@opengeni/worker-bundle 3.1.2 → 3.2.2

package/dist/chunk-436TOEBL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/activity-services.ts","../src/personal-github-git-credentials.ts","../src/pr-review-credentials.ts","../src/onepassword-vault-provider.ts","../src/activities/documents.ts","../src/activities/goals.ts","../src/activities/agent-turn/credential-restriction.ts","../src/activities/knowledge-source-sync.ts","../src/activities/google-drive-provider.ts","../src/activities/google-drive-changes.ts","../src/activities/subscription-core-wait-bindings.ts","../src/activities/subscription-core-codex-waits.ts","../src/activities/agent-turn/subscription-serving-catalog.ts","../src/activities/subscription-core-codex-quota.ts","../src/activities/subscription-core-usage-recheck.ts","../src/activities/common.ts","../src/activities/subscription-core-claude-waits.ts","../src/activities/subscription-core-xai-waits.ts","../src/activities/subscription-core-xai-quota.ts","../src/activities/sandbox-images.ts","../src/activities/streaming.ts","../src/activities/incident-telemetry-preflight.ts","../src/activities/incident-telemetry-authority.ts","../src/activities/agent-turn/provider-dispatch-barrier.ts","../src/activities/agent-turn/session-usage-custody.ts","../src/activities/agent-turn/codex-credit-policy.ts","../src/activities/agent-turn/sandbox-provision.ts","../src/activities/agent-turn/quiescence.ts","../src/activities/agent-turn/provider-recovery-policy.ts","../src/activities/agent-turn/errors.ts","../../../node_modules/.bun/drizzle-orm@0.45.2+1d2c014f134ec9f4/node_modules/src/entity.ts","../../../node_modules/.bun/drizzle-orm@0.45.2+1d2c014f134ec9f4/node_modules/src/errors.ts","../src/activities/agent-turn/codex-usage-policy.ts","../src/activities/run-input.ts","../src/activities/requester-unavailable-receipt.ts","../src/activities/agent-turn/codex-plan-entitlement.ts","../src/activities/agent-turn/codex-core-errors.ts","../src/activities/types.ts","../src/activities/agent-turn/provider-recovery-copy.ts"],"sourcesContent":["import {\n  codeSearchDeploymentPolicy,\n  resolveWebSearchProvider,\n  dbSearchPath,\n  getSettings,\n  resolveNatsControlPlaneAuth,\n} from \"@opengeni/config\";\nimport {\n  configureChildLifecycleNotices,\n  configureCodeSearchDeploymentPolicy,\n  createDb,\n} from \"@opengeni/db\";\nimport { createNatsEventBus } from \"@opengeni/events\";\nimport { createObservability } from \"@opengeni/observability\";\nimport { createRemoteExternalVaultFactories, resolveCatalogSettings } from \"@opengeni/core\";\nimport { createObjectStorage } from \"@opengeni/storage\";\nimport type { ActivityDependencies, SharedActivityServices } from \"./activities/types\";\nimport { observabilityEventBusOptions } from \"./observability-metrics\";\nimport { buildPersonalGitHubGitCredentials } from \"./personal-github-git-credentials\";\nimport { createStandaloneConnectionCredentialsPort } from \"./pr-review-credentials\";\nimport { loadOnePasswordVaultProvider } from \"./onepassword-vault-provider\";\nimport { createNativeExternalVaultFactories } from \"./external-vault-providers\";\n\n/**\n * Build the dependency graph common to both worker roles exactly once.\n *\n * This module deliberately has no import edge to @opengeni/runtime or\n * @opengeni/documents. Those graphs are added by the role-specific factories,\n * preventing an idle process from retaining an unused model SDK or parser\n * stack for its entire lifetime.\n */\nexport function createSharedActivityServices(\n  dependencies: ActivityDependencies,\n): () => Promise<SharedActivityServices> {\n  let servicesPromise: Promise<SharedActivityServices> | null = null;\n\n  return async function services(): Promise<SharedActivityServices> {\n    servicesPromise ??= (async () => {\n      const settings = dependencies.settings ?? getSettings();\n      const observability =\n        dependencies.observability ?? createObservability(settings, { component: \"worker\" });\n      const searchPath = dbSearchPath(settings);\n      const dbClient = dependencies.db\n        ? null\n        : createDb(settings.databaseUrl, {\n            ...(searchPath ? { searchPath } : {}),\n            rlsStrategy: settings.rlsStrategy,\n          });\n      const controlPlaneAuth = resolveNatsControlPlaneAuth(settings);\n      const db = dependencies.db ?? dbClient!.db;\n      const resolvedSettings = (await resolveCatalogSettings(db, settings)).settings;\n      // Child lifecycle notice producers are process-global in @opengeni/db;\n      // install the boot-validated rollout flag once for this worker.\n      configureChildLifecycleNotices({ enabled: settings.childLifecycleNoticesEnabled });\n      // Child, scheduled and automation sessions created here freeze their\n      // code_search decision from the same deployment policy as the API.\n      configureCodeSearchDeploymentPolicy(codeSearchDeploymentPolicy(settings));\n      // A named but unusable web search provider withholds the tools; say why.\n      const webSearchProvider = resolveWebSearchProvider(settings);\n      if (webSearchProvider.status === \"invalid\") {\n        observability.warn(\"web search provider is misconfigured; web_search stays off\", {\n          reason: webSearchProvider.reason,\n        });\n      }\n      return {\n        settings: resolvedSettings,\n        catalogSourceSettings: settings,\n        db,\n        bus:\n          dependencies.bus ??\n          (await createNatsEventBus(\n            settings.natsUrl,\n            controlPlaneAuth\n              ? { user: controlPlaneAuth.user, pass: controlPlaneAuth.password }\n              : undefined,\n            observabilityEventBusOptions(observability),\n          )),\n        objectStorage: dependencies.objectStorage ?? createObjectStorage(settings),\n        observability,\n        wakeSessionWorkflow: dependencies.wakeSessionWorkflow ?? null,\n        signalSessionAttemptQuiesced: dependencies.signalSessionAttemptQuiesced ?? null,\n        inspectSessionAttemptActivity: dependencies.inspectSessionAttemptActivity ?? null,\n        signalCodexCapacityWorkflow: dependencies.signalCodexCapacityWorkflow ?? null,\n        startSandboxReaperWorkflow: dependencies.startSandboxReaperWorkflow ?? null,\n        startVideoGenerationWorkflow: dependencies.startVideoGenerationWorkflow ?? null,\n        entitlements: dependencies.entitlements ?? null,\n        connectionCredentials:\n          dependencies.connectionCredentials ??\n          createStandaloneConnectionCredentialsPort(settings, db),\n        personalGitHubCredentials:\n          dependencies.personalGitHubCredentials ?? buildPersonalGitHubGitCredentials(db, settings),\n        onePasswordVaultProvider:\n          dependencies.onePasswordVaultProvider === undefined\n            ? loadOnePasswordVaultProvider\n            : dependencies.onePasswordVaultProvider,\n        externalVaultProviders:\n          dependencies.externalVaultProviders === undefined\n            ? {\n                ...createRemoteExternalVaultFactories(settings),\n                ...createNativeExternalVaultFactories(settings),\n              }\n            : dependencies.externalVaultProviders,\n      };\n    })();\n    return await servicesPromise;\n  };\n}\n","import type { Settings } from \"@opengeni/config\";\nimport {\n  type ConnectionCredentialsPort,\n  type GitCredentialRepositoryRef,\n  type McpPersonalConnectionDelegation,\n} from \"@opengeni/contracts\";\nimport {\n  isPersonalGitHubConnection,\n  PersonalGitHubConnectionMetadata,\n} from \"@opengeni/contracts/personal-github\";\nimport {\n  getConnectionMetadata,\n  getPersonalGitHubRepositorySelectionState,\n  getSessionAuthorityProjection,\n  getSessionTurnForAttempt,\n  resolveAcceptedConnectionUse,\n  type Database,\n} from \"@opengeni/db\";\nimport {\n  PERSONAL_GITHUB_GIT_BROKER_TOKEN_TTL_SECONDS,\n  personalGitHubGitBrokerRouteId,\n  sealPersonalGitHubGitBrokerClaims,\n  type PersonalGitHubGitBrokerClaims,\n  type PersonalGitHubGitBrokerRepositoryClaim,\n} from \"@opengeni/github\";\nimport { randomBytes, randomUUID } from \"node:crypto\";\nimport { execFileSync } from \"node:child_process\";\nimport { isIP } from \"node:net\";\nimport { isDeepStrictEqual } from \"node:util\";\n\nconst PERSONAL_GITHUB_SERVER_ID = \"github:personal\";\n\n/**\n * Build the standalone personal-GitHub credential consumer. It returns only an\n * Opengeni broker bearer: the broad provider OAuth token remains encrypted in\n * the API/database process and never crosses into a sandbox or worker result.\n */\nexport function buildPersonalGitHubGitCredentials(\n  db: Database,\n  settings: Settings,\n): NonNullable<ConnectionCredentialsPort[\"gitCredentials\"]> | null {\n  if (!settings.githubPersonalOauthEnabled) return null;\n  const secret = settings.integrationsStateSecret?.trim();\n  const publicOrigin = personalGitBrokerOrigin(settings);\n  if (!secret || !publicOrigin) {\n    throw new Error(\"personal GitHub Git broker configuration is unavailable\");\n  }\n\n  return async (request) => {\n    if (request.provider && request.provider !== \"github\") {\n      throw new Error(\"personal GitHub Git broker accepts only GitHub repositories\");\n    }\n    if (!request.credentialBindingId || !request.repositoryRefs?.length) {\n      throw new Error(\"personal GitHub Git broker requires one exact credential binding\");\n    }\n    const turn = await getSessionTurnForAttempt(\n      db,\n      request.workspaceId,\n      request.sessionId,\n      request.attemptId,\n    );\n    const session = await getSessionAuthorityProjection(db, request.workspaceId, request.sessionId);\n    if (\n      !turn ||\n      !session ||\n      turn.id !== request.turnId ||\n      turn.executionGeneration !== request.executionGeneration ||\n      !isDeepStrictEqual(turn.initiator, request.initiator) ||\n      !isDeepStrictEqual(turn.initiatorContext, request.initiatorContext) ||\n      session.rootSessionId !== request.rootSessionId\n    ) {\n      throw new Error(\"personal GitHub Git credential authority is no longer current\");\n    }\n    const delegation = exactPersonalGitHubDelegation(\n      turn.personalConnectionDelegations,\n      request.credentialBindingId,\n    );\n    const snapshot = delegation.personalGitHubRepositorySelection!;\n    const repositories = exactRequestedRepositories(\n      request.repositoryRefs,\n      snapshot.credentialBindingId,\n      snapshot.repositories,\n    );\n\n    const resolution = await resolveAcceptedConnectionUse(db, {\n      accountId: request.accountId,\n      workspaceId: request.workspaceId,\n      sessionId: request.sessionId,\n      turnId: request.turnId,\n      attemptId: request.attemptId,\n      executionGeneration: request.executionGeneration,\n      physicalRequestId: randomUUID(),\n      usePhase: \"credential_resolution\",\n      serverId: PERSONAL_GITHUB_SERVER_ID,\n      connectionId: delegation.connectionId,\n      providerDomain: \"github.com\",\n      connectionKind: \"oauth2\",\n      subjectScope: \"subject\",\n      ownerSubjectId: delegation.ownerSubjectId,\n    });\n    if (\n      resolution.status !== \"authorized\" ||\n      resolution.originWorkspaceId !== delegation.originWorkspaceId ||\n      resolution.attribution.connectionId !== delegation.connectionId ||\n      resolution.attribution.connectionGeneration !== snapshot.connectionAuthorityGeneration ||\n      resolution.attribution.ownerSubjectId !== delegation.ownerSubjectId\n    ) {\n      throw new Error(\"personal GitHub Git connection authority is no longer current\");\n    }\n\n    const connection = await getConnectionMetadata(\n      db,\n      delegation.originWorkspaceId!,\n      delegation.connectionId,\n      delegation.ownerSubjectId,\n    );\n    if (\n      !connection ||\n      connection.accountId !== request.accountId ||\n      connection.workspaceId !== delegation.originWorkspaceId ||\n      connection.subjectId !== delegation.ownerSubjectId ||\n      connection.status !== \"active\" ||\n      // connections.version is credential-refresh CAS, not use authority.\n      // resolveAcceptedConnectionUse above fences the independent common\n      // connection-authority generation carried by the accepted snapshot.\n      connection.grantedScopes.length !== 1 ||\n      connection.grantedScopes[0] !== \"repo\" ||\n      !isPersonalGitHubConnection(connection)\n    ) {\n      throw new Error(\"personal GitHub Git connection is unavailable\");\n    }\n    const metadata = PersonalGitHubConnectionMetadata.parse(connection.metadata);\n    const currentSelection = await getPersonalGitHubRepositorySelectionState(db, {\n      accountId: request.accountId,\n      originWorkspaceId: delegation.originWorkspaceId!,\n      subjectId: delegation.ownerSubjectId,\n      connectionId: delegation.connectionId,\n    });\n    if (\n      !currentSelection ||\n      currentSelection.connectionAuthorityGeneration !== snapshot.connectionAuthorityGeneration ||\n      currentSelection.selectionGeneration !== snapshot.selectionGeneration ||\n      currentSelection.credentialBindingId !== snapshot.credentialBindingId ||\n      currentSelection.credentialBindingId !== metadata.credentialBindingId ||\n      currentSelection.providerPrincipalId !== metadata.providerPrincipalId ||\n      metadata.githubUserId !== metadata.providerPrincipalId\n    ) {\n      throw new Error(\"personal GitHub repository authority changed\");\n    }\n    const currentById = new Map(\n      currentSelection.repositories.map((repository) => [repository.repositoryId, repository]),\n    );\n    for (const repository of repositories) {\n      const current = currentById.get(repository.repositoryId);\n      if (\n        !current ||\n        current.fullName !== repository.fullName ||\n        current.canonicalUrl !== repository.canonicalUrl ||\n        current.selectionGeneration !== repository.selectionGeneration ||\n        current.disabled ||\n        (repository.access === \"write\" &&\n          (current.selectedAccess !== \"write\" ||\n            current.archived ||\n            !personalGitHubCanWrite(current.permissions))) ||\n        !personalGitHubCanRead(current.permissions)\n      ) {\n        throw new Error(\"personal GitHub repository authority changed\");\n      }\n    }\n\n    const identity = {\n      name: metadata.githubLogin,\n      email: `${metadata.githubUserId}+${metadata.githubLogin}@users.noreply.github.com`,\n    };\n    if (request.purpose === \"identity\") {\n      return {\n        workspaceId: request.workspaceId,\n        credentialBindingId: request.credentialBindingId,\n        provider: \"github\",\n        providerHost: \"github.com\",\n        identity,\n      };\n    }\n\n    const now = Math.floor(Date.now() / 1_000);\n    const baseClaims = {\n      version: 1 as const,\n      accountId: request.accountId,\n      workspaceId: request.workspaceId,\n      sessionId: request.sessionId,\n      rootSessionId: request.rootSessionId,\n      turnId: request.turnId,\n      attemptId: request.attemptId,\n      executionGeneration: request.executionGeneration,\n      originWorkspaceId: delegation.originWorkspaceId!,\n      connectionId: delegation.connectionId,\n      connectionAuthorityGeneration: snapshot.connectionAuthorityGeneration,\n      ownerSubjectId: delegation.ownerSubjectId,\n      credentialBindingId: snapshot.credentialBindingId,\n      selectionGeneration: snapshot.selectionGeneration,\n    };\n    const repositoryClaims: PersonalGitHubGitBrokerRepositoryClaim[] = repositories.map(\n      (repository) => ({\n        ...repository,\n        routeId: personalGitHubGitBrokerRouteId(secret, {\n          ...baseClaims,\n          repository,\n        }),\n      }),\n    );\n    const claims: PersonalGitHubGitBrokerClaims = {\n      ...baseClaims,\n      nonce: randomBytes(24).toString(\"base64url\"),\n      issuedAt: now,\n      expiresAt: now + PERSONAL_GITHUB_GIT_BROKER_TOKEN_TTL_SECONDS,\n    };\n    return {\n      token: sealPersonalGitHubGitBrokerClaims(secret, claims),\n      expiresAt: new Date(claims.expiresAt * 1_000).toISOString(),\n      workspaceId: request.workspaceId,\n      credentialBindingId: request.credentialBindingId,\n      provider: \"github\",\n      providerHost: \"github.com\",\n      identity,\n      transport: {\n        kind: \"http_broker\",\n        repositories: repositoryClaims.map((repository) => ({\n          repositoryUri: repository.canonicalUrl,\n          brokerUri: `${publicOrigin}/v1/git/personal/${repository.routeId}`,\n        })),\n      },\n    };\n  };\n}\n\nfunction personalGitHubCanRead(permissions: {\n  pull: boolean;\n  triage: boolean;\n  push: boolean;\n  maintain: boolean;\n  admin: boolean;\n}): boolean {\n  return (\n    permissions.pull ||\n    permissions.triage ||\n    permissions.push ||\n    permissions.maintain ||\n    permissions.admin\n  );\n}\n\nfunction personalGitHubCanWrite(permissions: {\n  push: boolean;\n  maintain: boolean;\n  admin: boolean;\n}): boolean {\n  return permissions.push || permissions.maintain || permissions.admin;\n}\n\nlet cachedDockerBridgeGateway: string | null | undefined;\n\nfunction dockerBridgeGateway(): string | null {\n  if (cachedDockerBridgeGateway !== undefined) return cachedDockerBridgeGateway;\n  try {\n    const value = execFileSync(\n      \"docker\",\n      [\"network\", \"inspect\", \"bridge\", \"--format\", \"{{(index .IPAM.Config 0).Gateway}}\"],\n      { encoding: \"utf8\", timeout: 2_000, maxBuffer: 16 * 1024 },\n    ).trim();\n    cachedDockerBridgeGateway = isIP(value) ? value : null;\n  } catch {\n    cachedDockerBridgeGateway = null;\n  }\n  return cachedDockerBridgeGateway;\n}\n\nexport function personalGitBrokerOrigin(settings: Settings): string | null {\n  const value =\n    settings.opengeniMcpUrl ??\n    (settings.sandboxBackend === \"docker\"\n      ? `http://host.docker.internal:${settings.apiPort}`\n      : settings.sandboxBackend === \"local\" || settings.sandboxBackend === \"none\"\n        ? `http://127.0.0.1:${settings.apiPort}`\n        : settings.publicBaseUrl);\n  if (!value) return null;\n  const url = new URL(value);\n  if (\n    settings.sandboxBackend === \"docker\" &&\n    (url.hostname === \"127.0.0.1\" || url.hostname === \"localhost\")\n  ) {\n    url.hostname = dockerBridgeGateway() ?? \"host.docker.internal\";\n  }\n  const dockerPrivateOrigin =\n    settings.sandboxBackend === \"docker\" &&\n    (url.hostname === \"host.docker.internal\" ||\n      url.hostname === cachedDockerBridgeGateway ||\n      /^[a-z][a-z0-9-]{0,62}$/iu.test(url.hostname));\n  // The `local` and `test` environments accept any origin, which covers the\n  // local launcher's Linux Docker sandbox route on the Compose network gateway.\n  const privateExecutionOrigin =\n    (url.protocol === \"http:\" &&\n      (url.hostname === \"127.0.0.1\" || url.hostname === \"localhost\" || dockerPrivateOrigin)) ||\n    [\"local\", \"test\"].includes(settings.environment);\n  if (\n    (url.protocol !== \"https:\" && !privateExecutionOrigin) ||\n    url.username ||\n    url.password ||\n    url.search ||\n    url.hash\n  ) {\n    return null;\n  }\n  url.pathname = \"/\";\n  return url.origin;\n}\n\nfunction exactPersonalGitHubDelegation(\n  delegations: McpPersonalConnectionDelegation[],\n  credentialBindingId: string,\n): McpPersonalConnectionDelegation {\n  const matches = delegations.filter(\n    (delegation) =>\n      delegation.serverId === PERSONAL_GITHUB_SERVER_ID &&\n      delegation.connectionType === \"github_personal\" &&\n      delegation.personalGitHubRepositorySelection?.credentialBindingId === credentialBindingId,\n  );\n  const delegation = matches[0];\n  if (\n    matches.length !== 1 ||\n    !delegation ||\n    delegation.providerDomain !== \"github.com\" ||\n    delegation.kind !== \"oauth2\" ||\n    !delegation.originWorkspaceId ||\n    !delegation.personalGitHubRepositorySelection\n  ) {\n    throw new Error(\"personal GitHub Git delegation is unavailable\");\n  }\n  return delegation;\n}\n\nfunction exactRequestedRepositories(\n  refs: GitCredentialRepositoryRef[],\n  credentialBindingId: string,\n  snapshots: NonNullable<\n    McpPersonalConnectionDelegation[\"personalGitHubRepositorySelection\"]\n  >[\"repositories\"],\n): Array<Omit<PersonalGitHubGitBrokerRepositoryClaim, \"routeId\">> {\n  if (refs.length !== snapshots.length) {\n    throw new Error(\"personal GitHub Git request does not match the accepted repository set\");\n  }\n  const byCanonicalUrl = new Map(\n    snapshots.map((repository) => [repository.canonicalUrl, repository]),\n  );\n  const seen = new Set<string>();\n  return refs.map((ref) => {\n    const snapshot = byCanonicalUrl.get(ref.uri);\n    if (\n      !snapshot ||\n      seen.has(ref.uri) ||\n      ref.provider !== \"github\" ||\n      ref.credentialBindingId !== credentialBindingId ||\n      ref.connectionId !== undefined ||\n      ref.installationId !== undefined ||\n      String(ref.repositoryId) !== snapshot.repositoryId ||\n      ref.ref !== snapshot.ref ||\n      ref.access !== snapshot.access\n    ) {\n      throw new Error(\"personal GitHub Git request exceeds the accepted repository authority\");\n    }\n    seen.add(ref.uri);\n    return snapshot;\n  });\n}\n","import { environmentsEncryptionKeyBytes, type Settings } from \"@opengeni/config\";\nimport type {\n  ConnectionCredentialsPort,\n  GitCredentials,\n  GitCredentialsRequest,\n} from \"@opengeni/contracts\";\nimport { prReviewRegistrationIdFromCredentialBinding } from \"@opengeni/core\";\nimport { decryptVariableSetValue, resolvePrReviewGitCredential, type Database } from \"@opengeni/db\";\nimport {\n  createGitHubAppInstallationTokenWithExpiry,\n  createGitHubAppInstallationTokenWithSigningSettings,\n} from \"@opengeni/github\";\n\n/** Standalone credential broker for PR Review plus the existing GitHub App path.\n * Embedded hosts keep precedence by supplying their own connectionCredentials. */\nexport function createStandaloneConnectionCredentialsPort(\n  settings: Settings,\n  db: Database,\n): ConnectionCredentialsPort {\n  return {\n    gitCredentials: async (request) => await resolveStandaloneGitCredentials(settings, db, request),\n  };\n}\n\nasync function resolveStandaloneGitCredentials(\n  settings: Settings,\n  db: Database,\n  request: GitCredentialsRequest,\n): Promise<GitCredentials> {\n  const provider = request.provider ?? \"github\";\n  const registrationId = request.credentialBindingId\n    ? prReviewRegistrationIdFromCredentialBinding(request.credentialBindingId)\n    : null;\n  if (!registrationId) {\n    if (provider !== \"github\") {\n      throw new Error(`${provider} Git credentials require an explicit PR Review or host binding`);\n    }\n    if (request.purpose === \"identity\") {\n      return { workspaceId: request.workspaceId };\n    }\n    const minted = await createGitHubAppInstallationTokenWithExpiry(settings, {\n      installationId: request.installationId,\n      repositoryIds: request.repositoryIds,\n    });\n    return {\n      token: minted.token,\n      workspaceId: request.workspaceId,\n      ...(minted.expiresAt ? { expiresAt: minted.expiresAt } : {}),\n    };\n  }\n\n  const authority = await resolvePrReviewGitCredential(db, {\n    accountId: request.accountId,\n    workspaceId: request.workspaceId,\n    registrationId,\n    provider,\n    sessionId: request.sessionId,\n    rootSessionId: request.rootSessionId,\n    turnId: request.turnId,\n    attemptId: request.attemptId,\n    executionGeneration: request.executionGeneration,\n    repositoryRefs: (request.repositoryRefs ?? []).map((reference) => ({\n      uri: reference.uri,\n      ...(reference.expectedCommitSha !== undefined\n        ? { expectedCommitSha: reference.expectedCommitSha }\n        : {}),\n      ...(reference.repositoryId !== undefined ? { repositoryId: reference.repositoryId } : {}),\n      ...(reference.installationId !== undefined\n        ? { installationId: reference.installationId }\n        : {}),\n      ...(reference.projectId !== undefined ? { projectId: reference.projectId } : {}),\n    })),\n  });\n  const echoes = {\n    workspaceId: request.workspaceId,\n    ...(request.credentialBindingId ? { credentialBindingId: request.credentialBindingId } : {}),\n    provider,\n    ...(request.providerHost ? { providerHost: request.providerHost } : {}),\n  };\n  if (request.purpose === \"identity\") {\n    return authority.credentialKind === \"github_app\" ||\n      authority.credentialKind === \"managed_github_app\"\n      ? {\n          ...echoes,\n          identity: {\n            name: \"pr-review[bot]\",\n            email: `${authority.appId ?? \"pr-review\"}+pr-review[bot]@users.noreply.github.com`,\n          },\n        }\n      : echoes;\n  }\n  if (\n    authority.credentialKind === \"github_app\" ||\n    authority.credentialKind === \"managed_github_app\"\n  ) {\n    assertGitHubMintMatchesRepositoryRefs(request);\n    if (!authority.appId) {\n      throw new Error(\"PR Review GitHub App credential is unavailable\");\n    }\n    const signingSettings =\n      authority.credentialKind === \"managed_github_app\"\n        ? {\n            githubAppId: settings.prReviewGithubAppId,\n            githubAppPrivateKey: settings.prReviewGithubAppPrivateKey,\n          }\n        : manualPrReviewGitHubSigningSettings(settings, {\n            appId: authority.appId,\n            credentialEncrypted: authority.credentialEncrypted,\n          });\n    if (\n      authority.credentialKind === \"managed_github_app\" &&\n      settings.prReviewGithubAppId !== authority.appId\n    ) {\n      throw new Error(\"Opengeni Lens App identity no longer matches this registration\");\n    }\n    const minted = await createGitHubAppInstallationTokenWithSigningSettings(signingSettings, {\n      installationId: request.installationId,\n      repositoryIds: request.repositoryIds,\n      permissions: { contents: \"read\", pull_requests: \"write\" },\n    });\n    return {\n      ...echoes,\n      token: minted.token,\n      ...(minted.expiresAt ? { expiresAt: minted.expiresAt } : {}),\n    };\n  }\n  if (authority.expiresAt && Date.parse(authority.expiresAt) <= Date.now()) {\n    throw new Error(`PR Review ${provider} provider credential has expired`);\n  }\n  const encryptionKey = environmentsEncryptionKeyBytes(settings);\n  if (!encryptionKey || !authority.credentialEncrypted) {\n    throw new Error(`PR Review ${provider} provider credential is unavailable`);\n  }\n  return {\n    ...echoes,\n    token: decryptVariableSetValue(encryptionKey, authority.credentialEncrypted),\n    ...(authority.expiresAt ? { expiresAt: authority.expiresAt } : {}),\n  };\n}\n\nfunction manualPrReviewGitHubSigningSettings(\n  settings: Settings,\n  authority: { appId: string; credentialEncrypted: string | null },\n) {\n  const encryptionKey = environmentsEncryptionKeyBytes(settings);\n  if (!encryptionKey || !authority.credentialEncrypted) {\n    throw new Error(\"PR Review GitHub App credential is unavailable\");\n  }\n  return {\n    githubAppId: authority.appId,\n    githubAppPrivateKey: decryptVariableSetValue(encryptionKey, authority.credentialEncrypted),\n  };\n}\n\nfunction assertGitHubMintMatchesRepositoryRefs(request: GitCredentialsRequest): void {\n  const refs = request.repositoryRefs ?? [];\n  const repositoryIds = refs.map((reference) => positiveInteger(reference.repositoryId));\n  const installationIds = refs.map((reference) => positiveInteger(reference.installationId));\n  if (\n    repositoryIds.some((value) => value === null) ||\n    installationIds.some((value) => value === null)\n  ) {\n    throw new Error(\"PR Review GitHub credential request lacks exact repository authority\");\n  }\n  const exactRepositoryIds = [...new Set(repositoryIds as number[])].sort(\n    (left, right) => left - right,\n  );\n  const requestedRepositoryIds = [...new Set(request.repositoryIds)].sort(\n    (left, right) => left - right,\n  );\n  const exactInstallationIds = [...new Set(installationIds as number[])];\n  if (\n    exactInstallationIds.length !== 1 ||\n    exactInstallationIds[0] !== request.installationId ||\n    exactRepositoryIds.length !== request.repositoryIds.length ||\n    exactRepositoryIds.some((value, index) => value !== requestedRepositoryIds[index])\n  ) {\n    throw new Error(\n      \"PR Review GitHub token mint authority does not match its repository resources\",\n    );\n  }\n}\n\nfunction positiveInteger(value: unknown): number | null {\n  if (typeof value === \"number\" && Number.isSafeInteger(value) && value > 0) return value;\n  if (typeof value === \"string\" && /^\\d+$/.test(value)) {\n    const parsed = Number(value);\n    return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : null;\n  }\n  return null;\n}\n","import type { OnePasswordVaultProviderFactory } from \"@opengeni/core\";\n\n/**\n * Loads the 1Password adapter (and its ~14 MB WASM SDK) only when a turn first\n * touches a 1Password vault. The only allowed import edge, besides apps/api,\n * is this dynamic one (OP-5, packages/vaults-onepassword/test/import-guard.test.ts).\n */\nexport const loadOnePasswordVaultProvider: OnePasswordVaultProviderFactory = async (input) => {\n  const { vaultProviderForOnePasswordConnection } = await import(\"@opengeni/vaults-onepassword\");\n  return vaultProviderForOnePasswordConnection(input);\n};\n","import type { DocumentServices } from \"@opengeni/documents\";\nimport {\n  resolveDocumentIndexAuthority,\n  rlsContextForWorkspace,\n  withSessionRlsActorContext,\n  withWorkspaceUsageLock,\n} from \"@opengeni/db\";\nimport type { ControlActivityServices, IndexDocumentInput } from \"./types\";\n\nexport function createDocumentActivities(\n  services: () => Promise<ControlActivityServices>,\n  resolveDocumentServices?: () => Promise<DocumentServices>,\n) {\n  return {\n    indexDocument: async (input: IndexDocumentInput) => {\n      const { db, objectStorage } = await services();\n      if (!objectStorage) {\n        throw new Error(\"object storage is not configured\");\n      }\n      if (!resolveDocumentServices) {\n        throw new Error(\"document services are not configured\");\n      }\n      const [{ getDocumentForIndexing, indexDocumentNow }, documentServices] = await Promise.all([\n        import(\"@opengeni/documents\"),\n        resolveDocumentServices(),\n      ]);\n      const context = await rlsContextForWorkspace(db, input.workspaceId);\n      if (context.accountId !== input.accountId) {\n        throw new Error(\"document account/workspace authority mismatch\");\n      }\n      return await withWorkspaceUsageLock(db, input.workspaceId, async (lockedDb) => {\n        const storedAuthority = await resolveDocumentIndexAuthority(lockedDb, input);\n        if (!storedAuthority) {\n          throw new Error(\"document authority was not found before indexing\");\n        }\n        const suppliedAuthorityFields = [\n          \"authorityKind\",\n          \"authorityWorkspaceId\",\n          \"authoritySubjectId\",\n        ] as const;\n        const suppliedCount = suppliedAuthorityFields.filter((field) =>\n          Object.prototype.hasOwnProperty.call(input, field),\n        ).length;\n        const suppliedMismatch =\n          (Object.prototype.hasOwnProperty.call(input, \"authorityKind\") &&\n            input.authorityKind !== storedAuthority.authorityKind) ||\n          (Object.prototype.hasOwnProperty.call(input, \"authorityWorkspaceId\") &&\n            input.authorityWorkspaceId !== storedAuthority.authorityWorkspaceId) ||\n          (Object.prototype.hasOwnProperty.call(input, \"authoritySubjectId\") &&\n            input.authoritySubjectId !== storedAuthority.authoritySubjectId);\n        if (suppliedMismatch) {\n          throw new Error(\"document authority changed before indexing\");\n        }\n        if (suppliedCount !== 0 && suppliedCount !== suppliedAuthorityFields.length) {\n          throw new Error(\"document authority tuple is partial\");\n        }\n        const claimedDocument = await getDocumentForIndexing(\n          lockedDb,\n          input.workspaceId,\n          input.documentId,\n        );\n        if (\n          !claimedDocument ||\n          claimedDocument.authorityKind !== storedAuthority.authorityKind ||\n          claimedDocument.authorityWorkspaceId !== storedAuthority.authorityWorkspaceId ||\n          claimedDocument.authoritySubjectId !== storedAuthority.authoritySubjectId\n        ) {\n          throw new Error(\"document authority changed before indexing\");\n        }\n        const document = await withSessionRlsActorContext(\n          {\n            subjectId: \"service:document-preparation\",\n            privateFileOwnerSubjectId:\n              storedAuthority.authorityKind === \"personal\"\n                ? storedAuthority.authoritySubjectId\n                : null,\n          },\n          () =>\n            indexDocumentNow(\n              lockedDb,\n              objectStorage,\n              input.workspaceId,\n              input.documentId,\n              documentServices,\n              { viewerSubjectId: storedAuthority.authoritySubjectId },\n            ),\n        );\n        if (\n          document.authorityKind !== storedAuthority.authorityKind ||\n          document.authorityWorkspaceId !== storedAuthority.authorityWorkspaceId ||\n          document.authoritySubjectId !== storedAuthority.authoritySubjectId\n        ) {\n          throw new Error(\"document authority changed before indexing\");\n        }\n        return document;\n      });\n    },\n  };\n}\n","import {\n  resolveSessionFirstPartyMcpTools,\n  resolveTurnExecutionPolicyV1,\n  type Settings,\n} from \"@opengeni/config\";\nimport {\n  mergeToolRefs,\n  readTurnExecutionPolicyV1,\n  type SessionGoal,\n  type ToolRef,\n} from \"@opengeni/contracts\";\nimport {\n  enqueueSessionWorkflowWakeIfRunnable,\n  getSessionGoal,\n  getSessionTurn,\n  materializeGoalContinuation,\n  requireSession,\n  requireWorkspace,\n} from \"@opengeni/db\";\nimport type {\n  ControlActivityServices,\n  MaybeContinueGoalInput,\n  MaybeContinueGoalResult,\n} from \"./types\";\nimport {\n  modelFundingForAdmission,\n  goalRunBudgetBlocked,\n  goalSessionUsageLimitBlocked,\n  recordSessionUsageLimitEvent,\n  resolveGoalModelAdmission,\n} from \"@opengeni/core\";\nexport { goalContinuationModelDecision, goalRunBudgetBlocked } from \"@opengeni/core\";\nimport { turnCredentialRestriction } from \"./agent-turn/credential-restriction\";\n\nexport function createGoalActivities(services: () => Promise<ControlActivityServices>) {\n  async function enqueueGoalRetryWake(input: MaybeContinueGoalInput): Promise<void> {\n    const { db } = await services();\n    await enqueueSessionWorkflowWakeIfRunnable(db, {\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      sessionId: input.sessionId,\n      temporalWorkflowId: input.workflowId,\n      reason: \"goal_retry\",\n      // A permanently invalid goal must not become a tight workflow loop. One\n      // durable retry after a short delay preserves liveness without scanning.\n      notBefore: new Date(Date.now() + 30_000),\n    });\n  }\n\n  async function maybeContinueGoal(\n    input: MaybeContinueGoalInput,\n  ): Promise<MaybeContinueGoalResult> {\n    const service = await services();\n    const { db, bus } = service;\n    const catalogSourceSettings = service.catalogSourceSettings ?? service.settings;\n    // Cheap pre-read: the common goal-less session skips the budget queries.\n    const existingGoal = await getSessionGoal(db, input.workspaceId, input.sessionId);\n    if (!existingGoal || existingGoal.status !== \"active\") {\n      return { action: \"none\" };\n    }\n    // Loaded before the budget check so the codex-billed predicate and the\n    // synthesized turn use the SAME effective policy. An explicit per-turn\n    // model can differ from the persisted session default; follow-up goal work\n    // follows effective defaults: a started turn or a newer explicit settings\n    // boundary. Admission-rejected turns cannot poison that projection.\n    // Kept below the goal-less fast path so a non-goal session still skips the\n    // reads entirely.\n    const session = await requireSession(db, input.workspaceId, input.sessionId);\n    // Terminal sessions retain their goal for human recovery, but cannot\n    // continue. Do not validate an obsolete model before the locked guard gets\n    // the chance to reject that work; otherwise a deterministic error retries.\n    if (session.status === \"failed\" || session.status === \"cancelled\") {\n      return { action: \"none\" };\n    }\n    const workspace = await requireWorkspace(db, input.workspaceId);\n    const modelDecision = await resolveGoalModelAdmission(db, catalogSourceSettings, {\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      model: session.model,\n      codexCompactionMode: session.codexCompactionMode,\n      latencyMode: session.latencyMode,\n    });\n    const settings = modelDecision.settings;\n    const continuationModel = modelDecision.model;\n    const continuationReasoningEffort = session.reasoningEffort;\n    const continuationLatencyMode = session.latencyMode;\n    const modelPolicyBlocked = modelDecision.blocked;\n    const turnExecutionPolicy = modelPolicyBlocked\n      ? undefined\n      : resolveTurnExecutionPolicyV1(settings, {\n          modelId: continuationModel,\n          requestedModelId: null,\n          modelSource: \"continuation\",\n          reasoningEffort: continuationReasoningEffort,\n          reasoningSource: \"continuation\",\n          latencyMode: continuationLatencyMode,\n          latencyModeSource: \"continuation\",\n        });\n    const continuationPolicy: NonNullable<\n      Parameters<typeof materializeGoalContinuation>[1][\"policy\"]\n    > = {\n      model: continuationModel,\n      reasoningEffort: continuationReasoningEffort,\n      latencyMode: continuationLatencyMode,\n      ...(turnExecutionPolicy ? { turnExecutionPolicy } : {}),\n      tools: withFirstPartyTools(settings, session.tools),\n      sandboxBackend: session.sandboxBackend,\n    };\n    const decision = await materializeGoalContinuation(db, {\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      sessionId: input.sessionId,\n      workflowId: input.workflowId,\n      defaultMaxAutoContinuations: settings.goalMaxAutoContinuations ?? null,\n      // Pacing between consecutive no-input continuations (never a cap). The\n      // materializer re-arms a delayed outbox wake and returns `deferred`.\n      idleBackoff: {\n        scheduleMs: settings.goalIdleBackoffMs,\n        maxMs: settings.goalIdleBackoffMaxMs,\n      },\n      // A model-policy block takes precedence: it is deterministic (a budget\n      // pause can clear on its own; a policy pause needs a model/policy change)\n      // and rides the same visible-pause channel.\n      admission: async (tx, causalTurn) => {\n        // The materializer selects this exact causal row under its session/goal\n        // locks and freezes policy only after admission returns. Never infer\n        // credential authority from the generated continuation's payload.\n        const sourceTurn = causalTurn\n          ? await getSessionTurn(tx, input.workspaceId, causalTurn.id)\n          : null;\n        if (causalTurn && (!sourceTurn || sourceTurn.sessionId !== input.sessionId)) {\n          throw new Error(\"Goal continuation source turn is unavailable\");\n        }\n        const sourcePolicy = readTurnExecutionPolicyV1(sourceTurn?.metadata);\n        if (turnExecutionPolicy) {\n          const credentialRestriction = turnCredentialRestriction(\n            sourcePolicy.kind === \"valid\" ? sourcePolicy.policy : turnExecutionPolicy,\n            session.metadata,\n          );\n          continuationPolicy.turnExecutionPolicy = credentialRestriction\n            ? { ...turnExecutionPolicy, credentialRestriction }\n            : turnExecutionPolicy;\n        }\n        // a reached task usage limit pauses the goal with its own\n        // reason before any funding gate; a read failure aborts materialization.\n        const usageLimitBlocked = modelPolicyBlocked\n          ? null\n          : await goalSessionUsageLimitBlocked(tx, {\n              accountId: input.accountId,\n              workspaceId: input.workspaceId,\n              sessionId: input.sessionId,\n            });\n        if (usageLimitBlocked) {\n          recordSessionUsageLimitEvent(service.observability, \"goal\", \"reached\");\n        }\n        const budgetBlocked = modelPolicyBlocked\n          ? null\n          : (usageLimitBlocked ??\n            (await goalRunBudgetBlocked(\n              { ...service, settings, db: tx },\n              {\n                accountId: input.accountId,\n                workspaceId: input.workspaceId,\n                model: continuationModel,\n                initiatingHumanSubjectId: causalTurn?.initiatingHumanSubjectId ?? null,\n              },\n            )));\n        const pausedReason = modelPolicyBlocked\n          ? modelDecision.pausedReason\n          : budgetBlocked?.pausedReason;\n        return {\n          budgetBlocked: modelPolicyBlocked ?? budgetBlocked?.message ?? null,\n          ...(pausedReason ? { budgetPausedReason: pausedReason } : {}),\n        };\n      },\n      policy: continuationPolicy,\n      // Long-wait guidance is only given when `wait_for_input` is actually in this\n      // session's effective first-party selection (the same source the worker\n      // signs into the delegated token and the API uses to register tools), so\n      // a pre-existing narrowed selection is never told to call a missing tool.\n      prompt: (goal, autoContinuation, cap) => {\n        const effectiveFirstPartyTools = resolveSessionFirstPartyMcpTools(\n          settings,\n          session,\n          workspace.settings,\n        );\n        return goalContinuationPrompt(goal, autoContinuation, cap, {\n          inputWaitAvailable: effectiveFirstPartyTools.includes(\"wait_for_input\"),\n          humanInputRespondAvailable: effectiveFirstPartyTools.includes(\n            \"session_human_input_respond\",\n          ),\n        });\n      },\n    });\n    if (decision.events.length > 0) {\n      await bus.publish(input.workspaceId, input.sessionId, decision.events);\n    }\n    return { action: decision.action };\n  }\n\n  return {\n    enqueueGoalRetryWake,\n    maybeContinueGoal,\n  };\n}\n\nexport function goalContinuationFundedWithoutCredits(\n  settings: Settings,\n  model: string,\n  codexBilled: boolean,\n): boolean {\n  return modelFundingForAdmission(settings, model, codexBilled).fundedWithoutCredits;\n}\n\nexport function goalContinuationPrompt(\n  _goal: SessionGoal,\n  _autoContinuation: number,\n  _cap: number | null,\n  options: { inputWaitAvailable?: boolean; humanInputRespondAvailable?: boolean } = {},\n): string {\n  const waitingGuidance = options.inputWaitAvailable\n    ? [\n        \"Waiting on child sessions, background commands, or external events:\",\n        \"- When further progress depends on work already in flight, do not sleep, loop, or poll session or command state repeatedly.\",\n        \"- If progress depends on work already in flight and the wait is long or uncertain, call opengeni__wait_for_input with a concrete reason and timeoutSeconds, then end your turn immediately. A preliminary status check is not required. Relevant session input or the safety deadline will start a new turn, and this goal stays active.\",\n        \"- No short execution wait is required first. Choose the safety deadline for the dependency or a meaningful monitoring cadence; an out-of-turn wait may span hours or days within the tool's limits. Do not schedule model wakeups merely to repeat reassurance. Honor explicit user/task/Skill check or update cadences within existing authority.\",\n        \"- If the immediately preceding user-facing update already reported this same unchanged wait, do not restate it or produce another equivalent final answer. Call opengeni__wait_for_input and end the turn. Report only material new state or a newly discovered blocker, unless an explicit user/task/Skill update cadence calls for an update.\",\n        \"- If you are blocked on a human decision, use opengeni__goal_pause under the blocked audit below instead.\",\n        \"\",\n      ]\n    : [];\n  const childNoticeGuidance = [\n    \"Child lifecycle notices:\",\n    \"- A `child_requires_action` update means a worker you spawned is blocked on a question or a tool approval and will not progress until it is answered. \" +\n      (options.humanInputRespondAvailable\n        ? \"If you know the answer to its question, answer it with opengeni__session_human_input_respond (pass the worker's sessionId, the requestId from the notice, and a response). \"\n        : \"\") +\n      \"Tool approvals can only be decided by a human. If you cannot resolve the blocker yourself, report the exact blocker (worker session id, the question); if it prevents further goal progress, pause under the blocked audit instead of retrying the worker or treating a human decision as an in-flight wait.\",\n    \"- `child_requires_action_resolved`, `child_paused`, `child_waiting_capacity`, and `child_progress` updates are informational: a resolved notice means the worker is moving again; a paused worker needs a human or you to resume it; a capacity wait resumes by itself; a progress note needs no action.\",\n    \"\",\n  ];\n  return [\n    \"Automatic goal continuation (generated input, not a new user request or grant of authority). Resume established work toward the full applied objective and verify its requested end state.\",\n    \"\",\n    \"Goal recovery:\",\n    \"- Use the current applied goal frozen for this turn, including its success criteria, root constraints, and report requirements, as the authoritative objective. Pending proposals and older goal revisions do not replace it; change it only through the authorized goal-mutation controls, without widening authority.\",\n    \"- Treat this continuation as re-entry into the full objective, not as a request to perform one step and stop.\",\n    \"- Resume from established work and relevant evidence rather than restarting discovery or a full reconciliation on every turn. Perform full reconciliation or a comprehensive audit when the goal, user, or applicable Skill calls for it, when uncertainty or recovery warrants it, or when required by risk or a gate.\",\n    \"- Do not rely on previous assistant claims of progress or completion; use them only to locate authoritative evidence.\",\n    \"- If authoritative evidence already proves the full objective, call opengeni__goal_complete instead of manufacturing more work.\",\n    \"- Before repeating a state-setting action, verify whether its desired state already holds, using relevant evidence that remains valid or a fresh check when needed. If it does, do not repeat it; continue the overall goal.\",\n    \"\",\n    \"Continuation behavior:\",\n    \"- This goal persists across turns. A runtime boundary can end one turn without shrinking the objective; the next continuation resumes the same full objective.\",\n    \"- Keep working until the requested end state is true and verified. Do not end the turn merely because one useful action completed, and do not redefine success around a smaller or easier task.\",\n    \"- An incomplete-status report is not a substitute for continuing the work. If the remaining problem can be investigated or addressed within your current authority, continue that work in this turn rather than returning another equivalent status-only final.\",\n    \"- Distinguish unfinished work from a blocker that actually requires human input or external change; use the existing waiting and blocked audits only when their conditions hold.\",\n    \"- Temporary rough edges are acceptable while the work is moving in the right direction. Completion still requires the requested end state to be true and verified.\",\n    \"\",\n    \"Work from evidence:\",\n    \"Use authoritative workspace and external evidence, including prior tool results that remain relevant and valid. Reuse evidence only for the requirement, scope, version, and state it actually establishes; recheck changed, stale, uncertain, or insufficient evidence. Conversation summaries and assistant claims are pointers, not proof. Do not infer progress or evidence validity merely from this continuation. Improve, replace, or remove existing work as needed within authority to satisfy the actual objective.\",\n    \"\",\n    \"Progress visibility:\",\n    \"If a planning tool is available and the next work is meaningfully multi-step, use it to show a concise plan tied to the real objective. Keep the plan current as steps complete or the next best action changes. Skip planning overhead for trivial one-step progress, and do not treat a plan update as a substitute for doing the work.\",\n    \"\",\n    \"Fidelity:\",\n    \"- Optimize each turn for movement toward the requested end state, not for the smallest stable-looking subset or easiest passing change.\",\n    \"- Do not substitute a narrower, safer, smaller, merely compatible, or easier-to-test solution because it is more likely to pass current tests.\",\n    \"- Treat alignment as movement toward the requested end state. An edit is aligned only if it makes the requested final state more true; useful-looking behavior that preserves a different end state is misaligned.\",\n    \"\",\n    \"Completion audit:\",\n    \"Before deciding that the goal is achieved, treat completion as unproven and verify it against the actual current state. This full completion audit is required even when ordinary continuation did not need full reconciliation; reuse still-valid authoritative evidence, but refresh it when the requirement or gate requires a fresh check:\",\n    \"- Derive concrete requirements from the objective and any referenced files, plans, specifications, issues, or user instructions.\",\n    \"- Preserve the applied objective's scope; do not redefine success around the work that already exists.\",\n    \"- For every explicit requirement, named artifact, command, test, gate, invariant, and deliverable, identify and inspect the authoritative evidence that would prove it.\",\n    \"- Match verification scope to requirement scope. Treat uncertain, indirect, incomplete, or missing evidence as not achieved and continue working.\",\n    \"- The audit must prove completion, not merely fail to find obvious remaining work.\",\n    \"- For document report deliverables (a document the user asked for, or a large report meant to be kept or shared), follow the Documents Skill: create the durable native document first, inspect its relevant final head after the last edit, and provide the returned artifact reference. Declare report requirements through the available goal tools before authoring and satisfy every persisted report requirement with verified artifact delivery evidence before completion. Sandbox paths and raw file IDs do not prove report delivery. If artifact tooling or access is unavailable, keep that deliverable incomplete and state the blocker; never invent proof or silently substitute a local report. Ordinary chat answers, short progress updates, source-code links, and explicitly requested local-file work remain outside this report contract.\",\n    \"\",\n    \"Do not rely on intent, partial progress, memory of earlier work, or a plausible final answer as proof of completion. Call opengeni__goal_complete with concrete evidence only when the full objective is actually achieved and no required work remains.\",\n    \"Goal evidence is a short proof for the ledger, not the deliverable. After goal_complete succeeds, finish this same turn with the requested user-facing answer, or a concise summary and retained artifact link. Goal completion stops future automatic continuations; it does not send the answer or end this turn. Never compress a report into evidence or omit the final reply.\",\n    \"Goal progress notes are short human-readable milestone statuses, not raw transcripts or continuation instructions. Keep normal spaces and summarize detail instead of squeezing words into a ledger field. The text and successCriteria fields each allow 8192 UTF-8 bytes, progressNote allows 8192 UTF-8 bytes, rationale allows 2048 UTF-8 bytes, and evidence allows 8192 characters.\",\n    \"\",\n    ...waitingGuidance,\n    ...childNoticeGuidance,\n    \"Blocked audit:\",\n    \"- Base persistence on evidence, not a fixed number of turns or retries. Investigate recoverable failures and try plausible safe alternatives within current authority when they could materially advance the goal; do not exhaust every imaginable alternative or repeat an unchanged failure without a reason to expect progress.\",\n    \"- A definitive missing permission, required human decision, or external prerequisite with no actionable authorized path can justify pausing immediately. State the concrete blocker, relevant evidence or attempted alternatives, and what must change to resume. Tool approvals remain human-only.\",\n    \"- If progress depends on work already in flight or a meaningful timed recheck, use the available waiting mechanism rather than pausing the goal; continue any independent authorized work first.\",\n    \"- Do not pause merely because the work is hard, slow, uncertain, incomplete, or would benefit from clarification.\",\n    \"- When no meaningful authorized progress remains and the blocker requires human input or an external change that cannot be handled by an available wait or monitoring mechanism, call opengeni__goal_pause with the concrete blocker instead of repeatedly reporting it while leaving the goal active.\",\n    \"\",\n    \"Do not call opengeni__goal_complete or opengeni__goal_pause unless the corresponding audit above is satisfied.\",\n  ].join(\"\\n\");\n}\n\n/**\n * Ensures a session/turn carries the first-party \"opengeni\" MCP server, which\n * hosts set_session_title, the goal tools, and the permission-gated\n * orchestration/environment/github tools. Attached to EVERY session/turn (not\n * just goal-bearing ones); built-in tool refs are not auto-added to empty tool\n * lists anywhere else in the pipeline. No-op when the server is not configured.\n */\nexport function withFirstPartyTools(settings: Settings, tools: ToolRef[]): ToolRef[] {\n  if (!settings.mcpServers.some((server) => server.id === \"opengeni\")) {\n    return tools;\n  }\n  return mergeToolRefs(tools, [{ kind: \"mcp\", id: \"opengeni\" }]);\n}\n","import { readTurnExecutionPolicyV1, type TurnExecutionPolicyV1 } from \"@opengeni/contracts\";\n\n/** Only accepted policies establish the ceiling; ordinary metadata is not authority. */\nexport function turnCredentialRestriction(\n  acceptedPolicy: TurnExecutionPolicyV1,\n  initialSessionMetadata: unknown,\n): \"developer_setup\" | undefined {\n  const initialPolicy = readTurnExecutionPolicyV1(initialSessionMetadata);\n  return acceptedPolicy.credentialRestriction === \"developer_setup\" ||\n    (initialPolicy.kind === \"valid\" &&\n      initialPolicy.policy.credentialRestriction === \"developer_setup\")\n    ? \"developer_setup\"\n    : undefined;\n}\n","import {\n  ATLASSIAN_NATIVE_RETIRED_REASON,\n  isRetiredNativeAtlassianSource,\n} from \"@opengeni/contracts/atlassian-native-retirement\";\nimport { isDeepStrictEqual } from \"node:util\";\nimport { AsyncLocalStorage } from \"node:async_hooks\";\nimport { scheduledTaskKnowledgeSource } from \"@opengeni/contracts\";\nimport {\n  freezeAgentLearningPolicy,\n  getScheduledTaskRunAcceptedExecution,\n  ensureKnowledgeSourceSyncState,\n  recordKnowledgeSourceSyncWake,\n} from \"@opengeni/db\";\nimport { createHash } from \"node:crypto\";\nimport { heartbeat } from \"@temporalio/activity\";\nimport {\n  googleDriveProviderRetryOptions,\n  type GoogleDriveProviderRetryOptions,\n  type Settings,\n} from \"@opengeni/config\";\nimport {\n  KnowledgeSourceSyncRunSummary,\n  type ScheduledTask,\n  type ScopedKnowledgeScope,\n} from \"@opengeni/contracts\";\nimport {\n  ATLASSIAN_PROVIDER_DOMAIN,\n  AtlassianConnectionMetadata,\n  atlassianScopesAllowRead,\n  type AtlassianSelectedSource,\n} from \"@opengeni/contracts/atlassian\";\nimport {\n  GoogleDriveConnectionMetadata,\n  GOOGLE_DRIVE_PROVIDER_DOMAIN,\n  googleDriveScopesAllowCapability,\n  type GoogleDriveSelectedSource,\n} from \"@opengeni/contracts/google-drive\";\nimport {\n  googleDriveKnowledgeScope,\n  inventoryGoogleDriveSource,\n  type GoogleDriveInventoryEntry,\n  type GoogleDriveInventoryCheckpoint,\n  type GoogleDriveInventoryPage,\n  type GoogleDriveInventoryProviderItem,\n  type GoogleDriveInventoryStopReason,\n} from \"@opengeni/documents/google-drive\";\nimport {\n  atlassianKnowledgeScope,\n  inventoryAtlassianSource,\n  type AtlassianInventoryEntry,\n  type AtlassianInventoryPage,\n  type AtlassianInventoryStopReason,\n} from \"@opengeni/documents/atlassian\";\nimport { addDocumentToBase, ensureDefaultBase, getDocumentBase } from \"@opengeni/documents\";\nimport {\n  appendKnowledgeDocumentVersion,\n  appendKnowledgeSourceAclVersion,\n  beginKnowledgeSyncRun,\n  beginGoogleDriveObjectAclRefresh,\n  buildConnectionTokenResolver,\n  checkpointKnowledgeSourceSync,\n  claimKnowledgeSourceSyncLease,\n  compareCanonicalDecimalProviderRevisions,\n  completeKnowledgeSyncRun,\n  completeKnowledgeSourceSyncWakeWithoutLease,\n  deauthorizeKnowledgeSourceRetrieval,\n  enqueueKnowledgeSourceSyncIndexObligation,\n  ensureKnowledgeSourceBlobFile,\n  getConnectionMetadata,\n  getKnowledgeDocumentVersionObservationForSyncAuthority,\n  getKnowledgeSyncRunForSyncAuthority,\n  getKnowledgeSourceAclForSyncAuthority,\n  getKnowledgeSourceForSyncAuthority,\n  getKnowledgeSourceObjectForSyncAuthority,\n  getKnowledgeSourceSyncIndexObligationForVersion,\n  getScheduledTask,\n  listObservedKnowledgeSourceSyncExternalObjectIds,\n  KnowledgeSourceSyncObservationFenceError,\n  reconcileKnowledgeSourceSyncCompleteScan,\n  reconcileKnowledgeSourceSyncLiveGeneration,\n  recordGoogleDriveObjectAclEvidence,\n  recordKnowledgeSourceSyncItemOutcomes,\n  recordKnowledgeSourceSyncObjectObservations,\n  recordUsageEvent,\n  releaseKnowledgeSourceSyncLeaseForRetry,\n  restoreKnowledgeSourceObject,\n  retryKnowledgeSourceSyncIndexObligation,\n  scopedKnowledgeScopeKey,\n  settleKnowledgeSourceSyncLease,\n  settleKnowledgeSourceSyncIndexObligation,\n  updateKnowledgeSourceDocumentObservationMetadata,\n  updateScheduledTaskRun,\n  upsertKnowledgeSourceObject,\n  type Database,\n  type KnowledgeSourceSyncObjectObservationResult,\n  type KnowledgeSourceSyncObservationFloor,\n} from \"@opengeni/db\";\nimport { readResponseJsonBounded } from \"@opengeni/network\";\nimport type { Observability } from \"@opengeni/observability\";\nimport { createDocumentActivities } from \"./documents\";\nimport {\n  fetchGoogleDriveProvider,\n  GoogleDriveProviderTransportError,\n  type GoogleDriveProviderOperation,\n} from \"./google-drive-provider\";\nimport type {\n  ControlActivityServices,\n  RunKnowledgeSourceSyncBatchInput,\n  RunKnowledgeSourceSyncBatchResult,\n} from \"./types\";\nimport type {\n  KnowledgeSourceSyncAclEvidence,\n  KnowledgeSourceSyncDriver,\n} from \"./knowledge-source-sync-driver\";\nimport {\n  advanceGoogleDriveChangesCursor,\n  buildGoogleDriveChangesCursor,\n  drainGoogleDriveChanges,\n  GoogleDriveChangesProtocolError,\n  GoogleDriveCursorInvalidError,\n  googleDriveFullReconciliationDue,\n  parseGoogleDriveChangesCheckpoint,\n  parseGoogleDriveChangesCursor,\n  resolveGoogleDriveChangesBoundaryId,\n  type GoogleDriveChangesCheckpoint,\n  type GoogleDriveChangesPage,\n  type GoogleDriveSyncBudget,\n} from \"./google-drive-changes\";\n\n// Carries exact-attempt liveness into every physical request, including provider retries.\nconst sourceRequestAuthority = new AsyncLocalStorage<() => Promise<unknown>>();\nconst sourceFetch: typeof fetch = Object.assign(\n  async (...args: Parameters<typeof fetch>) => {\n    await sourceRequestAuthority.getStore()?.();\n    return fetch(...args);\n  },\n  { preconnect: fetch.preconnect },\n);\n\nconst DRIVE_API_BASE = \"https://www.googleapis.com/drive/v3\";\nconst DRIVE_JSON_MAX_BYTES = 2 * 1024 * 1024;\nconst GOOGLE_DRIVE_FULL_RECONCILIATION_INTERVAL_MS = 24 * 60 * 60 * 1_000;\nconst GOOGLE_DRIVE_SYNC_INVOCATION_SLICE_MS = 30_000;\nconst GOOGLE_DRIVE_EXECUTION_CHECKPOINT_MAX_BYTES = 2 * 1024 * 1024;\nconst GOOGLE_DRIVE_ACL_FRESHNESS_MS = 26 * 60 * 60 * 1_000;\nconst GOOGLE_DRIVE_ACL_MAX_PRINCIPALS = 1_000;\nconst ATLASSIAN_API_BASE = \"https://api.atlassian.com\";\nconst ATLASSIAN_JSON_MAX_BYTES = 4 * 1024 * 1024;\n\ntype KnowledgeSyncEntry = GoogleDriveInventoryEntry | AtlassianInventoryEntry;\ntype KnowledgeSyncStopReason = GoogleDriveInventoryStopReason | AtlassianInventoryStopReason;\n\ntype GoogleDrivePermission = {\n  id: string;\n  type: \"user\" | \"group\" | \"domain\" | \"anyone\";\n  role: \"owner\" | \"organizer\" | \"fileOrganizer\" | \"writer\" | \"commenter\" | \"reader\";\n  emailAddress: string | null;\n  domain: string | null;\n  allowFileDiscovery: boolean | null;\n  expirationTime: string | null;\n  inherited: boolean;\n};\n\ntype GoogleDrivePermissionsPage = {\n  permissions: GoogleDrivePermission[];\n  nextPageToken: string | null;\n  denied: boolean;\n};\n\nexport function knowledgeSyncObservationPolicy(kind: \"google_drive\" | \"atlassian\") {\n  return kind === \"google_drive\"\n    ? { revisionOrdering: \"canonical_decimal\" as const, filterWithDriveDurability: true }\n    : { revisionOrdering: \"first_observation\" as const, filterWithDriveDurability: false };\n}\n\nexport function createKnowledgeSourceSyncActivities(\n  services: () => Promise<ControlActivityServices>,\n  resolveDocumentServices?: () => Promise<import(\"@opengeni/documents\").DocumentServices>,\n) {\n  const documentActivities = createDocumentActivities(services, resolveDocumentServices);\n  return {\n    runKnowledgeSourceSyncBatch: async (\n      input: RunKnowledgeSourceSyncBatchInput,\n    ): Promise<RunKnowledgeSourceSyncBatchResult> => {\n      const { settings, db, objectStorage, observability } = await services();\n      if (!objectStorage) throw new Error(\"object storage is not configured\");\n      // A control workflow cannot fetch sources. Only the exact ordinary\n      // agent run carrying the immutable source binding can use this adapter.\n      if (!input.agent)\n        return { action: \"failed\", bufferedWake: false, errorCode: \"accepted_agent_required\" };\n      const context = {\n        accountId: input.accountId,\n        workspaceId: input.workspaceId,\n        actor: input.agent,\n      };\n      let boundSource: ReturnType<typeof scheduledTaskKnowledgeSource> = null;\n      const authorize = async () => {\n        const policy = await freezeAgentLearningPolicy(db, context);\n        if (policy.scheduledTaskRunId !== input.scheduledTaskRunId)\n          throw new Error(\"Source fetch does not belong to this accepted agent run\");\n        if (boundSource) {\n          const [currentTask, connection] = await Promise.all([\n            getScheduledTask(db, input.workspaceId, input.taskId),\n            getConnectionMetadata(\n              db,\n              input.workspaceId,\n              boundSource.connection.connectionId,\n              boundSource.initiatingSubjectId,\n            ),\n          ]);\n          const control = currentTask?.metadata.knowledgeSourceSync as\n            | Record<string, unknown>\n            | undefined;\n          if (\n            !currentTask ||\n            currentTask.status !== \"active\" ||\n            control?.sourceEnabled === false ||\n            control?.connectionPaused === true ||\n            !isDeepStrictEqual(scheduledTaskKnowledgeSource(currentTask), boundSource) ||\n            !connection ||\n            connection.status !== \"active\" ||\n            connection.version !== boundSource.connection.connectionVersion ||\n            connection.subjectId !== boundSource.connection.ownerSubjectId\n          )\n            throw new SyncFailure(\"authority_changed\", false);\n        }\n        return policy;\n      };\n      await authorize();\n      const accepted = await getScheduledTaskRunAcceptedExecution(db, {\n        workspaceId: input.workspaceId,\n        runId: input.scheduledTaskRunId,\n      });\n      const task = accepted?.task;\n      const action = task ? scheduledTaskKnowledgeSource(task) : null;\n      const liveTask = await getScheduledTask(db, input.workspaceId, input.taskId);\n      if (\n        !task ||\n        !action ||\n        !liveTask ||\n        liveTask.status !== \"active\" ||\n        task.id !== input.taskId ||\n        task.accountId !== input.accountId ||\n        task.action.kind !== \"agent_turn\" ||\n        action.sourceId !== input.sourceId ||\n        accepted.causalHumanSubjectId !== action.initiatingSubjectId\n      ) {\n        return { action: \"failed\", bufferedWake: false };\n      }\n      if (isRetiredNativeAtlassianSource(action))\n        return {\n          action: \"failed\",\n          bufferedWake: false,\n          errorCode: ATLASSIAN_NATIVE_RETIRED_REASON,\n        };\n      boundSource = action;\n      await authorize();\n      await ensureKnowledgeSourceSyncState(db, task);\n      await recordKnowledgeSourceSyncWake(db, {\n        accountId: input.accountId,\n        workspaceId: input.workspaceId,\n        sourceId: input.sourceId,\n        scheduledTaskId: task.id,\n        scheduledTaskRunId: input.scheduledTaskRunId,\n        cause: \"scheduled\",\n        producerKey: `agent-source:${input.scheduledTaskRunId}`,\n        sourceConfigGeneration: action.sourceConfigGeneration,\n        sourceLifecycleGeneration: action.sourceLifecycleGeneration,\n      });\n      const providerLabel =\n        action.connection.providerDomain === ATLASSIAN_PROVIDER_DOMAIN\n          ? \"atlassian\"\n          : \"google_drive\";\n      if (\n        action.controlWorkspaceId !== input.workspaceId ||\n        action.sourceConfigGeneration <= 0 ||\n        !action.providerCoordinationKey\n      ) {\n        return await failWithoutProvider(\"authority_changed\");\n      }\n      const lease = await claimKnowledgeSourceSyncLease(db, {\n        ...input,\n        overlapPolicy: input.overlapPolicy,\n      });\n      if (lease.action !== \"claimed\") {\n        observability.incrementCounter({\n          name: \"opengeni_knowledge_source_sync_runs_total\",\n          labels: { provider: providerLabel, outcome: lease.action },\n        });\n        return { action: lease.action };\n      }\n\n      let knowledgeRunId: string | null = null;\n      let activeSourceSyncGeneration: number | null = null;\n      const startedAt = Date.now();\n      const summary: KnowledgeSourceSyncRunSummary = {\n        phase: \"queued\",\n        scanned: 0,\n        imported: 0,\n        unchanged: 0,\n        skipped: 0,\n        failed: 0,\n        bytes: 0,\n        providerRequests: 0,\n        elapsedMs: 0,\n        indexed: 0,\n        aclPending: 0,\n        retryable: false,\n        limitReached: null as\n          | \"items\"\n          | \"bytes\"\n          | \"file_bytes\"\n          | \"provider_requests\"\n          | \"elapsed_time\"\n          | null,\n        checkpointed: false,\n        reconnectRequired: false,\n        failures: [],\n      };\n      observability.info(\"Knowledge source sync started\", {\n        provider: providerLabel,\n        outcome: \"started\",\n      });\n      try {\n        summary.phase = \"inventory\";\n        const resolved = await getKnowledgeSourceForSyncAuthority(db, {\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          sourceId: input.sourceId,\n          initiatingSubjectId: action.initiatingSubjectId,\n        });\n        if (!resolved || resolved.source.lifecycleState !== \"active\") {\n          throw new SyncFailure(\"authority_changed\", false);\n        }\n        if (\n          scopedKnowledgeScopeKey(resolved.source.scope) !==\n          scopedKnowledgeScopeKey(action.destination)\n        ) {\n          throw new SyncFailure(\"authority_changed\", false);\n        }\n        const liveState = await reconcileKnowledgeSourceSyncLiveGeneration(db, {\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          sourceId: input.sourceId,\n          scheduledTaskRunId: input.scheduledTaskRunId,\n          initiatingSubjectId: action.initiatingSubjectId,\n          sourceConfigGeneration: action.sourceConfigGeneration,\n          sourceLifecycleGeneration: action.sourceLifecycleGeneration,\n          liveSourceSyncGeneration: resolved.source.syncGeneration,\n        });\n        activeSourceSyncGeneration = resolved.source.syncGeneration;\n        const syncOperationId = `scheduled-task-run:${input.scheduledTaskRunId}`;\n        const replayedRun = await getKnowledgeSyncRunForSyncAuthority(db, {\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          sourceId: input.sourceId,\n          operationId: syncOperationId,\n          initiatingSubjectId: action.initiatingSubjectId,\n        });\n        if (replayedRun && replayedRun.state !== \"started\") {\n          const replayedSummary = KnowledgeSourceSyncRunSummary.parse(replayedRun.metadata);\n          const settlementInput: Parameters<typeof settleKnowledgeSourceSyncLease>[1] = {\n            accountId: input.accountId,\n            workspaceId: input.workspaceId,\n            sourceId: input.sourceId,\n            scheduledTaskRunId: input.scheduledTaskRunId,\n            knowledgeSyncRunId: replayedRun.id,\n            status: replayedRun.state === \"succeeded\" ? \"succeeded\" : \"failed\",\n            summary: replayedSummary,\n            error: replayedRun.errorCode,\n            sourceConfigGeneration: action.sourceConfigGeneration,\n            sourceLifecycleGeneration: action.sourceLifecycleGeneration,\n            sourceSyncGeneration: replayedRun.inputSyncGeneration,\n            completedSourceSyncGeneration:\n              replayedRun.state === \"succeeded\" ? replayedRun.inputSyncGeneration + 1 : null,\n            ...(replayedRun.state === \"succeeded\" &&\n            replayedRun.metadata.providerCursor &&\n            typeof replayedRun.metadata.providerCursor === \"object\"\n              ? {\n                  providerCursor: replayedRun.metadata.providerCursor as Record<string, unknown>,\n                }\n              : {}),\n          };\n          const settled =\n            replayedRun.state === \"failed\" && replayedSummary.reconnectRequired\n              ? await deauthorizeAndSettleKnowledgeSourceSyncFailure(db, {\n                  deauthorization: {\n                    accountId: input.accountId,\n                    workspaceId: input.workspaceId,\n                    sourceId: input.sourceId,\n                    audience: action.destination,\n                    operationId: `knowledge-sync-deauthorize:${input.sourceId}:${action.connection.connectionVersion}:${replayedRun.errorCode ?? \"connection_reconnect_required\"}`,\n                    reasonCode: \"connection_reconnect_required\",\n                    actor: {\n                      kind: \"service\",\n                      subjectId: \"knowledge-source-sync\",\n                      initiatingHumanSubjectId: action.initiatingSubjectId,\n                    },\n                  },\n                  settlement: settlementInput,\n                })\n              : await settleKnowledgeSourceSyncLease(db, settlementInput);\n          await recordConnectorUsage(\"completed\", replayedSummary.scanned, \"item\");\n          await recordConnectorUsage(\"items\", replayedSummary.imported, \"item\");\n          await recordConnectorUsage(\"bytes\", replayedSummary.bytes, \"byte\");\n          return {\n            action: replayedRun.state === \"succeeded\" ? \"complete\" : \"failed\",\n            summary: replayedSummary,\n            ...