSessionEvents(bus, task.workspaceId, session.id, titleEvents);\n              }\n            }\n            const scheduledUpdate = await addSessionSystemUpdateWithSourceMutation(\n              dispatchDb,\n              {\n                accountId: task.accountId,\n                workspaceId: task.workspaceId,\n                sessionId: session.id,\n                kind: \"scheduled_occurrence\",\n                classification: \"info\",\n                sourceId: run.id,\n                dedupeKey: `scheduled-task-run:${run.id}`,\n                summary: task.agentConfig.prompt,\n                payload: scheduledUserMessagePayload(\n                  task.agentConfig.prompt,\n                  task.agentConfig.resources,\n                  taskTools,\n                  task.id,\n                  run.id,\n                  degradedAccounts,\n                ),\n                lineage: {\n                  scheduledTaskId: task.id,\n                  scheduledTaskRunId: run.id,\n                  ...(causalHumanSubjectId ? { causalHumanSubjectId } : {}),\n                  ...(taskConnectionAuthoritySubjectId\n                    ? { connectionAuthoritySubjectId: taskConnectionAuthoritySubjectId }\n                    : {}),\n                  ...(taskXaiProviderAccountAuthoritySnapshot.scope === \"user\" &&\n                  task.createdBy.kind === \"subject\"\n                    ? { xaiAuthoritySubjectId: task.createdBy.subjectId }\n                    : {}),\n                  ...(claudeAuthoritySubjectId ? { claudeAuthoritySubjectId } : {}),\n                },\n                personalConnectionDelegations: taskPersonalConnectionDelegations,\n                mcpAccountBindings: taskMcpAccountBindings,\n                xaiProviderAccountAuthoritySnapshot: taskXaiProviderAccountAuthoritySnapshot,\n                claudeProviderAccountAuthoritySnapshot: taskClaudeProviderAccountAuthoritySnapshot,\n                subscriptionAuthority: taskSubscriptionAuthority,\n                scheduledTaskRunId: run.id,\n              },\n              async (tx, wakeEventId, _updateId, rejectionReason) => {\n                if (!wakeEventId) {\n                  const error = scheduledSessionRejectionError(rejectionReason);\n                  await settleScheduledTaskRunInTransaction(tx, {\n                    workspaceId: task.workspaceId,\n                    runId: scheduledRun.id,\n                    sessionId: session.id,\n                    triggerEventId: null,\n                    status: \"skipped\",\n                    error,\n                  });\n                  return;\n                }\n                await settleScheduledTaskRunInTransaction(tx, {\n                  workspaceId: task.workspaceId,\n                  runId: scheduledRun.id,\n                  sessionId: session.id,\n                  triggerEventId: wakeEventId,\n                  status: \"dispatched\",\n                });\n              },\n              {\n                requireIdleSession: task.overlapPolicy === \"skip\" && !sessionCreated,\n                ...(incidentPreflightRequired\n                  ? {\n                      prepareSource: async (tx, sessionId) =>\n                        await prepareIncidentTelemetrySource({\n                          tx,\n                          settings,\n                          taskId: task.id,\n                          workspaceId: task.workspaceId,\n                          sessionId,\n                          alertOccurrenceLabels: structuredAlertOccurrence?.labels ?? null,\n                          acceptedExecution,\n                        }),\n                    }\n                  : {}),\n              },\n            );\n            if (\n              scheduledUpdate.reason === \"session_cancelled\" ||\n              scheduledUpdate.reason === \"session_not_idle\" ||\n              scheduledUpdate.reason === \"session_paused\"\n            ) {\n              const error = scheduledSessionRejectionError(scheduledUpdate.reason);\n              return {\n                kind: \"blocked\" as const,\n                result: { action: \"blocked\" as const, reason: \"scheduled_run_terminal\" as const },\n                run: { ...run, status: \"skipped\" as const, error },\n              };\n            }\n            if (scheduledUpdate.added) {\n              recordUserMessageAccepted(baseService.observability, { surface: \"scheduled\" });\n            }\n            if (scheduledUpdate.added && scheduledUpdate.events.length > 0) {\n              if (deferPublications) {\n                deferredEvents.push({\n                  sessionId: session.id,\n                  events: scheduledUpdate.events,\n                });\n              } else {\n                await publishDurableSessionEvents(\n                  bus,\n                  task.workspaceId,\n                  session.id,\n                  scheduledUpdate.events,\n                );\n              }\n            }\n            result = {\n              action: sessionCreated ? \"start\" : \"signal\",\n              accountId: task.accountId,\n              workspaceId: task.workspaceId,\n              sessionId: session.id,\n              triggerEventId: scheduledUpdate.wakeEventId,\n              workflowId,\n              workflowWakeRevision: scheduledUpdate.workflowWakeRevision,\n            };\n          } else {\n            if (!run) throw new Error(\"scheduled task run was not created\");\n            const scheduledRun = run;\n            const session = await requireSession(dispatchDb, task.workspaceId, existingSessionId!);\n            await bindScheduledTaskRunSessionInTransaction(dispatchDb, {\n              accountId: task.accountId,\n              workspaceId: task.workspaceId,\n              runId: run.id,\n              sessionId: session.id,\n            });\n            // A user-cancelled (terminal) reusable session must not be revived and\n            // re-billed on the next fire. This cheap check gives an early answer;\n            // the locked admission check below remains authoritative. Mirrors\n            // apps/api/src/domain/sessions.ts.\n            assertReusableSessionRevivable(session.status);\n            // Slack routing remains bound to the reusable chat; execution\n            // attachments come from its accepted target snapshot.\n            assertReusableSessionBindingMatches(session, task);\n            const bundled = await addSessionSystemUpdateWithSourceMutation(\n              dispatchDb,\n              {\n                accountId: task.accountId,\n                workspaceId: task.workspaceId,\n                sessionId: session.id,\n                kind: \"scheduled_occurrence\",\n                classification: \"info\",\n                sourceId: run.id,\n                dedupeKey: `scheduled-task-run:${run.id}`,\n                summary: task.agentConfig.prompt,\n                payload: scheduledUserMessagePayload(\n                  task.agentConfig.prompt,\n                  task.agentConfig.resources,\n                  taskTools,\n                  task.id,\n                  run.id,\n                  degradedAccounts,\n                ),\n                lineage: {\n                  scheduledTaskId: task.id,\n                  scheduledTaskRunId: run.id,\n                  ...(causalHumanSubjectId ? { causalHumanSubjectId } : {}),\n                  ...(taskConnectionAuthoritySubjectId\n                    ? { connectionAuthoritySubjectId: taskConnectionAuthoritySubjectId }\n                    : {}),\n                  ...(taskXaiProviderAccountAuthoritySnapshot.scope === \"user\" &&\n                  task.createdBy.kind === \"subject\"\n                    ? { xaiAuthoritySubjectId: task.createdBy.subjectId }\n                    : {}),\n                  ...(claudeAuthoritySubjectId ? { claudeAuthoritySubjectId } : {}),\n                },\n                personalConnectionDelegations: taskPersonalConnectionDelegations,\n                mcpAccountBindings: taskMcpAccountBindings,\n                xaiProviderAccountAuthoritySnapshot: taskXaiProviderAccountAuthoritySnapshot,\n                claudeProviderAccountAuthoritySnapshot: taskClaudeProviderAccountAuthoritySnapshot,\n                subscriptionAuthority: taskSubscriptionAuthority,\n                scheduledTaskRunId: run.id,\n              },\n              async (tx, wakeEventId, _updateId, rejectionReason) => {\n                if (!wakeEventId) {\n                  const error = scheduledSessionRejectionError(rejectionReason);\n                  await settleScheduledTaskRunInTransaction(tx, {\n                    workspaceId: task.workspaceId,\n                    runId: scheduledRun.id,\n                    sessionId: session.id,\n                    triggerEventId: null,\n                    status: \"skipped\",\n                    error,\n                  });\n                  return;\n                }\n                await settleScheduledTaskRunInTransaction(tx, {\n                  workspaceId: task.workspaceId,\n                  runId: scheduledRun.id,\n                  sessionId: session.id,\n                  triggerEventId: wakeEventId,\n                  status: \"dispatched\",\n                });\n              },\n              {\n                requireIdleSession: task.overlapPolicy === \"skip\",\n                prepareSource: async (tx, sessionId) => {\n                  const goalEvents =\n                    task.runMode === \"reusable_session\" && goalSpec && run.status === \"queued\"\n                      ? await upsertScheduledSessionGoalForRun(tx, {\n                          accountId: task.accountId,\n                          workspaceId: task.workspaceId,\n                          sessionId,\n                          runId: run.id,\n                          text: goalSpec.text,\n                          successCriteria: goalSpec.successCriteria ?? null,\n                          maxAutoContinuations: goalSpec.maxAutoContinuations ?? null,\n                          ...(goalSpec.mutationPolicy\n                            ? { mutationPolicy: goalSpec.mutationPolicy }\n                            : {}),\n                        })\n                      : [];\n                  const incidentSource = incidentPreflightRequired\n                    ? await prepareIncidentTelemetrySource({\n                        tx,\n                        settings,\n                        taskId: task.id,\n                        workspaceId: task.workspaceId,\n                        sessionId,\n                        alertOccurrenceLabels: structuredAlertOccurrence?.labels ?? null,\n                        acceptedExecution,\n                      })\n                    : undefined;\n                  return {\n                    ...(incidentSource ?? {}),\n                    ...(goalEvents.length > 0 ? { events: goalEvents } : {}),\n                  };\n                },\n              },\n            );\n            if (\n              bundled.reason === \"session_cancelled\" ||\n              bundled.reason === \"session_not_idle\" ||\n              bundled.reason === \"session_paused\"\n            ) {\n              const error = scheduledSessionRejectionError(bundled.reason);\n              return {\n                kind: \"blocked\" as const,\n                result: { action: \"blocked\" as const, reason: \"scheduled_run_terminal\" as const },\n                run: { ...run, status: \"skipped\" as const, error },\n              };\n            }\n            if (bundled.added) {\n              recordUserMessageAccepted(baseService.observability, { surface: \"scheduled\" });\n            }\n            if (bundled.added && bundled.events.length > 0) {\n              if (deferPublications) {\n                deferredEvents.push({\n                  sessionId: session.id,\n                  events: bundled.events,\n                });\n              } else {\n                await publishDurableSessionEvents(\n                  bus,\n                  task.workspaceId,\n                  session.id,\n                  bundled.events,\n                );\n              }\n            }\n            result = {\n              action: \"signal\",\n              accountId: task.accountId,\n              workspaceId: task.workspaceId,\n              sessionId: session.id,\n              triggerEventId: bundled.wakeEventId,\n              workflowId: workflowIdForSession(session.id),\n              workflowWakeRevision: bundled.workflowWakeRevision,\n            };\n          }\n        } catch (error) {\n          const terminalError = scheduledRunRecoveryTerminalError(error);\n          if (!terminalError) throw error;\n          await markScheduledTaskRunFailedIfQueued(\n            dispatchDb,\n            task.workspaceId,\n            run.id,\n            terminalError.code,\n          );\n          return {\n            kind: \"blocked\" as const,\n            result: scheduledRunTerminalResult(terminalError.code),\n            run: { ...run, status: \"failed\" as const, error: terminalError.code },\n          };\n        }\n        await recordUsageEvent(dispatchDb, {\n          accountId: task.accountId,\n          workspaceId: task.workspaceId,\n          eventType: \"agent_run.created\",\n          quantity: 1,\n          unit: \"run\",\n          sourceResourceType: \"scheduled_task_run\",\n          sourceResourceId: run.id,\n          sessionId: result.sessionId,\n          initiator: input.initiator ?? {\n            kind: \"service\",\n            subjectId: \"scheduler\",\n          },\n          initiatorContext: {\n            scheduledTaskId: task.id,\n            scheduledTaskRunId: run.id,\n          },\n          origin: \"scheduled_task\",\n          idempotencyKey:\n            input.agentRunUsageIdempotencyKey ?? `usage:agent_run.created:scheduled:${run.id}`,\n        });\n        return { kind: \"complete\" as const, result, run };\n      };\n\n      let dispatchOutcome: Awaited<ReturnType<typeof executeDispatch>>;\n      try {\n        dispatchOutcome = incidentPreflightRequired\n          ? await withSessionActivityRlsContext(\n              db,\n              { accountId: task.accountId, workspaceId: task.workspaceId },\n              async (tx) => await executeDispatch(tx, true),\n            )\n          : await executeDispatch(db, false);\n      } catch (error) {\n        if (error instanceof IncidentTelemetryPreflightBlockedError) {\n          return { action: \"blocked\", reason: error.reason };\n        }\n        const terminalError = scheduledRunRecoveryTerminalError(error);\n        if (terminalError?.code === \"scheduled_model_unavailable\") {\n          // The fresh-run admission rolled back the run insert. Record the\n          // refusal as a visible run so the schedule never fails silently.\n          return await refuseAdmission(\"scheduled_model_unavailable\", false, terminalError.message);\n        }\n        throw error;\n      }\n      if (dispatchOutcome.kind === \"replay\") {\n        return await replayScheduledTaskDispatch({\n          db,\n          wakeSessionWorkflow,\n          task,\n          run: dispatchOutcome.run,\n          acceptedExecution: dispatchOutcome.acceptedExecution,\n        });\n      }\n      for (const deferred of deferredEvents) {\n        await publishDurableSessionEvents(\n          bus,\n          task.workspaceId,\n          deferred.sessionId,\n          deferred.events,\n        );\n      }\n      if (dispatchOutcome.kind === \"blocked\") return dispatchOutcome.result;\n      const result = dispatchOutcome.result;\n      if (wakeSessionWorkflow && result.workflowWakeRevision !== null) {\n        await wakeSessionWorkflow({\n          accountId: result.accountId,\n          workspaceId: result.workspaceId,\n          sessionId: result.sessionId,\n          workflowId: result.workflowId,\n          wakeRevision: result.workflowWakeRevision,\n        });\n      }\n      return result;\n    },\n  };\n}\n\nclass IncidentTelemetryPreflightBlockedError extends Error {\n  constructor(readonly reason: IncidentTelemetryPreflightBlockReason) {\n    super(reason);\n    this.name = \"IncidentTelemetryPreflightBlockedError\";\n  }\n}\n\n/**\n * Defensive backstop for the API-level Slack binding guard. Variable Sets\n * belong to the live target and are fenced by its accepted execution snapshot,\n * not by the task's retained creation defaults.\n */\nfunction assertReusableSessionBindingMatches(\n  session: { metadata: Record<string, unknown> },\n  task: Pick<ScheduledTask, \"runMode\" | \"agentConfig\">,\n): void {\n  // Existing-chat messages use the target policy frozen at admission. Task\n  // creation defaults are not an additional authority or binding constraint.\n  if (task.runMode === \"existing_session\") return;\n  if (\n    scheduledSlackBotConnectionId(session.metadata) !==\n    (task.agentConfig.slackBotConnectionId ?? null)\n  ) {\n    throw new ScheduledRunTerminalAuthorityError(\n      \"scheduled_reusable_binding_changed\",\n      \"scheduled task Opengeni Slack bot binding does not match its reusable session\",\n    );\n  }\n}\n\nclass ScheduledRunTerminalAuthorityError extends Error {\n  constructor(\n    readonly code: string,\n    message: string,\n  ) {\n    super(message);\n    this.name = \"ScheduledRunTerminalAuthorityError\";\n  }\n}\n\nfunction scheduledRunRecoveryTerminalError(\n  error: unknown,\n): ScheduledRunTerminalAuthorityError | null {\n  if (\n    error instanceof Error &&\n    \"cause\" in error &&\n    error.cause !== undefined &&\n    error.cause !== error\n  ) {\n    const nested = scheduledRunRecoveryTerminalError(error.cause);\n    if (nested) return nested;\n  }\n  if (error instanceof ScheduledRunTerminalAuthorityError) return error;\n  if (error instanceof IncidentTelemetryPreflightBlockedError) {\n    return new ScheduledRunTerminalAuthorityError(\n      `scheduled_incident_${error.reason}`,\n      error.message,\n    );\n  }\n  if (error instanceof SessionSpawnDeniedDbError) {\n    return new ScheduledRunTerminalAuthorityError(\"scheduled_session_spawn_denied\", error.message);\n  }\n  if (error instanceof Error && error.message.startsWith(\"Session not found:\")) {\n    return new ScheduledRunTerminalAuthorityError(\n      \"scheduled_target_session_unavailable\",\n      error.message,\n    );\n  }\n  if (typeof error === \"object\" && error !== null && \"status\" in error && error.status === 422) {\n    return new ScheduledRunTerminalAuthorityError(\n      \"scheduled_slack_authority_unavailable\",\n      error instanceof Error ? error.message : \"scheduled Slack authority is unavailable\",\n    );\n  }\n  if (typeof error === \"object\" && error !== null && \"code\" in error && error.code === \"42501\") {\n    return new ScheduledRunTerminalAuthorityError(\n      \"scheduled_run_authority_proof_rejected\",\n      error instanceof Error ? error.message : \"scheduled run authority proof was rejected\",\n    );\n  }\n  return null;\n}\n\nfunction scheduledPinKey(pin: { serverId: string; connectionId: string | null }): string {\n  return JSON.stringify([pin.serverId, pin.connectionId]);\n}\n\n/**\n * The pinned accounts an account-selection failure names. When the owner lost\n * workspace access, none of their pinned accounts can be used.\n */\nfunction scheduledStalePins(\n  pins: readonly McpConnectionAccountSelection[],\n  failure: ConnectionAccountSelectionError,\n): ScheduledTaskDegradedAccount[] {\n  const pinKeys = new Set(pins.map(scheduledPinKey));\n  const named = failure.diagnostic.accounts.flatMap((account) =>\n    pinKeys.has(scheduledPinKey(account))\n      ? [{ serverId: account.serverId, connectionId: account.connectionId, reason: account.reason }]\n      : [],\n  );\n  if (named.length > 0) return named;\n  if (failure.diagnostic.reason === \"owner_access_unavailable\") {\n    return pins.map((pin) => ({\n      serverId: pin.serverId,\n      connectionId: pin.connectionId,\n      reason: \"owner_access_unavailable\" as const,\n    }));\n  }\n  return [];\n}\n\n/** The blocked result of a diagnostic (refused) run receipt, fresh or replayed. */\nfunction scheduledAdmissionRefusalResult(\n  run: Pick<ScheduledTaskRun, \"id\" | \"admissionDiagnostic\" | \"admissionRefusal\">,\n): Extract<DispatchScheduledTaskRunResult, { action: \"blocked\" }> {\n  if (run.admissionRefusal) {\n    return {\n      action: \"blocked\",\n      reason: run.admissionRefusal.reason as ScheduledTaskAdmissionRefusalReason,\n      runId: run.id,\n      refusal: run.admissionRefusal,\n    };\n  }\n  return {\n    action: \"blocked\",\n    reason: \"connection_account_unavailable\",\n    runId: run.id,\n    ...(run.admissionDiagnostic ? { diagnostic: run.admissionDiagnostic } : {}),\n  };\n}\n\nfunction scheduledRunTerminalResult(\n  error: string | null,\n): Extract<DispatchScheduledTaskRunResult, { action: \"blocked\" }> {\n  if (error === ATLASSIAN_NATIVE_RETIRED_REASON)\n    return { action: \"blocked\", reason: ATLASSIAN_NATIVE_RETIRED_REASON };\n  if (error === \"scheduled_authority_exhausted\") {\n    return { action: \"blocked\", reason: \"scheduled_authority_exhausted\" };\n  }\n  if (error === \"scheduled_incident_incident_preflight_metadata_missing\") {\n    return { action: \"blocked\", reason: \"incident_preflight_metadata_missing\" };\n  }\n  if (error === \"scheduled_incident_incident_responder_under_capable\") {\n    return { action: \"blocked\", reason: \"incident_responder_under_capable\" };\n  }\n  if (error === \"scheduled_incident_incident_data_source_unsuitable\") {\n    return { action: \"blocked\", reason: \"incident_data_source_unsuitable\" };\n  }\n  return { action: \"blocked\", reason: \"scheduled_run_terminal\" };\n}\n\nfunction scheduledSessionRejectionError(\n  rejectionReason: \"session_cancelled\" | \"session_not_idle\" | \"session_paused\" | null,\n): \"session_cancelled\" | \"scheduled_session_not_idle\" | \"scheduled_session_paused\" {\n  if (rejectionReason === \"session_paused\") return \"scheduled_session_paused\";\n  return rejectionReason === \"session_not_idle\"\n    ? \"scheduled_session_not_idle\"\n    : \"session_cancelled\";\n}\n\nasync function prepareIncidentTelemetrySource(input: {\n  tx: Database;\n  settings: ControlActivityServices[\"settings\"];\n  taskId: string;\n  workspaceId: string;\n  sessionId: string;\n  alertOccurrenceLabels: Readonly<Record<string, string>> | null;\n  acceptedExecution: ScheduledTaskRunAcceptedExecution;\n}) {\n  const session = await requireSession(input.tx, input.workspaceId, input.sessionId);\n  const { task, personalConnectionDelegations } = input.acceptedExecution;\n  const responder = await resolveIncidentTelemetryResponderMetadata({\n    db: input.tx,\n    settings: input.settings,\n    task,\n    session,\n    personalConnectionDelegations,\n    personalResourceAuthoritySubjectId:\n      input.acceptedExecution.personalResourceAuthoritySubjectId ?? null,\n    executionPolicy: input.acceptedExecution.targetSessionExecution\n      ? {\n          tools: input.acceptedExecution.targetSessionExecution.tools,\n          firstPartyMcpTools:\n            input.acceptedExecution.targetSessionExecution.effectiveFirstPartyMcpTools ??\n            input.acceptedExecution.targetSessionExecution.firstPartyMcpTools,\n          firstPartyMcpPermissions:\n            input.acceptedExecution.targetSessionExecution.firstPartyMcpPermissions,\n          rigId: input.acceptedExecution.targetSessionExecution.rigId,\n          rigVersionId: input.acceptedExecution.targetSessionExecution.rigVersionId,\n          toolPolicy: input.acceptedExecution.targetSessionExecution.toolPolicy,\n          mcpServerIds: input.acceptedExecution.targetSessionExecution.mcpServerIds,\n          toolPolicyVersion: input.acceptedExecution.targetSessionExecution.toolPolicyVersion,\n        }\n      : {\n          tools: input.acceptedExecution.resolvedTools,\n          firstPartyMcpTools: input.acceptedExecution.resolvedFirstPartyMcpTools,\n          firstPartyMcpPermissions: input.acceptedExecution.resolvedFirstPartyMcpPermissions,\n          rigId: input.acceptedExecution.resolvedRig?.id ?? null,\n          rigVersionId: input.acceptedExecution.resolvedRig?.versionId ?? null,\n          toolPolicy: session.toolPolicy,\n          mcpServerIds: [],\n          toolPolicyVersion: session.toolPolicyVersion,\n        },\n  });\n  const preflight = evaluateIncidentTelemetryPreflight({\n    agentConfig: task.agentConfig,\n    incidentTriggered: input.alertOccurrenceLabels !== null,\n    alertOccurrenceLabels: input.alertOccurrenceLabels,\n    responder,\n  });\n  if (preflight.action === \"blocked\") {\n    throw new IncidentTelemetryPreflightBlockedError(preflight.reason);\n  }\n  const fence = incidentTelemetryAuthorityFence({\n    task,\n    responder,\n    alertOccurrenceLabels: input.alertOccurrenceLabels,\n  });\n  if (!fence) {\n    throw new IncidentTelemetryPreflightBlockedError(\"incident_preflight_metadata_missing\");\n  }\n  return {\n    lineage: {\n      [INCIDENT_TELEMETRY_AUTHORITY_FENCE_LINEAGE_KEY]: fence,\n    },\n  };\n}\n\nasync function recordScheduledTaskFiredUsage(\n  db: Database,\n  acceptedExecution: ScheduledTaskRunAcceptedExecution,\n  run: ScheduledTaskRun,\n): Promise<void> {\n  const task = acceptedExecution.task;\n  await recordUsageEvent(db, {\n    accountId: task.accountId,\n    workspaceId: task.workspaceId,\n    eventType: \"scheduled_task.fired\",\n    quantity: 1,\n    unit: \"run\",\n    sourceResourceType: \"scheduled_task_run\",\n    sourceResourceId: run.id,\n    initiator: acceptedExecution.triggerInitiator,\n    initiatorContext: { scheduledTaskId: task.id, scheduledTaskRunId: run.id },\n    origin: \"scheduled_task\",\n    idempotencyKey: `usage:scheduled_task.fired:${run.id}`,\n  });\n}\n\nfunction personalMachineScheduleOwner(task: ScheduledTask, subjectId: string | null): boolean {\n  return (\n    task.visibility === \"private\" &&\n    task.ownerSubjectId !== null &&\n    task.ownerSubjectId === subjectId\n  );\n}\n\n/**\n * The owner and machine authority when an Only me schedule runs on its owner's\n * personal machine; null for a shared machine. Throws when a personal machine is\n * no longer usable by the owner, so the run fails closed.\n */\nasync function scheduledPersonalMachineOwner(\n  db: Database,\n  task: ScheduledTask,\n  target: NonNullable<ScheduledTask[\"agentConfig\"][\"machineTarget\"]>,\n): Promise<{ subjectId: string; authorityId: string } | null> {\n  const subjectId = task.ownerSubjectId;\n  if (task.visibility !== \"private\" || !subjectId) return null;\n  const access = { accountId: task.accountId, workspaceId: task.workspaceId, subjectId };\n  const machine = await getSandbox(db, access, target.targetSandboxId);\n  if (machine?.scope !== \"user\") return null;\n  if (!machine.enrollmentId) {\n    throw new Error(\"scheduled personal Connected Machine has no enrollment\");\n  }\n  let cursor: string | undefined;\n  for (let page = 0; page < 50; page += 1) {\n    const listed = await listSelfUserResourceAuthorities(db, {\n      ...access,\n      resourceKind: \"connected_machine\",\n      limit: 100,\n      ...(cursor ? { cursor } : {}),\n    });\n    const authority = listed.authorities.find(\n      (candidate) => candidate.resourceId === machine.enrollmentId && candidate.status === \"active\",\n    );\n    if (authority) return { subjectId, authorityId: authority.authorityId };\n    if (!listed.nextCursor) break;\n    cursor = listed.nextCursor;\n  }\n  throw new Error(\"scheduled personal Connected Machine authority is not active\");\n}\n\nasync function seedScheduledGeneratedSessionRoute(input: {\n  db: Database;\n  bus: ControlActivityServices[\"bus\"];\n  settings: ControlActivityServices[\"settings\"];\n  task: ScheduledTask;\n  runId: string;\n  session: Awaited<ReturnType<typeof createSession>>;\n  deferPublications: boolean;\n  deferredEvents: Array<{\n    sessionId: string;\n    events: Awaited<ReturnType<typeof appendSessionEvents>>;\n  }>;\n}): Promise<Awaited<ReturnType<typeof createSession>>> {\n  const target = input.task.agentConfig.machineTarget;\n  if (!target) return input.session;\n  const personalOwner = await scheduledPersonalMachineOwner(input.db, input.task, target);\n  const seeded = await swapActiveSandbox(\n    {\n      db: input.db,\n      settings: input.settings,\n      bus: input.bus,\n    },\n    {\n      accountId: input.task.accountId,\n      workspaceId: input.task.workspaceId,\n      sessionId: input.session.id,\n      sessionBackend: input.session.sandboxBackend,\n      sessionGroupId: input.session.sandboxGroupId,\n      // A personal machine attaches through the owner's scoped authorization.\n      ...(personalOwner ? { subjectId: personalOwner.subjectId } : {}),\n    },\n    target.targetSandboxId,\n    target.workingDir ?? null,\n  );\n  if (seeded.swapped) {\n    if (personalOwner) {\n      // Saving an Only me schedule on your own machine is the consent. Each run\n      // gets a grant for exactly its own chat, so other chats keep asking.\n      const authorityEpoch = await getSessionAuthorityEpoch(input.db, {\n        accountId: input.task.accountId,\n        workspaceId: input.task.workspaceId,\n        sessionId: input.session.id,\n      });\n      if (authorityEpoch === null) throw new Error(\"scheduled run chat has no authority epoch\");\n      await issueSelfUserResourceGrant(input.db, {\n        accountId: input.task.accountId,\n        workspaceId: input.task.workspaceId,\n        subjectId: personalOwner.subjectId,\n        authorityId: personalOwner.authorityId,\n        resourceKind: \"connected_machine\",\n        mode: \"session\",\n        context: \"user_private\",\n        sessionId: input.session.id,\n        expectedAuthorityEpoch: authorityEpoch,\n        workspaceSharedAcknowledged: false,\n      });\n    }\n    return await requireSession(input.db, input.task.workspaceId, input.session.id);\n  }\n\n  const failed = await failScheduledGeneratedSessionRoute(input.db, {\n    accountId: input.task.accountId,\n    workspaceId: input.task.workspaceId,\n    taskId: input.task.id,\n    runId: input.runId,\n    sessionId: input.session.id,\n    error: \"scheduled_machine_unavailable\",\n  });\n  if (failed.action === \"advanced\") {\n    throw new Error(\n      `scheduled run advanced to ${failed.status} while its Connected Machine route was being established`,\n    );\n  }\n  if (failed.events.length > 0) {\n    if (input.deferPublications) {\n      input.deferredEvents.push({ sessionId: input.session.id, events: failed.events });\n    } else {\n      await publishDurableSessionEvents(\n        input.bus,\n        input.task.workspaceId,\n        input.session.id,\n        failed.events,\n      );\n    }\n  }\n  const error =\n    failed.action === \"terminal\" ? (failed.error ?? \"scheduled_run_terminal\") : failed.error;\n  throw new ScheduledRunTerminalAuthorityError(\n    error,\n    seeded.reason ?? \"scheduled Connected Machine target is unavailable\",\n  );\n}\n\nasync function recoverBoundScheduledTaskDispatch(input: {\n  db: Database;\n  observability?: ProductUsageMetricsSink | undefined;\n  bus: ControlActivityServices[\"bus\"];\n  settings: ControlActivityServices[\"settings\"];\n  wakeSessionWorkflow: WakeSessionWorkflowSignal | null;\n  run: ScheduledTaskRun;\n  acceptedExecution: ScheduledTaskRunAcceptedExecution;\n  input: DispatchScheduledTaskRunInput;\n}): Promise<DispatchScheduledTaskRunResult> {\n  const { task } = input.acceptedExecution;\n  if (input.run.status !== \"queued\") {\n    throw new Error(\"scheduled run is not an exact queued recovery\");\n  }\n  const generatedSession =\n    task.runMode === \"new_session_per_run\" ||\n    (task.runMode === \"reusable_session\" && task.reusableSessionId === null);\n  // The immutable creator policy determines standing session authority, not\n  // a manual caller's per-run ceiling. Read it for creation and recovery checks.\n  const recoveredCreatorPolicy = generatedSession\n    ? await getScheduledTaskCreatorPolicy(input.db, task.workspaceId, task.id)\n    : null;\n  const frozenSlack = input.acceptedExecution.resolvedSlackBotConnection;\n  if (frozenSlack) {\n    const currentSlack = await requireOpenGeniSlackBotConnection(\n      input.db,\n      task.workspaceId,\n      frozenSlack.id,\n    );\n    const currentMetadata = openGeniSlackBotMetadata(currentSlack.metadata);\n    if (\n      currentSlack.version !== frozenSlack.version ||\n      currentSlack.verifiedInstallVersion !== frozenSlack.verifiedInstallVersion ||\n      stableJson(currentMetadata) !== stableJson(frozenSlack.metadata)\n    ) {\n      throw new ScheduledRunTerminalAuthorityError(\n        \"scheduled_slack_authority_changed\",\n        \"scheduled Slack bot authority changed after run admission\",\n      );\n    }\n  }\n  let session: Awaited<ReturnType<typeof createSession>>;\n  if (input.run.sessionId) {\n    session = await requireSession(input.db, task.workspaceId, input.run.sessionId);\n    // Preserve the reusable chat's Slack routing; the accepted target snapshot\n    // independently fences its current Variable Set attachments during recovery.\n    if (!generatedSession) assertReusableSessionBindingMatches(session, task);\n  } else if (generatedSession) {\n    const variableSet = input.acceptedExecution.resolvedVariableSet;\n    if (variableSet) {\n      const current = await getVariableSet(\n        input.db,\n        {\n          accountId: task.accountId,\n          workspaceId: task.workspaceId,\n          subjectId:\n            input.acceptedExecution.personalResourceAuthoritySubjectId ?? task.createdBy.subjectId,\n        },\n        variableSet.id,\n      );\n      if (!current || current.generation !== variableSet.generation) {\n        throw new ScheduledRunTerminalAuthorityError(\n          \"scheduled_variable_set_authority_changed\",\n          \"scheduled variable set changed after run admission\",\n        );\n      }\n    }\n    const rig = input.acceptedExecution.resolvedRig;\n    if (rig) {\n      const retained = await getScheduledScopedRigVersionMetadata(\n        input.db,\n        {\n          accountId: task.accountId,\n          workspaceId: task.workspaceId,\n          subjectId:\n            input.acceptedExecution.personalResourceAuthoritySubjectId ?? task.createdBy.subjectId,\n        },\n        rig.id,\n        rig.versionId,\n      );\n      if (!retained) {\n        throw new ScheduledRunTerminalAuthorityError(\n          \"scheduled_rig_authority_changed\",\n          \"scheduled rig changed after run admission\",\n        );\n      }\n    }\n    const taskMetadata = { ...task.agentConfig.metadata };\n    delete taskMetadata[OPENGENI_SLACK_BOT_SESSION_METADATA_KEY];\n    const created = await createSessionWithIdempotencyKeyResult(input.db, {\n      accountId: task.accountId,\n      workspaceId: task.workspaceId,\n      initialMessage: task.agentConfig.prompt,\n      resources: task.agentConfig.resources,\n      bundledSkillIds: task.agentConfig.bundledSkillIds,\n      tools: input.acceptedExecution.resolvedTools,\n      firstPartyMcpTools: input.acceptedExecution.resolvedFirstPartyMcpTools,\n      firstPartyMcpPermissions: input.acceptedExecution.resolvedFirstPartyMcpPermissions,\n      ...(input.acceptedExecution.resolvedAgentConfig\n        ? { agentConfig: input.acceptedExecution.resolvedAgentConfig }\n        : {}),\n      ...(input.acceptedExecution.resolvedAgentInstructions !== undefined\n        ? { instructions: input.acceptedExecution.resolvedAgentInstructions }\n        : {}),\n      ...scheduledCreatorSessionPolicyInput(recoveredCreatorPolicy?.sessionPolicy ?? null),\n      ...(task.vaultPolicy ? { vaultPolicy: task.vaultPolicy } : {}),\n      ...(task.agentConfig.knowledgeSource?.destination.kind === \"personal\" ||\n      task.visibility === \"private\"\n        ? {\n            visibility: \"user_private\" as const,\n            scheduledSourceRunId: input.run.id,\n          }\n        : {}),\n      metadata: {\n        ...taskMetadata,\n        ...scheduledSessionExecutionPolicyMetadata(\n          input.acceptedExecution.turnExecutionPolicy,\n          recoveredCreatorPolicy?.credentialRestriction,\n        ),\n        model: input.acceptedExecution.resolvedModel,\n        reasoningEffort: input.acceptedExecution.resolvedReasoningEffort,\n        scheduledTaskId: task.id,\n        scheduledTaskRunMode: task.runMode,\n        ...(task.agentConfig.goal ? { scheduledTaskGoal: task.agentConfig.goal } : {}),\n        scheduledTaskRunId: input.run.id,\n        ...(frozenSlack ? { [OPENGENI_SLACK_BOT_SESSION_METADATA_KEY]: frozenSlack.id } : {}),\n      },\n      createdBy: {\n        kind: \"service\",\n        subjectId: \"scheduler\",\n        label: \"OpenGeni scheduler\",\n      },\n      createdByContext: {\n        scheduledTaskId: task.id,\n        scheduledTaskRunId: input.run.id,\n      },\n      model: input.acceptedExecution.resolvedModel,\n      reasoningEffort: input.acceptedExecution.resolvedReasoningEffort,\n      latencyMode: input.acceptedExecution.resolvedLatencyMode,\n      sandboxBackend: input.acceptedExecution.resolvedSandboxBackend,\n      sandboxOs: input.acceptedExecution.resolvedSandboxOs,\n      variableSetId: variableSet?.id ?? null,\n      rigId: rig?.id ?? null,\n      rigVersionId: rig?.versionId ?? null,\n      personalConnectionDelegations: [],\n      initialXaiProviderAccountAuthoritySnapshot:\n        input.acceptedExecution.xaiProviderAccountAuthoritySnapshot,\n      initialClaudeProviderAccountAuthoritySnapshot:\n        input.acceptedExecution.claudeProviderAccountAuthoritySnapshot,\n      maxNestedAgentDepthOverride: task.agentConfig.maxNestedAgentDepth ?? null,\n      frozenNestedAgentDepthPolicy: {\n        effectiveMaxNestedAgentDepth:\n          input.acceptedExecution.generatedSessionBinding!.effectiveMaxNestedAgentDepth,\n        nestedAgentDepthPolicySource:\n          input.acceptedExecution.generatedSessionBinding!.nestedAgentDepthPolicySource,\n      },\n      frozenCodexCompactionMode:\n        input.acceptedExecution.generatedSessionBinding!.codexCompactionMode,\n      allowNestedAgentDepthIncrease: true,\n      subjectId: `scheduled_task:${task.id}`,\n      createIdempotencyKey:\n        input.acceptedExecution.generatedSessionBinding?.createIdempotencyKey ??\n        (() => {\n          throw new ScheduledRunTerminalAuthorityError(\n            \"scheduled_generated_session_binding_missing\",\n            \"scheduled generated session binding is missing\",\n          );\n        })(),\n      beforeCreateCommit: async (tx, sessionId) => {\n        await bindScheduledTaskRunSessionInTransaction(tx, {\n          accountId: task.accountId,\n          workspaceId: task.workspaceId,\n          runId: input.run.id,\n          sessionId,\n        });\n      },\n    });\n    if (created.denied) throw new SessionSpawnDeniedDbError(created.denial);\n    session = created.session;\n    if (created.created) recordScheduledSessionCreated(input.observability);\n    if (!created.created) {\n      await bindScheduledTaskRunSessionInTransaction(input.db, {\n        accountId: task.accountId,\n        workspaceId: task.workspaceId,\n        runId: input.run.id,\n        sessionId: session.id,\n      });\n    }\n  } else {\n    const targetSessionId =\n      task.runMode === \"existing_session\" ? task.targetSessionId : task.reusableSessionId;\n    if (!targetSessionId) {\n      throw new ScheduledRunTerminalAuthorityError(\n        \"scheduled_target_session_unavailable\",\n        \"scheduled accepted target session is unavailable\",\n      );\n    }\n    session = await requireSession(input.db, task.workspaceId, targetSessionId);\n    // Same backstop for a first attempt that died before its bind landed.\n    assertReusableSessionBindingMatches(session, task);\n    await bindScheduledTaskRunSessionInTransaction(input.db, {\n      accountId: task.accountId,\n      workspaceId: task.workspaceId,\n      runId: input.run.id,\n      sessionId: session.id,\n    });\n  }\n  if (generatedSession) {\n    session = await seedScheduledGeneratedSessionRoute({\n      db: input.db,\n      bus: input.bus,\n      settings: input.settings,\n      task,\n      runId: input.run.id,\n      session,\n      deferPublications: false,\n      deferredEvents: [],\n    });\n  }\n  if (session.status === \"cancelled\") {\n    await markScheduledTaskRunSkippedIfQueued(input.db, {\n      workspaceId: task.workspaceId,\n      runId: input.run.id,\n      sessionId: session.id,\n      error: \"session_cancelled\",\n    });\n    return { action: \"blocked\", reason: \"scheduled_run_terminal\" };\n  }\n  if (generatedSession) {\n    const expectedCreateKey = input.acceptedExecution.generatedSessionBinding?.createIdempotencyKey;\n    if (!expectedCreateKey) {\n      throw new ScheduledRunTerminalAuthorityError(\n        \"scheduled_generated_session_binding_missing\",\n        \"scheduled generated session binding is missing\",\n      );\n    }\n    const generatedBinding = input.acceptedExecution.generatedSessionBinding!;\n    const canonicalGeneratedRunId =\n      task.runMode === \"reusable_session\" && typeof session.metadata.scheduledTaskRunId === \"string\"\n        ? session.metadata.scheduledTaskRunId\n        : input.run.id;\n    // The public Session policy follows the latest started turn. Recovery must\n    // instead validate the immutable creation binding accepted by this run.\n    const creationPolicy = await getSessionCreationExecutionPolicy(\n      input.db,\n      task.workspaceId,\n      session.id,\n    );\n    const expectedTaskMetadata = { ...task.agentConfig.metadata };\n    delete expectedTaskMetadata[OPENGENI_SLACK_BOT_SESSION_METADATA_KEY];\n    const expectedMetadata = metadataWithAgentConfigCreateIdentity(\n      {\n        ...expectedTaskMetadata,\n        ...scheduledSessionExecutionPolicyMetadata(\n          input.acceptedExecution.turnExecutionPolicy,\n          recoveredCreatorPolicy?.credentialRestriction,\n        ),\n        model: input.acceptedExecution.resolvedModel,\n        reasoningEffort: input.acceptedExecution.resolvedReasoningEffort,\n        scheduledTaskId: task.id,\n        scheduledTaskRunMode: task.runMode,\n        ...(task.agentConfig.goal ? { scheduledTaskGoal: task.agentConfig.goal } : {}),\n        scheduledTaskRunId: canonicalGeneratedRunId,\n        ...(frozenSlack ? { [OPENGENI_SLACK_BOT_SESSION_METADATA_KEY]: frozenSlack.id } : {}),\n      },\n      input.acceptedExecution.resolvedAgentConfig,\n    );\n    if (\n      session.createIdempotencyKey !== expectedCreateKey ||\n      session.initialMessage !== task.agentConfig.prompt ||\n      session.instructions !== (input.acceptedExecution.resolvedAgentInstructions ?? null) ||\n      session.policyRole !== null ||\n      stableJson(session.skills) !== \"[]\" ||\n      stableJson(session.toolPolicy) !==\n        stableJson({ mode: \"explicit\", inheritedFromSessionId: null }) ||\n      session.toolPolicyVersion !== 1 ||\n      session.mcpServers.length !== 0 ||\n      session.parentSessionId !== null ||\n      session.rootSessionId !== session.id ||\n      session.nestedAgentDepth !== 0 ||\n      session.effectiveMaxNestedAgentDepth !== generatedBinding.effectiveMaxNestedAgentDepth ||\n      session.nestedAgentDepthPolicySource !== generatedBinding.nestedAgentDepthPolicySource ||\n      session.nestedAgentDepthPolicySessionId !==\n        (generatedBinding.nestedAgentDepthPolicySource === \"session\" ? session.id : null) ||\n      session.sandboxGroupId !== session.id ||\n      session.channelId !== null ||\n      session.codexCompactionMode !== generatedBinding.codexCompactionMode ||\n      stableJson(session.metadata) !== stableJson(expectedMetadata) ||\n      session.createdBy.kind !== \"service\" ||\n      session.createdBy.subjectId !== \"scheduler\" ||\n      stableJson(session.createdByContext) !==\n        stableJson({\n          label: \"OpenGeni scheduler\",\n          scheduledTaskId: task.id,\n          scheduledTaskRunId: canonicalGeneratedRunId,\n        }) ||\n      (task.runMode === \"new_session_per_run\" &&\n        input.acceptedExecution.alertOccurrenceLabels === null &&\n        (session.metadata.scheduledTaskRunId !== input.run.id ||\n          session.createdByContext.scheduledTaskRunId !== input.run.id)) ||\n      creationPolicy?.model !== input.acceptedExecution.resolvedModel ||\n      creationPolicy.reasoningEffort !== input.acceptedExecution.resolvedReasoningEffort ||\n      creationPolicy.latencyMode !== input.acceptedExecution.resolvedLatencyMode ||\n      session.sandboxBackend !== input.acceptedExecution.resolvedSandboxBackend ||\n      session.sandboxOs !== input.acceptedExecution.resolvedSandboxOs ||\n      session.activeSandboxId !== (task.agentConfig.machineTarget?.targetSandboxId ?? null) ||\n      stableJson(session.resources) !== stableJson(task.agentConfig.resources) ||\n      stableJson(session.tools) !== stableJson(input.acceptedExecution.resolvedTools) ||\n      stableJson(session.firstPartyMcpTools) !==\n        stableJson(input.acceptedExecution.resolvedFirstPartyMcpTools) ||\n      stableJson(session.firstPartyMcpPermissions) !==\n        stableJson(input.acceptedExecution.resolvedFirstPartyMcpPermissions) ||\n      stableJson(session.agent) !==\n        stableJson(input.acceptedExecution.resolvedAgentConfig ?? null) ||\n      session.maxNestedAgentDepthOverride !== (task.agentConfig.maxNestedAgentDepth ?? null) ||\n      (session.variableSetId ?? null) !==\n        (input.acceptedExecution.resolvedVariableSet?.id ?? null) ||\n      (session.rigId ?? null) !== (input.acceptedExecution.resolvedRig?.id ?? null) ||\n      (session.rigVersionId ?? null) !== (input.acceptedExecution.resolvedRig?.versionId ?? null) ||\n      scheduledSlackBotConnectionId(session.metadata) !== (frozenSlack?.id ?? null)\n    ) {\n      throw new ScheduledRunTerminalAuthorityError(\n        \"scheduled_generated_session_changed\",\n        \"scheduled generated session differs from accepted execution\",\n      );\n    }\n  }\n  let workflowId = workflowIdForSession(session.id);\n  if (generatedSession) {\n    const goalSpec = task.agentConfig.goal ?? null;\n    const started = await initializeSessionStartAtomically(input.db, {\n      accountId: task.accountId,\n      workspaceId: task.workspaceId,\n      sessionId: session.id,\n      reasoningEffortFallback: input.acceptedExecution.resolvedReasoningEffort,\n      createdEventPayload: {\n        scheduledTaskId: task.id,\n        scheduledTaskRunId: input.run.id,\n      },\n      goal: goalSpec\n        ? {\n            text: goalSpec.text,\n            successCriteria: goalSpec.successCriteria ?? null,\n            maxAutoContinuations: goalSpec.maxAutoContinuations ?? null,\n            ...(goalSpec.mutationPolicy ? { mutationPolicy: goalSpec.mutationPolicy } : {}),\n            createdBy: \"scheduled_task\",\n          }\n        : null,\n      deferInitialTurn: true,\n      deferredStatus: \"queued\",\n    });\n    workflowId = started.temporalWorkflowId;\n    if (started.events.length > 0) {\n      await publishDurableSessionEvents(input.bus, task.workspaceId, session.id, started.events);\n    }\n    if (task.runMode === \"reusable_session\") {\n      await materializeScheduledTaskReusableSessionFromRun(input.db, {\n        accountId: task.accountId,\n        workspaceId: task.workspaceId,\n        taskId: task.id,\n        runId: input.run.id,\n        sessionId: session.id,\n        sourceTaskAuthorityRevision: input.run.taskAuthorityRevision!,\n        sourceExecutionDigest: input.run.taskExecutionDigest!,\n      });\n    }\n    // Same title the normal dispatch writes, from the same durable task row, in\n    // the same position relative to session.created. A session the dead dispatch\n    // already titled is left alone.\n    const titleEvents = await stampScheduledSessionTitle(input.db, {\n      workspaceId: task.workspaceId,\n      sessionId: session.id,\n      taskName: task.name,\n    });\n    if (titleEvents.length > 0) {\n      await publishDurableSessionEvents(input.bus, task.workspaceId, session.id, titleEvents);\n    }\n  }\n  const scheduledUpdate = await addSessionSystemUpdateWithSourceMutation(\n    input.db,\n    {\n      accountId: task.accountId,\n      workspaceId: task.workspaceId,\n      sessionId: session.id,\n      kind: \"scheduled_occurrence\",\n      classification: \"info\",\n      sourceId: input.run.id,\n      dedupeKey: `scheduled-task-run:${input.run.id}`,\n      summary: task.agentConfig.prompt,\n      payload: scheduledUserMessagePayload(\n        task.agentConfig.prompt,\n        task.agentConfig.resources,\n        input.acceptedExecution.resolvedTools,\n        task.id,\n        input.run.id,\n        input.acceptedExecution.degradedAccounts ?? [],\n      ),\n      lineage: {\n        scheduledTaskId: task.id,\n        scheduledTaskRunId: input.run.id,\n        ...(input.acceptedExecution.causalHumanSubjectId\n          ? { causalHumanSubjectId: input.acceptedExecution.causalHumanSubjectId }\n          : {}),\n        ...(input.acceptedExecution.connectionAuthoritySubjectId\n          ? {\n              connectionAuthoritySubjectId: input.acceptedExecution.connectionAuthoritySubjectId,\n            }\n          : {}),\n        ...(input.acceptedExecution.xaiAuthoritySubjectId\n          ? { xaiAuthoritySubjectId: input.acceptedExecution.xaiAuthoritySubjectId }\n          : {}),\n        ...(input.acceptedExecution.claudeAuthoritySubjectId\n          ? { claudeAuthoritySubjectId: input.acceptedExecution.claudeAuthoritySubjectId }\n          : {}),\n      },\n      personalConnectionDelegations: input.acceptedExecution.personalConnectionDelegations,\n      mcpAccountBindings: input.acceptedExecution.mcpAccountBindings ?? null,\n      xaiProviderAccountAuthoritySnapshot:\n        input.acceptedExecution.xaiProviderAccountAuthoritySnapshot,\n      claudeProviderAccountAuthoritySnapshot:\n        input.acceptedExecution.claudeProviderAccountAuthoritySnapshot,\n      // Codex v2 (M3 PR 3b): the task's value frozen at creation, narrowed to\n      // empty when the accepted revision's authorizer is not the owner.\n      subscriptionAuthority: await getScheduledTaskSubscriptionAuthority(input.db, {\n        workspaceId: task.workspaceId,\n        taskId: task.id,\n        revisionAuthorizerSubjectId:\n          input.acceptedExecution.causalHumanAuthority?.subjectId ?? null,\n        taskAuthorityRevision: task.authorityRevision,\n      }),\n      scheduledTaskRunId: input.run.id,\n    },\n    async (tx, wakeEventId, _updateId, rejectionReason) => {\n      if (!wakeEventId) {\n        const error = scheduledSessionRejectionError(rejectionReason);\n        await settleScheduledTaskRunInTransaction(tx, {\n          workspaceId: task.workspaceId,\n          runId: input.run.id,\n          sessionId: session.id,\n          triggerEventId: null,\n          status: \"skipped\",\n          error,\n        });\n        return;\n      }\n      await settleScheduledTaskRunInTransaction(tx, {\n        workspaceId: task.workspaceId,\n        runId: input.run.id,\n        sessionId: session.id,\n        triggerEventId: wakeEventId,\n        status: \"dispatched\",\n      });\n    },\n    {\n      requireIdleSession: task.overlapPolicy === \"skip\" && !generatedSession,\n      prepareSource: async (tx, sessionId) => {\n        const goal = task.agentConfig.goal;\n        const goalEvents =\n          !generatedSession && task.runMode === \"reusable_session\" && goal\n            ? await upsertScheduledSessionGoalForRun(tx, {\n                accountId: task.accountId,\n                workspaceId: task.workspaceId,\n                sessionId,\n                runId: input.run.id,\n                text: goal.text,\n                successCriteria: goal.successCriteria ?? null,\n                maxAutoContinuations: goal.maxAutoContinuations ?? null,\n                ...(goal.mutationPolicy ? { mutationPolicy: goal.mutationPolicy } : {}),\n              })\n            : [];\n        const incidentSource = input.acceptedExecution.incidentPreflightRequired\n          ? await prepareIncidentTelemetrySource({\n              tx,\n              settings: input.settings,\n              taskId: task.id,\n              workspaceId: task.workspaceId,\n              sessionId,\n              alertOccurrenceLabels: input.acceptedExecution.alertOccurrenceLabels,\n              acceptedExecution: input.acceptedExecution,\n            })\n          : undefined;\n        return {\n          ...(incidentSource ?? {}),\n          ...(goalEvents.length > 0 ? { events: goalEvents } : {}),\n        };\n      },\n    },\n  );\n  if (\n    scheduledUpdate.reason === \"session_cancelled\" ||\n    scheduledUpdate.reason === \"session_not_idle\" ||\n    scheduledUpdate.reason === \"session_paused\"\n  ) {\n    return { action: \"blocked\", reason: \"scheduled_run_terminal\" };\n  }\n  if (scheduledUpdate.added) {\n    recordUserMessageAccepted(input.observability, { surface: \"scheduled\" });\n  }\n  if (scheduledUpdate.added && scheduledUpdate.events.length > 0) {\n    await publishDurableSessionEvents(\n      input.bus,\n      task.workspaceId,\n      session.id,\n      scheduledUpdate.events,\n    );\n  }\n  await recordUsageEvent(input.db, {\n    accountId: task.accountId,\n    workspaceId: task.workspaceId,\n    eventType: \"agent_run.created\",\n    quantity: 1,\n    unit: \"run\",\n    sourceResourceType: \"scheduled_task_run\",\n    sourceResourceId: input.run.id,\n    sessionId: session.id,\n    initiator: input.acceptedExecution.triggerInitiator,\n    initiatorContext: { scheduledTaskId: task.id, scheduledTaskRunId: input.run.id },\n    origin: \"scheduled_task\",\n    idempotencyKey:\n      input.acceptedExecution.agentRunUsageIdempotencyKey ??\n      `usage:agent_run.created:scheduled:${input.run.id}`,\n  });\n  const workflowWakeRevision = await enqueueSessionWorkflowWakeIfRunnable(input.db, {\n    accountId: task.accountId,\n    workspaceId: task.workspaceId,\n    sessionId: session.id,\n    temporalWorkflowId: workflowId,\n    reason: \"scheduled_retry\",\n  });\n  const result = {\n    action: generatedSession ? \"start\" : \"signal\",\n    accountId: task.accountId,\n    workspaceId: task.workspaceId,\n    sessionId: session.id,\n    triggerEventId: scheduledUpdate.wakeEventId,\n    workflowId,\n    workflowWakeRevision,\n  } as const;\n  if (input.wakeSessionWorkflow && workflowWakeRevision !== null) {\n    await input.wakeSessionWorkflow({\n      accountId: result.accountId,\n      workspaceId: result.workspaceId,\n      sessionId: result.sessionId,\n      workflowId: result.workflowId,\n      wakeRevision: workflowWakeRevision,\n    });\n  }\n  return result;\n}\n\nasync function replayScheduledTaskDispatch(input: {\n  db: Database;\n  wakeSessionWorkflow: WakeSessionWorkflowSignal | null;\n  task: ScheduledTask;\n  run: ScheduledTaskRun;\n  acceptedExecution: ScheduledTaskRunAcceptedExecution;\n}): Promise<DispatchScheduledTaskRunResult> {\n  if (!input.run.sessionId || !input.run.triggerEventId) {\n    throw new Error(\"dispatched scheduled task run is missing its delivery identity\");\n  }\n  const sessionId = input.run.sessionId;\n  const triggerEventId = input.run.triggerEventId;\n  await requireSession(input.db, input.task.workspaceId, sessionId);\n  await recordUsageEvent(input.db, {\n    accountId: input.task.accountId,\n    workspaceId: input.task.workspaceId,\n    eventType: \"agent_run.created\",\n    quantity: 1,\n    unit: \"run\",\n    sourceResourceType: \"scheduled_task_run\",\n    sourceResourceId: input.run.id,\n    sessionId,\n    initiator: input.acceptedExecution.triggerInitiator,\n    initiatorContext: {\n      scheduledTaskId: input.task.id,\n      scheduledTaskRunId: input.run.id,\n    },\n    origin: \"scheduled_task\",\n    idempotencyKey:\n      input.acceptedExecution.agentRunUsageIdempotencyKey ??\n      `usage:agent_run.created:scheduled:${input.run.id}`,\n  });\n  const workflowId = workflowIdForSession(sessionId);\n  const workflowWakeRevision = await enqueueSessionWorkflowWakeIfRunnable(input.db, {\n    accountId: input.task.accountId,\n    workspaceId: input.task.workspaceId,\n    sessionId,\n    temporalWorkflowId: workflowId,\n    reason: \"scheduled_retry\",\n  });\n  const result = {\n    action: input.acceptedExecution.task.runMode === \"new_session_per_run\" ? \"start\" : \"signal\",\n    accountId: input.task.accountId,\n    workspaceId: input.task.workspaceId,\n    sessionId,\n    triggerEventId,\n    workflowId,\n    workflowWakeRevision,\n  } as const;\n  if (input.wakeSessionWorkflow && workflowWakeRevision !== null) {\n    await input.wakeSessionWorkflow({\n      accountId: result.accountId,\n      workspaceId: result.workspaceId,\n      sessionId: result.sessionId,\n      workflowId: result.workflowId,\n      wakeRevision: workflowWakeRevision,\n    });\n  }\n  return result;\n}\n\n/**\n * Session-create fields carried by a frozen creator session policy. Only the\n * facts the creating session projection exposed at task creation are set;\n * a null (or no longer valid) key leaves the generated session on its own\n * default. The field names are the session access-scope contract\n * (`agentAccess`, `scopeSubjectId`, `memoryScope`) consumed by session create.\n */\nfunction scheduledCreatorSessionPolicyInput(\n  policy: {\n    agentAccess: string | null;\n    scopeSubjectId: string | null;\n    memoryScope: string | null;\n  } | null,\n): {\n  agentAccess?: SessionAgentAccess;\n  scopeSubjectId?: string;\n  memoryScope?: SessionMemoryScope;\n} {\n  if (!policy) return {};\n  const agentAccess = SessionAgentAccess.safeParse(policy.agentAccess);\n  const memoryScope = SessionMemoryScope.safeParse(policy.memoryScope);\n  return {\n    ...(agentAccess.success ? { agentAccess: agentAccess.data } : {}),\n    // This is a trusted DB admission input, not the public create payload.\n    // Preserve the immutable creator policy through scheduled materialization.\n    ...(policy.scopeSubjectId && /^(?:user:|external_user:).+/u.test(policy.scopeSubjectId)\n      ? { scopeSubjectId: policy.scopeSubjectId }\n      : {}),\n    ...(memoryScope.success ? { memoryScope: memoryScope.data } : {}),\n  };\n}\n\nfunction knowledgeSourceSyncEffectivelyPaused(task: {\n  status: \"active\" | \"paused\";\n  metadata: Record<string, unknown>;\n}): boolean {\n  if (task.status === \"paused\") return true;\n  const value = task.metadata.knowledgeSourceSync;\n  if (!value || typeof value !== \"object\") return false;\n  const control = value as Record<string, unknown>;\n  return control.sourceEnabled === false || control.connectionPaused === true;\n}\n","import { createHash } from \"node:crypto\";\n\nconst MAX_SCHEDULED_TASK_ID_BYTES = 256;\nconst MAX_STARTS_AT_BYTES = 256;\nconst MAX_PROVIDER_BYTES = 256;\nconst MAX_FINGERPRINT_BYTES = 1_024;\nconst MAX_LABELS = 256;\nconst MAX_LABEL_KEY_BYTES = 256;\nconst MAX_LABEL_VALUE_BYTES = 4_096;\nconst OFFSET_TIMESTAMP =\n  /^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2})(?::(\\d{2})(?:\\.(\\d+))?)?(?:Z|[+-](\\d{2}):(\\d{2}))$/;\n\nexport type ScheduledAlertOccurrenceDeclaration = {\n  status: \"firing\" | \"resolved\";\n  startsAt: string;\n  fingerprint: string;\n  labels: Record<string, string>;\n  provider?: string;\n};\n\nexport type ScheduledAlertOccurrenceIdentity = {\n  status: \"firing\" | \"resolved\";\n  sessionCreateIdempotencyKey: string;\n  /** Exact bounded labels from the validated structured occurrence. */\n  labels: Readonly<Record<string, string>>;\n};\n\n/**\n * Bind the series-stable occurrence identity to one accepted task execution\n * definition. A later task revision must not adopt the prior responder root,\n * because that session has already frozen the old prompt/tool/authority policy.\n */\nexport function scheduledAlertResponderSessionCreateIdempotencyKey(input: {\n  occurrence: ScheduledAlertOccurrenceIdentity;\n  taskAuthorityRevision: number;\n  taskExecutionDigest: string;\n}): string {\n  const digest = createHash(\"sha256\")\n    .update(\n      JSON.stringify({\n        version: 1,\n        occurrenceKey: input.occurrence.sessionCreateIdempotencyKey,\n        taskAuthorityRevision: input.taskAuthorityRevision,\n        taskExecutionDigest: input.taskExecutionDigest,\n      }),\n    )\n    .digest(\"hex\");\n  return `scheduled-alert-occurrence:v1:${digest}`;\n}\n\n/**\n * Derive one content-free, workspace-bound identity for an Alertmanager-style\n * alert occurrence. Missing or malformed metadata deliberately returns null so\n * ordinary scheduled tasks retain their existing new-session-per-run behavior.\n */\nexport function scheduledAlertOccurrenceIdentity(input: {\n  workspaceId: string;\n  scheduledTaskId: string;\n  metadata: Record<string, unknown>;\n}): ScheduledAlertOccurrenceIdentity | null {\n  const scheduledTaskId = boundedString(input.scheduledTaskId, MAX_SCHEDULED_TASK_ID_BYTES);\n  if (!scheduledTaskId) return null;\n\n  const alert = record(input.metadata.alert);\n  if (!alert) return null;\n\n  const status = alert.status;\n  if (status !== \"firing\" && status !== \"resolved\") return null;\n\n  const startsAt = canonicalTimestamp(alert.startsAt);\n  const fingerprint = boundedString(alert.fingerprint, MAX_FINGERPRINT_BYTES);\n  const labels = canonicalLabels(alert.labels);\n  if (!startsAt || !fingerprint || !labels) return null;\n\n  const provider = boundedString(\n    alert.provider ?? input.metadata.alertProvider ?? input.metadata.provider ?? \"alertmanager\",\n    MAX_PROVIDER_BYTES,\n  );\n  if (!provider) return null;\n  const digest = createHash(\"sha256\")\n    .update(\n      JSON.stringify({\n        version: 1,\n        workspaceId: input.workspaceId,\n        scheduledTaskId,\n        provider,\n        fingerprint,\n        startsAt,\n        labels,\n      }),\n    )\n    .digest(\"hex\");\n  return {\n    status,\n    sessionCreateIdempotencyKey: `scheduled-alert-occurrence:v1:${digest}`,\n    labels: Object.fromEntries(labels),\n  };\n}\n\nfunction record(value: unknown): Record<string, unknown> | null {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : null;\n}\n\nfunction boundedString(value: unknown, maxBytes: number): string | null {\n  if (typeof value !== \"string\") return null;\n  const normalized = value.trim();\n  if (!normalized || Buffer.byteLength(normalized, \"utf8\") > maxBytes) return null;\n  return normalized;\n}\n\nfunction canonicalTimestamp(value: unknown): string | null {\n  if (typeof value !== \"string\") return null;\n  const trimmed = value.trim();\n  if (!trimmed || Buffer.byteLength(trimmed, \"utf8\") > MAX_STARTS_AT_BYTES) return null;\n  const match = OFFSET_TIMESTAMP.exec(trimmed);\n  if (!match) return null;\n  const [\n    ,\n    yearText,\n    monthText,\n    dayText,\n    hourText,\n    minuteText,\n    secondText,\n    ,\n    offsetHourText,\n    offsetMinuteText,\n  ] = match;\n  const year = Number(yearText);\n  const month = Number(monthText);\n  const day = Number(dayText);\n  const hour = Number(hourText);\n  const minute = Number(minuteText);\n  const second = secondText === undefined ? 0 : Number(secondText);\n  const offsetHour = offsetHourText === undefined ? 0 : Number(offsetHourText);\n  const offsetMinute = offsetMinuteText === undefined ? 0 : Number(offsetMinuteText);\n  const leapYear = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);\n  const daysInMonth = [31, leapYear ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];\n  if (\n    month < 1 ||\n    month > 12 ||\n    day < 1 ||\n    day > daysInMonth[month - 1]! ||\n    hour > 23 ||\n    minute > 59 ||\n    second > 59 ||\n    offsetHour > 23 ||\n    offsetMinute > 59\n  ) {\n    return null;\n  }\n  const parsed = new Date(trimmed);\n  return Number.isFinite(parsed.getTime()) ? trimmed : null;\n}\n\nfunction canonicalLabels(value: unknown): Array<readonly [string, string]> | null {\n  const labels = record(value);\n  if (!labels) return null;\n  const entries = Object.entries(labels);\n  if (entries.length === 0 || entries.length > MAX_LABELS) return null;\n  const canonical: Array<readonly [string, string]> = [];\n  for (const [key, rawValue] of entries) {\n    if (\n      !key ||\n      Buffer.byteLength(key, \"utf8\") > MAX_LABEL_KEY_BYTES ||\n      typeof rawValue !== \"string\" ||\n      Buffer.byteLength(rawValue, \"utf8\") > MAX_LABEL_VALUE_BYTES\n    ) {\n      return null;\n    }\n    canonical.push([key, rawValue]);\n  }\n  return canonical.sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0));\n}\n","import {\n  settleSessionAttemptInterruptions,\n  applySessionTurnSettlement,\n  enqueueSessionWorkflowWake,\n  failSessionWorkBeforeAttemptClaim,\n  blockSessionWorkBeforeAttemptClaim,\n  requestSessionTurnRecovery,\n  recoverSessionDispatch,\n  reconcileSettledSessionAttempt,\n  reconcileSessionAttemptQuiescence,\n  reconcileCompletedSandboxSetup,\n  peekSessionWork as peekSessionWorkDb,\n  settleSessionInputWait as settleSessionInputWaitDb,\n  countQueuedTurns,\n  getSessionAttemptActivityRef,\n  getSessionEvent,\n  getSessionTurnForAttempt,\n  getWorkspace,\n  expireSessionInteractionIntervention as expireSessionInteractionInterventionDb,\n  expireScheduledRunHumanWait as expireScheduledRunHumanWaitDb,\n  expireSessionHumanInputRequest,\n  markSessionAttemptQuiesced,\n  requireSession,\n  settleSessionIdleWithParentOutbox,\n  SANDBOX_SETUP_RECOVERY_LIMIT,\n} from \"@opengeni/db\";\nimport { publishDurableSessionEvents } from \"@opengeni/events\";\nimport { CancelledFailure } from \"@temporalio/activity\";\nimport { currentActivityContext } from \"./streaming\";\nimport { deliverFailedChildTurnToParent, notifyParentOfChildIdle } from \"./parent-wake\";\nimport { interactionInterventionMetricObserver } from \"@opengeni/observability\";\nimport { recordTurnsQueuedGauge, recordWorkerDeathRecoveryMetrics } from \"../observability-metrics\";\nimport {\n  MAX_AUTOMATIC_PROVIDER_RECOVERIES,\n  providerRecoveryCountFromMetadata,\n  providerRecoveryLimit,\n} from \"./agent-turn/errors\";\nimport {\n  PROVIDER_OVERLOAD_RECOVERY_CODE,\n  validProviderOverloadRecoveryDelay,\n} from \"./agent-turn/provider-recovery-policy\";\nimport { writeSessionUsageReceipts } from \"./agent-turn/session-usage-custody\";\nimport type {\n  ControlActivityServices,\n  ExpireSessionHumanInputInput,\n  ExpireSessionHumanInputResult,\n  ExpireSessionInteractionInterventionInput,\n  ExpireScheduledRunHumanWaitInput,\n  ExpireScheduledRunHumanWaitResult,\n  ExpireSessionInteractionInterventionResult,\n  PeekSessionWorkInput,\n  FailSessionAttemptInput,\n  FailSessionAttemptResult,\n  SettleSessionInterruptionsInput,\n  MarkSessionIdleInput,\n  PersistSessionAttemptQuiescenceInput,\n  ReconcileSessionAttemptQuiescenceInput,\n  ReconcileSessionAttemptQuiescenceResult,\n  ReconcileSettledSessionAttemptInput,\n  ReconcileSettledSessionAttemptResult,\n  RecoverDispatchInput,\n  RecoverDispatchResult,\n  RecoverEscapedMcpTimeoutInput,\n  RecoverEscapedMcpTimeoutResult,\n  SettleSessionInputWaitInput,\n  SettleSessionInputWaitResult,\n} from \"./types\";\n\nexport type SessionStateActivityOverrides = Partial<{\n  settleSessionAttemptInterruptions: typeof settleSessionAttemptInterruptions;\n  applySessionTurnSettlement: typeof applySessionTurnSettlement;\n  enqueueSessionWorkflowWake: typeof enqueueSessionWorkflowWake;\n  failSessionWorkBeforeAttemptClaim: typeof failSessionWorkBeforeAttemptClaim;\n  blockSessionWorkBeforeAttemptClaim: typeof blockSessionWorkBeforeAttemptClaim;\n  requestSessionTurnRecovery: typeof requestSessionTurnRecovery;\n  recoverSessionDispatch: typeof recoverSessionDispatch;\n  reconcileSettledSessionAttempt: typeof reconcileSettledSessionAttempt;\n  reconcileSessionAttemptQuiescence: typeof reconcileSessionAttemptQuiescence;\n  reconcileCompletedSandboxSetup: typeof reconcileCompletedSandboxSetup;\n  peekSessionWork: typeof peekSessionWorkDb;\n  settleSessionInputWait: typeof settleSessionInputWaitDb;\n  countQueuedTurns: typeof countQueuedTurns;\n  getSessionAttemptActivityRef: typeof getSessionAttemptActivityRef;\n  getSessionEvent: typeof getSessionEvent;\n  getSessionTurnForAttempt: typeof getSessionTurnForAttempt;\n  getWorkspace: typeof getWorkspace;\n  expireSessionHumanInputRequest: typeof expireSessionHumanInputRequest;\n  expireSessionInteractionIntervention: typeof expireSessionInteractionInterventionDb;\n  expireScheduledRunHumanWait: typeof expireScheduledRunHumanWaitDb;\n  requireSession: typeof requireSession;\n  settleSessionIdleWithParentOutbox: typeof settleSessionIdleWithParentOutbox;\n  markSessionAttemptQuiesced: typeof markSessionAttemptQuiesced;\n  publishDurableSessionEvents: typeof publishDurableSessionEvents;\n  deliverFailedChildTurnToParent: typeof deliverFailedChildTurnToParent;\n  notifyParentOfChildIdle: typeof notifyParentOfChildIdle;\n  recordTurnsQueuedGauge: typeof recordTurnsQueuedGauge;\n  recordWorkerDeathRecoveryMetrics: typeof recordWorkerDeathRecoveryMetrics;\n}>;\n\n// Crash-loop guard for worker-death re-dispatch: a turn that takes a worker\n// down this many times in a row is assumed to be the cause, not the victim,\n// and the session fails for real on the next death. A plain constant by\n// design — this is a pathology bound, not a run-length limit.\nexport const WORKER_DEATH_MAX_REDISPATCHES = 3;\n\nexport function createSessionStateActivities(\n  services: () => Promise<ControlActivityServices>,\n  overrides: SessionStateActivityOverrides = {},\n) {\n  const settleSessionAttemptInterruptionsFn =\n    overrides.settleSessionAttemptInterruptions ?? settleSessionAttemptInterruptions;\n  const applySessionTurnSettlementFn =\n    overrides.applySessionTurnSettlement ?? applySessionTurnSettlement;\n  const enqueueSessionWorkflowWakeFn =\n    overrides.enqueueSessionWorkflowWake ?? enqueueSessionWorkflowWake;\n  const failSessionWorkBeforeAttemptClaimFn =\n    overrides.failSessionWorkBeforeAttemptClaim ?? failSessionWorkBeforeAttemptClaim;\n  const blockSessionWorkBeforeAttemptClaimFn =\n    overrides.blockSessionWorkBeforeAttemptClaim ?? blockSessionWorkBeforeAttemptClaim;\n  const requestSessionTurnRecoveryFn =\n    overrides.requestSessionTurnRecovery ?? requestSessionTurnRecovery;\n  const recoverSessionDispatchFn = overrides.recoverSessionDispatch ?? recoverSessionDispatch;\n  const reconcileSettledSessionAttemptFn =\n    overrides.reconcileSettledSessionAttempt ?? reconcileSettledSessionAttempt;\n  const reconcileSessionAttemptQuiescenceFn =\n    overrides.reconcileSessionAttemptQuiescence ?? reconcileSessionAttemptQuiescence;\n  const peekSessionWorkFn = overrides.peekSessionWork ?? peekSessionWorkDb;\n  const reconcileCompletedSandboxSetupFn =\n    overrides.reconcileCompletedSandboxSetup ?? reconcileCompletedSandboxSetup;\n  const settleSessionInputWaitFn = overrides.settleSessionInputWait ?? settleSessionInputWaitDb;\n  const countQueuedTurnsFn = overrides.countQueuedTurns ?? countQueuedTurns;\n  const getSessionAttemptActivityRefFn =\n    overrides.getSessionAttemptActivityRef ?? getSessionAttemptActivityRef;\n  const getSessionEventFn = overrides.getSessionEvent ?? getSessionEvent;\n  const getSessionTurnForAttemptFn = overrides.getSessionTurnForAttempt ?? getSessionTurnForAttempt;\n  const getWorkspaceFn = overrides.getWorkspace ?? getWorkspace;\n  const expireSessionHumanInputRequestFn =\n    overrides.expireSessionHumanInputRequest ?? expireSessionHumanInputRequest;\n  const expireSessionInteractionInterventionFn =\n    overrides.expireSessionInteractionIntervention ?? expireSessionInteractionInterventionDb;\n  const expireScheduledRunHumanWaitFn =\n    overrides.expireScheduledRunHumanWait ?? expireScheduledRunHumanWaitDb;\n  const requireSessionFn = overrides.requireSession ?? requireSession;\n  const settleSessionIdleWithParentOutboxFn =\n    overrides.settleSessionIdleWithParentOutbox ?? settleSessionIdleWithParentOutbox;\n  const markSessionAttemptQuiescedFn =\n    overrides.markSessionAttemptQuiesced ?? markSessionAttemptQuiesced;\n  const publishDurableSessionEventsFn =\n    overrides.publishDurableSessionEvents ?? publishDurableSessionEvents;\n  const deliverFailedChildTurnToParentFn =\n    overrides.deliverFailedChildTurnToParent ?? deliverFailedChildTurnToParent;\n  const notifyParentOfChildIdleFn = overrides.notifyParentOfChildIdle ?? notifyParentOfChildIdle;\n  const recordTurnsQueuedGaugeFn = overrides.recordTurnsQueuedGauge ?? recordTurnsQueuedGauge;\n  const recordWorkerDeathRecoveryMetricsFn =\n    overrides.recordWorkerDeathRecoveryMetrics ?? recordWorkerDeathRecoveryMetrics;\n\n  async function failSessionAttempt(\n    input: FailSessionAttemptInput,\n  ): Promise<FailSessionAttemptResult> {\n    const { db, bus, settings, observability, wakeSessionWorkflow } = await services();\n    const session = await requireSessionFn(db, input.workspaceId, input.sessionId);\n    if (session.status === \"failed\" || session.status === \"cancelled\") {\n      // The activity may be retried after failure settlement committed but its\n      // response or event fanout was lost. Preserve terminal session truth so\n      // the workflow cannot interpret an idle peek as permission to synthesize\n      // an active-goal continuation.\n      return { action: \"terminal\" };\n    }\n    const workflowId =\n      input.workflowId ?? session.temporalWorkflowId ?? `session-${input.sessionId}`;\n    const turn = await getSessionTurnForAttemptFn(\n      db,\n      input.workspaceId,\n      input.sessionId,\n      input.attemptId,\n    );\n    if (!turn) {\n      const attempt = await getSessionAttemptActivityRefFn(db, {\n        accountId: input.accountId,\n        workspaceId: input.workspaceId,\n        sessionId: input.sessionId,\n        attemptId: input.attemptId,\n        temporalWorkflowId: workflowId,\n      });\n      if (attempt) return { action: \"stale\" };\n\n      const preClaimFailureDisposition =\n        input.preClaimFailure?.disposition ?? input.preClaimFailureDisposition;\n      if (\n        preClaimFailureDisposition === \"blocked\" &&\n        input.admissionFence &&\n        input.preClaimFailure?.reason\n      ) {\n        const blocked = await blockSessionWorkBeforeAttemptClaimFn(db, input.workspaceId, {\n          accountId: input.accountId,\n          sessionId: input.sessionId,\n          workflowId,\n          attemptId: input.attemptId,\n          fence: input.admissionFence,\n          reason: input.preClaimFailure.reason,\n          sqlState: input.preClaimFailure.sqlState ?? null,\n        });\n        await publishDurableSessionEventsFn(\n          bus,\n          input.workspaceId,\n          input.sessionId,\n          blocked.events,\n        );\n        return { action: blocked.action };\n      }\n      if (preClaimFailureDisposition === \"permanent\" && input.trigger) {\n        const failed = await failSessionWorkBeforeAttemptClaimFn(db, input.workspaceId, {\n          accountId: input.accountId,\n          sessionId: input.sessionId,\n          workflowId,\n          trigger: input.trigger,\n          error: input.error ?? \"Agent turn admission failed before attempt claim.\",\n          ...(input.preClaimFailure?.disposition === \"permanent\"\n            ? {\n                admissionFailure: {\n                  disposition: \"permanent\" as const,\n                  code: input.preClaimFailure.code,\n                },\n              }\n            : {}),\n        });\n        if (failed.action === \"terminal\") return { action: \"terminal\" };\n        if (failed.action === \"stale\") return { action: \"stale\" };\n        await publishDurableSessionEventsFn(bus, input.workspaceId, input.sessionId, failed.events);\n        if (failed.turnId) {\n          await deliverFailedChildTurnToParentFn(\n            { db, bus, settings, observability, wakeSessionWorkflow },\n            input.workspaceId,\n            input.sessionId,\n            failed.turnId,\n          );\n        }\n        return { action: \"failed\" };\n      }\n\n      const requestedRetryDelayMs = input.retryDelayMs;\n      const retryDelayMs =\n        typeof requestedRetryDelayMs === \"number\" && Number.isFinite(requestedRetryDelayMs)\n          ? Math.max(1_000, Math.min(60_000, Math.trunc(requestedRetryDelayMs)))\n          : 60_000;\n      await enqueueSessionWorkflowWakeFn(db, {\n        accountId: input.accountId,\n        workspaceId: input.workspaceId,\n        sessionId: input.sessionId,\n        temporalWorkflowId: workflowId,\n        reason: \"turn_activity_failed_before_attempt_claim\",\n        notBefore: new Date(Date.now() + retryDelayMs),\n      });\n      return { action: \"unclaimed\" };\n    }\n    const postClaimRecovery = input.postClaimDatabaseRecovery;\n    const postClaimIdentityMatches = Boolean(\n      postClaimRecovery &&\n      turn.id === postClaimRecovery.turnId &&\n      turn.triggerEventId === postClaimRecovery.triggerEventId &&\n      turn.executionGeneration === postClaimRecovery.executionGeneration,\n    );\n    // A typed checkpoint belongs to one exact turn/generation. A stale wire\n    // cannot recover or terminally fail a different current attempt.\n    if (postClaimRecovery && !postClaimIdentityMatches) {\n      return { action: \"stale\" };\n    }\n    const providerRecoveryCount = postClaimIdentityMatches\n      ? postClaimRecovery?.providerRecoveryCount\n      : undefined;\n    const providerFailureCode = postClaimIdentityMatches\n      ? postClaimRecovery?.providerFailureCode\n      : undefined;\n    const hasProviderRecoveryCount = providerRecoveryCount !== undefined;\n    const hasProviderFailureCode = providerFailureCode !== undefined;\n    const providerRecoveryContinueDelayMs = postClaimIdentityMatches\n      ? postClaimRecovery?.providerRecoveryContinueDelayMs\n      : undefined;\n    const setupOutcomeUnknown =\n      postClaimIdentityMatches && postClaimRecovery?.sandboxSetupOutcomeUnknown === true;\n    const setupRecoveryExhausted =\n      postClaimIdentityMatches && postClaimRecovery?.sandboxSetupRecoveryExhausted === true;\n    if (\n      (setupOutcomeUnknown && setupRecoveryExhausted) ||\n      ((setupOutcomeUnknown || setupRecoveryExhausted) &&\n        (hasProviderRecoveryCount || hasProviderFailureCode)) ||\n      (setupRecoveryExhausted &&\n        turn.metadata?.providerRecoveryCount !== SANDBOX_SETUP_RECOVERY_LIMIT)\n    ) {\n      return { action: \"stale\" };\n    }\n    if (hasProviderRecoveryCount !== hasProviderFailureCode) {\n      return { action: \"stale\" };\n    }\n    if (!validProviderOverloadRecoveryDelay(providerFailureCode, providerRecoveryContinueDelayMs)) {\n      return { action: \"stale\" };\n    }\n    if (\n      providerRecoveryCount !== undefined &&\n      (!Number.isSafeInteger(providerRecoveryCount) ||\n        providerRecoveryCount <= 0 ||\n        providerRecoveryCount !== providerRecoveryCountFromMetadata(turn.metadata ?? {}) + 1 ||\n        providerRecoveryCount > providerRecoveryLimit(providerFailureCode) ||\n        typeof providerFailureCode !== \"string\" ||\n        !/^[a-z][a-z0-9_]{0,63}$/.test(providerFailureCode))\n    ) {\n      return { action: \"stale\" };\n    }\n    const recoveredClaimCode = postClaimIdentityMatches\n      ? postClaimRecovery!.code\n      : input.preClaimFailure?.disposition === \"retryable\" &&\n          input.preClaimFailure.code !== \"claim_invariant\"\n        ? input.preClaimFailure.code\n        : input.preClaimFailureDisposition === \"retryable\"\n          ? \"legacy_retryable_preclaim_database_failure\"\n          : null;\n    if (recoveredClaimCode) {\n      // Known usage from the failed attempt is recorded under its original\n      // source identities before any replacement attempt can dispatch. A\n      // failure here retries this DB-only lane; nothing is re-requested.\n      const heldReceipts = postClaimIdentityMatches\n        ? (postClaimRecovery?.sessionUsageReceipts ?? [])\n        : [];\n      if (heldReceipts.length > 0) {\n        await writeSessionUsageReceipts(\n          db,\n          { accountId: input.accountId, workspaceId: input.workspaceId },\n          heldReceipts,\n        );\n      }\n      const recovery = await requestSessionTurnRecoveryFn(db, input.workspaceId, {\n        sessionId: input.sessionId,\n        turnId: turn.id,\n        triggerEventId: turn.triggerEventId,\n        attemptId: input.attemptId,\n        reason: setupOutcomeUnknown\n          ? \"sandbox_command_start_outcome_unknown\"\n          : setupRecoveryExhausted\n            ? \"sandbox_command_start_recovery_exhausted\"\n            : (providerFailureCode ?? \"claimed_attempt_database_failure\"),\n        ...(setupOutcomeUnknown ? { sandboxSetupOutcomeUnknown: true } : {}),\n        ...(setupRecoveryExhausted ? { sandboxSetupRecoveryExhausted: true } : {}),\n        ...(providerRecoveryCount !== undefined ? { providerRecoveryCount } : {}),\n        detail: {\n          code: setupOutcomeUnknown\n            ? \"sandbox_command_start_outcome_unknown\"\n            : setupRecoveryExhausted\n              ? \"sandbox_command_start_recovery_exhausted\"\n              : providerFailureCode === PROVIDER_OVERLOAD_RECOVERY_CODE\n                ? \"provider_unavailable\"\n                : (providerFailureCode ?? recoveredClaimCode),\n          retryable: !setupOutcomeUnknown && !setupRecoveryExhausted,\n          ...(setupOutcomeUnknown ? { setupOutcome: \"unknown\", replay: \"blocked\" } : {}),\n          ...(setupRecoveryExhausted\n            ? {\n                setupOutcome: \"not_started\",\n                replay: \"blocked\",\n                recoveryExhausted: true,\n                providerRecoveryCount: SANDBOX_SETUP_RECOVERY_LIMIT,\n              }\n            : {}),\n          ...(providerRecoveryCount !== undefined\n            ? {\n                databaseFailureCode: recoveredClaimCode,\n                providerRecoveryCount,\n                ...(providerFailureCode === PROVIDER_OVERLOAD_RECOVERY_CODE\n                  ? {\n                      providerCondition: \"overloaded\",\n                      maxProviderRecoveryCount: providerRecoveryLimit(providerFailureCode),\n                      continueDelayMs: providerRecoveryContinueDelayMs,\n                    }\n                  : {}),\n              }\n            : {}),\n          recoverySource: \"workflow_activity_failure\",\n        },\n        fromStatuses: [\"running\"],\n      });\n      if (recovery.action !== \"recovering\") return { action: \"stale\" };\n      await publishDurableSessionEventsFn(bus, input.workspaceId, input.sessionId, recovery.events);\n      await refreshQueuedTurnsGauge(\n        db,\n        observability,\n        countQueuedTurnsFn,\n        recordTurnsQueuedGaugeFn,\n      );\n      return {\n        action: \"recovering\",\n        ...(providerRecoveryContinueDelayMs !== undefined\n          ? { continueDelayMs: providerRecoveryContinueDelayMs }\n          : {}),\n      };\n    }\n    const trigger = await getSessionEventFn(db, input.workspaceId, turn.triggerEventId);\n    const result = await applySessionTurnSettlementFn(db, input.workspaceId, {\n      sessionId: input.sessionId,\n      turnId: turn.id,\n      triggerEventId: turn.triggerEventId,\n      attemptId: input.attemptId,\n      turnStatus: \"failed\",\n      sessionStatus: \"failed\",\n      activeTurnId: null,\n      events: [\n        {\n          type: \"turn.failed\",\n          payload: {\n            triggerEventId: turn.triggerEventId,\n            trigger: trigger?.payload ?? null,\n            error: input.error ?? \"Agent activity failed before it could report a terminal state.\",\n          },\n        },\n        { type: \"session.status.changed\", payload: { status: \"failed\" } },\n      ],\n    });\n    if (result.action === \"stale\") {\n      return { action: \"stale\" };\n    }\n    await publishDurableSessionEventsFn(bus, input.workspaceId, input.sessionId, result.events);\n    await deliverFailedChildTurnToParentFn(\n      { db, bus, settings, observability, wakeSessionWorkflow },\n      input.workspaceId,\n      input.sessionId,\n      turn.id,\n    );\n    return { action: \"failed\" };\n  }\n\n  async function settleSessionInterruptions(\n    input: SettleSessionInterruptionsInput,\n  ): Promise<{ action: \"paused\" | \"continue\" | \"stale\" }> {\n    const { db, bus, observability } = await services();\n    if (input.phase === \"attempt_quiesced\") {\n      // Replay compatibility only: v1 histories scheduled this idempotent\n      // fallback after WAIT_CANCELLATION_COMPLETED. Receipt-gated v2 workflows\n      // never call it; runAgentTurn writes immediately after its hard fence.\n      const events = await markSessionAttemptQuiescedFn(db, {\n        workspaceId: input.workspaceId,\n        sessionId: input.sessionId,\n        attemptId: input.attemptId,\n        temporalWorkflowId: input.workflowId,\n      });\n      await publishDurableSessionEventsFn(bus, input.workspaceId, input.sessionId, events);\n      return { action: \"stale\" };\n    }\n    const applied = await settleSessionAttemptInterruptionsFn(\n      db,\n      input.workspaceId,\n      input.sessionId,\n      input.attemptId,\n    );\n    if (applied.events.length > 0) {\n      await publishDurableSessionEventsFn(bus, input.workspaceId, input.sessionId, applied.events);\n    }\n    await refreshQueuedTurnsGauge(db, observability, countQueuedTurnsFn, recordTurnsQueuedGaugeFn);\n    return { action: applied.action };\n  }\n\n  /** Persist an exact activity-owned physical-quiescence proof through the\n   * workflow control-activity retry policy. The DB transaction remains the\n   * sole receipt/wake authority; duplicate signals and activity retries reuse\n   * its attempt-scoped idempotency key. */\n  async function persistSessionAttemptQuiescence(\n    input: PersistSessionAttemptQuiescenceInput,\n  ): Promise<void> {\n    const { db, bus, observability } = await services();\n    const events = await markSessionAttemptQuiescedFn(db, {\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      sessionId: input.sessionId,\n      attemptId: input.attemptId,\n      temporalWorkflowId: input.workflowId,\n      temporalWorkflowRunId: input.workflowRunId,\n      temporalActivityId: input.activityId,\n      allowUninterrupted: true,\n    });\n    try {\n      await publishDurableSessionEventsFn(bus, input.workspaceId, input.sessionId, events);\n    } catch (error) {\n      // The receipt and exact workflow wake already committed atomically in\n      // Postgres. NATS is best-effort live fanout and must not keep this\n      // control activity retrying or delay receipt-gated admission.\n      observability.error(\"session-attempt quiescence event fanout failed\", {\n        \"opengeni.session_id\": input.sessionId,\n        \"opengeni.attempt_id\": input.attemptId,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n\n  async function reconcileSessionAttemptQuiescenceActivity(\n    input: ReconcileSessionAttemptQuiescenceInput,\n  ): Promise<ReconcileSessionAttemptQuiescenceResult> {\n    const { db, bus, inspectSessionAttemptActivity } = await services();\n    const activityRef = await getSessionAttemptActivityRefFn(db, {\n      ...input,\n      temporalWorkflowId: input.workflowId,\n    });\n    if (!activityRef) return { action: \"stale\" };\n    if (!activityRef.quiesced) {\n      if (!inspectSessionAttemptActivity) return { action: \"pending\" };\n      const state = await inspectSessionAttemptActivity(activityRef);\n      if (state === \"pending\") return { action: \"pending\" };\n    }\n    const result = await reconcileSessionAttemptQuiescenceFn(db, {\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      sessionId: input.sessionId,\n      attemptId: input.attemptId,\n      temporalWorkflowId: input.workflowId,\n      temporalWorkflowRunId: activityRef.workflowRunId,\n      temporalActivityId: activityRef.activityId,\n      activitySettled: true,\n    });\n    if (result.events.length > 0) {\n      await publishDurableSessionEventsFn(\n        bus,\n        input.workspaceId,\n        input.sessionId,\n        result.events,\n      ).catch(() => undefined);\n    }\n    return { action: result.action };\n  }\n\n  /** A new authenticated inspection, never trust the earlier observer hint.\n   * The DB seam independently revalidates the entire stored/current identity,\n   * control and both writer predicates under canonical locks before closing. */\n  async function reconcileSettledSessionAttemptActivity(\n    input: ReconcileSettledSessionAttemptInput,\n  ): Promise<ReconcileSettledSessionAttemptResult> {\n    const { db, bus, inspectSessionAttemptActivity, settings, observability, wakeSessionWorkflow } =\n      await services();\n    const ref = await getSessionAttemptActivityRefFn(db, {\n      ...input,\n      temporalWorkflowId: input.workflowId,\n    });\n    if (!ref || ref.workflowRunId !== input.workflowRunId || ref.activityId !== input.activityId)\n      return { action: \"stale\" };\n    if (!inspectSessionAttemptActivity) return { action: \"pending\" };\n    try {\n      if ((await inspectSessionAttemptActivity(ref)) !== \"settled\") return { action: \"pending\" };\n    } catch (error) {\n      if (error instanceof CancelledFailure) throw error;\n      if (currentActivityContext()?.cancellationSignal.aborted)\n        throw new CancelledFailure(\"Settled-owner reconciliation cancelled\");\n      return { action: \"pending\" };\n    }\n    if (currentActivityContext()?.cancellationSignal.aborted)\n      throw new CancelledFailure(\"Settled-owner reconciliation cancelled\");\n    const result = await reconcileSettledSessionAttemptFn(db, {\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      sessionId: input.sessionId,\n      turnId: input.turnId,\n      attemptId: input.attemptId,\n      executionGeneration: input.executionGeneration,\n      temporalWorkflowId: ref.workflowId,\n      temporalWorkflowRunId: ref.workflowRunId,\n      temporalActivityId: ref.activityId,\n      activitySettled: true,\n      maxRedispatches: WORKER_DEATH_MAX_REDISPATCHES,\n    });\n    // Atomic Postgres recovery/quiescence/wake truth is already sufficient if\n    // live fanout fails. It must not be replaced by an observer-only wake.\n    if (result.events.length > 0)\n      await publishDurableSessionEventsFn(\n        bus,\n        input.workspaceId,\n        input.sessionId,\n        result.events,\n      ).catch(() => undefined);\n    if (result.action === \"exceeded\")\n      await deliverFailedChildTurnToParentFn(\n        { db, bus, settings, observability, wakeSessionWorkflow },\n        input.workspaceId,\n        input.sessionId,\n        result.turnId,\n      );\n    return { action: result.action };\n  }\n\n  /**\n   * Recover the same current inference when its worker dies without completing\n   * a graceful checkpoint (heartbeat timeout, SIGKILL, OOM, or node loss).\n   * Durable conversation truth and the original trigger stay attached to the\n   * same turn; recovery creates a new fenced attempt, never a prompt-queue row\n   * or a synthetic resume message. Repeated worker deaths are bounded per turn.\n   */\n  async function recoverDispatch(input: RecoverDispatchInput): Promise<RecoverDispatchResult> {\n    const { settings, db, bus, observability, wakeSessionWorkflow } = await services();\n    const result = await recoverSessionDispatchFn(db, input.workspaceId, {\n      sessionId: input.sessionId,\n      attemptId: input.attemptId,\n      timeoutType: input.timeoutType,\n      maxRedispatches: WORKER_DEATH_MAX_REDISPATCHES,\n    });\n    if (result.action === \"stale\" || result.action === \"unclaimed\") {\n      return { action: result.action };\n    }\n    recordWorkerDeathRecoveryMetricsFn(observability, {\n      outcome: result.action === \"exceeded\" ? \"exhausted\" : \"recovering\",\n      timeoutType: input.timeoutType,\n    });\n    await publishDurableSessionEventsFn(bus, input.workspaceId, input.sessionId, result.events);\n    await refreshQueuedTurnsGauge(db, observability, countQueuedTurnsFn, recordTurnsQueuedGaugeFn);\n    if (result.action === \"exceeded\") {\n      await deliverFailedChildTurnToParentFn(\n        { db, bus, settings, observability, wakeSessionWorkflow },\n        input.workspaceId,\n        input.sessionId,\n        result.turnId,\n      );\n      return {\n        action: \"exceeded\",\n        turnId: result.turnId,\n        redispatches: result.redispatches,\n      };\n    }\n    return {\n      action: \"recovering\",\n      turnId: result.turnId,\n      redispatches: result.redispatches,\n    };\n  }\n\n  /**\n   * Finish a retryable MCP timeout checkpoint that escaped a recovered turn's\n   * activity before any model request. Temporal carries the immutable turn\n   * identity in ApplicationFailure details; this activity re-reads and fences\n   * every field before mutating the exact still-owned attempt. A checkpoint\n   * that committed before event fanout failed is already recovering and\n   * therefore returns stale without another event or child callback.\n   */\n  async function recoverEscapedMcpTimeout(\n    input: RecoverEscapedMcpTimeoutInput,\n  ): Promise<RecoverEscapedMcpTimeoutResult> {\n    const { db, bus, observability } = await services();\n    const turn = await getSessionTurnForAttemptFn(\n      db,\n      input.workspaceId,\n      input.sessionId,\n      input.attemptId,\n    );\n    if (!turn) return { action: \"stale\" };\n    if (\n      turn.id !== input.turnId ||\n      turn.triggerEventId !== input.triggerEventId ||\n      turn.executionGeneration !== input.executionGeneration ||\n      input.executionGeneration <= 1 ||\n      input.providerRecoveryCount !== providerRecoveryCountFromMetadata(turn.metadata) + 1 ||\n      input.providerRecoveryCount > MAX_AUTOMATIC_PROVIDER_RECOVERIES\n    ) {\n      return { action: \"ineligible\" };\n    }\n    const recovery = await requestSessionTurnRecoveryFn(db, input.workspaceId, {\n      sessionId: input.sessionId,\n      turnId: input.turnId,\n      triggerEventId: input.triggerEventId,\n      attemptId: input.attemptId,\n      reason: \"mcp_transport_timeout\",\n      providerRecoveryCount: input.providerRecoveryCount,\n      detail: {\n        code: \"mcp_transport_timeout\",\n        retryable: true,\n        continueDelayMs: input.continueDelayMs,\n        providerRecoveryCount: input.providerRecoveryCount,\n        recoverySource: \"workflow_activity_failure\",\n      },\n      fromStatuses: [\"running\"],\n    });\n    if (recovery.action !== \"recovering\") {\n      return { action: \"stale\" };\n    }\n    await publishDurableSessionEventsFn(bus, input.workspaceId, input.sessionId, recovery.events);\n    await refreshQueuedTurnsGauge(db, observability, countQueuedTurnsFn, recordTurnsQueuedGaugeFn);\n    return { action: \"recovering\" };\n  }\n\n  async function peekSessionWork(input: PeekSessionWorkInput) {\n    const { db, bus, observability, inspectSessionAttemptActivity } = await services();\n    // Already scheduled activities retain their old input across workflow upgrades.\n    // Resolve its workspace scope exactly as the legacy DB path did, then use the\n    // observer path so absent rows and a still-owned attempt are observations.\n    const observerAccountId =\n      input.observerAccountId ?? (await getWorkspaceFn(db, input.workspaceId))?.accountId;\n    if (!observerAccountId) return { kind: \"unavailable\" as const };\n    let peek = await peekSessionWorkFn(\n      db,\n      input.workspaceId,\n      input.sessionId,\n      input.includeAdmissionFence,\n      observerAccountId,\n    );\n    if (peek.kind === \"unavailable\") return peek;\n    if (peek.kind === \"admission-blocked\" && peek.reason === \"sandbox_setup_outcome_unknown\") {\n      const ref = peek.ref;\n      if (ref && \"turnId\" in ref && \"attemptId\" in ref) {\n        const settled = await reconcileCompletedSandboxSetupFn(db, {\n          accountId: observerAccountId,\n          workspaceId: input.workspaceId,\n          sessionId: input.sessionId,\n          turnId: ref.turnId,\n          attemptId: ref.attemptId,\n        });\n        if (settled.events.length > 0)\n          await publishDurableSessionEventsFn(\n            bus,\n            input.workspaceId,\n            input.sessionId,\n            settled.events,\n          );\n        if (settled.reconciled)\n          peek = await peekSessionWorkFn(\n            db,\n            input.workspaceId,\n            input.sessionId,\n            input.includeAdmissionFence,\n            observerAccountId,\n          );\n      }\n    }\n    if (peek.kind === \"attempt-owned\") {\n      // Observation never revokes a writer or recovers a live owner. In\n      // particular, a settled Temporal activity is not physical-writer proof.\n      let ownerActivityState: \"pending\" | \"settled\" | \"unknown\" = \"unknown\";\n      if (inspectSessionAttemptActivity) {\n        try {\n          ownerActivityState = await inspectSessionAttemptActivity(peek.activityRef);\n        } catch (error) {\n          if (error instanceof CancelledFailure) throw error;\n          if (currentActivityContext()?.cancellationSignal.aborted)\n            throw new CancelledFailure(\"Control observation cancelled\");\n          // This optional metadata observation grants no recovery authority.\n          // An unavailable inspector must not pin the control activity in\n          // retries and prevent a fresh Pause/owner/visibility observation.\n          // Database reads below remain outside this catch and retry normally.\n        }\n      }\n      if (currentActivityContext()?.cancellationSignal.aborted)\n        throw new CancelledFailure(\"Control observation cancelled\");\n      const current = await peekSessionWorkFn(\n        db,\n        input.workspaceId,\n        input.sessionId,\n        input.includeAdmissionFence,\n        observerAccountId,\n      );\n      if (\n        current.kind !== \"attempt-owned\" ||\n        current.turnId !== peek.turnId ||\n        current.attemptId !== peek.attemptId ||\n        current.executionGeneration !== peek.executionGeneration ||\n        current.activityRef.workflowId !== peek.activityRef.workflowId ||\n        current.activityRef.workflowRunId !== peek.activityRef.workflowRunId ||\n        current.activityRef.activityId !== peek.activityRef.activityId\n      )\n        return current;\n      return { ...current, ownerActivityState };\n    }\n    await refreshQueuedTurnsGauge(db, observability, countQueuedTurnsFn, recordTurnsQueuedGaugeFn);\n    return peek;\n  }\n\n  async function settleSessionInputWait(\n    input: SettleSessionInputWaitInput,\n  ): Promise<SettleSessionInputWaitResult> {\n    const { db, bus } = await services();\n    const result = await settleSessionInputWaitFn(db, input);\n    if (result.events.length > 0) {\n      await publishDurableSessionEventsFn(bus, input.workspaceId, input.sessionId, result.events);\n    }\n    return { action: result.action };\n  }\n\n  async function expireSessionHumanInput(\n    input: ExpireSessionHumanInputInput,\n  ): Promise<ExpireSessionHumanInputResult> {\n    const { db, bus } = await services();\n    const result = await expireSessionHumanInputRequestFn(db, input);\n    if (result.action === \"not_found\") return { action: \"not_found\" };\n    if (result.events.length > 0) {\n      await publishDurableSessionEventsFn(bus, input.workspaceId, input.sessionId, result.events);\n    }\n    return {\n      action: result.request.status === \"expired\" ? \"expired\" : \"stale\",\n    };\n  }\n\n  async function expireSessionInteractionIntervention(\n    input: ExpireSessionInteractionInterventionInput,\n  ): Promise<ExpireSessionInteractionInterventionResult> {\n    const { db, bus, observability } = await services();\n    const result = await expireSessionInteractionInterventionFn(db, input);\n    if (result.action === \"expired\" && result.intervention) {\n      // The unanswered-handoff timer settles here, never through the API.\n      interactionInterventionMetricObserver(observability)({\n        kind: result.intervention.kind,\n        outcome: \"expired\",\n        waitMs: Date.now() - result.intervention.createdAt.getTime(),\n      });\n    }\n    if (result.events.length > 0) {\n      await publishDurableSessionEventsFn(bus, input.workspaceId, input.sessionId, result.events);\n    }\n    return { action: result.action };\n  }\n\n  /** A scheduled run's approval timeout answers for its unanswered human wait. */\n  async function expireScheduledRunHumanWait(\n    input: ExpireScheduledRunHumanWaitInput,\n  ): Promise<ExpireScheduledRunHumanWaitResult> {\n    const { db, bus } = await services();\n    const result = await expireScheduledRunHumanWaitFn(db, input);\n    if (result.events.length > 0) {\n      await publishDurableSessionEventsFn(bus, input.workspaceId, input.sessionId, result.events);\n    }\n    return { action: result.action };\n  }\n\n  async function markSessionIdle(input: MarkSessionIdleInput): Promise<void> {\n    const { db, bus, settings, observability, wakeSessionWorkflow } = await services();\n    const settled = await settleSessionIdleWithParentOutboxFn(\n      db,\n      input.workspaceId,\n      input.sessionId,\n    );\n    if (settled.events.length > 0) {\n      await publishDurableSessionEventsFn(bus, input.workspaceId, input.sessionId, settled.events);\n    }\n    await refreshQueuedTurnsGauge(db, observability, countQueuedTurnsFn, recordTurnsQueuedGaugeFn);\n    if (settled.action === \"stale\" || !settled.notifyParent) {\n      return;\n    }\n    // The idle transaction distinguishes parked wait/goal obligations from\n    // completed work. Only a terminal idle boundary may notify the parent;\n    // workflow closure while waiting retains its durable wake without a result.\n    await notifyParentOfChildIdleFn(\n      { db, bus, settings, observability, wakeSessionWorkflow },\n      input.workspaceId,\n      input.sessionId,\n      settled.episodeKey,\n    );\n  }\n\n  return {\n    failSessionAttempt,\n    settleSessionInterruptions,\n    persistSessionAttemptQuiescence,\n    reconcileSessionAttemptQuiescence: reconcileSessionAttemptQuiescenceActivity,\n    reconcileSettledSessionAttempt: reconcileSettledSessionAttemptActivity,\n    recoverDispatch,\n    recoverEscapedMcpTimeout,\n    peekSessionWork,\n    settleSessionInputWait,\n    expireSessionHumanInput,\n    expireSessionInteractionIntervention,\n    expireScheduledRunHumanWait,\n    markSessionIdle,\n  };\n}\n\nasync function refreshQueuedTurnsGauge(\n  db: ControlActivityServices[\"db\"],\n  observability: ControlActivityServices[\"observability\"],\n  countQueuedTurnsFn: typeof countQueuedTurns,\n  recordTurnsQueuedGaugeFn: typeof recordTurnsQueuedGauge,\n): Promise<void> {\n  try {\n    recordTurnsQueuedGaugeFn(observability, await countQueuedTurnsFn(db));\n  } catch {\n    // Best-effort telemetry; session state transitions remain authoritative.\n  }\n}\n","import { createHash, randomUUID } from \"node:crypto\";\nimport { once } from \"node:events\";\nimport { createReadStream, createWriteStream } from \"node:fs\";\nimport { mkdtemp, rm } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { Transform } from \"node:stream\";\nimport { pipeline } from \"node:stream/promises\";\nimport { constants as zlibConstants, createZstdCompress } from \"node:zlib\";\nimport {\n  SESSION_ARCHIVE_EXPORT_TABLES,\n  SESSION_ARCHIVE_FORMAT,\n  SESSION_ARCHIVE_FORMAT_VERSION,\n  SESSION_ARCHIVE_TRANSCRIPT_FORMAT,\n  abandonSessionArchive,\n  beginSessionArchive,\n  claimSessionArchiveObjectDeletions,\n  completeSessionArchive,\n  completeSessionArchiveObjectDeletion,\n  listSessionArchiveCandidates,\n  listUnfinishedSessionArchives,\n  purgeArchivedSessionContent,\n  readSessionArchiveRows,\n  readSessionArchiveSessionRow,\n  readSessionArchiveTranscriptEvents,\n  type Database,\n  type SessionArchiveManifest,\n  type SessionArchiveScope,\n} from \"@opengeni/db\";\nimport {\n  uploadWorkspaceArchiveSpool,\n  WorkspaceArchiveStorageError,\n  type ObjectStorage,\n} from \"@opengeni/storage\";\nimport type { ControlActivityServices } from \"./types\";\n\n/**\n * Content-free public classification of a failed session archive. Telemetry\n * only exports reviewed error classes and codes, so a raw error name or\n * storage code would be reduced to a generic \"OperationError\".\n */\nexport function sessionArchiveFailureCode(error: unknown): string {\n  if (error instanceof WorkspaceArchiveStorageError) {\n    switch (error.code) {\n      case \"archive_object_missing\":\n        return \"session_archive_object_missing\";\n      case \"archive_hash_mismatch\":\n        return \"session_archive_hash_mismatch\";\n      default:\n        return \"session_archive_storage_failed\";\n    }\n  }\n  return \"session_archive_failed\";\n}\n\nexport const SESSION_ARCHIVE_CANDIDATES_PER_PASS = 25;\n/**\n * Soft budget for one archive pass. It shares a workflow (and the Schedule's\n * skip-overlap cadence) with content compaction and delta folding, so a long\n * archive pass would starve them while a backlog drains. Matching the storage\n * pass budget gives both an equal share; unfinished work resumes next pass.\n */\nexport const SESSION_ARCHIVE_TIME_BUDGET_MS = 10 * 60 * 1_000;\nexport const SESSION_ARCHIVE_STALE_SECONDS = 2 * 60 * 60;\nexport const SESSION_ARCHIVE_EXPORT_PAGE_ROWS = 200;\nexport const SESSION_ARCHIVE_PURGE_BATCH_ROWS = 2_000;\n\ntype Spool = {\n  path: string;\n  byteSize: number;\n  sha256: string;\n  open: () => AsyncIterable<Uint8Array>;\n  dispose: () => Promise<void>;\n};\n\n/** Stream JSON lines through zstd into a private file, metering the compressed bytes. */\nexport async function writeCompressedJsonLines(\n  path: string,\n  produce: (write: (line: string) => Promise<void>) => Promise<void>,\n): Promise<Spool> {\n  const zstd = createZstdCompress({ params: { [zlibConstants.ZSTD_c_compressionLevel]: 9 } });\n  const hash = createHash(\"sha256\");\n  let byteSize = 0;\n  const meter = new Transform({\n    transform(chunk: Buffer, _encoding, callback) {\n      hash.update(chunk);\n      byteSize += chunk.length;\n      callback(null, chunk);\n    },\n  });\n  const piping = pipeline(zstd, meter, createWriteStream(path, { flags: \"wx\", mode: 0o600 }));\n  const write = async (line: string) => {\n    if (!zstd.write(`${line}\\n`)) await once(zstd, \"drain\");\n  };\n  try {\n    await produce(write);\n    zstd.end();\n    await piping;\n  } catch (error) {\n    zstd.destroy(error instanceof Error ? error : new Error(String(error)));\n    await piping.catch(() => undefined);\n    await rm(path, { force: true });\n    throw error;\n  }\n  return {\n    path,\n    byteSize,\n    sha256: hash.digest(\"hex\"),\n    open: () => createReadStream(path),\n    dispose: async () => rm(path, { force: true }),\n  };\n}\n\nexport function sessionArchiveObjectKeys(scope: SessionArchiveScope, archiveId: string) {\n  const prefix = `session-archives/${scope.workspaceId}/${scope.sessionId}/${archiveId}`;\n  return {\n    bundle: `${prefix}/bundle.jsonl.zst`,\n    transcript: `${prefix}/transcript.jsonl.zst`,\n  };\n}\n\n/** Write the full-fidelity bundle: header, every exported row as exact JSON, footer. */\nasync function writeBundle(db: Database, scope: SessionArchiveScope, path: string) {\n  const rowCounts: Record<string, number> = {};\n  const sessionRow = await readSessionArchiveSessionRow(db, scope);\n  const spool = await writeCompressedJsonLines(path, async (write) => {\n    await write(\n      `{\"format\":${JSON.stringify(SESSION_ARCHIVE_FORMAT)},\"version\":${SESSION_ARCHIVE_FORMAT_VERSION},` +\n        `\"createdAt\":${JSON.stringify(new Date().toISOString())},` +\n        `\"tables\":${JSON.stringify(SESSION_ARCHIVE_EXPORT_TABLES.map((spec) => spec.table))},` +\n        `\"session\":${sessionRow}}`,\n    );\n    for (const spec of SESSION_ARCHIVE_EXPORT_TABLES) {\n      let after: string[] | null = null;\n      let count = 0;\n      for (;;) {\n        const page = await readSessionArchiveRows(db, scope, spec, {\n          after,\n          limit: SESSION_ARCHIVE_EXPORT_PAGE_ROWS,\n        });\n        for (const row of page.rows) {\n          await write(`{\"table\":${JSON.stringify(spec.table)},\"row\":${row}}`);\n        }\n        count += page.rows.length;\n        if (page.rows.length < SESSION_ARCHIVE_EXPORT_PAGE_ROWS) break;\n        after = page.last;\n      }\n      rowCounts[spec.table] = count;\n    }\n    await write(`{\"end\":true,\"rowCounts\":${JSON.stringify(rowCounts)}}`);\n  });\n  return { spool, rowCounts };\n}\n\n/** Write the readable transcript: public SessionEvent objects, one per line. */\nasync function writeTranscript(db: Database, scope: SessionArchiveScope, path: string) {\n  let events = 0;\n  const spool = await writeCompressedJsonLines(path, async (write) => {\n    await write(\n      JSON.stringify({\n        format: SESSION_ARCHIVE_TRANSCRIPT_FORMAT,\n        version: SESSION_ARCHIVE_FORMAT_VERSION,\n        workspaceId: scope.workspaceId,\n        sessionId: scope.sessionId,\n      }),\n    );\n    let afterSequence = 0;\n    for (;;) {\n      const page = await readSessionArchiveTranscriptEvents(db, scope, {\n        afterSequence,\n        limit: 500,\n      });\n      for (const event of page) await write(JSON.stringify({ event }));\n      events += page.length;\n      if (page.length < 500) break;\n      afterSequence = page.at(-1)!.sequence;\n    }\n    await write(JSON.stringify({ end: true, events }));\n  });\n  return { spool, events };\n}\n\nexport type ArchiveSessionOutcome = \"archived\" | \"skipped\" | \"failed\";\n\nexport type SessionArchiveActivityOptions = {\n  candidatesPerPass?: number;\n  timeBudgetMs?: number;\n  now?: () => number;\n  upload?: (storage: ObjectStorage, key: string, spool: Spool) => Promise<void>;\n};\n\nexport type ArchiveIdleSessionsResult = {\n  enabled: boolean;\n  archived: number;\n  skipped: number;\n  failed: number;\n  abandoned: number;\n  purgedRows: number;\n  objectsDeleted: number;\n};\n\n/**\n * The idle-session archiver. Off unless the deployment enables it; recovery of\n * unfinished archives and deletion of removed sessions' objects always run so\n * that disabling the feature never strands work.\n */\nexport function createSessionArchiveActivities(\n  services: () => Promise<ControlActivityServices>,\n  options: SessionArchiveActivityOptions = {},\n) {\n  const candidatesPerPass = options.candidatesPerPass ?? SESSION_ARCHIVE_CANDIDATES_PER_PASS;\n  const timeBudgetMs = options.timeBudgetMs ?? SESSION_ARCHIVE_TIME_BUDGET_MS;\n  const now = options.now ?? Date.now;\n  const upload = options.upload ?? uploadWorkspaceArchiveSpool;\n\n  async function archiveOne(\n    db: Database,\n    storage: ObjectStorage,\n    scope: SessionArchiveScope,\n    idleSeconds: number,\n  ): Promise<ArchiveSessionOutcome> {\n    const keys = sessionArchiveObjectKeys(scope, randomUUID());\n    const begun = await beginSessionArchive(db, scope, {\n      idleSeconds,\n      objectKeys: [keys.bundle, keys.transcript],\n    });\n    if (!begun) return \"skipped\";\n    const directory = await mkdtemp(join(tmpdir(), \"opengeni-session-archive-\"));\n    try {\n      const bundle = await writeBundle(db, scope, join(directory, \"bundle.jsonl.zst\"));\n      const transcript = await writeTranscript(db, scope, join(directory, \"transcript.jsonl.zst\"));\n      await upload(storage, keys.bundle, bundle.spool);\n      await upload(storage, keys.transcript, transcript.spool);\n      const manifest: SessionArchiveManifest = {\n        format: SESSION_ARCHIVE_FORMAT,\n        version: SESSION_ARCHIVE_FORMAT_VERSION,\n        objectKeys: [keys.bundle, keys.transcript],\n        bundle: { key: keys.bundle, bytes: bundle.spool.byteSize, sha256: bundle.spool.sha256 },\n        transcript: {\n          key: keys.transcript,\n          bytes: transcript.spool.byteSize,\n          sha256: transcript.spool.sha256,\n          events: transcript.events,\n        },\n        sha256: bundle.spool.sha256,\n        rowCounts: bundle.rowCounts,\n        createdAt: new Date(now()).toISOString(),\n      };\n      if (!(await completeSessionArchive(db, scope, manifest))) {\n        throw new Error(\"session archive state changed before completion\");\n      }\n      return \"archived\";\n    } catch (error) {\n      await abandonSessionArchive(db, scope).catch(() => undefined);\n      throw error;\n    } finally {\n      await rm(directory, { recursive: true, force: true });\n    }\n  }\n\n  async function purgeUntilDone(\n    db: Database,\n    scope: SessionArchiveScope,\n    deadline: number,\n  ): Promise<number> {\n    let purged = 0;\n    while (now() < deadline) {\n      const step = await purgeArchivedSessionContent(db, scope, {\n        batchSize: SESSION_ARCHIVE_PURGE_BATCH_ROWS,\n      });\n      purged += step.deleted;\n      if (step.complete) break;\n    }\n    return purged;\n  }\n\n  async function archiveIdleSessions(): Promise<ArchiveIdleSessionsResult> {\n    const { db, objectStorage, observability, settings } = await services();\n    const deadline = now() + timeBudgetMs;\n    const result: ArchiveIdleSessionsResult = {\n      enabled: settings.sessionArchiveEnabled,\n      archived: 0,\n      skipped: 0,\n      failed: 0,\n      abandoned: 0,\n      purgedRows: 0,\n      objectsDeleted: 0,\n    };\n    if (objectStorage) {\n      for (const deletion of await claimSessionArchiveObjectDeletions(db, {\n        claimTimeoutSeconds: 600,\n        limit: 200,\n      })) {\n        try {\n          await objectStorage.deleteObject(deletion.objectKey);\n          if (await completeSessionArchiveObjectDeletion(db, deletion.objectKey)) {\n            result.objectsDeleted += 1;\n          }\n        } catch (error) {\n          observability.warn(\"session archive object deletion failed; it will be retried\", {\n            workspaceId: deletion.workspaceId,\n            sessionId: deletion.sessionId,\n            errorName: error instanceof Error ? error.name : \"unknown\",\n          });\n        }\n      }\n    }\n\n    for (const unfinished of await listUnfinishedSessionArchives(db, {\n      staleSeconds: SESSION_ARCHIVE_STALE_SECONDS,\n      limit: 25,\n    })) {\n      if (now() >= deadline) break;\n      // One session's failure must not stop the pass: it is retried next pass,\n      // and new archives still proceed.\n      try {\n        if (unfinished.state === \"archiving\") {\n          if (await abandonSessionArchive(db, unfinished)) result.abandoned += 1;\n        } else {\n          result.purgedRows += await purgeUntilDone(db, unfinished, deadline);\n        }\n      } catch (error) {\n        result.failed += 1;\n        observability.warn(\"session archive recovery failed; it will be retried\", {\n          workspaceId: unfinished.workspaceId,\n          sessionId: unfinished.sessionId,\n          errorClass: \"SessionArchiveOperationError\",\n          errorCode: sessionArchiveFailureCode(error),\n        });\n      }\n    }\n\n    if (!settings.sessionArchiveEnabled) return result;\n    if (!objectStorage) {\n      observability.warn(\"session archive is enabled but object storage is not configured\");\n      return result;\n    }\n    const idleSeconds = settings.sessionArchiveIdleDays * 24 * 60 * 60;\n    // Keep taking batches until the budget ends or nothing new qualifies, so a\n    // large backlog (for example right after enabling) drains steadily. A\n    // session that failed or was skipped is not retried in the same pass.\n    const attempted = new Set<string>();\n    for (;;) {\n      if (now() >= deadline) break;\n      const candidates = (\n        await listSessionArchiveCandidates(db, {\n          idleSeconds,\n          limit: candidatesPerPass + attempted.size,\n        })\n      ).filter((candidate) => !attempted.has(candidate.sessionId));\n      if (candidates.length === 0) break;\n      for (const scope of candidates.slice(0, candidatesPerPass)) {\n        if (now() >= deadline) break;\n        attempted.add(scope.sessionId);\n        try {\n          const outcome = await archiveOne(db, objectStorage, scope, idleSeconds);\n          if (outcome === \"skipped\") {\n            result.skipped += 1;\n            continue;\n          }\n          result.archived += 1;\n          result.purgedRows += await purgeUntilDone(db, scope, deadline);\n        } catch (error) {\n          result.failed += 1;\n          observability.warn(\"session archive failed; the session stays live\", {\n            workspaceId: scope.workspaceId,\n            sessionId: scope.sessionId,\n            // Content-free classification only: database errors can echo row values.\n            errorClass: \"SessionArchiveOperationError\",\n            errorCode: sessionArchiveFailureCode(error),\n          });\n        }\n      }\n    }\n    if (result.archived + result.failed + result.abandoned + result.objectsDeleted > 0) {\n      observability.info(\"session archive pass finished\", { ...result });\n    }\n    return result;\n  }\n\n  return { archiveIdleSessions };\n}\n","import { compactLegacySessionContent } from \"@opengeni/db\";\nimport type { ControlActivityServices } from \"./types\";\n\n/** Rows per content kind rewritten by one compaction batch. */\nexport const SESSION_CONTENT_COMPACTION_ROWS_PER_PASS = 200;\n/** Soft budget for one pass; the workflow's activity timeout is 15 minutes. */\nexport const SESSION_STORAGE_PASS_BUDGET_MS = 10 * 60 * 1_000;\n\nexport type MaintainSessionStorageResult = {\n  contentCompaction: { scanned: number; compacted: number; skipped: number; failed: number };\n};\n\nexport type SessionStorageActivityOptions = {\n  compactionRowsPerPass?: number;\n  compactLegacyContent?: typeof compactLegacySessionContent;\n  timeBudgetMs?: number;\n  now?: () => number;\n};\n\n/**\n * Deployment-wide session storage maintenance: legacy content compaction. It is\n * lossless (the database proves every rewrite) and therefore always on, and it\n * keeps working through its backlog while it makes progress and the pass has\n * budget left. Streamed text deltas need no pass: the turn writer stores each\n * flush's adjacent fragments as one row.\n */\nexport function createSessionStorageActivities(\n  services: () => Promise<ControlActivityServices>,\n  options: SessionStorageActivityOptions = {},\n) {\n  const rowsPerPass = options.compactionRowsPerPass ?? SESSION_CONTENT_COMPACTION_ROWS_PER_PASS;\n  const compactLegacyContent = options.compactLegacyContent ?? compactLegacySessionContent;\n  const timeBudgetMs = options.timeBudgetMs ?? SESSION_STORAGE_PASS_BUDGET_MS;\n  const now = options.now ?? Date.now;\n\n  async function maintainSessionStorage(): Promise<MaintainSessionStorageResult> {\n    const { db, observability } = await services();\n    const deadline = now() + timeBudgetMs;\n    const contentCompaction = { scanned: 0, compacted: 0, skipped: 0, failed: 0 };\n    do {\n      const batch = await compactLegacyContent(db, {\n        maxRows: rowsPerPass,\n        onRowError: (candidate, error) =>\n          observability.warn(\"session content compaction failed; row stays in legacy form\", {\n            kind: candidate.kind,\n            workspaceId: candidate.workspaceId,\n            sessionId: candidate.sessionId,\n            attemptId: candidate.attemptId,\n            errorName: error instanceof Error ? error.name : \"unknown\",\n          }),\n      });\n      contentCompaction.scanned += batch.scanned;\n      contentCompaction.compacted += batch.compacted;\n      contentCompaction.skipped += batch.skipped;\n      contentCompaction.failed += batch.failed;\n      // Rows that stay legacy are rescanned first; stop once a batch gains nothing.\n      if (batch.compacted === 0) break;\n    } while (now() < deadline);\n    if (contentCompaction.compacted > 0 || contentCompaction.failed > 0) {\n      observability.info(\"session content compaction pass finished\", contentCompaction);\n    }\n\n    return { contentCompaction };\n  }\n\n  return { maintainSessionStorage };\n}\n","import {\n  fireWorkspacePauseTimerInTransaction,\n  listDueWorkspacePauseTimers,\n  withWorkspaceRls,\n  getWorkspaceControlEvent,\n  type Database,\n} from \"@opengeni/db\";\nimport { publishDurableWorkspaceControlEvent } from \"@opengeni/events\";\nimport { recordWorkflowWakeReconciliation } from \"@opengeni/observability\";\nimport type { ControlActivityServices } from \"./types\";\nimport {\n  reconcileAutomaticSessionTitleFanout,\n  reconcilePendingSessionWorkflowWakes,\n  type WorkflowWakeReconciliationResult,\n} from \"./parent-wake\";\n\nconst BATCH_SIZE = 1_000;\nconst MAX_DELIVERIES_PER_ACTIVITY = 10_000;\nconst MAX_TITLE_FANOUT_PER_ACTIVITY = 1_000;\n\nexport type DispatchSessionWorkflowWakesResult = WorkflowWakeReconciliationResult & {\n  exhaustedBatchLimit: boolean;\n};\n\n/**\n * Drain committed session-workflow wake revisions through the same signal and\n * acknowledgement path used by immediate delivery. This is a repair path, not\n * an eligibility scan: producers have already decided what must be delivered.\n */\nexport function createWorkflowWakeActivities(services: () => Promise<ControlActivityServices>) {\n  return {\n    async dispatchSessionWorkflowWakes(): Promise<DispatchSessionWorkflowWakesResult> {\n      const service = await services();\n      // Timer commits produce ordinary durable wakes; drain those below in the same sweep.\n      const timers = await listDueWorkspacePauseTimers(service.db, 100);\n      for (const timer of timers) {\n        try {\n          const result = await withWorkspaceRls(service.db, timer.workspace_id, (scoped) =>\n            scoped.transaction((tx) =>\n              fireWorkspacePauseTimerInTransaction(tx as unknown as Database, {\n                workspaceId: timer.workspace_id,\n                timerId: timer.timer_id,\n              }),\n            ),\n          );\n          if (result?.workspaceControlEventId) {\n            const event = await getWorkspaceControlEvent(\n              service.db,\n              timer.workspace_id,\n              result.workspaceControlEventId,\n            );\n            if (event)\n              await publishDurableWorkspaceControlEvent(service.bus, timer.workspace_id, event);\n          }\n        } catch (error) {\n          service.observability.warn(\"Workspace pause timer will retry\", {\n            workspaceId: timer.workspace_id,\n            error: String(error),\n          });\n        }\n      }\n      let claimed = 0;\n      let signaled = 0;\n      let pendingAdmission = 0;\n      let unconfirmed = 0;\n      const pendingAdmissionBlockers: WorkflowWakeReconciliationResult[\"pendingAdmissionBlockers\"] =\n        {};\n      let delivered = 0;\n      let failed = 0;\n      let exhaustedBatchLimit = false;\n      for (;;) {\n        const remaining = MAX_DELIVERIES_PER_ACTIVITY - claimed;\n        if (remaining <= 0) {\n          exhaustedBatchLimit = true;\n          break;\n        }\n        const limit = Math.min(BATCH_SIZE, remaining);\n        const batch = await reconcilePendingSessionWorkflowWakes(service, limit);\n        claimed += batch.claimed;\n        signaled += batch.signaled;\n        delivered += batch.delivered;\n        pendingAdmission += batch.pendingAdmission;\n        unconfirmed += batch.unconfirmed;\n        for (const [blocker, count] of Object.entries(batch.pendingAdmissionBlockers)) {\n          const key = blocker as keyof typeof pendingAdmissionBlockers;\n          pendingAdmissionBlockers[key] = (pendingAdmissionBlockers[key] ?? 0) + count;\n        }\n        failed += batch.failed;\n        if (batch.claimed < limit) break;\n      }\n\n      // Migration fanout is lower priority than ordinary workflow wakes and is\n      // independently capped. Delivery acknowledgements run with bounded\n      // concurrency in the reconciler, so a broker timeout cannot occupy the\n      // five-minute activity budget once per quarantined session. Managed NATS\n      // uses its bounded confirmed publish; embedding buses use their required\n      // publish promise.\n      const titleFanout = await reconcileAutomaticSessionTitleFanout(\n        service,\n        MAX_TITLE_FANOUT_PER_ACTIVITY,\n      );\n      if (titleFanout.claimed > 0) {\n        service.observability.info(\"automatic-title migration event fanout reconciled\", {\n          claimed: titleFanout.claimed,\n          delivered: titleFanout.delivered,\n          failed: titleFanout.failed,\n        });\n      }\n      const result = {\n        claimed,\n        signaled,\n        delivered,\n        pendingAdmission,\n        unconfirmed,\n        failed,\n        pendingAdmissionBlockers,\n        exhaustedBatchLimit,\n      };\n      recordWorkflowWakeReconciliation(service.observability, result);\n      return result;\n    },\n  };\n}\n","import { createKnowledgeIndexingActivities } from \"./activities/knowledge-indexing\";\nimport { createSharedActivityServices } from \"./activity-services\";\nimport { createCodexCapacityActivities } from \"./activities/codex-capacity\";\nimport { createBrowserStateArtifactMaintenanceActivities } from \"./activities/browser-state-artifact-reaper\";\nimport { createBrowserDeadlineCheckpointActivities } from \"./activities/browser-deadline-checkpoint\";\nimport { createAutomationActivities } from \"./activities/automations\";\nimport { createDocumentActivities } from \"./activities/documents\";\nimport { createFileUploadReaperActivities } from \"./activities/file-upload-reaper\";\nimport { createGoalActivities } from \"./activities/goals\";\nimport { createModelCallFactReconcilerActivities } from \"./activities/model-call-fact-reconciler\";\nimport { createKnowledgeSourceSyncActivities } from \"./activities/knowledge-source-sync\";\nimport { createRetainedScreenshotMaintenanceActivities } from \"./activities/retained-screenshot-reaper\";\nimport { createRigVerificationActivities } from \"./activities/rig-verification\";\nimport { createSandboxLeaseActivities } from \"./activities/sandbox-lease\";\nimport { createScheduledTaskActivities } from \"./activities/scheduled-tasks\";\nimport { createSiteAuthMaintenanceActivities } from \"./activities/site-auth-maintenance\";\nimport { createSessionStateActivities } from \"./activities/session-state\";\nimport { createSessionArchiveActivities } from \"./activities/session-archive\";\nimport { createSessionStorageActivities } from \"./activities/session-storage\";\nimport type { ActivityDependencies, ControlActivityServices } from \"./activities/types\";\nimport { createWorkflowWakeActivities } from \"./activities/workflow-wake\";\n\nfunction createControlActivityServices(\n  dependencies: ActivityDependencies,\n): () => Promise<ControlActivityServices> {\n  const shared = createSharedActivityServices(dependencies);\n  return shared;\n}\n\nexport function createControlActivitiesFromServices(\n  services: () => Promise<ControlActivityServices>,\n  resolveDocumentServices?: () => Promise<import(\"@opengeni/documents\").DocumentServices>,\n) {\n  return {\n    ...createAutomationActivities(services),\n    ...createDocumentActivities(services, resolveDocumentServices),\n    ...createKnowledgeIndexingActivities(services, resolveDocumentServices),\n    ...createKnowledgeSourceSyncActivities(services, resolveDocumentServices),\n    ...createSessionStateActivities(services),\n    ...createSessionStorageActivities(services),\n    ...createSessionArchiveActivities(services),\n    ...createScheduledTaskActivities(services),\n    ...createSiteAuthMaintenanceActivities(services),\n    ...createGoalActivities(services),\n    ...createCodexCapacityActivities(services),\n    ...createRigVerificationActivities(services),\n    ...createBrowserStateArtifactMaintenanceActivities(services),\n    ...createBrowserDeadlineCheckpointActivities(services),\n    ...createFileUploadReaperActivities(services),\n    ...createModelCallFactReconcilerActivities(services),\n    ...createRetainedScreenshotMaintenanceActivities(services),\n    ...createWorkflowWakeActivities(services),\n    ...createSandboxLeaseActivities(services),\n  };\n}\n\nexport function createControlActivities(dependencies: ActivityDependencies = {}) {\n  const services = createControlActivityServices(dependencies);\n  let documentServicesPromise: Promise<import(\"@opengeni/documents\").DocumentServices> | null =\n    null;\n  const resolveDocumentServices = async () => {\n    documentServicesPromise ??= dependencies.documentServices\n      ? Promise.resolve(dependencies.documentServices)\n      : import(\"@opengeni/documents\").then(async ({ createDocumentServices }) =>\n          createDocumentServices((await services()).settings),\n        );\n    return await documentServicesPromise;\n  };\n  return createControlActivitiesFromServices(services, resolveDocumentServices);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,mCAAmC;AAC5C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAKA,IAAM,gCAAN,cAA4C,MAAM;AAAA,EACvD,cAAc;AACZ,UAAM,yCAAyC;AAC/C,SAAK,OAAO;AAAA,EACd;AACF;AAWO,SAAS,gCACd,OACA,OAWA;AACA,MAAI,iBAAiB,+BAA+B;AAClD,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,QAAQ;AAAA,IACV;AAAA,EACF;AACA,MAAI,UAAU,aAAa;AACzB,UAAM,SAAS,SAAS,OAAO,QAAQ;AACvC,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,GAAI,OAAO,WAAW,YAAY,OAAO,UAAU,MAAM,KAAK,UAAU,OAAO,UAAU,MACrF,EAAE,OAAO,IACT,CAAC;AAAA,IACP;AAAA,EACF;AACA,QAAM,WAAW,mBAAmB,KAAK;AACzC,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,QAAQ;AAAA,IACV;AAAA,EACF;AACA,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,GAAI,SAAS,WAAW,EAAE,UAAU,SAAS,SAAS,IAAI,CAAC;AAAA,EAC7D;AACF;AAEA,SAAS,SAAS,OAAgB,KAAsB;AACtD,MAAI;AACF,QAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,UAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,WAAO,cAAc,WAAW,aAAa,WAAW,QAAQ;AAAA,EAClE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,SAAS,mBAAmB,OAAmD;AAC7E,MAAI,UAAU;AACd,WAAS,QAAQ,GAAG,QAAQ,KAAK,WAAW,OAAO,YAAY,UAAU,SAAS,GAAG;AACnF,QAAI,SAAS,SAAS,MAAM,MAAM,iBAAiB;AACjD,YAAM,OAAO,SAAS,SAAS,MAAM;AACrC,aAAO,OAAO,SAAS,YAAY,gBAAgB,KAAK,IAAI,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC;AAAA,IACxF;AACA,cAAU,SAAS,SAAS,OAAO;AAAA,EACrC;AACA,SAAO;AACT;AAEO,SAAS,kCACd,UACA,yBACA;AAGA,MAAI;AACJ,SAAO;AAAA,IACL,gBAAgB,YAAY;AAC1B,YAAM,SAAS,EAAE,WAAW,GAAG,UAAU,GAAG,UAAU,GAAG,aAAa,EAAE;AACxE,UAAI,CAAC,wBAAyB,QAAO;AACrC,YAAM,EAAE,IAAI,UAAU,cAAc,IAAI,MAAM,SAAS;AACvD,UAAI;AACJ,UAAI,sBAAsB,QAAQ,GAAG;AACnC,YAAI,CAAC,SAAS;AACZ,gBAAM,IAAI,MAAM,wDAAwD;AAC1E,4BAAoB,IAAI,KAAK,SAAS,mCAAmC;AAAA,MAC3E,OAAO;AACL,2BAAmB,oCAAoC,EAAE,EAAE,MAAM,CAAC,UAAU;AAC1E,2BAAiB;AACjB,gBAAM;AAAA,QACR,CAAC;AACD,4BAAoB,MAAM;AAAA,MAC5B;AACA,YAAM,EAAE,SAAS,IAAI,MAAM,wBAAwB;AAGnD,UAAI,SAAS,cAAc,MAAO,QAAO;AACzC,YAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,qBAAqB;AACnE,YAAM,SAAS,MAAM,wBAAwB,IAAI;AAAA,QAC/C,OAAO,SAAS;AAAA,QAChB,YAAY,SAAS;AAAA,QACrB,OAAO;AAAA,MACT,CAAC;AACD,iBAAW,SAAS,QAAQ;AAC1B,YAAI,QAAoC;AACxC,YAAI;AACF,gBAAM,SAAS,MAAM,yBAAyB,IAAI,KAAK;AACvD,cAAI,CAAC,QAAQ;AACX,mBAAO;AACP;AAAA,UACF;AAIA,gBAAM,uBAAuB,IAAI,OAAO,oBAAoB,OAAO,aAAa;AAC9E,kBAAM,UAAU,MAAM,yBAAyB,UAAU,KAAK;AAC9D,gBAAI,CAAC,SAAS;AACZ,qBAAO;AACP;AAAA,YACF;AACA,kBAAM,SAAS,CAAC;AAChB,gBAAI,OAAO;AACX,uBAAW,SAAS,qBAAqB,QAAQ,KAAK,GAAG;AACvD,kBAAI,MAAM,QAAQ,QAAQ,UAAW;AACrC,kBAAI,OAAO,WAAW,IAAI;AACxB,uBAAO;AACP;AAAA,cACF;AACA,qBAAO,KAAK,KAAK;AAAA,YACnB;AACA,gBAAI,OAAO,QAAQ;AACjB,oBAAM,eAAe,MAAM;AAAA,gBACzB;AAAA,gBACA;AAAA;AAAA;AAAA;AAAA,gBAIA,SAAS,8BAA8B,WAClC,SAAS,gCAAgC,eAC1C;AAAA,gBACJ;AAAA,gBACA,SAAS,8CAA8C;AAAA,cACzD;AACA,kBAAI,aAAa,SAAS,mBAAmB;AAC3C,uBAAO;AACP;AAAA,cACF;AACA,kBAAI,aAAa,SAAS,YAAY;AACpC,uBAAO;AACP;AAAA,cACF;AAKA,kBAAI,aAAa,SAAS,aAAa,CAAC,sBAAsB,QAAQ,GAAG;AACvE,sBAAM,uBAAuB,UAAU,KAAK;AAC5C,uBAAO;AACP;AAAA,cACF;AACA,oBAAM,OAAO,aAAa,SAAS;AACnC,kBAAI,QAAQ,MAAM,mBAAmB,SAAS,WAAW;AAGvD,8BAAc,KAAK,yDAAyD;AAAA,kBAC1E,WAAW;AAAA,gBACb,CAAC;AACD,sBAAM,uBAAuB,UAAU,KAAK;AAC5C,uBAAO;AACP;AAAA,cACF;AAKA,kBAAI,QAAS,MAAM,yBAAyB,UAAU,QAAQ,kBAAkB,GAAI;AAClF,sBAAM,6BAA6B,UAAU,KAAK;AAClD,uBAAO;AACP;AAAA,cACF;AACA,kBAAI,QAAQ,QAAQ,cAAc,GAAG;AACnC,sBAAM,UAAU,MAAM,0BAA0B,UAAU,MAAM,SAAS;AACzE,oBAAI,QAAQ,iBAAiB,GAAG;AAC9B,wBAAM,6BAA6B,UAAU,KAAK;AAClD,yBAAO;AACP;AAAA,gBACF;AAAA,cACF;AACA,kBAAI,MAAM;AACR,sBAAM,UAAU,MAAM,wBAAwB,UAAU;AAAA,kBACtD,WAAW,MAAM;AAAA,kBACjB,aAAa,QAAQ;AAAA,kBACrB,WACE,MAAM,mBAAmB,SAAS,UAClC,MAAM,mBAAmB,SAAS,UAC9B,MAAM,mBAAmB,2BACzB;AAAA,gBACR,CAAC;AACD,oBAAI,SAAS;AACX,wBAAM,uBAAuB,UAAU,KAAK;AAC5C,yBAAO;AACP;AAAA,gBACF;AAAA,cACF;AACA,kBAAI,SAAS,oBAAoB,YAAY,SAAS,oBAAoB,WAAW;AACnF,sBAAM,QACJ,4BAA4B,QAAQ,EAAE;AACxC,oBAAI,OAAO;AACT,wBAAM,MAAM,oBAAI,KAAK;AACrB,wBAAM,OAAO,MAAM,iBAAiB,UAAU;AAAA,oBAC5C,aAAa,QAAQ;AAAA,oBACrB,WAAW;AAAA,oBACX,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,eAAe,GAAG,IAAI,YAAY,GAAG,CAAC,CAAC;AAAA,kBACtE,CAAC;AACD,sBAAI,OAAO,OAAO,SAAS,MAAO,OAAM,IAAI,8BAA8B;AAAA,gBAC5E;AAAA,cACF;AACA,oBAAM,SAAS,OAAO,IAAI,CAAC,UAAU,MAAM,cAAc;AACzD,oBAAM,QAAQ,OAAO;AAAA,gBACnB,CAAC,KAAK,UAAU,MAAM,OAAO,WAAW,OAAO,MAAM;AAAA,gBACrD;AAAA,cACF;AACA,sBAAQ;AACR,oBAAM,UAAU,MAAM,SAAS,UAAU,MAAM;AAC/C,kBAAI,QAAQ,WAAW,OAAO;AAC5B,sBAAM,IAAI,MAAM,iCAAiC;AACnD,sBAAQ;AAGR,kBAAI,MAAM;AACR,sBAAM,cAAc,MAAM,mCAAmC,UAAU,KAAK;AAC5E,oBAAI,gBAAgB,aAAa;AAC/B,sBAAI,gBAAgB,WAAY,QAAO;AAAA,sBAClC,QAAO;AACZ;AAAA,gBACF;AAAA,cACF;AACA,oBAAM,WAAW,MAAM;AAAA,gBACrB;AAAA,gBACA;AAAA,gBACA,QAAQ;AAAA,gBACR,OAAO,IAAI,CAAC,OAAO,WAAW,EAAE,GAAG,OAAO,WAAW,QAAQ,KAAK,EAAG,EAAE;AAAA,cACzE;AACA,kBAAI,SAAS,WAAW,WAAW;AACjC,uBAAO;AACP;AAAA,cACF;AACA,oBAAM,iBAAiB,UAAU;AAAA,gBAC/B,WAAW,MAAM;AAAA,gBACjB,aAAa,QAAQ;AAAA,gBACrB,WAAW;AAAA,gBACX,UAAU,OAAO;AAAA,gBACjB,MAAM;AAAA,gBACN,oBAAoB;AAAA,gBACpB,kBAAkB,MAAM;AAAA,gBACxB,gBAAgB,qBAAqB,MAAM,UAAU,IAAI,MAAM,UAAU,IAAI,QAAQ,SAAS;AAAA,cAChG,CAAC;AACD,oBAAM,iBAAiB,UAAU;AAAA,gBAC/B,WAAW,MAAM;AAAA,gBACjB,aAAa,QAAQ;AAAA,gBACrB,WAAW;AAAA,gBACX,UAAU;AAAA,gBACV,MAAM;AAAA,gBACN,oBAAoB;AAAA,gBACpB,kBAAkB,MAAM;AAAA,gBACxB,gBAAgB,6BAA6B,MAAM,UAAU,IAAI,MAAM,UAAU,IAAI,QAAQ,SAAS;AAAA,cACxG,CAAC;AACD,kBAAI,aAAa,SAAS,YAAY,aAAa,4BAA4B,GAAG;AAChF,sBAAM,WAAW;AAAA,kBACf;AAAA,oBACE,GAAG;AAAA,oBACH,4CACE,aAAa;AAAA,kBACjB;AAAA,kBACA;AAAA,gBACF;AACA,oBAAI,WAAW;AACb,wBAAM,iBAAiB,UAAU;AAAA,oBAC/B,WAAW,MAAM;AAAA,oBACjB,aAAa,QAAQ;AAAA,oBACrB,WAAW;AAAA,oBACX,UAAU;AAAA,oBACV,MAAM;AAAA,oBACN,oBAAoB;AAAA,oBACpB,kBAAkB,MAAM;AAAA,oBACxB,gBAAgB,8BAA8B,MAAM,UAAU,IAAI,MAAM,UAAU,IAAI,QAAQ,SAAS;AAAA,kBACzG,CAAC;AAAA,cACL;AACA,kBAAI,MAAM;AACR,sBAAM,OAAO;AAAA,kBACX;AAAA,oBACE,GAAG;AAAA,oBACH,4CACE,aAAa;AAAA,kBACjB;AAAA,kBACA;AAAA,gBACF;AACA,oBAAI,OAAO;AACT,wBAAM,yBAAyB,UAAU;AAAA,oBACvC,WAAW,MAAM;AAAA,oBACjB,aAAa,QAAQ;AAAA,oBACrB,MAAM;AAAA,oBACN,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU,MAAM;AAAA,oBAChB,gBAAgB,uBAAuB,MAAM,UAAU,IAAI,MAAM,UAAU,IAAI,QAAQ,SAAS;AAAA,oBAChG,UAAU;AAAA,sBACR,GAAG,+BAA+B,MAAM,kBAAkB;AAAA,sBAC1D,OAAO,MAAM;AAAA,sBACb;AAAA,sBACA,QAAQ,OAAO;AAAA,sBACf,2BAA2B,aAAa;AAAA,oBAC1C;AAAA,kBACF,CAAC;AAAA,cACL;AAAA,YACF;AACA,gBAAI,MAAM;AACR,oBAAM,0BAA0B,UAAU,KAAK;AAC/C,qBAAO;AAAA,YACT,OAAO;AACL,oBAAM,YAAY,MAAM;AAAA,gBACtB;AAAA,gBACA;AAAA,gBACA,QAAQ,YAAY,OAAO;AAAA,cAC7B;AACA,kBAAI,UAAU,WAAW,QAAS,QAAO;AAAA,kBACpC,QAAO;AAAA,YACd;AAAA,UACF,CAAC;AAAA,QACH,SAAS,OAAO;AAKd,wBAAc;AAAA,YACZ;AAAA,YACA,gCAAgC,OAAO,KAAK;AAAA,UAC9C;AACA,gBAAM,uBAAuB,IAAI,KAAK,EAAE,MAAM,CAAC,eAAwB;AACrE,kBAAM,kBAAkB,gCAAgC,cAAc,UAAU;AAChF,0BAAc,KAAK,4CAA4C;AAAA,cAC7D,GAAG;AAAA,cACH,WAAW;AAAA,YACb,CAAC;AAAA,UACH,CAAC;AACD,iBAAO;AAAA,QACT;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;AC/YA;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAYA,SAAS,8BAA8B,UAAkD;AAC9F,iBAAe,qBAAqB,OAAkC;AACpE,UAAM,EAAE,GAAG,IAAI,MAAM,SAAS;AAM9B,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AACA,QAAI,WAAY,QAAO,gCAAgC,UAAU;AACjE,WAAO;AAAA,EACT;AAEA,iBAAe,2BACb,OAC2C;AAC3C,UAAM,WAAW,MAAM,SAAS;AAGhC,UAAM,UAAU,6BAA6B,EAAE;AAAA,MAC7C,CAAC,cAAc,UAAU,cAAc,MAAM,YAAY;AAAA,IAC3D;AACA,QAAI,CAAC,QAAS,QAAO,EAAE,QAAQ,QAAQ;AACvC,UAAM,OAAO,MAAM,0BAA0B,UAAU,SAAS;AAAA,MAC9D,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,WAAW,MAAM;AAAA,MACjB,UAAU,MAAM;AAAA,MAChB,YAAY,MAAM;AAAA,IACpB,CAAC;AACD,WAAO,QAAQ,EAAE,QAAQ,QAAQ;AAAA,EACnC;AAEA,SAAO,EAAE,sBAAsB,2BAA2B;AAC5D;;;ACrDA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AAIA,IAAM,0CAA0C,KAAK,KAAK;AAC1D,IAAM,4CAA4C;AAEzD,IAAM,4BAA4B,oBAAI,IAAI;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAwBM,SAAS,gDACd,UACA,UAAkD,CAAC,GACnD;AACA,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,mBAAmB,QAAQ,oBAAoB;AACrD,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,eAAe,QAAQ,iBAAiB,CAAC,SAAS,QAAQ,QAAQ,aAAa,GAAG;AAExF,iBAAe,gCAA8E;AAC3F,UAAM,EAAE,IAAI,eAAe,cAAc,IAAI,MAAM,SAAS;AAC5D,QAAI,CAAC,cAAe,QAAO,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,EAAE;AAElE,UAAM,CAAC,gBAAgB,YAAY,IAAI,MAAM,QAAQ,IAAI;AAAA,MACvD,eAAe,IAAI,EAAE,gBAAgB,OAAO,UAAU,CAAC;AAAA,MACvD,aAAa,IAAI,EAAE,gBAAgB,OAAO,UAAU,CAAC;AAAA,IACvD,CAAC;AACD,UAAM,SAA8C;AAAA,MAClD,SAAS,eAAe,SAAS,aAAa;AAAA,MAC9C,SAAS;AAAA,MACT,WAAW;AAAA,IACb;AACA,eAAW,WAAW,gBAAgB;AACpC,UAAI;AACF,cAAM,aAAa,eAAe,QAAQ,SAAS;AACnD,YAAI,CAAE,MAAM,iBAAiB,IAAI,OAAO,GAAI;AAC1C,gBAAM,IAAI,MAAM,qDAAqD;AAAA,QACvE;AACA,eAAO,WAAW;AAAA,MACpB,SAAS,OAAO;AACd,eAAO,aAAa;AACpB,sBAAc,KAAK,oEAAoE;AAAA,UACrF,aAAa,QAAQ;AAAA,UACrB,YAAY,QAAQ;AAAA,UACpB,eAAe,qBAAqB,KAAK;AAAA,QAC3C,CAAC;AAAA,MACH;AAAA,IACF;AACA,eAAW,WAAW,cAAc;AAClC,UAAI;AACF,cAAM,aAAa,eAAe,QAAQ,SAAS;AACnD,YAAI,CAAE,MAAM,eAAe,IAAI,OAAO,GAAI;AACxC,gBAAM,IAAI,MAAM,mDAAmD;AAAA,QACrE;AACA,eAAO,WAAW;AAAA,MACpB,SAAS,OAAO;AACd,eAAO,aAAa;AACpB,sBAAc,KAAK,kEAAkE;AAAA,UACnF,aAAa,QAAQ;AAAA,UACrB,UAAU,QAAQ;AAAA,UAClB,eAAe,qBAAqB,KAAK;AAAA,QAC3C,CAAC;AAAA,MACH;AAAA,IACF;AACA,QAAI,OAAO,UAAU,GAAG;AACtB,oBAAc,KAAK,4CAA4C,MAAM;AAAA,IACvE;AACA,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,8BAA8B;AACzC;AAEA,SAAS,qBAAqB,OAAwB;AACpD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,OAAQ,MAA6B;AAC3C,SAAO,OAAO,SAAS,YAAY,0BAA0B,IAAI,IAAI,IAAI,OAAO;AAClF;;;ACrHA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB;AAoBvB,SAAS,2BACd,UACA,UAAqC,CAAC,GACtC;AACA,QAAM,QAAQ,QAAQ,SAAS;AAC/B,QAAM,SAAS,QAAQ,UAAU;AACjC,QAAM,kBAAkB,QAAQ,mBAAmB;AACnD,QAAMA,iBAAgB,QAAQ,iBAAiB;AAC/C,QAAM,gBAAgB,QAAQ,iBAAiB;AAC/C,QAAM,QAAQ,QAAQ,SAAS;AAC/B,QAAM,oBAAoB,QAAQ,qBAAqB;AACvD,QAAM,cAAc,QAAQ,eAAe;AAC3C,SAAO;AAAA,IACL,4BAA4B,OAAO,UAAqD;AACtF,YAAM,UAAU,MAAM,SAAS;AAC/B,YAAM,OAAO,QAAQ,IAAI;AAAA,QACvB,aAAa,MAAM;AAAA,QACnB,OAAO,MAAM;AAAA,QACb,QAAQ;AAAA,QACR,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,IACA,uBAAuB,OACrB,UACyC;AACzC,YAAM,UAAU,MAAM,SAAS;AAC/B,YAAM,wBAAwB,QAAQ,yBAAyB,QAAQ;AACvE,YAAM,6BACJ,MAAM,uBAAuB,QAAQ,IAAI,qBAAqB,GAC9D;AACF,YAAM,MAAM,MAAM,MAAM,QAAQ,IAAI,KAAK;AACzC,UAAI,CAAC,IAAK,QAAO,EAAE,QAAQ,YAAY;AACvC,UAAI,IAAI,WAAW,cAAc;AAC/B,YAAI,CAAC,IAAI,UAAW,OAAM,IAAI,MAAM,kDAAkD;AACtF,eAAO,EAAE,QAAQ,sBAAsB,WAAW,IAAI,UAAU;AAAA,MAClE;AACA,UAAI,IAAI,WAAW,WAAW;AAC5B,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,QAAQ,IAAI,aAAa;AAAA,QAC3B;AAAA,MACF;AACA,UAAI,IAAI,WAAW,UAAU;AAC3B,eAAO,EAAE,QAAQ,UAAU,QAAQ,IAAI,aAAa,kBAAkB;AAAA,MACxE;AAEA,UAAI;AACF,cAAM,WAAW,IAAI;AACrB,YACE,SAAS,cAAc,MAAM,aAC7B,SAAS,gBAAgB,MAAM,eAC/B,SAAS,aAAa,IAAI,YAC1B,SAAS,cAAc,IAAI,aAC3B,SAAS,oBAAoB,IAAI,mBACjC,SAAS,YAAY,IAAI,SACzB;AACA,gBAAM,OAAO,QAAQ,IAAI;AAAA,YACvB,aAAa,MAAM;AAAA,YACnB,OAAO,IAAI;AAAA,YACX,QAAQ;AAAA,YACR,WAAW;AAAA,UACb,CAAC;AACD,iBAAO,EAAE,QAAQ,WAAW,QAAQ,8BAA8B;AAAA,QACpE;AAEA,cAAM,WAAW,SAAS;AAC1B,YACE,SAAS,0BAA0B,qBACnC,SAAS,yBAAyB;AAAA,UAChC,CAAC,eAAe,CAAC,2CAA2C,UAAU;AAAA,QACxE,GACA;AACA,gBAAM,OAAO,QAAQ,IAAI;AAAA,YACvB,aAAa,MAAM;AAAA,YACnB,OAAO,IAAI;AAAA,YACX,QAAQ;AAAA,YACR,WAAW;AAAA,UACb,CAAC;AACD,iBAAO,EAAE,QAAQ,UAAU,QAAQ,mCAAmC;AAAA,QACxE;AACA,cAAM,iBAAiB,SAAS,SAAS,0BAA0B;AACnE,cAAM,kBACJ,eAAe,WAAW,iCAAiC,KAC3D,eAAe,WAAW,oCAAoC,KAC9D,eAAe,WAAW,+BAA+B,KAEnD,MAAM,gCAAgC,QAAQ,IAAI,uBAAuB;AAAA,UACvE,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,wBAAwB;AAAA,QAC1B,CAAC,GACD,WACF;AACN,cAAM,iBAAiB,EAAE,GAAG,SAAS,UAAU,gBAAgB;AAC/D,YAAI;AACJ,YAAI;AACF,gBAAM,kBAAkB,yBAAyB,iBAAiB,cAAc;AAChF,cAAI,CAAC,gBAAiB,OAAM,IAAI,MAAM,oCAAoC;AAC1E,gBAAM,kBAAkB,QAAQ,IAAI,iBAAiB,MAAM,aAAa,eAAe;AACvF,kBAAQ;AAAA,QACV,SAAS,OAAO;AACd,cAAI,CAAC,sBAAsB,KAAK,EAAG,OAAM;AACzC,gBAAM,OAAO,QAAQ,IAAI;AAAA,YACvB,aAAa,MAAM;AAAA,YACnB,OAAO,IAAI;AAAA,YACX,QAAQ;AAAA,YACR,WAAW;AAAA,UACb,CAAC;AACD,iBAAO,EAAE,QAAQ,UAAU,QAAQ,kBAAkB;AAAA,QACvD;AACA,cAAM,SAAS,MAAM,MAAM,gBAAgB;AAAA,UACzC,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB;AAAA,UACA,oBAAoB;AAAA,QACtB,CAAC;AACD,YAAI,QAAQ;AACV,gBAAM,OAAO,QAAQ,IAAI;AAAA,YACvB,aAAa,MAAM;AAAA,YACnB,OAAO,IAAI;AAAA,YACX,QAAQ;AAAA,YACR,WAAW;AAAA,UACb,CAAC;AACD,iBAAO,EAAE,QAAQ,UAAU,QAAQ,OAAO;AAAA,QAC5C;AACA,cAAM,kBAAkB,SAAS,mBAAmB,gBAAgB;AACpE,cAAM,iBAAiB,SAAS,kBAAkB,gBAAgB;AAClE,YAAI,mBAAmB,cAAc;AACnC,gBAAM,OAAO,QAAQ,IAAI;AAAA,YACvB,aAAa,MAAM;AAAA,YACnB,OAAO,IAAI;AAAA,YACX,QAAQ;AAAA,YACR,WAAW;AAAA,UACb,CAAC;AACD,iBAAO;AAAA,YACL,QAAQ;AAAA,YACR,QAAQ;AAAA,UACV;AAAA,QACF;AAGA,YAAI;AAMJ,YAAI;AACF,gBAAM,qBAAqB,MAAM,cAAc,QAAQ,IAAI,MAAM,WAAW,GAAG;AAC/E,gBAAM,aAAa,mCAAmC;AAAA,YACpD,UAAU;AAAA,YACV,SAAS;AAAA,YACT,SAAS,SAAS;AAAA,YAClB,cAAc,SAAS,gBAAgB;AAAA,YACvC;AAAA,YACA,QAAQ;AAAA,YACR,MAAM;AAAA,UACR,CAAC;AACD,gBAAM,UAAU,oCAAoC;AAAA,YAClD,QAAQ,WAAW;AAAA,YACnB,oBAAoB,SAAS;AAAA,YAC7B,OAAO,SAAS;AAAA,YAChB,YAAY,EAAE,MAAM,YAAY,wBAAwB,KAAK;AAAA,YAC7D,kBAAkB,SAAS,MAAM,IAAI,CAAC,SAAS,KAAK,EAAE;AAAA,UACxD,CAAC;AACD,8BAAoB;AAAA,YAClB,QAAQ,WAAW;AAAA,YACnB,cAAc,WAAW;AAAA,YACzB,oBAAoB,QAAQ;AAAA,YAC5B,OAAO,QAAQ;AAAA,UACjB;AAAA,QACF,SAAS,OAAO;AACd,cAAI,CAAC,sBAAsB,KAAK,EAAG,OAAM;AACzC,gBAAM,OAAO,QAAQ,IAAI;AAAA,YACvB,aAAa,MAAM;AAAA,YACnB,OAAO,IAAI;AAAA,YACX,QAAQ;AAAA,YACR,WAAW;AAAA,UACb,CAAC;AACD,iBAAO,EAAE,QAAQ,UAAU,QAAQ,kBAAkB;AAAA,QACvD;AACA,cAAM,8BAA8B,6BAA6B,iBAAiB;AAAA,UAChF,SAAS;AAAA,UACT,kBAAkB,SAAS;AAAA,UAC3B,aAAa,SAAS,QAAQ,aAAa;AAAA,UAC3C;AAAA,UACA,iBAAiB,SAAS,kBAAkB,aAAa;AAAA,UACzD,aAAa;AAAA,UACb,mBAAmB;AAAA,QACrB,CAAC;AACD,cAAM,sBAAsB,SAAS,wBACjC;AAAA,UACE,GAAG;AAAA,UACH,uBAAuB,SAAS;AAAA,QAClC,IACA;AACJ,cAAM,UAAU,MAAMA,eAAc;AAAA,UAClC,IAAI,QAAQ;AAAA,UACZ,KAAK,QAAQ;AAAA,UACb,gBAAgB;AAAA,YACd,qBAAqB,OAAO,SAAS;AACnC,oBAAM,QAAQ,sBAAsB,IAAI;AAAA,YAC1C;AAAA,UACF;AAAA,UACA,oBAAoB,OAAO,IAAI,cAAc;AAC3C,kBAAM,gBAAgB,IAAI;AAAA,cACxB,aAAa,MAAM;AAAA,cACnB,OAAO,IAAI;AAAA,cACX,WAAW,SAAS;AAAA,cACpB,iBAAiB,SAAS;AAAA,cAC1B,UAAU,SAAS;AAAA,cACnB,eAAe,SAAS;AAAA,cACxB;AAAA,YACF,CAAC;AAAA,UACH;AAAA,UACA,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,gBAAgB,SAAS;AAAA,UACzB,SAAS;AAAA,UACT,SAAS,QAAQ;AAAA,UACjB,WAAW,SAAS;AAAA,UACpB,QAAQ,cAAc,MAAM,SAAS,MAAM;AAAA,UAC3C,iBAAiB,SAAS;AAAA,UAC1B,OAAO,kBAAkB;AAAA,UACzB,YAAY,EAAE,MAAM,YAAY,wBAAwB,KAAK;AAAA,UAC7D;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,UAAU;AAAA,YACR,GAAG,SAAS;AAAA,YACZ,iBAAiB,IAAI;AAAA,YACrB,oBAAoB,IAAI;AAAA,YACxB,qBAAqB,IAAI;AAAA,YACzB,2BAA2B,IAAI;AAAA,UACjC;AAAA,UACA,WAAW;AAAA,YACT,MAAM;AAAA,YACN,WAAW,SAAS;AAAA,YACpB,OAAO,SAAS;AAAA,UAClB;AAAA,UACA,kBAAkB,SAAS;AAAA,UAC3B,cAAc,kBAAkB,gBAAgB,SAAS;AAAA,UACzD,YAAY,SAAS;AAAA,UACrB,0BAA0B,SAAS;AAAA,UACnC,oBAAoB,kBAAkB;AAAA,UACtC,GAAI,kBAAkB,SAAS,EAAE,aAAa,kBAAkB,OAAO,IAAI,CAAC;AAAA,UAC5E,4BACE,MAAM,WAAW,iCAAiC,KAClD,MAAM,WAAW,oCAAoC,KACrD,MAAM,WAAW,+BAA+B;AAAA,UAClD,sBAAsB,kBAAkB,IAAI,EAAE;AAAA,UAC9C,WAAW,SAAS;AAAA,QACtB,CAAC;AACD,cAAM;AAAA,UACJ,EAAE,IAAI,QAAQ,IAAI,UAAU,gBAAgB;AAAA,UAC5C;AAAA,YACE,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,WAAW,SAAS;AAAA,YACpB,WAAW;AAAA,YACX,UAAU;AAAA,YACV,MAAM;AAAA,YACN,oBAAoB;AAAA,YACpB,kBAAkB,IAAI;AAAA,YACtB,WAAW,QAAQ,QAAQ;AAAA,YAC3B,WAAW,QAAQ,QAAQ;AAAA,YAC3B,kBAAkB,QAAQ,QAAQ;AAAA,YAClC,QAAQ;AAAA,YACR,gBAAgB,gCAAgC,IAAI,EAAE;AAAA,UACxD;AAAA,QACF,EAAE,MAAM,CAAC,UAAU;AACjB,kBAAQ,cAAc,KAAK,qCAAqC;AAAA,YAC9D,aAAa,MAAM;AAAA,YACnB,OAAO,IAAI;AAAA,YACX,eAAe,iBAAiB,QAAQ,MAAM,OAAO;AAAA,UACvD,CAAC;AAAA,QACH,CAAC;AACD,eAAO,EAAE,QAAQ,WAAW,WAAW,QAAQ,QAAQ,GAAG;AAAA,MAC5D,SAAS,OAAO;AACd,YAAI,iBAAiB,iCAAiC;AACpD,gBAAM,OAAO,QAAQ,IAAI;AAAA,YACvB,aAAa,MAAM;AAAA,YACnB,OAAO,IAAI;AAAA,YACX,QAAQ;AAAA,YACR,WAAW;AAAA,UACb,CAAC;AACD,iBAAO,EAAE,QAAQ,WAAW,QAAQ,oBAAoB;AAAA,QAC1D;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,OAAyB;AACtD,SACE,iBAAiB,SACjB,YAAY,SACX,MAAuC,WAAW;AAEvD;;;ACzVA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,SAAS,kBAAkB;AAEpB,IAAM,+BAA+B,KAAK,KAAK;AAC/C,IAAM,uCAAuC,KAAK,KAAK;AACvD,IAAM,iCAAiC;AAC9C,IAAM,gCAAgC,oBAAI,IAAI;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,uBAAuB,OAG9B;AACA,MAAI,gBAAgB;AACpB,MAAI;AACJ,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,UAAM,UAAW,MAA6B;AAC9C,QAAI,OAAO,YAAY,YAAY,8BAA8B,IAAI,OAAO,GAAG;AAC7E,sBAAgB;AAAA,IAClB,WAAW,YAAY,QAAW;AAChC,sBAAgB;AAAA,IAClB;AACA,UAAM,YAAY;AAAA,MACf,MAAqD,UACnD,MAAmC;AAAA,IACxC;AACA,QAAI,OAAO,UAAU,SAAS,KAAK,aAAa,OAAO,aAAa,KAAK;AACvE,oBAAc;AAAA,IAChB;AAAA,EACF;AACA,SAAO,EAAE,eAAe,GAAI,gBAAgB,SAAY,CAAC,IAAI,EAAE,YAAY,EAAG;AAChF;AA0BO,SAAS,iCACd,UACA,UAA2C,CAAC,GAC5C;AACA,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,eAAe,QAAQ,iBAAiB,OAAO,SAAS,QAAQ,QAAQ,aAAa,GAAG;AAC9F,QAAM,mBAAmB,QAAQ,oBAAoB;AACrD,QAAM,qBAAqB,QAAQ,sBAAsB;AACzD,QAAM,4BACJ,QAAQ,6BAA6B;AACvC,QAAM,8BACJ,QAAQ,+BAA+B;AACzC,QAAM,+BACJ,QAAQ,gCAAgC;AAE1C,iBAAe,yBAAgE;AAC7E,UAAM,EAAE,IAAI,eAAe,cAAc,IAAI,MAAM,SAAS;AAC5D,QAAI,CAAC,eAAe;AAClB,UAAI;AACF,cAAM,6BAA6B,IAAI,EAAE,SAAS,OAAO,UAAU,CAAC;AAAA,MACtE,SAAS,OAAO;AACd,sBAAc,KAAK,yDAAyD;AAAA,UAC1E,GAAG,uBAAuB,KAAK;AAAA,QACjC,CAAC;AAAA,MACH;AACA,aAAO,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,EAAE;AAAA,IAC7C;AAEA,UAAM,SAAS,MAAM,iBAAiB,IAAI;AAAA,MACxC;AAAA,MACA;AAAA,MACA,OAAO;AAAA,IACT,CAAC;AACD,QAAI,UAAU;AACd,QAAI,SAAS;AACb,eAAW,SAAS,QAAQ;AAC1B,UAAI;AACF,cAAM,aAAa,eAAe,MAAM,SAAS;AACjD,cAAM,UAAU,MAAM,mBAAmB,IAAI,KAAK;AAClD,YAAI,CAAC,SAAS;AACZ,gBAAM,IAAI,MAAM,mDAAmD;AAAA,QACrE;AACA,mBAAW;AAAA,MACb,SAAS,OAAO;AACd,kBAAU;AACV,sBAAc,KAAK,iEAAiE;AAAA,UAClF,aAAa,MAAM;AAAA,UACnB,UAAU,MAAM;AAAA,UAChB,QAAQ,MAAM;AAAA,UACd,GAAG,uBAAuB,KAAK;AAAA,QACjC,CAAC;AAAA,MACH;AAAA,IACF;AACA,UAAM,kBAAkB,MAAM,0BAA0B,IAAI;AAAA,MAC1D;AAAA,MACA;AAAA,MACA,OAAO;AAAA,IACT,CAAC;AACD,eAAW,SAAS,iBAAiB;AACnC,UAAI;AACF,cAAM,aAAa,eAAe,MAAM,SAAS;AACjD,cAAM,UAAU,MAAM,4BAA4B,IAAI,KAAK;AAC3D,YAAI,CAAC,SAAS;AACZ,gBAAM,IAAI,MAAM,+DAA+D;AAAA,QACjF;AACA,mBAAW;AAAA,MACb,SAAS,OAAO;AACd,kBAAU;AACV,sBAAc;AAAA,UACZ;AAAA,UACA;AAAA,YACE,aAAa,MAAM;AAAA,YACnB,aAAa,MAAM;AAAA,YACnB,GAAG,uBAAuB,KAAK;AAAA,UACjC;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,gCAAgC;AACpC,QAAI;AACF,sCAAgC,MAAM,6BAA6B,IAAI;AAAA,QACrE;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AAAA,IACH,SAAS,OAAO;AACd,oBAAc,KAAK,yDAAyD;AAAA,QAC1E,GAAG,uBAAuB,KAAK;AAAA,MACjC,CAAC;AAAA,IACH;AACA,UAAM,UAAU,OAAO,SAAS,gBAAgB;AAChD,QAAI,UAAU,KAAK,gCAAgC,GAAG;AACpD,oBAAc,KAAK,qCAAqC;AAAA,QACtD;AAAA,QACA;AAAA,QACA;AAAA,QACA,aAAa,OAAO;AAAA,QACpB,+BAA+B,gBAAgB;AAAA,QAC/C;AAAA,MACF,CAAC;AAAA,IACH;AACA,WAAO,EAAE,SAAS,SAAS,OAAO;AAAA,EACpC;AAEA,iBAAe,kCAIZ;AACD,UAAM,EAAE,IAAI,8BAA8B,cAAc,IAAI,MAAM,SAAS;AAC3E,QAAI,CAAC,6BAA8B,QAAO,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,EAAE;AAC9E,UAAM,SAAS,MAAM,+BAA+B,IAAI;AAAA,MACtD,OAAO,2BAA2B,WAAW,CAAC;AAAA,MAC9C,cAAc;AAAA,MACd,OAAO;AAAA,IACT,CAAC;AACD,QAAI,UAAU;AACd,QAAI,SAAS;AACb,eAAW,SAAS,QAAQ;AAC1B,UAAI;AACF,cAAM,6BAA6B,KAAK;AACxC,mBAAW;AAAA,MACb,SAAS,OAAO;AACd,kBAAU;AACV,sBAAc,KAAK,mDAAmD;AAAA,UACpE,aAAa,MAAM;AAAA,UACnB,YAAY,iBAAiB,QAAQ,MAAM,OAAO;AAAA,QACpD,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO,EAAE,SAAS,OAAO,QAAQ,SAAS,OAAO;AAAA,EACnD;AAEA,SAAO,EAAE,wBAAwB,gCAAgC;AACnE;;;AClNA,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,uBAAuB,+BAA+B;AAIxD,IAAM,wCAAwC,IAAI,KAAK,KAAK;AAE5D,IAAM,sCAAsC,KAAK,KAAK;AACtD,IAAM,4CAA4C;AAClD,IAAM,0CAA0C,IAAI,KAAK;AAChE,IAAM,sBAAsB;AA2BrB,SAAS,wCACd,UACA,UAA0C,CAAC,GAC3C;AACA,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,cAAc,QAAQ,eAAe;AAC3C,QAAM,wBAAwB,QAAQ,yBAAyBA;AAC/D,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,iBAAiB,QAAQ,kBAAkB;AAEjD,iBAAe,gCAA8E;AAC3F,UAAM,EAAE,IAAI,cAAc,IAAI,MAAM,SAAS;AAC7C,UAAM,YAAY,IAAI;AACtB,UAAM,QAAQ,IAAI,KAAK,YAAY,mCAAmC;AACtE,UAAM,QAAQ,IAAI,KAAK,MAAM,QAAQ,IAAI,qCAAqC;AAC9E,UAAM,SAA8C;AAAA,MAClD,YAAY;AAAA,MACZ,SAAS;AAAA,MACT,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,qBAAqB;AAAA,MACrB,kBAAkB;AAAA,MAClB,iBAAiB;AAAA,IACnB;AACA,UAAM,QAAQ,sBAAsB;AACpC,QAAI,SAAwB;AAC5B,QAAI,UAAU;AACd,WAAO,MAAM;AACX,YAAM,OAAO,MAAM,eAAe,IAAI,EAAE,SAAS,QAAQ,OAAO,oBAAoB,CAAC;AACrF,YAAM,MAAM,UAAU,KAAK,OAAO,CAAC,OAAO,MAAM,KAAK,IAAI;AACzD,iBAAW,eAAe,KAAK;AAC7B,YAAI,IAAI,IAAI,aAAa,aAAa;AACpC,iBAAO,kBAAkB;AACzB;AAAA,QACF;AACA,eAAO,cAAc;AACrB,YAAI;AACF,gBAAM,UAAU,MAAM,UAAU,IAAI;AAAA,YAClC;AAAA,YACA;AAAA,YACA;AAAA,YACA,OAAO;AAAA,UACT,CAAC;AACD,iBAAO,WAAW,QAAQ;AAC1B,iBAAO,YAAY,QAAQ;AAC3B,iBAAO,cAAc,QAAQ;AAC7B,cAAI,QAAQ,UAAW,QAAO,uBAAuB;AAAA,QACvD,SAAS,OAAO;AACd,iBAAO,oBAAoB;AAC3B,wBAAc,KAAK,yDAAyD;AAAA,YAC1E;AAAA,YACA,WAAW,iBAAiB,QAAQ,MAAM,OAAO;AAAA,UACnD,CAAC;AAAA,QACH;AAAA,MACF;AACA,UAAI,OAAO,gBAAiB;AAC5B,UAAI,WAAW,IAAI,SAAS,KAAK,OAAQ;AACzC,UAAI,KAAK,SAAS,qBAAqB;AACrC,YAAI,QAAS;AACb,kBAAU;AACV,iBAAS;AACT;AAAA,MACF;AACA,eAAS,KAAK,KAAK,SAAS,CAAC;AAAA,IAC/B;AACA,QAAI,OAAO,mBAAmB,KAAK,OAAO,sBAAsB,KAAK,OAAO,iBAAiB;AAC3F,oBAAc,KAAK,6CAA6C,EAAE,GAAG,OAAO,CAAC;AAAA,IAC/E,WAAW,OAAO,UAAU,GAAG;AAC7B,oBAAc,KAAK,kCAAkC,EAAE,GAAG,OAAO,CAAC;AAAA,IACpE;AACA,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,8BAA8B;AACzC;;;AC9GA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,yBAA8D;AAGhE,IAAM,uCAAuC,KAAK,KAAK;AACvD,IAAM,uCAAuC,KAAK,KAAK;AACvD,IAAM,6CAA6C;AA2BnD,SAAS,8CACd,UACA,UAAwD,CAAC,GACzD;AACA,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,aAAa,QAAQ,eAAe,CAAC,SAAS,SAAS,QAAQ,WAAW,IAAI;AACpF,QAAM,WAAW,QAAQ,aAAa,CAAC,SAAS,SAAS,QAAQ,SAAS,IAAI;AAC9E,QAAM,eAAe,QAAQ,iBAAiB,CAAC,SAAS,QAAQ,QAAQ,aAAa,GAAG;AAExF,iBAAe,8BAA0E;AACvF,UAAM,EAAE,IAAI,eAAe,cAAc,IAAI,MAAM,SAAS;AAC5D,QAAI,CAAC,eAAe;AAClB,aAAO,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,EAAE;AAAA,IACrE;AAEA,UAAM,SAAS,MAAM,mCAAmC,IAAI;AAAA,MAC1D;AAAA,MACA;AAAA,MACA,OAAO;AAAA,IACT,CAAC;AACD,UAAM,SAA4C;AAAA,MAChD,SAAS,OAAO;AAAA,MAChB,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,WAAW;AAAA,IACb;AAEA,eAAW,SAAS,QAAQ;AAC1B,UAAI;AACF,YAAI,MAAM,WAAW,aAAa;AAChC,gBAAMC,WAAU,MAAM,eAAe,IAAI,eAAe,OAAO;AAAA,YAC7D;AAAA,YACA;AAAA,YACA;AAAA,UACF,CAAC;AACD,cAAIA,aAAY,SAAS;AACvB,mBAAO,SAAS;AAAA,UAClB,OAAO;AACL,mBAAO,UAAU;AAAA,UACnB;AACA;AAAA,QACF;AAEA,cAAM,aAAa,eAAe,MAAM,SAAS;AACjD,cAAM,UAAU,sBAAsB,MAAM,aAAa;AACzD,cAAM,UAAU,MAAM,sCAAsC,IAAI;AAAA,UAC9D,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,YAAY,MAAM;AAAA,UAClB,SAAS,MAAM;AAAA,UACf;AAAA,QACF,CAAC;AACD,YAAI,CAAC,QAAS,OAAM,IAAI,MAAM,kDAAkD;AAChF,eAAO,WAAW;AAAA,MACpB,SAAS,OAAO;AACd,eAAO,aAAa;AACpB,sBAAc,KAAK,qEAAqE;AAAA,UACtF,aAAa,MAAM;AAAA,UACnB,WAAW,MAAM;AAAA,UACjB,YAAY,MAAM;AAAA,UAClB,QAAQ,MAAM;AAAA,UACd,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,QAC9D,CAAC;AAAA,MACH;AAAA,IACF;AAEA,QAAI,OAAO,SAAS,GAAG;AACrB,oBAAc,KAAK,yCAAyC,MAAM;AAAA,IACpE;AACA,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,4BAA4B;AACvC;AAEA,eAAe,eACb,IACA,SACA,OACA,UAG6B;AAC7B,QAAM,cAAc,MAAM,mBAAmB,SAAS,OAAO,QAAQ;AACrE,MAAI,gBAAgB,WAAW;AAC7B,UAAMC,WAAU,MAAM,sCAAsC,IAAI;AAAA,MAC9D,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,YAAY,MAAM;AAAA,MAClB,SAAS,MAAM;AAAA,MACf,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAACA,SAAS,OAAM,IAAI,MAAM,oDAAoD;AAClF,WAAO;AAAA,EACT;AAKA,QAAM,WAAW,MAAM,4CAA4C,IAAI;AAAA,IACrE,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,YAAY,MAAM;AAAA,IAClB,SAAS,MAAM;AAAA,IACf,eAAe;AAAA,EACjB,CAAC;AACD,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,oDAAoD;AAInF,QAAM,SAAS,aAAa,SAAS,MAAM,SAAS;AACpD,QAAM,UAAU,MAAM,sCAAsC,IAAI;AAAA,IAC9D,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,YAAY,MAAM;AAAA,IAClB,SAAS,MAAM;AAAA,IACf,SAAS;AAAA,EACX,CAAC;AACD,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,oDAAoD;AAClF,SAAO;AACT;AAEA,eAAe,mBACb,SACA,OACA,UAC6C;AAC7C,QAAM,OAAO,UAAU,SAAS,KAAK;AACrC,QAAM,OAAO,MAAM,kBAAkB,YAAY;AAC/C,QAAI,CAAE,MAAM,SAAS,WAAW,SAAS,IAAI,EAAI,QAAO;AACxD,WAAO,MAAM,SAAS,SAAS,SAAS,IAAI;AAAA,EAC9C,CAAC;AACD,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,KAAK,kBAAkB,MAAM,aAClC,KAAK,gBAAgB,MAAM,aAC3B,KAAK,UAAU,WAAW,MAAM,SAC9B,YACA;AACN;AAEA,SAAS,UAAU,SAAwB,OAAsD;AAC/F,QAAM,aAAY,oBAAI,KAAK,CAAC,GAAE,YAAY;AAC1C,SAAO;AAAA,IACL,IAAI,MAAM;AAAA,IACV,aAAa,MAAM;AAAA,IACnB,QAAQ;AAAA,IACR,UAAU,uBAAuB,MAAM,UAAU;AAAA,IACjD,cAAc,uBAAuB,MAAM,UAAU;AAAA,IACrD,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,IACjB,QAAQ,MAAM;AAAA,IACd,QAAQ,QAAQ;AAAA,IAChB,WAAW,MAAM;AAAA,IACjB,WAAW;AAAA,IACX,WAAW;AAAA,EACb;AACF;AAEA,SAAS,sBAAsB,QAAyD;AACtF,MAAI,WAAW,UAAW,QAAO;AACjC,MAAI,WAAW,SAAU,QAAO;AAChC,SAAO;AACT;;;ACnMA,SAAS,wCAAwC;AACjD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AAOP,IAAI,sBAAoD;AAExD,eAAe,mBAAmB,MAA+C;AAC/E,0BAAwB,OAAO,mBAAmB,EAAE,KAAK,CAAC,YAAY,QAAQ,eAAe;AAC7F,QAAM,OAAO,MAAM;AACnB,QAAM,KAAK,GAAG,IAAI;AACpB;AAyBO,SAAS,6BACd,UACY;AACZ,QAAM,UAAU,SAAS;AACzB,MAAI,CAAC,4BAA4B,UAAU,OAAO,EAAG,QAAO,CAAC;AAE7D,QAAM,SAAqB;AAAA,IACzB;AAAA,MACE,MAAM;AAAA,MACN,SAAS;AAAA,QACP;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI;AAAA,IACb;AAAA,EACF;AAEA,MAAI,SAAS,wBAAwB;AACnC,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,QACP;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI;AAAA,IACb,CAAC;AAAA,EACH;AAEA,MAAI,SAAS,uBAAuB;AAClC,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,QACP;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI;AAAA,IACb,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAEA,IAAM,0CAA0C,IAAI;AACpD,IAAM,4CAA4C;AAClD,IAAM,6CAA6C;AACnD,IAAM,6CAA6C;AAK5C,IAAM,gCAAgC,KAAK;AAC3C,IAAM,2CACX;AACF,IAAM,4CAA4C;AAClD,IAAM,oCAAoC;AAEnC,IAAM,uCAAN,cAAmD,MAAM;AAAA,EAG9D,YACW,uBACA,kBACT;AACA;AAAA,MACE,yEAAyE,gBAAgB,sCAAsC,qBAAqB;AAAA,IACtJ;AALS;AACA;AAAA,EAKX;AAAA,EATS,OAAO;AAUlB;AASA,SAAS,wBAAwB,uBAAuC;AACtE,SAAO,KAAK;AAAA,IACV;AAAA,IACA,KAAK,IAAI,KAAK,KAAK,MAAM,wBAAwB,CAAC,CAAC;AAAA,IACnD,KAAK,IAAI,GAAG,wBAAwB,CAAC;AAAA,EACvC;AACF;AAWO,SAAS,uCACd,UAA0B,uBAAuB,GACf;AAClC,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,iBAAiB,SAAS;AAChC,QAAM,8BAA8B,MAAY;AAC9C,QAAI,CAAC,WAAW,OAAO,SAAS;AAC9B,iBAAW;AAAA,QACT,gBAAgB,UAAU,IAAI,MAAM,4CAA4C;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACA,MAAI,gBAAgB,SAAS;AAC3B,gCAA4B;AAAA,EAC9B,OAAO;AACL,oBAAgB,iBAAiB,SAAS,6BAA6B,EAAE,MAAM,KAAK,CAAC;AAAA,EACvF;AAEA,QAAM,cAAc,KAAK,IAAI;AAC7B,QAAM,wBAAwB,SAAS,KAAK;AAC5C,QAAM,YACJ,OAAO,0BAA0B,YAAY,wBAAwB,IACjE,wBAAwB,qBAAqB,IAC7C;AACN,QAAM,qBACJ,cAAc,QAAQ,0BAA0B,SAC5C,OACA,cAAc;AAIpB,QAAM,0BACJ,cAAc,OAAO,IAAI,KAAK,IAAI,KAAQ,KAAK,IAAI,GAAG,KAAK,MAAM,YAAY,CAAC,CAAC,CAAC;AAClF,QAAM,sBACJ,uBAAuB,OAAO,OAAO,qBAAqB;AAE5D,MAAI,gBAAsD;AAC1D,MAAI,cAAc,QAAQ,0BAA0B,UAAa,CAAC,WAAW,OAAO,SAAS;AAC3F,oBAAgB;AAAA,MACd,MAAM;AACJ,YAAI,CAAC,WAAW,OAAO,SAAS;AAC9B,qBAAW;AAAA,YACT,IAAI,qCAAqC,uBAAuB,SAAS;AAAA,UAC3E;AAAA,QACF;AAAA,MACF;AAAA,MACA,KAAK,IAAI,GAAG,wBAAwB,SAAS;AAAA,IAC/C;AAAA,EACF;AAEA,QAAM,YAAY,MAAY;AAC5B,QAAI,CAAC,QAAS;AACd,QAAI;AACF,cAAQ,UAAU;AAAA,QAChB,UAAU;AAAA,QACV,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,QAC3B,SAAS,WAAW,OAAO;AAAA,QAC3B,mBAAmB,sBAAsB,IAAI,KAAK,mBAAmB,EAAE,YAAY,IAAI;AAAA,MACzF,CAAC;AAAA,IACH,SAAS,OAAO;AAKd,UAAI,CAAC,WAAW,OAAO,QAAS,YAAW,MAAM,KAAK;AAAA,IACxD;AAAA,EACF;AACA,YAAU;AACV,QAAM,qBAAqB,SAAS,KAAK;AACzC,QAAM,sBACJ,OAAO,uBAAuB,YAAY,qBAAqB,IAC3D,KAAK;AAAA,IACH;AAAA,IACA,KAAK,IAAI,4CAA4C,KAAK,MAAM,qBAAqB,CAAC,CAAC;AAAA,EACzF,IACA;AACN,QAAM,iBAAiB,UAAU,YAAY,WAAW,mBAAmB,IAAI;AAC/E,MAAI,kBAAkB,WAAW,kBAAkB,OAAO,eAAe,UAAU,YAAY;AAC7F,mBAAe,MAAM;AAAA,EACvB;AAEA,SAAO;AAAA,IACL,QAAQ,WAAW;AAAA,IACnB;AAAA,IACA,SAAS,MAAM;AACb,sBAAgB,oBAAoB,SAAS,2BAA2B;AACxE,UAAI,cAAe,cAAa,aAAa;AAC7C,UAAI,eAAgB,eAAc,cAAc;AAChD,sBAAgB;AAAA,IAClB;AAAA,EACF;AACF;AAEA,SAAS,YAAY,QAA8B;AACjD,SAAO,OAAO,UAAU,IAAI,MAAM,4CAA4C;AAChF;AAEA,SAAS,eAAe,QAA2B;AACjD,MAAI,OAAO,QAAS,OAAM,YAAY,MAAM;AAC9C;AAEA,eAAe,iBAAoB,SAAqB,QAAiC;AACvF,iBAAe,MAAM;AACrB,MAAI,sBAAsB,MAAY;AACtC,QAAM,eAAe,IAAI,QAAe,CAAC,UAAU,WAAW;AAC5D,UAAM,UAAU,MAAY,OAAO,YAAY,MAAM,CAAC;AACtD,0BAAsB,MAAM,OAAO,oBAAoB,SAAS,OAAO;AACvE,WAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAAA,EAC1D,CAAC;AACD,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK,CAAC,SAAS,YAAY,CAAC;AAAA,EACnD,UAAE;AACA,wBAAoB;AAAA,EACtB;AACF;AAIA,eAAe,aACb,SACA,WAC+B;AAC/B,MAAI,aAAa,EAAG,QAAO,EAAE,QAAQ,YAAY;AACjD,MAAI,QAA8C;AAClD,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK;AAAA,MACxB,QAAQ,KAAK,CAAC,WAAW,EAAE,QAAQ,aAAsB,MAAM,EAAE;AAAA,MACjE,IAAI,QAAiC,CAAC,YAAY;AAChD,gBAAQ,WAAW,MAAM,QAAQ,EAAE,QAAQ,YAAY,CAAC,GAAG,SAAS;AAAA,MACtE,CAAC;AAAA,IACH,CAAC;AAAA,EACH,UAAE;AACA,QAAI,MAAO,cAAa,KAAK;AAAA,EAC/B;AACF;AAEA,SAAS,cAAc,WAAiE;AACtF,MAAI,WAAW,uBAAuB,MAAM;AAC1C,WAAO;AAAA,EACT;AACA,SAAO,KAAK;AAAA,IACV;AAAA,IACA,KAAK,IAAI,2CAA2C,UAAU,sBAAsB,KAAK,IAAI,CAAC;AAAA,EAChG;AACF;AAEA,SAAS,YAAY,KAAuB;AAC1C,SAAO;AAAA,IACL,WAAW,IAAI;AAAA,IACf,aAAa,IAAI;AAAA,IACjB,WAAW;AAAA,IACX,aAAa,CAAC,YAAY,aAAa;AAAA,EACzC;AACF;AAEA,eAAe,mBAAmB,aAAiE;AACjG,MAAI,CAAC,YAAa,QAAO;AACzB,MAAI;AACF,UAAM;AAAA,MACJ,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,YAAY;AAAA,IACd;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAkBA,IAAM,+BAAqE;AAAA,EACzE,SAAS;AAAA,EACT,WAAW;AAAA,EACX,eAAe;AAAA,EACf,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,eAAe;AAAA,EACf,aAAa;AAAA,EACb,cAAc;AAAA,EACd,WAAW;AAAA,EACX,KAAK;AAAA,EACL,WAAW;AAAA,EACX,8BAA8B;AAAA,EAC9B,YAAY,MAAM,OAAO,WAAW;AACtC;AAaO,IAAM,uCAAN,cAAmD,MAAM;AAAA,EAG9D,YACW,gBACA,MACT;AACA;AAAA,MACE,4EAA4E,cAAc,QAAQ,IAAI;AAAA,IACxG;AALS;AACA;AAAA,EAKX;AAAA,EATS,OAAO;AAUlB;AAgBA,eAAsB,mCACpB,OAWA,KAIA,eAAqD,8BACzC;AAIZ,MAAI,CAAC,MAAM,SAAS,sCAAsC;AACxD,UAAM,IAAI,MAAM,wCAAwC;AAAA,EAC1D;AAEA,QAAM,WAAW,oBAAoB,aAAa,WAAW,CAAC;AAC9D,QAAM,qBAAqB,IAAI,gBAAgB;AAC/C,QAAM,SAAS,MAAM,WAAW,UAAU,mBAAmB;AAC7D,QAAM,oBAAoB,aAAa,6BAA6B,MAAM;AAC1E,QAAM,gBAAgB,kBAAkB,kBAAkB,KAAK,iBAAiB;AAChF,MAAI,gBAAkD;AACtD,MAAI,WAAW;AACf,MAAI,mBAAmB;AACvB,MAAI,gBAA+B;AACnC,MAAI,sBAA6D;AACjE,MAAI,uBAAuB;AAC3B,MAAI,uBAAkE;AAEtE,QAAM,qBAAqB,CAAC,WAAmB,eAAoC;AACjF,UAAM,cAAc,KAAK,6DAA6D;AAAA,MACpF;AAAA,MACA;AAAA,MACA;AAAA,MACA,OACE;AAAA,IACJ,CAAC;AAAA,EACH;AAEA,QAAM,qBAAqB,CACzB,WACA,YACA,UACS;AACT,UAAM,cAAc,KAAK,0DAA0D;AAAA,MACjF;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,CAAC;AAAA,EACH;AAEA,QAAM,8BAA8B,OAAO,eAAsC;AAC/E,QAAI,kBAAkB,KAAM;AAC5B,UAAM,eAAe;AAIrB,UAAM,UAAU,MAAM,QAAQ,WAAW;AAAA,MACvC,QAAQ,QAAQ,EAAE;AAAA,QAAK,MACrB,aAAa,aAAa,MAAM,IAAI;AAAA,UAClC,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,gBAAgB,MAAM;AAAA,UACtB,eAAe,eAAe;AAAA,UAC9B,oBAAoB;AAAA,QACtB,CAAC;AAAA,MACH;AAAA,MACA,QAAQ,QAAQ,EAAE;AAAA,QAAK,MACrB,aAAa,YAAY,MAAM,IAAI;AAAA,UACjC,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,gBAAgB,MAAM;AAAA,UACtB,eAAe;AAAA,QACjB,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AACD,eAAW,CAAC,OAAO,MAAM,KAAK,QAAQ,QAAQ,GAAG;AAC/C,UAAI,OAAO,WAAW,YAAY;AAChC;AAAA,UACE,UAAU,IAAI,mBAAmB;AAAA,UACjC;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,oBAAoB,OAAO,YAAyD;AACxF,QAAI,aAAa;AACjB,QAAI;AACF,mBAAa,MAAM,aAAa,UAAU,OAAO;AAAA,IACnD,SAAS,OAAO;AACd,yBAAmB,aAAa,QAAQ,YAAY,KAAK;AAAA,IAC3D;AACA,QAAI,CAAC,YAAY;AACf;AAAA,QACE;AAAA,QACA,QAAQ;AAAA,QACR,IAAI,MAAM,+EAA+E;AAAA,MAC3F;AACA,aAAO;AAAA,IACT;AACA,UAAM,4BAA4B,QAAQ,UAAU;AACpD,WAAO;AAAA,EACT;AAEA,MAAI;AACF,mBAAe,MAAM;AACrB,UAAM,QAAQ,MAAM,aAAa,QAAQ,MAAM,IAAI;AAAA,MACjD,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,gBAAgB,MAAM;AAAA,MACtB,MAAM;AAAA,MACN;AAAA,MACA,WAAW;AAAA,MACX,SAAS,MAAM,SAAS;AAAA,MACxB,OAAO,4BAA4B,MAAM,UAAU,MAAM,SAAS,cAAc;AAAA,MAChF,cAAc,MAAM;AAAA,MACpB,YAAY;AAAA,MACZ,mBAAmB;AAAA,MACnB,eAAe,iCAAiC,MAAM,QAAQ;AAAA,MAC9D,YAAY;AAAA,IACd,CAAC;AACD,eAAW;AACX,oBAAgB,MAAM,MAAM;AAC5B,0BAAsB,YAAY,MAAM;AACtC,WAAK,aACF,YAAY,MAAM,IAAI;AAAA,QACrB,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,gBAAgB,MAAM;AAAA,QACtB,MAAM;AAAA,QACN;AAAA,MACF,CAAC,EACA,MAAM,MAAM,MAAS;AAAA,IAC1B,GAAG,yCAAyC;AAC5C,QAAI,WAAW,uBAAuB,OAAO,oBAAoB,UAAU,YAAY;AACrF,0BAAoB,MAAM;AAAA,IAC5B;AACA,QAAI,MAAM,SAAS,WAAW;AAC5B,YAAM,IAAI,qCAAqC,MAAM,gBAAgB,MAAM,IAAI;AAAA,IACjF;AACA,uBAAmB;AAEnB,2BAAuB,QAAQ,QAAQ,EAAE;AAAA,MAAK,MAC5C,aAAa,UAAU,MAAM,UAAU,MAAM;AAAA,QAC3C,WAAW,GAAG,MAAM,eAAe,IAAI,QAAQ;AAAA,QAC/C,UAAU;AAAA,QACV,aAAa,CAAC;AAAA,QACd,kBAAkB,OAAO,YAAY;AAGnC,0BAAgB;AAChB,gBAAMC,eACJ,QAAQ,cAAc,UAAU,OAAO,MAAM,aAAa,UAAU,OAAO;AAC7E,gBAAM,WAAW,MAAM,aAAa,cAAc,MAAM,IAAI;AAAA,YAC1D,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,gBAAgB,MAAM;AAAA,YACtB,eAAe,MAAM,MAAM;AAAA,YAC3B,YAAY,QAAQ;AAAA,YACpB,iBAAiB,QAAQ;AAAA,YACzB,aAAAA;AAAA,YACA,YAAY;AAAA,YACZ,mBAAmB;AAAA,UACrB,CAAC;AACD,cAAI,CAAC,SAAS,UAAU;AACtB,kBAAM,IAAI,qCAAqC,MAAM,gBAAgB,QAAQ;AAAA,UAC/E;AAEA,cAAI,QAAQ,cAAc,WAAW,CAAC,OAAO,SAAS;AACpD,gBAAI;AACF,oBAAM;AAAA,gBACJ,aAAa,IAAI,MAAM,UAAU,QAAQ,YAAY;AAAA,kBACnD,SAAS,MAAM,MAAM;AAAA,kBACrB,aAAa,MAAM;AAAA,kBACnB,gBAAgB,MAAM;AAAA,gBACxB,CAAC;AAAA,gBACD;AAAA,cACF;AAAA,YACF,SAAS,OAAO;AACd,kBAAI,CAAC,OAAO,SAAS;AACnB,sBAAM,cAAc;AAAA,kBAClB;AAAA,kBACA;AAAA,oBACE;AAAA,oBACA,YAAY,QAAQ;AAAA,oBACpB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,kBAC9D;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAKA,cAAI,OAAO,SAAS;AAClB,kBAAM,kBAAkB,OAAO;AAC/B,kBAAM,YAAY,MAAM;AAAA,UAC1B;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AACA,SAAK,qBAAqB;AAAA,MACxB,MAAM;AACJ,+BAAuB;AAAA,MACzB;AAAA,MACA,MAAM;AACJ,+BAAuB;AAAA,MACzB;AAAA,IACF;AAIA,SAAK,qBAAqB,MAAM,MAAM,MAAS;AAC/C,UAAM,cAAc,MAAM,iBAAiB,sBAAsB,MAAM;AACvE,oBAAgB;AAChB,UAAM,iBAAiB,2BAA2B,WAAW,GAAG,MAAM;AACtE,UAAM,cACJ,YAAY,cAAc,UAAU,OAAO,MAAM,aAAa,UAAU,WAAW;AACrF,UAAM,YAAY,MAAM,aAAa,WAAW,MAAM,IAAI;AAAA,MACxD,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,gBAAgB,MAAM;AAAA,MACtB,eAAe,MAAM,MAAM;AAAA,MAC3B,YAAY,YAAY;AAAA,MACxB,cAAc;AAAA,MACd,iBAAiB,YAAY;AAAA,MAC7B;AAAA,MACA,YAAY;AAAA,IACd,CAAC;AACD,QAAI,CAAC,UAAU,aAAa,CAAC,UAAU,OAAO;AAC5C,YAAM,IAAI,qCAAqC,MAAM,gBAAgB,QAAQ;AAAA,IAC/E;AACA,UAAM,SAAS,MAAM,IAAI,aAAa;AAAA,MACpC;AAAA,MACA;AAAA,MACA,WAAW;AAAA,QACT,SAAS,UAAU,MAAM;AAAA,QACzB,YAAY,UAAU,MAAM;AAAA,QAC5B,qBAAqB,UAAU,MAAM;AAAA,QACrC,YAAY,YAAY;AAAA,MAC1B;AAAA,IACF,CAAC;AACD,mBAAe,MAAM;AACrB,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,OAAO,QAAS,OAAM,YAAY,MAAM;AAC5C,UAAM;AAAA,EACR,UAAE;AACA,QAAI,OAAO,WAAW,wBAAwB,CAAC,sBAAsB;AACnE,YAAM,oBAAoB,MAAM;AAAA,QAC9B,QAAQ,WAAW,CAAC,oBAAoB,CAAC;AAAA,QACzC,cAAc,MAAM,SAAS;AAAA,MAC/B;AACA,UAAI,kBAAkB,WAAW,aAAa;AAC5C,2BAAmB,yBAAyB,eAAe,cAAc,IAAI;AAAA,MAC/E;AAAA,IACF;AAEA,QAAI,qBAAqB;AACvB,oBAAc,mBAAmB;AACjC,4BAAsB;AAAA,IACxB;AAMA,sBAAkB,OAAO,OAAO,UAAU,YAAY,MAAM,IAAI,IAAI,MAAM,mBAAmB,CAAC;AAC9F,UAAM,aAAa,kBAAkB,kBAAkB;AACvD,SAAK,WAAW,MAAM,MAAM,MAAS;AACrC,UAAM,mBAAmB,MAAM,aAAa,YAAY,cAAc,MAAM,SAAS,CAAC;AACtF,QAAI,iBAAiB,WAAW,aAAa;AAC3C,yBAAmB,sBAAsB,eAAe,cAAc,IAAI;AAAA,IAC5E;AAEA,UAAM,kBAAkB,QAAQ,QAAQ,EAAE,KAAK,YAAY;AACzD,UAAI,CAAC,eAAe;AAMlB,YAAI,oBAAoB,kBAAkB,MAAM;AAC9C,gBAAM,aAAa,YAAY,MAAM,IAAI;AAAA,YACvC,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,gBAAgB,MAAM;AAAA,YACtB;AAAA,UACF,CAAC;AAAA,QACH;AACA,eAAO;AAAA,MACT;AACA,aAAO,MAAM,kBAAkB,aAAa;AAAA,IAC9C,CAAC;AACD,SAAK,gBAAgB,MAAM,MAAM,MAAS;AAC1C,UAAM,qBAAqB,MAAM;AAAA,MAC/B,QAAQ,WAAW,CAAC,eAAe,CAAC;AAAA,MACpC,cAAc,MAAM,SAAS;AAAA,IAC/B;AACA,QAAI,mBAAmB,WAAW,aAAa;AAC7C,yBAAmB,uBAAuB,eAAe,cAAc,IAAI;AAAA,IAC7E,WAAW,mBAAmB,MAAM,CAAC,GAAG,WAAW,YAAY;AAC7D;AAAA,QACE;AAAA,QACA,eAAe,cAAc;AAAA,QAC7B,mBAAmB,MAAM,CAAC,EAAE;AAAA,MAC9B;AAAA,IACF;AAKA,QAAI,UAAU;AACZ,YAAM,UAAU,QAAQ,QAAQ,EAAE;AAAA,QAAK,MACrC,aAAa,cAAc,MAAM,IAAI;AAAA,UACnC,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,gBAAgB,MAAM;AAAA,UACtB,MAAM;AAAA,UACN;AAAA,UACA,aAAa;AAAA,QACf,CAAC;AAAA,MACH;AACA,WAAK,QAAQ,MAAM,MAAM,MAAS;AAClC,YAAM,WAAW,MAAM;AAAA,QACrB,QAAQ,WAAW,CAAC,OAAO,CAAC;AAAA,QAC5B,cAAc,MAAM,SAAS;AAAA,MAC/B;AACA,UAAI,SAAS,WAAW,aAAa;AACnC,2BAAmB,kBAAkB,eAAe,cAAc,IAAI;AAAA,MACxE,WAAW,SAAS,MAAM,CAAC,GAAG,WAAW,YAAY;AACnD;AAAA,UACE;AAAA,UACA,eAAe,cAAc;AAAA,UAC7B,SAAS,MAAM,CAAC,EAAE;AAAA,QACpB;AAAA,MACF;AAAA,IACF;AAIA,mBAAe,MAAM;AAAA,EACvB;AACF;AAEA,eAAe,WACb,SACA,SACA,WACA,eACwB;AACxB,QAAM,OAAO;AAAA,IACX,KAAK;AAAA,IACL,SAAS;AAAA,IACT,OAAO;AAAA,IACP,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AACA,QAAM,SAAS,MAAM,cAAc,SAAS,IAAI;AAChD,SAAO;AAAA,IACL,UAAU,uBAAuB,MAAM;AAAA,IACvC,QAAQ,qBAAqB,MAAM;AAAA,EACrC;AACF;AAEA,eAAe,aACb,SACA,QACA,WACA,eACmC;AACnC,QAAM,UAAoC,CAAC;AAC3C,aAAW,SAAS,QAAQ;AAC1B,YAAQ,KAAK;AAAA,MACX,MAAM,MAAM;AAAA,MACZ,SAAS,MAAM;AAAA,MACf,GAAI,MAAM,WAAW,SAAS,MAAM,SAAS,WAAW,aAAa;AAAA,IACvE,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,QAAkC;AAC5D,MAAI,OAAO,SAAS,gBAAgB;AAClC,WAAO;AAAA,EACT;AACA,QAAM,UAAW,OAAO,QAAkC;AAC1D,SAAO,OAAO,YAAY,WAAW,UAAU;AACjD;AAEA,SAAS,0BAA0B,aAAyB,QAA+B;AACzF,MAAI,OAAO,SAAS,mBAAmB;AACrC,WAAO,EAAE,GAAG,aAAa,OAAO,MAAM,gBAAgB,CAAC,EAAE;AAAA,EAC3D;AACA,QAAM,UAAU,OAAO;AAOvB,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO;AAAA,IACP,aACE,QAAQ,gBAAgB,SACpB,YAAY,cACX,QAAQ;AAAA,IACf,QAAQ,MAAM,QAAQ,QAAQ,MAAM,IAC/B,QAAQ,SACT,YAAY;AAAA,IAChB,iBAAiB,MAAM,QAAQ,QAAQ,eAAe,IACjD,QAAQ,kBACT,YAAY;AAAA,IAChB,uBAAuB,MAAM,QAAQ,QAAQ,qBAAqB,IAC7D,QAAQ,wBACT,YAAY;AAAA,IAChB,WAAW,OAAO,QAAQ,cAAc,WAAW,QAAQ,YAAY,YAAY;AAAA,IACnF,gBAAgB,CAAC;AAAA,EACnB;AACF;AAEA,SAAS,iCACP,aACA,QACA,kBAC4B;AAC5B,MAAI,OAAO,SAAS,eAAgB,QAAO;AAC3C,QAAM,UAAU,mBAAmB,MAAM;AACzC,SAAO;AAAA,IACL,aAAa,UACT,sBAAsB,YAAY,aAAa,OAAO,IACtD,YAAY;AAAA,IAChB,QAAQ,YAAY;AAAA,IACpB,iBAAiB,YAAY;AAAA,IAC7B,uBAAuB,YAAY;AAAA,EACrC;AACF;AAEO,SAAS,qCACd,aACA,aAAa,iBACL;AACR,QAAM,EAAE,QAAQ,eAAe,IAAI,8BAA8B,aAAa,UAAU;AACxF,SAAO,aAAa,cAAc,eAAe,MAAM;AACzD;AAEA,SAAS,8BACP,aACA,aAAa,iBAC+B;AAC5C,MAAI,CAAC,yBAAyB,KAAK,WAAW,GAAG;AAC/C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,wBAAwB,KAAK,UAAU,GAAG;AAC7C,UAAM,IAAI,MAAM,6EAA6E;AAAA,EAC/F;AACA,QAAM,iBAAiB,WAAW,QAAQ,SAAS,EAAE,KAAK;AAC1D,QAAM,SAAS,GAAG,mBAAmB,MAAM,KAAK,cAAc,sBAAsB,YAAY,MAAM,UAAU,MAAM,CAAC;AACvH,SAAO,EAAE,QAAQ,eAAe;AAClC;AAOA,IAAM,8CAAoF;AAAA,EACxF,iBAAiB;AAAA,EACjB,KAAK,MAAM,oBAAI,KAAK;AACtB;AAGA,eAAsB,+BACpB,OAcA,eAAqD,6CACpC;AACjB,QAAM,EAAE,OAAO,IAAI,8BAA8B,MAAM,WAAW;AAClE,QAAM,aAAa;AAAA,IACjB;AAAA,MACE,UAAU;AAAA,QACR,GAAG,MAAM;AAAA,QACT,cAAc,MAAM;AAAA;AAAA;AAAA,QAGpB,2BAA2B;AAAA,MAC7B;AAAA,MACA,IAAI,MAAM;AAAA,MACV,eAAe,MAAM;AAAA,MACrB,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,gBAAgB,MAAM;AAAA,MACtB,cAAc,MAAM;AAAA,MACpB,iBAAiB,MAAM;AAAA,MACvB,WAAW,MAAM;AAAA,IACnB;AAAA,IACA,OAAO,aAAa,eAAe;AACjC,YAAM,eAAe,MAAM;AAAA,QACzB,YAAY;AAAA,QACZ,YAAY,MAAM;AAAA,QAClB,MAAM,SAAS;AAAA,QACf,WAAW;AAAA,MACb;AACA,UAAI,aAAa,aAAa,GAAG;AAC/B,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,iBAAW,SAAS,6BAA6B,MAAM,QAAQ,GAAG;AAChE,cAAM,SAAS,MAAM;AAAA,UACnB,YAAY;AAAA,UACZ,MAAM;AAAA,UACN,MAAM,SAAS;AAAA,UACf,WAAW;AAAA,QACb;AACA,YAAI,OAAO,aAAa,GAAG;AACzB,gBAAM,IAAI;AAAA,YACR,wDAAwD,KAAK,UAAU,MAAM,IAAI,CAAC,KAAK,OAAO,OAAO,MAAM,IAAK,CAAC;AAAA,UACnH;AAAA,QACF;AAAA,MACF;AACA,iBAAW,SAAS,MAAM,QAAQ;AAChC,cAAM,SAAS,MAAM;AAAA,UACnB,YAAY;AAAA,UACZ,MAAM;AAAA,UACN,MAAM,SAAS;AAAA,UACf,WAAW;AAAA,QACb;AACA,YAAI,OAAO,aAAa,GAAG;AACzB,gBAAM,IAAI;AAAA,YACR,qCAAqC,KAAK,UAAU,MAAM,IAAI,CAAC,KAAK,OAAO,OAAO,MAAM,IAAK,CAAC;AAAA,UAChG;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,aAAa,IAAI,EAAE,YAAY;AACxC;AAEA,eAAsB,8BAA8B,OAatB;AAC5B,QAAM,UAAU,MAAM,SAAS;AAC/B,QAAM,wBAAwB,oCAAoC,OAAO;AACzE,QAAM,cAAc,4BAA4B,MAAM,UAAU,OAAO;AACvE,QAAM,cAAc,4BAA4B;AAAA,IAC9C;AAAA,IACA;AAAA,IACA,YAAY,MAAM;AAAA,EACpB,CAAC;AACD,QAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,MAAI,WAA6B;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA,IACV,QAAQ;AAAA,IACR;AAAA,IACA,WAAW,0BAA0B,MAAM,UAAU;AAAA,IACrD;AAAA,IACA,gBAAgB,+BAA+B;AAAA,MAC7C,UAAU,MAAM,OAAO;AAAA,MACvB;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,SAAS;AAAA,IACT,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,wBAAwB;AAAA,IACxB,YAAY;AAAA,MACV,MAAM;AAAA,MACN,YAAY,MAAM,OAAO;AAAA,MACzB,UAAU,MAAM,OAAO;AAAA,IACzB;AAAA,IACA;AAAA,IACA,YAAY;AAAA,IACZ,OAAO;AAAA,EACT;AAEA,MAAI,MAAM,mBAAmB;AAC3B,UAAM,QAAQ,MAAM,kCAAkC,MAAM,IAAI;AAAA,MAC9D,aAAa,MAAM;AAAA,MACnB,WAAW,MAAM;AAAA,MACjB,OAAO;AAAA,MACP,cAAc;AAAA,MACd,kBAAkB;AAAA,IACpB,CAAC;AACD,QACE,MAAM,WAAW,WACjB,MAAM,WAAW,iBACjB,MAAM,WAAW,eACjB;AACA,aAAO,MAAM;AAAA,IACf;AACA,QAAI,MAAM,WAAW,YAAY;AAC/B,aAAO;AAAA,QACL,GAAG;AAAA,QACH,QAAQ;AAAA,QACR,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,QACnC,OAAO;AAAA,UACL,MAAM;AAAA,UACN,SACE;AAAA,UACF,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AACA,eAAW,MAAM;AAAA,EACnB;AAEA,QAAM,WAAW,OAAO,UAAuD;AAC7E,QAAI,MAAM,mBAAmB;AAC3B,YAAM,YAAY,MAAM,qCAAqC,MAAM,IAAI;AAAA,QACrE,aAAa,MAAM;AAAA,QACnB,WAAW,MAAM;AAAA,QACjB;AAAA,MACF,CAAC;AACD,UAAI,CAAC,WAAW;AACd,YAAI,MAAM,YAAY;AACpB,gBAAM,2CAA2C,MAAM,IAAI;AAAA,YACzD,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,YAAY,MAAM;AAAA,YAClB,QAAQ;AAAA,UACV,CAAC,EAAE,MAAM,MAAM,KAAK;AAAA,QACtB;AACA,eAAO;AAAA,UACL,GAAG;AAAA,UACH,QAAQ;AAAA,UACR,SAAS;AAAA,UACT,aAAa;AAAA,UACb,YAAY;AAAA,UACZ,wBAAwB;AAAA,UACxB,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,UACnC,OAAO;AAAA,YACL,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,uBAAuB;AAC1B,WAAO,MAAM,SAAS;AAAA,MACpB,GAAG;AAAA,MACH,QAAQ;AAAA,MACR,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,MACnC,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,mBAAmB,OAAO;AAAA,QACnC,WAAW;AAAA,MACb;AAAA,IACF,CAAC;AAAA,EACH;AAEA,iBAAe,MAAM,MAAM;AAC3B,MAAI,gBAGO;AACX,MAAI,aAA4B;AAChC,MAAI,sBAAqC;AACzC,MAAI;AACF,UAAM,QAAQ,MAAM,4BAA4B;AAAA,MAC9C;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,SAAS,MAAM,YAAY;AAAA,MAC3B,WAAW,SAAS;AAAA,MACpB,WAAW,MAAM,SAAS;AAAA,IAC5B,CAAC;AACD,QAAI,CAAC,SAAU,CAAC,MAAM,WAAW,CAAC,MAAM,aAAc;AACpD,YAAM,IAAI,MAAM,6DAA6D;AAAA,IAC/E;AACA,QAAI,YAAY,SAAS;AACvB,UAAI,CAAC,MAAM,WAAW,CAAC,MAAM,sBAAsB,CAAC,MAAM,iBAAiB;AACzE,cAAM,IAAI,MAAM,mEAAmE;AAAA,MACrF;AACA,sBAAgB;AAAA,QACd,SAAS,MAAM;AAAA,QACf,oBAAoB,MAAM;AAAA,MAC5B;AACA,YAAM,eAAe,wBAAwB;AAAA,QAC3C,UAAU;AAAA,QACV,YAAY,MAAM;AAAA,QAClB,sBAAsB;AAAA,MACxB,CAAC;AACD,YAAM,aAAa,8BAA8B,YAAY;AAC7D,UAAI,CAAC,YAAY;AACf,cAAM,IAAI,MAAM,kEAAkE;AAAA,MACpF;AACA,YAAM,WAAW,MAAM,kCAAkC,MAAM,IAAI;AAAA,QACjE,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,gBAAgB,MAAM,OAAO;AAAA,QAC7B,eAAe,MAAM,UAAU;AAAA,QAC/B,kBAAkB,MAAM,UAAU;AAAA,QAClC,kBAAkB,MAAM,UAAU;AAAA,QAClC,2BAA2B,MAAM,UAAU;AAAA,QAC3C,oBAAoB,MAAM;AAAA,QAC1B,iBAAiB,MAAM;AAAA,QACvB,kBAAkB,OAAO,KAAK,YAAY,EAAE,SAAS,QAAQ;AAAA,QAC7D,sBAAsB;AAAA,QACtB,sBAAsB;AAAA,MACxB,CAAC;AACD,mBAAa,SAAS;AAKtB,4BAAsB,MAAM,+BAA+B;AAAA,QACzD,UAAU,MAAM;AAAA,QAChB,IAAI,MAAM;AAAA,QACV,eAAe,MAAM;AAAA,QACrB,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,gBAAgB,SAAS;AAAA,QACzB,cAAc,MAAM,OAAO;AAAA,QAC3B,iBAAiB,sBAAsB,MAAM,OAAO,EAAE;AAAA,QACtD,SAAS,MAAM;AAAA,QACf;AAAA,QACA,QAAQ,MAAM,WAAW;AAAA,QACzB,WAAW,MAAM;AAAA,MACnB,CAAC;AAAA,IACH;AACA,QAAI,CAAC,qBAAqB;AACxB,YAAM,IAAI,MAAM,GAAG,OAAO,8DAA8D;AAAA,IAC1F;AACA,QAAI,MAAM,OAAO,SAAS;AACxB,UAAI,YAAY;AACd,cAAM,2CAA2C,MAAM,IAAI;AAAA,UACzD,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB;AAAA,UACA,QAAQ;AAAA,QACV,CAAC,EAAE,MAAM,MAAM,KAAK;AAAA,MACtB;AACA,YAAM,YAAY,MAAM,MAAM;AAAA,IAChC;AACA,WAAO,MAAM,SAAS;AAAA,MACpB,GAAG;AAAA,MACH,UAAU,MAAM;AAAA,MAChB,QAAQ;AAAA,MACR,SAAS,MAAM;AAAA,MACf,aAAa,MAAM;AAAA,MACnB;AAAA,MACA,wBAAwB,MAAM,qBAC1B,uCAAuC,MAAM,kBAAkB,IAC/D;AAAA,MACJ,oBAAoB;AAAA,QAClB,SAAS;AAAA,QACT,WAAW;AAAA,MACb;AAAA,MACA,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,MACnC,OAAO;AAAA,IACT,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,MAAM,OAAO,QAAS,OAAM,YAAY,MAAM,MAAM;AACxD,QAAI,YAAY;AACd,YAAM,2CAA2C,MAAM,IAAI;AAAA,QACzD,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB;AAAA,QACA,QAAQ;AAAA,MACV,CAAC,EAAE,MAAM,MAAM,KAAK;AAAA,IACtB,WACE,YAAY,WACZ,iBACA,EAAE,iBAAiB,qDACnB;AACA,YAAM;AAAA,QACJ,MAAM;AAAA,QACN,cAAc;AAAA,QACd,cAAc;AAAA,MAChB,EAAE,MAAM,MAAM,WAAoB;AAAA,IACpC;AACA,UAAM,WAAW,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,MAAM,GAAG,GAAI;AACtF,WAAO,MAAM,SAAS;AAAA,MACpB,GAAG;AAAA,MACH,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,MACnC,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,WAAW;AAAA,QACpB,WAAW;AAAA,MACb;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEO,SAAS,2BACd,UACA,UACqC;AAGrC,OAAK;AACL,SAAO;AACT;AAEA,eAAe,iBACb,IACA,aACA,UACmE;AACnE,QAAM,SAAS,MAAM,aAAa,IAAI,aAAa,QAAQ;AAC3D,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,yCAAyC,QAAQ,EAAE;AAAA,EACrE;AACA,QAAM,MAAM,MAAM,OAAO,IAAI,aAAa,OAAO,KAAK;AACtD,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,6CAA6C,OAAO,KAAK,EAAE;AAAA,EAC7E;AACA,MAAI,CAAC,OAAO,eAAe;AACzB,UAAM,IAAI,MAAM,8BAA8B,OAAO,EAAE,sBAAsB;AAAA,EAC/E;AACA,QAAM,cAAc,MAAM,kBAAkB,IAAI,aAAa,OAAO,aAAa;AACjF,MAAI,CAAC,eAAe,YAAY,UAAU,IAAI,IAAI;AAChD,UAAM,IAAI,MAAM,+CAA+C,OAAO,aAAa,EAAE;AAAA,EACvF;AACA,SAAO,EAAE,KAAK,aAAa,OAAO;AACpC;AAEA,eAAe,kBACb,IACA,aACA,WAC4C;AAC5C,QAAM,UAAU,MAAM,kBAAkB,IAAI,aAAa,SAAS;AAClE,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,0CAA0C,SAAS,EAAE;AAAA,EACvE;AACA,QAAM,MAAM,MAAM,OAAO,IAAI,aAAa,QAAQ,KAAK;AACvD,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,8CAA8C,QAAQ,KAAK,EAAE;AAAA,EAC/E;AACA,SAAO,EAAE,KAAK,QAAQ;AACxB;AAEA,eAAe,qCACb,KACY;AAIZ,QAAM,YAAY,uCAAuC;AACzD,MAAI;AACF,mBAAe,UAAU,MAAM;AAC/B,WAAO,MAAM,IAAI,SAAS;AAAA,EAC5B,UAAE;AACA,cAAU,QAAQ;AAAA,EACpB;AACF;AAEO,SAAS,gCAAgC,UAAkD;AAChG,SAAO;AAAA,IACL,iBAAiB,CAAC,UAChB,qCAAqC,OAAO,cAAc;AACxD,YAAM,EAAE,UAAU,IAAI,cAAc,IAAI,MAAM,SAAS;AACvD,qBAAe,UAAU,MAAM;AAC/B,YAAM,EAAE,KAAK,aAAa,OAAO,IAAI,MAAM;AAAA,QACzC;AAAA,QACA,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AACA,YAAM,QAAQ,YAAY,GAAG;AAC7B,YAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,YAAM,kCAAkC,IAAI,MAAM,aAAa,OAAO,IAAI;AAAA,QACxE;AAAA,QACA,uBAAuB;AAAA,MACzB,CAAC;AACD,YAAM,oBAAoB,IAAI;AAAA,QAC5B;AAAA,QACA,QAAQ;AAAA,QACR,OAAO,IAAI;AAAA,QACX,UAAU,EAAE,UAAU,OAAO,GAAG;AAAA,MAClC,CAAC;AAED,YAAM,eAAwC,EAAE,WAAW,cAAc,CAAC,EAAE;AAC5E,UAAI;AACF,cAAM,mBAAmB,0BAA0B,aAAa,MAAM;AACtE,cAAM,0BAA0B;AAAA,UAC9B;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA,cAAM,cAAc,2BAA2B,UAAU,iBAAiB,KAAK;AAC/E,cAAM,2BAA2B,4BAA4B;AAAA,UAC3D,SAAS,YAAY;AAAA,UACrB,aAAa,4BAA4B,aAAa,YAAY,cAAc;AAAA,UAChF,YAAY;AAAA,QACd,CAAC;AACD,eAAO,MAAM;AAAA,UACX;AAAA,YACE,UAAU;AAAA,YACV;AAAA,YACA;AAAA,YACA,WAAW,IAAI;AAAA,YACf,aAAa,MAAM;AAAA,YACnB,gBAAgB,OAAO;AAAA,YACvB,cAAc,iBAAiB;AAAA,YAC/B,iBAAiB,oBAAoB,OAAO,EAAE;AAAA,YAC9C;AAAA,UACF;AAAA,UACA,OAAO,aAAa,eAAe;AACjC,iBAAK,iBAAiB,eAAe,IAAI,KAAK,GAAG;AAC/C,oBAAM,gBAAgB,YAAY,SAAkB;AAAA,gBAClD,aAAa,CAAC;AAAA,gBACd,OAAO;AAAA,gBACP,eAAe,WAAW;AAAA,gBAC1B,UAAU;AAAA,kBACR,OAAO,IAAI;AAAA,kBACX,SAAS,IAAI;AAAA,kBACb,WAAW,iBAAiB;AAAA,kBAC5B,QAAQ,iBAAiB,eAAe;AAAA,kBACxC,WAAW,SAAS;AAAA,kBACpB,aAAa;AAAA,gBACf;AAAA,cACF,CAAC;AACD,2BAAa,cAAc,EAAE,UAAU,GAAG,QAAQ,GAAG;AAAA,YACvD;AACA,kBAAM,UAAU,mBAAmB,MAAM;AACzC,gBAAI,SAAS;AACX,oBAAM,gBAAgB,MAAM;AAAA,gBAC1B,YAAY;AAAA,gBACZ;AAAA,gBACA,SAAS;AAAA,gBACT,WAAW;AAAA,cACb;AACA,2BAAa,gBAAgB;AAC7B,kBAAI,cAAc,aAAa,GAAG;AAChC,6BAAa,cAAa,oBAAI,KAAK,GAAE,YAAY;AACjD,6BAAa,SAAS;AACtB,sBAAMC,WAAU,MAAM,sBAAsB,IAAI,MAAM,aAAa,OAAO,IAAI;AAAA,kBAC5E,QAAQ;AAAA,kBACR;AAAA,gBACF,CAAC;AACD,sBAAM,oBAAoB,IAAI;AAAA,kBAC5B;AAAA,kBACA,QAAQ;AAAA,kBACR,OAAO,IAAI;AAAA,kBACX,UAAU,EAAE,UAAU,OAAO,IAAI,QAAQ,WAAW;AAAA,gBACtD,CAAC;AACD,sBAAM,oBAAoB,IAAI;AAAA,kBAC5B;AAAA,kBACA,QAAQ;AAAA,kBACR,OAAO,IAAI;AAAA,kBACX,UAAU,EAAE,UAAU,OAAO,GAAG;AAAA,gBAClC,CAAC;AACD,uBAAOA;AAAA,cACT;AAAA,YACF;AACA,kBAAM,eAAe,MAAM;AAAA,cACzB,YAAY;AAAA,cACZ,qCAAqC,wBAAwB;AAAA,cAC7D,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AACA,gBAAI,aAAa,aAAa,GAAG;AAC/B,oBAAM,IAAI;AAAA,gBACR,qEAAqE,aAAa,OAAO,MAAM,IAAK,CAAC;AAAA,cACvG;AAAA,YACF;AACA,kBAAM,uBAAuB,MAAM;AAAA,cACjC,YAAY;AAAA,cACZ,6BAA6B,WAAW;AAAA,cACxC,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AACA,yBAAa,uBAAuB;AACpC,kBAAM,eAAe,MAAM;AAAA,cACzB,YAAY;AAAA,cACZ,iBAAiB;AAAA,cACjB,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AACA,yBAAa,eAAe;AAC5B,kBAAM,SACJ,qBAAqB,MAAM,CAAC,WAAW,OAAO,aAAa,CAAC,KAC5D,aAAa,MAAM,CAAC,WAAW,OAAO,aAAa,CAAC;AACtD,gBAAI,QAAQ;AACV,2BAAa,gBAAgB,MAAM,8BAA8B;AAAA,gBAC/D,UAAU;AAAA,gBACV;AAAA,gBACA;AAAA,gBACA,WAAW,IAAI;AAAA,gBACf,aAAa,MAAM;AAAA,gBACnB,YAAY;AAAA,gBACZ,QAAQ,EAAE,MAAM,UAAU,IAAI,OAAO,GAAG;AAAA,gBACxC;AAAA,gBACA,WAAW,WAAW;AAAA,gBACtB;AAAA,gBACA,QAAQ,WAAW;AAAA,cACrB,CAAC;AAAA,YACH;AACA,yBAAa,cAAa,oBAAI,KAAK,GAAE,YAAY;AACjD,yBAAa,SAAS;AACtB,kBAAM,aAAa,+BAA+B,EAAE,MAAM,OAAO,MAAM,OAAO,CAAC;AAC/E,gBAAI,WAAW,WAAW,gBAAgB;AAMxC,oBAAM,sBAAsB,IAAI,MAAM,aAAa,OAAO,IAAI;AAAA,gBAC5D,QAAQ;AAAA,gBACR;AAAA,cACF,CAAC;AACD,oBAAM,EAAE,QAAQ,OAAO,IAAI,MAAM,yBAAyB,EAAE,GAAG,GAAG,OAAO,KAAK;AAAA,gBAC5E,GAAG;AAAA,gBACH;AAAA,cACF,CAAC;AACD,oBAAM,oBAAoB,IAAI;AAAA,gBAC5B;AAAA,gBACA,QAAQ;AAAA,gBACR,OAAO,IAAI;AAAA,gBACX,UAAU,EAAE,UAAU,OAAO,GAAG;AAAA,cAClC,CAAC;AACD,qBAAO;AAAA,YACT;AACA,kBAAM,UAAU,MAAM,sBAAsB,IAAI,MAAM,aAAa,OAAO,IAAI;AAAA,cAC5E,QAAQ,WAAW;AAAA,cACnB;AAAA,YACF,CAAC;AACD,kBAAM,oBAAoB,IAAI;AAAA,cAC5B;AAAA,cACA,QAAQ,SAAS,4BAA4B;AAAA,cAC7C,OAAO,IAAI;AAAA,cACX,UAAU,EAAE,UAAU,OAAO,IAAI,QAAQ,WAAW,OAAO;AAAA,YAC7D,CAAC;AACD,gBAAI,CAAC,QAAQ;AACX,oBAAM,oBAAoB,IAAI;AAAA,gBAC5B;AAAA,gBACA,QAAQ;AAAA,gBACR,OAAO,IAAI;AAAA,gBACX,UAAU,EAAE,UAAU,OAAO,GAAG;AAAA,cAClC,CAAC;AAAA,YACH;AACA,mBAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF,SAAS,OAAO;AACd,qBAAa,cAAa,oBAAI,KAAK,GAAE,YAAY;AACjD,qBAAa,SAAS;AACtB,qBAAa,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC1E,cAAM,UAAU,MAAM,sBAAsB,IAAI,MAAM,aAAa,OAAO,IAAI;AAAA,UAC5E,QAAQ;AAAA,UACR;AAAA,QACF,CAAC;AACD,cAAM,oBAAoB,IAAI;AAAA,UAC5B;AAAA,UACA,QAAQ;AAAA,UACR,OAAO,IAAI;AAAA,UACX,UAAU,EAAE,UAAU,OAAO,IAAI,QAAQ,SAAS;AAAA,QACpD,CAAC;AACD,cAAM,oBAAoB,IAAI;AAAA,UAC5B;AAAA,UACA,QAAQ;AAAA,UACR,OAAO,IAAI;AAAA,UACX,UAAU,EAAE,UAAU,OAAO,GAAG;AAAA,QAClC,CAAC;AACD,YAAI,UAAU,OAAO,QAAS,OAAM,YAAY,UAAU,MAAM;AAChE,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,IAEH,kBAAkB,CAAC,UACjB,qCAAqC,OAAO,cAAc;AACxD,YAAM,EAAE,UAAU,IAAI,cAAc,IAAI,MAAM,SAAS;AACvD,qBAAe,UAAU,MAAM;AAC/B,YAAM,EAAE,KAAK,QAAQ,IAAI,MAAM,kBAAkB,IAAI,MAAM,aAAa,MAAM,SAAS;AACvF,YAAM,QAAQ,YAAY,GAAG;AAC7B,YAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,YAAM,oBAAoB,IAAI;AAAA,QAC5B;AAAA,QACA,QAAQ;AAAA,QACR,OAAO,IAAI;AAAA,QACX,UAAU,EAAE,WAAW,QAAQ,GAAG;AAAA,MACpC,CAAC;AACD,UAAI;AACF,cAAM,cAAc,2BAA2B,UAAU,QAAQ,KAAK;AACtE,cAAM,2BAA2B,4BAA4B;AAAA,UAC3D,SAAS,YAAY;AAAA,UACrB,aAAa,4BAA4B,aAAa,YAAY,cAAc;AAAA,UAChF,YAAY;AAAA,QACd,CAAC;AACD,eAAO,MAAM;AAAA,UACX;AAAA,YACE,UAAU;AAAA,YACV;AAAA,YACA;AAAA,YACA,WAAW,IAAI;AAAA,YACf,aAAa,MAAM;AAAA,YACnB,gBAAgB,QAAQ;AAAA,YACxB,cAAc,QAAQ;AAAA,YACtB,iBAAiB,4BAA4B,QAAQ,EAAE;AAAA,YACvD;AAAA,UACF;AAAA,UACA,OAAO,aAAa,eAAe;AACjC,iBAAK,QAAQ,eAAe,IAAI,KAAK,GAAG;AACtC,oBAAM,gBAAgB,YAAY,SAAkB;AAAA,gBAClD,aAAa,CAAC;AAAA,gBACd,OAAO;AAAA,gBACP,eAAe,WAAW;AAAA,gBAC1B,UAAU;AAAA,kBACR,OAAO,IAAI;AAAA,kBACX,SAAS,IAAI;AAAA,kBACb,WAAW,QAAQ;AAAA,kBACnB,QAAQ,QAAQ,eAAe;AAAA,kBAC/B,WAAW,SAAS;AAAA,kBACpB,aAAa;AAAA,gBACf;AAAA,cACF,CAAC;AAAA,YACH;AACA,kBAAM,eAAe,MAAM;AAAA,cACzB,YAAY;AAAA,cACZ,qCAAqC,wBAAwB;AAAA,cAC7D,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AACA,gBAAI,aAAa,aAAa,GAAG;AAC/B,oBAAM,IAAI;AAAA,gBACR,qEAAqE,aAAa,OAAO,MAAM,IAAK,CAAC;AAAA,cACvG;AAAA,YACF;AACA,kBAAM,uBAAuB,MAAM;AAAA,cACjC,YAAY;AAAA,cACZ,6BAA6B,WAAW;AAAA,cACxC,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AACA,kBAAM,eAAe,MAAM;AAAA,cACzB,YAAY;AAAA,cACZ,QAAQ;AAAA,cACR,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AACA,kBAAM,SACJ,qBAAqB,MAAM,CAAC,WAAW,OAAO,aAAa,CAAC,KAC5D,aAAa,MAAM,CAAC,WAAW,OAAO,aAAa,CAAC;AACtD,kBAAM,gBAAgB,SAClB,MAAM,8BAA8B;AAAA,cAClC,UAAU;AAAA,cACV;AAAA,cACA;AAAA,cACA,WAAW,IAAI;AAAA,cACf,aAAa,MAAM;AAAA,cACnB,mBAAmB,QAAQ;AAAA,cAC3B,YAAY;AAAA,cACZ,QAAQ,EAAE,MAAM,WAAW,IAAI,QAAQ,GAAG;AAAA,cAC1C;AAAA,cACA,WAAW,WAAW;AAAA,cACtB;AAAA,cACA,QAAQ,WAAW;AAAA,YACrB,CAAC,IACD;AACJ,kBAAM,oBAAoB,IAAI;AAAA,cAC5B;AAAA,cACA,QAAQ,SAAS,4BAA4B;AAAA,cAC7C,OAAO,IAAI;AAAA,cACX,UAAU;AAAA,gBACR,WAAW,QAAQ;AAAA,gBACnB;AAAA,gBACA,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,gBACnC;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,cACF;AAAA,YACF,CAAC;AACD,mBAAO;AAAA,cACL,WAAW,QAAQ;AAAA,cACnB;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,OAAO;AAKd,cAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpE,cAAM,oBAAoB,IAAI;AAAA,UAC5B;AAAA,UACA,QAAQ;AAAA,UACR,OAAO,IAAI;AAAA,UACX,UAAU;AAAA,YACR,WAAW,QAAQ;AAAA,YACnB;AAAA,YACA,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,YACnC,QAAQ;AAAA,YACR,OAAO;AAAA,UACT;AAAA,QACF,CAAC;AACD,cAAM;AAAA,MACR;AAAA,IACF,CAAC;AAAA,EACL;AACF;;;ACjqDA,SAAS,8DAA8D;AACvE;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,0CAA0C;AACnD,SAAS,6CAA6C;AACtD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAMK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA,mCAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,uCAAAC;AAAA,EACA,sCAAAC;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,oBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA,oBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,mCAAmC;AAC5C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA,gCAAAC;AAAA,EACA;AAAA,OACK;AACP,SAAS,eAAe;AACxB,SAAS,cAAAC,mBAAkB;;;ACpH3B,SAAS,kBAAkB;AAE3B,IAAM,8BAA8B;AACpC,IAAM,sBAAsB;AAC5B,IAAM,qBAAqB;AAC3B,IAAM,wBAAwB;AAC9B,IAAM,aAAa;AACnB,IAAM,sBAAsB;AAC5B,IAAM,wBAAwB;AAC9B,IAAM,mBACJ;AAsBK,SAAS,mDAAmD,OAIxD;AACT,QAAM,SAAS,WAAW,QAAQ,EAC/B;AAAA,IACC,KAAK,UAAU;AAAA,MACb,SAAS;AAAA,MACT,eAAe,MAAM,WAAW;AAAA,MAChC,uBAAuB,MAAM;AAAA,MAC7B,qBAAqB,MAAM;AAAA,IAC7B,CAAC;AAAA,EACH,EACC,OAAO,KAAK;AACf,SAAO,iCAAiC,MAAM;AAChD;AAOO,SAAS,iCAAiC,OAIL;AAC1C,QAAM,kBAAkB,cAAc,MAAM,iBAAiB,2BAA2B;AACxF,MAAI,CAAC,gBAAiB,QAAO;AAE7B,QAAM,QAAQ,OAAO,MAAM,SAAS,KAAK;AACzC,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,SAAS,MAAM;AACrB,MAAI,WAAW,YAAY,WAAW,WAAY,QAAO;AAEzD,QAAM,WAAW,mBAAmB,MAAM,QAAQ;AAClD,QAAM,cAAc,cAAc,MAAM,aAAa,qBAAqB;AAC1E,QAAM,SAAS,gBAAgB,MAAM,MAAM;AAC3C,MAAI,CAAC,YAAY,CAAC,eAAe,CAAC,OAAQ,QAAO;AAEjD,QAAM,WAAW;AAAA,IACf,MAAM,YAAY,MAAM,SAAS,iBAAiB,MAAM,SAAS,YAAY;AAAA,IAC7E;AAAA,EACF;AACA,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,SAAS,WAAW,QAAQ,EAC/B;AAAA,IACC,KAAK,UAAU;AAAA,MACb,SAAS;AAAA,MACT,aAAa,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,EACC,OAAO,KAAK;AACf,SAAO;AAAA,IACL;AAAA,IACA,6BAA6B,iCAAiC,MAAM;AAAA,IACpE,QAAQ,OAAO,YAAY,MAAM;AAAA,EACnC;AACF;AAEA,SAAS,OAAO,OAAgD;AAC9D,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IACrE,QACD;AACN;AAEA,SAAS,cAAc,OAAgB,UAAiC;AACtE,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,aAAa,MAAM,KAAK;AAC9B,MAAI,CAAC,cAAc,OAAO,WAAW,YAAY,MAAM,IAAI,SAAU,QAAO;AAC5E,SAAO;AACT;AAEA,SAAS,mBAAmB,OAA+B;AACzD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,WAAW,OAAO,WAAW,SAAS,MAAM,IAAI,oBAAqB,QAAO;AACjF,QAAM,QAAQ,iBAAiB,KAAK,OAAO;AAC3C,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AACJ,QAAM,OAAO,OAAO,QAAQ;AAC5B,QAAM,QAAQ,OAAO,SAAS;AAC9B,QAAM,MAAM,OAAO,OAAO;AAC1B,QAAM,OAAO,OAAO,QAAQ;AAC5B,QAAM,SAAS,OAAO,UAAU;AAChC,QAAM,SAAS,eAAe,SAAY,IAAI,OAAO,UAAU;AAC/D,QAAM,aAAa,mBAAmB,SAAY,IAAI,OAAO,cAAc;AAC3E,QAAM,eAAe,qBAAqB,SAAY,IAAI,OAAO,gBAAgB;AACjF,QAAM,WAAW,OAAO,MAAM,MAAM,OAAO,QAAQ,KAAK,OAAO,QAAQ;AACvE,QAAM,cAAc,CAAC,IAAI,WAAW,KAAK,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;AACnF,MACE,QAAQ,KACR,QAAQ,MACR,MAAM,KACN,MAAM,YAAY,QAAQ,CAAC,KAC3B,OAAO,MACP,SAAS,MACT,SAAS,MACT,aAAa,MACb,eAAe,IACf;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAAS,IAAI,KAAK,OAAO;AAC/B,SAAO,OAAO,SAAS,OAAO,QAAQ,CAAC,IAAI,UAAU;AACvD;AAEA,SAAS,gBAAgB,OAAyD;AAChF,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,UAAU,OAAO,QAAQ,MAAM;AACrC,MAAI,QAAQ,WAAW,KAAK,QAAQ,SAAS,WAAY,QAAO;AAChE,QAAM,YAA8C,CAAC;AACrD,aAAW,CAAC,KAAK,QAAQ,KAAK,SAAS;AACrC,QACE,CAAC,OACD,OAAO,WAAW,KAAK,MAAM,IAAI,uBACjC,OAAO,aAAa,YACpB,OAAO,WAAW,UAAU,MAAM,IAAI,uBACtC;AACA,aAAO;AAAA,IACT;AACA,cAAU,KAAK,CAAC,KAAK,QAAQ,CAAC;AAAA,EAChC;AACA,SAAO,UAAU,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAO,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI,CAAE;AACvF;;;ADzBO,SAAS,gCACd,QACA,OACA,oBACuB;AACvB,SAAO,uBAAuB,qBAC3B,MAAM,gBAAgB,eAAe,MAAM,0BAA0B,oBACpE,EAAE,GAAG,QAAQ,uBAAuB,kBAAkB,IACtD;AACN;AAGO,SAAS,wCACd,QACA,oBACyB;AACzB,MAAI,WAAW,UAAa,WAAW,KAAM,QAAO,CAAC;AACrD,QAAM,iBAAiB,sBAAsB,MAAM,MAAM;AACzD,SAAO,uBAAuB,qBAC5B,eAAe,0BAA0B,oBACvC,kCAAkC,CAAC,GAAG,cAAc,IACpD,CAAC;AACP;AAEO,SAAS,4BACd,OACA,0BACQ;AACR,MAAI,MAAM,YAAa,QAAO,MAAM;AACpC,MAAI,MAAM,gBAAgB,YAAa,QAAO,MAAM;AAEpD,MAAI,OAAO;AACX,MAAI,CAAC,MAAM;AACT,QAAI;AACF,aAAO,QAAQ,QAAQ,EAAE;AAAA,IAC3B,QAAQ;AACN,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,KAAK,mBAAmB;AAC3B,UAAM,IAAI,MAAM,6EAA6E;AAAA,EAC/F;AACA,SAAO,sBAAsB,WAAW;AAAA,IACtC,WAAW,KAAK;AAAA,IAChB,YAAY,KAAK,kBAAkB;AAAA,EACrC,CAAC,CAAC;AACJ;AAEO,SAAS,kDAAkD,aAA6B;AAC7F,QAAM,SAASC,YAAW,QAAQ,EAC/B,OAAO,wBAAwB,MAAM,EACrC,OAAO,aAAa,MAAM,EAC1B,OAAO,KAAK;AACf,SAAO,sBAAsB,MAAM;AACrC;AAsCA,SAAS,8BAA8B,eAA0D;AAC/F,uBAAqB,eAAe;AAAA,IAClC,SAAS;AAAA,IACT,eAAe;AAAA,IACf,iBAAiB;AAAA,EACnB,CAAC;AACH;AAEO,SAAS,0BAA0B,UAA0B;AAClE,SAAO,+BAA+B,QAAQ,KAAK;AACrD;AA0CA,eAAsB,2BACpB,IACA,OAK4E;AAC5E,QAAM,QAAQ,0BAA0B,MAAM,QAAQ;AACtD,QAAM,SAAS,MAAM,4BAA4B,IAAI;AAAA,IACnD,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,IACjB;AAAA,IACA,QAAQ;AAAA,IACR,iBAAiB;AAAA,MACf,OAAO;AAAA,MACP,QAAQ;AAAA,IACV;AAAA,EACF,CAAC;AACD,SAAO,OAAO;AAChB;AAEO,SAAS,8BAA8B,UAAkD;AAC9F,SAAO;AAAA,IACL,0BAA0B,OACxB,UAC4C;AAC5C,YAAM,cAAc,MAAM,SAAS;AAInC,UAAI,MAAM,gBAAgB,eAAe,CAAC,MAAM,WAAW;AACzD,eAAO,EAAE,QAAQ,WAAW,QAAQ,2BAA2B;AAAA,MACjE;AACA,YAAM,EAAE,IAAI,KAAK,oBAAoB,IAAI;AACzC,YAAM,kBAAkB,OAAOC,OAAqB,4BAEhD,MAAMC;AAAA,QACJ;AAAA,QACA,YAAY,yBAAyB,YAAY;AAAA,QACjD;AAAA,UACE,WAAWD,MAAK;AAAA,UAChB,aAAaA,MAAK;AAAA,UAClB,GAAI,2BAA2B,SAAY,EAAE,uBAAuB,IAAI,CAAC;AAAA,QAC3E;AAAA,MACF,GACA;AACJ,YAAM,oBAAoB,4BAA4B,KAAK;AAC3D,YAAM,WAAW,MAAM,iCAAiC,IAAI;AAAA,QAC1D,aAAa,MAAM;AAAA,QACnB,QAAQ,MAAM;AAAA,QACd,aAAa,MAAM;AAAA,QACnB,aAAa;AAAA,MACf,CAAC;AACD,UAAI,UAAU,eAAe,cAAc;AACzC,YAAI,SAAS,uBAAuB,SAAS,kBAAkB;AAC7D,iBAAO,gCAAgC,QAAQ;AAAA,QACjD;AACA,cAAM,oBAAoB,MAAM,qCAAqC,IAAI;AAAA,UACvE,aAAa,MAAM;AAAA,UACnB,OAAO,SAAS;AAAA,QAClB,CAAC;AACD,YAAI,CAAC,mBAAmB;AACtB,cACE,SAAS,WAAW,eACpB,SAAS,WAAW,YACpB,SAAS,WAAW,WACpB;AACA,mBAAO,2BAA2B,SAAS,KAAK;AAAA,UAClD;AACA,gBAAM,IAAI,MAAM,yDAAyD;AAAA,QAC3E;AACA,YAAI,SAAS,WAAW,YAAY,6BAA6B,kBAAkB,IAAI,GAAG;AACxF,gBAAM;AAAA,YACJ;AAAA,YACA,SAAS;AAAA,YACT,SAAS;AAAA,YACT;AAAA,UACF;AACA,iBAAO,2BAA2B,+BAA+B;AAAA,QACnE;AACA,cAAM,8BAA8B,IAAI,mBAAmB,QAAQ;AACnE,YAAI,SAAS,WAAW,cAAc;AACpC,iBAAO,MAAM,4BAA4B;AAAA,YACvC;AAAA,YACA;AAAA,YACA,MAAM,kBAAkB;AAAA,YACxB,KAAK;AAAA,YACL;AAAA,UACF,CAAC;AAAA,QACH;AACA,YAAI,SAAS,WAAW,UAAU;AAChC,gBAAM,iBAAiB,kBAAkB,sBACrC,sBAAsB,MAAM,kBAAkB,mBAAmB,IACjE;AACJ,gBAAME,YAAW,MAAM;AAAA,YACrB,kBAAkB;AAAA,YAClB,gBAAgB,kBACd,kBAAkB,wBAAwB,SAC1C,kBAAkB;AAAA,UACtB;AACA,cAAI;AACF,mBAAO,MAAM,kCAAkC;AAAA,cAC7C;AAAA,cACA,eAAe,YAAY;AAAA,cAC3B;AAAA,cACA,UAAAA;AAAA,cACA;AAAA,cACA,KAAK;AAAA,cACL;AAAA,cACA;AAAA,YACF,CAAC;AAAA,UACH,SAAS,OAAO;AACd,kBAAM,gBAAgB,kCAAkC,KAAK;AAC7D,gBAAI,CAAC,cAAe,OAAM;AAC1B,kBAAM;AAAA,cACJ;AAAA,cACA,SAAS;AAAA,cACT,SAAS;AAAA,cACT,cAAc;AAAA,YAChB;AACA,mBAAO,2BAA2B,cAAc,IAAI;AAAA,UACtD;AAAA,QACF;AACA,YAAI,SAAS,WAAW,aAAa;AACnC,cAAI,CAAC,SAAS,aAAa,CAAC,SAAS,gBAAgB;AACnD,kBAAM,IAAI,MAAM,0DAA0D;AAAA,UAC5E;AACA,iBAAO;AAAA,YACL,QAAQ,kBAAkB,KAAK,YAAY,wBAAwB,UAAU;AAAA,YAC7E,WAAW,kBAAkB,KAAK;AAAA,YAClC,aAAa,kBAAkB,KAAK;AAAA,YACpC,WAAW,SAAS;AAAA,YACpB,gBAAgB,SAAS;AAAA,YACzB,YAAY,qBAAqB,SAAS,SAAS;AAAA,YACnD,sBAAsB;AAAA,UACxB;AAAA,QACF;AACA,YAAI,SAAS,WAAW,YAAY,SAAS,WAAW,WAAW;AACjE,iBAAO,2BAA2B,SAAS,KAAK;AAAA,QAClD;AAAA,MACF;AACA,YAAM,OAAO,MAAM,iBAAiB,IAAI,MAAM,aAAa,MAAM,MAAM;AAIvE,UAAI,CAAC,MAAM;AACT,eAAO,EAAE,QAAQ,UAAU;AAAA,MAC7B;AACA,UAAI,6BAA6B,IAAI;AACnC,eAAO,EAAE,QAAQ,WAAW,QAAQ,gCAAgC;AACtE,UAAI,KAAK,OAAO,SAAS,cAAc;AACrC,eAAO,EAAE,QAAQ,WAAW,QAAQ,4CAA4C;AAAA,MAClF;AACA,UAAI,KAAK,WAAW,UAAU;AAC5B,eAAO,EAAE,QAAQ,WAAW,QAAQ,wBAAwB;AAAA,MAC9D;AACA,UAAI,KAAK,YAAY,mBAAmB,qCAAqC,IAAI,GAAG;AAClF,eAAO,EAAE,QAAQ,WAAW,QAAQ,0BAA0B;AAAA,MAChE;AACA,YAAM,4BAA4B,iCAAiC;AAAA,QACjE,aAAa,KAAK;AAAA,QAClB,iBAAiB,KAAK;AAAA,QACtB,UAAU,KAAK;AAAA,MACjB,CAAC;AACD,YAAM,kBACJ,KAAK,YAAY,wBAAwB,4BAA4B;AACvE,YAAM,4CAA4C,kBAC9C,mDAAmD;AAAA,QACjD,YAAY;AAAA,QACZ,uBAAuB,KAAK;AAAA,QAC5B,qBAAqB,KAAK;AAAA,MAC5B,CAAC,IACD;AACJ,YAAM,sBAAsB;AAAA,QAC1B,KAAK;AAAA,QACL,8BAA8B;AAAA,MAChC;AACA,UAAI,oBAAoB,WAAW,WAAW;AAC5C,eAAO;AAAA,MACT;AACA,YAAM,yCACJ,MAAM,iDAAiD,IAAI;AAAA,QACzD,WAAW,KAAK;AAAA,QAChB,aAAa,KAAK;AAAA,QAClB,QAAQ,KAAK;AAAA,QACb,uBAAuB,KAAK;AAAA,MAC9B,CAAC;AACH,YAAM,wBAAwB,MAAM,kCAAkC,IAAI;AAAA,QACxE,WAAW,KAAK;AAAA,QAChB,aAAa,KAAK;AAAA,QAClB,QAAQ,KAAK;AAAA,QACb,uBAAuB,KAAK;AAAA,MAC9B,CAAC;AACD,YAAM,yBAAyB,KAAK;AAQpC,YAAM,kBAAkB,OACtB,QACA,WACA,WAC4C;AAC5C,gBAAQ;AAAA,UACN,0CAA0C,KAAK,EAAE,cAAc,KAAK,iBAAiB,MAAM,MAAM,KAAK,MAAM;AAAA,QAC9G;AACA,cAAM,UAAU,MAAM,oCAAoC,IAAI;AAAA,UAC5D,aAAa,KAAK;AAAA,UAClB,QAAQ,KAAK;AAAA,UACb,uBAAuB,KAAK;AAAA,UAC5B,qBAAqB,KAAK;AAAA,UAC1B,aAAa,MAAM;AAAA,UACnB,aAAa;AAAA,UACb;AAAA,UACA;AAAA,QACF,CAAC;AACD,YAAI,CAAC,QAAQ,kBAAkB;AAG7B,iBAAO,8BAA8B,QAAQ,EAAE,yBAAyB,KAAK;AAAA,QAC/E;AACA,eAAO,gCAAgC,OAAO;AAAA,MAChD;AACA,UACE,KAAK,OAAO,SAAS,kBACnB,uBAAuB,aAAa,UAAU,0BAC9C,CAAC,sCAAsC,EAAE;AAAA,QACvC,CAAC,YAAY,YAAY,QAAQ,YAAY;AAAA,MAC/C,IACF;AACA,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,0BACJ,KAAK,YAAY,qBACb,KAAK,kBACL,KAAK,YAAY,qBACf,KAAK,oBACL;AAOR,YAAM,6BAA6B,0BAC/B,MAAM;AAAA,QACJ;AAAA,QACA,KAAK;AAAA,QACL;AAAA,QACA;AAAA,MACF,IACA;AACJ,YAAM,WAAW,MAAM,gBAAgB,MAAM,4BAA4B,KAAK;AAS9E,YAAM,kBACJ,KAAK,YAAY,SAAS,6BACtB,OACA,MAAM,iCAAiC,IAAI,UAAU,IAAI;AAC/D,YAAM,QAAQ,KAAK,YAAY,SAAS,iBAAiB,SAAS,SAAS;AAC3E,YAAM,kBACJ,KAAK,YAAY,mBACjB,iBAAiB,mBACjB,SAAS;AACX,UAAI,iBAAiB,KAAK,YAAY,kBAAkB,SAAS;AACjE,UAAI,YAA2C;AAG/C,YAAM,WAAW,KAAK,YAAY,aAC9B,sBAAsB;AAAA,QACpB,aAAa,KAAK;AAAA,QAClB;AAAA,QACA,iBAAiB,MAAM;AAAA,UACrB;AAAA,UACA,KAAK;AAAA,UACL;AAAA,UACA,yBAAyB,EAAE,WAAW,uBAAuB,IAAI,CAAC;AAAA,QACpE;AAAA,QACA,mBAAmB;AAAA,WAChB,MAAMC,kBAAiB,IAAI,KAAK,WAAW,GAAG;AAAA,QACjD;AAAA,MACF,CAAC,IACD,KAAK,YAAY;AACrB,UAAI,YAAY,oBAAoB,UAAU,QAAQ;AAMtD,YAAM,gBAAgB,MAAM,8BAA8B,IAAI,KAAK,aAAa,KAAK,EAAE;AAGvF,UAAI,qBAAqB;AAAA,QACvB,eAAe,qBACX,oCAAoC,UAAU,cAAc,kBAAkB,IAC9E,+BAA+B,QAAQ,EAAE;AAAA,QAC7C,KAAK;AAAA,QACL,+BAA+B,QAAQ,EAAE;AAAA,MAC3C;AAKA,UAAI,sBAAkD;AACtD,UAAI;AACJ,YAAM,kBACJ,KAAK,YAAY,yBAChB,KAAK,YAAY,sBAAsB,KAAK,sBAAsB;AACrE,UAAI,iBAAiB;AACnB,YAAI;AACF,gBAAM,kBAAkBC,oCAAmC;AAAA,YACzD;AAAA,YACA,SAAS;AAAA,YACT,SAAS,KAAK,YAAY;AAAA,YAC1B,cAAc;AAAA,YACd,oBAAoB,MAAMD,kBAAiB,IAAI,KAAK,WAAW,GAAG;AAAA,YAClE,QAAQ;AAAA,YACR,MAAM,KAAK,YAAY,SAAS;AAAA,UAClC,CAAC;AACD,gCAAsB,gBAAgB;AACtC,sCAA4B,gBAAgB;AAC5C,gBAAM,UAAUE,qCAAoC;AAAA,YAClD,QAAQ;AAAA,YACR;AAAA,YACA,OAAO;AAAA,YACP,YAAY,EAAE,MAAM,YAAY,wBAAwB,KAAK;AAAA,YAC7D,kBAAkB,SAAS,IAAI,CAAC,SAAS,KAAK,EAAE;AAAA,UAClD,CAAC;AACD,+BAAqB,QAAQ;AAC7B,sBAAY,QAAQ;AAAA,QACtB,SAAS,OAAO;AACd,gBAAM,SACJ,iBAAiB,QAAS,MAAuC,SAAS;AAC5E,cAAI,EAAE,iBAAiB,UAAU,WAAW,IAAK,OAAM;AACvD,iBAAO,MAAM;AAAA,YACX;AAAA,YACA;AAAA,YACA,oDAAoD,MAAM,OAAO;AAAA,UACnE;AAAA,QACF;AAAA,MACF;AACA,YAAM,2BAA2B,eAAe,2BAC5C,CAAC,GAAG,cAAc,wBAAwB,IAC1C,CAAC,GAAG,mCAAmC;AAG3C,YAAM,qBAAqB,MAAM;AAAA,QAC/B;AAAA,QACA,KAAK;AAAA,QACL;AAAA,QACA,yBAAyB,EAAE,WAAW,uBAAuB,IAAI,CAAC;AAAA,MACpE;AACA,YAAM,mBACJ,2BAA2B,6BACvB,MAAM,eAAe,IAAI,KAAK,aAAa,uBAAuB,IAClE;AACN,YAAM,yBAAyB,MAAMF,kBAAiB,IAAI,KAAK,WAAW,GAAG;AAC7E,UAAI,kBAAkB,MAAM;AAAA,QAC1B;AAAA,QACA,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA,0BAA0B;AAAA,MAC5B;AAMA,UAAI,UACF,KAAK,YAAY,qBAAqB,CAAC,IAAI,CAAC,GAAI,KAAK,YAAY,kBAAkB,CAAC,CAAE;AACxF,YAAM,qBAAqB;AAAA,QACzB;AAAA,QACA,oBAAoB;AAAA,UAClB;AAAA,UACA;AAAA,QACF;AAAA,QACA;AAAA,MACF;AACA,YAAM,yBAAyB,MAC7B,yBAAyB;AAAA,QACvB;AAAA,QACA,WAAW,KAAK;AAAA,QAChB,aAAa,KAAK;AAAA,QAClB,UAAU,mBACN,qCAAqC,oBAAoB,iBAAiB,UAAU,IACpF;AAAA,QACJ,OAAO;AAAA,QACP,WAAW;AAAA,UACT,kBAAkB,aAAa,CAAC;AAAA,UAChC,KAAK,YAAY;AAAA,QACnB;AAAA,QACA,QAAQ,yBACJ,EAAE,MAAM,WAAW,WAAW,wBAAwB,WAAW,KAAK,UAAU,IAChF,EAAE,MAAM,OAAO;AAAA,QACnB,qBAAqB;AAAA,QACrB,GAAG;AAAA,MACL,CAAC,EAAE,MAAM,CAAC,UAAmB;AAC3B,YAAI,iBAAiB,gCAAiC,QAAO;AAC7D,cAAM;AAAA,MACR,CAAC;AACH,UAAI,kBAAkB,MAAM,uBAAuB;AAMnD,YAAM,mBAAmD,CAAC;AAC1D,aACE,2BAA2B,mCAC3B,KAAK,YAAY,2BAA2B,MAC5C;AACA,cAAM,UAA2C;AACjD,cAAM,QAAQ,mBAAmB,SAAS,OAAO;AAGjD,YACE,MAAM,WAAW,KACjB,MAAM,KAAK,CAAC,QAAQ,IAAI,aAAa,qCAAqC,GAC1E;AACA;AAAA,QACF;AACA,yBAAiB,KAAK,GAAG,KAAK;AAC9B,cAAM,YAAY,IAAI,IAAI,MAAM,IAAI,eAAe,CAAC;AACpD,cAAM,iBAAiB,IAAI,IAAI,MAAM,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;AAC/D,kBAAU,QAAQ,OAAO,CAAC,QAAQ,CAAC,UAAU,IAAI,gBAAgB,GAAG,CAAC,CAAC;AACtE,cAAM,mBAAmB,IAAI;AAAA,UAC3B,CAAC,GAAG,cAAc,EAAE;AAAA,YAClB,CAAC,aAAa,CAAC,QAAQ,KAAK,CAAC,QAAQ,IAAI,aAAa,QAAQ;AAAA,UAChE;AAAA,QACF;AACA,YAAI,iBAAiB,IAAI,kCAAkC,GAAG;AAC5D,6BAAmB,gCAAgC;AAAA,QACrD;AACA,0BAAkB,gBAAgB;AAAA,UAChC,CAAC,SAAS,EAAE,KAAK,SAAS,SAAS,iBAAiB,IAAI,KAAK,EAAE;AAAA,QACjE;AACA,oBAAY,UAAU;AAAA,UACpB,CAAC,SAAS,EAAE,KAAK,SAAS,SAAS,iBAAiB,IAAI,KAAK,EAAE;AAAA,QACjE;AACA,0BAAkB,MAAM,uBAAuB;AAAA,MACjD;AACA,UAAI,2BAA2B,iCAAiC;AAC9D,cAAM,UAAU,MAAM,oCAAoC,IAAI;AAAA,UAC5D,aAAa,KAAK;AAAA,UAClB,QAAQ,KAAK;AAAA,UACb,uBAAuB,KAAK;AAAA,UAC5B,qBAAqB,KAAK;AAAA,UAC1B,aAAa,MAAM;AAAA,UACnB,aAAa;AAAA,UACb,YAAY,gBAAgB;AAAA,QAC9B,CAAC;AACD,YAAI,CAAC,QAAQ,qBAAqB;AAGhC,iBAAO,8BAA8B,QAAQ,EAAE,yBAAyB,KAAK;AAAA,QAC/E;AACA,eAAO,gCAAgC,OAAO;AAAA,MAChD;AACA,YAAM;AAAA,QACJ,+BAA+B;AAAA,QAC/B,oBAAoB;AAAA,QACpB,yBAAyB;AAAA,MAC3B,IAAI;AACJ,YAAM,mCACJ,kCAAkC,SAAS,IAAI,yBAAyB;AAC1E,YAAM,uBAAuB;AAAA,QAC3B,eAAe,iBAAiB;AAAA,MAClC;AACA,UAAI,0BAA0B;AAC9B,UAAI,mBAAmB,KAAK,YAAY,eAAe;AACrD,cAAM,SAAS;AAAA,UACb,WAAW,KAAK;AAAA,UAChB,aAAa,KAAK;AAAA,UAClB,WAAW,0BAA0B,KAAK,UAAU;AAAA,QACtD;AACA,cAAM,UAAU,MAAM;AAAA,UACpB;AAAA,UACA;AAAA,UACA,KAAK,YAAY,cAAc;AAAA,QACjC;AAKA,YACE,CAAC,WACD,QAAQ,SAAS,gBACjB,CAAC,QAAQ,gBACR,QAAQ,UAAU,UAAU,CAAC,6BAA6B,MAAM,OAAO,SAAS,GACjF;AACA,iBAAO,MAAM;AAAA,YACX;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AACA,cAAM,aAAa,MAAM,cAAc,IAAI,QAAQ,QAAQ,YAAY;AACvE,YAAI,CAAC,YAAY;AACf,iBAAO,MAAM;AAAA,YACX;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AACA,YAAI,WAAW,WAAW,UAAU;AAGlC,iBAAO,MAAM;AAAA,YACX;AAAA,YACA;AAAA,YACA,6CAA6C,WAAW,MAAM;AAAA,UAChE;AAAA,QACF;AACA,yBAAiB;AACjB,oBAAY,WAAW;AACvB,kCAA0B,QAAQ,UAAU;AAAA,MAC9C,WAAW,mBAAmB,mBAAmB,cAAc;AAC7D,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,8BAA8B,kBAChC,OAAO,YAAY;AACjB,cAAM,YAAY,MAAMA,kBAAiB,IAAI,KAAK,WAAW;AAC7D,cAAM,aAAa,MAAM,oCAAoC,EAAE;AAC/D,cAAM,eAAe,KAAK,YAAY,uBAAuB;AAC7D,cAAM,oBACJ,OAAO,UAAU,SAAS,wBAAwB,WAC9C,UAAU,SAAS,sBACnB;AACN,eAAO,iBAAiB,OACpB;AAAA,UACE,8BAA8B;AAAA,UAC9B,8BAA8B;AAAA,UAC9B,qBAAqB,mBAAmB,KAAK,IACzC,uCAAuC,UAAU,QAAQ,IACxD;AAAA,QACP,IACA,sBAAsB,OACpB;AAAA,UACE,8BAA8B;AAAA,UAC9B,8BAA8B;AAAA,UAC9B,qBAAqB,mBAAmB,KAAK,IACzC,uCAAuC,UAAU,QAAQ,IACxD;AAAA,QACP,IACA;AAAA,UACE,8BAA8B,WAAW;AAAA,UACzC,8BAA8B,WAAW;AAAA,UACzC,qBAAqB,mBAAmB,KAAK,IACzC,uCAAuC,UAAU,QAAQ,IACxD;AAAA,QACP;AAAA,MACR,GAAG,IACH;AACJ,YAAM,yBAAyB,6BAC3B,OAAO,YAAY;AACjB,cAAM,0BACJ,MAAM;AAAA,UACJ;AAAA,UACA,KAAK;AAAA,UACL;AAAA,QACF;AACF,cAAM,wBAAwB,oBAAI,IAAI;AAAA,UACpC,GAAG,mBAAmB,WAAW,IAAI,CAAC,WAAW,OAAO,EAAE;AAAA,UAC1D,GAAG;AAAA,QACL,CAAC;AACD,mBAAW,MAAM,2BAA2B,cAAc;AACxD,gCAAsB,IAAI,EAAE;AAAA,QAC9B;AACA,cAAM,YAAY,yBAAyB;AAAA,UACzC,YAAY,2BAA2B;AAAA,UACvC,cAAc,2BAA2B;AAAA,UACzC;AAAA,UACA,qBAAqB;AAAA,YACnB,GAAG,gBAAgB,IAAI,CAAC,SAAS,KAAK,EAAE;AAAA,YACxC,GAAG;AAAA,UACL;AAAA,QACF,CAAC;AACD,eAAO;AAAA,UACL,GAAG;AAAA,UACH,6BAA6B;AAAA,YAC3B;AAAA,YACA;AAAA,cACE,GAAG;AAAA,cACH,GAAI,mBAAmB,EAAE,OAAO,iBAAiB,MAAM,IAAI,CAAC;AAAA,YAC9D;AAAA,YACA;AAAA,UACF;AAAA,UACA,uBAAuB;AAAA,YACrB,GAAG,IAAI;AAAA,cACL,UAAU,SAAS,QAAQ,CAAC,SAAU,KAAK,SAAS,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAE;AAAA,YAC7E;AAAA,UACF,EAAE,KAAK;AAAA,QACT;AAAA,MACF,GAAG,IACH;AACJ,YAAM,sBACJ,mBAAmB,KAAK,gBACpB,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,UACE,WAAW,KAAK;AAAA,UAChB,aAAa,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,UAKlB,WAAW,0BAA0B,KAAK,UAAU;AAAA,QACtD;AAAA,QACA,KAAK;AAAA,MACP,IACA;AACN,UAAI,mBAAmB,KAAK,iBAAiB,CAAC,qBAAqB;AACjE,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA,2BAA2B,KAAK,aAAa;AAAA,QAC/C;AAAA,MACF;AACA,YAAM,cACJ,mBAAmB,KAAK,QACpB,MAAMG;AAAA,QACJ;AAAA,QACA;AAAA,UACE,WAAW,KAAK;AAAA,UAChB,aAAa,KAAK;AAAA,UAClB,WAAW,0BAA0B,KAAK,UAAU;AAAA,QACtD;AAAA,QACA,KAAK;AAAA,MACP,IACA;AACN,UAAI,mBAAmB,KAAK,UAAU,CAAC,eAAe,CAAC,YAAY,gBAAgB;AACjF,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA,sDAAsD,KAAK,KAAK;AAAA,QAClE;AAAA,MACF;AACA,YAAM,oCAAoC,aAAa,gBACnD,MAAM,QAAQ;AAAA,QACZ,YAAY,cAAc,sBAAsB,IAAI,OAAO,mBAAmB;AAAA,UAC5E;AAAA,UACA,aAAa,MAAM;AAAA,YACjB;AAAA,YACA;AAAA,cACE,WAAW,KAAK;AAAA,cAChB,aAAa,KAAK;AAAA,cAClB,WAAW,0BAA0B,KAAK,UAAU;AAAA,YACtD;AAAA,YACA;AAAA,UACF;AAAA,QACF,EAAE;AAAA,MACJ,IACA,CAAC;AACL,YAAM,+BAA+B,kCAAkC;AAAA,QACrE,CAAC,QAAQ,CAAC,IAAI;AAAA,MAChB;AACA,UAAI,8BAA8B;AAChC,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA,uDAAuD,6BAA6B,aAAa;AAAA,QACnG;AAAA,MACF;AACA,YAAM,iCAAiC,kCAAkC;AAAA,QACvE,CAAC,EAAE,YAAY,OAAO,EAAE,IAAI,YAAa,IAAI,YAAY,YAAa,WAAW;AAAA,MACnF;AACA,UAAI,4BAA4B,oBAAoB,WAAW;AAC/D,UAAI,2BAA2B;AAC7B,cAAM,oBACJ,KAAK,YAAY,qBAAqB,KAAK,kBAAkB,KAAK;AACpE,cAAM,wBACJ,KAAK,YAAY,yBAAyB,kBACtC,MAAM;AAAA,UACJ;AAAA,UACA,KAAK;AAAA,UACL;AAAA,QACF,IACA;AACN,cAAM,mBAAmB,oBACrB,MAAM,eAAe,IAAI,KAAK,aAAa,iBAAiB,IAC5D;AACJ,cAAM,YAAY,MAAM,0CAA0C;AAAA,UAChE;AAAA,UACA;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,+BAA+B;AAAA,UAC/B,cAAc;AAAA,UACd,oCAAoC;AAAA,UACpC,iBAAiB,yBACb;AAAA,YACE,OAAO,uBAAuB;AAAA,YAC9B,oBACE,uBAAuB,+BACvB,uBAAuB;AAAA,YACzB,0BAA0B,uBAAuB;AAAA,YACjD,OAAO,uBAAuB;AAAA,YAC9B,cAAc,uBAAuB;AAAA,YACrC,YAAY,uBAAuB;AAAA,YACnC,cAAc,uBAAuB;AAAA,YACrC,mBAAmB,uBAAuB;AAAA,UAC5C,IACA;AAAA,YACE,OAAO;AAAA,YACP;AAAA,YACA;AAAA,YACA,OAAO,aAAa,MAAM;AAAA,YAC1B,cAAc,aAAa,eAAe,MAAM;AAAA,YAChD,YAAY,kBAAkB,cAAc;AAAA,cAC1C,MAAM;AAAA,cACN,wBAAwB;AAAA,YAC1B;AAAA,YACA,cAAc,CAAC;AAAA,YACf,mBAAmB,kBAAkB,qBAAqB;AAAA,UAC5D;AAAA,QACN,CAAC;AACD,cAAM,YAAY,mCAAmC;AAAA,UACnD,aAAa,KAAK;AAAA,UAClB,mBAAmB,8BAA8B;AAAA,UACjD,uBAAuB,2BAA2B,UAAU;AAAA,UAC5D;AAAA,QACF,CAAC;AACD,YAAI,UAAU,WAAW,UAAW,QAAO;AAC3C,oCAA4B,UAAU,WAAW;AAAA,MACnD;AACA,YAAM,0CACJ,MAAM,oDAAoD,IAAI,KAAK,aAAa,KAAK,EAAE;AACzF,YAAM,6CACJ,MAAM,uDAAuD,IAAI,KAAK,aAAa,KAAK,EAAE;AAI5F,YAAM,4BAA4B,MAAM,sCAAsC,IAAI;AAAA,QAChF,aAAa,KAAK;AAAA,QAClB,QAAQ,KAAK;AAAA,QACb,6BAA6B,uBAAuB,aAAa;AAAA,QACjE,uBAAuB,KAAK;AAAA,MAC9B,CAAC;AAKD,YAAM,qBAAqB,KAAK,YAAY,uBACxC,MAAM;AAAA,QACJ;AAAA,QACA,KAAK;AAAA,QACL,KAAK,YAAY;AAAA,MACnB,IACA;AACJ,YAAM,mBAAmB,qBACrB,yBAAyB,mBAAmB,QAAQ,IACpD;AACJ,UAAI,sBAAsB,CAAC,kBAAkB;AAC3C,cAAM,IAAI,MAAM,mDAAmD;AAAA,MACrE;AACA,YAAM,wBACJ,wCAAwC,UAAU,UAClD,KAAK,UAAU,SAAS,YACpB,KAAK,UAAU,YACf;AACN,UAAI,wCAAwC,UAAU,UAAU,CAAC,uBAAuB;AACtF,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UACE,yBACA,0BACA,0BAA0B,wBAC1B;AACA,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,2BACJ,2CAA2C,UAAU,UAAU,KAAK,iBAChE,KAAK,iBACL;AACN,UACE,2CAA2C,UAAU,UACrD,CAAC,0BACD;AACA,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UACE,4BACA,0BACA,6BAA6B,wBAC7B;AACA,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,uBACJ,0BAA0B,yBAAyB;AACrD,UACE,yBACA,4BACA,0BAA0B;AAE1B,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACF,UACE,KAAK,YAAY,mBACjB,yBAAyB,KAAK,YAAY,gBAAgB,qBAC1D;AACA,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAMA,YAAM,2BACJ,qBAAqB,UAAU,UAC/B,aAAa,UAAU,UACvB;AACF,UACG,4BAA4B,CAAC,wBAC7B,2BAA2B,yBAAyB,KAAK,gBAC1D;AACA,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,kBAAkB,MAAM;AAAA,QAC5B,EAAE,GAAG,aAAa,SAAS;AAAA,QAC3B;AAAA,UACE,WAAW,KAAK;AAAA,UAChB,aAAa,KAAK;AAAA,UAClB,OAAO,wBAAwB,SAAS;AAAA,UACxC,oBAAoB,MAAM,8BAA8B,IAAI;AAAA,UAC5D,0BAA0B;AAAA,QAC5B;AAAA,MACF;AACA,UAAI,iBAAiB;AAGnB,eAAO,MAAM,gBAAgB,iBAAiB,MAAM,4BAA4B;AAAA,MAClF;AACA,UAAI,2BAA2B,4BAA4B;AAMzD,cAAM,aAAa,MAAM,gCAAgC,IAAI;AAAA,UAC3D,WAAW,KAAK;AAAA,UAChB,aAAa,KAAK;AAAA,UAClB,WAAW;AAAA,UACX,SAAS;AAAA,QACX,CAAC;AACD,YAAI,CAAC,WAAW,SAAS;AACvB,iBAAO,MAAM;AAAA,YACX;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,YAAM,gBAAgB,wBAAwB,SAAS;AACvD,YAAM,0BAA0B,wBAAwB,mBAAmB;AAC3E,YAAM,sBAAsB,wBAAwB,eAAe;AACnE,YAAM,sBAAsB,kBACxB,8BAA8B,UAAU,aAAa,IACrD;AACJ,YAAM,4BAA4B,sBAC9B,OAAO,OAAgC;AAIrC,cAAM,SAAS,MAAM;AAAA,UACnB;AAAA,UACA,KAAK;AAAA,UACL,wBAAwB,KAAK,kBAAkB,KAAK,UAAU;AAAA,UAC9D,OAAO,WACL,MAAM,kCAAkC,QAAQ;AAAA,YAC9C,WAAW,KAAK;AAAA,YAChB,aAAa,KAAK;AAAA,YAClB,WAAW;AAAA,YACX,iBAAiB;AAAA,cACf,mBAAmB;AAAA,cACnB,iBAAiB,KAAK;AAAA,YACxB;AAAA,UACF,CAAC;AAAA,QACL;AACA,YAAI,CAAC,QAAQ;AACX,gBAAM,IAAI;AAAA,YACR;AAAA,YACA,2BAA2B,aAAa;AAAA,UAC1C;AAAA,QACF;AAAA,MACF,IACA;AACJ,UAAI;AACJ,UAAI;AACF,sCAA8BC,8BAA6B,UAAU;AAAA,UACnE,SAAS;AAAA,UACT,kBACE,mBAAmB,KAAK,YAAY,QAAQ,KAAK,YAAY,QAAQ;AAAA,UACvE,aAAa,kBACT,KAAK,YAAY,QACf,aACA,eACF;AAAA,UACJ,iBAAiB;AAAA,UACjB,iBAAiB,kBACb,KAAK,YAAY,kBACf,aACA,eACF;AAAA,UACJ,aAAa;AAAA,UACb,mBAAmB,kBAAkB,eAAe;AAAA,QACtD,CAAC;AAAA,MACH,SAAS,OAAO;AAId,YAAI,EAAE,iBAAiB,0CAA2C,OAAM;AACxE,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA,GAAG,MAAM,OAAO,KAAK,aAAa;AAAA,QACpC;AAAA,MACF;AACA,YAAM,sBAAsB;AAAA,QAC1B;AAAA,QACA;AAAA,QACA,eAAe;AAAA,MACjB;AACA,YAAM,iBAGD,CAAC;AACN,YAAM,kBAAkB,OAAO,YAAsB,sBAA+B;AAClF,cAAM,gBAAgB,OAAO,WAAW;AACxC,cAAM,0BAA0B,kBAC5B;AAAA,UACE,sBACE,8CACC,KAAK,YAAY,qBACd,2BAA2B,KAAK,EAAE,IAAI,KAAK,iBAAiB,IAAI,KAAK,eAAe,KACpF,kDAAkD,iBAAiB;AAAA,UACzE,8BACE,4BAA6B;AAAA,UAC/B,8BACE,4BAA6B;AAAA,UAC/B,qBAAqB,4BAA6B;AAAA,QACpD,IACA;AACJ,cAAM,oBAAuD;AAAA,UAC3D,SAAS;AAAA,UACT;AAAA,UACA,eAAe;AAAA,UACf,yBAAyB;AAAA,UACzB,qBAAqB;AAAA,UACrB;AAAA,UACA,wBAAwB;AAAA,UACxB,mBAAmB;AAAA,UACnB,eAAe;AAAA,UACf,4BAA4B;AAAA,UAC5B,kCAAkC;AAAA,UAClC,GAAI,sBACA;AAAA,YACE;AAAA,YACA,GAAI,8BAA8B,SAAY,EAAE,0BAA0B,IAAI,CAAC;AAAA,UACjF,IACA,CAAC;AAAA,UACL,qBAAqB,sBACjB,EAAE,IAAI,oBAAoB,IAAI,YAAY,oBAAoB,WAAW,IACzE;AAAA,UACJ,aAAa,aAAa,gBACtB;AAAA,YACE,IAAI,YAAY;AAAA,YAChB,WAAW,YAAY,cAAc;AAAA,YACrC,qBAAqB;AAAA,UACvB,IACA;AAAA,UACJ,4BACE,sBAAsB,oBAAoB,mBAAmB,yBACzD;AAAA,YACE,IAAI,mBAAmB;AAAA,YACvB,SAAS,mBAAmB;AAAA,YAC5B,wBAAwB,mBAAmB;AAAA,YAC3C,UAAU;AAAA,UACZ,IACA;AAAA,UACN;AAAA,UACA;AAAA,UACA,+BAA+B;AAAA,UAC/B,oBAAoB;AAAA,UACpB,oCAAoC;AAAA,UACpC;AAAA,UACA,sBAAsB;AAAA,UACtB,qCAAqC;AAAA,UACrC,wCAAwC;AAAA,UACxC;AAAA,UACA;AAAA,UACA,8BAA8B;AAAA,UAC9B,GAAI,iBAAiB,SAAS,IAAI,EAAE,iBAAiB,IAAI,CAAC;AAAA,UAC1D,yBAAyB;AAAA,UACzB,kBAAkB,MAAM,aAAa,EAAE,MAAM,WAAW,WAAW,YAAY;AAAA,UAC/E,6BAA6B,MAAM,+BAA+B;AAAA,UAClE;AAAA,UACA,uBAAuB,2BAA2B,UAAU;AAAA,QAC9D;AAKA,cAAM,yBACJ,kCAAkC,UAAU,iBAAiB;AAC/D,YACE,CAAC,uBAAuB,WACxB,oCAAoC;AAAA,UAClC,QAAQ,KAAK,YAAY;AAAA,UACzB,WAAW,KAAK,YAAY;AAAA,UAC5B,OAAO;AAAA,QACT,CAAC,IAAI,6CACL;AACA,iBAAO;AAAA,YACL,MAAM;AAAA,YACN,QAAQ;AAAA,cACN,QAAQ;AAAA,cACR,QAAQ;AAAA,YACV;AAAA,UACF;AAAA,QACF;AACA,YAAI,MAAM,MAAM,uBAAuB,YAAY;AAAA,UACjD,OAAO;AAAA,UACP,aAAa,KAAK;AAAA,UAClB,QAAQ,KAAK;AAAA,UACb,uBAAuB,KAAK;AAAA,UAC5B,qBAAqB,KAAK;AAAA,UAC1B,aAAa,MAAM;AAAA,UACnB,aAAa;AAAA,UACb,aAAa;AAAA,UACb,2BAA2B;AAAA,UAC3B,GAAI,4BAA4B,EAAE,0BAA0B,IAAI,CAAC;AAAA,QACnE,CAAC;AACD,cAAM,8BAA8B,YAAY,mBAAmB,GAAG;AACtE,YAAI,IAAI,WAAW,YAAY,IAAI,UAAU,iCAAiC;AAC5E,iBAAO;AAAA,YACL,MAAM;AAAA,YACN,QAAQ;AAAA,cACN,QAAQ;AAAA,cACR,QAAQ;AAAA,YACV;AAAA,YACA;AAAA,UACF;AAAA,QACF;AACA,YAAI,IAAI,WAAW,YAAY,IAAI,WAAW,WAAW;AACvD,iBAAO;AAAA,YACL,MAAM;AAAA,YACN,QAAQ,2BAA2B,IAAI,KAAK;AAAA,YAC5C;AAAA,UACF;AAAA,QACF;AACA,cAAM,+BAA+B,MAAM;AAAA,UACzC;AAAA,UACA;AAAA,YACE,WAAW,KAAK;AAAA,YAChB,aAAa,KAAK;AAAA,YAClB,OAAO,IAAI;AAAA,UACb;AAAA,QACF;AACA,YAAI,KAAK,WAAW,gBAAgB,IAAI,aAAa,IAAI,gBAAgB;AACvE,cAAI,mBAAmB;AACrB,mBAAO,EAAE,MAAM,UAAmB,KAAK,kBAAkB;AAAA,UAC3D;AACA,gBAAMC,kBAAiB,YAAY;AAAA,YACjC,WAAW,KAAK;AAAA,YAChB,aAAa,KAAK;AAAA,YAClB,WAAW;AAAA,YACX,UAAU;AAAA,YACV,MAAM;AAAA,YACN,oBAAoB;AAAA,YACpB,kBAAkB,IAAI;AAAA,YACtB,WAAW,IAAI;AAAA,YACf,WAAW,kBAAkB;AAAA,YAC7B,kBAAkB;AAAA,cAChB,iBAAiB,KAAK;AAAA,cACtB,oBAAoB,IAAI;AAAA,YAC1B;AAAA,YACA,QAAQ;AAAA,YACR,gBACE,kBAAkB,+BAClB,qCAAqC,IAAI,EAAE;AAAA,UAC/C,CAAC;AACD,gBAAM,aAAa,qBAAqB,IAAI,SAAS;AACrD,gBAAM,uBAAuB,MAAM,qCAAqC,YAAY;AAAA,YAClF,WAAW,KAAK;AAAA,YAChB,aAAa,KAAK;AAAA,YAClB,WAAW,IAAI;AAAA,YACf,oBAAoB;AAAA,YACpB,QAAQ;AAAA,UACV,CAAC;AACD,gBAAMC,UAAS;AAAA,YACb,QAAQ,KAAK,YAAY,wBAAwB,UAAU;AAAA,YAC3D,WAAW,KAAK;AAAA,YAChB,aAAa,KAAK;AAAA,YAClB,WAAW,IAAI;AAAA,YACf,gBAAgB,IAAI;AAAA,YACpB;AAAA,YACA;AAAA,UACF;AACA,iBAAO,EAAE,MAAM,YAAqB,QAAAA,SAAQ,IAAI;AAAA,QAClD;AACA,YAAIA;AACJ,YAAI;AACF,cAAI,2BAA2B;AAC7B,kBAAM,iBAAiB,MAAM;AAAA,cAC3B;AAAA,cACA;AAAA,gBACE,aAAa,KAAK;AAAA,gBAClB,QAAQ,KAAK;AAAA,cACf;AAAA,YACF;AACA,gBAAI,WAAW,cAAc,MAAM,WAAW,IAAI,GAAG;AACnD,oBAAM,IAAI;AAAA,gBACR;AAAA,cACF;AAAA,YACF;AAAA,UACF;AACA,gBAAM,WAAW,KAAK,YAAY,QAAQ;AAG1C,gBAAM,oBACJ,KAAK,YAAY,qBAAqB,KAAK,kBAAkB,KAAK;AACpE,cAAI,KAAK,YAAY,sBAAsB,CAAC,mBAAmB;AAC7D,kBAAM,IAAI,MAAM,8CAA8C;AAAA,UAChE;AACA,cACE,KAAK,YAAY,yBAChB,KAAK,YAAY,sBAAsB,CAAC,mBACzC;AAGA,kBAAM,cAAc;AACpB,gBAAI,KAAK,iBAAiB,CAAC,aAAa;AACtC,oBAAM,IAAI,MAAM,2BAA2B,KAAK,aAAa,EAAE;AAAA,YACjE;AAMA,gBAAI,cAA6B;AACjC,gBAAI,qBAAoC;AACxC,gBAAI,KAAK,OAAO;AACd,oBAAM,MAAM;AACZ,kBAAI,CAAC,OAAO,CAAC,IAAI,eAAe;AAC9B,sBAAM,IAAI,MAAM,sDAAsD,KAAK,KAAK,EAAE;AAAA,cACpF;AACA,4BAAc,IAAI;AAClB,mCACE,8BAA8B,UAAU;AAAA,gBACtC,CAAC,aAAa,SAAS,iBAAiB,SAAS,SAAS,eAAe,IAAI;AAAA,cAC/E,GAAG,qBAAqB,IAAI,cAAc;AAC5C,kBAAI,uBAAuB,IAAI,cAAc,IAAI;AAC/C,sBAAM,IAAI;AAAA,kBACR;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AACA,gBAAI;AACJ,gBAAI,iBAAiB;AACrB,kBAAM,eAAe,EAAE,GAAG,KAAK,YAAY,SAAS;AACpD,mBAAO,aAAa,uCAAuC;AAC3D,gBAAI;AACF,oBAAM,eAAoD;AAAA,gBACxD,WAAW,KAAK;AAAA,gBAChB,aAAa,KAAK;AAAA,gBAClB,gBAAgB,KAAK,YAAY;AAAA,gBACjC,WAAW,KAAK,YAAY;AAAA,gBAC5B,iBAAiB,KAAK,YAAY;AAAA,gBAClC,OAAO;AAAA,gBACP;AAAA,gBACA;AAAA,gBACA,GAAI,sBAAsB,EAAE,aAAa,oBAAoB,IAAI,CAAC;AAAA,gBAClE,GAAI,8BAA8B,SAC9B,EAAE,cAAc,0BAA0B,IAC1C,CAAC;AAAA,gBACL,GAAG;AAAA,gBACH,GAAI,KAAK,YAAY,iBAAiB,YAAY,SAAS,cAC3D,KAAK,eAAe,YAChB;AAAA,kBACE,YAAY;AAAA,kBACZ,sBAAsB,IAAI;AAAA,gBAC5B,IACA,CAAC;AAAA,gBACL,UAAU;AAAA,kBACR,GAAG;AAAA,kBACH,GAAG;AAAA,oBACD;AAAA,oBACA,eAAe;AAAA,kBACjB;AAAA,kBACA;AAAA,kBACA;AAAA,kBACA,iBAAiB,KAAK;AAAA,kBACtB,sBAAsB,KAAK;AAAA,kBAC3B,GAAI,WAAW,EAAE,mBAAmB,SAAS,IAAI,CAAC;AAAA,kBAClD,GAAI,MAAM,EAAE,oBAAoB,IAAI,GAAG,IAAI,CAAC;AAAA,kBAC5C,GAAI,qBACA;AAAA,oBACE,CAAC,uCAAuC,GAAG,mBAAmB;AAAA,kBAChE,IACA,CAAC;AAAA,gBACP;AAAA,gBACA,WAAW;AAAA,kBACT,MAAM;AAAA,kBACN,WAAW;AAAA,kBACX,OAAO;AAAA,gBACT;AAAA,gBACA,kBAAkB;AAAA,kBAChB,iBAAiB,KAAK;AAAA,kBACtB,GAAI,MAAM,EAAE,oBAAoB,IAAI,GAAG,IAAI,CAAC;AAAA,gBAC9C;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA,aAAa;AAAA,gBACb;AAAA,gBACA;AAAA,gBACA,eAAe,KAAK,iBAAiB;AAAA;AAAA;AAAA,gBAGrC,GAAI,KAAK,cAAc,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;AAAA,gBAC5D,OAAO;AAAA,gBACP,cAAc;AAAA,gBACd,+BAA+B,CAAC;AAAA,gBAChC,4CAA4C;AAAA,gBAC5C,+CACE;AAAA,gBACF,6BAA6B,KAAK,YAAY,uBAAuB;AAAA,gBACrE,8BAA8B;AAAA,kBAC5B,8BACE,wBAAyB;AAAA,kBAC3B,8BACE,wBAAyB;AAAA,gBAC7B;AAAA,gBACA,2BAA2B,wBAAyB;AAAA;AAAA;AAAA;AAAA,gBAIpD,+BAA+B;AAAA,gBAC/B,WAAW,kBAAkB,KAAK,EAAE;AAAA,gBACpC,oBAAoB,OAAO,IAAI,cAAc;AAC3C,sBAAI,2BAA2B;AAC7B,0BAAM,eAAe,MAAM,eAAe,IAAI,KAAK,aAAa,SAAS;AACzE,0BAAM,iBAAiB,MAAM,0CAA0C;AAAA,sBACrE,IAAI;AAAA,sBACJ;AAAA,sBACA,MAAM,kBAAkB;AAAA,sBACxB,SAAS;AAAA,sBACT,+BACE,kBAAkB;AAAA,sBACpB,oCACE,kBAAkB;AAAA,sBACpB,iBAAiB;AAAA,wBACf,OAAO,aAAa;AAAA,wBACpB,oBAAoB,aAAa;AAAA,wBACjC,0BAA0B,aAAa;AAAA,wBACvC,OAAO,aAAa;AAAA,wBACpB,cAAc,aAAa;AAAA,wBAC3B,YAAY,aAAa;AAAA,wBACzB,cAAc,aAAa,WAAW,IAAI,CAAC,WAAW,OAAO,EAAE;AAAA,wBAC/D,mBAAmB,aAAa;AAAA,sBAClC;AAAA,oBACF,CAAC;AACD,0BAAM,iBAAiB,mCAAmC;AAAA,sBACxD,aAAa,kBAAkB,KAAK;AAAA,sBACpC,mBAAmB,8BAA8B;AAAA,sBACjD,uBAAuB,2BAA2B,UAAU;AAAA,sBAC5D,WAAW;AAAA,oBACb,CAAC;AACD,wBAAI,eAAe,WAAW,WAAW;AACvC,4BAAM,IAAI,uCAAuC,eAAe,MAAM;AAAA,oBACxE;AAAA,kBACF;AACA,wBAAM,yCAAyC,IAAI;AAAA,oBACjD,WAAW,KAAK;AAAA,oBAChB,aAAa,KAAK;AAAA,oBAClB,OAAO,IAAI;AAAA,oBACX;AAAA,kBACF,CAAC;AAAA,gBACH;AAAA,cACF;AACA,oBAAM,UAAU,MAAM,sCAAsC,YAAY;AAAA,gBACtE,GAAG;AAAA,gBACH,sBAAsB,wBAAyB;AAAA,cACjD,CAAC;AACD,kBAAI,QAAQ,QAAQ;AAClB,sBAAM,IAAI,0BAA0B,QAAQ,MAAM;AAAA,cACpD;AACA,wBAAU,QAAQ;AAClB,+BAAiB,QAAQ;AACzB,kBAAI,eAAgB,+BAA8B,YAAY,aAAa;AAC3E,kBAAI,CAAC,gBAAgB;AACnB,sBAAM,yCAAyC,YAAY;AAAA,kBACzD,WAAW,KAAK;AAAA,kBAChB,aAAa,KAAK;AAAA,kBAClB,OAAO,IAAI;AAAA,kBACX,WAAW,QAAQ;AAAA,gBACrB,CAAC;AACD,sBAAM,EAAE,GAAG,KAAK,WAAW,QAAQ,GAAG;AAAA,cACxC;AAAA,YACF,SAAS,OAAO;AACd,kBAAI,iBAAiB,wCAAwC;AAC3D,sBAAM;AAAA,cACR;AACA,kBAAI,iBAAiB,2BAA2B;AAC9C,sBAAM,IAAI,MAAM,GAAG,MAAM,OAAO,IAAI,YAAY,MAAM,OAAO,EAAE,IAAI;AAAA,kBACjE,OAAO;AAAA,gBACT,CAAC;AAAA,cACH;AACA,oBAAM;AAAA,YACR;AACA,kBAAM,eAAe;AACrB,gBAAI,CAAC,gBAAgB;AACnB,6CAA+B,QAAQ,MAAM;AAC7C,mBAAK,QAAQ,iBAAiB,WAAW,KAAK,iBAAiB,OAAO;AACpE,sBAAM,IAAI;AAAA,kBACR;AAAA,gBACF;AAAA,cACF;AACA,kBACE,8BAA8B,QAAQ,QAAQ,OAC7C,KAAK,YAAY,wBAAwB,OAC1C;AACA,sBAAM,IAAI;AAAA,kBACR;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AACA,sBAAU,MAAM,mCAAmC;AAAA,cACjD,IAAI;AAAA,cACJ;AAAA,cACA;AAAA,cACA;AAAA,cACA,OAAO,IAAI;AAAA,cACX;AAAA,cACA;AAAA,cACA;AAAA,YACF,CAAC;AACD,gBAAI;AACJ,gBAAI,iBAAiB;AACnB,oBAAM,UAAU,MAAM,iCAAiC,YAAY;AAAA,gBACjE,WAAW,KAAK;AAAA,gBAChB,aAAa,KAAK;AAAA,gBAClB,WAAW,QAAQ;AAAA,gBACnB,yBAAyB;AAAA,gBACzB,8BAA8B;AAAA,gBAC9B,qBAAqB;AAAA,kBACnB,iBACE,OAAO,QAAQ,SAAS,oBAAoB,WACxC,QAAQ,SAAS,kBACjB,KAAK;AAAA,kBACX,oBACE,OAAO,QAAQ,SAAS,uBAAuB,WAC3C,QAAQ,SAAS,qBACjB,IAAI;AAAA;AAAA,kBAEV,GAAI,cACA;AAAA,oBACE,eAAe,YAAY;AAAA,oBAC3B,iBAAiB,YAAY;AAAA,kBAC/B,IACA,CAAC;AAAA,kBACL,GAAI,sBAAsB,mBACtB;AAAA,oBACE,oBAAoB;AAAA,sBAClB,gBAAgB;AAAA,sBAChB,iBAAiB;AAAA,sBACjB,cAAc,mBAAmB;AAAA,sBACjC,aAAa,iBAAiB;AAAA,oBAChC;AAAA,kBACF,IACA,CAAC;AAAA,gBACP;AAAA,gBACA,MAAM,WACF;AAAA,kBACE,MAAM,SAAS;AAAA,kBACf,iBAAiB,SAAS,mBAAmB;AAAA,kBAC7C,sBAAsB,SAAS,wBAAwB;AAAA,kBACvD,GAAI,SAAS,iBACT,EAAE,gBAAgB,SAAS,eAAe,IAC1C,CAAC;AAAA,kBACL,WAAW;AAAA,gBACb,IACA;AAAA,gBACJ,kBAAkB;AAAA,gBAClB,gBAAgB;AAAA,cAClB,CAAC;AACD,2BAAa,QAAQ;AACrB,kBAAI,QAAQ,OAAO,SAAS,GAAG;AAC7B,oBAAI,mBAAmB;AACrB,iCAAe,KAAK;AAAA,oBAClB,WAAW,QAAQ;AAAA,oBACnB,QAAQ,QAAQ;AAAA,kBAClB,CAAC;AAAA,gBACH,OAAO;AACL,wBAAM;AAAA,oBACJ;AAAA,oBACA,KAAK;AAAA,oBACL,QAAQ;AAAA,oBACR,QAAQ;AAAA,kBACV;AAAA,gBACF;AAAA,cACF;AAAA,YACF,OAAO;AACL,oBAAM,UAAU,MAAM,iCAAiC,YAAY;AAAA,gBACjE,WAAW,KAAK;AAAA,gBAChB,aAAa,KAAK;AAAA,gBAClB,WAAW,QAAQ;AAAA,gBACnB,yBAAyB;AAAA,gBACzB,8BAA8B;AAAA,gBAC9B,qBAAqB;AAAA,kBACnB,iBACE,OAAO,QAAQ,SAAS,oBAAoB,WACxC,QAAQ,SAAS,kBACjB,KAAK;AAAA,kBACX,oBACE,OAAO,QAAQ,SAAS,uBAAuB,WAC3C,QAAQ,SAAS,qBACjB,IAAI;AAAA;AAAA,kBAEV,GAAI,cACA,EAAE,eAAe,YAAY,IAAI,iBAAiB,YAAY,KAAK,IACnE,CAAC;AAAA,kBACL,GAAI,sBAAsB,mBACtB;AAAA,oBACE,oBAAoB;AAAA,sBAClB,gBAAgB;AAAA,sBAChB,iBAAiB;AAAA,sBACjB,cAAc,mBAAmB;AAAA,sBACjC,aAAa,iBAAiB;AAAA,oBAChC;AAAA,kBACF,IACA,CAAC;AAAA,gBACP;AAAA,gBACA,MAAM,WACF;AAAA,kBACE,MAAM,SAAS;AAAA,kBACf,iBAAiB,SAAS,mBAAmB;AAAA,kBAC7C,sBAAsB,SAAS,wBAAwB;AAAA,kBACvD,GAAI,SAAS,iBACT,EAAE,gBAAgB,SAAS,eAAe,IAC1C,CAAC;AAAA,kBACL,WAAW;AAAA,gBACb,IACA;AAAA,gBACJ,kBAAkB;AAAA,gBAClB,gBAAgB;AAAA,cAClB,CAAC;AACD,2BAAa,QAAQ;AACrB,kBAAI,QAAQ,OAAO,SAAS,GAAG;AAC7B,oBAAI,mBAAmB;AACrB,iCAAe,KAAK,EAAE,WAAW,QAAQ,IAAI,QAAQ,QAAQ,OAAO,CAAC;AAAA,gBACvE,OAAO;AACL,wBAAM;AAAA,oBACJ;AAAA,oBACA,KAAK;AAAA,oBACL,QAAQ;AAAA,oBACR,QAAQ;AAAA,kBACV;AAAA,gBACF;AAAA,cACF;AACA,kBAAI,KAAK,YAAY,oBAAoB;AACvC,sBAAM,+CAA+C,YAAY;AAAA,kBAC/D,WAAW,KAAK;AAAA,kBAChB,aAAa,KAAK;AAAA,kBAClB,QAAQ,KAAK;AAAA,kBACb,OAAO,IAAI;AAAA,kBACX,WAAW,QAAQ;AAAA,kBACnB,6BACE,8BAA8B,yBAC9B,IAAI;AAAA,kBACN,uBACE,8BAA8B,mBAAmB,IAAI;AAAA,gBACzD,CAAC;AAAA,cACH;AAAA,YACF;AAKA,kBAAM,cAAc,MAAM,2BAA2B,YAAY;AAAA,cAC/D,aAAa,KAAK;AAAA,cAClB,WAAW,QAAQ;AAAA,cACnB,UAAU,KAAK;AAAA,YACjB,CAAC;AACD,gBAAI,YAAY,SAAS,GAAG;AAC1B,kBAAI,mBAAmB;AACrB,+BAAe,KAAK,EAAE,WAAW,QAAQ,IAAI,QAAQ,YAAY,CAAC;AAAA,cACpE,OAAO;AACL,sBAAM,4BAA4B,KAAK,KAAK,aAAa,QAAQ,IAAI,WAAW;AAAA,cAClF;AAAA,YACF;AACA,kBAAM,kBAAkB,MAAM;AAAA,cAC5B;AAAA,cACA;AAAA,gBACE,WAAW,KAAK;AAAA,gBAChB,aAAa,KAAK;AAAA,gBAClB,WAAW,QAAQ;AAAA,gBACnB,MAAM;AAAA,gBACN,gBAAgB;AAAA,gBAChB,UAAU,IAAI;AAAA,gBACd,WAAW,sBAAsB,IAAI,EAAE;AAAA,gBACvC,SAAS,KAAK,YAAY;AAAA,gBAC1B,SAAS;AAAA,kBACP,KAAK,YAAY;AAAA,kBACjB,KAAK,YAAY;AAAA,kBACjB;AAAA,kBACA,KAAK;AAAA,kBACL,IAAI;AAAA,kBACJ;AAAA,gBACF;AAAA,gBACA,SAAS;AAAA,kBACP,iBAAiB,KAAK;AAAA,kBACtB,oBAAoB,IAAI;AAAA,kBACxB,GAAI,uBAAuB,EAAE,qBAAqB,IAAI,CAAC;AAAA,kBACvD,GAAI,mCACA,EAAE,8BAA8B,iCAAiC,IACjE,CAAC;AAAA,kBACL,GAAI,wCAAwC,UAAU,UACtD,KAAK,UAAU,SAAS,YACpB,EAAE,uBAAuB,KAAK,UAAU,UAAU,IAClD,CAAC;AAAA,kBACL,GAAI,2BAA2B,EAAE,yBAAyB,IAAI,CAAC;AAAA,gBACjE;AAAA,gBACA,+BAA+B;AAAA,gBAC/B,oBAAoB;AAAA,gBACpB,qCAAqC;AAAA,gBACrC,wCAAwC;AAAA,gBACxC,uBAAuB;AAAA,gBACvB,oBAAoB,IAAI;AAAA,cAC1B;AAAA,cACA,OAAO,IAAI,aAAa,WAAW,oBAAoB;AACrD,oBAAI,CAAC,aAAa;AAChB,wBAAM,QAAQ,+BAA+B,eAAe;AAC5D,wBAAM,oCAAoC,IAAI;AAAA,oBAC5C,aAAa,KAAK;AAAA,oBAClB,OAAO,aAAa;AAAA,oBACpB,WAAW,QAAQ;AAAA,oBACnB,gBAAgB;AAAA,oBAChB,QAAQ;AAAA,oBACR;AAAA,kBACF,CAAC;AACD;AAAA,gBACF;AACA,sBAAM,oCAAoC,IAAI;AAAA,kBAC5C,aAAa,KAAK;AAAA,kBAClB,OAAO,aAAa;AAAA,kBACpB,WAAW,QAAQ;AAAA,kBACnB,gBAAgB;AAAA,kBAChB,QAAQ;AAAA,gBACV,CAAC;AAAA,cACH;AAAA,cACA;AAAA,gBACE,oBAAoB,KAAK,kBAAkB,UAAU,CAAC;AAAA,gBACtD,GAAI,4BACA;AAAA,kBACE,eAAe,OAAO,IAAI,cACxB,MAAM,+BAA+B;AAAA,oBACnC;AAAA,oBACA;AAAA,oBACA,QAAQ,KAAK;AAAA,oBACb,aAAa,KAAK;AAAA,oBAClB;AAAA,oBACA,uBAAuB,2BAA2B,UAAU;AAAA,oBAC5D;AAAA,kBACF,CAAC;AAAA,gBACL,IACA,CAAC;AAAA,cACP;AAAA,YACF;AACA,gBACE,gBAAgB,WAAW,uBAC3B,gBAAgB,WAAW,sBAC3B,gBAAgB,WAAW,kBAC3B;AACA,oBAAM,QAAQ,+BAA+B,gBAAgB,MAAM;AACnE,qBAAO;AAAA,gBACL,MAAM;AAAA,gBACN,QAAQ,EAAE,QAAQ,WAAoB,QAAQ,yBAAkC;AAAA,gBAChF,KAAK,EAAE,GAAG,KAAK,QAAQ,WAAoB,MAAM;AAAA,cACnD;AAAA,YACF;AACA,gBAAI,gBAAgB,OAAO;AACzB,wCAA0B,YAAY,eAAe,EAAE,SAAS,YAAY,CAAC;AAAA,YAC/E;AACA,gBAAI,gBAAgB,SAAS,gBAAgB,OAAO,SAAS,GAAG;AAC9D,kBAAI,mBAAmB;AACrB,+BAAe,KAAK;AAAA,kBAClB,WAAW,QAAQ;AAAA,kBACnB,QAAQ,gBAAgB;AAAA,gBAC1B,CAAC;AAAA,cACH,OAAO;AACL,sBAAM;AAAA,kBACJ;AAAA,kBACA,KAAK;AAAA,kBACL,QAAQ;AAAA,kBACR,gBAAgB;AAAA,gBAClB;AAAA,cACF;AAAA,YACF;AACA,YAAAA,UAAS;AAAA,cACP,QAAQ,iBAAiB,UAAU;AAAA,cACnC,WAAW,KAAK;AAAA,cAChB,aAAa,KAAK;AAAA,cAClB,WAAW,QAAQ;AAAA,cACnB,gBAAgB,gBAAgB;AAAA,cAChC;AAAA,cACA,sBAAsB,gBAAgB;AAAA,YACxC;AAAA,UACF,OAAO;AACL,gBAAI,CAAC,IAAK,OAAM,IAAI,MAAM,oCAAoC;AAC9D,kBAAM,eAAe;AACrB,kBAAM,UAAU,MAAM,eAAe,YAAY,KAAK,aAAa,iBAAkB;AACrF,kBAAM,yCAAyC,YAAY;AAAA,cACzD,WAAW,KAAK;AAAA,cAChB,aAAa,KAAK;AAAA,cAClB,OAAO,IAAI;AAAA,cACX,WAAW,QAAQ;AAAA,YACrB,CAAC;AAKD,2CAA+B,QAAQ,MAAM;AAG7C,gDAAoC,SAAS,IAAI;AACjD,kBAAM,UAAU,MAAM;AAAA,cACpB;AAAA,cACA;AAAA,gBACE,WAAW,KAAK;AAAA,gBAChB,aAAa,KAAK;AAAA,gBAClB,WAAW,QAAQ;AAAA,gBACnB,MAAM;AAAA,gBACN,gBAAgB;AAAA,gBAChB,UAAU,IAAI;AAAA,gBACd,WAAW,sBAAsB,IAAI,EAAE;AAAA,gBACvC,SAAS,KAAK,YAAY;AAAA,gBAC1B,SAAS;AAAA,kBACP,KAAK,YAAY;AAAA,kBACjB,KAAK,YAAY;AAAA,kBACjB;AAAA,kBACA,KAAK;AAAA,kBACL,IAAI;AAAA,kBACJ;AAAA,gBACF;AAAA,gBACA,SAAS;AAAA,kBACP,iBAAiB,KAAK;AAAA,kBACtB,oBAAoB,IAAI;AAAA,kBACxB,GAAI,uBAAuB,EAAE,qBAAqB,IAAI,CAAC;AAAA,kBACvD,GAAI,mCACA,EAAE,8BAA8B,iCAAiC,IACjE,CAAC;AAAA,kBACL,GAAI,wCAAwC,UAAU,UACtD,KAAK,UAAU,SAAS,YACpB,EAAE,uBAAuB,KAAK,UAAU,UAAU,IAClD,CAAC;AAAA,kBACL,GAAI,2BAA2B,EAAE,yBAAyB,IAAI,CAAC;AAAA,gBACjE;AAAA,gBACA,+BAA+B;AAAA,gBAC/B,oBAAoB;AAAA,gBACpB,qCAAqC;AAAA,gBACrC,wCAAwC;AAAA,gBACxC,uBAAuB;AAAA,gBACvB,oBAAoB,IAAI;AAAA,cAC1B;AAAA,cACA,OAAO,IAAI,aAAa,WAAW,oBAAoB;AACrD,oBAAI,CAAC,aAAa;AAChB,wBAAM,QAAQ,+BAA+B,eAAe;AAC5D,wBAAM,oCAAoC,IAAI;AAAA,oBAC5C,aAAa,KAAK;AAAA,oBAClB,OAAO,aAAa;AAAA,oBACpB,WAAW,QAAQ;AAAA,oBACnB,gBAAgB;AAAA,oBAChB,QAAQ;AAAA,oBACR;AAAA,kBACF,CAAC;AACD;AAAA,gBACF;AACA,sBAAM,oCAAoC,IAAI;AAAA,kBAC5C,aAAa,KAAK;AAAA,kBAClB,OAAO,aAAa;AAAA,kBACpB,WAAW,QAAQ;AAAA,kBACnB,gBAAgB;AAAA,kBAChB,QAAQ;AAAA,gBACV,CAAC;AAAA,cACH;AAAA,cACA;AAAA,gBACE,oBAAoB,KAAK,kBAAkB;AAAA,gBAC3C,eAAe,OAAO,IAAI,cAAc;AACtC,wBAAM,aACJ,KAAK,YAAY,sBAAsB,YAAY,IAAI,WAAW,WAC9D,MAAM,iCAAiC,IAAI;AAAA,oBACzC,WAAW,KAAK;AAAA,oBAChB,aAAa,KAAK;AAAA,oBAClB;AAAA,oBACA,OAAO,IAAI;AAAA,oBACX,MAAM,SAAS;AAAA,oBACf,iBAAiB,SAAS,mBAAmB;AAAA,oBAC7C,sBAAsB,SAAS,wBAAwB;AAAA,oBACvD,GAAI,SAAS,iBACT,EAAE,gBAAgB,SAAS,eAAe,IAC1C,CAAC;AAAA,kBACP,CAAC,IACD,CAAC;AACP,wBAAM,iBAAiB,4BACnB,MAAM,+BAA+B;AAAA,oBACnC;AAAA,oBACA;AAAA,oBACA,QAAQ,KAAK;AAAA,oBACb,aAAa,KAAK;AAAA,oBAClB;AAAA,oBACA,uBAAuB,2BAA2B,UAAU;AAAA,oBAC5D;AAAA,kBACF,CAAC,IACD;AACJ,yBAAO;AAAA,oBACL,GAAI,kBAAkB,CAAC;AAAA,oBACvB,GAAI,WAAW,SAAS,IAAI,EAAE,QAAQ,WAAW,IAAI,CAAC;AAAA,kBACxD;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AACA,gBACE,QAAQ,WAAW,uBACnB,QAAQ,WAAW,sBACnB,QAAQ,WAAW,kBACnB;AACA,oBAAM,QAAQ,+BAA+B,QAAQ,MAAM;AAC3D,qBAAO;AAAA,gBACL,MAAM;AAAA,gBACN,QAAQ,EAAE,QAAQ,WAAoB,QAAQ,yBAAkC;AAAA,gBAChF,KAAK,EAAE,GAAG,KAAK,QAAQ,WAAoB,MAAM;AAAA,cACnD;AAAA,YACF;AACA,gBAAI,QAAQ,OAAO;AACjB,wCAA0B,YAAY,eAAe,EAAE,SAAS,YAAY,CAAC;AAAA,YAC/E;AACA,gBAAI,QAAQ,SAAS,QAAQ,OAAO,SAAS,GAAG;AAC9C,kBAAI,mBAAmB;AACrB,+BAAe,KAAK;AAAA,kBAClB,WAAW,QAAQ;AAAA,kBACnB,QAAQ,QAAQ;AAAA,gBAClB,CAAC;AAAA,cACH,OAAO;AACL,sBAAM;AAAA,kBACJ;AAAA,kBACA,KAAK;AAAA,kBACL,QAAQ;AAAA,kBACR,QAAQ;AAAA,gBACV;AAAA,cACF;AAAA,YACF;AACA,YAAAA,UAAS;AAAA,cACP,QAAQ;AAAA,cACR,WAAW,KAAK;AAAA,cAChB,aAAa,KAAK;AAAA,cAClB,WAAW,QAAQ;AAAA,cACnB,gBAAgB,QAAQ;AAAA,cACxB,YAAY,qBAAqB,QAAQ,EAAE;AAAA,cAC3C,sBAAsB,QAAQ;AAAA,YAChC;AAAA,UACF;AAAA,QACF,SAAS,OAAO;AACd,gBAAM,gBAAgB,kCAAkC,KAAK;AAC7D,cAAI,CAAC,cAAe,OAAM;AAC1B,gBAAM;AAAA,YACJ;AAAA,YACA,KAAK;AAAA,YACL,IAAI;AAAA,YACJ,cAAc;AAAA,UAChB;AACA,iBAAO;AAAA,YACL,MAAM;AAAA,YACN,QAAQ,2BAA2B,cAAc,IAAI;AAAA,YACrD,KAAK,EAAE,GAAG,KAAK,QAAQ,UAAmB,OAAO,cAAc,KAAK;AAAA,UACtE;AAAA,QACF;AACA,cAAMD,kBAAiB,YAAY;AAAA,UACjC,WAAW,KAAK;AAAA,UAChB,aAAa,KAAK;AAAA,UAClB,WAAW;AAAA,UACX,UAAU;AAAA,UACV,MAAM;AAAA,UACN,oBAAoB;AAAA,UACpB,kBAAkB,IAAI;AAAA,UACtB,WAAWC,QAAO;AAAA,UAClB,WAAW,MAAM,aAAa;AAAA,YAC5B,MAAM;AAAA,YACN,WAAW;AAAA,UACb;AAAA,UACA,kBAAkB;AAAA,YAChB,iBAAiB,KAAK;AAAA,YACtB,oBAAoB,IAAI;AAAA,UAC1B;AAAA,UACA,QAAQ;AAAA,UACR,gBACE,MAAM,+BAA+B,qCAAqC,IAAI,EAAE;AAAA,QACpF,CAAC;AACD,eAAO,EAAE,MAAM,YAAqB,QAAAA,SAAQ,IAAI;AAAA,MAClD;AAEA,UAAI;AACJ,UAAI;AACF,0BAAkB,4BACd,MAAM;AAAA,UACJ;AAAA,UACA,EAAE,WAAW,KAAK,WAAW,aAAa,KAAK,YAAY;AAAA,UAC3D,OAAO,OAAO,MAAM,gBAAgB,IAAI,IAAI;AAAA,QAC9C,IACA,MAAM,gBAAgB,IAAI,KAAK;AAAA,MACrC,SAAS,OAAO;AACd,YAAI,iBAAiB,wCAAwC;AAC3D,iBAAO,EAAE,QAAQ,WAAW,QAAQ,MAAM,OAAO;AAAA,QACnD;AACA,cAAM,gBAAgB,kCAAkC,KAAK;AAC7D,YAAI,eAAe,SAAS,+BAA+B;AAGzD,iBAAO,MAAM,gBAAgB,+BAA+B,OAAO,cAAc,OAAO;AAAA,QAC1F;AACA,cAAM;AAAA,MACR;AACA,UAAI,gBAAgB,SAAS,UAAU;AACrC,eAAO,MAAM,4BAA4B;AAAA,UACvC;AAAA,UACA;AAAA,UACA;AAAA,UACA,KAAK,gBAAgB;AAAA,UACrB,mBAAmB,gBAAgB;AAAA,QACrC,CAAC;AAAA,MACH;AACA,iBAAW,YAAY,gBAAgB;AACrC,cAAM;AAAA,UACJ;AAAA,UACA,KAAK;AAAA,UACL,SAAS;AAAA,UACT,SAAS;AAAA,QACX;AAAA,MACF;AACA,UAAI,gBAAgB,SAAS,UAAW,QAAO,gBAAgB;AAC/D,YAAM,SAAS,gBAAgB;AAC/B,UAAI,uBAAuB,OAAO,yBAAyB,MAAM;AAC/D,cAAM,oBAAoB;AAAA,UACxB,WAAW,OAAO;AAAA,UAClB,aAAa,OAAO;AAAA,UACpB,WAAW,OAAO;AAAA,UAClB,YAAY,OAAO;AAAA,UACnB,cAAc,OAAO;AAAA,QACvB,CAAC;AAAA,MACH;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,IAAM,yCAAN,cAAqD,MAAM;AAAA,EACzD,YAAqB,QAA+C;AAClE,UAAM,MAAM;AADO;AAEnB,SAAK,OAAO;AAAA,EACd;AACF;AAOA,SAAS,oCACP,SACA,MACM;AAGN,MAAI,KAAK,YAAY,mBAAoB;AACzC,MACE,8BAA8B,QAAQ,QAAQ,OAC7C,KAAK,YAAY,wBAAwB,OAC1C;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAM,qCAAN,cAAiD,MAAM;AAAA,EACrD,YACW,MACT,SACA;AACA,UAAM,OAAO;AAHJ;AAIT,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,kCACP,OAC2C;AAC3C,MACE,iBAAiB,SACjB,WAAW,SACX,MAAM,UAAU,UAChB,MAAM,UAAU,OAChB;AACA,UAAM,SAAS,kCAAkC,MAAM,KAAK;AAC5D,QAAI,OAAQ,QAAO;AAAA,EACrB;AACA,MAAI,iBAAiB,mCAAoC,QAAO;AAChE,MAAI,iBAAiB,wCAAwC;AAC3D,WAAO,IAAI;AAAA,MACT,sBAAsB,MAAM,MAAM;AAAA,MAClC,MAAM;AAAA,IACR;AAAA,EACF;AACA,MAAI,iBAAiB,2BAA2B;AAC9C,WAAO,IAAI,mCAAmC,kCAAkC,MAAM,OAAO;AAAA,EAC/F;AACA,MAAI,iBAAiB,SAAS,MAAM,QAAQ,WAAW,oBAAoB,GAAG;AAC5E,WAAO,IAAI;AAAA,MACT;AAAA,MACA,MAAM;AAAA,IACR;AAAA,EACF;AACA,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,YAAY,SAAS,MAAM,WAAW,KAAK;AAC5F,WAAO,IAAI;AAAA,MACT;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAC3C;AAAA,EACF;AACA,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,SAAS,MAAM,SAAS,SAAS;AAC5F,WAAO,IAAI;AAAA,MACT;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAC3C;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,KAAgE;AACvF,SAAO,KAAK,UAAU,CAAC,IAAI,UAAU,IAAI,YAAY,CAAC;AACxD;AAMA,SAAS,mBACP,MACA,SACgC;AAChC,QAAM,UAAU,IAAI,IAAI,KAAK,IAAI,eAAe,CAAC;AACjD,QAAM,QAAQ,QAAQ,WAAW,SAAS;AAAA,IAAQ,CAAC,YACjD,QAAQ,IAAI,gBAAgB,OAAO,CAAC,IAChC,CAAC,EAAE,UAAU,QAAQ,UAAU,cAAc,QAAQ,cAAc,QAAQ,QAAQ,OAAO,CAAC,IAC3F,CAAC;AAAA,EACP;AACA,MAAI,MAAM,SAAS,EAAG,QAAO;AAC7B,MAAI,QAAQ,WAAW,WAAW,4BAA4B;AAC5D,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,UAAU,IAAI;AAAA,MACd,cAAc,IAAI;AAAA,MAClB,QAAQ;AAAA,IACV,EAAE;AAAA,EACJ;AACA,SAAO,CAAC;AACV;AAGA,SAAS,gCACP,KACgE;AAChE,MAAI,IAAI,kBAAkB;AACxB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ,IAAI,iBAAiB;AAAA,MAC7B,OAAO,IAAI;AAAA,MACX,SAAS,IAAI;AAAA,IACf;AAAA,EACF;AACA,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,OAAO,IAAI;AAAA,IACX,GAAI,IAAI,sBAAsB,EAAE,YAAY,IAAI,oBAAoB,IAAI,CAAC;AAAA,EAC3E;AACF;AAEA,SAAS,2BACP,OACgE;AAChE,MAAI,UAAU;AACZ,WAAO,EAAE,QAAQ,WAAW,QAAQ,gCAAgC;AACtE,MAAI,UAAU,iCAAiC;AAC7C,WAAO,EAAE,QAAQ,WAAW,QAAQ,gCAAgC;AAAA,EACtE;AACA,MAAI,UAAU,0DAA0D;AACtE,WAAO,EAAE,QAAQ,WAAW,QAAQ,sCAAsC;AAAA,EAC5E;AACA,MAAI,UAAU,uDAAuD;AACnE,WAAO,EAAE,QAAQ,WAAW,QAAQ,mCAAmC;AAAA,EACzE;AACA,MAAI,UAAU,sDAAsD;AAClE,WAAO,EAAE,QAAQ,WAAW,QAAQ,kCAAkC;AAAA,EACxE;AACA,SAAO,EAAE,QAAQ,WAAW,QAAQ,yBAAyB;AAC/D;AAEA,SAAS,+BACP,iBACiF;AACjF,MAAI,oBAAoB,iBAAkB,QAAO;AACjD,SAAO,oBAAoB,qBACvB,+BACA;AACN;AAEA,eAAe,+BAA+B,OAQ3C;AACD,QAAM,UAAU,MAAM,eAAe,MAAM,IAAI,MAAM,aAAa,MAAM,SAAS;AACjF,QAAM,EAAE,MAAM,8BAA8B,IAAI,MAAM;AACtD,QAAM,YAAY,MAAM,0CAA0C;AAAA,IAChE,IAAI,MAAM;AAAA,IACV,UAAU,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA,oCACE,MAAM,kBAAkB,sCAAsC;AAAA,IAChE,iBAAiB,MAAM,kBAAkB,yBACrC;AAAA,MACE,OAAO,MAAM,kBAAkB,uBAAuB;AAAA,MACtD,oBACE,MAAM,kBAAkB,uBAAuB,+BAC/C,MAAM,kBAAkB,uBAAuB;AAAA,MACjD,0BACE,MAAM,kBAAkB,uBAAuB;AAAA,MACjD,OAAO,MAAM,kBAAkB,uBAAuB;AAAA,MACtD,cAAc,MAAM,kBAAkB,uBAAuB;AAAA,MAC7D,YAAY,MAAM,kBAAkB,uBAAuB;AAAA,MAC3D,cAAc,MAAM,kBAAkB,uBAAuB;AAAA,MAC7D,mBAAmB,MAAM,kBAAkB,uBAAuB;AAAA,IACpE,IACA;AAAA,MACE,OAAO,MAAM,kBAAkB;AAAA,MAC/B,oBAAoB,MAAM,kBAAkB;AAAA,MAC5C,0BAA0B,MAAM,kBAAkB;AAAA,MAClD,OAAO,MAAM,kBAAkB,aAAa,MAAM;AAAA,MAClD,cAAc,MAAM,kBAAkB,aAAa,aAAa;AAAA,MAChE,YAAY,QAAQ;AAAA,MACpB,cAAc,CAAC;AAAA,MACf,mBAAmB,QAAQ;AAAA,IAC7B;AAAA,EACN,CAAC;AACD,QAAM,YAAY,mCAAmC;AAAA,IACnD,aAAa,KAAK;AAAA,IAClB,mBAAmB,MAAM,0BAA0B;AAAA,IACnD,uBAAuB,MAAM;AAAA,IAC7B;AAAA,EACF,CAAC;AACD,MAAI,UAAU,WAAW,WAAW;AAClC,UAAM,IAAI,uCAAuC,UAAU,MAAM;AAAA,EACnE;AACA,QAAM,QAAQ,gCAAgC;AAAA,IAC5C;AAAA,IACA;AAAA,IACA,uBAAuB,MAAM;AAAA,EAC/B,CAAC;AACD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,uCAAuC,qCAAqC;AAAA,EACxF;AACA,SAAO;AAAA,IACL,SAAS;AAAA,MACP,CAAC,8CAA8C,GAAG;AAAA,IACpD;AAAA,EACF;AACF;AAEA,eAAe,8BACb,IACA,mBACA,KACe;AACf,QAAM,OAAO,kBAAkB;AAC/B,QAAMD,kBAAiB,IAAI;AAAA,IACzB,WAAW,KAAK;AAAA,IAChB,aAAa,KAAK;AAAA,IAClB,WAAW;AAAA,IACX,UAAU;AAAA,IACV,MAAM;AAAA,IACN,oBAAoB;AAAA,IACpB,kBAAkB,IAAI;AAAA,IACtB,WAAW,kBAAkB;AAAA,IAC7B,kBAAkB,EAAE,iBAAiB,KAAK,IAAI,oBAAoB,IAAI,GAAG;AAAA,IACzE,QAAQ;AAAA,IACR,gBAAgB,8BAA8B,IAAI,EAAE;AAAA,EACtD,CAAC;AACH;AAEA,SAAS,6BAA6B,MAAqB,WAAmC;AAC5F,SACE,KAAK,eAAe,aACpB,KAAK,mBAAmB,QACxB,KAAK,mBAAmB;AAE5B;AAOA,eAAe,8BACb,IACA,MACA,QAC4D;AAC5D,QAAM,YAAY,KAAK;AACvB,MAAI,KAAK,eAAe,aAAa,CAAC,UAAW,QAAO;AACxD,QAAM,SAAS,EAAE,WAAW,KAAK,WAAW,aAAa,KAAK,aAAa,UAAU;AACrF,QAAM,UAAU,MAAM,WAAW,IAAI,QAAQ,OAAO,eAAe;AACnE,MAAI,SAAS,UAAU,OAAQ,QAAO;AACtC,MAAI,CAAC,QAAQ,cAAc;AACzB,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,MAAI;AACJ,WAAS,OAAO,GAAG,OAAO,IAAI,QAAQ,GAAG;AACvC,UAAM,SAAS,MAAM,gCAAgC,IAAI;AAAA,MACvD,GAAG;AAAA,MACH,cAAc;AAAA,MACd,OAAO;AAAA,MACP,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC7B,CAAC;AACD,UAAM,YAAY,OAAO,YAAY;AAAA,MACnC,CAAC,cAAc,UAAU,eAAe,QAAQ,gBAAgB,UAAU,WAAW;AAAA,IACvF;AACA,QAAI,UAAW,QAAO,EAAE,WAAW,aAAa,UAAU,YAAY;AACtE,QAAI,CAAC,OAAO,WAAY;AACxB,aAAS,OAAO;AAAA,EAClB;AACA,QAAM,IAAI,MAAM,8DAA8D;AAChF;AAEA,eAAe,mCAAmC,OAYK;AACrD,QAAM,SAAS,MAAM,KAAK,YAAY;AACtC,MAAI,CAAC,OAAQ,QAAO,MAAM;AAC1B,QAAM,gBAAgB,MAAM,8BAA8B,MAAM,IAAI,MAAM,MAAM,MAAM;AACtF,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,MACE,IAAI,MAAM;AAAA,MACV,UAAU,MAAM;AAAA,MAChB,KAAK,MAAM;AAAA,IACb;AAAA,IACA;AAAA,MACE,WAAW,MAAM,KAAK;AAAA,MACtB,aAAa,MAAM,KAAK;AAAA,MACxB,WAAW,MAAM,QAAQ;AAAA,MACzB,gBAAgB,MAAM,QAAQ;AAAA,MAC9B,gBAAgB,MAAM,QAAQ;AAAA;AAAA,MAE9B,GAAI,gBAAgB,EAAE,WAAW,cAAc,UAAU,IAAI,CAAC;AAAA,IAChE;AAAA,IACA,OAAO;AAAA,IACP,OAAO,cAAc;AAAA,EACvB;AACA,MAAI,OAAO,SAAS;AAClB,QAAI,eAAe;AAGjB,YAAM,iBAAiB,MAAM,yBAAyB,MAAM,IAAI;AAAA,QAC9D,WAAW,MAAM,KAAK;AAAA,QACtB,aAAa,MAAM,KAAK;AAAA,QACxB,WAAW,MAAM,QAAQ;AAAA,MAC3B,CAAC;AACD,UAAI,mBAAmB,KAAM,OAAM,IAAI,MAAM,2CAA2C;AACxF,YAAM,2BAA2B,MAAM,IAAI;AAAA,QACzC,WAAW,MAAM,KAAK;AAAA,QACtB,aAAa,MAAM,KAAK;AAAA,QACxB,WAAW,cAAc;AAAA,QACzB,aAAa,cAAc;AAAA,QAC3B,cAAc;AAAA,QACd,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW,MAAM,QAAQ;AAAA,QACzB,wBAAwB;AAAA,QACxB,6BAA6B;AAAA,MAC/B,CAAC;AAAA,IACH;AACA,WAAO,MAAM,eAAe,MAAM,IAAI,MAAM,KAAK,aAAa,MAAM,QAAQ,EAAE;AAAA,EAChF;AAEA,QAAM,SAAS,MAAM,mCAAmC,MAAM,IAAI;AAAA,IAChE,WAAW,MAAM,KAAK;AAAA,IACtB,aAAa,MAAM,KAAK;AAAA,IACxB,QAAQ,MAAM,KAAK;AAAA,IACnB,OAAO,MAAM;AAAA,IACb,WAAW,MAAM,QAAQ;AAAA,IACzB,OAAO;AAAA,EACT,CAAC;AACD,MAAI,OAAO,WAAW,YAAY;AAChC,UAAM,IAAI;AAAA,MACR,6BAA6B,OAAO,MAAM;AAAA,IAC5C;AAAA,EACF;AACA,MAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,QAAI,MAAM,mBAAmB;AAC3B,YAAM,eAAe,KAAK,EAAE,WAAW,MAAM,QAAQ,IAAI,QAAQ,OAAO,OAAO,CAAC;AAAA,IAClF,OAAO;AACL,YAAM;AAAA,QACJ,MAAM;AAAA,QACN,MAAM,KAAK;AAAA,QACX,MAAM,QAAQ;AAAA,QACd,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACA,QAAM,QACJ,OAAO,WAAW,aAAc,OAAO,SAAS,2BAA4B,OAAO;AACrF,QAAM,IAAI;AAAA,IACR;AAAA,IACA,OAAO,UAAU;AAAA,EACnB;AACF;AAEA,eAAe,kCAAkC,OASL;AAC1C,QAAM,EAAE,KAAK,IAAI,MAAM;AACvB,MAAI,MAAM,IAAI,WAAW,UAAU;AACjC,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,QAAM,mBACJ,KAAK,YAAY,yBAChB,KAAK,YAAY,sBAAsB,KAAK,sBAAsB;AAGrE,QAAM,yBAAyB,mBAC3B,MAAM,8BAA8B,MAAM,IAAI,KAAK,aAAa,KAAK,EAAE,IACvE;AACJ,QAAM,cAAc,MAAM,kBAAkB;AAC5C,MAAI,aAAa;AACf,UAAM,eAAe,MAAM;AAAA,MACzB,MAAM;AAAA,MACN,KAAK;AAAA,MACL,YAAY;AAAA,IACd;AACA,UAAM,kBAAkB,yBAAyB,aAAa,QAAQ;AACtE,QACE,aAAa,YAAY,YAAY,WACrC,aAAa,2BAA2B,YAAY,0BACpD,WAAW,eAAe,MAAM,WAAW,YAAY,QAAQ,GAC/D;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI;AACJ,MAAI,MAAM,IAAI,WAAW;AACvB,cAAU,MAAM,eAAe,MAAM,IAAI,KAAK,aAAa,MAAM,IAAI,SAAS;AAG9E,QAAI,CAAC,iBAAkB,qCAAoC,SAAS,IAAI;AAAA,EAC1E,WAAW,kBAAkB;AAC3B,UAAM,cAAc,MAAM,kBAAkB;AAC5C,QAAI,aAAa;AACf,YAAM,UAAU,MAAM;AAAA,QACpB,MAAM;AAAA,QACN;AAAA,UACE,WAAW,KAAK;AAAA,UAChB,aAAa,KAAK;AAAA,UAClB,WACE,MAAM,kBAAkB,sCAAsC,KAAK,UAAU;AAAA,QACjF;AAAA,QACA,YAAY;AAAA,MACd;AACA,UAAI,CAAC,WAAW,QAAQ,eAAe,YAAY,YAAY;AAC7D,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,UAAM,MAAM,MAAM,kBAAkB;AACpC,QAAI,KAAK;AACP,YAAM,WAAW,MAAM;AAAA,QACrB,MAAM;AAAA,QACN;AAAA,UACE,WAAW,KAAK;AAAA,UAChB,aAAa,KAAK;AAAA,UAClB,WACE,MAAM,kBAAkB,sCAAsC,KAAK,UAAU;AAAA,QACjF;AAAA,QACA,IAAI;AAAA,QACJ,IAAI;AAAA,MACN;AACA,UAAI,CAAC,UAAU;AACb,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,UAAM,eAAe,EAAE,GAAG,KAAK,YAAY,SAAS;AACpD,WAAO,aAAa,uCAAuC;AAC3D,UAAM,UAAU,MAAM,sCAAsC,MAAM,IAAI;AAAA,MACpE,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,gBAAgB,KAAK,YAAY;AAAA,MACjC,WAAW,KAAK,YAAY;AAAA,MAC5B,iBAAiB,KAAK,YAAY;AAAA,MAClC,OAAO,MAAM,kBAAkB;AAAA,MAC/B,oBAAoB,MAAM,kBAAkB;AAAA,MAC5C,0BAA0B,MAAM,kBAAkB;AAAA,MAClD,GAAI,MAAM,kBAAkB,sBACxB,EAAE,aAAa,MAAM,kBAAkB,oBAAoB,IAC3D,CAAC;AAAA,MACL,GAAI,MAAM,kBAAkB,8BAA8B,SACtD,EAAE,cAAc,MAAM,kBAAkB,0BAA0B,IAClE,CAAC;AAAA,MACL,GAAG,mCAAmC,wBAAwB,iBAAiB,IAAI;AAAA,MACnF,GAAI,KAAK,cAAc,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;AAAA,MAC5D,GAAI,KAAK,YAAY,iBAAiB,YAAY,SAAS,cAC3D,KAAK,eAAe,YAChB;AAAA,QACE,YAAY;AAAA,QACZ,sBAAsB,MAAM,IAAI;AAAA,MAClC,IACA,CAAC;AAAA,MACL,UAAU;AAAA,QACR,GAAG;AAAA,QACH,GAAG;AAAA,UACD,MAAM,kBAAkB;AAAA,UACxB,wBAAwB;AAAA,QAC1B;AAAA,QACA,OAAO,MAAM,kBAAkB;AAAA,QAC/B,iBAAiB,MAAM,kBAAkB;AAAA,QACzC,iBAAiB,KAAK;AAAA,QACtB,sBAAsB,KAAK;AAAA,QAC3B,GAAI,KAAK,YAAY,OAAO,EAAE,mBAAmB,KAAK,YAAY,KAAK,IAAI,CAAC;AAAA,QAC5E,oBAAoB,MAAM,IAAI;AAAA,QAC9B,GAAI,cAAc,EAAE,CAAC,uCAAuC,GAAG,YAAY,GAAG,IAAI,CAAC;AAAA,MACrF;AAAA,MACA,WAAW;AAAA,QACT,MAAM;AAAA,QACN,WAAW;AAAA,QACX,OAAO;AAAA,MACT;AAAA,MACA,kBAAkB;AAAA,QAChB,iBAAiB,KAAK;AAAA,QACtB,oBAAoB,MAAM,IAAI;AAAA,MAChC;AAAA,MACA,OAAO,MAAM,kBAAkB;AAAA,MAC/B,iBAAiB,MAAM,kBAAkB;AAAA,MACzC,aAAa,MAAM,kBAAkB;AAAA,MACrC,gBAAgB,MAAM,kBAAkB;AAAA,MACxC,WAAW,MAAM,kBAAkB;AAAA,MACnC,eAAe,aAAa,MAAM;AAAA,MAClC,OAAO,KAAK,MAAM;AAAA,MAClB,cAAc,KAAK,aAAa;AAAA,MAChC,+BAA+B,CAAC;AAAA,MAChC,4CACE,MAAM,kBAAkB;AAAA,MAC1B,+CACE,MAAM,kBAAkB;AAAA,MAC1B,6BAA6B,KAAK,YAAY,uBAAuB;AAAA,MACrE,8BAA8B;AAAA,QAC5B,8BACE,MAAM,kBAAkB,wBAAyB;AAAA,QACnD,8BACE,MAAM,kBAAkB,wBAAyB;AAAA,MACrD;AAAA,MACA,2BACE,MAAM,kBAAkB,wBAAyB;AAAA,MACnD,+BAA+B;AAAA,MAC/B,WAAW,kBAAkB,KAAK,EAAE;AAAA,MACpC,sBACE,MAAM,kBAAkB,yBAAyB,yBAChD,MAAM;AACL,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF,GAAG;AAAA,MACL,oBAAoB,OAAO,IAAI,cAAc;AAC3C,cAAM,yCAAyC,IAAI;AAAA,UACjD,WAAW,KAAK;AAAA,UAChB,aAAa,KAAK;AAAA,UAClB,OAAO,MAAM,IAAI;AAAA,UACjB;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AACD,QAAI,QAAQ,OAAQ,OAAM,IAAI,0BAA0B,QAAQ,MAAM;AACtE,cAAU,QAAQ;AAClB,QAAI,QAAQ,QAAS,+BAA8B,MAAM,aAAa;AACtE,QAAI,CAAC,QAAQ,SAAS;AACpB,YAAM,yCAAyC,MAAM,IAAI;AAAA,QACvD,WAAW,KAAK;AAAA,QAChB,aAAa,KAAK;AAAA,QAClB,OAAO,MAAM,IAAI;AAAA,QACjB,WAAW,QAAQ;AAAA,MACrB,CAAC;AAAA,IACH;AAAA,EACF,OAAO;AACL,UAAM,kBACJ,KAAK,YAAY,qBAAqB,KAAK,kBAAkB,KAAK;AACpE,QAAI,CAAC,iBAAiB;AACpB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,cAAU,MAAM,eAAe,MAAM,IAAI,KAAK,aAAa,eAAe;AAE1E,wCAAoC,SAAS,IAAI;AACjD,UAAM,yCAAyC,MAAM,IAAI;AAAA,MACvD,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,OAAO,MAAM,IAAI;AAAA,MACjB,WAAW,QAAQ;AAAA,IACrB,CAAC;AAAA,EACH;AACA,MAAI,kBAAkB;AACpB,cAAU,MAAM,mCAAmC;AAAA,MACjD,IAAI,MAAM;AAAA,MACV,KAAK,MAAM;AAAA,MACX,UAAU,MAAM;AAAA,MAChB;AAAA,MACA,OAAO,MAAM,IAAI;AAAA,MACjB;AAAA,MACA,mBAAmB;AAAA,MACnB,gBAAgB,CAAC;AAAA,IACnB,CAAC;AAAA,EACH;AACA,MAAI,QAAQ,WAAW,aAAa;AAClC,UAAM,oCAAoC,MAAM,IAAI;AAAA,MAClD,aAAa,KAAK;AAAA,MAClB,OAAO,MAAM,IAAI;AAAA,MACjB,WAAW,QAAQ;AAAA,MACnB,OAAO;AAAA,IACT,CAAC;AACD,WAAO,EAAE,QAAQ,WAAW,QAAQ,yBAAyB;AAAA,EAC/D;AACA,MAAI,kBAAkB;AACpB,UAAM,oBAAoB,MAAM,kBAAkB,yBAAyB;AAC3E,QAAI,CAAC,mBAAmB;AACtB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,mBAAmB,MAAM,kBAAkB;AACjD,UAAM,0BACJ,KAAK,YAAY,sBAAsB,OAAO,QAAQ,SAAS,uBAAuB,WAClF,QAAQ,SAAS,qBACjB,MAAM,IAAI;AAGhB,UAAM,iBAAiB,MAAM;AAAA,MAC3B,MAAM;AAAA,MACN,KAAK;AAAA,MACL,QAAQ;AAAA,IACV;AACA,UAAM,uBAAuB,EAAE,GAAG,KAAK,YAAY,SAAS;AAC5D,WAAO,qBAAqB,uCAAuC;AACnE,UAAM,mBAAmB;AAAA,MACvB;AAAA,QACE,GAAG;AAAA,QACH,GAAG;AAAA,UACD,MAAM,kBAAkB;AAAA,UACxB,wBAAwB;AAAA,QAC1B;AAAA,QACA,OAAO,MAAM,kBAAkB;AAAA,QAC/B,iBAAiB,MAAM,kBAAkB;AAAA,QACzC,iBAAiB,KAAK;AAAA,QACtB,sBAAsB,KAAK;AAAA,QAC3B,GAAI,KAAK,YAAY,OAAO,EAAE,mBAAmB,KAAK,YAAY,KAAK,IAAI,CAAC;AAAA,QAC5E,oBAAoB;AAAA,QACpB,GAAI,cAAc,EAAE,CAAC,uCAAuC,GAAG,YAAY,GAAG,IAAI,CAAC;AAAA,MACrF;AAAA,MACA,MAAM,kBAAkB;AAAA,IAC1B;AACA,QACE,QAAQ,yBAAyB,qBACjC,QAAQ,mBAAmB,KAAK,YAAY,UAC5C,QAAQ,kBAAkB,MAAM,kBAAkB,6BAA6B,SAC/E,QAAQ,eAAe,QACvB,WAAW,QAAQ,MAAM,MAAM,QAC/B,WAAW,QAAQ,UAAU,MAC3B,WAAW,EAAE,MAAM,YAAY,wBAAwB,KAAK,CAAC,KAC/D,QAAQ,sBAAsB,KAC9B,QAAQ,WAAW,WAAW,KAC9B,QAAQ,oBAAoB,QAC5B,QAAQ,kBAAkB,QAAQ,MAClC,QAAQ,qBAAqB,KAC7B,QAAQ,iCAAiC,iBAAiB,gCAC1D,QAAQ,iCAAiC,iBAAiB,gCAC1D,QAAQ,qCACL,iBAAiB,iCAAiC,YAAY,QAAQ,KAAK,SAC9E,QAAQ,mBAAmB,QAAQ,MACnC,QAAQ,cAAc,QACtB,QAAQ,wBAAwB,iBAAiB,uBACjD,WAAW,QAAQ,QAAQ,MAAM,WAAW,gBAAgB,KAC5D,QAAQ,UAAU,SAAS,aAC3B,QAAQ,UAAU,cAAc,eAChC,WAAW,QAAQ,gBAAgB,MACjC,WAAW;AAAA,MACT,OAAO;AAAA,MACP,iBAAiB,KAAK;AAAA,MACtB,oBAAoB;AAAA,IACtB,CAAC,KACF,KAAK,YAAY,yBAChB,MAAM,kBAAkB,0BAA0B,SACjD,QAAQ,SAAS,uBAAuB,MAAM,IAAI,MACjD,QAAQ,iBAAiB,uBAAuB,MAAM,IAAI,OAC9D,gBAAgB,UAAU,MAAM,kBAAkB,iBAClD,eAAe,oBAAoB,MAAM,kBAAkB,2BAC3D,eAAe,gBAAgB,MAAM,kBAAkB,uBACvD,QAAQ,mBAAmB,MAAM,kBAAkB,0BACnD,QAAQ,cAAc,MAAM,kBAAkB,qBAC9C,QAAQ,qBAAqB,KAAK,YAAY,eAAe,mBAAmB,SAChF,WAAW,QAAQ,SAAS,MAAM,WAAW,KAAK,YAAY,SAAS,KACvE,WAAW,QAAQ,KAAK,MAAM,WAAW,MAAM,kBAAkB,aAAa,KAC9E,WAAW,QAAQ,kBAAkB,MACnC,WAAW,MAAM,kBAAkB,0BAA0B,KAC/D,WAAW,QAAQ,wBAAwB,MACzC,WAAW,MAAM,kBAAkB,gCAAgC,KACrE,WAAW,QAAQ,KAAK,MACtB,WAAW,MAAM,kBAAkB,uBAAuB,IAAI,KAChE,QAAQ,iCAAiC,KAAK,YAAY,uBAAuB,UAChF,QAAQ,iBAAiB,WACvB,MAAM,kBAAkB,qBAAqB,MAAM,UACrD,QAAQ,SAAS,WAAW,MAAM,kBAAkB,aAAa,MAAM,UACvE,QAAQ,gBAAgB,WAAW,MAAM,kBAAkB,aAAa,aAAa,SACtF,8BAA8B,QAAQ,QAAQ,OAAO,aAAa,MAAM,OACxE;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,aAAa,qBAAqB,QAAQ,EAAE;AAChD,MAAI,kBAAkB;AACpB,UAAM,WAAW,KAAK,YAAY,QAAQ;AAC1C,UAAM,UAAU,MAAM,iCAAiC,MAAM,IAAI;AAAA,MAC/D,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,WAAW,QAAQ;AAAA,MACnB,yBAAyB,MAAM,kBAAkB;AAAA,MACjD,qBAAqB;AAAA,QACnB,iBAAiB,KAAK;AAAA,QACtB,oBAAoB,MAAM,IAAI;AAAA,MAChC;AAAA,MACA,MAAM,WACF;AAAA,QACE,MAAM,SAAS;AAAA,QACf,iBAAiB,SAAS,mBAAmB;AAAA,QAC7C,sBAAsB,SAAS,wBAAwB;AAAA,QACvD,GAAI,SAAS,iBAAiB,EAAE,gBAAgB,SAAS,eAAe,IAAI,CAAC;AAAA,QAC7E,WAAW;AAAA,MACb,IACA;AAAA,MACJ,kBAAkB;AAAA,MAClB,gBAAgB;AAAA,IAClB,CAAC;AACD,iBAAa,QAAQ;AACrB,QAAI,QAAQ,OAAO,SAAS,GAAG;AAC7B,YAAM,4BAA4B,MAAM,KAAK,KAAK,aAAa,QAAQ,IAAI,QAAQ,MAAM;AAAA,IAC3F;AACA,QAAI,KAAK,YAAY,oBAAoB;AACvC,YAAM,+CAA+C,MAAM,IAAI;AAAA,QAC7D,WAAW,KAAK;AAAA,QAChB,aAAa,KAAK;AAAA,QAClB,QAAQ,KAAK;AAAA,QACb,OAAO,MAAM,IAAI;AAAA,QACjB,WAAW,QAAQ;AAAA,QACnB,6BAA6B,MAAM,IAAI;AAAA,QACvC,uBAAuB,MAAM,IAAI;AAAA,MACnC,CAAC;AAAA,IACH;AAIA,UAAM,cAAc,MAAM,2BAA2B,MAAM,IAAI;AAAA,MAC7D,aAAa,KAAK;AAAA,MAClB,WAAW,QAAQ;AAAA,MACnB,UAAU,KAAK;AAAA,IACjB,CAAC;AACD,QAAI,YAAY,SAAS,GAAG;AAC1B,YAAM,4BAA4B,MAAM,KAAK,KAAK,aAAa,QAAQ,IAAI,WAAW;AAAA,IACxF;AAAA,EACF;AACA,QAAM,kBAAkB,MAAM;AAAA,IAC5B,MAAM;AAAA,IACN;AAAA,MACE,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,WAAW,QAAQ;AAAA,MACnB,MAAM;AAAA,MACN,gBAAgB;AAAA,MAChB,UAAU,MAAM,IAAI;AAAA,MACpB,WAAW,sBAAsB,MAAM,IAAI,EAAE;AAAA,MAC7C,SAAS,KAAK,YAAY;AAAA,MAC1B,SAAS;AAAA,QACP,KAAK,YAAY;AAAA,QACjB,KAAK,YAAY;AAAA,QACjB,MAAM,kBAAkB;AAAA,QACxB,KAAK;AAAA,QACL,MAAM,IAAI;AAAA,QACV,MAAM,kBAAkB,oBAAoB,CAAC;AAAA,MAC/C;AAAA,MACA,SAAS;AAAA,QACP,iBAAiB,KAAK;AAAA,QACtB,oBAAoB,MAAM,IAAI;AAAA,QAC9B,GAAI,MAAM,kBAAkB,uBACxB,EAAE,sBAAsB,MAAM,kBAAkB,qBAAqB,IACrE,CAAC;AAAA,QACL,GAAI,MAAM,kBAAkB,+BACxB;AAAA,UACE,8BAA8B,MAAM,kBAAkB;AAAA,QACxD,IACA,CAAC;AAAA,QACL,GAAI,MAAM,kBAAkB,wBACxB,EAAE,uBAAuB,MAAM,kBAAkB,sBAAsB,IACvE,CAAC;AAAA,QACL,GAAI,MAAM,kBAAkB,2BACxB,EAAE,0BAA0B,MAAM,kBAAkB,yBAAyB,IAC7E,CAAC;AAAA,MACP;AAAA,MACA,+BAA+B,MAAM,kBAAkB;AAAA,MACvD,oBAAoB,MAAM,kBAAkB,sBAAsB;AAAA,MAClE,qCACE,MAAM,kBAAkB;AAAA,MAC1B,wCACE,MAAM,kBAAkB;AAAA;AAAA;AAAA,MAG1B,uBAAuB,MAAM,sCAAsC,MAAM,IAAI;AAAA,QAC3E,aAAa,KAAK;AAAA,QAClB,QAAQ,KAAK;AAAA,QACb,6BACE,MAAM,kBAAkB,sBAAsB,aAAa;AAAA,QAC7D,uBAAuB,KAAK;AAAA,MAC9B,CAAC;AAAA,MACD,oBAAoB,MAAM,IAAI;AAAA,IAChC;AAAA,IACA,OAAO,IAAI,aAAa,WAAW,oBAAoB;AACrD,UAAI,CAAC,aAAa;AAChB,cAAM,QAAQ,+BAA+B,eAAe;AAC5D,cAAM,oCAAoC,IAAI;AAAA,UAC5C,aAAa,KAAK;AAAA,UAClB,OAAO,MAAM,IAAI;AAAA,UACjB,WAAW,QAAQ;AAAA,UACnB,gBAAgB;AAAA,UAChB,QAAQ;AAAA,UACR;AAAA,QACF,CAAC;AACD;AAAA,MACF;AACA,YAAM,oCAAoC,IAAI;AAAA,QAC5C,aAAa,KAAK;AAAA,QAClB,OAAO,MAAM,IAAI;AAAA,QACjB,WAAW,QAAQ;AAAA,QACnB,gBAAgB;AAAA,QAChB,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA;AAAA,MACE,oBAAoB,KAAK,kBAAkB,UAAU,CAAC;AAAA,MACtD,eAAe,OAAO,IAAI,cAAc;AACtC,cAAM,OAAO,KAAK,YAAY;AAC9B,cAAM,aACJ,CAAC,oBAAoB,KAAK,YAAY,sBAAsB,OACxD,MAAM,iCAAiC,IAAI;AAAA,UACzC,WAAW,KAAK;AAAA,UAChB,aAAa,KAAK;AAAA,UAClB;AAAA,UACA,OAAO,MAAM,IAAI;AAAA,UACjB,MAAM,KAAK;AAAA,UACX,iBAAiB,KAAK,mBAAmB;AAAA,UACzC,sBAAsB,KAAK,wBAAwB;AAAA,UACnD,GAAI,KAAK,iBAAiB,EAAE,gBAAgB,KAAK,eAAe,IAAI,CAAC;AAAA,QACvE,CAAC,IACD,CAAC;AACP,cAAM,iBAAiB,MAAM,kBAAkB,4BAC3C,MAAM,+BAA+B;AAAA,UACnC;AAAA,UACA,UAAU,MAAM;AAAA,UAChB,QAAQ,KAAK;AAAA,UACb,aAAa,KAAK;AAAA,UAClB;AAAA,UACA,uBAAuB,MAAM,kBAAkB;AAAA,UAC/C,mBAAmB,MAAM;AAAA,QAC3B,CAAC,IACD;AACJ,eAAO;AAAA,UACL,GAAI,kBAAkB,CAAC;AAAA,UACvB,GAAI,WAAW,SAAS,IAAI,EAAE,QAAQ,WAAW,IAAI,CAAC;AAAA,QACxD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MACE,gBAAgB,WAAW,uBAC3B,gBAAgB,WAAW,sBAC3B,gBAAgB,WAAW,kBAC3B;AACA,WAAO,EAAE,QAAQ,WAAW,QAAQ,yBAAyB;AAAA,EAC/D;AACA,MAAI,gBAAgB,OAAO;AACzB,8BAA0B,MAAM,eAAe,EAAE,SAAS,YAAY,CAAC;AAAA,EACzE;AACA,MAAI,gBAAgB,SAAS,gBAAgB,OAAO,SAAS,GAAG;AAC9D,UAAM;AAAA,MACJ,MAAM;AAAA,MACN,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,gBAAgB;AAAA,IAClB;AAAA,EACF;AACA,QAAMA,kBAAiB,MAAM,IAAI;AAAA,IAC/B,WAAW,KAAK;AAAA,IAChB,aAAa,KAAK;AAAA,IAClB,WAAW;AAAA,IACX,UAAU;AAAA,IACV,MAAM;AAAA,IACN,oBAAoB;AAAA,IACpB,kBAAkB,MAAM,IAAI;AAAA,IAC5B,WAAW,QAAQ;AAAA,IACnB,WAAW,MAAM,kBAAkB;AAAA,IACnC,kBAAkB,EAAE,iBAAiB,KAAK,IAAI,oBAAoB,MAAM,IAAI,GAAG;AAAA,IAC/E,QAAQ;AAAA,IACR,gBACE,MAAM,kBAAkB,+BACxB,qCAAqC,MAAM,IAAI,EAAE;AAAA,EACrD,CAAC;AACD,QAAM,uBAAuB,MAAM,qCAAqC,MAAM,IAAI;AAAA,IAChF,WAAW,KAAK;AAAA,IAChB,aAAa,KAAK;AAAA,IAClB,WAAW,QAAQ;AAAA,IACnB,oBAAoB;AAAA,IACpB,QAAQ;AAAA,EACV,CAAC;AACD,QAAM,SAAS;AAAA,IACb,QAAQ,mBAAmB,UAAU;AAAA,IACrC,WAAW,KAAK;AAAA,IAChB,aAAa,KAAK;AAAA,IAClB,WAAW,QAAQ;AAAA,IACnB,gBAAgB,gBAAgB;AAAA,IAChC;AAAA,IACA;AAAA,EACF;AACA,MAAI,MAAM,uBAAuB,yBAAyB,MAAM;AAC9D,UAAM,MAAM,oBAAoB;AAAA,MAC9B,WAAW,OAAO;AAAA,MAClB,aAAa,OAAO;AAAA,MACpB,WAAW,OAAO;AAAA,MAClB,YAAY,OAAO;AAAA,MACnB,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,eAAe,4BAA4B,OAMC;AAC1C,MAAI,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,IAAI,gBAAgB;AACrD,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACA,QAAM,YAAY,MAAM,IAAI;AAC5B,QAAM,iBAAiB,MAAM,IAAI;AACjC,QAAM,eAAe,MAAM,IAAI,MAAM,KAAK,aAAa,SAAS;AAChE,QAAMA,kBAAiB,MAAM,IAAI;AAAA,IAC/B,WAAW,MAAM,KAAK;AAAA,IACtB,aAAa,MAAM,KAAK;AAAA,IACxB,WAAW;AAAA,IACX,UAAU;AAAA,IACV,MAAM;AAAA,IACN,oBAAoB;AAAA,IACpB,kBAAkB,MAAM,IAAI;AAAA,IAC5B;AAAA,IACA,WAAW,MAAM,kBAAkB;AAAA,IACnC,kBAAkB;AAAA,MAChB,iBAAiB,MAAM,KAAK;AAAA,MAC5B,oBAAoB,MAAM,IAAI;AAAA,IAChC;AAAA,IACA,QAAQ;AAAA,IACR,gBACE,MAAM,kBAAkB,+BACxB,qCAAqC,MAAM,IAAI,EAAE;AAAA,EACrD,CAAC;AACD,QAAM,aAAa,qBAAqB,SAAS;AACjD,QAAM,uBAAuB,MAAM,qCAAqC,MAAM,IAAI;AAAA,IAChF,WAAW,MAAM,KAAK;AAAA,IACtB,aAAa,MAAM,KAAK;AAAA,IACxB;AAAA,IACA,oBAAoB;AAAA,IACpB,QAAQ;AAAA,EACV,CAAC;AACD,QAAM,SAAS;AAAA,IACb,QAAQ,MAAM,kBAAkB,KAAK,YAAY,wBAAwB,UAAU;AAAA,IACnF,WAAW,MAAM,KAAK;AAAA,IACtB,aAAa,MAAM,KAAK;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,MAAM,uBAAuB,yBAAyB,MAAM;AAC9D,UAAM,MAAM,oBAAoB;AAAA,MAC9B,WAAW,OAAO;AAAA,MAClB,aAAa,OAAO;AAAA,MACpB,WAAW,OAAO;AAAA,MAClB,YAAY,OAAO;AAAA,MACnB,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AACA,SAAO;AACT;AASA,SAAS,mCACP,QASA;AACA,MAAI,CAAC,OAAQ,QAAO,CAAC;AACrB,QAAM,cAAc,mBAAmB,UAAU,OAAO,WAAW;AACnE,QAAM,cAAc,mBAAmB,UAAU,OAAO,WAAW;AACnE,SAAO;AAAA,IACL,GAAI,YAAY,UAAU,EAAE,aAAa,YAAY,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA,IAG/D,GAAI,OAAO,kBAAkB,+BAA+B,KAAK,OAAO,cAAc,IAClF,EAAE,gBAAgB,OAAO,eAAe,IACxC,CAAC;AAAA,IACL,GAAI,YAAY,UAAU,EAAE,aAAa,YAAY,KAAK,IAAI,CAAC;AAAA,EACjE;AACF;AAEA,SAAS,qCAAqC,MAGlC;AACV,MAAI,KAAK,WAAW,SAAU,QAAO;AACrC,QAAM,QAAQ,KAAK,SAAS;AAC5B,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,UAAU;AAChB,SAAO,QAAQ,kBAAkB,SAAS,QAAQ,qBAAqB;AACzE;;;AEpqGA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,mBAAmB;AAAA,EACnB,0BAA0B;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,wCAAwC;AAAA,EACxC,+BAA+B;AAAA,EAC/B;AAAA,EACA;AAAA,EACA,kBAAAE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,+BAAAC,oCAAmC;AAC5C,SAAS,wBAAwB;AAGjC,SAAS,6CAA6C;AAyE/C,IAAM,gCAAgC;AAEtC,SAAS,6BACd,UACA,YAA2C,CAAC,GAC5C;AACA,QAAM,sCACJ,UAAU,qCAAqC;AACjD,QAAM,+BACJ,UAAU,8BAA8B;AAC1C,QAAM,+BACJ,UAAU,8BAA8B;AAC1C,QAAM,sCACJ,UAAU,qCAAqC;AACjD,QAAM,uCACJ,UAAU,sCAAsC;AAClD,QAAM,+BACJ,UAAU,8BAA8B;AAC1C,QAAM,2BAA2B,UAAU,0BAA0B;AACrE,QAAM,mCACJ,UAAU,kCAAkC;AAC9C,QAAM,sCACJ,UAAU,qCAAqC;AACjD,QAAM,oBAAoB,UAAU,mBAAmB;AACvD,QAAM,mCACJ,UAAU,kCAAkC;AAC9C,QAAM,2BAA2B,UAAU,0BAA0B;AACrE,QAAM,qBAAqB,UAAU,oBAAoB;AACzD,QAAM,iCACJ,UAAU,gCAAgC;AAC5C,QAAM,oBAAoB,UAAU,mBAAmB;AACvD,QAAM,6BAA6B,UAAU,4BAA4B;AACzE,QAAM,iBAAiB,UAAU,gBAAgB;AACjD,QAAM,mCACJ,UAAU,kCAAkC;AAC9C,QAAM,yCACJ,UAAU,wCAAwC;AACpD,QAAM,gCACJ,UAAU,+BAA+B;AAC3C,QAAM,mBAAmB,UAAU,kBAAkBC;AACrD,QAAM,sCACJ,UAAU,qCAAqC;AACjD,QAAM,+BACJ,UAAU,8BAA8B;AAC1C,QAAM,gCACJ,UAAU,+BAA+BC;AAC3C,QAAM,mCACJ,UAAU,kCAAkC;AAC9C,QAAM,4BAA4B,UAAU,2BAA2B;AACvE,QAAM,2BAA2B,UAAU,0BAA0B;AACrE,QAAM,qCACJ,UAAU,oCAAoC;AAEhD,iBAAe,mBACb,OACmC;AACnC,UAAM,EAAE,IAAI,KAAK,UAAU,eAAe,oBAAoB,IAAI,MAAM,SAAS;AACjF,UAAM,UAAU,MAAM,iBAAiB,IAAI,MAAM,aAAa,MAAM,SAAS;AAC7E,QAAI,QAAQ,WAAW,YAAY,QAAQ,WAAW,aAAa;AAKjE,aAAO,EAAE,QAAQ,WAAW;AAAA,IAC9B;AACA,UAAM,aACJ,MAAM,cAAc,QAAQ,sBAAsB,WAAW,MAAM,SAAS;AAC9E,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AACA,QAAI,CAAC,MAAM;AACT,YAAM,UAAU,MAAM,+BAA+B,IAAI;AAAA,QACvD,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,QACjB,oBAAoB;AAAA,MACtB,CAAC;AACD,UAAI,QAAS,QAAO,EAAE,QAAQ,QAAQ;AAEtC,YAAM,6BACJ,MAAM,iBAAiB,eAAe,MAAM;AAC9C,UACE,+BAA+B,aAC/B,MAAM,kBACN,MAAM,iBAAiB,QACvB;AACA,cAAM,UAAU,MAAM,qCAAqC,IAAI,MAAM,aAAa;AAAA,UAChF,WAAW,MAAM;AAAA,UACjB,WAAW,MAAM;AAAA,UACjB;AAAA,UACA,WAAW,MAAM;AAAA,UACjB,OAAO,MAAM;AAAA,UACb,QAAQ,MAAM,gBAAgB;AAAA,UAC9B,UAAU,MAAM,gBAAgB,YAAY;AAAA,QAC9C,CAAC;AACD,cAAM;AAAA,UACJ;AAAA,UACA,MAAM;AAAA,UACN,MAAM;AAAA,UACN,QAAQ;AAAA,QACV;AACA,eAAO,EAAE,QAAQ,QAAQ,OAAO;AAAA,MAClC;AACA,UAAI,+BAA+B,eAAe,MAAM,SAAS;AAC/D,cAAM,SAAS,MAAM,oCAAoC,IAAI,MAAM,aAAa;AAAA,UAC9E,WAAW,MAAM;AAAA,UACjB,WAAW,MAAM;AAAA,UACjB;AAAA,UACA,SAAS,MAAM;AAAA,UACf,OAAO,MAAM,SAAS;AAAA,UACtB,GAAI,MAAM,iBAAiB,gBAAgB,cACvC;AAAA,YACE,kBAAkB;AAAA,cAChB,aAAa;AAAA,cACb,MAAM,MAAM,gBAAgB;AAAA,YAC9B;AAAA,UACF,IACA,CAAC;AAAA,QACP,CAAC;AACD,YAAI,OAAO,WAAW,WAAY,QAAO,EAAE,QAAQ,WAAW;AAC9D,YAAI,OAAO,WAAW,QAAS,QAAO,EAAE,QAAQ,QAAQ;AACxD,cAAM,8BAA8B,KAAK,MAAM,aAAa,MAAM,WAAW,OAAO,MAAM;AAC1F,YAAI,OAAO,QAAQ;AACjB,gBAAM;AAAA,YACJ,EAAE,IAAI,KAAK,UAAU,eAAe,oBAAoB;AAAA,YACxD,MAAM;AAAA,YACN,MAAM;AAAA,YACN,OAAO;AAAA,UACT;AAAA,QACF;AACA,eAAO,EAAE,QAAQ,SAAS;AAAA,MAC5B;AAEA,YAAM,wBAAwB,MAAM;AACpC,YAAM,eACJ,OAAO,0BAA0B,YAAY,OAAO,SAAS,qBAAqB,IAC9E,KAAK,IAAI,KAAO,KAAK,IAAI,KAAQ,KAAK,MAAM,qBAAqB,CAAC,CAAC,IACnE;AACN,YAAM,6BAA6B,IAAI;AAAA,QACrC,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,WAAW,MAAM;AAAA,QACjB,oBAAoB;AAAA,QACpB,QAAQ;AAAA,QACR,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY;AAAA,MAC/C,CAAC;AACD,aAAO,EAAE,QAAQ,YAAY;AAAA,IAC/B;AACA,UAAM,oBAAoB,MAAM;AAChC,UAAM,2BAA2B;AAAA,MAC/B,qBACA,KAAK,OAAO,kBAAkB,UAC9B,KAAK,mBAAmB,kBAAkB,kBAC1C,KAAK,wBAAwB,kBAAkB;AAAA,IACjD;AAGA,QAAI,qBAAqB,CAAC,0BAA0B;AAClD,aAAO,EAAE,QAAQ,QAAQ;AAAA,IAC3B;AACA,UAAM,wBAAwB,2BAC1B,mBAAmB,wBACnB;AACJ,UAAM,sBAAsB,2BACxB,mBAAmB,sBACnB;AACJ,UAAM,2BAA2B,0BAA0B;AAC3D,UAAM,yBAAyB,wBAAwB;AACvD,UAAM,kCAAkC,2BACpC,mBAAmB,kCACnB;AACJ,UAAM,sBACJ,4BAA4B,mBAAmB,+BAA+B;AAChF,UAAM,yBACJ,4BAA4B,mBAAmB,kCAAkC;AACnF,QACG,uBAAuB,2BACtB,uBAAuB,4BACtB,4BAA4B,2BAC9B,0BACC,KAAK,UAAU,0BAA0B,8BAC3C;AACA,aAAO,EAAE,QAAQ,QAAQ;AAAA,IAC3B;AACA,QAAI,6BAA6B,wBAAwB;AACvD,aAAO,EAAE,QAAQ,QAAQ;AAAA,IAC3B;AACA,QAAI,CAAC,mCAAmC,qBAAqB,+BAA+B,GAAG;AAC7F,aAAO,EAAE,QAAQ,QAAQ;AAAA,IAC3B;AACA,QACE,0BAA0B,WACzB,CAAC,OAAO,cAAc,qBAAqB,KAC1C,yBAAyB,KACzB,0BAA0B,kCAAkC,KAAK,YAAY,CAAC,CAAC,IAAI,KACnF,wBAAwB,sBAAsB,mBAAmB,KACjE,OAAO,wBAAwB,YAC/B,CAAC,yBAAyB,KAAK,mBAAmB,IACpD;AACA,aAAO,EAAE,QAAQ,QAAQ;AAAA,IAC3B;AACA,UAAM,qBAAqB,2BACvB,kBAAmB,OACnB,MAAM,iBAAiB,gBAAgB,eACrC,MAAM,gBAAgB,SAAS,oBAC/B,MAAM,gBAAgB,OACtB,MAAM,+BAA+B,cACnC,+CACA;AACR,QAAI,oBAAoB;AAItB,YAAM,eAAe,2BAChB,mBAAmB,wBAAwB,CAAC,IAC7C,CAAC;AACL,UAAI,aAAa,SAAS,GAAG;AAC3B,cAAM;AAAA,UACJ;AAAA,UACA,EAAE,WAAW,MAAM,WAAW,aAAa,MAAM,YAAY;AAAA,UAC7D;AAAA,QACF;AAAA,MACF;AACA,YAAM,WAAW,MAAM,6BAA6B,IAAI,MAAM,aAAa;AAAA,QACzE,WAAW,MAAM;AAAA,QACjB,QAAQ,KAAK;AAAA,QACb,gBAAgB,KAAK;AAAA,QACrB,WAAW,MAAM;AAAA,QACjB,QAAQ,sBACJ,0CACA,yBACE,6CACC,uBAAuB;AAAA,QAC9B,GAAI,sBAAsB,EAAE,4BAA4B,KAAK,IAAI,CAAC;AAAA,QAClE,GAAI,yBAAyB,EAAE,+BAA+B,KAAK,IAAI,CAAC;AAAA,QACxE,GAAI,0BAA0B,SAAY,EAAE,sBAAsB,IAAI,CAAC;AAAA,QACvE,QAAQ;AAAA,UACN,MAAM,sBACF,0CACA,yBACE,6CACA,wBAAwB,kCACtB,yBACC,uBAAuB;AAAA,UAChC,WAAW,CAAC,uBAAuB,CAAC;AAAA,UACpC,GAAI,sBAAsB,EAAE,cAAc,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,UAC5E,GAAI,yBACA;AAAA,YACE,cAAc;AAAA,YACd,QAAQ;AAAA,YACR,mBAAmB;AAAA,YACnB,uBAAuB;AAAA,UACzB,IACA,CAAC;AAAA,UACL,GAAI,0BAA0B,SAC1B;AAAA,YACE,qBAAqB;AAAA,YACrB;AAAA,YACA,GAAI,wBAAwB,kCACxB;AAAA,cACE,mBAAmB;AAAA,cACnB,0BAA0B,sBAAsB,mBAAmB;AAAA,cACnE,iBAAiB;AAAA,YACnB,IACA,CAAC;AAAA,UACP,IACA,CAAC;AAAA,UACL,gBAAgB;AAAA,QAClB;AAAA,QACA,cAAc,CAAC,SAAS;AAAA,MAC1B,CAAC;AACD,UAAI,SAAS,WAAW,aAAc,QAAO,EAAE,QAAQ,QAAQ;AAC/D,YAAM,8BAA8B,KAAK,MAAM,aAAa,MAAM,WAAW,SAAS,MAAM;AAC5F,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,GAAI,oCAAoC,SACpC,EAAE,iBAAiB,gCAAgC,IACnD,CAAC;AAAA,MACP;AAAA,IACF;AACA,UAAM,UAAU,MAAM,kBAAkB,IAAI,MAAM,aAAa,KAAK,cAAc;AAClF,UAAM,SAAS,MAAM,6BAA6B,IAAI,MAAM,aAAa;AAAA,MACvE,WAAW,MAAM;AAAA,MACjB,QAAQ,KAAK;AAAA,MACb,gBAAgB,KAAK;AAAA,MACrB,WAAW,MAAM;AAAA,MACjB,YAAY;AAAA,MACZ,eAAe;AAAA,MACf,cAAc;AAAA,MACd,QAAQ;AAAA,QACN;AAAA,UACE,MAAM;AAAA,UACN,SAAS;AAAA,YACP,gBAAgB,KAAK;AAAA,YACrB,SAAS,SAAS,WAAW;AAAA,YAC7B,OAAO,MAAM,SAAS;AAAA,UACxB;AAAA,QACF;AAAA,QACA,EAAE,MAAM,0BAA0B,SAAS,EAAE,QAAQ,SAAS,EAAE;AAAA,MAClE;AAAA,IACF,CAAC;AACD,QAAI,OAAO,WAAW,SAAS;AAC7B,aAAO,EAAE,QAAQ,QAAQ;AAAA,IAC3B;AACA,UAAM,8BAA8B,KAAK,MAAM,aAAa,MAAM,WAAW,OAAO,MAAM;AAC1F,UAAM;AAAA,MACJ,EAAE,IAAI,KAAK,UAAU,eAAe,oBAAoB;AAAA,MACxD,MAAM;AAAA,MACN,MAAM;AAAA,MACN,KAAK;AAAA,IACP;AACA,WAAO,EAAE,QAAQ,SAAS;AAAA,EAC5B;AAEA,iBAAe,2BACb,OACsD;AACtD,UAAM,EAAE,IAAI,KAAK,cAAc,IAAI,MAAM,SAAS;AAClD,QAAI,MAAM,UAAU,oBAAoB;AAItC,YAAM,SAAS,MAAM,6BAA6B,IAAI;AAAA,QACpD,aAAa,MAAM;AAAA,QACnB,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,QACjB,oBAAoB,MAAM;AAAA,MAC5B,CAAC;AACD,YAAM,8BAA8B,KAAK,MAAM,aAAa,MAAM,WAAW,MAAM;AACnF,aAAO,EAAE,QAAQ,QAAQ;AAAA,IAC3B;AACA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AACA,QAAI,QAAQ,OAAO,SAAS,GAAG;AAC7B,YAAM,8BAA8B,KAAK,MAAM,aAAa,MAAM,WAAW,QAAQ,MAAM;AAAA,IAC7F;AACA,UAAM,wBAAwB,IAAI,eAAe,oBAAoB,wBAAwB;AAC7F,WAAO,EAAE,QAAQ,QAAQ,OAAO;AAAA,EAClC;AAMA,iBAAe,gCACb,OACe;AACf,UAAM,EAAE,IAAI,KAAK,cAAc,IAAI,MAAM,SAAS;AAClD,UAAM,SAAS,MAAM,6BAA6B,IAAI;AAAA,MACpD,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,MACjB,oBAAoB,MAAM;AAAA,MAC1B,uBAAuB,MAAM;AAAA,MAC7B,oBAAoB,MAAM;AAAA,MAC1B,oBAAoB;AAAA,IACtB,CAAC;AACD,QAAI;AACF,YAAM,8BAA8B,KAAK,MAAM,aAAa,MAAM,WAAW,MAAM;AAAA,IACrF,SAAS,OAAO;AAId,oBAAc,MAAM,kDAAkD;AAAA,QACpE,uBAAuB,MAAM;AAAA,QAC7B,uBAAuB,MAAM;AAAA,QAC7B,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AAEA,iBAAe,0CACb,OACkD;AAClD,UAAM,EAAE,IAAI,KAAK,8BAA8B,IAAI,MAAM,SAAS;AAClE,UAAM,cAAc,MAAM,+BAA+B,IAAI;AAAA,MAC3D,GAAG;AAAA,MACH,oBAAoB,MAAM;AAAA,IAC5B,CAAC;AACD,QAAI,CAAC,YAAa,QAAO,EAAE,QAAQ,QAAQ;AAC3C,QAAI,CAAC,YAAY,UAAU;AACzB,UAAI,CAAC,8BAA+B,QAAO,EAAE,QAAQ,UAAU;AAC/D,YAAM,QAAQ,MAAM,8BAA8B,WAAW;AAC7D,UAAI,UAAU,UAAW,QAAO,EAAE,QAAQ,UAAU;AAAA,IACtD;AACA,UAAM,SAAS,MAAM,oCAAoC,IAAI;AAAA,MAC3D,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,MACjB,oBAAoB,MAAM;AAAA,MAC1B,uBAAuB,YAAY;AAAA,MACnC,oBAAoB,YAAY;AAAA,MAChC,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,YAAM;AAAA,QACJ;AAAA,QACA,MAAM;AAAA,QACN,MAAM;AAAA,QACN,OAAO;AAAA,MACT,EAAE,MAAM,MAAM,MAAS;AAAA,IACzB;AACA,WAAO,EAAE,QAAQ,OAAO,OAAO;AAAA,EACjC;AAKA,iBAAe,uCACb,OAC+C;AAC/C,UAAM,EAAE,IAAI,KAAK,+BAA+B,UAAU,eAAe,oBAAoB,IAC3F,MAAM,SAAS;AACjB,UAAM,MAAM,MAAM,+BAA+B,IAAI;AAAA,MACnD,GAAG;AAAA,MACH,oBAAoB,MAAM;AAAA,IAC5B,CAAC;AACD,QAAI,CAAC,OAAO,IAAI,kBAAkB,MAAM,iBAAiB,IAAI,eAAe,MAAM;AAChF,aAAO,EAAE,QAAQ,QAAQ;AAC3B,QAAI,CAAC,8BAA+B,QAAO,EAAE,QAAQ,UAAU;AAC/D,QAAI;AACF,UAAK,MAAM,8BAA8B,GAAG,MAAO,UAAW,QAAO,EAAE,QAAQ,UAAU;AAAA,IAC3F,SAAS,OAAO;AACd,UAAI,iBAAiB,iBAAkB,OAAM;AAC7C,UAAI,uBAAuB,GAAG,mBAAmB;AAC/C,cAAM,IAAI,iBAAiB,wCAAwC;AACrE,aAAO,EAAE,QAAQ,UAAU;AAAA,IAC7B;AACA,QAAI,uBAAuB,GAAG,mBAAmB;AAC/C,YAAM,IAAI,iBAAiB,wCAAwC;AACrE,UAAM,SAAS,MAAM,iCAAiC,IAAI;AAAA,MACxD,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,WAAW,MAAM;AAAA,MACjB,QAAQ,MAAM;AAAA,MACd,WAAW,MAAM;AAAA,MACjB,qBAAqB,MAAM;AAAA,MAC3B,oBAAoB,IAAI;AAAA,MACxB,uBAAuB,IAAI;AAAA,MAC3B,oBAAoB,IAAI;AAAA,MACxB,iBAAiB;AAAA,MACjB,iBAAiB;AAAA,IACnB,CAAC;AAGD,QAAI,OAAO,OAAO,SAAS;AACzB,YAAM;AAAA,QACJ;AAAA,QACA,MAAM;AAAA,QACN,MAAM;AAAA,QACN,OAAO;AAAA,MACT,EAAE,MAAM,MAAM,MAAS;AACzB,QAAI,OAAO,WAAW;AACpB,YAAM;AAAA,QACJ,EAAE,IAAI,KAAK,UAAU,eAAe,oBAAoB;AAAA,QACxD,MAAM;AAAA,QACN,MAAM;AAAA,QACN,OAAO;AAAA,MACT;AACF,WAAO,EAAE,QAAQ,OAAO,OAAO;AAAA,EACjC;AASA,iBAAe,gBAAgB,OAA6D;AAC1F,UAAM,EAAE,UAAU,IAAI,KAAK,eAAe,oBAAoB,IAAI,MAAM,SAAS;AACjF,UAAM,SAAS,MAAM,yBAAyB,IAAI,MAAM,aAAa;AAAA,MACnE,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,OAAO,WAAW,WAAW,OAAO,WAAW,aAAa;AAC9D,aAAO,EAAE,QAAQ,OAAO,OAAO;AAAA,IACjC;AACA,uCAAmC,eAAe;AAAA,MAChD,SAAS,OAAO,WAAW,aAAa,cAAc;AAAA,MACtD,aAAa,MAAM;AAAA,IACrB,CAAC;AACD,UAAM,8BAA8B,KAAK,MAAM,aAAa,MAAM,WAAW,OAAO,MAAM;AAC1F,UAAM,wBAAwB,IAAI,eAAe,oBAAoB,wBAAwB;AAC7F,QAAI,OAAO,WAAW,YAAY;AAChC,YAAM;AAAA,QACJ,EAAE,IAAI,KAAK,UAAU,eAAe,oBAAoB;AAAA,QACxD,MAAM;AAAA,QACN,MAAM;AAAA,QACN,OAAO;AAAA,MACT;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ,OAAO;AAAA,QACf,cAAc,OAAO;AAAA,MACvB;AAAA,IACF;AACA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ,OAAO;AAAA,MACf,cAAc,OAAO;AAAA,IACvB;AAAA,EACF;AAUA,iBAAe,yBACb,OACyC;AACzC,UAAM,EAAE,IAAI,KAAK,cAAc,IAAI,MAAM,SAAS;AAClD,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AACA,QAAI,CAAC,KAAM,QAAO,EAAE,QAAQ,QAAQ;AACpC,QACE,KAAK,OAAO,MAAM,UAClB,KAAK,mBAAmB,MAAM,kBAC9B,KAAK,wBAAwB,MAAM,uBACnC,MAAM,uBAAuB,KAC7B,MAAM,0BAA0B,kCAAkC,KAAK,QAAQ,IAAI,KACnF,MAAM,wBAAwB,mCAC9B;AACA,aAAO,EAAE,QAAQ,aAAa;AAAA,IAChC;AACA,UAAM,WAAW,MAAM,6BAA6B,IAAI,MAAM,aAAa;AAAA,MACzE,WAAW,MAAM;AAAA,MACjB,QAAQ,MAAM;AAAA,MACd,gBAAgB,MAAM;AAAA,MACtB,WAAW,MAAM;AAAA,MACjB,QAAQ;AAAA,MACR,uBAAuB,MAAM;AAAA,MAC7B,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,WAAW;AAAA,QACX,iBAAiB,MAAM;AAAA,QACvB,uBAAuB,MAAM;AAAA,QAC7B,gBAAgB;AAAA,MAClB;AAAA,MACA,cAAc,CAAC,SAAS;AAAA,IAC1B,CAAC;AACD,QAAI,SAAS,WAAW,cAAc;AACpC,aAAO,EAAE,QAAQ,QAAQ;AAAA,IAC3B;AACA,UAAM,8BAA8B,KAAK,MAAM,aAAa,MAAM,WAAW,SAAS,MAAM;AAC5F,UAAM,wBAAwB,IAAI,eAAe,oBAAoB,wBAAwB;AAC7F,WAAO,EAAE,QAAQ,aAAa;AAAA,EAChC;AAEA,iBAAe,gBAAgB,OAA6B;AAC1D,UAAM,EAAE,IAAI,KAAK,eAAe,8BAA8B,IAAI,MAAM,SAAS;AAIjF,UAAM,oBACJ,MAAM,sBAAsB,MAAM,eAAe,IAAI,MAAM,WAAW,IAAI;AAC5E,QAAI,CAAC,kBAAmB,QAAO,EAAE,MAAM,cAAuB;AAC9D,QAAI,OAAO,MAAM;AAAA,MACf;AAAA,MACA,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,MACN;AAAA,IACF;AACA,QAAI,KAAK,SAAS,cAAe,QAAO;AACxC,QAAI,KAAK,SAAS,uBAAuB,KAAK,WAAW,iCAAiC;AACxF,YAAM,MAAM,KAAK;AACjB,UAAI,OAAO,YAAY,OAAO,eAAe,KAAK;AAChD,cAAM,UAAU,MAAM,iCAAiC,IAAI;AAAA,UACzD,WAAW;AAAA,UACX,aAAa,MAAM;AAAA,UACnB,WAAW,MAAM;AAAA,UACjB,QAAQ,IAAI;AAAA,UACZ,WAAW,IAAI;AAAA,QACjB,CAAC;AACD,YAAI,QAAQ,OAAO,SAAS;AAC1B,gBAAM;AAAA,YACJ;AAAA,YACA,MAAM;AAAA,YACN,MAAM;AAAA,YACN,QAAQ;AAAA,UACV;AACF,YAAI,QAAQ;AACV,iBAAO,MAAM;AAAA,YACX;AAAA,YACA,MAAM;AAAA,YACN,MAAM;AAAA,YACN,MAAM;AAAA,YACN;AAAA,UACF;AAAA,MACJ;AAAA,IACF;AACA,QAAI,KAAK,SAAS,iBAAiB;AAGjC,UAAI,qBAAwD;AAC5D,UAAI,+BAA+B;AACjC,YAAI;AACF,+BAAqB,MAAM,8BAA8B,KAAK,WAAW;AAAA,QAC3E,SAAS,OAAO;AACd,cAAI,iBAAiB,iBAAkB,OAAM;AAC7C,cAAI,uBAAuB,GAAG,mBAAmB;AAC/C,kBAAM,IAAI,iBAAiB,+BAA+B;AAAA,QAK9D;AAAA,MACF;AACA,UAAI,uBAAuB,GAAG,mBAAmB;AAC/C,cAAM,IAAI,iBAAiB,+BAA+B;AAC5D,YAAM,UAAU,MAAM;AAAA,QACpB;AAAA,QACA,MAAM;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,QACN;AAAA,MACF;AACA,UACE,QAAQ,SAAS,mBACjB,QAAQ,WAAW,KAAK,UACxB,QAAQ,cAAc,KAAK,aAC3B,QAAQ,wBAAwB,KAAK,uBACrC,QAAQ,YAAY,eAAe,KAAK,YAAY,cACpD,QAAQ,YAAY,kBAAkB,KAAK,YAAY,iBACvD,QAAQ,YAAY,eAAe,KAAK,YAAY;AAEpD,eAAO;AACT,aAAO,EAAE,GAAG,SAAS,mBAAmB;AAAA,IAC1C;AACA,UAAM,wBAAwB,IAAI,eAAe,oBAAoB,wBAAwB;AAC7F,WAAO;AAAA,EACT;AAEA,iBAAe,uBACb,OACuC;AACvC,UAAM,EAAE,IAAI,IAAI,IAAI,MAAM,SAAS;AACnC,UAAM,SAAS,MAAM,yBAAyB,IAAI,KAAK;AACvD,QAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,YAAM,8BAA8B,KAAK,MAAM,aAAa,MAAM,WAAW,OAAO,MAAM;AAAA,IAC5F;AACA,WAAO,EAAE,QAAQ,OAAO,OAAO;AAAA,EACjC;AAEA,iBAAe,wBACb,OACwC;AACxC,UAAM,EAAE,IAAI,IAAI,IAAI,MAAM,SAAS;AACnC,UAAM,SAAS,MAAM,iCAAiC,IAAI,KAAK;AAC/D,QAAI,OAAO,WAAW,YAAa,QAAO,EAAE,QAAQ,YAAY;AAChE,QAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,YAAM,8BAA8B,KAAK,MAAM,aAAa,MAAM,WAAW,OAAO,MAAM;AAAA,IAC5F;AACA,WAAO;AAAA,MACL,QAAQ,OAAO,QAAQ,WAAW,YAAY,YAAY;AAAA,IAC5D;AAAA,EACF;AAEA,iBAAe,qCACb,OACqD;AACrD,UAAM,EAAE,IAAI,KAAK,cAAc,IAAI,MAAM,SAAS;AAClD,UAAM,SAAS,MAAM,uCAAuC,IAAI,KAAK;AACrE,QAAI,OAAO,WAAW,aAAa,OAAO,cAAc;AAEtD,4CAAsC,aAAa,EAAE;AAAA,QACnD,MAAM,OAAO,aAAa;AAAA,QAC1B,SAAS;AAAA,QACT,QAAQ,KAAK,IAAI,IAAI,OAAO,aAAa,UAAU,QAAQ;AAAA,MAC7D,CAAC;AAAA,IACH;AACA,QAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,YAAM,8BAA8B,KAAK,MAAM,aAAa,MAAM,WAAW,OAAO,MAAM;AAAA,IAC5F;AACA,WAAO,EAAE,QAAQ,OAAO,OAAO;AAAA,EACjC;AAGA,iBAAe,4BACb,OAC4C;AAC5C,UAAM,EAAE,IAAI,IAAI,IAAI,MAAM,SAAS;AACnC,UAAM,SAAS,MAAM,8BAA8B,IAAI,KAAK;AAC5D,QAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,YAAM,8BAA8B,KAAK,MAAM,aAAa,MAAM,WAAW,OAAO,MAAM;AAAA,IAC5F;AACA,WAAO,EAAE,QAAQ,OAAO,OAAO;AAAA,EACjC;AAEA,iBAAe,gBAAgB,OAA4C;AACzE,UAAM,EAAE,IAAI,KAAK,UAAU,eAAe,oBAAoB,IAAI,MAAM,SAAS;AACjF,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AACA,QAAI,QAAQ,OAAO,SAAS,GAAG;AAC7B,YAAM,8BAA8B,KAAK,MAAM,aAAa,MAAM,WAAW,QAAQ,MAAM;AAAA,IAC7F;AACA,UAAM,wBAAwB,IAAI,eAAe,oBAAoB,wBAAwB;AAC7F,QAAI,QAAQ,WAAW,WAAW,CAAC,QAAQ,cAAc;AACvD;AAAA,IACF;AAIA,UAAM;AAAA,MACJ,EAAE,IAAI,KAAK,UAAU,eAAe,oBAAoB;AAAA,MACxD,MAAM;AAAA,MACN,MAAM;AAAA,MACN,QAAQ;AAAA,IACV;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,mCAAmC;AAAA,IACnC,gCAAgC;AAAA,IAChC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAe,wBACb,IACA,eACA,oBACA,0BACe;AACf,MAAI;AACF,6BAAyB,eAAe,MAAM,mBAAmB,EAAE,CAAC;AAAA,EACtE,QAAQ;AAAA,EAER;AACF;;;ACx2BA,SAAS,cAAAC,aAAY,cAAAC,mBAAkB;AACvC,SAAS,YAAY;AACrB,SAAS,kBAAkB,yBAAyB;AACpD,SAAS,SAAS,UAAU;AAC5B,SAAS,cAAc;AACvB,SAAS,YAAY;AACrB,SAAS,iBAAiB;AAC1B,SAAS,gBAAgB;AACzB,SAAS,aAAa,eAAe,0BAA0B;AAC/D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAQA,SAAS,0BAA0B,OAAwB;AAChE,MAAI,iBAAiB,8BAA8B;AACjD,YAAQ,MAAM,MAAM;AAAA,MAClB,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT;AACE,eAAO;AAAA,IACX;AAAA,EACF;AACA,SAAO;AACT;AAEO,IAAM,sCAAsC;AAO5C,IAAM,iCAAiC,KAAK,KAAK;AACjD,IAAM,gCAAgC,IAAI,KAAK;AAC/C,IAAM,mCAAmC;AACzC,IAAM,mCAAmC;AAWhD,eAAsB,yBACpB,MACA,SACgB;AAChB,QAAM,OAAO,mBAAmB,EAAE,QAAQ,EAAE,CAAC,cAAc,uBAAuB,GAAG,EAAE,EAAE,CAAC;AAC1F,QAAM,OAAOD,YAAW,QAAQ;AAChC,MAAI,WAAW;AACf,QAAM,QAAQ,IAAI,UAAU;AAAA,IAC1B,UAAU,OAAe,WAAW,UAAU;AAC5C,WAAK,OAAO,KAAK;AACjB,kBAAY,MAAM;AAClB,eAAS,MAAM,KAAK;AAAA,IACtB;AAAA,EACF,CAAC;AACD,QAAM,SAAS,SAAS,MAAM,OAAO,kBAAkB,MAAM,EAAE,OAAO,MAAM,MAAM,IAAM,CAAC,CAAC;AAC1F,QAAM,QAAQ,OAAO,SAAiB;AACpC,QAAI,CAAC,KAAK,MAAM,GAAG,IAAI;AAAA,CAAI,EAAG,OAAM,KAAK,MAAM,OAAO;AAAA,EACxD;AACA,MAAI;AACF,UAAM,QAAQ,KAAK;AACnB,SAAK,IAAI;AACT,UAAM;AAAA,EACR,SAAS,OAAO;AACd,SAAK,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;AACtE,UAAM,OAAO,MAAM,MAAM,MAAS;AAClC,UAAM,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC;AAC9B,UAAM;AAAA,EACR;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,QAAQ,KAAK,OAAO,KAAK;AAAA,IACzB,MAAM,MAAM,iBAAiB,IAAI;AAAA,IACjC,SAAS,YAAY,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC;AAAA,EAC/C;AACF;AAEO,SAAS,yBAAyB,OAA4B,WAAmB;AACtF,QAAM,SAAS,oBAAoB,MAAM,WAAW,IAAI,MAAM,SAAS,IAAI,SAAS;AACpF,SAAO;AAAA,IACL,QAAQ,GAAG,MAAM;AAAA,IACjB,YAAY,GAAG,MAAM;AAAA,EACvB;AACF;AAGA,eAAe,YAAY,IAAc,OAA4B,MAAc;AACjF,QAAM,YAAoC,CAAC;AAC3C,QAAM,aAAa,MAAM,6BAA6B,IAAI,KAAK;AAC/D,QAAM,QAAQ,MAAM,yBAAyB,MAAM,OAAO,UAAU;AAClE,UAAM;AAAA,MACJ,aAAa,KAAK,UAAU,sBAAsB,CAAC,cAAc,8BAA8B,gBAC9E,KAAK,WAAU,oBAAI,KAAK,GAAE,YAAY,CAAC,CAAC,aAC3C,KAAK,UAAU,8BAA8B,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,cACtE,UAAU;AAAA,IAC3B;AACA,eAAW,QAAQ,+BAA+B;AAChD,UAAI,QAAyB;AAC7B,UAAI,QAAQ;AACZ,iBAAS;AACP,cAAM,OAAO,MAAM,uBAAuB,IAAI,OAAO,MAAM;AAAA,UACzD;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AACD,mBAAW,OAAO,KAAK,MAAM;AAC3B,gBAAM,MAAM,YAAY,KAAK,UAAU,KAAK,KAAK,CAAC,UAAU,GAAG,GAAG;AAAA,QACpE;AACA,iBAAS,KAAK,KAAK;AACnB,YAAI,KAAK,KAAK,SAAS,iCAAkC;AACzD,gBAAQ,KAAK;AAAA,MACf;AACA,gBAAU,KAAK,KAAK,IAAI;AAAA,IAC1B;AACA,UAAM,MAAM,2BAA2B,KAAK,UAAU,SAAS,CAAC,GAAG;AAAA,EACrE,CAAC;AACD,SAAO,EAAE,OAAO,UAAU;AAC5B;AAGA,eAAe,gBAAgB,IAAc,OAA4B,MAAc;AACrF,MAAI,SAAS;AACb,QAAM,QAAQ,MAAM,yBAAyB,MAAM,OAAO,UAAU;AAClE,UAAM;AAAA,MACJ,KAAK,UAAU;AAAA,QACb,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,aAAa,MAAM;AAAA,QACnB,WAAW,MAAM;AAAA,MACnB,CAAC;AAAA,IACH;AACA,QAAI,gBAAgB;AACpB,eAAS;AACP,YAAM,OAAO,MAAM,mCAAmC,IAAI,OAAO;AAAA,QAC/D;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AACD,iBAAW,SAAS,KAAM,OAAM,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC,CAAC;AAC/D,gBAAU,KAAK;AACf,UAAI,KAAK,SAAS,IAAK;AACvB,sBAAgB,KAAK,GAAG,EAAE,EAAG;AAAA,IAC/B;AACA,UAAM,MAAM,KAAK,UAAU,EAAE,KAAK,MAAM,OAAO,CAAC,CAAC;AAAA,EACnD,CAAC;AACD,SAAO,EAAE,OAAO,OAAO;AACzB;AA0BO,SAAS,+BACd,UACA,UAAyC,CAAC,GAC1C;AACA,QAAM,oBAAoB,QAAQ,qBAAqB;AACvD,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,SAAS,QAAQ,UAAU;AAEjC,iBAAe,WACb,IACA,SACA,OACA,aACgC;AAChC,UAAM,OAAO,yBAAyB,OAAOC,YAAW,CAAC;AACzD,UAAM,QAAQ,MAAM,oBAAoB,IAAI,OAAO;AAAA,MACjD;AAAA,MACA,YAAY,CAAC,KAAK,QAAQ,KAAK,UAAU;AAAA,IAC3C,CAAC;AACD,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,2BAA2B,CAAC;AAC3E,QAAI;AACF,YAAM,SAAS,MAAM,YAAY,IAAI,OAAO,KAAK,WAAW,kBAAkB,CAAC;AAC/E,YAAM,aAAa,MAAM,gBAAgB,IAAI,OAAO,KAAK,WAAW,sBAAsB,CAAC;AAC3F,YAAM,OAAO,SAAS,KAAK,QAAQ,OAAO,KAAK;AAC/C,YAAM,OAAO,SAAS,KAAK,YAAY,WAAW,KAAK;AACvD,YAAM,WAAmC;AAAA,QACvC,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,YAAY,CAAC,KAAK,QAAQ,KAAK,UAAU;AAAA,QACzC,QAAQ,EAAE,KAAK,KAAK,QAAQ,OAAO,OAAO,MAAM,UAAU,QAAQ,OAAO,MAAM,OAAO;AAAA,QACtF,YAAY;AAAA,UACV,KAAK,KAAK;AAAA,UACV,OAAO,WAAW,MAAM;AAAA,UACxB,QAAQ,WAAW,MAAM;AAAA,UACzB,QAAQ,WAAW;AAAA,QACrB;AAAA,QACA,QAAQ,OAAO,MAAM;AAAA,QACrB,WAAW,OAAO;AAAA,QAClB,WAAW,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAAA,MACzC;AACA,UAAI,CAAE,MAAM,uBAAuB,IAAI,OAAO,QAAQ,GAAI;AACxD,cAAM,IAAI,MAAM,iDAAiD;AAAA,MACnE;AACA,aAAO;AAAA,IACT,SAAS,OAAO;AACd,YAAM,sBAAsB,IAAI,KAAK,EAAE,MAAM,MAAM,MAAS;AAC5D,YAAM;AAAA,IACR,UAAE;AACA,YAAM,GAAG,WAAW,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,IACtD;AAAA,EACF;AAEA,iBAAe,eACb,IACA,OACA,UACiB;AACjB,QAAI,SAAS;AACb,WAAO,IAAI,IAAI,UAAU;AACvB,YAAM,OAAO,MAAM,4BAA4B,IAAI,OAAO;AAAA,QACxD,WAAW;AAAA,MACb,CAAC;AACD,gBAAU,KAAK;AACf,UAAI,KAAK,SAAU;AAAA,IACrB;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,sBAA0D;AACvE,UAAM,EAAE,IAAI,eAAe,eAAe,SAAS,IAAI,MAAM,SAAS;AACtE,UAAM,WAAW,IAAI,IAAI;AACzB,UAAM,SAAoC;AAAA,MACxC,SAAS,SAAS;AAAA,MAClB,UAAU;AAAA,MACV,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,YAAY;AAAA,MACZ,gBAAgB;AAAA,IAClB;AACA,QAAI,eAAe;AACjB,iBAAW,YAAY,MAAM,mCAAmC,IAAI;AAAA,QAClE,qBAAqB;AAAA,QACrB,OAAO;AAAA,MACT,CAAC,GAAG;AACF,YAAI;AACF,gBAAM,cAAc,aAAa,SAAS,SAAS;AACnD,cAAI,MAAM,qCAAqC,IAAI,SAAS,SAAS,GAAG;AACtE,mBAAO,kBAAkB;AAAA,UAC3B;AAAA,QACF,SAAS,OAAO;AACd,wBAAc,KAAK,8DAA8D;AAAA,YAC/E,aAAa,SAAS;AAAA,YACtB,WAAW,SAAS;AAAA,YACpB,WAAW,iBAAiB,QAAQ,MAAM,OAAO;AAAA,UACnD,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAEA,eAAW,cAAc,MAAM,8BAA8B,IAAI;AAAA,MAC/D,cAAc;AAAA,MACd,OAAO;AAAA,IACT,CAAC,GAAG;AACF,UAAI,IAAI,KAAK,SAAU;AAGvB,UAAI;AACF,YAAI,WAAW,UAAU,aAAa;AACpC,cAAI,MAAM,sBAAsB,IAAI,UAAU,EAAG,QAAO,aAAa;AAAA,QACvE,OAAO;AACL,iBAAO,cAAc,MAAM,eAAe,IAAI,YAAY,QAAQ;AAAA,QACpE;AAAA,MACF,SAAS,OAAO;AACd,eAAO,UAAU;AACjB,sBAAc,KAAK,uDAAuD;AAAA,UACxE,aAAa,WAAW;AAAA,UACxB,WAAW,WAAW;AAAA,UACtB,YAAY;AAAA,UACZ,WAAW,0BAA0B,KAAK;AAAA,QAC5C,CAAC;AAAA,MACH;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,sBAAuB,QAAO;AAC5C,QAAI,CAAC,eAAe;AAClB,oBAAc,KAAK,iEAAiE;AACpF,aAAO;AAAA,IACT;AACA,UAAM,cAAc,SAAS,yBAAyB,KAAK,KAAK;AAIhE,UAAM,YAAY,oBAAI,IAAY;AAClC,eAAS;AACP,UAAI,IAAI,KAAK,SAAU;AACvB,YAAM,cACJ,MAAM,6BAA6B,IAAI;AAAA,QACrC;AAAA,QACA,OAAO,oBAAoB,UAAU;AAAA,MACvC,CAAC,GACD,OAAO,CAAC,cAAc,CAAC,UAAU,IAAI,UAAU,SAAS,CAAC;AAC3D,UAAI,WAAW,WAAW,EAAG;AAC7B,iBAAW,SAAS,WAAW,MAAM,GAAG,iBAAiB,GAAG;AAC1D,YAAI,IAAI,KAAK,SAAU;AACvB,kBAAU,IAAI,MAAM,SAAS;AAC7B,YAAI;AACF,gBAAM,UAAU,MAAM,WAAW,IAAI,eAAe,OAAO,WAAW;AACtE,cAAI,YAAY,WAAW;AACzB,mBAAO,WAAW;AAClB;AAAA,UACF;AACA,iBAAO,YAAY;AACnB,iBAAO,cAAc,MAAM,eAAe,IAAI,OAAO,QAAQ;AAAA,QAC/D,SAAS,OAAO;AACd,iBAAO,UAAU;AACjB,wBAAc,KAAK,kDAAkD;AAAA,YACnE,aAAa,MAAM;AAAA,YACnB,WAAW,MAAM;AAAA;AAAA,YAEjB,YAAY;AAAA,YACZ,WAAW,0BAA0B,KAAK;AAAA,UAC5C,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,WAAW,OAAO,SAAS,OAAO,YAAY,OAAO,iBAAiB,GAAG;AAClF,oBAAc,KAAK,iCAAiC,EAAE,GAAG,OAAO,CAAC;AAAA,IACnE;AACA,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,oBAAoB;AAC/B;;;AC7XA,SAAS,mCAAmC;AAIrC,IAAM,2CAA2C;AAEjD,IAAM,iCAAiC,KAAK,KAAK;AAoBjD,SAAS,+BACd,UACA,UAAyC,CAAC,GAC1C;AACA,QAAM,cAAc,QAAQ,yBAAyB;AACrD,QAAM,uBAAuB,QAAQ,wBAAwB;AAC7D,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,MAAM,QAAQ,OAAO,KAAK;AAEhC,iBAAe,yBAAgE;AAC7E,UAAM,EAAE,IAAI,cAAc,IAAI,MAAM,SAAS;AAC7C,UAAM,WAAW,IAAI,IAAI;AACzB,UAAM,oBAAoB,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,EAAE;AAC5E,OAAG;AACD,YAAM,QAAQ,MAAM,qBAAqB,IAAI;AAAA,QAC3C,SAAS;AAAA,QACT,YAAY,CAAC,WAAW,UACtB,cAAc,KAAK,+DAA+D;AAAA,UAChF,MAAM,UAAU;AAAA,UAChB,aAAa,UAAU;AAAA,UACvB,WAAW,UAAU;AAAA,UACrB,WAAW,UAAU;AAAA,UACrB,WAAW,iBAAiB,QAAQ,MAAM,OAAO;AAAA,QACnD,CAAC;AAAA,MACL,CAAC;AACD,wBAAkB,WAAW,MAAM;AACnC,wBAAkB,aAAa,MAAM;AACrC,wBAAkB,WAAW,MAAM;AACnC,wBAAkB,UAAU,MAAM;AAElC,UAAI,MAAM,cAAc,EAAG;AAAA,IAC7B,SAAS,IAAI,IAAI;AACjB,QAAI,kBAAkB,YAAY,KAAK,kBAAkB,SAAS,GAAG;AACnE,oBAAc,KAAK,4CAA4C,iBAAiB;AAAA,IAClF;AAEA,WAAO,EAAE,kBAAkB;AAAA,EAC7B;AAEA,SAAO,EAAE,uBAAuB;AAClC;;;AClEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,2CAA2C;AACpD,SAAS,wCAAwC;AAQjD,IAAM,aAAa;AACnB,IAAM,8BAA8B;AACpC,IAAM,gCAAgC;AAW/B,SAAS,6BAA6B,UAAkD;AAC7F,SAAO;AAAA,IACL,MAAM,+BAA4E;AAChF,YAAM,UAAU,MAAM,SAAS;AAE/B,YAAM,SAAS,MAAM,4BAA4B,QAAQ,IAAI,GAAG;AAChE,iBAAW,SAAS,QAAQ;AAC1B,YAAI;AACF,gBAAMC,UAAS,MAAM;AAAA,YAAiB,QAAQ;AAAA,YAAI,MAAM;AAAA,YAAc,CAAC,WACrE,OAAO;AAAA,cAAY,CAAC,OAClB,qCAAqC,IAA2B;AAAA,gBAC9D,aAAa,MAAM;AAAA,gBACnB,SAAS,MAAM;AAAA,cACjB,CAAC;AAAA,YACH;AAAA,UACF;AACA,cAAIA,SAAQ,yBAAyB;AACnC,kBAAM,QAAQ,MAAM;AAAA,cAClB,QAAQ;AAAA,cACR,MAAM;AAAA,cACNA,QAAO;AAAA,YACT;AACA,gBAAI;AACF,oBAAM,oCAAoC,QAAQ,KAAK,MAAM,cAAc,KAAK;AAAA,UACpF;AAAA,QACF,SAAS,OAAO;AACd,kBAAQ,cAAc,KAAK,oCAAoC;AAAA,YAC7D,aAAa,MAAM;AAAA,YACnB,OAAO,OAAO,KAAK;AAAA,UACrB,CAAC;AAAA,QACH;AAAA,MACF;AACA,UAAI,UAAU;AACd,UAAI,WAAW;AACf,UAAI,mBAAmB;AACvB,UAAI,cAAc;AAClB,YAAM,2BACJ,CAAC;AACH,UAAI,YAAY;AAChB,UAAI,SAAS;AACb,UAAI,sBAAsB;AAC1B,iBAAS;AACP,cAAM,YAAY,8BAA8B;AAChD,YAAI,aAAa,GAAG;AAClB,gCAAsB;AACtB;AAAA,QACF;AACA,cAAM,QAAQ,KAAK,IAAI,YAAY,SAAS;AAC5C,cAAM,QAAQ,MAAM,qCAAqC,SAAS,KAAK;AACvE,mBAAW,MAAM;AACjB,oBAAY,MAAM;AAClB,qBAAa,MAAM;AACnB,4BAAoB,MAAM;AAC1B,uBAAe,MAAM;AACrB,mBAAW,CAAC,SAAS,KAAK,KAAK,OAAO,QAAQ,MAAM,wBAAwB,GAAG;AAC7E,gBAAM,MAAM;AACZ,mCAAyB,GAAG,KAAK,yBAAyB,GAAG,KAAK,KAAK;AAAA,QACzE;AACA,kBAAU,MAAM;AAChB,YAAI,MAAM,UAAU,MAAO;AAAA,MAC7B;AAQA,YAAM,cAAc,MAAM;AAAA,QACxB;AAAA,QACA;AAAA,MACF;AACA,UAAI,YAAY,UAAU,GAAG;AAC3B,gBAAQ,cAAc,KAAK,qDAAqD;AAAA,UAC9E,SAAS,YAAY;AAAA,UACrB,WAAW,YAAY;AAAA,UACvB,QAAQ,YAAY;AAAA,QACtB,CAAC;AAAA,MACH;AACA,YAAM,SAAS;AAAA,QACb;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,uCAAiC,QAAQ,eAAe,MAAM;AAC9D,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACpGA,SAAS,8BACP,cACwC;AACxC,QAAM,SAAS,6BAA6B,YAAY;AACxD,SAAO;AACT;AAEO,SAAS,oCACd,UACA,yBACA;AACA,SAAO;AAAA,IACL,GAAG,2BAA2B,QAAQ;AAAA,IACtC,GAAG,yBAAyB,UAAU,uBAAuB;AAAA,IAC7D,GAAG,kCAAkC,UAAU,uBAAuB;AAAA,IACtE,GAAG,oCAAoC,UAAU,uBAAuB;AAAA,IACxE,GAAG,6BAA6B,QAAQ;AAAA,IACxC,GAAG,+BAA+B,QAAQ;AAAA,IAC1C,GAAG,+BAA+B,QAAQ;AAAA,IAC1C,GAAG,8BAA8B,QAAQ;AAAA,IACzC,GAAG,oCAAoC,QAAQ;AAAA,IAC/C,GAAG,qBAAqB,QAAQ;AAAA,IAChC,GAAG,8BAA8B,QAAQ;AAAA,IACzC,GAAG,gCAAgC,QAAQ;AAAA,IAC3C,GAAG,gDAAgD,QAAQ;AAAA,IAC3D,GAAG,0CAA0C,QAAQ;AAAA,IACrD,GAAG,iCAAiC,QAAQ;AAAA,IAC5C,GAAG,wCAAwC,QAAQ;AAAA,IACnD,GAAG,8CAA8C,QAAQ;AAAA,IACzD,GAAG,6BAA6B,QAAQ;AAAA,IACxC,GAAG,6BAA6B,QAAQ;AAAA,EAC1C;AACF;AAEO,SAAS,wBAAwB,eAAqC,CAAC,GAAG;AAC/E,QAAM,WAAW,8BAA8B,YAAY;AAC3D,MAAI,0BACF;AACF,QAAM,0BAA0B,YAAY;AAC1C,gCAA4B,aAAa,mBACrC,QAAQ,QAAQ,aAAa,gBAAgB,IAC7C,OAAO,qBAAqB,EAAE;AAAA,MAAK,OAAO,EAAE,uBAAuB,MACjE,wBAAwB,MAAM,SAAS,GAAG,QAAQ;AAAA,IACpD;AACJ,WAAO,MAAM;AAAA,EACf;AACA,SAAO,oCAAoC,UAAU,uBAAuB;AAC9E;","names":["createSession","randomUUID","outcome","settled","resumeState","updated","resolveWorkspaceCatalogSettings","applySessionAgentConfigWriteThrough","resolveSessionAgentConfigForCreate","getRig","recordUsageEvent","requireWorkspace","resolveTurnExecutionPolicyV1","createHash","createHash","task","resolveWorkspaceCatalogSettings","settings","requireWorkspace","resolveSessionAgentConfigForCreate","applySessionAgentConfigWriteThrough","getRig","resolveTurnExecutionPolicyV1","recordUsageEvent","result","requireSession","publishDurableSessionEvents","requireSession","publishDurableSessionEvents","createHash","randomUUID","result"]}