(replayedRun.errorCode ? { errorCode: replayedRun.errorCode } : {}),\n            bufferedWake: settled.bufferedWake,\n            bufferedScheduledTaskRunId: settled.bufferedScheduledTaskRunId,\n          };\n        }\n        const provider = await resolveKnowledgeSyncProvider({\n          db,\n          settings,\n          observability,\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          action,\n          sourceId: input.sourceId,\n          externalSourceId: resolved.source.externalSourceId,\n        });\n        const selectedDestination = provider.selectedDestination;\n        const observationPolicy = knowledgeSyncObservationPolicy(provider.kind);\n\n        let aclGeneration = resolved.source.currentAclGeneration;\n        let acl = aclGeneration\n          ? await getKnowledgeSourceAclForSyncAuthority(db, {\n              accountId: input.accountId,\n              workspaceId: input.workspaceId,\n              sourceId: input.sourceId,\n              generation: aclGeneration,\n              initiatingSubjectId: action.initiatingSubjectId,\n            })\n          : null;\n        const actor = {\n          kind: \"service\" as const,\n          subjectId: \"knowledge-source-sync\",\n          initiatingHumanSubjectId: action.initiatingSubjectId,\n        };\n        if (!acl) {\n          acl = await appendKnowledgeSourceAclVersion(db, {\n            accountId: input.accountId,\n            workspaceId: input.workspaceId,\n            sourceId: input.sourceId,\n            audience: action.destination,\n            expectedSourceLifecycleGeneration: resolved.source.lifecycleGeneration,\n            expectedAclGeneration: 0,\n            aclVersion: \"opengeni-destination-v1\",\n            agentAccess: false,\n            operationId: `source-initial-acl:${input.sourceId}`,\n            reasonCode: \"initial_destination_acl\",\n            actor,\n          });\n          aclGeneration = acl.generation;\n        }\n\n        const knowledgeRun =\n          replayedRun ??\n          (await beginKnowledgeSyncRun(db, {\n            accountId: input.accountId,\n            workspaceId: input.workspaceId,\n            sourceId: input.sourceId,\n            expectedSourceLifecycleGeneration: resolved.source.lifecycleGeneration,\n            expectedSyncGeneration: resolved.source.syncGeneration,\n            inputCursor: null,\n            operationId: syncOperationId,\n            actor,\n          }));\n        knowledgeRunId = knowledgeRun.id;\n\n        const originalDriver = provider.driver;\n        const readAcl = originalDriver.readAcl;\n        const driver = {\n          ...originalDriver,\n          inventory: (...args: Parameters<typeof originalDriver.inventory>) =>\n            sourceRequestAuthority.run(authorize, () => originalDriver.inventory(...args)),\n          fetchContent: (...args: Parameters<typeof originalDriver.fetchContent>) =>\n            sourceRequestAuthority.run(authorize, () => originalDriver.fetchContent(...args)),\n          ...(readAcl\n            ? {\n                readAcl: (...args: Parameters<typeof readAcl>) =>\n                  sourceRequestAuthority.run(authorize, () => readAcl(...args)),\n              }\n            : {}),\n        };\n        await authorize();\n        const inventory = await driver.inventory(\n          lease.state.executionCheckpoint,\n          lease.state.providerCursor,\n        );\n        summary.providerRequests = inventory.providerRequests;\n        summary.elapsedMs = inventory.elapsedMs;\n\n        const base = selectedDestination.collectionId\n          ? await getDocumentBase(db, input.workspaceId, selectedDestination.collectionId)\n          : await ensureDefaultBase(db, {\n              accountId: input.accountId,\n              workspaceId: input.workspaceId,\n            });\n        if (!base) throw new SyncFailure(\"authority_changed\", false);\n\n        const durableObservations = await recordKnowledgeSourceSyncObjectObservations(db, {\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          sourceId: input.sourceId,\n          scheduledTaskRunId: input.scheduledTaskRunId,\n          initiatingSubjectId: action.initiatingSubjectId,\n          scanGeneration: liveState.activeScanGeneration,\n          executionCheckpointGeneration: lease.state.executionCheckpointGeneration,\n          revisionOrdering: observationPolicy.revisionOrdering,\n          observations: inventory.entries.map((entry) => ({\n            externalObjectId: entry.externalObjectId,\n            providerRevision: entry.externalVersionId,\n            metadataHash: entryMetadataHash(entry),\n          })),\n        });\n        const entriesToProcess = observationPolicy.filterWithDriveDurability\n          ? inventory.entries.filter((entry, index) =>\n              shouldProcessGoogleDriveDurableObservation({\n                entry,\n                observation: durableObservations[index]!,\n                sourceLifecycleGeneration: resolved.source.lifecycleGeneration,\n                aclGeneration: aclGeneration!,\n              }),\n            )\n          : inventory.entries;\n        const observationFloorsById = new Map<string, KnowledgeSourceSyncObservationFloor>();\n        for (const observation of durableObservations) {\n          observationFloorsById.set(observation.externalObjectId, {\n            externalObjectId: observation.externalObjectId,\n            providerRevision: observation.providerRevision,\n            metadataHash: observation.metadataHash,\n          });\n        }\n        const observationFloors = [...observationFloorsById.values()];\n        const executionCheckpoint = mergeGoogleDriveDurableObservationFloors(\n          inventory.checkpoint,\n          observationFloors,\n          action.limits.maxItems,\n        );\n\n        const ensureVersionIndexed = async (details: {\n          entry: KnowledgeSyncEntry;\n          object: {\n            id: string;\n            lifecycleGeneration: number;\n          };\n          version: {\n            id: string;\n            versionGeneration: number;\n            documentId: string | null;\n          };\n          indexRequired: boolean;\n          obligation?: Awaited<ReturnType<typeof getKnowledgeSourceSyncIndexObligationForVersion>>;\n        }) => {\n          if (!details.version.documentId) {\n            throw new SyncFailure(\"authority_changed\", false);\n          }\n          let obligation =\n            details.obligation ??\n            (await getKnowledgeSourceSyncIndexObligationForVersion(db, {\n              accountId: input.accountId,\n              workspaceId: input.workspaceId,\n              knowledgeDocumentVersionId: details.version.id,\n              initiatingSubjectId: action.initiatingSubjectId,\n            }));\n          if (!obligation) {\n            obligation = await enqueueKnowledgeSourceSyncIndexObligation(db, {\n              accountId: input.accountId,\n              workspaceId: input.workspaceId,\n              scheduledTaskRunId: input.scheduledTaskRunId,\n              sourceId: input.sourceId,\n              sourceSyncGeneration: knowledgeRun.inputSyncGeneration,\n              initiatingSubjectId: action.initiatingSubjectId,\n              externalObjectId: details.entry.externalObjectId,\n              knowledgeSourceObjectId: details.object.id,\n              knowledgeDocumentVersionId: details.version.id,\n              documentId: details.version.documentId,\n              sourceConfigGeneration: action.sourceConfigGeneration,\n              sourceLifecycleGeneration: action.sourceLifecycleGeneration,\n              objectLifecycleGeneration: details.object.lifecycleGeneration,\n              objectVersionGeneration: details.version.versionGeneration,\n              citationLocator: driver.citationLocator(details.entry),\n            });\n          }\n          if (obligation.documentId !== details.version.documentId) {\n            throw new SyncFailure(\"authority_changed\", false);\n          }\n          if (obligation.status === \"indexed\" && !details.indexRequired) return obligation;\n          if (obligation.status === \"indexed\" && details.indexRequired) {\n            summary.phase = \"index\";\n            try {\n              const indexedDocument = await documentActivities.indexDocument({\n                accountId: input.accountId,\n                workspaceId: input.workspaceId,\n                documentId: details.version.documentId,\n                authorityKind: action.destination.kind,\n                authorityWorkspaceId: action.destination.workspaceId,\n                authoritySubjectId: action.destination.subjectId,\n              });\n              if (indexedDocument.status !== \"ready\") {\n                throw new Error(\"document indexing did not complete\");\n              }\n            } catch {\n              throw new SyncFailure(\"indexing_failed\", true);\n            }\n            return obligation;\n          }\n          if (obligation.status === \"failed\") {\n            const retried = await retryKnowledgeSourceSyncIndexObligation(db, {\n              accountId: input.accountId,\n              workspaceId: input.workspaceId,\n              obligationId: obligation.id,\n              scheduledTaskRunId: input.scheduledTaskRunId,\n            });\n            if (retried === \"invalidated\") {\n              throw new SyncFailure(\"authority_changed\", false);\n            }\n            obligation = { ...obligation, status: retried };\n            if (retried === \"indexed\") return obligation;\n          }\n          if (obligation.status !== \"pending\") {\n            throw new SyncFailure(\"authority_changed\", false);\n          }\n          if (details.indexRequired) {\n            summary.phase = \"index\";\n            try {\n              const indexedDocument = await documentActivities.indexDocument({\n                accountId: input.accountId,\n                workspaceId: input.workspaceId,\n                documentId: details.version.documentId,\n                authorityKind: action.destination.kind,\n                authorityWorkspaceId: action.destination.workspaceId,\n                authoritySubjectId: action.destination.subjectId,\n              });\n              if (indexedDocument.status !== \"ready\") {\n                throw new Error(\"document indexing did not complete\");\n              }\n            } catch {\n              await settleKnowledgeSourceSyncIndexObligation(db, {\n                accountId: input.accountId,\n                workspaceId: input.workspaceId,\n                obligationId: obligation.id,\n                status: \"failed\",\n                failureCode: \"indexing_failed\",\n              }).catch(() => undefined);\n              throw new SyncFailure(\"indexing_failed\", true);\n            }\n          }\n          const settlement = await settleKnowledgeSourceSyncIndexObligation(db, {\n            accountId: input.accountId,\n            workspaceId: input.workspaceId,\n            obligationId: obligation.id,\n            status: \"indexed\",\n          });\n          if (settlement === \"invalidated\") {\n            throw new SyncFailure(\"authority_changed\", false);\n          }\n          return { ...obligation, status: \"indexed\" };\n        };\n\n        const recordEntryAcl = async (details: {\n          entry: KnowledgeSyncEntry;\n          object: { id: string; lifecycleGeneration: number };\n          version: { id: string; versionGeneration: number };\n          obligation: { id: string; sourceSyncGeneration: number };\n        }): Promise<{\n          aclEligibility: \"pending\" | \"eligible\" | \"denied\";\n          aclEvidence: Record<string, unknown> | null;\n        }> => {\n          if (!driver.readAcl || !provider.aclAuthority) {\n            return { aclEligibility: \"pending\", aclEvidence: null };\n          }\n          await beginGoogleDriveObjectAclRefresh(db, {\n            accountId: input.accountId,\n            workspaceId: input.workspaceId,\n            obligationId: details.obligation.id,\n            sourceSyncGeneration: details.obligation.sourceSyncGeneration,\n            sourceConfigGeneration: action.sourceConfigGeneration,\n            sourceLifecycleGeneration: action.sourceLifecycleGeneration,\n            objectLifecycleGeneration: details.object.lifecycleGeneration,\n            objectVersionGeneration: details.version.versionGeneration,\n          });\n          const remainingProviderRequests =\n            action.limits.maxProviderRequests - summary.providerRequests;\n          if (remainingProviderRequests < 1) {\n            throw new SyncFailure(\"resource_limit\", false);\n          }\n          await authorize();\n          const evidence = await driver.readAcl(details.entry, remainingProviderRequests);\n          summary.providerRequests += evidence.providerRequests;\n          if (summary.providerRequests > action.limits.maxProviderRequests) {\n            throw new SyncFailure(\"resource_limit\", false);\n          }\n          const recorded = await recordGoogleDriveObjectAclEvidence(db, {\n            accountId: input.accountId,\n            workspaceId: input.workspaceId,\n            obligationId: details.obligation.id,\n            connectionId: provider.aclAuthority.connectionId,\n            connectionVersion: provider.aclAuthority.connectionVersion,\n            sourceGooglePermissionId: provider.aclAuthority.sourceGooglePermissionId,\n            sourceSyncGeneration: details.obligation.sourceSyncGeneration,\n            sourceConfigGeneration: action.sourceConfigGeneration,\n            sourceLifecycleGeneration: action.sourceLifecycleGeneration,\n            objectLifecycleGeneration: details.object.lifecycleGeneration,\n            objectVersionGeneration: details.version.versionGeneration,\n            providerRevision: evidence.providerRevision,\n            driveId: evidence.driveId,\n            aclRevision: evidence.aclRevision,\n            eligibility: evidence.eligibility,\n            observedAt: evidence.observedAt,\n            expiresAt: evidence.expiresAt,\n            citationLocator: driver.citationLocator(details.entry),\n            operationId: `drive-acl:${details.obligation.id}:${evidence.aclRevision}`,\n            principals: evidence.principals,\n          });\n          return {\n            aclEligibility: evidence.eligibility,\n            aclEvidence: {\n              version: 1,\n              provider: \"google_drive\",\n              evidenceId: recorded.evidenceId,\n              aclRevision: evidence.aclRevision,\n              aclHash: recorded.aclHash,\n              observedAt: evidence.observedAt,\n              expiresAt: evidence.expiresAt,\n            },\n          };\n        };\n\n        const outcomes = [];\n        for (const entry of entriesToProcess) {\n          await authorize();\n          heartbeat({ sourceId: input.sourceId, externalObjectId: entry.externalObjectId });\n          const observationFloor = observationFloorsById.get(entry.externalObjectId);\n          if (!observationFloor) throw new SyncFailure(\"provider_payload_invalid\", false);\n          const syncObservation = {\n            scheduledTaskRunId: input.scheduledTaskRunId,\n            scanGeneration: liveState.activeScanGeneration,\n            providerRevision: observationFloor.providerRevision,\n            metadataHash: observationFloor.metadataHash,\n          };\n          summary.scanned += 1;\n          if (entry.transfer.action === \"skip\") {\n            summary.skipped += 1;\n            outcomes.push({\n              externalObjectId: entry.externalObjectId,\n              outcome: \"skipped\" as const,\n              reasonCode: entry.transfer.reason,\n            });\n            continue;\n          }\n          if (entry.transfer.action === \"traverse\") continue;\n          try {\n            const existingObject = await getKnowledgeSourceObjectForSyncAuthority(db, {\n              accountId: input.accountId,\n              workspaceId: input.workspaceId,\n              sourceId: input.sourceId,\n              externalObjectId: entry.externalObjectId,\n              initiatingSubjectId: action.initiatingSubjectId,\n            });\n            let object =\n              existingObject ??\n              (await upsertKnowledgeSourceObject(db, {\n                accountId: input.accountId,\n                workspaceId: input.workspaceId,\n                sourceId: input.sourceId,\n                externalObjectId: entry.externalObjectId,\n                operationId: `source-object:${input.sourceId}:${entry.externalObjectId}`,\n                actor,\n              }));\n            if (object.lifecycleState !== \"active\") {\n              const restored = await restoreKnowledgeSourceObject(db, {\n                accountId: input.accountId,\n                workspaceId: input.workspaceId,\n                targetId: object.id,\n                expectedGeneration: object.lifecycleGeneration,\n                operationId: `knowledge-sync-object-restore:${object.id}:${liveState.activeScanGeneration}`,\n                reasonCode: \"authoritative_scan_observed\",\n                actor,\n              });\n              object = {\n                ...object,\n                lifecycleState: \"active\",\n                lifecycleGeneration: restored.lifecycleGeneration,\n              };\n            }\n            const currentObservation = object.currentVersionId\n              ? await getKnowledgeDocumentVersionObservationForSyncAuthority(db, {\n                  accountId: input.accountId,\n                  workspaceId: input.workspaceId,\n                  versionId: object.currentVersionId,\n                  initiatingSubjectId: action.initiatingSubjectId,\n                })\n              : null;\n            const currentVersion = currentObservation?.version ?? null;\n            const metadataHash = entryMetadataHash(entry);\n            const observedProviderRevision =\n              typeof currentObservation?.sourceMetadata.providerRevision === \"string\"\n                ? currentObservation.sourceMetadata.providerRevision\n                : null;\n            const observedMetadataHash =\n              typeof currentObservation?.sourceMetadata.metadataHash === \"string\"\n                ? currentObservation.sourceMetadata.metadataHash\n                : null;\n            const observedSourceLifecycleGeneration = Number(\n              currentObservation?.sourceMetadata.sourceLifecycleGeneration ?? 0,\n            );\n            const observedObjectLifecycleGeneration = Number(\n              currentObservation?.sourceMetadata.objectLifecycleGeneration ?? 0,\n            );\n            const currentObligation = currentVersion\n              ? await getKnowledgeSourceSyncIndexObligationForVersion(db, {\n                  accountId: input.accountId,\n                  workspaceId: input.workspaceId,\n                  knowledgeDocumentVersionId: currentVersion.id,\n                  initiatingSubjectId: action.initiatingSubjectId,\n                })\n              : null;\n            if (\n              currentVersion &&\n              currentVersion.documentId &&\n              observedProviderRevision === entry.externalVersionId &&\n              observedMetadataHash === metadataHash &&\n              currentVersion.aclGeneration === aclGeneration &&\n              observedSourceLifecycleGeneration === resolved.source.lifecycleGeneration &&\n              observedObjectLifecycleGeneration === object.lifecycleGeneration &&\n              currentObligation?.status !== \"invalidated\"\n            ) {\n              await updateKnowledgeSourceDocumentObservationMetadata(db, {\n                accountId: input.accountId,\n                workspaceId: input.workspaceId,\n                initiatingSubjectId: action.initiatingSubjectId,\n                sourceId: input.sourceId,\n                expectedSourceLifecycleGeneration: resolved.source.lifecycleGeneration,\n                objectId: object.id,\n                expectedObjectLifecycleGeneration: object.lifecycleGeneration,\n                versionId: currentVersion.id,\n                documentId: currentVersion.documentId,\n                title: entry.title,\n                sourceUri: entry.sourceUri,\n                sourceVersion: entry.externalVersionId ?? currentVersion.contentSha256,\n                sourceUpdatedAt: entry.modifiedTime,\n                syncObservation,\n              });\n              const obligation = await ensureVersionIndexed({\n                entry,\n                object,\n                version: currentVersion,\n                indexRequired: (currentObservation?.documentChunkCount ?? 0) === 0,\n                obligation: currentObligation,\n              });\n              const objectAcl = await recordEntryAcl({\n                entry,\n                object,\n                version: currentVersion,\n                obligation,\n              });\n              summary.unchanged += 1;\n              outcomes.push({\n                externalObjectId: entry.externalObjectId,\n                outcome: \"unchanged\" as const,\n                contentSha256: currentVersion.contentSha256,\n                providerRevision: entry.externalVersionId,\n                metadataHash,\n                aclEligibility: objectAcl.aclEligibility,\n                aclEvidence: objectAcl.aclEvidence,\n                indexObligationId: obligation.id,\n              });\n              continue;\n            }\n            summary.phase = \"transfer\";\n            await authorize();\n            const bytes = await driver.fetchContent(entry, action.limits.maxFileBytes);\n            const contentSha256 = createHash(\"sha256\").update(bytes).digest(\"hex\");\n            const observationKey = createHash(\"sha256\")\n              .update(\n                JSON.stringify({\n                  externalObjectId: entry.externalObjectId,\n                  providerRevision: entry.externalVersionId,\n                  metadataHash,\n                  contentSha256,\n                  aclGeneration,\n                  sourceLifecycleGeneration: resolved.source.lifecycleGeneration,\n                  objectLifecycleGeneration: object.lifecycleGeneration,\n                }),\n              )\n              .digest(\"hex\");\n            if (\n              currentVersion?.contentSha256 === contentSha256 &&\n              currentVersion.documentId &&\n              currentVersion.fileId\n            ) {\n              const version = await appendKnowledgeDocumentVersion(db, {\n                accountId: input.accountId,\n                workspaceId: input.workspaceId,\n                objectId: object.id,\n                expectedSourceLifecycleGeneration: resolved.source.lifecycleGeneration,\n                expectedObjectLifecycleGeneration: object.lifecycleGeneration,\n                expectedVersionGeneration: object.versionGeneration,\n                externalVersionId: entry.externalVersionId ?? contentSha256,\n                contentSha256,\n                ingestionKey: `${entry.externalObjectId}:${observationKey}`,\n                sourceCursor: null,\n                sourceMetadata: {\n                  title: entry.title,\n                  mimeType: entry.mimeType,\n                  driveId: entry.driveId,\n                  providerRevision: entry.externalVersionId,\n                  metadataHash,\n                  aclEligibility: \"pending\",\n                  sourceLifecycleGeneration: resolved.source.lifecycleGeneration,\n                  objectLifecycleGeneration: object.lifecycleGeneration,\n                },\n                sourceCreatedAt: entry.createdTime,\n                sourceUpdatedAt: entry.modifiedTime,\n                aclVersionId: acl.id,\n                aclGeneration: aclGeneration!,\n                documentId: currentVersion.documentId,\n                fileId: currentVersion.fileId,\n                locationMetadata: { sourceUri: entry.sourceUri },\n                documentObservationMetadata: {\n                  title: entry.title,\n                  sourceUri: entry.sourceUri,\n                  sourceVersion: entry.externalVersionId ?? contentSha256,\n                  sourceUpdatedAt: entry.modifiedTime,\n                },\n                syncObservation,\n                operationId: `document-observation:${object.id}:${observationKey}`,\n                reasonCode: \"source_metadata_observed\",\n                actor,\n              });\n              await updateKnowledgeSourceDocumentObservationMetadata(db, {\n                accountId: input.accountId,\n                workspaceId: input.workspaceId,\n                initiatingSubjectId: action.initiatingSubjectId,\n                sourceId: input.sourceId,\n                expectedSourceLifecycleGeneration: resolved.source.lifecycleGeneration,\n                objectId: object.id,\n                expectedObjectLifecycleGeneration: object.lifecycleGeneration,\n                versionId: version.id,\n                documentId: currentVersion.documentId,\n                title: entry.title,\n                sourceUri: entry.sourceUri,\n                sourceVersion: entry.externalVersionId ?? contentSha256,\n                sourceUpdatedAt: entry.modifiedTime,\n                syncObservation,\n              });\n              const obligation = await ensureVersionIndexed({\n                entry,\n                object,\n                version,\n                indexRequired: (currentObservation?.documentChunkCount ?? 0) === 0,\n              });\n              const objectAcl = await recordEntryAcl({ entry, object, version, obligation });\n              summary.unchanged += 1;\n              summary.indexed += 1;\n              if (objectAcl.aclEligibility === \"pending\") summary.aclPending += 1;\n              outcomes.push({\n                externalObjectId: entry.externalObjectId,\n                outcome: \"unchanged\" as const,\n                contentSha256,\n                sizeBytes: bytes.byteLength,\n                providerRevision: entry.externalVersionId,\n                metadataHash,\n                aclEligibility: objectAcl.aclEligibility,\n                aclEvidence: objectAcl.aclEvidence,\n                indexObligationId: obligation.id,\n              });\n              continue;\n            }\n            const fileId = deterministicUuid(\n              `knowledge-blob:${input.accountId}:${input.workspaceId}:${contentSha256}`,\n            );\n            const objectKey = `workspaces/${input.workspaceId}/knowledge/blobs/${contentSha256}`;\n            await objectStorage.putObject({\n              key: objectKey,\n              contentType: entry.transfer.contentType,\n              body: bytes,\n              sha256: contentSha256,\n            });\n            const file = await ensureKnowledgeSourceBlobFile(db, {\n              accountId: input.accountId,\n              workspaceId: input.workspaceId,\n              fileId,\n              filename: entry.transfer.filename,\n              safeFilename: safeFilename(entry.transfer.filename),\n              contentType: entry.transfer.contentType,\n              sizeBytes: bytes.byteLength,\n              sha256: contentSha256,\n              bucket: objectStorage.bucket,\n              objectKey,\n            });\n            const document = await addDocumentToBase(db, {\n              accountId: input.accountId,\n              workspaceId: input.workspaceId,\n              baseId: base.id,\n              fileId: file.id,\n              title: entry.title,\n              sourceKind: \"document\",\n              sourceUri: entry.sourceUri,\n              sourceExternalId: entry.externalObjectId,\n              sourceTitle: entry.title,\n              sourceCreatedAt: entry.createdTime ?? undefined,\n              sourceUpdatedAt: entry.modifiedTime ?? undefined,\n              sourceVersion: entry.externalVersionId ?? contentSha256,\n              knowledgeSourceIdentity: deterministicUuid(\n                `knowledge-source-version:${object.id}:${observationKey}`,\n              ),\n              authorityKind: action.destination.kind,\n              createdBy: action.initiatingSubjectId,\n              initiatingSubjectId: action.initiatingSubjectId,\n              organizationAuthorityGranted: action.destination.kind === \"organization\",\n              agentAccess: false,\n              curationStatus: \"none\",\n              access: { viewerSubjectId: action.initiatingSubjectId },\n            });\n            const version = await appendKnowledgeDocumentVersion(db, {\n              accountId: input.accountId,\n              workspaceId: input.workspaceId,\n              objectId: object.id,\n              expectedSourceLifecycleGeneration: resolved.source.lifecycleGeneration,\n              expectedObjectLifecycleGeneration: object.lifecycleGeneration,\n              expectedVersionGeneration: object.versionGeneration,\n              externalVersionId: entry.externalVersionId ?? contentSha256,\n              contentSha256,\n              ingestionKey: `${entry.externalObjectId}:${observationKey}`,\n              sourceCursor: null,\n              sourceMetadata: {\n                title: entry.title,\n                mimeType: entry.mimeType,\n                driveId: entry.driveId,\n                providerRevision: entry.externalVersionId,\n                metadataHash,\n                aclEligibility: \"pending\",\n                sourceLifecycleGeneration: resolved.source.lifecycleGeneration,\n                objectLifecycleGeneration: object.lifecycleGeneration,\n              },\n              sourceCreatedAt: entry.createdTime,\n              sourceUpdatedAt: entry.modifiedTime,\n              aclVersionId: acl.id,\n              aclGeneration: aclGeneration!,\n              documentId: document.id,\n              fileId: file.id,\n              locationMetadata: { sourceUri: entry.sourceUri },\n              syncObservation,\n              operationId: `document-version:${object.id}:${observationKey}`,\n              reasonCode: \"source_content_observed\",\n              actor,\n            });\n            const obligation = await ensureVersionIndexed({\n              entry,\n              object,\n              version,\n              indexRequired: true,\n            });\n            const objectAcl = await recordEntryAcl({ entry, object, version, obligation });\n            summary.indexed += 1;\n            summary.imported += 1;\n            if (objectAcl.aclEligibility === \"pending\") summary.aclPending += 1;\n            summary.bytes += bytes.byteLength;\n            outcomes.push({\n              externalObjectId: entry.externalObjectId,\n              outcome: \"imported\" as const,\n              contentSha256,\n              sizeBytes: bytes.byteLength,\n              providerRevision: entry.externalVersionId,\n              metadataHash,\n              aclEligibility: objectAcl.aclEligibility,\n              aclEvidence: objectAcl.aclEvidence,\n              indexObligationId: obligation.id,\n            });\n          } catch (error) {\n            if (error instanceof KnowledgeSourceSyncObservationFenceError) {\n              throw new SyncFailure(\"provider_payload_invalid\", false);\n            }\n            const message = boundedError(error);\n            const itemFailure =\n              error instanceof SyncFailure\n                ? error\n                : new SyncFailure(\"item_processing_failed\", false);\n            summary.failed += 1;\n            summary.retryable ||= itemFailure.retryable;\n            if (summary.failures.length < action.limits.maxFailureDetails) {\n              summary.failures.push({\n                externalObjectId: entry.externalObjectId,\n                code: itemFailure.code,\n                retryable: itemFailure.retryable,\n                message,\n              });\n            }\n            outcomes.push({\n              externalObjectId: entry.externalObjectId,\n              outcome: \"failed\" as const,\n              reasonCode: itemFailure.code,\n              detail: message,\n              providerRevision: entry.externalVersionId,\n              metadataHash: entryMetadataHash(entry),\n              aclEligibility: \"pending\" as const,\n            });\n          }\n        }\n        await recordKnowledgeSourceSyncItemOutcomes(db, {\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          scheduledTaskRunId: input.scheduledTaskRunId,\n          knowledgeSyncRunId: knowledgeRun.id,\n          sourceId: input.sourceId,\n          sourceConfigGeneration: action.sourceConfigGeneration,\n          sourceLifecycleGeneration: action.sourceLifecycleGeneration,\n          outcomes,\n        });\n\n        if (inventory.status === \"paused\" && inventory.checkpoint) {\n          if (\n            inventory.stopReason === \"provider_error\" ||\n            inventory.stopReason === \"incomplete_search\"\n          ) {\n            throw new SyncFailure(\n              inventory.stopReason === \"provider_error\"\n                ? \"provider_unavailable\"\n                : \"provider_payload_invalid\",\n              inventory.stopReason === \"provider_error\",\n            );\n          }\n          if (inventory.hardLimitReached) {\n            summary.limitReached = inventoryLimit(inventory.stopReason);\n            throw new SyncFailure(\"resource_limit\", false);\n          }\n          if (inventory.stopReason !== \"elapsed_time_limit\") {\n            summary.limitReached = inventoryLimit(inventory.stopReason);\n            throw new SyncFailure(\"resource_limit\", false);\n          }\n          summary.checkpointed = true;\n          summary.phase = \"checkpoint\";\n          await checkpointKnowledgeSourceSync(db, {\n            accountId: input.accountId,\n            workspaceId: input.workspaceId,\n            sourceId: input.sourceId,\n            scheduledTaskRunId: input.scheduledTaskRunId,\n            sourceConfigGeneration: action.sourceConfigGeneration,\n            sourceLifecycleGeneration: action.sourceLifecycleGeneration,\n            executionCheckpoint: executionCheckpoint as Record<string, unknown>,\n            observationFence: {\n              initiatingSubjectId: action.initiatingSubjectId,\n              scanGeneration: liveState.activeScanGeneration,\n              executionCheckpointGeneration: lease.state.executionCheckpointGeneration,\n              observations: observationFloors,\n            },\n          });\n          return { action: \"continue\", summary };\n        }\n\n        const tombstonedExternalObjectIds = inventory.authoritativeFullScan\n          ? await reconcileKnowledgeSourceSyncCompleteScan(db, {\n              accountId: input.accountId,\n              workspaceId: input.workspaceId,\n              sourceId: input.sourceId,\n              scheduledTaskRunId: input.scheduledTaskRunId,\n              initiatingSubjectId: action.initiatingSubjectId,\n              sourceSyncGeneration: knowledgeRun.inputSyncGeneration,\n              sourceConfigGeneration: action.sourceConfigGeneration,\n              sourceLifecycleGeneration: action.sourceLifecycleGeneration,\n              scanGeneration: liveState.activeScanGeneration,\n            })\n          : [];\n        if (tombstonedExternalObjectIds.length > 0) {\n          summary.skipped += tombstonedExternalObjectIds.length;\n          await recordKnowledgeSourceSyncItemOutcomes(db, {\n            accountId: input.accountId,\n            workspaceId: input.workspaceId,\n            scheduledTaskRunId: input.scheduledTaskRunId,\n            knowledgeSyncRunId: knowledgeRun.id,\n            sourceId: input.sourceId,\n            sourceConfigGeneration: action.sourceConfigGeneration,\n            sourceLifecycleGeneration: action.sourceLifecycleGeneration,\n            outcomes: tombstonedExternalObjectIds.map((externalObjectId) => ({\n              externalObjectId,\n              outcome: \"tombstoned\" as const,\n              reasonCode: \"authoritative_scan_absent\",\n              aclEligibility: \"denied\" as const,\n            })),\n          });\n        }\n\n        await completeKnowledgeSyncRun(db, {\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          initiatingSubjectId: action.initiatingSubjectId,\n          runId: knowledgeRun.id,\n          state: \"succeeded\",\n          outputCursor: null,\n          watermark: new Date().toISOString(),\n          metadata: { ...summary, providerCursor: inventory.providerCursor },\n          reasonCode: \"scheduled_source_sync\",\n        });\n        summary.phase = \"completed\";\n        summary.elapsedMs = Date.now() - startedAt;\n        const settled = await settleKnowledgeSourceSyncLease(db, {\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          sourceId: input.sourceId,\n          scheduledTaskRunId: input.scheduledTaskRunId,\n          knowledgeSyncRunId: knowledgeRun.id,\n          status: \"succeeded\",\n          summary,\n          sourceConfigGeneration: action.sourceConfigGeneration,\n          sourceLifecycleGeneration: action.sourceLifecycleGeneration,\n          sourceSyncGeneration: knowledgeRun.inputSyncGeneration,\n          completedSourceSyncGeneration: knowledgeRun.inputSyncGeneration + 1,\n          providerCursor: inventory.providerCursor,\n          observationFence: {\n            initiatingSubjectId: action.initiatingSubjectId,\n            scanGeneration: liveState.activeScanGeneration,\n            executionCheckpointGeneration: lease.state.executionCheckpointGeneration,\n            observations: observationFloors,\n          },\n        });\n        await recordConnectorUsage(\"completed\", summary.scanned, \"item\");\n        await recordConnectorUsage(\"items\", summary.imported, \"item\");\n        await recordConnectorUsage(\"bytes\", summary.bytes, \"byte\");\n        observability.incrementCounter({\n          name: \"opengeni_knowledge_source_sync_runs_total\",\n          labels: { provider: providerLabel, outcome: \"succeeded\" },\n        });\n        observability.incrementCounter({\n          name: \"opengeni_knowledge_source_sync_items_total\",\n          labels: { provider: providerLabel, outcome: \"imported\" },\n          amount: summary.imported,\n        });\n        for (const outcome of [\"unchanged\", \"skipped\", \"failed\"] as const) {\n          observability.incrementCounter({\n            name: \"opengeni_knowledge_source_sync_items_total\",\n            labels: { provider: providerLabel, outcome },\n            amount: summary[outcome],\n          });\n        }\n        observability.incrementCounter({\n          name: \"opengeni_knowledge_source_sync_bytes_total\",\n          labels: { provider: providerLabel },\n          amount: summary.bytes,\n        });\n        recordSyncHealthTelemetry(observability, providerLabel, summary, \"succeeded\");\n        return {\n          action: \"complete\",\n          summary,\n          bufferedWake: settled.bufferedWake,\n          bufferedScheduledTaskRunId: settled.bufferedScheduledTaskRunId,\n        };\n      } catch (error) {\n        const failure =\n          error instanceof SyncFailure ? error : new SyncFailure(\"internal_failure\", false);\n        summary.phase = \"failed\";\n        summary.retryable ||= failure.retryable;\n        summary.elapsedMs = Date.now() - startedAt;\n        summary.reconnectRequired = failure.reconnectRequired;\n        summary.failed = Math.max(summary.failed, 1);\n        if (summary.failures.length === 0) {\n          summary.failures.push({\n            externalObjectId: input.sourceId,\n            code: failure.code,\n            retryable: failure.retryable,\n            message: boundedError(error),\n          });\n        }\n        if (knowledgeRunId) {\n          await completeKnowledgeSyncRun(db, {\n            accountId: input.accountId,\n            workspaceId: input.workspaceId,\n            initiatingSubjectId: action.initiatingSubjectId,\n            runId: knowledgeRunId,\n            state: \"failed\",\n            metadata: summary,\n            errorCode: failure.code,\n            reasonCode: \"scheduled_source_sync_failed\",\n          }).catch(() => undefined);\n        }\n        const settlementInput: Parameters<typeof settleKnowledgeSourceSyncLease>[1] = {\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          sourceId: input.sourceId,\n          scheduledTaskRunId: input.scheduledTaskRunId,\n          knowledgeSyncRunId: knowledgeRunId,\n          status: \"failed\",\n          summary,\n          error: failure.code,\n          sourceConfigGeneration: action.sourceConfigGeneration,\n          sourceLifecycleGeneration: action.sourceLifecycleGeneration,\n          sourceSyncGeneration: activeSourceSyncGeneration ?? lease.state.sourceSyncGeneration,\n          // Failed or incomplete provider walks are not authoritative scans.\n          // A later scheduled run must restart from the root under a fresh\n          // observation generation before it can infer object absence.\n          executionCheckpoint: null,\n        };\n        const settled = failure.reconnectRequired\n          ? await deauthorizeAndSettleKnowledgeSourceSyncFailure(db, {\n              deauthorization: {\n                accountId: input.accountId,\n                workspaceId: input.workspaceId,\n                sourceId: input.sourceId,\n                audience: action.destination,\n                operationId: `knowledge-sync-deauthorize:${input.sourceId}:${action.connection.connectionVersion}:${failure.code}`,\n                reasonCode: \"connection_reconnect_required\",\n                actor: {\n                  kind: \"service\",\n                  subjectId: \"knowledge-source-sync\",\n                  initiatingHumanSubjectId: action.initiatingSubjectId,\n                },\n              },\n              settlement: settlementInput,\n            })\n          : await settleKnowledgeSourceSyncLease(db, settlementInput);\n        await recordConnectorUsage(\"completed\", summary.scanned, \"item\");\n        await recordConnectorUsage(\"items\", summary.imported, \"item\");\n        await recordConnectorUsage(\"bytes\", summary.bytes, \"byte\");\n        observability.incrementCounter({\n          name: \"opengeni_knowledge_source_sync_runs_total\",\n          labels: { provider: providerLabel, outcome: \"failed\" },\n        });\n        for (const outcome of [\"imported\", \"unchanged\", \"skipped\", \"failed\"] as const) {\n          observability.incrementCounter({\n            name: \"opengeni_knowledge_source_sync_items_total\",\n            labels: { provider: providerLabel, outcome },\n            amount: summary[outcome],\n          });\n        }\n        observability.incrementCounter({\n          name: \"opengeni_knowledge_source_sync_bytes_total\",\n          labels: { provider: providerLabel },\n          amount: summary.bytes,\n        });\n        recordSyncHealthTelemetry(observability, providerLabel, summary, \"failed\", failure);\n        return {\n          action: \"failed\",\n          summary,\n          errorCode: failure.code,\n          bufferedWake: settled.bufferedWake,\n          bufferedScheduledTaskRunId: settled.bufferedScheduledTaskRunId,\n        };\n      }\n\n      async function failWithoutProvider(code: string): Promise<RunKnowledgeSourceSyncBatchResult> {\n        const terminalSummary = {\n          phase: \"failed\" as const,\n          scanned: 0,\n          imported: 0,\n          unchanged: 0,\n          skipped: 0,\n          failed: 1,\n          bytes: 0,\n          providerRequests: 0,\n          elapsedMs: 0,\n          indexed: 0,\n          aclPending: 0,\n          retryable: false,\n          limitReached: null,\n          checkpointed: false,\n          reconnectRequired: false,\n          failures: [\n            {\n              externalObjectId: input.sourceId,\n              code: \"authority_changed\" as const,\n              retryable: false,\n              message: code,\n            },\n          ],\n        };\n        await updateScheduledTaskRun(db, input.workspaceId, input.scheduledTaskRunId, {\n          knowledgeSummary: terminalSummary,\n        }).catch(() => undefined);\n        await completeKnowledgeSourceSyncWakeWithoutLease(db, {\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          sourceId: input.sourceId,\n          scheduledTaskRunId: input.scheduledTaskRunId,\n        }).catch(() => undefined);\n        await recordConnectorUsage(\"completed\", 0, \"item\").catch(() => undefined);\n        observability.incrementCounter({\n          name: \"opengeni_knowledge_source_sync_runs_total\",\n          labels: { provider: \"unknown\", outcome: \"failed_preflight\" },\n        });\n        return { action: \"failed\", bufferedWake: false, summary: terminalSummary, errorCode: code };\n      }\n\n      async function recordConnectorUsage(\n        kind: \"completed\" | \"items\" | \"bytes\",\n        quantity: number,\n        unit: string,\n      ) {\n        if (quantity === 0 && kind !== \"completed\") return;\n        await recordUsageEvent(db, {\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          eventType: `knowledge_source_sync.${kind}`,\n          quantity: kind === \"completed\" ? 1 : quantity,\n          unit,\n          sourceResourceType: \"scheduled_task_run\",\n          sourceResourceId: input.scheduledTaskRunId,\n          initiator: { kind: \"service\", subjectId: \"knowledge-source-sync\" },\n          initiatorContext: {\n            scheduledTaskId: input.taskId,\n            scheduledTaskRunId: input.scheduledTaskRunId,\n          },\n          origin: \"scheduled_task\",\n          idempotencyKey: `usage:knowledge_source_sync.${kind}:${input.scheduledTaskRunId}`,\n        });\n      }\n    },\n  };\n}\n\n/**\n * Permission loss must fail closed, while the exact source lease must never be\n * stranded by a deauthorization error. If deauthorization fails, release the\n * lease without settling the wake/run and surface the error so Temporal retries\n * this DB-only safety obligation. Terminal settlement is allowed only after\n * deauthorization succeeds.\n */\nexport async function deauthorizeAndSettleKnowledgeSourceSyncFailure(\n  db: Database,\n  input: {\n    deauthorization: Parameters<typeof deauthorizeKnowledgeSourceRetrieval>[1];\n    settlement: Parameters<typeof settleKnowledgeSourceSyncLease>[1];\n  },\n): Promise<Awaited<ReturnType<typeof settleKnowledgeSourceSyncLease>>> {\n  try {\n    await deauthorizeKnowledgeSourceRetrieval(db, input.deauthorization);\n  } catch (error) {\n    await releaseKnowledgeSourceSyncLeaseForRetry(db, {\n      accountId: input.settlement.accountId,\n      workspaceId: input.settlement.workspaceId,\n      sourceId: input.settlement.sourceId,\n      scheduledTaskRunId: input.settlement.scheduledTaskRunId,\n    });\n    throw error;\n  }\n  return await settleKnowledgeSourceSyncLease(db, input.settlement);\n}\n\nexport type GoogleDriveSyncProviderPort = {\n  now?: () => number;\n  getStartPageToken: (driveId: string | null) => Promise<string>;\n  listChanges: (\n    pageToken: string,\n    driveId: string | null,\n    pageSize: number,\n  ) => Promise<GoogleDriveChangesPage>;\n  getFile: (fileId: string) => Promise<GoogleDriveInventoryProviderItem | null>;\n  listChildren: (input: {\n    folderId: string;\n    driveId: string | null;\n    pageToken: string | null;\n    pageSize: number;\n  }) => Promise<GoogleDriveInventoryPage>;\n  listPermissions?: (input: {\n    fileId: string;\n    pageToken: string | null;\n    pageSize: number;\n  }) => Promise<GoogleDrivePermissionsPage>;\n};\n\nasync function resolveKnowledgeSyncProvider(input: {\n  db: Database;\n  settings: Settings;\n  observability: Observability;\n  accountId: string;\n  workspaceId: string;\n  action: Extract<ScheduledTask[\"action\"], { kind: \"knowledge_source_sync\" }>;\n  sourceId: string;\n  externalSourceId: string;\n}): Promise<{\n  kind: \"google_drive\" | \"atlassian\";\n  selectedDestination: NonNullable<\n    GoogleDriveSelectedSource[\"destination\"] | AtlassianSelectedSource[\"destination\"]\n  >;\n  driver: KnowledgeSourceSyncDriver<KnowledgeSyncEntry, KnowledgeSyncStopReason>;\n  aclAuthority: {\n    connectionId: string;\n    connectionVersion: number;\n    sourceGooglePermissionId: string;\n  } | null;\n}> {\n  const { action } = input;\n  const connection = await getConnectionMetadata(\n    input.db,\n    input.workspaceId,\n    action.connection.connectionId,\n    action.initiatingSubjectId,\n  );\n  if (\n    !connection ||\n    connection.accountId !== input.accountId ||\n    connection.subjectId !== action.connection.ownerSubjectId ||\n    connection.providerDomain.toLowerCase() !== action.connection.providerDomain.toLowerCase() ||\n    connection.kind !== action.connection.kind ||\n    connection.version < action.connection.connectionVersion ||\n    connection.status !== \"active\"\n  ) {\n    throw new SyncFailure(\"connection_reconnect_required\", true, true);\n  }\n\n  const googleInitial =\n    connection.providerDomain === GOOGLE_DRIVE_PROVIDER_DOMAIN\n      ? GoogleDriveConnectionMetadata.safeParse(connection.metadata)\n      : null;\n  const atlassianInitial =\n    connection.providerDomain === ATLASSIAN_PROVIDER_DOMAIN\n      ? AtlassianConnectionMetadata.safeParse(connection.metadata)\n      : null;\n  const initialAtlassianMetadata = atlassianInitial?.success ? atlassianInitial.data : null;\n  if (!googleInitial?.success && !initialAtlassianMetadata) {\n    throw new SyncFailure(\"provider_rejected\", false);\n  }\n  if (\n    googleInitial?.success &&\n    !googleDriveScopesAllowCapability(connection.grantedScopes, \"recursive_source_sync\")\n  ) {\n    throw new SyncFailure(\"connection_reconnect_required\", true, true);\n  }\n  if (atlassianInitial?.success && !atlassianScopesAllowRead(connection.grantedScopes)) {\n    throw new SyncFailure(\"connection_reconnect_required\", true, true);\n  }\n  const initialLifecycle = googleInitial?.success\n    ? googleInitial.data.lifecycle\n    : initialAtlassianMetadata!.lifecycle;\n  if (initialLifecycle?.state && initialLifecycle.state !== \"active\") {\n    throw new SyncFailure(\"connection_reconnect_required\", true, true);\n  }\n  const initialSource = googleInitial?.success\n    ? selectedDriveSource(googleInitial.data, input.externalSourceId)\n    : selectedAtlassianSource(initialAtlassianMetadata!, input.externalSourceId);\n  if (\n    !initialSource ||\n    !initialSource.syncEnabled ||\n    initialSource.configGeneration !== action.sourceConfigGeneration ||\n    !initialSource.destination ||\n    scopedKnowledgeScopeKey(\n      googleInitial?.success\n        ? googleDriveKnowledgeScope(initialSource.destination)\n        : atlassianKnowledgeScope(initialSource.destination),\n    ) !== scopedKnowledgeScopeKey(action.destination)\n  ) {\n    throw new SyncFailure(\"authority_changed\", false);\n  }\n\n  const token = await buildConnectionTokenResolver(\n    input.db,\n    input.settings,\n  )({\n    workspaceId: input.workspaceId,\n    subjectId: action.initiatingSubjectId,\n    serverId: \"knowledge-source-sync\",\n    connectionRef: {\n      connectionId: connection.id,\n      providerDomain: connection.providerDomain,\n      kind: connection.kind,\n      subjectScope: \"subject\",\n    },\n    destinationUrl:\n      connection.providerDomain === ATLASSIAN_PROVIDER_DOMAIN\n        ? ATLASSIAN_API_BASE\n        : \"https://www.googleapis.com\",\n  });\n  if (token.status !== \"ok\") {\n    throw new SyncFailure(\"connection_reconnect_required\", true, true);\n  }\n  const resolvedConnection = await getConnectionMetadata(\n    input.db,\n    input.workspaceId,\n    action.connection.connectionId,\n    action.initiatingSubjectId,\n  );\n  if (\n    !resolvedConnection ||\n    resolvedConnection.accountId !== input.accountId ||\n    resolvedConnection.subjectId !== action.connection.ownerSubjectId ||\n    resolvedConnection.providerDomain.toLowerCase() !==\n      action.connection.providerDomain.toLowerCase() ||\n    resolvedConnection.kind !== action.connection.kind ||\n    resolvedConnection.version !== token.connectionVersion ||\n    resolvedConnection.status !== \"active\"\n  ) {\n    throw new SyncFailure(\"connection_reconnect_required\", true, true);\n  }\n  const authorization = token.headers.Authorization ?? token.headers.authorization;\n  if (resolvedConnection.providerDomain === GOOGLE_DRIVE_PROVIDER_DOMAIN) {\n    const metadata = GoogleDriveConnectionMetadata.parse(resolvedConnection.metadata);\n    if (\n      !googleDriveSyncProviderAccessAllowed({\n        connectionVersion: resolvedConnection.version,\n        resolvedConnectionVersion: token.connectionVersion,\n        connectionStatus: resolvedConnection.status,\n        lifecycleState: metadata.lifecycle?.state,\n        grantedScopes: resolvedConnection.grantedScopes,\n      })\n    ) {\n      throw new SyncFailure(\"connection_reconnect_required\", true, true);\n    }\n    const source = selectedDriveSource(metadata, input.externalSourceId);\n    if (!validSelectedSource(source, action, googleDriveKnowledgeScope)) {\n      throw new SyncFailure(\"authority_changed\", false);\n    }\n    return {\n      kind: \"google_drive\",\n      selectedDestination: source.destination!,\n      aclAuthority: {\n        connectionId: resolvedConnection.id,\n        connectionVersion: resolvedConnection.version,\n        sourceGooglePermissionId: metadata.googlePermissionId,\n      },\n      driver: googleDriveSyncDriver({\n        actionProviderCoordinationKey: action.providerCoordinationKey,\n        metadata,\n        selectedSource: source,\n        accountId: input.accountId,\n        workspaceId: input.workspaceId,\n        initiatingSubjectId: action.initiatingSubjectId,\n        authorization,\n        retry: googleDriveProviderRetryOptions(input.settings),\n        observability: input.observability,\n        limits: action.limits,\n        connectionId: resolvedConnection.id,\n        fullReconciliationIntervalMs: GOOGLE_DRIVE_FULL_RECONCILIATION_INTERVAL_MS,\n        observedExternalObjectIds: async (externalObjectIds) =>\n          await listObservedKnowledgeSourceSyncExternalObjectIds(input.db, {\n            accountId: input.accountId,\n            workspaceId: input.workspaceId,\n            sourceId: input.sourceId,\n            externalObjectIds,\n          }),\n      }) as unknown as KnowledgeSourceSyncDriver<KnowledgeSyncEntry, KnowledgeSyncStopReason>,\n    };\n  }\n  if (resolvedConnection.providerDomain === ATLASSIAN_PROVIDER_DOMAIN) {\n    const metadata = AtlassianConnectionMetadata.parse(resolvedConnection.metadata);\n    if (\n      metadata.lifecycle?.state !== \"active\" ||\n      !atlassianScopesAllowRead(resolvedConnection.grantedScopes)\n    ) {\n      throw new SyncFailure(\"connection_reconnect_required\", true, true);\n    }\n    const source = selectedAtlassianSource(metadata, input.externalSourceId);\n    if (!validSelectedSource(source, action, atlassianKnowledgeScope)) {\n      throw new SyncFailure(\"authority_changed\", false);\n    }\n    return {\n      kind: \"atlassian\",\n      selectedDestination: source.destination!,\n      aclAuthority: null,\n      driver: atlassianSyncDriver({\n        actionProviderCoordinationKey: action.providerCoordinationKey,\n        metadata,\n        selectedSource: source,\n        authorization,\n        limits: action.limits,\n      }) as unknown as KnowledgeSourceSyncDriver<KnowledgeSyncEntry, KnowledgeSyncStopReason>,\n    };\n  }\n  throw new SyncFailure(\"provider_rejected\", false);\n}\n\nfunction validSelectedSource<Source extends GoogleDriveSelectedSource | AtlassianSelectedSource>(\n  source: Source | null,\n  action: Extract<ScheduledTask[\"action\"], { kind: \"knowledge_source_sync\" }>,\n  scope: (destination: NonNullable<Source[\"destination\"]>) => ScopedKnowledgeScope,\n): source is Source & { destination: NonNullable<Source[\"destination\"]> } {\n  return Boolean(\n    source &&\n    source.syncEnabled &&\n    source.configGeneration === action.sourceConfigGeneration &&\n    source.destination &&\n    scopedKnowledgeScopeKey(scope(source.destination)) ===\n      scopedKnowledgeScopeKey(action.destination),\n  );\n}\n\nfunction selectedAtlassianSource(\n  metadata: ReturnType<typeof AtlassianConnectionMetadata.parse>,\n  externalSourceId: string,\n): AtlassianSelectedSource | null {\n  return metadata.selectedSources.find((source) => source.id === externalSourceId) ?? null;\n}\n\nfunction atlassianSyncDriver(input: {\n  actionProviderCoordinationKey: string;\n  metadata: ReturnType<typeof AtlassianConnectionMetadata.parse>;\n  selectedSource: AtlassianSelectedSource;\n  authorization: string | undefined;\n  limits: {\n    maxItems: number;\n    maxBytes: number;\n    maxFileBytes: number;\n    maxProviderRequests: number;\n    maxElapsedSeconds: number;\n  };\n}): KnowledgeSourceSyncDriver<AtlassianInventoryEntry, AtlassianInventoryStopReason> {\n  return {\n    providerKey: \"atlassian\",\n    providerDomain: ATLASSIAN_PROVIDER_DOMAIN,\n    providerCoordinationKey: input.actionProviderCoordinationKey,\n    inventory: async (checkpoint) => {\n      const inventory = await inventoryAtlassianSource({\n        cloudId: input.selectedSource.cloudId,\n        source: input.selectedSource,\n        limits: {\n          maxItems: input.limits.maxItems,\n          maxApiRequests: input.limits.maxProviderRequests,\n          maxElapsedMs: input.limits.maxElapsedSeconds * 1_000,\n          pageSize: Math.min(input.limits.maxItems, 100),\n        },\n        checkpoint,\n        listPage: async (cursor, pageSize) =>\n          await listAtlassianItems(input.selectedSource, cursor, pageSize, input.authorization),\n      });\n      return {\n        ...inventory,\n        providerCursor: null,\n        authoritativeFullScan: inventory.status === \"complete\",\n        cursorInvalidated: false,\n        hardLimitReached:\n          inventory.status === \"paused\" &&\n          inventory.stopReason !== \"elapsed_time_limit\" &&\n          inventory.stopReason !== \"provider_error\",\n      };\n    },\n    fetchContent: async (entry, maxBytes) =>\n      await fetchAtlassianContent(input.selectedSource, entry, input.authorization, maxBytes),\n    citationLocator: (entry) => ({\n      version: 1,\n      providerKey: \"atlassian\",\n      providerCoordinationKey: input.actionProviderCoordinationKey,\n      cloudId: input.selectedSource.cloudId,\n      sourceKind: input.selectedSource.kind,\n      externalObjectId: entry.externalObjectId,\n      sourceUri: entry.sourceUri,\n    }),\n  };\n}\n\nexport function googleDriveSyncDriver(input: {\n  actionProviderCoordinationKey: string;\n  metadata: ReturnType<typeof GoogleDriveConnectionMetadata.parse>;\n  selectedSource: GoogleDriveSelectedSource;\n  connectionId: string;\n  accountId: string;\n  workspaceId: string;\n  initiatingSubjectId: string;\n  authorization: string | undefined;\n  retry: GoogleDriveProviderRetryOptions;\n  observability: Observability;\n  fullReconciliationIntervalMs: number;\n  observedExternalObjectIds: (ids: string[]) => Promise<Set<string>>;\n  provider?: GoogleDriveSyncProviderPort;\n  limits: {\n    maxItems: number;\n    maxBytes: number;\n    maxFileBytes: number;\n    maxProviderRequests: number;\n    maxElapsedSeconds: number;\n  };\n}): KnowledgeSourceSyncDriver<GoogleDriveInventoryEntry, GoogleDriveInventoryStopReason> {\n  const maxElapsedMs = input.limits.maxElapsedSeconds * 1_000;\n  const provider: GoogleDriveSyncProviderPort = input.provider ?? {\n    getStartPageToken: async (driveId) =>\n      await getDriveStartPageToken(driveId, input.authorization, input.retry, input.observability),\n    listChanges: async (pageToken, driveId, pageSize) =>\n      await listDriveChanges(\n        pageToken,\n        driveId,\n        pageSize,\n        input.authorization,\n        input.retry,\n        input.observability,\n      ),\n    getFile: async (fileId) =>\n      await getDriveFile(fileId, input.authorization, input.retry, input.observability),\n    listChildren: async (request) =>\n      await listDriveChildren(request, input.authorization, input.retry, input.observability),\n    listPermissions: async (request) =>\n      await listDrivePermissions(request, input.authorization, input.retry, input.observability),\n  };\n  const clock = provider.now ?? Date.now;\n  const budgetLimits = {\n    maxItems: input.limits.maxItems,\n    maxProviderRequests: input.limits.maxProviderRequests,\n    maxElapsedMs,\n  };\n  return {\n    providerKey: \"google_drive\",\n    providerDomain: GOOGLE_DRIVE_PROVIDER_DOMAIN,\n    providerCoordinationKey: input.actionProviderCoordinationKey,\n    inventory: async (executionCheckpoint, providerCursor) => {\n      const expectedCursor = {\n        connectionId: input.connectionId,\n        googlePermissionId: input.metadata.googlePermissionId,\n        sourceId: input.selectedSource.id,\n        driveId: input.selectedSource.driveId,\n      };\n      const legacyFullCheckpoint = isLegacyGoogleDriveFullReconciliationCheckpoint(\n        executionCheckpoint,\n        expectedCursor,\n      );\n      const cursor = parseGoogleDriveChangesCursor(providerCursor, expectedCursor);\n      const checkpoint = parseGoogleDriveExecutionCheckpoint(\n        executionCheckpoint,\n        expectedCursor,\n        budgetLimits,\n      );\n      const now = new Date(clock());\n\n      const runFullReconciliation = async (full: {\n        boundaryId: string;\n        startPageToken: string;\n        cursorInvalidated: boolean;\n        budgetBeforeInventory: GoogleDriveSyncBudget;\n        inventoryElapsedMs: number;\n        inventoryCheckpoint: GoogleDriveInventoryCheckpoint | null;\n        revisionFloors: GoogleDriveRevisionFloor[];\n      }) => {\n        const inventoryItems = full.inventoryCheckpoint?.totals.itemCount ?? 0;\n        const inventoryProviderRequests = full.inventoryCheckpoint?.totals.apiRequestCount ?? 0;\n        const budgetBeforeInvocation = {\n          examinedItems: full.budgetBeforeInventory.examinedItems + inventoryItems,\n          providerRequests: full.budgetBeforeInventory.providerRequests + inventoryProviderRequests,\n          elapsedMs: full.budgetBeforeInventory.elapsedMs + full.inventoryElapsedMs,\n        } satisfies GoogleDriveSyncBudget;\n        const hardStopReason = googleDriveHardLimitReason(budgetBeforeInvocation, budgetLimits);\n        const fullCheckpoint = buildGoogleDriveFullReconciliationCheckpoint({\n          ...expectedCursor,\n          ...full,\n        });\n        if (hardStopReason) {\n          return {\n            status: \"paused\" as const,\n            stopReason: hardStopReason,\n            entries: [],\n            checkpoint: fullCheckpoint,\n            providerCursor,\n            authoritativeFullScan: false,\n            cursorInvalidated: full.cursorInvalidated,\n            providerRequests: budgetBeforeInvocation.providerRequests,\n            elapsedMs: budgetBeforeInvocation.elapsedMs,\n            hardLimitReached: true,\n          };\n        }\n\n        const phaseMaxItems = input.limits.maxItems - full.budgetBeforeInventory.examinedItems;\n        const phaseMaxProviderRequests =\n          input.limits.maxProviderRequests - full.budgetBeforeInventory.providerRequests;\n        const remainingElapsedMs = maxElapsedMs - budgetBeforeInvocation.elapsedMs;\n        const inventory = await inventoryGoogleDriveSource({\n          googlePermissionId: input.metadata.googlePermissionId,\n          googleEmail: input.metadata.googleEmail,\n          source: input.selectedSource,\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          connectionSubjectId: input.initiatingSubjectId,\n          limits: {\n            maxItems: phaseMaxItems,\n            maxKnownBytes: input.limits.maxBytes,\n            maxApiRequests: phaseMaxProviderRequests,\n            maxElapsedMs: Math.min(GOOGLE_DRIVE_SYNC_INVOCATION_SLICE_MS, remainingElapsedMs),\n            maxFileBytes: input.limits.maxFileBytes,\n            maxFolders: Math.min(phaseMaxItems * 2, 2_000),\n            pageSize: Math.min(phaseMaxItems, 100),\n          },\n          checkpoint: full.inventoryCheckpoint,\n          listChildren: provider.listChildren,\n          now: clock,\n        });\n        const inventoryElapsedMs = full.inventoryElapsedMs + inventory.run.elapsedMs;\n        const budget = {\n          examinedItems: full.budgetBeforeInventory.examinedItems + inventory.totals.itemCount,\n          providerRequests:\n            full.budgetBeforeInventory.providerRequests + inventory.totals.apiRequestCount,\n          elapsedMs: full.budgetBeforeInventory.elapsedMs + inventoryElapsedMs,\n        } satisfies GoogleDriveSyncBudget;\n        const reconciled = reconcileGoogleDriveRevisionFloors(\n          inventory.entries,\n          full.revisionFloors,\n          input.limits.maxItems,\n        );\n        if (reconciled.conflict) {\n          return {\n            status: \"paused\" as const,\n            stopReason: \"incomplete_search\" as const,\n            entries: [],\n            checkpoint: fullCheckpoint,\n            providerCursor,\n            authoritativeFullScan: false,\n            cursorInvalidated: full.cursorInvalidated,\n            providerRequests: budget.providerRequests,\n            elapsedMs: budget.elapsedMs,\n            hardLimitReached: false,\n          };\n        }\n        const nextCursor =\n          inventory.status === \"complete\"\n            ? buildGoogleDriveChangesCursor({\n                ...expectedCursor,\n                boundaryId: full.boundaryId,\n                pageToken: full.startPageToken,\n                previousGeneration: cursor?.cursorGeneration ?? 0,\n                reconciledAt: now,\n                fullReconciliationIntervalMs: input.fullReconciliationIntervalMs,\n              })\n            : providerCursor;\n        return {\n          status: inventory.status,\n          stopReason: inventory.stopReason,\n          entries: reconciled.entries,\n          checkpoint:\n            inventory.status === \"paused\" && inventory.checkpoint\n              ? buildGoogleDriveFullReconciliationCheckpoint({\n                  ...expectedCursor,\n                  boundaryId: full.boundaryId,\n                  startPageToken: full.startPageToken,\n                  cursorInvalidated: full.cursorInvalidated,\n                  budgetBeforeInventory: full.budgetBeforeInventory,\n                  inventoryElapsedMs,\n                  inventoryCheckpoint: inventory.checkpoint,\n                  revisionFloors: reconciled.revisionFloors,\n                })\n              : null,\n          providerCursor: nextCursor,\n          authoritativeFullScan: inventory.status === \"complete\",\n          cursorInvalidated: full.cursorInvalidated,\n          providerRequests: budget.providerRequests,\n          elapsedMs: budget.elapsedMs,\n          hardLimitReached:\n            inventory.status === \"paused\" &&\n            googleDriveInventoryStopIsHard(inventory.stopReason, budget, budgetLimits),\n        };\n      };\n\n      const acquireFullReconciliation = async (details: {\n        budget: GoogleDriveSyncBudget;\n        boundaryId: string | null;\n        cursorInvalidated: boolean;\n      }) => {\n        const acquisitionStartedAt = clock();\n        const initialElapsedMs = details.budget.elapsedMs;\n        const budget = { ...details.budget };\n        const refreshElapsed = () => {\n          budget.elapsedMs = initialElapsedMs + Math.max(0, clock() - acquisitionStartedAt);\n        };\n        const requireProviderCapacity = () => {\n          refreshElapsed();\n          if (googleDriveHardLimitReason(budget, budgetLimits)) {\n            throw new SyncFailure(\"resource_limit\", false);\n          }\n          budget.providerRequests += 1;\n        };\n\n        requireProviderCapacity();\n        const startPageToken = await provider.getStartPageToken(input.selectedSource.driveId);\n        refreshElapsed();\n\n        let boundaryId = details.boundaryId;\n        if (!boundaryId) {\n          if (input.selectedSource.id === \"root\" && input.selectedSource.driveId === null) {\n            requireProviderCapacity();\n            try {\n              boundaryId = await resolveGoogleDriveChangesBoundaryId({\n                source: input.selectedSource,\n                getFile: provider.getFile,\n              });\n            } catch (error) {\n              if (error instanceof GoogleDriveChangesProtocolError) {\n                throw new SyncFailure(\"provider_payload_invalid\", false);\n              }\n              throw error;\n            }\n            refreshElapsed();\n          } else {\n            boundaryId = input.selectedSource.id;\n          }\n        }\n\n        return {\n          boundaryId,\n          startPageToken,\n          cursorInvalidated: details.cursorInvalidated,\n          budgetBeforeInventory: budget,\n          inventoryElapsedMs: 0,\n          inventoryCheckpoint: null,\n          revisionFloors: [],\n        };\n      };\n\n      if (checkpoint?.kind === \"google_drive_full_reconciliation\") {\n        return await runFullReconciliation(checkpoint);\n      }\n      if (!cursor) {\n        const budget =\n          checkpoint?.kind === \"google_drive_changes\"\n            ? checkpoint.changesCheckpoint.budget\n            : emptyGoogleDriveSyncBudget();\n        return await runFullReconciliation(\n          await acquireFullReconciliation({\n            budget,\n            boundaryId: null,\n            cursorInvalidated: providerCursor !== null,\n          }),\n        );\n      }\n      if (!checkpoint && !legacyFullCheckpoint && googleDriveFullReconciliationDue(cursor, now)) {\n        return await runFullReconciliation(\n          await acquireFullReconciliation({\n            budget: emptyGoogleDriveSyncBudget(),\n            boundaryId: cursor.boundaryId,\n            cursorInvalidated: false,\n          }),\n        );\n      }\n\n      try {\n        const forceFullReconciliation =\n          legacyFullCheckpoint || googleDriveFullReconciliationDue(cursor, now);\n        const changesCheckpoint =\n          checkpoint?.kind === \"google_drive_changes\"\n            ? {\n                ...checkpoint.changesCheckpoint,\n                requiresFullReconciliation:\n                  checkpoint.changesCheckpoint.requiresFullReconciliation ||\n                  forceFullReconciliation,\n              }\n            : null;\n        const changes = await drainGoogleDriveChanges({\n          source: input.selectedSource,\n          cursor,\n          checkpoint: changesCheckpoint,\n          maxItems: input.limits.maxItems,\n          maxProviderRequests: input.limits.maxProviderRequests,\n          maxElapsedMs,\n          maxInvocationElapsedMs: Math.min(GOOGLE_DRIVE_SYNC_INVOCATION_SLICE_MS, maxElapsedMs),\n          maxFileBytes: input.limits.maxFileBytes,\n          listChanges: async (pageToken, pageSize) =>\n            await provider.listChanges(pageToken, input.selectedSource.driveId, pageSize),\n          getFile: provider.getFile,\n          observedExternalObjectIds: input.observedExternalObjectIds,\n          now: clock,\n        });\n        if (changes.status === \"paused\" && changes.checkpoint) {\n          return {\n            status: \"paused\" as const,\n            stopReason: changes.stopReason,\n            entries: changes.entries,\n            checkpoint: {\n              version: 2,\n              kind: \"google_drive_changes\",\n              ...expectedCursor,\n              changesCheckpoint: {\n                ...changes.checkpoint,\n                requiresFullReconciliation:\n                  changes.checkpoint.requiresFullReconciliation || forceFullReconciliation,\n              },\n            } satisfies GoogleDriveExecutionCheckpoint,\n            providerCursor,\n            authoritativeFullScan: false,\n            cursorInvalidated: false,\n            providerRequests: changes.providerRequests,\n            elapsedMs: changes.elapsedMs,\n            hardLimitReached: changes.hardLimitReached,\n          };\n        }\n        if (!changes.newStartPageToken) throw new Error(\"google_drive_changes_cursor_missing\");\n        if (changes.requiresFullReconciliation || forceFullReconciliation) {\n          const hardStopReason = googleDriveHardLimitReason(changes.budget, budgetLimits);\n          return {\n            status: \"paused\" as const,\n            stopReason: hardStopReason ?? (\"elapsed_time_limit\" as const),\n            entries: changes.entries,\n            checkpoint: buildGoogleDriveFullReconciliationCheckpoint({\n              ...expectedCursor,\n              boundaryId: cursor.boundaryId,\n              startPageToken: changes.newStartPageToken,\n              cursorInvalidated: false,\n              budgetBeforeInventory: changes.budget,\n              inventoryElapsedMs: 0,\n              inventoryCheckpoint: null,\n              revisionFloors: revisionFloorsForEntries(changes.entries, input.limits.maxItems),\n            }),\n            providerCursor,\n            authoritativeFullScan: false,\n            cursorInvalidated: false,\n            providerRequests: changes.providerRequests,\n            elapsedMs: changes.elapsedMs,\n            hardLimitReached: hardStopReason !