+{"version":3,"sources":["../src/activities/knowledge-indexing.ts","../src/activities/codex-capacity.ts","../src/activities/browser-state-artifact-reaper.ts","../src/activities/automations.ts","../src/activities/file-upload-reaper.ts","../src/activities/model-call-fact-reconciler.ts","../src/activities/retained-screenshot-reaper.ts","../src/activities/rig-verification.ts","../src/activities/scheduled-tasks.ts","../src/scheduled-alert-occurrence.ts","../src/activities/session-state.ts","../src/activities/session-archive.ts","../src/activities/session-storage.ts","../src/activities/workflow-wake.ts","../src/activities-control.ts"],"sourcesContent":["import { configuredStaticUsageLimits } from \"@opengeni/config\";\nimport {\n  documentEmbeddingCostMicros,\n  paidDocumentEmbedding,\n  workspaceCreditsDisabled,\n} from \"@opengeni/core\";\nimport {\n  applyCreditDebitAfterUse,\n  appendKnowledgeIndexChunks,\n  claimKnowledgeIndexJobs,\n  checkWorkspaceAllowance,\n  completeKnowledgeIndexJob,\n  continueKnowledgeIndexJob,\n  creditDebitAttributionMetadata,\n  deferKnowledgeIndexJob,\n  freezeKnowledgeIndexBillingMode,\n  getSpendableCreditBalance,\n  guardPaidKnowledgeIndexPublication,\n  knowledgeIndexBillingActivationTime,\n  readKnowledgeIndexSource,\n  recordUsageEvent,\n  sumUsageQuantity,\n  withWorkspaceUsageLock,\n  waitKnowledgeIndexForFunding,\n} from \"@opengeni/db\";\nimport type { DocumentServices } from \"@opengeni/documents\";\nimport type { ControlActivityServices } from \"./types\";\n\n/** The configured monthly indexed-chunk limit, not a provider failure. */\nexport class KnowledgeIndexUsageLimitError extends Error {\n  constructor() {\n    super(\"monthly document indexing limit reached\");\n    this.name = \"KnowledgeIndexUsageLimitError\";\n  }\n}\n\nexport type KnowledgeIndexFailureStage = \"embedding\" | \"processing\";\n\n/**\n * Content-free classification for a deferred Knowledge index batch. Only\n * protocol constants, an HTTP status, and a PostgreSQL SQLSTATE are retained;\n * provider messages, bodies, SQL, and identifiers never leave the process.\n * Outside the embedding call, only a PostgreSQL error in the cause chain is\n * attributed to the database; any other failure stays a worker failure.\n */\nexport function knowledgeIndexFailureDiagnostic(\n  stage: KnowledgeIndexFailureStage,\n  error: unknown,\n): {\n  errorClass: \"KnowledgeIndexOperationError\";\n  errorCode:\n    | \"knowledge_index_usage_limit_reached\"\n    | \"knowledge_index_embedding_failed\"\n    | \"knowledge_index_persistence_failed\"\n    | \"knowledge_index_failed\";\n  origin: \"worker\" | \"db\";\n  status?: number;\n  sqlState?: string;\n} {\n  if (error instanceof KnowledgeIndexUsageLimitError) {\n    return {\n      errorClass: \"KnowledgeIndexOperationError\",\n      errorCode: \"knowledge_index_usage_limit_reached\",\n      origin: \"worker\",\n    };\n  }\n  if (stage === \"embedding\") {\n    const status = ownValue(error, \"status\");\n    return {\n      errorClass: \"KnowledgeIndexOperationError\",\n      errorCode: \"knowledge_index_embedding_failed\",\n      origin: \"worker\",\n      ...(typeof status === \"number\" && Number.isInteger(status) && status >= 100 && status <= 599\n        ? { status }\n        : {}),\n    };\n  }\n  const postgres = postgresErrorState(error);\n  if (!postgres) {\n    return {\n      errorClass: \"KnowledgeIndexOperationError\",\n      errorCode: \"knowledge_index_failed\",\n      origin: \"worker\",\n    };\n  }\n  return {\n    errorClass: \"KnowledgeIndexOperationError\",\n    errorCode: \"knowledge_index_persistence_failed\",\n    origin: \"db\",\n    ...(postgres.sqlState ? { sqlState: postgres.sqlState } : {}),\n  };\n}\n\nfunction ownValue(value: unknown, key: string): unknown {\n  try {\n    if (!value || typeof value !== \"object\") return undefined;\n    const descriptor = Object.getOwnPropertyDescriptor(value, key);\n    return descriptor && \"value\" in descriptor ? descriptor.value : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** The nearest PostgreSQL error in a short cause chain, with its SQLSTATE\n * when that is a well-formed five-character code. */\nfunction postgresErrorState(error: unknown): { sqlState?: string } | undefined {\n  let current = error;\n  for (let depth = 0; depth < 4 && current && typeof current === \"object\"; depth += 1) {\n    if (ownValue(current, \"name\") === \"PostgresError\") {\n      const code = ownValue(current, \"code\");\n      return typeof code === \"string\" && /^[0-9A-Z]{5}$/.test(code) ? { sqlState: code } : {};\n    }\n    current = ownValue(current, \"cause\");\n  }\n  return undefined;\n}\n\nexport function createKnowledgeIndexingActivities(\n  services: () => Promise<ControlActivityServices>,\n  resolveDocumentServices?: () => Promise<DocumentServices>,\n) {\n  // Unpaid modes retain a conservative first-poll cutoff; paid mode uses the\n  // operator's explicit timestamp so process restarts cannot change eligibility.\n  let activationTime: Promise<Date> | undefined;\n  return {\n    indexKnowledge: async () => {\n      const result = { completed: 0, advanced: 0, deferred: 0, unavailable: 0 };\n      if (!resolveDocumentServices) return result;\n      const { db, settings, observability } = await services();\n      let policyActivatedAt: Date;\n      if (paidDocumentEmbedding(settings)) {\n        if (!settings.documentEmbeddingCreditsActivatedAt)\n          throw new Error(\"paid Knowledge embedding requires an activation cutoff\");\n        policyActivatedAt = new Date(settings.documentEmbeddingCreditsActivatedAt);\n      } else {\n        activationTime ??= knowledgeIndexBillingActivationTime(db).catch((error) => {\n          activationTime = undefined;\n          throw error;\n        });\n        policyActivatedAt = await activationTime;\n      }\n      const { embedder } = await resolveDocumentServices();\n      // A claim would only record a failure and push the job's retry out; an\n      // embedder that cannot make any request leaves the queue untouched.\n      if (embedder.available === false) return result;\n      const { knowledgeIndexChunks } = await import(\"@opengeni/documents\");\n      const claims = await claimKnowledgeIndexJobs(db, {\n        model: embedder.model,\n        dimensions: embedder.dimensions,\n        limit: 2,\n      });\n      for (const claim of claims) {\n        let stage: KnowledgeIndexFailureStage = \"processing\";\n        try {\n          const source = await readKnowledgeIndexSource(db, claim);\n          if (!source) {\n            result.unavailable++;\n            continue;\n          }\n          // The checkpoint, usage and post-use debit commit together. A new\n          // generation requires funding once; committed batches may finish even\n          // if their accumulated cost takes the balance below zero.\n          await withWorkspaceUsageLock(db, source.billingWorkspaceId, async (lockedDb) => {\n            const current = await readKnowledgeIndexSource(lockedDb, claim);\n            if (!current) {\n              result.unavailable++;\n              return;\n            }\n            const chunks = [];\n            let more = false;\n            for (const chunk of knowledgeIndexChunks(current.entry)) {\n              if (chunk.index < current.nextIndex) continue;\n              if (chunks.length === 32) {\n                more = true;\n                break;\n              }\n              chunks.push(chunk);\n            }\n            if (chunks.length) {\n              const frozenPolicy = await freezeKnowledgeIndexBillingMode(\n                lockedDb,\n                claim,\n                // Deterministic embeddings incur no provider charge; a valid\n                // credits-mode config with zero tariff must still index them.\n                // OpenAI shadow keeps its price snapshot for internal estimates.\n                settings.documentEmbeddingProvider === \"openai\"\n                  ? (settings.documentEmbeddingBillingMode ?? \"usage_only\")\n                  : \"usage_only\",\n                policyActivatedAt,\n                settings.documentEmbeddingRateMicrosPerMillionBytes ?? 0,\n              );\n              if (frozenPolicy.mode === \"awaiting_review\") {\n                result.deferred++;\n                return;\n              }\n              if (frozenPolicy.mode === \"obsolete\") {\n                result.unavailable++;\n                return;\n              }\n              // An already-priced generation cannot become free when the\n              // operator turns off paid embedding. Retain its checkpoint and\n              // retry only after paid mode is restored; never call the provider\n              // or append a batch that the live policy would not debit.\n              if (frozenPolicy.mode === \"credits\" && !paidDocumentEmbedding(settings)) {\n                await deferKnowledgeIndexJob(lockedDb, claim);\n                result.deferred++;\n                return;\n              }\n              const paid = frozenPolicy.mode === \"credits\";\n              if (paid && claim.billingAttribution.kind === \"unknown\") {\n                // Unknown legacy/source-preparation causality is not service.\n                // Keep the checkpoint without making an uncountable paid call.\n                observability.warn(\"Paid Knowledge indexing awaits initiating attribution\", {\n                  errorCode: \"knowledge_index_attribution_unavailable\",\n                });\n                await deferKnowledgeIndexJob(lockedDb, claim);\n                result.deferred++;\n                return;\n              }\n              // A workspace that turned Opengeni credits off is never debited.\n              // Wait like an unfunded generation (no provider call, checkpoint\n              // kept); the job re-checks each minute and resumes once credits\n              // are turned back on.\n              if (paid && (await workspaceCreditsDisabled(lockedDb, current.billingWorkspaceId))) {\n                await waitKnowledgeIndexForFunding(lockedDb, claim);\n                result.deferred++;\n                return;\n              }\n              if (paid && current.nextIndex === 0) {\n                const balance = await getSpendableCreditBalance(lockedDb, claim.accountId);\n                if (balance.balanceMicros <= 0) {\n                  await waitKnowledgeIndexForFunding(lockedDb, claim);\n                  result.deferred++;\n                  return;\n                }\n              }\n              if (paid) {\n                const refusal = await checkWorkspaceAllowance(lockedDb, {\n                  accountId: claim.accountId,\n                  workspaceId: current.billingWorkspaceId,\n                  subjectId:\n                    claim.billingAttribution.kind === \"turn\" ||\n                    claim.billingAttribution.kind === \"human\"\n                      ? claim.billingAttribution.initiatingHumanSubjectId\n                      : null,\n                });\n                if (refusal) {\n                  await deferKnowledgeIndexJob(lockedDb, claim);\n                  result.deferred++;\n                  return;\n                }\n              }\n              if (settings.usageLimitsMode === \"static\" || settings.usageLimitsMode === \"managed\") {\n                const limit =\n                  configuredStaticUsageLimits(settings).maxDocumentIndexedChunksPerWorkspace;\n                if (limit) {\n                  const now = new Date();\n                  const used = await sumUsageQuantity(lockedDb, {\n                    workspaceId: current.billingWorkspaceId,\n                    eventType: \"document.indexed\",\n                    since: new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1)),\n                  });\n                  if (used + chunks.length > limit) throw new KnowledgeIndexUsageLimitError();\n                }\n              }\n              const inputs = chunks.map((chunk) => chunk.embeddingInput);\n              const bytes = inputs.reduce(\n                (sum, input) => sum + Buffer.byteLength(input, \"utf8\"),\n                0,\n              );\n              stage = \"embedding\";\n              const vectors = await embedder.embedMany(inputs);\n              if (vectors.length !== chunks.length)\n                throw new Error(\"Incomplete Knowledge embeddings\");\n              stage = \"processing\";\n              // A reviewer may have rejected this revision during the provider\n              // call. The DB guard holds its publication row through settlement.\n              if (paid) {\n                const publication = await guardPaidKnowledgeIndexPublication(lockedDb, claim);\n                if (publication !== \"published\") {\n                  if (publication === \"obsolete\") result.unavailable++;\n                  else result.deferred++;\n                  return;\n                }\n              }\n              const appended = await appendKnowledgeIndexChunks(\n                lockedDb,\n                claim,\n                current.nextIndex,\n                chunks.map((chunk, index) => ({ ...chunk, embedding: vectors[index]! })),\n              );\n              if (appended.status !== \"running\") {\n                result.unavailable++;\n                return;\n              }\n              await recordUsageEvent(lockedDb, {\n                accountId: claim.accountId,\n                workspaceId: current.billingWorkspaceId,\n                eventType: \"document.indexed\",\n                quantity: chunks.length,\n                unit: \"chunk\",\n                sourceResourceType: \"knowledge_revision\",\n                sourceResourceId: claim.revisionId,\n                idempotencyKey: `knowledge.indexed:${claim.revisionId}:${claim.generation}:${current.nextIndex}`,\n              });\n              await recordUsageEvent(lockedDb, {\n                accountId: claim.accountId,\n                workspaceId: current.billingWorkspaceId,\n                eventType: \"document.embedding_bytes\",\n                quantity: bytes,\n                unit: \"byte\",\n                sourceResourceType: \"knowledge_revision\",\n                sourceResourceId: claim.revisionId,\n                idempotencyKey: `knowledge.embedding_bytes:${claim.revisionId}:${claim.generation}:${current.nextIndex}`,\n              });\n              if (frozenPolicy.mode === \"shadow\" && frozenPolicy.rateMicrosPerMillionBytes > 0) {\n                const estimate = documentEmbeddingCostMicros(\n                  {\n                    ...settings,\n                    documentEmbeddingRateMicrosPerMillionBytes:\n                      frozenPolicy.rateMicrosPerMillionBytes,\n                  },\n                  bytes,\n                );\n                if (estimate > 0)\n                  await recordUsageEvent(lockedDb, {\n                    accountId: claim.accountId,\n                    workspaceId: current.billingWorkspaceId,\n                    eventType: \"document.embedding_shadow_estimate\",\n                    quantity: estimate,\n                    unit: \"micro_usd\",\n                    sourceResourceType: \"knowledge_revision\",\n                    sourceResourceId: claim.revisionId,\n                    idempotencyKey: `knowledge.embedding_shadow:${claim.revisionId}:${claim.generation}:${current.nextIndex}`,\n                  });\n              }\n              if (paid) {\n                const cost = documentEmbeddingCostMicros(\n                  {\n                    ...settings,\n                    documentEmbeddingRateMicrosPerMillionBytes:\n                      frozenPolicy.rateMicrosPerMillionBytes,\n                  },\n                  bytes,\n                );\n                if (cost > 0)\n                  await applyCreditDebitAfterUse(lockedDb, {\n                    accountId: claim.accountId,\n                    workspaceId: current.billingWorkspaceId,\n                    type: \"document_embedding_debit\",\n                    amountMicros: cost,\n                    sourceType: \"knowledge_revision\",\n                    sourceId: claim.revisionId,\n                    idempotencyKey: `knowledge.embedding:${claim.revisionId}:${claim.generation}:${current.nextIndex}`,\n                    metadata: {\n                      ...creditDebitAttributionMetadata(claim.billingAttribution),\n                      model: claim.model,\n                      bytes,\n                      chunks: chunks.length,\n                      rateMicrosPerMillionBytes: frozenPolicy.rateMicrosPerMillionBytes,\n                    },\n                  });\n              }\n            }\n            if (more) {\n              await continueKnowledgeIndexJob(lockedDb, claim);\n              result.advanced++;\n            } else {\n              const completed = await completeKnowledgeIndexJob(\n                lockedDb,\n                claim,\n                current.nextIndex + chunks.length,\n              );\n              if (completed.status === \"ready\") result.completed++;\n              else result.unavailable++;\n            }\n          });\n        } catch (error) {\n          // Provider failures retain the last completed projection. The durable\n          // queue owns retry/backoff; do not retry an entire activity implicitly.\n          // The stored reason stays the SQL lifecycle's fixed code; the log\n          // carries the content-free class/code of the actual cause.\n          observability.warn(\n            \"Knowledge indexing batch deferred\",\n            knowledgeIndexFailureDiagnostic(stage, error),\n          );\n          await deferKnowledgeIndexJob(db, claim).catch((deferError: unknown) => {\n            const deferDiagnostic = knowledgeIndexFailureDiagnostic(\"processing\", deferError);\n            observability.warn(\"Knowledge indexing batch deferral failed\", {\n              ...deferDiagnostic,\n              errorCode: \"knowledge_index_defer_failed\",\n            });\n          });\n          result.deferred++;\n        }\n      }\n      return result;\n    },\n  };\n}\n","import {\n  getSubscriptionCoreCapacityWaitForSession,\n  subscriptionCoreCapacityWaitRef,\n} from \"@opengeni/db\";\n\nimport { reconcileCoreCapacityWait } from \"./subscription-core-codex-waits\";\nimport { subscriptionCoreWaitBindings } from \"./subscription-core-wait-bindings\";\n\nimport type {\n  ControlActivityServices,\n  GetCodexCapacityWaitInput,\n  ReconcileCodexCapacityWaitInput,\n  ReconcileCodexCapacityWaitResult,\n} from \"./types\";\n\nexport function createCodexCapacityActivities(services: () => Promise<ControlActivityServices>) {\n  async function getCodexCapacityWait(input: GetCodexCapacityWaitInput) {\n    const { db } = await services();\n    // A core waiter (shared subscription core) is the only waiter written\n    // after its provider's cutover. A Codex one keeps the legacy Codex\n    // reference shape; a SuperGrok one carries `provider: \"xai\"` and a\n    // Claude one `provider: \"claude\"`, so their reconcile also looks the core\n    // up first.\n    const coreWaiter = await getSubscriptionCoreCapacityWaitForSession(\n      db,\n      input.workspaceId,\n      input.sessionId,\n    );\n    if (coreWaiter) return subscriptionCoreCapacityWaitRef(coreWaiter);\n    return null;\n  }\n\n  async function reconcileCodexCapacityWait(\n    input: ReconcileCodexCapacityWaitInput,\n  ): Promise<ReconcileCodexCapacityWaitResult> {\n    const resolved = await services();\n    // Histories without a provider keep the original Codex binding. Migrated\n    // waiters retain their ids/generations; lookup never infers new authority.\n    const binding = subscriptionCoreWaitBindings().find(\n      (candidate) => candidate.provider === (input.provider ?? \"codex\"),\n    );\n    if (!binding) return { action: \"stale\" };\n    const core = await reconcileCoreCapacityWait(resolved, binding, {\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      sessionId: input.sessionId,\n      waiterId: input.waiterId,\n      generation: input.generation,\n    });\n    return core ?? { action: \"stale\" };\n  }\n\n  return { getCodexCapacityWait, reconcileCodexCapacityWait };\n}\n","import {\n  claimBrowserStateArtifactCleanup,\n  claimBrowserStateUploadCleanup,\n  completeBrowserStateArtifactCleanup,\n  completeBrowserStateUploadCleanup,\n  type BrowserStateArtifactCleanupClaim,\n  type BrowserStateUploadCleanupClaim,\n} from \"@opengeni/db\";\nimport type { ObjectStorage } from \"@opengeni/storage\";\nimport type { ControlActivityServices } from \"./types\";\n\nexport const BROWSER_STATE_ARTIFACT_CLAIM_TIMEOUT_MS = 10 * 60 * 1_000;\nexport const BROWSER_STATE_ARTIFACT_CLEANUP_BATCH_SIZE = 100;\n\nconst SAFE_PROVIDER_ERROR_CODES = new Set([\n  \"aborted\",\n  \"conflict\",\n  \"network\",\n  \"not_found\",\n  \"permission_denied\",\n  \"provider\",\n  \"timeout\",\n  \"unavailable\",\n]);\n\nexport type MaintainBrowserStateArtifactsResult = {\n  claimed: number;\n  deleted: number;\n  retryable: number;\n};\n\nexport type BrowserStateArtifactMaintenanceOptions = {\n  claimTimeoutMs?: number;\n  batchSize?: number;\n  claimArtifacts?: typeof claimBrowserStateArtifactCleanup;\n  completeArtifact?: typeof completeBrowserStateArtifactCleanup;\n  claimUploads?: typeof claimBrowserStateUploadCleanup;\n  completeUpload?: typeof completeBrowserStateUploadCleanup;\n  /** Failure-injection seam; production uses the configured provider delete. */\n  deleteObject?: (storage: ObjectStorage, key: string) => Promise<void>;\n};\n\n/**\n * Reap retired encrypted private browser checkpoints. Provider deletion happens\n * before terminal settlement; a crash or provider failure leaves the durable\n * claim reclaimable and an already-deleted provider key is safe to retry.\n */\nexport function createBrowserStateArtifactMaintenanceActivities(\n  services: () => Promise<ControlActivityServices>,\n  options: BrowserStateArtifactMaintenanceOptions = {},\n) {\n  const claimTimeoutMs = options.claimTimeoutMs ?? BROWSER_STATE_ARTIFACT_CLAIM_TIMEOUT_MS;\n  const batchSize = options.batchSize ?? BROWSER_STATE_ARTIFACT_CLEANUP_BATCH_SIZE;\n  const claimArtifacts = options.claimArtifacts ?? claimBrowserStateArtifactCleanup;\n  const completeArtifact = options.completeArtifact ?? completeBrowserStateArtifactCleanup;\n  const claimUploads = options.claimUploads ?? claimBrowserStateUploadCleanup;\n  const completeUpload = options.completeUpload ?? completeBrowserStateUploadCleanup;\n  const deleteObject = options.deleteObject ?? ((storage, key) => storage.deleteObject(key));\n\n  async function maintainBrowserStateArtifacts(): Promise<MaintainBrowserStateArtifactsResult> {\n    const { db, objectStorage, observability } = await services();\n    if (!objectStorage) return { claimed: 0, deleted: 0, retryable: 0 };\n\n    const [artifactClaims, uploadClaims] = await Promise.all([\n      claimArtifacts(db, { claimTimeoutMs, limit: batchSize }),\n      claimUploads(db, { claimTimeoutMs, limit: batchSize }),\n    ]);\n    const result: MaintainBrowserStateArtifactsResult = {\n      claimed: artifactClaims.length + uploadClaims.length,\n      deleted: 0,\n      retryable: 0,\n    };\n    for (const cleanup of artifactClaims) {\n      try {\n        await deleteObject(objectStorage, cleanup.objectKey);\n        if (!(await completeArtifact(db, cleanup))) {\n          throw new Error(\"browser state artifact cleanup claim was superseded\");\n        }\n        result.deleted += 1;\n      } catch (error) {\n        result.retryable += 1;\n        observability.warn(\"browser state artifact cleanup failed; claim remains reclaimable\", {\n          workspaceId: cleanup.workspaceId,\n          artifactId: cleanup.artifactId,\n          errorCategory: cleanupErrorCategory(error),\n        });\n      }\n    }\n    for (const cleanup of uploadClaims) {\n      try {\n        await deleteObject(objectStorage, cleanup.objectKey);\n        if (!(await completeUpload(db, cleanup))) {\n          throw new Error(\"browser state upload cleanup claim was superseded\");\n        }\n        result.deleted += 1;\n      } catch (error) {\n        result.retryable += 1;\n        observability.warn(\"browser state upload cleanup failed; claim remains reclaimable\", {\n          workspaceId: cleanup.workspaceId,\n          uploadId: cleanup.uploadId,\n          errorCategory: cleanupErrorCategory(error),\n        });\n      }\n    }\n    if (result.claimed > 0) {\n      observability.info(\"browser state artifact maintenance swept\", result);\n    }\n    return result;\n  }\n\n  return { maintainBrowserStateArtifacts };\n}\n\nfunction cleanupErrorCategory(error: unknown): string {\n  if (!error || typeof error !== \"object\") return \"unknown\";\n  const code = (error as { code?: unknown }).code;\n  return typeof code === \"string\" && SAFE_PROVIDER_ERROR_CODES.has(code) ? code : \"unknown\";\n}\n\nexport type { BrowserStateArtifactCleanupClaim, BrowserStateUploadCleanupClaim };\n","import {\n  resolveTurnExecutionPolicyV1,\n  WORKSPACE_GATEWAY_MODEL_ID_PREFIX,\n  WORKSPACE_OPENROUTER_MODEL_ID_PREFIX,\n  WORKSPACE_OPPER_MODEL_ID_PREFIX,\n} from \"@opengeni/config\";\nimport {\n  applySessionAgentConfigWriteThrough,\n  assertWorkspaceModelPolicyAllows,\n  canonicalConfiguredModel,\n  resolveSessionAgentConfigForCreate,\n  createAndStartSessionWithOutcome,\n  recordWorkspaceUsage,\n  resolveCatalogSettings,\n  resolveWorkspaceCatalogSettings,\n  isDeveloperSetupDelegatedPermissionAllowed,\n} from \"@opengeni/core\";\nimport {\n  AutomationAuthorityRevokedError,\n  assertAutomationRunAuthorityInTransaction,\n  claimAutomationRun,\n  settleAutomationRun,\n  requireWorkspace,\n} from \"@opengeni/db\";\nimport { SessionSkills } from \"@opengeni/contracts\";\nimport { agentRunAdmissionDenial } from \"./agent-run-admission\";\nimport type {\n  ControlActivityServices,\n  DispatchAutomationRunInput,\n  DispatchAutomationRunResult,\n} from \"./types\";\n\nexport type AutomationActivityOptions = {\n  claim?: typeof claimAutomationRun;\n  settle?: typeof settleAutomationRun;\n  assertAuthority?: typeof assertAutomationRunAuthorityInTransaction;\n  createSession?: typeof createAndStartSessionWithOutcome;\n  /** Workspace read for agent-configuration defaults (tests inject it). */\n  readWorkspace?: typeof requireWorkspace;\n  admit?: typeof agentRunAdmissionDenial;\n  assertModelPolicy?: typeof assertWorkspaceModelPolicyAllows;\n  recordUsage?: typeof recordWorkspaceUsage;\n};\n\nexport function createAutomationActivities(\n  services: () => Promise<ControlActivityServices>,\n  options: AutomationActivityOptions = {},\n) {\n  const claim = options.claim ?? claimAutomationRun;\n  const settle = options.settle ?? settleAutomationRun;\n  const assertAuthority = options.assertAuthority ?? assertAutomationRunAuthorityInTransaction;\n  const createSession = options.createSession ?? createAndStartSessionWithOutcome;\n  const readWorkspace = options.readWorkspace ?? requireWorkspace;\n  const admit = options.admit ?? agentRunAdmissionDenial;\n  const assertModelPolicy = options.assertModelPolicy ?? assertWorkspaceModelPolicyAllows;\n  const recordUsage = options.recordUsage ?? recordWorkspaceUsage;\n  return {\n    settleAutomationRunFailure: async (input: DispatchAutomationRunInput): Promise<void> => {\n      const service = await services();\n      await settle(service.db, {\n        workspaceId: input.workspaceId,\n        runId: input.runId,\n        status: \"failed\",\n        errorCode: \"dispatch_failed\",\n      });\n    },\n    dispatchAutomationRun: async (\n      input: DispatchAutomationRunInput,\n    ): Promise<DispatchAutomationRunResult> => {\n      const service = await services();\n      const catalogSourceSettings = service.catalogSourceSettings ?? service.settings;\n      const deploymentCatalogSettings = (\n        await resolveCatalogSettings(service.db, catalogSourceSettings)\n      ).settings;\n      const run = await claim(service.db, input);\n      if (!run) return { action: \"not_found\" };\n      if (run.status === \"dispatched\") {\n        if (!run.sessionId) throw new Error(\"dispatched automation run is missing its session\");\n        return { action: \"already_dispatched\", sessionId: run.sessionId };\n      }\n      if (run.status === \"skipped\") {\n        return {\n          action: \"skipped\",\n          reason: run.errorCode ?? \"authority_revoked\",\n        };\n      }\n      if (run.status === \"failed\") {\n        return { action: \"failed\", reason: run.errorCode ?? \"dispatch_failed\" };\n      }\n\n      try {\n        const accepted = run.acceptedExecution;\n        if (\n          accepted.accountId !== input.accountId ||\n          accepted.workspaceId !== input.workspaceId ||\n          accepted.sourceId !== run.sourceId ||\n          accepted.triggerId !== run.triggerId ||\n          accepted.triggerRevision !== run.triggerRevision ||\n          accepted.eventId !== run.eventId\n        ) {\n          await settle(service.db, {\n            workspaceId: input.workspaceId,\n            runId: run.id,\n            status: \"skipped\",\n            errorCode: \"accepted_execution_mismatch\",\n          });\n          return { action: \"skipped\", reason: \"accepted_execution_mismatch\" };\n        }\n\n        const template = accepted.sessionTemplate;\n        if (\n          template.credentialRestriction === \"developer_setup\" &&\n          template.firstPartyMcpPermissions.some(\n            (permission) => !isDeveloperSetupDelegatedPermissionAllowed(permission),\n          )\n        ) {\n          await settle(service.db, {\n            workspaceId: input.workspaceId,\n            runId: run.id,\n            status: \"failed\",\n            errorCode: \"credential_restriction_violation\",\n          });\n          return { action: \"failed\", reason: \"credential_restriction_violation\" };\n        }\n        const requestedModel = template.model ?? deploymentCatalogSettings.openaiModel;\n        const catalogSettings =\n          requestedModel.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX) ||\n          requestedModel.startsWith(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX) ||\n          requestedModel.startsWith(WORKSPACE_OPPER_MODEL_ID_PREFIX)\n            ? (\n                await resolveWorkspaceCatalogSettings(service.db, catalogSourceSettings, {\n                  accountId: input.accountId,\n                  workspaceId: input.workspaceId,\n                  retainedProductModelId: requestedModel,\n                })\n              ).settings\n            : deploymentCatalogSettings;\n        const catalogService = { ...service, settings: catalogSettings };\n        let model: string;\n        try {\n          const configuredModel = canonicalConfiguredModel(catalogSettings, requestedModel);\n          if (!configuredModel) throw new Error(\"automation has no configured model\");\n          await assertModelPolicy(service.db, catalogSettings, input.workspaceId, configuredModel);\n          model = configuredModel;\n        } catch (error) {\n          if (!isUnprocessableEntity(error)) throw error;\n          await settle(service.db, {\n            workspaceId: input.workspaceId,\n            runId: run.id,\n            status: \"failed\",\n            errorCode: \"dispatch_failed\",\n          });\n          return { action: \"failed\", reason: \"dispatch_failed\" };\n        }\n        const denial = await admit(catalogService, {\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          model,\n          requestedAgentRuns: 1,\n        });\n        if (denial) {\n          await settle(service.db, {\n            workspaceId: input.workspaceId,\n            runId: run.id,\n            status: \"failed\",\n            errorCode: denial,\n          });\n          return { action: \"failed\", reason: denial };\n        }\n        const reasoningEffort = template.reasoningEffort ?? catalogSettings.openaiReasoningEffort;\n        const sandboxBackend = template.sandboxBackend ?? catalogSettings.sandboxBackend;\n        if (sandboxBackend === \"selfhosted\") {\n          await settle(service.db, {\n            workspaceId: input.workspaceId,\n            runId: run.id,\n            status: \"skipped\",\n            errorCode: \"interactive_compute_not_allowed\",\n          });\n          return {\n            action: \"skipped\",\n            reason: \"interactive_compute_not_allowed\",\n          };\n        }\n        // Agent configuration for the generated session (null = legacy). The\n        // template's explicit tools are its baseline; capabilities only narrow.\n        let agentWriteThrough: {\n          config: import(\"@opengeni/contracts\").ResolvedAgentConfig | null;\n          instructions: string | undefined;\n          firstPartyMcpTools: typeof template.firstPartyMcpTools;\n          tools: typeof template.tools;\n        };\n        try {\n          const workspaceSettings = (await readWorkspace(service.db, input.workspaceId)).settings;\n          const resolution = resolveSessionAgentConfigForCreate({\n            settings: catalogSettings,\n            creator: \"automation\",\n            request: template.agent,\n            instructions: template.instructions ?? undefined,\n            workspaceSettings,\n            parent: null,\n            goal: false,\n          });\n          const written = applySessionAgentConfigWriteThrough({\n            config: resolution.config,\n            firstPartyMcpTools: template.firstPartyMcpTools,\n            tools: template.tools,\n            toolPolicy: { mode: \"explicit\", inheritedFromSessionId: null },\n            productServerIds: template.tools.map((tool) => tool.id),\n          });\n          agentWriteThrough = {\n            config: resolution.config,\n            instructions: resolution.instructions,\n            firstPartyMcpTools: written.firstPartyMcpTools,\n            tools: written.tools,\n          };\n        } catch (error) {\n          if (!isUnprocessableEntity(error)) throw error;\n          await settle(service.db, {\n            workspaceId: input.workspaceId,\n            runId: run.id,\n            status: \"failed\",\n            errorCode: \"dispatch_failed\",\n          });\n          return { action: \"failed\", reason: \"dispatch_failed\" };\n        }\n        const resolvedTurnExecutionPolicy = resolveTurnExecutionPolicyV1(catalogSettings, {\n          modelId: model,\n          requestedModelId: template.model,\n          modelSource: template.model ? \"explicit\" : \"deployment\",\n          reasoningEffort,\n          reasoningSource: template.reasoningEffort ? \"explicit\" : \"deployment\",\n          latencyMode: \"standard\",\n          latencyModeSource: \"deployment\",\n        });\n        const turnExecutionPolicy = template.credentialRestriction\n          ? {\n              ...resolvedTurnExecutionPolicy,\n              credentialRestriction: template.credentialRestriction,\n            }\n          : resolvedTurnExecutionPolicy;\n        const created = await createSession({\n          db: service.db,\n          bus: service.bus,\n          workflowClient: {\n            wakeSessionWorkflow: async (wake) => {\n              await service.wakeSessionWorkflow?.(wake);\n            },\n          },\n          beforeCreateCommit: async (tx, sessionId) => {\n            await assertAuthority(tx, {\n              workspaceId: input.workspaceId,\n              runId: run.id,\n              triggerId: accepted.triggerId,\n              triggerRevision: accepted.triggerRevision,\n              sourceId: accepted.sourceId,\n              sourceVersion: accepted.sourceVersion,\n              sessionId,\n            });\n          },\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          initialMessage: accepted.initialMessage,\n          surface: \"automation\",\n          metrics: service.observability,\n          resources: template.resources,\n          skills: SessionSkills.parse(template.skills),\n          bundledSkillIds: template.bundledSkillIds,\n          tools: agentWriteThrough.tools,\n          toolPolicy: { mode: \"explicit\", inheritedFromSessionId: null },\n          model,\n          reasoningEffort,\n          turnExecutionPolicy,\n          sandboxBackend,\n          metadata: {\n            ...template.metadata,\n            automationRunId: run.id,\n            automationSourceId: run.sourceId,\n            automationTriggerId: run.triggerId,\n            automationTriggerRevision: run.triggerRevision,\n          },\n          createdBy: {\n            kind: \"service\",\n            subjectId: accepted.serviceSubjectId,\n            label: accepted.serviceLabel,\n          },\n          createdByContext: accepted.provenance,\n          instructions: agentWriteThrough.instructions ?? template.instructions,\n          policyRole: template.policyRole,\n          firstPartyMcpPermissions: template.firstPartyMcpPermissions,\n          firstPartyMcpTools: agentWriteThrough.firstPartyMcpTools,\n          ...(agentWriteThrough.config ? { agentConfig: agentWriteThrough.config } : {}),\n          retainWorkspaceCustomModel:\n            model.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX) ||\n            model.startsWith(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX) ||\n            model.startsWith(WORKSPACE_OPPER_MODEL_ID_PREFIX),\n          createIdempotencyKey: `automation-run:${run.id}`,\n          subjectId: accepted.serviceSubjectId,\n        });\n        await recordUsage(\n          { db: service.db, settings: catalogSettings },\n          {\n            accountId: input.accountId,\n            workspaceId: input.workspaceId,\n            subjectId: accepted.serviceSubjectId,\n            eventType: \"agent_run.created\",\n            quantity: 1,\n            unit: \"run\",\n            sourceResourceType: \"automation_run\",\n            sourceResourceId: run.id,\n            sessionId: created.session.id,\n            initiator: created.session.createdBy,\n            initiatorContext: created.session.createdByContext,\n            origin: \"system\",\n            idempotencyKey: `agent_run.created:automation:${run.id}`,\n          },\n        ).catch((error) => {\n          service.observability.warn(\"automation usage recording failed\", {\n            workspaceId: input.workspaceId,\n            runId: run.id,\n            errorCategory: error instanceof Error ? error.name : \"unknown\",\n          });\n        });\n        return { action: \"started\", sessionId: created.session.id };\n      } catch (error) {\n        if (error instanceof AutomationAuthorityRevokedError) {\n          await settle(service.db, {\n            workspaceId: input.workspaceId,\n            runId: run.id,\n            status: \"skipped\",\n            errorCode: \"authority_revoked\",\n          });\n          return { action: \"skipped\", reason: \"authority_revoked\" };\n        }\n        throw error;\n      }\n    },\n  };\n}\n\nfunction isUnprocessableEntity(error: unknown): boolean {\n  return (\n    error instanceof Error &&\n    \"status\" in error &&\n    (error as Error & { status?: unknown }).status === 422\n  );\n}\n","import {\n  claimDueTranscriptionRecordingObjectCleanup,\n  claimExpiredFileUploadCleanup,\n  completeDueTranscriptionRecordingObjectCleanup,\n  completeExpiredFileUploadCleanup,\n  claimVideoGenerationOperations,\n  purgeExpiredTranscriptionRecordings,\n} from \"@opengeni/db\";\nimport type { ObjectStorage } from \"@opengeni/storage\";\nimport type { ControlActivityServices } from \"./types\";\nimport { randomUUID } from \"node:crypto\";\n\nexport const FILE_UPLOAD_CLEANUP_GRACE_MS = 60 * 60 * 1_000;\nexport const FILE_UPLOAD_CLEANUP_CLAIM_TIMEOUT_MS = 10 * 60 * 1_000;\nexport const FILE_UPLOAD_CLEANUP_BATCH_SIZE = 100;\nconst SAFE_CLEANUP_ERROR_CATEGORIES = new Set([\n  \"aborted\",\n  \"conflict\",\n  \"invalid_response\",\n  \"network\",\n  \"not_found\",\n  \"permission_denied\",\n  \"provider\",\n  \"timeout\",\n  \"unavailable\",\n]);\n\nfunction cleanupErrorAttributes(error: unknown): {\n  errorCategory: string;\n  errorStatus?: number;\n} {\n  let errorCategory = \"provider_error\";\n  let errorStatus: number | undefined;\n  if (error && typeof error === \"object\") {\n    const rawCode = (error as { code?: unknown }).code;\n    if (typeof rawCode === \"string\" && SAFE_CLEANUP_ERROR_CATEGORIES.has(rawCode)) {\n      errorCategory = rawCode;\n    } else if (rawCode !== undefined) {\n      errorCategory = \"unknown\";\n    }\n    const rawStatus = Number(\n      (error as { status?: unknown; statusCode?: unknown }).status ??\n        (error as { statusCode?: unknown }).statusCode,\n    );\n    if (Number.isInteger(rawStatus) && rawStatus >= 100 && rawStatus <= 599) {\n      errorStatus = rawStatus;\n    }\n  }\n  return { errorCategory, ...(errorStatus === undefined ? {} : { errorStatus }) };\n}\n\nexport type ReapExpiredFileUploadsResult = {\n  claimed: number;\n  deleted: number;\n  failed: number;\n};\n\nexport type FileUploadReaperActivityOptions = {\n  graceMs?: number;\n  claimTimeoutMs?: number;\n  batchSize?: number;\n  /** Failure-injection seam; production uses the configured provider delete. */\n  deleteObject?: (storage: ObjectStorage, key: string) => Promise<void>;\n  claimFileUploads?: typeof claimExpiredFileUploadCleanup;\n  completeFileUpload?: typeof completeExpiredFileUploadCleanup;\n  claimTranscriptionObjects?: typeof claimDueTranscriptionRecordingObjectCleanup;\n  completeTranscriptionObject?: typeof completeDueTranscriptionRecordingObjectCleanup;\n  purgeTranscriptionRecordings?: typeof purgeExpiredTranscriptionRecordings;\n};\n\n/**\n * Build the provider-neutral expired direct-upload reaper. Claims are durable\n * and reclaimable; object deletion is idempotent; only a successful delete is\n * settled terminally. One provider failure never aborts the rest of the batch.\n */\nexport function createFileUploadReaperActivities(\n  services: () => Promise<ControlActivityServices>,\n  options: FileUploadReaperActivityOptions = {},\n) {\n  const graceMs = options.graceMs ?? FILE_UPLOAD_CLEANUP_GRACE_MS;\n  const claimTimeoutMs = options.claimTimeoutMs ?? FILE_UPLOAD_CLEANUP_CLAIM_TIMEOUT_MS;\n  const batchSize = options.batchSize ?? FILE_UPLOAD_CLEANUP_BATCH_SIZE;\n  const deleteObject = options.deleteObject ?? (async (storage, key) => storage.deleteObject(key));\n  const claimFileUploads = options.claimFileUploads ?? claimExpiredFileUploadCleanup;\n  const completeFileUpload = options.completeFileUpload ?? completeExpiredFileUploadCleanup;\n  const claimTranscriptionObjects =\n    options.claimTranscriptionObjects ?? claimDueTranscriptionRecordingObjectCleanup;\n  const completeTranscriptionObject =\n    options.completeTranscriptionObject ?? completeDueTranscriptionRecordingObjectCleanup;\n  const purgeTranscriptionRecordings =\n    options.purgeTranscriptionRecordings ?? purgeExpiredTranscriptionRecordings;\n\n  async function reapExpiredFileUploads(): Promise<ReapExpiredFileUploadsResult> {\n    const { db, objectStorage, observability } = await services();\n    if (!objectStorage) {\n      try {\n        await purgeTranscriptionRecordings(db, { graceMs, limit: batchSize });\n      } catch (error) {\n        observability.warn(\"expired transcription recording metadata purge failed\", {\n          ...cleanupErrorAttributes(error),\n        });\n      }\n      return { claimed: 0, deleted: 0, failed: 0 };\n    }\n\n    const claims = await claimFileUploads(db, {\n      graceMs,\n      claimTimeoutMs,\n      limit: batchSize,\n    });\n    let deleted = 0;\n    let failed = 0;\n    for (const claim of claims) {\n      try {\n        await deleteObject(objectStorage, claim.objectKey);\n        const settled = await completeFileUpload(db, claim);\n        if (!settled) {\n          throw new Error(\"cleanup claim no longer owns a reclaimable upload\");\n        }\n        deleted += 1;\n      } catch (error) {\n        failed += 1;\n        observability.warn(\"expired file upload cleanup failed; claim remains reclaimable\", {\n          workspaceId: claim.workspaceId,\n          uploadId: claim.uploadId,\n          fileId: claim.fileId,\n          ...cleanupErrorAttributes(error),\n        });\n      }\n    }\n    const recordingClaims = await claimTranscriptionObjects(db, {\n      graceMs,\n      claimTimeoutMs,\n      limit: batchSize,\n    });\n    for (const claim of recordingClaims) {\n      try {\n        await deleteObject(objectStorage, claim.objectKey);\n        const settled = await completeTranscriptionObject(db, claim);\n        if (!settled) {\n          throw new Error(\"cleanup claim no longer owns a transcription recording object\");\n        }\n        deleted += 1;\n      } catch (error) {\n        failed += 1;\n        observability.warn(\n          \"expired transcription recording object cleanup failed; claim remains reclaimable\",\n          {\n            workspaceId: claim.workspaceId,\n            recordingId: claim.recordingId,\n            ...cleanupErrorAttributes(error),\n          },\n        );\n      }\n    }\n    let transcriptionRecordingsPurged = 0;\n    try {\n      transcriptionRecordingsPurged = await purgeTranscriptionRecordings(db, {\n        graceMs,\n        limit: batchSize,\n      });\n    } catch (error) {\n      observability.warn(\"expired transcription recording metadata purge failed\", {\n        ...cleanupErrorAttributes(error),\n      });\n    }\n    const claimed = claims.length + recordingClaims.length;\n    if (claimed > 0 || transcriptionRecordingsPurged > 0) {\n      observability.info(\"expired file upload cleanup swept\", {\n        claimed,\n        deleted,\n        failed,\n        fileUploads: claims.length,\n        transcriptionRecordingObjects: recordingClaims.length,\n        transcriptionRecordingsPurged,\n      });\n    }\n    return { claimed, deleted, failed };\n  }\n\n  async function recoverVideoGenerationWorkflows(): Promise<{\n    claimed: number;\n    started: number;\n    failed: number;\n  }> {\n    const { db, startVideoGenerationWorkflow, observability } = await services();\n    if (!startVideoGenerationWorkflow) return { claimed: 0, started: 0, failed: 0 };\n    const claims = await claimVideoGenerationOperations(db, {\n      owner: `video-workflow-recovery:${randomUUID()}`,\n      leaseSeconds: 120,\n      limit: 100,\n    });\n    let started = 0;\n    let failed = 0;\n    for (const claim of claims) {\n      try {\n        await startVideoGenerationWorkflow(claim);\n        started += 1;\n      } catch (error) {\n        failed += 1;\n        observability.warn(\"Video generation workflow recovery start failed\", {\n          operationId: claim.operationId,\n          errorClass: error instanceof Error ? error.name : \"UnknownError\",\n        });\n      }\n    }\n    return { claimed: claims.length, started, failed };\n  }\n\n  return { reapExpiredFileUploads, recoverVideoGenerationWorkflows };\n}\n","import { randomUUID } from \"node:crypto\";\nimport { listWorkspaceIdsAfter, reconcileModelCallFacts } from \"@opengeni/db\";\nimport type { ControlActivityServices } from \"./types\";\n\n/** Recent charged calls are rechecked on every run; older gaps use the backfill script. */\nexport const MODEL_CALL_FACT_RECONCILE_LOOKBACK_MS = 2 * 60 * 60 * 1_000;\n/** Skip the newest calls so a live fact write is not raced by its own repair. */\nexport const MODEL_CALL_FACT_RECONCILE_SETTLE_MS = 10 * 60 * 1_000;\nexport const MODEL_CALL_FACT_RECONCILE_WORKSPACE_LIMIT = 500;\nexport const MODEL_CALL_FACT_RECONCILE_RUN_BUDGET_MS = 3 * 60 * 1_000;\nconst WORKSPACE_PAGE_SIZE = 200;\n\nexport type ReconcileRecentModelCallFactsResult = {\n  workspaces: number;\n  missing: number;\n  repaired: number;\n  unrepaired: number;\n  /** Workspaces with more missing facts than one bounded pass examines. */\n  truncatedWorkspaces: number;\n  failedWorkspaces: number;\n  budgetExhausted: boolean;\n};\n\nexport type ModelCallFactReconcilerOptions = {\n  now?: () => number;\n  runBudgetMs?: number;\n  startAfterWorkspaceId?: () => string;\n  reconcile?: typeof reconcileModelCallFacts;\n  listWorkspaces?: typeof listWorkspaceIdsAfter;\n};\n\n/**\n * Rebuild missing Insights call facts for recently charged model calls. Each\n * workspace pass is bounded and idempotent, one failure never stops the rest,\n * and each run starts at a random workspace so a run that exhausts its budget\n * does not starve the same tail of workspaces every time.\n */\nexport function createModelCallFactReconcilerActivities(\n  services: () => Promise<ControlActivityServices>,\n  options: ModelCallFactReconcilerOptions = {},\n) {\n  const now = options.now ?? Date.now;\n  const runBudgetMs = options.runBudgetMs ?? MODEL_CALL_FACT_RECONCILE_RUN_BUDGET_MS;\n  const startAfterWorkspaceId = options.startAfterWorkspaceId ?? randomUUID;\n  const reconcile = options.reconcile ?? reconcileModelCallFacts;\n  const listWorkspaces = options.listWorkspaces ?? listWorkspaceIdsAfter;\n\n  async function reconcileRecentModelCallFacts(): Promise<ReconcileRecentModelCallFactsResult> {\n    const { db, observability } = await services();\n    const startedAt = now();\n    const until = new Date(startedAt - MODEL_CALL_FACT_RECONCILE_SETTLE_MS);\n    const since = new Date(until.getTime() - MODEL_CALL_FACT_RECONCILE_LOOKBACK_MS);\n    const result: ReconcileRecentModelCallFactsResult = {\n      workspaces: 0,\n      missing: 0,\n      repaired: 0,\n      unrepaired: 0,\n      truncatedWorkspaces: 0,\n      failedWorkspaces: 0,\n      budgetExhausted: false,\n    };\n    const start = startAfterWorkspaceId();\n    let cursor: string | null = start;\n    let wrapped = false;\n    while (true) {\n      const page = await listWorkspaces(db, { afterId: cursor, limit: WORKSPACE_PAGE_SIZE });\n      const ids = wrapped ? page.filter((id) => id <= start) : page;\n      for (const workspaceId of ids) {\n        if (now() - startedAt >= runBudgetMs) {\n          result.budgetExhausted = true;\n          break;\n        }\n        result.workspaces += 1;\n        try {\n          const outcome = await reconcile(db, {\n            workspaceId,\n            since,\n            until,\n            limit: MODEL_CALL_FACT_RECONCILE_WORKSPACE_LIMIT,\n          });\n          result.missing += outcome.missing;\n          result.repaired += outcome.repaired;\n          result.unrepaired += outcome.unrepaired;\n          if (outcome.truncated) result.truncatedWorkspaces += 1;\n        } catch (error) {\n          result.failedWorkspaces += 1;\n          observability.warn(\"model call fact reconciliation failed for a workspace\", {\n            workspaceId,\n            errorName: error instanceof Error ? error.name : \"unknown\",\n          });\n        }\n      }\n      if (result.budgetExhausted) break;\n      if (wrapped && ids.length < page.length) break;\n      if (page.length < WORKSPACE_PAGE_SIZE) {\n        if (wrapped) break;\n        wrapped = true;\n        cursor = null;\n        continue;\n      }\n      cursor = page[page.length - 1]!;\n    }\n    if (result.failedWorkspaces > 0 || result.truncatedWorkspaces > 0 || result.budgetExhausted) {\n      observability.warn(\"model call fact reconciliation incomplete\", { ...result });\n    } else if (result.missing > 0) {\n      observability.info(\"model call fact reconciliation\", { ...result });\n    }\n    return result;\n  }\n\n  return { reconcileRecentModelCallFacts };\n}\n","import type { FileAsset } from \"@opengeni/contracts\";\nimport {\n  claimRetainedScreenshotMaintenance,\n  completeRetainedScreenshotMaintenance,\n  promoteRetainedScreenshotMaintenanceCleanup,\n  type RetainedScreenshotMaintenanceClaim,\n} from \"@opengeni/db\";\nimport { retryWhileMissing, type ObjectHead, type ObjectStorage } from \"@opengeni/storage\";\nimport type { ControlActivityServices } from \"./types\";\n\nexport const RETAINED_SCREENSHOT_PENDING_GRACE_MS = 15 * 60 * 1_000;\nexport const RETAINED_SCREENSHOT_CLAIM_TIMEOUT_MS = 10 * 60 * 1_000;\nexport const RETAINED_SCREENSHOT_MAINTENANCE_BATCH_SIZE = 100;\n\nexport type MaintainRetainedScreenshotsResult = {\n  claimed: number;\n  ready: number;\n  deleted: number;\n  failed: number;\n  retryable: number;\n};\n\nexport type RetainedScreenshotMaintenanceActivityOptions = {\n  pendingGraceMs?: number;\n  claimTimeoutMs?: number;\n  batchSize?: number;\n  /** Provider seams used by deterministic unit tests. */\n  fileExists?: (storage: ObjectStorage, file: FileAsset) => Promise<boolean>;\n  headFile?: (storage: ObjectStorage, file: FileAsset) => Promise<ObjectHead>;\n  deleteObject?: (storage: ObjectStorage, key: string) => Promise<void>;\n};\n\n/**\n * Reconcile interrupted screenshot writes and reap expired screenshot objects.\n * Claims move rows out of the readable `ready`/writable `pending` states before\n * provider access. Provider failures leave the durable claim reclaimable; DB\n * completion happens only after exact metadata verification or an idempotent\n * object delete.\n */\nexport function createRetainedScreenshotMaintenanceActivities(\n  services: () => Promise<ControlActivityServices>,\n  options: RetainedScreenshotMaintenanceActivityOptions = {},\n) {\n  const pendingGraceMs = options.pendingGraceMs ?? RETAINED_SCREENSHOT_PENDING_GRACE_MS;\n  const claimTimeoutMs = options.claimTimeoutMs ?? RETAINED_SCREENSHOT_CLAIM_TIMEOUT_MS;\n  const batchSize = options.batchSize ?? RETAINED_SCREENSHOT_MAINTENANCE_BATCH_SIZE;\n  const fileExists = options.fileExists ?? ((storage, file) => storage.fileExists(file));\n  const headFile = options.headFile ?? ((storage, file) => storage.headFile(file));\n  const deleteObject = options.deleteObject ?? ((storage, key) => storage.deleteObject(key));\n\n  async function maintainRetainedScreenshots(): Promise<MaintainRetainedScreenshotsResult> {\n    const { db, objectStorage, observability } = await services();\n    if (!objectStorage) {\n      return { claimed: 0, ready: 0, deleted: 0, failed: 0, retryable: 0 };\n    }\n\n    const claims = await claimRetainedScreenshotMaintenance(db, {\n      pendingGraceMs,\n      claimTimeoutMs,\n      limit: batchSize,\n    });\n    const result: MaintainRetainedScreenshotsResult = {\n      claimed: claims.length,\n      ready: 0,\n      deleted: 0,\n      failed: 0,\n      retryable: 0,\n    };\n\n    for (const claim of claims) {\n      try {\n        if (claim.action === \"reconcile\") {\n          const outcome = await reconcileClaim(db, objectStorage, claim, {\n            fileExists,\n            headFile,\n            deleteObject,\n          });\n          if (outcome === \"ready\") {\n            result.ready += 1;\n          } else {\n            result.failed += 1;\n          }\n          continue;\n        }\n\n        await deleteObject(objectStorage, claim.objectKey);\n        const outcome = terminalDeleteOutcome(claim.cleanupReason);\n        const settled = await completeRetainedScreenshotMaintenance(db, {\n          accountId: claim.accountId,\n          workspaceId: claim.workspaceId,\n          artifactId: claim.artifactId,\n          claimId: claim.claimId,\n          outcome,\n        });\n        if (!settled) throw new Error(\"retained screenshot cleanup claim was superseded\");\n        result.deleted += 1;\n      } catch (error) {\n        result.retryable += 1;\n        observability.warn(\"retained screenshot maintenance failed; claim remains reclaimable\", {\n          workspaceId: claim.workspaceId,\n          sessionId: claim.sessionId,\n          artifactId: claim.artifactId,\n          action: claim.action,\n          error: error instanceof Error ? error.message : String(error),\n        });\n      }\n    }\n\n    if (claims.length > 0) {\n      observability.info(\"retained screenshot maintenance swept\", result);\n    }\n    return result;\n  }\n\n  return { maintainRetainedScreenshots };\n}\n\nasync function reconcileClaim(\n  db: Parameters<typeof completeRetainedScreenshotMaintenance>[0],\n  storage: ObjectStorage,\n  claim: RetainedScreenshotMaintenanceClaim,\n  provider: Required<\n    Pick<RetainedScreenshotMaintenanceActivityOptions, \"fileExists\" | \"headFile\" | \"deleteObject\">\n  >,\n): Promise<\"ready\" | \"failed\"> {\n  const observation = await observeClaimObject(storage, claim, provider);\n  if (observation === \"matches\") {\n    const settled = await completeRetainedScreenshotMaintenance(db, {\n      accountId: claim.accountId,\n      workspaceId: claim.workspaceId,\n      artifactId: claim.artifactId,\n      claimId: claim.claimId,\n      outcome: \"ready\",\n    });\n    if (!settled) throw new Error(\"retained screenshot reconcile claim was superseded\");\n    return \"ready\";\n  }\n\n  // A mismatch/missing observation cannot authorize provider deletion while\n  // the artifact is still eligible for a concurrent ready settlement. Promote\n  // the exact claim first; a ready winner clears the claim and makes this stale.\n  const promoted = await promoteRetainedScreenshotMaintenanceCleanup(db, {\n    accountId: claim.accountId,\n    workspaceId: claim.workspaceId,\n    artifactId: claim.artifactId,\n    claimId: claim.claimId,\n    cleanupReason: \"failed\",\n  });\n  if (!promoted) throw new Error(\"retained screenshot reconcile claim was superseded\");\n\n  // Deletes are idempotent. Calling it for an authoritative missing observation\n  // also closes a race with a late writer that began before cleanup ownership.\n  await provider.deleteObject(storage, claim.objectKey);\n  const settled = await completeRetainedScreenshotMaintenance(db, {\n    accountId: claim.accountId,\n    workspaceId: claim.workspaceId,\n    artifactId: claim.artifactId,\n    claimId: claim.claimId,\n    outcome: \"failed\",\n  });\n  if (!settled) throw new Error(\"retained screenshot reconcile claim was superseded\");\n  return \"failed\";\n}\n\nasync function observeClaimObject(\n  storage: ObjectStorage,\n  claim: RetainedScreenshotMaintenanceClaim,\n  provider: Required<Pick<RetainedScreenshotMaintenanceActivityOptions, \"fileExists\" | \"headFile\">>,\n): Promise<\"matches\" | \"mismatch\" | \"missing\"> {\n  const file = claimFile(storage, claim);\n  const head = await retryWhileMissing(async () => {\n    if (!(await provider.fileExists(storage, file))) return null;\n    return await provider.headFile(storage, file);\n  });\n  if (!head) return \"missing\";\n  return head.ContentLength === claim.sizeBytes &&\n    head.ContentType === claim.mediaType &&\n    head.Metadata?.sha256 === claim.sha256\n    ? \"matches\"\n    : \"mismatch\";\n}\n\nfunction claimFile(storage: ObjectStorage, claim: RetainedScreenshotMaintenanceClaim): FileAsset {\n  const timestamp = new Date(0).toISOString();\n  return {\n    id: claim.artifactId,\n    workspaceId: claim.workspaceId,\n    status: \"pending_upload\",\n    filename: `computer-screenshot-${claim.artifactId}.png`,\n    safeFilename: `computer-screenshot-${claim.artifactId}.png`,\n    contentType: claim.mediaType,\n    sizeBytes: claim.sizeBytes,\n    sha256: claim.sha256,\n    bucket: storage.bucket,\n    objectKey: claim.objectKey,\n    createdAt: timestamp,\n    updatedAt: timestamp,\n  };\n}\n\nfunction terminalDeleteOutcome(reason: string | null): \"failed\" | \"expired\" | \"deleted\" {\n  if (reason === \"expired\") return \"expired\";\n  if (reason === \"failed\") return \"failed\";\n  return \"deleted\";\n}\n","import type {\n  AccessGrant,\n  Rig,\n  RigChange,\n  RigCheck,\n  RigProviderImage,\n  RigVersion,\n  SandboxBackend,\n} from \"@opengeni/contracts\";\nimport { sandboxLifecycleTransitionWaitMs } from \"@opengeni/config\";\nimport {\n  appendRigSetupCommand,\n  recordRigAuditEvent,\n  classifyRigVerificationOutcome,\n  promoteSetupAppendChange,\n  rigProviderImageBuildRequestId,\n  rigProviderImageContentHash,\n  rigProviderImageProviderBindingKeyHash,\n  rigProviderImageSetupHash,\n  type RigProviderImageDefinition,\n} from \"@opengeni/core\";\nimport {\n  acquireLease,\n  beginRigChangeVerificationAttempt,\n  claimRigVersionProviderImageBuild,\n  commitWarmingToWarm,\n  failWarmingToCold,\n  finalizeRigVersionProviderImageBuild,\n  getRig,\n  getRigChange,\n  getRigVersionById,\n  markWarmLeaseInstanceLost,\n  markSandboxCheckpointArtifactDeletePending,\n  recordWarmingSandboxCreated,\n  registerSandboxCheckpointArtifact,\n  releaseLeaseHolder,\n  touchLeaseHolder,\n  updateRigChangeStatus,\n  SandboxCheckpointArtifactRegistrationConflictError,\n  type Database,\n} from \"@opengeni/db\";\nimport {\n  buildImmutableProviderImage,\n  createTurnToolCancellationController,\n  deleteModalCheckpointSnapshot,\n  describeNativeSnapshotArchive,\n  encodeNativeSnapshotRef,\n  establishSandboxSessionFromEnvelope,\n  sandboxCommandExitCode,\n  sandboxCommandOutput,\n  serializeEstablishedSandboxEnvelope,\n  providerSupportsImmutableImageBuild,\n  tagModalSandbox,\n  terminateManagedSandboxSession,\n  verifySandboxExecReadiness,\n  type EstablishedSandboxSession,\n  type TurnSandboxCommandArgs,\n  type TurnSandboxCommandSession,\n} from \"@opengeni/runtime/sandbox\";\nimport type { Context } from \"@temporalio/activity\";\nimport type { ControlActivityServices } from \"./types\";\nimport { rigProviderImageSourceImage } from \"./sandbox-images\";\nimport { currentActivityContext } from \"./streaming\";\n\ntype RigSetupHook = typeof import(\"@opengeni/runtime\").runRigSetupHook;\nlet rigSetupHookPromise: Promise<RigSetupHook> | null = null;\n\nasync function runRigSetupHook(...args: Parameters<RigSetupHook>): Promise<void> {\n  rigSetupHookPromise ??= import(\"@opengeni/runtime\").then((runtime) => runtime.runRigSetupHook);\n  const hook = await rigSetupHookPromise;\n  await hook(...args);\n}\n\ntype SandboxLifecycleCommandRunner = (\n  session: TurnSandboxCommandSession,\n  args: TurnSandboxCommandArgs,\n) => Promise<unknown>;\n\nexport type RigVerificationWorkflowInput =\n  | { workspaceId: string; changeId: string; versionId?: never }\n  | { workspaceId: string; versionId: string; changeId?: never };\n\ntype CommandResult = {\n  exitCode: number | null;\n  output: string;\n};\n\nexport type RigPlatformCheckResult = CommandResult & RigCheck;\n\n/**\n * Platform-owned checks run after Rig setup and independently of user-declared\n * checks. They prove that a Rig layered on the deployment image did not remove\n * or replace the Browser, Terminal, or Computer/Desktop services. The commands\n * start each enabled service on its canonical loopback port, wait for its own\n * readiness contract, probe it, and tear it down before provider snapshotting.\n */\nexport function rigPlatformChecksForSettings(\n  settings: ControlActivityServices[\"settings\"],\n): RigCheck[] {\n  const backend = settings.sandboxBackend as SandboxBackend;\n  if (!rigProviderImageSourceImage(settings, backend)) return [];\n\n  const checks: RigCheck[] = [\n    {\n      name: \"opengeni-platform-browser\",\n      command: [\n        \"set -eu\",\n        \"test -x /usr/local/bin/opengeni-browserd\",\n        \"test -x /usr/local/bin/opengeni-browserd-up\",\n        \"test -x /usr/local/bin/opengeni-browserd-down\",\n        \"test -r /etc/opengeni/browser-engine\",\n        '__og_browser_engine=\"$(head -n 1 /etc/opengeni/browser-engine)\"',\n        'test -n \"$__og_browser_engine\"',\n        'test -x \"$__og_browser_engine\"',\n        '__og_browser_token=\"$(mktemp)\"',\n        \"trap 'opengeni-browserd-down >/dev/null 2>&1 || true; rm -f \\\"$__og_browser_token\\\"' EXIT\",\n        \"__og_browser_token_value=\\\"$(od -An -N32 -tx1 /dev/urandom | tr -d '[:space:]')\\\"\",\n        'test \"${#__og_browser_token_value}\" -eq 64',\n        'printf \\'%s\\\\n\\' \"$__og_browser_token_value\" > \"$__og_browser_token\"',\n        'chmod 0600 \"$__og_browser_token\"',\n        'OPENGENI_BROWSERD_ADMIN_TOKEN_FILE=\"$__og_browser_token\" OPENGENI_BROWSERD_PORT=7682 OPENGENI_BROWSERD_ALLOWED_ORIGINS= opengeni-browserd-up',\n        \"curl --noproxy '*' -fsS http://127.0.0.1:7682/healthz >/dev/null\",\n        \"curl --noproxy '*' -fsS -H \\\"Authorization: Bearer $__og_browser_token_value\\\" http://127.0.0.1:7682/v1/browser-sessions >/dev/null\",\n      ].join(\"\\n\"),\n    },\n  ];\n\n  if (settings.sandboxTerminalEnabled) {\n    checks.push({\n      name: \"opengeni-platform-terminal\",\n      command: [\n        \"set -eu\",\n        \"test -x /usr/local/bin/opengeni-terminal-up\",\n        \"test -x /usr/local/bin/opengeni-terminal-down\",\n        \"command -v ttyd >/dev/null\",\n        \"trap 'opengeni-terminal-down >/dev/null 2>&1 || true' EXIT\",\n        \"TERMINAL_PORT=7681 opengeni-terminal-up\",\n        \"curl --noproxy '*' -fsS http://127.0.0.1:7681/ >/dev/null\",\n      ].join(\"\\n\"),\n    });\n  }\n\n  if (settings.sandboxDesktopEnabled) {\n    checks.push({\n      name: \"opengeni-platform-computer-desktop\",\n      command: [\n        \"set -eu\",\n        \"test -x /usr/local/bin/opengeni-desktop-up\",\n        \"test -x /usr/local/bin/opengeni-desktop-down\",\n        \"command -v Xvfb >/dev/null\",\n        \"command -v x11vnc >/dev/null\",\n        \"test -x /opt/noVNC/utils/novnc_proxy\",\n        \"command -v scrot >/dev/null\",\n        \"command -v xdotool >/dev/null\",\n        '__og_desktop_home=\"$(mktemp -d)\"',\n        \"trap 'opengeni-desktop-down >/dev/null 2>&1 || true; rm -rf \\\"$__og_desktop_home\\\"' EXIT\",\n        'HOME=\"$__og_desktop_home\" STREAM_PORT=6080 DESKTOP_W=1280 DESKTOP_H=800 opengeni-desktop-up',\n        \"curl --noproxy '*' -fsS http://127.0.0.1:6080/vnc.html >/dev/null\",\n        \"nc -z 127.0.0.1 5900\",\n      ].join(\"\\n\"),\n    });\n  }\n\n  return checks;\n}\n\nconst RIG_VERIFICATION_CLEANUP_RESERVE_MAX_MS = 2 * 60_000;\nconst RIG_VERIFICATION_CLEANUP_OPERATION_MAX_MS = 60_000;\nconst RIG_VERIFICATION_HEARTBEAT_MAX_INTERVAL_MS = 10_000;\nconst RIG_VERIFICATION_HEARTBEAT_MIN_INTERVAL_MS = 250;\n// The Temporal activity has a 15-minute start-to-close timeout. Keep ownership\n// through that complete contract plus five minutes for cancellation delivery\n// and finally cleanup; a dead process then becomes sweep-eligible without any\n// lease-holder fiction or manual recovery.\nexport const RIG_VERIFICATION_OWNER_TTL_MS = 20 * 60_000;\nexport const RIG_VERIFICATION_OWNERS_DISABLED_MESSAGE =\n  \"Sandbox Environment verification lease ownership is disabled; refusing to create an unowned verifier sandbox\";\nconst RIG_VERIFICATION_HOLDER_TOUCH_INTERVAL_MS = 10_000;\nconst RIG_VERIFICATION_RELEASE_GRACE_MS = 1;\n\nexport class RigVerificationActivityDeadlineError extends Error {\n  readonly name = \"RigVerificationActivityDeadlineError\";\n\n  constructor(\n    readonly startToCloseTimeoutMs: number,\n    readonly cleanupReserveMs: number,\n  ) {\n    super(\n      `Sandbox Environment verification activity-local deadline reached with ${cleanupReserveMs}ms reserved for cleanup before the ${startToCloseTimeoutMs}ms Temporal start-to-close timeout`,\n    );\n  }\n}\n\nexport type RigVerificationActivityLifecycle = {\n  signal: AbortSignal;\n  /** Absolute wall-clock boundary before which immediate cleanup may wait. */\n  cleanupDeadlineAtMs: number | null;\n  dispose(): void;\n};\n\nfunction computeCleanupReserveMs(startToCloseTimeoutMs: number): number {\n  return Math.min(\n    RIG_VERIFICATION_CLEANUP_RESERVE_MAX_MS,\n    Math.max(100, Math.floor(startToCloseTimeoutMs / 4)),\n    Math.max(1, startToCloseTimeoutMs - 1),\n  );\n}\n\n/**\n * Start the verifier's real Temporal liveness/cancellation contract.\n *\n * The activity-local deadline is deliberately earlier than start-to-close. In\n * production a 15-minute server deadline becomes a 13-minute work deadline,\n * retaining two minutes for command quiescence, exact deactivation, and\n * provider termination. Short integration-test deadlines use the same bounded\n * one-quarter rule instead of a production-only magic value.\n */\nexport function createRigVerificationActivityLifecycle(\n  context: Context | null = currentActivityContext(),\n): RigVerificationActivityLifecycle {\n  const controller = new AbortController();\n  const temporalSignal = context?.cancellationSignal;\n  const forwardTemporalCancellation = (): void => {\n    if (!controller.signal.aborted) {\n      controller.abort(\n        temporalSignal?.reason ?? new Error(\"Sandbox Environment verification cancelled\"),\n      );\n    }\n  };\n  if (temporalSignal?.aborted) {\n    forwardTemporalCancellation();\n  } else {\n    temporalSignal?.addEventListener(\"abort\", forwardTemporalCancellation, { once: true });\n  }\n\n  const startedAtMs = Date.now();\n  const startToCloseTimeoutMs = context?.info.startToCloseTimeoutMs;\n  const reserveMs =\n    typeof startToCloseTimeoutMs === \"number\" && startToCloseTimeoutMs > 0\n      ? computeCleanupReserveMs(startToCloseTimeoutMs)\n      : null;\n  const serverDeadlineAtMs =\n    reserveMs === null || startToCloseTimeoutMs === undefined\n      ? null\n      : startedAtMs + startToCloseTimeoutMs;\n  // Keep an additional margin after our bounded cleanup waits. If a DB or\n  // provider promise remains unresolved, the activity must still report its\n  // local deadline before Temporal imposes the hard timeout.\n  const serverReportingMarginMs =\n    reserveMs === null ? 0 : Math.min(30_000, Math.max(1, Math.floor(reserveMs / 4)));\n  const cleanupDeadlineAtMs =\n    serverDeadlineAtMs === null ? null : serverDeadlineAtMs - serverReportingMarginMs;\n\n  let deadlineTimer: ReturnType<typeof setTimeout> | null = null;\n  if (reserveMs !== null && startToCloseTimeoutMs !== undefined && !controller.signal.aborted) {\n    deadlineTimer = setTimeout(\n      () => {\n        if (!controller.signal.aborted) {\n          controller.abort(\n            new RigVerificationActivityDeadlineError(startToCloseTimeoutMs, reserveMs),\n          );\n        }\n      },\n      Math.max(1, startToCloseTimeoutMs - reserveMs),\n    );\n  }\n\n  const heartbeat = (): void => {\n    if (!context) return;\n    try {\n      context.heartbeat({\n        activity: \"rig_verification\",\n        at: new Date().toISOString(),\n        cleanup: controller.signal.aborted,\n        cleanupDeadlineAt: cleanupDeadlineAtMs ? new Date(cleanupDeadlineAtMs).toISOString() : null,\n      });\n    } catch (error) {\n      // Context.heartbeat reports delivered cancellation synchronously on some\n      // SDK paths. Feed that failure into the same cooperative abort fence, but\n      // keep the interval alive through bounded cleanup: the abort signal stops\n      // verifier work, not the activity's liveness reporting.\n      if (!controller.signal.aborted) controller.abort(error);\n    }\n  };\n  heartbeat();\n  const heartbeatTimeoutMs = context?.info.heartbeatTimeoutMs;\n  const heartbeatIntervalMs =\n    typeof heartbeatTimeoutMs === \"number\" && heartbeatTimeoutMs > 0\n      ? Math.min(\n          RIG_VERIFICATION_HEARTBEAT_MAX_INTERVAL_MS,\n          Math.max(RIG_VERIFICATION_HEARTBEAT_MIN_INTERVAL_MS, Math.floor(heartbeatTimeoutMs / 3)),\n        )\n      : RIG_VERIFICATION_HEARTBEAT_MAX_INTERVAL_MS;\n  const heartbeatTimer = context ? setInterval(heartbeat, heartbeatIntervalMs) : null;\n  if (heartbeatTimer && \"unref\" in heartbeatTimer && typeof heartbeatTimer.unref === \"function\") {\n    heartbeatTimer.unref();\n  }\n\n  return {\n    signal: controller.signal,\n    cleanupDeadlineAtMs,\n    dispose: () => {\n      temporalSignal?.removeEventListener(\"abort\", forwardTemporalCancellation);\n      if (deadlineTimer) clearTimeout(deadlineTimer);\n      if (heartbeatTimer) clearInterval(heartbeatTimer);\n      deadlineTimer = null;\n    },\n  };\n}\n\nfunction abortReason(signal: AbortSignal): unknown {\n  return signal.reason ?? new Error(\"Sandbox Environment verification cancelled\");\n}\n\nfunction throwIfAborted(signal: AbortSignal): void {\n  if (signal.aborted) throw abortReason(signal);\n}\n\nasync function waitForAbortable<T>(promise: Promise<T>, signal: AbortSignal): Promise<T> {\n  throwIfAborted(signal);\n  let removeAbortListener = (): void => undefined;\n  const cancellation = new Promise<never>((_resolve, reject) => {\n    const onAbort = (): void => reject(abortReason(signal));\n    removeAbortListener = () => signal.removeEventListener(\"abort\", onAbort);\n    signal.addEventListener(\"abort\", onAbort, { once: true });\n  });\n  try {\n    return await Promise.race([promise, cancellation]);\n  } finally {\n    removeAbortListener();\n  }\n}\n\ntype BoundedSettlement<T> = { status: \"completed\"; value: T } | { status: \"timed_out\" };\n\nasync function settleWithin<T>(\n  promise: Promise<T>,\n  timeoutMs: number,\n): Promise<BoundedSettlement<T>> {\n  if (timeoutMs <= 0) return { status: \"timed_out\" };\n  let timer: ReturnType<typeof setTimeout> | null = null;\n  try {\n    return await Promise.race([\n      promise.then((value) => ({ status: \"completed\" as const, value })),\n      new Promise<{ status: \"timed_out\" }>((resolve) => {\n        timer = setTimeout(() => resolve({ status: \"timed_out\" }), timeoutMs);\n      }),\n    ]);\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n}\n\nfunction cleanupWaitMs(lifecycle: RigVerificationActivityLifecycle | undefined): number {\n  if (lifecycle?.cleanupDeadlineAtMs == null) {\n    return RIG_VERIFICATION_CLEANUP_OPERATION_MAX_MS;\n  }\n  return Math.max(\n    0,\n    Math.min(RIG_VERIFICATION_CLEANUP_OPERATION_MAX_MS, lifecycle.cleanupDeadlineAtMs - Date.now()),\n  );\n}\n\nfunction systemGrant(rig: Rig): AccessGrant {\n  return {\n    accountId: rig.accountId,\n    workspaceId: rig.workspaceId,\n    subjectId: \"system:rig-verification\",\n    permissions: [\"rigs:use\", \"rigs:manage\"],\n  };\n}\n\nasync function terminateThrowaway(established: EstablishedSandboxSession | null): Promise<boolean> {\n  if (!established) return true;\n  try {\n    await terminateManagedSandboxSession(\n      established.client,\n      established.sessionState,\n      established.session,\n    );\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport type RigVerificationOwnershipDependencies = {\n  acquire: typeof acquireLease;\n  establish: typeof establishSandboxSessionFromEnvelope;\n  recordCreated: typeof recordWarmingSandboxCreated;\n  commitWarm: typeof commitWarmingToWarm;\n  touchHolder: typeof touchLeaseHolder;\n  releaseHolder: typeof releaseLeaseHolder;\n  failWarming: typeof failWarmingToCold;\n  markWarmLost: typeof markWarmLeaseInstanceLost;\n  serialize: typeof serializeEstablishedSandboxEnvelope;\n  tag: typeof tagModalSandbox;\n  terminate: typeof terminateThrowaway;\n  createCancellationController: typeof createTurnToolCancellationController;\n  randomUUID: () => string;\n};\n\nconst defaultOwnershipDependencies: RigVerificationOwnershipDependencies = {\n  acquire: acquireLease,\n  establish: establishSandboxSessionFromEnvelope,\n  recordCreated: recordWarmingSandboxCreated,\n  commitWarm: commitWarmingToWarm,\n  touchHolder: touchLeaseHolder,\n  releaseHolder: releaseLeaseHolder,\n  failWarming: failWarmingToCold,\n  markWarmLost: markWarmLeaseInstanceLost,\n  serialize: serializeEstablishedSandboxEnvelope,\n  tag: tagModalSandbox,\n  terminate: terminateThrowaway,\n  createCancellationController: createTurnToolCancellationController,\n  randomUUID: () => crypto.randomUUID(),\n};\n\nexport type RigVerificationSandboxRunContext = {\n  signal: AbortSignal;\n  commandRunner: SandboxLifecycleCommandRunner;\n  ownership: {\n    leaseId: string;\n    leaseEpoch: number;\n    workspaceGeneration: number;\n    instanceId: string;\n  };\n};\n\nexport class RigVerificationLeaseUnavailableError extends Error {\n  readonly name = \"RigVerificationLeaseUnavailableError\";\n\n  constructor(\n    readonly sandboxGroupId: string,\n    readonly role: \"attached\" | \"blocked\" | \"rearmed\" | \"fenced\",\n  ) {\n    super(\n      `Sandbox Environment verification requires a new clean sandbox, but lease ${sandboxGroupId} was ${role}`,\n    );\n  }\n}\n\n/**\n * Run one verifier against one exactly attributed standalone sandbox.\n *\n * Ordering is deliberate and source-of-truth safe:\n *   acquire spawner -> create callback -> warming instance record -> warm commit\n *   -> setup/checks. The canonical sandbox lease, not provider tags, is durable\n * ownership. Every exact create callback is retained before its DB write so an\n * ambiguous acknowledgement can still be terminated in finally. Provider\n * termination precedes clearing that exact durable pointer; when termination\n * fails the pointer is retained and the holder is released with a one-millisecond\n * drain grace so the normal reaper retries. Temporal cancellation first drains\n * every verifier command. Cleanup waits are bounded inside the server reserve;\n * lease expiry and the provider reaper remain the hard-worker-loss backstops.\n */\nexport async function runWithOwnedRigVerificationSandbox<T>(\n  input: {\n    settings: ControlActivityServices[\"settings\"];\n    db: Database;\n    observability: ControlActivityServices[\"observability\"];\n    accountId: string;\n    workspaceId: string;\n    sandboxGroupId: string;\n    rigVersionId: string;\n    sessionIdPrefix: string;\n    lifecycle?: RigVerificationActivityLifecycle;\n  },\n  run: (\n    established: EstablishedSandboxSession,\n    context: RigVerificationSandboxRunContext,\n  ) => Promise<T>,\n  dependencies: RigVerificationOwnershipDependencies = defaultOwnershipDependencies,\n): Promise<T> {\n  // Phase B must remain inert throughout its code rollout. A disabled or\n  // omitted flag rejects before establish() can invoke any provider create;\n  // falling back to the legacy unowned verifier is never safe.\n  if (!input.settings.rigVerificationLeaseOwnershipEnabled) {\n    throw new Error(RIG_VERIFICATION_OWNERS_DISABLED_MESSAGE);\n  }\n\n  const holderId = `rig-verification:${dependencies.randomUUID()}`;\n  const fallbackController = new AbortController();\n  const signal = input.lifecycle?.signal ?? fallbackController.signal;\n  const commandController = dependencies.createCancellationController(signal);\n  const commandRunner = commandController.runSandboxCommand.bind(commandController);\n  let cleanupTarget: EstablishedSandboxSession | null = null;\n  let acquired = false;\n  let ownsWarmingEpoch = false;\n  let expectedEpoch: number | null = null;\n  let holderLivenessTimer: ReturnType<typeof setInterval> | null = null;\n  let establishmentSettled = false;\n  let establishmentPromise: Promise<EstablishedSandboxSession> | null = null;\n\n  const warnCleanupTimeout = (operation: string, instanceId: string | null): void => {\n    input.observability.warn(\"sandbox environment verifier: ownership cleanup timed out\", {\n      holderId,\n      instanceId,\n      operation,\n      error:\n        \"cleanup did not settle inside the activity reserve; exact owner expiry and the global provider reaper are the bounded delayed backstop\",\n    });\n  };\n\n  const warnCleanupFailure = (\n    operation: string,\n    instanceId: string | null,\n    error: unknown,\n  ): void => {\n    input.observability.warn(\"sandbox environment verifier: ownership cleanup failed\", {\n      holderId,\n      instanceId,\n      operation,\n      error: error instanceof Error ? error.message : String(error),\n    });\n  };\n\n  const clearTerminatedLeasePointer = async (instanceId: string): Promise<void> => {\n    if (expectedEpoch === null) return;\n    const cleanupEpoch = expectedEpoch;\n    // Exactly one transition can match. Running both covers a commit whose DB\n    // acknowledgement was lost: expectedEpoch is still warming, while\n    // expectedEpoch+1 is the only possible committed warm epoch.\n    const results = await Promise.allSettled([\n      Promise.resolve().then(() =>\n        dependencies.markWarmLost(input.db, {\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          sandboxGroupId: input.sandboxGroupId,\n          expectedEpoch: cleanupEpoch + 1,\n          expectedInstanceId: instanceId,\n        }),\n      ),\n      Promise.resolve().then(() =>\n        dependencies.failWarming(input.db, {\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          sandboxGroupId: input.sandboxGroupId,\n          expectedEpoch: cleanupEpoch,\n        }),\n      ),\n    ]);\n    for (const [index, result] of results.entries()) {\n      if (result.status === \"rejected\") {\n        warnCleanupFailure(\n          index === 0 ? \"mark_warm_lost\" : \"fail_warming\",\n          instanceId,\n          result.reason,\n        );\n      }\n    }\n  };\n\n  const terminateAndClear = async (created: EstablishedSandboxSession): Promise<boolean> => {\n    let terminated = false;\n    try {\n      terminated = await dependencies.terminate(created);\n    } catch (error) {\n      warnCleanupFailure(\"terminate\", created.instanceId, error);\n    }\n    if (!terminated) {\n      warnCleanupFailure(\n        \"terminate\",\n        created.instanceId,\n        new Error(\"provider termination was not confirmed; durable lease cleanup remains pending\"),\n      );\n      return false;\n    }\n    await clearTerminatedLeasePointer(created.instanceId);\n    return true;\n  };\n\n  try {\n    throwIfAborted(signal);\n    const lease = await dependencies.acquire(input.db, {\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      sandboxGroupId: input.sandboxGroupId,\n      kind: \"turn\",\n      holderId,\n      subjectId: null,\n      backend: input.settings.sandboxBackend,\n      image: rigProviderImageSourceImage(input.settings, input.settings.sandboxBackend),\n      rigVersionId: input.rigVersionId,\n      leaseTtlMs: RIG_VERIFICATION_OWNER_TTL_MS,\n      warmingLeaseTtlMs: RIG_VERIFICATION_OWNER_TTL_MS,\n      captureWaitMs: sandboxLifecycleTransitionWaitMs(input.settings),\n      waitSignal: signal,\n    });\n    acquired = true;\n    expectedEpoch = lease.lease.leaseEpoch;\n    holderLivenessTimer = setInterval(() => {\n      void dependencies\n        .touchHolder(input.db, {\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          sandboxGroupId: input.sandboxGroupId,\n          kind: \"turn\",\n          holderId,\n        })\n        .catch(() => undefined);\n    }, RIG_VERIFICATION_HOLDER_TOUCH_INTERVAL_MS);\n    if (\"unref\" in holderLivenessTimer && typeof holderLivenessTimer.unref === \"function\") {\n      holderLivenessTimer.unref();\n    }\n    if (lease.role !== \"spawner\") {\n      throw new RigVerificationLeaseUnavailableError(input.sandboxGroupId, lease.role);\n    }\n    ownsWarmingEpoch = true;\n\n    establishmentPromise = Promise.resolve().then(() =>\n      dependencies.establish(input.settings, null, {\n        sessionId: `${input.sessionIdPrefix}-${holderId}`,\n        recovery: \"create-or-restore\",\n        environment: {},\n        onSandboxCreated: async (created) => {\n          // Retain the exact handle before the durable write. If registration\n          // throws after commit, finally still has the provider identity.\n          cleanupTarget = created;\n          const resumeState =\n            created.backendId === \"modal\" ? null : await dependencies.serialize(created);\n          const recorded = await dependencies.recordCreated(input.db, {\n            accountId: input.accountId,\n            workspaceId: input.workspaceId,\n            sandboxGroupId: input.sandboxGroupId,\n            expectedEpoch: lease.lease.leaseEpoch,\n            instanceId: created.instanceId,\n            resumeBackendId: created.backendId,\n            resumeState,\n            leaseTtlMs: RIG_VERIFICATION_OWNER_TTL_MS,\n            warmingLeaseTtlMs: RIG_VERIFICATION_OWNER_TTL_MS,\n          });\n          if (!recorded.recorded) {\n            throw new RigVerificationLeaseUnavailableError(input.sandboxGroupId, \"fenced\");\n          }\n\n          if (created.backendId === \"modal\" && !signal.aborted) {\n            try {\n              await waitForAbortable(\n                dependencies.tag(input.settings, created.instanceId, {\n                  leaseId: lease.lease.id,\n                  workspaceId: input.workspaceId,\n                  sandboxGroupId: input.sandboxGroupId,\n                }),\n                signal,\n              );\n            } catch (error) {\n              if (!signal.aborted) {\n                input.observability.warn(\n                  \"sandbox environment verifier: Modal ownership tag failed\",\n                  {\n                    holderId,\n                    instanceId: created.instanceId,\n                    error: error instanceof Error ? error.message : String(error),\n                  },\n                );\n              }\n            }\n          }\n\n          // Provider create is not abortable. If it returns after cancellation\n          // won the outer race, the callback owns an independent exact cleanup\n          // path before it throws and triggers the runtime's fail-closed delete.\n          if (signal.aborted) {\n            await terminateAndClear(created);\n            throw abortReason(signal);\n          }\n        },\n      }),\n    );\n    void establishmentPromise.then(\n      () => {\n        establishmentSettled = true;\n      },\n      () => {\n        establishmentSettled = true;\n      },\n    );\n    // The losing provider promise retains the callback above and a rejection\n    // handler, so a late create can still deactivate/terminate without an\n    // unhandled rejection after the activity has reported cancellation.\n    void establishmentPromise.catch(() => undefined);\n    const established = await waitForAbortable(establishmentPromise, signal);\n    cleanupTarget = established;\n    await waitForAbortable(verifySandboxExecReadiness(established), signal);\n    const resumeState =\n      established.backendId === \"modal\" ? null : await dependencies.serialize(established);\n    const committed = await dependencies.commitWarm(input.db, {\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      sandboxGroupId: input.sandboxGroupId,\n      expectedEpoch: lease.lease.leaseEpoch,\n      instanceId: established.instanceId,\n      dataPlaneUrl: null,\n      resumeBackendId: established.backendId,\n      resumeState,\n      leaseTtlMs: RIG_VERIFICATION_OWNER_TTL_MS,\n    });\n    if (!committed.committed || !committed.lease) {\n      throw new RigVerificationLeaseUnavailableError(input.sandboxGroupId, \"fenced\");\n    }\n    const result = await run(established, {\n      signal,\n      commandRunner,\n      ownership: {\n        leaseId: committed.lease.id,\n        leaseEpoch: committed.lease.leaseEpoch,\n        workspaceGeneration: committed.lease.workspaceGeneration,\n        instanceId: established.instanceId,\n      },\n    });\n    throwIfAborted(signal);\n    return result;\n  } catch (error) {\n    if (signal.aborted) throw abortReason(signal);\n    throw error;\n  } finally {\n    if (signal.aborted && establishmentPromise && !establishmentSettled) {\n      const lateEstablishment = await settleWithin(\n        Promise.allSettled([establishmentPromise]),\n        cleanupWaitMs(input.lifecycle),\n      );\n      if (lateEstablishment.status === \"timed_out\") {\n        warnCleanupTimeout(\"establish_after_abort\", cleanupTarget?.instanceId ?? null);\n      }\n    }\n\n    if (holderLivenessTimer) {\n      clearInterval(holderLivenessTimer);\n      holderLivenessTimer = null;\n    }\n\n    // Physical command quiescence precedes provider teardown. If the provider\n    // control plane itself hangs, bound the wait so termination still starts\n    // inside the server reserve; terminating the throwaway box is then the\n    // stronger final process fence.\n    commandController.cancel(signal.aborted ? abortReason(signal) : new Error(\"Verifier complete\"));\n    const quiescence = commandController.waitForQuiescence();\n    void quiescence.catch(() => undefined);\n    const quiescenceResult = await settleWithin(quiescence, cleanupWaitMs(input.lifecycle));\n    if (quiescenceResult.status === \"timed_out\") {\n      warnCleanupTimeout(\"command_quiescence\", cleanupTarget?.instanceId ?? null);\n    }\n\n    const providerCleanup = Promise.resolve().then(async () => {\n      if (!cleanupTarget) {\n        // A provider create that rejects before onSandboxCreated leaves no box\n        // pointer to terminate. Roll back only our exact warming epoch so the\n        // next verification does not wait for the 20-minute death reaper. If a\n        // non-abortable create returns after this transition, its callback is\n        // fenced and the runtime's create-failure path terminates that box.\n        if (ownsWarmingEpoch && expectedEpoch !== null) {\n          await dependencies.failWarming(input.db, {\n            accountId: input.accountId,\n            workspaceId: input.workspaceId,\n            sandboxGroupId: input.sandboxGroupId,\n            expectedEpoch,\n          });\n        }\n        return true;\n      }\n      return await terminateAndClear(cleanupTarget);\n    });\n    void providerCleanup.catch(() => undefined);\n    const providerSettlement = await settleWithin(\n      Promise.allSettled([providerCleanup]),\n      cleanupWaitMs(input.lifecycle),\n    );\n    if (providerSettlement.status === \"timed_out\") {\n      warnCleanupTimeout(\"terminate_and_clear\", cleanupTarget?.instanceId ?? null);\n    } else if (providerSettlement.value[0]?.status === \"rejected\") {\n      warnCleanupFailure(\n        \"terminate_and_clear\",\n        cleanupTarget?.instanceId ?? null,\n        providerSettlement.value[0].reason,\n      );\n    }\n\n    // Release is independent from provider/DB cleanup. A failed direct\n    // termination therefore leaves the exact pointer intact and immediately\n    // makes the zero-holder lease eligible for the normal drain/reaper path.\n    if (acquired) {\n      const release = Promise.resolve().then(() =>\n        dependencies.releaseHolder(input.db, {\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          sandboxGroupId: input.sandboxGroupId,\n          kind: \"turn\",\n          holderId,\n          idleGraceMs: RIG_VERIFICATION_RELEASE_GRACE_MS,\n        }),\n      );\n      void release.catch(() => undefined);\n      const released = await settleWithin(\n        Promise.allSettled([release]),\n        cleanupWaitMs(input.lifecycle),\n      );\n      if (released.status === \"timed_out\") {\n        warnCleanupTimeout(\"release_holder\", cleanupTarget?.instanceId ?? null);\n      } else if (released.value[0]?.status === \"rejected\") {\n        warnCleanupFailure(\n          \"release_holder\",\n          cleanupTarget?.instanceId ?? null,\n          released.value[0].reason,\n        );\n      }\n    }\n    // Cancellation may be delivered by a heartbeat while finally is already\n    // draining. WAIT_CANCELLATION_COMPLETED must observe cancellation only\n    // after cleanup, but it must not turn that late cancellation into success.\n    throwIfAborted(signal);\n  }\n}\n\nasync function runCommand(\n  session: TurnSandboxCommandSession,\n  command: string,\n  timeoutMs: number,\n  commandRunner: SandboxLifecycleCommandRunner,\n): Promise<CommandResult> {\n  const args = {\n    cmd: command,\n    workdir: \"/workspace\",\n    runAs: \"root\",\n    yieldTimeMs: timeoutMs,\n    maxOutputTokens: 40_000,\n  };\n  const result = await commandRunner(session, args);\n  return {\n    exitCode: sandboxCommandExitCode(result),\n    output: sandboxCommandOutput(result),\n  };\n}\n\nasync function runRigChecks(\n  session: TurnSandboxCommandSession,\n  checks: readonly RigCheck[],\n  timeoutMs: number,\n  commandRunner: SandboxLifecycleCommandRunner,\n): Promise<RigPlatformCheckResult[]> {\n  const results: RigPlatformCheckResult[] = [];\n  for (const check of checks) {\n    results.push({\n      name: check.name,\n      command: check.command,\n      ...(await runCommand(session, check.command, timeoutMs, commandRunner)),\n    });\n  }\n  return results;\n}\n\nfunction setupAppendCommand(change: RigChange): string | null {\n  if (change.kind !== \"setup_append\") {\n    return null;\n  }\n  const command = (change.payload as { command?: unknown }).command;\n  return typeof command === \"string\" ? command : null;\n}\n\nfunction candidateVersionForChange(baseVersion: RigVersion, change: RigChange): RigVersion {\n  if (change.kind !== \"definition_edit\") {\n    return { ...baseVersion, image: null, providerImages: {} };\n  }\n  const payload = change.payload as {\n    setupScript?: unknown;\n    checks?: unknown;\n    credentialHooks?: unknown;\n    defaultVariableSetIds?: unknown;\n    changelog?: unknown;\n  };\n  return {\n    ...baseVersion,\n    image: null,\n    setupScript:\n      payload.setupScript === undefined\n        ? baseVersion.setupScript\n        : (payload.setupScript as string | null),\n    checks: Array.isArray(payload.checks)\n      ? (payload.checks as RigVersion[\"checks\"])\n      : baseVersion.checks,\n    credentialHooks: Array.isArray(payload.credentialHooks)\n      ? (payload.credentialHooks as string[])\n      : baseVersion.credentialHooks,\n    defaultVariableSetIds: Array.isArray(payload.defaultVariableSetIds)\n      ? (payload.defaultVariableSetIds as string[])\n      : baseVersion.defaultVariableSetIds,\n    changelog: typeof payload.changelog === \"string\" ? payload.changelog : baseVersion.changelog,\n    providerImages: {},\n  };\n}\n\nfunction providerImageDefinitionForChange(\n  baseVersion: RigVersion,\n  change: RigChange,\n  candidateVersion: RigVersion,\n): RigProviderImageDefinition {\n  if (change.kind !== \"setup_append\") return candidateVersion;\n  const command = setupAppendCommand(change);\n  return {\n    setupScript: command\n      ? appendRigSetupCommand(baseVersion.setupScript, command)\n      : baseVersion.setupScript,\n    checks: baseVersion.checks,\n    credentialHooks: baseVersion.credentialHooks,\n    defaultVariableSetIds: baseVersion.defaultVariableSetIds,\n  };\n}\n\nexport function rigProviderImageContentMarkerCommand(\n  contentHash: string,\n  markerRoot = \"/var/opengeni\",\n): string {\n  const { marker, normalizedRoot } = rigProviderImageContentMarker(contentHash, markerRoot);\n  return `mkdir -p '${normalizedRoot}' && touch '${marker}'`;\n}\n\nfunction rigProviderImageContentMarker(\n  contentHash: string,\n  markerRoot = \"/var/opengeni\",\n): { marker: string; normalizedRoot: string } {\n  if (!/^sha256:[0-9a-f]{64}$/u.test(contentHash)) {\n    throw new Error(\n      \"Sandbox Environment provider image content marker requires a canonical SHA-256 value\",\n    );\n  }\n  if (!/^\\/[A-Za-z0-9._/-]+$/u.test(markerRoot)) {\n    throw new Error(\"Sandbox Environment provider image marker root must be a safe absolute path\");\n  }\n  const normalizedRoot = markerRoot.replace(/\\/+$/u, \"\") || \"/\";\n  const marker = `${normalizedRoot === \"/\" ? \"\" : normalizedRoot}/rig-setup-content-${contentHash.slice(\"sha256:\".length)}.done`;\n  return { marker, normalizedRoot };\n}\n\nexport type RigProviderImageColdBootDependencies = {\n  runOwnedSandbox: typeof runWithOwnedRigVerificationSandbox;\n  now: () => Date;\n};\n\nconst defaultRigProviderImageColdBootDependencies: RigProviderImageColdBootDependencies = {\n  runOwnedSandbox: runWithOwnedRigVerificationSandbox,\n  now: () => new Date(),\n};\n\n/** Prove a provider image from a second clean sandbox before runtime selection. */\nexport async function verifyRigProviderImageColdBoot(\n  input: {\n    settings: ControlActivityServices[\"settings\"];\n    db: Database;\n    observability: ControlActivityServices[\"observability\"];\n    accountId: string;\n    workspaceId: string;\n    buildRequestId: string;\n    rigVersionId: string;\n    sessionIdPrefix: string;\n    imageId: string;\n    contentHash: string;\n    checks: RigProviderImageDefinition[\"checks\"];\n    lifecycle: RigVerificationActivityLifecycle;\n  },\n  dependencies: RigProviderImageColdBootDependencies = defaultRigProviderImageColdBootDependencies,\n): Promise<string> {\n  const { marker } = rigProviderImageContentMarker(input.contentHash);\n  await dependencies.runOwnedSandbox(\n    {\n      settings: {\n        ...input.settings,\n        modalImageId: input.imageId,\n        // The full-machine provider image is the immutable rig base. Any future\n        // workspace recovery must layer /workspace onto it, never replace it.\n        modalWorkspacePersistence: \"snapshot_directory\",\n      },\n      db: input.db,\n      observability: input.observability,\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      sandboxGroupId: input.buildRequestId,\n      rigVersionId: input.rigVersionId,\n      sessionIdPrefix: input.sessionIdPrefix,\n      lifecycle: input.lifecycle,\n    },\n    async (established, runContext) => {\n      const markerResult = await runCommand(\n        established.session as TurnSandboxCommandSession,\n        `test -f '${marker}'`,\n        input.settings.rigSetupTimeoutMs,\n        runContext.commandRunner,\n      );\n      if (markerResult.exitCode !== 0) {\n        throw new Error(\n          \"built provider image is missing its exact sandbox environment-content marker\",\n        );\n      }\n      for (const check of rigPlatformChecksForSettings(input.settings)) {\n        const result = await runCommand(\n          established.session as TurnSandboxCommandSession,\n          check.command,\n          input.settings.rigSetupTimeoutMs,\n          runContext.commandRunner,\n        );\n        if (result.exitCode !== 0) {\n          throw new Error(\n            `built provider image failed mandatory platform check ${JSON.stringify(check.name)}: ${result.output.slice(-2000)}`,\n          );\n        }\n      }\n      for (const check of input.checks) {\n        const result = await runCommand(\n          established.session as TurnSandboxCommandSession,\n          check.command,\n          input.settings.rigSetupTimeoutMs,\n          runContext.commandRunner,\n        );\n        if (result.exitCode !== 0) {\n          throw new Error(\n            `built provider image failed check ${JSON.stringify(check.name)}: ${result.output.slice(-2000)}`,\n          );\n        }\n      }\n    },\n  );\n  return dependencies.now().toISOString();\n}\n\nexport async function buildVerifiedRigProviderImage(input: {\n  settings: ControlActivityServices[\"settings\"];\n  db: Database;\n  observability: ControlActivityServices[\"observability\"];\n  accountId: string;\n  workspaceId: string;\n  existingVersionId?: string;\n  definition: RigProviderImageDefinition;\n  target: { kind: \"change\" | \"version\"; id: string };\n  established: EstablishedSandboxSession;\n  ownership: RigVerificationSandboxRunContext[\"ownership\"];\n  lifecycle: RigVerificationActivityLifecycle;\n  signal: AbortSignal;\n}): Promise<RigProviderImage> {\n  const backend = input.settings.sandboxBackend as SandboxBackend;\n  const providerSupportsBuild = providerSupportsImmutableImageBuild(backend);\n  const sourceImage = rigProviderImageSourceImage(input.settings, backend);\n  const contentHash = rigProviderImageContentHash({\n    backend,\n    sourceImage,\n    definition: input.definition,\n  });\n  const startedAt = new Date().toISOString();\n  let building: RigProviderImage = {\n    backend,\n    provider: backend,\n    status: \"building\",\n    contentHash,\n    setupHash: rigProviderImageSetupHash(input.definition),\n    sourceImage,\n    buildRequestId: rigProviderImageBuildRequestId({\n      targetId: input.target.id,\n      backend,\n      contentHash,\n    }),\n    imageId: null,\n    imageDigest: null,\n    artifactId: null,\n    providerBindingKeyHash: null,\n    provenance: {\n      kind: \"rig_verification\",\n      targetKind: input.target.kind,\n      targetId: input.target.id,\n    },\n    startedAt,\n    finishedAt: null,\n    error: null,\n  };\n\n  if (input.existingVersionId) {\n    const claim = await claimRigVersionProviderImageBuild(input.db, {\n      workspaceId: input.workspaceId,\n      versionId: input.existingVersionId,\n      image: building,\n      staleAfterMs: RIG_VERIFICATION_OWNER_TTL_MS,\n      retryUnsupported: providerSupportsBuild,\n    });\n    if (\n      claim.status === \"ready\" ||\n      claim.status === \"in_progress\" ||\n      claim.status === \"unsupported\"\n    ) {\n      return claim.image;\n    }\n    if (claim.status === \"conflict\") {\n      return {\n        ...building,\n        status: \"failed\",\n        finishedAt: new Date().toISOString(),\n        error: {\n          code: \"provider_image_content_conflict\",\n          message:\n            \"this exact sandbox environment version already records a provider image for different effective content; mint and verify a new version\",\n          retryable: false,\n        },\n      };\n    }\n    building = claim.image;\n  }\n\n  const finalize = async (image: RigProviderImage): Promise<RigProviderImage> => {\n    if (input.existingVersionId) {\n      const persisted = await finalizeRigVersionProviderImageBuild(input.db, {\n        workspaceId: input.workspaceId,\n        versionId: input.existingVersionId,\n        image,\n      });\n      if (!persisted) {\n        if (image.artifactId) {\n          await markSandboxCheckpointArtifactDeletePending(input.db, {\n            accountId: input.accountId,\n            workspaceId: input.workspaceId,\n            artifactId: image.artifactId,\n            reason: \"rig_provider_image_publication_fenced\",\n          }).catch(() => false);\n        }\n        return {\n          ...image,\n          status: \"failed\",\n          imageId: null,\n          imageDigest: null,\n          artifactId: null,\n          providerBindingKeyHash: null,\n          finishedAt: new Date().toISOString(),\n          error: {\n            code: \"provider_image_publication_fenced\",\n            message: \"provider image ownership changed before this build could be published\",\n            retryable: true,\n          },\n        };\n      }\n    }\n    return image;\n  };\n\n  if (!providerSupportsBuild) {\n    return await finalize({\n      ...building,\n      status: \"unsupported\",\n      finishedAt: new Date().toISOString(),\n      error: {\n        code: \"provider_image_build_unsupported\",\n        message: `sandbox backend ${backend} does not support immutable provider image builds`,\n        retryable: false,\n      },\n    });\n  }\n\n  throwIfAborted(input.signal);\n  let builtIdentity: {\n    imageId: string;\n    providerBindingKey: string;\n  } | null = null;\n  let artifactId: string | null = null;\n  let coldBootValidatedAt: string | null = null;\n  try {\n    const built = await buildImmutableProviderImage({\n      backend,\n      settings: input.settings,\n      session: input.established.session,\n      requestId: building.buildRequestId,\n      timeoutMs: input.settings.sandboxSnapshotTimeoutMs,\n    });\n    if (!built || (!built.imageId && !built.imageDigest)) {\n      throw new Error(\"provider image builder returned no immutable image identity\");\n    }\n    if (backend === \"modal\") {\n      if (!built.imageId || !built.providerBindingKey || !built.providerBinding) {\n        throw new Error(\"Modal provider image build returned incomplete ownership identity\");\n      }\n      builtIdentity = {\n        imageId: built.imageId,\n        providerBindingKey: built.providerBindingKey,\n      };\n      const archiveBytes = encodeNativeSnapshotRef({\n        provider: \"modal_snapshot_filesystem\",\n        snapshotId: built.imageId,\n        workspacePersistence: \"snapshot_filesystem\",\n      });\n      const descriptor = describeNativeSnapshotArchive(archiveBytes);\n      if (!descriptor) {\n        throw new Error(\"Modal provider image build returned an invalid snapshot identity\");\n      }\n      const artifact = await registerSandboxCheckpointArtifact(input.db, {\n        accountId: input.accountId,\n        workspaceId: input.workspaceId,\n        sandboxGroupId: input.target.id,\n        sourceLeaseId: input.ownership.leaseId,\n        sourceLeaseEpoch: input.ownership.leaseEpoch,\n        sourceInstanceId: input.ownership.instanceId,\n        sourceWorkspaceGeneration: input.ownership.workspaceGeneration,\n        providerBindingKey: built.providerBindingKey,\n        providerBinding: built.providerBinding,\n        workspaceArchive: Buffer.from(archiveBytes).toString(\"base64\"),\n        workspaceArchiveMeta: descriptor,\n        registrationIdentity: \"provider_object\",\n      });\n      artifactId = artifact.id;\n\n      // A snapshot receipt is not proof that the artifact can cold-start. Boot\n      // a second, independently owned sandbox from the exact image before it\n      // can become runtime-selectable.