== null,\n          };\n        }\n        return {\n          status: \"complete\" as const,\n          stopReason: null,\n          entries: changes.entries,\n          checkpoint: null,\n          providerCursor: advanceGoogleDriveChangesCursor(cursor, changes.newStartPageToken),\n          authoritativeFullScan: false,\n          cursorInvalidated: false,\n          providerRequests: changes.providerRequests,\n          elapsedMs: changes.elapsedMs,\n          hardLimitReached: false,\n        };\n      } catch (error) {\n        if (error instanceof GoogleDriveChangesProtocolError) {\n          throw new SyncFailure(\"provider_payload_invalid\", false);\n        }\n        if (!(error instanceof GoogleDriveCursorInvalidError)) throw error;\n        const full = await acquireFullReconciliation({\n          budget: error.budget ?? emptyGoogleDriveSyncBudget(),\n          boundaryId: cursor.boundaryId,\n          cursorInvalidated: true,\n        });\n        const hardStopReason = googleDriveHardLimitReason(full.budgetBeforeInventory, budgetLimits);\n        return {\n          status: \"paused\" as const,\n          stopReason: hardStopReason ?? (\"elapsed_time_limit\" as const),\n          entries: [],\n          checkpoint: buildGoogleDriveFullReconciliationCheckpoint({\n            ...expectedCursor,\n            ...full,\n          }),\n          providerCursor,\n          authoritativeFullScan: false,\n          cursorInvalidated: true,\n          providerRequests: full.budgetBeforeInventory.providerRequests,\n          elapsedMs: full.budgetBeforeInventory.elapsedMs,\n          hardLimitReached: hardStopReason !== null,\n        };\n      }\n    },\n    fetchContent: async (entry, maxBytes) =>\n      await fetchDriveBytes(entry, input.authorization, maxBytes, input.retry, input.observability),\n    readAcl: async (entry, maxProviderRequests) => {\n      if (!provider.listPermissions) {\n        throw new SyncFailure(\"provider_rejected\", false);\n      }\n      return await collectGoogleDriveAclEvidence({\n        entry,\n        maxProviderRequests,\n        listPermissions: provider.listPermissions,\n        getFile: provider.getFile,\n        now: clock,\n      });\n    },\n    citationLocator: (entry) => ({\n      version: 2,\n      providerKey: \"google-drive\",\n      providerCoordinationKey: input.actionProviderCoordinationKey,\n      externalObjectId: entry.externalObjectId,\n      providerRevision: entry.externalVersionId,\n      driveId: entry.driveId,\n      sourceUri: entry.sourceUri,\n    }),\n  };\n}\n\ntype GoogleDriveCheckpointIdentity = {\n  connectionId: string;\n  googlePermissionId: string;\n  sourceId: string;\n  driveId: string | null;\n};\n\ntype GoogleDriveRevisionFloor = [externalObjectId: string, providerRevision: string | null];\n\ntype GoogleDriveFullReconciliationCheckpoint = GoogleDriveCheckpointIdentity & {\n  version: 3;\n  kind: \"google_drive_full_reconciliation\";\n  boundaryId: string;\n  startPageToken: string;\n  cursorInvalidated: boolean;\n  budgetBeforeInventory: GoogleDriveSyncBudget;\n  inventoryElapsedMs: number;\n  inventoryCheckpoint: GoogleDriveInventoryCheckpoint | null;\n  revisionFloors: GoogleDriveRevisionFloor[];\n};\n\ntype GoogleDriveExecutionCheckpoint = GoogleDriveCheckpointIdentity &\n  (\n    | {\n        version: 2;\n        kind: \"google_drive_changes\";\n        changesCheckpoint: GoogleDriveChangesCheckpoint;\n      }\n    | GoogleDriveFullReconciliationCheckpoint\n  );\n\nfunction isLegacyGoogleDriveFullReconciliationCheckpoint(\n  value: Record<string, unknown> | null,\n  expected: GoogleDriveCheckpointIdentity,\n): boolean {\n  return (\n    value?.version === 2 &&\n    value.kind === \"google_drive_full_reconciliation\" &&\n    value.connectionId === expected.connectionId &&\n    value.googlePermissionId === expected.googlePermissionId &&\n    value.sourceId === expected.sourceId &&\n    value.driveId === expected.driveId &&\n    encodedJsonBytes(value) <= GOOGLE_DRIVE_EXECUTION_CHECKPOINT_MAX_BYTES\n  );\n}\n\nfunction parseGoogleDriveExecutionCheckpoint(\n  value: Record<string, unknown> | null,\n  expected: GoogleDriveCheckpointIdentity,\n  limits: { maxItems: number; maxProviderRequests: number; maxElapsedMs: number },\n): GoogleDriveExecutionCheckpoint | null {\n  if (\n    !value ||\n    value.connectionId !== expected.connectionId ||\n    value.googlePermissionId !== expected.googlePermissionId ||\n    value.sourceId !== expected.sourceId ||\n    value.driveId !== expected.driveId ||\n    encodedJsonBytes(value) > GOOGLE_DRIVE_EXECUTION_CHECKPOINT_MAX_BYTES\n  ) {\n    return null;\n  }\n  if (value.version === 2 && value.kind === \"google_drive_changes\") {\n    const changesCheckpoint = parseGoogleDriveChangesCheckpoint(value.changesCheckpoint, limits);\n    return changesCheckpoint\n      ? ({ ...value, changesCheckpoint } as GoogleDriveExecutionCheckpoint)\n      : null;\n  }\n  if (value.version === 3 && value.kind === \"google_drive_full_reconciliation\") {\n    const budgetBeforeInventory = parseGoogleDriveSyncBudget(value.budgetBeforeInventory, limits);\n    const revisionFloors = parseGoogleDriveRevisionFloors(value.revisionFloors, limits.maxItems);\n    if (\n      typeof value.boundaryId !== \"string\" ||\n      value.boundaryId.length < 1 ||\n      value.boundaryId.length > 1024 ||\n      typeof value.startPageToken !== \"string\" ||\n      value.startPageToken.length < 1 ||\n      value.startPageToken.length > 4096 ||\n      typeof value.cursorInvalidated !== \"boolean\" ||\n      !budgetBeforeInventory ||\n      !revisionFloors ||\n      !Number.isSafeInteger(value.inventoryElapsedMs) ||\n      Number(value.inventoryElapsedMs) < 0 ||\n      Number(value.inventoryElapsedMs) > limits.maxElapsedMs ||\n      budgetBeforeInventory.elapsedMs + Number(value.inventoryElapsedMs) > limits.maxElapsedMs ||\n      (value.inventoryCheckpoint !== null &&\n        (!value.inventoryCheckpoint ||\n          typeof value.inventoryCheckpoint !== \"object\" ||\n          Array.isArray(value.inventoryCheckpoint)))\n    ) {\n      return null;\n    }\n    return {\n      ...value,\n      budgetBeforeInventory,\n      inventoryElapsedMs: Number(value.inventoryElapsedMs),\n      revisionFloors,\n    } as GoogleDriveExecutionCheckpoint;\n  }\n  return null;\n}\n\nfunction buildGoogleDriveFullReconciliationCheckpoint(\n  input: Omit<GoogleDriveFullReconciliationCheckpoint, \"version\" | \"kind\">,\n): GoogleDriveFullReconciliationCheckpoint {\n  const checkpoint = {\n    version: 3,\n    kind: \"google_drive_full_reconciliation\",\n    ...input,\n    revisionFloors: input.revisionFloors.map((floor) => [...floor]),\n  } satisfies GoogleDriveFullReconciliationCheckpoint;\n  if (encodedJsonBytes(checkpoint) > GOOGLE_DRIVE_EXECUTION_CHECKPOINT_MAX_BYTES) {\n    throw new SyncFailure(\"resource_limit\", false);\n  }\n  return checkpoint;\n}\n\nfunction parseGoogleDriveRevisionFloors(\n  value: unknown,\n  maxItems: number,\n): GoogleDriveRevisionFloor[] | null {\n  if (!Array.isArray(value) || value.length > maxItems) return null;\n  const floors: GoogleDriveRevisionFloor[] = [];\n  const seen = new Set<string>();\n  for (const floor of value) {\n    if (\n      !Array.isArray(floor) ||\n      floor.length !== 2 ||\n      typeof floor[0] !== \"string\" ||\n      floor[0].trim().length < 1 ||\n      floor[0].length > 1024 ||\n      (floor[1] !== null &&\n        (typeof floor[1] !== \"string\" || floor[1].length < 1 || floor[1].length > 256)) ||\n      seen.has(floor[0])\n    ) {\n      return null;\n    }\n    seen.add(floor[0]);\n    floors.push([floor[0], floor[1]]);\n  }\n  return floors;\n}\n\nfunction revisionFloorsForEntries(\n  entries: GoogleDriveInventoryEntry[],\n  maxItems: number,\n): GoogleDriveRevisionFloor[] {\n  const reconciled = reconcileGoogleDriveRevisionFloors(entries, [], maxItems);\n  if (reconciled.conflict) throw new SyncFailure(\"provider_payload_invalid\", false);\n  return reconciled.revisionFloors;\n}\n\nexport function shouldProcessGoogleDriveDurableObservation(input: {\n  entry: Pick<GoogleDriveInventoryEntry, \"externalObjectId\">;\n  observation: KnowledgeSourceSyncObjectObservationResult;\n  sourceLifecycleGeneration: number;\n  aclGeneration: number;\n}): boolean {\n  if (input.observation.externalObjectId !== input.entry.externalObjectId) {\n    throw new SyncFailure(\"provider_payload_invalid\", false);\n  }\n  if (\n    input.observation.disposition === \"accepted\" ||\n    input.observation.disposition === \"replayed\"\n  ) {\n    return true;\n  }\n  if (input.observation.disposition === \"conflict\") {\n    throw new SyncFailure(\"provider_payload_invalid\", false);\n  }\n  const current = input.observation.currentVersion;\n  const comparison = current\n    ? compareCanonicalDecimalProviderRevisions(\n        current.providerRevision,\n        input.observation.providerRevision,\n      )\n    : null;\n  const fullyProcessed =\n    current !== null &&\n    current.objectLifecycleState === \"active\" &&\n    current.sourceLifecycleGeneration === input.sourceLifecycleGeneration &&\n    current.objectLifecycleGeneration === current.currentObjectLifecycleGeneration &&\n    current.aclGeneration === input.aclGeneration &&\n    current.indexObligationStatus === \"indexed\" &&\n    comparison !== null &&\n    comparison >= 0 &&\n    (comparison > 0 || current.metadataHash === input.observation.metadataHash);\n  if (!fullyProcessed) throw new SyncFailure(\"provider_payload_invalid\", false);\n  return false;\n}\n\nexport function mergeGoogleDriveDurableObservationFloors(\n  checkpoint: Record<string, unknown> | null,\n  observations: KnowledgeSourceSyncObservationFloor[],\n  maxItems: number,\n): Record<string, unknown> | null {\n  if (\n    !checkpoint ||\n    checkpoint.version !== 3 ||\n    checkpoint.kind !== \"google_drive_full_reconciliation\"\n  ) {\n    return checkpoint;\n  }\n  const parsedFloors = parseGoogleDriveRevisionFloors(checkpoint.revisionFloors, maxItems);\n  if (!parsedFloors) throw new SyncFailure(\"provider_payload_invalid\", false);\n  const floors = new Map<string, string | null>(parsedFloors);\n  for (const observation of observations) {\n    floors.set(observation.externalObjectId, observation.providerRevision);\n  }\n  if (floors.size > maxItems) throw new SyncFailure(\"resource_limit\", false);\n  const merged = {\n    ...checkpoint,\n    revisionFloors: [...floors],\n  };\n  if (encodedJsonBytes(merged) > GOOGLE_DRIVE_EXECUTION_CHECKPOINT_MAX_BYTES) {\n    throw new SyncFailure(\"resource_limit\", false);\n  }\n  return merged;\n}\n\nfunction reconcileGoogleDriveRevisionFloors(\n  entries: GoogleDriveInventoryEntry[],\n  existingFloors: GoogleDriveRevisionFloor[],\n  maxItems: number,\n): {\n  entries: GoogleDriveInventoryEntry[];\n  revisionFloors: GoogleDriveRevisionFloor[];\n  conflict: boolean;\n} {\n  const floors = new Map<string, string | null>(existingFloors);\n  const accepted: GoogleDriveInventoryEntry[] = [];\n  for (const entry of entries) {\n    if (!floors.has(entry.externalObjectId)) {\n      floors.set(entry.externalObjectId, entry.externalVersionId);\n      accepted.push(entry);\n    } else {\n      const comparison = compareCanonicalDecimalProviderRevisions(\n        entry.externalVersionId,\n        floors.get(entry.externalObjectId) ?? null,\n      );\n      if (comparison === null) {\n        return {\n          entries: [],\n          revisionFloors: [...floors],\n          conflict: true,\n        };\n      }\n      if (comparison > 0) {\n        floors.set(entry.externalObjectId, entry.externalVersionId);\n        accepted.push(entry);\n      }\n    }\n    if (floors.size > maxItems) throw new SyncFailure(\"resource_limit\", false);\n  }\n  return {\n    entries: accepted,\n    revisionFloors: [...floors],\n    conflict: false,\n  };\n}\n\nfunction encodedJsonBytes(value: unknown): number {\n  try {\n    return new TextEncoder().encode(JSON.stringify(value)).byteLength;\n  } catch {\n    return Number.POSITIVE_INFINITY;\n  }\n}\n\nfunction parseGoogleDriveSyncBudget(\n  value: unknown,\n  limits: { maxItems: number; maxProviderRequests: number; maxElapsedMs: number },\n): GoogleDriveSyncBudget | null {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return null;\n  const row = value as Record<string, unknown>;\n  for (const [key, maximum] of [\n    [\"examinedItems\", limits.maxItems],\n    [\"providerRequests\", limits.maxProviderRequests],\n    [\"elapsedMs\", limits.maxElapsedMs],\n  ] as const) {\n    const budgetValue = row[key];\n    if (\n      !Number.isSafeInteger(budgetValue) ||\n      Number(budgetValue) < 0 ||\n      Number(budgetValue) > maximum\n    ) {\n      return null;\n    }\n  }\n  return value as GoogleDriveSyncBudget;\n}\n\nfunction emptyGoogleDriveSyncBudget(): GoogleDriveSyncBudget {\n  return { examinedItems: 0, providerRequests: 0, elapsedMs: 0 };\n}\n\nfunction googleDriveHardLimitReason(\n  budget: GoogleDriveSyncBudget,\n  limits: { maxItems: number; maxProviderRequests: number; maxElapsedMs: number },\n): Extract<\n  GoogleDriveInventoryStopReason,\n  \"api_request_limit\" | \"elapsed_time_limit\" | \"item_limit\"\n> | null {\n  if (budget.examinedItems >= limits.maxItems) return \"item_limit\";\n  if (budget.providerRequests >= limits.maxProviderRequests) return \"api_request_limit\";\n  if (budget.elapsedMs >= limits.maxElapsedMs) return \"elapsed_time_limit\";\n  return null;\n}\n\nfunction googleDriveInventoryStopIsHard(\n  reason: GoogleDriveInventoryStopReason | null,\n  budget: GoogleDriveSyncBudget,\n  limits: { maxItems: number; maxProviderRequests: number; maxElapsedMs: number },\n): boolean {\n  if (reason === \"api_request_limit\" || reason === \"item_limit\" || reason === \"known_byte_limit\") {\n    return true;\n  }\n  return reason === \"elapsed_time_limit\" && budget.elapsedMs >= limits.maxElapsedMs;\n}\n\nasync function getDriveStartPageToken(\n  driveId: string | null,\n  authorization: string | undefined,\n  retry: GoogleDriveProviderRetryOptions,\n  observability: Observability,\n): Promise<string> {\n  if (!authorization) throw new SyncFailure(\"connection_reconnect_required\", true, true);\n  const url = new URL(`${DRIVE_API_BASE}/changes/startPageToken`);\n  url.searchParams.set(\"supportsAllDrives\", \"true\");\n  if (driveId) url.searchParams.set(\"driveId\", driveId);\n  const response = await requestGoogleDrive(\n    url,\n    { headers: { authorization, accept: \"application/json\" } },\n    \"start_page_token\",\n    retry,\n    observability,\n  );\n  if (!response.ok) throwGoogleDriveResponse(response);\n  const payload = (await readResponseJsonBounded(\n    response,\n    DRIVE_JSON_MAX_BYTES,\n    \"Google Drive start page token\",\n  )) as Record<string, unknown>;\n  return requiredString(payload.startPageToken, \"start_page_token\");\n}\n\nasync function listDriveChanges(\n  pageToken: string,\n  driveId: string | null,\n  pageSize: number,\n  authorization: string | undefined,\n  retry: GoogleDriveProviderRetryOptions,\n  observability: Observability,\n): Promise<GoogleDriveChangesPage> {\n  if (!authorization) throw new SyncFailure(\"connection_reconnect_required\", true, true);\n  const url = new URL(`${DRIVE_API_BASE}/changes`);\n  url.searchParams.set(\"pageToken\", pageToken);\n  url.searchParams.set(\"pageSize\", String(pageSize));\n  url.searchParams.set(\"supportsAllDrives\", \"true\");\n  url.searchParams.set(\"includeItemsFromAllDrives\", \"true\");\n  url.searchParams.set(\"spaces\", \"drive\");\n  url.searchParams.set(\n    \"fields\",\n    \"nextPageToken,newStartPageToken,changes(fileId,removed,time,driveId,file(id,name,mimeType,driveId,parents,modifiedTime,createdTime,version,md5Checksum,size,webViewLink,trashed))\",\n  );\n  if (driveId) url.searchParams.set(\"driveId\", driveId);\n  const response = await requestGoogleDrive(\n    url,\n    { headers: { authorization, accept: \"application/json\" } },\n    \"list_changes\",\n    retry,\n    observability,\n  );\n  if (response.status === 410) throw new GoogleDriveCursorInvalidError();\n  if (!response.ok) throwGoogleDriveResponse(response);\n  const payload = (await readResponseJsonBounded(\n    response,\n    DRIVE_JSON_MAX_BYTES,\n    \"Google Drive changes list\",\n  )) as Record<string, unknown>;\n  const changes = Array.isArray(payload.changes) ? payload.changes : [];\n  return {\n    changes: changes.map((value) => {\n      const row = value && typeof value === \"object\" ? (value as Record<string, unknown>) : {};\n      const fileId = requiredString(row.fileId, \"change_file_id\");\n      return {\n        fileId,\n        removed: row.removed === true,\n        file: row.file && typeof row.file === \"object\" ? parseDriveProviderItem(row.file) : null,\n      };\n    }),\n    nextPageToken: optionalString(payload.nextPageToken),\n    newStartPageToken: optionalString(payload.newStartPageToken),\n  };\n}\n\nasync function getDriveFile(\n  fileId: string,\n  authorization: string | undefined,\n  retry: GoogleDriveProviderRetryOptions,\n  observability: Observability,\n): Promise<GoogleDriveInventoryProviderItem | null> {\n  if (!authorization) throw new SyncFailure(\"connection_reconnect_required\", true, true);\n  const url = new URL(`${DRIVE_API_BASE}/files/${encodeURIComponent(fileId)}`);\n  url.searchParams.set(\"supportsAllDrives\", \"true\");\n  url.searchParams.set(\n    \"fields\",\n    \"id,name,mimeType,driveId,parents,modifiedTime,createdTime,version,md5Checksum,size,webViewLink,trashed\",\n  );\n  const response = await requestGoogleDrive(\n    url,\n    { headers: { authorization, accept: \"application/json\" } },\n    \"get_file\",\n    retry,\n    observability,\n  );\n  if (response.status === 404) return null;\n  if (!response.ok) throwGoogleDriveResponse(response);\n  return parseDriveProviderItem(\n    await readResponseJsonBounded(response, DRIVE_JSON_MAX_BYTES, \"Google Drive file metadata\"),\n  );\n}\n\nasync function listDrivePermissions(\n  input: { fileId: string; pageToken: string | null; pageSize: number },\n  authorization: string | undefined,\n  retry: GoogleDriveProviderRetryOptions,\n  observability: Observability,\n): Promise<GoogleDrivePermissionsPage> {\n  if (!authorization) throw new SyncFailure(\"connection_reconnect_required\", true, true);\n  const url = new URL(`${DRIVE_API_BASE}/files/${encodeURIComponent(input.fileId)}/permissions`);\n  url.searchParams.set(\"supportsAllDrives\", \"true\");\n  url.searchParams.set(\"pageSize\", String(input.pageSize));\n  url.searchParams.set(\n    \"fields\",\n    \"nextPageToken,permissions(id,type,emailAddress,domain,role,allowFileDiscovery,expirationTime,deleted,permissionDetails(inherited))\",\n  );\n  if (input.pageToken) url.searchParams.set(\"pageToken\", input.pageToken);\n  const response = await requestGoogleDrive(\n    url,\n    { headers: { authorization, accept: \"application/json\" } },\n    \"list_permissions\",\n    retry,\n    observability,\n  );\n  if (response.status === 403 || response.status === 404) {\n    return { permissions: [], nextPageToken: null, denied: true };\n  }\n  if (!response.ok) throwGoogleDriveResponse(response);\n  const payload = (await readResponseJsonBounded(\n    response,\n    DRIVE_JSON_MAX_BYTES,\n    \"Google Drive permission list\",\n  )) as Record<string, unknown>;\n  const rawPermissions = Array.isArray(payload.permissions) ? payload.permissions : null;\n  if (!rawPermissions) throw new SyncFailure(\"provider_payload_invalid\", false);\n  return {\n    permissions: rawPermissions.map(parseDrivePermission),\n    nextPageToken: optionalString(payload.nextPageToken),\n    denied: false,\n  };\n}\n\nexport async function collectGoogleDriveAclEvidence(input: {\n  entry: Pick<GoogleDriveInventoryEntry, \"externalObjectId\" | \"externalVersionId\" | \"driveId\">;\n  maxProviderRequests: number;\n  listPermissions: NonNullable<GoogleDriveSyncProviderPort[\"listPermissions\"]>;\n  getFile?: GoogleDriveSyncProviderPort[\"getFile\"];\n  now?: () => number;\n}): Promise<KnowledgeSourceSyncAclEvidence> {\n  if (!Number.isSafeInteger(input.maxProviderRequests) || input.maxProviderRequests < 1) {\n    throw new SyncFailure(\"resource_limit\", false);\n  }\n  const now = input.now ?? Date.now;\n  const observedAt = new Date(now());\n  if (!Number.isFinite(observedAt.getTime())) {\n    throw new SyncFailure(\"provider_payload_invalid\", false);\n  }\n  const permissions: GoogleDrivePermission[] = [];\n  const seenTokens = new Set<string>();\n  let pageToken: string | null = null;\n  let providerRequests = 0;\n  let permissionListDenied = false;\n  do {\n    if (providerRequests >= input.maxProviderRequests) {\n      throw new SyncFailure(\"resource_limit\", false);\n    }\n    providerRequests += 1;\n    const page = await input.listPermissions({\n      fileId: input.entry.externalObjectId,\n      pageToken,\n      pageSize: Math.min(100, GOOGLE_DRIVE_ACL_MAX_PRINCIPALS - permissions.length),\n    });\n    if (page.denied) {\n      permissionListDenied = true;\n      break;\n    }\n    permissions.push(...page.permissions);\n    if (permissions.length > GOOGLE_DRIVE_ACL_MAX_PRINCIPALS) {\n      throw new SyncFailure(\"resource_limit\", false);\n    }\n    pageToken = page.nextPageToken;\n    if (pageToken) {\n      if (pageToken.length > 4096 || seenTokens.has(pageToken)) {\n        throw new SyncFailure(\"provider_payload_invalid\", false);\n      }\n      seenTokens.add(pageToken);\n    }\n  } while (pageToken);\n\n  if (permissionListDenied) {\n    if (!input.getFile || providerRequests >= input.maxProviderRequests) {\n      return googleDriveDeniedAclEvidence(input.entry, observedAt, providerRequests);\n    }\n    providerRequests += 1;\n    const current = await input.getFile(input.entry.externalObjectId);\n    if (!current || current.trashed) {\n      return googleDriveDeniedAclEvidence(input.entry, observedAt, providerRequests);\n    }\n    const aclRevision = createHash(\"sha256\")\n      .update(\n        JSON.stringify({\n          version: 1,\n          mode: \"source_owner_only\",\n          externalObjectId: input.entry.externalObjectId,\n          providerRevision: input.entry.externalVersionId,\n        }),\n      )\n      .digest(\"hex\");\n    return {\n      eligibility: \"eligible\",\n      providerRevision: input.entry.externalVersionId,\n      driveId: input.entry.driveId,\n      aclRevision,\n      observedAt: observedAt.toISOString(),\n      expiresAt: new Date(observedAt.getTime() + GOOGLE_DRIVE_ACL_FRESHNESS_MS).toISOString(),\n      providerRequests,\n      principals: [],\n    };\n  }\n\n  const canonicalPermissions = permissions\n    .map((permission) => ({\n      id: permission.id,\n      type: permission.type,\n      role: permission.role,\n      emailAddress: permission.emailAddress,\n      domain: permission.domain,\n      allowFileDiscovery: permission.allowFileDiscovery,\n      expirationTime: permission.expirationTime,\n      inherited: permission.inherited,\n    }))\n    .sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right)));\n  const aclRevision = createHash(\"sha256\")\n    .update(\n      JSON.stringify({\n        version: 1,\n        externalObjectId: input.entry.externalObjectId,\n        providerRevision: input.entry.externalVersionId,\n        permissions: canonicalPermissions,\n      }),\n    )\n    .digest(\"hex\");\n  return {\n    eligibility: \"eligible\",\n    providerRevision: input.entry.externalVersionId,\n    driveId: input.entry.driveId,\n    aclRevision,\n    observedAt: observedAt.toISOString(),\n    expiresAt: new Date(observedAt.getTime() + GOOGLE_DRIVE_ACL_FRESHNESS_MS).toISOString(),\n    providerRequests,\n    principals: canonicalPermissions.map((permission) => ({\n      type: permission.type,\n      permissionId: permission.id,\n      emailAddress: permission.emailAddress,\n      domain: permission.domain,\n      role: permission.role,\n      inherited: permission.inherited,\n      allowFileDiscovery: permission.allowFileDiscovery,\n      expirationTime: permission.expirationTime,\n    })),\n  };\n}\n\nfunction googleDriveDeniedAclEvidence(\n  entry: Pick<GoogleDriveInventoryEntry, \"externalObjectId\" | \"externalVersionId\" | \"driveId\">,\n  observedAt: Date,\n  providerRequests: number,\n) {\n  return {\n    eligibility: \"denied\" as const,\n    providerRevision: entry.externalVersionId,\n    driveId: entry.driveId,\n    aclRevision: createHash(\"sha256\")\n      .update(\n        JSON.stringify({\n          version: 1,\n          mode: \"provider_denied\",\n          externalObjectId: entry.externalObjectId,\n          providerRevision: entry.externalVersionId,\n        }),\n      )\n      .digest(\"hex\"),\n    observedAt: observedAt.toISOString(),\n    expiresAt: new Date(observedAt.getTime() + GOOGLE_DRIVE_ACL_FRESHNESS_MS).toISOString(),\n    providerRequests,\n    principals: [],\n  };\n}\n\nfunction parseDrivePermission(value: unknown): GoogleDrivePermission {\n  const row = objectRecord(value);\n  if (row.deleted === true) throw new SyncFailure(\"provider_payload_invalid\", false);\n  const type = requiredString(row.type, \"permission.type\");\n  if (type !== \"user\" && type !== \"group\" && type !== \"domain\" && type !== \"anyone\") {\n    throw new SyncFailure(\"provider_payload_invalid\", false);\n  }\n  const role = requiredString(row.role, \"permission.role\");\n  if (\n    role !== \"owner\" &&\n    role !== \"organizer\" &&\n    role !== \"fileOrganizer\" &&\n    role !== \"writer\" &&\n    role !== \"commenter\" &&\n    role !== \"reader\"\n  ) {\n    throw new SyncFailure(\"provider_payload_invalid\", false);\n  }\n  const permissionDetails = Array.isArray(row.permissionDetails) ? row.permissionDetails : [];\n  return {\n    id: requiredString(row.id, \"permission.id\"),\n    type,\n    role,\n    emailAddress: optionalString(row.emailAddress),\n    domain: optionalString(row.domain),\n    allowFileDiscovery: typeof row.allowFileDiscovery === \"boolean\" ? row.allowFileDiscovery : null,\n    expirationTime: optionalExactProviderTimestamp(row.expirationTime),\n    inherited: permissionDetails.some((detail) => objectRecord(detail).inherited === true),\n  };\n}\n\nfunction optionalExactProviderTimestamp(value: unknown): string | null {\n  const timestamp = optionalString(value);\n  if (!timestamp) return null;\n  const parsed = new Date(timestamp);\n  if (!Number.isFinite(parsed.getTime())) throw new SyncFailure(\"provider_payload_invalid\", false);\n  return parsed.toISOString();\n}\n\nfunction throwGoogleDriveResponse(response: Response): never {\n  if (response.status === 401 || response.status === 403) {\n    throw new SyncFailure(\"connection_reconnect_required\", true, true);\n  }\n  throw new SyncFailure(\n    response.status >= 500 || response.status === 429\n      ? \"provider_unavailable\"\n      : \"provider_rejected\",\n    response.status >= 500 || response.status === 429,\n  );\n}\n\nasync function requestGoogleDrive(\n  url: URL,\n  init: RequestInit,\n  operation: GoogleDriveProviderOperation,\n  retry: GoogleDriveProviderRetryOptions,\n  observability: Observability,\n): Promise<Response> {\n  try {\n    return await fetchGoogleDriveProvider({\n      fetchImpl: sourceFetch,\n      url,\n      init,\n      operation,\n      policy: retry,\n      observability,\n      heartbeat: (details) => heartbeat({ provider: \"google_drive\", ...details }),\n    });\n  } catch (error) {\n    if (error instanceof GoogleDriveProviderTransportError) {\n      throw new SyncFailure(\"provider_unavailable\", true);\n    }\n    throw error;\n  }\n}\n\nfunction selectedDriveSource(\n  metadata: ReturnType<typeof GoogleDriveConnectionMetadata.parse>,\n  externalSourceId: string,\n): GoogleDriveSelectedSource | null {\n  const sources =\n    metadata.selectedSources ?? (metadata.selectedSource ? [metadata.selectedSource] : []);\n  return sources.find((source) => source.id === externalSourceId) ?? null;\n}\n\nexport function googleDriveSyncProviderAccessAllowed(input: {\n  connectionVersion: number;\n  resolvedConnectionVersion: number | undefined;\n  connectionStatus: string;\n  lifecycleState: string | undefined;\n  grantedScopes: string[];\n}): boolean {\n  return (\n    input.resolvedConnectionVersion !== undefined &&\n    input.connectionVersion === input.resolvedConnectionVersion &&\n    input.connectionStatus === \"active\" &&\n    (input.lifecycleState === undefined || input.lifecycleState === \"active\") &&\n    googleDriveScopesAllowCapability(input.grantedScopes, \"recursive_source_sync\")\n  );\n}\n\nasync function listDriveChildren(\n  input: { folderId: string; driveId: string | null; pageToken: string | null; pageSize: number },\n  authorization: string | undefined,\n  retry: GoogleDriveProviderRetryOptions,\n  observability: Observability,\n): Promise<GoogleDriveInventoryPage> {\n  if (!authorization) throw new SyncFailure(\"connection_reconnect_required\", true, true);\n  const url = new URL(`${DRIVE_API_BASE}/files`);\n  url.searchParams.set(\n    \"q\",\n    `'${input.folderId.replaceAll(\"'\", \"\\\\'\")}' in parents and trashed = false`,\n  );\n  url.searchParams.set(\"pageSize\", String(input.pageSize));\n  url.searchParams.set(\"supportsAllDrives\", \"true\");\n  url.searchParams.set(\"includeItemsFromAllDrives\", \"true\");\n  url.searchParams.set(\n    \"fields\",\n    \"nextPageToken,incompleteSearch,files(id,name,mimeType,driveId,parents,modifiedTime,createdTime,version,md5Checksum,size,webViewLink,trashed)\",\n  );\n  if (input.pageToken) url.searchParams.set(\"pageToken\", input.pageToken);\n  if (input.driveId) {\n    url.searchParams.set(\"corpora\", \"drive\");\n    url.searchParams.set(\"driveId\", input.driveId);\n  }\n  const response = await requestGoogleDrive(\n    url,\n    { headers: { authorization, accept: \"application/json\" } },\n    \"list_children\",\n    retry,\n    observability,\n  );\n  if (!response.ok) {\n    if (response.status === 401 || response.status === 403) {\n      throw new SyncFailure(\"connection_reconnect_required\", true, true);\n    }\n    throw new SyncFailure(\n      \"provider_unavailable\",\n      response.status >= 500 || response.status === 429,\n    );\n  }\n  const payload = (await readResponseJsonBounded(\n    response,\n    DRIVE_JSON_MAX_BYTES,\n    \"Google Drive file list\",\n  )) as Record<string, unknown>;\n  const rawFiles = Array.isArray(payload.files) ? payload.files : [];\n  return {\n    items: rawFiles.map(parseDriveProviderItem),\n    nextPageToken: typeof payload.nextPageToken === \"string\" ? payload.nextPageToken : null,\n    incompleteSearch: payload.incompleteSearch === true,\n  };\n}\n\nfunction parseDriveProviderItem(value: unknown): GoogleDriveInventoryProviderItem {\n  const row = value && typeof value === \"object\" ? (value as Record<string, unknown>) : {};\n  return {\n    id: requiredString(row.id, \"id\"),\n    name: requiredString(row.name, \"name\"),\n    mimeType: requiredString(row.mimeType, \"mimeType\"),\n    driveId: optionalString(row.driveId),\n    parents: Array.isArray(row.parents)\n      ? row.parents.filter((item): item is string => typeof item === \"string\")\n      : [],\n    modifiedTime: optionalString(row.modifiedTime),\n    createdTime: optionalString(row.createdTime),\n    version: optionalString(row.version),\n    md5Checksum: optionalString(row.md5Checksum),\n    size: optionalString(row.size),\n    webViewLink: optionalString(row.webViewLink),\n    trashed: row.trashed === true,\n  };\n}\n\nasync function fetchDriveBytes(\n  entry: GoogleDriveInventoryEntry,\n  authorization: string | undefined,\n  maxBytes: number,\n  retry: GoogleDriveProviderRetryOptions,\n  observability: Observability,\n): Promise<Uint8Array> {\n  if (!authorization) throw new SyncFailure(\"connection_reconnect_required\", true, true);\n  const url =\n    entry.transfer.action === \"export\"\n      ? new URL(`${DRIVE_API_BASE}/files/${encodeURIComponent(entry.externalObjectId)}/export`)\n      : new URL(`${DRIVE_API_BASE}/files/${encodeURIComponent(entry.externalObjectId)}`);\n  if (entry.transfer.action === \"export\") {\n    url.searchParams.set(\"mimeType\", entry.transfer.contentType);\n  } else {\n    url.searchParams.set(\"alt\", \"media\");\n    url.searchParams.set(\"supportsAllDrives\", \"true\");\n  }\n  const response = await requestGoogleDrive(\n    url,\n    { headers: { authorization } },\n    entry.transfer.action === \"export\" ? \"export\" : \"download\",\n    retry,\n    observability,\n  );\n  if (!response.ok) {\n    if (response.status === 401 || response.status === 403) {\n      throw new SyncFailure(\"connection_reconnect_required\", true, true);\n    }\n    throw new SyncFailure(\n      \"provider_unavailable\",\n      response.status >= 500 || response.status === 429,\n    );\n  }\n  const declared = Number(response.headers.get(\"content-length\") ?? \"0\");\n  if (Number.isFinite(declared) && declared > maxBytes) {\n    throw new SyncFailure(\"content_too_large\", false);\n  }\n  if (!response.body) {\n    const bytes = new Uint8Array(await response.arrayBuffer());\n    if (bytes.byteLength > maxBytes) throw new SyncFailure(\"content_too_large\", false);\n    return bytes;\n  }\n  const reader = response.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let total = 0;\n  while (true) {\n    const { done, value } = await reader.read();\n    if (done) break;\n    total += value.byteLength;\n    if (total > maxBytes) {\n      await reader.cancel();\n      throw new SyncFailure(\"content_too_large\", false);\n    }\n    chunks.push(value);\n  }\n  const bytes = new Uint8Array(total);\n  let offset = 0;\n  for (const chunk of chunks) {\n    bytes.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return bytes;\n}\n\nasync function listAtlassianItems(\n  source: AtlassianSelectedSource,\n  cursor: string | null,\n  pageSize: number,\n  authorization: string | undefined,\n): Promise<AtlassianInventoryPage> {\n  if (!authorization) throw new SyncFailure(\"connection_reconnect_required\", true, true);\n  if (source.kind === \"jira_project\") {\n    const url = new URL(\n      `${ATLASSIAN_API_BASE}/ex/jira/${encodeURIComponent(source.cloudId)}/rest/api/3/search/jql`,\n    );\n    url.searchParams.set(\n      \"jql\",\n      `project = \"${source.key.replaceAll('\"', '\\\\\"')}\" ORDER BY key ASC`,\n    );\n    url.searchParams.set(\"maxResults\", String(pageSize));\n    url.searchParams.set(\"fields\", \"summary,created,updated\");\n    if (cursor) url.searchParams.set(\"nextPageToken\", cursor);\n    const payload = objectRecord(await atlassianJsonRequest(url, authorization, \"Jira issue list\"));\n    const issues = Array.isArray(payload.issues) ? payload.issues : [];\n    return {\n      items: issues.map((raw) => {\n        const row = objectRecord(raw);\n        const fields = objectRecord(row.fields);\n        const id = requiredAtlassianString(row.id, \"issue.id\");\n        const key = requiredAtlassianString(row.key, \"issue.key\");\n        const updatedAt = optionalString(fields.updated);\n        return {\n          id,\n          key,\n          title: requiredAtlassianString(fields.summary, \"issue.summary\"),\n          version: updatedAt,\n          createdAt: optionalString(fields.created),\n          updatedAt,\n          webUrl: new URL(`/browse/${encodeURIComponent(key)}`, source.siteUrl).toString(),\n        };\n      }),\n      nextCursor: optionalString(payload.nextPageToken),\n    };\n  }\n\n  const url = new URL(\n    `${ATLASSIAN_API_BASE}/ex/confluence/${encodeURIComponent(source.cloudId)}/wiki/api/v2/spaces/${encodeURIComponent(source.resourceId)}/pages`,\n  );\n  url.searchParams.set(\"limit\", String(pageSize));\n  url.searchParams.set(\"sort\", \"id\");\n  if (cursor) url.searchParams.set(\"cursor\", cursor);\n  const payload = objectRecord(\n    await atlassianJsonRequest(url, authorization, \"Confluence page list\"),\n  );\n  const pages = Array.isArray(payload.results) ? payload.results : [];\n  return {\n    items: pages.map((raw) => {\n      const row = objectRecord(raw);\n      const version = objectRecord(row.version);\n      const id = requiredAtlassianString(row.id, \"page.id\");\n      const webUi = optionalString(objectRecord(row._links).webui);\n      const versionNumber = numberValue(version.number);\n      return {\n        id,\n        key: id,\n        title: requiredAtlassianString(row.title, \"page.title\"),\n        version: versionNumber === undefined ? null : String(versionNumber),\n        createdAt: optionalString(row.createdAt),\n        updatedAt: optionalString(version.createdAt),\n        webUrl: webUi\n          ? new URL(webUi.startsWith(\"/wiki/\") ? webUi : `/wiki${webUi}`, source.siteUrl).toString()\n          : new URL(\n              `/wiki/spaces/${encodeURIComponent(source.key)}/pages/${encodeURIComponent(id)}`,\n              source.siteUrl,\n            ).toString(),\n      };\n    }),\n    nextCursor: confluenceCursor(objectRecord(payload._links).next),\n  };\n}\n\nasync function fetchAtlassianContent(\n  source: AtlassianSelectedSource,\n  entry: AtlassianInventoryEntry,\n  authorization: string | undefined,\n  maxBytes: number,\n): Promise<Uint8Array> {\n  if (!authorization) throw new SyncFailure(\"connection_reconnect_required\", true, true);\n  const objectId = entry.externalObjectId.slice(entry.externalObjectId.indexOf(\":\") + 1);\n  const markdown =\n    source.kind === \"jira_project\"\n      ? await jiraIssueMarkdown(source, objectId, entry, authorization)\n      : await confluencePageMarkdown(source, objectId, entry, authorization);\n  const bytes = new TextEncoder().encode(markdown);\n  if (bytes.byteLength > maxBytes) throw new SyncFailure(\"content_too_large\", false);\n  return bytes;\n}\n\nasync function jiraIssueMarkdown(\n  source: AtlassianSelectedSource,\n  issueId: string,\n  entry: AtlassianInventoryEntry,\n  authorization: string,\n): Promise<string> {\n  const issueUrl = new URL(\n    `${ATLASSIAN_API_BASE}/ex/jira/${encodeURIComponent(source.cloudId)}/rest/api/3/issue/${encodeURIComponent(issueId)}`,\n  );\n  issueUrl.searchParams.set(\n    \"fields\",\n    \"summary,description,status,issuetype,priority,assignee,reporter,labels,created,updated\",\n  );\n  const issue = objectRecord(await atlassianJsonRequest(issueUrl, authorization, \"Jira issue\"));\n  const fields = objectRecord(issue.fields);\n  const lines = [\n    `# ${entry.title}`,\n    \"\",\n    `- Key: ${optionalString(issue.key) ?? entry.title}`,\n    `- Type: ${optionalString(objectRecord(fields.issuetype).name) ?? \"Unknown\"}`,\n    `- Status: ${optionalString(objectRecord(fields.status).name) ?? \"Unknown\"}`,\n    `- Priority: ${optionalString(objectRecord(fields.priority).name) ?? \"None\"}`,\n    `- Assignee: ${optionalString(objectRecord(fields.assignee).displayName) ?? \"Unassigned\"}`,\n    `- Reporter: ${optionalString(objectRecord(fields.reporter).displayName) ?? \"Unknown\"}`,\n    `- Updated: ${optionalString(fields.updated) ?? \"Unknown\"}`,\n    `- Source: ${entry.sourceUri}`,\n    \"\",\n    \"## Description\",\n    \"\",\n    adfToMarkdown(fields.description) || \"No description.\",\n  ];\n  const labels = Array.isArray(fields.labels)\n    ? fields.labels.filter((value): value is string => typeof value === \"string\")\n    : [];\n  if (labels.length > 0) lines.splice(9, 0, `- Labels: ${labels.join(\", \")}`);\n  const comments = await jiraComments(source, issueId, authorization);\n  if (comments.length > 0) {\n    lines.push(\"\", \"## Comments\", \"\");\n    for (const comment of comments) {\n      const row = objectRecord(comment);\n      const author = optionalString(objectRecord(row.author).displayName) ?? \"Unknown author\";\n      const created = optionalString(row.created) ?? \"Unknown date\";\n      lines.push(`### ${author} · ${created}`, \"\", adfToMarkdown(row.body), \"\");\n    }\n  }\n  return lines.join(\"\\n\");\n}\n\nasync function jiraComments(\n  source: AtlassianSelectedSource,\n  issueId: string,\n  authorization: string,\n): Promise<unknown[]> {\n  const comments: unknown[] = [];\n  let startAt = 0;\n  for (let page = 0; page < 20; page += 1) {\n    const url = new URL(\n      `${ATLASSIAN_API_BASE}/ex/jira/${encodeURIComponent(source.cloudId)}/rest/api/3/issue/${encodeURIComponent(issueId)}/comment`,\n    );\n    url.searchParams.set(\"startAt\", String(startAt));\n    url.searchParams.set(\"maxResults\", \"100\");\n    url.searchParams.set(\"orderBy\", \"created\");\n    const payload = objectRecord(await atlassianJsonRequest(url, authorization, \"Jira comments\"));\n    const pageComments = Array.isArray(payload.comments) ? payload.comments : [];\n    comments.push(...pageComments);\n    const total = numberValue(payload.total) ?? comments.length;\n    if (comments.length >= total || pageComments.length === 0) break;\n    startAt += pageComments.length;\n  }\n  return comments;\n}\n\nasync function confluencePageMarkdown(\n  source: AtlassianSelectedSource,\n  pageId: string,\n  entry: AtlassianInventoryEntry,\n  authorization: string,\n): Promise<string> {\n  const pageUrl = new URL(\n    `${ATLASSIAN_API_BASE}/ex/confluence/${encodeURIComponent(source.cloudId)}/wiki/api/v2/pages/${encodeURIComponent(pageId)}`,\n  );\n  pageUrl.searchParams.set(\"body-format\", \"storage\");\n  const page = objectRecord(await atlassianJsonRequest(pageUrl, authorization, \"Confluence page\"));\n  const storage = objectRecord(objectRecord(page.body).storage);\n  const lines = [\n    `# ${entry.title}`,\n    \"\",\n    `- Space: ${source.name} (${source.key})`,\n    `- Updated: ${entry.modifiedTime ?? \"Unknown\"}`,\n    `- Source: ${entry.sourceUri}`,\n    \"\",\n    \"## Content\",\n    \"\",\n    optionalString(storage.value) ?? \"No content.\",\n  ];\n  const comments = await confluenceFooterComments(source, pageId, authorization);\n  if (comments.length > 0) {\n    lines.push(\"\", \"## Comments\", \"\");\n    for (const comment of comments) {\n      const row = objectRecord(comment);\n      const body = objectRecord(objectRecord(row.body).storage);\n      const version = objectRecord(row.version);\n      lines.push(\n        `### Comment · ${optionalString(version.createdAt) ?? \"Unknown date\"}`,\n        \"\",\n        optionalString(body.value) ?? \"\",\n        \"\",\n      );\n    }\n  }\n  return lines.join(\"\\n\");\n}\n\nasync function confluenceFooterComments(\n  source: AtlassianSelectedSource,\n  pageId: string,\n  authorization: string,\n): Promise<unknown[]> {\n  const comments: unknown[] = [];\n  let cursor: string | null = null;\n  for (let page = 0; page < 20; page += 1) {\n    const url = new URL(\n      `${ATLASSIAN_API_BASE}/ex/confluence/${encodeURIComponent(source.cloudId)}/wiki/api/v2/pages/${encodeURIComponent(pageId)}/footer-comments`,\n    );\n    url.searchParams.set(\"body-format\", \"storage\");\n    url.searchParams.set(\"limit\", \"100\");\n    if (cursor) url.searchParams.set(\"cursor\", cursor);\n    const payload = objectRecord(\n      await atlassianJsonRequest(url, authorization, \"Confluence page comments\"),\n    );\n    const results = Array.isArray(payload.results) ? payload.results : [];\n    comments.push(...results);\n    cursor = confluenceCursor(objectRecord(payload._links).next);\n    if (!cursor) break;\n  }\n  return comments;\n}\n\nasync function atlassianJsonRequest(\n  url: URL,\n  authorization: string,\n  label: string,\n): Promise<unknown> {\n  const response = await sourceFetch(url, {\n    headers: { authorization, accept: \"application/json\" },\n    redirect: \"error\",\n    signal: AbortSignal.timeout(20_000),\n  });\n  if (!response.ok) {\n    await response.body?.cancel().catch(() => undefined);\n    if (response.status === 401 || response.status === 403) {\n      throw new SyncFailure(\"connection_reconnect_required\", true, true);\n    }\n    throw new SyncFailure(\n      \"provider_unavailable\",\n      response.status >= 500 || response.status === 429,\n    );\n  }\n  return await readResponseJsonBounded(response, ATLASSIAN_JSON_MAX_BYTES, label);\n}\n\nexport function confluenceCursor(value: unknown): string | null {\n  const next = optionalString(value);\n  if (!next) return null;\n  const url = new URL(next, ATLASSIAN_API_BASE);\n  const cursor = url.searchParams.get(\"cursor\");\n  if (!cursor || cursor.length > 4_096 || /[\\u0000-\\u001f]/.test(cursor)) {\n    throw new Error(\"invalid Confluence cursor\");\n  }\n  return cursor;\n}\n\nexport function adfToMarkdown(value: unknown): string {\n  const node = objectRecord(value);\n  const type = optionalString(node.type);\n  const children = Array.isArray(node.content) ? node.content.map(adfToMarkdown).join(\"\") : \"\";\n  if (type === \"text\") {\n    let text = typeof node.text === \"string\" ? node.text : \"\";\n    const marks = Array.isArray(node.marks) ? node.marks : [];\n    for (const rawMark of marks) {\n      const mark = objectRecord(rawMark);\n      const markType = optionalString(mark.type);\n      if (markType === \"code\") text = `\\`${text}\\``;\n      if (markType === \"strong\") text = `**${text}**`;\n      if (markType === \"em\") text = `*${text}*`;\n      if (markType === \"strike\") text = `~~${text}~~`;\n      if (markType === \"link\") {\n        const href = optionalString(objectRecord(mark.attrs).href);\n        if (href) text = `[${text}](${href})`;\n      }\n    }\n    return text;\n  }\n  if (type === \"paragraph\") return `${children}\\n\\n`;\n  if (type === \"heading\") {\n    const level = Math.min(Math.max(numberValue(objectRecord(node.attrs).level) ?? 2, 1), 6);\n    return `${\"#\".repeat(level)} ${children.trim()}\\n\\n`;\n  }\n  if (type === \"hardBreak\") return \"  \\n\";\n  if (type === \"rule\") return \"---\\n\\n\";\n  if (type === \"blockquote\") {\n    return `${children\n      .trim()\n      .split(\"\\n\")\n      .map((line) => `> ${line}`)\n      .join(\"\\n\")}\\n\\n`;\n  }\n  if (type === \"bulletList\") {\n    return `${children.trimEnd()}\\n`;\n  }\n  if (type === \"orderedList\") {\n    return `${children.trimEnd()}\\n`;\n  }\n  if (type === \"listItem\") {\n    return `- ${children.trim().replaceAll(\"\\n\", \"\\n  \")}\\n`;\n  }\n  if (type === \"codeBlock\") return `\\`\\`\\`\\n${children.trimEnd()}\\n\\`\\`\\`\\n\\n`;\n  if (type === \"mention\") return `@${optionalString(objectRecord(node.attrs).text) ?? \"user\"}`;\n  if (type === \"emoji\") return optionalString(objectRecord(node.attrs).text) ?? \"\";\n  if (type === \"inlineCard\") {\n    const url = optionalString(objectRecord(node.attrs).url);\n    return url ? `[${url}](${url})` : \"\";\n  }\n  return children;\n}\n\nfunction objectRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === \"object\" && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : {};\n}\n\nfunction requiredAtlassianString(value: unknown, label: string): string {\n  if (typeof value !== \"string\" || !value.trim()) throw new Error(`invalid_atlassian_${label}`);\n  return value;\n}\n\nfunction deterministicUuid(value: string): string {\n  const bytes = createHash(\"sha256\").update(value).digest().subarray(0, 16);\n  bytes[6] = (bytes[6]! & 0x0f) | 0x50;\n  bytes[8] = (bytes[8]! & 0x3f) | 0x80;\n  const hex = bytes.toString(\"hex\");\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;\n}\n\nfunction safeFilename(value: string): string {\n  const normalized = value\n    .normalize(\"NFKC\")\n    .replace(/[\\\\/:*?\"<>|\\0-\\x1f]/g, \"_\")\n    .trim();\n  return (normalized || \"document\").slice(0, 240);\n}\n\nfunction requiredString(value: unknown, label: string): string {\n  if (typeof value !== \"string\" || !value.trim()) throw new Error(`invalid_google_drive_${label}`);\n  return value;\n}\n\nfunction optionalString(value: unknown): string | null {\n  return typeof value === \"string\" && value.length > 0 ? value : null;\n}\n\nfunction numberValue(value: unknown): number | undefined {\n  return typeof value === \"number\" && Number.isFinite(value) ? value : undefined;\n}\n\nfunction boundedError(error: unknown): string {\n  return (error instanceof Error ? error.message : String(error)).slice(0, 1000);\n}\n\nfunction entryMetadataHash(entry: KnowledgeSyncEntry): string {\n  return createHash(\"sha256\")\n    .update(\n      JSON.stringify({\n        externalObjectId: entry.externalObjectId,\n        externalVersionId: entry.externalVersionId,\n        title: entry.title,\n        mimeType: entry.mimeType,\n        driveId: entry.driveId,\n        modifiedTime: entry.modifiedTime,\n        createdTime: entry.createdTime,\n        sourceUri: entry.sourceUri,\n      }),\n    )\n    .digest(\"hex\");\n}\n\nfunction inventoryLimit(\n  reason: GoogleDriveInventoryStopReason | null,\n): KnowledgeSourceSyncRunSummary[\"limitReached\"] {\n  if (reason === \"api_request_limit\") return \"provider_requests\";\n  if (reason === \"elapsed_time_limit\") return \"elapsed_time\";\n  if (reason === \"item_limit\") return \"items\";\n  if (reason === \"known_byte_limit\") return \"bytes\";\n  return null;\n}\n\nfunction recordSyncHealthTelemetry(\n  observability: Observability,\n  provider: \"google_drive\" | \"atlassian\",\n  summary: KnowledgeSourceSyncRunSummary,\n  outcome: \"succeeded\" | \"failed\",\n  failure?: SyncFailure,\n): void {\n  observability.observeHistogram({\n    name: \"opengeni_knowledge_source_sync_terminal_batch_duration_seconds\",\n    help: \"Terminal knowledge-source activity batch duration by provider and outcome.\",\n    labels: { provider, outcome },\n    value: Math.max(0, summary.elapsedMs) / 1_000,\n  });\n  if (summary.providerRequests > 0) {\n    observability.incrementCounter({\n      name: \"opengeni_knowledge_source_sync_provider_requests_total\",\n      help: \"Logical provider requests consumed by knowledge-source synchronization.\",\n      labels: { provider, outcome },\n      amount: summary.providerRequests,\n    });\n  }\n  if (summary.limitReached) {\n    observability.incrementCounter({\n      name: \"opengeni_knowledge_source_sync_limit_hits_total\",\n      help: \"Knowledge-source synchronization runs stopped by an explicit resource budget.\",\n      labels: { provider, limit: summary.limitReached },\n    });\n  }\n  if (summary.reconnectRequired) {\n    observability.incrementCounter({\n      name: \"opengeni_knowledge_source_sync_reconnect_required_total\",\n      help: \"Knowledge-source synchronization failures requiring connector reconnection.\",\n      labels: { provider },\n    });\n  }\n  if (failure) {\n    observability.incrementCounter({\n      name: \"opengeni_knowledge_source_sync_failures_total\",\n      help: \"Knowledge-source synchronization terminal failures by bounded reason.\",\n      labels: {\n        provider,\n        reason: failure.code,\n        retryable: failure.retryable ? \"true\" : \"false\",\n      },\n    });\n    observability.warn(\"Knowledge source sync failed\", {\n      provider,\n      outcome: failure.retryable ? \"retryable_failed\" : \"failed\",\n      reason: failure.code,\n      durationMs: summary.elapsedMs,\n    });\n    return;\n  }\n  observability.info(\"Knowledge source sync completed\", {\n    provider,\n    outcome: \"succeeded\",\n    durationMs: summary.elapsedMs,\n  });\n}\n\ntype SyncFailureCode = KnowledgeSourceSyncRunSummary[\"failures\"][number][\"code\"];\n\nclass SyncFailure extends Error {\n  constructor(\n    readonly code: SyncFailureCode,\n    readonly retryable: boolean,\n    readonly reconnectRequired = false,\n  ) {\n    super(code);\n    this.name = \"KnowledgeSourceSyncFailure\";\n  }\n}\n","import type { GoogleDriveProviderRetryOptions } from \"@opengeni/config\";\nimport type { FetchLike } from \"@opengeni/network\";\nimport type { Observability } from \"@opengeni/observability\";\n\nexport type GoogleDriveProviderOperation =\n  | \"start_page_token\"\n  | \"list_changes\"\n  | \"get_file\"\n  | \"list_children\"\n  | \"list_permissions\"\n  | \"download\"\n  | \"export\";\n\nexport type GoogleDriveProviderHeartbeat = (details: {\n  operation: GoogleDriveProviderOperation;\n  attempt: number;\n  phase: \"request_start\" | \"request_end\" | \"retry_delay_start\" | \"retry_delay_end\";\n}) => void;\n\nexport class GoogleDriveProviderTransportError extends Error {\n  constructor() {\n    super(\"google_drive_provider_transport_failed\");\n    this.name = \"GoogleDriveProviderTransportError\";\n  }\n}\n\n/**\n * Absorb only short, explicitly retryable Drive failures inside one bounded\n * activity. Provider bodies, URLs, headers, and credentials never enter logs\n * or metric labels. The caller's logical sync-request accounting remains\n * unchanged; this helper exposes physical attempts separately as telemetry.\n */\nexport async function fetchGoogleDriveProvider(input: {\n  fetchImpl: FetchLike;\n  url: string | URL;\n  init: RequestInit;\n  operation: GoogleDriveProviderOperation;\n  policy: GoogleDriveProviderRetryOptions;\n  observability: Observability;\n  heartbeat?: GoogleDriveProviderHeartbeat;\n  now?: () => number;\n  sleep?: (delayMs: number) => Promise<void>;\n}): Promise<Response> {\n  const now = input.now ?? Date.now;\n  const sleep = input.sleep ?? Bun.sleep;\n  let retryDelaySpentMs = 0;\n\n  for (let attempt = 1; attempt <= input.policy.attempts; attempt += 1) {\n    let response: Response;\n    input.heartbeat?.({ operation: input.operation, attempt, phase: \"request_start\" });\n    try {\n      response = await input.fetchImpl(input.url, {\n        ...input.init,\n        redirect: \"error\",\n        signal: AbortSignal.timeout(input.policy.requestTimeoutMs),\n      });\n    } catch {\n      input.heartbeat?.({ operation: input.operation, attempt, phase: \"request_end\" });\n      recordRequest(input.observability, input.operation, \"retryable_error\");\n      const delayMs = retryDelayMs(input.policy, attempt, null);\n      if (!canRetry(input.policy, attempt, retryDelaySpentMs, delayMs)) {\n        throw new GoogleDriveProviderTransportError();\n      }\n      recordRetry(input.observability, input.operation, \"transport\", attempt, delayMs);\n      retryDelaySpentMs += delayMs;\n      input.heartbeat?.({ operation: input.operation, attempt, phase: \"retry_delay_start\" });\n      await sleep(delayMs);\n      input.heartbeat?.({ operation: input.operation, attempt, phase: \"retry_delay_end\" });\n      continue;\n    }\n    input.heartbeat?.({ operation: input.operation, attempt, phase: \"request_end\" });\n\n    if (!isRetryableStatus(response.status)) {\n      recordRequest(\n        input.observability,\n        input.operation,\n        response.ok ? \"succeeded\" : \"terminal_error\",\n      );\n      return response;\n    }\n\n    recordRequest(input.observability, input.operation, \"retryable_error\");\n    const delayMs = retryDelayMs(\n      input.policy,\n      attempt,\n      retryAfterDelayMs(response.headers.get(\"retry-after\"), now()),\n    );\n    if (!canRetry(input.policy, attempt, retryDelaySpentMs, delayMs)) return response;\n    await response.body?.cancel().catch(() => undefined);\n    recordRetry(\n      input.observability,\n      input.operation,\n      response.status === 429 ? \"rate_limited\" : \"provider_unavailable\",\n      attempt,\n      delayMs,\n    );\n    retryDelaySpentMs += delayMs;\n    input.heartbeat?.({ operation: input.operation, attempt, phase: \"retry_delay_start\" });\n    await sleep(delayMs);\n    input.heartbeat?.({ operation: input.operation, attempt, phase: \"retry_delay_end\" });\n  }\n\n  throw new GoogleDriveProviderTransportError();\n}\n\nfunction canRetry(\n  policy: GoogleDriveProviderRetryOptions,\n  attempt: number,\n  retryDelaySpentMs: number,\n  delayMs: number,\n): boolean {\n  return attempt < policy.attempts && retryDelaySpentMs + delayMs <= policy.budgetMs;\n}\n\nfunction retryDelayMs(\n  policy: GoogleDriveProviderRetryOptions,\n  attempt: number,\n  retryAfterMs: number | null,\n): number {\n  const exponential = Math.min(\n    policy.maxDelayMs,\n    policy.initialDelayMs * 2 ** Math.max(0, attempt - 1),\n  );\n  return Math.min(policy.maxDelayMs, Math.max(exponential, retryAfterMs ?? 0));\n}\n\nfunction retryAfterDelayMs(value: string | null, nowMs: number): number | null {\n  if (!value) return null;\n  const seconds = Number(value);\n  if (Number.isFinite(seconds) && seconds >= 0) return Math.round(seconds * 1_000);\n  const timestamp = Date.parse(value);\n  return Number.isFinite(timestamp) ? Math.max(0, timestamp - nowMs) : null;\n}\n\nfunction isRetryableStatus(status: number): boolean {\n  return status === 429 || status >= 500;\n}\n\nfunction recordRequest(\n  observability: Observability,\n  operation: GoogleDriveProviderOperation,\n  outcome: \"succeeded\" | \"retryable_error\" | \"terminal_error\",\n): void {\n  observability.incrementCounter({\n    name: \"opengeni_google_drive_provider_requests_total\",\n    help: \"Google Drive provider request attempts by operation and bounded outcome.\",\n    labels: { operation, outcome },\n  });\n}\n\nfunction recordRetry(\n  observability: Observability,\n  operation: GoogleDriveProviderOperation,\n  reason: \"transport\" | \"rate_limited\" | \"provider_unavailable\",\n  attempt: number,\n  delayMs: number,\n): void {\n  observability.incrementCounter({\n    name: \"opengeni_google_drive_provider_retries_total\",\n    help: \"Bounded Google Drive provider retries by operation and reason.\",\n    labels: { operation, reason },\n  });\n  observability.observeHistogram({\n    name: \"opengeni_google_drive_provider_retry_delay_seconds\",\n    help: \"Delay applied before a bounded Google Drive provider retry.\",\n    labels: { operation, reason },\n    value: delayMs / 1_000,\n    buckets: [0.1, 0.25, 0.5, 1, 2, 5, 10, 30, 60],\n  });\n  observability.warn(\"Google Drive provider request retry scheduled\", {\n    provider: \"google_drive\",\n    operation,\n    outcome: \"retry_scheduled\",\n    reason,\n    attempt,\n    delayMs,\n  });\n}\n","import { createHash } from \"node:crypto\";\nimport type { GoogleDriveSelectedSource } from \"@opengeni/contracts/google-drive\";\nimport {\n  GOOGLE_DRIVE_FOLDER_MIME_TYPE,\n  planGoogleDriveTransfer,\n  type GoogleDriveInventoryEntry,\n  type GoogleDriveInventoryProviderItem,\n} from \"@opengeni/documents/google-drive\";\n\nconst MAX_TOKEN_CHARS = 4096;\nconst MAX_BOUNDARY_ID_CHARS = 1024;\nconst MAX_ANCESTOR_DEPTH = 100;\n\nexport type GoogleDriveSyncBudget = {\n  examinedItems: number;\n  providerRequests: number;\n  elapsedMs: number;\n};\n\nexport type GoogleDriveChangesCursor = {\n  version: 1;\n  kind: \"google_drive_changes\";\n  connectionId: string;\n  googlePermissionId: string;\n  sourceId: string;\n  driveId: string | null;\n  boundaryId: string;\n  pageToken: string;\n  cursorGeneration: number;\n  lastFullReconciliationAt: string;\n  nextFullReconciliationAt: string;\n};\n\nexport type GoogleDriveChangesCheckpoint = {\n  version: 2;\n  pageToken: string;\n  requiresFullReconciliation: boolean;\n  seenPageTokenHashes: string[];\n  budget: GoogleDriveSyncBudget;\n};\n\nexport type GoogleDriveChange = {\n  fileId: string;\n  removed: boolean;\n  file: GoogleDriveInventoryProviderItem | null;\n};\n\nexport type GoogleDriveChangesPage = {\n  changes: GoogleDriveChange[];\n  nextPageToken: string | null;\n  newStartPageToken: string | null;\n};\n\nexport type GoogleDriveChangesStopReason =\n  | \"item_limit\"\n  | \"api_request_limit\"\n  | \"elapsed_time_limit\";\n\nexport type GoogleDriveChangesDrainResult = {\n  status: \"complete\" | \"paused\";\n  stopReason: GoogleDriveChangesStopReason | null;\n  entries: GoogleDriveInventoryEntry[];\n  checkpoint: GoogleDriveChangesCheckpoint | null;\n  newStartPageToken: string | null;\n  requiresFullReconciliation: boolean;\n  providerRequests: number;\n  elapsedMs: number;\n  budget: GoogleDriveSyncBudget;\n  hardLimitReached: boolean;\n};\n\nexport function parseGoogleDriveChangesCursor(\n  value: Record<string, unknown> | null,\n  expected: {\n    connectionId: string;\n    googlePermissionId: string;\n    sourceId: string;\n    driveId: string | null;\n  },\n): GoogleDriveChangesCursor | null {\n  if (!value || value.version !== 1 || value.kind !== \"google_drive_changes\") return null;\n  if (\n    value.connectionId !== expected.connectionId ||\n    value.googlePermissionId !== expected.googlePermissionId ||\n    value.sourceId !== expected.sourceId ||\n    value.driveId !== expected.driveId ||\n    typeof value.boundaryId !== \"string\" ||\n    value.boundaryId.length < 1 ||\n    value.boundaryId.length > MAX_BOUNDARY_ID_CHARS ||\n    typeof value.pageToken !== \"string\" ||\n    value.pageToken.length < 1 ||\n    value.pageToken.length > MAX_TOKEN_CHARS ||\n    typeof value.cursorGeneration !== \"number\" ||\n    !Number.isSafeInteger(value.cursorGeneration) ||\n    value.cursorGeneration < 1 ||\n    typeof value.lastFullReconciliationAt !== \"string\" ||\n    !Number.isFinite(Date.parse(value.lastFullReconciliationAt)) ||\n    typeof value.nextFullReconciliationAt !== \"string\" ||\n    !Number.isFinite(Date.parse(value.nextFullReconciliationAt))\n  ) {\n    return null;\n  }\n  return value as GoogleDriveChangesCursor;\n}\n\nexport function buildGoogleDriveChangesCursor(input: {\n  connectionId: string;\n  googlePermissionId: string;\n  sourceId: string;\n  driveId: string | null;\n  boundaryId: string;\n  pageToken: string;\n  previousGeneration: number;\n  reconciledAt: Date;\n  fullReconciliationIntervalMs: number;\n}): GoogleDriveChangesCursor {\n  return {\n    version: 1,\n    kind: \"google_drive_changes\",\n    connectionId: input.connectionId,\n    googlePermissionId: input.googlePermissionId,\n    sourceId: input.sourceId,\n    driveId: input.driveId,\n    boundaryId: boundedBoundaryId(input.boundaryId),\n    pageToken: boundedToken(input.pageToken),\n    cursorGeneration: input.previousGeneration + 1,\n    lastFullReconciliationAt: input.reconciledAt.toISOString(),\n    nextFullReconciliationAt: new Date(\n      input.reconciledAt.getTime() + input.fullReconciliationIntervalMs,\n    ).toISOString(),\n  };\n}\n\nexport function advanceGoogleDriveChangesCursor(\n  cursor: GoogleDriveChangesCursor,\n  pageToken: string,\n): GoogleDriveChangesCursor {\n  return {\n    ...cursor,\n    pageToken: boundedToken(pageToken),\n    cursorGeneration: cursor.cursorGeneration + 1,\n  };\n}\n\nexport function googleDriveFullReconciliationDue(cursor: GoogleDriveChangesCursor, now: Date) {\n  return Date.parse(cursor.nextFullReconciliationAt) <= now.getTime();\n}\n\nexport async function resolveGoogleDriveChangesBoundaryId(input: {\n  source: GoogleDriveSelectedSource;\n  getFile: (fileId: string) => Promise<GoogleDriveInventoryProviderItem | null>;\n}): Promise<string> {\n  if (input.source.id !== \"root\" || input.source.driveId !== null) {\n    return boundedBoundaryId(input.source.id);\n  }\n  const root = await input.getFile(\"root\");\n  if (!root || root.mimeType !== GOOGLE_DRIVE_FOLDER_MIME_TYPE || root.trashed) {\n    throw new GoogleDriveChangesProtocolError(\"google_drive_root_boundary_invalid\");\n  }\n  return boundedBoundaryId(root.id);\n}\n\nexport function parseGoogleDriveChangesCheckpoint(\n  value: unknown,\n  limits: { maxItems: number; maxProviderRequests: number; maxElapsedMs: number },\n): GoogleDriveChangesCheckpoint | null {\n  try {\n    return validatedCheckpoint(value, limits);\n  } catch {\n    return null;\n  }\n}\n\nexport async function drainGoogleDriveChanges(input: {\n  source: GoogleDriveSelectedSource;\n  cursor: GoogleDriveChangesCursor;\n  checkpoint: GoogleDriveChangesCheckpoint | null;\n  maxItems: number;\n  maxProviderRequests: number;\n  maxElapsedMs: number;\n  maxInvocationElapsedMs: number;\n  maxFileBytes: number;\n  listChanges: (pageToken: string, pageSize: number) => Promise<GoogleDriveChangesPage>;\n  getFile: (fileId: string) => Promise<GoogleDriveInventoryProviderItem | null>;\n  observedExternalObjectIds: (ids: string[]) => Promise<Set<string>>;\n  now?: () => number;\n}): Promise<GoogleDriveChangesDrainResult> {\n  const now = input.now ?? Date.now;\n  const startedAt = now();\n  const checkpoint = input.checkpoint ? validatedCheckpoint(input.checkpoint, input) : null;\n  let pageToken = boundedToken(checkpoint?.pageToken ?? input.cursor.pageToken);\n  let requiresFullReconciliation = checkpoint?.requiresFullReconciliation ?? false;\n  const seenPageTokenHashes = new Set(checkpoint?.seenPageTokenHashes ?? []);\n  const initialBudget = checkpoint?.budget ?? emptyBudget();\n  const budget = { ...initialBudget };\n  const entries = new Map<string, GoogleDriveInventoryEntry>();\n\n  while (true) {\n    const invocationElapsedMs = Math.max(0, now() - startedAt);\n    budget.elapsedMs = initialBudget.elapsedMs + invocationElapsedMs;\n    const stopReason = limitReason(budget, input, invocationElapsedMs);\n    if (stopReason) {\n      return {\n        status: \"paused\",\n        stopReason,\n        entries: [...entries.values()],\n        checkpoint: {\n          version: 2,\n          pageToken,\n          requiresFullReconciliation,\n          seenPageTokenHashes: [...seenPageTokenHashes],\n          budget: { ...budget },\n        },\n        newStartPageToken: null,\n        requiresFullReconciliation,\n        providerRequests: budget.providerRequests,\n        elapsedMs: budget.elapsedMs,\n        budget: { ...budget },\n        hardLimitReached:\n          stopReason !== \"elapsed_time_limit\" || budget.elapsedMs >= input.maxElapsedMs,\n      };\n    }\n\n    const pageTokenHash = createHash(\"sha256\").update(pageToken).digest(\"hex\");\n    if (seenPageTokenHashes.has(pageTokenHash)) {\n      throw new GoogleDriveChangesProtocolError(\"google_drive_changes_page_token_cycle\");\n    }\n    seenPageTokenHashes.add(pageTokenHash);\n    budget.providerRequests += 1;\n    const pageSize = Math.min(100, input.maxItems - budget.examinedItems);\n    let page: GoogleDriveChangesPage;\n    try {\n      page = await input.listChanges(pageToken, pageSize);\n    } catch (error) {\n      budget.elapsedMs = initialBudget.elapsedMs + Math.max(0, now() - startedAt);\n      if (error instanceof GoogleDriveCursorInvalidError) error.budget = { ...budget };\n      throw error;\n    }\n    if (page.changes.length > pageSize) {\n      throw new GoogleDriveChangesProtocolError(\"google_drive_changes_page_exceeds_item_budget\");\n    }\n    budget.examinedItems += page.changes.length;\n\n    const repairCandidates = new Set<string>();\n    for (const change of page.changes) {\n      if (change.removed || !change.file || change.file.trashed) {\n        repairCandidates.add(change.fileId);\n        continue;\n      }\n      const membership = await isInsideSource({\n        file: change.file,\n        boundaryId: input.cursor.boundaryId,\n        getFile: async (fileId) => {\n          const ancestryElapsedMs = Math.max(0, now() - startedAt);\n          budget.elapsedMs = initialBudget.elapsedMs + ancestryElapsedMs;\n          if (\n            budget.providerRequests >= input.maxProviderRequests ||\n            budget.elapsedMs >= input.maxElapsedMs ||\n            ancestryElapsedMs >= input.maxInvocationElapsedMs\n          ) {\n            return null;\n          }\n          budget.providerRequests += 1;\n          const parent = await input.getFile(fileId);\n          budget.elapsedMs = initialBudget.elapsedMs + Math.max(0, now() - startedAt);\n          return parent;\n        },\n      });\n      if (change.file.mimeType === GOOGLE_DRIVE_FOLDER_MIME_TYPE) {\n        entries.delete(change.fileId);\n        if (membership !== \"outside\") requiresFullReconciliation = true;\n        else repairCandidates.add(change.fileId);\n        continue;\n      }\n      if (membership === \"inside\") {\n        entries.set(change.fileId, toInventoryEntry(change.file, input.source, input.maxFileBytes));\n      } else if (membership === \"unknown\") {\n        entries.delete(change.fileId);\n        requiresFullReconciliation = true;\n      } else {\n        repairCandidates.add(change.fileId);\n      }\n    }\n    if (repairCandidates.size > 0) {\n      for (const fileId of repairCandidates) {\n        if (entries.delete(fileId)) requiresFullReconciliation = true;\n      }\n      const observed = await input.observedExternalObjectIds([...repairCandidates]);\n      if (observed.size > 0) requiresFullReconciliation = true;\n    }\n    if (page.nextPageToken) {\n      pageToken = boundedToken(page.nextPageToken);\n      continue;\n    }\n    if (!page.newStartPageToken) {\n      throw new GoogleDriveChangesProtocolError(\"google_drive_changes_terminal_token_missing\");\n    }\n    budget.elapsedMs = initialBudget.elapsedMs + Math.max(0, now() - startedAt);\n    return {\n      status: \"complete\",\n      stopReason: null,\n      entries: [...entries.values()],\n      checkpoint: null,\n      newStartPageToken: boundedToken(page.newStartPageToken),\n      requiresFullReconciliation,\n      providerRequests: budget.providerRequests,\n      elapsedMs: budget.elapsedMs,\n      budget: { ...budget },\n      hardLimitReached: false,\n    };\n  }\n}\n\nasync function isInsideSource(input: {\n  file: GoogleDriveInventoryProviderItem;\n  boundaryId: string;\n  getFile: (fileId: string) => Promise<GoogleDriveInventoryProviderItem | null>;\n}): Promise<\"inside\" | \"outside\" | \"unknown\"> {\n  if (input.file.id === input.boundaryId) return \"inside\";\n  let parents = input.file.parents;\n  const seen = new Set<string>([input.file.id]);\n  for (let depth = 0; depth < MAX_ANCESTOR_DEPTH; depth += 1) {\n    if (parents.includes(input.boundaryId)) return \"inside\";\n    const next = parents.find((parent) => !seen.has(parent));\n    if (!next) return \"outside\";\n    seen.add(next);\n    const parent = await input.getFile(next);\n    if (!parent) return \"unknown\";\n    parents = parent.parents;\n  }\n  return \"unknown\";\n}\n\nfunction toInventoryEntry(\n  file: GoogleDriveInventoryProviderItem,\n  source: GoogleDriveSelectedSource,\n  maxFileBytes: number,\n): GoogleDriveInventoryEntry {\n  return {\n    externalObjectId: file.id,\n    externalVersionId: file.version ?? file.modifiedTime ?? file.md5Checksum,\n    sourceId: source.id,\n    parentFolderId: file.parents[0] ?? source.id,\n    driveId: file.driveId ?? source.driveId,\n    title: file.name,\n    mimeType: file.mimeType,\n    modifiedTime: file.modifiedTime,\n    createdTime: file.createdTime,\n    sourceUri:\n      file.webViewLink ?? `https://drive.google.com/open?id=${encodeURIComponent(file.id)}`,\n    transfer: planGoogleDriveTransfer(file, maxFileBytes),\n  };\n}\n\nfunction validatedCheckpoint(\n  value: unknown,\n  limits: { maxItems: number; maxProviderRequests: number; maxElapsedMs: number },\n): GoogleDriveChangesCheckpoint {\n  if (!value || typeof value !== \"object\") {\n    throw new Error(\"google_drive_changes_checkpoint_invalid\");\n  }\n  const checkpoint = value as Record<string, unknown>;\n  const budget = checkpoint.budget;\n  if (\n    checkpoint.version !== 2 ||\n    typeof checkpoint.requiresFullReconciliation !== \"boolean\" ||\n    !Array.isArray(checkpoint.seenPageTokenHashes) ||\n    checkpoint.seenPageTokenHashes.some((hash) => !/^[a-f0-9]{64}$/.test(hash)) ||\n    new Set(checkpoint.seenPageTokenHashes).size !== checkpoint.seenPageTokenHashes.length ||\n    checkpoint.seenPageTokenHashes.length > limits.maxProviderRequests ||\n    !budget ||\n    typeof budget !== \"object\"\n  ) {\n    throw new Error(\"google_drive_changes_checkpoint_invalid\");\n  }\n  if (typeof checkpoint.pageToken !== \"string\") {\n    throw new Error(\"google_drive_changes_checkpoint_invalid\");\n  }\n  boundedToken(checkpoint.pageToken);\n  const budgetRow = budget as Record<string, unknown>;\n  for (const [key, maximum] of [\n    [\"examinedItems\", limits.maxItems],\n    [\"providerRequests\", limits.maxProviderRequests],\n    [\"elapsedMs\", limits.maxElapsedMs],\n  ] as const) {\n    const budgetValue = budgetRow[key];\n    if (\n      !Number.isSafeInteger(budgetValue) ||\n      Number(budgetValue) < 0 ||\n      Number(budgetValue) > maximum\n    ) {\n      throw new Error(\"google_drive_changes_checkpoint_budget_invalid\");\n    }\n  }\n  if (checkpoint.seenPageTokenHashes.length > Number(budgetRow.providerRequests)) {\n    throw new Error(\"google_drive_changes_checkpoint_request_history_invalid\");\n  }\n  return value as GoogleDriveChangesCheckpoint;\n}\n\nfunction limitReason(\n  budget: GoogleDriveSyncBudget,\n  input: {\n    maxItems: number;\n    maxProviderRequests: number;\n    maxElapsedMs: number;\n    maxInvocationElapsedMs: number;\n  },\n  invocationElapsedMs: number,\n): GoogleDriveChangesStopReason | null {\n  if (budget.examinedItems >= input.maxItems) return \"item_limit\";\n  if (budget.providerRequests >= input.maxProviderRequests) return \"api_request_limit\";\n  if (\n    budget.elapsedMs >= input.maxElapsedMs ||\n    invocationElapsedMs >= input.maxInvocationElapsedMs\n  ) {\n    return \"elapsed_time_limit\";\n  }\n  return null;\n}\n\nfunction emptyBudget(): GoogleDriveSyncBudget {\n  return { examinedItems: 0, providerRequests: 0, elapsedMs: 0 };\n}\n\nfunction boundedToken(value: string): string {\n  if (value.length < 1 || value.length > MAX_TOKEN_CHARS) {\n    throw new Error(\"google_drive_changes_token_invalid\");\n  }\n  return value;\n}\n\nfunction boundedBoundaryId(value: string): string {\n  if (value.length < 1 || value.length > MAX_BOUNDARY_ID_CHARS) {\n    throw new Error(\"google_drive_changes_boundary_invalid\");\n  }\n  return value;\n}\n\nexport class GoogleDriveCursorInvalidError extends Error {\n  budget: GoogleDriveSyncBudget | null = null;\n\n  constructor() {\n    super(\"google_drive_changes_cursor_invalid\");\n    this.name = \"GoogleDriveCursorInvalidError\";\n  }\n}\n\nexport class GoogleDriveChangesProtocolError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"GoogleDriveChangesProtocolError\";\n  }\n}\n","import { subscriptionCoreProviderIds } from \"@opengeni/db\";\nimport { CODEX_CORE_WAIT_BINDING, type CoreWaitBinding } from \"./subscription-core-codex-waits\";\nimport { CLAUDE_CORE_WAIT_BINDING } from \"./subscription-core-claude-waits\";\nimport { XAI_CORE_WAIT_BINDING } from \"./subscription-core-xai-waits\";\n\n/** Control-worker adapters only; never import the turn runtime to wake work. */\nexport function subscriptionCoreWaitBindings(): CoreWaitBinding[] {\n  const registered = new Set(subscriptionCoreProviderIds());\n  return [CODEX_CORE_WAIT_BINDING, CLAUDE_CORE_WAIT_BINDING, XAI_CORE_WAIT_BINDING].filter(\n    (binding) => registered.has(binding.provider),\n  );\n}\n","/**\n * Durable capacity waits and wakes for Codex chat turns on the shared\n * subscription core (M3 PR 2a, inventory EP-T09/T10). Reached only for an\n * account whose Codex cutover row is enabled; the legacy Codex waiter path is\n * untouched. Workflow activity names, signal names and argument shapes stay\n * those of the legacy Codex wait: the activities look a waiter id up in the\n * core table first and fall back to the legacy table.\n *\n * The wait, wake and reconcile steps are provider-neutral (SuperGrok track\n * X1b): a `CoreWaitBinding` supplies one provider's database entry points.\n * The Codex-named functions are Codex's bindings and are unchanged.\n */\nimport {\n  abandonSubscriptionCapacityWakeDelivery,\n  armSubscriptionCoreCodexCapacityWait,\n  claimSubscriptionCapacityWakeDeliveries,\n  evaluateSubscriptionCoreCodexPlacement,\n  evaluateSubscriptionCorePlacementWithFailover,\n  getSession,\n  getSessionTurn,\n  getSubscriptionCoreCodexCapacityWaitById,\n  markSubscriptionCapacityWakeDelivered,\n  readSubscriptionCoreCodexTurnModel,\n  readSubscriptionCoreTurnIdentity,\n  reconcileSubscriptionCoreCodexCapacityWait,\n  recoverSubscriptionCoreCodexConnectionHealth,\n  retrySubscriptionCapacityWakeDelivery,\n  subscriptionCoreCodexCapacityWaitRef,\n  subscriptionCoreProvider,\n  wakeSubscriptionCoreCodexCapacityWaiters,\n  withSubscriptionCapacityWakeOutboxScope,\n  withSubscriptionCoreAcceptedTurn,\n  type Database,\n  type SubscriptionCoreCodexCapacityWait,\n  type SubscriptionCoreCodexWaitEvaluation,\n  type SubscriptionCoreCodexWakeScope,\n  type SubscriptionCoreCodexPlacementEvaluation,\n  type SubscriptionCoreTurnIdentity,\n  type SubscriptionCoreWaiterProvider,\n} from \"@opengeni/db\";\nimport { publishDurableSessionEvents, type EventBus } from \"@opengeni/events\";\nimport type { Settings } from \"@opengeni/config\";\nimport { readTurnExecutionPolicyV1 } from \"@opengeni/contracts\";\nimport { servingCatalogForBlockedTurn } from \"./agent-turn/subscription-serving-catalog\";\nimport { refreshExhaustedCodexCoreQuota } from \"./subscription-core-codex-quota\";\nimport { subscriptionCoreWaitBindings } from \"./subscription-core-wait-bindings\";\nimport type { CodexCapacityWaitRef, SignalCodexCapacityWorkflow } from \"./types\";\nimport { workflowIdForSession } from \"./common\";\n\n/** Typed wake signal attempts before the outbox gives the fast path up. */\nexport const CORE_CODEX_WAKE_DELIVERY_MAX_ATTEMPTS = 8;\nconst CORE_CODEX_WAKE_DELIVERY_BATCH = 100;\nconst CORE_CODEX_WAKE_CLAIM_TTL_MS = 60_000;\n\n/** Exponential retry for one typed wake signal: 1 s doubling to 5 minutes. */\nexport function coreCodexWakeRetryDelayMs(attemptCount: number): number {\n  const exponent = Math.max(0, Math.min(attemptCount - 1, 16));\n  return Math.min(1_000 * 2 ** exponent, 5 * 60_000);\n}\n\nexport type CoreCodexWakeServices = {\n  db: Database;\n  settings?: Settings;\n  signalCodexCapacityWorkflow?: SignalCodexCapacityWorkflow | null | undefined;\n};\n\n/** One provider's database entry points for its core waiters. */\nexport type CoreWaitBinding = {\n  provider: SubscriptionCoreWaiterProvider;\n  arm: typeof armSubscriptionCoreCodexCapacityWait;\n  getWaiterById: (\n    db: Database,\n    input: { workspaceId: string; sessionId: string; waiterId: string },\n  ) => Promise<SubscriptionCoreCodexCapacityWait | null>;\n  readTurnModel: typeof readSubscriptionCoreCodexTurnModel;\n  recoverHealth: (db: Database, identity: SubscriptionCoreTurnIdentity) => Promise<number>;\n  evaluatePlacement: (\n    db: Database,\n    request: {\n      identity: SubscriptionCoreTurnIdentity;\n      productModelId: string;\n      reasoningLevel: string;\n    },\n  ) => Promise<SubscriptionCoreCodexPlacementEvaluation>;\n  wakeWaiters: (\n    db: Database,\n    input: { accountId: string; reason: string; workspaceIds?: readonly string[] },\n  ) => Promise<SubscriptionCoreCodexWakeScope[]>;\n  reconcileWaiter: typeof reconcileSubscriptionCoreCodexCapacityWait;\n  /**\n   * Re-read the provider's usage before a timed or woken reconcile evaluates\n   * placement, for a provider whose usage read can end an exhaustion before\n   * its stored reset (its waiters then recheck on a bounded backoff), under\n   * the parked turn's exact accepted identity (the same read placement\n   * evaluation uses; never called without one). Best effort: a failure\n   * leaves the stored state, and placement decides.\n   */\n  refreshBeforeReconcile?: (\n    services: { db: Database; settings: Settings },\n    turn: SubscriptionCoreTurnIdentity,\n  ) => Promise<void>;\n};\n\n/** Codex's binding (each call resolves the Codex-named entry point at call time). */\nexport const CODEX_CORE_WAIT_BINDING: CoreWaitBinding = {\n  provider: \"codex\",\n  arm: (db, input) => armSubscriptionCoreCodexCapacityWait(db, input),\n  getWaiterById: (db, input) => getSubscriptionCoreCodexCapacityWaitById(db, input),\n  readTurnModel: (db, input) => readSubscriptionCoreCodexTurnModel(db, input),\n  recoverHealth: (db, identity) => recoverSubscriptionCoreCodexConnectionHealth(db, identity),\n  evaluatePlacement: (db, request) => evaluateSubscriptionCoreCodexPlacement(db, request),\n  wakeWaiters: (db, input) => wakeSubscriptionCoreCodexCapacityWaiters(db, input),\n  reconcileWaiter: (db, input) => reconcileSubscriptionCoreCodexCapacityWait(db, input),\n  // OpenAI can reset a Codex limit before the reset it reported, so a parked\n  // turn re-reads `/wham/usage` (rate-limited per connection) at each bounded\n  // recheck instead of sleeping until a stale reset.\n  refreshBeforeReconcile: ({ db, settings }, turn) =>\n    refreshExhaustedCodexCoreQuota({\n      db,\n      settings,\n      accountId: turn.accountId,\n      workspaceId: turn.workspaceId,\n      personalTurn: turn,\n    }),\n};\n\nexport type CoreCodexWakeDeliveryResult = {\n  claimed: number;\n  delivered: number;\n  retried: number;\n  abandoned: number;\n};\n\n/**\n * Drain one workspace's due typed wake obligations: claim (fenced by claim\n * generation), signal `codexCapacityChanged` with the waiter's wake revision,\n * then mark delivered; a failed signal is retried with bounded backoff and\n * given up after a fixed number of attempts. Idempotent across a crash\n * between the database wake and the signal: an unacknowledged claim becomes\n * due again when its claim expires, and the generic session workflow wake\n * committed with the same database wake still reaches the workflow.\n */\nexport async function deliverSubscriptionCoreCodexWakes(\n  services: CoreCodexWakeServices,\n  scope: SubscriptionCoreCodexWakeScope,\n): Promise<CoreCodexWakeDeliveryResult> {\n  const result: CoreCodexWakeDeliveryResult = {\n    claimed: 0,\n    delivered: 0,\n    retried: 0,\n    abandoned: 0,\n  };\n  const signal = services.signalCodexCapacityWorkflow;\n  // A host without a typed signaler claims nothing: the rows stay pending for\n  // a worker that can signal (the generic durable wake committed with each\n  // row still reaches the workflow meanwhile).\n  if (!signal) return result;\n  const deliveries = await withSubscriptionCapacityWakeOutboxScope(services.db, scope, (tx) =>\n    claimSubscriptionCapacityWakeDeliveries(tx, {\n      limit: CORE_CODEX_WAKE_DELIVERY_BATCH,\n      claimTtlMs: CORE_CODEX_WAKE_CLAIM_TTL_MS,\n    }),\n  );\n  result.claimed = deliveries.length;\n  for (const delivery of deliveries) {\n    try {\n      await signal({\n        accountId: delivery.accountId,\n        workspaceId: delivery.workspaceId,\n        sessionId: delivery.sessionId,\n        workflowId: workflowIdForSession(delivery.sessionId),\n        wakeRevision: delivery.wakeRevision,\n      });\n      await withSubscriptionCapacityWakeOutboxScope(services.db, scope, (tx) =>\n        markSubscriptionCapacityWakeDelivered(tx, delivery),\n      );\n      result.delivered += 1;\n    } catch {\n      const exhausted = delivery.attemptCount >= CORE_CODEX_WAKE_DELIVERY_MAX_ATTEMPTS;\n      await withSubscriptionCapacityWakeOutboxScope(services.db, scope, (tx) =>\n        exhausted\n          ? abandonSubscriptionCapacityWakeDelivery(tx, {\n              id: delivery.id,\n              claimGeneration: delivery.claimGeneration,\n              failureCode: \"signal_attempts_exhausted\",\n            })\n          : retrySubscriptionCapacityWakeDelivery(tx, {\n              id: delivery.id,\n              claimGeneration: delivery.claimGeneration,\n              retryInMs: coreCodexWakeRetryDelayMs(delivery.attemptCount),\n              failureCode: \"signal_failed\",\n            }),\n      ).catch(() => false);\n      if (exhausted) result.abandoned += 1;\n      else result.retried += 1;\n    }\n  }\n  return result;\n}\n\n/**\n * A capacity change for the account's Codex pool: wake every waiting core\n * waiter (database first, outbox and generic wake in the same commit), then\n * deliver the typed signals. Best effort after the commit; never throws.\n */\nexport async function wakeSubscriptionCoreCodexWaitersAndDeliver(\n  services: CoreCodexWakeServices,\n  input: { accountId: string; reason: string; workspaceIds?: readonly string[] },\n): Promise<SubscriptionCoreCodexWakeScope[]> {\n  return await wakeSubscriptionCoreWaitersAndDeliver(services, CODEX_CORE_WAIT_BINDING, input);\n}\n\n/** The same wake for any provider's core waiters. */\nexport async function wakeSubscriptionCoreWaitersAndDeliver(\n  services: CoreCodexWakeServices,\n  binding: Pick<CoreWaitBinding, \"wakeWaiters\">,\n  input: { accountId: string; reason: string; workspaceIds?: readonly string[] },\n): Promise<SubscriptionCoreCodexWakeScope[]> {\n  let scopes: SubscriptionCoreCodexWakeScope[] = [];\n  try {\n    scopes = await binding.wakeWaiters(services.db, input);\n  } catch {\n    return [];\n  }\n  await Promise.allSettled(\n    scopes.map((scope) => deliverSubscriptionCoreCodexWakes(services, scope)),\n  );\n  return scopes;\n}\n\n/**\n * What core placement says about a blocked turn now: run, wait (with its\n * reason, earliest reset and quarantine end), revoked (the exact accepted\n * turn no longer authorizes core use) or paused (the cutover is switched off;\n * the work stays parked). Due quarantines are returned to service first, and\n * a recovery wakes the account's other waiters.\n */\nexport async function evaluateCoreCodexBlockedTurn(\n  services: CoreCodexWakeServices,\n  input: { accountId: string; workspaceId: string; sessionId: string; turnId: string },\n): Promise<SubscriptionCoreCodexWaitEvaluation> {\n  return await evaluateCoreBlockedTurn(services, CODEX_CORE_WAIT_BINDING, input);\n}\n\n/** The same evaluation for any provider's blocked turn. */\nexport async function evaluateCoreBlockedTurn(\n  services: CoreCodexWakeServices,\n  binding: CoreWaitBinding,\n  input: { accountId: string; workspaceId: string; sessionId: string; turnId: string },\n): Promise<SubscriptionCoreCodexWaitEvaluation> {\n  const identity = await readSubscriptionCoreTurnIdentity(services.db, input);\n  if (!identity) return { kind: \"revoked\" };\n  const model = await binding.readTurnModel(services.db, input);\n  if (!model) return { kind: \"revoked\" };\n  await recoverCoreHealthAndWake(services, binding, identity);\n  const failover = await evaluateFailoverBlockedTurn(services, binding, identity, model);\n  if (failover) return failover;\n  const evaluation = await binding.evaluatePlacement(services.db, {\n    identity,\n    productModelId: model.productModelId,\n    reasoningLevel: model.reasoningLevel,\n  });\n  switch (evaluation.kind) {\n    case \"not_visible\":\n      return { kind: \"revoked\" };\n    case \"cutover_not_enabled\":\n      return { kind: \"paused\" };\n    case \"run\":\n      return { kind: \"run\" };\n    case \"wait\":\n      return {\n        kind: \"wait\",\n        waitReason: evaluation.reason,\n        earliestResetAt: evaluation.earliestResetAt,\n        healthRetryAt: evaluation.healthRetryAt,\n      };\n  }\n}\n\n/** Fresh accepted policy + current readiness/settings decide the whole pool.\n * Stored waiter candidates are deliberately not an input to this evaluator.\n * A wake grants no credentials: the resumed attempt still claims and leases.\n */\nasync function evaluateFailoverBlockedTurn(\n  services: CoreCodexWakeServices,\n  home: CoreWaitBinding,\n  identity: SubscriptionCoreTurnIdentity,\n  model: { productModelId: string; reasoningLevel: string },\n): Promise<SubscriptionCoreCodexWaitEvaluation | null> {\n  const settings = services.settings;\n  if (!settings?.subscriptionCrossProviderFailoverEnabled) return null;\n  const context = await withSubscriptionCoreAcceptedTurn(services.db, identity, async (tx) => {\n    const session = await getSession(tx, identity.workspaceId, identity.sessionId);\n    const turn = await getSessionTurn(tx, identity.workspaceId, identity.turnId);\n    if (!session || !turn || turn.sessionId !== identity.sessionId) return null;\n    const accepted = readTurnExecutionPolicyV1(turn.metadata);\n    return (\n      session.codexCompactionMode === \"portable\" &&\n      turn.source !== \"compaction\" &&\n      accepted.kind === \"valid\" &&\n      accepted.policy.credentialRestriction === undefined &&\n      accepted.policy.productModelId === model.productModelId\n    );\n  });\n  if (context.status !== \"completed\" || context.value === null) return { kind: \"revoked\" };\n  if (!context.value) return null;\n  const bindings = subscriptionCoreWaitBindings();\n  const models = await servingCatalogForBlockedTurn(\n    services.db,\n    settings,\n    identity,\n    model.productModelId,\n    bindings.map((binding) => binding.provider),\n  );\n  if (\n    !models.some(\n      (candidate) => candidate.id === model.productModelId && candidate.provider === home.provider,\n    )\n  )\n    return null;\n  const request = { identity, ...model, models, crossProviderFailoverEnabled: true };\n  let evaluation = await evaluateSubscriptionCorePlacementWithFailover(\n    services.db,\n    subscriptionCoreProvider(home.provider),\n    request,\n  );\n  // Only candidates derived by the live authority/policy evaluator can have\n  // their health or usage refreshed. Personal billing keeps the same accepted\n  // identity, including shared-session and frozen-background restrictions.\n  const candidates = new Set(evaluation.candidateProviders ?? []);\n  for (const binding of bindings) {\n    if (binding.provider === home.provider || !candidates.has(binding.provider)) continue;\n    await recoverCoreHealthAndWake(services, binding, identity);\n    await binding\n      .refreshBeforeReconcile?.({ db: services.db, settings }, identity)\n      .catch(() => undefined);\n  }\n  if ([...candidates].some((provider) => provider !== home.provider)) {\n    evaluation = await evaluateSubscriptionCorePlacementWithFailover(\n      services.db,\n      subscriptionCoreProvider(home.provider),\n      request,\n    );\n  }\n  switch (evaluation.kind) {\n    case \"not_visible\":\n      return { kind: \"revoked\" };\n    case \"cutover_not_enabled\":\n      return { kind: \"paused\" };\n    case \"run\":\n      return { kind: \"run\", candidateProviders: evaluation.candidateProviders ?? [] };\n    case \"wait\":\n      // Leave the capacity wait once to surface the actionable configuration\n      // failure at claim. This is not a capacity/authority grant, and does not\n      // fabricate a provider or strand work behind an unrelated quota reset.\n      if (evaluation.reason === \"failover_no_model_mapping\")\n        return { kind: \"run\", candidateProviders: [] };\n      return {\n        kind: \"wait\",\n        waitReason: evaluation.reason,\n        earliestResetAt: evaluation.earliestResetAt,\n        healthRetryAt: evaluation.healthRetryAt,\n        candidateProviders: evaluation.candidateProviders ?? [],\n      };\n  }\n}\n\n/** Return due quarantines to service under this accepted turn; wake others if any recovered. */\nexport async function recoverCoreCodexHealthAndWake(\n  services: CoreCodexWakeServices,\n  identity: SubscriptionCoreTurnIdentity,\n): Promise<number> {\n  return await recoverCoreHealthAndWake(services, CODEX_CORE_WAIT_BINDING, identity);\n}\n\n/** The same recovery for any provider's connections. */\nexport async function recoverCoreHealthAndWake(\n  services: CoreCodexWakeServices,\n  binding: Pick<CoreWaitBinding, \"recoverHealth\" | \"wakeWaiters\">,\n  identity: SubscriptionCoreTurnIdentity,\n): Promise<number> {\n  const recovered = await binding.recoverHealth(services.db, identity).catch(() => 0);\n  if (recovered > 0) {\n    await wakeSubscriptionCoreWaitersAndDeliver(services, binding, {\n      accountId: identity.accountId,\n      reason: \"connection_health_recovered\",\n    });\n  }\n  return recovered;\n}\n\nexport type CoreCodexReconcileResult =\n  | ({ action: \"waiting\" } & CodexCapacityWaitRef)\n  | { action: \"resumed\" | \"paused\" | \"superseded\" | \"stale\" };\n\n/**\n * Reconcile one core waiter for the workflow (timer, signal, queue wake or\n * recovery). Returns null when the waiter id is not a core waiter, so the\n * caller falls back to the legacy Codex waiter with the same reference.\n */\nexport async function reconcileCoreCodexCapacityWait(\n  services: CoreCodexWakeServices & { bus: EventBus },\n  input: {\n    accountId: string;\n    workspaceId: string;\n    sessionId: string;\n    waiterId: string;\n    generation: number;\n  },\n): Promise<CoreCodexReconcileResult | null> {\n  return await reconcileCoreCapacityWait(services, CODEX_CORE_WAIT_BINDING, input);\n}\n\n/**\n * The same reconcile for any provider: the waiter is looked up by the exact\n * id and generation the workflow recorded. Null when the id names no core\n * waiter of the binding's provider.\n */\nexport async function reconcileCoreCapacityWait(\n  services: CoreCodexWakeServices & {\n    bus: EventBus;\n    /** Present on the workflow's reconcile; the in-turn arm has just placed. */\n    settings?: Settings;\n  },\n  binding: CoreWaitBinding,\n  input: {\n    accountId: string;\n    workspaceId: string;\n    sessionId: string;\n    waiterId: string;\n    generation: number;\n  },\n): Promise<CoreCodexReconcileResult | null> {\n  let waiter = await binding.getWaiterById(services.db, input);\n  if (!waiter) return null;\n  // Repair: drain this workspace's typed wakes that a crash left behind.\n  await deliverSubscriptionCoreCodexWakes(services, {\n    accountId: input.accountId,\n    workspaceId: input.workspaceId,\n  }).catch(() => undefined);\n  if (waiter.accountId !== input.accountId || waiter.generation !== input.generation) {\n    return { action: \"stale\" };\n  }\n  if (binding.refreshBeforeReconcile && services.settings && waiter.blockedTurnLive !== false) {\n    const turn = await readSubscriptionCoreTurnIdentity(services.db, {\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      sessionId: input.sessionId,\n      turnId: waiter.blockedTurnId,\n    });\n    // Without the exact accepted identity the evaluation below revokes.\n    if (turn) {\n      await binding\n        .refreshBeforeReconcile({ db: services.db, settings: services.settings }, turn)\n        .catch(() => undefined);\n    }\n    // A recovery the re-read found woke this waiter: evaluate at that revision.\n    waiter = await binding.getWaiterById(services.db, input);\n    if (!waiter || waiter.accountId !== input.accountId || waiter.generation !== input.generation)\n      return { action: \"stale\" };\n  }\n  // A row left behind by a Steer, Cancel or other transition is superseded by\n  // the reconcile without placing (a non-run evaluation never resumes).\n  const evaluation: SubscriptionCoreCodexWaitEvaluation =\n    waiter.blockedTurnLive === false\n      ? { kind: \"paused\" }\n      : await evaluateCoreBlockedTurn(services, binding, {\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          sessionId: input.sessionId,\n          turnId: waiter.blockedTurnId,\n        });\n  const result = await binding.reconcileWaiter(services.db, {\n    ...input,\n    evaluatedWakeRevision: waiter.wakeRevision,\n    evaluation,\n  });\n  await publishDurableSessionEvents(\n    services.bus,\n    input.workspaceId,\n    input.sessionId,\n    result.events,\n  );\n  if (result.action === \"waiting\") {\n    return { action: \"waiting\", ...subscriptionCoreCodexCapacityWaitRef(result.waiter) };\n  }\n  return { action: result.action };\n}\n","import {\n  configuredModels,\n  withCodexCatalogProvider,\n  withXaiSubscriptionCatalogProvider,\n  type Settings,\n} from \"@opengeni/config\";\nimport { resolveWorkspaceCatalogSettings } from \"@opengeni/core\";\nimport {\n  subscriptionCoreProvider,\n  type Database,\n  type SubscriptionCoreFailoverModel,\n  type SubscriptionCoreTurnIdentity,\n} from \"@opengeni/db\";\nimport { subscriptionCoreModelPolicyProviderIds } from \"@opengeni/subscriptions\";\n\n/** Shared by live placement and durable-wait evaluation, without importing\n * provider runtime hooks into the control worker. Catalog entries are not\n * authority: the core rechecks every candidate against accepted and live scope.\n */\nexport function servingCatalog(\n  settings: Settings,\n  providerIds: readonly string[],\n): SubscriptionCoreFailoverModel[] {\n  return configuredModels(settings).flatMap((model) => {\n    if (model.billing.metering !== \"external\" || model.credentialSource.kind === \"deployment\")\n      return [];\n    const matches = providerIds.filter((id) =>\n      subscriptionCoreModelPolicyProviderIds(\n        subscriptionCoreProvider(id).adapter,\n        model.id,\n      ).includes(model.providerId),\n    );\n    if (matches.length > 1) throw new Error(\"Ambiguous serving catalog provider\");\n    const provider = matches[0];\n    return provider\n      ? [\n          {\n            id: model.id,\n            provider,\n            upstreamModelId: model.upstreamModelId,\n            reasoningLevels: model.capabilities.reasoning.efforts.length\n              ? [...model.capabilities.reasoning.efforts]\n              : [\"none\"],\n          },\n        ]\n      : [];\n  });\n}\n\n/** The control worker has raw deployment settings, not claim's credential\n * overlays. Resolve the same current model definitions without loading keys\n * or filtering exhausted accounts out of the catalog. Core placement owns\n * authority/readiness, independently of catalog membership.\n */\nexport async function servingCatalogForBlockedTurn(\n  db: Database,\n  settings: Settings,\n  identity: SubscriptionCoreTurnIdentity,\n  productModelId: string,\n  providerIds: readonly string[],\n): Promise<SubscriptionCoreFailoverModel[]> {\n  const resolved = await resolveWorkspaceCatalogSettings(db, settings, {\n    accountId: identity.accountId,\n    workspaceId: identity.workspaceId,\n    retainedProductModelId: productModelId,\n  });\n  let catalog = resolved.settings;\n  if (catalog.codexSubscriptionEnabled) catalog = withCodexCatalogProvider(catalog);\n  if (catalog.supergrokSubscriptionEnabled) catalog = withXaiSubscriptionCatalogProvider(catalog);\n  return servingCatalog(catalog, providerIds);\n}\n","import {\n  subscriptionCoreProvider,\n  type Database,\n  type SubscriptionCoreTurnIdentity,\n} from \"@opengeni/db\";\nimport type { Settings } from \"@opengeni/config\";\nimport {\n  CORE_USAGE_PROBE_ATTEMPT_INTERVAL_MS,\n  CORE_USAGE_RECHECK_MIN_INTERVAL_MS,\n  refreshBlockedCoreQuotaBeforeReconcile,\n  resetCoreUsageProbeAttempts,\n} from \"./subscription-core-usage-recheck\";\n\n/** Codex's per-connection re-read interval (the provider-neutral one). */\nexport const CODEX_CORE_USAGE_RECHECK_MIN_INTERVAL_MS = CORE_USAGE_RECHECK_MIN_INTERVAL_MS;\n\n/** Codex's per-scope probe attempt interval (the provider-neutral one). */\nexport const CODEX_CORE_USAGE_PROBE_ATTEMPT_INTERVAL_MS = CORE_USAGE_PROBE_ATTEMPT_INTERVAL_MS;\n\n/** Test seam: forget every recorded probe attempt. */\nexport function resetCodexCoreUsageProbeAttempts(): void {\n  resetCoreUsageProbeAttempts();\n}\n\n/**\n * Before a parked Codex turn's reconcile: one `/wham/usage` read per\n * exhausted connection the work can use whose stored quota was not observed\n * within `CODEX_CORE_USAGE_RECHECK_MIN_INTERVAL_MS`, through the same core\n * probe the usage refresh route uses (`refreshBlockedCoreQuotaBeforeReconcile`\n * bound to Codex: shared connections as the core's service subject, and only\n * the personal connections the exact accepted turn admits).\n */\nexport async function refreshExhaustedCodexCoreQuota(input: {\n  db: Database;\n  settings: Settings;\n  accountId: string;\n  workspaceId: string;\n  personalTurn?: SubscriptionCoreTurnIdentity | null;\n  fetch?: typeof fetch;\n  now?: number;\n}): Promise<void> {\n  await refreshBlockedCoreQuotaBeforeReconcile({\n    ...input,\n    provider: subscriptionCoreProvider(\"codex\"),\n  });\n}\n","import {\n  deliverSubscriptionCoreProviderWake,\n  subscriptionCoreOperationConnections,\n  subscriptionCorePersonalConnections,\n  type Database,\n  type SubscriptionCoreProvider,\n  type SubscriptionCoreTurnIdentity,\n} from \"@opengeni/db\";\nimport type { Settings } from \"@opengeni/config\";\nimport { subscriptionPersonalAuthorityForProviderV2 } from \"@opengeni/contracts\";\n\nconst CORE_SUBSCRIPTION_SERVICE_SUBJECT = \"service:subscription-core\";\n\n/** A provider with personal subscription authority (Codex, Claude, SuperGrok). */\ntype PersonalAuthorityProvider = Parameters<typeof subscriptionPersonalAuthorityForProviderV2>[1];\n\n/**\n * A stored exhaustion (or a model cooldown the adapter's usage read can end)\n * is re-read at most this often per connection, however many waiters\n * recheck: each waiter rechecks on the bounded backoff (at most every 15\n * minutes), so a parked turn sees an early provider reset within about 50\n * minutes instead of at a stale reset days away.\n */\nexport const CORE_USAGE_RECHECK_MIN_INTERVAL_MS = 30 * 60_000;\n\n/**\n * The per-connection interval above counts from the last stored reading, so\n * a probe that stores nothing (the endpoint fails, or answers without\n * windows) would otherwise be repeated by every waiter's recheck. This worker\n * attempts one probe scope (a provider's shared pool in a workspace, or one\n * owner's personal connections) at most this often, whatever the outcome.\n */\nexport const CORE_USAGE_PROBE_ATTEMPT_INTERVAL_MS = 5 * 60_000;\n\nconst probeAttempts = new Map<string, number>();\n\n/** Claims one probe attempt for `key` now, unless one ran within the interval. */\nfunction claimProbeAttempt(key: string, now: number): boolean {\n  const last = probeAttempts.get(key);\n  if (last !== undefined && now - last < CORE_USAGE_PROBE_ATTEMPT_INTERVAL_MS) return false;\n  if (probeAttempts.size >= 10_000) {\n    for (const [stale, at] of probeAttempts) {\n      if (now - at >= CORE_USAGE_PROBE_ATTEMPT_INTERVAL_MS) probeAttempts.delete(stale);\n    }\n  }\n  probeAttempts.set(key, now);\n  return true;\n}\n\n/** Test seam: forget every recorded probe attempt (every provider). */\nexport function resetCoreUsageProbeAttempts(): void {\n  probeAttempts.clear();\n}\n\n/**\n * Before a parked core turn's reconcile, for a provider whose usage read can\n * end an exhaustion before its stored reset (its adapter's\n * `usageReadEndsQuotaExhaustion`): one usage read per blocked connection the\n * work can use whose stored quota was not observed within\n * `CORE_USAGE_RECHECK_MIN_INTERVAL_MS`, through the same core probe the usage\n * refresh routes use.\n *\n * - Shared connections in this workspace's explicit context, as the core's\n *   service subject.\n * - With `personalTurn` (the exact accepted turn that waits): only the\n *   personal connections placement's personal authorization admits for that\n *   turn, each read as the owner in their own Personal workspace.\n *\n * A recovery wakes the organization's core waiters of that provider. A failed\n * probe never blocks a waiter; the stored state stands. Each probe scope is\n * attempted at most once per `CORE_USAGE_PROBE_ATTEMPT_INTERVAL_MS` in this\n * worker.\n */\nexport async function refreshBlockedCoreQuotaBeforeReconcile(input: {\n  provider: SubscriptionCoreProvider;\n  db: Database;\n  settings: Settings;\n  accountId: string;\n  workspaceId: string;\n  personalTurn?: SubscriptionCoreTurnIdentity | null;\n  fetch?: typeof fetch;\n  now?: number;\n}): Promise<void> {\n  const providerId = input.provider.adapter.provider;\n  const now = input.now ?? Date.now();\n  const deps = {\n    minIntervalMs: CORE_USAGE_RECHECK_MIN_INTERVAL_MS,\n    ...(input.fetch ? { fetchImpl: input.fetch } : {}),\n  };\n  const recovered: string[] = [];\n  if (claimProbeAttempt(`${providerId}:${input.accountId}:${input.workspaceId}:shared`, now)) {\n    try {\n      recovered.push(\n        ...(await subscriptionCoreOperationConnections(\n          input.provider,\n        ).refreshExhaustedSubscriptionCoreQuota(\n          input.db,\n          input.settings,\n          {\n            kind: \"workspace\",\n            accountId: input.accountId,\n            workspaceId: input.workspaceId,\n            subjectId: CORE_SUBSCRIPTION_SERVICE_SUBJECT,\n          },\n          deps,\n        )),\n      );\n    } catch {\n      // The stored shared state stands.\n    }\n  }\n  const personal = input.personalTurn;\n  if (\n    personal &&\n    claimProbeAttempt(\n      `${providerId}:${input.accountId}:${input.workspaceId}:personal:${personal.sessionOwnerMembershipId}:${\n        subscriptionPersonalAuthorityForProviderV2(\n          personal.acceptedAuthorityV2,\n          providerId as PersonalAuthorityProvider,\n        )?.authorityGeneration ?? \"none\"\n      }`,\n      now,\n    )\n  ) {\n    try {\n      recovered.push(\n        ...(await subscriptionCorePersonalConnections(\n          input.provider,\n        ).refreshExhaustedSubscriptionCoreTurnPersonalQuota(\n          input.db,\n          input.settings,\n          personal,\n          deps,\n        )),\n      );\n    } catch {\n      // The stored personal state stands.\n    }\n  }\n  if (recovered.length > 0) {\n    await deliverSubscriptionCoreProviderWake(input.db, providerId, {\n      accountId: input.accountId,\n      reason: \"usage_recovered\",\n    }).catch(() => undefined);\n  }\n}\n","import type {\n  ResourceRef,\n  SessionStatus,\n  SessionSystemUpdatePayload,\n  ToolRef,\n} from \"@opengeni/contracts\";\n\nexport { mergeResourceRefs, mergeToolRefs } from \"@opengeni/contracts\";\n\n/**\n * Refuse to revive a terminal reusable session on a scheduled fire. Mirrors the\n * API-level guard in apps/api/src/domain/sessions.ts (post a user message ->\n * 409 when cancelled): \"cancelled\" is the one terminal state, an explicit user\n * act, so a recurring task must NOT silently resurrect and re-bill it. Failed\n * and idle sessions stay revivable (talking to a session is how it resumes), so\n * only \"cancelled\" is rejected. Throwing inside the FOR UPDATE locked-update\n * callback aborts the whole append+enqueue transaction atomically, and the\n * dispatch catch marks the scheduled_task_run \"failed\" rather than dispatched.\n */\nexport function assertReusableSessionRevivable(status: SessionStatus): void {\n  if (status === \"cancelled\") {\n    throw new Error(\"reusable session is cancelled; refusing to revive on scheduled fire\");\n  }\n}\n\nexport function scheduledUserMessagePayload(\n  prompt: string,\n  resources: ResourceRef[],\n  tools: ToolRef[],\n  taskId: string,\n  runId: string,\n  degradedAccounts: readonly { serverId: string }[] = [],\n): Extract<SessionSystemUpdatePayload, { type: \"scheduled_occurrence\" }> {\n  // Connectors this occurrence runs without because every account a person\n  // pinned for them is unusable. A connector that kept a working pin still has\n  // its tools and is not named.\n  const unavailableConnectors = [\n    ...new Set(\n      degradedAccounts\n        .map((account) => account.serverId)\n        .filter((serverId) => !tools.some((tool) => tool.kind === \"mcp\" && tool.id === serverId)),\n    ),\n  ].sort();\n  return {\n    type: \"scheduled_occurrence\",\n    text: prompt,\n    scheduledTaskId: taskId,\n    scheduledTaskRunId: runId,\n    ...(resources.length ? { resources } : {}),\n    ...(tools.length ? { tools } : {}),\n    ...(unavailableConnectors.length ? { unavailableConnectors } : {}),\n  };\n}\n\nexport function workflowIdForSession(sessionId: string): string {\n  return `session-${sessionId}`;\n}\n","/**\n * Claude's binding of the provider-neutral core waits (Claude track C1b).\n * The workflow reaches it only for a waiter the core holds.\n */\nimport {\n  armSubscriptionCoreCapacityWait,\n  getSubscriptionCoreCapacityWaitById,\n  readSubscriptionCoreTurnModel,\n  reconcileSubscriptionCoreCapacityWait,\n  SUBSCRIPTION_CORE_CLAUDE,\n  subscriptionCoreTurns,\n  wakeSubscriptionCoreProviderCapacityWaiters,\n  type SubscriptionCoreProvider,\n} from \"@opengeni/db\";\nimport type { CoreWaitBinding } from \"./subscription-core-codex-waits\";\nimport { refreshBlockedCoreQuotaBeforeReconcile } from \"./subscription-core-usage-recheck\";\n\nconst CLAUDE = SUBSCRIPTION_CORE_CLAUDE as SubscriptionCoreProvider;\n\nexport const CLAUDE_CORE_WAIT_BINDING: CoreWaitBinding = {\n  provider: \"claude\",\n  arm: (db, input) => armSubscriptionCoreCapacityWait(db, \"claude\", input),\n  getWaiterById: async (db, input) => {\n    const waiter = await getSubscriptionCoreCapacityWaitById(db, input);\n    return waiter?.provider === \"claude\" ? waiter : null;\n  },\n  readTurnModel: (db, input) => readSubscriptionCoreTurnModel(db, input),\n  recoverHealth: (db, identity) =>\n    subscriptionCoreTurns(CLAUDE).recoverSubscriptionCoreConnectionHealth(db, identity),\n  evaluatePlacement: (db, request) =>\n    subscriptionCoreTurns(CLAUDE).evaluateSubscriptionCorePlacement(db, request),\n  wakeWaiters: (db, input) => wakeSubscriptionCoreProviderCapacityWaiters(db, \"claude\", input),\n  reconcileWaiter: (db, input) =>\n    reconcileSubscriptionCoreCapacityWait(db, { ...input, provider: \"claude\" }),\n  // Anthropic can reset a plan limit before the reset a refused request\n  // reported, so a parked turn re-reads the Claude usage endpoint\n  // (rate-limited per connection and per probe scope) at each bounded\n  // recheck instead of sleeping until a stale reset: the shared pool, and the\n  // personal connections its exact accepted identity authorizes.\n  refreshBeforeReconcile: ({ db, settings }, turn) =>\n    refreshBlockedCoreQuotaBeforeReconcile({\n      provider: CLAUDE,\n      db,\n      settings,\n      accountId: turn.accountId,\n      workspaceId: turn.workspaceId,\n      personalTurn: turn,\n    }),\n};\n","/**\n * SuperGrok's binding of the provider-neutral core waits (SuperGrok track\n * X1b). The only SuperGrok waits: the drained cutover moved every legacy\n * waiter onto the core with its id and generation, and the workflow reaches\n * this binding only for a waiter the core holds.\n */\nimport {\n  armSubscriptionCoreCapacityWait,\n  getSubscriptionCoreCapacityWaitById,\n  readSubscriptionCoreTurnModel,\n  reconcileSubscriptionCoreCapacityWait,\n  SUBSCRIPTION_CORE_XAI,\n  subscriptionCoreTurns,\n  wakeSubscriptionCoreProviderCapacityWaiters,\n  type SubscriptionCoreProvider,\n} from \"@opengeni/db\";\nimport type { CoreWaitBinding } from \"./subscription-core-codex-waits\";\nimport { refreshExhaustedXaiCoreQuota } from \"./subscription-core-xai-quota\";\n\nconst XAI = SUBSCRIPTION_CORE_XAI as SubscriptionCoreProvider;\n\nexport const XAI_CORE_WAIT_BINDING: CoreWaitBinding = {\n  provider: \"xai\",\n  arm: (db, input) => armSubscriptionCoreCapacityWait(db, \"xai\", input),\n  getWaiterById: async (db, input) => {\n    const waiter = await getSubscriptionCoreCapacityWaitById(db, input);\n    return waiter?.provider === \"xai\" ? waiter : null;\n  },\n  readTurnModel: (db, input) => readSubscriptionCoreTurnModel(db, input),\n  recoverHealth: (db, identity) =>\n    subscriptionCoreTurns(XAI).recoverSubscriptionCoreConnectionHealth(db, identity),\n  evaluatePlacement: (db, request) =>\n    subscriptionCoreTurns(XAI).evaluateSubscriptionCorePlacement(db, request),\n  wakeWaiters: (db, input) => wakeSubscriptionCoreProviderCapacityWaiters(db, \"xai\", input),\n  reconcileWaiter: (db, input) =>\n    reconcileSubscriptionCoreCapacityWait(db, { ...input, provider: \"xai\" }),\n  // A SuperGrok billing read can end an exhaustion before its stored reset, so\n  // a parked turn re-reads shared billing and the personal connections its\n  // exact accepted identity authorizes, at each bounded recheck.\n  refreshBeforeReconcile: ({ db, settings }, turn) =>\n    refreshExhaustedXaiCoreQuota({\n      db,\n      settings,\n      accountId: turn.accountId,\n      workspaceId: turn.workspaceId,\n      personalTurn: turn,\n    }),\n};\n","import {\n  deliverSubscriptionCoreProviderWake,\n  SUBSCRIPTION_CORE_XAI,\n  SUBSCRIPTION_CORE_XAI_PROVIDER,\n  subscriptionCoreOperationConnections,\n  subscriptionCorePersonalConnections,\n  type Database,\n  type SubscriptionCoreTurnIdentity,\n} from \"@opengeni/db\";\nimport type { Settings } from \"@opengeni/config\";\n\nconst CORE_SUBSCRIPTION_SERVICE_SUBJECT = \"service:subscription-core\";\n\n/**\n * After the SuperGrok receipt: one billing probe per exhausted connection\n * the work can use (design 5.3, EP-N22), never legacy rows.\n *\n * - Shared connections in this workspace's explicit context, as the core's\n *   service subject.\n * - With `personalTurn` (the exact accepted turn being placed or waiting):\n *   only the personal connections placement's personal authorization admits\n *   for that turn\n *   (its initiating human is the session owner, a private session or the\n *   owner's Personal workspace, the frozen v2 entry at the current\n *   authority generation, personal connections allowed), each read as the\n *   owner in their own Personal workspace (the administered\n *   `personal_owner` read). Any other turn reads no personal connection.\n *\n * A recovery wakes the organization's SuperGrok core waiters: a shared\n * connection can serve every workspace it reaches, and an owner's parked\n * private work may wait in any workspace. A failed probe never blocks\n * placement or a waiter; the stored state stands.\n */\nexport async function refreshExhaustedXaiCoreQuota(input: {\n  db: Database;\n  settings: Settings;\n  accountId: string;\n  workspaceId: string;\n  personalTurn?: SubscriptionCoreTurnIdentity | null;\n  fetch?: typeof fetch;\n}): Promise<void> {\n  const deps = input.fetch ? { fetchImpl: input.fetch } : {};\n  const recovered: string[] = [];\n  try {\n    recovered.push(\n      ...(await subscriptionCoreOperationConnections(\n        SUBSCRIPTION_CORE_XAI,\n      ).refreshExhaustedSubscriptionCoreQuota(\n        input.db,\n        input.settings,\n        {\n          kind: \"workspace\",\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          subjectId: CORE_SUBSCRIPTION_SERVICE_SUBJECT,\n        },\n        deps,\n      )),\n    );\n  } catch {\n    // The stored shared state stands.\n  }\n  if (input.personalTurn) {\n    try {\n      recovered.push(\n        ...(await subscriptionCorePersonalConnections(\n          SUBSCRIPTION_CORE_XAI,\n        ).refreshExhaustedSubscriptionCoreTurnPersonalQuota(\n          input.db,\n          input.settings,\n          input.personalTurn,\n          deps,\n        )),\n      );\n    } catch {\n      // The stored personal state stands.\n    }\n  }\n  if (recovered.length > 0) {\n    await deliverSubscriptionCoreProviderWake(input.db, SUBSCRIPTION_CORE_XAI_PROVIDER, {\n      accountId: input.accountId,\n      reason: \"usage_recovered\",\n    }).catch(() => undefined);\n  }\n}\n","export {\n  resolveRigProviderImageSelection,\n  rigProviderImageSourceImage,\n  settingsWithRigImage,\n  settingsWithRigProviderImage,\n  type RigProviderImageSelectionReason,\n} from \"@opengeni/core\";\n","import type { SessionEventType } from \"@opengeni/contracts\";\nimport { TURN_ACTIVITY_CANCELLATION_HEARTBEAT_INTERVAL_MS } from \"@opengeni/core\";\nimport type { AppendEventInput } from \"@opengeni/db\";\nimport {\n  SESSION_EVENT_COALESCED_TEXT_TARGET_BYTES,\n  reasoningDeltaSeparator,\n} from \"@opengeni/events\";\nimport { Context } from \"@temporalio/activity\";\n\n// Trailing-flush window. A burst of coalesced deltas followed by model silence\n// must not sit in `pending` unbounded — without a timer, flush fires only on\n// the NEXT push. The first fragment of a turn, after a structural event (a\n// tool call, a completed message) or after a silence of one window is sent at\n// once, so time to first token is unchanged; later fragments wait at most one\n// window.\n// Each flush stores adjacent text fragments as one row, so the window sets how\n// many delta rows a stream writes: on staging traffic, 100ms stores about a\n// fifth of the provider fragments.\nexport const TRAILING_FLUSH_MS = 100;\nconst MAX_BATCH_EVENTS = 50;\n// Keep model ingestion independent from a slow durable append, but never let a\n// provider outrun storage without bound. At the high-water mark `push` waits for\n// the serialized drain before consuming more provider output.\nconst MAX_BUFFERED_EVENTS = 1_000;\n\nconst MERGEABLE_TEXT_DELTA_TYPES: ReadonlySet<string> = new Set([\n  \"agent.message.delta\",\n  \"agent.reasoning.delta\",\n]);\nconst textEncoder = new TextEncoder();\n\ntype PlainTextDelta = { text: string; messageId?: string; phase?: string };\n\n/** The plain fragment shape only: any other payload field would not survive a merge. */\nfunction plainTextDelta(event: AppendEventInput): PlainTextDelta | null {\n  if (!MERGEABLE_TEXT_DELTA_TYPES.has(event.type)) return null;\n  for (const key of Object.keys(event)) {\n    if (key !== \"type\" && key !== \"payload\") return null;\n  }\n  const payload = event.payload;\n  if (payload === null || typeof payload !== \"object\" || Array.isArray(payload)) return null;\n  const record = payload as Record<string, unknown>;\n  if (typeof record.text !== \"string\") return null;\n  for (const key of Object.keys(record)) {\n    if (key !== \"text\" && key !== \"messageId\" && key !== \"phase\") return null;\n  }\n  if (record.messageId !== undefined && typeof record.messageId !== \"string\") return null;\n  if (record.phase !== undefined && typeof record.phase !== \"string\") return null;\n  return record as PlainTextDelta;\n}\n\n/**\n * Stores adjacent text fragments of one stream as one delta: same type,\n * message and phase, at most the live stream's 48 KiB bound. The text and the\n * order of every other event are unchanged; only the provider's fragment\n * boundaries are dropped. Reasoning fragments are joined with the same\n * separator readers use ({@link reasoningDeltaSeparator}), so the rendered\n * reasoning is identical whether a reader sees the fragments or the merge.\n */\nexport function mergeAdjacentTextDeltas(events: AppendEventInput[]): AppendEventInput[] {\n  const merged: AppendEventInput[] = [];\n  let run: {\n    first: AppendEventInput;\n    head: PlainTextDelta;\n    text: string;\n    count: number;\n    bytes: number;\n  } | null = null;\n  const flushRun = () => {\n    if (!run) return;\n    merged.push(\n      run.count === 1\n        ? run.first\n        : {\n            type: run.first.type,\n            payload: {\n              text: run.text,\n              ...(run.head.messageId !== undefined ? { messageId: run.head.messageId } : {}),\n              ...(run.head.phase !== undefined ? { phase: run.head.phase } : {}),\n            },\n          },\n    );\n    run = null;\n  };\n  for (const event of events) {\n    const delta = plainTextDelta(event);\n    if (!delta) {\n      flushRun();\n      merged.push(event);\n      continue;\n    }\n    if (\n      run &&\n      run.first.type === event.type &&\n      run.head.messageId === delta.messageId &&\n      run.head.phase === delta.phase\n    ) {\n      const piece =\n        (event.type === \"agent.reasoning.delta\"\n          ? reasoningDeltaSeparator(run.text, delta.text)\n          : \"\") + delta.text;\n      const pieceBytes = textEncoder.encode(piece).byteLength;\n      if (run.bytes + pieceBytes <= SESSION_EVENT_COALESCED_TEXT_TARGET_BYTES) {\n        run.text += piece;\n        run.count += 1;\n        run.bytes += pieceBytes;\n        continue;\n      }\n    }\n    flushRun();\n    run = {\n      first: event,\n      head: delta,\n      text: delta.text,\n      count: 1,\n      bytes: textEncoder.encode(delta.text).byteLength,\n    };\n  }\n  flushRun();\n  return merged;\n}\n\n/** Optional metrics seam for the batcher. `onFlush` fires once per flush (on both\n *  success and failure) with the stored event count (after adjacent text deltas\n *  merge) and the flush duration, so the worker can meter batch shape without the\n *  batcher knowing about Observability.\n *  `now` is injectable for deterministic tests. Both are optional; absent ⇒ no-op. */\nexport type RuntimeBatcherOptions = {\n  onFlush?: (info: { events: number; durationSeconds: number }) => void;\n  now?: () => number;\n};\n\nexport function createRuntimeBatcher(\n  flushEvents: (events: AppendEventInput[]) => Promise<void>,\n  options: RuntimeBatcherOptions = {},\n) {\n  const now = options.now ?? (() => performance.now());\n  let pending: AppendEventInput[] = [];\n  let lastFlush = Number.NEGATIVE_INFINITY;\n  // Leading edge: the first text fragment of a turn, and the first after a\n  // structural event, goes out at once. Only text consumes it, so another\n  // non-structural event (such as `agent.updated` on a handoff) cannot delay\n  // the content that follows it.\n  let awaitingFirstText = true;\n  let trailingTimer: ReturnType<typeof setTimeout> | null = null;\n  let activeBatchSize = 0;\n  // One drain loop owns `flushEvents`, so DB-assigned sequence order always\n  // matches push order. Ordinary deltas do not await this promise; structural\n  // boundaries, explicit flushes, and the bounded high-water mark do.\n  let drainPromise: Promise<void> | null = null;\n  // A timer has no direct awaiter. Retain its failure so the next push or final\n  // flush terminates the turn instead of silently losing streamed evidence.\n  let flushFailed = false;\n  let flushFailure: unknown;\n  // The high-volume token deltas (agent.message.delta, agent.reasoning.delta,\n  // sandbox.command.output.delta) are DELIBERATELY NOT here: they coalesce\n  // under the 50-event / TRAILING_FLUSH_MS policy into one appendSessionEvents\n  // txn + one publish per flush, instead of one DB round-trip per token, and\n  // adjacent text fragments in a flush are stored as one row. Only events that\n  // must be delivered promptly stay structural (flush-immediately). PTY bytes\n  // stay structural on purpose — an interactive terminal is useless batched\n  // behind a window (P4.4).\n  const structural = new Set<SessionEventType>([\n    \"terminal.pty.output.delta\",\n    \"agent.toolCall.created\",\n    \"agent.toolCall.output\",\n    \"agent.message.completed\",\n    \"tool.auth_needed\",\n    \"credential.auth_needed\",\n    \"session.requiresAction\",\n    \"turn.completed\",\n    \"turn.failed\",\n    \"turn.cancelled\",\n  ]);\n  return {\n    push: async (event: { type: SessionEventType; payload: unknown }) => {\n      throwIfFlushFailed();\n      // Append BEFORE the structural check so a structural event's flush always\n      // carries any pending deltas in order (same flush, order preserved).\n      pending.push({ type: event.type, payload: event.payload });\n      const elapsed = Date.now() - lastFlush;\n      if (structural.has(event.type)) {\n        await flush();\n        // A structural event closes the window: the next text fragment (the\n        // start of the next message or reasoning item) is sent at once.\n        awaitingFirstText = true;\n        return;\n      }\n      const firstText = awaitingFirstText && MERGEABLE_TEXT_DELTA_TYPES.has(event.type);\n      if (firstText) awaitingFirstText = false;\n      if (firstText || pending.length >= MAX_BATCH_EVENTS || elapsed >= TRAILING_FLUSH_MS) {\n        // Start the serialized drain, but keep consuming provider deltas while\n        // the append/publish round-trip is in flight. The active drain records\n        // any failure for the next awaited boundary.\n        void startDrain().catch(() => undefined);\n      }\n      if (activeBatchSize + pending.length >= MAX_BUFFERED_EVENTS) {\n        await flush();\n        return;\n      }\n      armTrailingTimer();\n    },\n    flush,\n  };\n\n  function armTrailingTimer() {\n    if (trailingTimer !== null) {\n      return;\n    }\n    trailingTimer = setTimeout(() => {\n      trailingTimer = null;\n      // A timer has no awaiter, so prevent an unhandled rejection. startDrain\n      // retains the exact error and the next push/final flush rethrows it.\n      void flush().catch(() => undefined);\n    }, TRAILING_FLUSH_MS);\n    if (\"unref\" in trailingTimer && typeof trailingTimer.unref === \"function\") {\n      trailingTimer.unref();\n    }\n  }\n\n  function clearTrailingTimer() {\n    if (trailingTimer !== null) {\n      clearTimeout(trailingTimer);\n      trailingTimer = null;\n    }\n  }\n\n  async function flush(): Promise<void> {\n    throwIfFlushFailed();\n    clearTrailingTimer();\n    await startDrain();\n    throwIfFlushFailed();\n  }\n\n  function startDrain(): Promise<void> {\n    if (drainPromise) {\n      return drainPromise;\n    }\n    if (flushFailed) {\n      return Promise.reject(flushFailure);\n    }\n    if (pending.length === 0) {\n      return Promise.resolve();\n    }\n    clearTrailingTimer();\n    // Clear `drainPromise` in the same step that observes an empty queue, so a\n    // push can never join a drain that has already finished its last batch\n    // (that fragment would then wait for the trailing timer).\n    let finished = false;\n    const running = (async () => {\n      try {\n        while (pending.length > 0) {\n          const events = mergeAdjacentTextDeltas(pending.splice(0, MAX_BATCH_EVENTS));\n          activeBatchSize = events.length;\n          lastFlush = Date.now();\n          const startedAt = now();\n          try {\n            await flushEvents(events);\n          } catch (error) {\n            flushFailed = true;\n            flushFailure = error;\n            throw error;\n          } finally {\n            activeBatchSize = 0;\n            if (options.onFlush) {\n              try {\n                options.onFlush({\n                  events: events.length,\n                  durationSeconds: Math.max(0, (now() - startedAt) / 1000),\n                });\n              } catch {\n                // Metrics emission must never affect a flush.\n              }\n            }\n          }\n        }\n      } finally {\n        finished = true;\n        drainPromise = null;\n      }\n    })();\n    if (!finished) {\n      drainPromise = running;\n    }\n    return running;\n  }\n\n  function throwIfFlushFailed(): void {\n    if (flushFailed) {\n      throw flushFailure;\n    }\n  }\n}\n\nexport function currentActivityContext(): Context | null {\n  try {\n    return Context.current();\n  } catch {\n    return null;\n  }\n}\n\nexport function startActivityHeartbeat(\n  context: Context | null,\n  details: Record<string, unknown>,\n  schedule: typeof setInterval = setInterval,\n): ReturnType<typeof setInterval> | null {\n  if (!context) {\n    return null;\n  }\n  const timer = schedule(() => {\n    context.heartbeat({ ...details, at: new Date().toISOString() });\n  }, TURN_ACTIVITY_CANCELLATION_HEARTBEAT_INTERVAL_MS);\n  if (\"unref\" in timer && typeof timer.unref === \"function\") {\n    timer.unref();\n  }\n  return timer;\n}\n\nexport async function nextStreamEvent<T>(\n  iterator: AsyncIterator<T>,\n  context: Context | null,\n): Promise<IteratorResult<T>> {\n  if (!context) {\n    return await iterator.next();\n  }\n  const signal = context.cancellationSignal;\n  if (signal.aborted) {\n    throw signal.reason;\n  }\n\n  // Context.cancelled never settles for a normally completed activity. Racing\n  // every token/event read against that lifetime promise leaves one losing\n  // Promise reaction attached for every event until the Context itself dies.\n  // Use the equivalent Temporal AbortSignal and remove each listener as soon as\n  // the iterator wins, so a long stream retains at most its one pending read.\n  return await new Promise<IteratorResult<T>>((resolve, reject) => {\n    let settled = false;\n    const settle = (complete: () => void) => {\n      if (settled) return;\n      settled = true;\n      signal.removeEventListener(\"abort\", onAbort);\n      complete();\n    };\n    const onAbort = () => settle(() => reject(signal.reason));\n\n    signal.addEventListener(\"abort\", onAbort, { once: true });\n    if (signal.aborted) {\n      onAbort();\n      return;\n    }\n\n    let next: PromiseLike<IteratorResult<T>>;\n    try {\n      next = iterator.next();\n    } catch (error) {\n      settle(() => reject(error));\n      return;\n    }\n    void Promise.resolve(next).then(\n      (result) => settle(() => resolve(result)),\n      (error) => settle(() => reject(error)),\n    );\n  });\n}\n","import {\n  IncidentTelemetryPreflight,\n  secretNameKey,\n  stableJson,\n  type FirstPartyMcpToolName,\n  type Permission,\n  type ResourceRef,\n  type ScheduledTask,\n  type ScheduledTaskAgentConfig,\n} from \"@opengeni/contracts\";\nimport { createHash } from \"node:crypto\";\nimport { isDeepStrictEqual } from \"node:util\";\n\nexport type IncidentTelemetryPreflightBlockReason =\n  | \"incident_preflight_metadata_missing\"\n  | \"incident_responder_under_capable\"\n  | \"incident_data_source_unsuitable\";\n\nexport type IncidentTelemetryPreflightResult =\n  | { action: \"not_required\" }\n  | { action: \"ready\" }\n  | { action: \"blocked\"; reason: IncidentTelemetryPreflightBlockReason };\n\nexport type IncidentTelemetryRigMetadata = {\n  name: string;\n  credentialHooks: readonly string[];\n  checkHealth: \"passing\" | \"failing\" | \"unknown\";\n};\n\n/** A vault the responder can reach, with its item names (never values). */\nexport type IncidentTelemetryVaultMetadata = {\n  name: string;\n  items: readonly { name: string }[];\n};\n\nexport type IncidentTelemetryResponderMetadata = {\n  /** False when an exact selected attachment could not be projected safely. */\n  metadataComplete: boolean;\n  resources: readonly ResourceRef[];\n  mcpServerIds: readonly string[];\n  firstPartyMcpTools: readonly FirstPartyMcpToolName[];\n  firstPartyMcpPermissions: readonly Permission[];\n  rig: IncidentTelemetryRigMetadata | null;\n  /**\n   * Vaults the responder reaches under the task's vault policy. The preflight\n   * contract still says \"variable set\" (`requiredVariableSetNames`,\n   * `requiredVariableNames`, route kind `variable_set`): those now name vaults\n   * and items, matched case-insensitively.\n   */\n  vaults: readonly IncidentTelemetryVaultMetadata[];\n  /** Exact durable session policy version, or null for a not-yet-created session. */\n  toolPolicyVersion: number | null;\n};\n\nexport type IncidentTelemetryPreflightInput = {\n  agentConfig: ScheduledTaskAgentConfig;\n  /** A valid structured alert occurrence also makes a legacy task incident-triggered. */\n  incidentTriggered: boolean;\n  /** Exact bounded labels from that validated occurrence; values are never rendered in blockers. */\n  alertOccurrenceLabels: Readonly<Record<string, string>> | null;\n  responder: IncidentTelemetryResponderMetadata;\n};\n\nexport const INCIDENT_TELEMETRY_AUTHORITY_FENCE_LINEAGE_KEY = \"incidentTelemetryAuthorityFence\";\n\nexport type IncidentTelemetryAuthorityFence = {\n  version: 2;\n  toolPolicyVersion: number;\n  responderDigest: string;\n  taskDigest: string;\n  alertSelectorDigest: string;\n};\n\nexport type IncidentTelemetryPreflightDeclaration =\n  | { action: \"not_required\" }\n  | {\n      action: \"blocked\";\n      reason: \"incident_preflight_metadata_missing\" | \"incident_data_source_unsuitable\";\n    }\n  | { action: \"required\"; preflight: IncidentTelemetryPreflight };\n\nexport function incidentTelemetryPreflightDeclaration(\n  agentConfig: ScheduledTaskAgentConfig,\n  incidentTriggered: boolean,\n): IncidentTelemetryPreflightDeclaration {\n  const rawConfig = agentConfig as ScheduledTaskAgentConfig & Record<string, unknown>;\n  const executionClass = rawConfig.executionClass;\n  const rawPreflight = rawConfig.incidentTelemetryPreflight;\n  if (executionClass === undefined && rawPreflight === undefined && !incidentTriggered) {\n    return { action: \"not_required\" };\n  }\n  if (executionClass !== \"incident_telemetry\" || rawPreflight === undefined) {\n    return { action: \"blocked\", reason: \"incident_preflight_metadata_missing\" };\n  }\n\n  const parsed = IncidentTelemetryPreflight.safeParse(rawPreflight);\n  if (!parsed.success) {\n    const dataSourceInvalid = parsed.error.issues.some((issue) => issue.path[0] === \"dataSource\");\n    return {\n      action: \"blocked\",\n      reason: dataSourceInvalid\n        ? \"incident_data_source_unsuitable\"\n        : \"incident_preflight_metadata_missing\",\n    };\n  }\n  return { action: \"required\", preflight: parsed.data };\n}\n\n/**\n * Pure, metadata-only incident admission. No provider request, public endpoint\n * fetch, secret read/decrypt, session creation, or ambient credential lookup is\n * reachable from this evaluator.\n */\nexport function evaluateIncidentTelemetryPreflight(\n  input: IncidentTelemetryPreflightInput,\n): IncidentTelemetryPreflightResult {\n  const declaration = incidentTelemetryPreflightDeclaration(\n    input.agentConfig,\n    input.incidentTriggered,\n  );\n  if (declaration.action !== \"required\") return declaration;\n  const preflight = declaration.preflight;\n\n  if (!input.responder.metadataComplete) {\n    return blocked(\"incident_preflight_metadata_missing\");\n  }\n\n  if (\n    preflight.requiredResources.some(\n      (required) =>\n        !input.responder.resources.some((selected) => isDeepStrictEqual(selected, required)),\n    )\n  ) {\n    return blocked(\"incident_responder_under_capable\");\n  }\n\n  const selectedMcpServerIds = new Set(input.responder.mcpServerIds);\n  if (preflight.requiredMcpServerIds.some((id) => !selectedMcpServerIds.has(id))) {\n    return blocked(\"incident_responder_under_capable\");\n  }\n\n  const selectedFirstPartyTools = new Set(input.responder.firstPartyMcpTools);\n  if (preflight.requiredFirstPartyMcpTools.some((tool) => !selectedFirstPartyTools.has(tool))) {\n    return blocked(\"incident_responder_under_capable\");\n  }\n\n  const selectedFirstPartyPermissions = new Set(input.responder.firstPartyMcpPermissions);\n  if (\n    preflight.requiredFirstPartyMcpPermissions.some(\n      (permission) => !selectedFirstPartyPermissions.has(permission),\n    )\n  ) {\n    return blocked(\"incident_responder_under_capable\");\n  }\n\n  if (preflight.requiredRig && !rigSatisfies(input.responder.rig, preflight.requiredRig)) {\n    return blocked(\"incident_responder_under_capable\");\n  }\n\n  const vaultsByName = new Map(\n    input.responder.vaults.map((vault) => [secretNameKey(vault.name), vault]),\n  );\n  if (preflight.requiredVariableSetNames.some((name) => !vaultsByName.has(secretNameKey(name)))) {\n    return blocked(\"incident_responder_under_capable\");\n  }\n  const reachableItemNames = new Set(\n    input.responder.vaults.flatMap((vault) => vault.items.map((item) => secretNameKey(item.name))),\n  );\n  if (\n    preflight.requiredVariableNames.some((name) => !reachableItemNames.has(secretNameKey(name)))\n  ) {\n    return blocked(\"incident_responder_under_capable\");\n  }\n\n  const route = preflight.dataSource.route;\n  if (route.kind === \"mcp\" && !selectedMcpServerIds.has(route.serverId)) {\n    return blocked(\"incident_responder_under_capable\");\n  }\n  if (route.kind === \"first_party\" && !selectedFirstPartyTools.has(route.tool)) {\n    return blocked(\"incident_responder_under_capable\");\n  }\n  if (route.kind === \"variable_set\") {\n    const selected = vaultsByName.get(secretNameKey(route.variableSetName));\n    const names = new Set(selected?.items.map((item) => secretNameKey(item.name)) ?? []);\n    if (!selected || route.variableNames.some((name) => !names.has(secretNameKey(name)))) {\n      return blocked(\"incident_responder_under_capable\");\n    }\n  }\n  if (\n    route.kind === \"rig_credential_hook\" &&\n    !rigSatisfies(input.responder.rig, {\n      name: preflight.requiredRig?.name ?? \"\",\n      credentialHookIds: [route.credentialHookId],\n    })\n  ) {\n    return blocked(\"incident_responder_under_capable\");\n  }\n\n  if (!seriesMetadataSatisfies(preflight.dataSource)) {\n    return blocked(\"incident_data_source_unsuitable\");\n  }\n  if (!alertSelectorsSatisfy(preflight.dataSource, input.alertOccurrenceLabels)) {\n    return blocked(\"incident_data_source_unsuitable\");\n  }\n  return { action: \"ready\" };\n}\n\nexport function incidentTelemetryAuthorityFence(input: {\n  task: ScheduledTask;\n  responder: IncidentTelemetryResponderMetadata;\n  alertOccurrenceLabels: Readonly<Record<string, string>> | null;\n}): IncidentTelemetryAuthorityFence | null {\n  const { task, responder } = input;\n  if (responder.toolPolicyVersion === null) return null;\n  const declaration = incidentTelemetryPreflightDeclaration(\n    task.agentConfig,\n    input.alertOccurrenceLabels !== null,\n  );\n  if (declaration.action !== \"required\" || !input.alertOccurrenceLabels) return null;\n  const selectorEntries = declaration.preflight.dataSource.alertSelectorLabels\n    .map((label) => [label, input.alertOccurrenceLabels?.[label]] as const)\n    .sort(([left], [right]) => left.localeCompare(right));\n  if (selectorEntries.some(([, value]) => typeof value !== \"string\" || value.length === 0)) {\n    return null;\n  }\n  const normalized = {\n    metadataComplete: responder.metadataComplete,\n    resources: [...responder.resources].map((resource) => stableJson(resource)).sort(),\n    mcpServerIds: [...responder.mcpServerIds].sort(),\n    firstPartyMcpTools: [...responder.firstPartyMcpTools].sort(),\n    firstPartyMcpPermissions: [...responder.firstPartyMcpPermissions].sort(),\n    rig: responder.rig\n      ? {\n          name: responder.rig.name,\n          credentialHooks: [...responder.rig.credentialHooks].sort(),\n          checkHealth: responder.rig.checkHealth,\n        }\n      : null,\n    vaults: [...responder.vaults]\n      .map((vault) => ({\n        name: vault.name,\n        items: vault.items.map((item) => item.name).sort(),\n      }))\n      .sort((left, right) => left.name.localeCompare(right.name)),\n  };\n  return {\n    version: 2,\n    toolPolicyVersion: responder.toolPolicyVersion,\n    responderDigest: createHash(\"sha256\").update(stableJson(normalized)).digest(\"hex\"),\n    taskDigest: createHash(\"sha256\").update(stableJson(task)).digest(\"hex\"),\n    alertSelectorDigest: createHash(\"sha256\").update(stableJson(selectorEntries)).digest(\"hex\"),\n  };\n}\n\nexport function parseIncidentTelemetryAuthorityFence(\n  lineage: Record<string, unknown>,\n): IncidentTelemetryAuthorityFence | null {\n  const raw = lineage[INCIDENT_TELEMETRY_AUTHORITY_FENCE_LINEAGE_KEY];\n  if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return null;\n  const value = raw as Record<string, unknown>;\n  return value.version === 2 &&\n    typeof value.toolPolicyVersion === \"number\" &&\n    Number.isInteger(value.toolPolicyVersion) &&\n    value.toolPolicyVersion > 0 &&\n    typeof value.responderDigest === \"string\" &&\n    /^[0-9a-f]{64}$/.test(value.responderDigest) &&\n    typeof value.taskDigest === \"string\" &&\n    /^[0-9a-f]{64}$/.test(value.taskDigest) &&\n    typeof value.alertSelectorDigest === \"string\" &&\n    /^[0-9a-f]{64}$/.test(value.alertSelectorDigest)\n    ? {\n        version: 2,\n        toolPolicyVersion: value.toolPolicyVersion,\n        responderDigest: value.responderDigest,\n        taskDigest: value.taskDigest,\n        alertSelectorDigest: value.alertSelectorDigest,\n      }\n    : null;\n}\n\nfunction blocked(reason: IncidentTelemetryPreflightBlockReason): IncidentTelemetryPreflightResult {\n  return { action: \"blocked\", reason };\n}\n\nfunction rigSatisfies(\n  rig: IncidentTelemetryRigMetadata | null,\n  required: { name: string; credentialHookIds: readonly string[] },\n): boolean {\n  if (!rig || rig.name !== required.name || rig.checkHealth !== \"passing\") {\n    return false;\n  }\n  const hookIds = new Set(rig.credentialHooks);\n  return required.credentialHookIds.every((hookId) => hookIds.has(hookId));\n}\n\nfunction seriesMetadataSatisfies(dataSource: IncidentTelemetryPreflight[\"dataSource\"]): boolean {\n  if (dataSource.queryPath !== \"/api/v1/query\" && dataSource.queryPath !== \"/api/v1/query_range\") {\n    return false;\n  }\n  return dataSource.requiredSeries.every((required) =>\n    dataSource.availableSeries.some((available) => {\n      if (available.metric !== required.metric) return false;\n      const labels = new Set(available.labels);\n      return (\n        labels.has(dataSource.workspaceLabel) && required.labels.every((label) => labels.has(label))\n      );\n    }),\n  );\n}\n\nfunction alertSelectorsSatisfy(\n  dataSource: IncidentTelemetryPreflight[\"dataSource\"],\n  occurrenceLabels: Readonly<Record<string, string>> | null,\n): boolean {\n  if (!occurrenceLabels) return false;\n  return dataSource.alertSelectorLabels.every(\n    (label) =>\n      label !== dataSource.workspaceLabel &&\n      typeof occurrenceLabels[label] === \"string\" &&\n      occurrenceLabels[label]!.length > 0 &&\n      dataSource.requiredSeries.every((series) => series.labels.includes(label)) &&\n      dataSource.availableSeries.some(\n        (series) =>\n          dataSource.requiredSeries.some((required) => required.metric === series.metric) &&\n          series.labels.includes(dataSource.workspaceLabel) &&\n          series.labels.includes(label),\n      ),\n  );\n}\n","import {\n  DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,\n  type McpPersonalConnectionDelegation,\n  type ScheduledTask,\n  type ScheduledTaskRunAcceptedExecution,\n  type Session,\n  type SessionSystemUpdate,\n} from \"@opengeni/contracts\";\nimport { defaultSessionMcpServerIds, resolveSessionToolPolicy } from \"@opengeni/core\";\nimport {\n  getRig,\n  getScheduledScopedRigVersionMetadata,\n  getScheduledTaskRunAcceptedExecution,\n  listEnabledMcpCapabilityServerIds,\n  listInstalledApiIntegrationServerIdsForDelegations,\n  listVaultItems,\n  listVaultsForSubject,\n  markScheduledTaskRunAuthorityRejectedInTransaction,\n  requireSession,\n  requireWorkspace,\n  type Database,\n} from \"@opengeni/db\";\nimport {\n  resolveSessionFirstPartyMcpTools,\n  resolveFirstPartyMcpToolPolicy,\n  type Settings,\n} from \"@opengeni/config\";\nimport { withFirstPartyTools } from \"./goals\";\nimport {\n  INCIDENT_TELEMETRY_AUTHORITY_FENCE_LINEAGE_KEY,\n  incidentTelemetryAuthorityFence,\n  parseIncidentTelemetryAuthorityFence,\n  evaluateIncidentTelemetryPreflight,\n  incidentTelemetryPreflightDeclaration,\n  type IncidentTelemetryResponderMetadata,\n  type IncidentTelemetryVaultMetadata,\n} from \"./incident-telemetry-preflight\";\n\n/**\n * Vaults (with item names) the responder reaches under the task's vault\n * policy, read only when the preflight names vaults or items. Metadata only:\n * connected vaults answer from their mirror, values are never read. Returns\n * null when the lookup failed, so the run blocks as metadata-incomplete.\n */\nasync function resolveIncidentTelemetryVaults(input: {\n  db: Database;\n  task: ScheduledTask;\n  subjectId: string;\n}): Promise<IncidentTelemetryVaultMetadata[] | null> {\n  const declaration = incidentTelemetryPreflightDeclaration(input.task.agentConfig, true);\n  if (declaration.action !== \"required\") return [];\n  const preflight = declaration.preflight;\n  if (\n    preflight.requiredVariableSetNames.length === 0 &&\n    preflight.requiredVariableNames.length === 0 &&\n    preflight.dataSource.route.kind !== \"variable_set\"\n  ) {\n    return [];\n  }\n  const context = {\n    kind: \"subject\" as const,\n    accountId: input.task.accountId,\n    workspaceId: input.task.workspaceId,\n    subjectId: input.subjectId,\n  };\n  const policy = input.task.vaultPolicy ?? { mode: \"all\" as const };\n  try {\n    const reachable = (\n      await listVaultsForSubject(input.db, context, { workspaceId: input.task.workspaceId })\n    ).filter((vault) => policy.mode === \"all\" || policy.vaultIds.includes(vault.id));\n    const vaults: IncidentTelemetryVaultMetadata[] = [];\n    for (const vault of reachable) {\n      const items: { name: string }[] = [];\n      let cursor: string | undefined;\n      do {\n        const page = await listVaultItems(input.db, context, {\n          vaultId: vault.id,\n          limit: 200,\n          ...