\n      coldBootValidatedAt = await verifyRigProviderImageColdBoot({\n        settings: input.settings,\n        db: input.db,\n        observability: input.observability,\n        accountId: input.accountId,\n        workspaceId: input.workspaceId,\n        buildRequestId: building.buildRequestId,\n        rigVersionId: input.target.id,\n        sessionIdPrefix: `rig-provider-image-${input.target.id}`,\n        imageId: built.imageId,\n        contentHash,\n        checks: input.definition.checks,\n        lifecycle: input.lifecycle,\n      });\n    }\n    if (!coldBootValidatedAt) {\n      throw new Error(`${backend} provider image build has no independent cold-boot validator`);\n    }\n    if (input.signal.aborted) {\n      if (artifactId) {\n        await markSandboxCheckpointArtifactDeletePending(input.db, {\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          artifactId,\n          reason: \"rig_provider_image_build_cancelled\",\n        }).catch(() => false);\n      }\n      throw abortReason(input.signal);\n    }\n    return await finalize({\n      ...building,\n      provider: built.provider,\n      status: \"ready\",\n      imageId: built.imageId,\n      imageDigest: built.imageDigest,\n      artifactId,\n      providerBindingKeyHash: built.providerBindingKey\n        ? rigProviderImageProviderBindingKeyHash(built.providerBindingKey)\n        : null,\n      coldBootValidation: {\n        version: 1,\n        checkedAt: coldBootValidatedAt,\n      },\n      finishedAt: new Date().toISOString(),\n      error: null,\n    });\n  } catch (error) {\n    if (input.signal.aborted) throw abortReason(input.signal);\n    if (artifactId) {\n      await markSandboxCheckpointArtifactDeletePending(input.db, {\n        accountId: input.accountId,\n        workspaceId: input.workspaceId,\n        artifactId,\n        reason: \"rig_provider_image_build_failed\",\n      }).catch(() => false);\n    } else if (\n      backend === \"modal\" &&\n      builtIdentity &&\n      !(error instanceof SandboxCheckpointArtifactRegistrationConflictError)\n    ) {\n      await deleteModalCheckpointSnapshot(\n        input.settings,\n        builtIdentity.providerBindingKey,\n        builtIdentity.imageId,\n      ).catch(() => \"not_found\" as const);\n    }\n    const message = (error instanceof Error ? error.message : String(error)).slice(0, 2000);\n    return await finalize({\n      ...building,\n      status: \"failed\",\n      artifactId: null,\n      finishedAt: new Date().toISOString(),\n      error: {\n        code: \"provider_image_build_failed\",\n        message: message || \"provider image build failed\",\n        retryable: true,\n      },\n    });\n  }\n}\n\nexport function settingsForRigVerification(\n  settings: ControlActivityServices[\"settings\"],\n  rigImage: string | null,\n): ControlActivityServices[\"settings\"] {\n  // Rig verification must prove setup and provider-image materialization on\n  // the deployment-owned platform base. Historical Rig image values are ignored.\n  void rigImage;\n  return settings;\n}\n\nasync function loadChangeTarget(\n  db: Database,\n  workspaceId: string,\n  changeId: string,\n): Promise<{ rig: Rig; baseVersion: RigVersion; change: RigChange }> {\n  const change = await getRigChange(db, workspaceId, changeId);\n  if (!change) {\n    throw new Error(`Sandbox Environment change not found: ${changeId}`);\n  }\n  const rig = await getRig(db, workspaceId, change.rigId);\n  if (!rig) {\n    throw new Error(`Sandbox Environment not found for change: ${change.rigId}`);\n  }\n  if (!change.baseVersionId) {\n    throw new Error(`Sandbox Environment change ${change.id} has no base version`);\n  }\n  const baseVersion = await getRigVersionById(db, workspaceId, change.baseVersionId);\n  if (!baseVersion || baseVersion.rigId !== rig.id) {\n    throw new Error(`Base sandbox environment version not found: ${change.baseVersionId}`);\n  }\n  return { rig, baseVersion, change };\n}\n\nasync function loadVersionTarget(\n  db: Database,\n  workspaceId: string,\n  versionId: string,\n): Promise<{ rig: Rig; version: RigVersion }> {\n  const version = await getRigVersionById(db, workspaceId, versionId);\n  if (!version) {\n    throw new Error(`Sandbox Environment version not found: ${versionId}`);\n  }\n  const rig = await getRig(db, workspaceId, version.rigId);\n  if (!rig) {\n    throw new Error(`Sandbox Environment not found for version: ${version.rigId}`);\n  }\n  return { rig, version };\n}\n\nasync function withRigVerificationActivityLifecycle<T>(\n  run: (lifecycle: RigVerificationActivityLifecycle) => Promise<T>,\n): Promise<T> {\n  // Context.current() and the immediate heartbeat happen before lazy service\n  // construction, so Temporal can deliver cancellation even while the worker\n  // is opening its first database/provider dependencies.\n  const lifecycle = createRigVerificationActivityLifecycle();\n  try {\n    throwIfAborted(lifecycle.signal);\n    return await run(lifecycle);\n  } finally {\n    lifecycle.dispose();\n  }\n}\n\nexport function createRigVerificationActivities(services: () => Promise<ControlActivityServices>) {\n  return {\n    verifyRigChange: (input: { workspaceId: string; changeId: string }) =>\n      withRigVerificationActivityLifecycle(async (lifecycle) => {\n        const { settings, db, observability } = await services();\n        throwIfAborted(lifecycle.signal);\n        const { rig, baseVersion, change } = await loadChangeTarget(\n          db,\n          input.workspaceId,\n          input.changeId,\n        );\n        const grant = systemGrant(rig);\n        const startedAt = new Date().toISOString();\n        await beginRigChangeVerificationAttempt(db, input.workspaceId, change.id, {\n          startedAt,\n          allowAlreadyVerifying: true,\n        });\n        await recordRigAuditEvent(db, {\n          grant,\n          action: \"rig.verification.started\",\n          rigId: rig.id,\n          metadata: { changeId: change.id },\n        });\n\n        const verification: Record<string, unknown> = { startedAt, checkResults: [] };\n        try {\n          const candidateVersion = candidateVersionForChange(baseVersion, change);\n          const providerImageDefinition = providerImageDefinitionForChange(\n            baseVersion,\n            change,\n            candidateVersion,\n          );\n          const runSettings = settingsForRigVerification(settings, candidateVersion.image);\n          const providerImageContentHash = rigProviderImageContentHash({\n            backend: runSettings.sandboxBackend,\n            sourceImage: rigProviderImageSourceImage(runSettings, runSettings.sandboxBackend),\n            definition: providerImageDefinition,\n          });\n          return await runWithOwnedRigVerificationSandbox(\n            {\n              settings: runSettings,\n              db,\n              observability,\n              accountId: rig.accountId,\n              workspaceId: input.workspaceId,\n              sandboxGroupId: change.id,\n              rigVersionId: candidateVersion.id,\n              sessionIdPrefix: `rig-verification-${change.id}`,\n              lifecycle,\n            },\n            async (established, runContext) => {\n              if ((candidateVersion.setupScript ?? \"\").trim()) {\n                await runRigSetupHook(established.session as never, {\n                  environment: {},\n                  runAs: \"root\",\n                  commandRunner: runContext.commandRunner,\n                  rigSetup: {\n                    rigId: rig.id,\n                    rigName: rig.name,\n                    versionId: candidateVersion.id,\n                    script: candidateVersion.setupScript ?? \"\",\n                    timeoutMs: settings.rigSetupTimeoutMs,\n                    contentHash: providerImageContentHash,\n                  },\n                });\n                verification.setupResult = { exitCode: 0, output: \"\" };\n              }\n              const command = setupAppendCommand(change);\n              if (command) {\n                const commandResult = await runCommand(\n                  established.session as TurnSandboxCommandSession,\n                  command,\n                  settings.rigSetupTimeoutMs,\n                  runContext.commandRunner,\n                );\n                verification.commandResult = commandResult;\n                if (commandResult.exitCode !== 0) {\n                  verification.finishedAt = new Date().toISOString();\n                  verification.passed = false;\n                  const updated = await updateRigChangeStatus(db, input.workspaceId, change.id, {\n                    status: \"rejected\",\n                    verification,\n                  });\n                  await recordRigAuditEvent(db, {\n                    grant,\n                    action: \"rig.verification.failed\",\n                    rigId: rig.id,\n                    metadata: { changeId: change.id, status: \"rejected\" },\n                  });\n                  await recordRigAuditEvent(db, {\n                    grant,\n                    action: \"rig.change.rejected\",\n                    rigId: rig.id,\n                    metadata: { changeId: change.id },\n                  });\n                  return updated;\n                }\n              }\n              const markerResult = await runCommand(\n                established.session as TurnSandboxCommandSession,\n                rigProviderImageContentMarkerCommand(providerImageContentHash),\n                settings.rigSetupTimeoutMs,\n                runContext.commandRunner,\n              );\n              if (markerResult.exitCode !== 0) {\n                throw new Error(\n                  `Failed to seal sandbox environment provider image content marker: ${markerResult.output.slice(-2000)}`,\n                );\n              }\n              const platformCheckResults = await runRigChecks(\n                established.session as TurnSandboxCommandSession,\n                rigPlatformChecksForSettings(runSettings),\n                settings.rigSetupTimeoutMs,\n                runContext.commandRunner,\n              );\n              verification.platformCheckResults = platformCheckResults;\n              const checkResults = await runRigChecks(\n                established.session as TurnSandboxCommandSession,\n                candidateVersion.checks,\n                settings.rigSetupTimeoutMs,\n                runContext.commandRunner,\n              );\n              verification.checkResults = checkResults;\n              const passed =\n                platformCheckResults.every((result) => result.exitCode === 0) &&\n                checkResults.every((result) => result.exitCode === 0);\n              if (passed) {\n                verification.providerImage = await buildVerifiedRigProviderImage({\n                  settings: runSettings,\n                  db,\n                  observability,\n                  accountId: rig.accountId,\n                  workspaceId: input.workspaceId,\n                  definition: providerImageDefinition,\n                  target: { kind: \"change\", id: change.id },\n                  established,\n                  ownership: runContext.ownership,\n                  lifecycle,\n                  signal: runContext.signal,\n                });\n              }\n              verification.finishedAt = new Date().toISOString();\n              verification.passed = passed;\n              const classified = classifyRigVerificationOutcome({ kind: change.kind, passed });\n              if (classified.action === \"auto_promote\") {\n                // Keep the change `verifying` (NOT `proposed`) across the write→promote\n                // gap: promoteSetupAppendChange accepts `verifying`, and leaving it\n                // `verifying` keeps beginRigChangeVerificationAttempt blocking a\n                // concurrent /verify — resetting to `proposed` would reopen that race\n                // (a second run could reject a change whose first verification passed).\n                await updateRigChangeStatus(db, input.workspaceId, change.id, {\n                  status: \"verifying\",\n                  verification,\n                });\n                const { change: merged } = await promoteSetupAppendChange({ db }, grant, rig, {\n                  ...change,\n                  verification,\n                });\n                await recordRigAuditEvent(db, {\n                  grant,\n                  action: \"rig.verification.passed\",\n                  rigId: rig.id,\n                  metadata: { changeId: change.id },\n                });\n                return merged;\n              }\n              const updated = await updateRigChangeStatus(db, input.workspaceId, change.id, {\n                status: classified.status,\n                verification,\n              });\n              await recordRigAuditEvent(db, {\n                grant,\n                action: passed ? \"rig.verification.passed\" : \"rig.verification.failed\",\n                rigId: rig.id,\n                metadata: { changeId: change.id, status: classified.status },\n              });\n              if (!passed) {\n                await recordRigAuditEvent(db, {\n                  grant,\n                  action: \"rig.change.rejected\",\n                  rigId: rig.id,\n                  metadata: { changeId: change.id },\n                });\n              }\n              return updated;\n            },\n          );\n        } catch (error) {\n          verification.finishedAt = new Date().toISOString();\n          verification.passed = false;\n          verification.error = error instanceof Error ? error.message : String(error);\n          const updated = await updateRigChangeStatus(db, input.workspaceId, change.id, {\n            status: \"failed\",\n            verification,\n          });\n          await recordRigAuditEvent(db, {\n            grant,\n            action: \"rig.verification.failed\",\n            rigId: rig.id,\n            metadata: { changeId: change.id, status: \"failed\" },\n          });\n          await recordRigAuditEvent(db, {\n            grant,\n            action: \"rig.change.failed\",\n            rigId: rig.id,\n            metadata: { changeId: change.id },\n          });\n          if (lifecycle.signal.aborted) throw abortReason(lifecycle.signal);\n          return updated;\n        }\n      }),\n\n    verifyRigVersion: (input: { workspaceId: string; versionId: string }) =>\n      withRigVerificationActivityLifecycle(async (lifecycle) => {\n        const { settings, db, observability } = await services();\n        throwIfAborted(lifecycle.signal);\n        const { rig, version } = await loadVersionTarget(db, input.workspaceId, input.versionId);\n        const grant = systemGrant(rig);\n        const startedAt = new Date().toISOString();\n        await recordRigAuditEvent(db, {\n          grant,\n          action: \"rig.verification.started\",\n          rigId: rig.id,\n          metadata: { versionId: version.id },\n        });\n        try {\n          const runSettings = settingsForRigVerification(settings, version.image);\n          const providerImageContentHash = rigProviderImageContentHash({\n            backend: runSettings.sandboxBackend,\n            sourceImage: rigProviderImageSourceImage(runSettings, runSettings.sandboxBackend),\n            definition: version,\n          });\n          return await runWithOwnedRigVerificationSandbox(\n            {\n              settings: runSettings,\n              db,\n              observability,\n              accountId: rig.accountId,\n              workspaceId: input.workspaceId,\n              sandboxGroupId: version.id,\n              rigVersionId: version.id,\n              sessionIdPrefix: `rig-version-verification-${version.id}`,\n              lifecycle,\n            },\n            async (established, runContext) => {\n              if ((version.setupScript ?? \"\").trim()) {\n                await runRigSetupHook(established.session as never, {\n                  environment: {},\n                  runAs: \"root\",\n                  commandRunner: runContext.commandRunner,\n                  rigSetup: {\n                    rigId: rig.id,\n                    rigName: rig.name,\n                    versionId: version.id,\n                    script: version.setupScript ?? \"\",\n                    timeoutMs: settings.rigSetupTimeoutMs,\n                    contentHash: providerImageContentHash,\n                  },\n                });\n              }\n              const markerResult = await runCommand(\n                established.session as TurnSandboxCommandSession,\n                rigProviderImageContentMarkerCommand(providerImageContentHash),\n                settings.rigSetupTimeoutMs,\n                runContext.commandRunner,\n              );\n              if (markerResult.exitCode !== 0) {\n                throw new Error(\n                  `Failed to seal sandbox environment provider image content marker: ${markerResult.output.slice(-2000)}`,\n                );\n              }\n              const platformCheckResults = await runRigChecks(\n                established.session as TurnSandboxCommandSession,\n                rigPlatformChecksForSettings(runSettings),\n                settings.rigSetupTimeoutMs,\n                runContext.commandRunner,\n              );\n              const checkResults = await runRigChecks(\n                established.session as TurnSandboxCommandSession,\n                version.checks,\n                settings.rigSetupTimeoutMs,\n                runContext.commandRunner,\n              );\n              const passed =\n                platformCheckResults.every((result) => result.exitCode === 0) &&\n                checkResults.every((result) => result.exitCode === 0);\n              const providerImage = passed\n                ? await buildVerifiedRigProviderImage({\n                    settings: runSettings,\n                    db,\n                    observability,\n                    accountId: rig.accountId,\n                    workspaceId: input.workspaceId,\n                    existingVersionId: version.id,\n                    definition: version,\n                    target: { kind: \"version\", id: version.id },\n                    established,\n                    ownership: runContext.ownership,\n                    lifecycle,\n                    signal: runContext.signal,\n                  })\n                : null;\n              await recordRigAuditEvent(db, {\n                grant,\n                action: passed ? \"rig.verification.passed\" : \"rig.verification.failed\",\n                rigId: rig.id,\n                metadata: {\n                  versionId: version.id,\n                  startedAt,\n                  finishedAt: new Date().toISOString(),\n                  passed,\n                  platformCheckResults,\n                  checkResults,\n                  providerImage,\n                },\n              });\n              return {\n                versionId: version.id,\n                passed,\n                platformCheckResults,\n                checkResults,\n                providerImage,\n              };\n            },\n          );\n        } catch (error) {\n          // Infra failure (sandbox establish / setup / check exec threw) — record\n          // rig.verification.failed so activeVersionHealth reflects the failed\n          // re-run instead of staying stale, symmetric to verifyRigChange. Then\n          // rethrow so the Temporal activity still surfaces the failure.\n          const detail = error instanceof Error ? error.message : String(error);\n          await recordRigAuditEvent(db, {\n            grant,\n            action: \"rig.verification.failed\",\n            rigId: rig.id,\n            metadata: {\n              versionId: version.id,\n              startedAt,\n              finishedAt: new Date().toISOString(),\n              passed: false,\n              error: detail,\n            },\n          });\n          throw error;\n        }\n      }),\n  };\n}\n","import { getScheduledTaskClaudeProviderAccountAuthoritySnapshot } from \"@opengeni/db\";\nimport {\n  ATLASSIAN_NATIVE_RETIRED_REASON,\n  isRetiredNativeAtlassianTask,\n} from \"@opengeni/contracts/atlassian-native-retirement\";\nimport { GOOGLE_DRIVE_PUBLICATION_SERVER_ID } from \"@opengeni/contracts/google-drive\";\nimport { PERSONAL_GITHUB_CONNECTION_SURFACE_ID } from \"@opengeni/contracts/personal-github\";\nimport {\n  AUTOMATIC_SESSION_TITLE_FALLBACK,\n  DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,\n  OPENGENI_SLACK_BOT_CREDENTIAL_LABEL,\n  OPENGENI_SLACK_BOT_CREDENTIAL_ROLE,\n  OPENGENI_SLACK_BOT_SESSION_METADATA_KEY,\n  resolveWorkspaceCodexCompactionDefault,\n  SCHEDULED_TASK_OCCURRENCE_PAYLOAD_MAX_BYTES,\n  ScheduledTaskRunAcceptedExecution,\n  SessionAgentAccess,\n  SessionMemoryScope,\n  normalizeAutomaticSessionTitle,\n  metadataWithTurnExecutionPolicyV1,\n  mergeResourceRefs,\n  resolveWorkspaceSessionToolDefaults,\n  scheduledOccurrencePayloadUtf8Bytes,\n  stableJson,\n  TurnExecutionPolicyV1,\n  type McpConnectionAccountSelection,\n  type ScheduledTask,\n  type ScheduledTaskDegradedAccount,\n  type ScheduledTaskRun,\n  type ResolvedAgentConfig,\n} from \"@opengeni/contracts\";\nimport {\n  openGeniSlackBotMetadata,\n  requireOpenGeniSlackBotConnection,\n  withScheduledSlackBotPostingTools,\n  resolveWorkspaceCatalogSettings,\n  resolveScheduledTaskDefaultModel,\n  resolveSessionToolPolicy,\n  workspaceCustomModelReference,\n  lockActiveCustomModelForAdmission,\n  scheduledSlackBotConnectionId,\n  freezeConnectionAccounts,\n  ConnectionAccountSelectionError,\n  scheduledConnectionSurfaceEligibility,\n  scheduledConnectionTools,\n  scheduledTaskRunTools,\n  settingsWithEnabledCapabilityMcpServers,\n  settingsWithSessionMcpServerMetadata,\n  swapActiveSandbox,\n  applySessionAgentConfigWriteThrough,\n  resolveSessionAgentConfigForCreate,\n  recordSessionCreated,\n  recordUserMessageAccepted,\n  type ProductUsageMetricsSink,\n} from \"@opengeni/core\";\nimport {\n  appendSessionEvents,\n  addSessionSystemUpdateWithSourceMutation,\n  bindScheduledTaskRunSessionInTransaction,\n  checkSessionUsageLimitAdmission,\n  createScheduledTaskRun,\n  recordScheduledTaskAdmissionFailure,\n  recordScheduledTaskAdmissionRefusal,\n  type ScheduledTaskAdmissionRefusalReason,\n  createSession,\n  createSessionWithIdempotencyKeyResult,\n  enqueueSessionWorkflowWakeIfRunnable,\n  failScheduledGeneratedSessionRoute,\n  getScheduledTask,\n  getScheduledTaskCreatorPolicy,\n  getScheduledTaskRunAcceptedExecution,\n  getScheduledTaskRunByProducerKey,\n  getScheduledTargetSessionExecution,\n  getScheduledTaskRunPersonalResourceAuthority,\n  getScheduledTaskPersonalResourceAuthoritySubject,\n  getScheduledTaskRevisionAuthority,\n  getScheduledTaskSubscriptionAuthority,\n  getScheduledTaskXaiProviderAccountAuthoritySnapshot,\n  getEnrollment,\n  getSandbox,\n  getSessionAuthorityEpoch,\n  issueSelfUserResourceGrant,\n  listSelfUserResourceAuthorities,\n  getRig,\n  getScheduledScopedRigVersionMetadata,\n  getNestedAgentDepthDeploymentPolicy,\n  getSessionByCreateIdempotencyKey,\n  getSessionCreationExecutionPolicy,\n  metadataWithAgentConfigCreateIdentity,\n  getVariableSet,\n  isCodexBilledModel,\n  initializeSessionStartAtomically,\n  materializeScheduledTaskReusableSessionFromRun,\n  listInstalledApiIntegrationServerIdsForDelegations,\n  markScheduledTaskRunFailedIfQueued,\n  markScheduledTaskRunSkippedIfQueued,\n  recordUsageEvent,\n  requireScheduledTaskIncidentAuthorityInTransaction,\n  requireSession,\n  requireWorkspace,\n  settleScheduledTaskRunInTransaction,\n  SessionSpawnDeniedDbError,\n  updateSessionTitleWithEvent,\n  upsertScheduledSessionGoalForRun,\n  withSessionActivityRlsContext,\n  withWorkspaceSubjectRls,\n} from \"@opengeni/db\";\nimport { publishDurableSessionEvents } from \"@opengeni/events\";\nimport {\n  allowedFirstPartyMcpToolsForSession,\n  resolveSessionFirstPartyMcpTools,\n  resolveFirstPartyMcpToolPolicy,\n  resolveTurnExecutionPolicyV1,\n  TurnExecutionPolicyModelUnavailableError,\n} from \"@opengeni/config\";\nimport { Context } from \"@temporalio/activity\";\nimport { createHash } from \"node:crypto\";\nimport {\n  assertReusableSessionRevivable,\n  scheduledUserMessagePayload,\n  workflowIdForSession,\n} from \"./common\";\nimport { withFirstPartyTools } from \"./goals\";\nimport { agentRunAdmissionDenial } from \"./agent-run-admission\";\nimport {\n  scheduledAlertOccurrenceIdentity,\n  scheduledAlertResponderSessionCreateIdempotencyKey,\n} from \"../scheduled-alert-occurrence\";\nimport {\n  evaluateIncidentTelemetryPreflight,\n  incidentTelemetryAuthorityFence,\n  incidentTelemetryPreflightDeclaration,\n  INCIDENT_TELEMETRY_AUTHORITY_FENCE_LINEAGE_KEY,\n  type IncidentTelemetryPreflightBlockReason,\n} from \"./incident-telemetry-preflight\";\nimport { resolveIncidentTelemetryResponderMetadata } from \"./incident-telemetry-authority\";\nimport type {\n  ControlActivityServices,\n  DispatchScheduledTaskRunInput,\n  DispatchScheduledTaskRunResult,\n  WakeSessionWorkflowSignal,\n} from \"./types\";\nimport type { Database } from \"@opengeni/db\";\n\ntype ScheduledTemporalActivityIdentity = {\n  namespace: string;\n  workflowExecution?: { workflowId: string; runId: string };\n  activityId: string;\n};\n\nexport function scheduledTaskRunExecutionPolicy(\n  policy: TurnExecutionPolicyV1,\n  input: DispatchScheduledTaskRunInput,\n  creatorRestriction?: \"developer_setup\",\n): TurnExecutionPolicyV1 {\n  return creatorRestriction === \"developer_setup\" ||\n    (input.triggerType !== \"scheduled\" && input.credentialRestriction === \"developer_setup\")\n    ? { ...policy, credentialRestriction: \"developer_setup\" }\n    : policy;\n}\n\n/** Only a creator ceiling is standing; a manual caller ceiling is per-run. */\nexport function scheduledSessionExecutionPolicyMetadata(\n  policy: unknown,\n  creatorRestriction?: \"developer_setup\",\n): Record<string, unknown> {\n  if (policy === undefined || policy === null) return {};\n  const acceptedPolicy = TurnExecutionPolicyV1.parse(policy);\n  return creatorRestriction === \"developer_setup\" &&\n    acceptedPolicy.credentialRestriction === \"developer_setup\"\n    ? metadataWithTurnExecutionPolicyV1({}, acceptedPolicy)\n    : {};\n}\n\nexport function scheduledTaskRunProducerKey(\n  input: DispatchScheduledTaskRunInput,\n  suppliedActivityIdentity?: ScheduledTemporalActivityIdentity,\n): string {\n  if (input.producerKey) return input.producerKey;\n  if (input.triggerType !== \"scheduled\") return input.agentRunUsageIdempotencyKey;\n\n  let info = suppliedActivityIdentity;\n  if (!info) {\n    try {\n      info = Context.current().info;\n    } catch {\n      throw new Error(\n        \"scheduled task delivery without a producer key requires a Temporal activity execution\",\n      );\n    }\n  }\n  if (!info.workflowExecution) {\n    throw new Error(\"scheduled task Temporal activity is missing its workflow execution identity\");\n  }\n  return `scheduled-temporal:${stableJson({\n    namespace: info.namespace,\n    workflowId: info.workflowExecution.workflowId,\n  })}`;\n}\n\nexport function scheduledTaskGeneratedSessionCreateIdempotencyKey(producerKey: string): string {\n  const digest = createHash(\"sha256\")\n    .update(\"scheduled-task-run\\0\", \"utf8\")\n    .update(producerKey, \"utf8\")\n    .digest(\"hex\");\n  return `scheduled-task-run:${digest}`;\n}\n\n/**\n * Display title for a session the scheduler generates for a task.\n *\n * A scheduled session's `initialMessage` is the task prompt, byte-identical for\n * every run. The task name is the short human-chosen label that actually\n * identifies it, so that is the title.\n *\n * The title is the task name and NOTHING else. It deliberately does not name the\n * run's fire instant, for two independent reasons:\n *\n *   - No run mode guarantees one run per session. `reusable_session` generates\n *     its session on the first fire and then reuses it forever, and even under\n *     `new_session_per_run` alert-occurrence redelivery converges several runs\n *     onto one canonical responder session. `existing_session` never generates a\n *     session at all, so the scheduler never titles one. A run-specific fact\n *     frozen into the title is therefore right for the generating run and a lie\n *     for every run that lands in the same session afterwards.\n *   - A title is one stored string shown to every viewer, while every surface\n *     that renders a run's fire instant renders it viewer-local: the rail row\n *     prints the title beside `relativeTimeLabel(session.updatedAt)`, and the\n *     Schedules run list prints `formatTimestamp(run.firedAt)`, which is\n *     `toLocaleString()`. A wall clock stored in the title therefore disagrees\n *     with the time printed next to it for every viewer outside whichever zone\n *     it was rendered in. The task's own `timeZone` is no escape: it labels the\n *     schedule rule (\"Mon Wed 09:00 Europe/Oslo\"), not the rendering of a run,\n *     which stays viewer-local. No stored clock can agree with a viewer-local\n *     one, so the title carries none and the instant stays on the surfaces that\n *     already render it correctly.\n *\n * Dropping the clock settles the determinism constraint outright rather than\n * working around it: the same run titled by the normal dispatch or by a later\n * recovery in a different worker process derives one string from `task.name`\n * alone, with no Intl call and so no host ICU or tzdata build to make the two\n * texts differ.\n */\n/** A scheduler-generated run session: a service-created root session. */\nfunction recordScheduledSessionCreated(observability: ProductUsageMetricsSink | undefined): void {\n  recordSessionCreated(observability, {\n    surface: \"scheduled\",\n    createdByKind: \"service\",\n    parentSessionId: null,\n  });\n}\n\nexport function scheduledTaskSessionTitle(taskName: string): string {\n  return normalizeAutomaticSessionTitle(taskName) ?? \"Scheduled run\";\n}\n\n/**\n * Title a session the scheduler generated, and emit the same `session.title_set`\n * event every other title write in the product emits.\n *\n * This uses the same database operation as `@opengeni/core`\n * `updateSessionTitle`: the clobber/CAS guarded row update and its identical\n * `session.title_set` append commit together under the session event lock. A\n * newer writer therefore cannot land between the authoritative row change and\n * an older event. Without the event a live subscriber sees nothing:\n * `packages/react/src/hooks/use-session.ts` patches an open session's title\n * exclusively on `session.title_set`, so a bare row write leaves the viewer on\n * the stale title until an unrelated refetch.\n *\n * The core wrapper itself is not called, because its only additional behavior is\n * `requireSessionAuthorization(grant, ...)` - a check on an HTTP/MCP caller's\n * grant. The scheduler has no such grant; it is naming a session it just created\n * itself moments earlier. Satisfying that gate would mean fabricating a subject,\n * and the gate would then answer for it: a session later transitioned to\n * `user_private` denies any actor whose subject is not the owner\n * (`packages/core/src/session-authorization.ts`), which would turn naming a\n * session into a way to fail a dispatch. Authorization belongs to callers with\n * grants; the durable write and its event are the part that is shared.\n *\n * Only the neutral create fallback is replaced. A keyed create replay can hand\n * back a session that has already run, and recovery re-enters this path for a\n * session the dead dispatch may already have titled; in both cases whatever the\n * agent or a human chose is newer truth than this stamp. The fallback check is\n * part of the UPDATE itself, not a stale session-object precheck, so a title\n * committed between dispatch read and stamp cannot be overwritten.\n *\n * `source: \"agent\"` is deliberate, and is the only system-assigned value the\n * schema offers (`Session.titleSource` is \"user\" | \"agent\" | null). The database\n * clobber guard pins only a `user` title, so this title still lets the agent\n * rename its own session through set_session_title, and a human rename still\n * wins permanently. Writing \"user\" here would quietly make every scheduled\n * session unrenameable by the agent that runs in it.\n *\n * Returns the appended events so the caller can route them through the same\n * defer-or-publish path as every other event this dispatch produces.\n */\nexport async function stampScheduledSessionTitle(\n  db: Database,\n  input: {\n    workspaceId: string;\n    sessionId: string;\n    taskName: string;\n  },\n): Promise<Awaited<ReturnType<typeof updateSessionTitleWithEvent>>[\"events\"]> {\n  const title = scheduledTaskSessionTitle(input.taskName);\n  const result = await updateSessionTitleWithEvent(db, {\n    workspaceId: input.workspaceId,\n    sessionId: input.sessionId,\n    title,\n    source: \"agent\",\n    expectedCurrent: {\n      title: AUTOMATIC_SESSION_TITLE_FALLBACK,\n      source: \"agent\",\n    },\n  });\n  return result.events;\n}\n\nexport function createScheduledTaskActivities(services: () => Promise<ControlActivityServices>) {\n  return {\n    dispatchScheduledTaskRun: async (\n      input: DispatchScheduledTaskRunInput,\n    ): Promise<DispatchScheduledTaskRunResult> => {\n      const baseService = await services();\n      // Histories created before the manual-initiator workflow patch already\n      // contain this activity command. Reject their incomplete wire input here\n      // so replay consumes the recorded command and the retry loop settles.\n      if (input.triggerType !== \"scheduled\" && !input.initiator) {\n        return { action: \"blocked\", reason: \"malformed_manual_trigger\" };\n      }\n      const { db, bus, wakeSessionWorkflow } = baseService;\n      const settingsForTask = async (task: ScheduledTask, retainedProductModelId?: string | null) =>\n        (\n          await resolveWorkspaceCatalogSettings(\n            db,\n            baseService.catalogSourceSettings ?? baseService.settings,\n            {\n              accountId: task.accountId,\n              workspaceId: task.workspaceId,\n              ...(retainedProductModelId !== undefined ? { retainedProductModelId } : {}),\n            },\n          )\n        ).settings;\n      const stableProducerKey = scheduledTaskRunProducerKey(input);\n      const priorRun = await getScheduledTaskRunByProducerKey(db, {\n        workspaceId: input.workspaceId,\n        taskId: input.taskId,\n        triggerType: input.triggerType,\n        producerKey: stableProducerKey,\n      });\n      if (priorRun?.actionKind === \"agent_turn\") {\n        if (priorRun.admissionDiagnostic || priorRun.admissionRefusal) {\n          return scheduledAdmissionRefusalResult(priorRun);\n        }\n        const acceptedExecution = await getScheduledTaskRunAcceptedExecution(db, {\n          workspaceId: input.workspaceId,\n          runId: priorRun.id,\n        });\n        if (!acceptedExecution) {\n          if (\n            priorRun.status === \"succeeded\" ||\n            priorRun.status === \"failed\" ||\n            priorRun.status === \"skipped\"\n          ) {\n            return scheduledRunTerminalResult(priorRun.error);\n          }\n          throw new Error(\"scheduled agent run is missing accepted execution truth\");\n        }\n        if (priorRun.status === \"queued\" && isRetiredNativeAtlassianTask(acceptedExecution.task)) {\n          await markScheduledTaskRunFailedIfQueued(\n            db,\n            priorRun.workspaceId,\n            priorRun.id,\n            ATLASSIAN_NATIVE_RETIRED_REASON,\n          );\n          return scheduledRunTerminalResult(ATLASSIAN_NATIVE_RETIRED_REASON);\n        }\n        await recordScheduledTaskFiredUsage(db, acceptedExecution, priorRun);\n        if (priorRun.status === \"dispatched\") {\n          return await replayScheduledTaskDispatch({\n            db,\n            wakeSessionWorkflow,\n            task: acceptedExecution.task,\n            run: priorRun,\n            acceptedExecution,\n          });\n        }\n        if (priorRun.status === \"queued\") {\n          const acceptedPolicy = acceptedExecution.turnExecutionPolicy\n            ? TurnExecutionPolicyV1.parse(acceptedExecution.turnExecutionPolicy)\n            : null;\n          const settings = await settingsForTask(\n            acceptedExecution.task,\n            acceptedPolicy?.productModelId ??\n              acceptedExecution.targetSessionExecution?.model ??\n              acceptedExecution.resolvedModel,\n          );\n          try {\n            return await recoverBoundScheduledTaskDispatch({\n              db,\n              observability: baseService.observability,\n              bus,\n              settings,\n              wakeSessionWorkflow,\n              run: priorRun,\n              acceptedExecution,\n              input,\n            });\n          } catch (error) {\n            const terminalError = scheduledRunRecoveryTerminalError(error);\n            if (!terminalError) throw error;\n            await markScheduledTaskRunFailedIfQueued(\n              db,\n              priorRun.workspaceId,\n              priorRun.id,\n              terminalError.code,\n            );\n            return scheduledRunTerminalResult(terminalError.code);\n          }\n        }\n        if (priorRun.status === \"succeeded\") {\n          if (!priorRun.sessionId || !priorRun.triggerEventId) {\n            throw new Error(\"succeeded scheduled run is missing its delivery identity\");\n          }\n          return {\n            action: acceptedExecution.task.runMode === \"new_session_per_run\" ? \"start\" : \"signal\",\n            accountId: acceptedExecution.task.accountId,\n            workspaceId: acceptedExecution.task.workspaceId,\n            sessionId: priorRun.sessionId,\n            triggerEventId: priorRun.triggerEventId,\n            workflowId: workflowIdForSession(priorRun.sessionId),\n            workflowWakeRevision: null,\n          };\n        }\n        if (priorRun.status === \"failed\" || priorRun.status === \"skipped\") {\n          return scheduledRunTerminalResult(priorRun.error);\n        }\n      }\n      const task = await getScheduledTask(db, input.workspaceId, input.taskId);\n      // Deleting a schedule is authoritative. A fire workflow that was already\n      // created may still start afterward; completing it as a no-op prevents an\n      // unbounded retry loop for work that no longer exists.\n      if (!task) {\n        return { action: \"deleted\" };\n      }\n      if (isRetiredNativeAtlassianTask(task))\n        return { action: \"blocked\", reason: ATLASSIAN_NATIVE_RETIRED_REASON };\n      if (task.action.kind !== \"agent_turn\") {\n        return { action: \"blocked\", reason: \"legacy_source_schedule_requires_migration\" };\n      }\n      if (task.status !== \"active\") {\n        return { action: \"blocked\", reason: \"scheduled_task_paused\" };\n      }\n      if (task.agentConfig.knowledgeSource && knowledgeSourceSyncEffectivelyPaused(task)) {\n        return { action: \"blocked\", reason: \"knowledge_source_paused\" };\n      }\n      const structuredAlertOccurrence = scheduledAlertOccurrenceIdentity({\n        workspaceId: task.workspaceId,\n        scheduledTaskId: task.id,\n        metadata: task.metadata,\n      });\n      const alertOccurrence =\n        task.runMode === \"new_session_per_run\" ? structuredAlertOccurrence : null;\n      const alertResponderSessionCreateIdempotencyKey = alertOccurrence\n        ? scheduledAlertResponderSessionCreateIdempotencyKey({\n            occurrence: alertOccurrence,\n            taskAuthorityRevision: task.authorityRevision,\n            taskExecutionDigest: task.executionDigest,\n          })\n        : null;\n      const incidentDeclaration = incidentTelemetryPreflightDeclaration(\n        task.agentConfig,\n        structuredAlertOccurrence !== null,\n      );\n      if (incidentDeclaration.action === \"blocked\") {\n        return incidentDeclaration;\n      }\n      const taskPersonalResourceAuthoritySubjectId =\n        await getScheduledTaskPersonalResourceAuthoritySubject(db, {\n          accountId: task.accountId,\n          workspaceId: task.workspaceId,\n          taskId: task.id,\n          taskAuthorityRevision: task.authorityRevision,\n        });\n      const taskRevisionAuthority = await getScheduledTaskRevisionAuthority(db, {\n        accountId: task.accountId,\n        workspaceId: task.workspaceId,\n        taskId: task.id,\n        taskAuthorityRevision: task.authorityRevision,\n      });\n      const taskAuthoritySubjectId = task.ownerSubjectId;\n      // Every pre-admission refusal below is recorded as a visible run receipt\n      // under this producer identity instead of throwing (a thrown activity is\n      // retried to exhaustion and leaves no run) or returning a bare blocked\n      // result (the occurrence silently disappears). Terminal refusals are\n      // deterministic for this task revision and digest; transient ones\n      // (`retryable`) are skipped and a later occurrence is admitted normally.\n      // Redelivery replays the same receipt, so no occurrence gets two runs.\n      const refuseAdmission = async (\n        reason: ScheduledTaskAdmissionRefusalReason,\n        retryable: boolean,\n        detail: string,\n      ): Promise<DispatchScheduledTaskRunResult> => {\n        console.warn(\n          `[scheduled-task] refused occurrence of ${task.id} (revision ${task.authorityRevision}): ${reason}: ${detail}`,\n        );\n        const receipt = await recordScheduledTaskAdmissionRefusal(db, {\n          workspaceId: task.workspaceId,\n          taskId: task.id,\n          taskAuthorityRevision: task.authorityRevision,\n          taskExecutionDigest: task.executionDigest,\n          triggerType: input.triggerType,\n          producerKey: stableProducerKey,\n          reason,\n          retryable,\n        });\n        if (!receipt.admissionRefusal) {\n          // A concurrent delivery accepted this producer first. Follow the\n          // existing exact-receipt recovery path, never replace its outcome.\n          return createScheduledTaskActivities(services).dispatchScheduledTaskRun(input);\n        }\n        return scheduledAdmissionRefusalResult(receipt);\n      };\n      if (\n        task.action.kind === \"agent_turn\" &&\n        ((taskRevisionAuthority?.subjectId ?? null) !== taskAuthoritySubjectId ||\n          [taskPersonalResourceAuthoritySubjectId].some(\n            (subject) => subject !== null && subject !== taskAuthoritySubjectId,\n          ))\n      ) {\n        return await refuseAdmission(\n          \"scheduled_authority_unavailable\",\n          false,\n          \"scheduled authority differs from its immutable execution owner\",\n        );\n      }\n      const acceptedTargetSessionId =\n        task.runMode === \"existing_session\"\n          ? task.targetSessionId\n          : task.runMode === \"reusable_session\"\n            ? task.reusableSessionId\n            : null;\n      // A targeted task whose exact session was deleted has no target to\n      // resolve; database admission settles that occurrence terminally\n      // (`scheduled_target_session_unavailable`) instead of retrying forever.\n      // Resolve this before the catalog so an existing session's retired\n      // custom Gateway model remains executable without becoming selectable\n      // for a new scheduled session.\n      const targetSessionExecutionBase = acceptedTargetSessionId\n        ? await getScheduledTargetSessionExecution(\n            db,\n            task.workspaceId,\n            acceptedTargetSessionId,\n            taskAuthoritySubjectId,\n          )\n        : null;\n      const settings = await settingsForTask(task, targetSessionExecutionBase?.model);\n      // A task that names no model resolves the new-chat default at each fresh\n      // occurrence (saved workspace default, then a usable connected\n      // subscription under the task's frozen SuperGrok authority, then the\n      // credits default while the organization holds a credit balance, then the\n      // deployment default). A frozen SuperGrok pool that is gone only means\n      // SuperGrok is not ready. The accepted execution freezes the result, so\n      // retries and recovery never resolve again. Existing-session runs keep\n      // that session's model.\n      const resolvedDefault =\n        task.agentConfig.model || targetSessionExecutionBase\n          ? null\n          : await resolveScheduledTaskDefaultModel(db, settings, task);\n      const model = task.agentConfig.model ?? resolvedDefault?.model ?? settings.openaiModel;\n      const reasoningEffort =\n        task.agentConfig.reasoningEffort ??\n        resolvedDefault?.reasoningEffort ??\n        settings.openaiReasoningEffort;\n      let sandboxBackend = task.agentConfig.sandboxBackend ?? settings.sandboxBackend;\n      let sandboxOs: \"linux\" | \"macos\" | \"windows\" = \"linux\";\n      // A schedule that follows the workspace defaults gets them as they are\n      // now, from the owner's registry; nothing about them was saved with it.\n      const runTools = task.agentConfig.toolPolicy\n        ? scheduledTaskRunTools({\n            agentConfig: task.agentConfig,\n            settings,\n            runtimeSettings: await settingsWithEnabledCapabilityMcpServers(\n              db,\n              task.workspaceId,\n              settings,\n              taskAuthoritySubjectId ? { subjectId: taskAuthoritySubjectId } : {},\n            ),\n            workspaceDefaults: resolveWorkspaceSessionToolDefaults(\n              (await requireWorkspace(db, task.workspaceId)).settings,\n            ),\n          })\n        : task.agentConfig.tools;\n      let taskTools = withFirstPartyTools(settings, runTools);\n      // A task created by a live agent attempt froze its creator's effective\n      // first-party selection, permission set, and session access policy;\n      // its generated sessions inherit that boundary under today's\n      // deployment ceiling. A human/API-created task (null policy) keeps the\n      // deployment default exactly as before.\n      const creatorPolicy = await getScheduledTaskCreatorPolicy(db, task.workspaceId, task.id);\n      // A person-chosen Slack channel adds only the two bot posting tools;\n      // they post nowhere else, whatever the creator's own selection was.\n      let firstPartyMcpTools = withScheduledSlackBotPostingTools(\n        creatorPolicy?.firstPartyMcpTools\n          ? allowedFirstPartyMcpToolsForSession(settings, creatorPolicy.firstPartyMcpTools)\n          : resolveFirstPartyMcpToolPolicy(settings).default,\n        task.agentConfig,\n        resolveFirstPartyMcpToolPolicy(settings).allowed,\n      );\n      // Agent configuration for generated sessions (null = legacy). The\n      // scheduled baseline above (creator policy or deployment default) is\n      // what \"all\" reproduces; capabilities only narrow it. Frozen into the\n      // accepted execution so retries and recovery never resolve again.\n      let resolvedAgentConfig: ResolvedAgentConfig | null = null;\n      let resolvedAgentInstructions: string | undefined;\n      const generatedTarget =\n        task.runMode === \"new_session_per_run\" ||\n        (task.runMode === \"reusable_session\" && task.reusableSessionId === null);\n      if (generatedTarget) {\n        try {\n          const agentResolution = resolveSessionAgentConfigForCreate({\n            settings,\n            creator: \"scheduled\",\n            request: task.agentConfig.agent,\n            instructions: undefined,\n            workspaceSettings: (await requireWorkspace(db, task.workspaceId)).settings,\n            parent: null,\n            goal: task.agentConfig.goal !== undefined,\n          });\n          resolvedAgentConfig = agentResolution.config;\n          resolvedAgentInstructions = agentResolution.instructions;\n          const written = applySessionAgentConfigWriteThrough({\n            config: resolvedAgentConfig,\n            firstPartyMcpTools,\n            tools: taskTools,\n            toolPolicy: { mode: \"explicit\", inheritedFromSessionId: null },\n            productServerIds: runTools.map((tool) => tool.id),\n          });\n          firstPartyMcpTools = written.firstPartyMcpTools;\n          taskTools = written.tools;\n        } catch (error) {\n          const status =\n            error instanceof Error ? (error as Error & { status?: unknown }).status : undefined;\n          if (!(error instanceof Error) || status !== 422) throw error;\n          return await refuseAdmission(\n            \"scheduled_authority_unavailable\",\n            false,\n            `scheduled agent configuration is not admissible: ${error.message}`,\n          );\n        }\n      }\n      const firstPartyMcpPermissions = creatorPolicy?.firstPartyMcpPermissions\n        ? [...creatorPolicy.firstPartyMcpPermissions]\n        : [...DEFAULT_FIRST_PARTY_MCP_PERMISSIONS];\n      // A fresh occurrence resolves the immutable owner's current accounts.\n      // Retry/recovery above uses the already accepted occurrence snapshot.\n      const connectionSettings = await settingsWithEnabledCapabilityMcpServers(\n        db,\n        task.workspaceId,\n        settings,\n        taskAuthoritySubjectId ? { subjectId: taskAuthoritySubjectId } : {},\n      );\n      const connectionTarget =\n        acceptedTargetSessionId && targetSessionExecutionBase\n          ? await requireSession(db, task.workspaceId, acceptedTargetSessionId)\n          : null;\n      const toolWorkspaceSettings = (await requireWorkspace(db, task.workspaceId)).settings;\n      let connectionTools = await scheduledConnectionTools(\n        db,\n        task.workspaceId,\n        connectionSettings,\n        connectionTarget,\n        taskTools,\n        taskAuthoritySubjectId ?? undefined,\n      );\n      // Connector accounts resolve live at each fresh occurrence: every\n      // connector uses the owner's current accounts. Only an account a person\n      // pinned on a schedule that starts its own session narrows its\n      // connector. An existing-chat schedule never pins; that chat supplies\n      // its connectors and the owner's current accounts.\n      let runPins: McpConnectionAccountSelection[] =\n        task.runMode === \"existing_session\" ? [] : [...(task.agentConfig.pinnedAccounts ?? [])];\n      const surfaceEligibility = scheduledConnectionSurfaceEligibility(\n        settings,\n        connectionTarget ?? {\n          firstPartyMcpTools,\n          firstPartyMcpPermissions,\n        },\n        toolWorkspaceSettings,\n      );\n      const resolveTaskConnections = () =>\n        freezeConnectionAccounts({\n          db,\n          accountId: task.accountId,\n          workspaceId: task.workspaceId,\n          settings: connectionTarget\n            ? settingsWithSessionMcpServerMetadata(connectionSettings, connectionTarget.mcpServers)\n            : connectionSettings,\n          tools: connectionTools,\n          resources: mergeResourceRefs(\n            connectionTarget?.resources ?? [],\n            task.agentConfig.resources,\n          ),\n          source: taskAuthoritySubjectId\n            ? { kind: \"subject\", subjectId: taskAuthoritySubjectId, accountId: task.accountId }\n            : { kind: \"none\" },\n          authoritySelections: runPins,\n          ...surfaceEligibility,\n        }).catch((error: unknown) => {\n          if (error instanceof ConnectionAccountSelectionError) return error;\n          throw error;\n        });\n      let taskConnections = await resolveTaskConnections();\n      // A pinned account that can no longer be used is never replaced by\n      // another account. Unless the schedule requires its pinned accounts,\n      // the occurrence goes ahead without that connector and records what it\n      // ran without, so its owner can be told; a connector keeps any of its\n      // pins that still work.\n      const degradedAccounts: ScheduledTaskDegradedAccount[] = [];\n      while (\n        taskConnections instanceof ConnectionAccountSelectionError &&\n        task.agentConfig.pinnedAccountsRequired !== true\n      ) {\n        const failure: ConnectionAccountSelectionError = taskConnections;\n        const stale = scheduledStalePins(runPins, failure);\n        // A personal repository pin is bound to the schedule's repository\n        // resources; there is no connector to leave out, so it cannot degrade.\n        if (\n          stale.length === 0 ||\n          stale.some((pin) => pin.serverId === PERSONAL_GITHUB_CONNECTION_SURFACE_ID)\n        ) {\n          break;\n        }\n        degradedAccounts.push(...stale);\n        const staleKeys = new Set(stale.map(scheduledPinKey));\n        const staleServerIds = new Set(stale.map((pin) => pin.serverId));\n        runPins = runPins.filter((pin) => !staleKeys.has(scheduledPinKey(pin)));\n        const droppedServerIds = new Set(\n          [...staleServerIds].filter(\n            (serverId) => !runPins.some((pin) => pin.serverId === serverId),\n          ),\n        );\n        if (droppedServerIds.has(GOOGLE_DRIVE_PUBLICATION_SERVER_ID)) {\n          surfaceEligibility.googleDrivePublicationEnabled = false;\n        }\n        connectionTools = connectionTools.filter(\n          (tool) => !(tool.kind === \"mcp\" && droppedServerIds.has(tool.id)),\n        );\n        taskTools = taskTools.filter(\n          (tool) => !(tool.kind === \"mcp\" && droppedServerIds.has(tool.id)),\n        );\n        taskConnections = await resolveTaskConnections();\n      }\n      if (taskConnections instanceof ConnectionAccountSelectionError) {\n        const receipt = await recordScheduledTaskAdmissionFailure(db, {\n          workspaceId: task.workspaceId,\n          taskId: task.id,\n          taskAuthorityRevision: task.authorityRevision,\n          taskExecutionDigest: task.executionDigest,\n          triggerType: input.triggerType,\n          producerKey: stableProducerKey,\n          diagnostic: taskConnections.diagnostic,\n        });\n        if (!receipt.admissionDiagnostic) {\n          // A concurrent delivery accepted this producer first. Follow the\n          // existing exact-receipt recovery path, never replace its outcome.\n          return createScheduledTaskActivities(services).dispatchScheduledTaskRun(input);\n        }\n        return scheduledAdmissionRefusalResult(receipt);\n      }\n      const {\n        personalConnectionDelegations: taskPersonalConnectionDelegations,\n        mcpAccountBindings: taskMcpAccountBindings,\n        connectionAccountIntent: taskConnectionAccountIntent,\n      } = taskConnections;\n      const taskConnectionAuthoritySubjectId =\n        taskPersonalConnectionDelegations.length > 0 ? taskAuthoritySubjectId : null;\n      const creatorSessionPolicy = scheduledCreatorSessionPolicyInput(\n        creatorPolicy?.sessionPolicy ?? null,\n      );\n      let acceptedPersonalMachine = false;\n      if (generatedTarget && task.agentConfig.machineTarget) {\n        const access = {\n          accountId: task.accountId,\n          workspaceId: task.workspaceId,\n          subjectId: taskAuthoritySubjectId ?? task.createdBy.subjectId,\n        };\n        const machine = await getSandbox(\n          db,\n          access,\n          task.agentConfig.machineTarget.targetSandboxId,\n        );\n        // A personal machine runs only its owner's Only me schedule. The scoped\n        // lookup returns a personal machine to its owner alone, and every attempt\n        // re-proves the owner's membership, workspace access and grant in the\n        // database before the machine is used.\n        if (\n          !machine ||\n          machine.kind !== \"selfhosted\" ||\n          !machine.enrollmentId ||\n          (machine.scope === \"user\" && !personalMachineScheduleOwner(task, access.subjectId))\n        ) {\n          return await refuseAdmission(\n            \"machine_target_unavailable\",\n            false,\n            \"scheduled Connected Machine target is unavailable\",\n          );\n        }\n        const enrollment = await getEnrollment(db, access, machine.enrollmentId);\n        if (!enrollment) {\n          return await refuseAdmission(\n            \"machine_target_unavailable\",\n            false,\n            \"scheduled Connected Machine enrollment is gone\",\n          );\n        }\n        if (enrollment.status !== \"active\") {\n          // A paused/suspended enrollment can be re-activated; skip this\n          // occurrence rather than failing the schedule.\n          return await refuseAdmission(\n            \"machine_enrollment_inactive\",\n            true,\n            `scheduled Connected Machine enrollment is ${enrollment.status}`,\n          );\n        }\n        sandboxBackend = \"selfhosted\";\n        sandboxOs = enrollment.os;\n        acceptedPersonalMachine = machine.scope === \"user\";\n      } else if (generatedTarget && sandboxBackend === \"selfhosted\") {\n        return await refuseAdmission(\n          \"machine_target_unavailable\",\n          false,\n          \"self-hosted scheduled task has no Connected Machine target\",\n        );\n      }\n      const generatedSessionDepthPolicy = generatedTarget\n        ? await (async () => {\n            const workspace = await requireWorkspace(db, task.workspaceId);\n            const deployment = await getNestedAgentDepthDeploymentPolicy(db);\n            const taskOverride = task.agentConfig.maxNestedAgentDepth ?? null;\n            const workspaceOverride =\n              typeof workspace.settings.maxNestedAgentDepth === \"number\"\n                ? workspace.settings.maxNestedAgentDepth\n                : null;\n            return taskOverride !== null\n              ? {\n                  effectiveMaxNestedAgentDepth: taskOverride,\n                  nestedAgentDepthPolicySource: \"session\" as const,\n                  codexCompactionMode: isCodexBilledModel(model)\n                    ? resolveWorkspaceCodexCompactionDefault(workspace.settings)\n                    : (\"portable\" as const),\n                }\n              : workspaceOverride !== null\n                ? {\n                    effectiveMaxNestedAgentDepth: workspaceOverride,\n                    nestedAgentDepthPolicySource: \"workspace\" as const,\n                    codexCompactionMode: isCodexBilledModel(model)\n                      ? resolveWorkspaceCodexCompactionDefault(workspace.settings)\n                      : (\"portable\" as const),\n                  }\n                : {\n                    effectiveMaxNestedAgentDepth: deployment.maxNestedAgentDepth,\n                    nestedAgentDepthPolicySource: deployment.policySource,\n                    codexCompactionMode: isCodexBilledModel(model)\n                      ? resolveWorkspaceCodexCompactionDefault(workspace.settings)\n                      : (\"portable\" as const),\n                  };\n          })()\n        : null;\n      const targetSessionExecution = targetSessionExecutionBase\n        ? await (async () => {\n            const apiIntegrationServerIds =\n              await listInstalledApiIntegrationServerIdsForDelegations(\n                db,\n                task.workspaceId,\n                taskPersonalConnectionDelegations,\n              );\n            const availableMcpServerIds = new Set([\n              ...connectionSettings.mcpServers.map((server) => server.id),\n              ...apiIntegrationServerIds,\n            ]);\n            for (const id of targetSessionExecutionBase.mcpServerIds) {\n              availableMcpServerIds.add(id);\n            }\n            const effective = resolveSessionToolPolicy({\n              toolPolicy: targetSessionExecutionBase.toolPolicy,\n              sessionTools: targetSessionExecutionBase.tools,\n              availableMcpServerIds,\n              defaultMcpServerIds: [\n                ...connectionTools.map((tool) => tool.id),\n                ...apiIntegrationServerIds,\n              ],\n            });\n            return {\n              ...targetSessionExecutionBase,\n              effectiveFirstPartyMcpTools: resolveSessionFirstPartyMcpTools(\n                settings,\n                {\n                  ...targetSessionExecutionBase,\n                  ...(connectionTarget ? { agent: connectionTarget.agent } : {}),\n                },\n                toolWorkspaceSettings,\n              ),\n              effectiveMcpServerIds: [\n                ...new Set(\n                  effective.toolRefs.flatMap((tool) => (tool.kind === \"mcp\" ? [tool.id] : [])),\n                ),\n              ].sort(),\n            };\n          })()\n        : null;\n      const acceptedVariableSet =\n        generatedTarget && task.variableSetId\n          ? await getVariableSet(\n              db,\n              {\n                accountId: task.accountId,\n                workspaceId: task.workspaceId,\n                // Organization/workspace sets have no personal-resource causal\n                // subject. The scoped resolver still permits those common\n                // scopes for a service/legacy actor, while a user-owned set can\n                // only resolve through the exact frozen 0252 subject.\n                subjectId: taskAuthoritySubjectId ?? task.createdBy.subjectId,\n              },\n              task.variableSetId,\n            )\n          : null;\n      if (generatedTarget && task.variableSetId && !acceptedVariableSet) {\n        return await refuseAdmission(\n          \"variable_set_unavailable\",\n          false,\n          `variable set not found: ${task.variableSetId}`,\n        );\n      }\n      const acceptedRig =\n        generatedTarget && task.rigId\n          ? await getRig(\n              db,\n              {\n                accountId: task.accountId,\n                workspaceId: task.workspaceId,\n                subjectId: taskAuthoritySubjectId ?? task.createdBy.subjectId,\n              },\n              task.rigId,\n            )\n          : null;\n      if (generatedTarget && task.rigId && (!acceptedRig || !acceptedRig.activeVersion)) {\n        return await refuseAdmission(\n          \"rig_version_unavailable\",\n          false,\n          `sandbox environment has no active version to bind: ${task.rigId}`,\n        );\n      }\n      const acceptedRigDefaultVariableSetRows = acceptedRig?.activeVersion\n        ? await Promise.all(\n            acceptedRig.activeVersion.defaultVariableSetIds.map(async (variableSetId) => ({\n              variableSetId,\n              variableSet: await getVariableSet(\n                db,\n                {\n                  accountId: task.accountId,\n                  workspaceId: task.workspaceId,\n                  subjectId: taskAuthoritySubjectId ?? task.createdBy.subjectId,\n                },\n                variableSetId,\n              ),\n            })),\n          )\n        : [];\n      const missingRigDefaultVariableSet = acceptedRigDefaultVariableSetRows.find(\n        (row) => !row.variableSet,\n      );\n      if (missingRigDefaultVariableSet) {\n        return await refuseAdmission(\n          \"variable_set_unavailable\",\n          false,\n          `sandbox environment default Variable Set not found: ${missingRigDefaultVariableSet.variableSetId}`,\n        );\n      }\n      const acceptedRigDefaultVariableSets = acceptedRigDefaultVariableSetRows.map(\n        ({ variableSet }) => ({ id: variableSet!.id, generation: variableSet!.generation }),\n      );\n      let incidentPreflightRequired = incidentDeclaration.action === \"required\";\n      if (incidentPreflightRequired) {\n        const existingSessionId =\n          task.runMode === \"existing_session\" ? task.targetSessionId : task.reusableSessionId;\n        const canonicalAlertSession =\n          task.runMode === \"new_session_per_run\" && alertOccurrence\n            ? await getSessionByCreateIdempotencyKey(\n                db,\n                task.workspaceId,\n                alertResponderSessionCreateIdempotencyKey!,\n              )\n            : null;\n        const responderSession = existingSessionId\n          ? await requireSession(db, task.workspaceId, existingSessionId)\n          : canonicalAlertSession;\n        const responder = await resolveIncidentTelemetryResponderMetadata({\n          db,\n          settings,\n          task,\n          session: responderSession,\n          personalConnectionDelegations: taskPersonalConnectionDelegations,\n          plannedTools: taskTools,\n          personalResourceAuthoritySubjectId: taskAuthoritySubjectId,\n          executionPolicy: targetSessionExecution\n            ? {\n                tools: targetSessionExecution.tools,\n                firstPartyMcpTools:\n                  targetSessionExecution.effectiveFirstPartyMcpTools ??\n                  targetSessionExecution.firstPartyMcpTools,\n                firstPartyMcpPermissions: targetSessionExecution.firstPartyMcpPermissions,\n                rigId: targetSessionExecution.rigId,\n                rigVersionId: targetSessionExecution.rigVersionId,\n                toolPolicy: targetSessionExecution.toolPolicy,\n                mcpServerIds: targetSessionExecution.mcpServerIds,\n                toolPolicyVersion: targetSessionExecution.toolPolicyVersion,\n              }\n            : {\n                tools: taskTools,\n                firstPartyMcpTools,\n                firstPartyMcpPermissions,\n                rigId: acceptedRig?.id ?? null,\n                rigVersionId: acceptedRig?.activeVersion?.id ?? null,\n                toolPolicy: responderSession?.toolPolicy ?? {\n                  mode: \"explicit\",\n                  inheritedFromSessionId: null,\n                },\n                mcpServerIds: [],\n                toolPolicyVersion: responderSession?.toolPolicyVersion ?? null,\n              },\n        });\n        const preflight = evaluateIncidentTelemetryPreflight({\n          agentConfig: task.agentConfig,\n          incidentTriggered: structuredAlertOccurrence !== null,\n          alertOccurrenceLabels: structuredAlertOccurrence?.labels ?? null,\n          responder,\n        });\n        if (preflight.action === \"blocked\") return preflight;\n        incidentPreflightRequired = preflight.action === \"ready\";\n      }\n      const taskXaiProviderAccountAuthoritySnapshot =\n        await getScheduledTaskXaiProviderAccountAuthoritySnapshot(db, task.workspaceId, task.id);\n      const taskClaudeProviderAccountAuthoritySnapshot =\n        await getScheduledTaskClaudeProviderAccountAuthoritySnapshot(db, task.workspaceId, task.id);\n      // Codex v2 (M3 PR 3b, EP-T15): the task's value frozen at creation,\n      // copied by every firing; empty when another person authorized the\n      // current revision. Never recomputed from current membership.\n      const taskSubscriptionAuthority = await getScheduledTaskSubscriptionAuthority(db, {\n        workspaceId: task.workspaceId,\n        taskId: task.id,\n        revisionAuthorizerSubjectId: taskRevisionAuthority?.subjectId ?? null,\n        taskAuthorityRevision: task.authorityRevision,\n      });\n      // A scheduled bot selection was authorized when the task was written,\n      // but connection status and tenant/role binding are mutable. Revalidate\n      // before any session/model cost and never fall back to a personal Slack\n      // OAuth grant when the selected bot has been revoked or changed.\n      const slackBotConnection = task.agentConfig.slackBotConnectionId\n        ? await requireOpenGeniSlackBotConnection(\n            db,\n            task.workspaceId,\n            task.agentConfig.slackBotConnectionId,\n          )\n        : null;\n      const slackBotMetadata = slackBotConnection\n        ? openGeniSlackBotMetadata(slackBotConnection.metadata)\n        : null;\n      if (slackBotConnection && !slackBotMetadata) {\n        throw new Error(\"Opengeni Slack bot connection metadata is invalid\");\n      }\n      const xaiAuthoritySubjectId =\n        taskXaiProviderAccountAuthoritySnapshot.scope === \"user\" &&\n        task.createdBy.kind === \"subject\"\n          ? task.createdBy.subjectId\n          : null;\n      if (taskXaiProviderAccountAuthoritySnapshot.scope === \"user\" && !xaiAuthoritySubjectId) {\n        return await refuseAdmission(\n          \"scheduled_authority_unavailable\",\n          false,\n          \"scheduled user-scoped xAI authority has no causal human\",\n        );\n      }\n      if (\n        xaiAuthoritySubjectId &&\n        taskAuthoritySubjectId &&\n        xaiAuthoritySubjectId !== taskAuthoritySubjectId\n      ) {\n        return await refuseAdmission(\n          \"scheduled_authority_unavailable\",\n          false,\n          \"scheduled authority classes have different causal humans\",\n        );\n      }\n      const claudeAuthoritySubjectId =\n        taskClaudeProviderAccountAuthoritySnapshot.scope === \"user\" && task.ownerSubjectId\n          ? task.ownerSubjectId\n          : null;\n      if (\n        taskClaudeProviderAccountAuthoritySnapshot.scope === \"user\" &&\n        !claudeAuthoritySubjectId\n      ) {\n        return await refuseAdmission(\n          \"scheduled_authority_unavailable\",\n          false,\n          \"scheduled user-scoped Claude authority has no causal human\",\n        );\n      }\n      if (\n        claudeAuthoritySubjectId &&\n        taskAuthoritySubjectId &&\n        claudeAuthoritySubjectId !== taskAuthoritySubjectId\n      ) {\n        return await refuseAdmission(\n          \"scheduled_authority_unavailable\",\n          false,\n          \"scheduled authority classes have different causal humans\",\n        );\n      }\n      const causalHumanSubjectId =\n        taskAuthoritySubjectId ?? xaiAuthoritySubjectId ?? claudeAuthoritySubjectId;\n      if (\n        xaiAuthoritySubjectId &&\n        claudeAuthoritySubjectId &&\n        xaiAuthoritySubjectId !== claudeAuthoritySubjectId\n      )\n        return await refuseAdmission(\n          \"scheduled_authority_unavailable\",\n          false,\n          \"scheduled subscription pools have different causal humans\",\n        );\n      if (\n        task.agentConfig.knowledgeSource &&\n        causalHumanSubjectId !== task.agentConfig.knowledgeSource.initiatingSubjectId\n      ) {\n        return await refuseAdmission(\n          \"scheduled_authority_unavailable\",\n          false,\n          \"Source schedule requires its connection owner's current human authorization; update the source schedule to authorize it\",\n        );\n      }\n      // Workspace/organization Variable Sets and Rigs run through ordinary\n      // workspace authority; only a user-owned resource needs the exact frozen\n      // human, and the database admission fence re-proves the same rule for\n      // existing/warm targets.\n      // A personal machine additionally needs that human to be the machine's owner.\n      const personalResourceSelected =\n        acceptedVariableSet?.scope === \"user\" ||\n        acceptedRig?.scope === \"user\" ||\n        acceptedPersonalMachine;\n      if (\n        (personalResourceSelected && !causalHumanSubjectId) ||\n        (acceptedPersonalMachine && causalHumanSubjectId !== task.ownerSubjectId)\n      ) {\n        return await refuseAdmission(\n          \"scheduled_authority_unavailable\",\n          false,\n          \"scheduled personal-resource execution has no causal human\",\n        );\n      }\n      const admissionDenial = await agentRunAdmissionDenial(\n        { ...baseService, settings },\n        {\n          accountId: task.accountId,\n          workspaceId: task.workspaceId,\n          model: targetSessionExecution?.model ?? model,\n          requestedAgentRuns: input.agentRunUsageIdempotencyKey ? 0 : 1,\n          initiatingHumanSubjectId: causalHumanSubjectId,\n        },\n      );\n      if (admissionDenial) {\n        // Credits and monthly limits clear on their own (top-up, new period):\n        // skip this occurrence visibly; a later one is admitted normally.\n        return await refuseAdmission(admissionDenial, true, \"agent run admission denied\");\n      }\n      if (acceptedTargetSessionId && targetSessionExecutionBase) {\n        // An occurrence that targets an existing task tree counts against\n        // that task's usage limit. A reached limit skips the occurrence\n        // visibly (no message, turn or wake is appended) until a person raises\n        // or clears the limit; an unreadable state throws for activity retry,\n        // never admitting as unlimited.\n        const usageLimit = await checkSessionUsageLimitAdmission(db, {\n          accountId: task.accountId,\n          workspaceId: task.workspaceId,\n          sessionId: acceptedTargetSessionId,\n          runtime: true,\n        });\n        if (!usageLimit.allowed) {\n          return await refuseAdmission(\n            \"session_usage_limit\",\n            true,\n            \"the target task reached its usage limit\",\n          );\n        }\n      }\n      const acceptedModel = targetSessionExecution?.model ?? model;\n      const acceptedReasoningEffort = targetSessionExecution?.reasoningEffort ?? reasoningEffort;\n      const acceptedLatencyMode = targetSessionExecution?.latencyMode ?? \"standard\";\n      const acceptedCustomModel = generatedTarget\n        ? workspaceCustomModelReference(settings, acceptedModel)\n        : null;\n      const beforeFreshAgentRunCommit = acceptedCustomModel\n        ? async (tx: Database): Promise<void> => {\n            // Admission reads the task's accepted Claude authority (its\n            // carrier) as the person accountable for the task. The subject is\n            // scoped to this check and restored afterwards.\n            const active = await withWorkspaceSubjectRls(\n              tx,\n              task.workspaceId,\n              causalHumanSubjectId ?? task.ownerSubjectId ?? task.createdBy.subjectId,\n              async (scoped) =>\n                await lockActiveCustomModelForAdmission(scoped, {\n                  accountId: task.accountId,\n                  workspaceId: task.workspaceId,\n                  reference: acceptedCustomModel,\n                  claudeAuthority: {\n                    authoritySnapshot: taskClaudeProviderAccountAuthoritySnapshot,\n                    scheduledTaskId: task.id,\n                  },\n                }),\n            );\n            if (!active) {\n              throw new ScheduledRunTerminalAuthorityError(\n                \"scheduled_model_unavailable\",\n                `model is not available: ${acceptedModel}`,\n              );\n            }\n          }\n        : undefined;\n      let acceptedTurnExecutionPolicy: ReturnType<typeof resolveTurnExecutionPolicyV1>;\n      try {\n        acceptedTurnExecutionPolicy = resolveTurnExecutionPolicyV1(settings, {\n          modelId: acceptedModel,\n          requestedModelId:\n            generatedTarget && task.agentConfig.model ? task.agentConfig.model : null,\n          modelSource: generatedTarget\n            ? task.agentConfig.model\n              ? \"explicit\"\n              : \"deployment\"\n            : \"session\",\n          reasoningEffort: acceptedReasoningEffort,\n          reasoningSource: generatedTarget\n            ? task.agentConfig.reasoningEffort\n              ? \"explicit\"\n              : \"deployment\"\n            : \"session\",\n          latencyMode: acceptedLatencyMode,\n          latencyModeSource: generatedTarget ? \"deployment\" : \"session\",\n        });\n      } catch (error) {\n        // A retired or removed model refuses every occurrence until the task\n        // (or its target session) names an available model: record that as a\n        // visible terminal run instead of exhausting activity retries.\n        if (!(error instanceof TurnExecutionPolicyModelUnavailableError)) throw error;\n        return await refuseAdmission(\n          \"scheduled_model_unavailable\",\n          false,\n          `${error.message}: ${acceptedModel}`,\n        );\n      }\n      const turnExecutionPolicy = scheduledTaskRunExecutionPolicy(\n        acceptedTurnExecutionPolicy,\n        input,\n        creatorPolicy?.credentialRestriction,\n      );\n      const deferredEvents: Array<{\n        sessionId: string;\n        events: Awaited<ReturnType<typeof appendSessionEvents>>;\n      }> = [];\n      const executeDispatch = async (dispatchDb: Database, deferPublications: boolean) => {\n        const admittedRunId = crypto.randomUUID();\n        const generatedSessionBinding = generatedTarget\n          ? {\n              createIdempotencyKey:\n                alertResponderSessionCreateIdempotencyKey ??\n                (task.runMode === \"reusable_session\"\n                  ? `scheduled-task-reusable:${task.id}:${task.authorityRevision}:${task.executionDigest}`\n                  : scheduledTaskGeneratedSessionCreateIdempotencyKey(stableProducerKey)),\n              effectiveMaxNestedAgentDepth:\n                generatedSessionDepthPolicy!.effectiveMaxNestedAgentDepth,\n              nestedAgentDepthPolicySource:\n                generatedSessionDepthPolicy!.nestedAgentDepthPolicySource,\n              codexCompactionMode: generatedSessionDepthPolicy!.codexCompactionMode,\n            }\n          : null;\n        const acceptedExecution: ScheduledTaskRunAcceptedExecution = {\n          version: 1,\n          task,\n          resolvedModel: model,\n          resolvedReasoningEffort: reasoningEffort,\n          resolvedLatencyMode: \"standard\",\n          turnExecutionPolicy,\n          resolvedSandboxBackend: sandboxBackend,\n          resolvedSandboxOs: sandboxOs,\n          resolvedTools: taskTools,\n          resolvedFirstPartyMcpTools: firstPartyMcpTools,\n          resolvedFirstPartyMcpPermissions: firstPartyMcpPermissions,\n          ...(resolvedAgentConfig\n            ? {\n                resolvedAgentConfig,\n                ...(resolvedAgentInstructions !== undefined ? { resolvedAgentInstructions } : {}),\n              }\n            : {}),\n          resolvedVariableSet: acceptedVariableSet\n            ? { id: acceptedVariableSet.id, generation: acceptedVariableSet.generation }\n            : null,\n          resolvedRig: acceptedRig?.activeVersion\n            ? {\n                id: acceptedRig.id,\n                versionId: acceptedRig.activeVersion.id,\n                defaultVariableSets: acceptedRigDefaultVariableSets,\n              }\n            : null,\n          resolvedSlackBotConnection:\n            slackBotConnection && slackBotMetadata && slackBotConnection.verifiedInstallVersion\n              ? {\n                  id: slackBotConnection.id,\n                  version: slackBotConnection.version,\n                  verifiedInstallVersion: slackBotConnection.verifiedInstallVersion,\n                  metadata: slackBotMetadata,\n                }\n              : null,\n          targetSessionExecution,\n          generatedSessionBinding,\n          personalConnectionDelegations: taskPersonalConnectionDelegations,\n          mcpAccountBindings: taskMcpAccountBindings,\n          personalResourceAuthoritySubjectId: taskPersonalResourceAuthoritySubjectId,\n          causalHumanSubjectId,\n          causalHumanAuthority: taskRevisionAuthority,\n          xaiProviderAccountAuthoritySnapshot: taskXaiProviderAccountAuthoritySnapshot,\n          claudeProviderAccountAuthoritySnapshot: taskClaudeProviderAccountAuthoritySnapshot,\n          xaiAuthoritySubjectId,\n          claudeAuthoritySubjectId,\n          connectionAuthoritySubjectId: taskConnectionAuthoritySubjectId,\n          ...(degradedAccounts.length > 0 ? { degradedAccounts } : {}),\n          connectionAccountIntent: taskConnectionAccountIntent,\n          triggerInitiator: input.initiator ?? { kind: \"service\", subjectId: \"scheduler\" },\n          agentRunUsageIdempotencyKey: input.agentRunUsageIdempotencyKey ?? null,\n          incidentPreflightRequired,\n          alertOccurrenceLabels: structuredAlertOccurrence?.labels ?? null,\n        };\n        // The accepted snapshot is immutable execution truth. A legacy task\n        // whose stored shape can no longer be represented as a bounded\n        // accepted execution is a deterministic, operator-visible block, not a\n        // retryable activity failure that would silently drop the occurrence.\n        const acceptedExecutionParse =\n          ScheduledTaskRunAcceptedExecution.safeParse(acceptedExecution);\n        if (\n          !acceptedExecutionParse.success ||\n          scheduledOccurrencePayloadUtf8Bytes({\n            prompt: task.agentConfig.prompt,\n            resources: task.agentConfig.resources,\n            tools: taskTools,\n          }) > SCHEDULED_TASK_OCCURRENCE_PAYLOAD_MAX_BYTES\n        ) {\n          return {\n            kind: \"blocked\" as const,\n            result: {\n              action: \"blocked\" as const,\n              reason: \"scheduled_execution_unrepresentable\" as const,\n            },\n          };\n        }\n        let run = await createScheduledTaskRun(dispatchDb, {\n          runId: admittedRunId,\n          workspaceId: task.workspaceId,\n          taskId: task.id,\n          taskAuthorityRevision: task.authorityRevision,\n          taskExecutionDigest: task.executionDigest,\n          triggerType: input.triggerType,\n          producerKey: stableProducerKey,\n          scheduledAt: null,\n          acceptedExecutionSnapshot: acceptedExecution,\n          ...(beforeFreshAgentRunCommit ? { beforeFreshAgentRunCommit } : {}),\n        });\n        await recordScheduledTaskFiredUsage(dispatchDb, acceptedExecution, run);\n        if (run.status === \"failed\" && run.error === \"scheduled_authority_exhausted\") {\n          return {\n            kind: \"blocked\" as const,\n            result: {\n              action: \"blocked\" as const,\n              reason: \"scheduled_authority_exhausted\" as const,\n            },\n            run,\n          };\n        }\n        if (run.status === \"failed\" || run.status === \"skipped\") {\n          return {\n            kind: \"blocked\" as const,\n            result: scheduledRunTerminalResult(run.error),\n            run,\n          };\n        }\n        const runPersonalResourceAuthority = await getScheduledTaskRunPersonalResourceAuthority(\n          dispatchDb,\n          {\n            accountId: task.accountId,\n            workspaceId: task.workspaceId,\n            runId: run.id,\n          },\n        );\n        if (run?.status === \"dispatched\" && run.sessionId && run.triggerEventId) {\n          if (deferPublications) {\n            return { kind: \"replay\" as const, run, acceptedExecution };\n          }\n          await recordUsageEvent(dispatchDb, {\n            accountId: task.accountId,\n            workspaceId: task.workspaceId,\n            eventType: \"agent_run.created\",\n            quantity: 1,\n            unit: \"run\",\n            sourceResourceType: \"scheduled_task_run\",\n            sourceResourceId: run.id,\n            sessionId: run.sessionId,\n            initiator: acceptedExecution.triggerInitiator,\n            initiatorContext: {\n              scheduledTaskId: task.id,\n              scheduledTaskRunId: run.id,\n            },\n            origin: \"scheduled_task\",\n            idempotencyKey:\n              acceptedExecution.agentRunUsageIdempotencyKey ??\n              `usage:agent_run.created:scheduled:${run.id}`,\n          });\n          const workflowId = workflowIdForSession(run.sessionId);\n          const workflowWakeRevision = await enqueueSessionWorkflowWakeIfRunnable(dispatchDb, {\n            accountId: task.accountId,\n            workspaceId: task.workspaceId,\n            sessionId: run.sessionId,\n            temporalWorkflowId: workflowId,\n            reason: \"scheduled_retry\",\n          });\n          const result = {\n            action: task.runMode === \"new_session_per_run\" ? \"start\" : \"signal\",\n            accountId: task.accountId,\n            workspaceId: task.workspaceId,\n            sessionId: run.sessionId,\n            triggerEventId: run.triggerEventId,\n            workflowId,\n            workflowWakeRevision,\n          } as const;\n          return { kind: \"complete\" as const, result, run };\n        }\n        let result: DispatchScheduledTaskRunResult;\n        try {\n          if (incidentPreflightRequired) {\n            const exactAuthority = await requireScheduledTaskIncidentAuthorityInTransaction(\n              dispatchDb,\n              {\n                workspaceId: task.workspaceId,\n                taskId: task.id,\n              },\n            );\n            if (stableJson(exactAuthority) !== stableJson(task)) {\n              throw new IncidentTelemetryPreflightBlockedError(\n                \"incident_preflight_metadata_missing\",\n              );\n            }\n          }\n          const goalSpec = task.agentConfig.goal ?? null;\n          // Every dispatch carries the first-party MCP server; runtime visibility\n          // still follows the session's exact selection and authorization.\n          const existingSessionId =\n            task.runMode === \"existing_session\" ? task.targetSessionId : task.reusableSessionId;\n          if (task.runMode === \"existing_session\" && !existingSessionId) {\n            throw new Error(\"scheduled task target session is unavailable\");\n          }\n          if (\n            task.runMode === \"new_session_per_run\" ||\n            (task.runMode === \"reusable_session\" && !existingSessionId)\n          ) {\n            // The FK on scheduled_tasks.variable_set_id is ON DELETE RESTRICT, so\n            // an attached variableSet must still exist here; fail closed if not.\n            const variableSet = acceptedVariableSet;\n            if (task.variableSetId && !variableSet) {\n              throw new Error(`variable set not found: ${task.variableSetId}`);\n            }\n            // RIG BINDING (M3): resolve the task's rig to its CURRENTLY-ACTIVE\n            // version at FIRE time (not task-create time) and freeze that version\n            // onto the new session — a task always runs the rig's latest active\n            // version. A deleted rig FK-nulls task.rigId (rig-less run); a rig that\n            // somehow has no active version fails the fire closed.\n            let frozenRigId: string | null = null;\n            let frozenRigVersionId: string | null = null;\n            if (task.rigId) {\n              const rig = acceptedRig;\n              if (!rig || !rig.activeVersion) {\n                throw new Error(`sandbox environment has no active version to bind: ${task.rigId}`);\n              }\n              frozenRigId = rig.id;\n              frozenRigVersionId =\n                runPersonalResourceAuthority?.resources.find(\n                  (resource) => resource.resourceKind === \"rig\" && resource.resourceId === rig.id,\n                )?.resourceVersionId ?? rig.activeVersion.id;\n              if (frozenRigVersionId !== rig.activeVersion.id) {\n                throw new Error(\n                  \"scheduled run sandbox environment version changed during admission\",\n                );\n              }\n            }\n            let session: Awaited<ReturnType<typeof createSession>>;\n            let sessionCreated = true;\n            const taskMetadata = { ...task.agentConfig.metadata };\n            delete taskMetadata[OPENGENI_SLACK_BOT_SESSION_METADATA_KEY];\n            try {\n              const sessionInput: Parameters<typeof createSession>[1] = {\n                accountId: task.accountId,\n                workspaceId: task.workspaceId,\n                initialMessage: task.agentConfig.prompt,\n                resources: task.agentConfig.resources,\n                bundledSkillIds: task.agentConfig.bundledSkillIds,\n                tools: taskTools,\n                firstPartyMcpTools,\n                firstPartyMcpPermissions,\n                ...(resolvedAgentConfig ? { agentConfig: resolvedAgentConfig } : {}),\n                ...(resolvedAgentInstructions !== undefined\n                  ? { instructions: resolvedAgentInstructions }\n                  : {}),\n                ...creatorSessionPolicy,\n                ...(task.agentConfig.knowledgeSource?.destination.kind === \"personal\" ||\n                task.visibility === \"private\"\n                  ? {\n                      visibility: \"user_private\" as const,\n                      scheduledSourceRunId: run.id,\n                    }\n                  : {}),\n                metadata: {\n                  ...taskMetadata,\n                  ...scheduledSessionExecutionPolicyMetadata(\n                    turnExecutionPolicy,\n                    creatorPolicy?.credentialRestriction,\n                  ),\n                  model,\n                  reasoningEffort,\n                  scheduledTaskId: task.id,\n                  scheduledTaskRunMode: task.runMode,\n                  ...(goalSpec ? { scheduledTaskGoal: goalSpec } : {}),\n                  ...(run ? { scheduledTaskRunId: run.id } : {}),\n                  ...(slackBotConnection\n                    ? {\n                        [OPENGENI_SLACK_BOT_SESSION_METADATA_KEY]: slackBotConnection.id,\n                      }\n                    : {}),\n                },\n                createdBy: {\n                  kind: \"service\",\n                  subjectId: \"scheduler\",\n                  label: \"OpenGeni scheduler\",\n                },\n                createdByContext: {\n                  scheduledTaskId: task.id,\n                  ...(run ? { scheduledTaskRunId: run.id } : {}),\n                },\n                model,\n                reasoningEffort,\n                latencyMode: \"standard\",\n                sandboxBackend,\n                sandboxOs,\n                variableSetId: task.variableSetId ?? null,\n                // The schedule's vault narrowing lives on the run session so every\n                // later turn and every child inherits it through the policy chain.\n                ...(task.vaultPolicy ? { vaultPolicy: task.vaultPolicy } : {}),\n                rigId: frozenRigId,\n                rigVersionId: frozenRigVersionId,\n                personalConnectionDelegations: [],\n                initialXaiProviderAccountAuthoritySnapshot: taskXaiProviderAccountAuthoritySnapshot,\n                initialClaudeProviderAccountAuthoritySnapshot:\n                  taskClaudeProviderAccountAuthoritySnapshot,\n                maxNestedAgentDepthOverride: task.agentConfig.maxNestedAgentDepth ?? null,\n                frozenNestedAgentDepthPolicy: {\n                  effectiveMaxNestedAgentDepth:\n                    generatedSessionBinding!.effectiveMaxNestedAgentDepth,\n                  nestedAgentDepthPolicySource:\n                    generatedSessionBinding!.nestedAgentDepthPolicySource,\n                },\n                frozenCodexCompactionMode: generatedSessionBinding!.codexCompactionMode,\n                // The durable agent config was privilege-checked when the task\n                // was created/updated. Preserve that explicit policy if a broader\n                // workspace/deployment limit is narrowed before a later fire.\n                allowNestedAgentDepthIncrease: true,\n                subjectId: `scheduled_task:${task.id}`,\n                beforeCreateCommit: async (tx, sessionId) => {\n                  if (incidentPreflightRequired) {\n                    const exactSession = await requireSession(tx, task.workspaceId, sessionId);\n                    const exactResponder = await resolveIncidentTelemetryResponderMetadata({\n                      db: tx,\n                      settings,\n                      task: acceptedExecution.task,\n                      session: exactSession,\n                      personalConnectionDelegations:\n                        acceptedExecution.personalConnectionDelegations,\n                      personalResourceAuthoritySubjectId:\n                        acceptedExecution.personalResourceAuthoritySubjectId,\n                      executionPolicy: {\n                        tools: exactSession.tools,\n                        firstPartyMcpTools: exactSession.firstPartyMcpTools,\n                        firstPartyMcpPermissions: exactSession.firstPartyMcpPermissions,\n                        rigId: exactSession.rigId,\n                        rigVersionId: exactSession.rigVersionId,\n                        toolPolicy: exactSession.toolPolicy,\n                        mcpServerIds: exactSession.mcpServers.map((server) => server.id),\n                        toolPolicyVersion: exactSession.toolPolicyVersion,\n                      },\n                    });\n                    const exactPreflight = evaluateIncidentTelemetryPreflight({\n                      agentConfig: acceptedExecution.task.agentConfig,\n                      incidentTriggered: structuredAlertOccurrence !== null,\n                      alertOccurrenceLabels: structuredAlertOccurrence?.labels ?? null,\n                      responder: exactResponder,\n                    });\n                    if (exactPreflight.action === \"blocked\") {\n                      throw new IncidentTelemetryPreflightBlockedError(exactPreflight.reason);\n                    }\n                  }\n                  await bindScheduledTaskRunSessionInTransaction(tx, {\n                    accountId: task.accountId,\n                    workspaceId: task.workspaceId,\n                    runId: run.id,\n                    sessionId,\n                  });\n                },\n              };\n              const created = await createSessionWithIdempotencyKeyResult(dispatchDb, {\n                ...sessionInput,\n                createIdempotencyKey: generatedSessionBinding!.createIdempotencyKey,\n              });\n              if (created.denied) {\n                throw new SessionSpawnDeniedDbError(created.denial);\n              }\n              session = created.session;\n              sessionCreated = created.created;\n              if (sessionCreated) recordScheduledSessionCreated(baseService.observability);\n              if (!sessionCreated) {\n                await bindScheduledTaskRunSessionInTransaction(dispatchDb, {\n                  accountId: task.accountId,\n                  workspaceId: task.workspaceId,\n                  runId: run.id,\n                  sessionId: session.id,\n                });\n                run = { ...run, sessionId: session.id };\n              }\n            } catch (error) {\n              if (error instanceof IncidentTelemetryPreflightBlockedError) {\n                throw error;\n              }\n              if (error instanceof SessionSpawnDeniedDbError) {\n                throw new Error(`${error.denial.code}: denial=${error.denial.id}`, {\n                  cause: error,\n                });\n              }\n              throw error;\n            }\n            const scheduledRun = run;\n            if (!sessionCreated) {\n              assertReusableSessionRevivable(session.status);\n              if ((session.variableSetId ?? null) !== (task.variableSetId ?? null)) {\n                throw new Error(\n                  \"scheduled alert occurrence variableSet attachment does not match its canonical session\",\n                );\n              }\n              if (\n                scheduledSlackBotConnectionId(session.metadata) !==\n                (task.agentConfig.slackBotConnectionId ?? null)\n              ) {\n                throw new Error(\n                  \"scheduled alert occurrence Opengeni Slack bot binding does not match its canonical session\",\n                );\n              }\n            }\n            session = await seedScheduledGeneratedSessionRoute({\n              db: dispatchDb,\n              bus,\n              settings,\n              task,\n              runId: run.id,\n              session,\n              deferPublications,\n              deferredEvents,\n            });\n            let workflowId: string;\n            if (alertOccurrence) {\n              const started = await initializeSessionStartAtomically(dispatchDb, {\n                accountId: task.accountId,\n                workspaceId: task.workspaceId,\n                sessionId: session.id,\n                reasoningEffortFallback: reasoningEffort,\n                initialSubscriptionAuthority: taskSubscriptionAuthority,\n                createdEventPayload: {\n                  scheduledTaskId:\n                    typeof session.metadata.scheduledTaskId === \"string\"\n                      ? session.metadata.scheduledTaskId\n                      : task.id,\n                  scheduledTaskRunId:\n                    typeof session.metadata.scheduledTaskRunId === \"string\"\n                      ? session.metadata.scheduledTaskRunId\n                      : run.id,\n                  // Names/ids only; never values.\n                  ...(variableSet\n                    ? {\n                        variableSetId: variableSet.id,\n                        variableSetName: variableSet.name,\n                      }\n                    : {}),\n                  ...(slackBotConnection && slackBotMetadata\n                    ? {\n                        slackBotConnection: {\n                          credentialRole: OPENGENI_SLACK_BOT_CREDENTIAL_ROLE,\n                          credentialLabel: OPENGENI_SLACK_BOT_CREDENTIAL_LABEL,\n                          connectionId: slackBotConnection.id,\n                          slackTeamId: slackBotMetadata.slackTeamId,\n                        },\n                      }\n                    : {}),\n                },\n                goal: goalSpec\n                  ? {\n                      text: goalSpec.text,\n                      successCriteria: goalSpec.successCriteria ?? null,\n                      maxAutoContinuations: goalSpec.maxAutoContinuations ?? null,\n                      ...(goalSpec.mutationPolicy\n                        ? { mutationPolicy: goalSpec.mutationPolicy }\n                        : {}),\n                      createdBy: \"scheduled_task\",\n                    }\n                  : null,\n                deferInitialTurn: true,\n                deferredStatus: \"queued\",\n              });\n              workflowId = started.temporalWorkflowId;\n              if (started.events.length > 0) {\n                if (deferPublications) {\n                  deferredEvents.push({\n                    sessionId: session.id,\n                    events: started.events,\n                  });\n                } else {\n                  await publishDurableSessionEvents(\n                    bus,\n                    task.workspaceId,\n                    session.id,\n                    started.events,\n                  );\n                }\n              }\n            } else {\n              const started = await initializeSessionStartAtomically(dispatchDb, {\n                accountId: task.accountId,\n                workspaceId: task.workspaceId,\n                sessionId: session.id,\n                reasoningEffortFallback: reasoningEffort,\n                initialSubscriptionAuthority: taskSubscriptionAuthority,\n                createdEventPayload: {\n                  scheduledTaskId:\n                    typeof session.metadata.scheduledTaskId === \"string\"\n                      ? session.metadata.scheduledTaskId\n                      : task.id,\n                  scheduledTaskRunId:\n                    typeof session.metadata.scheduledTaskRunId === \"string\"\n                      ? session.metadata.scheduledTaskRunId\n                      : run.id,\n                  // Names/ids only; never values.\n                  ...(variableSet\n                    ? { variableSetId: variableSet.id, variableSetName: variableSet.name }\n                    : {}),\n                  ...(slackBotConnection && slackBotMetadata\n                    ? {\n                        slackBotConnection: {\n                          credentialRole: OPENGENI_SLACK_BOT_CREDENTIAL_ROLE,\n                          credentialLabel: OPENGENI_SLACK_BOT_CREDENTIAL_LABEL,\n                          connectionId: slackBotConnection.id,\n                          slackTeamId: slackBotMetadata.slackTeamId,\n                        },\n                      }\n                    : {}),\n                },\n                goal: goalSpec\n                  ? {\n                      text: goalSpec.text,\n                      successCriteria: goalSpec.successCriteria ?? null,\n                      maxAutoContinuations: goalSpec.maxAutoContinuations ?? null,\n                      ...(goalSpec.mutationPolicy\n                        ? { mutationPolicy: goalSpec.mutationPolicy }\n                        : {}),\n                      createdBy: \"scheduled_task\",\n                    }\n                  : null,\n                deferInitialTurn: true,\n                deferredStatus: \"queued\",\n              });\n              workflowId = started.temporalWorkflowId;\n              if (started.events.length > 0) {\n                if (deferPublications) {\n                  deferredEvents.push({ sessionId: session.id, events: started.events });\n                } else {\n                  await publishDurableSessionEvents(\n                    bus,\n                    task.workspaceId,\n                    session.id,\n                    started.events,\n                  );\n                }\n              }\n              if (task.runMode === \"reusable_session\") {\n                await materializeScheduledTaskReusableSessionFromRun(dispatchDb, {\n                  accountId: task.accountId,\n                  workspaceId: task.workspaceId,\n                  taskId: task.id,\n                  runId: run.id,\n                  sessionId: session.id,\n                  sourceTaskAuthorityRevision:\n                    runPersonalResourceAuthority?.taskAuthorityRevision ??\n                    run.taskAuthorityRevision!,\n                  sourceExecutionDigest:\n                    runPersonalResourceAuthority?.executionDigest ?? run.taskExecutionDigest!,\n                });\n              }\n            }\n            // After both start branches, so the timeline reads session.created\n            // then session.title_set rather than titling a session that has not\n            // announced itself yet. `session.created` is what carries the row\n            // into the rail, and this lands on its heels.\n            const titleEvents = await stampScheduledSessionTitle(dispatchDb, {\n              workspaceId: task.workspaceId,\n              sessionId: session.id,\n              taskName: task.name,\n            });\n            if (titleEvents.length > 0) {\n              if (deferPublications) {\n                deferredEvents.push({ sessionId: session.id, events: titleEvents });\n              } else {\n                await publishDurableSessionEvents(bus, task.workspaceId, session.id, titleEvents);\n              }\n            }\n            const scheduledUpdate = await addSessionSystemUpdateWithSourceMutation(\n              dispatchDb,\n              {\n                accountId: task.accountId,\n                workspaceId: task.workspaceId,\n                sessionId: session.id,\n                kind: \"scheduled_occurrence\",\n                classification: \"info\",\n                sourceId: run.id,\n                dedupeKey: `scheduled-task-run:${run.id}`,\n                summary: task.agentConfig.prompt,\n                payload: scheduledUserMessagePayload(\n                  task.agentConfig.prompt,\n                  task.agentConfig.resources,\n                  taskTools,\n                  task.id,\n                  run.id,\n                  degradedAccounts,\n                ),\n                lineage: {\n                  scheduledTaskId: task.id,\n                  scheduledTaskRunId: run.id,\n                  ...(causalHumanSubjectId ? { causalHumanSubjectId } : {}),\n                  ...(taskConnectionAuthoritySubjectId\n                    ? { connectionAuthoritySubjectId: taskConnectionAuthoritySubjectId }\n                    : {}),\n                  ...(taskXaiProviderAccountAuthoritySnapshot.scope === \"user\" &&\n                  task.createdBy.kind === \"subject\"\n                    ? { xaiAuthoritySubjectId: task.createdBy.subjectId }\n                    : {}),\n                  ...(claudeAuthoritySubjectId ? { claudeAuthoritySubjectId } : {}),\n                },\n                personalConnectionDelegations: taskPersonalConnectionDelegations,\n                mcpAccountBindings: taskMcpAccountBindings,\n                xaiProviderAccountAuthoritySnapshot: taskXaiProviderAccountAuthoritySnapshot,\n                claudeProviderAccountAuthoritySnapshot: taskClaudeProviderAccountAuthoritySnapshot,\n                subscriptionAuthority: taskSubscriptionAuthority,\n                scheduledTaskRunId: run.id,\n              },\n              async (tx, wakeEventId, _updateId, rejectionReason) => {\n                if (!wakeEventId) {\n                  const error = scheduledSessionRejectionError(rejectionReason);\n                  await settleScheduledTaskRunInTransaction(tx, {\n                    workspaceId: task.workspaceId,\n                    runId: scheduledRun.id,\n                    sessionId: session.id,\n                    triggerEventId: null,\n                    status: \"skipped\",\n                    error,\n                  });\n                  return;\n                }\n                await settleScheduledTaskRunInTransaction(tx, {\n                  workspaceId: task.workspaceId,\n                  runId: scheduledRun.id,\n                  sessionId: session.id,\n                  triggerEventId: wakeEventId,\n                  status: \"dispatched\",\n                });\n              },\n              {\n                requireIdleSession: task.overlapPolicy === \"skip\" && !sessionCreated,\n                ...(incidentPreflightRequired\n                  ? {\n                      prepareSource: async (tx, sessionId) =>\n                        await prepareIncidentTelemetrySource({\n                          tx,\n                          settings,\n                          taskId: task.id,\n                          workspaceId: task.workspaceId,\n                          sessionId,\n                          alertOccurrenceLabels: structuredAlertOccurrence?.labels ?? null,\n                          acceptedExecution,\n                        }),\n                    }\n                  : {}),\n              },\n            );\n            if (\n              scheduledUpdate.reason === \"session_cancelled\" ||\n              scheduledUpdate.reason === \"session_not_idle\" ||\n              scheduledUpdate.reason === \"session_paused\"\n            ) {\n              const error = scheduledSessionRejectionError(scheduledUpdate.reason);\n              return {\n                kind: \"blocked\" as const,\n                result: { action: \"blocked\" as const, reason: \"scheduled_run_terminal\" as const },\n                run: { ...run, status: \"skipped\" as const, error },\n              };\n            }\n            if (scheduledUpdate.added) {\n              recordUserMessageAccepted(baseService.observability, { surface: \"scheduled\" });\n            }\n            if (scheduledUpdate.added && scheduledUpdate.events.length > 0) {\n              if (deferPublications) {\n                deferredEvents.push({\n                  sessionId: session.id,\n                  events: scheduledUpdate.events,\n                });\n              } else {\n                await publishDurableSessionEvents(\n                  bus,\n                  task.workspaceId,\n                  session.id,\n                  scheduledUpdate.events,\n                );\n              }\n            }\n            result = {\n              action: sessionCreated ? \"start\" : \"signal\",\n              accountId: task.accountId,\n              workspaceId: task.workspaceId,\n              sessionId: session.id,\n              triggerEventId: scheduledUpdate.wakeEventId,\n              workflowId,\n              workflowWakeRevision: scheduledUpdate.workflowWakeRevision,\n            };\n          } else {\n            if (!run) throw new Error(\"scheduled task run was not created\");\n            const scheduledRun = run;\n            const session = await requireSession(dispatchDb, task.workspaceId, existingSessionId!);\n            await bindScheduledTaskRunSessionInTransaction(dispatchDb, {\n              accountId: task.accountId,\n              workspaceId: task.workspaceId,\n              runId: run.id,\n              sessionId: session.id,\n            });\n            // A user-cancelled (terminal) reusable session must not be revived and\n            // re-billed on the next fire. This cheap check gives an early answer;\n            // the locked admission check below remains authoritative. Mirrors\n            // apps/api/src/domain/sessions.ts.\n            assertReusableSessionRevivable(session.status);\n            // Slack routing remains bound to the reusable chat; execution\n            // attachments come from its accepted target snapshot.\n            assertReusableSessionBindingMatches(session, task);\n            const bundled = await addSessionSystemUpdateWithSourceMutation(\n              dispatchDb,\n              {\n                accountId: task.accountId,\n                workspaceId: task.workspaceId,\n                sessionId: session.id,\n                kind: \"scheduled_occurrence\",\n                classification: \"info\",\n                sourceId: run.id,\n                dedupeKey: `scheduled-task-run:${run.id}`,\n                summary: task.agentConfig.prompt,\n                payload: scheduledUserMessagePayload(\n                  task.agentConfig.prompt,\n                  task.agentConfig.resources,\n                  taskTools,\n                  task.id,\n                  run.id,\n                  degradedAccounts,\n                ),\n                lineage: {\n                  scheduledTaskId: task.id,\n                  scheduledTaskRunId: run.id,\n                  ...(causalHumanSubjectId ? { causalHumanSubjectId } : {}),\n                  ...(taskConnectionAuthoritySubjectId\n                    ? { connectionAuthoritySubjectId: taskConnectionAuthoritySubjectId }\n                    : {}),\n                  ...(taskXaiProviderAccountAuthoritySnapshot.scope === \"user\" &&\n                  task.createdBy.kind === \"subject\"\n                    ? { xaiAuthoritySubjectId: task.createdBy.subjectId }\n                    : {}),\n                  ...(claudeAuthoritySubjectId ? { claudeAuthoritySubjectId } : {}),\n                },\n                personalConnectionDelegations: taskPersonalConnectionDelegations,\n                mcpAccountBindings: taskMcpAccountBindings,\n                xaiProviderAccountAuthoritySnapshot: taskXaiProviderAccountAuthoritySnapshot,\n                claudeProviderAccountAuthoritySnapshot: taskClaudeProviderAccountAuthoritySnapshot,\n                subscriptionAuthority: taskSubscriptionAuthority,\n                scheduledTaskRunId: run.id,\n              },\n              async (tx, wakeEventId, _updateId, rejectionReason) => {\n                if (!wakeEventId) {\n                  const error = scheduledSessionRejectionError(rejectionReason);\n                  await settleScheduledTaskRunInTransaction(tx, {\n                    workspaceId: task.workspaceId,\n                    runId: scheduledRun.id,\n                    sessionId: session.id,\n                    triggerEventId: null,\n                    status: \"skipped\",\n                    error,\n                  });\n                  return;\n                }\n                await settleScheduledTaskRunInTransaction(tx, {\n                  workspaceId: task.workspaceId,\n                  runId: scheduledRun.id,\n                  sessionId: session.id,\n                  triggerEventId: wakeEventId,\n                  status: \"dispatched\",\n                });\n              },\n              {\n                requireIdleSession: task.overlapPolicy === \"skip\",\n                prepareSource: async (tx, sessionId) => {\n                  const goalEvents =\n                    task.runMode === \"reusable_session\" && goalSpec && run.status === \"queued\"\n                      ? await upsertScheduledSessionGoalForRun(tx, {\n                          accountId: task.accountId,\n                          workspaceId: task.workspaceId,\n                          sessionId,\n                          runId: run.id,\n                          text: goalSpec.text,\n                          successCriteria: goalSpec.successCriteria ?? null,\n                          maxAutoContinuations: goalSpec.maxAutoContinuations ?? null,\n                          ...(goalSpec.mutationPolicy\n                            ? { mutationPolicy: goalSpec.mutationPolicy }\n                            : {}),\n                        })\n                      : [];\n                  const incidentSource = incidentPreflightRequired\n                    ? await prepareIncidentTelemetrySource({\n                        tx,\n                        settings,\n                        taskId: task.id,\n                        workspaceId: task.workspaceId,\n                        sessionId,\n                        alertOccurrenceLabels: structuredAlertOccurrence?.labels ?? null,\n                        acceptedExecution,\n                      })\n                    : undefined;\n                  return {\n                    ...(incidentSource ?? {}),\n                    ...(goalEvents.length > 0 ? { events: goalEvents } : {}),\n                  };\n                },\n              },\n            );\n            if (\n              bundled.reason === \"session_cancelled\" ||\n              bundled.reason === \"session_not_idle\" ||\n              bundled.reason === \"session_paused\"\n            ) {\n              const error = scheduledSessionRejectionError(bundled.reason);\n              return {\n                kind: \"blocked\" as const,\n                result: { action: \"blocked\" as const, reason: \"scheduled_run_terminal\" as const },\n                run: { ...run, status: \"skipped\" as const, error },\n              };\n            }\n            if (bundled.added) {\n              recordUserMessageAccepted(baseService.observability, { surface: \"scheduled\" });\n            }\n            if (bundled.added && bundled.events.length > 0) {\n              if (deferPublications) {\n                deferredEvents.push({\n                  sessionId: session.id,\n                  events: bundled.events,\n                });\n              } else {\n                await publishDurableSessionEvents(\n                  bus,\n                  task.workspaceId,\n                  session.id,\n                  bundled.events,\n                );\n              }\n            }\n            result = {\n              action: \"signal\",\n              accountId: task.accountId,\n              workspaceId: task.workspaceId,\n              sessionId: session.id,\n              triggerEventId: bundled.wakeEventId,\n              workflowId: workflowIdForSession(session.id),\n              workflowWakeRevision: bundled.workflowWakeRevision,\n            };\n          }\n        } catch (error) {\n          const terminalError = scheduledRunRecoveryTerminalError(error);\n          if (!terminalError) throw error;\n          await markScheduledTaskRunFailedIfQueued(\n            dispatchDb,\n            task.workspaceId,\n            run.id,\n            terminalError.code,\n          );\n          return {\n            kind: \"blocked\" as const,\n            result: scheduledRunTerminalResult(terminalError.code),\n            run: { ...run, status: \"failed\" as const, error: terminalError.code },\n          };\n        }\n        await recordUsageEvent(dispatchDb, {\n          accountId: task.accountId,\n          workspaceId: task.workspaceId,\n          eventType: \"agent_run.created\",\n          quantity: 1,\n          unit: \"run\",\n          sourceResourceType: \"scheduled_task_run\",\n          sourceResourceId: run.id,\n          sessionId: result.sessionId,\n          initiator: input.initiator ?? {\n            kind: \"service\",\n            subjectId: \"scheduler\",\n          },\n          initiatorContext: {\n            scheduledTaskId: task.id,\n            scheduledTaskRunId: run.id,\n          },\n          origin: \"scheduled_task\",\n          idempotencyKey:\n            input.agentRunUsageIdempotencyKey ?? `usage:agent_run.created:scheduled:${run.id}`,\n        });\n        return { kind: \"complete\" as const, result, run };\n      };\n\n      let dispatchOutcome: Awaited<ReturnType<typeof executeDispatch>>;\n      try {\n        dispatchOutcome = incidentPreflightRequired\n          ? await withSessionActivityRlsContext(\n              db,\n              { accountId: task.accountId, workspaceId: task.workspaceId },\n              async (tx) => await executeDispatch(tx, true),\n            )\n          : await executeDispatch(db, false);\n      } catch (error) {\n        if (error instanceof IncidentTelemetryPreflightBlockedError) {\n          return { action: \"blocked\", reason: error.reason };\n        }\n        const terminalError = scheduledRunRecoveryTerminalError(error);\n        if (terminalError?.code === \"scheduled_model_unavailable\") {\n          // The fresh-run admission rolled back the run insert. Record the\n          // refusal as a visible run so the schedule never fails silently.\n          return await refuseAdmission(\"scheduled_model_unavailable\", false, terminalError.message);\n        }\n        throw error;\n      }\n      if (dispatchOutcome.kind === \"replay\") {\n        return await replayScheduledTaskDispatch({\n          db,\n          wakeSessionWorkflow,\n          task,\n          run: dispatchOutcome.run,\n          acceptedExecution: dispatchOutcome.acceptedExecution,\n        });\n      }\n      for (const deferred of deferredEvents) {\n        await publishDurableSessionEvents(\n          bus,\n          task.workspaceId,\n          deferred.sessionId,\n          deferred.events,\n        );\n      }\n      if (dispatchOutcome.kind === \"blocked\") return dispatchOutcome.result;\n      const result = dispatchOutcome.result;\n      if (wakeSessionWorkflow && result.workflowWakeRevision !== null) {\n        await wakeSessionWorkflow({\n          accountId: result.accountId,\n          workspaceId: result.workspaceId,\n          sessionId: result.sessionId,\n          workflowId: result.workflowId,\n          wakeRevision: result.workflowWakeRevision,\n        });\n      }\n      return result;\n    },\n  };\n}\n\nclass IncidentTelemetryPreflightBlockedError extends Error {\n  constructor(readonly reason: IncidentTelemetryPreflightBlockReason) {\n    super(reason);\n    this.name = \"IncidentTelemetryPreflightBlockedError\";\n  }\n}\n\n/**\n * Defensive backstop for the API-level Slack binding guard. Variable Sets\n * belong to the live target and are fenced by its accepted execution snapshot,\n * not by the task's retained creation defaults.\n */\nfunction assertReusableSessionBindingMatches(\n  session: { metadata: Record<string, unknown> },\n  task: Pick<ScheduledTask, \"runMode\" | \"agentConfig\">,\n): void {\n  // Existing-chat messages use the target policy frozen at admission. Task\n  // creation defaults are not an additional authority or binding constraint.\n  if (task.runMode === \"existing_session\") return;\n  if (\n    scheduledSlackBotConnectionId(session.metadata) !==\n    (task.agentConfig.slackBotConnectionId ?? null)\n  ) {\n    throw new ScheduledRunTerminalAuthorityError(\n      \"scheduled_reusable_binding_changed\",\n      \"scheduled task Opengeni Slack bot binding does not match its reusable session\",\n    );\n  }\n}\n\nclass ScheduledRunTerminalAuthorityError extends Error {\n  constructor(\n    readonly code: string,\n    message: string,\n  ) {\n    super(message);\n    this.name = \"ScheduledRunTerminalAuthorityError\";\n  }\n}\n\nfunction scheduledRunRecoveryTerminalError(\n  error: unknown,\n): ScheduledRunTerminalAuthorityError | null {\n  if (\n    error instanceof Error &&\n    \"cause\" in error &&\n    error.cause !== undefined &&\n    error.cause !== error\n  ) {\n    const nested = scheduledRunRecoveryTerminalError(error.cause);\n    if (nested) return nested;\n  }\n  if (error instanceof ScheduledRunTerminalAuthorityError) return error;\n  if (error instanceof IncidentTelemetryPreflightBlockedError) {\n    return new ScheduledRunTerminalAuthorityError(\n      `scheduled_incident_${error.reason}`,\n      error.message,\n    );\n  }\n  if (error instanceof SessionSpawnDeniedDbError) {\n    return new ScheduledRunTerminalAuthorityError(\"scheduled_session_spawn_denied\", error.message);\n  }\n  if (error instanceof Error && error.message.startsWith(\"Session not found:\")) {\n    return new ScheduledRunTerminalAuthorityError(\n      \"scheduled_target_session_unavailable\",\n      error.message,\n    );\n  }\n  if (typeof error === \"object\" && error !== null && \"status\" in error && error.status === 422) {\n    return new ScheduledRunTerminalAuthorityError(\n      \"scheduled_slack_authority_unavailable\",\n      error instanceof Error ? error.message : \"scheduled Slack authority is unavailable\",\n    );\n  }\n  if (typeof error === \"object\" && error !== null && \"code\" in error && error.code === \"42501\") {\n    return new ScheduledRunTerminalAuthorityError(\n      \"scheduled_run_authority_proof_rejected\",\n      error instanceof Error ? error.message : \"scheduled run authority proof was rejected\",\n    );\n  }\n  return null;\n}\n\nfunction scheduledPinKey(pin: { serverId: string; connectionId: string | null }): string {\n  return JSON.stringify([pin.serverId, pin.connectionId]);\n}\n\n/**\n * The pinned accounts an account-selection failure names. When the owner lost\n * workspace access, none of their pinned accounts can be used.\n */\nfunction scheduledStalePins(\n  pins: readonly McpConnectionAccountSelection[],\n  failure: ConnectionAccountSelectionError,\n): ScheduledTaskDegradedAccount[] {\n  const pinKeys = new Set(pins.map(scheduledPinKey));\n  const named = failure.diagnostic.accounts.flatMap((account) =>\n    pinKeys.has(scheduledPinKey(account))\n      ? [{ serverId: account.serverId, connectionId: account.connectionId, reason: account.reason }]\n      : [],\n  );\n  if (named.length > 0) return named;\n  if (failure.diagnostic.reason === \"owner_access_unavailable\") {\n    return pins.map((pin) => ({\n      serverId: pin.serverId,\n      connectionId: pin.connectionId,\n      reason: \"owner_access_unavailable\" as const,\n    }));\n  }\n  return [];\n}\n\n/** The blocked result of a diagnostic (refused) run receipt, fresh or replayed. */\nfunction scheduledAdmissionRefusalResult(\n  run: Pick<ScheduledTaskRun, \"id\" | \"admissionDiagnostic\" | \"admissionRefusal\">,\n): Extract<DispatchScheduledTaskRunResult, { action: \"blocked\" }> {\n  if (run.admissionRefusal) {\n    return {\n      action: \"blocked\",\n      reason: run.admissionRefusal.reason as ScheduledTaskAdmissionRefusalReason,\n      runId: run.id,\n      refusal: run.admissionRefusal,\n    };\n  }\n  return {\n    action: \"blocked\",\n    reason: \"connection_account_unavailable\",\n    runId: run.id,\n    ...(run.admissionDiagnostic ? { diagnostic: run.admissionDiagnostic } : {}),\n  };\n}\n\nfunction scheduledRunTerminalResult(\n  error: string | null,\n): Extract<DispatchScheduledTaskRunResult, { action: \"blocked\" }> {\n  if (error === ATLASSIAN_NATIVE_RETIRED_REASON)\n    return { action: \"blocked\", reason: ATLASSIAN_NATIVE_RETIRED_REASON };\n  if (error === \"scheduled_authority_exhausted\") {\n    return { action: \"blocked\", reason: \"scheduled_authority_exhausted\" };\n  }\n  if (error === \"scheduled_incident_incident_preflight_metadata_missing\") {\n    return { action: \"blocked\", reason: \"incident_preflight_metadata_missing\" };\n  }\n  if (error === \"scheduled_incident_incident_responder_under_capable\") {\n    return { action: \"blocked\", reason: \"incident_responder_under_capable\" };\n  }\n  if (error === \"scheduled_incident_incident_data_source_unsuitable\") {\n    return { action: \"blocked\", reason: \"incident_data_source_unsuitable\" };\n  }\n  return { action: \"blocked\", reason: \"scheduled_run_terminal\" };\n}\n\nfunction scheduledSessionRejectionError(\n  rejectionReason: \"session_cancelled\" | \"session_not_idle\" | \"session_paused\" | null,\n): \"session_cancelled\" | \"scheduled_session_not_idle\" | \"scheduled_session_paused\" {\n  if (rejectionReason === \"session_paused\") return \"scheduled_session_paused\";\n  return rejectionReason === \"session_not_idle\"\n    ? \"scheduled_session_not_idle\"\n    : \"session_cancelled\";\n}\n\nasync function prepareIncidentTelemetrySource(input: {\n  tx: Database;\n  settings: ControlActivityServices[\"settings\"];\n  taskId: string;\n  workspaceId: string;\n  sessionId: string;\n  alertOccurrenceLabels: Readonly<Record<string, string>> | null;\n  acceptedExecution: ScheduledTaskRunAcceptedExecution;\n}) {\n  const session = await requireSession(input.tx, input.workspaceId, input.sessionId);\n  const { task, personalConnectionDelegations } = input.acceptedExecution;\n  const responder = await resolveIncidentTelemetryResponderMetadata({\n    db: input.tx,\n    settings: input.settings,\n    task,\n    session,\n    personalConnectionDelegations,\n    personalResourceAuthoritySubjectId:\n      input.acceptedExecution.personalResourceAuthoritySubjectId ?? null,\n    executionPolicy: input.acceptedExecution.targetSessionExecution\n      ? {\n          tools: input.acceptedExecution.targetSessionExecution.tools,\n          firstPartyMcpTools:\n            input.acceptedExecution.targetSessionExecution.effectiveFirstPartyMcpTools ??\n            input.acceptedExecution.targetSessionExecution.firstPartyMcpTools,\n          firstPartyMcpPermissions:\n            input.acceptedExecution.targetSessionExecution.firstPartyMcpPermissions,\n          rigId: input.acceptedExecution.targetSessionExecution.rigId,\n          rigVersionId: input.acceptedExecution.targetSessionExecution.rigVersionId,\n          toolPolicy: input.acceptedExecution.targetSessionExecution.toolPolicy,\n          mcpServerIds: input.acceptedExecution.targetSessionExecution.mcpServerIds,\n          toolPolicyVersion: input.acceptedExecution.targetSessionExecution.toolPolicyVersion,\n        }\n      : {\n          tools: input.acceptedExecution.resolvedTools,\n          firstPartyMcpTools: input.acceptedExecution.resolvedFirstPartyMcpTools,\n          firstPartyMcpPermissions: input.acceptedExecution.resolvedFirstPartyMcpPermissions,\n          rigId: input.acceptedExecution.resolvedRig?.id ?? null,\n          rigVersionId: input.acceptedExecution.resolvedRig?.versionId ?? null,\n          toolPolicy: session.toolPolicy,\n          mcpServerIds: [],\n          toolPolicyVersion: session.toolPolicyVersion,\n        },\n  });\n  const preflight = evaluateIncidentTelemetryPreflight({\n    agentConfig: task.agentConfig,\n    incidentTriggered: input.alertOccurrenceLabels !== null,\n    alertOccurrenceLabels: input.alertOccurrenceLabels,\n    responder,\n  });\n  if (preflight.action === \"blocked\") {\n    throw new IncidentTelemetryPreflightBlockedError(preflight.reason);\n  }\n  const fence = incidentTelemetryAuthorityFence({\n    task,\n    responder,\n    alertOccurrenceLabels: input.alertOccurrenceLabels,\n  });\n  if (!fence) {\n    throw new IncidentTelemetryPreflightBlockedError(\"incident_preflight_metadata_missing\");\n  }\n  return {\n    lineage: {\n      [INCIDENT_TELEMETRY_AUTHORITY_FENCE_LINEAGE_KEY]: fence,\n    },\n  };\n}\n\nasync function recordScheduledTaskFiredUsage(\n  db: Database,\n  acceptedExecution: ScheduledTaskRunAcceptedExecution,\n  run: ScheduledTaskRun,\n): Promise<void> {\n  const task = acceptedExecution.task;\n  await recordUsageEvent(db, {\n    accountId: task.accountId,\n    workspaceId: task.workspaceId,\n    eventType: \"scheduled_task.fired\",\n    quantity: 1,\n    unit: \"run\",\n    sourceResourceType: \"scheduled_task_run\",\n    sourceResourceId: run.id,\n    initiator: acceptedExecution.triggerInitiator,\n    initiatorContext: { scheduledTaskId: task.id, scheduledTaskRunId: run.id },\n    origin: \"scheduled_task\",\n    idempotencyKey: `usage:scheduled_task.fired:${run.id}`,\n  });\n}\n\nfunction personalMachineScheduleOwner(task: ScheduledTask, subjectId: string | null): boolean {\n  return (\n    task.visibility === \"private\" &&\n    task.ownerSubjectId !== null &&\n    task.ownerSubjectId === subjectId\n  );\n}\n\n/**\n * The owner and machine authority when an Only me schedule runs on its owner's\n * personal machine; null for a shared machine. Throws when a personal machine is\n * no longer usable by the owner, so the run fails closed.\n */\nasync function scheduledPersonalMachineOwner(\n  db: Database,\n  task: ScheduledTask,\n  target: NonNullable<ScheduledTask[\"agentConfig\"][\"machineTarget\"]>,\n): Promise<{ subjectId: string; authorityId: string } | null> {\n  const subjectId = task.ownerSubjectId;\n  if (task.visibility !== \"private\" || !subjectId) return null;\n  const access = { accountId: task.accountId, workspaceId: task.workspaceId, subjectId };\n  const machine = await getSandbox(db, access, target.targetSandboxId);\n  if (machine?.scope !== \"user\") return null;\n  if (!machine.enrollmentId) {\n    throw new Error(\"scheduled personal Connected Machine has no enrollment\");\n  }\n  let cursor: string | undefined;\n  for (let page = 0; page < 50; page += 1) {\n    const listed = await listSelfUserResourceAuthorities(db, {\n      ...access,\n      resourceKind: \"connected_machine\",\n      limit: 100,\n      ...(cursor ? { cursor } : {}),\n    });\n    const authority = listed.authorities.find(\n      (candidate) => candidate.resourceId === machine.enrollmentId && candidate.status === \"active\",\n    );\n    if (authority) return { subjectId, authorityId: authority.authorityId };\n    if (!listed.nextCursor) break;\n    cursor = listed.nextCursor;\n  }\n  throw new Error(\"scheduled personal Connected Machine authority is not active\");\n}\n\nasync function seedScheduledGeneratedSessionRoute(input: {\n  db: Database;\n  bus: ControlActivityServices[\"bus\"];\n  settings: ControlActivityServices[\"settings\"];\n  task: ScheduledTask;\n  runId: string;\n  session: Awaited<ReturnType<typeof createSession>>;\n  deferPublications: boolean;\n  deferredEvents: Array<{\n    sessionId: string;\n    events: Awaited<ReturnType<typeof appendSessionEvents>>;\n  }>;\n}): Promise<Awaited<ReturnType<typeof createSession>>> {\n  const target = input.task.agentConfig.machineTarget;\n  if (!target) return input.session;\n  const personalOwner = await scheduledPersonalMachineOwner(input.db, input.task, target);\n  const seeded = await swapActiveSandbox(\n    {\n      db: input.db,\n      settings: input.settings,\n      bus: input.bus,\n    },\n    {\n      accountId: input.task.accountId,\n      workspaceId: input.task.workspaceId,\n      sessionId: input.session.id,\n      sessionBackend: input.session.sandboxBackend,\n      sessionGroupId: input.session.sandboxGroupId,\n      // A personal machine attaches through the owner's scoped authorization.\n      ...(personalOwner ? { subjectId: personalOwner.subjectId } : {}),\n    },\n    target.targetSandboxId,\n    target.workingDir ?? null,\n  );\n  if (seeded.swapped) {\n    if (personalOwner) {\n      // Saving an Only me schedule on your own machine is the consent. Each run\n      // gets a grant for exactly its own chat, so other chats keep asking.\n      const authorityEpoch = await getSessionAuthorityEpoch(input.db, {\n        accountId: input.task.accountId,\n        workspaceId: input.task.workspaceId,\n        sessionId: input.session.id,\n      });\n      if (authorityEpoch === null) throw new Error(\"scheduled run chat has no authority epoch\");\n      await issueSelfUserResourceGrant(input.db, {\n        accountId: input.task.accountId,\n        workspaceId: input.task.workspaceId,\n        subjectId: personalOwner.subjectId,\n        authorityId: personalOwner.authorityId,\n        resourceKind: \"connected_machine\",\n        mode: \"session\",\n        context: \"user_private\",\n        sessionId: input.session.id,\n        expectedAuthorityEpoch: authorityEpoch,\n        workspaceSharedAcknowledged: false,\n      });\n    }\n    return await requireSession(input.db, input.task.workspaceId, input.session.id);\n  }\n\n  const failed = await failScheduledGeneratedSessionRoute(input.db, {\n    accountId: input.task.accountId,\n    workspaceId: input.task.workspaceId,\n    taskId: input.task.id,\n    runId: input.runId,\n    sessionId: input.session.id,\n    error: \"scheduled_machine_unavailable\",\n  });\n  if (failed.action === \"advanced\") {\n    throw new Error(\n      `scheduled run advanced to ${failed.status} while its Connected Machine route was being established`,\n    );\n  }\n  if (failed.events.length > 0) {\n    if (input.deferPublications) {\n      input.deferredEvents.push({ sessionId: input.session.id, events: failed.events });\n    } else {\n      await publishDurableSessionEvents(\n        input.bus,\n        input.task.workspaceId,\n        input.session.id,\n        failed.events,\n      );\n    }\n  }\n  const error =\n    failed.action === \"terminal\" ? (failed.error ?? \"scheduled_run_terminal\") : failed.error;\n  throw new ScheduledRunTerminalAuthorityError(\n    error,\n    seeded.reason ?? \"scheduled Connected Machine target is unavailable\",\n  );\n}\n\nasync function recoverBoundScheduledTaskDispatch(input: {\n  db: Database;\n  observability?: ProductUsageMetricsSink | undefined;\n  bus: ControlActivityServices[\"bus\"];\n  settings: ControlActivityServices[\"settings\"];\n  wakeSessionWorkflow: WakeSessionWorkflowSignal | null;\n  run: ScheduledTaskRun;\n  acceptedExecution: ScheduledTaskRunAcceptedExecution;\n  input: DispatchScheduledTaskRunInput;\n}): Promise<DispatchScheduledTaskRunResult> {\n  const { task } = input.acceptedExecution;\n  if (input.run.status !== \"queued\") {\n    throw new Error(\"scheduled run is not an exact queued recovery\");\n  }\n  const generatedSession =\n    task.runMode === \"new_session_per_run\" ||\n    (task.runMode === \"reusable_session\" && task.reusableSessionId === null);\n  // The immutable creator policy determines standing session authority, not\n  // a manual caller's per-run ceiling. Read it for creation and recovery checks.\n  const recoveredCreatorPolicy = generatedSession\n    ? await getScheduledTaskCreatorPolicy(input.db, task.workspaceId, task.id)\n    : null;\n  const frozenSlack = input.acceptedExecution.resolvedSlackBotConnection;\n  if (frozenSlack) {\n    const currentSlack = await requireOpenGeniSlackBotConnection(\n      input.db,\n      task.workspaceId,\n      frozenSlack.id,\n    );\n    const currentMetadata = openGeniSlackBotMetadata(currentSlack.metadata);\n    if (\n      currentSlack.version !== frozenSlack.version ||\n      currentSlack.verifiedInstallVersion !== frozenSlack.verifiedInstallVersion ||\n      stableJson(currentMetadata) !== stableJson(frozenSlack.metadata)\n    ) {\n      throw new ScheduledRunTerminalAuthorityError(\n        \"scheduled_slack_authority_changed\",\n        \"scheduled Slack bot authority changed after run admission\",\n      );\n    }\n  }\n  let session: Awaited<ReturnType<typeof createSession>>;\n  if (input.run.sessionId) {\n    session = await requireSession(input.db, task.workspaceId, input.run.sessionId);\n    // Preserve the reusable chat's Slack routing; the accepted target snapshot\n    // independently fences its current Variable Set attachments during recovery.\n    if (!generatedSession) assertReusableSessionBindingMatches(session, task);\n  } else if (generatedSession) {\n    const variableSet = input.acceptedExecution.resolvedVariableSet;\n    if (variableSet) {\n      const current = await getVariableSet(\n        input.db,\n        {\n          accountId: task.accountId,\n          workspaceId: task.workspaceId,\n          subjectId:\n            input.acceptedExecution.personalResourceAuthoritySubjectId ?? task.createdBy.subjectId,\n        },\n        variableSet.id,\n      );\n      if (!current || current.generation !== variableSet.generation) {\n        throw new ScheduledRunTerminalAuthorityError(\n          \"scheduled_variable_set_authority_changed\",\n          \"scheduled variable set changed after run admission\",\n        );\n      }\n    }\n    const rig = input.acceptedExecution.resolvedRig;\n    if (rig) {\n      const retained = await getScheduledScopedRigVersionMetadata(\n        input.db,\n        {\n          accountId: task.accountId,\n          workspaceId: task.workspaceId,\n          subjectId:\n            input.acceptedExecution.personalResourceAuthoritySubjectId ?? task.createdBy.subjectId,\n        },\n        rig.id,\n        rig.versionId,\n      );\n      if (!retained) {\n        throw new ScheduledRunTerminalAuthorityError(\n          \"scheduled_rig_authority_changed\",\n          \"scheduled rig changed after run admission\",\n        );\n      }\n    }\n    const taskMetadata = { ...task.agentConfig.metadata };\n    delete taskMetadata[OPENGENI_SLACK_BOT_SESSION_METADATA_KEY];\n    const created = await createSessionWithIdempotencyKeyResult(input.db, {\n      accountId: task.accountId,\n      workspaceId: task.workspaceId,\n      initialMessage: task.agentConfig.prompt,\n      resources: task.agentConfig.resources,\n      bundledSkillIds: task.agentConfig.bundledSkillIds,\n      tools: input.acceptedExecution.resolvedTools,\n      firstPartyMcpTools: input.acceptedExecution.resolvedFirstPartyMcpTools,\n      firstPartyMcpPermissions: input.acceptedExecution.resolvedFirstPartyMcpPermissions,\n      ...(input.acceptedExecution.resolvedAgentConfig\n        ? { agentConfig: input.acceptedExecution.resolvedAgentConfig }\n        : {}),\n      ...(input.acceptedExecution.resolvedAgentInstructions !== undefined\n        ? { instructions: input.acceptedExecution.resolvedAgentInstructions }\n        : {}),\n      ...scheduledCreatorSessionPolicyInput(recoveredCreatorPolicy?.sessionPolicy ?? null),\n      ...(task.vaultPolicy ? { vaultPolicy: task.vaultPolicy } : {}),\n      ...(task.agentConfig.knowledgeSource?.destination.kind === \"personal\" ||\n      task.visibility === \"private\"\n        ? {\n            visibility: \"user_private\" as const,\n            scheduledSourceRunId: input.run.id,\n          }\n        : {}),\n      metadata: {\n        ...taskMetadata,\n        ...scheduledSessionExecutionPolicyMetadata(\n          input.acceptedExecution.turnExecutionPolicy,\n          recoveredCreatorPolicy?.credentialRestriction,\n        ),\n        model: input.acceptedExecution.resolvedModel,\n        reasoningEffort: input.acceptedExecution.resolvedReasoningEffort,\n        scheduledTaskId: task.id,\n        scheduledTaskRunMode: task.runMode,\n        ...(task.agentConfig.goal ? { scheduledTaskGoal: task.agentConfig.goal } : {}),\n        scheduledTaskRunId: input.run.id,\n        ...(frozenSlack ? { [OPENGENI_SLACK_BOT_SESSION_METADATA_KEY]: frozenSlack.id } : {}),\n      },\n      createdBy: {\n        kind: \"service\",\n        subjectId: \"scheduler\",\n        label: \"OpenGeni scheduler\",\n      },\n      createdByContext: {\n        scheduledTaskId: task.id,\n        scheduledTaskRunId: input.run.id,\n      },\n      model: input.acceptedExecution.resolvedModel,\n      reasoningEffort: input.acceptedExecution.resolvedReasoningEffort,\n      latencyMode: input.acceptedExecution.resolvedLatencyMode,\n      sandboxBackend: input.acceptedExecution.resolvedSandboxBackend,\n      sandboxOs: input.acceptedExecution.resolvedSandboxOs,\n      variableSetId: variableSet?.id ?? null,\n      rigId: rig?.id ?? null,\n      rigVersionId: rig?.versionId ?? null,\n      personalConnectionDelegations: [],\n      initialXaiProviderAccountAuthoritySnapshot:\n        input.acceptedExecution.xaiProviderAccountAuthoritySnapshot,\n      initialClaudeProviderAccountAuthoritySnapshot:\n        input.acceptedExecution.claudeProviderAccountAuthoritySnapshot,\n      maxNestedAgentDepthOverride: task.agentConfig.maxNestedAgentDepth ?? null,\n      frozenNestedAgentDepthPolicy: {\n        effectiveMaxNestedAgentDepth:\n          input.acceptedExecution.generatedSessionBinding!.effectiveMaxNestedAgentDepth,\n        nestedAgentDepthPolicySource:\n          input.acceptedExecution.generatedSessionBinding!.nestedAgentDepthPolicySource,\n      },\n      frozenCodexCompactionMode:\n        input.acceptedExecution.generatedSessionBinding!.codexCompactionMode,\n      allowNestedAgentDepthIncrease: true,\n      subjectId: `scheduled_task:${task.id}`,\n      createIdempotencyKey:\n        input.acceptedExecution.generatedSessionBinding?.createIdempotencyKey ??\n        (() => {\n          throw new ScheduledRunTerminalAuthorityError(\n            \"scheduled_generated_session_binding_missing\",\n            \"scheduled generated session binding is missing\",\n          );\n        })(),\n      beforeCreateCommit: async (tx, sessionId) => {\n        await bindScheduledTaskRunSessionInTransaction(tx, {\n          accountId: task.accountId,\n          workspaceId: task.workspaceId,\n          runId: input.run.id,\n          sessionId,\n        });\n      },\n    });\n    if (created.denied) throw new SessionSpawnDeniedDbError(created.denial);\n    session = created.session;\n    if (created.created) recordScheduledSessionCreated(input.observability);\n    if (!created.created) {\n      await bindScheduledTaskRunSessionInTransaction(input.db, {\n        accountId: task.accountId,\n        workspaceId: task.workspaceId,\n        runId: input.run.id,\n        sessionId: session.id,\n      });\n    }\n  } else {\n    const targetSessionId =\n      task.runMode === \"existing_session\" ? task.targetSessionId : task.reusableSessionId;\n    if (!targetSessionId) {\n      throw new ScheduledRunTerminalAuthorityError(\n        \"scheduled_target_session_unavailable\",\n        \"scheduled accepted target session is unavailable\",\n      );\n    }\n    session = await requireSession(input.db, task.workspaceId, targetSessionId);\n    // Same backstop for a first attempt that died before its bind landed.\n    assertReusableSessionBindingMatches(session, task);\n    await bindScheduledTaskRunSessionInTransaction(input.db, {\n      accountId: task.accountId,\n      workspaceId: task.workspaceId,\n      runId: input.run.id,\n      sessionId: session.id,\n    });\n  }\n  if (generatedSession) {\n    session = await seedScheduledGeneratedSessionRoute({\n      db: input.db,\n      bus: input.bus,\n      settings: input.settings,\n      task,\n      runId: input.run.id,\n      session,\n      deferPublications: false,\n      deferredEvents: [],\n    });\n  }\n  if (session.status === \"cancelled\") {\n    await markScheduledTaskRunSkippedIfQueued(input.db, {\n      workspaceId: task.workspaceId,\n      runId: input.run.id,\n      sessionId: session.id,\n      error: \"session_cancelled\",\n    });\n    return { action: \"blocked\", reason: \"scheduled_run_terminal\" };\n  }\n  if (generatedSession) {\n    const expectedCreateKey = input.acceptedExecution.generatedSessionBinding?.createIdempotencyKey;\n    if (!expectedCreateKey) {\n      throw new ScheduledRunTerminalAuthorityError(\n        \"scheduled_generated_session_binding_missing\",\n        \"scheduled generated session binding is missing\",\n      );\n    }\n    const generatedBinding = input.acceptedExecution.generatedSessionBinding!;\n    const canonicalGeneratedRunId =\n      task.runMode === \"reusable_session\" && typeof session.metadata.scheduledTaskRunId === \"string\"\n        ? session.metadata.scheduledTaskRunId\n        : input.run.id;\n    // The public Session policy follows the latest started turn. Recovery must\n    // instead validate the immutable creation binding accepted by this run.\n    const creationPolicy = await getSessionCreationExecutionPolicy(\n      input.db,\n      task.workspaceId,\n      session.id,\n    );\n    const expectedTaskMetadata = { ...task.agentConfig.metadata };\n    delete expectedTaskMetadata[OPENGENI_SLACK_BOT_SESSION_METADATA_KEY];\n    const expectedMetadata = metadataWithAgentConfigCreateIdentity(\n      {\n        ...expectedTaskMetadata,\n        ...scheduledSessionExecutionPolicyMetadata(\n          input.acceptedExecution.turnExecutionPolicy,\n          recoveredCreatorPolicy?.credentialRestriction,\n        ),\n        model: input.acceptedExecution.resolvedModel,\n        reasoningEffort: input.acceptedExecution.resolvedReasoningEffort,\n        scheduledTaskId: task.id,\n        scheduledTaskRunMode: task.runMode,\n        ...(task.agentConfig.goal ? { scheduledTaskGoal: task.agentConfig.goal } : {}),\n        scheduledTaskRunId: canonicalGeneratedRunId,\n        ...(frozenSlack ? { [OPENGENI_SLACK_BOT_SESSION_METADATA_KEY]: frozenSlack.id } : {}),\n      },\n      input.acceptedExecution.resolvedAgentConfig,\n    );\n    if (\n      session.createIdempotencyKey !== expectedCreateKey ||\n      session.initialMessage !== task.agentConfig.prompt ||\n      session.instructions !== (input.acceptedExecution.resolvedAgentInstructions ?? null) ||\n      session.policyRole !== null ||\n      stableJson(session.skills) !== \"[]\" ||\n      stableJson(session.toolPolicy) !==\n        stableJson({ mode: \"explicit\", inheritedFromSessionId: null }) ||\n      session.toolPolicyVersion !== 1 ||\n      session.mcpServers.length !== 0 ||\n      session.parentSessionId !== null ||\n      session.rootSessionId !== session.id ||\n      session.nestedAgentDepth !== 0 ||\n      session.effectiveMaxNestedAgentDepth !== generatedBinding.effectiveMaxNestedAgentDepth ||\n      session.nestedAgentDepthPolicySource !== generatedBinding.nestedAgentDepthPolicySource ||\n      session.nestedAgentDepthPolicySessionId !==\n        (generatedBinding.nestedAgentDepthPolicySource === \"session\" ? session.id : null) ||\n      session.sandboxGroupId !== session.id ||\n      session.channelId !== null ||\n      session.codexCompactionMode !== generatedBinding.codexCompactionMode ||\n      stableJson(session.metadata) !== stableJson(expectedMetadata) ||\n      session.createdBy.kind !== \"service\" ||\n      session.createdBy.subjectId !== \"scheduler\" ||\n      stableJson(session.createdByContext) !==\n        stableJson({\n          label: \"OpenGeni scheduler\",\n          scheduledTaskId: task.id,\n          scheduledTaskRunId: canonicalGeneratedRunId,\n        }) ||\n      (task.runMode === \"new_session_per_run\" &&\n        input.acceptedExecution.alertOccurrenceLabels === null &&\n        (session.metadata.scheduledTaskRunId !== input.run.id ||\n          session.createdByContext.scheduledTaskRunId !== input.run.id)) ||\n      creationPolicy?.model !== input.acceptedExecution.resolvedModel ||\n      creationPolicy.reasoningEffort !== input.acceptedExecution.resolvedReasoningEffort ||\n      creationPolicy.latencyMode !== input.acceptedExecution.resolvedLatencyMode ||\n      session.sandboxBackend !== input.acceptedExecution.resolvedSandboxBackend ||\n      session.sandboxOs !== input.acceptedExecution.resolvedSandboxOs ||\n      session.activeSandboxId !== (task.agentConfig.machineTarget?.targetSandboxId ?? null) ||\n      stableJson(session.resources) !== stableJson(task.agentConfig.resources) ||\n      stableJson(session.tools) !== stableJson(input.acceptedExecution.resolvedTools) ||\n      stableJson(session.firstPartyMcpTools) !==\n        stableJson(input.acceptedExecution.resolvedFirstPartyMcpTools) ||\n      stableJson(session.firstPartyMcpPermissions) !==\n        stableJson(input.acceptedExecution.resolvedFirstPartyMcpPermissions) ||\n      stableJson(session.agent) !==\n        stableJson(input.acceptedExecution.resolvedAgentConfig ?? null) ||\n      session.maxNestedAgentDepthOverride !== (task.agentConfig.maxNestedAgentDepth ?? null) ||\n      (session.variableSetId ?? null) !==\n        (input.acceptedExecution.resolvedVariableSet?.id ?? null) ||\n      (session.rigId ?? null) !== (input.acceptedExecution.resolvedRig?.id ?? null) ||\n      (session.rigVersionId ?? null) !== (input.acceptedExecution.resolvedRig?.versionId ?? null) ||\n      scheduledSlackBotConnectionId(session.metadata) !== (frozenSlack?.id ?? null)\n    ) {\n      throw new ScheduledRunTerminalAuthorityError(\n        \"scheduled_generated_session_changed\",\n        \"scheduled generated session differs from accepted execution\",\n      );\n    }\n  }\n  let workflowId = workflowIdForSession(session.id);\n  if (generatedSession) {\n    const goalSpec = task.agentConfig.goal ?? null;\n    const started = await initializeSessionStartAtomically(input.db, {\n      accountId: task.accountId,\n      workspaceId: task.workspaceId,\n      sessionId: session.id,\n      reasoningEffortFallback: input.acceptedExecution.resolvedReasoningEffort,\n      createdEventPayload: {\n        scheduledTaskId: task.id,\n        scheduledTaskRunId: input.run.id,\n      },\n      goal: goalSpec\n        ? {\n            text: goalSpec.text,\n            successCriteria: goalSpec.successCriteria ?? null,\n            maxAutoContinuations: goalSpec.maxAutoContinuations ?? null,\n            ...(goalSpec.mutationPolicy ? { mutationPolicy: goalSpec.mutationPolicy } : {}),\n            createdBy: \"scheduled_task\",\n          }\n        : null,\n      deferInitialTurn: true,\n      deferredStatus: \"queued\",\n    });\n    workflowId = started.temporalWorkflowId;\n    if (started.events.length > 0) {\n      await publishDurableSessionEvents(input.bus, task.workspaceId, session.id, started.events);\n    }\n    if (task.runMode === \"reusable_session\") {\n      await materializeScheduledTaskReusableSessionFromRun(input.db, {\n        accountId: task.accountId,\n        workspaceId: task.workspaceId,\n        taskId: task.id,\n        runId: input.run.id,\n        sessionId: session.id,\n        sourceTaskAuthorityRevision: input.run.taskAuthorityRevision!,\n        sourceExecutionDigest: input.run.taskExecutionDigest!,\n      });\n    }\n    // Same title the normal dispatch writes, from the same durable task row, in\n    // the same position relative to session.created. A session the dead dispatch\n    // already titled is left alone.\n    const titleEvents = await stampScheduledSessionTitle(input.db, {\n      workspaceId: task.workspaceId,\n      sessionId: session.id,\n      taskName: task.name,\n    });\n    if (titleEvents.length > 0) {\n      await publishDurableSessionEvents(input.bus, task.workspaceId, session.id, titleEvents);\n    }\n  }\n  const scheduledUpdate = await addSessionSystemUpdateWithSourceMutation(\n    input.db,\n    {\n      accountId: task.accountId,\n      workspaceId: task.workspaceId,\n      sessionId: session.id,\n      kind: \"scheduled_occurrence\",\n      classification: \"info\",\n      sourceId: input.run.id,\n      dedupeKey: `scheduled-task-run:${input.run.id}`,\n      summary: task.agentConfig.prompt,\n      payload: scheduledUserMessagePayload(\n        task.agentConfig.prompt,\n        task.agentConfig.resources,\n        input.acceptedExecution.resolvedTools,\n        task.id,\n        input.run.id,\n        input.acceptedExecution.degradedAccounts ?? [],\n      ),\n      lineage: {\n        scheduledTaskId: task.id,\n        scheduledTaskRunId: input.run.id,\n        ...(input.acceptedExecution.causalHumanSubjectId\n          ? { causalHumanSubjectId: input.acceptedExecution.causalHumanSubjectId }\n          : {}),\n        ...(input.acceptedExecution.connectionAuthoritySubjectId\n          ? {\n              connectionAuthoritySubjectId: input.acceptedExecution.connectionAuthoritySubjectId,\n            }\n          : {}),\n        ...(input.acceptedExecution.xaiAuthoritySubjectId\n          ? { xaiAuthoritySubjectId: input.acceptedExecution.xaiAuthoritySubjectId }\n          : {}),\n        ...(input.acceptedExecution.claudeAuthoritySubjectId\n          ? { claudeAuthoritySubjectId: input.acceptedExecution.claudeAuthoritySubjectId }\n          : {}),\n      },\n      personalConnectionDelegations: input.acceptedExecution.personalConnectionDelegations,\n      mcpAccountBindings: input.acceptedExecution.mcpAccountBindings ?? null,\n      xaiProviderAccountAuthoritySnapshot:\n        input.acceptedExecution.xaiProviderAccountAuthoritySnapshot,\n      claudeProviderAccountAuthoritySnapshot:\n        input.acceptedExecution.claudeProviderAccountAuthoritySnapshot,\n      // Codex v2 (M3 PR 3b): the task's value frozen at creation, narrowed to\n      // empty when the accepted revision's authorizer is not the owner.\n      subscriptionAuthority: await getScheduledTaskSubscriptionAuthority(input.db, {\n        workspaceId: task.workspaceId,\n        taskId: task.id,\n        revisionAuthorizerSubjectId:\n          input.acceptedExecution.causalHumanAuthority?.subjectId ?? null,\n        taskAuthorityRevision: task.authorityRevision,\n      }),\n      scheduledTaskRunId: input.run.id,\n    },\n    async (tx, wakeEventId, _updateId, rejectionReason) => {\n      if (!wakeEventId) {\n        const error = scheduledSessionRejectionError(rejectionReason);\n        await settleScheduledTaskRunInTransaction(tx, {\n          workspaceId: task.workspaceId,\n          runId: input.run.id,\n          sessionId: session.id,\n          triggerEventId: null,\n          status: \"skipped\",\n          error,\n        });\n        return;\n      }\n      await settleScheduledTaskRunInTransaction(tx, {\n        workspaceId: task.workspaceId,\n        runId: input.run.id,\n        sessionId: session.id,\n        triggerEventId: wakeEventId,\n        status: \"dispatched\",\n      });\n    },\n    {\n      requireIdleSession: task.overlapPolicy === \"skip\" && !generatedSession,\n      prepareSource: async (tx, sessionId) => {\n        const goal = task.agentConfig.goal;\n        const goalEvents =\n          !generatedSession && task.runMode === \"reusable_session\" && goal\n            ? await upsertScheduledSessionGoalForRun(tx, {\n                accountId: task.accountId,\n                workspaceId: task.workspaceId,\n                sessionId,\n                runId: input.run.id,\n                text: goal.text,\n                successCriteria: goal.successCriteria ?? null,\n                maxAutoContinuations: goal.maxAutoContinuations ?? null,\n                ...(goal.mutationPolicy ? { mutationPolicy: goal.mutationPolicy } : {}),\n              })\n            : [];\n        const incidentSource = input.acceptedExecution.incidentPreflightRequired\n          ? await prepareIncidentTelemetrySource({\n              tx,\n              settings: input.settings,\n              taskId: task.id,\n              workspaceId: task.workspaceId,\n              sessionId,\n              alertOccurrenceLabels: input.acceptedExecution.alertOccurrenceLabels,\n              acceptedExecution: input.acceptedExecution,\n            })\n          : undefined;\n        return {\n          ...(incidentSource ?? {}),\n          ...(goalEvents.length > 0 ? { events: goalEvents } : {}),\n        };\n      },\n    },\n  );\n  if (\n    scheduledUpdate.reason === \"session_cancelled\" ||\n    scheduledUpdate.reason === \"session_not_idle\" ||\n    scheduledUpdate.reason === \"session_paused\"\n  ) {\n    return { action: \"blocked\", reason: \"scheduled_run_terminal\" };\n  }\n  if (scheduledUpdate.added) {\n    recordUserMessageAccepted(input.observability, { surface: \"scheduled\" });\n  }\n  if (scheduledUpdate.added && scheduledUpdate.events.length > 0) {\n    await publishDurableSessionEvents(\n      input.bus,\n      task.workspaceId,\n      session.id,\n      scheduledUpdate.events,\n    );\n  }\n  await recordUsageEvent(input.db, {\n    accountId: task.accountId,\n    workspaceId: task.workspaceId,\n    eventType: \"agent_run.created\",\n    quantity: 1,\n    unit: \"run\",\n    sourceResourceType: \"scheduled_task_run\",\n    sourceResourceId: input.run.id,\n    sessionId: session.id,\n    initiator: input.acceptedExecution.triggerInitiator,\n    initiatorContext: { scheduledTaskId: task.id, scheduledTaskRunId: input.run.id },\n    origin: \"scheduled_task\",\n    idempotencyKey:\n      input.acceptedExecution.agentRunUsageIdempotencyKey ??\n      `usage:agent_run.created:scheduled:${input.run.id}`,\n  });\n  const workflowWakeRevision = await enqueueSessionWorkflowWakeIfRunnable(input.db, {\n    accountId: task.accountId,\n    workspaceId: task.workspaceId,\n    sessionId: session.id,\n    temporalWorkflowId: workflowId,\n    reason: \"scheduled_retry\",\n  });\n  const result = {\n    action: generatedSession ? \"start\" : \"signal\",\n    accountId: task.accountId,\n    workspaceId: task.workspaceId,\n    sessionId: session.id,\n    triggerEventId: scheduledUpdate.wakeEventId,\n    workflowId,\n    workflowWakeRevision,\n  } as const;\n  if (input.wakeSessionWorkflow && workflowWakeRevision !== null) {\n    await input.wakeSessionWorkflow({\n      accountId: result.accountId,\n      workspaceId: result.workspaceId,\n      sessionId: result.sessionId,\n      workflowId: result.workflowId,\n      wakeRevision: workflowWakeRevision,\n    });\n  }\n  return result;\n}\n\nasync function replayScheduledTaskDispatch(input: {\n  db: Database;\n  wakeSessionWorkflow: WakeSessionWorkflowSignal | null;\n  task: ScheduledTask;\n  run: ScheduledTaskRun;\n  acceptedExecution: ScheduledTaskRunAcceptedExecution;\n}): Promise<DispatchScheduledTaskRunResult> {\n  if (!input.run.sessionId || !input.run.triggerEventId) {\n    throw new Error(\"dispatched scheduled task run is missing its delivery identity\");\n  }\n  const sessionId = input.run.sessionId;\n  const triggerEventId = input.run.triggerEventId;\n  await requireSession(input.db, input.task.workspaceId, sessionId);\n  await recordUsageEvent(input.db, {\n    accountId: input.task.accountId,\n    workspaceId: input.task.workspaceId,\n    eventType: \"agent_run.created\",\n    quantity: 1,\n    unit: \"run\",\n    sourceResourceType: \"scheduled_task_run\",\n    sourceResourceId: input.run.id,\n    sessionId,\n    initiator: input.acceptedExecution.triggerInitiator,\n    initiatorContext: {\n      scheduledTaskId: input.task.id,\n      scheduledTaskRunId: input.run.id,\n    },\n    origin: \"scheduled_task\",\n    idempotencyKey:\n      input.acceptedExecution.agentRunUsageIdempotencyKey ??\n      `usage:agent_run.created:scheduled:${input.run.id}`,\n  });\n  const workflowId = workflowIdForSession(sessionId);\n  const workflowWakeRevision = await enqueueSessionWorkflowWakeIfRunnable(input.db, {\n    accountId: input.task.accountId,\n    workspaceId: input.task.workspaceId,\n    sessionId,\n    temporalWorkflowId: workflowId,\n    reason: \"scheduled_retry\",\n  });\n  const result = {\n    action: input.acceptedExecution.task.runMode === \"new_session_per_run\" ? \"start\" : \"signal\",\n    accountId: input.task.accountId,\n    workspaceId: input.task.workspaceId,\n    sessionId,\n    triggerEventId,\n    workflowId,\n    workflowWakeRevision,\n  } as const;\n  if (input.wakeSessionWorkflow && workflowWakeRevision !== null) {\n    await input.wakeSessionWorkflow({\n      accountId: result.accountId,\n      workspaceId: result.workspaceId,\n      sessionId: result.sessionId,\n      workflowId: result.workflowId,\n      wakeRevision: workflowWakeRevision,\n    });\n  }\n  return result;\n}\n\n/**\n * Session-create fields carried by a frozen creator session policy. Only the\n * facts the creating session projection exposed at task creation are set;\n * a null (or no longer valid) key leaves the generated session on its own\n * default. The field names are the session access-scope contract\n * (`agentAccess`, `scopeSubjectId`, `memoryScope`) consumed by session create.\n */\nfunction scheduledCreatorSessionPolicyInput(\n  policy: {\n    agentAccess: string | null;\n    scopeSubjectId: string | null;\n    memoryScope: string | null;\n  } | null,\n): {\n  agentAccess?: SessionAgentAccess;\n  scopeSubjectId?: string;\n  memoryScope?: SessionMemoryScope;\n} {\n  if (!policy) return {};\n  const agentAccess = SessionAgentAccess.safeParse(policy.agentAccess);\n  const memoryScope = SessionMemoryScope.safeParse(policy.memoryScope);\n  return {\n    ...(agentAccess.success ? { agentAccess: agentAccess.data } : {}),\n    // This is a trusted DB admission input, not the public create payload.\n    // Preserve the immutable creator policy through scheduled materialization.\n    ...(policy.scopeSubjectId && /^(?:user:|external_user:).+/u.test(policy.scopeSubjectId)\n      ? { scopeSubjectId: policy.scopeSubjectId }\n      : {}),\n    ...(memoryScope.success ? { memoryScope: memoryScope.data } : {}),\n  };\n}\n\nfunction knowledgeSourceSyncEffectivelyPaused(task: {\n  status: \"active\" | \"paused\";\n  metadata: Record<string, unknown>;\n}): boolean {\n  if (task.status === \"paused\") return true;\n  const value = task.metadata.knowledgeSourceSync;\n  if (!value || typeof value !== \"object\") return false;\n  const control = value as Record<string, unknown>;\n  return control.sourceEnabled === false || control.connectionPaused === true;\n}\n","import { createHash } from \"node:crypto\";\n\nconst MAX_SCHEDULED_TASK_ID_BYTES = 256;\nconst MAX_STARTS_AT_BYTES = 256;\nconst MAX_PROVIDER_BYTES = 256;\nconst MAX_FINGERPRINT_BYTES = 1_024;\nconst MAX_LABELS = 256;\nconst MAX_LABEL_KEY_BYTES = 256;\nconst MAX_LABEL_VALUE_BYTES = 4_096;\nconst OFFSET_TIMESTAMP =\n  /^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2})(?::(\\d{2})(?:\\.(\\d+))?)?(?:Z|[+-](\\d{2}):(\\d{2}))$/;\n\nexport type ScheduledAlertOccurrenceDeclaration = {\n  status: \"firing\" | \"resolved\";\n  startsAt: string;\n  fingerprint: string;\n  labels: Record<string, string>;\n  provider?: string;\n};\n\nexport type ScheduledAlertOccurrenceIdentity = {\n  status: \"firing\" | \"resolved\";\n  sessionCreateIdempotencyKey: string;\n  /** Exact bounded labels from the validated structured occurrence. */\n  labels: Readonly<Record<string, string>>;\n};\n\n/**\n * Bind the series-stable occurrence identity to one accepted task execution\n * definition. A later task revision must not adopt the prior responder root,\n * because that session has already frozen the old prompt/tool/authority policy.\n */\nexport function scheduledAlertResponderSessionCreateIdempotencyKey(input: {\n  occurrence: ScheduledAlertOccurrenceIdentity;\n  taskAuthorityRevision: number;\n  taskExecutionDigest: string;\n}): string {\n  const digest = createHash(\"sha256\")\n    .update(\n      JSON.stringify({\n        version: 1,\n        occurrenceKey: input.occurrence.sessionCreateIdempotencyKey,\n        taskAuthorityRevision: input.taskAuthorityRevision,\n        taskExecutionDigest: input.taskExecutionDigest,\n      }),\n    )\n    .digest(\"hex\");\n  return `scheduled-alert-occurrence:v1:${digest}`;\n}\n\n/**\n * Derive one content-free, workspace-bound identity for an Alertmanager-style\n * alert occurrence. Missing or malformed metadata deliberately returns null so\n * ordinary scheduled tasks retain their existing new-session-per-run behavior.\n */\nexport function scheduledAlertOccurrenceIdentity(input: {\n  workspaceId: string;\n  scheduledTaskId: string;\n  metadata: Record<string, unknown>;\n}): ScheduledAlertOccurrenceIdentity | null {\n  const scheduledTaskId = boundedString(input.scheduledTaskId, MAX_SCHEDULED_TASK_ID_BYTES);\n  if (!scheduledTaskId) return null;\n\n  const alert = record(input.metadata.alert);\n  if (!alert) return null;\n\n  const status = alert.status;\n  if (status !== \"firing\" && status !== \"resolved\") return null;\n\n  const startsAt = canonicalTimestamp(alert.startsAt);\n  const fingerprint = boundedString(alert.fingerprint, MAX_FINGERPRINT_BYTES);\n  const labels = canonicalLabels(alert.labels);\n  if (!startsAt || !fingerprint || !labels) return null;\n\n  const provider = boundedString(\n    alert.provider ?? input.metadata.alertProvider ?? input.metadata.provider ?? \"alertmanager\",\n    MAX_PROVIDER_BYTES,\n  );\n  if (!provider) return null;\n  const digest = createHash(\"sha256\")\n    .update(\n      JSON.stringify({\n        version: 1,\n        workspaceId: input.workspaceId,\n        scheduledTaskId,\n        provider,\n        fingerprint,\n        startsAt,\n        labels,\n      }),\n    )\n    .digest(\"hex\");\n  return {\n    status,\n    sessionCreateIdempotencyKey: `scheduled-alert-occurrence:v1:${digest}`,\n    labels: Object.fromEntries(labels),\n  };\n}\n\nfunction record(value: unknown): Record<string, unknown> | null {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : null;\n}\n\nfunction boundedString(value: unknown, maxBytes: number): string | null {\n  if (typeof value !== \"string\") return null;\n  const normalized = value.trim();\n  if (!normalized || Buffer.byteLength(normalized, \"utf8\") > maxBytes) return null;\n  return normalized;\n}\n\nfunction canonicalTimestamp(value: unknown): string | null {\n  if (typeof value !== \"string\") return null;\n  const trimmed = value.trim();\n  if (!trimmed || Buffer.byteLength(trimmed, \"utf8\") > MAX_STARTS_AT_BYTES) return null;\n  const match = OFFSET_TIMESTAMP.exec(trimmed);\n  if (!match) return null;\n  const [\n    ,\n    yearText,\n    monthText,\n    dayText,\n    hourText,\n    minuteText,\n    secondText,\n    ,\n    offsetHourText,\n    offsetMinuteText,\n  ] = match;\n  const year = Number(yearText);\n  const month = Number(monthText);\n  const day = Number(dayText);\n  const hour = Number(hourText);\n  const minute = Number(minuteText);\n  const second = secondText === undefined ? 0 : Number(secondText);\n  const offsetHour = offsetHourText === undefined ? 0 : Number(offsetHourText);\n  const offsetMinute = offsetMinuteText === undefined ? 0 : Number(offsetMinuteText);\n  const leapYear = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);\n  const daysInMonth = [31, leapYear ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];\n  if (\n    month < 1 ||\n    month > 12 ||\n    day < 1 ||\n    day > daysInMonth[month - 1]! ||\n    hour > 23 ||\n    minute > 59 ||\n    second > 59 ||\n    offsetHour > 23 ||\n    offsetMinute > 59\n  ) {\n    return null;\n  }\n  const parsed = new Date(trimmed);\n  return Number.isFinite(parsed.getTime()) ? trimmed : null;\n}\n\nfunction canonicalLabels(value: unknown): Array<readonly [string, string]> | null {\n  const labels = record(value);\n  if (!labels) return null;\n  const entries = Object.entries(labels);\n  if (entries.length === 0 || entries.length > MAX_LABELS) return null;\n  const canonical: Array<readonly [string, string]> = [];\n  for (const [key, rawValue] of entries) {\n    if (\n      !key ||\n      Buffer.byteLength(key, \"utf8\") > MAX_LABEL_KEY_BYTES ||\n      typeof rawValue !== \"string\" ||\n      Buffer.byteLength(rawValue, \"utf8\") > MAX_LABEL_VALUE_BYTES\n    ) {\n      return null;\n    }\n    canonical.push([key, rawValue]);\n  }\n  return canonical.sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0));\n}\n","import {\n  settleSessionAttemptInterruptions,\n  applySessionTurnSettlement,\n  enqueueSessionWorkflowWake,\n  failSessionWorkBeforeAttemptClaim,\n  blockSessionWorkBeforeAttemptClaim,\n  requestSessionTurnRecovery,\n  recoverSessionDispatch,\n  reconcileSettledSessionAttempt,\n  reconcileSessionAttemptQuiescence,\n  reconcileCompletedSandboxSetup,\n  peekSessionWork as peekSessionWorkDb,\n  settleSessionInputWait as settleSessionInputWaitDb,\n  countQueuedTurns,\n  getSessionAttemptActivityRef,\n  getSessionEvent,\n  getSessionTurnForAttempt,\n  getWorkspace,\n  expireSessionInteractionIntervention as expireSessionInteractionInterventionDb,\n  expireScheduledRunHumanWait as expireScheduledRunHumanWaitDb,\n  expireSessionHumanInputRequest,\n  markSessionAttemptQuiesced,\n  requireSession,\n  settleSessionIdleWithParentOutbox,\n  SANDBOX_SETUP_RECOVERY_LIMIT,\n} from \"@opengeni/db\";\nimport { publishDurableSessionEvents } from \"@opengeni/events\";\nimport { CancelledFailure } from \"@temporalio/activity\";\nimport { currentActivityContext } from \"./streaming\";\nimport { deliverFailedChildTurnToParent, notifyParentOfChildIdle } from \"./parent-wake\";\nimport { interactionInterventionMetricObserver } from \"@opengeni/observability\";\nimport { recordTurnsQueuedGauge, recordWorkerDeathRecoveryMetrics } from \"../observability-metrics\";\nimport {\n  MAX_AUTOMATIC_PROVIDER_RECOVERIES,\n  providerRecoveryCountFromMetadata,\n  providerRecoveryLimit,\n} from \"./agent-turn/errors\";\nimport {\n  PROVIDER_OVERLOAD_RECOVERY_CODE,\n  validProviderOverloadRecoveryDelay,\n} from \"./agent-turn/provider-recovery-policy\";\nimport { writeSessionUsageReceipts } from \"./agent-turn/session-usage-custody\";\nimport type {\n  ControlActivityServices,\n  ExpireSessionHumanInputInput,\n  ExpireSessionHumanInputResult,\n  ExpireSessionInteractionInterventionInput,\n  ExpireScheduledRunHumanWaitInput,\n  ExpireScheduledRunHumanWaitResult,\n  ExpireSessionInteractionInterventionResult,\n  PeekSessionWorkInput,\n  FailSessionAttemptInput,\n  FailSessionAttemptResult,\n  SettleSessionInterruptionsInput,\n  MarkSessionIdleInput,\n  PersistSessionAttemptQuiescenceInput,\n  ReconcileSessionAttemptQuiescenceInput,\n  ReconcileSessionAttemptQuiescenceResult,\n  ReconcileSettledSessionAttemptInput,\n  ReconcileSettledSessionAttemptResult,\n  RecoverDispatchInput,\n  RecoverDispatchResult,\n  RecoverEscapedMcpTimeoutInput,\n  RecoverEscapedMcpTimeoutResult,\n  SettleSessionInputWaitInput,\n  SettleSessionInputWaitResult,\n} from \"./types\";\n\nexport type SessionStateActivityOverrides = Partial<{\n  settleSessionAttemptInterruptions: typeof settleSessionAttemptInterruptions;\n  applySessionTurnSettlement: typeof applySessionTurnSettlement;\n  enqueueSessionWorkflowWake: typeof enqueueSessionWorkflowWake;\n  failSessionWorkBeforeAttemptClaim: typeof failSessionWorkBeforeAttemptClaim;\n  blockSessionWorkBeforeAttemptClaim: typeof blockSessionWorkBeforeAttemptClaim;\n  requestSessionTurnRecovery: typeof requestSessionTurnRecovery;\n  recoverSessionDispatch: typeof recoverSessionDispatch;\n  reconcileSettledSessionAttempt: typeof reconcileSettledSessionAttempt;\n  reconcileSessionAttemptQuiescence: typeof reconcileSessionAttemptQuiescence;\n  reconcileCompletedSandboxSetup: typeof reconcileCompletedSandboxSetup;\n  peekSessionWork: typeof peekSessionWorkDb;\n  settleSessionInputWait: typeof settleSessionInputWaitDb;\n  countQueuedTurns: typeof countQueuedTurns;\n  getSessionAttemptActivityRef: typeof getSessionAttemptActivityRef;\n  getSessionEvent: typeof getSessionEvent;\n  getSessionTurnForAttempt: typeof getSessionTurnForAttempt;\n  getWorkspace: typeof getWorkspace;\n  expireSessionHumanInputRequest: typeof expireSessionHumanInputRequest;\n  expireSessionInteractionIntervention: typeof expireSessionInteractionInterventionDb;\n  expireScheduledRunHumanWait: typeof expireScheduledRunHumanWaitDb;\n  requireSession: typeof requireSession;\n  settleSessionIdleWithParentOutbox: typeof settleSessionIdleWithParentOutbox;\n  markSessionAttemptQuiesced: typeof markSessionAttemptQuiesced;\n  publishDurableSessionEvents: typeof publishDurableSessionEvents;\n  deliverFailedChildTurnToParent: typeof deliverFailedChildTurnToParent;\n  notifyParentOfChildIdle: typeof notifyParentOfChildIdle;\n  recordTurnsQueuedGauge: typeof recordTurnsQueuedGauge;\n  recordWorkerDeathRecoveryMetrics: typeof recordWorkerDeathRecoveryMetrics;\n}>;\n\n// Crash-loop guard for worker-death re-dispatch: a turn that takes a worker\n// down this many times in a row is assumed to be the cause, not the victim,\n// and the session fails for real on the next death. A plain constant by\n// design — this is a pathology bound, not a run-length limit.\nexport const WORKER_DEATH_MAX_REDISPATCHES = 3;\n\nexport function createSessionStateActivities(\n  services: () => Promise<ControlActivityServices>,\n  overrides: SessionStateActivityOverrides = {},\n) {\n  const settleSessionAttemptInterruptionsFn =\n    overrides.settleSessionAttemptInterruptions ?? settleSessionAttemptInterruptions;\n  const applySessionTurnSettlementFn =\n    overrides.applySessionTurnSettlement ?? applySessionTurnSettlement;\n  const enqueueSessionWorkflowWakeFn =\n    overrides.enqueueSessionWorkflowWake ?? enqueueSessionWorkflowWake;\n  const failSessionWorkBeforeAttemptClaimFn =\n    overrides.failSessionWorkBeforeAttemptClaim ?? failSessionWorkBeforeAttemptClaim;\n  const blockSessionWorkBeforeAttemptClaimFn =\n    overrides.blockSessionWorkBeforeAttemptClaim ?? blockSessionWorkBeforeAttemptClaim;\n  const requestSessionTurnRecoveryFn =\n    overrides.requestSessionTurnRecovery ?? requestSessionTurnRecovery;\n  const recoverSessionDispatchFn = overrides.recoverSessionDispatch ?? recoverSessionDispatch;\n  const reconcileSettledSessionAttemptFn =\n    overrides.reconcileSettledSessionAttempt ?? reconcileSettledSessionAttempt;\n  const reconcileSessionAttemptQuiescenceFn =\n    overrides.reconcileSessionAttemptQuiescence ?? reconcileSessionAttemptQuiescence;\n  const peekSessionWorkFn = overrides.peekSessionWork ?? peekSessionWorkDb;\n  const reconcileCompletedSandboxSetupFn =\n    overrides.reconcileCompletedSandboxSetup ?? reconcileCompletedSandboxSetup;\n  const settleSessionInputWaitFn = overrides.settleSessionInputWait ?? settleSessionInputWaitDb;\n  const countQueuedTurnsFn = overrides.countQueuedTurns ?? countQueuedTurns;\n  const getSessionAttemptActivityRefFn =\n    overrides.getSessionAttemptActivityRef ?? getSessionAttemptActivityRef;\n  const getSessionEventFn = overrides.getSessionEvent ?? getSessionEvent;\n  const getSessionTurnForAttemptFn = overrides.getSessionTurnForAttempt ?? getSessionTurnForAttempt;\n  const getWorkspaceFn = overrides.getWorkspace ?? getWorkspace;\n  const expireSessionHumanInputRequestFn =\n    overrides.expireSessionHumanInputRequest ?? expireSessionHumanInputRequest;\n  const expireSessionInteractionInterventionFn =\n    overrides.expireSessionInteractionIntervention ?? expireSessionInteractionInterventionDb;\n  const expireScheduledRunHumanWaitFn =\n    overrides.expireScheduledRunHumanWait ?? expireScheduledRunHumanWaitDb;\n  const requireSessionFn = overrides.requireSession ?? requireSession;\n  const settleSessionIdleWithParentOutboxFn =\n    overrides.settleSessionIdleWithParentOutbox ?? settleSessionIdleWithParentOutbox;\n  const markSessionAttemptQuiescedFn =\n    overrides.markSessionAttemptQuiesced ?? markSessionAttemptQuiesced;\n  const publishDurableSessionEventsFn =\n    overrides.publishDurableSessionEvents ?? publishDurableSessionEvents;\n  const deliverFailedChildTurnToParentFn =\n    overrides.deliverFailedChildTurnToParent ?? deliverFailedChildTurnToParent;\n  const notifyParentOfChildIdleFn = overrides.notifyParentOfChildIdle ?? notifyParentOfChildIdle;\n  const recordTurnsQueuedGaugeFn = overrides.recordTurnsQueuedGauge ?? recordTurnsQueuedGauge;\n  const recordWorkerDeathRecoveryMetricsFn =\n    overrides.recordWorkerDeathRecoveryMetrics ?? recordWorkerDeathRecoveryMetrics;\n\n  async function failSessionAttempt(\n    input: FailSessionAttemptInput,\n  ): Promise<FailSessionAttemptResult> {\n    const { db, bus, settings, observability, wakeSessionWorkflow } = await services();\n    const session = await requireSessionFn(db, input.workspaceId, input.sessionId);\n    if (session.status === \"failed\" || session.status === \"cancelled\") {\n      // The activity may be retried after failure settlement committed but its\n      // response or event fanout was lost. Preserve terminal session truth so\n      // the workflow cannot interpret an idle peek as permission to synthesize\n      // an active-goal continuation.\n      return { action: \"terminal\" };\n    }\n    const workflowId =\n      input.workflowId ?? session.temporalWorkflowId ?? `session-${input.sessionId}`;\n    const turn = await getSessionTurnForAttemptFn(\n      db,\n      input.workspaceId,\n      input.sessionId,\n      input.attemptId,\n    );\n    if (!turn) {\n      const attempt = await getSessionAttemptActivityRefFn(db, {\n        accountId: input.accountId,\n        workspaceId: input.workspaceId,\n        sessionId: input.sessionId,\n        attemptId: input.attemptId,\n        temporalWorkflowId: workflowId,\n      });\n      if (attempt) return { action: \"stale\" };\n\n      const preClaimFailureDisposition =\n        input.preClaimFailure?.disposition ?? input.preClaimFailureDisposition;\n      if (\n        preClaimFailureDisposition === \"blocked\" &&\n        input.admissionFence &&\n        input.preClaimFailure?.reason\n      ) {\n        const blocked = await blockSessionWorkBeforeAttemptClaimFn(db, input.workspaceId, {\n          accountId: input.accountId,\n          sessionId: input.sessionId,\n          workflowId,\n          attemptId: input.attemptId,\n          fence: input.admissionFence,\n          reason: input.preClaimFailure.reason,\n          sqlState: input.preClaimFailure.sqlState ?? null,\n        });\n        await publishDurableSessionEventsFn(\n          bus,\n          input.workspaceId,\n          input.sessionId,\n          blocked.events,\n        );\n        return { action: blocked.action };\n      }\n      if (preClaimFailureDisposition === \"permanent\" && input.trigger) {\n        const failed = await failSessionWorkBeforeAttemptClaimFn(db, input.workspaceId, {\n          accountId: input.accountId,\n          sessionId: input.sessionId,\n          workflowId,\n          trigger: input.trigger,\n          error: input.error ?? \"Agent turn admission failed before attempt claim.\",\n          ...(input.preClaimFailure?.disposition === \"permanent\"\n            ? {\n                admissionFailure: {\n                  disposition: \"permanent\" as const,\n                  code: input.preClaimFailure.code,\n                },\n              }\n            : {}),\n        });\n        if (failed.action === \"terminal\") return { action: \"terminal\" };\n        if (failed.action === \"stale\") return { action: \"stale\" };\n        await publishDurableSessionEventsFn(bus, input.workspaceId, input.sessionId, failed.events);\n        if (failed.turnId) {\n          await deliverFailedChildTurnToParentFn(\n            { db, bus, settings, observability, wakeSessionWorkflow },\n            input.workspaceId,\n            input.sessionId,\n            failed.turnId,\n          );\n        }\n        return { action: \"failed\" };\n      }\n\n      const requestedRetryDelayMs = input.retryDelayMs;\n      const retryDelayMs =\n        typeof requestedRetryDelayMs === \"number\" && Number.isFinite(requestedRetryDelayMs)\n          ? Math.max(1_000, Math.min(60_000, Math.trunc(requestedRetryDelayMs)))\n          : 60_000;\n      await enqueueSessionWorkflowWakeFn(db, {\n        accountId: input.accountId,\n        workspaceId: input.workspaceId,\n        sessionId: input.sessionId,\n        temporalWorkflowId: workflowId,\n        reason: \"turn_activity_failed_before_attempt_claim\",\n        notBefore: new Date(Date.now() + retryDelayMs),\n      });\n      return { action: \"unclaimed\" };\n    }\n    const postClaimRecovery = input.postClaimDatabaseRecovery;\n    const postClaimIdentityMatches = Boolean(\n      postClaimRecovery &&\n      turn.id === postClaimRecovery.turnId &&\n      turn.triggerEventId === postClaimRecovery.triggerEventId &&\n      turn.executionGeneration === postClaimRecovery.executionGeneration,\n    );\n    // A typed checkpoint belongs to one exact turn/generation. A stale wire\n    // cannot recover or terminally fail a different current attempt.\n    if (postClaimRecovery && !postClaimIdentityMatches) {\n      return { action: \"stale\" };\n    }\n    const providerRecoveryCount = postClaimIdentityMatches\n      ? postClaimRecovery?.providerRecoveryCount\n      : undefined;\n    const providerFailureCode = postClaimIdentityMatches\n      ? postClaimRecovery?.providerFailureCode\n      : undefined;\n    const hasProviderRecoveryCount = providerRecoveryCount !== undefined;\n    const hasProviderFailureCode = providerFailureCode !== undefined;\n    const providerRecoveryContinueDelayMs = postClaimIdentityMatches\n      ? postClaimRecovery?.providerRecoveryContinueDelayMs\n      : undefined;\n    const setupOutcomeUnknown =\n      postClaimIdentityMatches && postClaimRecovery?.sandboxSetupOutcomeUnknown === true;\n    const setupRecoveryExhausted =\n      postClaimIdentityMatches && postClaimRecovery?.sandboxSetupRecoveryExhausted === true;\n    if (\n      (setupOutcomeUnknown && setupRecoveryExhausted) ||\n      ((setupOutcomeUnknown || setupRecoveryExhausted) &&\n        (hasProviderRecoveryCount || hasProviderFailureCode)) ||\n      (setupRecoveryExhausted &&\n        turn.metadata?.providerRecoveryCount !== SANDBOX_SETUP_RECOVERY_LIMIT)\n    ) {\n      return { action: \"stale\" };\n    }\n    if (hasProviderRecoveryCount !== hasProviderFailureCode) {\n      return { action: \"stale\" };\n    }\n    if (!validProviderOverloadRecoveryDelay(providerFailureCode, providerRecoveryContinueDelayMs)) {\n      return { action: \"stale\" };\n    }\n    if (\n      providerRecoveryCount !