(cursor ? { cursor } : {}),\n        });\n        items.push(...page.items.map((item) => ({ name: item.name })));\n        cursor = page.nextCursor ?? undefined;\n      } while (cursor);\n      vaults.push({ name: vault.name, items });\n    }\n    return vaults;\n  } catch {\n    return null;\n  }\n}\n\n/** Resolve only exact selected responder metadata; never read/decrypt values or call providers. */\nexport async function resolveIncidentTelemetryResponderMetadata(input: {\n  db: Database;\n  settings: Settings;\n  task: ScheduledTask;\n  session: Session | null;\n  personalConnectionDelegations: readonly McpPersonalConnectionDelegation[];\n  personalResourceAuthoritySubjectId?: string | null;\n  /**\n   * The tools a run that has no session yet will start with; a schedule that\n   * follows the workspace defaults resolves them per run.\n   */\n  plannedTools?: Session[\"tools\"];\n  executionPolicy?: {\n    tools: ScheduledTaskRunAcceptedExecution[\"resolvedTools\"];\n    firstPartyMcpTools: ScheduledTaskRunAcceptedExecution[\"resolvedFirstPartyMcpTools\"];\n    firstPartyMcpPermissions:\n      | ScheduledTaskRunAcceptedExecution[\"resolvedFirstPartyMcpPermissions\"]\n      | null;\n    rigId: string | null;\n    rigVersionId: string | null;\n    toolPolicy: Session[\"toolPolicy\"];\n    mcpServerIds: readonly string[];\n    toolPolicyVersion: number | null;\n  };\n}): Promise<IncidentTelemetryResponderMetadata> {\n  const [capabilityServerIds, apiIntegrationServerIds] = await Promise.all([\n    listEnabledMcpCapabilityServerIds(input.db, input.task.workspaceId),\n    listInstalledApiIntegrationServerIdsForDelegations(\n      input.db,\n      input.task.workspaceId,\n      input.personalConnectionDelegations,\n    ),\n  ]);\n  const sessionTools = input.executionPolicy\n    ? input.executionPolicy.tools\n    : input.session\n      ? input.session.tools\n      : (input.plannedTools ?? withFirstPartyTools(input.settings, input.task.agentConfig.tools));\n  const resolvedToolPolicy = resolveIncidentTelemetryResponderToolPolicy({\n    settingsMcpServerIds: input.settings.mcpServers.map((server) => server.id),\n    capabilityServerIds,\n    apiIntegrationServerIds,\n    ...(input.executionPolicy\n      ? { acceptedSessionMcpServerIds: input.executionPolicy.mcpServerIds }\n      : {}),\n    session: input.executionPolicy\n      ? {\n          mcpServers: input.executionPolicy.mcpServerIds.map((id) => ({ id })),\n          tools: input.executionPolicy.tools,\n          toolPolicy: input.executionPolicy.toolPolicy,\n        }\n      : input.session,\n    plannedTools: sessionTools,\n  });\n\n  let metadataComplete = true;\n  let rig: IncidentTelemetryResponderMetadata[\"rig\"] = null;\n  if (input.executionPolicy ?? input.session) {\n    const rigId = input.executionPolicy?.rigId ?? input.session?.rigId ?? null;\n    const rigVersionId = input.executionPolicy?.rigVersionId ?? input.session?.rigVersionId ?? null;\n    if ((rigId === null) !== (rigVersionId === null)) {\n      metadataComplete = false;\n    } else if (rigId && rigVersionId) {\n      const selected = await getScheduledScopedRigVersionMetadata(\n        input.db,\n        {\n          accountId: input.task.accountId,\n          workspaceId: input.task.workspaceId,\n          subjectId: input.personalResourceAuthoritySubjectId ?? input.task.createdBy.subjectId,\n        },\n        rigId,\n        rigVersionId,\n      );\n      if (!selected) {\n        metadataComplete = false;\n      } else {\n        rig = {\n          name: selected.name,\n          credentialHooks: selected.version.credentialHooks,\n          checkHealth: selected.health.checkHealth,\n        };\n      }\n    }\n  } else {\n    if (input.task.rigId) {\n      const selectedRig = await getRig(\n        input.db,\n        {\n          accountId: input.task.accountId,\n          workspaceId: input.task.workspaceId,\n          subjectId: input.personalResourceAuthoritySubjectId ?? input.task.createdBy.subjectId,\n        },\n        input.task.rigId,\n      );\n      if (!selectedRig?.activeVersion || !selectedRig.activeVersionHealth) {\n        metadataComplete = false;\n      } else {\n        rig = {\n          name: selectedRig.name,\n          credentialHooks: selectedRig.activeVersion.credentialHooks,\n          checkHealth: selectedRig.activeVersionHealth.checkHealth,\n        };\n      }\n    }\n  }\n\n  const vaults = await resolveIncidentTelemetryVaults({\n    db: input.db,\n    task: input.task,\n    subjectId: input.personalResourceAuthoritySubjectId ?? input.task.createdBy.subjectId,\n  });\n  if (vaults === null) metadataComplete = false;\n\n  return {\n    metadataComplete,\n    resources: input.executionPolicy\n      ? input.task.agentConfig.resources\n      : (input.session?.resources ?? input.task.agentConfig.resources),\n    mcpServerIds: resolvedToolPolicy.toolRefs.map((tool) => tool.id),\n    firstPartyMcpTools: input.executionPolicy\n      ? input.executionPolicy.firstPartyMcpTools\n      : input.session\n        ? resolveSessionFirstPartyMcpTools(\n            input.settings,\n            input.session,\n            (await requireWorkspace(input.db, input.task.workspaceId)).settings,\n          )\n        : resolveFirstPartyMcpToolPolicy(input.settings).default,\n    firstPartyMcpPermissions: input.executionPolicy\n      ? (input.executionPolicy.firstPartyMcpPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS)\n      : (input.session?.firstPartyMcpPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS),\n    rig,\n    vaults: vaults ?? [],\n    toolPolicyVersion:\n      input.executionPolicy?.toolPolicyVersion ?? input.session?.toolPolicyVersion ?? null,\n  };\n}\n\n/** Resolve the responder's current ID-only MCP policy without materializing runtime secrets. */\nexport function resolveIncidentTelemetryResponderToolPolicy(input: {\n  settingsMcpServerIds: readonly string[];\n  capabilityServerIds: readonly string[];\n  apiIntegrationServerIds: readonly string[];\n  acceptedSessionMcpServerIds?: readonly string[];\n  session: {\n    mcpServers: readonly { id: string }[];\n    tools: Session[\"tools\"];\n    toolPolicy: Session[\"toolPolicy\"];\n  } | null;\n  plannedTools: Session[\"tools\"];\n}) {\n  const workspaceDefaultMcpServerIds = new Set(input.settingsMcpServerIds);\n  for (const id of input.capabilityServerIds) workspaceDefaultMcpServerIds.add(id);\n  for (const id of input.apiIntegrationServerIds) workspaceDefaultMcpServerIds.add(id);\n  for (const id of input.acceptedSessionMcpServerIds ?? []) {\n    workspaceDefaultMcpServerIds.add(id);\n  }\n\n  const availableMcpServerIds = new Set(workspaceDefaultMcpServerIds);\n  for (const server of input.session?.mcpServers ?? []) {\n    availableMcpServerIds.add(server.id);\n  }\n\n  return resolveSessionToolPolicy({\n    toolPolicy: input.session?.toolPolicy ?? {\n      mode: \"explicit\",\n      inheritedFromSessionId: null,\n    },\n    sessionTools: input.plannedTools,\n    availableMcpServerIds,\n    defaultMcpServerIds: defaultSessionMcpServerIds(\n      [...workspaceDefaultMcpServerIds].map((id) => ({ id })),\n    ),\n  });\n}\n\n/** Revalidate a source-frozen incident responder fence before a turn can claim it. */\nexport async function validateIncidentTelemetrySystemUpdateAuthority(input: {\n  db: Database;\n  settings: Settings;\n  workspaceId: string;\n  sessionId: string;\n  update: SessionSystemUpdate;\n}): Promise<{ action: \"accept\" } | { action: \"reject\"; reason: string }> {\n  if (!(INCIDENT_TELEMETRY_AUTHORITY_FENCE_LINEAGE_KEY in input.update.lineage)) {\n    return { action: \"accept\" };\n  }\n  const fence = parseIncidentTelemetryAuthorityFence(input.update.lineage);\n  const payload = input.update.payload;\n  const taskId = input.update.lineage.scheduledTaskId;\n  const runId = payload.type === \"scheduled_occurrence\" ? payload.scheduledTaskRunId : null;\n  const reject = async () => {\n    if (runId) {\n      await markScheduledTaskRunAuthorityRejectedInTransaction(input.db, {\n        workspaceId: input.workspaceId,\n        sessionId: input.sessionId,\n        runId,\n      });\n    }\n    return {\n      action: \"reject\",\n      reason: \"incident_responder_under_capable\",\n    } as const;\n  };\n  if (!fence || typeof taskId !== \"string\" || !runId) return await reject();\n\n  const session = await requireSession(input.db, input.workspaceId, input.sessionId);\n  const acceptedExecution = await getScheduledTaskRunAcceptedExecution(input.db, {\n    workspaceId: input.workspaceId,\n    runId,\n  });\n  if (\n    !acceptedExecution ||\n    acceptedExecution.task.id !== taskId ||\n    !acceptedExecution.incidentPreflightRequired\n  ) {\n    return await reject();\n  }\n  const task = acceptedExecution.task;\n  const personalConnectionDelegations = acceptedExecution.personalConnectionDelegations;\n  const responder = await resolveIncidentTelemetryResponderMetadata({\n    db: input.db,\n    settings: input.settings,\n    task,\n    session,\n    personalConnectionDelegations,\n    personalResourceAuthoritySubjectId: acceptedExecution.personalResourceAuthoritySubjectId,\n    executionPolicy: acceptedExecution.targetSessionExecution\n      ? {\n          tools: acceptedExecution.targetSessionExecution.tools,\n          firstPartyMcpTools:\n            acceptedExecution.targetSessionExecution.effectiveFirstPartyMcpTools ??\n            acceptedExecution.targetSessionExecution.firstPartyMcpTools,\n          firstPartyMcpPermissions:\n            acceptedExecution.targetSessionExecution.firstPartyMcpPermissions,\n          rigId: acceptedExecution.targetSessionExecution.rigId,\n          rigVersionId: acceptedExecution.targetSessionExecution.rigVersionId,\n          toolPolicy: acceptedExecution.targetSessionExecution.toolPolicy,\n          mcpServerIds: acceptedExecution.targetSessionExecution.mcpServerIds,\n          toolPolicyVersion: acceptedExecution.targetSessionExecution.toolPolicyVersion,\n        }\n      : {\n          tools: acceptedExecution.resolvedTools,\n          firstPartyMcpTools: acceptedExecution.resolvedFirstPartyMcpTools,\n          firstPartyMcpPermissions: acceptedExecution.resolvedFirstPartyMcpPermissions,\n          rigId: acceptedExecution.resolvedRig?.id ?? null,\n          rigVersionId: acceptedExecution.resolvedRig?.versionId ?? null,\n          toolPolicy: session.toolPolicy,\n          mcpServerIds: [],\n          toolPolicyVersion: session.toolPolicyVersion,\n        },\n  });\n  const preflight = evaluateIncidentTelemetryPreflight({\n    agentConfig: task.agentConfig,\n    incidentTriggered: acceptedExecution.alertOccurrenceLabels !== null,\n    alertOccurrenceLabels: acceptedExecution.alertOccurrenceLabels,\n    responder,\n  });\n  if (preflight.action !== \"ready\") return await reject();\n  const current = incidentTelemetryAuthorityFence({\n    task,\n    responder,\n    alertOccurrenceLabels: acceptedExecution.alertOccurrenceLabels,\n  });\n  return current &&\n    current.toolPolicyVersion === fence.toolPolicyVersion &&\n    current.responderDigest === fence.responderDigest &&\n    current.taskDigest === fence.taskDigest &&\n    current.alertSelectorDigest === fence.alertSelectorDigest\n    ? { action: \"accept\" }\n    : await reject();\n}\n","import type { TurnHistorySink } from \"./history-sink\";\nimport type { Settings } from \"@opengeni/config\";\n\nexport class SandboxCapabilitiesChangedError extends Error {\n  readonly code = \"native_capabilities_changed_this_attempt\";\n\n  constructor() {\n    super(\"The attached sandbox requires rebuilding this attempt's native capabilities.\");\n    this.name = \"SandboxCapabilitiesChangedError\";\n  }\n}\n\n/**\n * Persist the SDK's complete prior model/tool history before another provider\n * request can start. The first request has no prior model/tool rows to append.\n * Follow-up requests run only after the preceding complete call/result batch is\n * replay-safe.\n */\nexport async function checkpointHistoryBeforeProviderDispatch(\n  historySink: Pick<TurnHistorySink, \"reconcileConversationTruth\">,\n  route?: {\n    effectiveSandboxBackend: Settings[\"sandboxBackend\"];\n    routingEnabled: boolean;\n    readActiveSandbox: () => Promise<{ activeSandboxId: string | null } | null>;\n  },\n): Promise<void> {\n  await historySink.reconcileConversationTruth({ requireDurable: true });\n  // A plain Agent cannot acquire SandboxAgent capabilities in place. Preserve\n  // its completed tool batch before recovering the same logical turn; the next\n  // attempt resolves and authorizes the route normally.\n  if (route?.effectiveSandboxBackend === \"none\" && route.routingEnabled) {\n    const active = await route.readActiveSandbox();\n    if (active?.activeSandboxId) throw new SandboxCapabilitiesChangedError();\n  }\n}\n","import type { HeldSessionUsageReceipt } from \"@opengeni/core\";\nimport { settleSessionUsageReceipt, SessionUsageLimitUnavailableError } from \"@opengeni/db\";\nimport type { TurnActivityServices as ActivityServices } from \"../types\";\n\n/**\n * Attempt-scoped custody for per-task usage receipts whose write failed after\n * the provider response was received.\n *\n * The response is never lost or re-requested because of an accounting\n * failure: settlement hands the content-free receipt here (original source\n * identity, amount, pricing source) and the turn keeps the response. Before\n * the next model request (every admission check) and before the turn\n * completes, held receipts are written; if that still fails, the attempt\n * stops for the workflow's DB-only recovery lane and carries the held\n * receipts in its typed failure detail (durable in workflow history), which\n * the lane writes before any replacement attempt. Writes are idempotent per\n * source identity, so overlapping writers (the `agent.model.usage` event\n * meter, a later flush and the recovery lane) record the call once.\n */\n\ntype Scope = { accountId: string; workspaceId: string };\ntype Entry = Scope & { receipts: Map<string, HeldSessionUsageReceipt> };\n\n/** Bound on receipts carried through one recovery failure detail. */\nexport const MAX_RECOVERY_SESSION_USAGE_RECEIPTS = 64;\nconst MAX_HELD_SESSIONS = 4096;\nconst FLUSH_DELAYS_MS = [0, 250, 1_000];\n\nconst held = new Map<string, Entry>();\n\n/** Recovery reason and detail code for a task whose earlier single-call receipt is still owed. */\nexport const SESSION_USAGE_CUSTODY_PENDING = \"session_usage_custody_pending\";\n/**\n * How long a parked turn waits before its replacement attempt re-checks\n * admission (database reads only). An owner fills its receipt within\n * seconds; a dead owner's marker is disclosed by maintenance after 30\n * minutes, so a task waits at most about 60 rechecks.\n */\nexport const SESSION_USAGE_CUSTODY_RECHECK_MS = 30_000;\n\n/** A fenced or overdue custody marker (not a database outage) refused the next model request. */\nexport function sessionUsageCustodyPending(error: unknown): boolean {\n  let current = error;\n  for (let depth = 0; depth < 6 && current && typeof current === \"object\"; depth += 1) {\n    if (current instanceof SessionUsageLimitUnavailableError) {\n      return current.reason === \"custody_pending\";\n    }\n    current = (current as { cause?: unknown }).cause;\n  }\n  return false;\n}\n\nexport function holdSessionUsageReceipt(scope: Scope, receipt: HeldSessionUsageReceipt): void {\n  let entry = held.get(receipt.sessionId);\n  if (!entry) {\n    if (held.size >= MAX_HELD_SESSIONS) {\n      // Oldest sessions only: their receipts already travelled with a\n      // recovery failure or will be re-imported from durable usage events.\n      const oldest = held.keys().next().value;\n      if (oldest !== undefined) held.delete(oldest);\n    }\n    entry = { accountId: scope.accountId, workspaceId: scope.workspaceId, receipts: new Map() };\n    held.set(receipt.sessionId, entry);\n  }\n  entry.receipts.set(receipt.sourceId, receipt);\n}\n\n/** Held receipts for one turn, bounded, for a post-claim recovery failure detail. */\nexport function heldSessionUsageReceiptsForTurn(turnId: string): HeldSessionUsageReceipt[] {\n  const receipts: HeldSessionUsageReceipt[] = [];\n  for (const entry of held.values()) {\n    for (const receipt of entry.receipts.values()) {\n      if (receipt.turnId === turnId) receipts.push(receipt);\n      if (receipts.length >= MAX_RECOVERY_SESSION_USAGE_RECEIPTS) return receipts;\n    }\n  }\n  return receipts;\n}\n\nexport function heldSessionUsageReceiptCount(sessionId?: string): number {\n  if (sessionId !== undefined) return held.get(sessionId)?.receipts.size ?? 0;\n  let count = 0;\n  for (const entry of held.values()) count += entry.receipts.size;\n  return count;\n}\n\n/**\n * The `agent.model.usage` event for a held receipt committed. Its appending\n * transaction meters the same source identity through the database trigger\n * (or, for a root still preparing, leaves the event for the bounded import),\n * and a trigger failure would have rolled the event back. When the event\n * carries exactly the held amount, the receipt is therefore durable and the\n * hold is dropped, so completion does not stop for a write that is already\n * done. A different or unknown event amount keeps the hold: only the direct\n * write can record (or fill) that value.\n */\nexport function releaseHeldSessionUsageReceiptMeteredByEvent(input: {\n  sessionId: string;\n  sourceId: string;\n  amountMicros: number | null;\n  pricingSource: string | null;\n}): boolean {\n  const entry = held.get(input.sessionId);\n  const receipt = entry?.receipts.get(input.sourceId);\n  if (!entry || !receipt) return false;\n  if (receipt.amountMicros !== input.amountMicros) return false;\n  if (receipt.amountMicros !== null && receipt.pricingSource !== input.pricingSource) return false;\n  entry.receipts.delete(input.sourceId);\n  if (entry.receipts.size === 0 && held.get(input.sessionId) === entry) {\n    held.delete(input.sessionId);\n  }\n  return true;\n}\n\n/** Write receipts with their original identities; throws the last database error. */\nexport async function writeSessionUsageReceipts(\n  db: ActivityServices[\"db\"],\n  scope: Scope,\n  receipts: readonly HeldSessionUsageReceipt[],\n): Promise<void> {\n  for (const receipt of receipts) {\n    await settleSessionUsageReceipt(db, {\n      accountId: scope.accountId,\n      workspaceId: scope.workspaceId,\n      sessionId: receipt.sessionId,\n      sourceId: receipt.sourceId,\n      turnId: receipt.turnId,\n      amountMicros: receipt.amountMicros,\n      pricingSource: receipt.amountMicros === null ? null : receipt.pricingSource,\n      model: receipt.model,\n    });\n  }\n}\n\n/**\n * Write every receipt held for this session before another model request or\n * turn completion. Retries briefly; a persistent failure rethrows the\n * database error so the attempt enters post-claim DB recovery with the\n * receipts still held for its failure detail.\n */\nexport async function flushHeldSessionUsageReceipts(\n  db: ActivityServices[\"db\"],\n  sessionId: string,\n): Promise<void> {\n  const entry = held.get(sessionId);\n  if (!entry || entry.receipts.size === 0) return;\n  let lastError: unknown;\n  for (const delay of FLUSH_DELAYS_MS) {\n    if (delay > 0) await new Promise((resolve) => setTimeout(resolve, delay));\n    try {\n      // A parallel call (session title) may hold another receipt meanwhile.\n      while (entry.receipts.size > 0) {\n        for (const [sourceId, receipt] of [...entry.receipts]) {\n          await writeSessionUsageReceipts(db, entry, [receipt]);\n          entry.receipts.delete(sourceId);\n        }\n      }\n      if (entry.receipts.size === 0 && held.get(sessionId) === entry) held.delete(sessionId);\n      return;\n    } catch (error) {\n      lastError = error;\n    }\n  }\n  throw lastError;\n}\n\n/** Test-only reset of process custody. */\nexport function resetSessionUsageReceiptCustodyForTests(): void {\n  held.clear();\n}\n","import {\n  CODEX_CLIENT_VERSION,\n  fetchCodexUsage,\n  normalizeCodexUsage,\n  type CodexTokenSnapshot,\n  type CodexUsageHeaderSnapshot,\n  type CodexUsagePayload,\n} from \"@opengeni/codex\";\nimport { SubscriptionCoreCodexRequestOutcomeUnknownError } from \"@opengeni/db\";\n\n/** Local admission decision, never a synthetic provider/transport error. */\nexport class CodexIncludedUsageExhaustedError extends Error {\n  readonly code = \"codex_included_usage_exhausted\";\n  constructor(readonly resetsInSeconds: number | null) {\n    super(\"This account's included Codex usage is exhausted. Extra credits are protected.\");\n    this.name = \"CodexIncludedUsageExhaustedError\";\n  }\n}\n\nexport class CodexIncludedUsageUnknownError extends Error {\n  readonly code = \"codex_included_usage_unknown\";\n  constructor() {\n    super(\n      \"Couldn't verify included Codex usage. This account is temporarily unavailable while extra credits are protected.\",\n    );\n    this.name = \"CodexIncludedUsageUnknownError\";\n  }\n}\n\nexport function findCodexCreditPolicyError(\n  error: unknown,\n): CodexIncludedUsageExhaustedError | CodexIncludedUsageUnknownError | null {\n  const seen = new Set<object>();\n  for (let depth = 0; depth < 8 && error && typeof error === \"object\"; depth++) {\n    if (seen.has(error)) break;\n    seen.add(error);\n    if (\n      error instanceof CodexIncludedUsageExhaustedError ||\n      error instanceof CodexIncludedUsageUnknownError\n    )\n      return error;\n    error = (error as { cause?: unknown }).cause;\n  }\n  return null;\n}\n\n/** A model call can cross the provider's limit; the next call must be admitted again. */\nexport function createCodexCreditGuard(input: {\n  allowExtraCredits?: boolean;\n  /** Live accepted-pool admission, rechecked immediately before dispatch. */\n  canSpendCredits?: () => Promise<boolean>;\n  readUsage?: (token: CodexTokenSnapshot) => Promise<CodexUsagePayload>;\n  fetchUsage?: typeof fetchCodexUsage;\n  refreshToken?: () => Promise<CodexTokenSnapshot>;\n  now?: () => number;\n  onUsage?: (snapshot: CodexUsageHeaderSnapshot) => void;\n}) {\n  const now = input.now ?? Date.now;\n  const readUsage =\n    input.readUsage ??\n    (async (token: CodexTokenSnapshot) => {\n      const result = await (input.fetchUsage ?? fetchCodexUsage)({\n        ...token,\n        clientVersion: CODEX_CLIENT_VERSION,\n      });\n      if (result.status === 401) throw new CodexUsageUnauthorizedError();\n      return normalizeCodexUsage(result.status, result.payload);\n    });\n  let token: CodexTokenSnapshot | null = null;\n  type Observation = { windows: Array<{ used: number; reset: Date | null }>; checkedAt: Date };\n  let snapshot: Observation | null = null;\n  let spendingRefusal: CodexIncludedUsageExhaustedError | CodexIncludedUsageUnknownError | null =\n    null;\n  let observationRevision = 0;\n  let admissionTail: Promise<void> = Promise.resolve();\n  const observe = (next: CodexUsageHeaderSnapshot) => {\n    if (snapshot && next.checkedAt.getTime() < snapshot.checkedAt.getTime()) return;\n    observationRevision++;\n    snapshot = {\n      checkedAt: next.checkedAt,\n      windows: [\n        { used: next.primaryUsedPercent, reset: next.primaryResetAt },\n        { used: next.secondaryUsedPercent, reset: next.secondaryResetAt },\n      ],\n    };\n  };\n  const check = (value: Observation, at: number): boolean => {\n    const windows = value.windows;\n    const exhausted = windows.filter((w) => w.used >= 100 && (!w.reset || w.reset.getTime() > at));\n    if (exhausted.length) {\n      const reset = exhausted.every((w) => w.reset)\n        ? Math.max(...exhausted.map((w) => w.reset!.getTime()))\n        : null;\n      throw new CodexIncludedUsageExhaustedError(\n        reset === null ? null : Math.ceil((reset - at) / 1000),\n      );\n    }\n    // A passed reset is a reason to refresh, not proof of new allowance.\n    return windows.every((w) => Number.isFinite(w.used) && (!w.reset || w.reset.getTime() > at));\n  };\n  const assertCanDispatch = async () => {\n    if (input.allowExtraCredits) return;\n    const at = now();\n    // Headers can refuse dispatch immediately. A successful observation is\n    // never a reusable spending permit: the preceding response or another\n    // session may have consumed the remaining allowance.\n    if (snapshot) check(snapshot, at);\n    if (!token) throw new CodexIncludedUsageUnknownError();\n    const revisionAtRead = observationRevision;\n    let usage: CodexUsagePayload | null;\n    try {\n      usage = await readUsage(token);\n    } catch (error) {\n      if (error instanceof SubscriptionCoreCodexRequestOutcomeUnknownError) throw error;\n      if (error instanceof CodexUsageUnauthorizedError && input.refreshToken) {\n        // This runs during credential resolution, before the model's auth\n        // headers are constructed. The caller tracks the refreshed version.\n        token = await input.refreshToken();\n        usage = await readUsage(token).catch((usageError: unknown) => {\n          if (usageError instanceof SubscriptionCoreCodexRequestOutcomeUnknownError)\n            throw usageError;\n          return null;\n        });\n      } else {\n        usage = null;\n      }\n    }\n    if (!usage || usage.status === \"error\" || usage.status === \"no-data\")\n      throw new CodexIncludedUsageUnknownError();\n    const windows = [usage.fiveHour, usage.weekly].flatMap((window) =>\n      window\n        ? [\n            {\n              used: window.percent,\n              reset: window.resetAt ? new Date(window.resetAt) : null,\n            },\n          ]\n        : [],\n    );\n    if (!windows.length) {\n      if (usage.limitReached || usage.status === \"limit_reached\")\n        throw new CodexIncludedUsageExhaustedError(null);\n      throw new CodexIncludedUsageUnknownError();\n    }\n    const next: Observation = { windows, checkedAt: new Date(now()) };\n    // A response header received during this read is newer evidence than the\n    // request's snapshot. Never let a delayed usage response erase it.\n    if (observationRevision === revisionAtRead) snapshot = next;\n    // The legacy cache contract only accepts a complete duration-labeled pair.\n    if (usage.fiveHour && usage.weekly && observationRevision === revisionAtRead)\n      input.onUsage?.({\n        primaryUsedPercent: usage.fiveHour.percent,\n        primaryResetAt: usage.fiveHour.resetAt ? new Date(usage.fiveHour.resetAt) : null,\n        secondaryUsedPercent: usage.weekly.percent,\n        secondaryResetAt: usage.weekly.resetAt ? new Date(usage.weekly.resetAt) : null,\n        checkedAt: next.checkedAt,\n      });\n    if (snapshot) check(snapshot, now());\n    if (!check(next, now())) throw new CodexIncludedUsageUnknownError();\n    // Provider feature identifiers are not guaranteed to be model slugs.\n    // Until an authoritative mapping exists, an exhausted extra allowance\n    // cannot grant permission to continue spending on this account.\n    for (const limit of usage.additionalLimits ?? []) {\n      if (limit.unknownWindowExhausted) throw new CodexIncludedUsageExhaustedError(null);\n      const featureWindows = [limit.fiveHour, limit.weekly].flatMap((window) =>\n        window\n          ? [\n              {\n                used: window.percent,\n                reset: window.resetAt ? new Date(window.resetAt) : null,\n              },\n            ]\n          : [],\n      );\n      if (\n        featureWindows.length &&\n        !check({ windows: featureWindows, checkedAt: next.checkedAt }, now())\n      ) {\n        throw new CodexIncludedUsageUnknownError();\n      }\n    }\n    if (usage.limitReached || usage.status === \"limit_reached\")\n      throw new CodexIncludedUsageExhaustedError(null);\n  };\n  return {\n    setToken: (next: CodexTokenSnapshot) => {\n      token = next;\n    },\n    observe,\n    assertObservedUsageAllowsDispatch: async () => {\n      if (input.allowExtraCredits) return;\n      const refusal = spendingRefusal;\n      if (refusal instanceof CodexIncludedUsageExhaustedError) {\n        const allowed = await input.canSpendCredits?.();\n        // A concurrent read can learn that usage is unverifiable while this\n        // policy query is pending. Earlier consent cannot erase newer evidence.\n        if (spendingRefusal !== refusal) {\n          if (spendingRefusal) throw spendingRefusal;\n          if (snapshot) check(snapshot, now());\n          return;\n        }\n        if (allowed) return;\n      }\n      if (spendingRefusal) throw spendingRefusal;\n      if (snapshot) check(snapshot, now());\n    },\n    assertCanDispatch: () => {\n      // Main and title requests share this guard. Serialize their reads so a\n      // late successful response cannot overwrite a newer exhaustion result.\n      const admission = admissionTail.then(async () => {\n        try {\n          await assertCanDispatch();\n          // Pending reads cannot erase an earlier feature-limit refusal. Only\n          // a complete, successful usage observation restores included access.\n          spendingRefusal = null;\n        } catch (error) {\n          if (\n            error instanceof CodexIncludedUsageExhaustedError ||\n            error instanceof CodexIncludedUsageUnknownError\n          )\n            spendingRefusal = error;\n          if (\n            error instanceof CodexIncludedUsageExhaustedError &&\n            (await input.canSpendCredits?.()) &&\n            spendingRefusal === error\n          ) {\n            return;\n          }\n          throw error;\n        }\n      });\n      admissionTail = admission.catch(() => undefined);\n      return admission;\n    },\n  };\n}\n\nclass CodexUsageUnauthorizedError extends Error {}\n\n/** No awaited policy work may run after the final physical lease fence. */\nexport async function assertCodexDispatchAdmission(\n  assertCredits: () => Promise<void>,\n  assertLease: () => Promise<void>,\n): Promise<void> {\n  await assertCredits();\n  await assertLease();\n}\n","import {\n  SandboxLeaseRecoveryBlockedError,\n  SandboxLeaseSupersededError,\n  SandboxLeaseTransitionError,\n  SandboxImageConflictError,\n  SandboxRigConflictError,\n} from \"@opengeni/db\";\nimport {\n  SandboxConfigError,\n  SandboxExactResumeInstanceUnavailableError,\n  SandboxExactResumeReplacedError,\n  SandboxExecReadinessError,\n  SandboxProviderContinuityUnavailableError,\n  SandboxProviderUnavailableError,\n  SandboxResumeIdentityMismatchError,\n  SandboxResumeIdentityUnavailableError,\n  SandboxResumeStateUnavailableError,\n  WorkspaceArchiveIntegrityError,\n  classifyProviderSandboxFailure,\n} from \"@opengeni/runtime\";\nimport { type Settings } from \"@opengeni/config\";\nimport { CancelledFailure } from \"@temporalio/activity\";\nimport {\n  sandboxProvisionFailureStage,\n  SandboxProvisionStageError,\n  SandboxWarmingTimeoutError,\n} from \"../../sandbox-resume\";\nimport {\n  type SandboxLogicalProvisionCategory,\n  type SandboxLogicalProvisionStage,\n} from \"../../observability-metrics\";\nimport { randomUUID } from \"node:crypto\";\n\nexport type TurnSandboxProvisioner<T> = {\n  get(): Promise<T>;\n  hasStarted(): boolean;\n  waitForSettled(timeoutMs: number): Promise<T | null>;\n};\n\nexport type SandboxLogicalProvisionFailure = {\n  category: SandboxLogicalProvisionCategory;\n  stage: SandboxLogicalProvisionStage;\n  code: string;\n  expected: boolean;\n  retryable: boolean;\n};\n\nexport type TurnSandboxProvisionAttempt<T = unknown> = {\n  provisionId: string;\n  attempt: number;\n  outcome: \"completed\" | \"retrying\" | \"failed\";\n  durationMs: number;\n  result?: T;\n  error?: unknown;\n};\n\nexport type TurnSandboxProvisionSettlement = {\n  provisionId: string;\n  internalAttempts: number;\n  durationMs: number;\n};\n\nexport class TurnOperationCancelledError extends Error {\n  readonly name = \"TurnOperationCancelledError\";\n\n  constructor(readonly reason: unknown) {\n    super(\"Turn operation was cancelled with its owning turn\", {\n      ...(reason instanceof Error ? { cause: reason } : {}),\n    });\n  }\n}\n\nexport class SandboxDeadlineRotationError extends Error {\n  readonly name = \"SandboxDeadlineRotationError\";\n\n  constructor(\n    readonly sandboxGroupId: string,\n    readonly leaseEpoch: number,\n  ) {\n    super(\n      `Sandbox ${sandboxGroupId} reached its provider rotation boundary at lease epoch ${leaseEpoch}`,\n    );\n  }\n}\n\n/**\n * Normalize a preparation/provisioning cancellation race back to the Temporal\n * cancellation that owns the activity. Several provider APIs expose no portable\n * abort primitive, so the worker stops awaiting them and disposes any late\n * resource. The wrapper error must never fall through as an ordinary turn\n * failure: doing so would omit the quiescence receipt and strand a committed\n * Steer/Pause behind `control-pending`.\n */\nexport function turnOperationCancellationFailure(error: unknown): CancelledFailure | null {\n  if (error instanceof CancelledFailure) return error;\n  if (!(error instanceof TurnOperationCancelledError)) return null;\n  return error.reason instanceof CancelledFailure\n    ? error.reason\n    : new CancelledFailure(\"TURN_SANDBOX_PROVISION_CANCELLED\", [], error);\n}\n\nexport function throwIfTurnOperationCancelled(signal: AbortSignal | undefined): void {\n  if (signal?.aborted) {\n    throw new TurnOperationCancelledError(signal.reason);\n  }\n}\n\nexport async function waitForTurnOperation<T>(\n  operation: Promise<T>,\n  signal: AbortSignal | undefined,\n  disposeLateResult: ((result: T) => Promise<void> | void) | undefined,\n): Promise<T> {\n  if (!signal) return await operation;\n\n  let rejectCancellation: ((error: TurnOperationCancelledError) => void) | undefined;\n  const cancelled = new Promise<never>((_resolve, reject) => {\n    rejectCancellation = reject;\n  });\n  const cancel = (): void => {\n    rejectCancellation?.(new TurnOperationCancelledError(signal.reason));\n  };\n  signal.addEventListener(\"abort\", cancel, { once: true });\n  if (signal.aborted) cancel();\n\n  try {\n    const result = await Promise.race([operation, cancelled]);\n    // Cancellation owns an exact turn boundary even when the provider result\n    // and AbortSignal settle in the same microtask checkpoint. Never let a\n    // just-resolved lease escape after the control was already committed.\n    if (signal.aborted) {\n      throw new TurnOperationCancelledError(signal.reason);\n    }\n    return result;\n  } catch (error) {\n    if (signal.aborted) {\n      // The provider establish call has no universal cancellation seam. It may\n      // finish after the Temporal activity has correctly stopped; dispose its\n      // late lease instead of letting a cancelled turn resurrect a holder/box.\n      void operation\n        .then(async (result) => await disposeLateResult?.(result))\n        .catch(() => undefined);\n      // A provider failure may settle in the same checkpoint as the committed\n      // control. The control is authoritative; retain its cancellation shape\n      // so the activity publishes quiescence instead of looking like an\n      // unrelated turn failure.\n      if (!(error instanceof TurnOperationCancelledError)) {\n        throw new TurnOperationCancelledError(signal.reason);\n      }\n    }\n    throw error;\n  } finally {\n    signal.removeEventListener(\"abort\", cancel);\n  }\n}\n\n/**\n * Upper bound for joining a cancelled attempt's in-flight provider establish.\n * Worker shutdown cancels activities 5s after SIGTERM and force-stops 100s\n * after it; this leaves room for the remaining finalization steps.\n */\nexport const PHYSICAL_SANDBOX_RESUME_DRAIN_TIMEOUT_MS = 60_000;\n\n/** Register the PHYSICAL lease acquire/provider establish promise, not the\n * cancellable wrapper awaiting it. */\nexport function trackPhysicalSandboxResume<T>(\n  inFlight: Set<Promise<unknown>>,\n  operation: Promise<T>,\n): Promise<T> {\n  inFlight.add(operation);\n  const settle = (): void => {\n    inFlight.delete(operation);\n  };\n  operation.then(settle, settle);\n  return operation;\n}\n\n/**\n * Join every lease acquire/provider establish this attempt started, even after\n * the turn-facing wrapper rejected on cancellation. An establish has no\n * portable abort: after cancellation it still finishes its own exact cleanup\n * (terminate an unpublished box and roll warming back to cold, or keep a\n * published box and drop its holder). If the activity returned first, a\n * shutting-down worker exited mid-cleanup and stranded a warming lease naming a\n * terminated box; the replacement attempt then waited out the warming TTL and\n * inherited a lost-workspace verdict. This wait is deliberately independent of\n * the finalizer cancellation signal (cancellation is what started it) and is\n * bounded so an uncooperative provider call cannot pin the activity.\n */\nexport async function drainPhysicalSandboxResumes(\n  inFlight: Set<Promise<unknown>>,\n  timeoutMs: number = PHYSICAL_SANDBOX_RESUME_DRAIN_TIMEOUT_MS,\n): Promise<\"none\" | \"settled\" | \"timed_out\"> {\n  if (inFlight.size === 0) return \"none\";\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  try {\n    return await Promise.race([\n      Promise.allSettled([...inFlight]).then(() => \"settled\" as const),\n      new Promise<\"timed_out\">((resolve) => {\n        timer = setTimeout(() => resolve(\"timed_out\"), Math.max(1, timeoutMs));\n      }),\n    ]);\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n}\n\nexport function sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\nexport function sandboxProvisionErrorChain(error: unknown): unknown[] {\n  const chain: unknown[] = [];\n  const seen = new Set<object>();\n  let current = error;\n  for (let depth = 0; depth < 6; depth += 1) {\n    chain.push(current);\n    if (!current || typeof current !== \"object\" || seen.has(current)) break;\n    seen.add(current);\n    if (current instanceof SandboxProvisionStageError) {\n      current = current.source;\n      continue;\n    }\n    const cause = Reflect.get(current, \"cause\");\n    if (cause === undefined || cause === current) break;\n    current = cause;\n  }\n  return chain;\n}\n\nexport function firstProvisionError<T>(\n  chain: readonly unknown[],\n  constructor: abstract new (...args: never[]) => T,\n): T | null {\n  return chain.find((value): value is T => value instanceof constructor) ?? null;\n}\n\n/**\n * Closed, structural taxonomy for one logical provision failure. The classifier\n * follows only typed wrapper/cause links and provider status/code fields; it\n * never infers lifecycle truth from an arbitrary error message.\n */\nexport function classifySandboxLogicalProvisionFailure(\n  backend: string,\n  error: unknown,\n): SandboxLogicalProvisionFailure {\n  const chain = sandboxProvisionErrorChain(error);\n  const wrappedStage =\n    chain.map((value) => sandboxProvisionFailureStage(value)).find((stage) => stage !== null) ??\n    null;\n  const warming =\n    chain.find(\n      (value): value is SandboxWarmingTimeoutError => value instanceof SandboxWarmingTimeoutError,\n    ) ?? null;\n  if (warming) {\n    const execReadiness = warming.stage === \"exec_readiness\";\n    return {\n      category: execReadiness ? \"exec_readiness\" : \"sibling_warming\",\n      stage: execReadiness ? \"exec_readiness\" : \"sibling_warming\",\n      code: warming.code,\n      expected: false,\n      retryable: false,\n    };\n  }\n  const readiness = firstProvisionError(chain, SandboxExecReadinessError);\n  if (readiness) {\n    return {\n      category: \"exec_readiness\",\n      stage: \"exec_readiness\",\n      code: readiness.code,\n      expected: false,\n      retryable: false,\n    };\n  }\n  const superseded = firstProvisionError(chain, SandboxLeaseSupersededError);\n  if (superseded) {\n    return {\n      category: \"lease_superseded\",\n      stage: \"lease_admission\",\n      code: \"lease_superseded\",\n      expected: true,\n      retryable: true,\n    };\n  }\n  const transition = firstProvisionError(chain, SandboxLeaseTransitionError);\n  if (transition) {\n    return {\n      category: \"drain_capture_wait\",\n      stage: \"lifecycle_wait\",\n      code: transition.reason,\n      expected: true,\n      retryable: true,\n    };\n  }\n  const deadlineRotation = firstProvisionError(chain, SandboxDeadlineRotationError);\n  if (deadlineRotation) {\n    return {\n      category: \"drain_capture_wait\",\n      stage: \"lifecycle_wait\",\n      code: \"provider_deadline_rotation\",\n      expected: true,\n      retryable: false,\n    };\n  }\n  const recoveryBlocked = firstProvisionError(chain, SandboxLeaseRecoveryBlockedError);\n  if (recoveryBlocked) {\n    return {\n      category: \"archive_recovery\",\n      stage: \"archive_recovery\",\n      code: recoveryBlocked.code,\n      expected: false,\n      retryable: false,\n    };\n  }\n  const archive = firstProvisionError(chain, WorkspaceArchiveIntegrityError);\n  if (archive) {\n    return {\n      category: \"archive_recovery\",\n      stage: \"archive_recovery\",\n      code: archive.code,\n      expected: false,\n      retryable: archive.retryable,\n    };\n  }\n  const continuity = firstProvisionError(chain, SandboxProviderContinuityUnavailableError);\n  if (continuity) {\n    return {\n      category: \"archive_recovery\",\n      stage: \"archive_recovery\",\n      code: \"provider_continuity_unavailable\",\n      expected: false,\n      retryable: continuity.retryable,\n    };\n  }\n  const configuration = chain.find(\n    (value) =>\n      value instanceof SandboxConfigError ||\n      value instanceof SandboxProviderUnavailableError ||\n      value instanceof SandboxImageConflictError ||\n      value instanceof SandboxRigConflictError,\n  );\n  if (configuration) {\n    return {\n      category: \"configuration\",\n      stage: wrappedStage ?? \"configuration\",\n      code:\n        configuration instanceof SandboxImageConflictError\n          ? \"image_conflict\"\n          : configuration instanceof SandboxRigConflictError\n            ? \"rig_conflict\"\n            : configuration instanceof SandboxProviderUnavailableError\n              ? \"provider_unavailable\"\n              : \"sandbox_config\",\n      expected: false,\n      retryable: false,\n    };\n  }\n  const resumeFailure = chain.find(\n    (value) =>\n      value instanceof SandboxResumeStateUnavailableError ||\n      value instanceof SandboxResumeIdentityMismatchError ||\n      value instanceof SandboxResumeIdentityUnavailableError ||\n      value instanceof SandboxExactResumeReplacedError ||\n      value instanceof SandboxExactResumeInstanceUnavailableError,\n  );\n  if (resumeFailure) {\n    return {\n      category: \"resume\",\n      stage: \"resume\",\n      code:\n        resumeFailure instanceof SandboxResumeStateUnavailableError\n          ? \"resume_state_unavailable\"\n          : resumeFailure instanceof SandboxResumeIdentityMismatchError\n            ? \"resume_identity_mismatch\"\n            : resumeFailure instanceof SandboxResumeIdentityUnavailableError\n              ? \"resume_identity_unavailable\"\n              : resumeFailure instanceof SandboxExactResumeReplacedError\n                ? \"exact_resume_replaced\"\n                : \"exact_resume_instance_unavailable\",\n      expected: false,\n      retryable: false,\n    };\n  }\n  const providerFailure = classifyProviderSandboxFailure(backend, error);\n  if (providerFailure.kind === \"transient_transport\") {\n    return {\n      category: \"provider_transport\",\n      stage: wrappedStage ?? \"provider_transport\",\n      code: providerFailure.diagnostic,\n      expected: false,\n      // A typed transport fault is attributable, but a create outcome may be\n      // ambiguous. Classification never licenses replay on its own.\n      retryable: false,\n    };\n  }\n  if (wrappedStage) {\n    return {\n      category: wrappedStage,\n      stage: wrappedStage,\n      code: `${wrappedStage}_failed`,\n      expected: false,\n      retryable: false,\n    };\n  }\n  return {\n    category: \"unknown\",\n    stage: \"unknown\",\n    code: \"unknown\",\n    expected: false,\n    retryable: false,\n  };\n}\n\nexport function isLazySandboxProvisionRetryable(error: unknown): boolean {\n  const chain = sandboxProvisionErrorChain(error);\n  // Rotation resumes through the durable lifecycle wake. Retrying here holds\n  // a turn worker and can repeat the entire lease wait for every skill root.\n  if (\n    chain.some(\n      (value) =>\n        value instanceof SandboxLeaseTransitionError && value.reason === \"rotation_in_progress\",\n    )\n  )\n    return false;\n  if (\n    chain.some(\n      (value) =>\n        value instanceof SandboxImageConflictError ||\n        value instanceof SandboxRigConflictError ||\n        value instanceof SandboxLeaseRecoveryBlockedError,\n    )\n  ) {\n    return false;\n  }\n  const archive = firstProvisionError(chain, WorkspaceArchiveIntegrityError);\n  if (archive) {\n    return archive.retryable;\n  }\n  if (\n    chain.some(\n      (value) =>\n        value instanceof SandboxLeaseSupersededError ||\n        value instanceof SandboxLeaseTransitionError,\n    )\n  ) {\n    return true;\n  }\n  if (chain.some((value) => value instanceof SandboxWarmingTimeoutError)) {\n    return false;\n  }\n  // Provider/transport text is not durable evidence that creation never\n  // happened. Retrying an ambiguous unknown here can create a second box; only\n  // typed, ownership-fenced lifecycle outcomes above are safe to replay.\n  return false;\n}\n\n/** Short workflow-visible anti-churn pacing after a lifecycle transition. The\n * next acquire waits on the exact durable claim itself, so this is deliberately\n * not a guessed snapshot-plus-schedules completion time. */\nexport function sandboxDeadlineRotationRecoveryDelayMs(\n  settings: Pick<Settings, \"sandboxLeaseReaperPeriodMs\">,\n): number {\n  // The next attempt waits on the durable lifecycle claim itself. This delay is\n  // only anti-churn pacing, not an estimate of snapshot + future schedules.\n  return Math.min(5_000, settings.sandboxLeaseReaperPeriodMs);\n}\n\nexport function createTurnSandboxProvisioner<T>(\n  establish: () => Promise<T>,\n  options: {\n    maxRetries?: number;\n    backoffMs?: number;\n    signal?: AbortSignal;\n    provisionIdFactory?: () => string;\n    onStarted?: (\n      settlement: Pick<TurnSandboxProvisionSettlement, \"provisionId\">,\n    ) => Promise<void> | void;\n    onAttemptSettled?: (attempt: TurnSandboxProvisionAttempt<T>) => Promise<void> | void;\n    beforeCompleted?: (\n      result: T,\n      settlement: TurnSandboxProvisionSettlement,\n    ) => Promise<void> | void;\n    onCompleted?: (result: T, settlement: TurnSandboxProvisionSettlement) => Promise<void> | void;\n    onFailed?: (error: unknown, settlement: TurnSandboxProvisionSettlement) => Promise<void> | void;\n    disposeResult?: (result: T) => Promise<void> | void;\n  } = {},\n): TurnSandboxProvisioner<T> {\n  const maxRetries = options.maxRetries ?? 2;\n  const backoffMs = options.backoffMs ?? 250;\n  let memo: Promise<T> | null = null;\n\n  const run = async (\n    provisionId: string,\n    onAttempt: (attempt: number) => void,\n  ): Promise<{ result: T; internalAttempts: number }> => {\n    let internalAttempts = 0;\n    while (true) {\n      internalAttempts += 1;\n      onAttempt(internalAttempts);\n      const startedAt = performance.now();\n      try {\n        throwIfTurnOperationCancelled(options.signal);\n        const operation = establish();\n        const result = await waitForTurnOperation(operation, options.signal, options.disposeResult);\n        await options.onAttemptSettled?.({\n          provisionId,\n          attempt: internalAttempts,\n          outcome: \"completed\",\n          durationMs: performance.now() - startedAt,\n          result,\n        });\n        return { result, internalAttempts };\n      } catch (error) {\n        const retrying = !(\n          error instanceof TurnOperationCancelledError ||\n          internalAttempts > maxRetries ||\n          !isLazySandboxProvisionRetryable(error)\n        );\n        await options.onAttemptSettled?.({\n          provisionId,\n          attempt: internalAttempts,\n          outcome: retrying ? \"retrying\" : \"failed\",\n          durationMs: performance.now() - startedAt,\n          error,\n        });\n        if (!retrying) {\n          throw error;\n        }\n        await sleep(backoffMs * internalAttempts);\n      }\n    }\n  };\n\n  return {\n    get(): Promise<T> {\n      if (!memo) {\n        const provisionId = options.provisionIdFactory?.() ?? randomUUID();\n        memo = (async () => {\n          const startedAt = performance.now();\n          throwIfTurnOperationCancelled(options.signal);\n          await options.onStarted?.({ provisionId });\n          throwIfTurnOperationCancelled(options.signal);\n          let result: T | undefined;\n          let internalAttempts = 0;\n          let hasResult = false;\n          try {\n            const runResult = await run(provisionId, (attempt) => {\n              internalAttempts = attempt;\n            });\n            result = runResult.result;\n            internalAttempts = runResult.internalAttempts;\n            hasResult = true;\n            throwIfTurnOperationCancelled(options.signal);\n            await options.beforeCompleted?.(result, {\n              provisionId,\n              internalAttempts,\n              durationMs: performance.now() - startedAt,\n            });\n            throwIfTurnOperationCancelled(options.signal);\n            await options.onCompleted?.(result, {\n              provisionId,\n              internalAttempts,\n              durationMs: performance.now() - startedAt,\n            });\n            return result;\n          } catch (error) {\n            if (hasResult) {\n              await options.disposeResult?.(result as T);\n            }\n            if (!(error instanceof TurnOperationCancelledError)) {\n              await options.onFailed?.(error, {\n                provisionId,\n                internalAttempts: Math.max(1, internalAttempts),\n                durationMs: performance.now() - startedAt,\n              });\n            }\n            throw error;\n          }\n        })().catch((error) => {\n          // A terminal lease/archive/configuration result cannot change within\n          // this frozen turn. Keep its rejected promise memoized so later model\n          // tool calls observe the same typed result without re-entering\n          // provisioning, emitting another failure event, or creating another\n          // provider attempt. Only a retryable failure releases the single-flight\n          // for a later operation to re-read the lease/provider state.\n          if (isLazySandboxProvisionRetryable(error)) {\n            memo = null;\n          }\n          throw error;\n        });\n      }\n      return memo;\n    },\n    hasStarted(): boolean {\n      return memo !== null;\n    },\n    async waitForSettled(timeoutMs: number): Promise<T | null> {\n      if (!memo) {\n        return null;\n      }\n      let timer: ReturnType<typeof setTimeout> | undefined;\n      try {\n        return await Promise.race([\n          memo.catch(() => null),\n          new Promise<null>((resolve) => {\n            timer = setTimeout(() => resolve(null), timeoutMs);\n          }),\n        ]);\n      } finally {\n        if (timer) {\n          clearTimeout(timer);\n        }\n      }\n    },\n  };\n}\n\n/**\n * Decide whether THIS turn may send OpenAI's `prompt_cache_key` request field.\n *\n * Accepted transports:\n *   - legacy/built-in OpenAI or Azure Responses fallback (resolvedModel null);\n *   - resolved built-in OpenAI/Azure providers;\n *   - ChatGPT/Codex subscription backend (its strict allowlist permits the field).\n *   - native Anthropic Messages (maps the internal key to Claude session identity;\n *     the OpenAI field is never sent on that wire).\n *\n * Other registry API-key providers are intentionally excluded. Fireworks' prompt-cache\n * docs prescribe `user` or `x-session-affinity`, not `prompt_cache_key`; Z.AI/GLM\n * documents automatic context caching plus `user_id`. Sending OpenAI-only fields\n * to unknown OpenAI-compatible providers risks unsupported-parameter 400s.\n */\n","import { type SessionAttemptQuiescenceCommit } from \"@opengeni/db\";\nimport { type TurnToolCancellationFence } from \"@opengeni/runtime\";\nimport { type GitCredentialRenewalController } from \"../git-credential-renewal\";\nimport { type RunCredentialRenewalController } from \"../run-credential-renewal\";\nimport { type CodemodeTokenRenewalController } from \"../codemode-token-renewal\";\nimport type {\n  TurnActivityServices as ActivityServices,\n  RunAgentTurnResult,\n  SessionAttemptQuiescenceProof,\n} from \"../types\";\nimport { type ResumedTurnSandbox } from \"../../sandbox-resume\";\nimport { type SessionEvent } from \"@opengeni/contracts\";\nimport { sleep } from \"./sandbox-provision\";\n\nexport function shouldRunTurnEndWorkspacePersistence(input: {\n  activityStatus: RunAgentTurnResult[\"status\"] | \"unknown\";\n  cancellationRequested: boolean;\n  deadlineRotationRequested?: boolean;\n}): boolean {\n  return (\n    input.activityStatus !== \"cancelled\" &&\n    !input.cancellationRequested &&\n    input.deadlineRotationRequested !== true\n  );\n}\n\n/**\n * Periodic workspace snapshots protect work performed during a long-running\n * turn. Before the first provider request reaches the wire there is no\n * mid-turn agent work to protect; snapshotting platform setup at that point can\n * instead make the request wait behind the snapshot's workspace-write fence.\n */\nexport function shouldStartPeriodicWorkspaceSnapshot(input: {\n  firstProviderRequestStarted: boolean;\n  snapshotInFlight: boolean;\n  turnEndCaptureInProgress: boolean;\n  deadlineRotationRequested: boolean;\n}): boolean {\n  return (\n    input.firstProviderRequestStarted &&\n    !input.snapshotInFlight &&\n    !input.turnEndCaptureInProgress &&\n    !input.deadlineRotationRequested\n  );\n}\n\n/**\n * Temporal cancellation is delivery/transport state, never proof that the\n * dying activity crossed its mandatory sandbox-tool fence. If that fence\n * fails, surface the fence failure instead of retaining a misleading typed\n * cancellation; replacement admission remains closed because no durable\n * quiescence receipt was written.\n */\nexport function assertPhysicalToolQuiescenceForCancellation(input: {\n  acknowledgeQuiescence: boolean;\n  physicalToolQuiescenceConfirmed: boolean;\n  failure: unknown;\n}): void {\n  if (!input.acknowledgeQuiescence || input.physicalToolQuiescenceConfirmed) return;\n  if (input.failure instanceof Error) throw input.failure;\n  throw new Error(\"Physical sandbox-tool quiescence could not be confirmed\", {\n    cause: input.failure,\n  });\n}\n\n/** A physically drained attempt must leave one durable recovery producer. The\n * direct Postgres receipt is preferred; after its bounded retries exhaust, an\n * exact Temporal proof signal is sufficient because the workflow persists it\n * through an independently retrying DB-only control activity. */\nexport function assertSessionAttemptQuiescenceRecoveryDurable(input: {\n  acknowledgeQuiescence: boolean;\n  physicalToolQuiescenceConfirmed: boolean;\n  receiptOrProofDurable: boolean;\n  failure: unknown;\n}): void {\n  if (\n    !input.acknowledgeQuiescence ||\n    !input.physicalToolQuiescenceConfirmed ||\n    input.receiptOrProofDurable\n  ) {\n    return;\n  }\n  if (input.failure instanceof Error) throw input.failure;\n  throw new Error(\"Physical quiescence had no durable receipt or recovery proof\", {\n    cause: input.failure,\n  });\n}\n\nexport const QUIESCENCE_PROOF_SIGNAL_INITIAL_RETRY_MS = 250;\nexport const QUIESCENCE_PROOF_SIGNAL_MAX_RETRY_MS = 5_000;\nexport const TURN_QUIESCENCE_WATCHDOG_MS = 5 * 60_000;\nexport const TURN_FINALIZER_STEP_TIMEOUT_MS = 30_000;\n\n/** A fenced activity must never heartbeat forever while physical cleanup is\n * stuck. The callback requests host-owned containment, which drains peer turns\n * before applying its final exit policy. A timeout is never quiescence proof. */\nexport function armTurnQuiescenceWatchdog(input: {\n  enabled: boolean;\n  timeoutMs?: number;\n  onTimeout?: () => void;\n  terminateWorker: () => void;\n}): () => void {\n  if (!input.enabled) return () => undefined;\n  let armed = true;\n  const timer = setTimeout(() => {\n    if (!armed) return;\n    input.onTimeout?.();\n    input.terminateWorker();\n  }, input.timeoutMs ?? TURN_QUIESCENCE_WATCHDOG_MS);\n  timer.unref?.();\n  return () => {\n    if (!armed) return;\n    armed = false;\n    clearTimeout(timer);\n  };\n}\n\n/** Persist the authoritative receipt or durably hand the exact physical proof\n * to Temporal. This retries signal delivery, not DB eligibility or workflow\n * state. The proof object never changes between attempts. */\nexport async function persistOrSignalSessionAttemptQuiescence(input: {\n  proof: SessionAttemptQuiescenceProof;\n  persistReceipt: () => Promise<SessionAttemptQuiescenceCommit>;\n  deliverWorkflowWake?: (\n    wake: NonNullable<SessionAttemptQuiescenceCommit[\"workflowWake\"]>,\n  ) => Promise<unknown>;\n  publishEvents: (events: SessionEvent[]) => Promise<unknown>;\n  signalProof: ActivityServices[\"signalSessionAttemptQuiesced\"];\n  sleep?: (ms: number) => Promise<void>;\n  heartbeat?: (attempt: number, delayMs: number) => void;\n  onReceiptFailure?: (error: unknown) => void;\n  onWakeFailure?: (error: unknown) => void;\n  onPublishFailure?: (error: unknown) => void;\n  onSignalFailure?: (error: unknown, attempt: number, delayMs: number) => void;\n}): Promise<\"receipt\" | \"signal\"> {\n  let receipt: SessionAttemptQuiescenceCommit;\n  try {\n    receipt = await input.persistReceipt();\n  } catch (receiptError) {\n    input.onReceiptFailure?.(receiptError);\n    if (!input.signalProof) {\n      throw new Error(\"Session-attempt quiescence proof signaler is unavailable\", {\n        cause: receiptError,\n      });\n    }\n    const delay = input.sleep ?? sleep;\n    let retryMs = QUIESCENCE_PROOF_SIGNAL_INITIAL_RETRY_MS;\n    let attempt = 1;\n    for (;;) {\n      try {\n        await input.signalProof(input.proof);\n        return \"signal\";\n      } catch (signalError) {\n        input.onSignalFailure?.(signalError, attempt, retryMs);\n        try {\n          input.heartbeat?.(attempt, retryMs);\n        } catch {\n          // Heartbeat telemetry is not proof delivery and cannot replace or\n          // interrupt the exact signal retry loop.\n        }\n        await delay(retryMs);\n        retryMs = Math.min(retryMs * 2, QUIESCENCE_PROOF_SIGNAL_MAX_RETRY_MS);\n        attempt += 1;\n      }\n    }\n  }\n\n  if (receipt.workflowWake && input.deliverWorkflowWake) {\n    try {\n      await input.deliverWorkflowWake(receipt.workflowWake);\n    } catch (wakeError) {\n      // The exact revision is already durable. Immediate delivery is latency\n      // optimization only; the outbox dispatcher remains the repair path.\n      input.onWakeFailure?.(wakeError);\n    }\n  }\n  try {\n    await input.publishEvents(receipt.events);\n  } catch (publishError) {\n    // Postgres already committed quiesced_at, the queue event, and the wake.\n    // NATS is live fanout only; never misclassify its failure as receipt loss.\n    input.onPublishFailure?.(publishError);\n  }\n  return \"receipt\";\n}\n\n/**\n * Cross the non-detachable physical boundary for one dying attempt. Temporal's\n * cancellation signal is intentionally absent: cancellation is transport, not\n * proof that sandbox tools and attempt-owned credential writers have drained.\n * A replacement may be admitted only after this function resolves and the\n * caller durably persists or signals the exact quiescence receipt.\n */\nexport async function drainAttemptOwnedSandboxWriters(input: {\n  toolCancellationFence: Pick<TurnToolCancellationFence, \"cancel\" | \"waitForQuiescence\"> | null;\n  cancellationReason?: unknown;\n  gitCredentialRenewals: readonly Pick<GitCredentialRenewalController, \"stop\">[];\n  codemodeTokenRenewal: Pick<CodemodeTokenRenewalController, \"stop\"> | null;\n  runCredentialRenewal: Pick<RunCredentialRenewalController, \"stop\"> | null;\n  onStage?: (stage: \"tool_writers\" | \"credential_renewals\") => void;\n}): Promise<void> {\n  input.onStage?.(\"tool_writers\");\n  if (input.toolCancellationFence) {\n    input.toolCancellationFence.cancel(\n      input.cancellationReason ?? new Error(\"TURN_ATTEMPT_FENCED\"),\n    );\n    await input.toolCancellationFence.waitForQuiescence();\n  }\n  input.onStage?.(\"credential_renewals\");\n  await Promise.all(input.gitCredentialRenewals.map(async (renewal) => await renewal.stop()));\n  await input.codemodeTokenRenewal?.stop();\n  await input.runCredentialRenewal?.stop();\n}\n\n/** Persist the exact turn's second-stage release only after the caller has\n * crossed the physical writer boundary. This wait is intentionally independent\n * of Temporal cancellation: it is a short idempotent DB transaction that closes\n * the durable archive-capture fence. Bounded retries cover a rollout connection\n * reset without turning ordinary finalizer housekeeping into lifecycle state. */\nexport async function releaseTurnSandboxAfterWriterDrain(\n  sandbox: Pick<ResumedTurnSandbox, \"release\">,\n  options: {\n    maxAttempts?: number;\n    retryDelayMs?: number;\n    wait?: (delayMs: number) => Promise<void>;\n  } = {},\n): Promise<void> {\n  const maxAttempts = Math.max(1, options.maxAttempts ?? 3);\n  const retryDelayMs = Math.max(0, options.retryDelayMs ?? 50);\n  const wait = options.wait ?? sleep;\n  let lastError: unknown;\n  for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {\n    try {\n      await sandbox.release({ workspaceWritersQuiesced: true });\n      return;\n    } catch (error) {\n      lastError = error;\n      if (attempt < maxAttempts) {\n        await wait(retryDelayMs * attempt);\n      }\n    }\n  }\n  throw lastError;\n}\n\n/**\n * Await bounded, idempotent finalizer housekeeping only while this Temporal\n * activity still owns its execution window. A completed turn must never keep\n * heartbeating forever because a provider/tool close promise did not settle:\n * that strands every later durable prompt behind an already-terminal attempt.\n * Cancellation or the hard timeout detaches the operation with a rejection\n * handler; the operation may still finish its attempt-scoped cleanup, but it\n * cannot pin activity terminalization.\n */\nexport async function waitForTurnFinalizerStep<T>(\n  operation: Promise<T>,\n  signal: AbortSignal | undefined,\n  timeoutMs = TURN_FINALIZER_STEP_TIMEOUT_MS,\n): Promise<T | undefined> {\n  if (signal?.aborted) {\n    void operation.catch(() => undefined);\n    return undefined;\n  }\n\n  let resolveDetached: (() => void) | undefined;\n  const detached = new Promise<undefined>((resolve) => {\n    resolveDetached = () => resolve(undefined);\n  });\n  const detach = (): void => {\n    void operation.catch(() => undefined);\n    resolveDetached?.();\n  };\n  signal?.addEventListener(\"abort\", detach, { once: true });\n  const timeout = setTimeout(detach, Math.max(1, timeoutMs));\n  timeout.unref?.();\n  try {\n    return await Promise.race([operation, detached]);\n  } finally {\n    clearTimeout(timeout);\n    signal?.removeEventListener(\"abort\", detach);\n  }\n}\n\n/**\n * Flush provider-facing stream state while the attempt still owns its activity\n * window. On Pause/Steer, both promises are detached with rejection handlers:\n * neither a runtime batcher nor an uncooperative provider completion promise\n * may pin the activity behind cancellation after durable writes are fenced.\n */\nexport async function waitForTurnStreamCleanup(\n  batcherFlush: Promise<unknown>,\n  providerCompleted: Promise<unknown>,\n  signal: AbortSignal | undefined,\n): Promise<void> {\n  await waitForTurnFinalizerStep(batcherFlush, signal);\n  await waitForTurnFinalizerStep(providerCompleted, signal);\n}\n\nexport class IncompleteAgentStreamError extends Error {\n  readonly name = \"IncompleteAgentStreamError\";\n\n  constructor(message = \"Agent stream ended without a successful terminal output\") {\n    super(message);\n  }\n}\n\n/**\n * Prove that SDK completion authority did not report a failure or runtime\n * cancellation. The Agents SDK closes its ReadableStream immediately when its\n * run signal aborts, so iterator EOF is not completion authority: the separate\n * `completed` promise carries the eventual run failure.\n *\n * Only Temporal cancellation detaches cleanup. Internal runtime cancellation\n * such as a provider-deadline sandbox rotation must escape to the turn failure\n * settlement path, which checkpoints and redispatches the same logical turn.\n */\nexport async function assertSuccessfulAgentStreamCompletion(input: {\n  batcherFlush: Promise<unknown>;\n  stream: {\n    completed: Promise<void>;\n    error: unknown;\n  };\n  temporalCancellationSignal: AbortSignal | undefined;\n  runtimeCancellationSignal: AbortSignal;\n}): Promise<void> {\n  await waitForTurnStreamCleanup(\n    input.batcherFlush,\n    input.stream.completed,\n    input.temporalCancellationSignal,\n  );\n\n  if (input.runtimeCancellationSignal.aborted) {\n    throw (\n      input.runtimeCancellationSignal.reason ??\n      new IncompleteAgentStreamError(\"Agent stream was cancelled without a terminal reason\")\n    );\n  }\n  if (input.stream.error !== null && input.stream.error !== undefined) {\n    throw input.stream.error;\n  }\n}\n\n/** Call after any more-specific empty-stream recovery has had priority. */\nexport function assertAgentStreamNotCancelled(cancelled: boolean): void {\n  if (cancelled) {\n    throw new IncompleteAgentStreamError(\"Agent stream was cancelled without a terminal result\");\n  }\n}\n\n/** Interruption streams do not produce a normal final output. Call this only\n * after the interruption branch has settled any required action. A successful\n * runtime-owned input wait is a normal terminal result without assistant text;\n * its authority comes from prepared tools, never the provider's output. */\nexport function requireAgentStreamFinalOutput(\n  finalOutput: unknown | undefined,\n  inputWaitYielded = false,\n): unknown {\n  if (inputWaitYielded) return \"\";\n  if (finalOutput === undefined) {\n    throw new IncompleteAgentStreamError();\n  }\n  return finalOutput;\n}\n\n/**\n * Terminal settlement closes the active attempt before turn finalization. The\n * ordinary workspace admission therefore correctly returns `attempt_fenced`\n * for the final attempt-qualified credential deletion. Retry only that exact\n * settled-attempt case directly; every other fence/status and the direct\n * deletion itself remain fail-closed.\n */\nexport async function clearAttemptCredentialsWithSettledFence(input: {\n  activityStatus: RunAgentTurnResult[\"status\"] | \"unknown\";\n  runWorkspaceFencedClear: () => Promise<void>;\n  clearExactAttempt: () => Promise<void>;\n  onSettledAttemptFence: () => void;\n}): Promise<void> {\n  try {\n    await input.runWorkspaceFencedClear();\n  } catch (error) {\n    const settledAttemptFence =\n      error instanceof Error &&\n      error.name === \"SandboxWorkspaceMutationFencedError\" &&\n      (error as Error & { code?: unknown }).code === \"attempt_fenced\" &&\n      (input.activityStatus === \"idle\" ||\n        input.activityStatus === \"failed\" ||\n        input.activityStatus === \"cancelled\");\n    if (!settledAttemptFence) throw error;\n    input.onSettledAttemptFence();\n    await input.clearExactAttempt();\n  }\n}\n\nexport function turnFinalizerCancellationSignal(\n  temporalSignal: AbortSignal | undefined,\n  activityStatus: RunAgentTurnResult[\"status\"] | \"unknown\",\n): AbortSignal | undefined {\n  if (activityStatus !== \"cancelled\" || temporalSignal?.aborted) return temporalSignal;\n  const fenced = new AbortController();\n  fenced.abort(new Error(\"TURN_ATTEMPT_FENCED\"));\n  return fenced.signal;\n}\n\nexport type MandatoryHistoryPersistenceStage = \"history_append\" | \"sandbox_envelope\";\n\n/**\n * Preserve the exact storage failure for the permission-controlled turn event\n * while attaching only a stable, non-secret operation token to public worker\n * diagnostics. Mandatory history failures remain terminal and never inherit a\n * provider-retry classification from coincidental source text or status.\n */\nexport class MandatoryHistoryPersistenceError extends Error {\n  readonly name = \"MandatoryHistoryPersistenceError\";\n  readonly cause: unknown;\n\n  constructor(\n    readonly stage: MandatoryHistoryPersistenceStage,\n    cause: unknown,\n  ) {\n    super(cause instanceof Error ? cause.message : String(cause));\n    this.cause = cause;\n  }\n}\n\nexport async function runMandatoryHistoryPersistenceStep<T>(\n  stage: MandatoryHistoryPersistenceStage,\n  operation: () => Promise<T>,\n): Promise<T> {\n  try {\n    return await operation();\n  } catch (cause) {\n    throw new MandatoryHistoryPersistenceError(stage, cause);\n  }\n}\n\nexport type OpStreamFinalizer = {\n  finalizeOpStreamOps(toolCallIds?: readonly string[]): Promise<void>;\n};\n\n/** Release only durably recorded tool results, or the complete durable turn. */\nexport async function finalizeDurableTurnOpStreams(\n  sessions: readonly unknown[],\n  fallback: OpStreamFinalizer | null,\n  toolCallIds?: readonly string[],\n): Promise<void> {\n  const candidates = new Set<OpStreamFinalizer>();\n  for (const session of sessions) {\n    const candidate = session as Partial<OpStreamFinalizer> | null;\n    if (typeof candidate?.finalizeOpStreamOps === \"function\") {\n      candidates.add(candidate as OpStreamFinalizer);\n    }\n  }\n  if (candidates.size === 0 && fallback) {\n    candidates.add(fallback);\n  }\n  for (const candidate of candidates) {\n    try {\n      await candidate.finalizeOpStreamOps(toolCallIds);\n    } catch {\n      // The runner's retention TTL owns the fallback.\n    }\n  }\n}\n","/** Closed policy facts shared with the workflow's content-free recovery wire. */\nexport const PROVIDER_OVERLOAD_RECOVERY_CODE = \"provider_overloaded\";\nexport const MAX_AUTOMATIC_PROVIDER_OVERLOAD_RECOVERIES = 15;\nexport const PROVIDER_OVERLOAD_RECOVERY_WINDOW_MS = 15 * 60_000;\n\nexport function validProviderOverloadRecoveryDelay(code: unknown, delay: unknown): boolean {\n  if (delay === undefined) return code !== PROVIDER_OVERLOAD_RECOVERY_CODE;\n  return (\n    code === PROVIDER_OVERLOAD_RECOVERY_CODE &&\n    typeof delay === \"number\" &&\n    Number.isSafeInteger(delay) &&\n    delay > 0 &&\n    delay < PROVIDER_OVERLOAD_RECOVERY_WINDOW_MS\n  );\n}\n\nexport function readProviderRecoveryStartedAt(\n  metadata: Record<string, unknown>,\n): number | undefined {\n  const value =\n    typeof metadata.providerRecoveryStartedAt === \"string\"\n      ? Date.parse(metadata.providerRecoveryStartedAt)\n      : NaN;\n  return Number.isFinite(value) ? value : undefined;\n}\n","import { ClaudeSubscriptionReconnectRequired } from \"@opengeni/db\";\nimport { DrizzleQueryError } from \"drizzle-orm\";\nimport { SandboxCapabilitiesChangedError } from \"./provider-dispatch-barrier\";\nimport { heldSessionUsageReceiptsForTurn } from \"./session-usage-custody\";\nimport {\n  ActiveSessionHistoryLimitExceededError,\n  ApprovalRunStateLimitExceededError,\n  nestedPostgresSqlState,\n  databaseFailureCode,\n  isRetryablePersistenceSqlState,\n  safeDatabaseErrorFacts,\n  isRetryableDatabaseTransportFailure,\n  isSessionEventPersistenceError,\n  DatabaseTransactionError,\n  SandboxLeaseTransitionError,\n} from \"@opengeni/db\";\nimport {\n  ActiveBackendUnresolvableError,\n  AnthropicProviderRejection,\n  CompactionProviderResponseError,\n  EmptyCompactionSummaryError,\n  compactionProviderRejection,\n  describeCompactionProviderRejection,\n  type CompactionProviderRejection,\n  isMcpRequestTimeoutError,\n  isMcpTransportConnectivityError,\n  isModalTaskExecStartPreDispatchUnavailableError,\n  isModalCommandStartOutcomeUnknownError,\n  isProviderCommandObservationUnavailableError,\n  ProviderCommandInputOutcomeUnknownError,\n  ProviderCommandStartOutcomeUnknownError,\n  isRoutingMutationOutcomeUnknownError,\n  isRoutingMutationOutputRejectedError,\n  RoutingWorkspaceRootChangedError,\n  RoutingBackendRecoveryRequiredError,\n  ResponsesStreamingTerminalError,\n  classifyModelStreamIdleTimeoutError,\n  SandboxMaterializationVerificationError,\n  materializationVerificationDiagnostic,\n  type MaterializationVerificationDiagnostic,\n  PROVIDER_QUOTA_EXHAUSTED_CODE,\n  type ProviderQuotaExhaustion,\n  type ProviderQuotaScope,\n  classifyProviderQuotaError,\n  providerQuotaExhaustedMessage,\n  SelfhostedWorkspaceRootChangedError,\n  UNKNOWN_MODEL_FINISH_REASON_CODE,\n  AnthropicRequestError,\n  findAnthropicRequestSizeError,\n  AnthropicSizeRecoveryExhaustedError,\n  type AnthropicRequestSize,\n} from \"@opengeni/runtime\";\nimport {\n  mcpTransportRequestFailureDiagnostic,\n  type McpTransportRequestFailureDiagnostic,\n} from \"@opengeni/runtime/mcp-network\";\nimport { ApplicationFailure, CancelledFailure } from \"@temporalio/activity\";\nimport type { ProviderErrorOutcome } from \"@opengeni/subscriptions\";\nimport { CODEX_USAGE_EXHAUSTED_PCT } from \"./codex-usage-policy\";\nimport {\n  RetainedAttachmentTransportLimitError,\n  RetainedAttachmentUnavailableError,\n} from \"../run-input\";\nimport type { CodexAccountStatus } from \"@opengeni/db\";\nimport {\n  CODEX_USAGE_LIMIT_ERROR_TYPE,\n  CodexReloginRequired,\n  classifyCodexEncryptedArtifactRejection,\n  classifyCodexEntitlementRejection,\n  classifyCodexResponseTimeoutError,\n  classifyCodexUsageLimitError,\n  isCodexTransportError,\n} from \"@opengeni/codex\";\nimport {\n  CodexPlanEntitlementError,\n  codexPlanEntitlementFailurePayload,\n  codexRequestRejectedFailurePayload,\n} from \"./codex-plan-entitlement\";\nimport { SubscriptionCoreCodexTurnError } from \"./codex-core-errors\";\nimport {\n  CodexIncludedUsageExhaustedError,\n  CodexIncludedUsageUnknownError,\n  findCodexCreditPolicyError,\n} from \"./codex-credit-policy\";\nimport {\n  classifyXaiSubscriptionStreamingTerminalError,\n  classifyXaiSubscriptionStreamIdleTimeoutError,\n  isXaiSubscriptionHostedToolContinuationError,\n  isXaiSubscriptionRateLimitDiagnostic,\n  isXaiSubscriptionTransportError,\n  XaiSubscriptionReloginRequired,\n} from \"@opengeni/xai-subscription\";\nimport type {\n  EscapedMcpTimeoutRecoveryDetail,\n  PostClaimDatabaseRecoveryDetail,\n  PreClaimFailureDetail,\n} from \"../types\";\nimport {\n  ESCAPED_MCP_TIMEOUT_RECOVERY_FAILURE_MESSAGE,\n  ESCAPED_MCP_TIMEOUT_RECOVERY_FAILURE_TYPE,\n  POST_CLAIM_DATABASE_RECOVERY_FAILURE_MESSAGE,\n  POST_CLAIM_DATABASE_RECOVERY_FAILURE_TYPE,\n  PRE_CLAIM_FAILURE_MESSAGE,\n  PRE_CLAIM_FAILURE_TYPE,\n} from \"../types\";\nimport {\n  MandatoryHistoryPersistenceError,\n  type MandatoryHistoryPersistenceStage,\n} from \"./quiescence\";\nimport {\n  MODEL_PROVIDER_RECOVERY_CODES,\n  providerRecoveryExhaustedMessage,\n  providerRecoverySubject,\n  type ProviderCondition,\n} from \"./provider-recovery-copy\";\nimport {\n  PROVIDER_OVERLOAD_RECOVERY_CODE,\n  MAX_AUTOMATIC_PROVIDER_OVERLOAD_RECOVERIES,\n  PROVIDER_OVERLOAD_RECOVERY_WINDOW_MS,\n  validProviderOverloadRecoveryDelay,\n} from \"./provider-recovery-policy\";\nexport {\n  PROVIDER_OVERLOAD_RECOVERY_CODE,\n  MAX_AUTOMATIC_PROVIDER_OVERLOAD_RECOVERIES,\n  PROVIDER_OVERLOAD_RECOVERY_WINDOW_MS,\n} from \"./provider-recovery-policy\";\n\n// Retryable provider connectivity/5xx failures start quickly and back off to\n// this ceiling. Explicit rate limits retain the minute-granular fallback.\nexport const PROVIDER_BACKPRESSURE_DELAY_MS = 60_000;\nexport const PROVIDER_CONNECTIVITY_BACKOFF_MS = [2_000, 5_000, 15_000, 30_000, 60_000] as const;\nexport const MAX_AUTOMATIC_PROVIDER_RECOVERIES = PROVIDER_CONNECTIVITY_BACKOFF_MS.length;\nexport function providerRecoveryLimit(failureCode: unknown): number {\n  return failureCode === PROVIDER_OVERLOAD_RECOVERY_CODE\n    ? MAX_AUTOMATIC_PROVIDER_OVERLOAD_RECOVERIES\n    : MAX_AUTOMATIC_PROVIDER_RECOVERIES;\n}\n/**\n * Minimum wait per rate-limited recovery. Providers such as Azure OpenAI often\n * answer a per-minute token limit with a `retry-after` of about a second, which\n * alone would spend every automatic recovery before the window resets.\n */\nexport const PROVIDER_RATE_LIMIT_BACKOFF_MS = [10_000, 20_000, 40_000, 60_000, 120_000] as const;\n/** Positive-only spread: never shorten the provider's minimum delay. */\nexport function providerRecoveryJitterMs(delayMs: number, sample: number): number {\n  const bounded = Number.isFinite(sample) ? Math.max(0, Math.min(sample, 1)) : 0;\n  return Math.floor(Math.min(5_000, delayMs * 0.2) * bounded);\n}\nexport const POST_COMPACTION_CONTINUATION_EMPTY_CODE = \"post_compaction_continuation_empty\";\nexport const RETAINED_ATTACHMENT_UNAVAILABLE_CODE = \"retained_attachment_unavailable\";\n\nfunction findRetainedAttachmentUnavailableError(\n  error: unknown,\n): RetainedAttachmentUnavailableError | null {\n  let current = error;\n  const seen = new Set<unknown>();\n  for (let depth = 0; depth < 6 && current && typeof current === \"object\"; depth += 1) {\n    if (current instanceof RetainedAttachmentUnavailableError) return current;\n    if (seen.has(current)) break;\n    seen.add(current);\n    current = (current as { cause?: unknown }).cause;\n  }\n  return null;\n}\n\nexport class PostCompactionContinuationEmptyError extends Error {\n  readonly code = POST_COMPACTION_CONTINUATION_EMPTY_CODE;\n\n  constructor() {\n    super(\"Post-compaction continuation stream ended before a terminal model response\");\n    this.name = \"PostCompactionContinuationEmptyError\";\n  }\n}\n\nexport type ProviderRecoveryResult =\n  | {\n      status: \"recovering\";\n      continueDelayMs: number;\n      maxProviderRecoveryCount?: number;\n    }\n  | {\n      status: \"exhausted\";\n      providerRecoveryCount: number;\n      maxProviderRecoveryCount: number;\n      providerRecoveryExhaustedReason?: \"deadline\" | \"retry_limit\" | \"invalid_clock\";\n    };\n\nexport function providerRecoveryResult(input: {\n  failureCode: string | undefined;\n  attemptNumber: number;\n  retryAfterMs?: number | null;\n  jitterSample?: number;\n  /** Durable first-failure clock, never a new clock on each replacement attempt. */\n  recoveryStartedAt?: number | undefined;\n  now?: number;\n}): ProviderRecoveryResult {\n  const overload = input.failureCode === PROVIDER_OVERLOAD_RECOVERY_CODE;\n  const limit = providerRecoveryLimit(input.failureCode);\n  const exhausted = (\n    reason: \"deadline\" | \"retry_limit\" | \"invalid_clock\",\n  ): Extract<ProviderRecoveryResult, { status: \"exhausted\" }> => ({\n    status: \"exhausted\",\n    providerRecoveryCount: Math.min(Math.max(input.attemptNumber - 1, 0), limit),\n    maxProviderRecoveryCount: limit,\n    providerRecoveryExhaustedReason: reason,\n  });\n  if (input.attemptNumber > limit) {\n    if (overload) return exhausted(\"retry_limit\");\n    return {\n      status: \"exhausted\",\n      providerRecoveryCount: MAX_AUTOMATIC_PROVIDER_RECOVERIES,\n      maxProviderRecoveryCount: MAX_AUTOMATIC_PROVIDER_RECOVERIES,\n    };\n  }\n  const now = input.now ?? Date.now();\n  const startedAt = input.recoveryStartedAt ?? (input.attemptNumber === 1 ? now : NaN);\n  if (overload && (!Number.isFinite(startedAt) || !Number.isFinite(now) || startedAt > now)) {\n    return exhausted(\"invalid_clock\");\n  }\n  const providerDelay =\n    input.retryAfterMs !== null &&\n    input.retryAfterMs !== undefined &&\n    Number.isFinite(input.retryAfterMs) &&\n    input.retryAfterMs > 0\n      ? Math.ceil(input.retryAfterMs)\n      : null;\n  const continueDelayMs =\n    input.failureCode === \"provider_rate_limited\"\n      ? Math.max(\n          providerDelay ?? PROVIDER_BACKPRESSURE_DELAY_MS,\n          PROVIDER_RATE_LIMIT_BACKOFF_MS[\n            Math.min(\n              Math.max(Math.trunc(input.attemptNumber) - 1, 0),\n              PROVIDER_RATE_LIMIT_BACKOFF_MS.length - 1,\n            )\n          ]!,\n        )\n      : overload ||\n          input.failureCode === \"provider_unavailable\" ||\n          input.failureCode === \"upstream_connectivity_unavailable\" ||\n          input.failureCode === \"sandbox_command_start_unavailable\" ||\n          input.failureCode === RETAINED_ATTACHMENT_UNAVAILABLE_CODE ||\n          input.failureCode === \"mcp_transport_timeout\" ||\n          input.failureCode === \"mcp_transport_unavailable\" ||\n          input.failureCode === \"turn_execution_policy_definition_mismatch\" ||\n          input.failureCode === POST_COMPACTION_CONTINUATION_EMPTY_CODE\n        ? Math.max(\n            providerDelay ?? 0,\n            PROVIDER_CONNECTIVITY_BACKOFF_MS[\n              Math.min(\n                Math.max(Math.trunc(input.attemptNumber) - 1, 0),\n                PROVIDER_CONNECTIVITY_BACKOFF_MS.length - 1,\n              )\n            ]!,\n          )\n        : PROVIDER_BACKPRESSURE_DELAY_MS;\n  const delayMs =\n    continueDelayMs +\n    (overload ||\n    input.failureCode === \"provider_rate_limited\" ||\n    input.failureCode === \"provider_unavailable\" ||\n    input.failureCode === \"upstream_connectivity_unavailable\"\n      ? providerRecoveryJitterMs(continueDelayMs, input.jitterSample ?? 0)\n      : 0);\n  // Do not shorten Retry-After, or schedule a replacement outside the window.\n  if (overload && now + delayMs >= startedAt + PROVIDER_OVERLOAD_RECOVERY_WINDOW_MS) {\n    return exhausted(\"deadline\");\n  }\n  return {\n    status: \"recovering\",\n    continueDelayMs: delayMs,\n    ...(overload ? { maxProviderRecoveryCount: limit } : {}),\n  };\n}\n\n/** A timer/queue delay cannot authorize a provider call after the recovery window. */\nexport class ProviderOverloadRecoveryExpiredError extends Error {\n  readonly failure;\n\n  constructor(count: number, reason: \"deadline\" | \"retry_limit\" | \"invalid_clock\") {\n    super(\"Confirmed provider overload recovery window expired before dispatch\");\n    this.name = \"ProviderOverloadRecoveryExpiredError\";\n    this.failure = providerRecoveryExhaustedFailure(\n      {\n        error: this.message,\n        code: \"provider_unavailable\",\n        providerCondition: \"overloaded\" as const,\n      },\n      {\n        status: \"exhausted\",\n        // The queued replacement has not dispatched; count only prior retries.\n        providerRecoveryCount: Math.min(\n          MAX_AUTOMATIC_PROVIDER_OVERLOAD_RECOVERIES,\n          Math.max(0, count - 1),\n        ),\n        maxProviderRecoveryCount: MAX_AUTOMATIC_PROVIDER_OVERLOAD_RECOVERIES,\n        providerRecoveryExhaustedReason: reason,\n      },\n    );\n  }\n}\n\nexport function assertProviderOverloadRecoveryActive(input: {\n  failureCode: unknown;\n  providerRecoveryCount: number;\n  recoveryStartedAt?: number | undefined;\n  now?: number;\n}): void {\n  if (input.failureCode !== PROVIDER_OVERLOAD_RECOVERY_CODE || input.providerRecoveryCount === 0) {\n    return;\n  }\n  if (input.providerRecoveryCount > MAX_AUTOMATIC_PROVIDER_OVERLOAD_RECOVERIES) {\n    throw new ProviderOverloadRecoveryExpiredError(input.providerRecoveryCount, \"retry_limit\");\n  }\n  const now = input.now ?? Date.now();\n  const startedAt = input.recoveryStartedAt;\n  if (\n    startedAt === undefined ||\n    !Number.isFinite(startedAt) ||\n    !Number.isFinite(now) ||\n    startedAt > now\n  ) {\n    throw new ProviderOverloadRecoveryExpiredError(input.providerRecoveryCount, \"invalid_clock\");\n  }\n  if (now >= startedAt + PROVIDER_OVERLOAD_RECOVERY_WINDOW_MS) {\n    throw new ProviderOverloadRecoveryExpiredError(input.providerRecoveryCount, \"deadline\");\n  }\n}\n\nexport function providerRecoveryExhaustedFailure<\n  T extends Record<string, unknown> & { error: string },\n>(\n  failure: T,\n  recovery: Extract<ProviderRecoveryResult, { status: \"exhausted\" }>,\n): T & {\n  retryable: false;\n  recoveryExhausted: true;\n  providerRecoveryCount: number;\n  maxProviderRecoveryCount: number;\n  lastRetryableError: string;\n  providerRecoveryExhaustedReason?: \"deadline\" | \"retry_limit\" | \"invalid_clock\";\n} {\n  return {\n    ...failure,\n    error: providerRecoveryExhaustedMessage({\n      code: typeof failure.code === \"string\" ? failure.code : null,\n      providerCondition: isProviderCondition(failure.providerCondition)\n        ? failure.providerCondition\n        : null,\n      modelLabel: typeof failure.modelLabel === \"string\" ? failure.modelLabel : null,\n      providerLabel: typeof failure.providerLabel === \"string\" ? failure.providerLabel : null,\n      providerRecoveryCount: recovery.providerRecoveryCount,\n    }),\n    retryable: false,\n    recoveryExhausted: true,\n    providerRecoveryCount: recovery.providerRecoveryCount,\n    maxProviderRecoveryCount: recovery.maxProviderRecoveryCount,\n    ...(recovery.providerRecoveryExhaustedReason\n      ? { providerRecoveryExhaustedReason: recovery.providerRecoveryExhaustedReason }\n      : {}),\n    lastRetryableError: failure.error,\n  };\n}\n\nfunction isProviderCondition(value: unknown): value is ProviderCondition {\n  return (\n    value === \"overloaded\" ||\n    value === \"unavailable\" ||\n    value === \"unresponsive\" ||\n    value === \"rate_limited\"\n  );\n}\n\n/**\n * A retryable failure whose automatic same-turn recovery was not authorized\n * (for example, request custody could not be checkpointed). The classifier's\n * \"will retry\" sentence would be false on a terminal record, so name the\n * condition and the person's options instead.\n */\nexport function automaticRecoveryUnavailableFailure<\n  T extends Record<string, unknown> & { error: string },\n>(\n  failure: T,\n): T & {\n  retryable: false;\n  automaticRecovery: \"unavailable\";\n  lastRetryableError: string;\n} {\n  const subject = providerRecoverySubject({\n    code: typeof failure.code === \"string\" ? failure.code : null,\n    providerCondition: isProviderCondition(failure.providerCondition)\n      ? failure.providerCondition\n      : null,\n    modelLabel: typeof failure.modelLabel === \"string\" ? failure.modelLabel : null,\n    providerLabel: typeof failure.providerLabel === \"string\" ? failure.providerLabel : null,\n  });\n  return {\n    ...failure,\n    error: `${subject}. Opengeni couldn't retry this turn automatically. Try again, or send a message to continue.`,\n    retryable: false,\n    automaticRecovery: \"unavailable\",\n    lastRetryableError: failure.error,\n  };\n}\n\n/**\n * Name the exact accepted model route on model-provider recovery evidence so a\n * person learns which model is affected. Display labels only: the route's\n * credentials, base URL and upstream ids never enter the event.\n */\nexport function withModelRoutePresentation<T extends { code?: string | undefined }>(\n  failure: T,\n  route: { model: string; modelLabel: string; providerLabel: string } | undefined,\n): T & { model?: string; modelLabel?: string; providerLabel?: string } {\n  if (!route || !failure.code || !MODEL_PROVIDER_RECOVERY_CODES.has(failure.code)) return failure;\n  return {\n    ...failure,\n    model: route.model,\n    modelLabel: route.modelLabel,\n    providerLabel: route.providerLabel,\n  };\n}\n\nexport function providerRecoveryCountFromMetadata(metadata: Record<string, unknown>): number {\n  const value = metadata.providerRecoveryCount;\n  return typeof value === \"number\" && Number.isSafeInteger(value) && value >= 0 ? value : 0;\n}\n\nexport function providerRecoveryCountAfterModelRequestPhase(\n  currentCount: number,\n  phase: string,\n): number {\n  return phase === \"completed\" ? 0 : currentCount;\n}\n\nexport function headerValue(headers: unknown, name: string): string | null {\n  if (!headers || typeof headers !== \"object\") return null;\n  const getter = (headers as { get?: unknown }).get;\n  if (typeof getter === \"function\") {\n    const value = getter.call(headers, name);\n    return typeof value === \"string\" ? value : null;\n  }\n  const target = name.toLowerCase();\n  const entry = Object.entries(headers as Record<string, unknown>).find(\n    ([key, value]) => key.toLowerCase() === target && typeof value === \"string\",\n  );\n  return typeof entry?.[1] === \"string\" ? entry[1] : null;\n}\n\n/** Read a provider Retry-After hint without retaining response headers/body. */\nexport function providerRetryAfterMs(error: unknown, nowMs = Date.now()): number | null {\n  let current: unknown = error;\n  for (let depth = 0; depth < 6 && current && typeof current === \"object\"; depth += 1) {\n    const value = current as Record<string, unknown>;\n    const body =\n      value.error && typeof value.error === \"object\"\n        ? (value.error as Record<string, unknown>)\n        : null;\n    const milliseconds = Number(\n      headerValue(value.headers, \"retry-after-ms\") ??\n        headerValue(value.responseHeaders, \"retry-after-ms\") ??\n        headerValue(body?.headers, \"retry-after-ms\") ??\n        undefined,\n    );\n    if (Number.isFinite(milliseconds) && milliseconds > 0) return Math.ceil(milliseconds);\n    const directSeconds = Number(\n      value.retry_after_seconds ?? body?.retry_after_seconds ?? value.retryAfterSeconds,\n    );\n    const header =\n      headerValue(value.headers, \"retry-after\") ??\n      headerValue(value.responseHeaders, \"retry-after\") ??\n      headerValue(body?.headers, \"retry-after\");\n    const headerSeconds = header === null ? Number.NaN : Number(header);\n    const headerDate =\n      header !== null && !Number.isFinite(headerSeconds) ? Date.parse(header) : Number.NaN;\n    const seconds = Number.isFinite(directSeconds)\n      ? directSeconds\n      : Number.isFinite(headerSeconds)\n        ? headerSeconds\n        : Number.isFinite(headerDate)\n          ? Math.max(0, (headerDate - nowMs) / 1_000)\n          : Number.NaN;\n    if (Number.isFinite(seconds) && seconds > 0) return Math.ceil(seconds * 1_000);\n    current = value.cause;\n  }\n  return null;\n}\n\n/**\n * Tell the model when durable MCP policy references are unavailable for this\n * exact turn. The policy projection already bounds and validates these ids;\n * this notice prevents a graceful runtime drop from becoming a silent source-\n * of-truth substitution or a false claim that the disconnected system was read.\n */\nexport function unavailableMcpOperationalContext(input: {\n  droppedIds: readonly string[];\n  droppedCount: number;\n}): string | undefined {\n  if (input.droppedCount <= 0) {\n    return undefined;\n  }\n  const omittedCount = Math.max(0, input.droppedCount - input.droppedIds.length);\n  const listed = input.droppedIds.map((id) => `\"${id}\"`).join(\", \");\n  const inventory = listed\n    ? `${listed}${omittedCount > 0 ? `, plus ${omittedCount} additional unavailable server(s)` : \"\"}`\n    : `${input.droppedCount} unavailable server(s)`;\n  return `MCP capability availability for this turn: the following session-selected server(s) are disconnected or no longer registered and were skipped: ${inventory}. Do not claim to have read or updated those systems. If the task depends on one as a source of truth, explain the limitation and ask the user to reconnect it or select another authoritative source; continue with unaffected work only when safe.`;\n}\n\n/**\n * Preserve one precise recovery obligation across Temporal's activity boundary.\n * This is intentionally narrower than the ordinary retryable-provider path:\n * only a recovered turn (generation > 1) whose MCP timeout happened before a\n * model request may ask the workflow's DB-only control activity to finish the\n * same-turn checkpoint. The original transport/recovery errors are excluded\n * from details so raw MCP response data can never enter workflow history.\n */\nexport function escapedMcpTimeoutRecoveryFailure(input: {\n  failureCode: string | undefined;\n  modelRequestStarted: boolean;\n  detail: EscapedMcpTimeoutRecoveryDetail;\n}): ApplicationFailure | null {\n  if (\n    input.failureCode !== \"mcp_transport_timeout\" ||\n    input.modelRequestStarted ||\n    !Number.isSafeInteger(input.detail.executionGeneration) ||\n    input.detail.executionGeneration <= 1 ||\n    !Number.isSafeInteger(input.detail.providerRecoveryCount) ||\n    input.detail.providerRecoveryCount <= 0 ||\n    input.detail.providerRecoveryCount > MAX_AUTOMATIC_PROVIDER_RECOVERIES ||\n    !Number.isSafeInteger(input.detail.continueDelayMs) ||\n    input.detail.continueDelayMs <= 0\n  ) {\n    return null;\n  }\n  return ApplicationFailure.create({\n    message: ESCAPED_MCP_TIMEOUT_RECOVERY_FAILURE_MESSAGE,\n    type: ESCAPED_MCP_TIMEOUT_RECOVERY_FAILURE_TYPE,\n    nonRetryable: true,\n    details: [input.detail],\n  });\n}\n\n/**\n * Convert the atomic claim transaction's failure into a small, stable\n * Temporal wire contract. The original error remains in activity diagnostics,\n * but SQL text, parameters, and arbitrary invariant messages never enter\n * workflow history. Operational failures retry; other persistence rejections\n * retain accepted work behind a durable explicit-recheck fence. Repeating the\n * same rejected transaction without changed conditions is not recovery.\n */\nexport function preClaimAdmissionFailure(error: unknown): ApplicationFailure {\n  const persistenceFailure = isSessionEventPersistenceError(error) ? error : null;\n  const retryableCode = retryableDatabaseFailureCode(error);\n  const rejectedClaim =\n    persistenceFailure?.details.stage === \"session_attempts.claim\" &&\n    persistenceFailure.details.retryOutcome === \"not_retryable\" &&\n    !retryableCode;\n  const detail: PreClaimFailureDetail = {\n    disposition: rejectedClaim\n      ? \"blocked\"\n      : persistenceFailure || retryableCode\n        ? \"retryable\"\n        : \"permanent\",\n    code: retryableCode ?? persistenceFailure?.details.code ?? \"claim_invariant\",\n    ...(persistenceFailure && rejectedClaim\n      ? {\n          sqlState: persistenceFailure.details.sqlState,\n          reason:\n            persistenceFailure.details.stage === \"session_attempts.claim\" &&\n            persistenceFailure.details.sqlState === \"OG001\"\n              ? (\"initiator_membership_required\" as const)\n              : persistenceFailure.details.stage === \"session_attempts.claim\" &&\n                  persistenceFailure.details.sqlState === \"OG002\"\n                ? (\"personal_resource_grant_required\" as const)\n                : (\"database_claim_rejected\" as const),\n          retryPolicy: \"explicit_recheck\" as const,\n        }\n      : {}),\n  };\n  return ApplicationFailure.create({\n    message: PRE_CLAIM_FAILURE_MESSAGE,\n    type: PRE_CLAIM_FAILURE_TYPE,\n    nonRetryable: true,\n    details: [detail],\n  });\n}\n\n/** Complete structured-cause graph or no recovery authority. Budget distinct\n * objects (including array containers), not queue positions/duplicate refs.\n * The separate link ceiling bounds huge duplicate arrays without truncating\n * them into permission. Cycles are harmless; overflow/unreadable edges hold. */\nfunction structuredRecoveryCauseGraph(error: unknown): Map<object, Set<object>> | null {\n  const graph = new Map<object, Set<object>>();\n  const queue: object[] = [];\n  let links = 0;\n  const add = (value: unknown): boolean => {\n    if (!value || typeof value !== \"object\" || graph.has(value)) return true;\n    if (graph.size >= 64) return false;\n    graph.set(value, new Set());\n    queue.push(value);\n    return true;\n  };\n  if (!add(error)) return null;\n  try {\n    for (const current of queue) {\n      const record = current as Record<string, unknown>;\n      const children = Array.isArray(current)\n        ? current\n        : [\"cause\", \"original\", \"driverError\", \"error\", \"errors\"].map((key) => record[key]);\n      for (const child of children) {\n        if (++links > 4096 || !add(child)) return null;\n        if (child && typeof child === \"object\") graph.get(current)!.add(child);\n      }\n    }\n  } catch {\n    return null;\n  }\n  return graph;\n}\n\nfunction retryableDatabaseFailureCode(\n  error: unknown,\n  requireDatabaseProvenance = false,\n): PostClaimDatabaseRecoveryDetail[\"code\"] | null {\n  try {\n    const graph = structuredRecoveryCauseGraph(error);\n    if (!graph) return null;\n    const transports = new Set<object>();\n    const boundaries = new Set<object>();\n    const ownDatabaseNodes = new Set<object>();\n    const codes = new Set<PostClaimDatabaseRecoveryDetail[\"code\"]>();\n    const ownChildren = (node: object): object[] =>\n      node instanceof DatabaseTransactionError\n        ? // Callback failures retained beside a failed rollback supply vetoes,\n          // never driver provenance for a provider's connection-looking error.\n          [...graph.get(node)!].filter((child) => child === node.cause)\n        : [...graph.get(node)!];\n    // Ask the canonical transport predicate about ONLY this node's facts. Its\n    // recursive search must not pair a DB sibling with an unrelated provider.\n    for (const node of graph.keys()) {\n      if (isRoutingMutationOutcomeUnknownError(node) || isRoutingMutationOutputRejectedError(node))\n        return null;\n      const record = node as Record<string, unknown>;\n      if (\n        requireDatabaseProvenance\n          ? isRunningTurnDatabaseTransportFailure(record)\n          : isRetryableDatabaseTransportFailure({ code: record.code, errno: record.errno })\n      )\n        transports.add(node);\n      const sqlState = isSessionEventPersistenceError(node)\n        ? node.details.sqlState\n        : record.name === \"PostgresError\" && typeof record.code === \"string\"\n          ? record.code\n          : null;\n      if (\n        requireDatabaseProvenance\n          ? isRunningTurnDatabaseConnectionSqlState(sqlState)\n          : isDatabaseConnectionSqlState(sqlState)\n      )\n        transports.add(node);\n      if (\n        node instanceof DrizzleQueryError ||\n        node instanceof DatabaseTransactionError ||\n        isSessionEventPersistenceError(node)\n      ) {\n        // Only actual errors raised at our ORM/typed persistence boundary own\n        // their driver subtree. A PostgresError name, SDK wrapper or provider\n        // socket by itself is never own-client provenance for a running turn.\n        const queue: object[] = [node];\n        for (const source of queue) {\n          if (ownDatabaseNodes.has(source)) continue;\n          ownDatabaseNodes.add(source);\n          queue.push(...ownChildren(source));\n        }\n      }\n    }\n    const hasOwnTransport = (boundary: object): boolean => {\n      const seen = new Set<object>();\n      const queue = [boundary];\n      for (const node of queue) {\n        if (seen.has(node)) continue;\n        seen.add(node);\n        if (transports.has(node)) return true;\n        queue.push(...ownChildren(node));\n      }\n      return false;\n    };\n    // Inspect ALL trusted DB evidence before returning a permit. A permanent,\n    // auth or uncertain SQLSTATE vetoes every sibling regardless of traversal\n    // order; a deeper transport/reset cannot override it either.\n    for (const node of graph.keys()) {\n      const record = node as Record<string, unknown>;\n      if (node instanceof DrizzleQueryError || node instanceof DatabaseTransactionError) {\n        boundaries.add(node);\n        if (hasOwnTransport(node)) codes.add(\"db_failure\");\n      }\n      const typed = isSessionEventPersistenceError(node);\n      if (!typed && record.name !== \"PostgresError\") continue;\n      boundaries.add(node);\n      const sqlState = typed\n        ? node.details.sqlState\n        : typeof record.code === \"string\"\n          ? record.code\n          : null;\n      const connectionOutage = requireDatabaseProvenance\n        ? isRunningTurnDatabaseConnectionSqlState(sqlState)\n        : isDatabaseConnectionSqlState(sqlState);\n      // PostgreSQL aborts a deadlock or serialization victim's whole\n      // transaction: unlike a lost connection, that write certainly did not\n      // commit, so it is at least as safe for exact-attempt recovery.\n      const rolledBack = isRetryablePersistenceSqlState(sqlState);\n      const code = typed\n        ? retryablePersistenceFailureCode(sqlState)\n        : connectionOutage || rolledBack\n          ? databaseFailureCode(sqlState)\n          : null;\n      if (\n        !code ||\n        (requireDatabaseProvenance &&\n          !connectionOutage &&\n          !rolledBack &&\n          !(sqlState === null && hasOwnTransport(node)))\n      )\n        return null;\n      if (!requireDatabaseProvenance || ownDatabaseNodes.has(node)) codes.add(code);\n    }\n    // Preserve the legacy pre-execution transport-only allowance, but never\n    // borrow it across an explicit DB boundary with no eligible own evidence.\n    if (!requireDatabaseProvenance && boundaries.size === 0 && transports.size > 0)\n      codes.add(\"db_failure\");\n    // Stable classification for multiple positive DB siblings too.\n    for (const code of [\"db_failure\", \"db_deadlock\", \"db_serialization_failure\"] as const)\n      if (codes.has(code)) return code;\n    return null;\n  } catch {\n    // Unreadable structured facts are no more authority than unreadable edges.\n    return null;\n  }\n}\n\nconst RUNNING_TURN_DATABASE_TRANSPORT_CODES = new Set([\n  // postgres.js reports these for a physically lost connection, including\n  // transaction cleanup after its socket has already closed. Own-client\n  // provenance and the unknown-outcome veto remain mandatory above.\n  \"CONNECTION_CLOSED\",\n  \"CONNECTION_DESTROYED\",\n  \"CONNECTION_ENDED\",\n  \"ECONNREFUSED\",\n  \"ECONNRESET\",\n  \"CONNECT_TIMEOUT\",\n]);\n\nfunction isRunningTurnDatabaseTransportFailure(record: Record<string, unknown>): boolean {\n  return [record.code, record.errno].some(\n    (code) => typeof code === \"string\" && RUNNING_TURN_DATABASE_TRANSPORT_CODES.has(code),\n  );\n}\n\nfunction isRunningTurnDatabaseConnectionSqlState(sqlState: string | null): boolean {\n  return (\n    sqlState !== null &&\n    (/^08[0-9A-Z]{3}$/.test(sqlState) || [\"57P01\", \"57P02\", \"57P03\"].includes(sqlState))\n  );\n}\n\nfunction isDatabaseConnectionSqlState(sqlState: string | null): boolean {\n  return (\n    sqlState !== null &&\n    (sqlState.startsWith(\"08\") || [\"57P01\", \"57P02\", \"57P03\"].includes(sqlState))\n  );\n}\n\nfunction retryablePersistenceFailureCode(\n  sqlState: string | null,\n): PostClaimDatabaseRecoveryDetail[\"code\"] | null {\n  if (\n    !(\n      sqlState === null ||\n      sqlState.startsWith(\"08\") ||\n      isRetryablePersistenceSqlState(sqlState) ||\n      sqlState.startsWith(\"53\") ||\n      sqlState === \"55P03\" ||\n      sqlState === \"57014\" ||\n      sqlState === \"57P01\" ||\n      sqlState === \"57P02\" ||\n      sqlState === \"57P03\" ||\n      sqlState.startsWith(\"58\")\n    )\n  ) {\n    return null;\n  }\n  return databaseFailureCode(sqlState);\n}\n\n/**\n * True when an error is a structured database failure that the exact-attempt\n * database recovery path owns. Callers that translate other failures into\n * user-visible states must rethrow these unchanged.\n */\nexport function isPostClaimDatabaseRecoveryCandidate(error: unknown): boolean {\n  return retryableDatabaseFailureCode(error, true) !== null;\n}\n\n/**\n * Carry one exact claimed attempt into the workflow's DB-only\n * recovery lane. Permanent database/state failures remain terminal. The\n * running-turn lane additionally requires a closed own-client outage class;\n * existing pre-execution recovery classifications are unchanged.\n */\nexport function postClaimDatabaseRecoveryFailure(input: {\n  error: unknown;\n  turnId: string;\n  triggerEventId: string;\n  executionGeneration: number;\n  /** Require an actual own-client boundary and the closed running-turn allowlist. */\n  requireDatabaseProvenance?: boolean;\n  sandboxSetupOutcomeUnknown?: true;\n  sandboxSetupRecoveryExhausted?: true;\n  providerRecovery?: {\n    failureCode: string;\n    providerRecoveryCount: number;\n    continueDelayMs?: number;\n  };\n}): ApplicationFailure | null {\n  const code = retryableDatabaseFailureCode(input.error, input.requireDatabaseProvenance);\n  if (!code || input.executionGeneration < 1) return null;\n  if (\n    (input.sandboxSetupOutcomeUnknown && input.sandboxSetupRecoveryExhausted) ||\n    ((input.sandboxSetupOutcomeUnknown || input.sandboxSetupRecoveryExhausted) &&\n      input.providerRecovery)\n  ) {\n    return null;\n  }\n  if (\n    input.providerRecovery &&\n    (!Number.isSafeInteger(input.providerRecovery.providerRecoveryCount) ||\n      input.providerRecovery.providerRecoveryCount <= 0 ||\n      input.providerRecovery.providerRecoveryCount >\n        providerRecoveryLimit(input.providerRecovery.failureCode) ||\n      !/^[a-z][a-z0-9_]{0,63}$/.test(input.providerRecovery.failureCode) ||\n      !validProviderOverloadRecoveryDelay(\n        input.providerRecovery.failureCode,\n        input.providerRecovery.continueDelayMs,\n      ))\n  ) {\n    return null;\n  }\n  const detail: PostClaimDatabaseRecoveryDetail = {\n    turnId: input.turnId,\n    triggerEventId: input.triggerEventId,\n    executionGeneration: input.executionGeneration,\n    code,\n    ...(input.sandboxSetupOutcomeUnknown ? { sandboxSetupOutcomeUnknown: true } : {}),\n    ...(input.sandboxSetupRecoveryExhausted ? { sandboxSetupRecoveryExhausted: true } : {}),\n    ...(input.providerRecovery\n      ? {\n          providerFailureCode: input.providerRecovery.failureCode,\n          providerRecoveryCount: input.providerRecovery.providerRecoveryCount,\n          ...(input.providerRecovery.continueDelayMs !== undefined\n            ? { providerRecoveryContinueDelayMs: input.providerRecovery.continueDelayMs }\n            : {}),\n        }\n      : {}),\n  };\n  // Known usage whose receipt write failed travels with the exact attempt.\n  const sessionUsageReceipts = heldSessionUsageReceiptsForTurn(input.turnId);\n  if (sessionUsageReceipts.length > 0) detail.sessionUsageReceipts = sessionUsageReceipts;\n  return ApplicationFailure.create({\n    message: POST_CLAIM_DATABASE_RECOVERY_FAILURE_MESSAGE,\n    type: POST_CLAIM_DATABASE_RECOVERY_FAILURE_TYPE,\n    nonRetryable: true,\n    details: [detail],\n  });\n}\n\n/**\n * Resolve which Codex account a turn runs on (multi-account P1): session-pin >\n * workspace-active. No rotation in P1. The selected id must still be in the\n * connected set — a disconnected pin was FK-nulled, so a stale id can't appear,\n * but we guard anyway. Returns null when there is no usable account (the turn\n * then fails with the existing relogin error path).\n */\nexport function isWorkerShutdownCancellation(error: unknown): boolean {\n  return error instanceof CancelledFailure && error.message === \"WORKER_SHUTDOWN\";\n}\n\nexport type SandboxLifecycleTransitionDiagnostic = {\n  sandboxGroupId: string;\n  leaseEpoch: number;\n  reason: \"capture_in_progress\" | \"rotation_in_progress\" | \"provider_recovery_in_progress\";\n};\n\n/**\n * Recover a typed sandbox lifecycle transition through the structural wrappers\n * used by parallel Agents SDK function-tool execution. Never infer transition\n * truth from message text: only the original class or an exact, fully-shaped\n * cross-package error object is accepted.\n */\nexport function sandboxLifecycleTransitionDiagnostic(\n  error: unknown,\n): SandboxLifecycleTransitionDiagnostic | null {\n  const pending: unknown[] = [error];\n  const seen = new WeakSet<object>();\n  let inspected = 0;\n\n  while (pending.length > 0 && inspected < 64) {\n    const current = pending.shift();\n    inspected += 1;\n    if (!current || typeof current !== \"object\" || seen.has(current)) continue;\n    seen.add(current);\n\n    try {\n      const record = current as Record<string, unknown>;\n      const reason = record.reason;\n      if (\n        (current instanceof SandboxLeaseTransitionError ||\n          record.name === \"SandboxLeaseTransitionError\") &&\n        typeof record.sandboxGroupId === \"string\" &&\n        record.sandboxGroupId.length > 0 &&\n        typeof record.leaseEpoch === \"number\" &&\n        Number.isSafeInteger(record.leaseEpoch) &&\n        record.leaseEpoch >= 0 &&\n        (reason === \"capture_in_progress\" ||\n          reason === \"rotation_in_progress\" ||\n          reason === \"provider_recovery_in_progress\")\n      ) {\n        return {\n          sandboxGroupId: record.sandboxGroupId,\n          leaseEpoch: record.leaseEpoch,\n          reason,\n        };\n      }\n\n      for (const key of [\"cause\", \"error\"] as const) {\n        const nested = record[key];\n        if (nested && typeof nested === \"object\") pending.push(nested);\n      }\n      if (Array.isArray(record.errors)) pending.push(...record.errors.slice(0, 32));\n    } catch {\n      // A hostile proxy or getter is not durable lifecycle evidence.\n    }\n  }\n\n  return null;\n}\n\nexport function modelPreparationFailureEventPayload(error: unknown, durationMs: number) {\n  const transition = sandboxLifecycleTransitionDiagnostic(error);\n  return {\n    phase: \"model_preparation\",\n    durationMs: Math.max(0, Math.round(durationMs)),\n    expectedTransition: transition !== null,\n    ...(transition\n      ? {\n          failureCategory: \"drain_capture_wait\",\n          failureStage: \"lifecycle_wait\",\n          failureCode: transition.reason,\n          retryable: true,\n        }\n      : {}),\n  };\n}\n\n/**\n * The turn's first model request could not be dispatched until the context\n * was compacted (proactive threshold or an operator-requested Compact). That\n * is an expected step of preparation, not a failure: the same activity\n * compacts and then reopens preparation for the retried request.\n */\nexport function compactionFirstPreparationEventPayload(durationMs: number) {\n  return {\n    phase: \"model_preparation\",\n    durationMs: Math.max(0, Math.round(durationMs)),\n    expectedTransition: true,\n    failureCategory: \"context_compaction\",\n    failureStage: \"context_compaction\",\n    failureCode: \"compaction_required\",\n    retryable: true,\n  } as const;\n}\n\n/**\n * Recognize active-route transitions that cannot finish inside their\n * originating attempt. A Modal-home session may start on a Connected Machine\n * without creating or leasing its managed home box. When an explicit attach\n * clears the active pointer back to home, the pointer commit is authoritative,\n * but this attempt has no home session to serve the next sandbox operation.\n *\n * The Agents SDK may retain the typed routing error directly, through `cause`,\n * or inside an AggregateError from a parallel function-tool batch. Traverse\n * only those structural error links with a strict bound; never classify from\n * message text, which could originate in model or tool content.\n */\n/**\n * Only the home resolver's positive pre-dispatch signal permits a fresh attempt.\n * The same error class can also escape AFTER a provider mutation, so neither its\n * retryable property nor message alone establishes replay safety. Inspect the\n * complete bounded SDK cause graph and let uncertain peer outcomes veto this\n * narrow recovery; unreadable or overflowing graphs fail closed.\n */\nfunction isPreDispatchHomeBackendRecoveryRequired(error: unknown): boolean {\n  const graph = structuredRecoveryCauseGraph(error);\n  if (!graph) return false;\n  let found = false;\n  try {\n    for (const node of graph.keys()) {\n      if (\n        isRoutingMutationOutcomeUnknownError(node) ||\n        isRoutingMutationOutputRejectedError(node) ||\n        isRawProviderCommandOutcomeUnknown(node) ||\n        isModalCommandStartOutcomeUnknownError(node) ||\n        isProviderCommandObservationUnavailableError(node)\n      )\n        return false;\n      if (node instanceof RoutingBackendRecoveryRequiredError) {\n        if (\n          node.op !== \"resolve_home_backend\" ||\n          !Number.isSafeInteger(node.leaseEpoch) ||\n          node.leaseEpoch < 0 ||\n          !node.retryable ||\n          (node.recovery !== \"pending\" && node.recovery !== \"superseded\")\n        )\n          return false;\n        found = true;\n      }\n    }\n  } catch {\n    return false;\n  }\n  return found;\n}\n\nexport function sandboxRouteTransitionCode(\n  error: unknown,\n):\n  | \"home_unavailable_this_turn\"\n  | \"workspace_root_changed_this_turn\"\n  | \"native_capabilities_changed_this_attempt\"\n  | \"home_backend_recovery_pending\"\n  | null {\n  if (isPreDispatchHomeBackendRecoveryRequired(error)) {\n    return \"home_backend_recovery_pending\";\n  }\n  const pending: unknown[] = [error];\n  const seen = new WeakSet<object>();\n  let inspected = 0;\n\n  while (pending.length > 0 && inspected < 64) {\n    const current = pending.shift();\n    inspected += 1;\n    if (!current || typeof current !== \"object\" || seen.has(current)) continue;\n    seen.add(current);\n\n    try {\n      const record = current as Record<string, unknown>;\n      if (\n        (current instanceof SandboxCapabilitiesChangedError ||\n          record.name === \"SandboxCapabilitiesChangedError\") &&\n        record.code === \"native_capabilities_changed_this_attempt\"\n      ) {\n        return \"native_capabilities_changed_this_attempt\";\n      }\n      if (\n        (current instanceof ActiveBackendUnresolvableError ||\n          record.name === \"ActiveBackendUnresolvableError\") &&\n        record.code === \"home_unavailable_this_turn\"\n      ) {\n        return \"home_unavailable_this_turn\";\n      }\n      if (\n        current instanceof RoutingWorkspaceRootChangedError ||\n        current instanceof SelfhostedWorkspaceRootChangedError ||\n        record.name === \"RoutingWorkspaceRootChangedError\" ||\n        record.name === \"SelfhostedWorkspaceRootChangedError\"\n      ) {\n        return \"workspace_root_changed_this_turn\";\n      }\n\n      for (const key of [\"cause\", \"error\"] as const) {\n        const nested = record[key];\n        if (nested && typeof nested === \"object\") pending.push(nested);\n      }\n      if (Array.isArray(record.errors)) {\n        pending.push(...record.errors.slice(0, 32));\n      }\n    } catch {\n      // A hostile proxy or getter is not a route-transition proof.\n    }\n  }\n\n  return null;\n}\n\nexport function isSandboxRouteTransitionError(error: unknown): boolean {\n  return sandboxRouteTransitionCode(error) !== null;\n}\n\n/** Backward-compatible name for callers/tests that only exercised the original\n * machine-to-home transition. */\nexport function isHomeSandboxTurnTransitionError(error: unknown): boolean {\n  return sandboxRouteTransitionCode(error) === \"home_unavailable_this_turn\";\n}\n\n/**\n * Review captures and protective snapshots are cache/persistence housekeeping,\n * never part of cancellation correctness. A control-fenced or Temporal-cancelled\n * attempt must release its physical activity promptly so Steer/Pause can advance.\n */\nexport function compactionFailureReason(reason: string): string {\n  return reason.startsWith(\"compaction summarization failed:\")\n    ? reason\n    : `compaction summarization failed: ${reason}`;\n}\n\nexport type SafeErrorDiagnostic = {\n  errorClass: \"WorkerOperationError\";\n  errorCode: \"worker_operation_failed\";\n  status?: number;\n  origin: \"worker\";\n  historyPersistenceStage?: MandatoryHistoryPersistenceStage;\n};\n\n/**\n * Produce the only exception shape allowed in worker logs. It deliberately\n * excludes the arbitrary source message, stack, cause, response/request\n * bodies, and enumerable properties. Exact failure content belongs in the\n * permission-controlled session event, not stdout or telemetry.\n */\nexport function safeErrorDiagnostic(error: unknown): SafeErrorDiagnostic {\n  const diagnostic: SafeErrorDiagnostic = {\n    errorClass: \"WorkerOperationError\",\n    errorCode: \"worker_operation_failed\",\n    origin: \"worker\",\n  };\n  try {\n    let statusSource = error;\n    if (error instanceof MandatoryHistoryPersistenceError) {\n      diagnostic.historyPersistenceStage = error.stage;\n      statusSource = error.cause;\n    }\n    if (statusSource && typeof statusSource === \"object\") {\n      const status = Number(\n        (statusSource as { status?: unknown; statusCode?: unknown }).status ??\n          (statusSource as { statusCode?: unknown }).statusCode,\n      );\n      if (Number.isInteger(status) && status >= 100 && status <= 599) {\n        diagnostic.status = status;\n      }\n    }\n  } catch {\n    // Public diagnostics are best-effort and must never replace the exact\n    // internal worker failure.\n  }\n  return diagnostic;\n}\n\nexport function safeErrorForTelemetry(error: unknown): Error {\n  const diagnostic = safeErrorDiagnostic(error);\n  const safe = new Error(\"worker operation failed\") as Error & {\n    code?: string;\n    status?: number;\n    origin?: string;\n  };\n  safe.name = \"WorkerOperationError\";\n  safe.code = diagnostic.errorCode;\n  if (diagnostic.status !== undefined) safe.status = diagnostic.status;\n  safe.origin = diagnostic.origin;\n  return safe;\n}\n\n/**\n * Guidance appended to a definitive provider rejection. Repeating the exact\n * request cannot succeed, so the generic \"send another message to retry\"\n * advice is wrong here: a new prompt re-sends the same rejected history.\n */\nexport const COMPACTION_PROVIDER_REJECTION_GUIDANCE =\n  \"The provider refused this exact request, so repeating it fails the same way until the conversation changes. If a new message fails again, start a new session.\";\n\nexport function compactionFailureReasonFromError(error: unknown): string {\n  const rejection = compactionProviderRejection(error);\n  if (rejection) {\n    return compactionFailureReason(\n      `the model provider rejected the compaction request (${describeCompactionProviderRejection(rejection)}). Active history was preserved. ${COMPACTION_PROVIDER_REJECTION_GUIDANCE}`,\n    );\n  }\n  // An exhausted provider quota is not retried (see agentRunFailurePayload),\n  // so name the refusal plainly instead of the raw diagnostic envelope.\n  const quota = classifyProviderQuotaExhaustionError(error);\n  if (quota) {\n    return compactionFailureReason(\n      `${providerQuotaExhaustedMessage(quota.scope)} Active history was preserved.`,\n    );\n  }\n  if (\n    error instanceof CompactionProviderResponseError ||\n    error instanceof EmptyCompactionSummaryError\n  ) {\n    return compactionFailureReason(error.message);\n  }\n  const errorName = error instanceof Error && error.name ? error.name : \"unknown error\";\n  return compactionFailureReason(`unexpected ${errorName}`);\n}\n\n/**\n * Exact `turn.failed` payload for a terminal compaction failure. A definitive\n * provider rejection additionally carries its closed identifier record so the\n * timeline, API consumers, and operators can name the rejected field without\n * parsing the message.\n */\nexport function compactionFailureTurnEventPayload(\n  error: unknown,\n  overrides: { error?: string } = {},\n): {\n  error: string;\n  code: \"context_compaction_failed\";\n  retryable: false;\n  recovery: \"user_message\";\n  compacted: false;\n  providerRejection?: CompactionProviderRejection;\n  quotaScope?: ProviderQuotaScope;\n} {\n  const rejection = compactionProviderRejection(error);\n  // The same closed marker as a `provider_quota_exhausted` turn failure, so\n  // clients can name the exhausted limit and offer another model here too.\n  const quota = rejection ? null : classifyProviderQuotaExhaustionError(error);\n  return {\n    error: overrides.error ?? compactionFailureReasonFromError(error),\n    code: \"context_compaction_failed\",\n    retryable: false,\n    recovery: \"user_message\",\n    compacted: false,\n    ...(rejection ? { providerRejection: rejection } : {}),\n    ...(quota ? { quotaScope: quota.scope } : {}),\n  };\n}\n\nexport function isCompactionSummaryFailure(error: unknown): boolean {\n  return (\n    error instanceof CompactionProviderResponseError || error instanceof EmptyCompactionSummaryError\n  );\n}\n\nexport function shouldRecoverCompactionProviderFailure(error: unknown): boolean {\n  if (!(error instanceof CompactionProviderResponseError)) return false;\n  // The worker's own included-usage refusal (usage exhausted or unverifiable)\n  // happens before dispatch, so the checkpoint request was never sent. It\n  // settles exactly like the same refusal on an ordinary request: recorded\n  // against the account, then the same turn re-places or waits for capacity.\n  if (findCodexCreditPolicyError(error)) return true;\n  if (isCodexTransportError(error) && classifyCodexUsageLimitError(error)) return true;\n  // A Claude subscription refusal (rate limit or reconnect) on the checkpoint\n  // request recovers exactly like one on an ordinary request: failure\n  // settlement rotates to another account or waits for capacity on the same\n  // logical turn. Its wording or retry hint never makes it a terminal quota.\n  const claudeRefusal = isClaudeSubscriptionTransportError(error)\n    ? classifyClaudeProviderError(error)\n    : null;\n  if (claudeRefusal?.kind === \"unauthorized\" || claudeRefusal?.kind === \"rate_limited\") return true;\n  // Codex may reject an opaque artifact it minted itself on the compaction\n  // request exactly as it can on an ordinary request. Failure settlement\n  // invalidates only the exact participating artifacts and recovers the same\n  // logical turn; when nothing can be invalidated it fails closed there.\n  if (classifyCodexEncryptedArtifactRejection(error)) return true;\n  // A ChatGPT plan that no longer includes the model refuses the compaction\n  // request exactly as it refuses an ordinary one (often with an empty 400).\n  // Failure settlement re-checks the plan and, when it proves the loss,\n  // excludes that account for the model and fails the same turn over; an\n  // unexplained rejection still fails there with typed copy.\n  if (classifyCodexEntitlementRejection(error)) return true;\n  return agentRunFailurePayload(error).retryable === true;\n}\n\nexport function classifyContextWindowOverflowError(\n  error: unknown,\n): { message: string; code?: string; detail?: string } | null {\n  if (isProviderSafetyRefusal(error)) return null;\n  const fields = collectErrorStrings(error);\n  const matched = fields.find(\n    (value) =>\n      /context[_\\s-]*length[_\\s-]*exceeded/i.test(value) ||\n      /exceeds?\\s+(?:the\\s+)?context\\s+window/i.test(value) ||\n      /maximum\\s+context\\s+length/i.test(value) ||\n      /context\\s+window[^.]*exceed/i.test(value),\n  );\n  if (!matched) {\n    return null;\n  }\n  const message = error instanceof Error ? error.message : String(error);\n  const code = fields.find((value) => /context[_\\s-]*length[_\\s-]*exceeded/i.test(value));\n  return {\n    message,\n    ...(code ? { code } : {}),\n    ...(matched && matched !== message ? { detail: matched } : {}),\n  };\n}\n\n/**\n * Recognize an MCP transport/request timeout that escaped the SDK's per-tool\n * `mcpConfig.errorFunction` boundary. A thrown tool invocation is normally\n * converted to an `{isError:true}` tool output; however, connect/tools-list or\n * next-loop transport work can reject the stream iterator after a prior tool\n * output was already published. That is transient external backpressure, not a\n * terminal session error. Match MCP-qualified timeout text only: an unrelated\n * sandbox/model timeout and MCP's application-defined Authentication required signal must\n * retain their existing semantics.\n */\nexport function classifyMcpTransportTimeoutError(\n  error: unknown,\n): { message: string; detail?: string } | null {\n  const fields = collectErrorStrings(error);\n  const matchedText = fields.find(\n    (value) =>\n      /\\bmcp\\b/i.test(value) &&\n      /(?:request\\s+timed\\s+out|request\\s+timeout|\\btimed\\s+out\\b|\\btimeout\\b|ETIMEDOUT)/i.test(\n        value,\n      ) &&\n      !/authentication\\s+required/i.test(value),\n  );\n  const sanitizedSdkTimeout = isMcpRequestTimeoutError(error);\n  if (!matchedText && !sanitizedSdkTimeout) {\n    return null;\n  }\n  const message = error instanceof Error ? error.message : String(error);\n  const matched = matchedText ?? fields.find((value) => /\\bmcp\\b/i.test(value));\n  return {\n    message,\n    ...(matched && matched !== message ? { detail: matched } : {}),\n  };\n}\n\nexport function collectErrorStrings(value: unknown, seen = new WeakSet<object>()): string[] {\n  if (typeof value === \"string\") {\n    return [value];\n  }\n  if (!value || typeof value !== \"object\") {\n    return [];\n  }\n  if (seen.has(value)) {\n    return [];\n  }\n  seen.add(value);\n  const out: string[] = [];\n  // This diagnostic is already provider-owned and byte-bounded. Do not widen\n  // generic detail traversal to arbitrary application payloads.\n  if (value instanceof ResponsesStreamingTerminalError) out.push(value.detail);\n  const record = value as Record<string, unknown>;\n  for (const key of [\"message\", \"code\", \"type\", \"name\", \"param\"]) {\n    const field = record[key];\n    if (typeof field === \"string\" && field.length > 0) {\n      out.push(field);\n    }\n  }\n  for (const key of [\"error\", \"cause\", \"response\", \"data\"]) {\n    out.push(...collectErrorStrings(record[key], seen));\n  }\n  return out;\n}\n\n/**\n * Compute the conversation-truth rows a reconcile pass should append, given the\n * SDK's current `state.history` and the count already persisted.\n *\n * `state.history` is a computed getter that runs the SDK's orphan-tool-call\n * pruning on every access, so it is non-monotonic: a `function_call` with no\n * settling result yet is transiently absent and a later access yields a\n * different, possibly shorter/reordered list. The old code sliced this list by\n * a blind length watermark and appended at fixed positions with\n * onConflictDoNothing, which could freeze a position with one shape and later\n * persist a `function_call_result` whose `function_call` had been pruned away in\n * an earlier slice — the orphaned tool output that 400s the Responses API and\n * bricks the session on every replay.\n *\n * Defending: structurally repair the full current history into an API-valid sequence (the\n * same pure rules the read path uses), then append only the new tail beyond the\n * watermark. A trailing dangling call is dropped here and re-evaluated next\n * pass once its result lands, so a call and its result are written together at\n * consecutive positions and a result is never persisted without its call. The\n * watermark advances to the repaired length — never past anything unwritten —\n * so a non-monotonic history can never desync it. When previously-persisted\n * rows already exceed the repaired length (e.g. legacy orphans written before\n * this fix), nothing new is appended and the watermark holds steady.\n */\n/**\n * Stable+unique usage source key for one model call, used to build the per-call\n * idempotency key (`usage:model.tokens:${turnId}:${sourceKey}`). The turnId is\n * shared across a new attempt of the SAME turn (recovery, approval\n * rerun, activity retry), so the sourceKey alone must distinguish calls.\n *\n * - A provider responseId is globally stable+unique, so reuse it verbatim: a\n *   true activity retry that re-emits the same responseId correctly DEDUPES\n *   (one charge), while two distinct calls get distinct ids.\n * - Without a responseId the old synthesized key was only POSITIONAL (\"response-1\",\n *   \"aggregate\"), which collides across a re-dispatch — dispatch B's first\n *   call reuses dispatch A's \"response-1\" key and its charge is silently\n *   dropped (undercharge). Qualifying the synthesized key with the\n *   per-execution dispatch id (the Temporal activityId, unique per scheduled\n *   execution) makes re-dispatched calls distinct while still deduping a\n *   same-execution retry.\n */\nexport const STATUSLESS_UPSTREAM_CONNECTIVITY_MESSAGE =\n  \"unable to connect. is the computer able to access the url?\";\n/** Bun's exact fetch text when an upstream drops an open connection. */\nexport const STATUSLESS_UPSTREAM_SOCKET_CLOSED_MESSAGE =\n  \"the socket connection was closed unexpectedly. for more information, pass `verbose: true` in the second argument to fetch()\";\nconst STATUSLESS_UPSTREAM_CONNECTIVITY_MESSAGES = new Set([\n  STATUSLESS_UPSTREAM_CONNECTIVITY_MESSAGE,\n  STATUSLESS_UPSTREAM_SOCKET_CLOSED_MESSAGE,\n]);\n\nexport function isExactStatuslessUpstreamConnectivityMessage(message: string): boolean {\n  return STATUSLESS_UPSTREAM_CONNECTIVITY_MESSAGES.has(message.trim().toLowerCase());\n}\n\nconst TRANSIENT_TRANSPORT_CODE = /^(?:ECONNRESET|ETIMEDOUT|EAI_AGAIN|ECONNREFUSED|EPIPE)$/i;\n\n/**\n * A network fault code anywhere on the Error.cause chain. SDK and runner\n * wrappers often keep the transport error only as `cause`, so the outermost\n * error's own `code` is not enough.\n */\nfunction transientTransportCode(error: unknown): string | undefined {\n  let current = error;\n  const seen = new Set<unknown>();\n  for (let depth = 0; depth < 6 && current && typeof current === \"object\"; depth += 1) {\n    if (seen.has(current)) break;\n    seen.add(current);\n    const value = current as { code?: unknown; cause?: unknown };\n    if (typeof value.code === \"string\" && TRANSIENT_TRANSPORT_CODE.test(value.code)) {\n      return value.code;\n    }\n    current = value.cause;\n  }\n  return undefined;\n}\n\nfunction providerSafetyRefusalDiagnostic(error: unknown): string | undefined {\n  if (error instanceof ResponsesStreamingTerminalError) {\n    return error.category === \"safety\" ? error.detail : undefined;\n  }\n  return collectErrorStrings(error).find(\n    (value) =>\n      /^(?:content_policy_violation|content_filter|safety_violation|bio_policy|cyber_policy|misalignment_policy_violation)$/.test(\n        value,\n      ) || /\\bthis request was blocked by our safety systems\\b/i.test(value),\n  );\n}\n\nfunction isProviderSafetyRefusal(error: unknown): boolean {\n  return providerSafetyRefusalDiagnostic(error) !== undefined;\n}\n\n/** Preserve the closest real HTTP status through SDK Error.cause wrappers. */\nfunction providerHttpStatus(error: unknown): number | undefined {\n  let current = error;\n  const seen = new Set<unknown>();\n  for (let depth = 0; depth < 6 && current && typeof current === \"object\"; depth += 1) {\n    if (seen.has(current)) break;\n    seen.add(current);\n    const value = current as { status?: unknown; statusCode?: unknown; cause?: unknown };\n    const status = Number(value.status ?? value.statusCode);\n    if (Number.isInteger(status) && status >= 100 && status < 600) return status;\n    current = value.cause;\n  }\n  return undefined;\n}\n\n/**\n * A fetch-layer timeout: the runtime's DOMException `TimeoutError` (message\n * \"The operation timed out.\"), possibly wrapped by SDK/runner `cause` chains.\n * Explicit cancellation (`AbortError`) is deliberately not matched.\n */\nexport function isTransportTimeoutError(error: unknown): boolean {\n  let current: unknown = error;\n  const seen = new Set<unknown>();\n  for (let depth = 0; depth < 8 && current && typeof current === \"object\"; depth += 1) {\n    if (seen.has(current)) break;\n    seen.add(current);\n    const value = current as { name?: unknown; message?: unknown; cause?: unknown };\n    if (value.name === \"TimeoutError\" || value.message === \"The operation timed out.\") {\n      return true;\n    }\n    current = value.cause;\n  }\n  return false;\n}\n\nexport function isTransientProviderError(error: unknown): boolean {\n  if (error instanceof ResponsesStreamingTerminalError) {\n    return error.category === \"unavailable\";\n  }\n  // A semantic refusal can arrive inside a 5xx transport envelope.\n  if (isProviderSafetyRefusal(error)) return false;\n  const status = providerHttpStatus(error);\n  // A real HTTP status is AUTHORITATIVE: a 5xx is transient, and ANY other status\n  // (4xx validation/auth/404, plus the 429 the earlier branches already handled) is\n  // a request fault that must NOT auto-retry — even if its body happens to read like\n  // \"connection error\" or \"overloaded\". The code/message heuristics below apply ONLY\n  // when no status survived: a network fault or an SDK-rethrown bare Error.\n  if (status !== undefined && Number.isFinite(status)) {\n    return status >= 500 && status < 600;\n  }\n  if (transientTransportCode(error)) return true;\n  const message = error instanceof Error ? error.message : String(error);\n  if (isExactStatuslessUpstreamConnectivityMessage(message)) {\n    return true;\n  }\n  return /overloaded|an error occurred while processing your request|connection error|service unavailable|bad gateway|gateway timeout/i.test(\n    message,\n  );\n}\n\n/** An explicit `usage_limit_reached` type or code string anywhere on the error chain. */\nfunction hasCodexUsageLimitType(error: unknown): boolean {\n  return collectErrorStrings(error).some((value) => value.includes(CODEX_USAGE_LIMIT_ERROR_TYPE));\n}\n\n/**\n * Recognize an exhausted API-key provider quota (a daily or monthly allowance,\n * a free-tier day cap, or an account out of credits) as distinct from an\n * ordinary per-minute rate limit. Retrying within the bounded same-turn budget\n * cannot succeed, so the turn fails promptly instead. Subscription transports\n * own their quota semantics through credential rotation and durable capacity\n * waits, so a Codex, SuperGrok or Claude subscription transport error never\n * classifies here.\n */\nexport function classifyProviderQuotaExhaustionError(\n  error: unknown,\n): ProviderQuotaExhaustion | null {\n  if (\n    isCodexTransportError(error) ||\n    isXaiSubscriptionTransportError(error) ||\n    isClaudeSubscriptionTransportError(error)\n  )\n    return null;\n  // The same reader the OpenAI SDK retry veto uses, so the two never disagree.\n  return classifyProviderQuotaError(error);\n}\n\n/** A refusal raised by a Claude subscription (OAuth) transport, at any wrapper depth. */\nexport function isClaudeSubscriptionTransportError(error: unknown): boolean {\n  let current: unknown = error;\n  for (let depth = 0; depth < 6 && current instanceof Error; depth++) {\n    if (current instanceof AnthropicRequestError && current.subscription) return true;\n    current = current.cause;\n  }\n  return false;\n}\n\n/**\n * SuperGrok's classification of a failed model request as a shared provider\n * outcome (the adapter's `classifyError`, SuperGrok track X1b): a refresh\n * relogin or a marked 401 is `unauthorized`, a marked 403 `forbidden`, and a\n * marked 429 or HTTP 200 SSE capacity terminal `rate_limited` with the\n * provider's retry time (null when it gave none: the adapter's fallback\n * applies). Anything else, a provider safety refusal included, is null: not\n * a refusal of the account.\n */\nexport function classifyXaiProviderError(error: unknown): ProviderErrorOutcome | null {\n  if (isProviderSafetyRefusal(error)) return null;\n  let relogin: unknown = error;\n  for (let depth = 0; depth < 6 && relogin && typeof relogin === \"object\"; depth += 1) {\n    if (relogin instanceof XaiSubscriptionReloginRequired) {\n      return { kind: \"unauthorized\" };\n    }\n    relogin = (relogin as Record<string, unknown>).cause;\n  }\n  if (!isXaiSubscriptionTransportError(error)) return null;\n  let current: unknown = error;\n  for (let depth = 0; depth < 6 && current && typeof current === \"object\"; depth += 1) {\n    const value = current as Record<string, unknown>;\n    const body =\n      value.error && typeof value.error === \"object\"\n        ? (value.error as Record<string, unknown>)\n        : null;\n    const status = Number(value.status ?? value.statusCode ?? body?.status ?? body?.statusCode);\n    const code = String(value.code ?? body?.code ?? \"\").toLowerCase();\n    if (status === 401 || code === \"unauthorized\" || code === \"invalid_token\") {\n      return { kind: \"unauthorized\" };\n    }\n    if (status === 403) {\n      return { kind: \"forbidden\" };\n    }\n    const message = String(value.message ?? body?.message ?? \"\");\n    if (\n      isXaiSubscriptionRateLimitDiagnostic({\n        code,\n        message,\n        status: Number.isInteger(status) ? status : null,\n      })\n    ) {\n      return { kind: \"rate_limited\", retryAfterMs: providerRetryAfterMs(error) };\n    }\n    current = value.cause;\n  }\n  return null;\n}\n\n// The generic turn-failure boundary also receives application/provider errors.\n// A five-character code or generic severity alone does not establish a driver error.\nfunction findPostgresDriverError(error: unknown): Record<string, unknown> | null {\n  const queue: unknown[] = [error];\n  const seen = new Set<unknown>();\n  for (let index = 0; index < queue.length && index < 64; index += 1) {\n    const current = queue[index];\n    if (!current || typeof current !== \"object\" || seen.has(current)) continue;\n    seen.add(current);\n    const record = current as Record<string, unknown>;\n    if (record.name === \"PostgresError\") return record;\n    for (const key of [\"cause\", \"original\", \"driverError\", \"error\", \"errors\"]) {\n      const nested = record[key];\n      if (Array.isArray(nested)) queue.push(...nested.slice(0, 64));\n      else if (nested !== undefined) queue.push(nested);\n    }\n  }\n  return null;\n}\n\nfunction isRawDatabaseQueryError(error: unknown): boolean {\n  return (\n    error instanceof Error &&\n    \"query\" in error &&\n    typeof error.query === \"string\" &&\n    \"params\" in error &&\n    Array.isArray(error.params)\n  );\n}\n\nfunction anthropicRequestDiagnostic(error: unknown): AnthropicRequestError | undefined {\n  if (error instanceof AnthropicRequestError) return error;\n  return error instanceof Error && error.cause instanceof AnthropicRequestError\n    ? error.cause\n    : undefined;\n}\n\nfunction isRawProviderCommandOutcomeUnknown(error: unknown): boolean {\n  try {\n    return (\n      error instanceof ProviderCommandInputOutcomeUnknownError ||\n      error instanceof ProviderCommandStartOutcomeUnknownError\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport function agentRunFailurePayload(\n  error: unknown,\n  options: { isCodexTurn?: boolean } = {},\n): ReturnType<typeof baseAgentRunFailurePayload> {\n  return withProviderCondition(error, classifyAgentRunFailurePayload(error, options));\n}\n\n/**\n * Record the closed provider condition on a retryable model-provider failure so\n * clients can say \"overloaded\" rather than a generic outage. Presentation\n * evidence only: retry authority and pacing are decided by `code`.\n */\nfunction withProviderCondition(\n  error: unknown,\n  failure: ReturnType<typeof baseAgentRunFailurePayload>,\n): ReturnType<typeof baseAgentRunFailurePayload> {\n  if (failure.code === \"provider_rate_limited\") {\n    return { ...failure, providerCondition: \"rate_limited\" };\n  }\n  if (failure.code !== \"provider_unavailable\") return failure;\n  if (failure.timeoutClass) return { ...failure, providerCondition: \"unresponsive\" };\n  return {\n    ...failure,\n    providerCondition: isProviderOverloadError(error, failure) ? \"overloaded\" : \"unavailable\",\n  };\n}\n\n/** HTTP 529, Anthropic `overloaded_error`, or explicit provider \"overloaded\" wording. */\nexport function isProviderOverloadError(\n  error: unknown,\n  failure: { error?: string; detail?: string } = {},\n): boolean {\n  if (providerHttpStatus(error) === 529) return true;\n  const anthropic = anthropicRequestDiagnostic(error);\n  return [...collectErrorStrings(error), anthropic?.detail, failure.error, failure.detail].some(\n    (value) => typeof value === \"string\" && /\\boverload(?:ed)?(?:_error)?\\b/i.test(value),\n  );\n}\n\n/** Retry authority must not depend on the looser presentation-only overload label. */\nexport function providerRecoveryCode(\n  error: unknown,\n  failure: { code?: string; retryable?: boolean },\n): string | undefined {\n  if (failure.code !== \"provider_unavailable\" || !failure.retryable) return failure.code;\n  const status = providerHttpStatus(error);\n  let current = error;\n  const seen = new Set<unknown>();\n  for (let depth = 0; depth < 6 && current && typeof current === \"object\"; depth += 1) {\n    if (seen.has(current)) break;\n    seen.add(current);\n    if (\n      current instanceof AnthropicRequestError &&\n      status !== undefined &&\n      status >= 500 &&\n      status < 600 &&\n      (status === 529 || current.errorType === \"overloaded_error\")\n    ) {\n      return PROVIDER_OVERLOAD_RECOVERY_CODE;\n    }\n    current = (current as { cause?: unknown }).cause;\n  }\n  return failure.code;\n}\n\nfunction classifyAgentRunFailurePayload(\n  error: unknown,\n  options: { isCodexTurn?: boolean } = {},\n): ReturnType<typeof baseAgentRunFailurePayload> {\n  const sizeError = findAnthropicRequestSizeError(error);\n  if (sizeError)\n    return {\n      error: sizeError.message,\n      code: sizeError.code,\n      retryable: false,\n      requestSize: sizeError.requestSize,\n      ...(sizeError.request_id ? { requestId: sizeError.request_id } : {}),\n    };\n  const graph = structuredRecoveryCauseGraph(error);\n  const nodes = graph ? [...graph.keys()] : [];\n  const outputRejected = nodes.find(isRoutingMutationOutputRejectedError);\n  if (outputRejected) {\n    // A known receipt applies only to its own mutation. Uncertain peers retain\n    // their established terminal classification, regardless of SDK graph order.\n    const unknown = nodes.find(\n      (node) =>\n        isRoutingMutationOutcomeUnknownError(node) ||\n        isModalCommandStartOutcomeUnknownError(node) ||\n        isProviderCommandObservationUnavailableError(node) ||\n        isRawProviderCommandOutcomeUnknown(node),\n    );\n    if (unknown) return { ...baseAgentRunFailurePayload(unknown, options), retryable: false };\n    return {\n      error: outputRejected.message,\n      code: outputRejected.code,\n      retryable: false,\n    };\n  }\n  const expired = nodes.find((node) => node instanceof ProviderOverloadRecoveryExpiredError);\n  if (expired instanceof ProviderOverloadRecoveryExpiredError) return expired.failure;\n  const failure = baseAgentRunFailurePayload(error, options);\n  const diagnostic = materializationVerificationDiagnostic(error);\n  const anthropic = anthropicRequestDiagnostic(error);\n  if (anthropic) {\n    const authenticationRejected =\n      anthropic.status === 401 &&\n      (error === anthropic ||\n        (error instanceof Error && (error as Error & { status?: unknown }).status === 401));\n    return {\n      ...failure,\n      code:\n        failure.code ??\n        (authenticationRejected ? \"anthropic_authentication_error\" : anthropic.code),\n      retryable: failure.retryable ?? false,\n      ...(anthropic.detail ? { detail: anthropic.detail } : {}),\n      ...(anthropic.request_id ? { requestId: anthropic.request_id } : {}),\n    };\n  }\n  return diagnostic ? { ...failure, materializationDiagnostic: diagnostic } : failure;\n}\n\n/** Keep Anthropic provider text on terminal failures, never recovery events. */\nexport function agentRunRecoveryFailurePayload(\n  error: unknown,\n  failure: ReturnType<typeof agentRunFailurePayload>,\n): ReturnType<typeof agentRunFailurePayload> {\n  if (!anthropicRequestDiagnostic(error)) return failure;\n  // Project a copy: retry exhaustion still needs the terminal diagnostic.