== undefined &&\n      (!Number.isSafeInteger(providerRecoveryCount) ||\n        providerRecoveryCount <= 0 ||\n        providerRecoveryCount !== providerRecoveryCountFromMetadata(turn.metadata ?? {}) + 1 ||\n        providerRecoveryCount > providerRecoveryLimit(providerFailureCode) ||\n        typeof providerFailureCode !== \"string\" ||\n        !/^[a-z][a-z0-9_]{0,63}$/.test(providerFailureCode))\n    ) {\n      return { action: \"stale\" };\n    }\n    const recoveredClaimCode = postClaimIdentityMatches\n      ? postClaimRecovery!.code\n      : input.preClaimFailure?.disposition === \"retryable\" &&\n          input.preClaimFailure.code !== \"claim_invariant\"\n        ? input.preClaimFailure.code\n        : input.preClaimFailureDisposition === \"retryable\"\n          ? \"legacy_retryable_preclaim_database_failure\"\n          : null;\n    if (recoveredClaimCode) {\n      // Known usage from the failed attempt is recorded under its original\n      // source identities before any replacement attempt can dispatch. A\n      // failure here retries this DB-only lane; nothing is re-requested.\n      const heldReceipts = postClaimIdentityMatches\n        ? (postClaimRecovery?.sessionUsageReceipts ?? [])\n        : [];\n      if (heldReceipts.length > 0) {\n        await writeSessionUsageReceipts(\n          db,\n          { accountId: input.accountId, workspaceId: input.workspaceId },\n          heldReceipts,\n        );\n      }\n      const recovery = await requestSessionTurnRecoveryFn(db, input.workspaceId, {\n        sessionId: input.sessionId,\n        turnId: turn.id,\n        triggerEventId: turn.triggerEventId,\n        attemptId: input.attemptId,\n        reason: setupOutcomeUnknown\n          ? \"sandbox_command_start_outcome_unknown\"\n          : setupRecoveryExhausted\n            ? \"sandbox_command_start_recovery_exhausted\"\n            : (providerFailureCode ?? \"claimed_attempt_database_failure\"),\n        ...(setupOutcomeUnknown ? { sandboxSetupOutcomeUnknown: true } : {}),\n        ...(setupRecoveryExhausted ? { sandboxSetupRecoveryExhausted: true } : {}),\n        ...(providerRecoveryCount !== undefined ? { providerRecoveryCount } : {}),\n        detail: {\n          code: setupOutcomeUnknown\n            ? \"sandbox_command_start_outcome_unknown\"\n            : setupRecoveryExhausted\n              ? \"sandbox_command_start_recovery_exhausted\"\n              : providerFailureCode === PROVIDER_OVERLOAD_RECOVERY_CODE\n                ? \"provider_unavailable\"\n                : (providerFailureCode ?? recoveredClaimCode),\n          retryable: !setupOutcomeUnknown && !setupRecoveryExhausted,\n          ...(setupOutcomeUnknown ? { setupOutcome: \"unknown\", replay: \"blocked\" } : {}),\n          ...(setupRecoveryExhausted\n            ? {\n                setupOutcome: \"not_started\",\n                replay: \"blocked\",\n                recoveryExhausted: true,\n                providerRecoveryCount: SANDBOX_SETUP_RECOVERY_LIMIT,\n              }\n            : {}),\n          ...(providerRecoveryCount !== undefined\n            ? {\n                databaseFailureCode: recoveredClaimCode,\n                providerRecoveryCount,\n                ...(providerFailureCode === PROVIDER_OVERLOAD_RECOVERY_CODE\n                  ? {\n                      providerCondition: \"overloaded\",\n                      maxProviderRecoveryCount: providerRecoveryLimit(providerFailureCode),\n                      continueDelayMs: providerRecoveryContinueDelayMs,\n                    }\n                  : {}),\n              }\n            : {}),\n          recoverySource: \"workflow_activity_failure\",\n        },\n        fromStatuses: [\"running\"],\n      });\n      if (recovery.action !== \"recovering\") return { action: \"stale\" };\n      await publishDurableSessionEventsFn(bus, input.workspaceId, input.sessionId, recovery.events);\n      await refreshQueuedTurnsGauge(\n        db,\n        observability,\n        countQueuedTurnsFn,\n        recordTurnsQueuedGaugeFn,\n      );\n      return {\n        action: \"recovering\",\n        ...(providerRecoveryContinueDelayMs !== undefined\n          ? { continueDelayMs: providerRecoveryContinueDelayMs }\n          : {}),\n      };\n    }\n    const trigger = await getSessionEventFn(db, input.workspaceId, turn.triggerEventId);\n    const result = await applySessionTurnSettlementFn(db, input.workspaceId, {\n      sessionId: input.sessionId,\n      turnId: turn.id,\n      triggerEventId: turn.triggerEventId,\n      attemptId: input.attemptId,\n      turnStatus: \"failed\",\n      sessionStatus: \"failed\",\n      activeTurnId: null,\n      events: [\n        {\n          type: \"turn.failed\",\n          payload: {\n            triggerEventId: turn.triggerEventId,\n            trigger: trigger?.payload ?? null,\n            error: input.error ?? \"Agent activity failed before it could report a terminal state.\",\n          },\n        },\n        { type: \"session.status.changed\", payload: { status: \"failed\" } },\n      ],\n    });\n    if (result.action === \"stale\") {\n      return { action: \"stale\" };\n    }\n    await publishDurableSessionEventsFn(bus, input.workspaceId, input.sessionId, result.events);\n    await deliverFailedChildTurnToParentFn(\n      { db, bus, settings, observability, wakeSessionWorkflow },\n      input.workspaceId,\n      input.sessionId,\n      turn.id,\n    );\n    return { action: \"failed\" };\n  }\n\n  async function settleSessionInterruptions(\n    input: SettleSessionInterruptionsInput,\n  ): Promise<{ action: \"paused\" | \"continue\" | \"stale\" }> {\n    const { db, bus, observability } = await services();\n    if (input.phase === \"attempt_quiesced\") {\n      // Replay compatibility only: v1 histories scheduled this idempotent\n      // fallback after WAIT_CANCELLATION_COMPLETED. Receipt-gated v2 workflows\n      // never call it; runAgentTurn writes immediately after its hard fence.\n      const events = await markSessionAttemptQuiescedFn(db, {\n        workspaceId: input.workspaceId,\n        sessionId: input.sessionId,\n        attemptId: input.attemptId,\n        temporalWorkflowId: input.workflowId,\n      });\n      await publishDurableSessionEventsFn(bus, input.workspaceId, input.sessionId, events);\n      return { action: \"stale\" };\n    }\n    const applied = await settleSessionAttemptInterruptionsFn(\n      db,\n      input.workspaceId,\n      input.sessionId,\n      input.attemptId,\n    );\n    if (applied.events.length > 0) {\n      await publishDurableSessionEventsFn(bus, input.workspaceId, input.sessionId, applied.events);\n    }\n    await refreshQueuedTurnsGauge(db, observability, countQueuedTurnsFn, recordTurnsQueuedGaugeFn);\n    return { action: applied.action };\n  }\n\n  /** Persist an exact activity-owned physical-quiescence proof through the\n   * workflow control-activity retry policy. The DB transaction remains the\n   * sole receipt/wake authority; duplicate signals and activity retries reuse\n   * its attempt-scoped idempotency key. */\n  async function persistSessionAttemptQuiescence(\n    input: PersistSessionAttemptQuiescenceInput,\n  ): Promise<void> {\n    const { db, bus, observability } = await services();\n    const events = await markSessionAttemptQuiescedFn(db, {\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      sessionId: input.sessionId,\n      attemptId: input.attemptId,\n      temporalWorkflowId: input.workflowId,\n      temporalWorkflowRunId: input.workflowRunId,\n      temporalActivityId: input.activityId,\n      allowUninterrupted: true,\n    });\n    try {\n      await publishDurableSessionEventsFn(bus, input.workspaceId, input.sessionId, events);\n    } catch (error) {\n      // The receipt and exact workflow wake already committed atomically in\n      // Postgres. NATS is best-effort live fanout and must not keep this\n      // control activity retrying or delay receipt-gated admission.\n      observability.error(\"session-attempt quiescence event fanout failed\", {\n        \"opengeni.session_id\": input.sessionId,\n        \"opengeni.attempt_id\": input.attemptId,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n\n  async function reconcileSessionAttemptQuiescenceActivity(\n    input: ReconcileSessionAttemptQuiescenceInput,\n  ): Promise<ReconcileSessionAttemptQuiescenceResult> {\n    const { db, bus, inspectSessionAttemptActivity } = await services();\n    const activityRef = await getSessionAttemptActivityRefFn(db, {\n      ...input,\n      temporalWorkflowId: input.workflowId,\n    });\n    if (!activityRef) return { action: \"stale\" };\n    if (!activityRef.quiesced) {\n      if (!inspectSessionAttemptActivity) return { action: \"pending\" };\n      const state = await inspectSessionAttemptActivity(activityRef);\n      if (state === \"pending\") return { action: \"pending\" };\n    }\n    const result = await reconcileSessionAttemptQuiescenceFn(db, {\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      sessionId: input.sessionId,\n      attemptId: input.attemptId,\n      temporalWorkflowId: input.workflowId,\n      temporalWorkflowRunId: activityRef.workflowRunId,\n      temporalActivityId: activityRef.activityId,\n      activitySettled: true,\n    });\n    if (result.events.length > 0) {\n      await publishDurableSessionEventsFn(\n        bus,\n        input.workspaceId,\n        input.sessionId,\n        result.events,\n      ).catch(() => undefined);\n    }\n    return { action: result.action };\n  }\n\n  /** A new authenticated inspection, never trust the earlier observer hint.\n   * The DB seam independently revalidates the entire stored/current identity,\n   * control and both writer predicates under canonical locks before closing. */\n  async function reconcileSettledSessionAttemptActivity(\n    input: ReconcileSettledSessionAttemptInput,\n  ): Promise<ReconcileSettledSessionAttemptResult> {\n    const { db, bus, inspectSessionAttemptActivity, settings, observability, wakeSessionWorkflow } =\n      await services();\n    const ref = await getSessionAttemptActivityRefFn(db, {\n      ...input,\n      temporalWorkflowId: input.workflowId,\n    });\n    if (!ref || ref.workflowRunId !== input.workflowRunId || ref.activityId !== input.activityId)\n      return { action: \"stale\" };\n    if (!inspectSessionAttemptActivity) return { action: \"pending\" };\n    try {\n      if ((await inspectSessionAttemptActivity(ref)) !== \"settled\") return { action: \"pending\" };\n    } catch (error) {\n      if (error instanceof CancelledFailure) throw error;\n      if (currentActivityContext()?.cancellationSignal.aborted)\n        throw new CancelledFailure(\"Settled-owner reconciliation cancelled\");\n      return { action: \"pending\" };\n    }\n    if (currentActivityContext()?.cancellationSignal.aborted)\n      throw new CancelledFailure(\"Settled-owner reconciliation cancelled\");\n    const result = await reconcileSettledSessionAttemptFn(db, {\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      sessionId: input.sessionId,\n      turnId: input.turnId,\n      attemptId: input.attemptId,\n      executionGeneration: input.executionGeneration,\n      temporalWorkflowId: ref.workflowId,\n      temporalWorkflowRunId: ref.workflowRunId,\n      temporalActivityId: ref.activityId,\n      activitySettled: true,\n      maxRedispatches: WORKER_DEATH_MAX_REDISPATCHES,\n    });\n    // Atomic Postgres recovery/quiescence/wake truth is already sufficient if\n    // live fanout fails. It must not be replaced by an observer-only wake.\n    if (result.events.length > 0)\n      await publishDurableSessionEventsFn(\n        bus,\n        input.workspaceId,\n        input.sessionId,\n        result.events,\n      ).catch(() => undefined);\n    if (result.action === \"exceeded\")\n      await deliverFailedChildTurnToParentFn(\n        { db, bus, settings, observability, wakeSessionWorkflow },\n        input.workspaceId,\n        input.sessionId,\n        result.turnId,\n      );\n    return { action: result.action };\n  }\n\n  /**\n   * Recover the same current inference when its worker dies without completing\n   * a graceful checkpoint (heartbeat timeout, SIGKILL, OOM, or node loss).\n   * Durable conversation truth and the original trigger stay attached to the\n   * same turn; recovery creates a new fenced attempt, never a prompt-queue row\n   * or a synthetic resume message. Repeated worker deaths are bounded per turn.\n   */\n  async function recoverDispatch(input: RecoverDispatchInput): Promise<RecoverDispatchResult> {\n    const { settings, db, bus, observability, wakeSessionWorkflow } = await services();\n    const result = await recoverSessionDispatchFn(db, input.workspaceId, {\n      sessionId: input.sessionId,\n      attemptId: input.attemptId,\n      timeoutType: input.timeoutType,\n      maxRedispatches: WORKER_DEATH_MAX_REDISPATCHES,\n    });\n    if (result.action === \"stale\" || result.action === \"unclaimed\") {\n      return { action: result.action };\n    }\n    recordWorkerDeathRecoveryMetricsFn(observability, {\n      outcome: result.action === \"exceeded\" ? \"exhausted\" : \"recovering\",\n      timeoutType: input.timeoutType,\n    });\n    await publishDurableSessionEventsFn(bus, input.workspaceId, input.sessionId, result.events);\n    await refreshQueuedTurnsGauge(db, observability, countQueuedTurnsFn, recordTurnsQueuedGaugeFn);\n    if (result.action === \"exceeded\") {\n      await deliverFailedChildTurnToParentFn(\n        { db, bus, settings, observability, wakeSessionWorkflow },\n        input.workspaceId,\n        input.sessionId,\n        result.turnId,\n      );\n      return {\n        action: \"exceeded\",\n        turnId: result.turnId,\n        redispatches: result.redispatches,\n      };\n    }\n    return {\n      action: \"recovering\",\n      turnId: result.turnId,\n      redispatches: result.redispatches,\n    };\n  }\n\n  /**\n   * Finish a retryable MCP timeout checkpoint that escaped a recovered turn's\n   * activity before any model request. Temporal carries the immutable turn\n   * identity in ApplicationFailure details; this activity re-reads and fences\n   * every field before mutating the exact still-owned attempt. A checkpoint\n   * that committed before event fanout failed is already recovering and\n   * therefore returns stale without another event or child callback.\n   */\n  async function recoverEscapedMcpTimeout(\n    input: RecoverEscapedMcpTimeoutInput,\n  ): Promise<RecoverEscapedMcpTimeoutResult> {\n    const { db, bus, observability } = await services();\n    const turn = await getSessionTurnForAttemptFn(\n      db,\n      input.workspaceId,\n      input.sessionId,\n      input.attemptId,\n    );\n    if (!turn) return { action: \"stale\" };\n    if (\n      turn.id !== input.turnId ||\n      turn.triggerEventId !== input.triggerEventId ||\n      turn.executionGeneration !== input.executionGeneration ||\n      input.executionGeneration <= 1 ||\n      input.providerRecoveryCount !== providerRecoveryCountFromMetadata(turn.metadata) + 1 ||\n      input.providerRecoveryCount > MAX_AUTOMATIC_PROVIDER_RECOVERIES\n    ) {\n      return { action: \"ineligible\" };\n    }\n    const recovery = await requestSessionTurnRecoveryFn(db, input.workspaceId, {\n      sessionId: input.sessionId,\n      turnId: input.turnId,\n      triggerEventId: input.triggerEventId,\n      attemptId: input.attemptId,\n      reason: \"mcp_transport_timeout\",\n      providerRecoveryCount: input.providerRecoveryCount,\n      detail: {\n        code: \"mcp_transport_timeout\",\n        retryable: true,\n        continueDelayMs: input.continueDelayMs,\n        providerRecoveryCount: input.providerRecoveryCount,\n        recoverySource: \"workflow_activity_failure\",\n      },\n      fromStatuses: [\"running\"],\n    });\n    if (recovery.action !== \"recovering\") {\n      return { action: \"stale\" };\n    }\n    await publishDurableSessionEventsFn(bus, input.workspaceId, input.sessionId, recovery.events);\n    await refreshQueuedTurnsGauge(db, observability, countQueuedTurnsFn, recordTurnsQueuedGaugeFn);\n    return { action: \"recovering\" };\n  }\n\n  async function peekSessionWork(input: PeekSessionWorkInput) {\n    const { db, bus, observability, inspectSessionAttemptActivity } = await services();\n    // Already scheduled activities retain their old input across workflow upgrades.\n    // Resolve its workspace scope exactly as the legacy DB path did, then use the\n    // observer path so absent rows and a still-owned attempt are observations.\n    const observerAccountId =\n      input.observerAccountId ?? (await getWorkspaceFn(db, input.workspaceId))?.accountId;\n    if (!observerAccountId) return { kind: \"unavailable\" as const };\n    let peek = await peekSessionWorkFn(\n      db,\n      input.workspaceId,\n      input.sessionId,\n      input.includeAdmissionFence,\n      observerAccountId,\n    );\n    if (peek.kind === \"unavailable\") return peek;\n    if (peek.kind === \"admission-blocked\" && peek.reason === \"sandbox_setup_outcome_unknown\") {\n      const ref = peek.ref;\n      if (ref && \"turnId\" in ref && \"attemptId\" in ref) {\n        const settled = await reconcileCompletedSandboxSetupFn(db, {\n          accountId: observerAccountId,\n          workspaceId: input.workspaceId,\n          sessionId: input.sessionId,\n          turnId: ref.turnId,\n          attemptId: ref.attemptId,\n        });\n        if (settled.events.length > 0)\n          await publishDurableSessionEventsFn(\n            bus,\n            input.workspaceId,\n            input.sessionId,\n            settled.events,\n          );\n        if (settled.reconciled)\n          peek = await peekSessionWorkFn(\n            db,\n            input.workspaceId,\n            input.sessionId,\n            input.includeAdmissionFence,\n            observerAccountId,\n          );\n      }\n    }\n    if (peek.kind === \"attempt-owned\") {\n      // Observation never revokes a writer or recovers a live owner. In\n      // particular, a settled Temporal activity is not physical-writer proof.\n      let ownerActivityState: \"pending\" | \"settled\" | \"unknown\" = \"unknown\";\n      if (inspectSessionAttemptActivity) {\n        try {\n          ownerActivityState = await inspectSessionAttemptActivity(peek.activityRef);\n        } catch (error) {\n          if (error instanceof CancelledFailure) throw error;\n          if (currentActivityContext()?.cancellationSignal.aborted)\n            throw new CancelledFailure(\"Control observation cancelled\");\n          // This optional metadata observation grants no recovery authority.\n          // An unavailable inspector must not pin the control activity in\n          // retries and prevent a fresh Pause/owner/visibility observation.\n          // Database reads below remain outside this catch and retry normally.\n        }\n      }\n      if (currentActivityContext()?.cancellationSignal.aborted)\n        throw new CancelledFailure(\"Control observation cancelled\");\n      const current = await peekSessionWorkFn(\n        db,\n        input.workspaceId,\n        input.sessionId,\n        input.includeAdmissionFence,\n        observerAccountId,\n      );\n      if (\n        current.kind !== \"attempt-owned\" ||\n        current.turnId !== peek.turnId ||\n        current.attemptId !== peek.attemptId ||\n        current.executionGeneration !== peek.executionGeneration ||\n        current.activityRef.workflowId !== peek.activityRef.workflowId ||\n        current.activityRef.workflowRunId !== peek.activityRef.workflowRunId ||\n        current.activityRef.activityId !== peek.activityRef.activityId\n      )\n        return current;\n      return { ...current, ownerActivityState };\n    }\n    await refreshQueuedTurnsGauge(db, observability, countQueuedTurnsFn, recordTurnsQueuedGaugeFn);\n    return peek;\n  }\n\n  async function settleSessionInputWait(\n    input: SettleSessionInputWaitInput,\n  ): Promise<SettleSessionInputWaitResult> {\n    const { db, bus } = await services();\n    const result = await settleSessionInputWaitFn(db, input);\n    if (result.events.length > 0) {\n      await publishDurableSessionEventsFn(bus, input.workspaceId, input.sessionId, result.events);\n    }\n    return { action: result.action };\n  }\n\n  async function expireSessionHumanInput(\n    input: ExpireSessionHumanInputInput,\n  ): Promise<ExpireSessionHumanInputResult> {\n    const { db, bus } = await services();\n    const result = await expireSessionHumanInputRequestFn(db, input);\n    if (result.action === \"not_found\") return { action: \"not_found\" };\n    if (result.events.length > 0) {\n      await publishDurableSessionEventsFn(bus, input.workspaceId, input.sessionId, result.events);\n    }\n    return {\n      action: result.request.status === \"expired\" ? \"expired\" : \"stale\",\n    };\n  }\n\n  async function expireSessionInteractionIntervention(\n    input: ExpireSessionInteractionInterventionInput,\n  ): Promise<ExpireSessionInteractionInterventionResult> {\n    const { db, bus, observability } = await services();\n    const result = await expireSessionInteractionInterventionFn(db, input);\n    if (result.action === \"expired\" && result.intervention) {\n      // The unanswered-handoff timer settles here, never through the API.\n      interactionInterventionMetricObserver(observability)({\n        kind: result.intervention.kind,\n        outcome: \"expired\",\n        waitMs: Date.now() - result.intervention.createdAt.getTime(),\n      });\n    }\n    if (result.events.length > 0) {\n      await publishDurableSessionEventsFn(bus, input.workspaceId, input.sessionId, result.events);\n    }\n    return { action: result.action };\n  }\n\n  /** A scheduled run's approval timeout answers for its unanswered human wait. */\n  async function expireScheduledRunHumanWait(\n    input: ExpireScheduledRunHumanWaitInput,\n  ): Promise<ExpireScheduledRunHumanWaitResult> {\n    const { db, bus } = await services();\n    const result = await expireScheduledRunHumanWaitFn(db, input);\n    if (result.events.length > 0) {\n      await publishDurableSessionEventsFn(bus, input.workspaceId, input.sessionId, result.events);\n    }\n    return { action: result.action };\n  }\n\n  async function markSessionIdle(input: MarkSessionIdleInput): Promise<void> {\n    const { db, bus, settings, observability, wakeSessionWorkflow } = await services();\n    const settled = await settleSessionIdleWithParentOutboxFn(\n      db,\n      input.workspaceId,\n      input.sessionId,\n    );\n    if (settled.events.length > 0) {\n      await publishDurableSessionEventsFn(bus, input.workspaceId, input.sessionId, settled.events);\n    }\n    await refreshQueuedTurnsGauge(db, observability, countQueuedTurnsFn, recordTurnsQueuedGaugeFn);\n    if (settled.action === \"stale\" || !settled.notifyParent) {\n      return;\n    }\n    // The idle transaction distinguishes parked wait/goal obligations from\n    // completed work. Only a terminal idle boundary may notify the parent;\n    // workflow closure while waiting retains its durable wake without a result.\n    await notifyParentOfChildIdleFn(\n      { db, bus, settings, observability, wakeSessionWorkflow },\n      input.workspaceId,\n      input.sessionId,\n      settled.episodeKey,\n    );\n  }\n\n  return {\n    failSessionAttempt,\n    settleSessionInterruptions,\n    persistSessionAttemptQuiescence,\n    reconcileSessionAttemptQuiescence: reconcileSessionAttemptQuiescenceActivity,\n    reconcileSettledSessionAttempt: reconcileSettledSessionAttemptActivity,\n    recoverDispatch,\n    recoverEscapedMcpTimeout,\n    peekSessionWork,\n    settleSessionInputWait,\n    expireSessionHumanInput,\n    expireSessionInteractionIntervention,\n    expireScheduledRunHumanWait,\n    markSessionIdle,\n  };\n}\n\nasync function refreshQueuedTurnsGauge(\n  db: ControlActivityServices[\"db\"],\n  observability: ControlActivityServices[\"observability\"],\n  countQueuedTurnsFn: typeof countQueuedTurns,\n  recordTurnsQueuedGaugeFn: typeof recordTurnsQueuedGauge,\n): Promise<void> {\n  try {\n    recordTurnsQueuedGaugeFn(observability, await countQueuedTurnsFn(db));\n  } catch {\n    // Best-effort telemetry; session state transitions remain authoritative.\n  }\n}\n","import { createHash, randomUUID } from \"node:crypto\";\nimport { once } from \"node:events\";\nimport { createReadStream, createWriteStream } from \"node:fs\";\nimport { mkdtemp, rm } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { Transform } from \"node:stream\";\nimport { pipeline } from \"node:stream/promises\";\nimport { constants as zlibConstants, createZstdCompress } from \"node:zlib\";\nimport {\n  SESSION_ARCHIVE_EXPORT_TABLES,\n  SESSION_ARCHIVE_FORMAT,\n  SESSION_ARCHIVE_FORMAT_VERSION,\n  SESSION_ARCHIVE_TRANSCRIPT_FORMAT,\n  abandonSessionArchive,\n  beginSessionArchive,\n  claimSessionArchiveObjectDeletions,\n  completeSessionArchive,\n  completeSessionArchiveObjectDeletion,\n  listSessionArchiveCandidates,\n  listUnfinishedSessionArchives,\n  purgeArchivedSessionContent,\n  readSessionArchiveRows,\n  readSessionArchiveSessionRow,\n  readSessionArchiveTranscriptEvents,\n  type Database,\n  type SessionArchiveManifest,\n  type SessionArchiveScope,\n} from \"@opengeni/db\";\nimport {\n  uploadWorkspaceArchiveSpool,\n  WorkspaceArchiveStorageError,\n  type ObjectStorage,\n} from \"@opengeni/storage\";\nimport type { ControlActivityServices } from \"./types\";\n\n/**\n * Content-free public classification of a failed session archive. Telemetry\n * only exports reviewed error classes and codes, so a raw error name or\n * storage code would be reduced to a generic \"OperationError\".\n */\nexport function sessionArchiveFailureCode(error: unknown): string {\n  if (error instanceof WorkspaceArchiveStorageError) {\n    switch (error.code) {\n      case \"archive_object_missing\":\n        return \"session_archive_object_missing\";\n      case \"archive_hash_mismatch\":\n        return \"session_archive_hash_mismatch\";\n      default:\n        return \"session_archive_storage_failed\";\n    }\n  }\n  return \"session_archive_failed\";\n}\n\nexport const SESSION_ARCHIVE_CANDIDATES_PER_PASS = 25;\n/**\n * Soft budget for one archive pass. It shares a workflow (and the Schedule's\n * skip-overlap cadence) with content compaction and delta folding, so a long\n * archive pass would starve them while a backlog drains. Matching the storage\n * pass budget gives both an equal share; unfinished work resumes next pass.\n */\nexport const SESSION_ARCHIVE_TIME_BUDGET_MS = 10 * 60 * 1_000;\nexport const SESSION_ARCHIVE_STALE_SECONDS = 2 * 60 * 60;\nexport const SESSION_ARCHIVE_EXPORT_PAGE_ROWS = 200;\nexport const SESSION_ARCHIVE_PURGE_BATCH_ROWS = 2_000;\n\ntype Spool = {\n  path: string;\n  byteSize: number;\n  sha256: string;\n  open: () => AsyncIterable<Uint8Array>;\n  dispose: () => Promise<void>;\n};\n\n/** Stream JSON lines through zstd into a private file, metering the compressed bytes. */\nexport async function writeCompressedJsonLines(\n  path: string,\n  produce: (write: (line: string) => Promise<void>) => Promise<void>,\n): Promise<Spool> {\n  const zstd = createZstdCompress({ params: { [zlibConstants.ZSTD_c_compressionLevel]: 9 } });\n  const hash = createHash(\"sha256\");\n  let byteSize = 0;\n  const meter = new Transform({\n    transform(chunk: Buffer, _encoding, callback) {\n      hash.update(chunk);\n      byteSize += chunk.length;\n      callback(null, chunk);\n    },\n  });\n  const piping = pipeline(zstd, meter, createWriteStream(path, { flags: \"wx\", mode: 0o600 }));\n  const write = async (line: string) => {\n    if (!zstd.write(`${line}\\n`)) await once(zstd, \"drain\");\n  };\n  try {\n    await produce(write);\n    zstd.end();\n    await piping;\n  } catch (error) {\n    zstd.destroy(error instanceof Error ? error : new Error(String(error)));\n    await piping.catch(() => undefined);\n    await rm(path, { force: true });\n    throw error;\n  }\n  return {\n    path,\n    byteSize,\n    sha256: hash.digest(\"hex\"),\n    open: () => createReadStream(path),\n    dispose: async () => rm(path, { force: true }),\n  };\n}\n\nexport function sessionArchiveObjectKeys(scope: SessionArchiveScope, archiveId: string) {\n  const prefix = `session-archives/${scope.workspaceId}/${scope.sessionId}/${archiveId}`;\n  return {\n    bundle: `${prefix}/bundle.jsonl.zst`,\n    transcript: `${prefix}/transcript.jsonl.zst`,\n  };\n}\n\n/** Write the full-fidelity bundle: header, every exported row as exact JSON, footer. */\nasync function writeBundle(db: Database, scope: SessionArchiveScope, path: string) {\n  const rowCounts: Record<string, number> = {};\n  const sessionRow = await readSessionArchiveSessionRow(db, scope);\n  const spool = await writeCompressedJsonLines(path, async (write) => {\n    await write(\n      `{\"format\":${JSON.stringify(SESSION_ARCHIVE_FORMAT)},\"version\":${SESSION_ARCHIVE_FORMAT_VERSION},` +\n        `\"createdAt\":${JSON.stringify(new Date().toISOString())},` +\n        `\"tables\":${JSON.stringify(SESSION_ARCHIVE_EXPORT_TABLES.map((spec) => spec.table))},` +\n        `\"session\":${sessionRow}}`,\n    );\n    for (const spec of SESSION_ARCHIVE_EXPORT_TABLES) {\n      let after: string[] | null = null;\n      let count = 0;\n      for (;;) {\n        const page = await readSessionArchiveRows(db, scope, spec, {\n          after,\n          limit: SESSION_ARCHIVE_EXPORT_PAGE_ROWS,\n        });\n        for (const row of page.rows) {\n          await write(`{\"table\":${JSON.stringify(spec.table)},\"row\":${row}}`);\n        }\n        count += page.rows.length;\n        if (page.rows.length < SESSION_ARCHIVE_EXPORT_PAGE_ROWS) break;\n        after = page.last;\n      }\n      rowCounts[spec.table] = count;\n    }\n    await write(`{\"end\":true,\"rowCounts\":${JSON.stringify(rowCounts)}}`);\n  });\n  return { spool, rowCounts };\n}\n\n/** Write the readable transcript: public SessionEvent objects, one per line. */\nasync function writeTranscript(db: Database, scope: SessionArchiveScope, path: string) {\n  let events = 0;\n  const spool = await writeCompressedJsonLines(path, async (write) => {\n    await write(\n      JSON.stringify({\n        format: SESSION_ARCHIVE_TRANSCRIPT_FORMAT,\n        version: SESSION_ARCHIVE_FORMAT_VERSION,\n        workspaceId: scope.workspaceId,\n        sessionId: scope.sessionId,\n      }),\n    );\n    let afterSequence = 0;\n    for (;;) {\n      const page = await readSessionArchiveTranscriptEvents(db, scope, {\n        afterSequence,\n        limit: 500,\n      });\n      for (const event of page) await write(JSON.stringify({ event }));\n      events += page.length;\n      if (page.length < 500) break;\n      afterSequence = page.at(-1)!.sequence;\n    }\n    await write(JSON.stringify({ end: true, events }));\n  });\n  return { spool, events };\n}\n\nexport type ArchiveSessionOutcome = \"archived\" | \"skipped\" | \"failed\";\n\nexport type SessionArchiveActivityOptions = {\n  candidatesPerPass?: number;\n  timeBudgetMs?: number;\n  now?: () => number;\n  upload?: (storage: ObjectStorage, key: string, spool: Spool) => Promise<void>;\n};\n\nexport type ArchiveIdleSessionsResult = {\n  enabled: boolean;\n  archived: number;\n  skipped: number;\n  failed: number;\n  abandoned: number;\n  purgedRows: number;\n  objectsDeleted: number;\n};\n\n/**\n * The idle-session archiver. Off unless the deployment enables it; recovery of\n * unfinished archives and deletion of removed sessions' objects always run so\n * that disabling the feature never strands work.\n */\nexport function createSessionArchiveActivities(\n  services: () => Promise<ControlActivityServices>,\n  options: SessionArchiveActivityOptions = {},\n) {\n  const candidatesPerPass = options.candidatesPerPass ?? SESSION_ARCHIVE_CANDIDATES_PER_PASS;\n  const timeBudgetMs = options.timeBudgetMs ?? SESSION_ARCHIVE_TIME_BUDGET_MS;\n  const now = options.now ?? Date.now;\n  const upload = options.upload ?? uploadWorkspaceArchiveSpool;\n\n  async function archiveOne(\n    db: Database,\n    storage: ObjectStorage,\n    scope: SessionArchiveScope,\n    idleSeconds: number,\n  ): Promise<ArchiveSessionOutcome> {\n    const keys = sessionArchiveObjectKeys(scope, randomUUID());\n    const begun = await beginSessionArchive(db, scope, {\n      idleSeconds,\n      objectKeys: [keys.bundle, keys.transcript],\n    });\n    if (!begun) return \"skipped\";\n    const directory = await mkdtemp(join(tmpdir(), \"opengeni-session-archive-\"));\n    try {\n      const bundle = await writeBundle(db, scope, join(directory, \"bundle.jsonl.zst\"));\n      const transcript = await writeTranscript(db, scope, join(directory, \"transcript.jsonl.zst\"));\n      await upload(storage, keys.bundle, bundle.spool);\n      await upload(storage, keys.transcript, transcript.spool);\n      const manifest: SessionArchiveManifest = {\n        format: SESSION_ARCHIVE_FORMAT,\n        version: SESSION_ARCHIVE_FORMAT_VERSION,\n        objectKeys: [keys.bundle, keys.transcript],\n        bundle: { key: keys.bundle, bytes: bundle.spool.byteSize, sha256: bundle.spool.sha256 },\n        transcript: {\n          key: keys.transcript,\n          bytes: transcript.spool.byteSize,\n          sha256: transcript.spool.sha256,\n          events: transcript.events,\n        },\n        sha256: bundle.spool.sha256,\n        rowCounts: bundle.rowCounts,\n        createdAt: new Date(now()).toISOString(),\n      };\n      if (!(await completeSessionArchive(db, scope, manifest))) {\n        throw new Error(\"session archive state changed before completion\");\n      }\n      return \"archived\";\n    } catch (error) {\n      await abandonSessionArchive(db, scope).catch(() => undefined);\n      throw error;\n    } finally {\n      await rm(directory, { recursive: true, force: true });\n    }\n  }\n\n  async function purgeUntilDone(\n    db: Database,\n    scope: SessionArchiveScope,\n    deadline: number,\n  ): Promise<number> {\n    let purged = 0;\n    while (now() < deadline) {\n      const step = await purgeArchivedSessionContent(db, scope, {\n        batchSize: SESSION_ARCHIVE_PURGE_BATCH_ROWS,\n      });\n      purged += step.deleted;\n      if (step.complete) break;\n    }\n    return purged;\n  }\n\n  async function archiveIdleSessions(): Promise<ArchiveIdleSessionsResult> {\n    const { db, objectStorage, observability, settings } = await services();\n    const deadline = now() + timeBudgetMs;\n    const result: ArchiveIdleSessionsResult = {\n      enabled: settings.sessionArchiveEnabled,\n      archived: 0,\n      skipped: 0,\n      failed: 0,\n      abandoned: 0,\n      purgedRows: 0,\n      objectsDeleted: 0,\n    };\n    if (objectStorage) {\n      for (const deletion of await claimSessionArchiveObjectDeletions(db, {\n        claimTimeoutSeconds: 600,\n        limit: 200,\n      })) {\n        try {\n          await objectStorage.deleteObject(deletion.objectKey);\n          if (await completeSessionArchiveObjectDeletion(db, deletion.objectKey)) {\n            result.objectsDeleted += 1;\n          }\n        } catch (error) {\n          observability.warn(\"session archive object deletion failed; it will be retried\", {\n            workspaceId: deletion.workspaceId,\n            sessionId: deletion.sessionId,\n            errorName: error instanceof Error ? error.name : \"unknown\",\n          });\n        }\n      }\n    }\n\n    for (const unfinished of await listUnfinishedSessionArchives(db, {\n      staleSeconds: SESSION_ARCHIVE_STALE_SECONDS,\n      limit: 25,\n    })) {\n      if (now() >= deadline) break;\n      // One session's failure must not stop the pass: it is retried next pass,\n      // and new archives still proceed.\n      try {\n        if (unfinished.state === \"archiving\") {\n          if (await abandonSessionArchive(db, unfinished)) result.abandoned += 1;\n        } else {\n          result.purgedRows += await purgeUntilDone(db, unfinished, deadline);\n        }\n      } catch (error) {\n        result.failed += 1;\n        observability.warn(\"session archive recovery failed; it will be retried\", {\n          workspaceId: unfinished.workspaceId,\n          sessionId: unfinished.sessionId,\n          errorClass: \"SessionArchiveOperationError\",\n          errorCode: sessionArchiveFailureCode(error),\n        });\n      }\n    }\n\n    if (!settings.sessionArchiveEnabled) return result;\n    if (!objectStorage) {\n      observability.warn(\"session archive is enabled but object storage is not configured\");\n      return result;\n    }\n    const idleSeconds = settings.sessionArchiveIdleDays * 24 * 60 * 60;\n    // Keep taking batches until the budget ends or nothing new qualifies, so a\n    // large backlog (for example right after enabling) drains steadily. A\n    // session that failed or was skipped is not retried in the same pass.\n    const attempted = new Set<string>();\n    for (;;) {\n      if (now() >= deadline) break;\n      const candidates = (\n        await listSessionArchiveCandidates(db, {\n          idleSeconds,\n          limit: candidatesPerPass + attempted.size,\n        })\n      ).filter((candidate) => !attempted.has(candidate.sessionId));\n      if (candidates.length === 0) break;\n      for (const scope of candidates.slice(0, candidatesPerPass)) {\n        if (now() >= deadline) break;\n        attempted.add(scope.sessionId);\n        try {\n          const outcome = await archiveOne(db, objectStorage, scope, idleSeconds);\n          if (outcome === \"skipped\") {\n            result.skipped += 1;\n            continue;\n          }\n          result.archived += 1;\n          result.purgedRows += await purgeUntilDone(db, scope, deadline);\n        } catch (error) {\n          result.failed += 1;\n          observability.warn(\"session archive failed; the session stays live\", {\n            workspaceId: scope.workspaceId,\n            sessionId: scope.sessionId,\n            // Content-free classification only: database errors can echo row values.\n            errorClass: \"SessionArchiveOperationError\",\n            errorCode: sessionArchiveFailureCode(error),\n          });\n        }\n      }\n    }\n    if (result.archived + result.failed + result.abandoned + result.objectsDeleted > 0) {\n      observability.info(\"session archive pass finished\", { ...result });\n    }\n    return result;\n  }\n\n  return { archiveIdleSessions };\n}\n","import { compactLegacySessionContent } from \"@opengeni/db\";\nimport type { ControlActivityServices } from \"./types\";\n\n/** Rows per content kind rewritten by one compaction batch. */\nexport const SESSION_CONTENT_COMPACTION_ROWS_PER_PASS = 200;\n/** Soft budget for one pass; the workflow's activity timeout is 15 minutes. */\nexport const SESSION_STORAGE_PASS_BUDGET_MS = 10 * 60 * 1_000;\n\nexport type MaintainSessionStorageResult = {\n  contentCompaction: { scanned: number; compacted: number; skipped: number; failed: number };\n};\n\nexport type SessionStorageActivityOptions = {\n  compactionRowsPerPass?: number;\n  compactLegacyContent?: typeof compactLegacySessionContent;\n  timeBudgetMs?: number;\n  now?: () => number;\n};\n\n/**\n * Deployment-wide session storage maintenance: legacy content compaction. It is\n * lossless (the database proves every rewrite) and therefore always on, and it\n * keeps working through its backlog while it makes progress and the pass has\n * budget left. Streamed text deltas need no pass: the turn writer stores each\n * flush's adjacent fragments as one row.\n */\nexport function createSessionStorageActivities(\n  services: () => Promise<ControlActivityServices>,\n  options: SessionStorageActivityOptions = {},\n) {\n  const rowsPerPass = options.compactionRowsPerPass ?? SESSION_CONTENT_COMPACTION_ROWS_PER_PASS;\n  const compactLegacyContent = options.compactLegacyContent ?? compactLegacySessionContent;\n  const timeBudgetMs = options.timeBudgetMs ?? SESSION_STORAGE_PASS_BUDGET_MS;\n  const now = options.now ?? Date.now;\n\n  async function maintainSessionStorage(): Promise<MaintainSessionStorageResult> {\n    const { db, observability } = await services();\n    const deadline = now() + timeBudgetMs;\n    const contentCompaction = { scanned: 0, compacted: 0, skipped: 0, failed: 0 };\n    do {\n      const batch = await compactLegacyContent(db, {\n        maxRows: rowsPerPass,\n        onRowError: (candidate, error) =>\n          observability.warn(\"session content compaction failed; row stays in legacy form\", {\n            kind: candidate.kind,\n            workspaceId: candidate.workspaceId,\n            sessionId: candidate.sessionId,\n            attemptId: candidate.attemptId,\n            errorName: error instanceof Error ? error.name : \"unknown\",\n          }),\n      });\n      contentCompaction.scanned += batch.scanned;\n      contentCompaction.compacted += batch.compacted;\n      contentCompaction.skipped += batch.skipped;\n      contentCompaction.failed += batch.failed;\n      // Rows that stay legacy are rescanned first; stop once a batch gains nothing.\n      if (batch.compacted === 0) break;\n    } while (now() < deadline);\n    if (contentCompaction.compacted > 0 || contentCompaction.failed > 0) {\n      observability.info(\"session content compaction pass finished\", contentCompaction);\n    }\n\n    return { contentCompaction };\n  }\n\n  return { maintainSessionStorage };\n}\n","import {\n  fireWorkspacePauseTimerInTransaction,\n  listDueWorkspacePauseTimers,\n  withWorkspaceRls,\n  getWorkspaceControlEvent,\n  type Database,\n} from \"@opengeni/db\";\nimport { publishDurableWorkspaceControlEvent } from \"@opengeni/events\";\nimport { recordWorkflowWakeReconciliation } from \"@opengeni/observability\";\nimport type { ControlActivityServices } from \"./types\";\nimport {\n  reconcileAutomaticSessionTitleFanout,\n  reconcilePendingSessionWorkflowWakes,\n  type WorkflowWakeReconciliationResult,\n} from \"./parent-wake\";\n\nconst BATCH_SIZE = 1_000;\nconst MAX_DELIVERIES_PER_ACTIVITY = 10_000;\nconst MAX_TITLE_FANOUT_PER_ACTIVITY = 1_000;\n\nexport type DispatchSessionWorkflowWakesResult = WorkflowWakeReconciliationResult & {\n  exhaustedBatchLimit: boolean;\n};\n\n/**\n * Drain committed session-workflow wake revisions through the same signal and\n * acknowledgement path used by immediate delivery. This is a repair path, not\n * an eligibility scan: producers have already decided what must be delivered.\n */\nexport function createWorkflowWakeActivities(services: () => Promise<ControlActivityServices>) {\n  return {\n    async dispatchSessionWorkflowWakes(): Promise<DispatchSessionWorkflowWakesResult> {\n      const service = await services();\n      // Timer commits produce ordinary durable wakes; drain those below in the same sweep.\n      const timers = await listDueWorkspacePauseTimers(service.db, 100);\n      for (const timer of timers) {\n        try {\n          const result = await withWorkspaceRls(service.db, timer.workspace_id, (scoped) =>\n            scoped.transaction((tx) =>\n              fireWorkspacePauseTimerInTransaction(tx as unknown as Database, {\n                workspaceId: timer.workspace_id,\n                timerId: timer.timer_id,\n              }),\n            ),\n          );\n          if (result?.workspaceControlEventId) {\n            const event = await getWorkspaceControlEvent(\n              service.db,\n              timer.workspace_id,\n              result.workspaceControlEventId,\n            );\n            if (event)\n              await publishDurableWorkspaceControlEvent(service.bus, timer.workspace_id, event);\n          }\n        } catch (error) {\n          service.observability.warn(\"Workspace pause timer will retry\", {\n            workspaceId: timer.workspace_id,\n            error: String(error),\n          });\n        }\n      }\n      let claimed = 0;\n      let signaled = 0;\n      let pendingAdmission = 0;\n      let unconfirmed = 0;\n      const pendingAdmissionBlockers: WorkflowWakeReconciliationResult[\"pendingAdmissionBlockers\"] =\n        {};\n      let delivered = 0;\n      let failed = 0;\n      let exhaustedBatchLimit = false;\n      for (;;) {\n        const remaining = MAX_DELIVERIES_PER_ACTIVITY - claimed;\n        if (remaining <= 0) {\n          exhaustedBatchLimit = true;\n          break;\n        }\n        const limit = Math.min(BATCH_SIZE, remaining);\n        const batch = await reconcilePendingSessionWorkflowWakes(service, limit);\n        claimed += batch.claimed;\n        signaled += batch.signaled;\n        delivered += batch.delivered;\n        pendingAdmission += batch.pendingAdmission;\n        unconfirmed += batch.unconfirmed;\n        for (const [blocker, count] of Object.entries(batch.pendingAdmissionBlockers)) {\n          const key = blocker as keyof typeof pendingAdmissionBlockers;\n          pendingAdmissionBlockers[key] = (pendingAdmissionBlockers[key] ?? 0) + count;\n        }\n        failed += batch.failed;\n        if (batch.claimed < limit) break;\n      }\n\n      // Migration fanout is lower priority than ordinary workflow wakes and is\n      // independently capped. Delivery acknowledgements run with bounded\n      // concurrency in the reconciler, so a broker timeout cannot occupy the\n      // five-minute activity budget once per quarantined session. Managed NATS\n      // uses its bounded confirmed publish; embedding buses use their required\n      // publish promise.\n      const titleFanout = await reconcileAutomaticSessionTitleFanout(\n        service,\n        MAX_TITLE_FANOUT_PER_ACTIVITY,\n      );\n      if (titleFanout.claimed > 0) {\n        service.observability.info(\"automatic-title migration event fanout reconciled\", {\n          claimed: titleFanout.claimed,\n          delivered: titleFanout.delivered,\n          failed: titleFanout.failed,\n        });\n      }\n      const result = {\n        claimed,\n        signaled,\n        delivered,\n        pendingAdmission,\n        unconfirmed,\n        failed,\n        pendingAdmissionBlockers,\n        exhaustedBatchLimit,\n      };\n      recordWorkflowWakeReconciliation(service.observability, result);\n      return result;\n    },\n  };\n}\n","import { createKnowledgeIndexingActivities } from \"./activities/knowledge-indexing\";\nimport { createSharedActivityServices } from \"./activity-services\";\nimport { createCodexCapacityActivities } from \"./activities/codex-capacity\";\nimport { createBrowserStateArtifactMaintenanceActivities } from \"./activities/browser-state-artifact-reaper\";\nimport { createBrowserDeadlineCheckpointActivities } from \"./activities/browser-deadline-checkpoint\";\nimport { createAutomationActivities } from \"./activities/automations\";\nimport { createDocumentActivities } from \"./activities/documents\";\nimport { createFileUploadReaperActivities } from \"./activities/file-upload-reaper\";\nimport { createGoalActivities } from \"./activities/goals\";\nimport { createModelCallFactReconcilerActivities } from \"./activities/model-call-fact-reconciler\";\nimport { createKnowledgeSourceSyncActivities } from \"./activities/knowledge-source-sync\";\nimport { createRetainedScreenshotMaintenanceActivities } from \"./activities/retained-screenshot-reaper\";\nimport { createRigVerificationActivities } from \"./activities/rig-verification\";\nimport { createSandboxLeaseActivities } from \"./activities/sandbox-lease\";\nimport { createScheduledTaskActivities } from \"./activities/scheduled-tasks\";\nimport { createSiteAuthMaintenanceActivities } from \"./activities/site-auth-maintenance\";\nimport { createSessionStateActivities } from \"./activities/session-state\";\nimport { createSessionArchiveActivities } from \"./activities/session-archive\";\nimport { createSessionStorageActivities } from \"./activities/session-storage\";\nimport type { ActivityDependencies, ControlActivityServices } from \"./activities/types\";\nimport { createWorkflowWakeActivities } from \"./activities/workflow-wake\";\n\nfunction createControlActivityServices(\n  dependencies: ActivityDependencies,\n): () => Promise<ControlActivityServices> {\n  const shared = createSharedActivityServices(dependencies);\n  return shared;\n}\n\nexport function createControlActivitiesFromServices(\n  services: () => Promise<ControlActivityServices>,\n  resolveDocumentServices?: () => Promise<import(\"@opengeni/documents\").DocumentServices>,\n) {\n  return {\n    ...createAutomationActivities(services),\n    ...createDocumentActivities(services, resolveDocumentServices),\n    ...createKnowledgeIndexingActivities(services, resolveDocumentServices),\n    ...createKnowledgeSourceSyncActivities(services, resolveDocumentServices),\n    ...createSessionStateActivities(services),\n    ...createSessionStorageActivities(services),\n    ...createSessionArchiveActivities(services),\n    ...createScheduledTaskActivities(services),\n    ...createSiteAuthMaintenanceActivities(services),\n    ...createGoalActivities(services),\n    ...createCodexCapacityActivities(services),\n    ...createRigVerificationActivities(services),\n    ...createBrowserStateArtifactMaintenanceActivities(services),\n    ...createBrowserDeadlineCheckpointActivities(services),\n    ...createFileUploadReaperActivities(services),\n    ...createModelCallFactReconcilerActivities(services),\n    ...createRetainedScreenshotMaintenanceActivities(services),\n    ...createWorkflowWakeActivities(services),\n    ...createSandboxLeaseActivities(services),\n  };\n}\n\nexport function createControlActivities(dependencies: ActivityDependencies = {}) {\n  const services = createControlActivityServices(dependencies);\n  let documentServicesPromise: Promise<import(\"@opengeni/documents\").DocumentServices> | null =\n    null;\n  const resolveDocumentServices = async () => {\n    documentServicesPromise ??= dependencies.documentServices\n      ? Promise.resolve(dependencies.documentServices)\n      : import(\"@opengeni/documents\").then(async ({ createDocumentServices }) =>\n          createDocumentServices((await services()).settings),\n        );\n    return await documentServicesPromise;\n  };\n  return createControlActivitiesFromServices(services, resolveDocumentServices);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,mCAAmC;AAC5C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAKA,IAAM,gCAAN,cAA4C,MAAM;AAAA,EACvD,cAAc;AACZ,UAAM,yCAAyC;AAC/C,SAAK,OAAO;AAAA,EACd;AACF;AAWO,SAAS,gCACd,OACA,OAWA;AACA,MAAI,iBAAiB,+BAA+B;AAClD,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,QAAQ;AAAA,IACV;AAAA,EACF;AACA,MAAI,UAAU,aAAa;AACzB,UAAM,SAAS,SAAS,OAAO,QAAQ;AACvC,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,GAAI,OAAO,WAAW,YAAY,OAAO,UAAU,MAAM,KAAK,UAAU,OAAO,UAAU,MACrF,EAAE,OAAO,IACT,CAAC;AAAA,IACP;AAAA,EACF;AACA,QAAM,WAAW,mBAAmB,KAAK;AACzC,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,QAAQ;AAAA,IACV;AAAA,EACF;AACA,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,GAAI,SAAS,WAAW,EAAE,UAAU,SAAS,SAAS,IAAI,CAAC;AAAA,EAC7D;AACF;AAEA,SAAS,SAAS,OAAgB,KAAsB;AACtD,MAAI;AACF,QAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,UAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,WAAO,cAAc,WAAW,aAAa,WAAW,QAAQ;AAAA,EAClE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,SAAS,mBAAmB,OAAmD;AAC7E,MAAI,UAAU;AACd,WAAS,QAAQ,GAAG,QAAQ,KAAK,WAAW,OAAO,YAAY,UAAU,SAAS,GAAG;AACnF,QAAI,SAAS,SAAS,MAAM,MAAM,iBAAiB;AACjD,YAAM,OAAO,SAAS,SAAS,MAAM;AACrC,aAAO,OAAO,SAAS,YAAY,gBAAgB,KAAK,IAAI,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC;AAAA,IACxF;AACA,cAAU,SAAS,SAAS,OAAO;AAAA,EACrC;AACA,SAAO;AACT;AAEO,SAAS,kCACd,UACA,yBACA;AAGA,MAAI;AACJ,SAAO;AAAA,IACL,gBAAgB,YAAY;AAC1B,YAAM,SAAS,EAAE,WAAW,GAAG,UAAU,GAAG,UAAU,GAAG,aAAa,EAAE;AACxE,UAAI,CAAC,wBAAyB,QAAO;AACrC,YAAM,EAAE,IAAI,UAAU,cAAc,IAAI,MAAM,SAAS;AACvD,UAAI;AACJ,UAAI,sBAAsB,QAAQ,GAAG;AACnC,YAAI,CAAC,SAAS;AACZ,gBAAM,IAAI,MAAM,wDAAwD;AAC1E,4BAAoB,IAAI,KAAK,SAAS,mCAAmC;AAAA,MAC3E,OAAO;AACL,2BAAmB,oCAAoC,EAAE,EAAE,MAAM,CAAC,UAAU;AAC1E,2BAAiB;AACjB,gBAAM;AAAA,QACR,CAAC;AACD,4BAAoB,MAAM;AAAA,MAC5B;AACA,YAAM,EAAE,SAAS,IAAI,MAAM,wBAAwB;AAGnD,UAAI,SAAS,cAAc,MAAO,QAAO;AACzC,YAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,qBAAqB;AACnE,YAAM,SAAS,MAAM,wBAAwB,IAAI;AAAA,QAC/C,OAAO,SAAS;AAAA,QAChB,YAAY,SAAS;AAAA,QACrB,OAAO;AAAA,MACT,CAAC;AACD,iBAAW,SAAS,QAAQ;AAC1B,YAAI,QAAoC;AACxC,YAAI;AACF,gBAAM,SAAS,MAAM,yBAAyB,IAAI,KAAK;AACvD,cAAI,CAAC,QAAQ;AACX,mBAAO;AACP;AAAA,UACF;AAIA,gBAAM,uBAAuB,IAAI,OAAO,oBAAoB,OAAO,aAAa;AAC9E,kBAAM,UAAU,MAAM,yBAAyB,UAAU,KAAK;AAC9D,gBAAI,CAAC,SAAS;AACZ,qBAAO;AACP;AAAA,YACF;AACA,kBAAM,SAAS,CAAC;AAChB,gBAAI,OAAO;AACX,uBAAW,SAAS,qBAAqB,QAAQ,KAAK,GAAG;AACvD,kBAAI,MAAM,QAAQ,QAAQ,UAAW;AACrC,kBAAI,OAAO,WAAW,IAAI;AACxB,uBAAO;AACP;AAAA,cACF;AACA,qBAAO,KAAK,KAAK;AAAA,YACnB;AACA,gBAAI,OAAO,QAAQ;AACjB,oBAAM,eAAe,MAAM;AAAA,gBACzB;AAAA,gBACA;AAAA;AAAA;AAAA;AAAA,gBAIA,SAAS,8BAA8B,WAClC,SAAS,gCAAgC,eAC1C;AAAA,gBACJ;AAAA,gBACA,SAAS,8CAA8C;AAAA,cACzD;AACA,kBAAI,aAAa,SAAS,mBAAmB;AAC3C,uBAAO;AACP;AAAA,cACF;AACA,kBAAI,aAAa,SAAS,YAAY;AACpC,uBAAO;AACP;AAAA,cACF;AAKA,kBAAI,aAAa,SAAS,aAAa,CAAC,sBAAsB,QAAQ,GAAG;AACvE,sBAAM,uBAAuB,UAAU,KAAK;AAC5C,uBAAO;AACP;AAAA,cACF;AACA,oBAAM,OAAO,aAAa,SAAS;AACnC,kBAAI,QAAQ,MAAM,mBAAmB,SAAS,WAAW;AAGvD,8BAAc,KAAK,yDAAyD;AAAA,kBAC1E,WAAW;AAAA,gBACb,CAAC;AACD,sBAAM,uBAAuB,UAAU,KAAK;AAC5C,uBAAO;AACP;AAAA,cACF;AAKA,kBAAI,QAAS,MAAM,yBAAyB,UAAU,QAAQ,kBAAkB,GAAI;AAClF,sBAAM,6BAA6B,UAAU,KAAK;AAClD,uBAAO;AACP;AAAA,cACF;AACA,kBAAI,QAAQ,QAAQ,cAAc,GAAG;AACnC,sBAAM,UAAU,MAAM,0BAA0B,UAAU,MAAM,SAAS;AACzE,oBAAI,QAAQ,iBAAiB,GAAG;AAC9B,wBAAM,6BAA6B,UAAU,KAAK;AAClD,yBAAO;AACP;AAAA,gBACF;AAAA,cACF;AACA,kBAAI,MAAM;AACR,sBAAM,UAAU,MAAM,wBAAwB,UAAU;AAAA,kBACtD,WAAW,MAAM;AAAA,kBACjB,aAAa,QAAQ;AAAA,kBACrB,WACE,MAAM,mBAAmB,SAAS,UAClC,MAAM,mBAAmB,SAAS,UAC9B,MAAM,mBAAmB,2BACzB;AAAA,gBACR,CAAC;AACD,oBAAI,SAAS;AACX,wBAAM,uBAAuB,UAAU,KAAK;AAC5C,yBAAO;AACP;AAAA,gBACF;AAAA,cACF;AACA,kBAAI,SAAS,oBAAoB,YAAY,SAAS,oBAAoB,WAAW;AACnF,sBAAM,QACJ,4BAA4B,QAAQ,EAAE;AACxC,oBAAI,OAAO;AACT,wBAAM,MAAM,oBAAI,KAAK;AACrB,wBAAM,OAAO,MAAM,iBAAiB,UAAU;AAAA,oBAC5C,aAAa,QAAQ;AAAA,oBACrB,WAAW;AAAA,oBACX,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,eAAe,GAAG,IAAI,YAAY,GAAG,CAAC,CAAC;AAAA,kBACtE,CAAC;AACD,sBAAI,OAAO,OAAO,SAAS,MAAO,OAAM,IAAI,8BAA8B;AAAA,gBAC5E;AAAA,cACF;AACA,oBAAM,SAAS,OAAO,IAAI,CAAC,UAAU,MAAM,cAAc;AACzD,oBAAM,QAAQ,OAAO;AAAA,gBACnB,CAAC,KAAK,UAAU,MAAM,OAAO,WAAW,OAAO,MAAM;AAAA,gBACrD;AAAA,cACF;AACA,sBAAQ;AACR,oBAAM,UAAU,MAAM,SAAS,UAAU,MAAM;AAC/C,kBAAI,QAAQ,WAAW,OAAO;AAC5B,sBAAM,IAAI,MAAM,iCAAiC;AACnD,sBAAQ;AAGR,kBAAI,MAAM;AACR,sBAAM,cAAc,MAAM,mCAAmC,UAAU,KAAK;AAC5E,oBAAI,gBAAgB,aAAa;AAC/B,sBAAI,gBAAgB,WAAY,QAAO;AAAA,sBAClC,QAAO;AACZ;AAAA,gBACF;AAAA,cACF;AACA,oBAAM,WAAW,MAAM;AAAA,gBACrB;AAAA,gBACA;AAAA,gBACA,QAAQ;AAAA,gBACR,OAAO,IAAI,CAAC,OAAO,WAAW,EAAE,GAAG,OAAO,WAAW,QAAQ,KAAK,EAAG,EAAE;AAAA,cACzE;AACA,kBAAI,SAAS,WAAW,WAAW;AACjC,uBAAO;AACP;AAAA,cACF;AACA,oBAAM,iBAAiB,UAAU;AAAA,gBAC/B,WAAW,MAAM;AAAA,gBACjB,aAAa,QAAQ;AAAA,gBACrB,WAAW;AAAA,gBACX,UAAU,OAAO;AAAA,gBACjB,MAAM;AAAA,gBACN,oBAAoB;AAAA,gBACpB,kBAAkB,MAAM;AAAA,gBACxB,gBAAgB,qBAAqB,MAAM,UAAU,IAAI,MAAM,UAAU,IAAI,QAAQ,SAAS;AAAA,cAChG,CAAC;AACD,oBAAM,iBAAiB,UAAU;AAAA,gBAC/B,WAAW,MAAM;AAAA,gBACjB,aAAa,QAAQ;AAAA,gBACrB,WAAW;AAAA,gBACX,UAAU;AAAA,gBACV,MAAM;AAAA,gBACN,oBAAoB;AAAA,gBACpB,kBAAkB,MAAM;AAAA,gBACxB,gBAAgB,6BAA6B,MAAM,UAAU,IAAI,MAAM,UAAU,IAAI,QAAQ,SAAS;AAAA,cACxG,CAAC;AACD,kBAAI,aAAa,SAAS,YAAY,aAAa,4BAA4B,GAAG;AAChF,sBAAM,WAAW;AAAA,kBACf;AAAA,oBACE,GAAG;AAAA,oBACH,4CACE,aAAa;AAAA,kBACjB;AAAA,kBACA;AAAA,gBACF;AACA,oBAAI,WAAW;AACb,wBAAM,iBAAiB,UAAU;AAAA,oBAC/B,WAAW,MAAM;AAAA,oBACjB,aAAa,QAAQ;AAAA,oBACrB,WAAW;AAAA,oBACX,UAAU;AAAA,oBACV,MAAM;AAAA,oBACN,oBAAoB;AAAA,oBACpB,kBAAkB,MAAM;AAAA,oBACxB,gBAAgB,8BAA8B,MAAM,UAAU,IAAI,MAAM,UAAU,IAAI,QAAQ,SAAS;AAAA,kBACzG,CAAC;AAAA,cACL;AACA,kBAAI,MAAM;AACR,sBAAM,OAAO;AAAA,kBACX;AAAA,oBACE,GAAG;AAAA,oBACH,4CACE,aAAa;AAAA,kBACjB;AAAA,kBACA;AAAA,gBACF;AACA,oBAAI,OAAO;AACT,wBAAM,yBAAyB,UAAU;AAAA,oBACvC,WAAW,MAAM;AAAA,oBACjB,aAAa,QAAQ;AAAA,oBACrB,MAAM;AAAA,oBACN,cAAc;AAAA,oBACd,YAAY;AAAA,oBACZ,UAAU,MAAM;AAAA,oBAChB,gBAAgB,uBAAuB,MAAM,UAAU,IAAI,MAAM,UAAU,IAAI,QAAQ,SAAS;AAAA,oBAChG,UAAU;AAAA,sBACR,GAAG,+BAA+B,MAAM,kBAAkB;AAAA,sBAC1D,OAAO,MAAM;AAAA,sBACb;AAAA,sBACA,QAAQ,OAAO;AAAA,sBACf,2BAA2B,aAAa;AAAA,oBAC1C;AAAA,kBACF,CAAC;AAAA,cACL;AAAA,YACF;AACA,gBAAI,MAAM;AACR,oBAAM,0BAA0B,UAAU,KAAK;AAC/C,qBAAO;AAAA,YACT,OAAO;AACL,oBAAM,YAAY,MAAM;AAAA,gBACtB;AAAA,gBACA;AAAA,gBACA,QAAQ,YAAY,OAAO;AAAA,cAC7B;AACA,kBAAI,UAAU,WAAW,QAAS,QAAO;AAAA,kBACpC,QAAO;AAAA,YACd;AAAA,UACF,CAAC;AAAA,QACH,SAAS,OAAO;AAKd,wBAAc;AAAA,YACZ;AAAA,YACA,gCAAgC,OAAO,KAAK;AAAA,UAC9C;AACA,gBAAM,uBAAuB,IAAI,KAAK,EAAE,MAAM,CAAC,eAAwB;AACrE,kBAAM,kBAAkB,gCAAgC,cAAc,UAAU;AAChF,0BAAc,KAAK,4CAA4C;AAAA,cAC7D,GAAG;AAAA,cACH,WAAW;AAAA,YACb,CAAC;AAAA,UACH,CAAC;AACD,iBAAO;AAAA,QACT;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;AC/YA;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAYA,SAAS,8BAA8B,UAAkD;AAC9F,iBAAe,qBAAqB,OAAkC;AACpE,UAAM,EAAE,GAAG,IAAI,MAAM,SAAS;AAM9B,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AACA,QAAI,WAAY,QAAO,gCAAgC,UAAU;AACjE,WAAO;AAAA,EACT;AAEA,iBAAe,2BACb,OAC2C;AAC3C,UAAM,WAAW,MAAM,SAAS;AAGhC,UAAM,UAAU,6BAA6B,EAAE;AAAA,MAC7C,CAAC,cAAc,UAAU,cAAc,MAAM,YAAY;AAAA,IAC3D;AACA,QAAI,CAAC,QAAS,QAAO,EAAE,QAAQ,QAAQ;AACvC,UAAM,OAAO,MAAM,0BAA0B,UAAU,SAAS;AAAA,MAC9D,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,WAAW,MAAM;AAAA,MACjB,UAAU,MAAM;AAAA,MAChB,YAAY,MAAM;AAAA,IACpB,CAAC;AACD,WAAO,QAAQ,EAAE,QAAQ,QAAQ;AAAA,EACnC;AAEA,SAAO,EAAE,sBAAsB,2BAA2B;AAC5D;;;ACrDA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AAIA,IAAM,0CAA0C,KAAK,KAAK;AAC1D,IAAM,4CAA4C;AAEzD,IAAM,4BAA4B,oBAAI,IAAI;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAwBM,SAAS,gDACd,UACA,UAAkD,CAAC,GACnD;AACA,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,mBAAmB,QAAQ,oBAAoB;AACrD,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,eAAe,QAAQ,iBAAiB,CAAC,SAAS,QAAQ,QAAQ,aAAa,GAAG;AAExF,iBAAe,gCAA8E;AAC3F,UAAM,EAAE,IAAI,eAAe,cAAc,IAAI,MAAM,SAAS;AAC5D,QAAI,CAAC,cAAe,QAAO,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,EAAE;AAElE,UAAM,CAAC,gBAAgB,YAAY,IAAI,MAAM,QAAQ,IAAI;AAAA,MACvD,eAAe,IAAI,EAAE,gBAAgB,OAAO,UAAU,CAAC;AAAA,MACvD,aAAa,IAAI,EAAE,gBAAgB,OAAO,UAAU,CAAC;AAAA,IACvD,CAAC;AACD,UAAM,SAA8C;AAAA,MAClD,SAAS,eAAe,SAAS,aAAa;AAAA,MAC9C,SAAS;AAAA,MACT,WAAW;AAAA,IACb;AACA,eAAW,WAAW,gBAAgB;AACpC,UAAI;AACF,cAAM,aAAa,eAAe,QAAQ,SAAS;AACnD,YAAI,CAAE,MAAM,iBAAiB,IAAI,OAAO,GAAI;AAC1C,gBAAM,IAAI,MAAM,qDAAqD;AAAA,QACvE;AACA,eAAO,WAAW;AAAA,MACpB,SAAS,OAAO;AACd,eAAO,aAAa;AACpB,sBAAc,KAAK,oEAAoE;AAAA,UACrF,aAAa,QAAQ;AAAA,UACrB,YAAY,QAAQ;AAAA,UACpB,eAAe,qBAAqB,KAAK;AAAA,QAC3C,CAAC;AAAA,MACH;AAAA,IACF;AACA,eAAW,WAAW,cAAc;AAClC,UAAI;AACF,cAAM,aAAa,eAAe,QAAQ,SAAS;AACnD,YAAI,CAAE,MAAM,eAAe,IAAI,OAAO,GAAI;AACxC,gBAAM,IAAI,MAAM,mDAAmD;AAAA,QACrE;AACA,eAAO,WAAW;AAAA,MACpB,SAAS,OAAO;AACd,eAAO,aAAa;AACpB,sBAAc,KAAK,kEAAkE;AAAA,UACnF,aAAa,QAAQ;AAAA,UACrB,UAAU,QAAQ;AAAA,UAClB,eAAe,qBAAqB,KAAK;AAAA,QAC3C,CAAC;AAAA,MACH;AAAA,IACF;AACA,QAAI,OAAO,UAAU,GAAG;AACtB,oBAAc,KAAK,4CAA4C,MAAM;AAAA,IACvE;AACA,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,8BAA8B;AACzC;AAEA,SAAS,qBAAqB,OAAwB;AACpD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,OAAQ,MAA6B;AAC3C,SAAO,OAAO,SAAS,YAAY,0BAA0B,IAAI,IAAI,IAAI,OAAO;AAClF;;;ACrHA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB;AAoBvB,SAAS,2BACd,UACA,UAAqC,CAAC,GACtC;AACA,QAAM,QAAQ,QAAQ,SAAS;AAC/B,QAAM,SAAS,QAAQ,UAAU;AACjC,QAAM,kBAAkB,QAAQ,mBAAmB;AACnD,QAAMA,iBAAgB,QAAQ,iBAAiB;AAC/C,QAAM,gBAAgB,QAAQ,iBAAiB;AAC/C,QAAM,QAAQ,QAAQ,SAAS;AAC/B,QAAM,oBAAoB,QAAQ,qBAAqB;AACvD,QAAM,cAAc,QAAQ,eAAe;AAC3C,SAAO;AAAA,IACL,4BAA4B,OAAO,UAAqD;AACtF,YAAM,UAAU,MAAM,SAAS;AAC/B,YAAM,OAAO,QAAQ,IAAI;AAAA,QACvB,aAAa,MAAM;AAAA,QACnB,OAAO,MAAM;AAAA,QACb,QAAQ;AAAA,QACR,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,IACA,uBAAuB,OACrB,UACyC;AACzC,YAAM,UAAU,MAAM,SAAS;AAC/B,YAAM,wBAAwB,QAAQ,yBAAyB,QAAQ;AACvE,YAAM,6BACJ,MAAM,uBAAuB,QAAQ,IAAI,qBAAqB,GAC9D;AACF,YAAM,MAAM,MAAM,MAAM,QAAQ,IAAI,KAAK;AACzC,UAAI,CAAC,IAAK,QAAO,EAAE,QAAQ,YAAY;AACvC,UAAI,IAAI,WAAW,cAAc;AAC/B,YAAI,CAAC,IAAI,UAAW,OAAM,IAAI,MAAM,kDAAkD;AACtF,eAAO,EAAE,QAAQ,sBAAsB,WAAW,IAAI,UAAU;AAAA,MAClE;AACA,UAAI,IAAI,WAAW,WAAW;AAC5B,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,QAAQ,IAAI,aAAa;AAAA,QAC3B;AAAA,MACF;AACA,UAAI,IAAI,WAAW,UAAU;AAC3B,eAAO,EAAE,QAAQ,UAAU,QAAQ,IAAI,aAAa,kBAAkB;AAAA,MACxE;AAEA,UAAI;AACF,cAAM,WAAW,IAAI;AACrB,YACE,SAAS,cAAc,MAAM,aAC7B,SAAS,gBAAgB,MAAM,eAC/B,SAAS,aAAa,IAAI,YAC1B,SAAS,cAAc,IAAI,aAC3B,SAAS,oBAAoB,IAAI,mBACjC,SAAS,YAAY,IAAI,SACzB;AACA,gBAAM,OAAO,QAAQ,IAAI;AAAA,YACvB,aAAa,MAAM;AAAA,YACnB,OAAO,IAAI;AAAA,YACX,QAAQ;AAAA,YACR,WAAW;AAAA,UACb,CAAC;AACD,iBAAO,EAAE,QAAQ,WAAW,QAAQ,8BAA8B;AAAA,QACpE;AAEA,cAAM,WAAW,SAAS;AAC1B,YACE,SAAS,0BAA0B,qBACnC,SAAS,yBAAyB;AAAA,UAChC,CAAC,eAAe,CAAC,2CAA2C,UAAU;AAAA,QACxE,GACA;AACA,gBAAM,OAAO,QAAQ,IAAI;AAAA,YACvB,aAAa,MAAM;AAAA,YACnB,OAAO,IAAI;AAAA,YACX,QAAQ;AAAA,YACR,WAAW;AAAA,UACb,CAAC;AACD,iBAAO,EAAE,QAAQ,UAAU,QAAQ,mCAAmC;AAAA,QACxE;AACA,cAAM,iBAAiB,SAAS,SAAS,0BAA0B;AACnE,cAAM,kBACJ,eAAe,WAAW,iCAAiC,KAC3D,eAAe,WAAW,oCAAoC,KAC9D,eAAe,WAAW,+BAA+B,KAEnD,MAAM,gCAAgC,QAAQ,IAAI,uBAAuB;AAAA,UACvE,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,wBAAwB;AAAA,QAC1B,CAAC,GACD,WACF;AACN,cAAM,iBAAiB,EAAE,GAAG,SAAS,UAAU,gBAAgB;AAC/D,YAAI;AACJ,YAAI;AACF,gBAAM,kBAAkB,yBAAyB,iBAAiB,cAAc;AAChF,cAAI,CAAC,gBAAiB,OAAM,IAAI,MAAM,oCAAoC;AAC1E,gBAAM,kBAAkB,QAAQ,IAAI,iBAAiB,MAAM,aAAa,eAAe;AACvF,kBAAQ;AAAA,QACV,SAAS,OAAO;AACd,cAAI,CAAC,sBAAsB,KAAK,EAAG,OAAM;AACzC,gBAAM,OAAO,QAAQ,IAAI;AAAA,YACvB,aAAa,MAAM;AAAA,YACnB,OAAO,IAAI;AAAA,YACX,QAAQ;AAAA,YACR,WAAW;AAAA,UACb,CAAC;AACD,iBAAO,EAAE,QAAQ,UAAU,QAAQ,kBAAkB;AAAA,QACvD;AACA,cAAM,SAAS,MAAM,MAAM,gBAAgB;AAAA,UACzC,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB;AAAA,UACA,oBAAoB;AAAA,QACtB,CAAC;AACD,YAAI,QAAQ;AACV,gBAAM,OAAO,QAAQ,IAAI;AAAA,YACvB,aAAa,MAAM;AAAA,YACnB,OAAO,IAAI;AAAA,YACX,QAAQ;AAAA,YACR,WAAW;AAAA,UACb,CAAC;AACD,iBAAO,EAAE,QAAQ,UAAU,QAAQ,OAAO;AAAA,QAC5C;AACA,cAAM,kBAAkB,SAAS,mBAAmB,gBAAgB;AACpE,cAAM,iBAAiB,SAAS,kBAAkB,gBAAgB;AAClE,YAAI,mBAAmB,cAAc;AACnC,gBAAM,OAAO,QAAQ,IAAI;AAAA,YACvB,aAAa,MAAM;AAAA,YACnB,OAAO,IAAI;AAAA,YACX,QAAQ;AAAA,YACR,WAAW;AAAA,UACb,CAAC;AACD,iBAAO;AAAA,YACL,QAAQ;AAAA,YACR,QAAQ;AAAA,UACV;AAAA,QACF;AAGA,YAAI;AAMJ,YAAI;AACF,gBAAM,qBAAqB,MAAM,cAAc,QAAQ,IAAI,MAAM,WAAW,GAAG;AAC/E,gBAAM,aAAa,mCAAmC;AAAA,YACpD,UAAU;AAAA,YACV,SAAS;AAAA,YACT,SAAS,SAAS;AAAA,YAClB,cAAc,SAAS,gBAAgB;AAAA,YACvC;AAAA,YACA,QAAQ;AAAA,YACR,MAAM;AAAA,UACR,CAAC;AACD,gBAAM,UAAU,oCAAoC;AAAA,YAClD,QAAQ,WAAW;AAAA,YACnB,oBAAoB,SAAS;AAAA,YAC7B,OAAO,SAAS;AAAA,YAChB,YAAY,EAAE,MAAM,YAAY,wBAAwB,KAAK;AAAA,YAC7D,kBAAkB,SAAS,MAAM,IAAI,CAAC,SAAS,KAAK,EAAE;AAAA,UACxD,CAAC;AACD,8BAAoB;AAAA,YAClB,QAAQ,WAAW;AAAA,YACnB,cAAc,WAAW;AAAA,YACzB,oBAAoB,QAAQ;AAAA,YAC5B,OAAO,QAAQ;AAAA,UACjB;AAAA,QACF,SAAS,OAAO;AACd,cAAI,CAAC,sBAAsB,KAAK,EAAG,OAAM;AACzC,gBAAM,OAAO,QAAQ,IAAI;AAAA,YACvB,aAAa,MAAM;AAAA,YACnB,OAAO,IAAI;AAAA,YACX,QAAQ;AAAA,YACR,WAAW;AAAA,UACb,CAAC;AACD,iBAAO,EAAE,QAAQ,UAAU,QAAQ,kBAAkB;AAAA,QACvD;AACA,cAAM,8BAA8B,6BAA6B,iBAAiB;AAAA,UAChF,SAAS;AAAA,UACT,kBAAkB,SAAS;AAAA,UAC3B,aAAa,SAAS,QAAQ,aAAa;AAAA,UAC3C;AAAA,UACA,iBAAiB,SAAS,kBAAkB,aAAa;AAAA,UACzD,aAAa;AAAA,UACb,mBAAmB;AAAA,QACrB,CAAC;AACD,cAAM,sBAAsB,SAAS,wBACjC;AAAA,UACE,GAAG;AAAA,UACH,uBAAuB,SAAS;AAAA,QAClC,IACA;AACJ,cAAM,UAAU,MAAMA,eAAc;AAAA,UAClC,IAAI,QAAQ;AAAA,UACZ,KAAK,QAAQ;AAAA,UACb,gBAAgB;AAAA,YACd,qBAAqB,OAAO,SAAS;AACnC,oBAAM,QAAQ,sBAAsB,IAAI;AAAA,YAC1C;AAAA,UACF;AAAA,UACA,oBAAoB,OAAO,IAAI,cAAc;AAC3C,kBAAM,gBAAgB,IAAI;AAAA,cACxB,aAAa,MAAM;AAAA,cACnB,OAAO,IAAI;AAAA,cACX,WAAW,SAAS;AAAA,cACpB,iBAAiB,SAAS;AAAA,cAC1B,UAAU,SAAS;AAAA,cACnB,eAAe,SAAS;AAAA,cACxB;AAAA,YACF,CAAC;AAAA,UACH;AAAA,UACA,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,gBAAgB,SAAS;AAAA,UACzB,SAAS;AAAA,UACT,SAAS,QAAQ;AAAA,UACjB,WAAW,SAAS;AAAA,UACpB,QAAQ,cAAc,MAAM,SAAS,MAAM;AAAA,UAC3C,iBAAiB,SAAS;AAAA,UAC1B,OAAO,kBAAkB;AAAA,UACzB,YAAY,EAAE,MAAM,YAAY,wBAAwB,KAAK;AAAA,UAC7D;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,UAAU;AAAA,YACR,GAAG,SAAS;AAAA,YACZ,iBAAiB,IAAI;AAAA,YACrB,oBAAoB,IAAI;AAAA,YACxB,qBAAqB,IAAI;AAAA,YACzB,2BAA2B,IAAI;AAAA,UACjC;AAAA,UACA,WAAW;AAAA,YACT,MAAM;AAAA,YACN,WAAW,SAAS;AAAA,YACpB,OAAO,SAAS;AAAA,UAClB;AAAA,UACA,kBAAkB,SAAS;AAAA,UAC3B,cAAc,kBAAkB,gBAAgB,SAAS;AAAA,UACzD,YAAY,SAAS;AAAA,UACrB,0BAA0B,SAAS;AAAA,UACnC,oBAAoB,kBAAkB;AAAA,UACtC,GAAI,kBAAkB,SAAS,EAAE,aAAa,kBAAkB,OAAO,IAAI,CAAC;AAAA,UAC5E,4BACE,MAAM,WAAW,iCAAiC,KAClD,MAAM,WAAW,oCAAoC,KACrD,MAAM,WAAW,+BAA+B;AAAA,UAClD,sBAAsB,kBAAkB,IAAI,EAAE;AAAA,UAC9C,WAAW,SAAS;AAAA,QACtB,CAAC;AACD,cAAM;AAAA,UACJ,EAAE,IAAI,QAAQ,IAAI,UAAU,gBAAgB;AAAA,UAC5C;AAAA,YACE,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,WAAW,SAAS;AAAA,YACpB,WAAW;AAAA,YACX,UAAU;AAAA,YACV,MAAM;AAAA,YACN,oBAAoB;AAAA,YACpB,kBAAkB,IAAI;AAAA,YACtB,WAAW,QAAQ,QAAQ;AAAA,YAC3B,WAAW,QAAQ,QAAQ;AAAA,YAC3B,kBAAkB,QAAQ,QAAQ;AAAA,YAClC,QAAQ;AAAA,YACR,gBAAgB,gCAAgC,IAAI,EAAE;AAAA,UACxD;AAAA,QACF,EAAE,MAAM,CAAC,UAAU;AACjB,kBAAQ,cAAc,KAAK,qCAAqC;AAAA,YAC9D,aAAa,MAAM;AAAA,YACnB,OAAO,IAAI;AAAA,YACX,eAAe,iBAAiB,QAAQ,MAAM,OAAO;AAAA,UACvD,CAAC;AAAA,QACH,CAAC;AACD,eAAO,EAAE,QAAQ,WAAW,WAAW,QAAQ,QAAQ,GAAG;AAAA,MAC5D,SAAS,OAAO;AACd,YAAI,iBAAiB,iCAAiC;AACpD,gBAAM,OAAO,QAAQ,IAAI;AAAA,YACvB,aAAa,MAAM;AAAA,YACnB,OAAO,IAAI;AAAA,YACX,QAAQ;AAAA,YACR,WAAW;AAAA,UACb,CAAC;AACD,iBAAO,EAAE,QAAQ,WAAW,QAAQ,oBAAoB;AAAA,QAC1D;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,OAAyB;AACtD,SACE,iBAAiB,SACjB,YAAY,SACX,MAAuC,WAAW;AAEvD;;;ACzVA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,SAAS,kBAAkB;AAEpB,IAAM,+BAA+B,KAAK,KAAK;AAC/C,IAAM,uCAAuC,KAAK,KAAK;AACvD,IAAM,iCAAiC;AAC9C,IAAM,gCAAgC,oBAAI,IAAI;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,uBAAuB,OAG9B;AACA,MAAI,gBAAgB;AACpB,MAAI;AACJ,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,UAAM,UAAW,MAA6B;AAC9C,QAAI,OAAO,YAAY,YAAY,8BAA8B,IAAI,OAAO,GAAG;AAC7E,sBAAgB;AAAA,IAClB,WAAW,YAAY,QAAW;AAChC,sBAAgB;AAAA,IAClB;AACA,UAAM,YAAY;AAAA,MACf,MAAqD,UACnD,MAAmC;AAAA,IACxC;AACA,QAAI,OAAO,UAAU,SAAS,KAAK,aAAa,OAAO,aAAa,KAAK;AACvE,oBAAc;AAAA,IAChB;AAAA,EACF;AACA,SAAO,EAAE,eAAe,GAAI,gBAAgB,SAAY,CAAC,IAAI,EAAE,YAAY,EAAG;AAChF;AA0BO,SAAS,iCACd,UACA,UAA2C,CAAC,GAC5C;AACA,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,eAAe,QAAQ,iBAAiB,OAAO,SAAS,QAAQ,QAAQ,aAAa,GAAG;AAC9F,QAAM,mBAAmB,QAAQ,oBAAoB;AACrD,QAAM,qBAAqB,QAAQ,sBAAsB;AACzD,QAAM,4BACJ,QAAQ,6BAA6B;AACvC,QAAM,8BACJ,QAAQ,+BAA+B;AACzC,QAAM,+BACJ,QAAQ,gCAAgC;AAE1C,iBAAe,yBAAgE;AAC7E,UAAM,EAAE,IAAI,eAAe,cAAc,IAAI,MAAM,SAAS;AAC5D,QAAI,CAAC,eAAe;AAClB,UAAI;AACF,cAAM,6BAA6B,IAAI,EAAE,SAAS,OAAO,UAAU,CAAC;AAAA,MACtE,SAAS,OAAO;AACd,sBAAc,KAAK,yDAAyD;AAAA,UAC1E,GAAG,uBAAuB,KAAK;AAAA,QACjC,CAAC;AAAA,MACH;AACA,aAAO,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,EAAE;AAAA,IAC7C;AAEA,UAAM,SAAS,MAAM,iBAAiB,IAAI;AAAA,MACxC;AAAA,MACA;AAAA,MACA,OAAO;AAAA,IACT,CAAC;AACD,QAAI,UAAU;AACd,QAAI,SAAS;AACb,eAAW,SAAS,QAAQ;AAC1B,UAAI;AACF,cAAM,aAAa,eAAe,MAAM,SAAS;AACjD,cAAM,UAAU,MAAM,mBAAmB,IAAI,KAAK;AAClD,YAAI,CAAC,SAAS;AACZ,gBAAM,IAAI,MAAM,mDAAmD;AAAA,QACrE;AACA,mBAAW;AAAA,MACb,SAAS,OAAO;AACd,kBAAU;AACV,sBAAc,KAAK,iEAAiE;AAAA,UAClF,aAAa,MAAM;AAAA,UACnB,UAAU,MAAM;AAAA,UAChB,QAAQ,MAAM;AAAA,UACd,GAAG,uBAAuB,KAAK;AAAA,QACjC,CAAC;AAAA,MACH;AAAA,IACF;AACA,UAAM,kBAAkB,MAAM,0BAA0B,IAAI;AAAA,MAC1D;AAAA,MACA;AAAA,MACA,OAAO;AAAA,IACT,CAAC;AACD,eAAW,SAAS,iBAAiB;AACnC,UAAI;AACF,cAAM,aAAa,eAAe,MAAM,SAAS;AACjD,cAAM,UAAU,MAAM,4BAA4B,IAAI,KAAK;AAC3D,YAAI,CAAC,SAAS;AACZ,gBAAM,IAAI,MAAM,+DAA+D;AAAA,QACjF;AACA,mBAAW;AAAA,MACb,SAAS,OAAO;AACd,kBAAU;AACV,sBAAc;AAAA,UACZ;AAAA,UACA;AAAA,YACE,aAAa,MAAM;AAAA,YACnB,aAAa,MAAM;AAAA,YACnB,GAAG,uBAAuB,KAAK;AAAA,UACjC;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,gCAAgC;AACpC,QAAI;AACF,sCAAgC,MAAM,6BAA6B,IAAI;AAAA,QACrE;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AAAA,IACH,SAAS,OAAO;AACd,oBAAc,KAAK,yDAAyD;AAAA,QAC1E,GAAG,uBAAuB,KAAK;AAAA,MACjC,CAAC;AAAA,IACH;AACA,UAAM,UAAU,OAAO,SAAS,gBAAgB;AAChD,QAAI,UAAU,KAAK,gCAAgC,GAAG;AACpD,oBAAc,KAAK,qCAAqC;AAAA,QACtD;AAAA,QACA;AAAA,QACA;AAAA,QACA,aAAa,OAAO;AAAA,QACpB,+BAA+B,gBAAgB;AAAA,QAC/C;AAAA,MACF,CAAC;AAAA,IACH;AACA,WAAO,EAAE,SAAS,SAAS,OAAO;AAAA,EACpC;AAEA,iBAAe,kCAIZ;AACD,UAAM,EAAE,IAAI,8BAA8B,cAAc,IAAI,MAAM,SAAS;AAC3E,QAAI,CAAC,6BAA8B,QAAO,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,EAAE;AAC9E,UAAM,SAAS,MAAM,+BAA+B,IAAI;AAAA,MACtD,OAAO,2BAA2B,WAAW,CAAC;AAAA,MAC9C,cAAc;AAAA,MACd,OAAO;AAAA,IACT,CAAC;AACD,QAAI,UAAU;AACd,QAAI,SAAS;AACb,eAAW,SAAS,QAAQ;AAC1B,UAAI;AACF,cAAM,6BAA6B,KAAK;AACxC,mBAAW;AAAA,MACb,SAAS,OAAO;AACd,kBAAU;AACV,sBAAc,KAAK,mDAAmD;AAAA,UACpE,aAAa,MAAM;AAAA,UACnB,YAAY,iBAAiB,QAAQ,MAAM,OAAO;AAAA,QACpD,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO,EAAE,SAAS,OAAO,QAAQ,SAAS,OAAO;AAAA,EACnD;AAEA,SAAO,EAAE,wBAAwB,gCAAgC;AACnE;;;AClNA,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,uBAAuB,+BAA+B;AAIxD,IAAM,wCAAwC,IAAI,KAAK,KAAK;AAE5D,IAAM,sCAAsC,KAAK,KAAK;AACtD,IAAM,4CAA4C;AAClD,IAAM,0CAA0C,IAAI,KAAK;AAChE,IAAM,sBAAsB;AA2BrB,SAAS,wCACd,UACA,UAA0C,CAAC,GAC3C;AACA,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,cAAc,QAAQ,eAAe;AAC3C,QAAM,wBAAwB,QAAQ,yBAAyBA;AAC/D,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,iBAAiB,QAAQ,kBAAkB;AAEjD,iBAAe,gCAA8E;AAC3F,UAAM,EAAE,IAAI,cAAc,IAAI,MAAM,SAAS;AAC7C,UAAM,YAAY,IAAI;AACtB,UAAM,QAAQ,IAAI,KAAK,YAAY,mCAAmC;AACtE,UAAM,QAAQ,IAAI,KAAK,MAAM,QAAQ,IAAI,qCAAqC;AAC9E,UAAM,SAA8C;AAAA,MAClD,YAAY;AAAA,MACZ,SAAS;AAAA,MACT,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,qBAAqB;AAAA,MACrB,kBAAkB;AAAA,MAClB,iBAAiB;AAAA,IACnB;AACA,UAAM,QAAQ,sBAAsB;AACpC,QAAI,SAAwB;AAC5B,QAAI,UAAU;AACd,WAAO,MAAM;AACX,YAAM,OAAO,MAAM,eAAe,IAAI,EAAE,SAAS,QAAQ,OAAO,oBAAoB,CAAC;AACrF,YAAM,MAAM,UAAU,KAAK,OAAO,CAAC,OAAO,MAAM,KAAK,IAAI;AACzD,iBAAW,eAAe,KAAK;AAC7B,YAAI,IAAI,IAAI,aAAa,aAAa;AACpC,iBAAO,kBAAkB;AACzB;AAAA,QACF;AACA,eAAO,cAAc;AACrB,YAAI;AACF,gBAAM,UAAU,MAAM,UAAU,IAAI;AAAA,YAClC;AAAA,YACA;AAAA,YACA;AAAA,YACA,OAAO;AAAA,UACT,CAAC;AACD,iBAAO,WAAW,QAAQ;AAC1B,iBAAO,YAAY,QAAQ;AAC3B,iBAAO,cAAc,QAAQ;AAC7B,cAAI,QAAQ,UAAW,QAAO,uBAAuB;AAAA,QACvD,SAAS,OAAO;AACd,iBAAO,oBAAoB;AAC3B,wBAAc,KAAK,yDAAyD;AAAA,YAC1E;AAAA,YACA,WAAW,iBAAiB,QAAQ,MAAM,OAAO;AAAA,UACnD,CAAC;AAAA,QACH;AAAA,MACF;AACA,UAAI,OAAO,gBAAiB;AAC5B,UAAI,WAAW,IAAI,SAAS,KAAK,OAAQ;AACzC,UAAI,KAAK,SAAS,qBAAqB;AACrC,YAAI,QAAS;AACb,kBAAU;AACV,iBAAS;AACT;AAAA,MACF;AACA,eAAS,KAAK,KAAK,SAAS,CAAC;AAAA,IAC/B;AACA,QAAI,OAAO,mBAAmB,KAAK,OAAO,sBAAsB,KAAK,OAAO,iBAAiB;AAC3F,oBAAc,KAAK,6CAA6C,EAAE,GAAG,OAAO,CAAC;AAAA,IAC/E,WAAW,OAAO,UAAU,GAAG;AAC7B,oBAAc,KAAK,kCAAkC,EAAE,GAAG,OAAO,CAAC;AAAA,IACpE;AACA,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,8BAA8B;AACzC;;;AC9GA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,yBAA8D;AAGhE,IAAM,uCAAuC,KAAK,KAAK;AACvD,IAAM,uCAAuC,KAAK,KAAK;AACvD,IAAM,6CAA6C;AA2BnD,SAAS,8CACd,UACA,UAAwD,CAAC,GACzD;AACA,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,aAAa,QAAQ,eAAe,CAAC,SAAS,SAAS,QAAQ,WAAW,IAAI;AACpF,QAAM,WAAW,QAAQ,aAAa,CAAC,SAAS,SAAS,QAAQ,SAAS,IAAI;AAC9E,QAAM,eAAe,QAAQ,iBAAiB,CAAC,SAAS,QAAQ,QAAQ,aAAa,GAAG;AAExF,iBAAe,8BAA0E;AACvF,UAAM,EAAE,IAAI,eAAe,cAAc,IAAI,MAAM,SAAS;AAC5D,QAAI,CAAC,eAAe;AAClB,aAAO,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,EAAE;AAAA,IACrE;AAEA,UAAM,SAAS,MAAM,mCAAmC,IAAI;AAAA,MAC1D;AAAA,MACA;AAAA,MACA,OAAO;AAAA,IACT,CAAC;AACD,UAAM,SAA4C;AAAA,MAChD,SAAS,OAAO;AAAA,MAChB,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,WAAW;AAAA,IACb;AAEA,eAAW,SAAS,QAAQ;AAC1B,UAAI;AACF,YAAI,MAAM,WAAW,aAAa;AAChC,gBAAMC,WAAU,MAAM,eAAe,IAAI,eAAe,OAAO;AAAA,YAC7D;AAAA,YACA;AAAA,YACA;AAAA,UACF,CAAC;AACD,cAAIA,aAAY,SAAS;AACvB,mBAAO,SAAS;AAAA,UAClB,OAAO;AACL,mBAAO,UAAU;AAAA,UACnB;AACA;AAAA,QACF;AAEA,cAAM,aAAa,eAAe,MAAM,SAAS;AACjD,cAAM,UAAU,sBAAsB,MAAM,aAAa;AACzD,cAAM,UAAU,MAAM,sCAAsC,IAAI;AAAA,UAC9D,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,YAAY,MAAM;AAAA,UAClB,SAAS,MAAM;AAAA,UACf;AAAA,QACF,CAAC;AACD,YAAI,CAAC,QAAS,OAAM,IAAI,MAAM,kDAAkD;AAChF,eAAO,WAAW;AAAA,MACpB,SAAS,OAAO;AACd,eAAO,aAAa;AACpB,sBAAc,KAAK,qEAAqE;AAAA,UACtF,aAAa,MAAM;AAAA,UACnB,WAAW,MAAM;AAAA,UACjB,YAAY,MAAM;AAAA,UAClB,QAAQ,MAAM;AAAA,UACd,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,QAC9D,CAAC;AAAA,MACH;AAAA,IACF;AAEA,QAAI,OAAO,SAAS,GAAG;AACrB,oBAAc,KAAK,yCAAyC,MAAM;AAAA,IACpE;AACA,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,4BAA4B;AACvC;AAEA,eAAe,eACb,IACA,SACA,OACA,UAG6B;AAC7B,QAAM,cAAc,MAAM,mBAAmB,SAAS,OAAO,QAAQ;AACrE,MAAI,gBAAgB,WAAW;AAC7B,UAAMC,WAAU,MAAM,sCAAsC,IAAI;AAAA,MAC9D,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,YAAY,MAAM;AAAA,MAClB,SAAS,MAAM;AAAA,MACf,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAACA,SAAS,OAAM,IAAI,MAAM,oDAAoD;AAClF,WAAO;AAAA,EACT;AAKA,QAAM,WAAW,MAAM,4CAA4C,IAAI;AAAA,IACrE,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,YAAY,MAAM;AAAA,IAClB,SAAS,MAAM;AAAA,IACf,eAAe;AAAA,EACjB,CAAC;AACD,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,oDAAoD;AAInF,QAAM,SAAS,aAAa,SAAS,MAAM,SAAS;AACpD,QAAM,UAAU,MAAM,sCAAsC,IAAI;AAAA,IAC9D,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,YAAY,MAAM;AAAA,IAClB,SAAS,MAAM;AAAA,IACf,SAAS;AAAA,EACX,CAAC;AACD,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,oDAAoD;AAClF,SAAO;AACT;AAEA,eAAe,mBACb,SACA,OACA,UAC6C;AAC7C,QAAM,OAAO,UAAU,SAAS,KAAK;AACrC,QAAM,OAAO,MAAM,kBAAkB,YAAY;AAC/C,QAAI,CAAE,MAAM,SAAS,WAAW,SAAS,IAAI,EAAI,QAAO;AACxD,WAAO,MAAM,SAAS,SAAS,SAAS,IAAI;AAAA,EAC9C,CAAC;AACD,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,KAAK,kBAAkB,MAAM,aAClC,KAAK,gBAAgB,MAAM,aAC3B,KAAK,UAAU,WAAW,MAAM,SAC9B,YACA;AACN;AAEA,SAAS,UAAU,SAAwB,OAAsD;AAC/F,QAAM,aAAY,oBAAI,KAAK,CAAC,GAAE,YAAY;AAC1C,SAAO;AAAA,IACL,IAAI,MAAM;AAAA,IACV,aAAa,MAAM;AAAA,IACnB,QAAQ;AAAA,IACR,UAAU,uBAAuB,MAAM,UAAU;AAAA,IACjD,cAAc,uBAAuB,MAAM,UAAU;AAAA,IACrD,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,IACjB,QAAQ,MAAM;AAAA,IACd,QAAQ,QAAQ;AAAA,IAChB,WAAW,MAAM;AAAA,IACjB,WAAW;AAAA,IACX,WAAW;AAAA,EACb;AACF;AAEA,SAAS,sBAAsB,QAAyD;AACtF,MAAI,WAAW,UAAW,QAAO;AACjC,MAAI,WAAW,SAAU,QAAO;AAChC,SAAO;AACT;;;ACnMA,SAAS,wCAAwC;AACjD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AAOP,IAAI,sBAAoD;AAExD,eAAe,mBAAmB,MAA+C;AAC/E,0BAAwB,OAAO,mBAAmB,EAAE,KAAK,CAAC,YAAY,QAAQ,eAAe;AAC7F,QAAM,OAAO,MAAM;AACnB,QAAM,KAAK,GAAG,IAAI;AACpB;AAyBO,SAAS,6BACd,UACY;AACZ,QAAM,UAAU,SAAS;AACzB,MAAI,CAAC,4BAA4B,UAAU,OAAO,EAAG,QAAO,CAAC;AAE7D,QAAM,SAAqB;AAAA,IACzB;AAAA,MACE,MAAM;AAAA,MACN,SAAS;AAAA,QACP;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI;AAAA,IACb;AAAA,EACF;AAEA,MAAI,SAAS,wBAAwB;AACnC,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,QACP;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI;AAAA,IACb,CAAC;AAAA,EACH;AAEA,MAAI,SAAS,uBAAuB;AAClC,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,QACP;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI;AAAA,IACb,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAEA,IAAM,0CAA0C,IAAI;AACpD,IAAM,4CAA4C;AAClD,IAAM,6CAA6C;AACnD,IAAM,6CAA6C;AAK5C,IAAM,gCAAgC,KAAK;AAC3C,IAAM,2CACX;AACF,IAAM,4CAA4C;AAClD,IAAM,oCAAoC;AAEnC,IAAM,uCAAN,cAAmD,MAAM;AAAA,EAG9D,YACW,uBACA,kBACT;AACA;AAAA,MACE,yEAAyE,gBAAgB,sCAAsC,qBAAqB;AAAA,IACtJ;AALS;AACA;AAAA,EAKX;AAAA,EATS,OAAO;AAUlB;AASA,SAAS,wBAAwB,uBAAuC;AACtE,SAAO,KAAK;AAAA,IACV;AAAA,IACA,KAAK,IAAI,KAAK,KAAK,MAAM,wBAAwB,CAAC,CAAC;AAAA,IACnD,KAAK,IAAI,GAAG,wBAAwB,CAAC;AAAA,EACvC;AACF;AAWO,SAAS,uCACd,UAA0B,uBAAuB,GACf;AAClC,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,iBAAiB,SAAS;AAChC,QAAM,8BAA8B,MAAY;AAC9C,QAAI,CAAC,WAAW,OAAO,SAAS;AAC9B,iBAAW;AAAA,QACT,gBAAgB,UAAU,IAAI,MAAM,4CAA4C;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACA,MAAI,gBAAgB,SAAS;AAC3B,gCAA4B;AAAA,EAC9B,OAAO;AACL,oBAAgB,iBAAiB,SAAS,6BAA6B,EAAE,MAAM,KAAK,CAAC;AAAA,EACvF;AAEA,QAAM,cAAc,KAAK,IAAI;AAC7B,QAAM,wBAAwB,SAAS,KAAK;AAC5C,QAAM,YACJ,OAAO,0BAA0B,YAAY,wBAAwB,IACjE,wBAAwB,qBAAqB,IAC7C;AACN,QAAM,qBACJ,cAAc,QAAQ,0BAA0B,SAC5C,OACA,cAAc;AAIpB,QAAM,0BACJ,cAAc,OAAO,IAAI,KAAK,IAAI,KAAQ,KAAK,IAAI,GAAG,KAAK,MAAM,YAAY,CAAC,CAAC,CAAC;AAClF,QAAM,sBACJ,uBAAuB,OAAO,OAAO,qBAAqB;AAE5D,MAAI,gBAAsD;AAC1D,MAAI,cAAc,QAAQ,0BAA0B,UAAa,CAAC,WAAW,OAAO,SAAS;AAC3F,oBAAgB;AAAA,MACd,MAAM;AACJ,YAAI,CAAC,WAAW,OAAO,SAAS;AAC9B,qBAAW;AAAA,YACT,IAAI,qCAAqC,uBAAuB,SAAS;AAAA,UAC3E;AAAA,QACF;AAAA,MACF;AAAA,MACA,KAAK,IAAI,GAAG,wBAAwB,SAAS;AAAA,IAC/C;AAAA,EACF;AAEA,QAAM,YAAY,MAAY;AAC5B,QAAI,CAAC,QAAS;AACd,QAAI;AACF,cAAQ,UAAU;AAAA,QAChB,UAAU;AAAA,QACV,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,QAC3B,SAAS,WAAW,OAAO;AAAA,QAC3B,mBAAmB,sBAAsB,IAAI,KAAK,mBAAmB,EAAE,YAAY,IAAI;AAAA,MACzF,CAAC;AAAA,IACH,SAAS,OAAO;AAKd,UAAI,CAAC,WAAW,OAAO,QAAS,YAAW,MAAM,KAAK;AAAA,IACxD;AAAA,EACF;AACA,YAAU;AACV,QAAM,qBAAqB,SAAS,KAAK;AACzC,QAAM,sBACJ,OAAO,uBAAuB,YAAY,qBAAqB,IAC3D,KAAK;AAAA,IACH;AAAA,IACA,KAAK,IAAI,4CAA4C,KAAK,MAAM,qBAAqB,CAAC,CAAC;AAAA,EACzF,IACA;AACN,QAAM,iBAAiB,UAAU,YAAY,WAAW,mBAAmB,IAAI;AAC/E,MAAI,kBAAkB,WAAW,kBAAkB,OAAO,eAAe,UAAU,YAAY;AAC7F,mBAAe,MAAM;AAAA,EACvB;AAEA,SAAO;AAAA,IACL,QAAQ,WAAW;AAAA,IACnB;AAAA,IACA,SAAS,MAAM;AACb,sBAAgB,oBAAoB,SAAS,2BAA2B;AACxE,UAAI,cAAe,cAAa,aAAa;AAC7C,UAAI,eAAgB,eAAc,cAAc;AAChD,sBAAgB;AAAA,IAClB;AAAA,EACF;AACF;AAEA,SAAS,YAAY,QAA8B;AACjD,SAAO,OAAO,UAAU,IAAI,MAAM,4CAA4C;AAChF;AAEA,SAAS,eAAe,QAA2B;AACjD,MAAI,OAAO,QAAS,OAAM,YAAY,MAAM;AAC9C;AAEA,eAAe,iBAAoB,SAAqB,QAAiC;AACvF,iBAAe,MAAM;AACrB,MAAI,sBAAsB,MAAY;AACtC,QAAM,eAAe,IAAI,QAAe,CAAC,UAAU,WAAW;AAC5D,UAAM,UAAU,MAAY,OAAO,YAAY,MAAM,CAAC;AACtD,0BAAsB,MAAM,OAAO,oBAAoB,SAAS,OAAO;AACvE,WAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAAA,EAC1D,CAAC;AACD,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK,CAAC,SAAS,YAAY,CAAC;AAAA,EACnD,UAAE;AACA,wBAAoB;AAAA,EACtB;AACF;AAIA,eAAe,aACb,SACA,WAC+B;AAC/B,MAAI,aAAa,EAAG,QAAO,EAAE,QAAQ,YAAY;AACjD,MAAI,QAA8C;AAClD,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK;AAAA,MACxB,QAAQ,KAAK,CAAC,WAAW,EAAE,QAAQ,aAAsB,MAAM,EAAE;AAAA,MACjE,IAAI,QAAiC,CAAC,YAAY;AAChD,gBAAQ,WAAW,MAAM,QAAQ,EAAE,QAAQ,YAAY,CAAC,GAAG,SAAS;AAAA,MACtE,CAAC;AAAA,IACH,CAAC;AAAA,EACH,UAAE;AACA,QAAI,MAAO,cAAa,KAAK;AAAA,EAC/B;AACF;AAEA,SAAS,cAAc,WAAiE;AACtF,MAAI,WAAW,uBAAuB,MAAM;AAC1C,WAAO;AAAA,EACT;AACA,SAAO,KAAK;AAAA,IACV;AAAA,IACA,KAAK,IAAI,2CAA2C,UAAU,sBAAsB,KAAK,IAAI,CAAC;AAAA,EAChG;AACF;AAEA,SAAS,YAAY,KAAuB;AAC1C,SAAO;AAAA,IACL,WAAW,IAAI;AAAA,IACf,aAAa,IAAI;AAAA,IACjB,WAAW;AAAA,IACX,aAAa,CAAC,YAAY,aAAa;AAAA,EACzC;AACF;AAEA,eAAe,mBAAmB,aAAiE;AACjG,MAAI,CAAC,YAAa,QAAO;AACzB,MAAI;AACF,UAAM;AAAA,MACJ,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,YAAY;AAAA,IACd;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAkBA,IAAM,+BAAqE;AAAA,EACzE,SAAS;AAAA,EACT,WAAW;AAAA,EACX,eAAe;AAAA,EACf,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,eAAe;AAAA,EACf,aAAa;AAAA,EACb,cAAc;AAAA,EACd,WAAW;AAAA,EACX,KAAK;AAAA,EACL,WAAW;AAAA,EACX,8BAA8B;AAAA,EAC9B,YAAY,MAAM,OAAO,WAAW;AACtC;AAaO,IAAM,uCAAN,cAAmD,MAAM;AAAA,EAG9D,YACW,gBACA,MACT;AACA;AAAA,MACE,4EAA4E,cAAc,QAAQ,IAAI;AAAA,IACxG;AALS;AACA;AAAA,EAKX;AAAA,EATS,OAAO;AAUlB;AAgBA,eAAsB,mCACpB,OAWA,KAIA,eAAqD,8BACzC;AAIZ,MAAI,CAAC,MAAM,SAAS,sCAAsC;AACxD,UAAM,IAAI,MAAM,wCAAwC;AAAA,EAC1D;AAEA,QAAM,WAAW,oBAAoB,aAAa,WAAW,CAAC;AAC9D,QAAM,qBAAqB,IAAI,gBAAgB;AAC/C,QAAM,SAAS,MAAM,WAAW,UAAU,mBAAmB;AAC7D,QAAM,oBAAoB,aAAa,6BAA6B,MAAM;AAC1E,QAAM,gBAAgB,kBAAkB,kBAAkB,KAAK,iBAAiB;AAChF,MAAI,gBAAkD;AACtD,MAAI,WAAW;AACf,MAAI,mBAAmB;AACvB,MAAI,gBAA+B;AACnC,MAAI,sBAA6D;AACjE,MAAI,uBAAuB;AAC3B,MAAI,uBAAkE;AAEtE,QAAM,qBAAqB,CAAC,WAAmB,eAAoC;AACjF,UAAM,cAAc,KAAK,6DAA6D;AAAA,MACpF;AAAA,MACA;AAAA,MACA;AAAA,MACA,OACE;AAAA,IACJ,CAAC;AAAA,EACH;AAEA,QAAM,qBAAqB,CACzB,WACA,YACA,UACS;AACT,UAAM,cAAc,KAAK,0DAA0D;AAAA,MACjF;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,CAAC;AAAA,EACH;AAEA,QAAM,8BAA8B,OAAO,eAAsC;AAC/E,QAAI,kBAAkB,KAAM;AAC5B,UAAM,eAAe;AAIrB,UAAM,UAAU,MAAM,QAAQ,WAAW;AAAA,MACvC,QAAQ,QAAQ,EAAE;AAAA,QAAK,MACrB,aAAa,aAAa,MAAM,IAAI;AAAA,UAClC,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,gBAAgB,MAAM;AAAA,UACtB,eAAe,eAAe;AAAA,UAC9B,oBAAoB;AAAA,QACtB,CAAC;AAAA,MACH;AAAA,MACA,QAAQ,QAAQ,EAAE;AAAA,QAAK,MACrB,aAAa,YAAY,MAAM,IAAI;AAAA,UACjC,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,gBAAgB,MAAM;AAAA,UACtB,eAAe;AAAA,QACjB,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AACD,eAAW,CAAC,OAAO,MAAM,KAAK,QAAQ,QAAQ,GAAG;AAC/C,UAAI,OAAO,WAAW,YAAY;AAChC;AAAA,UACE,UAAU,IAAI,mBAAmB;AAAA,UACjC;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,oBAAoB,OAAO,YAAyD;AACxF,QAAI,aAAa;AACjB,QAAI;AACF,mBAAa,MAAM,aAAa,UAAU,OAAO;AAAA,IACnD,SAAS,OAAO;AACd,yBAAmB,aAAa,QAAQ,YAAY,KAAK;AAAA,IAC3D;AACA,QAAI,CAAC,YAAY;AACf;AAAA,QACE;AAAA,QACA,QAAQ;AAAA,QACR,IAAI,MAAM,+EAA+E;AAAA,MAC3F;AACA,aAAO;AAAA,IACT;AACA,UAAM,4BAA4B,QAAQ,UAAU;AACpD,WAAO;AAAA,EACT;AAEA,MAAI;AACF,mBAAe,MAAM;AACrB,UAAM,QAAQ,MAAM,aAAa,QAAQ,MAAM,IAAI;AAAA,MACjD,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,gBAAgB,MAAM;AAAA,MACtB,MAAM;AAAA,MACN;AAAA,MACA,WAAW;AAAA,MACX,SAAS,MAAM,SAAS;AAAA,MACxB,OAAO,4BAA4B,MAAM,UAAU,MAAM,SAAS,cAAc;AAAA,MAChF,cAAc,MAAM;AAAA,MACpB,YAAY;AAAA,MACZ,mBAAmB;AAAA,MACnB,eAAe,iCAAiC,MAAM,QAAQ;AAAA,MAC9D,YAAY;AAAA,IACd,CAAC;AACD,eAAW;AACX,oBAAgB,MAAM,MAAM;AAC5B,0BAAsB,YAAY,MAAM;AACtC,WAAK,aACF,YAAY,MAAM,IAAI;AAAA,QACrB,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,gBAAgB,MAAM;AAAA,QACtB,MAAM;AAAA,QACN;AAAA,MACF,CAAC,EACA,MAAM,MAAM,MAAS;AAAA,IAC1B,GAAG,yCAAyC;AAC5C,QAAI,WAAW,uBAAuB,OAAO,oBAAoB,UAAU,YAAY;AACrF,0BAAoB,MAAM;AAAA,IAC5B;AACA,QAAI,MAAM,SAAS,WAAW;AAC5B,YAAM,IAAI,qCAAqC,MAAM,gBAAgB,MAAM,IAAI;AAAA,IACjF;AACA,uBAAmB;AAEnB,2BAAuB,QAAQ,QAAQ,EAAE;AAAA,MAAK,MAC5C,aAAa,UAAU,MAAM,UAAU,MAAM;AAAA,QAC3C,WAAW,GAAG,MAAM,eAAe,IAAI,QAAQ;AAAA,QAC/C,UAAU;AAAA,QACV,aAAa,CAAC;AAAA,QACd,kBAAkB,OAAO,YAAY;AAGnC,0BAAgB;AAChB,gBAAMC,eACJ,QAAQ,cAAc,UAAU,OAAO,MAAM,aAAa,UAAU,OAAO;AAC7E,gBAAM,WAAW,MAAM,aAAa,cAAc,MAAM,IAAI;AAAA,YAC1D,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,gBAAgB,MAAM;AAAA,YACtB,eAAe,MAAM,MAAM;AAAA,YAC3B,YAAY,QAAQ;AAAA,YACpB,iBAAiB,QAAQ;AAAA,YACzB,aAAAA;AAAA,YACA,YAAY;AAAA,YACZ,mBAAmB;AAAA,UACrB,CAAC;AACD,cAAI,CAAC,SAAS,UAAU;AACtB,kBAAM,IAAI,qCAAqC,MAAM,gBAAgB,QAAQ;AAAA,UAC/E;AAEA,cAAI,QAAQ,cAAc,WAAW,CAAC,OAAO,SAAS;AACpD,gBAAI;AACF,oBAAM;AAAA,gBACJ,aAAa,IAAI,MAAM,UAAU,QAAQ,YAAY;AAAA,kBACnD,SAAS,MAAM,MAAM;AAAA,kBACrB,aAAa,MAAM;AAAA,kBACnB,gBAAgB,MAAM;AAAA,gBACxB,CAAC;AAAA,gBACD;AAAA,cACF;AAAA,YACF,SAAS,OAAO;AACd,kBAAI,CAAC,OAAO,SAAS;AACnB,sBAAM,cAAc;AAAA,kBAClB;AAAA,kBACA;AAAA,oBACE;AAAA,oBACA,YAAY,QAAQ;AAAA,oBACpB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,kBAC9D;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAKA,cAAI,OAAO,SAAS;AAClB,kBAAM,kBAAkB,OAAO;AAC/B,kBAAM,YAAY,MAAM;AAAA,UAC1B;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AACA,SAAK,qBAAqB;AAAA,MACxB,MAAM;AACJ,+BAAuB;AAAA,MACzB;AAAA,MACA,MAAM;AACJ,+BAAuB;AAAA,MACzB;AAAA,IACF;AAIA,SAAK,qBAAqB,MAAM,MAAM,MAAS;AAC/C,UAAM,cAAc,MAAM,iBAAiB,sBAAsB,MAAM;AACvE,oBAAgB;AAChB,UAAM,iBAAiB,2BAA2B,WAAW,GAAG,MAAM;AACtE,UAAM,cACJ,YAAY,cAAc,UAAU,OAAO,MAAM,aAAa,UAAU,WAAW;AACrF,UAAM,YAAY,MAAM,aAAa,WAAW,MAAM,IAAI;AAAA,MACxD,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,gBAAgB,MAAM;AAAA,MACtB,eAAe,MAAM,MAAM;AAAA,MAC3B,YAAY,YAAY;AAAA,MACxB,cAAc;AAAA,MACd,iBAAiB,YAAY;AAAA,MAC7B;AAAA,MACA,YAAY;AAAA,IACd,CAAC;AACD,QAAI,CAAC,UAAU,aAAa,CAAC,UAAU,OAAO;AAC5C,YAAM,IAAI,qCAAqC,MAAM,gBAAgB,QAAQ;AAAA,IAC/E;AACA,UAAM,SAAS,MAAM,IAAI,aAAa;AAAA,MACpC;AAAA,MACA;AAAA,MACA,WAAW;AAAA,QACT,SAAS,UAAU,MAAM;AAAA,QACzB,YAAY,UAAU,MAAM;AAAA,QAC5B,qBAAqB,UAAU,MAAM;AAAA,QACrC,YAAY,YAAY;AAAA,MAC1B;AAAA,IACF,CAAC;AACD,mBAAe,MAAM;AACrB,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,OAAO,QAAS,OAAM,YAAY,MAAM;AAC5C,UAAM;AAAA,EACR,UAAE;AACA,QAAI,OAAO,WAAW,wBAAwB,CAAC,sBAAsB;AACnE,YAAM,oBAAoB,MAAM;AAAA,QAC9B,QAAQ,WAAW,CAAC,oBAAoB,CAAC;AAAA,QACzC,cAAc,MAAM,SAAS;AAAA,MAC/B;AACA,UAAI,kBAAkB,WAAW,aAAa;AAC5C,2BAAmB,yBAAyB,eAAe,cAAc,IAAI;AAAA,MAC/E;AAAA,IACF;AAEA,QAAI,qBAAqB;AACvB,oBAAc,mBAAmB;AACjC,4BAAsB;AAAA,IACxB;AAMA,sBAAkB,OAAO,OAAO,UAAU,YAAY,MAAM,IAAI,IAAI,MAAM,mBAAmB,CAAC;AAC9F,UAAM,aAAa,kBAAkB,kBAAkB;AACvD,SAAK,WAAW,MAAM,MAAM,MAAS;AACrC,UAAM,mBAAmB,MAAM,aAAa,YAAY,cAAc,MAAM,SAAS,CAAC;AACtF,QAAI,iBAAiB,WAAW,aAAa;AAC3C,yBAAmB,sBAAsB,eAAe,cAAc,IAAI;AAAA,IAC5E;AAEA,UAAM,kBAAkB,QAAQ,QAAQ,EAAE,KAAK,YAAY;AACzD,UAAI,CAAC,eAAe;AAMlB,YAAI,oBAAoB,kBAAkB,MAAM;AAC9C,gBAAM,aAAa,YAAY,MAAM,IAAI;AAAA,YACvC,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,gBAAgB,MAAM;AAAA,YACtB;AAAA,UACF,CAAC;AAAA,QACH;AACA,eAAO;AAAA,MACT;AACA,aAAO,MAAM,kBAAkB,aAAa;AAAA,IAC9C,CAAC;AACD,SAAK,gBAAgB,MAAM,MAAM,MAAS;AAC1C,UAAM,qBAAqB,MAAM;AAAA,MAC/B,QAAQ,WAAW,CAAC,eAAe,CAAC;AAAA,MACpC,cAAc,MAAM,SAAS;AAAA,IAC/B;AACA,QAAI,mBAAmB,WAAW,aAAa;AAC7C,yBAAmB,uBAAuB,eAAe,cAAc,IAAI;AAAA,IAC7E,WAAW,mBAAmB,MAAM,CAAC,GAAG,WAAW,YAAY;AAC7D;AAAA,QACE;AAAA,QACA,eAAe,cAAc;AAAA,QAC7B,mBAAmB,MAAM,CAAC,EAAE;AAAA,MAC9B;AAAA,IACF;AAKA,QAAI,UAAU;AACZ,YAAM,UAAU,QAAQ,QAAQ,EAAE;AAAA,QAAK,MACrC,aAAa,cAAc,MAAM,IAAI;AAAA,UACnC,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,gBAAgB,MAAM;AAAA,UACtB,MAAM;AAAA,UACN;AAAA,UACA,aAAa;AAAA,QACf,CAAC;AAAA,MACH;AACA,WAAK,QAAQ,MAAM,MAAM,MAAS;AAClC,YAAM,WAAW,MAAM;AAAA,QACrB,QAAQ,WAAW,CAAC,OAAO,CAAC;AAAA,QAC5B,cAAc,MAAM,SAAS;AAAA,MAC/B;AACA,UAAI,SAAS,WAAW,aAAa;AACnC,2BAAmB,kBAAkB,eAAe,cAAc,IAAI;AAAA,MACxE,WAAW,SAAS,MAAM,CAAC,GAAG,WAAW,YAAY;AACnD;AAAA,UACE;AAAA,UACA,eAAe,cAAc;AAAA,UAC7B,SAAS,MAAM,CAAC,EAAE;AAAA,QACpB;AAAA,MACF;AAAA,IACF;AAIA,mBAAe,MAAM;AAAA,EACvB;AACF;AAEA,eAAe,WACb,SACA,SACA,WACA,eACwB;AACxB,QAAM,OAAO;AAAA,IACX,KAAK;AAAA,IACL,SAAS;AAAA,IACT,OAAO;AAAA,IACP,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AACA,QAAM,SAAS,MAAM,cAAc,SAAS,IAAI;AAChD,SAAO;AAAA,IACL,UAAU,uBAAuB,MAAM;AAAA,IACvC,QAAQ,qBAAqB,MAAM;AAAA,EACrC;AACF;AAEA,eAAe,aACb,SACA,QACA,WACA,eACmC;AACnC,QAAM,UAAoC,CAAC;AAC3C,aAAW,SAAS,QAAQ;AAC1B,YAAQ,KAAK;AAAA,MACX,MAAM,MAAM;AAAA,MACZ,SAAS,MAAM;AAAA,MACf,GAAI,MAAM,WAAW,SAAS,MAAM,SAAS,WAAW,aAAa;AAAA,IACvE,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,QAAkC;AAC5D,MAAI,OAAO,SAAS,gBAAgB;AAClC,WAAO;AAAA,EACT;AACA,QAAM,UAAW,OAAO,QAAkC;AAC1D,SAAO,OAAO,YAAY,WAAW,UAAU;AACjD;AAEA,SAAS,0BAA0B,aAAyB,QAA+B;AACzF,MAAI,OAAO,SAAS,mBAAmB;AACrC,WAAO,EAAE,GAAG,aAAa,OAAO,MAAM,gBAAgB,CAAC,EAAE;AAAA,EAC3D;AACA,QAAM,UAAU,OAAO;AAOvB,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO;AAAA,IACP,aACE,QAAQ,gBAAgB,SACpB,YAAY,cACX,QAAQ;AAAA,IACf,QAAQ,MAAM,QAAQ,QAAQ,MAAM,IAC/B,QAAQ,SACT,YAAY;AAAA,IAChB,iBAAiB,MAAM,QAAQ,QAAQ,eAAe,IACjD,QAAQ,kBACT,YAAY;AAAA,IAChB,uBAAuB,MAAM,QAAQ,QAAQ,qBAAqB,IAC7D,QAAQ,wBACT,YAAY;AAAA,IAChB,WAAW,OAAO,QAAQ,cAAc,WAAW,QAAQ,YAAY,YAAY;AAAA,IACnF,gBAAgB,CAAC;AAAA,EACnB;AACF;AAEA,SAAS,iCACP,aACA,QACA,kBAC4B;AAC5B,MAAI,OAAO,SAAS,eAAgB,QAAO;AAC3C,QAAM,UAAU,mBAAmB,MAAM;AACzC,SAAO;AAAA,IACL,aAAa,UACT,sBAAsB,YAAY,aAAa,OAAO,IACtD,YAAY;AAAA,IAChB,QAAQ,YAAY;AAAA,IACpB,iBAAiB,YAAY;AAAA,IAC7B,uBAAuB,YAAY;AAAA,EACrC;AACF;AAEO,SAAS,qCACd,aACA,aAAa,iBACL;AACR,QAAM,EAAE,QAAQ,eAAe,IAAI,8BAA8B,aAAa,UAAU;AACxF,SAAO,aAAa,cAAc,eAAe,MAAM;AACzD;AAEA,SAAS,8BACP,aACA,aAAa,iBAC+B;AAC5C,MAAI,CAAC,yBAAyB,KAAK,WAAW,GAAG;AAC/C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,wBAAwB,KAAK,UAAU,GAAG;AAC7C,UAAM,IAAI,MAAM,6EAA6E;AAAA,EAC/F;AACA,QAAM,iBAAiB,WAAW,QAAQ,SAAS,EAAE,KAAK;AAC1D,QAAM,SAAS,GAAG,mBAAmB,MAAM,KAAK,cAAc,sBAAsB,YAAY,MAAM,UAAU,MAAM,CAAC;AACvH,SAAO,EAAE,QAAQ,eAAe;AAClC;AAOA,IAAM,8CAAoF;AAAA,EACxF,iBAAiB;AAAA,EACjB,KAAK,MAAM,oBAAI,KAAK;AACtB;AAGA,eAAsB,+BACpB,OAcA,eAAqD,6CACpC;AACjB,QAAM,EAAE,OAAO,IAAI,8BAA8B,MAAM,WAAW;AAClE,QAAM,aAAa;AAAA,IACjB;AAAA,MACE,UAAU;AAAA,QACR,GAAG,MAAM;AAAA,QACT,cAAc,MAAM;AAAA;AAAA;AAAA,QAGpB,2BAA2B;AAAA,MAC7B;AAAA,MACA,IAAI,MAAM;AAAA,MACV,eAAe,MAAM;AAAA,MACrB,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,gBAAgB,MAAM;AAAA,MACtB,cAAc,MAAM;AAAA,MACpB,iBAAiB,MAAM;AAAA,MACvB,WAAW,MAAM;AAAA,IACnB;AAAA,IACA,OAAO,aAAa,eAAe;AACjC,YAAM,eAAe,MAAM;AAAA,QACzB,YAAY;AAAA,QACZ,YAAY,MAAM;AAAA,QAClB,MAAM,SAAS;AAAA,QACf,WAAW;AAAA,MACb;AACA,UAAI,aAAa,aAAa,GAAG;AAC/B,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,iBAAW,SAAS,6BAA6B,MAAM,QAAQ,GAAG;AAChE,cAAM,SAAS,MAAM;AAAA,UACnB,YAAY;AAAA,UACZ,MAAM;AAAA,UACN,MAAM,SAAS;AAAA,UACf,WAAW;AAAA,QACb;AACA,YAAI,OAAO,aAAa,GAAG;AACzB,gBAAM,IAAI;AAAA,YACR,wDAAwD,KAAK,UAAU,MAAM,IAAI,CAAC,KAAK,OAAO,OAAO,MAAM,IAAK,CAAC;AAAA,UACnH;AAAA,QACF;AAAA,MACF;AACA,iBAAW,SAAS,MAAM,QAAQ;AAChC,cAAM,SAAS,MAAM;AAAA,UACnB,YAAY;AAAA,UACZ,MAAM;AAAA,UACN,MAAM,SAAS;AAAA,UACf,WAAW;AAAA,QACb;AACA,YAAI,OAAO,aAAa,GAAG;AACzB,gBAAM,IAAI;AAAA,YACR,qCAAqC,KAAK,UAAU,MAAM,IAAI,CAAC,KAAK,OAAO,OAAO,MAAM,IAAK,CAAC;AAAA,UAChG;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,aAAa,IAAI,EAAE,YAAY;AACxC;AAEA,eAAsB,8BAA8B,OAatB;AAC5B,QAAM,UAAU,MAAM,SAAS;AAC/B,QAAM,wBAAwB,oCAAoC,OAAO;AACzE,QAAM,cAAc,4BAA4B,MAAM,UAAU,OAAO;AACvE,QAAM,cAAc,4BAA4B;AAAA,IAC9C;AAAA,IACA;AAAA,IACA,YAAY,MAAM;AAAA,EACpB,CAAC;AACD,QAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,MAAI,WAA6B;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA,IACV,QAAQ;AAAA,IACR;AAAA,IACA,WAAW,0BAA0B,MAAM,UAAU;AAAA,IACrD;AAAA,IACA,gBAAgB,+BAA+B;AAAA,MAC7C,UAAU,MAAM,OAAO;AAAA,MACvB;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,SAAS;AAAA,IACT,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,wBAAwB;AAAA,IACxB,YAAY;AAAA,MACV,MAAM;AAAA,MACN,YAAY,MAAM,OAAO;AAAA,MACzB,UAAU,MAAM,OAAO;AAAA,IACzB;AAAA,IACA;AAAA,IACA,YAAY;AAAA,IACZ,OAAO;AAAA,EACT;AAEA,MAAI,MAAM,mBAAmB;AAC3B,UAAM,QAAQ,MAAM,kCAAkC,MAAM,IAAI;AAAA,MAC9D,aAAa,MAAM;AAAA,MACnB,WAAW,MAAM;AAAA,MACjB,OAAO;AAAA,MACP,cAAc;AAAA,MACd,kBAAkB;AAAA,IACpB,CAAC;AACD,QACE,MAAM,WAAW,WACjB,MAAM,WAAW,iBACjB,MAAM,WAAW,eACjB;AACA,aAAO,MAAM;AAAA,IACf;AACA,QAAI,MAAM,WAAW,YAAY;AAC/B,aAAO;AAAA,QACL,GAAG;AAAA,QACH,QAAQ;AAAA,QACR,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,QACnC,OAAO;AAAA,UACL,MAAM;AAAA,UACN,SACE;AAAA,UACF,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AACA,eAAW,MAAM;AAAA,EACnB;AAEA,QAAM,WAAW,OAAO,UAAuD;AAC7E,QAAI,MAAM,mBAAmB;AAC3B,YAAM,YAAY,MAAM,qCAAqC,MAAM,IAAI;AAAA,QACrE,aAAa,MAAM;AAAA,QACnB,WAAW,MAAM;AAAA,QACjB;AAAA,MACF,CAAC;AACD,UAAI,CAAC,WAAW;AACd,YAAI,MAAM,YAAY;AACpB,gBAAM,2CAA2C,MAAM,IAAI;AAAA,YACzD,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,YAAY,MAAM;AAAA,YAClB,QAAQ;AAAA,UACV,CAAC,EAAE,MAAM,MAAM,KAAK;AAAA,QACtB;AACA,eAAO;AAAA,UACL,GAAG;AAAA,UACH,QAAQ;AAAA,UACR,SAAS;AAAA,UACT,aAAa;AAAA,UACb,YAAY;AAAA,UACZ,wBAAwB;AAAA,UACxB,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,UACnC,OAAO;AAAA,YACL,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,uBAAuB;AAC1B,WAAO,MAAM,SAAS;AAAA,MACpB,GAAG;AAAA,MACH,QAAQ;AAAA,MACR,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,MACnC,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,mBAAmB,OAAO;AAAA,QACnC,WAAW;AAAA,MACb;AAAA,IACF,CAAC;AAAA,EACH;AAEA,iBAAe,MAAM,MAAM;AAC3B,MAAI,gBAGO;AACX,MAAI,aAA4B;AAChC,MAAI,sBAAqC;AACzC,MAAI;AACF,UAAM,QAAQ,MAAM,4BAA4B;AAAA,MAC9C;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,SAAS,MAAM,YAAY;AAAA,MAC3B,WAAW,SAAS;AAAA,MACpB,WAAW,MAAM,SAAS;AAAA,IAC5B,CAAC;AACD,QAAI,CAAC,SAAU,CAAC,MAAM,WAAW,CAAC,MAAM,aAAc;AACpD,YAAM,IAAI,MAAM,6DAA6D;AAAA,IAC/E;AACA,QAAI,YAAY,SAAS;AACvB,UAAI,CAAC,MAAM,WAAW,CAAC,MAAM,sBAAsB,CAAC,MAAM,iBAAiB;AACzE,cAAM,IAAI,MAAM,mEAAmE;AAAA,MACrF;AACA,sBAAgB;AAAA,QACd,SAAS,MAAM;AAAA,QACf,oBAAoB,MAAM;AAAA,MAC5B;AACA,YAAM,eAAe,wBAAwB;AAAA,QAC3C,UAAU;AAAA,QACV,YAAY,MAAM;AAAA,QAClB,sBAAsB;AAAA,MACxB,CAAC;AACD,YAAM,aAAa,8BAA8B,YAAY;AAC7D,UAAI,CAAC,YAAY;AACf,cAAM,IAAI,MAAM,kEAAkE;AAAA,MACpF;AACA,YAAM,WAAW,MAAM,kCAAkC,MAAM,IAAI;AAAA,QACjE,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,gBAAgB,MAAM,OAAO;AAAA,QAC7B,eAAe,MAAM,UAAU;AAAA,QAC/B,kBAAkB,MAAM,UAAU;AAAA,QAClC,kBAAkB,MAAM,UAAU;AAAA,QAClC,2BAA2B,MAAM,UAAU;AAAA,QAC3C,oBAAoB,MAAM;AAAA,QAC1B,iBAAiB,MAAM;AAAA,QACvB,kBAAkB,OAAO,KAAK,YAAY,EAAE,SAAS,QAAQ;AAAA,QAC7D,sBAAsB;AAAA,QACtB,sBAAsB;AAAA,MACxB,CAAC;AACD,mBAAa,SAAS;AAKtB,4BAAsB,MAAM,+BAA+B;AAAA,QACzD,UAAU,MAAM;AAAA,QAChB,IAAI,MAAM;AAAA,QACV,eAAe,MAAM;AAAA,QACrB,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,gBAAgB,SAAS;AAAA,QACzB,cAAc,MAAM,OAAO;AAAA,QAC3B,iBAAiB,sBAAsB,MAAM,OAAO,EAAE;AAAA,QACtD,SAAS,MAAM;AAAA,QACf;AAAA,QACA,QAAQ,MAAM,WAAW;AAAA,QACzB,WAAW,MAAM;AAAA,MACnB,CAAC;AAAA,IACH;AACA,QAAI,CAAC,qBAAqB;AACxB,YAAM,IAAI,MAAM,GAAG,OAAO,8DAA8D;AAAA,IAC1F;AACA,QAAI,MAAM,OAAO,SAAS;AACxB,UAAI,YAAY;AACd,cAAM,2CAA2C,MAAM,IAAI;AAAA,UACzD,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB;AAAA,UACA,QAAQ;AAAA,QACV,CAAC,EAAE,MAAM,MAAM,KAAK;AAAA,MACtB;AACA,YAAM,YAAY,MAAM,MAAM;AAAA,IAChC;AACA,WAAO,MAAM,SAAS;AAAA,MACpB,GAAG;AAAA,MACH,UAAU,MAAM;AAAA,MAChB,QAAQ;AAAA,MACR,SAAS,MAAM;AAAA,MACf,aAAa,MAAM;AAAA,MACnB;AAAA,MACA,wBAAwB,MAAM,qBAC1B,uCAAuC,MAAM,kBAAkB,IAC/D;AAAA,MACJ,oBAAoB;AAAA,QAClB,SAAS;AAAA,QACT,WAAW;AAAA,MACb;AAAA,MACA,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,MACnC,OAAO;AAAA,IACT,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,MAAM,OAAO,QAAS,OAAM,YAAY,MAAM,MAAM;AACxD,QAAI,YAAY;AACd,YAAM,2CAA2C,MAAM,IAAI;AAAA,QACzD,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB;AAAA,QACA,QAAQ;AAAA,MACV,CAAC,EAAE,MAAM,MAAM,KAAK;AAAA,IACtB,WACE,YAAY,WACZ,iBACA,EAAE,iBAAiB,qDACnB;AACA,YAAM;AAAA,QACJ,MAAM;AAAA,QACN,cAAc;AAAA,QACd,cAAc;AAAA,MAChB,EAAE,MAAM,MAAM,WAAoB;AAAA,IACpC;AACA,UAAM,WAAW,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,MAAM,GAAG,GAAI;AACtF,WAAO,MAAM,SAAS;AAAA,MACpB,GAAG;AAAA,MACH,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,MACnC,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,WAAW;AAAA,QACpB,WAAW;AAAA,MACb;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEO,SAAS,2BACd,UACA,UACqC;AAGrC,OAAK;AACL,SAAO;AACT;AAEA,eAAe,iBACb,IACA,aACA,UACmE;AACnE,QAAM,SAAS,MAAM,aAAa,IAAI,aAAa,QAAQ;AAC3D,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,yCAAyC,QAAQ,EAAE;AAAA,EACrE;AACA,QAAM,MAAM,MAAM,OAAO,IAAI,aAAa,OAAO,KAAK;AACtD,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,6CAA6C,OAAO,KAAK,EAAE;AAAA,EAC7E;AACA,MAAI,CAAC,OAAO,eAAe;AACzB,UAAM,IAAI,MAAM,8BAA8B,OAAO,EAAE,sBAAsB;AAAA,EAC/E;AACA,QAAM,cAAc,MAAM,kBAAkB,IAAI,aAAa,OAAO,aAAa;AACjF,MAAI,CAAC,eAAe,YAAY,UAAU,IAAI,IAAI;AAChD,UAAM,IAAI,MAAM,+CAA+C,OAAO,aAAa,EAAE;AAAA,EACvF;AACA,SAAO,EAAE,KAAK,aAAa,OAAO;AACpC;AAEA,eAAe,kBACb,IACA,aACA,WAC4C;AAC5C,QAAM,UAAU,MAAM,kBAAkB,IAAI,aAAa,SAAS;AAClE,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,0CAA0C,SAAS,EAAE;AAAA,EACvE;AACA,QAAM,MAAM,MAAM,OAAO,IAAI,aAAa,QAAQ,KAAK;AACvD,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,8CAA8C,QAAQ,KAAK,EAAE;AAAA,EAC/E;AACA,SAAO,EAAE,KAAK,QAAQ;AACxB;AAEA,eAAe,qCACb,KACY;AAIZ,QAAM,YAAY,uCAAuC;AACzD,MAAI;AACF,mBAAe,UAAU,MAAM;AAC/B,WAAO,MAAM,IAAI,SAAS;AAAA,EAC5B,UAAE;AACA,cAAU,QAAQ;AAAA,EACpB;AACF;AAEO,SAAS,gCAAgC,UAAkD;AAChG,SAAO;AAAA,IACL,iBAAiB,CAAC,UAChB,qCAAqC,OAAO,cAAc;AACxD,YAAM,EAAE,UAAU,IAAI,cAAc,IAAI,MAAM,SAAS;AACvD,qBAAe,UAAU,MAAM;AAC/B,YAAM,EAAE,KAAK,aAAa,OAAO,IAAI,MAAM;AAAA,QACzC;AAAA,QACA,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AACA,YAAM,QAAQ,YAAY,GAAG;AAC7B,YAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,YAAM,kCAAkC,IAAI,MAAM,aAAa,OAAO,IAAI;AAAA,QACxE;AAAA,QACA,uBAAuB;AAAA,MACzB,CAAC;AACD,YAAM,oBAAoB,IAAI;AAAA,QAC5B;AAAA,QACA,QAAQ;AAAA,QACR,OAAO,IAAI;AAAA,QACX,UAAU,EAAE,UAAU,OAAO,GAAG;AAAA,MAClC,CAAC;AAED,YAAM,eAAwC,EAAE,WAAW,cAAc,CAAC,EAAE;AAC5E,UAAI;AACF,cAAM,mBAAmB,0BAA0B,aAAa,MAAM;AACtE,cAAM,0BAA0B;AAAA,UAC9B;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA,cAAM,cAAc,2BAA2B,UAAU,iBAAiB,KAAK;AAC/E,cAAM,2BAA2B,4BAA4B;AAAA,UAC3D,SAAS,YAAY;AAAA,UACrB,aAAa,4BAA4B,aAAa,YAAY,cAAc;AAAA,UAChF,YAAY;AAAA,QACd,CAAC;AACD,eAAO,MAAM;AAAA,UACX;AAAA,YACE,UAAU;AAAA,YACV;AAAA,YACA;AAAA,YACA,WAAW,IAAI;AAAA,YACf,aAAa,MAAM;AAAA,YACnB,gBAAgB,OAAO;AAAA,YACvB,cAAc,iBAAiB;AAAA,YAC/B,iBAAiB,oBAAoB,OAAO,EAAE;AAAA,YAC9C;AAAA,UACF;AAAA,UACA,OAAO,aAAa,eAAe;AACjC,iBAAK,iBAAiB,eAAe,IAAI,KAAK,GAAG;AAC/C,oBAAM,gBAAgB,YAAY,SAAkB;AAAA,gBAClD,aAAa,CAAC;AAAA,gBACd,OAAO;AAAA,gBACP,eAAe,WAAW;AAAA,gBAC1B,UAAU;AAAA,kBACR,OAAO,IAAI;AAAA,kBACX,SAAS,IAAI;AAAA,kBACb,WAAW,iBAAiB;AAAA,kBAC5B,QAAQ,iBAAiB,eAAe;AAAA,kBACxC,WAAW,SAAS;AAAA,kBACpB,aAAa;AAAA,gBACf;AAAA,cACF,CAAC;AACD,2BAAa,cAAc,EAAE,UAAU,GAAG,QAAQ,GAAG;AAAA,YACvD;AACA,kBAAM,UAAU,mBAAmB,MAAM;AACzC,gBAAI,SAAS;AACX,oBAAM,gBAAgB,MAAM;AAAA,gBAC1B,YAAY;AAAA,gBACZ;AAAA,gBACA,SAAS;AAAA,gBACT,WAAW;AAAA,cACb;AACA,2BAAa,gBAAgB;AAC7B,kBAAI,cAAc,aAAa,GAAG;AAChC,6BAAa,cAAa,oBAAI,KAAK,GAAE,YAAY;AACjD,6BAAa,SAAS;AACtB,sBAAMC,WAAU,MAAM,sBAAsB,IAAI,MAAM,aAAa,OAAO,IAAI;AAAA,kBAC5E,QAAQ;AAAA,kBACR;AAAA,gBACF,CAAC;AACD,sBAAM,oBAAoB,IAAI;AAAA,kBAC5B;AAAA,kBACA,QAAQ;AAAA,kBACR,OAAO,IAAI;AAAA,kBACX,UAAU,EAAE,UAAU,OAAO,IAAI,QAAQ,WAAW;AAAA,gBACtD,CAAC;AACD,sBAAM,oBAAoB,IAAI;AAAA,kBAC5B;AAAA,kBACA,QAAQ;AAAA,kBACR,OAAO,IAAI;AAAA,kBACX,UAAU,EAAE,UAAU,OAAO,GAAG;AAAA,gBAClC,CAAC;AACD,uBAAOA;AAAA,cACT;AAAA,YACF;AACA,kBAAM,eAAe,MAAM;AAAA,cACzB,YAAY;AAAA,cACZ,qCAAqC,wBAAwB;AAAA,cAC7D,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AACA,gBAAI,aAAa,aAAa,GAAG;AAC/B,oBAAM,IAAI;AAAA,gBACR,qEAAqE,aAAa,OAAO,MAAM,IAAK,CAAC;AAAA,cACvG;AAAA,YACF;AACA,kBAAM,uBAAuB,MAAM;AAAA,cACjC,YAAY;AAAA,cACZ,6BAA6B,WAAW;AAAA,cACxC,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AACA,yBAAa,uBAAuB;AACpC,kBAAM,eAAe,MAAM;AAAA,cACzB,YAAY;AAAA,cACZ,iBAAiB;AAAA,cACjB,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AACA,yBAAa,eAAe;AAC5B,kBAAM,SACJ,qBAAqB,MAAM,CAAC,WAAW,OAAO,aAAa,CAAC,KAC5D,aAAa,MAAM,CAAC,WAAW,OAAO,aAAa,CAAC;AACtD,gBAAI,QAAQ;AACV,2BAAa,gBAAgB,MAAM,8BAA8B;AAAA,gBAC/D,UAAU;AAAA,gBACV;AAAA,gBACA;AAAA,gBACA,WAAW,IAAI;AAAA,gBACf,aAAa,MAAM;AAAA,gBACnB,YAAY;AAAA,gBACZ,QAAQ,EAAE,MAAM,UAAU,IAAI,OAAO,GAAG;AAAA,gBACxC;AAAA,gBACA,WAAW,WAAW;AAAA,gBACtB;AAAA,gBACA,QAAQ,WAAW;AAAA,cACrB,CAAC;AAAA,YACH;AACA,yBAAa,cAAa,oBAAI,KAAK,GAAE,YAAY;AACjD,yBAAa,SAAS;AACtB,kBAAM,aAAa,+BAA+B,EAAE,MAAM,OAAO,MAAM,OAAO,CAAC;AAC/E,gBAAI,WAAW,WAAW,gBAAgB;AAMxC,oBAAM,sBAAsB,IAAI,MAAM,aAAa,OAAO,IAAI;AAAA,gBAC5D,QAAQ;AAAA,gBACR;AAAA,cACF,CAAC;AACD,oBAAM,EAAE,QAAQ,OAAO,IAAI,MAAM,yBAAyB,EAAE,GAAG,GAAG,OAAO,KAAK;AAAA,gBAC5E,GAAG;AAAA,gBACH;AAAA,cACF,CAAC;AACD,oBAAM,oBAAoB,IAAI;AAAA,gBAC5B;AAAA,gBACA,QAAQ;AAAA,gBACR,OAAO,IAAI;AAAA,gBACX,UAAU,EAAE,UAAU,OAAO,GAAG;AAAA,cAClC,CAAC;AACD,qBAAO;AAAA,YACT;AACA,kBAAM,UAAU,MAAM,sBAAsB,IAAI,MAAM,aAAa,OAAO,IAAI;AAAA,cAC5E,QAAQ,WAAW;AAAA,cACnB;AAAA,YACF,CAAC;AACD,kBAAM,oBAAoB,IAAI;AAAA,cAC5B;AAAA,cACA,QAAQ,SAAS,4BAA4B;AAAA,cAC7C,OAAO,IAAI;AAAA,cACX,UAAU,EAAE,UAAU,OAAO,IAAI,QAAQ,WAAW,OAAO;AAAA,YAC7D,CAAC;AACD,gBAAI,CAAC,QAAQ;AACX,oBAAM,oBAAoB,IAAI;AAAA,gBAC5B;AAAA,gBACA,QAAQ;AAAA,gBACR,OAAO,IAAI;AAAA,gBACX,UAAU,EAAE,UAAU,OAAO,GAAG;AAAA,cAClC,CAAC;AAAA,YACH;AACA,mBAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF,SAAS,OAAO;AACd,qBAAa,cAAa,oBAAI,KAAK,GAAE,YAAY;AACjD,qBAAa,SAAS;AACtB,qBAAa,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC1E,cAAM,UAAU,MAAM,sBAAsB,IAAI,MAAM,aAAa,OAAO,IAAI;AAAA,UAC5E,QAAQ;AAAA,UACR;AAAA,QACF,CAAC;AACD,cAAM,oBAAoB,IAAI;AAAA,UAC5B;AAAA,UACA,QAAQ;AAAA,UACR,OAAO,IAAI;AAAA,UACX,UAAU,EAAE,UAAU,OAAO,IAAI,QAAQ,SAAS;AAAA,QACpD,CAAC;AACD,cAAM,oBAAoB,IAAI;AAAA,UAC5B;AAAA,UACA,QAAQ;AAAA,UACR,OAAO,IAAI;AAAA,UACX,UAAU,EAAE,UAAU,OAAO,GAAG;AAAA,QAClC,CAAC;AACD,YAAI,UAAU,OAAO,QAAS,OAAM,YAAY,UAAU,MAAM;AAChE,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,IAEH,kBAAkB,CAAC,UACjB,qCAAqC,OAAO,cAAc;AACxD,YAAM,EAAE,UAAU,IAAI,cAAc,IAAI,MAAM,SAAS;AACvD,qBAAe,UAAU,MAAM;AAC/B,YAAM,EAAE,KAAK,QAAQ,IAAI,MAAM,kBAAkB,IAAI,MAAM,aAAa,MAAM,SAAS;AACvF,YAAM,QAAQ,YAAY,GAAG;AAC7B,YAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,YAAM,oBAAoB,IAAI;AAAA,QAC5B;AAAA,QACA,QAAQ;AAAA,QACR,OAAO,IAAI;AAAA,QACX,UAAU,EAAE,WAAW,QAAQ,GAAG;AAAA,MACpC,CAAC;AACD,UAAI;AACF,cAAM,cAAc,2BAA2B,UAAU,QAAQ,KAAK;AACtE,cAAM,2BAA2B,4BAA4B;AAAA,UAC3D,SAAS,YAAY;AAAA,UACrB,aAAa,4BAA4B,aAAa,YAAY,cAAc;AAAA,UAChF,YAAY;AAAA,QACd,CAAC;AACD,eAAO,MAAM;AAAA,UACX;AAAA,YACE,UAAU;AAAA,YACV;AAAA,YACA;AAAA,YACA,WAAW,IAAI;AAAA,YACf,aAAa,MAAM;AAAA,YACnB,gBAAgB,QAAQ;AAAA,YACxB,cAAc,QAAQ;AAAA,YACtB,iBAAiB,4BAA4B,QAAQ,EAAE;AAAA,YACvD;AAAA,UACF;AAAA,UACA,OAAO,aAAa,eAAe;AACjC,iBAAK,QAAQ,eAAe,IAAI,KAAK,GAAG;AACtC,oBAAM,gBAAgB,YAAY,SAAkB;AAAA,gBAClD,aAAa,CAAC;AAAA,gBACd,OAAO;AAAA,gBACP,eAAe,WAAW;AAAA,gBAC1B,UAAU;AAAA,kBACR,OAAO,IAAI;AAAA,kBACX,SAAS,IAAI;AAAA,kBACb,WAAW,QAAQ;AAAA,kBACnB,QAAQ,QAAQ,eAAe;AAAA,kBAC/B,WAAW,SAAS;AAAA,kBACpB,aAAa;AAAA,gBACf;AAAA,cACF,CAAC;AAAA,YACH;AACA,kBAAM,eAAe,MAAM;AAAA,cACzB,YAAY;AAAA,cACZ,qCAAqC,wBAAwB;AAAA,cAC7D,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AACA,gBAAI,aAAa,aAAa,GAAG;AAC/B,oBAAM,IAAI;AAAA,gBACR,qEAAqE,aAAa,OAAO,MAAM,IAAK,CAAC;AAAA,cACvG;AAAA,YACF;AACA,kBAAM,uBAAuB,MAAM;AAAA,cACjC,YAAY;AAAA,cACZ,6BAA6B,WAAW;AAAA,cACxC,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AACA,kBAAM,eAAe,MAAM;AAAA,cACzB,YAAY;AAAA,cACZ,QAAQ;AAAA,cACR,SAAS;AAAA,cACT,WAAW;AAAA,YACb;AACA,kBAAM,SACJ,qBAAqB,MAAM,CAAC,WAAW,OAAO,aAAa,CAAC,KAC5D,aAAa,MAAM,CAAC,WAAW,OAAO,aAAa,CAAC;AACtD,kBAAM,gBAAgB,SAClB,MAAM,8BAA8B;AAAA,cAClC,UAAU;AAAA,cACV;AAAA,cACA;AAAA,cACA,WAAW,IAAI;AAAA,cACf,aAAa,MAAM;AAAA,cACnB,mBAAmB,QAAQ;AAAA,cAC3B,YAAY;AAAA,cACZ,QAAQ,EAAE,MAAM,WAAW,IAAI,QAAQ,GAAG;AAAA,cAC1C;AAAA,cACA,WAAW,WAAW;AAAA,cACtB;AAAA,cACA,QAAQ,WAAW;AAAA,YACrB,CAAC,IACD;AACJ,kBAAM,oBAAoB,IAAI;AAAA,cAC5B;AAAA,cACA,QAAQ,SAAS,4BAA4B;AAAA,cAC7C,OAAO,IAAI;AAAA,cACX,UAAU;AAAA,gBACR,WAAW,QAAQ;AAAA,gBACnB;AAAA,gBACA,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,gBACnC;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,cACF;AAAA,YACF,CAAC;AACD,mBAAO;AAAA,cACL,WAAW,QAAQ;AAAA,cACnB;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,OAAO;AAKd,cAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpE,cAAM,oBAAoB,IAAI;AAAA,UAC5B;AAAA,UACA,QAAQ;AAAA,UACR,OAAO,IAAI;AAAA,UACX,UAAU;AAAA,YACR,WAAW,QAAQ;AAAA,YACnB;AAAA,YACA,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,YACnC,QAAQ;AAAA,YACR,OAAO;AAAA,UACT;AAAA,QACF,CAAC;AACD,cAAM;AAAA,MACR;AAAA,IACF,CAAC;AAAA,EACL;AACF;;;ACjqDA,SAAS,8DAA8D;AACvE;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,0CAA0C;AACnD,SAAS,6CAA6C;AACtD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAMK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA,mCAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,uCAAAC;AAAA,EACA,sCAAAC;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,oBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA,oBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,mCAAmC;AAC5C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA,gCAAAC;AAAA,EACA;AAAA,OACK;AACP,SAAS,eAAe;AACxB,SAAS,cAAAC,mBAAkB;;;ACpH3B,SAAS,kBAAkB;AAE3B,IAAM,8BAA8B;AACpC,IAAM,sBAAsB;AAC5B,IAAM,qBAAqB;AAC3B,IAAM,wBAAwB;AAC9B,IAAM,aAAa;AACnB,IAAM,sBAAsB;AAC5B,IAAM,wBAAwB;AAC9B,IAAM,mBACJ;AAsBK,SAAS,mDAAmD,OAIxD;AACT,QAAM,SAAS,WAAW,QAAQ,EAC/B;AAAA,IACC,KAAK,UAAU;AAAA,MACb,SAAS;AAAA,MACT,eAAe,MAAM,WAAW;AAAA,MAChC,uBAAuB,MAAM;AAAA,MAC7B,qBAAqB,MAAM;AAAA,IAC7B,CAAC;AAAA,EACH,EACC,OAAO,KAAK;AACf,SAAO,iCAAiC,MAAM;AAChD;AAOO,SAAS,iCAAiC,OAIL;AAC1C,QAAM,kBAAkB,cAAc,MAAM,iBAAiB,2BAA2B;AACxF,MAAI,CAAC,gBAAiB,QAAO;AAE7B,QAAM,QAAQ,OAAO,MAAM,SAAS,KAAK;AACzC,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,SAAS,MAAM;AACrB,MAAI,WAAW,YAAY,WAAW,WAAY,QAAO;AAEzD,QAAM,WAAW,mBAAmB,MAAM,QAAQ;AAClD,QAAM,cAAc,cAAc,MAAM,aAAa,qBAAqB;AAC1E,QAAM,SAAS,gBAAgB,MAAM,MAAM;AAC3C,MAAI,CAAC,YAAY,CAAC,eAAe,CAAC,OAAQ,QAAO;AAEjD,QAAM,WAAW;AAAA,IACf,MAAM,YAAY,MAAM,SAAS,iBAAiB,MAAM,SAAS,YAAY;AAAA,IAC7E;AAAA,EACF;AACA,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,SAAS,WAAW,QAAQ,EAC/B;AAAA,IACC,KAAK,UAAU;AAAA,MACb,SAAS;AAAA,MACT,aAAa,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,EACC,OAAO,KAAK;AACf,SAAO;AAAA,IACL;AAAA,IACA,6BAA6B,iCAAiC,MAAM;AAAA,IACpE,QAAQ,OAAO,YAAY,MAAM;AAAA,EACnC;AACF;AAEA,SAAS,OAAO,OAAgD;AAC9D,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IACrE,QACD;AACN;AAEA,SAAS,cAAc,OAAgB,UAAiC;AACtE,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,aAAa,MAAM,KAAK;AAC9B,MAAI,CAAC,cAAc,OAAO,WAAW,YAAY,MAAM,IAAI,SAAU,QAAO;AAC5E,SAAO;AACT;AAEA,SAAS,mBAAmB,OAA+B;AACzD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,WAAW,OAAO,WAAW,SAAS,MAAM,IAAI,oBAAqB,QAAO;AACjF,QAAM,QAAQ,iBAAiB,KAAK,OAAO;AAC3C,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AACJ,QAAM,OAAO,OAAO,QAAQ;AAC5B,QAAM,QAAQ,OAAO,SAAS;AAC9B,QAAM,MAAM,OAAO,OAAO;AAC1B,QAAM,OAAO,OAAO,QAAQ;AAC5B,QAAM,SAAS,OAAO,UAAU;AAChC,QAAM,SAAS,eAAe,SAAY,IAAI,OAAO,UAAU;AAC/D,QAAM,aAAa,mBAAmB,SAAY,IAAI,OAAO,cAAc;AAC3E,QAAM,eAAe,qBAAqB,SAAY,IAAI,OAAO,gBAAgB;AACjF,QAAM,WAAW,OAAO,MAAM,MAAM,OAAO,QAAQ,KAAK,OAAO,QAAQ;AACvE,QAAM,cAAc,CAAC,IAAI,WAAW,KAAK,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;AACnF,MACE,QAAQ,KACR,QAAQ,MACR,MAAM,KACN,MAAM,YAAY,QAAQ,CAAC,KAC3B,OAAO,MACP,SAAS,MACT,SAAS,MACT,aAAa,MACb,eAAe,IACf;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAAS,IAAI,KAAK,OAAO;AAC/B,SAAO,OAAO,SAAS,OAAO,QAAQ,CAAC,IAAI,UAAU;AACvD;AAEA,SAAS,gBAAgB,OAAyD;AAChF,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,UAAU,OAAO,QAAQ,MAAM;AACrC,MAAI,QAAQ,WAAW,KAAK,QAAQ,SAAS,WAAY,QAAO;AAChE,QAAM,YAA8C,CAAC;AACrD,aAAW,CAAC,KAAK,QAAQ,KAAK,SAAS;AACrC,QACE,CAAC,OACD,OAAO,WAAW,KAAK,MAAM,IAAI,uBACjC,OAAO,aAAa,YACpB,OAAO,WAAW,UAAU,MAAM,IAAI,uBACtC;AACA,aAAO;AAAA,IACT;AACA,cAAU,KAAK,CAAC,KAAK,QAAQ,CAAC;AAAA,EAChC;AACA,SAAO,UAAU,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAO,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI,CAAE;AACvF;;;ADzBO,SAAS,gCACd,QACA,OACA,oBACuB;AACvB,SAAO,uBAAuB,qBAC3B,MAAM,gBAAgB,eAAe,MAAM,0BAA0B,oBACpE,EAAE,GAAG,QAAQ,uBAAuB,kBAAkB,IACtD;AACN;AAGO,SAAS,wCACd,QACA,oBACyB;AACzB,MAAI,WAAW,UAAa,WAAW,KAAM,QAAO,CAAC;AACrD,QAAM,iBAAiB,sBAAsB,MAAM,MAAM;AACzD,SAAO,uBAAuB,qBAC5B,eAAe,0BAA0B,oBACvC,kCAAkC,CAAC,GAAG,cAAc,IACpD,CAAC;AACP;AAEO,SAAS,4BACd,OACA,0BACQ;AACR,MAAI,MAAM,YAAa,QAAO,MAAM;AACpC,MAAI,MAAM,gBAAgB,YAAa,QAAO,MAAM;AAEpD,MAAI,OAAO;AACX,MAAI,CAAC,MAAM;AACT,QAAI;AACF,aAAO,QAAQ,QAAQ,EAAE;AAAA,IAC3B,QAAQ;AACN,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,KAAK,mBAAmB;AAC3B,UAAM,IAAI,MAAM,6EAA6E;AAAA,EAC/F;AACA,SAAO,sBAAsB,WAAW;AAAA,IACtC,WAAW,KAAK;AAAA,IAChB,YAAY,KAAK,kBAAkB;AAAA,EACrC,CAAC,CAAC;AACJ;AAEO,SAAS,kDAAkD,aAA6B;AAC7F,QAAM,SAASC,YAAW,QAAQ,EAC/B,OAAO,wBAAwB,MAAM,EACrC,OAAO,aAAa,MAAM,EAC1B,OAAO,KAAK;AACf,SAAO,sBAAsB,MAAM;AACrC;AAsCA,SAAS,8BAA8B,eAA0D;AAC/F,uBAAqB,eAAe;AAAA,IAClC,SAAS;AAAA,IACT,eAAe;AAAA,IACf,iBAAiB;AAAA,EACnB,CAAC;AACH;AAEO,SAAS,0BAA0B,UAA0B;AAClE,SAAO,+BAA+B,QAAQ,KAAK;AACrD;AA0CA,eAAsB,2BACpB,IACA,OAK4E;AAC5E,QAAM,QAAQ,0BAA0B,MAAM,QAAQ;AACtD,QAAM,SAAS,MAAM,4BAA4B,IAAI;AAAA,IACnD,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,IACjB;AAAA,IACA,QAAQ;AAAA,IACR,iBAAiB;AAAA,MACf,OAAO;AAAA,MACP,QAAQ;AAAA,IACV;AAAA,EACF,CAAC;AACD,SAAO,OAAO;AAChB;AAEO,SAAS,8BAA8B,UAAkD;AAC9F,SAAO;AAAA,IACL,0BAA0B,OACxB,UAC4C;AAC5C,YAAM,cAAc,MAAM,SAAS;AAInC,UAAI,MAAM,gBAAgB,eAAe,CAAC,MAAM,WAAW;AACzD,eAAO,EAAE,QAAQ,WAAW,QAAQ,2BAA2B;AAAA,MACjE;AACA,YAAM,EAAE,IAAI,KAAK,oBAAoB,IAAI;AACzC,YAAM,kBAAkB,OAAOC,OAAqB,4BAEhD,MAAMC;AAAA,QACJ;AAAA,QACA,YAAY,yBAAyB,YAAY;AAAA,QACjD;AAAA,UACE,WAAWD,MAAK;AAAA,UAChB,aAAaA,MAAK;AAAA,UAClB,GAAI,2BAA2B,SAAY,EAAE,uBAAuB,IAAI,CAAC;AAAA,QAC3E;AAAA,MACF,GACA;AACJ,YAAM,oBAAoB,4BAA4B,KAAK;AAC3D,YAAM,WAAW,MAAM,iCAAiC,IAAI;AAAA,QAC1D,aAAa,MAAM;AAAA,QACnB,QAAQ,MAAM;AAAA,QACd,aAAa,MAAM;AAAA,QACnB,aAAa;AAAA,MACf,CAAC;AACD,UAAI,UAAU,eAAe,cAAc;AACzC,YAAI,SAAS,uBAAuB,SAAS,kBAAkB;AAC7D,iBAAO,gCAAgC,QAAQ;AAAA,QACjD;AACA,cAAM,oBAAoB,MAAM,qCAAqC,IAAI;AAAA,UACvE,aAAa,MAAM;AAAA,UACnB,OAAO,SAAS;AAAA,QAClB,CAAC;AACD,YAAI,CAAC,mBAAmB;AACtB,cACE,SAAS,WAAW,eACpB,SAAS,WAAW,YACpB,SAAS,WAAW,WACpB;AACA,mBAAO,2BAA2B,SAAS,KAAK;AAAA,UAClD;AACA,gBAAM,IAAI,MAAM,yDAAyD;AAAA,QAC3E;AACA,YAAI,SAAS,WAAW,YAAY,6BAA6B,kBAAkB,IAAI,GAAG;AACxF,gBAAM;AAAA,YACJ;AAAA,YACA,SAAS;AAAA,YACT,SAAS;AAAA,YACT;AAAA,UACF;AACA,iBAAO,2BAA2B,+BAA+B;AAAA,QACnE;AACA,cAAM,8BAA8B,IAAI,mBAAmB,QAAQ;AACnE,YAAI,SAAS,WAAW,cAAc;AACpC,iBAAO,MAAM,4BAA4B;AAAA,YACvC;AAAA,YACA;AAAA,YACA,MAAM,kBAAkB;AAAA,YACxB,KAAK;AAAA,YACL;AAAA,UACF,CAAC;AAAA,QACH;AACA,YAAI,SAAS,WAAW,UAAU;AAChC,gBAAM,iBAAiB,kBAAkB,sBACrC,sBAAsB,MAAM,kBAAkB,mBAAmB,IACjE;AACJ,gBAAME,YAAW,MAAM;AAAA,YACrB,kBAAkB;AAAA,YAClB,gBAAgB,kBACd,kBAAkB,wBAAwB,SAC1C,kBAAkB;AAAA,UACtB;AACA,cAAI;AACF,mBAAO,MAAM,kCAAkC;AAAA,cAC7C;AAAA,cACA,eAAe,YAAY;AAAA,cAC3B;AAAA,cACA,UAAAA;AAAA,cACA;AAAA,cACA,KAAK;AAAA,cACL;AAAA,cACA;AAAA,YACF,CAAC;AAAA,UACH,SAAS,OAAO;AACd,kBAAM,gBAAgB,kCAAkC,KAAK;AAC7D,gBAAI,CAAC,cAAe,OAAM;AAC1B,kBAAM;AAAA,cACJ;AAAA,cACA,SAAS;AAAA,cACT,SAAS;AAAA,cACT,cAAc;AAAA,YAChB;AACA,mBAAO,2BAA2B,cAAc,IAAI;AAAA,UACtD;AAAA,QACF;AACA,YAAI,SAAS,WAAW,aAAa;AACnC,cAAI,CAAC,SAAS,aAAa,CAAC,SAAS,gBAAgB;AACnD,kBAAM,IAAI,MAAM,0DAA0D;AAAA,UAC5E;AACA,iBAAO;AAAA,YACL,QAAQ,kBAAkB,KAAK,YAAY,wBAAwB,UAAU;AAAA,YAC7E,WAAW,kBAAkB,KAAK;AAAA,YAClC,aAAa,kBAAkB,KAAK;AAAA,YACpC,WAAW,SAAS;AAAA,YACpB,gBAAgB,SAAS;AAAA,YACzB,YAAY,qBAAqB,SAAS,SAAS;AAAA,YACnD,sBAAsB;AAAA,UACxB;AAAA,QACF;AACA,YAAI,SAAS,WAAW,YAAY,SAAS,WAAW,WAAW;AACjE,iBAAO,2BAA2B,SAAS,KAAK;AAAA,QAClD;AAAA,MACF;AACA,YAAM,OAAO,MAAM,iBAAiB,IAAI,MAAM,aAAa,MAAM,MAAM;AAIvE,UAAI,CAAC,MAAM;AACT,eAAO,EAAE,QAAQ,UAAU;AAAA,MAC7B;AACA,UAAI,6BAA6B,IAAI;AACnC,eAAO,EAAE,QAAQ,WAAW,QAAQ,gCAAgC;AACtE,UAAI,KAAK,OAAO,SAAS,cAAc;AACrC,eAAO,EAAE,QAAQ,WAAW,QAAQ,4CAA4C;AAAA,MAClF;AACA,UAAI,KAAK,WAAW,UAAU;AAC5B,eAAO,EAAE,QAAQ,WAAW,QAAQ,wBAAwB;AAAA,MAC9D;AACA,UAAI,KAAK,YAAY,mBAAmB,qCAAqC,IAAI,GAAG;AAClF,eAAO,EAAE,QAAQ,WAAW,QAAQ,0BAA0B;AAAA,MAChE;AACA,YAAM,4BAA4B,iCAAiC;AAAA,QACjE,aAAa,KAAK;AAAA,QAClB,iBAAiB,KAAK;AAAA,QACtB,UAAU,KAAK;AAAA,MACjB,CAAC;AACD,YAAM,kBACJ,KAAK,YAAY,wBAAwB,4BAA4B;AACvE,YAAM,4CAA4C,kBAC9C,mDAAmD;AAAA,QACjD,YAAY;AAAA,QACZ,uBAAuB,KAAK;AAAA,QAC5B,qBAAqB,KAAK;AAAA,MAC5B,CAAC,IACD;AACJ,YAAM,sBAAsB;AAAA,QAC1B,KAAK;AAAA,QACL,8BAA8B;AAAA,MAChC;AACA,UAAI,oBAAoB,WAAW,WAAW;AAC5C,eAAO;AAAA,MACT;AACA,YAAM,yCACJ,MAAM,iDAAiD,IAAI;AAAA,QACzD,WAAW,KAAK;AAAA,QAChB,aAAa,KAAK;AAAA,QAClB,QAAQ,KAAK;AAAA,QACb,uBAAuB,KAAK;AAAA,MAC9B,CAAC;AACH,YAAM,wBAAwB,MAAM,kCAAkC,IAAI;AAAA,QACxE,WAAW,KAAK;AAAA,QAChB,aAAa,KAAK;AAAA,QAClB,QAAQ,KAAK;AAAA,QACb,uBAAuB,KAAK;AAAA,MAC9B,CAAC;AACD,YAAM,yBAAyB,KAAK;AAQpC,YAAM,kBAAkB,OACtB,QACA,WACA,WAC4C;AAC5C,gBAAQ;AAAA,UACN,0CAA0C,KAAK,EAAE,cAAc,KAAK,iBAAiB,MAAM,MAAM,KAAK,MAAM;AAAA,QAC9G;AACA,cAAM,UAAU,MAAM,oCAAoC,IAAI;AAAA,UAC5D,aAAa,KAAK;AAAA,UAClB,QAAQ,KAAK;AAAA,UACb,uBAAuB,KAAK;AAAA,UAC5B,qBAAqB,KAAK;AAAA,UAC1B,aAAa,MAAM;AAAA,UACnB,aAAa;AAAA,UACb;AAAA,UACA;AAAA,QACF,CAAC;AACD,YAAI,CAAC,QAAQ,kBAAkB;AAG7B,iBAAO,8BAA8B,QAAQ,EAAE,yBAAyB,KAAK;AAAA,QAC/E;AACA,eAAO,gCAAgC,OAAO;AAAA,MAChD;AACA,UACE,KAAK,OAAO,SAAS,kBACnB,uBAAuB,aAAa,UAAU,0BAC9C,CAAC,sCAAsC,EAAE;AAAA,QACvC,CAAC,YAAY,YAAY,QAAQ,YAAY;AAAA,MAC/C,IACF;AACA,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,0BACJ,KAAK,YAAY,qBACb,KAAK,kBACL,KAAK,YAAY,qBACf,KAAK,oBACL;AAOR,YAAM,6BAA6B,0BAC/B,MAAM;AAAA,QACJ;AAAA,QACA,KAAK;AAAA,QACL;AAAA,QACA;AAAA,MACF,IACA;AACJ,YAAM,WAAW,MAAM,gBAAgB,MAAM,4BAA4B,KAAK;AAS9E,YAAM,kBACJ,KAAK,YAAY,SAAS,6BACtB,OACA,MAAM,iCAAiC,IAAI,UAAU,IAAI;AAC/D,YAAM,QAAQ,KAAK,YAAY,SAAS,iBAAiB,SAAS,SAAS;AAC3E,YAAM,kBACJ,KAAK,YAAY,mBACjB,iBAAiB,mBACjB,SAAS;AACX,UAAI,iBAAiB,KAAK,YAAY,kBAAkB,SAAS;AACjE,UAAI,YAA2C;AAG/C,YAAM,WAAW,KAAK,YAAY,aAC9B,sBAAsB;AAAA,QACpB,aAAa,KAAK;AAAA,QAClB;AAAA,QACA,iBAAiB,MAAM;AAAA,UACrB;AAAA,UACA,KAAK;AAAA,UACL;AAAA,UACA,yBAAyB,EAAE,WAAW,uBAAuB,IAAI,CAAC;AAAA,QACpE;AAAA,QACA,mBAAmB;AAAA,WAChB,MAAMC,kBAAiB,IAAI,KAAK,WAAW,GAAG;AAAA,QACjD;AAAA,MACF,CAAC,IACD,KAAK,YAAY;AACrB,UAAI,YAAY,oBAAoB,UAAU,QAAQ;AAMtD,YAAM,gBAAgB,MAAM,8BAA8B,IAAI,KAAK,aAAa,KAAK,EAAE;AAGvF,UAAI,qBAAqB;AAAA,QACvB,eAAe,qBACX,oCAAoC,UAAU,cAAc,kBAAkB,IAC9E,+BAA+B,QAAQ,EAAE;AAAA,QAC7C,KAAK;AAAA,QACL,+BAA+B,QAAQ,EAAE;AAAA,MAC3C;AAKA,UAAI,sBAAkD;AACtD,UAAI;AACJ,YAAM,kBACJ,KAAK,YAAY,yBAChB,KAAK,YAAY,sBAAsB,KAAK,sBAAsB;AACrE,UAAI,iBAAiB;AACnB,YAAI;AACF,gBAAM,kBAAkBC,oCAAmC;AAAA,YACzD;AAAA,YACA,SAAS;AAAA,YACT,SAAS,KAAK,YAAY;AAAA,YAC1B,cAAc;AAAA,YACd,oBAAoB,MAAMD,kBAAiB,IAAI,KAAK,WAAW,GAAG;AAAA,YAClE,QAAQ;AAAA,YACR,MAAM,KAAK,YAAY,SAAS;AAAA,UAClC,CAAC;AACD,gCAAsB,gBAAgB;AACtC,sCAA4B,gBAAgB;AAC5C,gBAAM,UAAUE,qCAAoC;AAAA,YAClD,QAAQ;AAAA,YACR;AAAA,YACA,OAAO;AAAA,YACP,YAAY,EAAE,MAAM,YAAY,wBAAwB,KAAK;AAAA,YAC7D,kBAAkB,SAAS,IAAI,CAAC,SAAS,KAAK,EAAE;AAAA,UAClD,CAAC;AACD,+BAAqB,QAAQ;AAC7B,sBAAY,QAAQ;AAAA,QACtB,SAAS,OAAO;AACd,gBAAM,SACJ,iBAAiB,QAAS,MAAuC,SAAS;AAC5E,cAAI,EAAE,iBAAiB,UAAU,WAAW,IAAK,OAAM;AACvD,iBAAO,MAAM;AAAA,YACX;AAAA,YACA;AAAA,YACA,oDAAoD,MAAM,OAAO;AAAA,UACnE;AAAA,QACF;AAAA,MACF;AACA,YAAM,2BAA2B,eAAe,2BAC5C,CAAC,GAAG,cAAc,wBAAwB,IAC1C,CAAC,GAAG,mCAAmC;AAG3C,YAAM,qBAAqB,MAAM;AAAA,QAC/B;AAAA,QACA,KAAK;AAAA,QACL;AAAA,QACA,yBAAyB,EAAE,WAAW,uBAAuB,IAAI,CAAC;AAAA,MACpE;AACA,YAAM,mBACJ,2BAA2B,6BACvB,MAAM,eAAe,IAAI,KAAK,aAAa,uBAAuB,IAClE;AACN,YAAM,yBAAyB,MAAMF,kBAAiB,IAAI,KAAK,WAAW,GAAG;AAC7E,UAAI,kBAAkB,MAAM;AAAA,QAC1B;AAAA,QACA,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA,0BAA0B;AAAA,MAC5B;AAMA,UAAI,UACF,KAAK,YAAY,qBAAqB,CAAC,IAAI,CAAC,GAAI,KAAK,YAAY,kBAAkB,CAAC,CAAE;AACxF,YAAM,qBAAqB;AAAA,QACzB;AAAA,QACA,oBAAoB;AAAA,UAClB;AAAA,UACA;AAAA,QACF;AAAA,QACA;AAAA,MACF;AACA,YAAM,yBAAyB,MAC7B,yBAAyB;AAAA,QACvB;AAAA,QACA,WAAW,KAAK;AAAA,QAChB,aAAa,KAAK;AAAA,QAClB,UAAU,mBACN,qCAAqC,oBAAoB,iBAAiB,UAAU,IACpF;AAAA,QACJ,OAAO;AAAA,QACP,WAAW;AAAA,UACT,kBAAkB,aAAa,CAAC;AAAA,UAChC,KAAK,YAAY;AAAA,QACnB;AAAA,QACA,QAAQ,yBACJ,EAAE,MAAM,WAAW,WAAW,wBAAwB,WAAW,KAAK,UAAU,IAChF,EAAE,MAAM,OAAO;AAAA,QACnB,qBAAqB;AAAA,QACrB,GAAG;AAAA,MACL,CAAC,EAAE,MAAM,CAAC,UAAmB;AAC3B,YAAI,iBAAiB,gCAAiC,QAAO;AAC7D,cAAM;AAAA,MACR,CAAC;AACH,UAAI,kBAAkB,MAAM,uBAAuB;AAMnD,YAAM,mBAAmD,CAAC;AAC1D,aACE,2BAA2B,mCAC3B,KAAK,YAAY,2BAA2B,MAC5C;AACA,cAAM,UAA2C;AACjD,cAAM,QAAQ,mBAAmB,SAAS,OAAO;AAGjD,YACE,MAAM,WAAW,KACjB,MAAM,KAAK,CAAC,QAAQ,IAAI,aAAa,qCAAqC,GAC1E;AACA;AAAA,QACF;AACA,yBAAiB,KAAK,GAAG,KAAK;AAC9B,cAAM,YAAY,IAAI,IAAI,MAAM,IAAI,eAAe,CAAC;AACpD,cAAM,iBAAiB,IAAI,IAAI,MAAM,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;AAC/D,kBAAU,QAAQ,OAAO,CAAC,QAAQ,CAAC,UAAU,IAAI,gBAAgB,GAAG,CAAC,CAAC;AACtE,cAAM,mBAAmB,IAAI;AAAA,UAC3B,CAAC,GAAG,cAAc,EAAE;AAAA,YAClB,CAAC,aAAa,CAAC,QAAQ,KAAK,CAAC,QAAQ,IAAI,aAAa,QAAQ;AAAA,UAChE;AAAA,QACF;AACA,YAAI,iBAAiB,IAAI,kCAAkC,GAAG;AAC5D,6BAAmB,gCAAgC;AAAA,QACrD;AACA,0BAAkB,gBAAgB;AAAA,UAChC,CAAC,SAAS,EAAE,KAAK,SAAS,SAAS,iBAAiB,IAAI,KAAK,EAAE;AAAA,QACjE;AACA,oBAAY,UAAU;AAAA,UACpB,CAAC,SAAS,EAAE,KAAK,SAAS,SAAS,iBAAiB,IAAI,KAAK,EAAE;AAAA,QACjE;AACA,0BAAkB,MAAM,uBAAuB;AAAA,MACjD;AACA,UAAI,2BAA2B,iCAAiC;AAC9D,cAAM,UAAU,MAAM,oCAAoC,IAAI;AAAA,UAC5D,aAAa,KAAK;AAAA,UAClB,QAAQ,KAAK;AAAA,UACb,uBAAuB,KAAK;AAAA,UAC5B,qBAAqB,KAAK;AAAA,UAC1B,aAAa,MAAM;AAAA,UACnB,aAAa;AAAA,UACb,YAAY,gBAAgB;AAAA,QAC9B,CAAC;AACD,YAAI,CAAC,QAAQ,qBAAqB;AAGhC,iBAAO,8BAA8B,QAAQ,EAAE,yBAAyB,KAAK;AAAA,QAC/E;AACA,eAAO,gCAAgC,OAAO;AAAA,MAChD;AACA,YAAM;AAAA,QACJ,+BAA+B;AAAA,QAC/B,oBAAoB;AAAA,QACpB,yBAAyB;AAAA,MAC3B,IAAI;AACJ,YAAM,mCACJ,kCAAkC,SAAS,IAAI,yBAAyB;AAC1E,YAAM,uBAAuB;AAAA,QAC3B,eAAe,iBAAiB;AAAA,MAClC;AACA,UAAI,0BAA0B;AAC9B,UAAI,mBAAmB,KAAK,YAAY,eAAe;AACrD,cAAM,SAAS;AAAA,UACb,WAAW,KAAK;AAAA,UAChB,aAAa,KAAK;AAAA,UAClB,WAAW,0BAA0B,KAAK,UAAU;AAAA,QACtD;AACA,cAAM,UAAU,MAAM;AAAA,UACpB;AAAA,UACA;AAAA,UACA,KAAK,YAAY,cAAc;AAAA,QACjC;AAKA,YACE,CAAC,WACD,QAAQ,SAAS,gBACjB,CAAC,QAAQ,gBACR,QAAQ,UAAU,UAAU,CAAC,6BAA6B,MAAM,OAAO,SAAS,GACjF;AACA,iBAAO,MAAM;AAAA,YACX;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AACA,cAAM,aAAa,MAAM,cAAc,IAAI,QAAQ,QAAQ,YAAY;AACvE,YAAI,CAAC,YAAY;AACf,iBAAO,MAAM;AAAA,YACX;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AACA,YAAI,WAAW,WAAW,UAAU;AAGlC,iBAAO,MAAM;AAAA,YACX;AAAA,YACA;AAAA,YACA,6CAA6C,WAAW,MAAM;AAAA,UAChE;AAAA,QACF;AACA,yBAAiB;AACjB,oBAAY,WAAW;AACvB,kCAA0B,QAAQ,UAAU;AAAA,MAC9C,WAAW,mBAAmB,mBAAmB,cAAc;AAC7D,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,8BAA8B,kBAChC,OAAO,YAAY;AACjB,cAAM,YAAY,MAAMA,kBAAiB,IAAI,KAAK,WAAW;AAC7D,cAAM,aAAa,MAAM,oCAAoC,EAAE;AAC/D,cAAM,eAAe,KAAK,YAAY,uBAAuB;AAC7D,cAAM,oBACJ,OAAO,UAAU,SAAS,wBAAwB,WAC9C,UAAU,SAAS,sBACnB;AACN,eAAO,iBAAiB,OACpB;AAAA,UACE,8BAA8B;AAAA,UAC9B,8BAA8B;AAAA,UAC9B,qBAAqB,mBAAmB,KAAK,IACzC,uCAAuC,UAAU,QAAQ,IACxD;AAAA,QACP,IACA,sBAAsB,OACpB;AAAA,UACE,8BAA8B;AAAA,UAC9B,8BAA8B;AAAA,UAC9B,qBAAqB,mBAAmB,KAAK,IACzC,uCAAuC,UAAU,QAAQ,IACxD;AAAA,QACP,IACA;AAAA,UACE,8BAA8B,WAAW;AAAA,UACzC,8BAA8B,WAAW;AAAA,UACzC,qBAAqB,mBAAmB,KAAK,IACzC,uCAAuC,UAAU,QAAQ,IACxD;AAAA,QACP;AAAA,MACR,GAAG,IACH;AACJ,YAAM,yBAAyB,6BAC3B,OAAO,YAAY;AACjB,cAAM,0BACJ,MAAM;AAAA,UACJ;AAAA,UACA,KAAK;AAAA,UACL;AAAA,QACF;AACF,cAAM,wBAAwB,oBAAI,IAAI;AAAA,UACpC,GAAG,mBAAmB,WAAW,IAAI,CAAC,WAAW,OAAO,EAAE;AAAA,UAC1D,GAAG;AAAA,QACL,CAAC;AACD,mBAAW,MAAM,2BAA2B,cAAc;AACxD,gCAAsB,IAAI,EAAE;AAAA,QAC9B;AACA,cAAM,YAAY,yBAAyB;AAAA,UACzC,YAAY,2BAA2B;AAAA,UACvC,cAAc,2BAA2B;AAAA,UACzC;AAAA,UACA,qBAAqB;AAAA,YACnB,GAAG,gBAAgB,IAAI,CAAC,SAAS,KAAK,EAAE;AAAA,YACxC,GAAG;AAAA,UACL;AAAA,QACF,CAAC;AACD,eAAO;AAAA,UACL,GAAG;AAAA,UACH,6BAA6B;AAAA,YAC3B;AAAA,YACA;AAAA,cACE,GAAG;AAAA,cACH,GAAI,mBAAmB,EAAE,OAAO,iBAAiB,MAAM,IAAI,CAAC;AAAA,YAC9D;AAAA,YACA;AAAA,UACF;AAAA,UACA,uBAAuB;AAAA,YACrB,GAAG,IAAI;AAAA,cACL,UAAU,SAAS,QAAQ,CAAC,SAAU,KAAK,SAAS,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAE;AAAA,YAC7E;AAAA,UACF,EAAE,KAAK;AAAA,QACT;AAAA,MACF,GAAG,IACH;AACJ,YAAM,sBACJ,mBAAmB,KAAK,gBACpB,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,UACE,WAAW,KAAK;AAAA,UAChB,aAAa,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,UAKlB,WAAW,0BAA0B,KAAK,UAAU;AAAA,QACtD;AAAA,QACA,KAAK;AAAA,MACP,IACA;AACN,UAAI,mBAAmB,KAAK,iBAAiB,CAAC,qBAAqB;AACjE,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA,2BAA2B,KAAK,aAAa;AAAA,QAC/C;AAAA,MACF;AACA,YAAM,cACJ,mBAAmB,KAAK,QACpB,MAAMG;AAAA,QACJ;AAAA,QACA;AAAA,UACE,WAAW,KAAK;AAAA,UAChB,aAAa,KAAK;AAAA,UAClB,WAAW,0BAA0B,KAAK,UAAU;AAAA,QACtD;AAAA,QACA,KAAK;AAAA,MACP,IACA;AACN,UAAI,mBAAmB,KAAK,UAAU,CAAC,eAAe,CAAC,YAAY,gBAAgB;AACjF,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA,sDAAsD,KAAK,KAAK;AAAA,QAClE;AAAA,MACF;AACA,YAAM,oCAAoC,aAAa,gBACnD,MAAM,QAAQ;AAAA,QACZ,YAAY,cAAc,sBAAsB,IAAI,OAAO,mBAAmB;AAAA,UAC5E;AAAA,UACA,aAAa,MAAM;AAAA,YACjB;AAAA,YACA;AAAA,cACE,WAAW,KAAK;AAAA,cAChB,aAAa,KAAK;AAAA,cAClB,WAAW,0BAA0B,KAAK,UAAU;AAAA,YACtD;AAAA,YACA;AAAA,UACF;AAAA,QACF,EAAE;AAAA,MACJ,IACA,CAAC;AACL,YAAM,+BAA+B,kCAAkC;AAAA,QACrE,CAAC,QAAQ,CAAC,IAAI;AAAA,MAChB;AACA,UAAI,8BAA8B;AAChC,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA,uDAAuD,6BAA6B,aAAa;AAAA,QACnG;AAAA,MACF;AACA,YAAM,iCAAiC,kCAAkC;AAAA,QACvE,CAAC,EAAE,YAAY,OAAO,EAAE,IAAI,YAAa,IAAI,YAAY,YAAa,WAAW;AAAA,MACnF;AACA,UAAI,4BAA4B,oBAAoB,WAAW;AAC/D,UAAI,2BAA2B;AAC7B,cAAM,oBACJ,KAAK,YAAY,qBAAqB,KAAK,kBAAkB,KAAK;AACpE,cAAM,wBACJ,KAAK,YAAY,yBAAyB,kBACtC,MAAM;AAAA,UACJ;AAAA,UACA,KAAK;AAAA,UACL;AAAA,QACF,IACA;AACN,cAAM,mBAAmB,oBACrB,MAAM,eAAe,IAAI,KAAK,aAAa,iBAAiB,IAC5D;AACJ,cAAM,YAAY,MAAM,0CAA0C;AAAA,UAChE;AAAA,UACA;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,+BAA+B;AAAA,UAC/B,cAAc;AAAA,UACd,oCAAoC;AAAA,UACpC,iBAAiB,yBACb;AAAA,YACE,OAAO,uBAAuB;AAAA,YAC9B,oBACE,uBAAuB,+BACvB,uBAAuB;AAAA,YACzB,0BAA0B,uBAAuB;AAAA,YACjD,OAAO,uBAAuB;AAAA,YAC9B,cAAc,uBAAuB;AAAA,YACrC,YAAY,uBAAuB;AAAA,YACnC,cAAc,uBAAuB;AAAA,YACrC,mBAAmB,uBAAuB;AAAA,UAC5C,IACA;AAAA,YACE,OAAO;AAAA,YACP;AAAA,YACA;AAAA,YACA,OAAO,aAAa,MAAM;AAAA,YAC1B,cAAc,aAAa,eAAe,MAAM;AAAA,YAChD,YAAY,kBAAkB,cAAc;AAAA,cAC1C,MAAM;AAAA,cACN,wBAAwB;AAAA,YAC1B;AAAA,YACA,cAAc,CAAC;AAAA,YACf,mBAAmB,kBAAkB,qBAAqB;AAAA,UAC5D;AAAA,QACN,CAAC;AACD,cAAM,YAAY,mCAAmC;AAAA,UACnD,aAAa,KAAK;AAAA,UAClB,mBAAmB,8BAA8B;AAAA,UACjD,uBAAuB,2BAA2B,UAAU;AAAA,UAC5D;AAAA,QACF,CAAC;AACD,YAAI,UAAU,WAAW,UAAW,QAAO;AAC3C,oCAA4B,UAAU,WAAW;AAAA,MACnD;AACA,YAAM,0CACJ,MAAM,oDAAoD,IAAI,KAAK,aAAa,KAAK,EAAE;AACzF,YAAM,6CACJ,MAAM,uDAAuD,IAAI,KAAK,aAAa,KAAK,EAAE;AAI5F,YAAM,4BAA4B,MAAM,sCAAsC,IAAI;AAAA,QAChF,aAAa,KAAK;AAAA,QAClB,QAAQ,KAAK;AAAA,QACb,6BAA6B,uBAAuB,aAAa;AAAA,QACjE,uBAAuB,KAAK;AAAA,MAC9B,CAAC;AAKD,YAAM,qBAAqB,KAAK,YAAY,uBACxC,MAAM;AAAA,QACJ;AAAA,QACA,KAAK;AAAA,QACL,KAAK,YAAY;AAAA,MACnB,IACA;AACJ,YAAM,mBAAmB,qBACrB,yBAAyB,mBAAmB,QAAQ,IACpD;AACJ,UAAI,sBAAsB,CAAC,kBAAkB;AAC3C,cAAM,IAAI,MAAM,mDAAmD;AAAA,MACrE;AACA,YAAM,wBACJ,wCAAwC,UAAU,UAClD,KAAK,UAAU,SAAS,YACpB,KAAK,UAAU,YACf;AACN,UAAI,wCAAwC,UAAU,UAAU,CAAC,uBAAuB;AACtF,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UACE,yBACA,0BACA,0BAA0B,wBAC1B;AACA,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,2BACJ,2CAA2C,UAAU,UAAU,KAAK,iBAChE,KAAK,iBACL;AACN,UACE,2CAA2C,UAAU,UACrD,CAAC,0BACD;AACA,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UACE,4BACA,0BACA,6BAA6B,wBAC7B;AACA,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,uBACJ,0BAA0B,yBAAyB;AACrD,UACE,yBACA,4BACA,0BAA0B;AAE1B,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACF,UACE,KAAK,YAAY,mBACjB,yBAAyB,KAAK,YAAY,gBAAgB,qBAC1D;AACA,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAMA,YAAM,2BACJ,qBAAqB,UAAU,UAC/B,aAAa,UAAU,UACvB;AACF,UACG,4BAA4B,CAAC,wBAC7B,2BAA2B,yBAAyB,KAAK,gBAC1D;AACA,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,kBAAkB,MAAM;AAAA,QAC5B,EAAE,GAAG,aAAa,SAAS;AAAA,QAC3B;AAAA,UACE,WAAW,KAAK;AAAA,UAChB,aAAa,KAAK;AAAA,UAClB,OAAO,wBAAwB,SAAS;AAAA,UACxC,oBAAoB,MAAM,8BAA8B,IAAI;AAAA,UAC5D,0BAA0B;AAAA,QAC5B;AAAA,MACF;AACA,UAAI,iBAAiB;AAGnB,eAAO,MAAM,gBAAgB,iBAAiB,MAAM,4BAA4B;AAAA,MAClF;AACA,UAAI,2BAA2B,4BAA4B;AAMzD,cAAM,aAAa,MAAM,gCAAgC,IAAI;AAAA,UAC3D,WAAW,KAAK;AAAA,UAChB,aAAa,KAAK;AAAA,UAClB,WAAW;AAAA,UACX,SAAS;AAAA,QACX,CAAC;AACD,YAAI,CAAC,WAAW,SAAS;AACvB,iBAAO,MAAM;AAAA,YACX;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,YAAM,gBAAgB,wBAAwB,SAAS;AACvD,YAAM,0BAA0B,wBAAwB,mBAAmB;AAC3E,YAAM,sBAAsB,wBAAwB,eAAe;AACnE,YAAM,sBAAsB,kBACxB,8BAA8B,UAAU,aAAa,IACrD;AACJ,YAAM,4BAA4B,sBAC9B,OAAO,OAAgC;AAIrC,cAAM,SAAS,MAAM;AAAA,UACnB;AAAA,UACA,KAAK;AAAA,UACL,wBAAwB,KAAK,kBAAkB,KAAK,UAAU;AAAA,UAC9D,OAAO,WACL,MAAM,kCAAkC,QAAQ;AAAA,YAC9C,WAAW,KAAK;AAAA,YAChB,aAAa,KAAK;AAAA,YAClB,WAAW;AAAA,YACX,iBAAiB;AAAA,cACf,mBAAmB;AAAA,cACnB,iBAAiB,KAAK;AAAA,YACxB;AAAA,UACF,CAAC;AAAA,QACL;AACA,YAAI,CAAC,QAAQ;AACX,gBAAM,IAAI;AAAA,YACR;AAAA,YACA,2BAA2B,aAAa;AAAA,UAC1C;AAAA,QACF;AAAA,MACF,IACA;AACJ,UAAI;AACJ,UAAI;AACF,sCAA8BC,8BAA6B,UAAU;AAAA,UACnE,SAAS;AAAA,UACT,kBACE,mBAAmB,KAAK,YAAY,QAAQ,KAAK,YAAY,QAAQ;AAAA,UACvE,aAAa,kBACT,KAAK,YAAY,QACf,aACA,eACF;AAAA,UACJ,iBAAiB;AAAA,UACjB,iBAAiB,kBACb,KAAK,YAAY,kBACf,aACA,eACF;AAAA,UACJ,aAAa;AAAA,UACb,mBAAmB,kBAAkB,eAAe;AAAA,QACtD,CAAC;AAAA,MACH,SAAS,OAAO;AAId,YAAI,EAAE,iBAAiB,0CAA2C,OAAM;AACxE,eAAO,MAAM;AAAA,UACX;AAAA,UACA;AAAA,UACA,GAAG,MAAM,OAAO,KAAK,aAAa;AAAA,QACpC;AAAA,MACF;AACA,YAAM,sBAAsB;AAAA,QAC1B;AAAA,QACA;AAAA,QACA,eAAe;AAAA,MACjB;AACA,YAAM,iBAGD,CAAC;AACN,YAAM,kBAAkB,OAAO,YAAsB,sBAA+B;AAClF,cAAM,gBAAgB,OAAO,WAAW;AACxC,cAAM,0BAA0B,kBAC5B;AAAA,UACE,sBACE,8CACC,KAAK,YAAY,qBACd,2BAA2B,KAAK,EAAE,IAAI,KAAK,iBAAiB,IAAI,KAAK,eAAe,KACpF,kDAAkD,iBAAiB;AAAA,UACzE,8BACE,4BAA6B;AAAA,UAC/B,8BACE,4BAA6B;AAAA,UAC/B,qBAAqB,4BAA6B;AAAA,QACpD,IACA;AACJ,cAAM,oBAAuD;AAAA,UAC3D,SAAS;AAAA,UACT;AAAA,UACA,eAAe;AAAA,UACf,yBAAyB;AAAA,UACzB,qBAAqB;AAAA,UACrB;AAAA,UACA,wBAAwB;AAAA,UACxB,mBAAmB;AAAA,UACnB,eAAe;AAAA,UACf,4BAA4B;AAAA,UAC5B,kCAAkC;AAAA,UAClC,GAAI,sBACA;AAAA,YACE;AAAA,YACA,GAAI,8BAA8B,SAAY,EAAE,0BAA0B,IAAI,CAAC;AAAA,UACjF,IACA,CAAC;AAAA,UACL,qBAAqB,sBACjB,EAAE,IAAI,oBAAoB,IAAI,YAAY,oBAAoB,WAAW,IACzE;AAAA,UACJ,aAAa,aAAa,gBACtB;AAAA,YACE,IAAI,YAAY;AAAA,YAChB,WAAW,YAAY,cAAc;AAAA,YACrC,qBAAqB;AAAA,UACvB,IACA;AAAA,UACJ,4BACE,sBAAsB,oBAAoB,mBAAmB,yBACzD;AAAA,YACE,IAAI,mBAAmB;AAAA,YACvB,SAAS,mBAAmB;AAAA,YAC5B,wBAAwB,mBAAmB;AAAA,YAC3C,UAAU;AAAA,UACZ,IACA;AAAA,UACN;AAAA,UACA;AAAA,UACA,+BAA+B;AAAA,UAC/B,oBAAoB;AAAA,UACpB,oCAAoC;AAAA,UACpC;AAAA,UACA,sBAAsB;AAAA,UACtB,qCAAqC;AAAA,UACrC,wCAAwC;AAAA,UACxC;AAAA,UACA;AAAA,UACA,8BAA8B;AAAA,UAC9B,GAAI,iBAAiB,SAAS,IAAI,EAAE,iBAAiB,IAAI,CAAC;AAAA,UAC1D,yBAAyB;AAAA,UACzB,kBAAkB,MAAM,aAAa,EAAE,MAAM,WAAW,WAAW,YAAY;AAAA,UAC/E,6BAA6B,MAAM,+BAA+B;AAAA,UAClE;AAAA,UACA,uBAAuB,2BAA2B,UAAU;AAAA,QAC9D;AAKA,cAAM,yBACJ,kCAAkC,UAAU,iBAAiB;AAC/D,YACE,CAAC,uBAAuB,WACxB,oCAAoC;AAAA,UAClC,QAAQ,KAAK,YAAY;AAAA,UACzB,WAAW,KAAK,YAAY;AAAA,UAC5B,OAAO;AAAA,QACT,CAAC,IAAI,6CACL;AACA,iBAAO;AAAA,YACL,MAAM;AAAA,YACN,QAAQ;AAAA,cACN,QAAQ;AAAA,cACR,QAAQ;AAAA,YACV;AAAA,UACF;AAAA,QACF;AACA,YAAI,MAAM,MAAM,uBAAuB,YAAY;AAAA,UACjD,OAAO;AAAA,UACP,aAAa,KAAK;AAAA,UAClB,QAAQ,KAAK;AAAA,UACb,uBAAuB,KAAK;AAAA,UAC5B,qBAAqB,KAAK;AAAA,UAC1B,aAAa,MAAM;AAAA,UACnB,aAAa;AAAA,UACb,aAAa;AAAA,UACb,2BAA2B;AAAA,UAC3B,GAAI,4BAA4B,EAAE,0BAA0B,IAAI,CAAC;AAAA,QACnE,CAAC;AACD,cAAM,8BAA8B,YAAY,mBAAmB,GAAG;AACtE,YAAI,IAAI,WAAW,YAAY,IAAI,UAAU,iCAAiC;AAC5E,iBAAO;AAAA,YACL,MAAM;AAAA,YACN,QAAQ;AAAA,cACN,QAAQ;AAAA,cACR,QAAQ;AAAA,YACV;AAAA,YACA;AAAA,UACF;AAAA,QACF;AACA,YAAI,IAAI,WAAW,YAAY,IAAI,WAAW,WAAW;AACvD,iBAAO;AAAA,YACL,MAAM;AAAA,YACN,QAAQ,2BAA2B,IAAI,KAAK;AAAA,YAC5C;AAAA,UACF;AAAA,QACF;AACA,cAAM,+BAA+B,MAAM;AAAA,UACzC;AAAA,UACA;AAAA,YACE,WAAW,KAAK;AAAA,YAChB,aAAa,KAAK;AAAA,YAClB,OAAO,IAAI;AAAA,UACb;AAAA,QACF;AACA,YAAI,KAAK,WAAW,gBAAgB,IAAI,aAAa,IAAI,gBAAgB;AACvE,cAAI,mBAAmB;AACrB,mBAAO,EAAE,MAAM,UAAmB,KAAK,kBAAkB;AAAA,UAC3D;AACA,gBAAMC,kBAAiB,YAAY;AAAA,YACjC,WAAW,KAAK;AAAA,YAChB,aAAa,KAAK;AAAA,YAClB,WAAW;AAAA,YACX,UAAU;AAAA,YACV,MAAM;AAAA,YACN,oBAAoB;AAAA,YACpB,kBAAkB,IAAI;AAAA,YACtB,WAAW,IAAI;AAAA,YACf,WAAW,kBAAkB;AAAA,YAC7B,kBAAkB;AAAA,cAChB,iBAAiB,KAAK;AAAA,cACtB,oBAAoB,IAAI;AAAA,YAC1B;AAAA,YACA,QAAQ;AAAA,YACR,gBACE,kBAAkB,+BAClB,qCAAqC,IAAI,EAAE;AAAA,UAC/C,CAAC;AACD,gBAAM,aAAa,qBAAqB,IAAI,SAAS;AACrD,gBAAM,uBAAuB,MAAM,qCAAqC,YAAY;AAAA,YAClF,WAAW,KAAK;AAAA,YAChB,aAAa,KAAK;AAAA,YAClB,WAAW,IAAI;AAAA,YACf,oBAAoB;AAAA,YACpB,QAAQ;AAAA,UACV,CAAC;AACD,gBAAMC,UAAS;AAAA,YACb,QAAQ,KAAK,YAAY,wBAAwB,UAAU;AAAA,YAC3D,WAAW,KAAK;AAAA,YAChB,aAAa,KAAK;AAAA,YAClB,WAAW,IAAI;AAAA,YACf,gBAAgB,IAAI;AAAA,YACpB;AAAA,YACA;AAAA,UACF;AACA,iBAAO,EAAE,MAAM,YAAqB,QAAAA,SAAQ,IAAI;AAAA,QAClD;AACA,YAAIA;AACJ,YAAI;AACF,cAAI,2BAA2B;AAC7B,kBAAM,iBAAiB,MAAM;AAAA,cAC3B;AAAA,cACA;AAAA,gBACE,aAAa,KAAK;AAAA,gBAClB,QAAQ,KAAK;AAAA,cACf;AAAA,YACF;AACA,gBAAI,WAAW,cAAc,MAAM,WAAW,IAAI,GAAG;AACnD,oBAAM,IAAI;AAAA,gBACR;AAAA,cACF;AAAA,YACF;AAAA,UACF;AACA,gBAAM,WAAW,KAAK,YAAY,QAAQ;AAG1C,gBAAM,oBACJ,KAAK,YAAY,qBAAqB,KAAK,kBAAkB,KAAK;AACpE,cAAI,KAAK,YAAY,sBAAsB,CAAC,mBAAmB;AAC7D,kBAAM,IAAI,MAAM,8CAA8C;AAAA,UAChE;AACA,cACE,KAAK,YAAY,yBAChB,KAAK,YAAY,sBAAsB,CAAC,mBACzC;AAGA,kBAAM,cAAc;AACpB,gBAAI,KAAK,iBAAiB,CAAC,aAAa;AACtC,oBAAM,IAAI,MAAM,2BAA2B,KAAK,aAAa,EAAE;AAAA,YACjE;AAMA,gBAAI,cAA6B;AACjC,gBAAI,qBAAoC;AACxC,gBAAI,KAAK,OAAO;AACd,oBAAM,MAAM;AACZ,kBAAI,CAAC,OAAO,CAAC,IAAI,eAAe;AAC9B,sBAAM,IAAI,MAAM,sDAAsD,KAAK,KAAK,EAAE;AAAA,cACpF;AACA,4BAAc,IAAI;AAClB,mCACE,8BAA8B,UAAU;AAAA,gBACtC,CAAC,aAAa,SAAS,iBAAiB,SAAS,SAAS,eAAe,IAAI;AAAA,cAC/E,GAAG,qBAAqB,IAAI,cAAc;AAC5C,kBAAI,uBAAuB,IAAI,cAAc,IAAI;AAC/C,sBAAM,IAAI;AAAA,kBACR;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AACA,gBAAI;AACJ,gBAAI,iBAAiB;AACrB,kBAAM,eAAe,EAAE,GAAG,KAAK,YAAY,SAAS;AACpD,mBAAO,aAAa,uCAAuC;AAC3D,gBAAI;AACF,oBAAM,eAAoD;AAAA,gBACxD,WAAW,KAAK;AAAA,gBAChB,aAAa,KAAK;AAAA,gBAClB,gBAAgB,KAAK,YAAY;AAAA,gBACjC,WAAW,KAAK,YAAY;AAAA,gBAC5B,iBAAiB,KAAK,YAAY;AAAA,gBAClC,OAAO;AAAA,gBACP;AAAA,gBACA;AAAA,gBACA,GAAI,sBAAsB,EAAE,aAAa,oBAAoB,IAAI,CAAC;AAAA,gBAClE,GAAI,8BAA8B,SAC9B,EAAE,cAAc,0BAA0B,IAC1C,CAAC;AAAA,gBACL,GAAG;AAAA,gBACH,GAAI,KAAK,YAAY,iBAAiB,YAAY,SAAS,cAC3D,KAAK,eAAe,YAChB;AAAA,kBACE,YAAY;AAAA,kBACZ,sBAAsB,IAAI;AAAA,gBAC5B,IACA,CAAC;AAAA,gBACL,UAAU;AAAA,kBACR,GAAG;AAAA,kBACH,GAAG;AAAA,oBACD;AAAA,oBACA,eAAe;AAAA,kBACjB;AAAA,kBACA;AAAA,kBACA;AAAA,kBACA,iBAAiB,KAAK;AAAA,kBACtB,sBAAsB,KAAK;AAAA,kBAC3B,GAAI,WAAW,EAAE,mBAAmB,SAAS,IAAI,CAAC;AAAA,kBAClD,GAAI,MAAM,EAAE,oBAAoB,IAAI,GAAG,IAAI,CAAC;AAAA,kBAC5C,GAAI,qBACA;AAAA,oBACE,CAAC,uCAAuC,GAAG,mBAAmB;AAAA,kBAChE,IACA,CAAC;AAAA,gBACP;AAAA,gBACA,WAAW;AAAA,kBACT,MAAM;AAAA,kBACN,WAAW;AAAA,kBACX,OAAO;AAAA,gBACT;AAAA,gBACA,kBAAkB;AAAA,kBAChB,iBAAiB,KAAK;AAAA,kBACtB,GAAI,MAAM,EAAE,oBAAoB,IAAI,GAAG,IAAI,CAAC;AAAA,gBAC9C;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA,aAAa;AAAA,gBACb;AAAA,gBACA;AAAA,gBACA,eAAe,KAAK,iBAAiB;AAAA;AAAA;AAAA,gBAGrC,GAAI,KAAK,cAAc,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;AAAA,gBAC5D,OAAO;AAAA,gBACP,cAAc;AAAA,gBACd,+BAA+B,CAAC;AAAA,gBAChC,4CAA4C;AAAA,gBAC5C,+CACE;AAAA,gBACF,6BAA6B,KAAK,YAAY,uBAAuB;AAAA,gBACrE,8BAA8B;AAAA,kBAC5B,8BACE,wBAAyB;AAAA,kBAC3B,8BACE,wBAAyB;AAAA,gBAC7B;AAAA,gBACA,2BAA2B,wBAAyB;AAAA;AAAA;AAAA;AAAA,gBAIpD,+BAA+B;AAAA,gBAC/B,WAAW,kBAAkB,KAAK,EAAE;AAAA,gBACpC,oBAAoB,OAAO,IAAI,cAAc;AAC3C,sBAAI,2BAA2B;AAC7B,0BAAM,eAAe,MAAM,eAAe,IAAI,KAAK,aAAa,SAAS;AACzE,0BAAM,iBAAiB,MAAM,0CAA0C;AAAA,sBACrE,IAAI;AAAA,sBACJ;AAAA,sBACA,MAAM,kBAAkB;AAAA,sBACxB,SAAS;AAAA,sBACT,+BACE,kBAAkB;AAAA,sBACpB,oCACE,kBAAkB;AAAA,sBACpB,iBAAiB;AAAA,wBACf,OAAO,aAAa;AAAA,wBACpB,oBAAoB,aAAa;AAAA,wBACjC,0BAA0B,aAAa;AAAA,wBACvC,OAAO,aAAa;AAAA,wBACpB,cAAc,aAAa;AAAA,wBAC3B,YAAY,aAAa;AAAA,wBACzB,cAAc,aAAa,WAAW,IAAI,CAAC,WAAW,OAAO,EAAE;AAAA,wBAC/D,mBAAmB,aAAa;AAAA,sBAClC;AAAA,oBACF,CAAC;AACD,0BAAM,iBAAiB,mCAAmC;AAAA,sBACxD,aAAa,kBAAkB,KAAK;AAAA,sBACpC,mBAAmB,8BAA8B;AAAA,sBACjD,uBAAuB,2BAA2B,UAAU;AAAA,sBAC5D,WAAW;AAAA,oBACb,CAAC;AACD,wBAAI,eAAe,WAAW,WAAW;AACvC,4BAAM,IAAI,uCAAuC,eAAe,MAAM;AAAA,oBACxE;AAAA,kBACF;AACA,wBAAM,yCAAyC,IAAI;AAAA,oBACjD,WAAW,KAAK;AAAA,oBAChB,aAAa,KAAK;AAAA,oBAClB,OAAO,IAAI;AAAA,oBACX;AAAA,kBACF,CAAC;AAAA,gBACH;AAAA,cACF;AACA,oBAAM,UAAU,MAAM,sCAAsC,YAAY;AAAA,gBACtE,GAAG;AAAA,gBACH,sBAAsB,wBAAyB;AAAA,cACjD,CAAC;AACD,kBAAI,QAAQ,QAAQ;AAClB,sBAAM,IAAI,0BAA0B,QAAQ,MAAM;AAAA,cACpD;AACA,wBAAU,QAAQ;AAClB,+BAAiB,QAAQ;AACzB,kBAAI,eAAgB,+BAA8B,YAAY,aAAa;AAC3E,kBAAI,CAAC,gBAAgB;AACnB,sBAAM,yCAAyC,YAAY;AAAA,kBACzD,WAAW,KAAK;AAAA,kBAChB,aAAa,KAAK;AAAA,kBAClB,OAAO,IAAI;AAAA,kBACX,WAAW,QAAQ;AAAA,gBACrB,CAAC;AACD,sBAAM,EAAE,GAAG,KAAK,WAAW,QAAQ,GAAG;AAAA,cACxC;AAAA,YACF,SAAS,OAAO;AACd,kBAAI,iBAAiB,wCAAwC;AAC3D,sBAAM;AAAA,cACR;AACA,kBAAI,iBAAiB,2BAA2B;AAC9C,sBAAM,IAAI,MAAM,GAAG,MAAM,OAAO,IAAI,YAAY,MAAM,OAAO,EAAE,IAAI;AAAA,kBACjE,OAAO;AAAA,gBACT,CAAC;AAAA,cACH;AACA,oBAAM;AAAA,YACR;AACA,kBAAM,eAAe;AACrB,gBAAI,CAAC,gBAAgB;AACnB,6CAA+B,QAAQ,MAAM;AAC7C,mBAAK,QAAQ,iBAAiB,WAAW,KAAK,iBAAiB,OAAO;AACpE,sBAAM,IAAI;AAAA,kBACR;AAAA,gBACF;AAAA,cACF;AACA,kBACE,8BAA8B,QAAQ,QAAQ,OAC7C,KAAK,YAAY,wBAAwB,OAC1C;AACA,sBAAM,IAAI;AAAA,kBACR;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AACA,sBAAU,MAAM,mCAAmC;AAAA,cACjD,IAAI;AAAA,cACJ;AAAA,cACA;AAAA,cACA;AAAA,cACA,OAAO,IAAI;AAAA,cACX;AAAA,cACA;AAAA,cACA;AAAA,YACF,CAAC;AACD,gBAAI;AACJ,gBAAI,iBAAiB;AACnB,oBAAM,UAAU,MAAM,iCAAiC,YAAY;AAAA,gBACjE,WAAW,KAAK;AAAA,gBAChB,aAAa,KAAK;AAAA,gBAClB,WAAW,QAAQ;AAAA,gBACnB,yBAAyB;AAAA,gBACzB,8BAA8B;AAAA,gBAC9B,qBAAqB;AAAA,kBACnB,iBACE,OAAO,QAAQ,SAAS,oBAAoB,WACxC,QAAQ,SAAS,kBACjB,KAAK;AAAA,kBACX,oBACE,OAAO,QAAQ,SAAS,uBAAuB,WAC3C,QAAQ,SAAS,qBACjB,IAAI;AAAA;AAAA,kBAEV,GAAI,cACA;AAAA,oBACE,eAAe,YAAY;AAAA,oBAC3B,iBAAiB,YAAY;AAAA,kBAC/B,IACA,CAAC;AAAA,kBACL,GAAI,sBAAsB,mBACtB;AAAA,oBACE,oBAAoB;AAAA,sBAClB,gBAAgB;AAAA,sBAChB,iBAAiB;AAAA,sBACjB,cAAc,mBAAmB;AAAA,sBACjC,aAAa,iBAAiB;AAAA,oBAChC;AAAA,kBACF,IACA,CAAC;AAAA,gBACP;AAAA,gBACA,MAAM,WACF;AAAA,kBACE,MAAM,SAAS;AAAA,kBACf,iBAAiB,SAAS,mBAAmB;AAAA,kBAC7C,sBAAsB,SAAS,wBAAwB;AAAA,kBACvD,GAAI,SAAS,iBACT,EAAE,gBAAgB,SAAS,eAAe,IAC1C,CAAC;AAAA,kBACL,WAAW;AAAA,gBACb,IACA;AAAA,gBACJ,kBAAkB;AAAA,gBAClB,gBAAgB;AAAA,cAClB,CAAC;AACD,2BAAa,QAAQ;AACrB,kBAAI,QAAQ,OAAO,SAAS,GAAG;AAC7B,oBAAI,mBAAmB;AACrB,iCAAe,KAAK;AAAA,oBAClB,WAAW,QAAQ;AAAA,oBACnB,QAAQ,QAAQ;AAAA,kBAClB,CAAC;AAAA,gBACH,OAAO;AACL,wBAAM;AAAA,oBACJ;AAAA,oBACA,KAAK;AAAA,oBACL,QAAQ;AAAA,oBACR,QAAQ;AAAA,kBACV;AAAA,gBACF;AAAA,cACF;AAAA,YACF,OAAO;AACL,oBAAM,UAAU,MAAM,iCAAiC,YAAY;AAAA,gBACjE,WAAW,KAAK;AAAA,gBAChB,aAAa,KAAK;AAAA,gBAClB,WAAW,QAAQ;AAAA,gBACnB,yBAAyB;AAAA,gBACzB,8BAA8B;AAAA,gBAC9B,qBAAqB;AAAA,kBACnB,iBACE,OAAO,QAAQ,SAAS,oBAAoB,WACxC,QAAQ,SAAS,kBACjB,KAAK;AAAA,kBACX,oBACE,OAAO,QAAQ,SAAS,uBAAuB,WAC3C,QAAQ,SAAS,qBACjB,IAAI;AAAA;AAAA,kBAEV,GAAI,cACA,EAAE,eAAe,YAAY,IAAI,iBAAiB,YAAY,KAAK,IACnE,CAAC;AAAA,kBACL,GAAI,sBAAsB,mBACtB;AAAA,oBACE,oBAAoB;AAAA,sBAClB,gBAAgB;AAAA,sBAChB,iBAAiB;AAAA,sBACjB,cAAc,mBAAmB;AAAA,sBACjC,aAAa,iBAAiB;AAAA,oBAChC;AAAA,kBACF,IACA,CAAC;AAAA,gBACP;AAAA,gBACA,MAAM,WACF;AAAA,kBACE,MAAM,SAAS;AAAA,kBACf,iBAAiB,SAAS,mBAAmB;AAAA,kBAC7C,sBAAsB,SAAS,wBAAwB;AAAA,kBACvD,GAAI,SAAS,iBACT,EAAE,gBAAgB,SAAS,eAAe,IAC1C,CAAC;AAAA,kBACL,WAAW;AAAA,gBACb,IACA;AAAA,gBACJ,kBAAkB;AAAA,gBAClB,gBAAgB;AAAA,cAClB,CAAC;AACD,2BAAa,QAAQ;AACrB,kBAAI,QAAQ,OAAO,SAAS,GAAG;AAC7B,oBAAI,mBAAmB;AACrB,iCAAe,KAAK,EAAE,WAAW,QAAQ,IAAI,QAAQ,QAAQ,OAAO,CAAC;AAAA,gBACvE,OAAO;AACL,wBAAM;AAAA,oBACJ;AAAA,oBACA,KAAK;AAAA,oBACL,QAAQ;AAAA,oBACR,QAAQ;AAAA,kBACV;AAAA,gBACF;AAAA,cACF;AACA,kBAAI,KAAK,YAAY,oBAAoB;AACvC,sBAAM,+CAA+C,YAAY;AAAA,kBAC/D,WAAW,KAAK;AAAA,kBAChB,aAAa,KAAK;AAAA,kBAClB,QAAQ,KAAK;AAAA,kBACb,OAAO,IAAI;AAAA,kBACX,WAAW,QAAQ;AAAA,kBACnB,6BACE,8BAA8B,yBAC9B,IAAI;AAAA,kBACN,uBACE,8BAA8B,mBAAmB,IAAI;AAAA,gBACzD,CAAC;AAAA,cACH;AAAA,YACF;AAKA,kBAAM,cAAc,MAAM,2BAA2B,YAAY;AAAA,cAC/D,aAAa,KAAK;AAAA,cAClB,WAAW,QAAQ;AAAA,cACnB,UAAU,KAAK;AAAA,YACjB,CAAC;AACD,gBAAI,YAAY,SAAS,GAAG;AAC1B,kBAAI,mBAAmB;AACrB,+BAAe,KAAK,EAAE,WAAW,QAAQ,IAAI,QAAQ,YAAY,CAAC;AAAA,cACpE,OAAO;AACL,sBAAM,4BAA4B,KAAK,KAAK,aAAa,QAAQ,IAAI,WAAW;AAAA,cAClF;AAAA,YACF;AACA,kBAAM,kBAAkB,MAAM;AAAA,cAC5B;AAAA,cACA;AAAA,gBACE,WAAW,KAAK;AAAA,gBAChB,aAAa,KAAK;AAAA,gBAClB,WAAW,QAAQ;AAAA,gBACnB,MAAM;AAAA,gBACN,gBAAgB;AAAA,gBAChB,UAAU,IAAI;AAAA,gBACd,WAAW,sBAAsB,IAAI,EAAE;AAAA,gBACvC,SAAS,KAAK,YAAY;AAAA,gBAC1B,SAAS;AAAA,kBACP,KAAK,YAAY;AAAA,kBACjB,KAAK,YAAY;AAAA,kBACjB;AAAA,kBACA,KAAK;AAAA,kBACL,IAAI;AAAA,kBACJ;AAAA,gBACF;AAAA,gBACA,SAAS;AAAA,kBACP,iBAAiB,KAAK;AAAA,kBACtB,oBAAoB,IAAI;AAAA,kBACxB,GAAI,uBAAuB,EAAE,qBAAqB,IAAI,CAAC;AAAA,kBACvD,GAAI,mCACA,EAAE,8BAA8B,iCAAiC,IACjE,CAAC;AAAA,kBACL,GAAI,wCAAwC,UAAU,UACtD,KAAK,UAAU,SAAS,YACpB,EAAE,uBAAuB,KAAK,UAAU,UAAU,IAClD,CAAC;AAAA,kBACL,GAAI,2BAA2B,EAAE,yBAAyB,IAAI,CAAC;AAAA,gBACjE;AAAA,gBACA,+BAA+B;AAAA,gBAC/B,oBAAoB;AAAA,gBACpB,qCAAqC;AAAA,gBACrC,wCAAwC;AAAA,gBACxC,uBAAuB;AAAA,gBACvB,oBAAoB,IAAI;AAAA,cAC1B;AAAA,cACA,OAAO,IAAI,aAAa,WAAW,oBAAoB;AACrD,oBAAI,CAAC,aAAa;AAChB,wBAAM,QAAQ,+BAA+B,eAAe;AAC5D,wBAAM,oCAAoC,IAAI;AAAA,oBAC5C,aAAa,KAAK;AAAA,oBAClB,OAAO,aAAa;AAAA,oBACpB,WAAW,QAAQ;AAAA,oBACnB,gBAAgB;AAAA,oBAChB,QAAQ;AAAA,oBACR;AAAA,kBACF,CAAC;AACD;AAAA,gBACF;AACA,sBAAM,oCAAoC,IAAI;AAAA,kBAC5C,aAAa,KAAK;AAAA,kBAClB,OAAO,aAAa;AAAA,kBACpB,WAAW,QAAQ;AAAA,kBACnB,gBAAgB;AAAA,kBAChB,QAAQ;AAAA,gBACV,CAAC;AAAA,cACH;AAAA,cACA;AAAA,gBACE,oBAAoB,KAAK,kBAAkB,UAAU,CAAC;AAAA,gBACtD,GAAI,4BACA;AAAA,kBACE,eAAe,OAAO,IAAI,cACxB,MAAM,+BAA+B;AAAA,oBACnC;AAAA,oBACA;AAAA,oBACA,QAAQ,KAAK;AAAA,oBACb,aAAa,KAAK;AAAA,oBAClB;AAAA,oBACA,uBAAuB,2BAA2B,UAAU;AAAA,oBAC5D;AAAA,kBACF,CAAC;AAAA,gBACL,IACA,CAAC;AAAA,cACP;AAAA,YACF;AACA,gBACE,gBAAgB,WAAW,uBAC3B,gBAAgB,WAAW,sBAC3B,gBAAgB,WAAW,kBAC3B;AACA,oBAAM,QAAQ,+BAA+B,gBAAgB,MAAM;AACnE,qBAAO;AAAA,gBACL,MAAM;AAAA,gBACN,QAAQ,EAAE,QAAQ,WAAoB,QAAQ,yBAAkC;AAAA,gBAChF,KAAK,EAAE,GAAG,KAAK,QAAQ,WAAoB,MAAM;AAAA,cACnD;AAAA,YACF;AACA,gBAAI,gBAAgB,OAAO;AACzB,wCAA0B,YAAY,eAAe,EAAE,SAAS,YAAY,CAAC;AAAA,YAC/E;AACA,gBAAI,gBAAgB,SAAS,gBAAgB,OAAO,SAAS,GAAG;AAC9D,kBAAI,mBAAmB;AACrB,+BAAe,KAAK;AAAA,kBAClB,WAAW,QAAQ;AAAA,kBACnB,QAAQ,gBAAgB;AAAA,gBAC1B,CAAC;AAAA,cACH,OAAO;AACL,sBAAM;AAAA,kBACJ;AAAA,kBACA,KAAK;AAAA,kBACL,QAAQ;AAAA,kBACR,gBAAgB;AAAA,gBAClB;AAAA,cACF;AAAA,YACF;AACA,YAAAA,UAAS;AAAA,cACP,QAAQ,iBAAiB,UAAU;AAAA,cACnC,WAAW,KAAK;AAAA,cAChB,aAAa,KAAK;AAAA,cAClB,WAAW,QAAQ;AAAA,cACnB,gBAAgB,gBAAgB;AAAA,cAChC;AAAA,cACA,sBAAsB,gBAAgB;AAAA,YACxC;AAAA,UACF,OAAO;AACL,gBAAI,CAAC,IAAK,OAAM,IAAI,MAAM,oCAAoC;AAC9D,kBAAM,eAAe;AACrB,kBAAM,UAAU,MAAM,eAAe,YAAY,KAAK,aAAa,iBAAkB;AACrF,kBAAM,yCAAyC,YAAY;AAAA,cACzD,WAAW,KAAK;AAAA,cAChB,aAAa,KAAK;AAAA,cAClB,OAAO,IAAI;AAAA,cACX,WAAW,QAAQ;AAAA,YACrB,CAAC;AAKD,2CAA+B,QAAQ,MAAM;AAG7C,gDAAoC,SAAS,IAAI;AACjD,kBAAM,UAAU,MAAM;AAAA,cACpB;AAAA,cACA;AAAA,gBACE,WAAW,KAAK;AAAA,gBAChB,aAAa,KAAK;AAAA,gBAClB,WAAW,QAAQ;AAAA,gBACnB,MAAM;AAAA,gBACN,gBAAgB;AAAA,gBAChB,UAAU,IAAI;AAAA,gBACd,WAAW,sBAAsB,IAAI,EAAE;AAAA,gBACvC,SAAS,KAAK,YAAY;AAAA,gBAC1B,SAAS;AAAA,kBACP,KAAK,YAAY;AAAA,kBACjB,KAAK,YAAY;AAAA,kBACjB;AAAA,kBACA,KAAK;AAAA,kBACL,IAAI;AAAA,kBACJ;AAAA,gBACF;AAAA,gBACA,SAAS;AAAA,kBACP,iBAAiB,KAAK;AAAA,kBACtB,oBAAoB,IAAI;AAAA,kBACxB,GAAI,uBAAuB,EAAE,qBAAqB,IAAI,CAAC;AAAA,kBACvD,GAAI,mCACA,EAAE,8BAA8B,iCAAiC,IACjE,CAAC;AAAA,kBACL,GAAI,wCAAwC,UAAU,UACtD,KAAK,UAAU,SAAS,YACpB,EAAE,uBAAuB,KAAK,UAAU,UAAU,IAClD,CAAC;AAAA,kBACL,GAAI,2BAA2B,EAAE,yBAAyB,IAAI,CAAC;AAAA,gBACjE;AAAA,gBACA,+BAA+B;AAAA,gBAC/B,oBAAoB;AAAA,gBACpB,qCAAqC;AAAA,gBACrC,wCAAwC;AAAA,gBACxC,uBAAuB;AAAA,gBACvB,oBAAoB,IAAI;AAAA,cAC1B;AAAA,cACA,OAAO,IAAI,aAAa,WAAW,oBAAoB;AACrD,oBAAI,CAAC,aAAa;AAChB,wBAAM,QAAQ,+BAA+B,eAAe;AAC5D,wBAAM,oCAAoC,IAAI;AAAA,oBAC5C,aAAa,KAAK;AAAA,oBAClB,OAAO,aAAa;AAAA,oBACpB,WAAW,QAAQ;AAAA,oBACnB,gBAAgB;AAAA,oBAChB,QAAQ;AAAA,oBACR;AAAA,kBACF,CAAC;AACD;AAAA,gBACF;AACA,sBAAM,oCAAoC,IAAI;AAAA,kBAC5C,aAAa,KAAK;AAAA,kBAClB,OAAO,aAAa;AAAA,kBACpB,WAAW,QAAQ;AAAA,kBACnB,gBAAgB;AAAA,kBAChB,QAAQ;AAAA,gBACV,CAAC;AAAA,cACH;AAAA,cACA;AAAA,gBACE,oBAAoB,KAAK,kBAAkB;AAAA,gBAC3C,eAAe,OAAO,IAAI,cAAc;AACtC,wBAAM,aACJ,KAAK,YAAY,sBAAsB,YAAY,IAAI,WAAW,WAC9D,MAAM,iCAAiC,IAAI;AAAA,oBACzC,WAAW,KAAK;AAAA,oBAChB,aAAa,KAAK;AAAA,oBAClB;AAAA,oBACA,OAAO,IAAI;AAAA,oBACX,MAAM,SAAS;AAAA,oBACf,iBAAiB,SAAS,mBAAmB;AAAA,oBAC7C,sBAAsB,SAAS,wBAAwB;AAAA,oBACvD,GAAI,SAAS,iBACT,EAAE,gBAAgB,SAAS,eAAe,IAC1C,CAAC;AAAA,kBACP,CAAC,IACD,CAAC;AACP,wBAAM,iBAAiB,4BACnB,MAAM,+BAA+B;AAAA,oBACnC;AAAA,oBACA;AAAA,oBACA,QAAQ,KAAK;AAAA,oBACb,aAAa,KAAK;AAAA,oBAClB;AAAA,oBACA,uBAAuB,2BAA2B,UAAU;AAAA,oBAC5D;AAAA,kBACF,CAAC,IACD;AACJ,yBAAO;AAAA,oBACL,GAAI,kBAAkB,CAAC;AAAA,oBACvB,GAAI,WAAW,SAAS,IAAI,EAAE,QAAQ,WAAW,IAAI,CAAC;AAAA,kBACxD;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AACA,gBACE,QAAQ,WAAW,uBACnB,QAAQ,WAAW,sBACnB,QAAQ,WAAW,kBACnB;AACA,oBAAM,QAAQ,+BAA+B,QAAQ,MAAM;AAC3D,qBAAO;AAAA,gBACL,MAAM;AAAA,gBACN,QAAQ,EAAE,QAAQ,WAAoB,QAAQ,yBAAkC;AAAA,gBAChF,KAAK,EAAE,GAAG,KAAK,QAAQ,WAAoB,MAAM;AAAA,cACnD;AAAA,YACF;AACA,gBAAI,QAAQ,OAAO;AACjB,wCAA0B,YAAY,eAAe,EAAE,SAAS,YAAY,CAAC;AAAA,YAC/E;AACA,gBAAI,QAAQ,SAAS,QAAQ,OAAO,SAAS,GAAG;AAC9C,kBAAI,mBAAmB;AACrB,+BAAe,KAAK;AAAA,kBAClB,WAAW,QAAQ;AAAA,kBACnB,QAAQ,QAAQ;AAAA,gBAClB,CAAC;AAAA,cACH,OAAO;AACL,sBAAM;AAAA,kBACJ;AAAA,kBACA,KAAK;AAAA,kBACL,QAAQ;AAAA,kBACR,QAAQ;AAAA,gBACV;AAAA,cACF;AAAA,YACF;AACA,YAAAA,UAAS;AAAA,cACP,QAAQ;AAAA,cACR,WAAW,KAAK;AAAA,cAChB,aAAa,KAAK;AAAA,cAClB,WAAW,QAAQ;AAAA,cACnB,gBAAgB,QAAQ;AAAA,cACxB,YAAY,qBAAqB,QAAQ,EAAE;AAAA,cAC3C,sBAAsB,QAAQ;AAAA,YAChC;AAAA,UACF;AAAA,QACF,SAAS,OAAO;AACd,gBAAM,gBAAgB,kCAAkC,KAAK;AAC7D,cAAI,CAAC,cAAe,OAAM;AAC1B,gBAAM;AAAA,YACJ;AAAA,YACA,KAAK;AAAA,YACL,IAAI;AAAA,YACJ,cAAc;AAAA,UAChB;AACA,iBAAO;AAAA,YACL,MAAM;AAAA,YACN,QAAQ,2BAA2B,cAAc,IAAI;AAAA,YACrD,KAAK,EAAE,GAAG,KAAK,QAAQ,UAAmB,OAAO,cAAc,KAAK;AAAA,UACtE;AAAA,QACF;AACA,cAAMD,kBAAiB,YAAY;AAAA,UACjC,WAAW,KAAK;AAAA,UAChB,aAAa,KAAK;AAAA,UAClB,WAAW;AAAA,UACX,UAAU;AAAA,UACV,MAAM;AAAA,UACN,oBAAoB;AAAA,UACpB,kBAAkB,IAAI;AAAA,UACtB,WAAWC,QAAO;AAAA,UAClB,WAAW,MAAM,aAAa;AAAA,YAC5B,MAAM;AAAA,YACN,WAAW;AAAA,UACb;AAAA,UACA,kBAAkB;AAAA,YAChB,iBAAiB,KAAK;AAAA,YACtB,oBAAoB,IAAI;AAAA,UAC1B;AAAA,UACA,QAAQ;AAAA,UACR,gBACE,MAAM,+BAA+B,qCAAqC,IAAI,EAAE;AAAA,QACpF,CAAC;AACD,eAAO,EAAE,MAAM,YAAqB,QAAAA,SAAQ,IAAI;AAAA,MAClD;AAEA,UAAI;AACJ,UAAI;AACF,0BAAkB,4BACd,MAAM;AAAA,UACJ;AAAA,UACA,EAAE,WAAW,KAAK,WAAW,aAAa,KAAK,YAAY;AAAA,UAC3D,OAAO,OAAO,MAAM,gBAAgB,IAAI,IAAI;AAAA,QAC9C,IACA,MAAM,gBAAgB,IAAI,KAAK;AAAA,MACrC,SAAS,OAAO;AACd,YAAI,iBAAiB,wCAAwC;AAC3D,iBAAO,EAAE,QAAQ,WAAW,QAAQ,MAAM,OAAO;AAAA,QACnD;AACA,cAAM,gBAAgB,kCAAkC,KAAK;AAC7D,YAAI,eAAe,SAAS,+BAA+B;AAGzD,iBAAO,MAAM,gBAAgB,+BAA+B,OAAO,cAAc,OAAO;AAAA,QAC1F;AACA,cAAM;AAAA,MACR;AACA,UAAI,gBAAgB,SAAS,UAAU;AACrC,eAAO,MAAM,4BAA4B;AAAA,UACvC;AAAA,UACA;AAAA,UACA;AAAA,UACA,KAAK,gBAAgB;AAAA,UACrB,mBAAmB,gBAAgB;AAAA,QACrC,CAAC;AAAA,MACH;AACA,iBAAW,YAAY,gBAAgB;AACrC,cAAM;AAAA,UACJ;AAAA,UACA,KAAK;AAAA,UACL,SAAS;AAAA,UACT,SAAS;AAAA,QACX;AAAA,MACF;AACA,UAAI,gBAAgB,SAAS,UAAW,QAAO,gBAAgB;AAC/D,YAAM,SAAS,gBAAgB;AAC/B,UAAI,uBAAuB,OAAO,yBAAyB,MAAM;AAC/D,cAAM,oBAAoB;AAAA,UACxB,WAAW,OAAO;AAAA,UAClB,aAAa,OAAO;AAAA,UACpB,WAAW,OAAO;AAAA,UAClB,YAAY,OAAO;AAAA,UACnB,cAAc,OAAO;AAAA,QACvB,CAAC;AAAA,MACH;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,IAAM,yCAAN,cAAqD,MAAM;AAAA,EACzD,YAAqB,QAA+C;AAClE,UAAM,MAAM;AADO;AAEnB,SAAK,OAAO;AAAA,EACd;AACF;AAOA,SAAS,oCACP,SACA,MACM;AAGN,MAAI,KAAK,YAAY,mBAAoB;AACzC,MACE,8BAA8B,QAAQ,QAAQ,OAC7C,KAAK,YAAY,wBAAwB,OAC1C;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAM,qCAAN,cAAiD,MAAM;AAAA,EACrD,YACW,MACT,SACA;AACA,UAAM,OAAO;AAHJ;AAIT,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,kCACP,OAC2C;AAC3C,MACE,iBAAiB,SACjB,WAAW,SACX,MAAM,UAAU,UAChB,MAAM,UAAU,OAChB;AACA,UAAM,SAAS,kCAAkC,MAAM,KAAK;AAC5D,QAAI,OAAQ,QAAO;AAAA,EACrB;AACA,MAAI,iBAAiB,mCAAoC,QAAO;AAChE,MAAI,iBAAiB,wCAAwC;AAC3D,WAAO,IAAI;AAAA,MACT,sBAAsB,MAAM,MAAM;AAAA,MAClC,MAAM;AAAA,IACR;AAAA,EACF;AACA,MAAI,iBAAiB,2BAA2B;AAC9C,WAAO,IAAI,mCAAmC,kCAAkC,MAAM,OAAO;AAAA,EAC/F;AACA,MAAI,iBAAiB,SAAS,MAAM,QAAQ,WAAW,oBAAoB,GAAG;AAC5E,WAAO,IAAI;AAAA,MACT;AAAA,MACA,MAAM;AAAA,IACR;AAAA,EACF;AACA,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,YAAY,SAAS,MAAM,WAAW,KAAK;AAC5F,WAAO,IAAI;AAAA,MACT;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAC3C;AAAA,EACF;AACA,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,SAAS,MAAM,SAAS,SAAS;AAC5F,WAAO,IAAI;AAAA,MACT;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAC3C;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,KAAgE;AACvF,SAAO,KAAK,UAAU,CAAC,IAAI,UAAU,IAAI,YAAY,CAAC;AACxD;AAMA,SAAS,mBACP,MACA,SACgC;AAChC,QAAM,UAAU,IAAI,IAAI,KAAK,IAAI,eAAe,CAAC;AACjD,QAAM,QAAQ,QAAQ,WAAW,SAAS;AAAA,IAAQ,CAAC,YACjD,QAAQ,IAAI,gBAAgB,OAAO,CAAC,IAChC,CAAC,EAAE,UAAU,QAAQ,UAAU,cAAc,QAAQ,cAAc,QAAQ,QAAQ,OAAO,CAAC,IAC3F,CAAC;AAAA,EACP;AACA,MAAI,MAAM,SAAS,EAAG,QAAO;AAC7B,MAAI,QAAQ,WAAW,WAAW,4BAA4B;AAC5D,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,UAAU,IAAI;AAAA,MACd,cAAc,IAAI;AAAA,MAClB,QAAQ;AAAA,IACV,EAAE;AAAA,EACJ;AACA,SAAO,CAAC;AACV;AAGA,SAAS,gCACP,KACgE;AAChE,MAAI,IAAI,kBAAkB;AACxB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ,IAAI,iBAAiB;AAAA,MAC7B,OAAO,IAAI;AAAA,MACX,SAAS,IAAI;AAAA,IACf;AAAA,EACF;AACA,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,OAAO,IAAI;AAAA,IACX,GAAI,IAAI,sBAAsB,EAAE,YAAY,IAAI,oBAAoB,IAAI,CAAC;AAAA,EAC3E;AACF;AAEA,SAAS,2BACP,OACgE;AAChE,MAAI,UAAU;AACZ,WAAO,EAAE,QAAQ,WAAW,QAAQ,gCAAgC;AACtE,MAAI,UAAU,iCAAiC;AAC7C,WAAO,EAAE,QAAQ,WAAW,QAAQ,gCAAgC;AAAA,EACtE;AACA,MAAI,UAAU,0DAA0D;AACtE,WAAO,EAAE,QAAQ,WAAW,QAAQ,sCAAsC;AAAA,EAC5E;AACA,MAAI,UAAU,uDAAuD;AACnE,WAAO,EAAE,QAAQ,WAAW,QAAQ,mCAAmC;AAAA,EACzE;AACA,MAAI,UAAU,sDAAsD;AAClE,WAAO,EAAE,QAAQ,WAAW,QAAQ,kCAAkC;AAAA,EACxE;AACA,SAAO,EAAE,QAAQ,WAAW,QAAQ,yBAAyB;AAC/D;AAEA,SAAS,+BACP,iBACiF;AACjF,MAAI,oBAAoB,iBAAkB,QAAO;AACjD,SAAO,oBAAoB,qBACvB,+BACA;AACN;AAEA,eAAe,+BAA+B,OAQ3C;AACD,QAAM,UAAU,MAAM,eAAe,MAAM,IAAI,MAAM,aAAa,MAAM,SAAS;AACjF,QAAM,EAAE,MAAM,8BAA8B,IAAI,MAAM;AACtD,QAAM,YAAY,MAAM,0CAA0C;AAAA,IAChE,IAAI,MAAM;AAAA,IACV,UAAU,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA,oCACE,MAAM,kBAAkB,sCAAsC;AAAA,IAChE,iBAAiB,MAAM,kBAAkB,yBACrC;AAAA,MACE,OAAO,MAAM,kBAAkB,uBAAuB;AAAA,MACtD,oBACE,MAAM,kBAAkB,uBAAuB,+BAC/C,MAAM,kBAAkB,uBAAuB;AAAA,MACjD,0BACE,MAAM,kBAAkB,uBAAuB;AAAA,MACjD,OAAO,MAAM,kBAAkB,uBAAuB;AAAA,MACtD,cAAc,MAAM,kBAAkB,uBAAuB;AAAA,MAC7D,YAAY,MAAM,kBAAkB,uBAAuB;AAAA,MAC3D,cAAc,MAAM,kBAAkB,uBAAuB;AAAA,MAC7D,mBAAmB,MAAM,kBAAkB,uBAAuB;AAAA,IACpE,IACA;AAAA,MACE,OAAO,MAAM,kBAAkB;AAAA,MAC/B,oBAAoB,MAAM,kBAAkB;AAAA,MAC5C,0BAA0B,MAAM,kBAAkB;AAAA,MAClD,OAAO,MAAM,kBAAkB,aAAa,MAAM;AAAA,MAClD,cAAc,MAAM,kBAAkB,aAAa,aAAa;AAAA,MAChE,YAAY,QAAQ;AAAA,MACpB,cAAc,CAAC;AAAA,MACf,mBAAmB,QAAQ;AAAA,IAC7B;AAAA,EACN,CAAC;AACD,QAAM,YAAY,mCAAmC;AAAA,IACnD,aAAa,KAAK;AAAA,IAClB,mBAAmB,MAAM,0BAA0B;AAAA,IACnD,uBAAuB,MAAM;AAAA,IAC7B;AAAA,EACF,CAAC;AACD,MAAI,UAAU,WAAW,WAAW;AAClC,UAAM,IAAI,uCAAuC,UAAU,MAAM;AAAA,EACnE;AACA,QAAM,QAAQ,gCAAgC;AAAA,IAC5C;AAAA,IACA;AAAA,IACA,uBAAuB,MAAM;AAAA,EAC/B,CAAC;AACD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,uCAAuC,qCAAqC;AAAA,EACxF;AACA,SAAO;AAAA,IACL,SAAS;AAAA,MACP,CAAC,8CAA8C,GAAG;AAAA,IACpD;AAAA,EACF;AACF;AAEA,eAAe,8BACb,IACA,mBACA,KACe;AACf,QAAM,OAAO,kBAAkB;AAC/B,QAAMD,kBAAiB,IAAI;AAAA,IACzB,WAAW,KAAK;AAAA,IAChB,aAAa,KAAK;AAAA,IAClB,WAAW;AAAA,IACX,UAAU;AAAA,IACV,MAAM;AAAA,IACN,oBAAoB;AAAA,IACpB,kBAAkB,IAAI;AAAA,IACtB,WAAW,kBAAkB;AAAA,IAC7B,kBAAkB,EAAE,iBAAiB,KAAK,IAAI,oBAAoB,IAAI,GAAG;AAAA,IACzE,QAAQ;AAAA,IACR,gBAAgB,8BAA8B,IAAI,EAAE;AAAA,EACtD,CAAC;AACH;AAEA,SAAS,6BAA6B,MAAqB,WAAmC;AAC5F,SACE,KAAK,eAAe,aACpB,KAAK,mBAAmB,QACxB,KAAK,mBAAmB;AAE5B;AAOA,eAAe,8BACb,IACA,MACA,QAC4D;AAC5D,QAAM,YAAY,KAAK;AACvB,MAAI,KAAK,eAAe,aAAa,CAAC,UAAW,QAAO;AACxD,QAAM,SAAS,EAAE,WAAW,KAAK,WAAW,aAAa,KAAK,aAAa,UAAU;AACrF,QAAM,UAAU,MAAM,WAAW,IAAI,QAAQ,OAAO,eAAe;AACnE,MAAI,SAAS,UAAU,OAAQ,QAAO;AACtC,MAAI,CAAC,QAAQ,cAAc;AACzB,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,MAAI;AACJ,WAAS,OAAO,GAAG,OAAO,IAAI,QAAQ,GAAG;AACvC,UAAM,SAAS,MAAM,gCAAgC,IAAI;AAAA,MACvD,GAAG;AAAA,MACH,cAAc;AAAA,MACd,OAAO;AAAA,MACP,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC7B,CAAC;AACD,UAAM,YAAY,OAAO,YAAY;AAAA,MACnC,CAAC,cAAc,UAAU,eAAe,QAAQ,gBAAgB,UAAU,WAAW;AAAA,IACvF;AACA,QAAI,UAAW,QAAO,EAAE,WAAW,aAAa,UAAU,YAAY;AACtE,QAAI,CAAC,OAAO,WAAY;AACxB,aAAS,OAAO;AAAA,EAClB;AACA,QAAM,IAAI,MAAM,8DAA8D;AAChF;AAEA,eAAe,mCAAmC,OAYK;AACrD,QAAM,SAAS,MAAM,KAAK,YAAY;AACtC,MAAI,CAAC,OAAQ,QAAO,MAAM;AAC1B,QAAM,gBAAgB,MAAM,8BAA8B,MAAM,IAAI,MAAM,MAAM,MAAM;AACtF,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,MACE,IAAI,MAAM;AAAA,MACV,UAAU,MAAM;AAAA,MAChB,KAAK,MAAM;AAAA,IACb;AAAA,IACA;AAAA,MACE,WAAW,MAAM,KAAK;AAAA,MACtB,aAAa,MAAM,KAAK;AAAA,MACxB,WAAW,MAAM,QAAQ;AAAA,MACzB,gBAAgB,MAAM,QAAQ;AAAA,MAC9B,gBAAgB,MAAM,QAAQ;AAAA;AAAA,MAE9B,GAAI,gBAAgB,EAAE,WAAW,cAAc,UAAU,IAAI,CAAC;AAAA,IAChE;AAAA,IACA,OAAO;AAAA,IACP,OAAO,cAAc;AAAA,EACvB;AACA,MAAI,OAAO,SAAS;AAClB,QAAI,eAAe;AAGjB,YAAM,iBAAiB,MAAM,yBAAyB,MAAM,IAAI;AAAA,QAC9D,WAAW,MAAM,KAAK;AAAA,QACtB,aAAa,MAAM,KAAK;AAAA,QACxB,WAAW,MAAM,QAAQ;AAAA,MAC3B,CAAC;AACD,UAAI,mBAAmB,KAAM,OAAM,IAAI,MAAM,2CAA2C;AACxF,YAAM,2BAA2B,MAAM,IAAI;AAAA,QACzC,WAAW,MAAM,KAAK;AAAA,QACtB,aAAa,MAAM,KAAK;AAAA,QACxB,WAAW,cAAc;AAAA,QACzB,aAAa,cAAc;AAAA,QAC3B,cAAc;AAAA,QACd,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW,MAAM,QAAQ;AAAA,QACzB,wBAAwB;AAAA,QACxB,6BAA6B;AAAA,MAC/B,CAAC;AAAA,IACH;AACA,WAAO,MAAM,eAAe,MAAM,IAAI,MAAM,KAAK,aAAa,MAAM,QAAQ,EAAE;AAAA,EAChF;AAEA,QAAM,SAAS,MAAM,mCAAmC,MAAM,IAAI;AAAA,IAChE,WAAW,MAAM,KAAK;AAAA,IACtB,aAAa,MAAM,KAAK;AAAA,IACxB,QAAQ,MAAM,KAAK;AAAA,IACnB,OAAO,MAAM;AAAA,IACb,WAAW,MAAM,QAAQ;AAAA,IACzB,OAAO;AAAA,EACT,CAAC;AACD,MAAI,OAAO,WAAW,YAAY;AAChC,UAAM,IAAI;AAAA,MACR,6BAA6B,OAAO,MAAM;AAAA,IAC5C;AAAA,EACF;AACA,MAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,QAAI,MAAM,mBAAmB;AAC3B,YAAM,eAAe,KAAK,EAAE,WAAW,MAAM,QAAQ,IAAI,QAAQ,OAAO,OAAO,CAAC;AAAA,IAClF,OAAO;AACL,YAAM;AAAA,QACJ,MAAM;AAAA,QACN,MAAM,KAAK;AAAA,QACX,MAAM,QAAQ;AAAA,QACd,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACA,QAAM,QACJ,OAAO,WAAW,aAAc,OAAO,SAAS,2BAA4B,OAAO;AACrF,QAAM,IAAI;AAAA,IACR;AAAA,IACA,OAAO,UAAU;AAAA,EACnB;AACF;AAEA,eAAe,kCAAkC,OASL;AAC1C,QAAM,EAAE,KAAK,IAAI,MAAM;AACvB,MAAI,MAAM,IAAI,WAAW,UAAU;AACjC,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,QAAM,mBACJ,KAAK,YAAY,yBAChB,KAAK,YAAY,sBAAsB,KAAK,sBAAsB;AAGrE,QAAM,yBAAyB,mBAC3B,MAAM,8BAA8B,MAAM,IAAI,KAAK,aAAa,KAAK,EAAE,IACvE;AACJ,QAAM,cAAc,MAAM,kBAAkB;AAC5C,MAAI,aAAa;AACf,UAAM,eAAe,MAAM;AAAA,MACzB,MAAM;AAAA,MACN,KAAK;AAAA,MACL,YAAY;AAAA,IACd;AACA,UAAM,kBAAkB,yBAAyB,aAAa,QAAQ;AACtE,QACE,aAAa,YAAY,YAAY,WACrC,aAAa,2BAA2B,YAAY,0BACpD,WAAW,eAAe,MAAM,WAAW,YAAY,QAAQ,GAC/D;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI;AACJ,MAAI,MAAM,IAAI,WAAW;AACvB,cAAU,MAAM,eAAe,MAAM,IAAI,KAAK,aAAa,MAAM,IAAI,SAAS;AAG9E,QAAI,CAAC,iBAAkB,qCAAoC,SAAS,IAAI;AAAA,EAC1E,WAAW,kBAAkB;AAC3B,UAAM,cAAc,MAAM,kBAAkB;AAC5C,QAAI,aAAa;AACf,YAAM,UAAU,MAAM;AAAA,QACpB,MAAM;AAAA,QACN;AAAA,UACE,WAAW,KAAK;AAAA,UAChB,aAAa,KAAK;AAAA,UAClB,WACE,MAAM,kBAAkB,sCAAsC,KAAK,UAAU;AAAA,QACjF;AAAA,QACA,YAAY;AAAA,MACd;AACA,UAAI,CAAC,WAAW,QAAQ,eAAe,YAAY,YAAY;AAC7D,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,UAAM,MAAM,MAAM,kBAAkB;AACpC,QAAI,KAAK;AACP,YAAM,WAAW,MAAM;AAAA,QACrB,MAAM;AAAA,QACN;AAAA,UACE,WAAW,KAAK;AAAA,UAChB,aAAa,KAAK;AAAA,UAClB,WACE,MAAM,kBAAkB,sCAAsC,KAAK,UAAU;AAAA,QACjF;AAAA,QACA,IAAI;AAAA,QACJ,IAAI;AAAA,MACN;AACA,UAAI,CAAC,UAAU;AACb,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,UAAM,eAAe,EAAE,GAAG,KAAK,YAAY,SAAS;AACpD,WAAO,aAAa,uCAAuC;AAC3D,UAAM,UAAU,MAAM,sCAAsC,MAAM,IAAI;AAAA,MACpE,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,gBAAgB,KAAK,YAAY;AAAA,MACjC,WAAW,KAAK,YAAY;AAAA,MAC5B,iBAAiB,KAAK,YAAY;AAAA,MAClC,OAAO,MAAM,kBAAkB;AAAA,MAC/B,oBAAoB,MAAM,kBAAkB;AAAA,MAC5C,0BAA0B,MAAM,kBAAkB;AAAA,MAClD,GAAI,MAAM,kBAAkB,sBACxB,EAAE,aAAa,MAAM,kBAAkB,oBAAoB,IAC3D,CAAC;AAAA,MACL,GAAI,MAAM,kBAAkB,8BAA8B,SACtD,EAAE,cAAc,MAAM,kBAAkB,0BAA0B,IAClE,CAAC;AAAA,MACL,GAAG,mCAAmC,wBAAwB,iBAAiB,IAAI;AAAA,MACnF,GAAI,KAAK,cAAc,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;AAAA,MAC5D,GAAI,KAAK,YAAY,iBAAiB,YAAY,SAAS,cAC3D,KAAK,eAAe,YAChB;AAAA,QACE,YAAY;AAAA,QACZ,sBAAsB,MAAM,IAAI;AAAA,MAClC,IACA,CAAC;AAAA,MACL,UAAU;AAAA,QACR,GAAG;AAAA,QACH,GAAG;AAAA,UACD,MAAM,kBAAkB;AAAA,UACxB,wBAAwB;AAAA,QAC1B;AAAA,QACA,OAAO,MAAM,kBAAkB;AAAA,QAC/B,iBAAiB,MAAM,kBAAkB;AAAA,QACzC,iBAAiB,KAAK;AAAA,QACtB,sBAAsB,KAAK;AAAA,QAC3B,GAAI,KAAK,YAAY,OAAO,EAAE,mBAAmB,KAAK,YAAY,KAAK,IAAI,CAAC;AAAA,QAC5E,oBAAoB,MAAM,IAAI;AAAA,QAC9B,GAAI,cAAc,EAAE,CAAC,uCAAuC,GAAG,YAAY,GAAG,IAAI,CAAC;AAAA,MACrF;AAAA,MACA,WAAW;AAAA,QACT,MAAM;AAAA,QACN,WAAW;AAAA,QACX,OAAO;AAAA,MACT;AAAA,MACA,kBAAkB;AAAA,QAChB,iBAAiB,KAAK;AAAA,QACtB,oBAAoB,MAAM,IAAI;AAAA,MAChC;AAAA,MACA,OAAO,MAAM,kBAAkB;AAAA,MAC/B,iBAAiB,MAAM,kBAAkB;AAAA,MACzC,aAAa,MAAM,kBAAkB;AAAA,MACrC,gBAAgB,MAAM,kBAAkB;AAAA,MACxC,WAAW,MAAM,kBAAkB;AAAA,MACnC,eAAe,aAAa,MAAM;AAAA,MAClC,OAAO,KAAK,MAAM;AAAA,MAClB,cAAc,KAAK,aAAa;AAAA,MAChC,+BAA+B,CAAC;AAAA,MAChC,4CACE,MAAM,kBAAkB;AAAA,MAC1B,+CACE,MAAM,kBAAkB;AAAA,MAC1B,6BAA6B,KAAK,YAAY,uBAAuB;AAAA,MACrE,8BAA8B;AAAA,QAC5B,8BACE,MAAM,kBAAkB,wBAAyB;AAAA,QACnD,8BACE,MAAM,kBAAkB,wBAAyB;AAAA,MACrD;AAAA,MACA,2BACE,MAAM,kBAAkB,wBAAyB;AAAA,MACnD,+BAA+B;AAAA,MAC/B,WAAW,kBAAkB,KAAK,EAAE;AAAA,MACpC,sBACE,MAAM,kBAAkB,yBAAyB,yBAChD,MAAM;AACL,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF,GAAG;AAAA,MACL,oBAAoB,OAAO,IAAI,cAAc;AAC3C,cAAM,yCAAyC,IAAI;AAAA,UACjD,WAAW,KAAK;AAAA,UAChB,aAAa,KAAK;AAAA,UAClB,OAAO,MAAM,IAAI;AAAA,UACjB;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AACD,QAAI,QAAQ,OAAQ,OAAM,IAAI,0BAA0B,QAAQ,MAAM;AACtE,cAAU,QAAQ;AAClB,QAAI,QAAQ,QAAS,+BAA8B,MAAM,aAAa;AACtE,QAAI,CAAC,QAAQ,SAAS;AACpB,YAAM,yCAAyC,MAAM,IAAI;AAAA,QACvD,WAAW,KAAK;AAAA,QAChB,aAAa,KAAK;AAAA,QAClB,OAAO,MAAM,IAAI;AAAA,QACjB,WAAW,QAAQ;AAAA,MACrB,CAAC;AAAA,IACH;AAAA,EACF,OAAO;AACL,UAAM,kBACJ,KAAK,YAAY,qBAAqB,KAAK,kBAAkB,KAAK;AACpE,QAAI,CAAC,iBAAiB;AACpB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,cAAU,MAAM,eAAe,MAAM,IAAI,KAAK,aAAa,eAAe;AAE1E,wCAAoC,SAAS,IAAI;AACjD,UAAM,yCAAyC,MAAM,IAAI;AAAA,MACvD,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,OAAO,MAAM,IAAI;AAAA,MACjB,WAAW,QAAQ;AAAA,IACrB,CAAC;AAAA,EACH;AACA,MAAI,kBAAkB;AACpB,cAAU,MAAM,mCAAmC;AAAA,MACjD,IAAI,MAAM;AAAA,MACV,KAAK,MAAM;AAAA,MACX,UAAU,MAAM;AAAA,MAChB;AAAA,MACA,OAAO,MAAM,IAAI;AAAA,MACjB;AAAA,MACA,mBAAmB;AAAA,MACnB,gBAAgB,CAAC;AAAA,IACnB,CAAC;AAAA,EACH;AACA,MAAI,QAAQ,WAAW,aAAa;AAClC,UAAM,oCAAoC,MAAM,IAAI;AAAA,MAClD,aAAa,KAAK;AAAA,MAClB,OAAO,MAAM,IAAI;AAAA,MACjB,WAAW,QAAQ;AAAA,MACnB,OAAO;AAAA,IACT,CAAC;AACD,WAAO,EAAE,QAAQ,WAAW,QAAQ,yBAAyB;AAAA,EAC/D;AACA,MAAI,kBAAkB;AACpB,UAAM,oBAAoB,MAAM,kBAAkB,yBAAyB;AAC3E,QAAI,CAAC,mBAAmB;AACtB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,mBAAmB,MAAM,kBAAkB;AACjD,UAAM,0BACJ,KAAK,YAAY,sBAAsB,OAAO,QAAQ,SAAS,uBAAuB,WAClF,QAAQ,SAAS,qBACjB,MAAM,IAAI;AAGhB,UAAM,iBAAiB,MAAM;AAAA,MAC3B,MAAM;AAAA,MACN,KAAK;AAAA,MACL,QAAQ;AAAA,IACV;AACA,UAAM,uBAAuB,EAAE,GAAG,KAAK,YAAY,SAAS;AAC5D,WAAO,qBAAqB,uCAAuC;AACnE,UAAM,mBAAmB;AAAA,MACvB;AAAA,QACE,GAAG;AAAA,QACH,GAAG;AAAA,UACD,MAAM,kBAAkB;AAAA,UACxB,wBAAwB;AAAA,QAC1B;AAAA,QACA,OAAO,MAAM,kBAAkB;AAAA,QAC/B,iBAAiB,MAAM,kBAAkB;AAAA,QACzC,iBAAiB,KAAK;AAAA,QACtB,sBAAsB,KAAK;AAAA,QAC3B,GAAI,KAAK,YAAY,OAAO,EAAE,mBAAmB,KAAK,YAAY,KAAK,IAAI,CAAC;AAAA,QAC5E,oBAAoB;AAAA,QACpB,GAAI,cAAc,EAAE,CAAC,uCAAuC,GAAG,YAAY,GAAG,IAAI,CAAC;AAAA,MACrF;AAAA,MACA,MAAM,kBAAkB;AAAA,IAC1B;AACA,QACE,QAAQ,yBAAyB,qBACjC,QAAQ,mBAAmB,KAAK,YAAY,UAC5C,QAAQ,kBAAkB,MAAM,kBAAkB,6BAA6B,SAC/E,QAAQ,eAAe,QACvB,WAAW,QAAQ,MAAM,MAAM,QAC/B,WAAW,QAAQ,UAAU,MAC3B,WAAW,EAAE,MAAM,YAAY,wBAAwB,KAAK,CAAC,KAC/D,QAAQ,sBAAsB,KAC9B,QAAQ,WAAW,WAAW,KAC9B,QAAQ,oBAAoB,QAC5B,QAAQ,kBAAkB,QAAQ,MAClC,QAAQ,qBAAqB,KAC7B,QAAQ,iCAAiC,iBAAiB,gCAC1D,QAAQ,iCAAiC,iBAAiB,gCAC1D,QAAQ,qCACL,iBAAiB,iCAAiC,YAAY,QAAQ,KAAK,SAC9E,QAAQ,mBAAmB,QAAQ,MACnC,QAAQ,cAAc,QACtB,QAAQ,wBAAwB,iBAAiB,uBACjD,WAAW,QAAQ,QAAQ,MAAM,WAAW,gBAAgB,KAC5D,QAAQ,UAAU,SAAS,aAC3B,QAAQ,UAAU,cAAc,eAChC,WAAW,QAAQ,gBAAgB,MACjC,WAAW;AAAA,MACT,OAAO;AAAA,MACP,iBAAiB,KAAK;AAAA,MACtB,oBAAoB;AAAA,IACtB,CAAC,KACF,KAAK,YAAY,yBAChB,MAAM,kBAAkB,0BAA0B,SACjD,QAAQ,SAAS,uBAAuB,MAAM,IAAI,MACjD,QAAQ,iBAAiB,uBAAuB,MAAM,IAAI,OAC9D,gBAAgB,UAAU,MAAM,kBAAkB,iBAClD,eAAe,oBAAoB,MAAM,kBAAkB,2BAC3D,eAAe,gBAAgB,MAAM,kBAAkB,uBACvD,QAAQ,mBAAmB,MAAM,kBAAkB,0BACnD,QAAQ,cAAc,MAAM,kBAAkB,qBAC9C,QAAQ,qBAAqB,KAAK,YAAY,eAAe,mBAAmB,SAChF,WAAW,QAAQ,SAAS,MAAM,WAAW,KAAK,YAAY,SAAS,KACvE,WAAW,QAAQ,KAAK,MAAM,WAAW,MAAM,kBAAkB,aAAa,KAC9E,WAAW,QAAQ,kBAAkB,MACnC,WAAW,MAAM,kBAAkB,0BAA0B,KAC/D,WAAW,QAAQ,wBAAwB,MACzC,WAAW,MAAM,kBAAkB,gCAAgC,KACrE,WAAW,QAAQ,KAAK,MACtB,WAAW,MAAM,kBAAkB,uBAAuB,IAAI,KAChE,QAAQ,iCAAiC,KAAK,YAAY,uBAAuB,UAChF,QAAQ,iBAAiB,WACvB,MAAM,kBAAkB,qBAAqB,MAAM,UACrD,QAAQ,SAAS,WAAW,MAAM,kBAAkB,aAAa,MAAM,UACvE,QAAQ,gBAAgB,WAAW,MAAM,kBAAkB,aAAa,aAAa,SACtF,8BAA8B,QAAQ,QAAQ,OAAO,aAAa,MAAM,OACxE;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,aAAa,qBAAqB,QAAQ,EAAE;AAChD,MAAI,kBAAkB;AACpB,UAAM,WAAW,KAAK,YAAY,QAAQ;AAC1C,UAAM,UAAU,MAAM,iCAAiC,MAAM,IAAI;AAAA,MAC/D,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,WAAW,QAAQ;AAAA,MACnB,yBAAyB,MAAM,kBAAkB;AAAA,MACjD,qBAAqB;AAAA,QACnB,iBAAiB,KAAK;AAAA,QACtB,oBAAoB,MAAM,IAAI;AAAA,MAChC;AAAA,MACA,MAAM,WACF;AAAA,QACE,MAAM,SAAS;AAAA,QACf,iBAAiB,SAAS,mBAAmB;AAAA,QAC7C,sBAAsB,SAAS,wBAAwB;AAAA,QACvD,GAAI,SAAS,iBAAiB,EAAE,gBAAgB,SAAS,eAAe,IAAI,CAAC;AAAA,QAC7E,WAAW;AAAA,MACb,IACA;AAAA,MACJ,kBAAkB;AAAA,MAClB,gBAAgB;AAAA,IAClB,CAAC;AACD,iBAAa,QAAQ;AACrB,QAAI,QAAQ,OAAO,SAAS,GAAG;AAC7B,YAAM,4BAA4B,MAAM,KAAK,KAAK,aAAa,QAAQ,IAAI,QAAQ,MAAM;AAAA,IAC3F;AACA,QAAI,KAAK,YAAY,oBAAoB;AACvC,YAAM,+CAA+C,MAAM,IAAI;AAAA,QAC7D,WAAW,KAAK;AAAA,QAChB,aAAa,KAAK;AAAA,QAClB,QAAQ,KAAK;AAAA,QACb,OAAO,MAAM,IAAI;AAAA,QACjB,WAAW,QAAQ;AAAA,QACnB,6BAA6B,MAAM,IAAI;AAAA,QACvC,uBAAuB,MAAM,IAAI;AAAA,MACnC,CAAC;AAAA,IACH;AAIA,UAAM,cAAc,MAAM,2BAA2B,MAAM,IAAI;AAAA,MAC7D,aAAa,KAAK;AAAA,MAClB,WAAW,QAAQ;AAAA,MACnB,UAAU,KAAK;AAAA,IACjB,CAAC;AACD,QAAI,YAAY,SAAS,GAAG;AAC1B,YAAM,4BAA4B,MAAM,KAAK,KAAK,aAAa,QAAQ,IAAI,WAAW;AAAA,IACxF;AAAA,EACF;AACA,QAAM,kBAAkB,MAAM;AAAA,IAC5B,MAAM;AAAA,IACN;AAAA,MACE,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,WAAW,QAAQ;AAAA,MACnB,MAAM;AAAA,MACN,gBAAgB;AAAA,MAChB,UAAU,MAAM,IAAI;AAAA,MACpB,WAAW,sBAAsB,MAAM,IAAI,EAAE;AAAA,MAC7C,SAAS,KAAK,YAAY;AAAA,MAC1B,SAAS;AAAA,QACP,KAAK,YAAY;AAAA,QACjB,KAAK,YAAY;AAAA,QACjB,MAAM,kBAAkB;AAAA,QACxB,KAAK;AAAA,QACL,MAAM,IAAI;AAAA,QACV,MAAM,kBAAkB,oBAAoB,CAAC;AAAA,MAC/C;AAAA,MACA,SAAS;AAAA,QACP,iBAAiB,KAAK;AAAA,QACtB,oBAAoB,MAAM,IAAI;AAAA,QAC9B,GAAI,MAAM,kBAAkB,uBACxB,EAAE,sBAAsB,MAAM,kBAAkB,qBAAqB,IACrE,CAAC;AAAA,QACL,GAAI,MAAM,kBAAkB,+BACxB;AAAA,UACE,8BAA8B,MAAM,kBAAkB;AAAA,QACxD,IACA,CAAC;AAAA,QACL,GAAI,MAAM,kBAAkB,wBACxB,EAAE,uBAAuB,MAAM,kBAAkB,sBAAsB,IACvE,CAAC;AAAA,QACL,GAAI,MAAM,kBAAkB,2BACxB,EAAE,0BAA0B,MAAM,kBAAkB,yBAAyB,IAC7E,CAAC;AAAA,MACP;AAAA,MACA,+BAA+B,MAAM,kBAAkB;AAAA,MACvD,oBAAoB,MAAM,kBAAkB,sBAAsB;AAAA,MAClE,qCACE,MAAM,kBAAkB;AAAA,MAC1B,wCACE,MAAM,kBAAkB;AAAA;AAAA;AAAA,MAG1B,uBAAuB,MAAM,sCAAsC,MAAM,IAAI;AAAA,QAC3E,aAAa,KAAK;AAAA,QAClB,QAAQ,KAAK;AAAA,QACb,6BACE,MAAM,kBAAkB,sBAAsB,aAAa;AAAA,QAC7D,uBAAuB,KAAK;AAAA,MAC9B,CAAC;AAAA,MACD,oBAAoB,MAAM,IAAI;AAAA,IAChC;AAAA,IACA,OAAO,IAAI,aAAa,WAAW,oBAAoB;AACrD,UAAI,CAAC,aAAa;AAChB,cAAM,QAAQ,+BAA+B,eAAe;AAC5D,cAAM,oCAAoC,IAAI;AAAA,UAC5C,aAAa,KAAK;AAAA,UAClB,OAAO,MAAM,IAAI;AAAA,UACjB,WAAW,QAAQ;AAAA,UACnB,gBAAgB;AAAA,UAChB,QAAQ;AAAA,UACR;AAAA,QACF,CAAC;AACD;AAAA,MACF;AACA,YAAM,oCAAoC,IAAI;AAAA,QAC5C,aAAa,KAAK;AAAA,QAClB,OAAO,MAAM,IAAI;AAAA,QACjB,WAAW,QAAQ;AAAA,QACnB,gBAAgB;AAAA,QAChB,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA;AAAA,MACE,oBAAoB,KAAK,kBAAkB,UAAU,CAAC;AAAA,MACtD,eAAe,OAAO,IAAI,cAAc;AACtC,cAAM,OAAO,KAAK,YAAY;AAC9B,cAAM,aACJ,CAAC,oBAAoB,KAAK,YAAY,sBAAsB,OACxD,MAAM,iCAAiC,IAAI;AAAA,UACzC,WAAW,KAAK;AAAA,UAChB,aAAa,KAAK;AAAA,UAClB;AAAA,UACA,OAAO,MAAM,IAAI;AAAA,UACjB,MAAM,KAAK;AAAA,UACX,iBAAiB,KAAK,mBAAmB;AAAA,UACzC,sBAAsB,KAAK,wBAAwB;AAAA,UACnD,GAAI,KAAK,iBAAiB,EAAE,gBAAgB,KAAK,eAAe,IAAI,CAAC;AAAA,QACvE,CAAC,IACD,CAAC;AACP,cAAM,iBAAiB,MAAM,kBAAkB,4BAC3C,MAAM,+BAA+B;AAAA,UACnC;AAAA,UACA,UAAU,MAAM;AAAA,UAChB,QAAQ,KAAK;AAAA,UACb,aAAa,KAAK;AAAA,UAClB;AAAA,UACA,uBAAuB,MAAM,kBAAkB;AAAA,UAC/C,mBAAmB,MAAM;AAAA,QAC3B,CAAC,IACD;AACJ,eAAO;AAAA,UACL,GAAI,kBAAkB,CAAC;AAAA,UACvB,GAAI,WAAW,SAAS,IAAI,EAAE,QAAQ,WAAW,IAAI,CAAC;AAAA,QACxD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MACE,gBAAgB,WAAW,uBAC3B,gBAAgB,WAAW,sBAC3B,gBAAgB,WAAW,kBAC3B;AACA,WAAO,EAAE,QAAQ,WAAW,QAAQ,yBAAyB;AAAA,EAC/D;AACA,MAAI,gBAAgB,OAAO;AACzB,8BAA0B,MAAM,eAAe,EAAE,SAAS,YAAY,CAAC;AAAA,EACzE;AACA,MAAI,gBAAgB,SAAS,gBAAgB,OAAO,SAAS,GAAG;AAC9D,UAAM;AAAA,MACJ,MAAM;AAAA,MACN,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,gBAAgB;AAAA,IAClB;AAAA,EACF;AACA,QAAMA,kBAAiB,MAAM,IAAI;AAAA,IAC/B,WAAW,KAAK;AAAA,IAChB,aAAa,KAAK;AAAA,IAClB,WAAW;AAAA,IACX,UAAU;AAAA,IACV,MAAM;AAAA,IACN,oBAAoB;AAAA,IACpB,kBAAkB,MAAM,IAAI;AAAA,IAC5B,WAAW,QAAQ;AAAA,IACnB,WAAW,MAAM,kBAAkB;AAAA,IACnC,kBAAkB,EAAE,iBAAiB,KAAK,IAAI,oBAAoB,MAAM,IAAI,GAAG;AAAA,IAC/E,QAAQ;AAAA,IACR,gBACE,MAAM,kBAAkB,+BACxB,qCAAqC,MAAM,IAAI,EAAE;AAAA,EACrD,CAAC;AACD,QAAM,uBAAuB,MAAM,qCAAqC,MAAM,IAAI;AAAA,IAChF,WAAW,KAAK;AAAA,IAChB,aAAa,KAAK;AAAA,IAClB,WAAW,QAAQ;AAAA,IACnB,oBAAoB;AAAA,IACpB,QAAQ;AAAA,EACV,CAAC;AACD,QAAM,SAAS;AAAA,IACb,QAAQ,mBAAmB,UAAU;AAAA,IACrC,WAAW,KAAK;AAAA,IAChB,aAAa,KAAK;AAAA,IAClB,WAAW,QAAQ;AAAA,IACnB,gBAAgB,gBAAgB;AAAA,IAChC;AAAA,IACA;AAAA,EACF;AACA,MAAI,MAAM,uBAAuB,yBAAyB,MAAM;AAC9D,UAAM,MAAM,oBAAoB;AAAA,MAC9B,WAAW,OAAO;AAAA,MAClB,aAAa,OAAO;AAAA,MACpB,WAAW,OAAO;AAAA,MAClB,YAAY,OAAO;AAAA,MACnB,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,eAAe,4BAA4B,OAMC;AAC1C,MAAI,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,IAAI,gBAAgB;AACrD,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACA,QAAM,YAAY,MAAM,IAAI;AAC5B,QAAM,iBAAiB,MAAM,IAAI;AACjC,QAAM,eAAe,MAAM,IAAI,MAAM,KAAK,aAAa,SAAS;AAChE,QAAMA,kBAAiB,MAAM,IAAI;AAAA,IAC/B,WAAW,MAAM,KAAK;AAAA,IACtB,aAAa,MAAM,KAAK;AAAA,IACxB,WAAW;AAAA,IACX,UAAU;AAAA,IACV,MAAM;AAAA,IACN,oBAAoB;AAAA,IACpB,kBAAkB,MAAM,IAAI;AAAA,IAC5B;AAAA,IACA,WAAW,MAAM,kBAAkB;AAAA,IACnC,kBAAkB;AAAA,MAChB,iBAAiB,MAAM,KAAK;AAAA,MAC5B,oBAAoB,MAAM,IAAI;AAAA,IAChC;AAAA,IACA,QAAQ;AAAA,IACR,gBACE,MAAM,kBAAkB,+BACxB,qCAAqC,MAAM,IAAI,EAAE;AAAA,EACrD,CAAC;AACD,QAAM,aAAa,qBAAqB,SAAS;AACjD,QAAM,uBAAuB,MAAM,qCAAqC,MAAM,IAAI;AAAA,IAChF,WAAW,MAAM,KAAK;AAAA,IACtB,aAAa,MAAM,KAAK;AAAA,IACxB;AAAA,IACA,oBAAoB;AAAA,IACpB,QAAQ;AAAA,EACV,CAAC;AACD,QAAM,SAAS;AAAA,IACb,QAAQ,MAAM,kBAAkB,KAAK,YAAY,wBAAwB,UAAU;AAAA,IACnF,WAAW,MAAM,KAAK;AAAA,IACtB,aAAa,MAAM,KAAK;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,MAAM,uBAAuB,yBAAyB,MAAM;AAC9D,UAAM,MAAM,oBAAoB;AAAA,MAC9B,WAAW,OAAO;AAAA,MAClB,aAAa,OAAO;AAAA,MACpB,WAAW,OAAO;AAAA,MAClB,YAAY,OAAO;AAAA,MACnB,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AACA,SAAO;AACT;AASA,SAAS,mCACP,QASA;AACA,MAAI,CAAC,OAAQ,QAAO,CAAC;AACrB,QAAM,cAAc,mBAAmB,UAAU,OAAO,WAAW;AACnE,QAAM,cAAc,mBAAmB,UAAU,OAAO,WAAW;AACnE,SAAO;AAAA,IACL,GAAI,YAAY,UAAU,EAAE,aAAa,YAAY,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA,IAG/D,GAAI,OAAO,kBAAkB,+BAA+B,KAAK,OAAO,cAAc,IAClF,EAAE,gBAAgB,OAAO,eAAe,IACxC,CAAC;AAAA,IACL,GAAI,YAAY,UAAU,EAAE,aAAa,YAAY,KAAK,IAAI,CAAC;AAAA,EACjE;AACF;AAEA,SAAS,qCAAqC,MAGlC;AACV,MAAI,KAAK,WAAW,SAAU,QAAO;AACrC,QAAM,QAAQ,KAAK,SAAS;AAC5B,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,UAAU;AAChB,SAAO,QAAQ,kBAAkB,SAAS,QAAQ,qBAAqB;AACzE;;;AEpqGA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,mBAAmB;AAAA,EACnB,0BAA0B;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,wCAAwC;AAAA,EACxC,+BAA+B;AAAA,EAC/B;AAAA,EACA;AAAA,EACA,kBAAAE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,+BAAAC,oCAAmC;AAC5C,SAAS,wBAAwB;AAGjC,SAAS,6CAA6C;AAyE/C,IAAM,gCAAgC;AAEtC,SAAS,6BACd,UACA,YAA2C,CAAC,GAC5C;AACA,QAAM,sCACJ,UAAU,qCAAqC;AACjD,QAAM,+BACJ,UAAU,8BAA8B;AAC1C,QAAM,+BACJ,UAAU,8BAA8B;AAC1C,QAAM,sCACJ,UAAU,qCAAqC;AACjD,QAAM,uCACJ,UAAU,sCAAsC;AAClD,QAAM,+BACJ,UAAU,8BAA8B;AAC1C,QAAM,2BAA2B,UAAU,0BAA0B;AACrE,QAAM,mCACJ,UAAU,kCAAkC;AAC9C,QAAM,sCACJ,UAAU,qCAAqC;AACjD,QAAM,oBAAoB,UAAU,mBAAmB;AACvD,QAAM,mCACJ,UAAU,kCAAkC;AAC9C,QAAM,2BAA2B,UAAU,0BAA0B;AACrE,QAAM,qBAAqB,UAAU,oBAAoB;AACzD,QAAM,iCACJ,UAAU,gCAAgC;AAC5C,QAAM,oBAAoB,UAAU,mBAAmB;AACvD,QAAM,6BAA6B,UAAU,4BAA4B;AACzE,QAAM,iBAAiB,UAAU,gBAAgB;AACjD,QAAM,mCACJ,UAAU,kCAAkC;AAC9C,QAAM,yCACJ,UAAU,wCAAwC;AACpD,QAAM,gCACJ,UAAU,+BAA+B;AAC3C,QAAM,mBAAmB,UAAU,kBAAkBC;AACrD,QAAM,sCACJ,UAAU,qCAAqC;AACjD,QAAM,+BACJ,UAAU,8BAA8B;AAC1C,QAAM,gCACJ,UAAU,+BAA+BC;AAC3C,QAAM,mCACJ,UAAU,kCAAkC;AAC9C,QAAM,4BAA4B,UAAU,2BAA2B;AACvE,QAAM,2BAA2B,UAAU,0BAA0B;AACrE,QAAM,qCACJ,UAAU,oCAAoC;AAEhD,iBAAe,mBACb,OACmC;AACnC,UAAM,EAAE,IAAI,KAAK,UAAU,eAAe,oBAAoB,IAAI,MAAM,SAAS;AACjF,UAAM,UAAU,MAAM,iBAAiB,IAAI,MAAM,aAAa,MAAM,SAAS;AAC7E,QAAI,QAAQ,WAAW,YAAY,QAAQ,WAAW,aAAa;AAKjE,aAAO,EAAE,QAAQ,WAAW;AAAA,IAC9B;AACA,UAAM,aACJ,MAAM,cAAc,QAAQ,sBAAsB,WAAW,MAAM,SAAS;AAC9E,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AACA,QAAI,CAAC,MAAM;AACT,YAAM,UAAU,MAAM,+BAA+B,IAAI;AAAA,QACvD,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,QACjB,oBAAoB;AAAA,MACtB,CAAC;AACD,UAAI,QAAS,QAAO,EAAE,QAAQ,QAAQ;AAEtC,YAAM,6BACJ,MAAM,iBAAiB,eAAe,MAAM;AAC9C,UACE,+BAA+B,aAC/B,MAAM,kBACN,MAAM,iBAAiB,QACvB;AACA,cAAM,UAAU,MAAM,qCAAqC,IAAI,MAAM,aAAa;AAAA,UAChF,WAAW,MAAM;AAAA,UACjB,WAAW,MAAM;AAAA,UACjB;AAAA,UACA,WAAW,MAAM;AAAA,UACjB,OAAO,MAAM;AAAA,UACb,QAAQ,MAAM,gBAAgB;AAAA,UAC9B,UAAU,MAAM,gBAAgB,YAAY;AAAA,QAC9C,CAAC;AACD,cAAM;AAAA,UACJ;AAAA,UACA,MAAM;AAAA,UACN,MAAM;AAAA,UACN,QAAQ;AAAA,QACV;AACA,eAAO,EAAE,QAAQ,QAAQ,OAAO;AAAA,MAClC;AACA,UAAI,+BAA+B,eAAe,MAAM,SAAS;AAC/D,cAAM,SAAS,MAAM,oCAAoC,IAAI,MAAM,aAAa;AAAA,UAC9E,WAAW,MAAM;AAAA,UACjB,WAAW,MAAM;AAAA,UACjB;AAAA,UACA,SAAS,MAAM;AAAA,UACf,OAAO,MAAM,SAAS;AAAA,UACtB,GAAI,MAAM,iBAAiB,gBAAgB,cACvC;AAAA,YACE,kBAAkB;AAAA,cAChB,aAAa;AAAA,cACb,MAAM,MAAM,gBAAgB;AAAA,YAC9B;AAAA,UACF,IACA,CAAC;AAAA,QACP,CAAC;AACD,YAAI,OAAO,WAAW,WAAY,QAAO,EAAE,QAAQ,WAAW;AAC9D,YAAI,OAAO,WAAW,QAAS,QAAO,EAAE,QAAQ,QAAQ;AACxD,cAAM,8BAA8B,KAAK,MAAM,aAAa,MAAM,WAAW,OAAO,MAAM;AAC1F,YAAI,OAAO,QAAQ;AACjB,gBAAM;AAAA,YACJ,EAAE,IAAI,KAAK,UAAU,eAAe,oBAAoB;AAAA,YACxD,MAAM;AAAA,YACN,MAAM;AAAA,YACN,OAAO;AAAA,UACT;AAAA,QACF;AACA,eAAO,EAAE,QAAQ,SAAS;AAAA,MAC5B;AAEA,YAAM,wBAAwB,MAAM;AACpC,YAAM,eACJ,OAAO,0BAA0B,YAAY,OAAO,SAAS,qBAAqB,IAC9E,KAAK,IAAI,KAAO,KAAK,IAAI,KAAQ,KAAK,MAAM,qBAAqB,CAAC,CAAC,IACnE;AACN,YAAM,6BAA6B,IAAI;AAAA,QACrC,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,WAAW,MAAM;AAAA,QACjB,oBAAoB;AAAA,QACpB,QAAQ;AAAA,QACR,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY;AAAA,MAC/C,CAAC;AACD,aAAO,EAAE,QAAQ,YAAY;AAAA,IAC/B;AACA,UAAM,oBAAoB,MAAM;AAChC,UAAM,2BAA2B;AAAA,MAC/B,qBACA,KAAK,OAAO,kBAAkB,UAC9B,KAAK,mBAAmB,kBAAkB,kBAC1C,KAAK,wBAAwB,kBAAkB;AAAA,IACjD;AAGA,QAAI,qBAAqB,CAAC,0BAA0B;AAClD,aAAO,EAAE,QAAQ,QAAQ;AAAA,IAC3B;AACA,UAAM,wBAAwB,2BAC1B,mBAAmB,wBACnB;AACJ,UAAM,sBAAsB,2BACxB,mBAAmB,sBACnB;AACJ,UAAM,2BAA2B,0BAA0B;AAC3D,UAAM,yBAAyB,wBAAwB;AACvD,UAAM,kCAAkC,2BACpC,mBAAmB,kCACnB;AACJ,UAAM,sBACJ,4BAA4B,mBAAmB,+BAA+B;AAChF,UAAM,yBACJ,4BAA4B,mBAAmB,kCAAkC;AACnF,QACG,uBAAuB,2BACtB,uBAAuB,4BACtB,4BAA4B,2BAC9B,0BACC,KAAK,UAAU,0BAA0B,8BAC3C;AACA,aAAO,EAAE,QAAQ,QAAQ;AAAA,IAC3B;AACA,QAAI,6BAA6B,wBAAwB;AACvD,aAAO,EAAE,QAAQ,QAAQ;AAAA,IAC3B;AACA,QAAI,CAAC,mCAAmC,qBAAqB,+BAA+B,GAAG;AAC7F,aAAO,EAAE,QAAQ,QAAQ;AAAA,IAC3B;AACA,QACE,0BAA0B,WACzB,CAAC,OAAO,cAAc,qBAAqB,KAC1C,yBAAyB,KACzB,0BAA0B,kCAAkC,KAAK,YAAY,CAAC,CAAC,IAAI,KACnF,wBAAwB,sBAAsB,mBAAmB,KACjE,OAAO,wBAAwB,YAC/B,CAAC,yBAAyB,KAAK,mBAAmB,IACpD;AACA,aAAO,EAAE,QAAQ,QAAQ;AAAA,IAC3B;AACA,UAAM,qBAAqB,2BACvB,kBAAmB,OACnB,MAAM,iBAAiB,gBAAgB,eACrC,MAAM,gBAAgB,SAAS,oBAC/B,MAAM,gBAAgB,OACtB,MAAM,+BAA+B,cACnC,+CACA;AACR,QAAI,oBAAoB;AAItB,YAAM,eAAe,2BAChB,mBAAmB,wBAAwB,CAAC,IAC7C,CAAC;AACL,UAAI,aAAa,SAAS,GAAG;AAC3B,cAAM;AAAA,UACJ;AAAA,UACA,EAAE,WAAW,MAAM,WAAW,aAAa,MAAM,YAAY;AAAA,UAC7D;AAAA,QACF;AAAA,MACF;AACA,YAAM,WAAW,MAAM,6BAA6B,IAAI,MAAM,aAAa;AAAA,QACzE,WAAW,MAAM;AAAA,QACjB,QAAQ,KAAK;AAAA,QACb,gBAAgB,KAAK;AAAA,QACrB,WAAW,MAAM;AAAA,QACjB,QAAQ,sBACJ,0CACA,yBACE,6CACC,uBAAuB;AAAA,QAC9B,GAAI,sBAAsB,EAAE,4BAA4B,KAAK,IAAI,CAAC;AAAA,QAClE,GAAI,yBAAyB,EAAE,+BAA+B,KAAK,IAAI,CAAC;AAAA,QACxE,GAAI,0BAA0B,SAAY,EAAE,sBAAsB,IAAI,CAAC;AAAA,QACvE,QAAQ;AAAA,UACN,MAAM,sBACF,0CACA,yBACE,6CACA,wBAAwB,kCACtB,yBACC,uBAAuB;AAAA,UAChC,WAAW,CAAC,uBAAuB,CAAC;AAAA,UACpC,GAAI,sBAAsB,EAAE,cAAc,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,UAC5E,GAAI,yBACA;AAAA,YACE,cAAc;AAAA,YACd,QAAQ;AAAA,YACR,mBAAmB;AAAA,YACnB,uBAAuB;AAAA,UACzB,IACA,CAAC;AAAA,UACL,GAAI,0BAA0B,SAC1B;AAAA,YACE,qBAAqB;AAAA,YACrB;AAAA,YACA,GAAI,wBAAwB,kCACxB;AAAA,cACE,mBAAmB;AAAA,cACnB,0BAA0B,sBAAsB,mBAAmB;AAAA,cACnE,iBAAiB;AAAA,YACnB,IACA,CAAC;AAAA,UACP,IACA,CAAC;AAAA,UACL,gBAAgB;AAAA,QAClB;AAAA,QACA,cAAc,CAAC,SAAS;AAAA,MAC1B,CAAC;AACD,UAAI,SAAS,WAAW,aAAc,QAAO,EAAE,QAAQ,QAAQ;AAC/D,YAAM,8BAA8B,KAAK,MAAM,aAAa,MAAM,WAAW,SAAS,MAAM;AAC5F,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,GAAI,oCAAoC,SACpC,EAAE,iBAAiB,gCAAgC,IACnD,CAAC;AAAA,MACP;AAAA,IACF;AACA,UAAM,UAAU,MAAM,kBAAkB,IAAI,MAAM,aAAa,KAAK,cAAc;AAClF,UAAM,SAAS,MAAM,6BAA6B,IAAI,MAAM,aAAa;AAAA,MACvE,WAAW,MAAM;AAAA,MACjB,QAAQ,KAAK;AAAA,MACb,gBAAgB,KAAK;AAAA,MACrB,WAAW,MAAM;AAAA,MACjB,YAAY;AAAA,MACZ,eAAe;AAAA,MACf,cAAc;AAAA,MACd,QAAQ;AAAA,QACN;AAAA,UACE,MAAM;AAAA,UACN,SAAS;AAAA,YACP,gBAAgB,KAAK;AAAA,YACrB,SAAS,SAAS,WAAW;AAAA,YAC7B,OAAO,MAAM,SAAS;AAAA,UACxB;AAAA,QACF;AAAA,QACA,EAAE,MAAM,0BAA0B,SAAS,EAAE,QAAQ,SAAS,EAAE;AAAA,MAClE;AAAA,IACF,CAAC;AACD,QAAI,OAAO,WAAW,SAAS;AAC7B,aAAO,EAAE,QAAQ,QAAQ;AAAA,IAC3B;AACA,UAAM,8BAA8B,KAAK,MAAM,aAAa,MAAM,WAAW,OAAO,MAAM;AAC1F,UAAM;AAAA,MACJ,EAAE,IAAI,KAAK,UAAU,eAAe,oBAAoB;AAAA,MACxD,MAAM;AAAA,MACN,MAAM;AAAA,MACN,KAAK;AAAA,IACP;AACA,WAAO,EAAE,QAAQ,SAAS;AAAA,EAC5B;AAEA,iBAAe,2BACb,OACsD;AACtD,UAAM,EAAE,IAAI,KAAK,cAAc,IAAI,MAAM,SAAS;AAClD,QAAI,MAAM,UAAU,oBAAoB;AAItC,YAAM,SAAS,MAAM,6BAA6B,IAAI;AAAA,QACpD,aAAa,MAAM;AAAA,QACnB,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,QACjB,oBAAoB,MAAM;AAAA,MAC5B,CAAC;AACD,YAAM,8BAA8B,KAAK,MAAM,aAAa,MAAM,WAAW,MAAM;AACnF,aAAO,EAAE,QAAQ,QAAQ;AAAA,IAC3B;AACA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AACA,QAAI,QAAQ,OAAO,SAAS,GAAG;AAC7B,YAAM,8BAA8B,KAAK,MAAM,aAAa,MAAM,WAAW,QAAQ,MAAM;AAAA,IAC7F;AACA,UAAM,wBAAwB,IAAI,eAAe,oBAAoB,wBAAwB;AAC7F,WAAO,EAAE,QAAQ,QAAQ,OAAO;AAAA,EAClC;AAMA,iBAAe,gCACb,OACe;AACf,UAAM,EAAE,IAAI,KAAK,cAAc,IAAI,MAAM,SAAS;AAClD,UAAM,SAAS,MAAM,6BAA6B,IAAI;AAAA,MACpD,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,MACjB,oBAAoB,MAAM;AAAA,MAC1B,uBAAuB,MAAM;AAAA,MAC7B,oBAAoB,MAAM;AAAA,MAC1B,oBAAoB;AAAA,IACtB,CAAC;AACD,QAAI;AACF,YAAM,8BAA8B,KAAK,MAAM,aAAa,MAAM,WAAW,MAAM;AAAA,IACrF,SAAS,OAAO;AAId,oBAAc,MAAM,kDAAkD;AAAA,QACpE,uBAAuB,MAAM;AAAA,QAC7B,uBAAuB,MAAM;AAAA,QAC7B,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AAEA,iBAAe,0CACb,OACkD;AAClD,UAAM,EAAE,IAAI,KAAK,8BAA8B,IAAI,MAAM,SAAS;AAClE,UAAM,cAAc,MAAM,+BAA+B,IAAI;AAAA,MAC3D,GAAG;AAAA,MACH,oBAAoB,MAAM;AAAA,IAC5B,CAAC;AACD,QAAI,CAAC,YAAa,QAAO,EAAE,QAAQ,QAAQ;AAC3C,QAAI,CAAC,YAAY,UAAU;AACzB,UAAI,CAAC,8BAA+B,QAAO,EAAE,QAAQ,UAAU;AAC/D,YAAM,QAAQ,MAAM,8BAA8B,WAAW;AAC7D,UAAI,UAAU,UAAW,QAAO,EAAE,QAAQ,UAAU;AAAA,IACtD;AACA,UAAM,SAAS,MAAM,oCAAoC,IAAI;AAAA,MAC3D,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,MACjB,oBAAoB,MAAM;AAAA,MAC1B,uBAAuB,YAAY;AAAA,MACnC,oBAAoB,YAAY;AAAA,MAChC,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,YAAM;AAAA,QACJ;AAAA,QACA,MAAM;AAAA,QACN,MAAM;AAAA,QACN,OAAO;AAAA,MACT,EAAE,MAAM,MAAM,MAAS;AAAA,IACzB;AACA,WAAO,EAAE,QAAQ,OAAO,OAAO;AAAA,EACjC;AAKA,iBAAe,uCACb,OAC+C;AAC/C,UAAM,EAAE,IAAI,KAAK,+BAA+B,UAAU,eAAe,oBAAoB,IAC3F,MAAM,SAAS;AACjB,UAAM,MAAM,MAAM,+BAA+B,IAAI;AAAA,MACnD,GAAG;AAAA,MACH,oBAAoB,MAAM;AAAA,IAC5B,CAAC;AACD,QAAI,CAAC,OAAO,IAAI,kBAAkB,MAAM,iBAAiB,IAAI,eAAe,MAAM;AAChF,aAAO,EAAE,QAAQ,QAAQ;AAC3B,QAAI,CAAC,8BAA+B,QAAO,EAAE,QAAQ,UAAU;AAC/D,QAAI;AACF,UAAK,MAAM,8BAA8B,GAAG,MAAO,UAAW,QAAO,EAAE,QAAQ,UAAU;AAAA,IAC3F,SAAS,OAAO;AACd,UAAI,iBAAiB,iBAAkB,OAAM;AAC7C,UAAI,uBAAuB,GAAG,mBAAmB;AAC/C,cAAM,IAAI,iBAAiB,wCAAwC;AACrE,aAAO,EAAE,QAAQ,UAAU;AAAA,IAC7B;AACA,QAAI,uBAAuB,GAAG,mBAAmB;AAC/C,YAAM,IAAI,iBAAiB,wCAAwC;AACrE,UAAM,SAAS,MAAM,iCAAiC,IAAI;AAAA,MACxD,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,WAAW,MAAM;AAAA,MACjB,QAAQ,MAAM;AAAA,MACd,WAAW,MAAM;AAAA,MACjB,qBAAqB,MAAM;AAAA,MAC3B,oBAAoB,IAAI;AAAA,MACxB,uBAAuB,IAAI;AAAA,MAC3B,oBAAoB,IAAI;AAAA,MACxB,iBAAiB;AAAA,MACjB,iBAAiB;AAAA,IACnB,CAAC;AAGD,QAAI,OAAO,OAAO,SAAS;AACzB,YAAM;AAAA,QACJ;AAAA,QACA,MAAM;AAAA,QACN,MAAM;AAAA,QACN,OAAO;AAAA,MACT,EAAE,MAAM,MAAM,MAAS;AACzB,QAAI,OAAO,WAAW;AACpB,YAAM;AAAA,QACJ,EAAE,IAAI,KAAK,UAAU,eAAe,oBAAoB;AAAA,QACxD,MAAM;AAAA,QACN,MAAM;AAAA,QACN,OAAO;AAAA,MACT;AACF,WAAO,EAAE,QAAQ,OAAO,OAAO;AAAA,EACjC;AASA,iBAAe,gBAAgB,OAA6D;AAC1F,UAAM,EAAE,UAAU,IAAI,KAAK,eAAe,oBAAoB,IAAI,MAAM,SAAS;AACjF,UAAM,SAAS,MAAM,yBAAyB,IAAI,MAAM,aAAa;AAAA,MACnE,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,OAAO,WAAW,WAAW,OAAO,WAAW,aAAa;AAC9D,aAAO,EAAE,QAAQ,OAAO,OAAO;AAAA,IACjC;AACA,uCAAmC,eAAe;AAAA,MAChD,SAAS,OAAO,WAAW,aAAa,cAAc;AAAA,MACtD,aAAa,MAAM;AAAA,IACrB,CAAC;AACD,UAAM,8BAA8B,KAAK,MAAM,aAAa,MAAM,WAAW,OAAO,MAAM;AAC1F,UAAM,wBAAwB,IAAI,eAAe,oBAAoB,wBAAwB;AAC7F,QAAI,OAAO,WAAW,YAAY;AAChC,YAAM;AAAA,QACJ,EAAE,IAAI,KAAK,UAAU,eAAe,oBAAoB;AAAA,QACxD,MAAM;AAAA,QACN,MAAM;AAAA,QACN,OAAO;AAAA,MACT;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ,OAAO;AAAA,QACf,cAAc,OAAO;AAAA,MACvB;AAAA,IACF;AACA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ,OAAO;AAAA,MACf,cAAc,OAAO;AAAA,IACvB;AAAA,EACF;AAUA,iBAAe,yBACb,OACyC;AACzC,UAAM,EAAE,IAAI,KAAK,cAAc,IAAI,MAAM,SAAS;AAClD,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AACA,QAAI,CAAC,KAAM,QAAO,EAAE,QAAQ,QAAQ;AACpC,QACE,KAAK,OAAO,MAAM,UAClB,KAAK,mBAAmB,MAAM,kBAC9B,KAAK,wBAAwB,MAAM,uBACnC,MAAM,uBAAuB,KAC7B,MAAM,0BAA0B,kCAAkC,KAAK,QAAQ,IAAI,KACnF,MAAM,wBAAwB,mCAC9B;AACA,aAAO,EAAE,QAAQ,aAAa;AAAA,IAChC;AACA,UAAM,WAAW,MAAM,6BAA6B,IAAI,MAAM,aAAa;AAAA,MACzE,WAAW,MAAM;AAAA,MACjB,QAAQ,MAAM;AAAA,MACd,gBAAgB,MAAM;AAAA,MACtB,WAAW,MAAM;AAAA,MACjB,QAAQ;AAAA,MACR,uBAAuB,MAAM;AAAA,MAC7B,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,WAAW;AAAA,QACX,iBAAiB,MAAM;AAAA,QACvB,uBAAuB,MAAM;AAAA,QAC7B,gBAAgB;AAAA,MAClB;AAAA,MACA,cAAc,CAAC,SAAS;AAAA,IAC1B,CAAC;AACD,QAAI,SAAS,WAAW,cAAc;AACpC,aAAO,EAAE,QAAQ,QAAQ;AAAA,IAC3B;AACA,UAAM,8BAA8B,KAAK,MAAM,aAAa,MAAM,WAAW,SAAS,MAAM;AAC5F,UAAM,wBAAwB,IAAI,eAAe,oBAAoB,wBAAwB;AAC7F,WAAO,EAAE,QAAQ,aAAa;AAAA,EAChC;AAEA,iBAAe,gBAAgB,OAA6B;AAC1D,UAAM,EAAE,IAAI,KAAK,eAAe,8BAA8B,IAAI,MAAM,SAAS;AAIjF,UAAM,oBACJ,MAAM,sBAAsB,MAAM,eAAe,IAAI,MAAM,WAAW,IAAI;AAC5E,QAAI,CAAC,kBAAmB,QAAO,EAAE,MAAM,cAAuB;AAC9D,QAAI,OAAO,MAAM;AAAA,MACf;AAAA,MACA,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,MACN;AAAA,IACF;AACA,QAAI,KAAK,SAAS,cAAe,QAAO;AACxC,QAAI,KAAK,SAAS,uBAAuB,KAAK,WAAW,iCAAiC;AACxF,YAAM,MAAM,KAAK;AACjB,UAAI,OAAO,YAAY,OAAO,eAAe,KAAK;AAChD,cAAM,UAAU,MAAM,iCAAiC,IAAI;AAAA,UACzD,WAAW;AAAA,UACX,aAAa,MAAM;AAAA,UACnB,WAAW,MAAM;AAAA,UACjB,QAAQ,IAAI;AAAA,UACZ,WAAW,IAAI;AAAA,QACjB,CAAC;AACD,YAAI,QAAQ,OAAO,SAAS;AAC1B,gBAAM;AAAA,YACJ;AAAA,YACA,MAAM;AAAA,YACN,MAAM;AAAA,YACN,QAAQ;AAAA,UACV;AACF,YAAI,QAAQ;AACV,iBAAO,MAAM;AAAA,YACX;AAAA,YACA,MAAM;AAAA,YACN,MAAM;AAAA,YACN,MAAM;AAAA,YACN;AAAA,UACF;AAAA,MACJ;AAAA,IACF;AACA,QAAI,KAAK,SAAS,iBAAiB;AAGjC,UAAI,qBAAwD;AAC5D,UAAI,+BAA+B;AACjC,YAAI;AACF,+BAAqB,MAAM,8BAA8B,KAAK,WAAW;AAAA,QAC3E,SAAS,OAAO;AACd,cAAI,iBAAiB,iBAAkB,OAAM;AAC7C,cAAI,uBAAuB,GAAG,mBAAmB;AAC/C,kBAAM,IAAI,iBAAiB,+BAA+B;AAAA,QAK9D;AAAA,MACF;AACA,UAAI,uBAAuB,GAAG,mBAAmB;AAC/C,cAAM,IAAI,iBAAiB,+BAA+B;AAC5D,YAAM,UAAU,MAAM;AAAA,QACpB;AAAA,QACA,MAAM;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,QACN;AAAA,MACF;AACA,UACE,QAAQ,SAAS,mBACjB,QAAQ,WAAW,KAAK,UACxB,QAAQ,cAAc,KAAK,aAC3B,QAAQ,wBAAwB,KAAK,uBACrC,QAAQ,YAAY,eAAe,KAAK,YAAY,cACpD,QAAQ,YAAY,kBAAkB,KAAK,YAAY,iBACvD,QAAQ,YAAY,eAAe,KAAK,YAAY;AAEpD,eAAO;AACT,aAAO,EAAE,GAAG,SAAS,mBAAmB;AAAA,IAC1C;AACA,UAAM,wBAAwB,IAAI,eAAe,oBAAoB,wBAAwB;AAC7F,WAAO;AAAA,EACT;AAEA,iBAAe,uBACb,OACuC;AACvC,UAAM,EAAE,IAAI,IAAI,IAAI,MAAM,SAAS;AACnC,UAAM,SAAS,MAAM,yBAAyB,IAAI,KAAK;AACvD,QAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,YAAM,8BAA8B,KAAK,MAAM,aAAa,MAAM,WAAW,OAAO,MAAM;AAAA,IAC5F;AACA,WAAO,EAAE,QAAQ,OAAO,OAAO;AAAA,EACjC;AAEA,iBAAe,wBACb,OACwC;AACxC,UAAM,EAAE,IAAI,IAAI,IAAI,MAAM,SAAS;AACnC,UAAM,SAAS,MAAM,iCAAiC,IAAI,KAAK;AAC/D,QAAI,OAAO,WAAW,YAAa,QAAO,EAAE,QAAQ,YAAY;AAChE,QAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,YAAM,8BAA8B,KAAK,MAAM,aAAa,MAAM,WAAW,OAAO,MAAM;AAAA,IAC5F;AACA,WAAO;AAAA,MACL,QAAQ,OAAO,QAAQ,WAAW,YAAY,YAAY;AAAA,IAC5D;AAAA,EACF;AAEA,iBAAe,qCACb,OACqD;AACrD,UAAM,EAAE,IAAI,KAAK,cAAc,IAAI,MAAM,SAAS;AAClD,UAAM,SAAS,MAAM,uCAAuC,IAAI,KAAK;AACrE,QAAI,OAAO,WAAW,aAAa,OAAO,cAAc;AAEtD,4CAAsC,aAAa,EAAE;AAAA,QACnD,MAAM,OAAO,aAAa;AAAA,QAC1B,SAAS;AAAA,QACT,QAAQ,KAAK,IAAI,IAAI,OAAO,aAAa,UAAU,QAAQ;AAAA,MAC7D,CAAC;AAAA,IACH;AACA,QAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,YAAM,8BAA8B,KAAK,MAAM,aAAa,MAAM,WAAW,OAAO,MAAM;AAAA,IAC5F;AACA,WAAO,EAAE,QAAQ,OAAO,OAAO;AAAA,EACjC;AAGA,iBAAe,4BACb,OAC4C;AAC5C,UAAM,EAAE,IAAI,IAAI,IAAI,MAAM,SAAS;AACnC,UAAM,SAAS,MAAM,8BAA8B,IAAI,KAAK;AAC5D,QAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,YAAM,8BAA8B,KAAK,MAAM,aAAa,MAAM,WAAW,OAAO,MAAM;AAAA,IAC5F;AACA,WAAO,EAAE,QAAQ,OAAO,OAAO;AAAA,EACjC;AAEA,iBAAe,gBAAgB,OAA4C;AACzE,UAAM,EAAE,IAAI,KAAK,UAAU,eAAe,oBAAoB,IAAI,MAAM,SAAS;AACjF,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AACA,QAAI,QAAQ,OAAO,SAAS,GAAG;AAC7B,YAAM,8BAA8B,KAAK,MAAM,aAAa,MAAM,WAAW,QAAQ,MAAM;AAAA,IAC7F;AACA,UAAM,wBAAwB,IAAI,eAAe,oBAAoB,wBAAwB;AAC7F,QAAI,QAAQ,WAAW,WAAW,CAAC,QAAQ,cAAc;AACvD;AAAA,IACF;AAIA,UAAM;AAAA,MACJ,EAAE,IAAI,KAAK,UAAU,eAAe,oBAAoB;AAAA,MACxD,MAAM;AAAA,MACN,MAAM;AAAA,MACN,QAAQ;AAAA,IACV;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,mCAAmC;AAAA,IACnC,gCAAgC;AAAA,IAChC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAe,wBACb,IACA,eACA,oBACA,0BACe;AACf,MAAI;AACF,6BAAyB,eAAe,MAAM,mBAAmB,EAAE,CAAC;AAAA,EACtE,QAAQ;AAAA,EAER;AACF;;;ACx2BA,SAAS,cAAAC,aAAY,cAAAC,mBAAkB;AACvC,SAAS,YAAY;AACrB,SAAS,kBAAkB,yBAAyB;AACpD,SAAS,SAAS,UAAU;AAC5B,SAAS,cAAc;AACvB,SAAS,YAAY;AACrB,SAAS,iBAAiB;AAC1B,SAAS,gBAAgB;AACzB,SAAS,aAAa,eAAe,0BAA0B;AAC/D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAQA,SAAS,0BAA0B,OAAwB;AAChE,MAAI,iBAAiB,8BAA8B;AACjD,YAAQ,MAAM,MAAM;AAAA,MAClB,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT;AACE,eAAO;AAAA,IACX;AAAA,EACF;AACA,SAAO;AACT;AAEO,IAAM,sCAAsC;AAO5C,IAAM,iCAAiC,KAAK,KAAK;AACjD,IAAM,gCAAgC,IAAI,KAAK;AAC/C,IAAM,mCAAmC;AACzC,IAAM,mCAAmC;AAWhD,eAAsB,yBACpB,MACA,SACgB;AAChB,QAAM,OAAO,mBAAmB,EAAE,QAAQ,EAAE,CAAC,cAAc,uBAAuB,GAAG,EAAE,EAAE,CAAC;AAC1F,QAAM,OAAOD,YAAW,QAAQ;AAChC,MAAI,WAAW;AACf,QAAM,QAAQ,IAAI,UAAU;AAAA,IAC1B,UAAU,OAAe,WAAW,UAAU;AAC5C,WAAK,OAAO,KAAK;AACjB,kBAAY,MAAM;AAClB,eAAS,MAAM,KAAK;AAAA,IACtB;AAAA,EACF,CAAC;AACD,QAAM,SAAS,SAAS,MAAM,OAAO,kBAAkB,MAAM,EAAE,OAAO,MAAM,MAAM,IAAM,CAAC,CAAC;AAC1F,QAAM,QAAQ,OAAO,SAAiB;AACpC,QAAI,CAAC,KAAK,MAAM,GAAG,IAAI;AAAA,CAAI,EAAG,OAAM,KAAK,MAAM,OAAO;AAAA,EACxD;AACA,MAAI;AACF,UAAM,QAAQ,KAAK;AACnB,SAAK,IAAI;AACT,UAAM;AAAA,EACR,SAAS,OAAO;AACd,SAAK,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;AACtE,UAAM,OAAO,MAAM,MAAM,MAAS;AAClC,UAAM,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC;AAC9B,UAAM;AAAA,EACR;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,QAAQ,KAAK,OAAO,KAAK;AAAA,IACzB,MAAM,MAAM,iBAAiB,IAAI;AAAA,IACjC,SAAS,YAAY,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC;AAAA,EAC/C;AACF;AAEO,SAAS,yBAAyB,OAA4B,WAAmB;AACtF,QAAM,SAAS,oBAAoB,MAAM,WAAW,IAAI,MAAM,SAAS,IAAI,SAAS;AACpF,SAAO;AAAA,IACL,QAAQ,GAAG,MAAM;AAAA,IACjB,YAAY,GAAG,MAAM;AAAA,EACvB;AACF;AAGA,eAAe,YAAY,IAAc,OAA4B,MAAc;AACjF,QAAM,YAAoC,CAAC;AAC3C,QAAM,aAAa,MAAM,6BAA6B,IAAI,KAAK;AAC/D,QAAM,QAAQ,MAAM,yBAAyB,MAAM,OAAO,UAAU;AAClE,UAAM;AAAA,MACJ,aAAa,KAAK,UAAU,sBAAsB,CAAC,cAAc,8BAA8B,gBAC9E,KAAK,WAAU,oBAAI,KAAK,GAAE,YAAY,CAAC,CAAC,aAC3C,KAAK,UAAU,8BAA8B,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,cACtE,UAAU;AAAA,IAC3B;AACA,eAAW,QAAQ,+BAA+B;AAChD,UAAI,QAAyB;AAC7B,UAAI,QAAQ;AACZ,iBAAS;AACP,cAAM,OAAO,MAAM,uBAAuB,IAAI,OAAO,MAAM;AAAA,UACzD;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AACD,mBAAW,OAAO,KAAK,MAAM;AAC3B,gBAAM,MAAM,YAAY,KAAK,UAAU,KAAK,KAAK,CAAC,UAAU,GAAG,GAAG;AAAA,QACpE;AACA,iBAAS,KAAK,KAAK;AACnB,YAAI,KAAK,KAAK,SAAS,iCAAkC;AACzD,gBAAQ,KAAK;AAAA,MACf;AACA,gBAAU,KAAK,KAAK,IAAI;AAAA,IAC1B;AACA,UAAM,MAAM,2BAA2B,KAAK,UAAU,SAAS,CAAC,GAAG;AAAA,EACrE,CAAC;AACD,SAAO,EAAE,OAAO,UAAU;AAC5B;AAGA,eAAe,gBAAgB,IAAc,OAA4B,MAAc;AACrF,MAAI,SAAS;AACb,QAAM,QAAQ,MAAM,yBAAyB,MAAM,OAAO,UAAU;AAClE,UAAM;AAAA,MACJ,KAAK,UAAU;AAAA,QACb,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,aAAa,MAAM;AAAA,QACnB,WAAW,MAAM;AAAA,MACnB,CAAC;AAAA,IACH;AACA,QAAI,gBAAgB;AACpB,eAAS;AACP,YAAM,OAAO,MAAM,mCAAmC,IAAI,OAAO;AAAA,QAC/D;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AACD,iBAAW,SAAS,KAAM,OAAM,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC,CAAC;AAC/D,gBAAU,KAAK;AACf,UAAI,KAAK,SAAS,IAAK;AACvB,sBAAgB,KAAK,GAAG,EAAE,EAAG;AAAA,IAC/B;AACA,UAAM,MAAM,KAAK,UAAU,EAAE,KAAK,MAAM,OAAO,CAAC,CAAC;AAAA,EACnD,CAAC;AACD,SAAO,EAAE,OAAO,OAAO;AACzB;AA0BO,SAAS,+BACd,UACA,UAAyC,CAAC,GAC1C;AACA,QAAM,oBAAoB,QAAQ,qBAAqB;AACvD,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,SAAS,QAAQ,UAAU;AAEjC,iBAAe,WACb,IACA,SACA,OACA,aACgC;AAChC,UAAM,OAAO,yBAAyB,OAAOC,YAAW,CAAC;AACzD,UAAM,QAAQ,MAAM,oBAAoB,IAAI,OAAO;AAAA,MACjD;AAAA,MACA,YAAY,CAAC,KAAK,QAAQ,KAAK,UAAU;AAAA,IAC3C,CAAC;AACD,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,2BAA2B,CAAC;AAC3E,QAAI;AACF,YAAM,SAAS,MAAM,YAAY,IAAI,OAAO,KAAK,WAAW,kBAAkB,CAAC;AAC/E,YAAM,aAAa,MAAM,gBAAgB,IAAI,OAAO,KAAK,WAAW,sBAAsB,CAAC;AAC3F,YAAM,OAAO,SAAS,KAAK,QAAQ,OAAO,KAAK;AAC/C,YAAM,OAAO,SAAS,KAAK,YAAY,WAAW,KAAK;AACvD,YAAM,WAAmC;AAAA,QACvC,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,YAAY,CAAC,KAAK,QAAQ,KAAK,UAAU;AAAA,QACzC,QAAQ,EAAE,KAAK,KAAK,QAAQ,OAAO,OAAO,MAAM,UAAU,QAAQ,OAAO,MAAM,OAAO;AAAA,QACtF,YAAY;AAAA,UACV,KAAK,KAAK;AAAA,UACV,OAAO,WAAW,MAAM;AAAA,UACxB,QAAQ,WAAW,MAAM;AAAA,UACzB,QAAQ,WAAW;AAAA,QACrB;AAAA,QACA,QAAQ,OAAO,MAAM;AAAA,QACrB,WAAW,OAAO;AAAA,QAClB,WAAW,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAAA,MACzC;AACA,UAAI,CAAE,MAAM,uBAAuB,IAAI,OAAO,QAAQ,GAAI;AACxD,cAAM,IAAI,MAAM,iDAAiD;AAAA,MACnE;AACA,aAAO;AAAA,IACT,SAAS,OAAO;AACd,YAAM,sBAAsB,IAAI,KAAK,EAAE,MAAM,MAAM,MAAS;AAC5D,YAAM;AAAA,IACR,UAAE;AACA,YAAM,GAAG,WAAW,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,IACtD;AAAA,EACF;AAEA,iBAAe,eACb,IACA,OACA,UACiB;AACjB,QAAI,SAAS;AACb,WAAO,IAAI,IAAI,UAAU;AACvB,YAAM,OAAO,MAAM,4BAA4B,IAAI,OAAO;AAAA,QACxD,WAAW;AAAA,MACb,CAAC;AACD,gBAAU,KAAK;AACf,UAAI,KAAK,SAAU;AAAA,IACrB;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,sBAA0D;AACvE,UAAM,EAAE,IAAI,eAAe,eAAe,SAAS,IAAI,MAAM,SAAS;AACtE,UAAM,WAAW,IAAI,IAAI;AACzB,UAAM,SAAoC;AAAA,MACxC,SAAS,SAAS;AAAA,MAClB,UAAU;AAAA,MACV,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,YAAY;AAAA,MACZ,gBAAgB;AAAA,IAClB;AACA,QAAI,eAAe;AACjB,iBAAW,YAAY,MAAM,mCAAmC,IAAI;AAAA,QAClE,qBAAqB;AAAA,QACrB,OAAO;AAAA,MACT,CAAC,GAAG;AACF,YAAI;AACF,gBAAM,cAAc,aAAa,SAAS,SAAS;AACnD,cAAI,MAAM,qCAAqC,IAAI,SAAS,SAAS,GAAG;AACtE,mBAAO,kBAAkB;AAAA,UAC3B;AAAA,QACF,SAAS,OAAO;AACd,wBAAc,KAAK,8DAA8D;AAAA,YAC/E,aAAa,SAAS;AAAA,YACtB,WAAW,SAAS;AAAA,YACpB,WAAW,iBAAiB,QAAQ,MAAM,OAAO;AAAA,UACnD,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAEA,eAAW,cAAc,MAAM,8BAA8B,IAAI;AAAA,MAC/D,cAAc;AAAA,MACd,OAAO;AAAA,IACT,CAAC,GAAG;AACF,UAAI,IAAI,KAAK,SAAU;AAGvB,UAAI;AACF,YAAI,WAAW,UAAU,aAAa;AACpC,cAAI,MAAM,sBAAsB,IAAI,UAAU,EAAG,QAAO,aAAa;AAAA,QACvE,OAAO;AACL,iBAAO,cAAc,MAAM,eAAe,IAAI,YAAY,QAAQ;AAAA,QACpE;AAAA,MACF,SAAS,OAAO;AACd,eAAO,UAAU;AACjB,sBAAc,KAAK,uDAAuD;AAAA,UACxE,aAAa,WAAW;AAAA,UACxB,WAAW,WAAW;AAAA,UACtB,YAAY;AAAA,UACZ,WAAW,0BAA0B,KAAK;AAAA,QAC5C,CAAC;AAAA,MACH;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,sBAAuB,QAAO;AAC5C,QAAI,CAAC,eAAe;AAClB,oBAAc,KAAK,iEAAiE;AACpF,aAAO;AAAA,IACT;AACA,UAAM,cAAc,SAAS,yBAAyB,KAAK,KAAK;AAIhE,UAAM,YAAY,oBAAI,IAAY;AAClC,eAAS;AACP,UAAI,IAAI,KAAK,SAAU;AACvB,YAAM,cACJ,MAAM,6BAA6B,IAAI;AAAA,QACrC;AAAA,QACA,OAAO,oBAAoB,UAAU;AAAA,MACvC,CAAC,GACD,OAAO,CAAC,cAAc,CAAC,UAAU,IAAI,UAAU,SAAS,CAAC;AAC3D,UAAI,WAAW,WAAW,EAAG;AAC7B,iBAAW,SAAS,WAAW,MAAM,GAAG,iBAAiB,GAAG;AAC1D,YAAI,IAAI,KAAK,SAAU;AACvB,kBAAU,IAAI,MAAM,SAAS;AAC7B,YAAI;AACF,gBAAM,UAAU,MAAM,WAAW,IAAI,eAAe,OAAO,WAAW;AACtE,cAAI,YAAY,WAAW;AACzB,mBAAO,WAAW;AAClB;AAAA,UACF;AACA,iBAAO,YAAY;AACnB,iBAAO,cAAc,MAAM,eAAe,IAAI,OAAO,QAAQ;AAAA,QAC/D,SAAS,OAAO;AACd,iBAAO,UAAU;AACjB,wBAAc,KAAK,kDAAkD;AAAA,YACnE,aAAa,MAAM;AAAA,YACnB,WAAW,MAAM;AAAA;AAAA,YAEjB,YAAY;AAAA,YACZ,WAAW,0BAA0B,KAAK;AAAA,UAC5C,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,WAAW,OAAO,SAAS,OAAO,YAAY,OAAO,iBAAiB,GAAG;AAClF,oBAAc,KAAK,iCAAiC,EAAE,GAAG,OAAO,CAAC;AAAA,IACnE;AACA,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,oBAAoB;AAC/B;;;AC7XA,SAAS,mCAAmC;AAIrC,IAAM,2CAA2C;AAEjD,IAAM,iCAAiC,KAAK,KAAK;AAoBjD,SAAS,+BACd,UACA,UAAyC,CAAC,GAC1C;AACA,QAAM,cAAc,QAAQ,yBAAyB;AACrD,QAAM,uBAAuB,QAAQ,wBAAwB;AAC7D,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,MAAM,QAAQ,OAAO,KAAK;AAEhC,iBAAe,yBAAgE;AAC7E,UAAM,EAAE,IAAI,cAAc,IAAI,MAAM,SAAS;AAC7C,UAAM,WAAW,IAAI,IAAI;AACzB,UAAM,oBAAoB,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,EAAE;AAC5E,OAAG;AACD,YAAM,QAAQ,MAAM,qBAAqB,IAAI;AAAA,QAC3C,SAAS;AAAA,QACT,YAAY,CAAC,WAAW,UACtB,cAAc,KAAK,+DAA+D;AAAA,UAChF,MAAM,UAAU;AAAA,UAChB,aAAa,UAAU;AAAA,UACvB,WAAW,UAAU;AAAA,UACrB,WAAW,UAAU;AAAA,UACrB,WAAW,iBAAiB,QAAQ,MAAM,OAAO;AAAA,QACnD,CAAC;AAAA,MACL,CAAC;AACD,wBAAkB,WAAW,MAAM;AACnC,wBAAkB,aAAa,MAAM;AACrC,wBAAkB,WAAW,MAAM;AACnC,wBAAkB,UAAU,MAAM;AAElC,UAAI,MAAM,cAAc,EAAG;AAAA,IAC7B,SAAS,IAAI,IAAI;AACjB,QAAI,kBAAkB,YAAY,KAAK,kBAAkB,SAAS,GAAG;AACnE,oBAAc,KAAK,4CAA4C,iBAAiB;AAAA,IAClF;AAEA,WAAO,EAAE,kBAAkB;AAAA,EAC7B;AAEA,SAAO,EAAE,uBAAuB;AAClC;;;AClEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,2CAA2C;AACpD,SAAS,wCAAwC;AAQjD,IAAM,aAAa;AACnB,IAAM,8BAA8B;AACpC,IAAM,gCAAgC;AAW/B,SAAS,6BAA6B,UAAkD;AAC7F,SAAO;AAAA,IACL,MAAM,+BAA4E;AAChF,YAAM,UAAU,MAAM,SAAS;AAE/B,YAAM,SAAS,MAAM,4BAA4B,QAAQ,IAAI,GAAG;AAChE,iBAAW,SAAS,QAAQ;AAC1B,YAAI;AACF,gBAAMC,UAAS,MAAM;AAAA,YAAiB,QAAQ;AAAA,YAAI,MAAM;AAAA,YAAc,CAAC,WACrE,OAAO;AAAA,cAAY,CAAC,OAClB,qCAAqC,IAA2B;AAAA,gBAC9D,aAAa,MAAM;AAAA,gBACnB,SAAS,MAAM;AAAA,cACjB,CAAC;AAAA,YACH;AAAA,UACF;AACA,cAAIA,SAAQ,yBAAyB;AACnC,kBAAM,QAAQ,MAAM;AAAA,cAClB,QAAQ;AAAA,cACR,MAAM;AAAA,cACNA,QAAO;AAAA,YACT;AACA,gBAAI;AACF,oBAAM,oCAAoC,QAAQ,KAAK,MAAM,cAAc,KAAK;AAAA,UACpF;AAAA,QACF,SAAS,OAAO;AACd,kBAAQ,cAAc,KAAK,oCAAoC;AAAA,YAC7D,aAAa,MAAM;AAAA,YACnB,OAAO,OAAO,KAAK;AAAA,UACrB,CAAC;AAAA,QACH;AAAA,MACF;AACA,UAAI,UAAU;AACd,UAAI,WAAW;AACf,UAAI,mBAAmB;AACvB,UAAI,cAAc;AAClB,YAAM,2BACJ,CAAC;AACH,UAAI,YAAY;AAChB,UAAI,SAAS;AACb,UAAI,sBAAsB;AAC1B,iBAAS;AACP,cAAM,YAAY,8BAA8B;AAChD,YAAI,aAAa,GAAG;AAClB,gCAAsB;AACtB;AAAA,QACF;AACA,cAAM,QAAQ,KAAK,IAAI,YAAY,SAAS;AAC5C,cAAM,QAAQ,MAAM,qCAAqC,SAAS,KAAK;AACvE,mBAAW,MAAM;AACjB,oBAAY,MAAM;AAClB,qBAAa,MAAM;AACnB,4BAAoB,MAAM;AAC1B,uBAAe,MAAM;AACrB,mBAAW,CAAC,SAAS,KAAK,KAAK,OAAO,QAAQ,MAAM,wBAAwB,GAAG;AAC7E,gBAAM,MAAM;AACZ,mCAAyB,GAAG,KAAK,yBAAyB,GAAG,KAAK,KAAK;AAAA,QACzE;AACA,kBAAU,MAAM;AAChB,YAAI,MAAM,UAAU,MAAO;AAAA,MAC7B;AAQA,YAAM,cAAc,MAAM;AAAA,QACxB;AAAA,QACA;AAAA,MACF;AACA,UAAI,YAAY,UAAU,GAAG;AAC3B,gBAAQ,cAAc,KAAK,qDAAqD;AAAA,UAC9E,SAAS,YAAY;AAAA,UACrB,WAAW,YAAY;AAAA,UACvB,QAAQ,YAAY;AAAA,QACtB,CAAC;AAAA,MACH;AACA,YAAM,SAAS;AAAA,QACb;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,uCAAiC,QAAQ,eAAe,MAAM;AAC9D,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACpGA,SAAS,8BACP,cACwC;AACxC,QAAM,SAAS,6BAA6B,YAAY;AACxD,SAAO;AACT;AAEO,SAAS,oCACd,UACA,yBACA;AACA,SAAO;AAAA,IACL,GAAG,2BAA2B,QAAQ;AAAA,IACtC,GAAG,yBAAyB,UAAU,uBAAuB;AAAA,IAC7D,GAAG,kCAAkC,UAAU,uBAAuB;AAAA,IACtE,GAAG,oCAAoC,UAAU,uBAAuB;AAAA,IACxE,GAAG,6BAA6B,QAAQ;AAAA,IACxC,GAAG,+BAA+B,QAAQ;AAAA,IAC1C,GAAG,+BAA+B,QAAQ;AAAA,IAC1C,GAAG,8BAA8B,QAAQ;AAAA,IACzC,GAAG,oCAAoC,QAAQ;AAAA,IAC/C,GAAG,qBAAqB,QAAQ;AAAA,IAChC,GAAG,8BAA8B,QAAQ;AAAA,IACzC,GAAG,gCAAgC,QAAQ;AAAA,IAC3C,GAAG,gDAAgD,QAAQ;AAAA,IAC3D,GAAG,0CAA0C,QAAQ;AAAA,IACrD,GAAG,iCAAiC,QAAQ;AAAA,IAC5C,GAAG,wCAAwC,QAAQ;AAAA,IACnD,GAAG,8CAA8C,QAAQ;AAAA,IACzD,GAAG,6BAA6B,QAAQ;AAAA,IACxC,GAAG,6BAA6B,QAAQ;AAAA,EAC1C;AACF;AAEO,SAAS,wBAAwB,eAAqC,CAAC,GAAG;AAC/E,QAAM,WAAW,8BAA8B,YAAY;AAC3D,MAAI,0BACF;AACF,QAAM,0BAA0B,YAAY;AAC1C,gCAA4B,aAAa,mBACrC,QAAQ,QAAQ,aAAa,gBAAgB,IAC7C,OAAO,qBAAqB,EAAE;AAAA,MAAK,OAAO,EAAE,uBAAuB,MACjE,wBAAwB,MAAM,SAAS,GAAG,QAAQ;AAAA,IACpD;AACJ,WAAO,MAAM;AAAA,EACf;AACA,SAAO,oCAAoC,UAAU,uBAAuB;AAC9E;","names":["createSession","randomUUID","outcome","settled","resumeState","updated","resolveWorkspaceCatalogSettings","applySessionAgentConfigWriteThrough","resolveSessionAgentConfigForCreate","getRig","recordUsageEvent","requireWorkspace","resolveTurnExecutionPolicyV1","createHash","createHash","task","resolveWorkspaceCatalogSettings","settings","requireWorkspace","resolveSessionAgentConfigForCreate","applySessionAgentConfigWriteThrough","getRig","resolveTurnExecutionPolicyV1","recordUsageEvent","result","requireSession","publishDurableSessionEvents","requireSession","publishDurableSessionEvents","createHash","randomUUID","result"]}