\n  const recovery = { ...failure };\n  delete recovery.detail;\n  return recovery;\n}\n\nfunction baseAgentRunFailurePayload(\n  error: unknown,\n  options: { isCodexTurn?: boolean } = {},\n): {\n  error: string;\n  code?: string;\n  retryable?: boolean;\n  detail?: string;\n  timeoutClass?: string;\n  responseObserved?: boolean;\n  requestId?: string;\n  eventCount?: number;\n  lastEventType?: string;\n  silenceDurationMs?: number;\n  correlationId?: string;\n  stage?: string;\n  sqlState?: string | null;\n  attempts?: number;\n  retryOutcome?: string;\n  database?: Record<string, string>;\n  historyPersistenceStage?: MandatoryHistoryPersistenceStage;\n  mcpTransportDiagnostic?: McpTransportRequestFailureDiagnostic;\n  materializationDiagnostic?: MaterializationVerificationDiagnostic;\n  requestSize?: AnthropicRequestSize;\n  quotaScope?: ProviderQuotaScope;\n  /** Closed Codex plan key on `codex_plan_entitlement` / `codex_request_rejected`. */\n  planType?: string | null;\n  /** Product model id a `codex_plan_entitlement` or model-provider recovery failure refers to. */\n  model?: string | null;\n  /** Display label of the turn's model on model-provider recovery evidence. */\n  modelLabel?: string;\n  /** Display label of the serving provider on model-provider recovery evidence. */\n  providerLabel?: string;\n  /** Closed transient provider condition on `provider_unavailable` / `provider_rate_limited`. */\n  providerCondition?: ProviderCondition;\n  recoveryExhausted?: boolean;\n  providerRecoveryCount?: number;\n  maxProviderRecoveryCount?: number;\n  providerRecoveryExhaustedReason?: \"deadline\" | \"retry_limit\" | \"invalid_clock\";\n} {\n  if (error instanceof SandboxMaterializationVerificationError) {\n    return {\n      error: error.message,\n      code: error.code,\n      retryable: false,\n      materializationDiagnostic: error.diagnostic,\n    };\n  }\n  if (error instanceof RetainedAttachmentTransportLimitError) {\n    return { error: error.message, code: \"retained_attachment_transport_limit\", retryable: false };\n  }\n  if (findRetainedAttachmentUnavailableError(error)) {\n    // Storage may lag after a replica outage. The same turn retries with the\n    // connectivity backoff and never continues without the image's pixels.\n    return {\n      error:\n        \"An image attached earlier in this conversation can't be read from storage right now. The same turn will retry after a short delay.\",\n      code: RETAINED_ATTACHMENT_UNAVAILABLE_CODE,\n      retryable: true,\n    };\n  }\n  if (error instanceof MandatoryHistoryPersistenceError) {\n    const databaseFailure =\n      isSessionEventPersistenceError(error.cause) ||\n      findPostgresDriverError(error.cause) !== null ||\n      isRawDatabaseQueryError(error.cause);\n    const underlying = databaseFailure\n      ? agentRunFailurePayload(error.cause, options)\n      : {\n          error: error.cause instanceof Error ? error.cause.message : String(error.cause),\n        };\n    return {\n      ...underlying,\n      historyPersistenceStage: error.stage,\n    };\n  }\n  // Raw ORM wrappers can contain the full SQL and its parameters. Classify a\n  // real driver before provider message heuristics; the original cause stays\n  // available to internal diagnostics. This payload grants no replay authority.\n  const postgresDriverError = findPostgresDriverError(error);\n  const rawOrmFailure = isRawDatabaseQueryError(error);\n  if ((postgresDriverError || rawOrmFailure) && !isSessionEventPersistenceError(error)) {\n    const database = safeDatabaseErrorFacts(postgresDriverError ?? error);\n    const sqlState = postgresDriverError ? nestedPostgresSqlState(postgresDriverError) : null;\n    return {\n      error: \"Opengeni encountered a database error.\",\n      code: databaseFailureCode(sqlState),\n      sqlState,\n      ...(Object.keys(database).length > 0 ? { database } : {}),\n    };\n  }\n  if (error instanceof AnthropicSizeRecoveryExhaustedError) {\n    return { error: error.message, code: error.code, retryable: false };\n  }\n  if (error instanceof AnthropicProviderRejection) {\n    return {\n      error: error.message,\n      code: error.code === \"content_policy_violation\" ? \"provider_safety_refusal\" : error.code,\n      retryable: false,\n      ...(error.request_id ? { requestId: error.request_id } : {}),\n    };\n  }\n  const safetyRefusalDiagnostic = providerSafetyRefusalDiagnostic(error);\n  if (safetyRefusalDiagnostic !== undefined) {\n    return {\n      error:\n        \"The model provider blocked this request through its safety systems. Automatic retries stopped.\",\n      code: \"provider_safety_refusal\",\n      retryable: false,\n      detail: safetyRefusalDiagnostic,\n    };\n  }\n  if (error instanceof ResponsesStreamingTerminalError) {\n    const quota =\n      error.category === \"unknown\" || error.category === \"rate_limit\"\n        ? classifyProviderQuotaExhaustionError({\n            code: error.code,\n            error: { code: error.code, type: error.type, message: error.detail },\n            retryAfterSeconds: error.retryAfterSeconds,\n          })\n        : null;\n    if (quota) {\n      return {\n        error: providerQuotaExhaustedMessage(quota.scope),\n        code: PROVIDER_QUOTA_EXHAUSTED_CODE,\n        retryable: false,\n        quotaScope: quota.scope,\n        detail: error.detail,\n      };\n    }\n    return {\n      error:\n        error.category === \"rate_limit\"\n          ? \"Model provider rate limit hit. Try again in a minute or lower the reasoning effort.\"\n          : error.category === \"unavailable\"\n            ? \"The model provider is temporarily unavailable. The same turn will retry after a short delay.\"\n            : \"The model provider rejected the response. Automatic retries stopped.\",\n      code:\n        error.category === \"rate_limit\"\n          ? \"provider_rate_limited\"\n          : error.category === \"unavailable\"\n            ? \"provider_unavailable\"\n            : \"provider_request_rejected\",\n      retryable: error.category === \"rate_limit\" || error.category === \"unavailable\",\n      detail: error.detail,\n    };\n  }\n  const message = error instanceof Error ? error.message : String(error);\n  const status = providerHttpStatus(error);\n  const code =\n    typeof error === \"object\" && error !== null && \"code\" in error\n      ? String((error as { code?: unknown }).code)\n      : undefined;\n  if (error instanceof ActiveSessionHistoryLimitExceededError) {\n    return {\n      error:\n        \"The session's active conversation history exceeds the worker's safe materialization envelope. Clear the session context before retrying; an oversized history cannot be compacted safely in a serving worker.\",\n      code: error.code,\n      retryable: false,\n      detail: error.message,\n    };\n  }\n  if (error instanceof ApprovalRunStateLimitExceededError) {\n    return {\n      error:\n        \"The saved approval state exceeds the worker's safe materialization envelope. Clear the pending approval context before retrying.\",\n      code: error.code,\n      retryable: false,\n      detail: error.message,\n    };\n  }\n  if (error instanceof PostCompactionContinuationEmptyError) {\n    return {\n      error:\n        \"Context compaction completed, but the continuation ended before a new model response. The same turn will retry from the compacted checkpoint.\",\n      code: POST_COMPACTION_CONTINUATION_EMPTY_CODE,\n      retryable: true,\n    };\n  }\n  if (isProviderCommandObservationUnavailableError(error)) {\n    return {\n      error:\n        \"A managed sandbox command cannot be observed. Its exact invocation and writer remain retained; setup is blocked without replay until the incomplete operation can be reconciled.\",\n      code: \"sandbox_command_observation_unavailable\",\n      retryable: false,\n    };\n  }\n  if (isModalCommandStartOutcomeUnknownError(error)) {\n    return {\n      error:\n        \"A managed sandbox command has an unknown outcome. Its original invocation remains fenced; setup is blocked without replay until the incomplete operation can be reconciled.\",\n      code: \"sandbox_command_start_outcome_unknown\",\n      retryable: false,\n    };\n  }\n  if (\n    !isRoutingMutationOutcomeUnknownError(error) &&\n    isModalTaskExecStartPreDispatchUnavailableError(error)\n  ) {\n    return {\n      error:\n        \"The managed sandbox command router was not ready before the command was sent. The same turn will retry after a short delay.\",\n      code: \"sandbox_command_start_unavailable\",\n      retryable: true,\n    };\n  }\n  // An accepted Codex stream with no terminal response is malformed/partial,\n  // not provider backpressure. Replaying the same accepted turn could repeat\n  // model or tool effects, so this marked transport failure must outrank the\n  // generic 5xx retry classifier (CodexStreamingTerminalError uses status 502).\n  if (isCodexTransportError(error) && code === \"invalid_sse_terminal\") {\n    return {\n      error: \"The Codex response stream ended without a terminal response\",\n      code: \"invalid_sse_terminal\",\n      retryable: false,\n    };\n  }\n  if (isXaiSubscriptionHostedToolContinuationError(error)) {\n    return {\n      error:\n        \"SuperGrok stopped responding after its hosted search completed. Partial output was preserved; automatic replay is disabled because the accepted response may still have provider-side effects.\",\n      code: \"xai_hosted_tool_continuation_stalled\",\n      retryable: false,\n    };\n  }\n  const xaiStreamTerminal = classifyXaiSubscriptionStreamingTerminalError(error);\n  if (xaiStreamTerminal) {\n    return {\n      error: xaiStreamTerminal.message,\n      code: xaiStreamTerminal.code,\n      retryable: xaiStreamTerminal.status === 429,\n      lastEventType: xaiStreamTerminal.eventType,\n      ...(xaiStreamTerminal.requestId ? { requestId: xaiStreamTerminal.requestId } : {}),\n    };\n  }\n  const xaiStreamTimeout = classifyXaiSubscriptionStreamIdleTimeoutError(error);\n  if (xaiStreamTimeout) {\n    return {\n      error:\n        \"SuperGrok stopped sending valid response events. Partial output was preserved; automatic replay is disabled because the accepted response may still have provider-side effects.\",\n      code: \"xai_response_stream_idle_timeout\",\n      retryable: false,\n      responseObserved: xaiStreamTimeout.responseObserved,\n      eventCount: xaiStreamTimeout.eventCount,\n      silenceDurationMs: xaiStreamTimeout.silenceDurationMs,\n      ...(xaiStreamTimeout.requestId ? { requestId: xaiStreamTimeout.requestId } : {}),\n      ...(xaiStreamTimeout.lastEventType ? { lastEventType: xaiStreamTimeout.lastEventType } : {}),\n    };\n  }\n  if (isSessionEventPersistenceError(error)) {\n    const { details } = error;\n    return {\n      error: error.message,\n      code: details.code,\n      detail:\n        details.retryOutcome === \"exhausted\"\n          ? `The idempotent persistence transaction failed after ${details.attempts} attempts.`\n          : \"The database rejected the idempotent persistence transaction.\",\n      correlationId: details.correlationId,\n      stage: details.stage,\n      sqlState: details.sqlState,\n      attempts: details.attempts,\n      retryOutcome: details.retryOutcome,\n      ...(Object.keys(details.database).length > 0 ? { database: details.database } : {}),\n    };\n  }\n  // Codex plan entitlement: the settlement path normally re-checks the plan\n  // and records a precise payload. These branches keep any other path from\n  // surfacing the SDK's raw \"400 status code (no body)\" text.\n  if (error instanceof CodexPlanEntitlementError) {\n    return error.payload;\n  }\n  // Shared subscription core placement outcomes carry their own typed copy.\n  if (error instanceof SubscriptionCoreCodexTurnError) {\n    return error.payload;\n  }\n  const entitlementRejection = classifyCodexEntitlementRejection(error);\n  if (entitlementRejection) {\n    return entitlementRejection.evidence === \"plan_entitlement\"\n      ? codexPlanEntitlementFailurePayload({\n          accountLabel: null,\n          planType: null,\n          planChanged: false,\n          modelId: null,\n          rejection: entitlementRejection,\n        })\n      : codexRequestRejectedFailurePayload({\n          accountLabel: null,\n          planType: null,\n          rejection: entitlementRejection,\n          planChecked: false,\n        });\n  }\n  // A ChatGPT/Codex usage cap is a HARD limit, not transient backpressure: it\n  // must NOT be reported as a generic, retryable rate-limit (which would loop a\n  // goal against a capped backend). Surface a precise, actionable message with\n  // the humanized reset window and code, non-retryable. Checked BEFORE the\n  // generic 429 branch below (a usage cap is also a 429).\n  // This terminal payload classifier may receive a plain SDK-shaped error in\n  // tests or after wrapper metadata was stripped. An explicit\n  // `usage_limit_reached` shape must still outrank generic 429 retryability.\n  // Credential quarantine/failover remains separately provenance-gated by\n  // `isCodexTransportError`; this branch only chooses the truthful user payload.\n  // The looser \"429 ... usage limit\" wording counts only on a Codex transport\n  // error: an API-key provider's 429 that says \"usage limit\" is provider quota\n  // evidence, not a ChatGPT/Codex subscription cap.\n  const creditPolicy = findCodexCreditPolicyError(error);\n  if (creditPolicy) {\n    return { error: creditPolicy.message, code: creditPolicy.code, retryable: false };\n  }\n  const usageLimit = classifyCodexUsageLimitError(error);\n  if (usageLimit && (isCodexTransportError(error) || hasCodexUsageLimitType(error))) {\n    return codexUsageLimitFailurePayload(usageLimit, message);\n  }\n  const codexTimeout = classifyCodexResponseTimeoutError(error, {\n    allowLegacyRequestTimeout: options.isCodexTurn === true,\n  });\n  if (codexTimeout) {\n    return {\n      error: codexTimeout.responseObserved\n        ? \"The Codex response timed out after streaming began. Observed output was checkpointed; automatic replay is disabled because the upstream operation may still be active.\"\n        : \"The Codex response timed out before any response was observed. Upstream acceptance is unknown, so automatic replay is disabled.\",\n      code: \"codex_response_timeout\",\n      retryable: false,\n      timeoutClass: codexTimeout.timeoutClass,\n      responseObserved: codexTimeout.responseObserved,\n      ...(codexTimeout.requestId ? { requestId: codexTimeout.requestId } : {}),\n      ...(codexTimeout.message ? { detail: codexTimeout.message } : {}),\n    };\n  }\n  const mcpTimeout = classifyMcpTransportTimeoutError(error);\n  if (mcpTimeout) {\n    const mcpTransportDiagnostic = mcpTransportRequestFailureDiagnostic(error);\n    return {\n      error:\n        \"An MCP server request timed out. Any completed tool output was checkpointed; the session can continue safely.\",\n      code: \"mcp_transport_timeout\",\n      retryable: true,\n      ...(mcpTimeout.detail || mcpTimeout.message\n        ? { detail: mcpTimeout.detail ?? mcpTimeout.message }\n        : {}),\n      ...(mcpTransportDiagnostic ? { mcpTransportDiagnostic } : {}),\n    };\n  }\n  if (isMcpTransportConnectivityError(error)) {\n    const mcpTransportDiagnostic = mcpTransportRequestFailureDiagnostic(error);\n    return {\n      error:\n        \"A required MCP server was temporarily unreachable. The same turn will retry after a short delay.\",\n      code: \"mcp_transport_unavailable\",\n      retryable: true,\n      detail: message,\n      ...(mcpTransportDiagnostic ? { mcpTransportDiagnostic } : {}),\n    };\n  }\n  // A generic model stream that went silent mid-response (typed idle bound) or\n  // a transport timeout (\"The operation timed out.\" DOMException TimeoutError\n  // from the fetch layer) is a dead upstream connection, not a request fault:\n  // checkpoint durable truth and recover the same turn within the finite\n  // provider recovery budget. Codex/SuperGrok typed timeouts are classified\n  // above under their own transport policy.\n  const streamIdle = classifyModelStreamIdleTimeoutError(error);\n  if (streamIdle) {\n    const seconds =\n      streamIdle.idleTimeoutMs !== null ? Math.round(streamIdle.idleTimeoutMs / 1_000) : null;\n    const window = seconds !== null ? ` for ${seconds}s` : \"\";\n    return {\n      error:\n        streamIdle.kind === \"progress\"\n          ? `The model provider stream stalled: only keepalive traffic and no response progress${window}. The same turn will retry after a short delay.`\n          : `The model provider stopped sending response data${window}. The same turn will retry after a short delay.`,\n      code: \"provider_unavailable\",\n      retryable: true,\n      timeoutClass: streamIdle.kind === \"progress\" ? \"progress_stream\" : \"idle_stream\",\n      responseObserved: true,\n      detail: streamIdle.message,\n    };\n  }\n  if (status === undefined && isTransportTimeoutError(error)) {\n    return {\n      error:\n        \"The model provider connection timed out. The same turn will retry after a short delay.\",\n      code: \"provider_unavailable\",\n      retryable: true,\n      timeoutClass: \"transport\",\n      detail: message,\n    };\n  }\n  if (code === UNKNOWN_MODEL_FINISH_REASON_CODE) {\n    return {\n      error:\n        \"The model provider ended its response ambiguously. Partial output was not accepted as complete; the same turn will retry from durable history.\",\n      code: UNKNOWN_MODEL_FINISH_REASON_CODE,\n      retryable: true,\n    };\n  }\n  // An exhausted quota also arrives as HTTP 429 (or 402), but no retry within\n  // the finite same-turn budget can succeed. Fail the turn promptly with a\n  // distinct code so the client can offer another model; ordinary short rate\n  // limits fall through to the retryable branch below.\n  if (status === 402 && code === \"anthropic_billing_error\") {\n    return {\n      error: \"Claude could not bill this request. Check the account's billing and payment details.\",\n      code: \"provider_billing_error\",\n      retryable: false,\n      ...(message ? { detail: message } : {}),\n    };\n  }\n  const quota = classifyProviderQuotaExhaustionError(error);\n  if (quota) {\n    return {\n      error: providerQuotaExhaustedMessage(quota.scope),\n      code: PROVIDER_QUOTA_EXHAUSTED_CODE,\n      retryable: false,\n      quotaScope: quota.scope,\n      ...(message ? { detail: message } : {}),\n    };\n  }\n  if (\n    status === 429 ||\n    ((status === undefined || !Number.isFinite(status)) &&\n      (code === \"rate_limit_exceeded\" ||\n        /(?:too many requests|rate.?limit|\\b429\\b)/i.test(message)))\n  ) {\n    return {\n      error: \"Model provider rate limit hit. Try again in a minute or lower the reasoning effort.\",\n      code: \"provider_rate_limited\",\n      retryable: true,\n      ...(message && message !== \"Too Many Requests\" ? { detail: message } : {}),\n    };\n  }\n  // Transient upstream backpressure (5xx / overloaded / dropped connection): keep\n  // the provider's own message (it is already user-meaningful) but mark it\n  // retryable so a goal-bearing session idles and auto-continues instead of going\n  // terminal on a provider's bad minute. See isTransientProviderError.\n  if (isTransientProviderError(error)) {\n    if (isExactStatuslessUpstreamConnectivityMessage(message)) {\n      return {\n        error:\n          \"Opengeni could not reach an upstream service. The same turn will retry after a short delay.\",\n        code: \"upstream_connectivity_unavailable\",\n        retryable: true,\n      };\n    }\n    return { error: message, code: \"provider_unavailable\", retryable: true };\n  }\n  return { error: message };\n}\n\nexport type CodexCredentialFailure = {\n  /**\n   * `plan_entitlement` is produced only after a plan re-check proves the\n   * serving account's current plan does not include the requested model.\n   */\n  kind: \"auth\" | \"forbidden\" | \"rate_limit\" | \"quota\" | \"plan_entitlement\";\n  cooldownSeconds: number | null;\n  origin?: \"included_usage_policy\" | \"usage_verification_policy\";\n};\n\nexport const CODEX_ALLOWANCE_FALLBACK_MS = 5 * 60 * 60_000;\n\n/**\n * Resolve a deterministic quarantine end. Generic request throttling honors\n * provider retry-after (or one minute); allowance/quota refusal waits for the\n * LAST of provider reset and every still-binding cached window (five-hour and\n * weekly both bind), falling back to one complete five-hour window when no reset\n * metadata exists.\n */\nexport function codexCredentialCooldownUntil(\n  failure: CodexCredentialFailure,\n  account: Pick<\n    CodexAccountStatus,\n    \"primaryUsedPercent\" | \"primaryResetAt\" | \"secondaryUsedPercent\" | \"secondaryResetAt\"\n  > | null,\n  now: Date,\n): Date | null {\n  if (\n    failure.kind === \"auth\" ||\n    failure.kind === \"forbidden\" ||\n    failure.kind === \"plan_entitlement\"\n  ) {\n    return null;\n  }\n  const providerReset =\n    failure.cooldownSeconds !== null &&\n    Number.isFinite(failure.cooldownSeconds) &&\n    failure.cooldownSeconds > 0\n      ? new Date(now.getTime() + Math.ceil(failure.cooldownSeconds) * 1000)\n      : null;\n  if (failure.kind === \"rate_limit\") {\n    return providerReset ?? new Date(now.getTime() + PROVIDER_BACKPRESSURE_DELAY_MS);\n  }\n  const blockingResets = account\n    ? [\n        { used: account.primaryUsedPercent, reset: account.primaryResetAt },\n        { used: account.secondaryUsedPercent, reset: account.secondaryResetAt },\n      ]\n        .filter(\n          (window): window is { used: number; reset: Date } =>\n            (window.used ?? 0) >= CODEX_USAGE_EXHAUSTED_PCT &&\n            window.reset instanceof Date &&\n            window.reset.getTime() > now.getTime(),\n        )\n        .map((window) => window.reset)\n    : [];\n  const quotaResets = providerReset ? [...blockingResets, providerReset] : blockingResets;\n  if (quotaResets.length === 0) {\n    return new Date(now.getTime() + CODEX_ALLOWANCE_FALLBACK_MS);\n  }\n  return quotaResets.reduce((latest, reset) =>\n    reset.getTime() > latest.getTime() ? reset : latest,\n  );\n}\n\n/**\n * Only definitive credential/account refusals are safe rotation signals.\n * Ambiguous network failures, malformed/partial streams, invalid model content,\n * prompt 4xx, and provider 5xx may already have consumed tokens or persisted\n * progress and therefore MUST NOT walk the credential pool automatically.\n */\nexport function classifyCodexCredentialFailure(error: unknown): CodexCredentialFailure | null {\n  const creditPolicy = findCodexCreditPolicyError(error);\n  if (creditPolicy instanceof CodexIncludedUsageUnknownError) {\n    // Verified pre-dispatch refusal. A short hard hold cannot authorize credit\n    // fallback and does not claim that the provider exhausted its allowance.\n    return { kind: \"rate_limit\", cooldownSeconds: 60, origin: \"usage_verification_policy\" };\n  }\n  if (creditPolicy instanceof CodexIncludedUsageExhaustedError) {\n    return {\n      kind: \"quota\",\n      cooldownSeconds: creditPolicy.resetsInSeconds,\n      origin: \"included_usage_policy\",\n    };\n  }\n  // A request safety refusal is not evidence that another account should run it.\n  if (isProviderSafetyRefusal(error)) return null;\n  // A permanent OAuth refresh failure is definitive and the shared resolver has\n  // already fenced/stamped the exact credential version. The OpenAI client can\n  // wrap a rejection from its custom fetch in APIConnectionError, so recognize\n  // the typed exception through the same bounded cause chain used below.\n  let refreshError: unknown = error;\n  for (let depth = 0; depth < 6 && refreshError && typeof refreshError === \"object\"; depth += 1) {\n    if (refreshError instanceof CodexReloginRequired) {\n      return { kind: \"auth\", cooldownSeconds: null };\n    }\n    refreshError = (refreshError as Record<string, unknown>).cause;\n  }\n  // The activity catch also receives sandbox, MCP, storage, and tool failures.\n  // Their HTTP status codes are not Codex account state and must never walk the\n  // subscription pool or replay a tool on another credential.\n  if (!isCodexTransportError(error)) {\n    return null;\n  }\n  // Plan/model entitlement evidence (an explicit plan refusal, or an empty\n  // HTTP 400) is not account health or quota. The worker re-checks the plan\n  // first; only a proven entitlement loss walks the pool, as `plan_entitlement`.\n  if (classifyCodexEntitlementRejection(error)) {\n    return null;\n  }\n  const usageLimit = classifyCodexUsageLimitError(error);\n  if (usageLimit) {\n    return { kind: \"quota\", cooldownSeconds: usageLimit.resetsInSeconds };\n  }\n  let cur: unknown = error;\n  for (let depth = 0; depth < 6 && cur && typeof cur === \"object\"; depth++) {\n    const value = cur as Record<string, unknown>;\n    const body =\n      value.error && typeof value.error === \"object\"\n        ? (value.error as Record<string, unknown>)\n        : null;\n    const status = Number(value.status ?? value.statusCode ?? body?.status ?? body?.statusCode);\n    const code = String(value.code ?? body?.code ?? \"\").toLowerCase();\n    const directRetryAfter = Number(\n      value.retry_after_seconds ?? body?.retry_after_seconds ?? value.retryAfterSeconds,\n    );\n    const retryAfterHeader =\n      headerValue(value.headers, \"retry-after\") ??\n      headerValue(value.responseHeaders, \"retry-after\") ??\n      headerValue(body?.headers, \"retry-after\");\n    const retryAfterNumber = retryAfterHeader === null ? Number.NaN : Number(retryAfterHeader);\n    const retryAfterDate =\n      retryAfterHeader !== null && !Number.isFinite(retryAfterNumber)\n        ? Date.parse(retryAfterHeader)\n        : Number.NaN;\n    const retryAfter = Number.isFinite(directRetryAfter)\n      ? directRetryAfter\n      : Number.isFinite(retryAfterNumber)\n        ? retryAfterNumber\n        : Number.isFinite(retryAfterDate)\n          ? Math.max(0, (retryAfterDate - Date.now()) / 1000)\n          : Number.NaN;\n    const cooldownSeconds =\n      Number.isFinite(retryAfter) && retryAfter > 0 ? Math.ceil(retryAfter) : null;\n    // Provider quota codes are more specific than their HTTP transport status.\n    // A permanent allowance refusal commonly arrives as HTTP 429; classify it\n    // before generic backpressure so it receives the binding-window cooldown.\n    if (\n      code === \"insufficient_quota\" ||\n      code === \"quota_exceeded\" ||\n      code === \"billing_hard_limit_reached\"\n    ) {\n      return { kind: \"quota\", cooldownSeconds };\n    }\n    if (status === 401 || code === \"unauthorized\" || code === \"invalid_api_key\") {\n      return { kind: \"auth\", cooldownSeconds };\n    }\n    if (status === 403) {\n      return { kind: \"forbidden\", cooldownSeconds };\n    }\n    if (status === 429 || code === \"rate_limit_exceeded\" || code === \"too_many_requests\") {\n      return { kind: \"rate_limit\", cooldownSeconds };\n    }\n    cur = value.cause;\n  }\n  return null;\n}\n\n/** Humanize a seconds duration into a short \"2h 5m\" / \"9m\" / \"in under a minute\" string. */\nexport function humanizeResetWindow(resetsInSeconds: number | null): string {\n  if (resetsInSeconds === null || !Number.isFinite(resetsInSeconds) || resetsInSeconds <= 0) {\n    return \"shortly\";\n  }\n  const total = Math.ceil(resetsInSeconds);\n  if (total < 60) {\n    return \"in under a minute\";\n  }\n  const hours = Math.floor(total / 3600);\n  const minutes = Math.round((total % 3600) / 60);\n  if (hours > 0) {\n    return minutes > 0 ? `in about ${hours}h ${minutes}m` : `in about ${hours}h`;\n  }\n  return `in about ${minutes}m`;\n}\n\n/**\n * Build the turn.failed payload for a ChatGPT/Codex usage cap: a precise,\n * actionable message naming the reset window, the stable `codex_usage_limit_reached`\n * code, and retryable:false (an auto-retry would just re-hit the cap).\n */\nexport function codexUsageLimitFailurePayload(\n  info: { resetsInSeconds: number | null },\n  detail: string,\n  opts?: { allAccounts?: boolean },\n): { error: string; code: string; retryable: false; detail?: string } {\n  // P3: when EVERY connected subscription is rate-limited the message names the\n  // earliest reset across accounts; the single-account message is unchanged.\n  const error = opts?.allAccounts\n    ? `All connected ChatGPT/Codex subscriptions are rate-limited. Access returns ${humanizeResetWindow(info.resetsInSeconds)}. ` +\n      `You can switch this session to a different model in the meantime, or wait for a subscription to reset.`\n    : `Your ChatGPT/Codex subscription usage limit has been reached. Access resets ${humanizeResetWindow(info.resetsInSeconds)}. ` +\n      `You can switch this session to a different model in the meantime, or wait for the limit to reset.`;\n  return {\n    error,\n    code: \"codex_usage_limit_reached\",\n    retryable: false,\n    ...(detail ? { detail } : {}),\n  };\n}\n\n// A usage cap that won't reset for a long time should not pin a Temporal timer\n// open indefinitely for a goal-bearing session; cap the continuation hold so the\n// goal re-evaluates at most this far out (it will re-pause if still capped).\nexport const CODEX_USAGE_LIMIT_MAX_RESUME_MS = 60 * 60_000; // 1h\n\n/**\n * Claude's classification of a failed model request as a shared provider\n * outcome (the adapter's `classifyError`, Claude track C1b), for a request\n * of the Claude subscription transport only: a reconnect-required refresh or\n * HTTP 401 is `unauthorized` (the transport already ran the turn's one\n * forced refresh); 429 is `rate_limited` for the turn's model `modelId`, with\n * the provider's retry time (null: the adapter's fallback applies); 529 or\n * `overloaded_error` is `overloaded`, which never moves the turn to another\n * account; 403 is `fatal`, which never rotates or quarantines the account.\n * Anything else, a provider safety refusal included, is null: not a refusal\n * of the account.\n */\nexport function classifyClaudeProviderError(\n  error: unknown,\n  modelId?: string,\n): ProviderErrorOutcome | null {\n  if (isProviderSafetyRefusal(error)) return null;\n  let current: unknown = error;\n  for (let depth = 0; depth < 6 && current instanceof Error; depth++) {\n    if (current instanceof ClaudeSubscriptionReconnectRequired) return { kind: \"unauthorized\" };\n    if (current instanceof AnthropicRequestError) {\n      if (!current.subscription) return null;\n      if (current.status === 401) return { kind: \"unauthorized\" };\n      if (current.status === 429)\n        return {\n          kind: \"rate_limited\",\n          retryAfterMs: providerRetryAfterMs(current),\n          ...(modelId === undefined ? {} : { modelId }),\n        };\n      if (current.status === 529 || current.errorType === \"overloaded_error\")\n        return { kind: \"overloaded\" };\n      if (current.status === 403) return { kind: \"fatal\" };\n      return null;\n    }\n    current = current.cause;\n  }\n  return null;\n}\n","export const entityKind = Symbol.for('drizzle:entityKind');\nexport const hasOwnEntityKind = Symbol.for('drizzle:hasOwnEntityKind');\n\nexport interface DrizzleEntity {\n\t[entityKind]: string;\n}\n\nexport type DrizzleEntityClass<T> =\n\t& ((abstract new(...args: any[]) => T) | (new(...args: any[]) => T))\n\t& DrizzleEntity;\n\nexport function is<T extends DrizzleEntityClass<any>>(value: any, type: T): value is InstanceType<T> {\n\tif (!value || typeof value !== 'object') {\n\t\treturn false;\n\t}\n\n\tif (value instanceof type) { // eslint-disable-line no-instanceof/no-instanceof\n\t\treturn true;\n\t}\n\n\tif (!Object.prototype.hasOwnProperty.call(type, entityKind)) {\n\t\tthrow new Error(\n\t\t\t`Class \"${\n\t\t\t\ttype.name ?? '<unknown>'\n\t\t\t}\" doesn't look like a Drizzle entity. If this is incorrect and the class is provided by Drizzle, please report this as a bug.`,\n\t\t);\n\t}\n\n\tlet cls = Object.getPrototypeOf(value).constructor;\n\tif (cls) {\n\t\t// Traverse the prototype chain to find the entityKind\n\t\twhile (cls) {\n\t\t\tif (entityKind in cls && cls[entityKind] === type[entityKind]) {\n\t\t\t\treturn true;\n\t\t\t}\n\n\t\t\tcls = Object.getPrototypeOf(cls);\n\t\t}\n\t}\n\n\treturn false;\n}\n","import { entityKind } from '~/entity.ts';\n\nexport class DrizzleError extends Error {\n\tstatic readonly [entityKind]: string = 'DrizzleError';\n\n\tconstructor({ message, cause }: { message?: string; cause?: unknown }) {\n\t\tsuper(message);\n\t\tthis.name = 'DrizzleError';\n\t\tthis.cause = cause;\n\t}\n}\n\nexport class DrizzleQueryError extends Error {\n\tconstructor(\n\t\tpublic query: string,\n\t\tpublic params: any[],\n\t\tpublic override cause?: Error,\n\t) {\n\t\tsuper(`Failed query: ${query}\\nparams: ${params}`);\n\t\tError.captureStackTrace(this, DrizzleQueryError);\n\n\t\t// ES2022+: preserves original error on `.cause`\n\t\tif (cause) (this as any).cause = cause;\n\t}\n}\n\nexport class TransactionRollbackError extends DrizzleError {\n\tstatic override readonly [entityKind]: string = 'TransactionRollbackError';\n\n\tconstructor() {\n\t\tsuper({ message: 'Rollback' });\n\t}\n}\n","/** A provider-reported usage percentage at or above this value is exhausted. */\nexport const CODEX_USAGE_EXHAUSTED_PCT = 100;\n","import {\n  MODEL_ATTACHMENT_REFS_FIELD,\n  MODEL_ATTACHMENT_CATALOG_MARKER,\n  MODEL_ATTACHMENT_CATALOG_RENDERED_FIELD,\n  MODEL_ATTACHMENT_IMAGE_MAX_DIMENSION_FIELD,\n  FileResourceRef,\n  resourceMountPath,\n  readTurnExecutionPolicyV1,\n  readTurnServingPolicyV1,\n  type FileAsset,\n  type ResourceRef,\n} from \"@opengeni/contracts\";\nimport { createHash } from \"node:crypto\";\nimport {\n  getActiveSessionHistoryItemsPaged,\n  getFilesForSubject,\n  getSandboxSessionEnvelope,\n  getSessionEvent,\n  listSessionSystemUpdatesForTurn,\n  listTurnOpenSuffixToolCalls,\n  readSubscriptionHistoryProvenance,\n  type Database,\n} from \"@opengeni/db\";\nimport {\n  createModelImageSizer,\n  projectHistoryForProvider,\n  projectRejectedProviderArtifactsFromSerializedRunState,\n  projectRejectedReasoningArtifact,\n  hasOpaqueProviderArtifact,\n  type HistoryProviderApi,\n  type OpenGeniRuntime,\n} from \"@opengeni/runtime\";\nimport { requesterUnavailableReceiptText } from \"./requester-unavailable-receipt\";\n\n/** D-37 request-copy projection. C1 is deliberately not wired into turnInput;\n * C2 must supply scoped turn metadata and the D-43 deployment gate. The API\n * alone cannot establish provenance: different providers may share a wire API.\n */\nexport function projectServingProviderArtifacts(\n  rows: ReadonlyArray<{\n    item: Record<string, unknown>;\n    turnId?: string | null;\n    position: number;\n    providerArtifactInvalidatedAt?: Date | null;\n  }>,\n  options: {\n    enabled?: boolean;\n    servingProviderId: string;\n    turnMetadata: ReadonlyMap<string, unknown>;\n  },\n): Array<Record<string, unknown>> {\n  if (options.enabled !== true) return projectRejectedProviderArtifacts(rows);\n  const providers = new Map<string, ReturnType<typeof readTurnServingPolicyV1> | null>();\n  const acceptedProviders = new Map<string, string | null>();\n  return rows.flatMap((row) => {\n    let provider: string | null = null;\n    if (row.turnId) {\n      if (!providers.has(row.turnId)) {\n        try {\n          const metadata = options.turnMetadata.get(row.turnId);\n          const accepted = readTurnExecutionPolicyV1(metadata);\n          providers.set(row.turnId, readTurnServingPolicyV1(metadata));\n          acceptedProviders.set(\n            row.turnId,\n            accepted.kind === \"valid\" ? accepted.policy.providerId : null,\n          );\n        } catch {\n          // Unattributable legacy/fork history keeps today's projection. This\n          // does not authorize executing an unreadable serving policy.\n          providers.set(row.turnId, null);\n          acceptedProviders.set(row.turnId, null);\n        }\n      }\n      provider = acceptedProviders.get(row.turnId) ?? null;\n      const read = providers.get(row.turnId);\n      if (read?.kind === \"valid\") {\n        for (const revision of read.revisions) {\n          if (revision.historyPosition >= row.position) break;\n          provider = revision.policy.providerId;\n        }\n      }\n    }\n    if (\n      provider !== null &&\n      provider !== options.servingProviderId &&\n      hasOpaqueProviderArtifact(row.item)\n    ) {\n      if (row.item.type === \"compaction\") return [];\n      return [projectRejectedReasoningArtifact(row.item)];\n    }\n    return projectRejectedProviderArtifacts([row]);\n  });\n}\n\n/** Project only artifacts explicitly rejected by the provider out of its next view. */\nexport function projectRejectedProviderArtifacts(\n  rows: ReadonlyArray<{\n    item: Record<string, unknown>;\n    providerArtifactInvalidatedAt?: Date | null;\n  }>,\n): Array<Record<string, unknown>> {\n  const out: Array<Record<string, unknown>> = [];\n  for (const row of rows) {\n    if (!row.providerArtifactInvalidatedAt) {\n      out.push(row.item);\n      continue;\n    }\n    const type = typeof row.item.type === \"string\" ? row.item.type : undefined;\n    if (type === \"reasoning\") {\n      out.push(projectRejectedReasoningArtifact(row.item));\n      continue;\n    }\n    if (type === \"compaction\") {\n      continue;\n    }\n    out.push(row.item);\n  }\n  return out;\n}\n\n/** Build the attempt-local RunState view after an explicit provider rejection. */\nexport function resumeRunState(state: {\n  serializedRunState: string;\n  providerArtifactInvalidatedAt?: Date | null;\n}): string {\n  if (!state.providerArtifactInvalidatedAt) {\n    return state.serializedRunState;\n  }\n  return projectRejectedProviderArtifactsFromSerializedRunState(state.serializedRunState);\n}\n\n/** Prepared input and its exact durable-history prefix length for reconciliation. */\nexport type PreparedTurnInput = {\n  input: Awaited<ReturnType<OpenGeniRuntime[\"prepareInput\"]>>;\n  persistedHistoryCount: number;\n  providerArtifactCandidates: {\n    knownHistoryItemIds: string[];\n    historyItemIds: string[];\n    runStateId?: string;\n  };\n};\n\nexport type TurnInputOptions = {\n  turnId: string;\n  /** Frozen initiating-human authority for every model-visible file read. */\n  fileAuthority: { accountId: string; subjectId: string | null };\n  recovering?: boolean;\n  unavailableSandboxFilesNote?: string;\n  runCredentialsNote?: string;\n  mcpAvailabilityNote?: string;\n  codemodeContinuationNote?: string;\n  programmaticApprovalAcknowledged?: boolean;\n  knowledgeSourcePreparationNote?: string;\n  providerApi: HistoryProviderApi;\n  servingProviderId?: string;\n  projectCanonicalHistory?: ModelHistoryAttachmentProjector;\n  materializeModelHistory?: ModelHistoryAttachmentProjector;\n  projectModelHistory?: ModelHistoryAttachmentProjector;\n  loadActiveHistory?: typeof getActiveSessionHistoryItemsPaged;\n  /** Bounded critical-path timings; telemetry failures never affect preparation. */\n  onPreparationPhase?: (measurement: HistoryPreparationPhaseMeasurement) => void;\n};\n\nexport type HistoryPreparationPhase =\n  | \"system_update_load\"\n  | \"current_attachment_resolution\"\n  | \"durable_history_load\"\n  | \"sandbox_envelope_load\"\n  | \"canonical_projection\"\n  | \"provider_projection\"\n  | \"attachment_ref_projection\"\n  | \"screenshot_materialization\"\n  | \"model_attachment_projection\"\n  | \"runtime_input_assembly\"\n  | \"artifact_candidate_scan\";\n\nexport type HistoryPreparationPhaseMeasurement = {\n  phase: HistoryPreparationPhase;\n  outcome: \"completed\" | \"failed\";\n  durationSeconds: number;\n};\n\nasync function measureHistoryPreparationPhase<T>(\n  options: Pick<TurnInputOptions, \"onPreparationPhase\">,\n  phase: HistoryPreparationPhase,\n  operation: () => T | Promise<T>,\n): Promise<T> {\n  const startedAt = performance.now();\n  let outcome: HistoryPreparationPhaseMeasurement[\"outcome\"] = \"completed\";\n  try {\n    return await operation();\n  } catch (error) {\n    outcome = \"failed\";\n    throw error;\n  } finally {\n    try {\n      options.onPreparationPhase?.({\n        phase,\n        outcome,\n        durationSeconds: (performance.now() - startedAt) / 1_000,\n      });\n    } catch {\n      // Diagnostics must not change durable history or provider input.\n    }\n  }\n}\n\nexport const MAX_INLINE_MODEL_ATTACHMENT_BYTES = 20 * 1024 * 1024;\n// Raw-byte allowance; base64 and request serialization add memory overhead.\n// This is transport admission, never an instruction to rewrite old messages.\nexport const MAX_RETAINED_MODEL_ATTACHMENT_BYTES = 64 * 1024 * 1024;\n\nexport class RetainedAttachmentTransportLimitError extends Error {\n  constructor() {\n    super(\n      \"Active uploaded images exceed the 64 MiB inline transport limit. \" +\n        \"History was preserved and no new image bytes were downloaded. \" +\n        \"Start a smaller conversation or fork before the image-heavy messages.\",\n    );\n    this.name = \"RetainedAttachmentTransportLimitError\";\n  }\n}\n\n/**\n * A retained image the conversation already sent could not be read from\n * object storage, for example while a storage replica catches up after an\n * outage. Its pixels are part of the accepted prompt, so the turn waits and\n * retries rather than continuing without them. Integrity mismatches are not\n * this error: retrying cannot repair different bytes.\n */\nexport class RetainedAttachmentUnavailableError extends Error {\n  readonly fileIds: readonly string[];\n\n  constructor(fileIds: readonly string[]) {\n    super(\"An image attached earlier in this conversation can't be read from storage right now.\");\n    this.name = \"RetainedAttachmentUnavailableError\";\n    this.fileIds = [...fileIds];\n  }\n}\n\nexport type ModelAttachmentReadFailure = \"unavailable\" | \"integrity_mismatch\";\n\nexport type ModelAttachmentContent = {\n  kind: \"image\" | \"file\";\n  fileId: string;\n  filename: string;\n  contentType: string;\n  dataUrl: string;\n};\n\nexport type ModelHistoryAttachmentProjector = (\n  items: Array<Record<string, unknown>>,\n  options?: ModelHistoryAttachmentProjectionOptions,\n) => Promise<Array<Record<string, unknown>>>;\n\nexport type ModelHistoryAttachmentProjectionOptions = {\n  /** Exact, already-authorized files attached to the triggering message. */\n  inlineFiles?: readonly FileAsset[];\n};\n\nexport type ModelAttachmentInputPolicy = {\n  supportsImageInput: boolean;\n  inputFileMediaTypes: readonly string[];\n};\n\nconst MODEL_IMAGE_CONTENT_TYPES = new Set([\"image/gif\", \"image/jpeg\", \"image/png\", \"image/webp\"]);\n\nconst MODEL_FILE_CONTENT_TYPES = new Set([\n  \"application/json\",\n  \"application/pdf\",\n  \"application/x-yaml\",\n  \"application/yaml\",\n]);\n\n// Generic XML has equivalent application/* and text/* registrations. Keep both\n// aliases on the sandbox-path fallback until a provider parser boundary is\n// explicitly supported and verified; MIME spelling must not bypass the fence.\nconst BLOCKED_TEXT_CONTENT_TYPES = new Set([\n  \"text/css\",\n  \"text/html\",\n  \"text/javascript\",\n  \"text/xml\",\n]);\n\nfunction safeErrorType(error: unknown): string {\n  if (!(error instanceof Error)) return typeof error;\n  const name = error.name.trim();\n  return /^[A-Za-z][A-Za-z0-9_.-]{0,63}$/.test(name) ? name : \"Error\";\n}\n\nfunction modelAttachmentDescriptor(\n  contentType: string,\n): Pick<ModelAttachmentContent, \"kind\" | \"contentType\"> | null {\n  const normalized = contentType.toLowerCase().split(\";\", 1)[0]?.trim() ?? \"\";\n  if (MODEL_IMAGE_CONTENT_TYPES.has(normalized)) {\n    return { kind: \"image\", contentType: normalized };\n  }\n  if (\n    MODEL_FILE_CONTENT_TYPES.has(normalized) ||\n    (normalized.startsWith(\"text/\") && !BLOCKED_TEXT_CONTENT_TYPES.has(normalized))\n  ) {\n    return { kind: \"file\", contentType: normalized };\n  }\n  return null;\n}\n\nexport async function modelAttachmentContentForFiles(\n  files: FileAsset[],\n  readFileBytes: (file: FileAsset) => Promise<Uint8Array>,\n  options: {\n    retainAll?: boolean;\n    /** Why a selected file produced no content; omitted files are not reported. */\n    onReadFailure?: (fileId: string, failure: ModelAttachmentReadFailure) => void;\n  } = {},\n): Promise<ModelAttachmentContent[]> {\n  const selected: Array<{\n    file: FileAsset;\n    descriptor: Pick<ModelAttachmentContent, \"kind\" | \"contentType\">;\n    checksum: string;\n  }> = [];\n  let remainingBytes = options.retainAll\n    ? Number.POSITIVE_INFINITY\n    : MAX_INLINE_MODEL_ATTACHMENT_BYTES;\n  for (const file of files) {\n    const descriptor = modelAttachmentDescriptor(file.contentType);\n    const checksum = file.sha256?.trim().toLowerCase() ?? \"\";\n    if (\n      file.status !== \"ready\" ||\n      !descriptor ||\n      descriptor.kind !== \"image\" ||\n      file.sizeBytes > MAX_INLINE_MODEL_ATTACHMENT_BYTES ||\n      file.sizeBytes > remainingBytes ||\n      !/^[a-f0-9]{64}$/.test(checksum)\n    ) {\n      continue;\n    }\n    selected.push({ file, descriptor, checksum });\n    remainingBytes -= file.sizeBytes;\n  }\n\n  const attachments = new Array<ModelAttachmentContent | undefined>(selected.length);\n  let cursor = 0;\n  const worker = async () => {\n    while (cursor < selected.length) {\n      const index = cursor++;\n      const { file, descriptor, checksum } = selected[index]!;\n      try {\n        const bytes = await readFileBytes(file);\n        if (bytes.byteLength !== file.sizeBytes) {\n          console.error(\"model attachment bytes did not match finalized metadata\", {\n            fileId: file.id,\n            expectedSizeBytes: file.sizeBytes,\n            actualSizeBytes: bytes.byteLength,\n          });\n          options.onReadFailure?.(file.id, \"integrity_mismatch\");\n          continue;\n        }\n        if (createHash(\"sha256\").update(bytes).digest(\"hex\") !== checksum) {\n          console.error(\"model attachment checksum did not match finalized metadata\", {\n            fileId: file.id,\n          });\n          options.onReadFailure?.(file.id, \"integrity_mismatch\");\n          continue;\n        }\n        attachments[index] = {\n          kind: descriptor.kind,\n          fileId: file.id,\n          filename: file.safeFilename,\n          contentType: descriptor.contentType,\n          dataUrl: `data:${descriptor.contentType};base64,${Buffer.from(bytes).toString(\"base64\")}`,\n        };\n      } catch (error) {\n        // The sandbox-path projection remains available for every file. A direct\n        // provider-content read is an additive fast path and must not turn a\n        // transient storage read into loss of the accepted prompt.\n        console.error(\"model attachment content read failed; retaining sandbox path fallback\", {\n          fileId: file.id,\n          errorType: safeErrorType(error),\n        });\n        options.onReadFailure?.(file.id, \"unavailable\");\n      }\n    }\n  };\n  await Promise.all(\n    Array.from({ length: Math.min(8, selected.length) }, async () => await worker()),\n  );\n  return attachments.filter(\n    (attachment): attachment is ModelAttachmentContent => attachment !== undefined,\n  );\n}\n\nfunction attachmentRefsFromItem(item: Record<string, unknown>): FileResourceRef[] {\n  const raw = item[MODEL_ATTACHMENT_REFS_FIELD];\n  if (!Array.isArray(raw)) return [];\n  const refs: FileResourceRef[] = [];\n  for (const candidate of raw) {\n    const parsed = FileResourceRef.safeParse(candidate);\n    if (parsed.success) refs.push(parsed.data);\n  }\n  return refs;\n}\n\nfunction attachmentReceiptText(ref: FileResourceRef): string {\n  // The durable reference is immutable; live metadata must not rewrite old\n  // receipt text. Pixel delivery remains subject to current file authority.\n  return (\n    `[Attachment: fileId=${ref.fileId}; mountDirectory=${resourceMountPath(ref)}. ` +\n    `Use the existing file there, or call files__files_get_download_url with this fileId and ` +\n    `download it with the shell.]`\n  );\n}\n\n/** Receipt for an active reference that this turn's file-authority lookup did\n * not return: another participant's file, or one that is no longer available\n * (not ready, purged, or access revoked). The lookup cannot tell these apart,\n * so the text stays neutral. The authority boundary is unchanged: no bytes and\n * no fetch instruction, which would fail and lead the model to report the file\n * as deleted. */\nfunction unavailableAttachmentReceiptText(ref: FileResourceRef): string {\n  return requesterUnavailableReceiptText(`Attachment: fileId=${ref.fileId}`, \"file\");\n}\n\n/** The image bound stamped on a message when it was accepted, if any. */\nfunction attachmentImageBound(item: Record<string, unknown>): number | undefined {\n  const raw = item[MODEL_ATTACHMENT_IMAGE_MAX_DIMENSION_FIELD];\n  return typeof raw === \"number\" && Number.isSafeInteger(raw) && raw >= 64 && raw <= 8192\n    ? raw\n    : undefined;\n}\n\n// Process-wide, so a long conversation does not re-encode the same photos on\n// every turn. The projection depends only on the image bytes and the bound.\nconst boundedImageSizers = new Map<number, ReturnType<typeof createModelImageSizer>>();\n\ntype BoundedAttachmentImage = { image: string; note: string };\n\n/**\n * The model-facing rendition of one image under the bound its message was\n * stamped with. Smaller images keep their original bytes. The file in the\n * sandbox and in storage stays at full resolution.\n */\nasync function boundedAttachmentImage(\n  attachment: ModelAttachmentContent,\n  bound: number,\n): Promise<BoundedAttachmentImage> {\n  const original = { image: attachment.dataUrl, note: \"\" };\n  const comma = attachment.dataUrl.indexOf(\",\");\n  if (comma < 0) return original;\n  const data = attachment.dataUrl.slice(comma + 1);\n  let sizer = boundedImageSizers.get(bound);\n  if (!sizer) {\n    sizer = createModelImageSizer(bound, 10 * 1024 * 1024, { jpegQuality: 85 });\n    boundedImageSizers.set(bound, sizer);\n  }\n  try {\n    const sized = await sizer(data, attachment.contentType);\n    if (sized.data === data && sized.mediaType === attachment.contentType) return original;\n    return {\n      image: `data:${sized.mediaType};base64,${sized.data}`,\n      note:\n        ` Shown to you downscaled to ${sized.width}x${sized.height} from ` +\n        `${sized.originalWidth}x${sized.originalHeight}; the file itself is full resolution.`,\n    };\n  } catch (error) {\n    // Decoding is deterministic: an image that cannot be resized here keeps\n    // the original projection on every turn rather than being dropped.\n    console.error(\"model attachment image could not be resized; sending original\", {\n      fileId: attachment.fileId,\n      errorType: safeErrorType(error),\n    });\n    return original;\n  }\n}\n\n/**\n * Build one turn-scoped durable-attachment projector. Resolve active refs under\n * current file authority and memoize metadata/bytes for retries and compaction.\n * A turn boundary never changes an authorized attachment's representation.\n * Images of a message stamped with an image bound are shown downscaled to fit\n * it; unstamped (older) messages keep their full-resolution projection.\n */\nexport function createModelHistoryAttachmentProjector(\n  policy: ModelAttachmentInputPolicy,\n  readFileBytes?: (file: FileAsset) => Promise<Uint8Array>,\n  loadAuthorizedFiles?: (fileIds: readonly string[]) => Promise<readonly FileAsset[]>,\n): ModelHistoryAttachmentProjector {\n  const contentById = new Map<string, ModelAttachmentContent>();\n  const attemptedContentIds = new Set<string>();\n  const fileById = new Map<string, FileAsset>();\n  const resolvedFileIds = new Set<string>();\n  const retainedByteSizes = new Map<string, number>();\n  const boundedById = new Map<string, BoundedAttachmentImage>();\n\n  return async (items, options = {}) => {\n    for (const file of options.inlineFiles ?? []) {\n      fileById.set(file.id, file);\n      resolvedFileIds.add(file.id);\n    }\n    const refsByIndex = new Map<number, FileResourceRef[]>();\n    const orderedFileIds: string[] = [];\n    const seenFileIds = new Set<string>();\n    for (let index = 0; index < items.length; index += 1) {\n      const refs = attachmentRefsFromItem(items[index]!);\n      if (refs.length === 0) continue;\n      refsByIndex.set(index, refs);\n      for (const ref of refs) {\n        if (items[index]![MODEL_ATTACHMENT_CATALOG_MARKER] === true || seenFileIds.has(ref.fileId))\n          continue;\n        seenFileIds.add(ref.fileId);\n        orderedFileIds.push(ref.fileId);\n      }\n    }\n    if (refsByIndex.size === 0) return items;\n    const unresolved = orderedFileIds.filter((id) => !resolvedFileIds.has(id));\n    if (loadAuthorizedFiles && unresolved.length > 0) {\n      const files = await loadAuthorizedFiles(unresolved);\n      for (const file of files) fileById.set(file.id, file);\n      for (const id of unresolved) resolvedFileIds.add(id);\n    }\n\n    if (readFileBytes) {\n      const admitted = new Map(retainedByteSizes);\n      let requestImageBytes = 0;\n      for (const [index, refs] of refsByIndex) {\n        if (items[index]![MODEL_ATTACHMENT_CATALOG_MARKER] === true) continue;\n        for (const ref of refs) {\n          const file = fileById.get(ref.fileId);\n          if (\n            !file ||\n            !policy.supportsImageInput ||\n            file.status !== \"ready\" ||\n            file.sizeBytes > MAX_INLINE_MODEL_ATTACHMENT_BYTES ||\n            modelAttachmentDescriptor(file.contentType)?.kind !== \"image\" ||\n            !/^[a-f0-9]{64}$/i.test(file.sha256?.trim() ?? \"\")\n          )\n            continue;\n          // Repeated references share cached bytes but repeat in the wire body.\n          requestImageBytes += file.sizeBytes;\n          admitted.set(file.id, file.sizeBytes);\n        }\n      }\n      const turnImageBytes = [...admitted.values()].reduce((sum, bytes) => sum + bytes, 0);\n      if (\n        requestImageBytes > MAX_RETAINED_MODEL_ATTACHMENT_BYTES ||\n        turnImageBytes > MAX_RETAINED_MODEL_ATTACHMENT_BYTES\n      ) {\n        throw new RetainedAttachmentTransportLimitError();\n      }\n      for (const [id, bytes] of admitted) retainedByteSizes.set(id, bytes);\n      // Every active attachment uses the same authorized projection. Metadata\n      // and bytes are resolved once per turn, including compaction and retries.\n      const readable = [...orderedFileIds]\n        .reverse()\n        .map((id) => fileById.get(id))\n        .filter((file): file is FileAsset => {\n          if (!file || attemptedContentIds.has(file.id)) return false;\n          const descriptor = modelAttachmentDescriptor(file.contentType);\n          return Boolean(descriptor && descriptor.kind === \"image\" && policy.supportsImageInput);\n        });\n      for (const file of readable) attemptedContentIds.add(file.id);\n      const readFailures = new Map<string, ModelAttachmentReadFailure>();\n      const content = await modelAttachmentContentForFiles(readable, readFileBytes, {\n        retainAll: true,\n        onReadFailure: (fileId, failure) => readFailures.set(fileId, failure),\n      });\n      const loadedIds = new Set(content.map((entry) => entry.fileId));\n      const missing = readable.filter(\n        (file) =>\n          file.status === \"ready\" &&\n          file.sizeBytes <= MAX_INLINE_MODEL_ATTACHMENT_BYTES &&\n          /^[a-f0-9]{64}$/i.test(file.sha256 ?? \"\") &&\n          !loadedIds.has(file.id),\n      );\n      if (missing.length > 0) {\n        // Do not let a retry silently proceed with pixels removed.\n        for (const candidate of readable) attemptedContentIds.delete(candidate.id);\n        const corrupt = missing.find((file) => readFailures.get(file.id) === \"integrity_mismatch\");\n        if (corrupt) {\n          throw new Error(`Retained attachment bytes unavailable or invalid: ${corrupt.id}`);\n        }\n        throw new RetainedAttachmentUnavailableError(missing.map((file) => file.id));\n      }\n      for (const attachment of content) contentById.set(attachment.fileId, attachment);\n    }\n\n    for (const [index, refs] of refsByIndex) {\n      const item = items[index]!;\n      if (item[MODEL_ATTACHMENT_CATALOG_MARKER] === true) continue;\n      const bound = attachmentImageBound(item);\n      if (bound === undefined) continue;\n      for (const ref of refs) {\n        const attachment = fileById.has(ref.fileId) ? contentById.get(ref.fileId) : undefined;\n        const key = `${bound}:${ref.fileId}`;\n        if (!attachment || attachment.kind !== \"image\" || boundedById.has(key)) continue;\n        boundedById.set(key, await boundedAttachmentImage(attachment, bound));\n      }\n    }\n\n    const projected = [...items];\n    for (const [index, refs] of refsByIndex) {\n      const original = items[index]!;\n      if (original[MODEL_ATTACHMENT_CATALOG_RENDERED_FIELD] === true) {\n        // Its complete, dated text was frozen when compaction created it.\n        const clone: Record<string, unknown> = { ...original };\n        delete clone[MODEL_ATTACHMENT_REFS_FIELD];\n        projected[index] = clone;\n        continue;\n      }\n      const existingContent = Array.isArray(original.content)\n        ? [...original.content]\n        : [{ type: \"input_text\", text: String(original.content ?? \"\") }];\n      const attachmentParts = refs.flatMap((ref) => {\n        const catalog = original[MODEL_ATTACHMENT_CATALOG_MARKER] === true;\n        const currentFile = catalog ? undefined : fileById.get(ref.fileId);\n        // Only an authority lookup that actually ran can exclude a reference.\n        // Legacy callers without a resolver and compacted catalogs, which never\n        // look up authority, keep the reference-only receipt.\n        const excluded =\n          !catalog &&\n          loadAuthorizedFiles !== undefined &&\n          resolvedFileIds.has(ref.fileId) &&\n          currentFile === undefined;\n        const attachment = currentFile ? contentById.get(ref.fileId) : undefined;\n        if (!attachment || attachment.kind !== \"image\") {\n          return [\n            {\n              type: \"input_text\",\n              text: excluded ? unavailableAttachmentReceiptText(ref) : attachmentReceiptText(ref),\n            },\n          ];\n        }\n        const bound = attachmentImageBound(original);\n        const bounded = bound === undefined ? undefined : boundedById.get(`${bound}:${ref.fileId}`);\n        return [\n          { type: \"input_text\", text: attachmentReceiptText(ref) + (bounded?.note ?? \"\") },\n          { type: \"input_image\", image: bounded?.image ?? attachment.dataUrl },\n        ];\n      });\n      const clone: Record<string, unknown> = {\n        ...original,\n        content: [...existingContent, ...attachmentParts],\n      };\n      delete clone[MODEL_ATTACHMENT_REFS_FIELD];\n      projected[index] = clone;\n    }\n    return projected;\n  };\n}\n\n/** Add current trigger refs only when older/local history predates durable stamping. */\nexport function withCurrentUserAttachmentRefs(\n  historyItems: Array<Record<string, unknown>>,\n  refs: FileResourceRef[],\n): Array<Record<string, unknown>> {\n  if (refs.length === 0) return historyItems;\n  // Compaction can put a catalog after the triggering user message. A ref\n  // already retained anywhere in canonical history must not be copied onto\n  // that older catalog (and then disappear when the next turn replays it).\n  const retainedIds = new Set(\n    historyItems.flatMap((item) => attachmentRefsFromItem(item).map((ref) => ref.fileId)),\n  );\n  const missing = refs.filter((ref) => !retainedIds.has(ref.fileId));\n  if (missing.length === 0) return historyItems;\n  for (let index = historyItems.length - 1; index >= 0; index -= 1) {\n    const item = historyItems[index]!;\n    if (item[MODEL_ATTACHMENT_CATALOG_MARKER] === true) continue;\n    if (item.type !== \"message\" || item.role !== \"user\") continue;\n    const existing = attachmentRefsFromItem(item);\n    const existingIds = new Set(existing.map((ref) => ref.fileId));\n    const additions = missing.filter((ref) => !existingIds.has(ref.fileId));\n    if (additions.length === 0) return historyItems;\n    const projected = [...historyItems];\n    projected[index] = { ...item, [MODEL_ATTACHMENT_REFS_FIELD]: [...existing, ...additions] };\n    return projected;\n  }\n  return historyItems;\n}\n\nexport async function turnInput(\n  db: Database,\n  runtime: OpenGeniRuntime,\n  agent: any,\n  trigger: Awaited<ReturnType<typeof getSessionEvent>>,\n  options: TurnInputOptions,\n): Promise<PreparedTurnInput> {\n  if (!trigger) {\n    throw new Error(\"Missing trigger event\");\n  }\n  const updates = await measureHistoryPreparationPhase(\n    options,\n    \"system_update_load\",\n    async () =>\n      await listSessionSystemUpdatesForTurn(\n        db,\n        trigger.workspaceId,\n        trigger.sessionId,\n        options.turnId,\n      ),\n  );\n  // A logical turn can receive another atomic batch when an interrupted\n  // attempt resumes. Every update must retain its durable receipt, but the\n  // turn-wide query legitimately spans multiple history items. Canonical\n  // history owns their ordering and exactly-once inclusion below.\n  if (updates.some((update) => !update.deliveredHistoryItemId)) {\n    throw new Error(\"Delivered internal update has no durable model-memory batch\");\n  }\n  const internalContext = joinInternalContext(\n    options.recovering\n      ? [\n          \"[Opengeni inference recovery]\",\n          \"Continue the same inference from durable conversation and sandbox state. A previous execution stopped before it could finish. Do not repeat completed side effects; inspect actual state when uncertain.\",\n        ].join(\"\\n\")\n      : undefined,\n    options.unavailableSandboxFilesNote,\n    options.runCredentialsNote,\n    options.mcpAvailabilityNote,\n    options.codemodeContinuationNote,\n    options.knowledgeSourcePreparationNote,\n  );\n  if (trigger.type === \"user.message\") {\n    const payload = trigger.payload as {\n      text?: unknown;\n      annotations?: unknown;\n      resources?: unknown;\n    };\n    const hasAnnotations = Array.isArray(payload.annotations) && payload.annotations.length > 0;\n    if (typeof payload.text !== \"string\" || (payload.text.trim().length === 0 && !hasAnnotations)) {\n      throw new Error(\"user.message payload is missing text and annotations\");\n    }\n    const resources = Array.isArray(payload.resources) ? (payload.resources as ResourceRef[]) : [];\n    const fileAttachments = await measureHistoryPreparationPhase(\n      options,\n      \"current_attachment_resolution\",\n      async () =>\n        await resolveUserMessageFileAttachments(\n          db,\n          options.fileAuthority.accountId,\n          trigger.workspaceId,\n          options.fileAuthority.subjectId,\n          resources,\n        ),\n    );\n    const attachmentContext = userMessageAttachmentsContext(fileAttachments);\n    return await messageInput(\n      db,\n      runtime,\n      agent,\n      trigger,\n      undefined,\n      joinInternalContext(internalContext, attachmentContext),\n      fileAttachments,\n      options.providerApi,\n      options.projectCanonicalHistory,\n      options.materializeModelHistory,\n      options.projectModelHistory,\n      options.loadActiveHistory,\n      options,\n    );\n  }\n  // Maintenance has no user message or delivered-update batch. It still needs\n  // the ordinary history/projection path so SDK preparation can capture the\n  // same model request prefix before the queued compaction stops inference.\n  if (\n    trigger.type === \"system.update.delivered\" ||\n    trigger.type === \"session.context.compaction.requested\"\n  ) {\n    if (trigger.type === \"system.update.delivered\" && updates.length === 0) {\n      throw new Error(\"Internal update inference has no delivered updates\");\n    }\n    return await messageInput(\n      db,\n      runtime,\n      agent,\n      trigger,\n      undefined,\n      internalContext,\n      [],\n      options.providerApi,\n      options.projectCanonicalHistory,\n      options.materializeModelHistory,\n      options.projectModelHistory,\n      options.loadActiveHistory,\n      options,\n    );\n  }\n  if (trigger.type === \"user.approvalDecision\" || trigger.type === \"user.humanInputResponse\") {\n    return await openSuffixMessageInput(db, runtime, agent, trigger, internalContext, options);\n  }\n  throw new Error(`Unsupported trigger event type: ${trigger.type}`);\n}\n\nfunction joinInternalContext(...parts: Array<string | undefined>): string | undefined {\n  const content = parts.map((part) => part?.trim()).filter((part): part is string => Boolean(part));\n  return content.length > 0 ? content.join(\"\\n\\n\") : undefined;\n}\n\nasync function openSuffixMessageInput(\n  db: Database,\n  runtime: OpenGeniRuntime,\n  agent: any,\n  trigger: NonNullable<Awaited<ReturnType<typeof getSessionEvent>>>,\n  internalContext: string | undefined,\n  options: TurnInputOptions,\n): Promise<PreparedTurnInput> {\n  const suffixRows = await listTurnOpenSuffixToolCalls(\n    db,\n    trigger.workspaceId,\n    trigger.sessionId,\n    options.turnId,\n  );\n  if (suffixRows.length === 0 && !options.programmaticApprovalAcknowledged) {\n    throw new Error(\"Open suffix resume has no interruption rows\");\n  }\n  if (suffixRows.some((row) => row.resultItem == null)) {\n    throw new Error(\"Open suffix resume still has unresolved members\");\n  }\n  return await messageInput(\n    db,\n    runtime,\n    agent,\n    trigger,\n    undefined,\n    internalContext,\n    [],\n    options.providerApi,\n    options.projectCanonicalHistory,\n    options.materializeModelHistory,\n    options.projectModelHistory,\n    options.loadActiveHistory,\n    options,\n  );\n}\n\n/** Build one inference from canonical history plus attempt-local operational context. */\nasync function messageInput(\n  db: Database,\n  runtime: OpenGeniRuntime,\n  agent: any,\n  trigger: NonNullable<Awaited<ReturnType<typeof getSessionEvent>>>,\n  text: string | undefined,\n  internalContext: string | undefined,\n  currentAttachments: UserMessageFileAttachment[] = [],\n  providerApi: HistoryProviderApi = \"responses\",\n  projectCanonicalHistory?: ModelHistoryAttachmentProjector,\n  materializeModelHistory?: ModelHistoryAttachmentProjector,\n  projectModelHistory?: ModelHistoryAttachmentProjector,\n  loadActiveHistory: typeof getActiveSessionHistoryItemsPaged = getActiveSessionHistoryItemsPaged,\n  preparationOptions: Pick<TurnInputOptions, \"onPreparationPhase\" | \"servingProviderId\"> = {},\n): Promise<PreparedTurnInput> {\n  const currentAttachmentRefs = currentAttachments.map((attachment) => attachment.resource);\n  const [stored, envelope] = await Promise.all([\n    measureHistoryPreparationPhase(preparationOptions, \"durable_history_load\", async () =>\n      loadActiveHistory(db, trigger.workspaceId, trigger.sessionId),\n    ),\n    measureHistoryPreparationPhase(preparationOptions, \"sandbox_envelope_load\", async () =>\n      getSandboxSessionEnvelope(db, trigger.workspaceId, trigger.sessionId),\n    ),\n  ]);\n  const canonicalView = await measureHistoryPreparationPhase(\n    preparationOptions,\n    \"canonical_projection\",\n    async () => {\n      const provenance = preparationOptions.servingProviderId\n        ? await readSubscriptionHistoryProvenance(\n            db,\n            trigger.workspaceId,\n            trigger.sessionId,\n            stored.map((row) => row.id),\n          )\n        : null;\n      const active =\n        provenance && preparationOptions.servingProviderId\n          ? projectServingProviderArtifacts(\n              stored.map((row) => ({\n                ...row,\n                turnId: provenance.turnByHistoryId.get(row.id) ?? null,\n              })),\n              {\n                enabled: true,\n                servingProviderId: preparationOptions.servingProviderId,\n                turnMetadata: provenance.turnMetadata,\n              },\n            )\n          : projectRejectedProviderArtifacts(stored);\n      return projectCanonicalHistory ? await projectCanonicalHistory(active) : active;\n    },\n  );\n  const providerView = await measureHistoryPreparationPhase(\n    preparationOptions,\n    \"provider_projection\",\n    () => projectHistoryForProvider(canonicalView, providerApi),\n  );\n  const referencedHistory = await measureHistoryPreparationPhase(\n    preparationOptions,\n    \"attachment_ref_projection\",\n    () => withCurrentUserAttachmentRefs(providerView, currentAttachmentRefs),\n  );\n  const materializedHistory = await measureHistoryPreparationPhase(\n    preparationOptions,\n    \"screenshot_materialization\",\n    async () =>\n      materializeModelHistory\n        ? await materializeModelHistory(referencedHistory)\n        : referencedHistory,\n  );\n  const historyItems = await measureHistoryPreparationPhase(\n    preparationOptions,\n    \"model_attachment_projection\",\n    async () =>\n      projectModelHistory\n        ? await projectModelHistory(materializedHistory, {\n            inlineFiles: currentAttachments.map((attachment) => attachment.file),\n          })\n        : materializedHistory,\n  );\n  const prepared = await measureHistoryPreparationPhase(\n    preparationOptions,\n    \"runtime_input_assembly\",\n    async () =>\n      await runtime.prepareInput(agent, {\n        kind: \"message\",\n        ...(text ? { text } : {}),\n        ...(internalContext ? { internalContext } : {}),\n        historyItems: historyItems as any,\n        sandboxEnvelope: envelope,\n        ...(projectModelHistory ? { modelInputAlreadyProjected: true } : {}),\n      }),\n  );\n  const providerArtifactCandidates = await measureHistoryPreparationPhase(\n    preparationOptions,\n    \"artifact_candidate_scan\",\n    () => {\n      const preparedItems = Array.isArray(prepared.input)\n        ? new Set(prepared.input)\n        : new Set<unknown>();\n      return {\n        knownHistoryItemIds: stored.map((row) => row.id),\n        historyItemIds: stored\n          .filter(\n            (row) =>\n              row.providerArtifactInvalidatedAt === null &&\n              hasOpaqueProviderArtifact(row.item) &&\n              preparedItems.has(row.item),\n          )\n          .map((row) => row.id),\n      };\n    },\n  );\n  return {\n    input: prepared,\n    persistedHistoryCount: prepared.persistedHistoryCount,\n    providerArtifactCandidates,\n  };\n}\n\nexport async function userMessageTextWithAttachments(\n  db: Database,\n  accountId: string,\n  workspaceId: string,\n  subjectId: string | null,\n  text: string,\n  resources: ResourceRef[],\n): Promise<string> {\n  const fileAttachments = await resolveUserMessageFileAttachments(\n    db,\n    accountId,\n    workspaceId,\n    subjectId,\n    resources,\n  );\n  const attachmentContext = userMessageAttachmentsContext(fileAttachments);\n  return attachmentContext ? [text, \"\", attachmentContext].join(\"\\n\") : text;\n}\n\ntype UserMessageFileAttachment = {\n  resource: Extract<ResourceRef, { kind: \"file\" }>;\n  file: FileAsset;\n};\n\nasync function resolveUserMessageFileAttachments(\n  db: Database,\n  accountId: string,\n  workspaceId: string,\n  subjectId: string | null,\n  resources: ResourceRef[],\n): Promise<UserMessageFileAttachment[]> {\n  const fileResources = resources.filter(\n    (resource): resource is FileResourceRef => resource.kind === \"file\",\n  );\n  if (fileResources.length === 0) return [];\n  const files = await getFilesForSubject(db, {\n    accountId,\n    workspaceId,\n    subjectId,\n    fileIds: fileResources.map((resource) => resource.fileId),\n  });\n  const fileById = new Map(files.map((file) => [file.id, file]));\n  return fileResources.map((resource) => {\n    const file = fileById.get(resource.fileId);\n    if (!file) throw new Error(`File not found: ${resource.fileId}`);\n    return { resource, file };\n  });\n}\n\nfunction userMessageAttachmentsContext(\n  attachments: UserMessageFileAttachment[],\n): string | undefined {\n  const attachedFiles = attachments.map(\n    ({ resource, file }) =>\n      `- ${file.filename} (${file.contentType}, ${file.sizeBytes} bytes): ${sandboxFilePath(resource, file)}`,\n  );\n  if (attachedFiles.length === 0) {\n    return undefined;\n  }\n  return [\"Attached files are available in the sandbox:\", ...attachedFiles].join(\"\\n\");\n}\n\nfunction sandboxFilePath(\n  resource: Extract<ResourceRef, { kind: \"file\" }>,\n  file: FileAsset,\n): string {\n  return `${resourceMountPath(resource)}/${file.safeFilename}`;\n}\n","/**\n * Neutral model-facing text for history media the current requester's file\n * authority excludes, for example another participant's private file in a\n * shared session. Authority exclusion and real unavailability stay\n * indistinguishable, and there is no fetch instruction that would fail and\n * lead the model to report the file as deleted.\n */\nexport function requesterUnavailableReceiptText(subject: string, noun: \"file\" | \"image\"): string {\n  return (\n    `[${subject}. This ${noun} is not available to the current requester: ` +\n    `it may belong to another participant, or it may no longer be available. ` +\n    `Its contents are not included and it cannot be downloaded in this turn; do not guess which.]`\n  );\n}\n","// ChatGPT plan entitlement for Codex-billed turns.\n//\n// A connected ChatGPT account can move to a plan that no longer includes the\n// requested model (production: Pro to Free, then every request answered with\n// an empty HTTP 400). This module turns that evidence into a typed decision:\n// re-check the account's current plan, and either exclude that credential for\n// this model and let the normal failover protocol move the SAME turn, or fail\n// with a typed, plain-language payload. It never retries the request itself.\n\nimport { productLabelForModelId } from \"@opengeni/config\";\nimport {\n  codexPlanDisplayName,\n  codexPlanEntitlementLost,\n  codexPlanIsUpgrade,\n  codexPlanKey,\n  type CodexEntitlementRejection,\n} from \"@opengeni/codex\";\nimport {\n  codexPlanExcludesModel,\n  codexPlanPreviouslyExcludedModel,\n  connectionModelAllowed,\n  type CodexCredentialPlanRecheck,\n  type CodexPlanEntitlementExclusion,\n} from \"@opengeni/db\";\n\nexport const CODEX_PLAN_ENTITLEMENT_CODE = \"codex_plan_entitlement\";\nexport const CODEX_REQUEST_REJECTED_CODE = \"codex_request_rejected\";\n\nexport type CodexPlanEntitlementFailurePayload = {\n  error: string;\n  code: typeof CODEX_PLAN_ENTITLEMENT_CODE;\n  retryable: false;\n  planType: string | null;\n  model: string | null;\n  detail?: string;\n};\n\nexport type CodexRequestRejectedFailurePayload = {\n  error: string;\n  code: typeof CODEX_REQUEST_REJECTED_CODE;\n  retryable: false;\n  planType: string | null;\n  detail?: string;\n};\n\n/**\n * The user-set label of one connected ChatGPT account. The account email is\n * deliberately never used: this text lands in the durable `turn.failed` event\n * that every session reader (including embedding-host end users) can see, and\n * an inherited organization credential's email may be a member's personal\n * address. Without a label the copy says \"The connected ChatGPT account\".\n */\nexport function codexAccountDisplayLabel(\n  account: { label: string | null } | null | undefined,\n): string | null {\n  const label = account?.label?.trim() || null;\n  return label ? label.slice(0, 120) : null;\n}\n\nfunction accountPhrase(accountLabel: string | null): string {\n  return accountLabel ? `The ChatGPT account \"${accountLabel}\"` : \"The connected ChatGPT account\";\n}\n\nfunction rejectionDetail(rejection: CodexEntitlementRejection | null): string | undefined {\n  if (!rejection) return undefined;\n  return rejection.evidence === \"empty_body\"\n    ? `The Codex backend answered HTTP ${rejection.status} with no error body.`\n    : `The Codex backend refused the model for this plan (HTTP ${rejection.status}).`;\n}\n\n/** Terminal copy when the serving account's plan does not include the model. */\nexport function codexPlanEntitlementFailurePayload(input: {\n  accountLabel: string | null;\n  planType: string | null;\n  planChanged: boolean;\n  modelId: string | null;\n  rejection?: CodexEntitlementRejection | null;\n  /** The same turn waits for another connected account instead of failing. */\n  waiting?: boolean;\n}): CodexPlanEntitlementFailurePayload {\n  const plan = codexPlanDisplayName(input.planType);\n  const model = input.modelId ? productLabelForModelId(input.modelId) : \"this model\";\n  const lead = accountPhrase(input.accountLabel);\n  const next = input.waiting\n    ? \"Opengeni is waiting for another connected account to become available.\"\n    : \"Upgrade it, use another connected account, or choose another model.\";\n  const error = plan\n    ? `${lead} ${input.planChanged ? \"is now\" : \"is\"} on the ${plan} plan, which doesn't include ${model}. ${next}`\n    : `${lead} no longer has access to ${model} on its current plan. ${next}`;\n  const detail = rejectionDetail(input.rejection ?? null);\n  return {\n    error,\n    code: CODEX_PLAN_ENTITLEMENT_CODE,\n    retryable: false,\n    planType: plan ? codexPlanKey(input.planType) : null,\n    model: input.modelId,\n    ...(detail ? { detail } : {}),\n  };\n}\n\n/**\n * Terminal copy for an empty Codex rejection. With `planChecked`, the account's\n * plan was re-read and did not explain it, so Opengeni kept the account.\n */\nexport function codexRequestRejectedFailurePayload(input: {\n  accountLabel: string | null;\n  planType: string | null;\n  rejection: CodexEntitlementRejection;\n  planChecked?: boolean;\n}): CodexRequestRejectedFailurePayload {\n  const plan = codexPlanDisplayName(input.planType);\n  const lead = accountPhrase(input.accountLabel);\n  const planClause =\n    input.planChecked === false\n      ? \"\"\n      : plan\n        ? `${lead} still reports the ${plan} plan, so Opengeni did not switch accounts. `\n        : `Opengeni could not confirm the current plan of ${lead.charAt(0).toLowerCase()}${lead.slice(1)}, so it did not switch accounts. `;\n  return {\n    error:\n      `The Codex backend rejected this request (HTTP ${input.rejection.status}) without an error message. ` +\n      `${planClause}Try again, or choose another model if it keeps failing.`,\n    code: CODEX_REQUEST_REJECTED_CODE,\n    retryable: false,\n    planType: plan ? codexPlanKey(input.planType) : null,\n    ...(rejectionDetail(input.rejection) ? { detail: rejectionDetail(input.rejection)! } : {}),\n  };\n}\n\n/**\n * Admission-time refusal: the only accounts that could serve this turn were\n * already proven not to include its model on their current plan.\n */\nexport class CodexPlanEntitlementError extends Error {\n  readonly code = CODEX_PLAN_ENTITLEMENT_CODE;\n  constructor(readonly payload: CodexPlanEntitlementFailurePayload) {\n    super(payload.error);\n    this.name = \"CodexPlanEntitlementError\";\n  }\n}\n\nexport type CodexPlanEntitlementAssessment =\n  | {\n      kind: \"entitlement_lost\";\n      /**\n       * Plan the exclusion binds to: the freshly observed plan, or the\n       * recorded plan when the provider reported none.\n       */\n      planType: string | null;\n      /** The provider reported the current plan during this re-check. */\n      planObserved: boolean;\n      /** The observed plan was reached by a recorded (non-upgrade) plan change. */\n      planChanged: boolean;\n      credentialVersion: number | null;\n    }\n  | { kind: \"unexplained\"; planType: string | null };\n\n/** Pure decision over one plan re-check (see `codexPlanEntitlementLost`). */\nexport function assessCodexPlanEntitlement(\n  rejection: CodexEntitlementRejection,\n  recheck: CodexCredentialPlanRecheck,\n  modelId: string | null,\n): CodexPlanEntitlementAssessment {\n  const planObserved = recheck.planType !== null;\n  // The persisted change record, or (if that write did not land) the plan\n  // recorded just before this re-check when the fresh observation differs.\n  const planChangedFrom =\n    planObserved &&\n    recheck.previousPlanType !== null &&\n    codexPlanKey(recheck.previousPlanType) !== codexPlanKey(recheck.planType)\n      ? recheck.previousPlanType\n      : recheck.planChangedFrom;\n  const planChanged =\n    planObserved &&\n    planChangedFrom !== null &&\n    codexPlanKey(planChangedFrom) !== codexPlanKey(recheck.planType) &&\n    !codexPlanIsUpgrade(planChangedFrom, recheck.planType);\n  if (\n    codexPlanEntitlementLost({\n      evidence: rejection.evidence,\n      currentPlanType: recheck.planType,\n      planChangedFrom,\n      previouslyExcluded:\n        planObserved &&\n        codexPlanPreviouslyExcludedModel(\n          { planType: recheck.planType, planEntitlementExclusion: recheck.exclusion },\n          modelId,\n        ),\n    })\n  ) {\n    return {\n      kind: \"entitlement_lost\",\n      planType: planObserved ? recheck.planType : recheck.previousPlanType,\n      planObserved,\n      planChanged,\n      credentialVersion: recheck.credentialVersion,\n    };\n  }\n  return { kind: \"unexplained\", planType: recheck.planType };\n}\n\ntype AdmissionAccount = {\n  id: string;\n  label: string | null;\n  planType: string | null;\n  allocatorEnabled: boolean;\n  allowedModelIds?: string[] | null;\n  planEntitlementExclusion?: CodexPlanEntitlementExclusion | null;\n};\n\n/**\n * Pure admission check after credential selection found no account. Returns\n * the plan-excluded accounts that alone explain it, or null when capacity,\n * health, or policy (not plan entitlement) is the reason:\n *\n * - a manual pin (user intent) whose account's plan excludes the model;\n * - with rotation off, the active account's plan excludes the model;\n * - with rotation on, every allocatable account permitted for the model is\n *   plan-excluded.\n */\nexport function codexPlanEntitlementAdmissionBlock<T extends AdmissionAccount>(input: {\n  accounts: readonly T[];\n  modelId: string;\n  credentialId: string | null;\n  rotationEnabled: boolean;\n  activeCredentialId: string | null;\n  pinnedCredentialId: string | null;\n  pinSource: \"manual\" | \"policy\" | null;\n  now: Date;\n}): T[] | null {\n  if (input.credentialId !== null) return null;\n  const permitted = input.accounts.filter((account) =>\n    connectionModelAllowed(account.allowedModelIds, input.modelId),\n  );\n  const excluded = permitted.filter((account) =>\n    codexPlanExcludesModel(account, input.modelId, input.now),\n  );\n  if (excluded.length === 0) return null;\n  if (input.pinnedCredentialId && input.pinSource !== \"policy\") {\n    const pinned = excluded.find((account) => account.id === input.pinnedCredentialId);\n    return pinned ? [pinned] : null;\n  }\n  if (!input.rotationEnabled) {\n    const active = excluded.find((account) => account.id === input.activeCredentialId);\n    return active ? [active] : null;\n  }\n  const allocatable = permitted.filter((account) => account.allocatorEnabled);\n  const allocatableExcluded = allocatable.filter((account) =>\n    codexPlanExcludesModel(account, input.modelId, input.now),\n  );\n  return allocatable.length > 0 && allocatableExcluded.length === allocatable.length\n    ? allocatableExcluded\n    : null;\n}\n","import { CODEX_CREDENTIAL_LEASE_TTL_MS } from \"@opengeni/db\";\nimport {\n  subscriptionCapacityWaitReasonText,\n  subscriptionCapacityWaitNeedsAction,\n  type WaitReason,\n} from \"@opengeni/subscriptions\";\n\n/*\n * Failures of a chat turn on the shared subscription core, for any provider.\n * The codes are provider-neutral; the copy names the provider, and every\n * builder defaults to Codex, so Codex callers and texts are unchanged (M3\n * shipped these as Codex failures). Other providers pass their display name.\n */\n\n/** The provider name in failure copy when a caller passes none (M3's Codex texts). */\nconst DEFAULT_DISPLAY_NAME = \"Codex\";\n\n/** Typed, user-readable failure for a turn on the shared subscription core. */\nexport type SubscriptionCoreCodexFailurePayload = {\n  error: string;\n  code:\n    | \"subscription_capacity_unavailable\"\n    | \"subscription_lease_busy\"\n    | \"subscription_core_unsupported\"\n    | \"subscription_core_cutover_disabled\"\n    | \"subscription_account_refused\"\n    | \"subscription_failover_exhausted\";\n  retryable: boolean;\n  detail?: string;\n  /** Placement wait reason when `code` is `subscription_capacity_unavailable`. */\n  waitReason?: WaitReason;\n  /** Refusal class when `code` is `subscription_account_refused`. */\n  refusal?: SubscriptionCoreAccountRefusal;\n  /** ISO time the earliest known capacity returns, when placement knows it. */\n  resetsAt?: string;\n  /**\n   * Refusals this turn took, and the per-turn refusal bound, when `code` is\n   * `subscription_failover_exhausted` (refusals, not switches: the turn\n   * switched accounts `maxRefusals - 1` times before the last refusal).\n   */\n  refusals?: number;\n  maxRefusals?: number;\n  /** Combined model/provider changes and refusals, not a refusal count. */\n  failoverSteps?: number;\n  maxFailoverSteps?: number;\n};\n\n/** The provider-neutral name of the core turn failure payload. */\nexport type SubscriptionCoreFailurePayload = SubscriptionCoreCodexFailurePayload;\n\n/** A typed core turn failure (the class keeps its M3 name; it serves every provider). */\nexport class SubscriptionCoreCodexTurnError extends Error {\n  readonly code: SubscriptionCoreCodexFailurePayload[\"code\"];\n  /**\n   * The provider name its copy used. In-process only, never part of the\n   * payload, so a follow-up failure for the same turn (an exhausted lease-busy\n   * chain) names the same provider without the settlement naming providers.\n   */\n  readonly displayName: string;\n  constructor(\n    readonly payload: SubscriptionCoreCodexFailurePayload,\n    displayName: string = DEFAULT_DISPLAY_NAME,\n  ) {\n    super(payload.error);\n    this.name = \"SubscriptionCoreCodexTurnError\";\n    this.code = payload.code;\n    this.displayName = displayName;\n  }\n}\n\nconst WAIT_COPY = (name: string): Record<WaitReason, string> => ({\n  pinned_account_disabled: `The ${name} account pinned to this chat is turned off. Turn it back on, choose another account, or switch the chat to automatic. Waiting alone will not fix this.`,\n  pinned_account_unavailable: `The ${name} account chosen for this session is unavailable right now. Send a new message once it is available again, or switch the session back to automatic.`,\n  pinned_account_ineligible: `The ${name} account chosen for this session can no longer serve this work. Choose another account or switch the session back to automatic.`,\n  no_eligible_capacity: `No ${name} subscription has capacity for this turn right now. Send a new message once an account is available again.`,\n  model_not_allowed: `This model is not allowed for the ${name} subscriptions available here.`,\n  compaction_provider_locked:\n    \"This session is tied to a provider that has no capacity right now. Send a new message once an account is available again.\",\n  accepted_authority_unavailable:\n    \"This work was accepted before the account move and its account access could not be carried. Send it again.\",\n});\n\n/**\n * The `codex.capacity.waiting` payload for a turn parked on a core waiter\n * (M3 PR 2a): the legacy event shape with the core wait reason and the\n * earliest known reset.\n */\nexport function subscriptionCoreCapacityWaitPayload(\n  reason: WaitReason,\n  earliestResetAt: Date | null,\n  displayName: string = DEFAULT_DISPLAY_NAME,\n): Record<string, unknown> {\n  return {\n    error: subscriptionCapacityWaitReasonText(reason, displayName),\n    code: \"subscription_capacity_unavailable\",\n    waitReason: reason,\n    ...(subscriptionCapacityWaitNeedsAction(reason) ? { actionRequired: true } : {}),\n    ...(earliestResetAt ? { resetsAt: earliestResetAt.toISOString() } : {}),\n  };\n}\n\n/** The per-turn failover bound was reached; the session stays usable. */\nexport function subscriptionCoreFailoverExhaustedFailure(\n  refusals: number,\n  maxRefusals: number,\n  displayName: string = DEFAULT_DISPLAY_NAME,\n): SubscriptionCoreCodexTurnError {\n  return new SubscriptionCoreCodexTurnError(\n    {\n      error: `${displayName} accounts refused this turn too many times in a row. Send a new message after checking the accounts' health or capacity.`,\n      code: \"subscription_failover_exhausted\",\n      retryable: false,\n      refusals,\n      maxRefusals,\n    },\n    displayName,\n  );\n}\n\nexport function subscriptionCoreServingFailoverExhaustedFailure(\n  steps: number,\n  limit: number,\n): SubscriptionCoreCodexTurnError {\n  return new SubscriptionCoreCodexTurnError(\n    {\n      error:\n        \"Model accounts reached this turn's failover limit. Send a new message after checking the accounts' health or capacity.\",\n      code: \"subscription_failover_exhausted\",\n      retryable: false,\n      failoverSteps: steps,\n      maxFailoverSteps: limit,\n    },\n    \"Model account\",\n  );\n}\n\n/**\n * The capacity wait the core decided, as a typed terminal failure. PR 2a\n * parks waits on a durable core waiter instead; this remains for callers that\n * cannot wait.\n */\nexport function subscriptionCoreCapacityFailure(\n  reason: WaitReason,\n  earliestResetAt: Date | null,\n  displayName: string = DEFAULT_DISPLAY_NAME,\n): SubscriptionCoreCodexTurnError {\n  return new SubscriptionCoreCodexTurnError(\n    {\n      error: WAIT_COPY(displayName)[reason],\n      code: \"subscription_capacity_unavailable\",\n      retryable: false,\n      waitReason: reason,\n      ...(earliestResetAt ? { resetsAt: earliestResetAt.toISOString() } : {}),\n    },\n    displayName,\n  );\n}\n\n/**\n * An older attempt of this same turn still holds its lease until expiry, or\n * (`binding_conflict`) the session's account changed while this placement\n * was deciding. Both retry the same way; only the copy differs.\n */\nexport function subscriptionCoreLeaseBusyFailure(\n  leasedUntil: Date | null,\n  cause?: \"binding_conflict\",\n  displayName: string = DEFAULT_DISPLAY_NAME,\n): SubscriptionCoreCodexTurnError {\n  return new SubscriptionCoreCodexTurnError(\n    {\n      error:\n        cause === \"binding_conflict\"\n          ? `The session's ${displayName} account changed while this turn was starting. The turn will retry.`\n          : `A previous attempt of this turn still holds its ${displayName} account. The turn will retry once that hold ends.`,\n      code: \"subscription_lease_busy\",\n      retryable: true,\n      ...(leasedUntil ? { resetsAt: leasedUntil.toISOString() } : {}),\n    },\n    displayName,\n  );\n}\n\n/** Most extra delay added after the older lease's expiry, so retries spread out. */\nexport const SUBSCRIPTION_CORE_LEASE_BUSY_JITTER_MS = 5_000;\n\n/**\n * When a redispatched attempt should retry after finding an older attempt's\n * live lease: just after that lease expires (plus jitter), never later than\n * one lease TTL, and never sooner than one second.\n */\nexport function subscriptionCoreLeaseBusyDelayMs(\n  resetsAt: string | undefined,\n  now: number,\n  jitterSample: number,\n  ttlMs: number = CODEX_CREDENTIAL_LEASE_TTL_MS,\n): number {\n  const until = resetsAt ? Date.parse(resetsAt) : Number.NaN;\n  const remaining = Number.isFinite(until) ? Math.min(Math.max(until - now, 0), ttlMs) : ttlMs;\n  const jitter = Math.min(Math.max(jitterSample, 0), 1) * SUBSCRIPTION_CORE_LEASE_BUSY_JITTER_MS;\n  return Math.max(1_000, Math.ceil(remaining + jitter));\n}\n\n/**\n * How long one turn may keep finding an older attempt's live lease: about\n * three lease TTLs of wall-clock time since the first such recovery. Lease\n * renewal is not fenced on the turn's current attempt, so a superseded attempt\n * that keeps heartbeating would otherwise hold the turn forever.\n */\nexport const SUBSCRIPTION_CORE_LEASE_BUSY_MAX_MS = 3 * CODEX_CREDENTIAL_LEASE_TTL_MS;\n\n/**\n * The consecutive lease-busy chain after this attempt: it continues only when\n * the immediately previous execution generation recorded it. A stored start\n * in the future (clock skew or a bad write) is clamped to now so it can never\n * disable the bound.\n */\nexport function subscriptionCoreLeaseBusyChain(\n  stored: { startedAt: number; executionGeneration: number } | undefined,\n  executionGeneration: number,\n  now: number,\n): { startedAt: number; executionGeneration: number; exhausted: boolean } {\n  const startedAt =\n    stored && stored.executionGeneration === executionGeneration - 1\n      ? Math.min(stored.startedAt, now)\n      : now;\n  return {\n    startedAt,\n    executionGeneration,\n    exhausted: now - startedAt >= SUBSCRIPTION_CORE_LEASE_BUSY_MAX_MS,\n  };\n}\n\n/** The lease-busy chain lasted too long: stop with readable copy. */\nexport function subscriptionCoreLeaseBusyExhaustedFailure(\n  displayName: string = DEFAULT_DISPLAY_NAME,\n): SubscriptionCoreCodexTurnError {\n  return new SubscriptionCoreCodexTurnError(\n    {\n      error: `A previous attempt of this turn kept holding its ${displayName} account, so the turn stopped. Send a new message to try again.`,\n      code: \"subscription_lease_busy\",\n      retryable: false,\n    },\n    displayName,\n  );\n}\n\nexport type SubscriptionCoreAccountRefusal =\n  | \"sign_in\"\n  | \"forbidden\"\n  | \"entitlement\"\n  | \"access_lost\";\n\nconst REFUSAL_COPY = (name: string): Record<SubscriptionCoreAccountRefusal, string> => ({\n  sign_in: `The ${name} account serving this session needs a new sign-in. Reconnect it or choose another account, then send a new message.`,\n  forbidden: `The ${name} account serving this session refused this request. Check the account's access or choose another account, then send a new message.`,\n  entitlement: `The ${name} account serving this session cannot use this model on its current plan. Choose another model or account, then send a new message.`,\n  access_lost: `This session lost access to the ${name} account it was running on. Send a new message to continue on an account it can use.`,\n});\n\n/**\n * A definitive refusal from the leased account (revoked sign-in, 403, or a\n * plan that does not include the model). Health and quarantine of the\n * connection arrive with PR 2; until then the turn stops with readable copy\n * and the session stays usable.\n */\nexport function subscriptionCoreAccountRefusedFailure(\n  refusal: SubscriptionCoreAccountRefusal,\n  displayName: string = DEFAULT_DISPLAY_NAME,\n): SubscriptionCoreCodexTurnError {\n  return new SubscriptionCoreCodexTurnError(\n    {\n      error: REFUSAL_COPY(displayName)[refusal],\n      code: \"subscription_account_refused\",\n      retryable: false,\n      refusal,\n    },\n    displayName,\n  );\n}\n\n/** A Codex consumer that has not moved to the core yet (PR 2) must not read legacy tables. */\nexport function subscriptionCoreUnsupportedFailure(\n  consumer: string,\n  displayName: string = DEFAULT_DISPLAY_NAME,\n): SubscriptionCoreCodexTurnError {\n  return new SubscriptionCoreCodexTurnError(\n    {\n      error: `${consumer} is not available for ${displayName} subscriptions on this deployment yet.`,\n      code: \"subscription_core_unsupported\",\n      retryable: false,\n    },\n    displayName,\n  );\n}\n\n/** The organization's cutover row for the provider exists but is switched off. */\nexport function subscriptionCoreCutoverDisabledFailure(\n  displayName: string = DEFAULT_DISPLAY_NAME,\n): SubscriptionCoreCodexTurnError {\n  return new SubscriptionCoreCodexTurnError(\n    {\n      error: `${displayName} subscriptions are paused for this organization during maintenance.`,\n      code: \"subscription_core_cutover_disabled\",\n      retryable: false,\n    },\n    displayName,\n  );\n}\n","import type { Settings } from \"@opengeni/config\";\nimport type {\n  ConnectionCredentialsPort,\n  DocumentAuthorityKind,\n  EntitlementsPort,\n  KnowledgeSourceSyncRunSummary,\n  ScheduledTaskTriggerType,\n  TurnInitiator,\n} from \"@opengeni/contracts\";\nimport type {\n  Database,\n  SessionWorkflowWakeDeliveryResult,\n  SessionAdmissionFence,\n} from \"@opengeni/db\";\nimport type { DocumentServices } from \"@opengeni/documents\";\nimport type { EventBus } from \"@opengeni/events\";\nimport type { Observability } from \"@opengeni/observability\";\nimport type { OpenGeniRuntime } from \"@opengeni/runtime\";\nimport type { ObjectStorage } from \"@opengeni/storage\";\nimport type { VaultConnectionCredentialsPort } from \"@opengeni/vaults\";\nimport type {\n  ExternalVaultProviderFactories,\n  OnePasswordVaultProviderFactory,\n} from \"@opengeni/core\";\n\n// Signal (start-if-needed) a session's Temporal workflow so a queued turn it\n// cannot otherwise observe gets claimed. Used to wake a PARENT session's\n// workflow when a spawned worker completes: the parent may have idled and let\n// its workflow run complete, so a plain signal would not start one — this must\n// signalWithStart. Injected (not built from the worker's NativeConnection)\n// because the worker package owns only the worker runtime, not a client; an\n// missing signaler leaves the committed outbox revision for the global repair\n// sweep; production workers always inject this dependency.\nexport type WakeSessionWorkflowSignal = (input: {\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  workflowId: string;\n  wakeRevision: number;\n  interruptionRequested?: boolean;\n  /** Called after transport acceptance, before the fallible durable ACK. */\n  onSignalAccepted?: () => void;\n}) => Promise<SessionWorkflowWakeDeliveryResult | void>;\n\nexport type SignalCodexCapacityWorkflow = (input: {\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  workflowId: string;\n  wakeRevision: number;\n}) => Promise<void>;\n\n/** Start the versioned, per-box sandbox reaper from the history-stable legacy\n * activity. The legacy Schedule workflow must keep its exact historical\n * ScheduleActivity command across mixed-version worker pools. */\nexport type StartSandboxReaperWorkflow = () => Promise<\"started\" | \"already_running\">;\n\n/** Start-or-observe the one durable reconciler for a paid video operation. */\nexport type StartVideoGenerationWorkflow = (input: {\n  accountId: string;\n  workspaceId: string;\n  operationId: string;\n}) => Promise<\"started\" | \"already_running\">;\n\n/** Exact activity-owned proof that the hard sandbox/tool fence physically\n * drained. This is delivery evidence only: the workflow still validates the\n * persisted attempt dispatch and commits the authoritative Postgres receipt. */\nexport type SessionAttemptQuiescenceProof = {\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  attemptId: string;\n  workflowId: string;\n  workflowRunId: string;\n  activityId: string;\n};\n\nexport type SignalSessionAttemptQuiesced = (input: SessionAttemptQuiescenceProof) => Promise<void>;\n\nexport type InspectSessionAttemptActivity = (input: {\n  workflowId: string;\n  workflowRunId: string;\n  activityId: string;\n}) => Promise<\"pending\" | \"settled\">;\n\n/** Services shared by both Temporal worker roles. Keep this graph free of the\n * agent runtime and document parser so each process can load only its role. */\nexport type SharedActivityServices = {\n  settings: Settings;\n  /**\n   * Original environment/host settings retained across live database-catalog\n   * refreshes. Older embedded test hosts may omit it and fall back to settings.\n   */\n  catalogSourceSettings?: Settings;\n  db: Database;\n  bus: EventBus;\n  objectStorage: ObjectStorage | null;\n  observability: Observability;\n  wakeSessionWorkflow: WakeSessionWorkflowSignal | null;\n  /** Durable signalWithStart fallback used only after the activity's direct\n   * physical-quiescence receipt write exhausts its bounded DB retries. */\n  signalSessionAttemptQuiesced: SignalSessionAttemptQuiesced | null;\n  /** Server-authoritative Temporal activity lease inspection used only to\n   * recover a missing quiescence receipt after the original activity vanished. */\n  inspectSessionAttemptActivity: InspectSessionAttemptActivity | null;\n  /** Revision-carrying capacity nudge; generic outbox repair is also sufficient. */\n  signalCodexCapacityWorkflow?: SignalCodexCapacityWorkflow | null;\n  /** Production control workers inject this Temporal client edge. A null edge\n   * deliberately retains the composite implementation for embedded/test hosts. */\n  startSandboxReaperWorkflow?: StartSandboxReaperWorkflow | null;\n  startVideoGenerationWorkflow?: StartVideoGenerationWorkflow | null;\n  // §7.5 P3 — host-entitlements port, the WORKER half of the same seam the API\n  // edge exposes on `AppDependencies`. When set, `ensureRunAllowed` (turn-entry\n  // AND the mid-stream budget valve) delegates the funding decision to\n  // `admitRun` instead of reading `getBillingBalance` locally. null/undefined\n  // (standalone default) → today's local-ledger read runs unchanged.\n  //\n  // IDEMPOTENCY: the worker calls `admitRun` ONLY as an admission READ (\"may\n  // this run/continue?\"), never to RECORD consumption. Usage is recorded\n  // exactly once, by `recordUsageEvent` keyed on a deterministic idempotency\n  // key the API already wrote at create-time — so a host PULL meter that also\n  // observes that same recorded event is consulted without double-charging:\n  // admission and metering are separate operations, and only metering carries\n  // the idempotency key.\n  entitlements?: EntitlementsPort | null;\n  // §7.6 connection-credential provider — host connection-credential provider, the WORKER half of the\n  // federated-connection boundary. When set, the run's per-run credential mint\n  // delegates to the host instead of self-minting from `settings`:\n  //   - `gitCredentials` REPLACES `createGitHubAppInstallationToken(settings,…)`\n  //     in `sandboxEnvironmentForRun` (the GH_TOKEN / git-extraheader source).\n  //   - `vaultProvider` links a host-owned secret store as a `source: \"host\"`\n  //     vault (see `@opengeni/vaults` `VaultConnectionCredentialsPort`).\n  // Each leg is independently optional; an unset leg falls through to today's\n  // self-mint for THAT leg. null/undefined (standalone default) → every leg\n  // self-mints byte-for-byte as today.\n  //\n  // workspace-scope cross-check CROSS-CHECK: a provider echoes the `workspaceId` it scoped the\n  // credential to; the consuming activity ASSERTS agreement with the run's\n  // workspace BEFORE injecting `GH_TOKEN` (or applying decrypted values). A host\n  // mapping bug returning tenant B's creds for a tenant-A run is caught here.\n  connectionCredentials?: VaultConnectionCredentialsPort | null;\n  /**\n   * Builds 1Password providers for linked vaults (dynamic import of\n   * `@opengeni/vaults-onepassword`); null leaves 1Password vaults unavailable.\n   */\n  onePasswordVaultProvider?: OnePasswordVaultProviderFactory | null;\n  externalVaultProviders?: ExternalVaultProviderFactories | null;\n  /** Standalone, default-off personal GitHub smart-HTTP broker consumer. */\n  personalGitHubCredentials?: ConnectionCredentialsPort[\"gitCredentials\"] | null;\n};\n\n/** Control workers own short database and maintenance activities. Document\n * parsing is resolved lazily by the indexing activity itself. */\nexport type ControlActivityServices = SharedActivityServices;\n\n/** Turn workers own the model loop and never construct document parsers. */\nexport type TurnActivityServices = SharedActivityServices & {\n  /** Host-owned containment: stop polling and checkpoint peer turns before exit.\n   * Bare activity embedders must provide their own worker lifecycle edge. */\n  requestWorkerDrain: () => void;\n  /** Deterministic test clock for the cleanup-only monitor. */\n  turnFinalizationTimeoutMs?: number | undefined;\n  runtime: OpenGeniRuntime;\n  /** Provider-free test/profiling seam; production injects the real runtime summarizer. */\n  summarizeContextForCompaction: typeof import(\"@opengeni/runtime\").summarizeForCompaction;\n};\n\n/** Full test/embedded harness retained as a source-compatible superset. */\nexport type ActivityServices = ControlActivityServices &\n  TurnActivityServices & {\n    documentServices: DocumentServices;\n  };\n\nexport type CodexCapacityWaitRef = {\n  /** Absent only for Temporal histories written before provider-tagged waits. */\n  provider?: \"codex\" | \"xai\" | \"claude\";\n  waiterId: string;\n  generation: number;\n  nextCheckAt: string;\n  wakeRevision: number;\n};\n\nexport type XaiCapacityWaitRef = CodexCapacityWaitRef & { provider: \"xai\" };\n\nexport type GetCodexCapacityWaitInput = {\n  workspaceId: string;\n  sessionId: string;\n};\n\nexport type ReconcileCodexCapacityWaitInput = {\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  waiterId: string;\n  generation: number;\n  cause: \"timer\" | \"signal\" | \"queue\" | \"recovery\";\n  /** Absent only for Codex waits and pre-provider-tagged workflow histories. */\n  provider?: \"codex\" | \"xai\" | \"claude\";\n};\n\nexport type ReconcileCodexCapacityWaitResult =\n  | ({ action: \"waiting\" } & CodexCapacityWaitRef)\n  | { action: \"resumed\" | \"paused\" | \"superseded\" | \"stale\" };\n\nexport type ActivityDependencies = Partial<ActivityServices>;\nexport type ControlActivityDependencies = Partial<ControlActivityServices>;\nexport type TurnActivityDependencies = Partial<TurnActivityServices>;\n\nexport type RunAgentTurnInput = {\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  workflowId: string;\n  workflowRunId: string;\n  attemptId: string;\n  trigger: { kind: \"next\" } | { kind: \"approval\"; triggerEventId: string };\n};\n\nexport type VideoGenerationTerminalStatus =\n  | \"completed\"\n  | \"provider_failed\"\n  | \"cancelled_before_submit\"\n  | \"outcome_unknown\"\n  | \"retention_failed\";\n\nexport type VideoGenerationReconcileResult =\n  | { action: \"waiting\"; delayMs: number }\n  | { action: \"terminal\"; status: VideoGenerationTerminalStatus };\n\nexport type SettleSessionInterruptionsInput = {\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  attemptId: string;\n  workflowId: string;\n  /**\n   * Replay-only compatibility for session workflow histories created before\n   * the receipt-gated cancellation v2 patch. New histories never send this\n   * phase; the exact activity writes the authoritative receipt itself.\n   */\n  phase?: \"logical\" | \"attempt_quiesced\";\n};\n\nexport type PersistSessionAttemptQuiescenceInput = SessionAttemptQuiescenceProof;\n\nexport type ReconcileSessionAttemptQuiescenceInput = {\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  attemptId: string;\n  workflowId: string;\n};\n\nexport type ReconcileSessionAttemptQuiescenceResult = {\n  action: \"quiesced\" | \"pending\" | \"stale\";\n};\n\nexport type ReconcileSettledSessionAttemptInput = {\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  turnId: string;\n  attemptId: string;\n  executionGeneration: number;\n  workflowId: string;\n  workflowRunId: string;\n  activityId: string;\n};\n\nexport type ReconcileSettledSessionAttemptResult = {\n  action: \"recovering\" | \"exceeded\" | \"pending\" | \"stale\";\n};\n\nexport type FailSessionAttemptInput = {\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  attemptId: string;\n  /** Added in v2; old Temporal histories derive the session's canonical id. */\n  workflowId?: string;\n  /** Added in v2; old Temporal histories use the bounded 60-second floor. */\n  retryDelayMs?: number;\n  /** Added in v3. Upgraded turn workers classify failures from the atomic\n   * admission transaction; omission is a rolling-deploy/legacy unknown and\n   * deliberately keeps the recoverable wake behavior. */\n  preClaimFailureDisposition?: PreClaimFailureDisposition;\n  /** Added in v4. Retains the safe classified DB code so an ambiguously\n   * committed claim discovered by the control lane can recover the exact\n   * attempt instead of terminally failing it. */\n  preClaimFailure?: PreClaimFailureDetail;\n  admissionFence?: SessionAdmissionFence;\n  /** Added in v4. A claimed attempt that lost operational database access\n   * before turn-start completion carries its exact immutable turn identity so\n   * the DB-only control lane can recover it instead of terminally failing it. */\n  postClaimDatabaseRecovery?: PostClaimDatabaseRecoveryDetail;\n  /** The workflow admission trigger is required to re-evaluate the same\n   * durable admission branch before terminally settling a permanent failure. */\n  trigger?: RunAgentTurnInput[\"trigger\"];\n  error?: string;\n};\n\nexport type FailSessionAttemptResult =\n  | { action: \"blocked\" }\n  | { action: \"failed\" }\n  | { action: \"recovering\"; continueDelayMs?: number }\n  | { action: \"unclaimed\" }\n  | { action: \"terminal\" }\n  | { action: \"stale\" };\n\nexport type PreClaimFailureDisposition = \"retryable\" | \"permanent\" | \"blocked\";\n\nexport type PreClaimFailureDetail = {\n  disposition: PreClaimFailureDisposition;\n  code: \"db_deadlock\" | \"db_serialization_failure\" | \"db_failure\" | \"claim_invariant\";\n  sqlState?: string | null;\n  reason?:\n    | \"database_claim_rejected\"\n    | \"initiator_membership_required\"\n    | \"personal_resource_grant_required\";\n  retryPolicy?: \"explicit_recheck\";\n};\n\nexport const PRE_CLAIM_FAILURE_TYPE = \"OpenGeniPreClaimFailure\";\nexport const PRE_CLAIM_FAILURE_MESSAGE = \"Agent turn admission failed before attempt claim.\";\n\nexport type PostClaimDatabaseRecoveryDetail = {\n  turnId: string;\n  triggerEventId: string;\n  executionGeneration: number;\n  code: \"db_deadlock\" | \"db_serialization_failure\" | \"db_failure\";\n  /** Present when the database outage interrupted a retryable provider\n   * recovery checkpoint. The control lane must advance this exact durable\n   * count instead of reopening the same recovery generation. */\n  providerRecoveryCount?: number;\n  /** Safe classified provider cause paired with providerRecoveryCount. */\n  providerFailureCode?: string;\n  /** Preserve a confirmed-overload Retry-After through checkpoint DB outages. */\n  providerRecoveryContinueDelayMs?: number;\n  /** Persist the no-replay setup marker, not a new provider/setup attempt. */\n  sandboxSetupOutcomeUnknown?: true;\n  /** Preserve the exhausted budget for a command proven not dispatched. */\n  sandboxSetupRecoveryExhausted?: true;\n  /** Content-free task usage receipts whose write failed after their\n   * provider responses were received. The DB-only control lane writes them\n   * with their original identities before any replacement attempt, so known\n   * usage is neither lost nor re-requested. Bounded; omitted when none. */\n  sessionUsageReceipts?: PostClaimSessionUsageReceipt[];\n};\n\nexport type PostClaimSessionUsageReceipt = {\n  sessionId: string;\n  sourceId: string;\n  turnId: string | null;\n  amountMicros: number | null;\n  pricingSource: \"configured_list_price\" | \"gateway_reported\" | null;\n  model: string | null;\n};\n\nexport const POST_CLAIM_DATABASE_RECOVERY_FAILURE_TYPE = \"OpenGeniPostClaimDatabaseRecovery\";\nexport const POST_CLAIM_DATABASE_RECOVERY_FAILURE_MESSAGE =\n  \"Agent turn database recovery required after attempt claim.\";\n\nexport type RecoverDispatchInput = {\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  attemptId: string;\n  timeoutType: \"HEARTBEAT\" | \"SCHEDULE_TO_START\";\n};\n\nexport type RecoverDispatchResult =\n  // The same current inference is now recoverable. It never enters the prompt\n  // queue; the next claim creates a new attempt for this exact turn.\n  | { action: \"unclaimed\" }\n  | { action: \"recovering\"; turnId: string; redispatches: number }\n  // The turn is no longer running/requires_action: the timed-out attempt was\n  // a zombie that actually settled the turn after the server gave up on its\n  // heartbeats. Nothing to redo; the workflow just continues its loop.\n  | { action: \"stale\" }\n  // The per-turn crash-loop guard tripped; the workflow must fail the\n  // session for real. `redispatches` is the count already consumed (== the\n  // ceiling), so the failed attempt was worker death number redispatches + 1.\n  | { action: \"exceeded\"; turnId: string; redispatches: number };\n\nexport const ESCAPED_MCP_TIMEOUT_RECOVERY_FAILURE_TYPE = \"EscapedMcpTimeoutRecoveryFailure\";\nexport const ESCAPED_MCP_TIMEOUT_RECOVERY_FAILURE_MESSAGE =\n  \"MCP request timeout recovery checkpoint failed before model request\";\n\nexport type EscapedMcpTimeoutRecoveryDetail = {\n  turnId: string;\n  triggerEventId: string;\n  executionGeneration: number;\n  providerRecoveryCount: number;\n  continueDelayMs: number;\n};\n\nexport type RecoverEscapedMcpTimeoutInput = EscapedMcpTimeoutRecoveryDetail & {\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  attemptId: string;\n};\n\nexport type RecoverEscapedMcpTimeoutResult = {\n  action: \"recovering\" | \"stale\" | \"ineligible\";\n};\n\nexport type PeekSessionWorkInput = {\n  workspaceId: string;\n  sessionId: string;\n  includeAdmissionFence?: boolean;\n  /** Versioned workflow observer opt-in, never a caller authorization grant. */\n  observerAccountId?: string;\n};\n\nexport type SettleSessionInputWaitInput = {\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  waitTurnId: string;\n  disposition: \"held\" | \"timeout\" | \"superseded\";\n};\n\nexport type SettleSessionInputWaitResult = {\n  action: \"held\" | \"timeout\" | \"superseded\" | \"stale\";\n};\n\nexport type ExpireSessionHumanInputInput = {\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  requestId: string;\n};\n\nexport type ExpireSessionHumanInputResult = {\n  action: \"expired\" | \"stale\" | \"not_found\";\n};\n\nexport type ExpireSessionInteractionInterventionInput = {\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  interventionId: string;\n};\n\nexport type ExpireSessionInteractionInterventionResult = {\n  action: \"expired\" | \"stale\" | \"not_found\";\n};\n\nexport type ExpireScheduledRunHumanWaitInput = {\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  turnId: string;\n  runId: string;\n};\n\nexport type ExpireScheduledRunHumanWaitResult = {\n  action: \"expired\" | \"stale\" | \"not_found\";\n};\n\nexport type MarkSessionIdleInput = {\n  workspaceId: string;\n  sessionId: string;\n};\n\nexport type MaybeContinueGoalInput = {\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  workflowId: string;\n};\n\nexport type MaybeContinueGoalResult = {\n  // `deferred`: idle backoff between consecutive no-input continuations.\n  // Nothing was materialized; the obligation remains armed and a delayed\n  // outbox wake at the pacing deadline restarts it.\n  action: \"none\" | \"queue\" | \"continue\" | \"paused\" | \"deferred\";\n};\n\nexport type DispatchScheduledTaskRunInput = {\n  workspaceId: string;\n  taskId: string;\n  /** Stable Temporal workflow identity; retries must reuse the same source row. */\n  producerKey?: string;\n} & (\n  | {\n      triggerType: Extract<ScheduledTaskTriggerType, \"scheduled\">;\n      agentRunUsageIdempotencyKey?: never;\n      initiator?: never;\n      credentialRestriction?: never;\n    }\n  | {\n      triggerType: Extract<\n        ScheduledTaskTriggerType,\n        \"manual\" | \"initial\" | \"provider_event\" | \"retry\" | \"repair\"\n      >;\n      agentRunUsageIdempotencyKey: string;\n      /** Exact identity used by the API-side charge for this same trigger. */\n      initiator: TurnInitiator;\n      /** Trusted API-side caller ceiling for this occurrence, not the schedule. */\n      credentialRestriction?: \"developer_setup\";\n    }\n);\n\nexport type DispatchScheduledTaskRunResult =\n  | { action: \"deleted\" }\n  | {\n      action: \"blocked\";\n      runId?: string;\n      diagnostic?: import(\"@opengeni/contracts\").ConnectionAccountSelectionDiagnostic;\n      /** Present when the occurrence was refused as a visible run receipt. */\n      refusal?: import(\"@opengeni/contracts\").ScheduledTaskAdmissionRefusal;\n      reason:\n        | \"insufficient_credits\"\n        | \"allowance_exhausted\"\n        | \"monthly_model_cost_limit\"\n        | \"monthly_agent_run_limit\"\n        | \"session_usage_limit\"\n        | \"malformed_manual_trigger\"\n        | \"scheduled_task_paused\"\n        | \"scheduled_authority_exhausted\"\n        | \"scheduled_run_terminal\"\n        | \"scheduled_execution_unrepresentable\"\n        | \"connection_account_unavailable\"\n        | \"scheduled_authority_unavailable\"\n        | \"machine_target_unavailable\"\n        | \"machine_enrollment_inactive\"\n        | \"variable_set_unavailable\"\n        | \"rig_version_unavailable\"\n        | \"scheduled_model_unavailable\"\n        | \"knowledge_source_paused\"\n        | \"legacy_source_schedule_requires_migration\"\n        | \"atlassian_native_retired\"\n        | \"incident_preflight_metadata_missing\"\n        | \"incident_responder_under_capable\"\n        | \"incident_data_source_unsuitable\";\n    }\n  | {\n      action: \"start\" | \"signal\";\n      accountId: string;\n      workspaceId: string;\n      sessionId: string;\n      triggerEventId: string;\n      workflowId: string;\n      workflowWakeRevision: number | null;\n    }\n  | {\n      action: \"knowledge_source_sync\";\n      accountId: string;\n      workspaceId: string;\n      taskId: string;\n      scheduledTaskRunId: string;\n      sourceId: string;\n      overlapPolicy: \"skip\" | \"buffer_one\";\n    };\n\nexport type RunKnowledgeSourceSyncBatchInput = {\n  /** Host-bound attempt only. Legacy control workflow inputs have none and cannot fetch. */\n  agent?: Extract<import(\"@opengeni/db\").KnowledgeActor, { kind: \"agent\" }>;\n\n  accountId: string;\n  workspaceId: string;\n  taskId: string;\n  scheduledTaskRunId: string;\n  sourceId: string;\n  overlapPolicy: \"skip\" | \"buffer_one\";\n};\n\nexport type DispatchAutomationRunInput = {\n  accountId: string;\n  workspaceId: string;\n  runId: string;\n};\n\nexport type DispatchAutomationRunResult =\n  | { action: \"started\"; sessionId: string }\n  | { action: \"already_dispatched\"; sessionId: string }\n  | { action: \"skipped\"; reason: string }\n  | { action: \"failed\"; reason: string }\n  | { action: \"not_found\" };\n\nexport type RunKnowledgeSourceSyncBatchResult = (\n  | { action: \"continue\" }\n  | {\n      action: \"complete\";\n      bufferedWake: boolean;\n      bufferedScheduledTaskRunId?: string | null;\n    }\n  | { action: \"skipped\" | \"buffered\" }\n  | {\n      action: \"failed\";\n      bufferedWake: boolean;\n      bufferedScheduledTaskRunId?: string | null;\n    }\n) & { summary?: KnowledgeSourceSyncRunSummary; errorCode?: string };\n\ntype DocumentIndexIdentity = {\n  accountId: string;\n  workspaceId: string;\n  documentId: string;\n};\n\ntype CurrentDocumentIndexAuthority = {\n  authorityKind: DocumentAuthorityKind;\n  authorityWorkspaceId: string | null;\n  authoritySubjectId: string | null;\n};\n\ntype HistoricalDocumentIndexAuthority = {\n  authorityKind?: never;\n  authorityWorkspaceId?: never;\n  authoritySubjectId?: never;\n};\n\nexport type IndexDocumentInput = DocumentIndexIdentity &\n  (CurrentDocumentIndexAuthority | HistoricalDocumentIndexAuthority);\n\ntype ClaimedRunAgentTurnResult = {\n  // \"recovering\": this attempt ended after durably preserving the same current\n  // inference for a new attempt. Recovery is not prompt queue work.\n  status: \"idle\" | \"requires_action\" | \"failed\" | \"cancelled\" | \"recovering\" | \"waiting_capacity\";\n  turnId: string;\n  attemptId: string;\n  // Provider backpressure pacing: when set on an idle or recovering result, the\n  // session workflow holds the loop this long before admitting the next attempt.\n  continueDelayMs?: number;\n  // Multi-account rotation all-capped idle: every connected Codex subscription is\n  // rate-limited/cooling. This is a MANDATORY hold — session.ts must wait\n  // continueDelayMs (floored to a minimum) and must NOT treat a 0/elapsed delay as\n  // \"continue now\" (invariant 4: NO THRASH). Distinct from a normal continueDelayMs:0\n  // which legitimately means \"a rotation candidate is ready, re-dispatch immediately\".\n  idleUntilReset?: boolean;\n  // Durable native zero-pool wait for this same nonterminal logical turn.\n  // Unlike continueDelayMs, this reference is persisted in Postgres and\n  // reconstructed after workflow/worker restart. The workflow must not call\n  // maybeContinueGoal or manufacture queue/input work while it is active.\n  capacityWait?: CodexCapacityWaitRef;\n  // This execution reached a durable terminal-for-now boundary (for example,\n  // maintenance could not run or same-turn context recovery failed). End this\n  // workflow run without synthesizing another goal continuation from unchanged\n  // state. A later prompt/control/new-update wake may retry through normal claim\n  // ordering.\n  deferredUntilWake?: boolean;\n};\n\nexport type RunAgentTurnResult =\n  | ClaimedRunAgentTurnResult\n  | {\n      status: \"unclaimed\";\n      reason: \"gate-closed\" | \"no-work\" | \"stale-approval\" | \"control-pending\" | \"dispatch-expired\";\n    };\n","/**\n * Person-facing copy for finite same-turn provider recovery. Presentation only:\n * retry authority, pacing and the recovery budget stay in `errors.ts`.\n *\n * `@opengeni/react` (`lib/provider-recovery.ts`) composes the same sentences\n * from the structured event fields, so live retry status and historical\n * failures read identically in every surface. Keep the two in step.\n */\n\n/** Closed provider condition recorded on model-provider recovery payloads. */\nexport type ProviderCondition = \"overloaded\" | \"unavailable\" | \"unresponsive\" | \"rate_limited\";\n\n/** Failure codes whose transient condition belongs to the turn's model route. */\nexport const MODEL_PROVIDER_RECOVERY_CODES: ReadonlySet<string> = new Set([\n  \"provider_unavailable\",\n  \"provider_rate_limited\",\n  \"provider_unknown_finish_reason\",\n  \"post_compaction_continuation_empty\",\n]);\n\nexport type ProviderRecoveryCopyInput = {\n  code?: string | null | undefined;\n  providerCondition?: ProviderCondition | null | undefined;\n  modelLabel?: string | null | undefined;\n  providerLabel?: string | null | undefined;\n};\n\nfunction label(value: string | null | undefined): string | null {\n  const trimmed = typeof value === \"string\" ? value.replace(/\\s+/g, \" \").trim() : \"\";\n  return trimmed ? trimmed.slice(0, 120) : null;\n}\n\n/** One present-tense clause naming what is unavailable, without a trailing period. */\nexport function providerRecoverySubject(input: ProviderRecoveryCopyInput): string {\n  const model = label(input.modelLabel) ?? \"The model\";\n  const provider = label(input.providerLabel);\n  const at = provider ? ` at the provider (${provider})` : \" at the provider\";\n  switch (input.code) {\n    case \"provider_rate_limited\":\n      return `${model} is rate limited${at}`;\n    case \"provider_unavailable\":\n      return input.providerCondition === \"overloaded\"\n        ? `${model} is overloaded${at}`\n        : input.providerCondition === \"unresponsive\"\n          ? `${model} stopped responding${at}`\n          : `${model} is temporarily unavailable${at}`;\n    case \"provider_unknown_finish_reason\":\n      return `${model} ended its response unexpectedly`;\n    case \"post_compaction_continuation_empty\":\n      return `${model} stopped right after compacting the conversation`;\n    case \"upstream_connectivity_unavailable\":\n      return \"Opengeni can't reach an upstream service\";\n    case \"mcp_transport_timeout\":\n      return \"A required MCP server isn't responding\";\n    case \"mcp_transport_unavailable\":\n      return \"A required MCP server is unreachable\";\n    case \"sandbox_command_start_unavailable\":\n      return \"The sandbox isn't ready yet\";\n    case \"retained_attachment_unavailable\":\n      return \"An image from earlier in this conversation can't be read from storage\";\n    case \"turn_execution_policy_definition_mismatch\":\n      return \"Opengeni is applying a configuration update\";\n    default:\n      return \"A service this turn depends on is temporarily unavailable\";\n  }\n}\n\n/** Terminal copy once the finite automatic recovery budget is spent. */\nexport function providerRecoveryExhaustedMessage(\n  input: ProviderRecoveryCopyInput & { providerRecoveryCount: number },\n): string {\n  const count = input.providerRecoveryCount;\n  const retried = `Opengeni retried ${count} ${count === 1 ? \"time\" : \"times\"} without success.`;\n  const remedy = MODEL_PROVIDER_RECOVERY_CODES.has(input.code ?? \"\")\n    ? \"Try again in a few minutes, or switch to another model.\"\n    : \"Try again in a few minutes.\";\n  return `${providerRecoverySubject(input)}. ${retried} ${remedy}`;\n}\n"],"mappings":";;;;;;;;;;;;;AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AACpC,SAAS,oCAAoC,8BAA8B;AAC3E,SAAS,2BAA2B;;;ACTpC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP,SAAS,aAAa,kBAAkB;AACxC,SAAS,oBAAoB;AAC7B,SAAS,YAAY;AACrB,SAAS,yBAAyB;AAElC,IAAM,4BAA4B;AAO3B,SAAS,kCACd,IACA,UACiE;AACjE,MAAI,CAAC,SAAS,2BAA4B,QAAO;AACjD,QAAM,SAAS,SAAS,yBAAyB,KAAK;AACtD,QAAM,eAAe,wBAAwB,QAAQ;AACrD,MAAI,CAAC,UAAU,CAAC,cAAc;AAC5B,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AAEA,SAAO,OAAO,YAAY;AACxB,QAAI,QAAQ,YAAY,QAAQ,aAAa,UAAU;AACrD,YAAM,IAAI,MAAM,6DAA6D;AAAA,IAC/E;AACA,QAAI,CAAC,QAAQ,uBAAuB,CAAC,QAAQ,gBAAgB,QAAQ;AACnE,YAAM,IAAI,MAAM,kEAAkE;AAAA,IACpF;AACA,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AACA,UAAM,UAAU,MAAM,8BAA8B,IAAI,QAAQ,aAAa,QAAQ,SAAS;AAC9F,QACE,CAAC,QACD,CAAC,WACD,KAAK,OAAO,QAAQ,UACpB,KAAK,wBAAwB,QAAQ,uBACrC,CAAC,kBAAkB,KAAK,WAAW,QAAQ,SAAS,KACpD,CAAC,kBAAkB,KAAK,kBAAkB,QAAQ,gBAAgB,KAClE,QAAQ,kBAAkB,QAAQ,eAClC;AACA,YAAM,IAAI,MAAM,+DAA+D;AAAA,IACjF;AACA,UAAM,aAAa;AAAA,MACjB,KAAK;AAAA,MACL,QAAQ;AAAA,IACV;AACA,UAAM,WAAW,WAAW;AAC5B,UAAM,eAAe;AAAA,MACnB,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,SAAS;AAAA,IACX;AAEA,UAAM,aAAa,MAAM,6BAA6B,IAAI;AAAA,MACxD,WAAW,QAAQ;AAAA,MACnB,aAAa,QAAQ;AAAA,MACrB,WAAW,QAAQ;AAAA,MACnB,QAAQ,QAAQ;AAAA,MAChB,WAAW,QAAQ;AAAA,MACnB,qBAAqB,QAAQ;AAAA,MAC7B,mBAAmB,WAAW;AAAA,MAC9B,UAAU;AAAA,MACV,UAAU;AAAA,MACV,cAAc,WAAW;AAAA,MACzB,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,MAChB,cAAc;AAAA,MACd,gBAAgB,WAAW;AAAA,IAC7B,CAAC;AACD,QACE,WAAW,WAAW,gBACtB,WAAW,sBAAsB,WAAW,qBAC5C,WAAW,YAAY,iBAAiB,WAAW,gBACnD,WAAW,YAAY,yBAAyB,SAAS,iCACzD,WAAW,YAAY,mBAAmB,WAAW,gBACrD;AACA,YAAM,IAAI,MAAM,+DAA+D;AAAA,IACjF;AAEA,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA,WAAW;AAAA,MACX,WAAW;AAAA,MACX,WAAW;AAAA,IACb;AACA,QACE,CAAC,cACD,WAAW,cAAc,QAAQ,aACjC,WAAW,gBAAgB,WAAW,qBACtC,WAAW,cAAc,WAAW,kBACpC,WAAW,WAAW;AAAA;AAAA;AAAA,IAItB,WAAW,cAAc,WAAW,KACpC,WAAW,cAAc,CAAC,MAAM,UAChC,CAAC,2BAA2B,UAAU,GACtC;AACA,YAAM,IAAI,MAAM,+CAA+C;AAAA,IACjE;AACA,UAAM,WAAW,iCAAiC,MAAM,WAAW,QAAQ;AAC3E,UAAM,mBAAmB,MAAM,0CAA0C,IAAI;AAAA,MAC3E,WAAW,QAAQ;AAAA,MACnB,mBAAmB,WAAW;AAAA,MAC9B,WAAW,WAAW;AAAA,MACtB,cAAc,WAAW;AAAA,IAC3B,CAAC;AACD,QACE,CAAC,oBACD,iBAAiB,kCAAkC,SAAS,iCAC5D,iBAAiB,wBAAwB,SAAS,uBAClD,iBAAiB,wBAAwB,SAAS,uBAClD,iBAAiB,wBAAwB,SAAS,uBAClD,iBAAiB,wBAAwB,SAAS,uBAClD,SAAS,iBAAiB,SAAS,qBACnC;AACA,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AACA,UAAM,cAAc,IAAI;AAAA,MACtB,iBAAiB,aAAa,IAAI,CAAC,eAAe,CAAC,WAAW,cAAc,UAAU,CAAC;AAAA,IACzF;AACA,eAAW,cAAc,cAAc;AACrC,YAAM,UAAU,YAAY,IAAI,WAAW,YAAY;AACvD,UACE,CAAC,WACD,QAAQ,aAAa,WAAW,YAChC,QAAQ,iBAAiB,WAAW,gBACpC,QAAQ,wBAAwB,WAAW,uBAC3C,QAAQ,YACP,WAAW,WAAW,YACpB,QAAQ,mBAAmB,WAC1B,QAAQ,YACR,CAAC,uBAAuB,QAAQ,WAAW,MAC/C,CAAC,sBAAsB,QAAQ,WAAW,GAC1C;AACA,cAAM,IAAI,MAAM,8CAA8C;AAAA,MAChE;AAAA,IACF;AAEA,UAAM,WAAW;AAAA,MACf,MAAM,SAAS;AAAA,MACf,OAAO,GAAG,SAAS,YAAY,IAAI,SAAS,WAAW;AAAA,IACzD;AACA,QAAI,QAAQ,YAAY,YAAY;AAClC,aAAO;AAAA,QACL,aAAa,QAAQ;AAAA,QACrB,qBAAqB,QAAQ;AAAA,QAC7B,UAAU;AAAA,QACV,cAAc;AAAA,QACd;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAK;AACzC,UAAM,aAAa;AAAA,MACjB,SAAS;AAAA,MACT,WAAW,QAAQ;AAAA,MACnB,aAAa,QAAQ;AAAA,MACrB,WAAW,QAAQ;AAAA,MACnB,eAAe,QAAQ;AAAA,MACvB,QAAQ,QAAQ;AAAA,MAChB,WAAW,QAAQ;AAAA,MACnB,qBAAqB,QAAQ;AAAA,MAC7B,mBAAmB,WAAW;AAAA,MAC9B,cAAc,WAAW;AAAA,MACzB,+BAA+B,SAAS;AAAA,MACxC,gBAAgB,WAAW;AAAA,MAC3B,qBAAqB,SAAS;AAAA,MAC9B,qBAAqB,SAAS;AAAA,IAChC;AACA,UAAM,mBAA6D,aAAa;AAAA,MAC9E,CAAC,gBAAgB;AAAA,QACf,GAAG;AAAA,QACH,SAAS,+BAA+B,QAAQ;AAAA,UAC9C,GAAG;AAAA,UACH;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AACA,UAAM,SAAwC;AAAA,MAC5C,GAAG;AAAA,MACH,OAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAAA,MAC3C,UAAU;AAAA,MACV,WAAW,MAAM;AAAA,IACnB;AACA,WAAO;AAAA,MACL,OAAO,kCAAkC,QAAQ,MAAM;AAAA,MACvD,WAAW,IAAI,KAAK,OAAO,YAAY,GAAK,EAAE,YAAY;AAAA,MAC1D,aAAa,QAAQ;AAAA,MACrB,qBAAqB,QAAQ;AAAA,MAC7B,UAAU;AAAA,MACV,cAAc;AAAA,MACd;AAAA,MACA,WAAW;AAAA,QACT,MAAM;AAAA,QACN,cAAc,iBAAiB,IAAI,CAAC,gBAAgB;AAAA,UAClD,eAAe,WAAW;AAAA,UAC1B,WAAW,GAAG,YAAY,oBAAoB,WAAW,OAAO;AAAA,QAClE,EAAE;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,aAMnB;AACV,SACE,YAAY,QACZ,YAAY,UACZ,YAAY,QACZ,YAAY,YACZ,YAAY;AAEhB;AAEA,SAAS,uBAAuB,aAIpB;AACV,SAAO,YAAY,QAAQ,YAAY,YAAY,YAAY;AACjE;AAEA,IAAI;AAEJ,SAAS,sBAAqC;AAC5C,MAAI,8BAA8B,OAAW,QAAO;AACpD,MAAI;AACF,UAAM,QAAQ;AAAA,MACZ;AAAA,MACA,CAAC,WAAW,WAAW,UAAU,YAAY,oCAAoC;AAAA,MACjF,EAAE,UAAU,QAAQ,SAAS,KAAO,WAAW,KAAK,KAAK;AAAA,IAC3D,EAAE,KAAK;AACP,gCAA4B,KAAK,KAAK,IAAI,QAAQ;AAAA,EACpD,QAAQ;AACN,gCAA4B;AAAA,EAC9B;AACA,SAAO;AACT;AAEO,SAAS,wBAAwB,UAAmC;AACzE,QAAM,QACJ,SAAS,mBACR,SAAS,mBAAmB,WACzB,+BAA+B,SAAS,OAAO,KAC/C,SAAS,mBAAmB,WAAW,SAAS,mBAAmB,SACjE,oBAAoB,SAAS,OAAO,KACpC,SAAS;AACjB,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,MAAM,IAAI,IAAI,KAAK;AACzB,MACE,SAAS,mBAAmB,aAC3B,IAAI,aAAa,eAAe,IAAI,aAAa,cAClD;AACA,QAAI,WAAW,oBAAoB,KAAK;AAAA,EAC1C;AACA,QAAM,sBACJ,SAAS,mBAAmB,aAC3B,IAAI,aAAa,0BAChB,IAAI,aAAa,6BACjB,2BAA2B,KAAK,IAAI,QAAQ;AAGhD,QAAM,yBACH,IAAI,aAAa,YACf,IAAI,aAAa,eAAe,IAAI,aAAa,eAAe,wBACnE,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW;AACjD,MACG,IAAI,aAAa,YAAY,CAAC,0BAC/B,IAAI,YACJ,IAAI,YACJ,IAAI,UACJ,IAAI,MACJ;AACA,WAAO;AAAA,EACT;AACA,MAAI,WAAW;AACf,SAAO,IAAI;AACb;AAEA,SAAS,8BACP,aACA,qBACiC;AACjC,QAAM,UAAU,YAAY;AAAA,IAC1B,CAACA,gBACCA,YAAW,aAAa,6BACxBA,YAAW,mBAAmB,qBAC9BA,YAAW,mCAAmC,wBAAwB;AAAA,EAC1E;AACA,QAAM,aAAa,QAAQ,CAAC;AAC5B,MACE,QAAQ,WAAW,KACnB,CAAC,cACD,WAAW,mBAAmB,gBAC9B,WAAW,SAAS,YACpB,CAAC,WAAW,qBACZ,CAAC,WAAW,mCACZ;AACA,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,SAAO;AACT;AAEA,SAAS,2BACP,MACA,qBACA,WAGgE;AAChE,MAAI,KAAK,WAAW,UAAU,QAAQ;AACpC,UAAM,IAAI,MAAM,wEAAwE;AAAA,EAC1F;AACA,QAAM,iBAAiB,IAAI;AAAA,IACzB,UAAU,IAAI,CAAC,eAAe,CAAC,WAAW,cAAc,UAAU,CAAC;AAAA,EACrE;AACA,QAAM,OAAO,oBAAI,IAAY;AAC7B,SAAO,KAAK,IAAI,CAAC,QAAQ;AACvB,UAAM,WAAW,eAAe,IAAI,IAAI,GAAG;AAC3C,QACE,CAAC,YACD,KAAK,IAAI,IAAI,GAAG,KAChB,IAAI,aAAa,YACjB,IAAI,wBAAwB,uBAC5B,IAAI,iBAAiB,UACrB,IAAI,mBAAmB,UACvB,OAAO,IAAI,YAAY,MAAM,SAAS,gBACtC,IAAI,QAAQ,SAAS,OACrB,IAAI,WAAW,SAAS,QACxB;AACA,YAAM,IAAI,MAAM,uEAAuE;AAAA,IACzF;AACA,SAAK,IAAI,IAAI,GAAG;AAChB,WAAO;AAAA,EACT,CAAC;AACH;;;ACpXA,SAAS,sCAAqD;AAM9D,SAAS,mDAAmD;AAC5D,SAAS,yBAAyB,oCAAmD;AACrF;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAIA,SAAS,0CACd,UACA,IAC2B;AAC3B,SAAO;AAAA,IACL,gBAAgB,OAAO,YAAY,MAAM,gCAAgC,UAAU,IAAI,OAAO;AAAA,EAChG;AACF;AAEA,eAAe,gCACb,UACA,IACA,SACyB;AACzB,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,iBAAiB,QAAQ,sBAC3B,4CAA4C,QAAQ,mBAAmB,IACvE;AACJ,MAAI,CAAC,gBAAgB;AACnB,QAAI,aAAa,UAAU;AACzB,YAAM,IAAI,MAAM,GAAG,QAAQ,gEAAgE;AAAA,IAC7F;AACA,QAAI,QAAQ,YAAY,YAAY;AAClC,aAAO,EAAE,aAAa,QAAQ,YAAY;AAAA,IAC5C;AACA,UAAM,SAAS,MAAM,2CAA2C,UAAU;AAAA,MACxE,gBAAgB,QAAQ;AAAA,MACxB,eAAe,QAAQ;AAAA,IACzB,CAAC;AACD,WAAO;AAAA,MACL,OAAO,OAAO;AAAA,MACd,aAAa,QAAQ;AAAA,MACrB,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;AAAA,IAC5D;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,6BAA6B,IAAI;AAAA,IACvD,WAAW,QAAQ;AAAA,IACnB,aAAa,QAAQ;AAAA,IACrB;AAAA,IACA;AAAA,IACA,WAAW,QAAQ;AAAA,IACnB,eAAe,QAAQ;AAAA,IACvB,QAAQ,QAAQ;AAAA,IAChB,WAAW,QAAQ;AAAA,IACnB,qBAAqB,QAAQ;AAAA,IAC7B,iBAAiB,QAAQ,kBAAkB,CAAC,GAAG,IAAI,CAAC,eAAe;AAAA,MACjE,KAAK,UAAU;AAAA,MACf,GAAI,UAAU,sBAAsB,SAChC,EAAE,mBAAmB,UAAU,kBAAkB,IACjD,CAAC;AAAA,MACL,GAAI,UAAU,iBAAiB,SAAY,EAAE,cAAc,UAAU,aAAa,IAAI,CAAC;AAAA,MACvF,GAAI,UAAU,mBAAmB,SAC7B,EAAE,gBAAgB,UAAU,eAAe,IAC3C,CAAC;AAAA,MACL,GAAI,UAAU,cAAc,SAAY,EAAE,WAAW,UAAU,UAAU,IAAI,CAAC;AAAA,IAChF,EAAE;AAAA,EACJ,CAAC;AACD,QAAM,SAAS;AAAA,IACb,aAAa,QAAQ;AAAA,IACrB,GAAI,QAAQ,sBAAsB,EAAE,qBAAqB,QAAQ,oBAAoB,IAAI,CAAC;AAAA,IAC1F;AAAA,IACA,GAAI,QAAQ,eAAe,EAAE,cAAc,QAAQ,aAAa,IAAI,CAAC;AAAA,EACvE;AACA,MAAI,QAAQ,YAAY,YAAY;AAClC,WAAO,UAAU,mBAAmB,gBAClC,UAAU,mBAAmB,uBAC3B;AAAA,MACE,GAAG;AAAA,MACH,UAAU;AAAA,QACR,MAAM;AAAA,QACN,OAAO,GAAG,UAAU,SAAS,WAAW;AAAA,MAC1C;AAAA,IACF,IACA;AAAA,EACN;AACA,MACE,UAAU,mBAAmB,gBAC7B,UAAU,mBAAmB,sBAC7B;AACA,0CAAsC,OAAO;AAC7C,QAAI,CAAC,UAAU,OAAO;AACpB,YAAM,IAAI,MAAM,gDAAgD;AAAA,IAClE;AACA,UAAM,kBACJ,UAAU,mBAAmB,uBACzB;AAAA,MACE,aAAa,SAAS;AAAA,MACtB,qBAAqB,SAAS;AAAA,IAChC,IACA,oCAAoC,UAAU;AAAA,MAC5C,OAAO,UAAU;AAAA,MACjB,qBAAqB,UAAU;AAAA,IACjC,CAAC;AACP,QACE,UAAU,mBAAmB,wBAC7B,SAAS,wBAAwB,UAAU,OAC3C;AACA,YAAM,IAAI,MAAM,gEAAgE;AAAA,IAClF;AACA,UAAM,SAAS,MAAM,oDAAoD,iBAAiB;AAAA,MACxF,gBAAgB,QAAQ;AAAA,MACxB,eAAe,QAAQ;AAAA,MACvB,aAAa,EAAE,UAAU,QAAQ,eAAe,QAAQ;AAAA,IAC1D,CAAC;AACD,WAAO;AAAA,MACL,GAAG;AAAA,MACH,OAAO,OAAO;AAAA,MACd,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;AAAA,IAC5D;AAAA,EACF;AACA,MAAI,UAAU,aAAa,KAAK,MAAM,UAAU,SAAS,KAAK,KAAK,IAAI,GAAG;AACxE,UAAM,IAAI,MAAM,aAAa,QAAQ,kCAAkC;AAAA,EACzE;AACA,QAAM,gBAAgB,+BAA+B,QAAQ;AAC7D,MAAI,CAAC,iBAAiB,CAAC,UAAU,qBAAqB;AACpD,UAAM,IAAI,MAAM,aAAa,QAAQ,qCAAqC;AAAA,EAC5E;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,wBAAwB,eAAe,UAAU,mBAAmB;AAAA,IAC3E,GAAI,UAAU,YAAY,EAAE,WAAW,UAAU,UAAU,IAAI,CAAC;AAAA,EAClE;AACF;AAEA,SAAS,oCACP,UACA,WACA;AACA,QAAM,gBAAgB,+BAA+B,QAAQ;AAC7D,MAAI,CAAC,iBAAiB,CAAC,UAAU,qBAAqB;AACpD,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACA,SAAO;AAAA,IACL,aAAa,UAAU;AAAA,IACvB,qBAAqB,wBAAwB,eAAe,UAAU,mBAAmB;AAAA,EAC3F;AACF;AAEA,SAAS,sCAAsC,SAAsC;AACnF,QAAM,OAAO,QAAQ,kBAAkB,CAAC;AACxC,QAAM,gBAAgB,KAAK,IAAI,CAAC,cAAc,gBAAgB,UAAU,YAAY,CAAC;AACrF,QAAM,kBAAkB,KAAK,IAAI,CAAC,cAAc,gBAAgB,UAAU,cAAc,CAAC;AACzF,MACE,cAAc,KAAK,CAAC,UAAU,UAAU,IAAI,KAC5C,gBAAgB,KAAK,CAAC,UAAU,UAAU,IAAI,GAC9C;AACA,UAAM,IAAI,MAAM,sEAAsE;AAAA,EACxF;AACA,QAAM,qBAAqB,CAAC,GAAG,IAAI,IAAI,aAAyB,CAAC,EAAE;AAAA,IACjE,CAAC,MAAM,UAAU,OAAO;AAAA,EAC1B;AACA,QAAM,yBAAyB,CAAC,GAAG,IAAI,IAAI,QAAQ,aAAa,CAAC,EAAE;AAAA,IACjE,CAAC,MAAM,UAAU,OAAO;AAAA,EAC1B;AACA,QAAM,uBAAuB,CAAC,GAAG,IAAI,IAAI,eAA2B,CAAC;AACrE,MACE,qBAAqB,WAAW,KAChC,qBAAqB,CAAC,MAAM,QAAQ,kBACpC,mBAAmB,WAAW,QAAQ,cAAc,UACpD,mBAAmB,KAAK,CAAC,OAAO,UAAU,UAAU,uBAAuB,KAAK,CAAC,GACjF;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,OAA+B;AACtD,MAAI,OAAO,UAAU,YAAY,OAAO,cAAc,KAAK,KAAK,QAAQ,EAAG,QAAO;AAClF,MAAI,OAAO,UAAU,YAAY,QAAQ,KAAK,KAAK,GAAG;AACpD,UAAM,SAAS,OAAO,KAAK;AAC3B,WAAO,OAAO,cAAc,MAAM,KAAK,SAAS,IAAI,SAAS;AAAA,EAC/D;AACA,SAAO;AACT;;;ACvLO,IAAM,+BAAgE,OAAO,UAAU;AAC5F,QAAM,EAAE,sCAAsC,IAAI,MAAM,OAAO,8BAA8B;AAC7F,SAAO,sCAAsC,KAAK;AACpD;;;AHqBO,SAAS,6BACd,cACuC;AACvC,MAAI,kBAA0D;AAE9D,SAAO,eAAe,WAA4C;AAChE,yBAAqB,YAAY;AAC/B,YAAM,WAAW,aAAa,YAAY,YAAY;AACtD,YAAM,gBACJ,aAAa,iBAAiB,oBAAoB,UAAU,EAAE,WAAW,SAAS,CAAC;AACrF,YAAM,aAAa,aAAa,QAAQ;AACxC,YAAM,WAAW,aAAa,KAC1B,OACA,SAAS,SAAS,aAAa;AAAA,QAC7B,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,QACnC,aAAa,SAAS;AAAA,MACxB,CAAC;AACL,YAAM,mBAAmB,4BAA4B,QAAQ;AAC7D,YAAM,KAAK,aAAa,MAAM,SAAU;AACxC,YAAM,oBAAoB,MAAM,uBAAuB,IAAI,QAAQ,GAAG;AAGtE,qCAA+B,EAAE,SAAS,SAAS,6BAA6B,CAAC;AAGjF,0CAAoC,2BAA2B,QAAQ,CAAC;AAExE,YAAM,oBAAoB,yBAAyB,QAAQ;AAC3D,UAAI,kBAAkB,WAAW,WAAW;AAC1C,sBAAc,KAAK,8DAA8D;AAAA,UAC/E,QAAQ,kBAAkB;AAAA,QAC5B,CAAC;AAAA,MACH;AACA,aAAO;AAAA,QACL,UAAU;AAAA,QACV,uBAAuB;AAAA,QACvB;AAAA,QACA,KACE,aAAa,OACZ,MAAM;AAAA,UACL,SAAS;AAAA,UACT,mBACI,EAAE,MAAM,iBAAiB,MAAM,MAAM,iBAAiB,SAAS,IAC/D;AAAA,UACJ,6BAA6B,aAAa;AAAA,QAC5C;AAAA,QACF,eAAe,aAAa,iBAAiB,oBAAoB,QAAQ;AAAA,QACzE;AAAA,QACA,qBAAqB,aAAa,uBAAuB;AAAA,QACzD,8BAA8B,aAAa,gCAAgC;AAAA,QAC3E,+BAA+B,aAAa,iCAAiC;AAAA,QAC7E,6BAA6B,aAAa,+BAA+B;AAAA,QACzE,4BAA4B,aAAa,8BAA8B;AAAA,QACvE,8BAA8B,aAAa,gCAAgC;AAAA,QAC3E,cAAc,aAAa,gBAAgB;AAAA,QAC3C,uBACE,aAAa,yBACb,0CAA0C,UAAU,EAAE;AAAA,QACxD,2BACE,aAAa,6BAA6B,kCAAkC,IAAI,QAAQ;AAAA,QAC1F,0BACE,aAAa,6BAA6B,SACtC,+BACA,aAAa;AAAA,QACnB,wBACE,aAAa,2BAA2B,SACpC;AAAA,UACE,GAAG,mCAAmC,QAAQ;AAAA,UAC9C,GAAG,mCAAmC,QAAQ;AAAA,QAChD,IACA,aAAa;AAAA,MACrB;AAAA,IACF,GAAG;AACH,WAAO,MAAM;AAAA,EACf;AACF;;;AIzGA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGA,SAAS,yBACd,UACA,yBACA;AACA,SAAO;AAAA,IACL,eAAe,OAAO,UAA8B;AAClD,YAAM,EAAE,IAAI,cAAc,IAAI,MAAM,SAAS;AAC7C,UAAI,CAAC,eAAe;AAClB,cAAM,IAAI,MAAM,kCAAkC;AAAA,MACpD;AACA,UAAI,CAAC,yBAAyB;AAC5B,cAAM,IAAI,MAAM,sCAAsC;AAAA,MACxD;AACA,YAAM,CAAC,EAAE,wBAAwB,iBAAiB,GAAG,gBAAgB,IAAI,MAAM,QAAQ,IAAI;AAAA,QACzF,OAAO,qBAAqB;AAAA,QAC5B,wBAAwB;AAAA,MAC1B,CAAC;AACD,YAAM,UAAU,MAAM,uBAAuB,IAAI,MAAM,WAAW;AAClE,UAAI,QAAQ,cAAc,MAAM,WAAW;AACzC,cAAM,IAAI,MAAM,+CAA+C;AAAA,MACjE;AACA,aAAO,MAAM,uBAAuB,IAAI,MAAM,aAAa,OAAO,aAAa;AAC7E,cAAM,kBAAkB,MAAM,8BAA8B,UAAU,KAAK;AAC3E,YAAI,CAAC,iBAAiB;AACpB,gBAAM,IAAI,MAAM,kDAAkD;AAAA,QACpE;AACA,cAAM,0BAA0B;AAAA,UAC9B;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA,cAAM,gBAAgB,wBAAwB;AAAA,UAAO,CAAC,UACpD,OAAO,UAAU,eAAe,KAAK,OAAO,KAAK;AAAA,QACnD,EAAE;AACF,cAAM,mBACH,OAAO,UAAU,eAAe,KAAK,OAAO,eAAe,KAC1D,MAAM,kBAAkB,gBAAgB,iBACzC,OAAO,UAAU,eAAe,KAAK,OAAO,sBAAsB,KACjE,MAAM,yBAAyB,gBAAgB,wBAChD,OAAO,UAAU,eAAe,KAAK,OAAO,oBAAoB,KAC/D,MAAM,uBAAuB,gBAAgB;AACjD,YAAI,kBAAkB;AACpB,gBAAM,IAAI,MAAM,4CAA4C;AAAA,QAC9D;AACA,YAAI,kBAAkB,KAAK,kBAAkB,wBAAwB,QAAQ;AAC3E,gBAAM,IAAI,MAAM,qCAAqC;AAAA,QACvD;AACA,cAAM,kBAAkB,MAAM;AAAA,UAC5B;AAAA,UACA,MAAM;AAAA,UACN,MAAM;AAAA,QACR;AACA,YACE,CAAC,mBACD,gBAAgB,kBAAkB,gBAAgB,iBAClD,gBAAgB,yBAAyB,gBAAgB,wBACzD,gBAAgB,uBAAuB,gBAAgB,oBACvD;AACA,gBAAM,IAAI,MAAM,4CAA4C;AAAA,QAC9D;AACA,cAAM,WAAW,MAAM;AAAA,UACrB;AAAA,YACE,WAAW;AAAA,YACX,2BACE,gBAAgB,kBAAkB,aAC9B,gBAAgB,qBAChB;AAAA,UACR;AAAA,UACA,MACE;AAAA,YACE;AAAA,YACA;AAAA,YACA,MAAM;AAAA,YACN,MAAM;AAAA,YACN;AAAA,YACA,EAAE,iBAAiB,gBAAgB,mBAAmB;AAAA,UACxD;AAAA,QACJ;AACA,YACE,SAAS,kBAAkB,gBAAgB,iBAC3C,SAAS,yBAAyB,gBAAgB,wBAClD,SAAS,uBAAuB,gBAAgB,oBAChD;AACA,gBAAM,IAAI,MAAM,4CAA4C;AAAA,QAC9D;AACA,eAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;AClGA;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA,6BAAAC;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,+BAA+B,wBAAAC,6BAA4B;;;AC/BpE,SAAS,iCAA6D;AAG/D,SAAS,0BACd,gBACA,wBAC+B;AAC/B,QAAM,gBAAgB,0BAA0B,sBAAsB;AACtE,SAAO,eAAe,0BAA0B,qBAC7C,cAAc,SAAS,WACtB,cAAc,OAAO,0BAA0B,oBAC/C,oBACA;AACN;;;ADqBO,SAAS,qBAAqB,UAAkD;AACrF,iBAAe,qBAAqB,OAA8C;AAChF,UAAM,EAAE,GAAG,IAAI,MAAM,SAAS;AAC9B,UAAM,qCAAqC,IAAI;AAAA,MAC7C,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,WAAW,MAAM;AAAA,MACjB,oBAAoB,MAAM;AAAA,MAC1B,QAAQ;AAAA;AAAA;AAAA,MAGR,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,GAAM;AAAA,IACzC,CAAC;AAAA,EACH;AAEA,iBAAe,kBACb,OACkC;AAClC,UAAM,UAAU,MAAM,SAAS;AAC/B,UAAM,EAAE,IAAI,IAAI,IAAI;AACpB,UAAM,wBAAwB,QAAQ,yBAAyB,QAAQ;AAEvE,UAAM,eAAe,MAAM,eAAe,IAAI,MAAM,aAAa,MAAM,SAAS;AAChF,QAAI,CAAC,gBAAgB,aAAa,WAAW,UAAU;AACrD,aAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AAQA,UAAM,UAAU,MAAM,eAAe,IAAI,MAAM,aAAa,MAAM,SAAS;AAI3E,QAAI,QAAQ,WAAW,YAAY,QAAQ,WAAW,aAAa;AACjE,aAAO,EAAE,QAAQ,OAAO;AAAA,IAC1B;AACA,UAAM,YAAY,MAAM,iBAAiB,IAAI,MAAM,WAAW;AAC9D,UAAM,gBAAgB,MAAM,0BAA0B,IAAI,uBAAuB;AAAA,MAC/E,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,OAAO,QAAQ;AAAA,MACf,qBAAqB,QAAQ;AAAA,MAC7B,aAAa,QAAQ;AAAA,IACvB,CAAC;AACD,UAAM,WAAW,cAAc;AAC/B,UAAM,oBAAoB,cAAc;AACxC,UAAM,8BAA8B,QAAQ;AAC5C,UAAM,0BAA0B,QAAQ;AACxC,UAAM,qBAAqB,cAAc;AACzC,UAAM,sBAAsB,qBACxB,SACA,6BAA6B,UAAU;AAAA,MACrC,SAAS;AAAA,MACT,kBAAkB;AAAA,MAClB,aAAa;AAAA,MACb,iBAAiB;AAAA,MACjB,iBAAiB;AAAA,MACjB,aAAa;AAAA,MACb,mBAAmB;AAAA,IACrB,CAAC;AACL,UAAM,qBAEF;AAAA,MACF,OAAO;AAAA,MACP,iBAAiB;AAAA,MACjB,aAAa;AAAA,MACb,GAAI,sBAAsB,EAAE,oBAAoB,IAAI,CAAC;AAAA,MACrD,OAAO,oBAAoB,UAAU,QAAQ,KAAK;AAAA,MAClD,gBAAgB,QAAQ;AAAA,IAC1B;AACA,UAAM,WAAW,MAAM,4BAA4B,IAAI;AAAA,MACrD,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,WAAW,MAAM;AAAA,MACjB,YAAY,MAAM;AAAA,MAClB,6BAA6B,SAAS,4BAA4B;AAAA;AAAA;AAAA,MAGlE,aAAa;AAAA,QACX,YAAY,SAAS;AAAA,QACrB,OAAO,SAAS;AAAA,MAClB;AAAA;AAAA;AAAA;AAAA,MAIA,WAAW,OAAO,IAAI,eAAe;AAInC,cAAM,aAAa,aACf,MAAM,eAAe,IAAI,MAAM,aAAa,WAAW,EAAE,IACzD;AACJ,YAAI,eAAe,CAAC,cAAc,WAAW,cAAc,MAAM,YAAY;AAC3E,gBAAM,IAAI,MAAM,8CAA8C;AAAA,QAChE;AACA,cAAM,eAAeC,2BAA0B,YAAY,QAAQ;AACnE,YAAI,qBAAqB;AACvB,gBAAM,wBAAwB;AAAA,YAC5B,aAAa,SAAS,UAAU,aAAa,SAAS;AAAA,YACtD,QAAQ;AAAA,UACV;AACA,6BAAmB,sBAAsB,wBACrC,EAAE,GAAG,qBAAqB,sBAAsB,IAChD;AAAA,QACN;AAGA,cAAM,oBAAoB,qBACtB,OACA,MAAM,6BAA6B,IAAI;AAAA,UACrC,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,WAAW,MAAM;AAAA,QACnB,CAAC;AACL,YAAI,mBAAmB;AACrB,uCAA6B,QAAQ,eAAe,QAAQ,SAAS;AAAA,QACvE;AACA,cAAM,gBAAgB,qBAClB,OACC,qBACA,MAAM;AAAA,UACL,EAAE,GAAG,SAAS,UAAU,IAAI,GAAG;AAAA,UAC/B;AAAA,YACE,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,OAAO;AAAA,YACP,0BAA0B,YAAY,4BAA4B;AAAA,UACpE;AAAA,QACF;AACJ,cAAM,eAAe,qBACjB,cAAc,eACd,eAAe;AACnB,eAAO;AAAA,UACL,eAAe,sBAAsB,eAAe,WAAW;AAAA,UAC/D,GAAI,eAAe,EAAE,oBAAoB,aAAa,IAAI,CAAC;AAAA,QAC7D;AAAA,MACF;AAAA,MACA,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,MAKR,QAAQ,CAAC,MAAM,kBAAkB,QAAQ;AACvC,cAAM,2BAA2B;AAAA,UAC/B;AAAA,UACA;AAAA,UACA,UAAU;AAAA,QACZ;AACA,eAAO,uBAAuB,MAAM,kBAAkB,KAAK;AAAA,UACzD,oBAAoB,yBAAyB,SAAS,gBAAgB;AAAA,UACtE,4BAA4B,yBAAyB;AAAA,YACnD;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AACD,QAAI,SAAS,OAAO,SAAS,GAAG;AAC9B,YAAM,IAAI,QAAQ,MAAM,aAAa,MAAM,WAAW,SAAS,MAAM;AAAA,IACvE;AACA,WAAO,EAAE,QAAQ,SAAS,OAAO;AAAA,EACnC;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;AAUO,SAAS,uBACd,OACA,mBACA,MACA,UAAkF,CAAC,GAC3E;AACR,QAAM,kBAAkB,QAAQ,qBAC5B;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IACA,CAAC;AACL,QAAM,sBAAsB;AAAA,IAC1B;AAAA,IACA,4JACG,QAAQ,6BACL,gLACA,MACJ;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AASO,SAAS,oBAAoB,UAAoB,OAA6B;AACnF,MAAI,CAAC,SAAS,WAAW,KAAK,CAAC,WAAW,OAAO,OAAO,UAAU,GAAG;AACnE,WAAO;AAAA,EACT;AACA,SAAO,cAAc,OAAO,CAAC,EAAE,MAAM,OAAO,IAAI,WAAW,CAAC,CAAC;AAC/D;;;AEpTA;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAAC,0BAAyB;AAClC,SAAS,yBAAyB;AAClC,SAAS,oCAAoC;AAC7C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,iBAAiB;AAC1B;AAAA,EACE;AAAA,OAGK;AACP;AAAA,EACE;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAMK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAIK;AACP,SAAS,mBAAmB,mBAAmB,uBAAuB;AACtE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,yBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AACP,SAAS,+BAA+B;;;AC9EjC,IAAM,oCAAN,cAAgD,MAAM;AAAA,EAC3D,cAAc;AACZ,UAAM,wCAAwC;AAC9C,SAAK,OAAO;AAAA,EACd;AACF;AAQA,eAAsB,yBAAyB,OAUzB;AACpB,QAAM,MAAM,MAAM,OAAO,KAAK;AAC9B,QAAMC,SAAQ,MAAM,SAAS,IAAI;AACjC,MAAI,oBAAoB;AAExB,WAAS,UAAU,GAAG,WAAW,MAAM,OAAO,UAAU,WAAW,GAAG;AACpE,QAAI;AACJ,UAAM,YAAY,EAAE,WAAW,MAAM,WAAW,SAAS,OAAO,gBAAgB,CAAC;AACjF,QAAI;AACF,iBAAW,MAAM,MAAM,UAAU,MAAM,KAAK;AAAA,QAC1C,GAAG,MAAM;AAAA,QACT,UAAU;AAAA,QACV,QAAQ,YAAY,QAAQ,MAAM,OAAO,gBAAgB;AAAA,MAC3D,CAAC;AAAA,IACH,QAAQ;AACN,YAAM,YAAY,EAAE,WAAW,MAAM,WAAW,SAAS,OAAO,cAAc,CAAC;AAC/E,oBAAc,MAAM,eAAe,MAAM,WAAW,iBAAiB;AACrE,YAAMC,WAAU,aAAa,MAAM,QAAQ,SAAS,IAAI;AACxD,UAAI,CAAC,SAAS,MAAM,QAAQ,SAAS,mBAAmBA,QAAO,GAAG;AAChE,cAAM,IAAI,kCAAkC;AAAA,MAC9C;AACA,kBAAY,MAAM,eAAe,MAAM,WAAW,aAAa,SAASA,QAAO;AAC/E,2BAAqBA;AACrB,YAAM,YAAY,EAAE,WAAW,MAAM,WAAW,SAAS,OAAO,oBAAoB,CAAC;AACrF,YAAMD,OAAMC,QAAO;AACnB,YAAM,YAAY,EAAE,WAAW,MAAM,WAAW,SAAS,OAAO,kBAAkB,CAAC;AACnF;AAAA,IACF;AACA,UAAM,YAAY,EAAE,WAAW,MAAM,WAAW,SAAS,OAAO,cAAc,CAAC;AAE/E,QAAI,CAAC,kBAAkB,SAAS,MAAM,GAAG;AACvC;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,SAAS,KAAK,cAAc;AAAA,MAC9B;AACA,aAAO;AAAA,IACT;AAEA,kBAAc,MAAM,eAAe,MAAM,WAAW,iBAAiB;AACrE,UAAM,UAAU;AAAA,MACd,MAAM;AAAA,MACN;AAAA,MACA,kBAAkB,SAAS,QAAQ,IAAI,aAAa,GAAG,IAAI,CAAC;AAAA,IAC9D;AACA,QAAI,CAAC,SAAS,MAAM,QAAQ,SAAS,mBAAmB,OAAO,EAAG,QAAO;AACzE,UAAM,SAAS,MAAM,OAAO,EAAE,MAAM,MAAM,MAAS;AACnD;AAAA,MACE,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS,WAAW,MAAM,iBAAiB;AAAA,MAC3C;AAAA,MACA;AAAA,IACF;AACA,yBAAqB;AACrB,UAAM,YAAY,EAAE,WAAW,MAAM,WAAW,SAAS,OAAO,oBAAoB,CAAC;AACrF,UAAMD,OAAM,OAAO;AACnB,UAAM,YAAY,EAAE,WAAW,MAAM,WAAW,SAAS,OAAO,kBAAkB,CAAC;AAAA,EACrF;AAEA,QAAM,IAAI,kCAAkC;AAC9C;AAEA,SAAS,SACP,QACA,SACA,mBACA,SACS;AACT,SAAO,UAAU,OAAO,YAAY,oBAAoB,WAAW,OAAO;AAC5E;AAEA,SAAS,aACP,QACA,SACA,cACQ;AACR,QAAM,cAAc,KAAK;AAAA,IACvB,OAAO;AAAA,IACP,OAAO,iBAAiB,KAAK,KAAK,IAAI,GAAG,UAAU,CAAC;AAAA,EACtD;AACA,SAAO,KAAK,IAAI,OAAO,YAAY,KAAK,IAAI,aAAa,gBAAgB,CAAC,CAAC;AAC7E;AAEA,SAAS,kBAAkB,OAAsB,OAA8B;AAC7E,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAU,OAAO,KAAK;AAC5B,MAAI,OAAO,SAAS,OAAO,KAAK,WAAW,EAAG,QAAO,KAAK,MAAM,UAAU,GAAK;AAC/E,QAAM,YAAY,KAAK,MAAM,KAAK;AAClC,SAAO,OAAO,SAAS,SAAS,IAAI,KAAK,IAAI,GAAG,YAAY,KAAK,IAAI;AACvE;AAEA,SAAS,kBAAkB,QAAyB;AAClD,SAAO,WAAW,OAAO,UAAU;AACrC;AAEA,SAAS,cACP,eACA,WACA,SACM;AACN,gBAAc,iBAAiB;AAAA,IAC7B,MAAM;AAAA,IACN,MAAM;AAAA,IACN,QAAQ,EAAE,WAAW,QAAQ;AAAA,EAC/B,CAAC;AACH;AAEA,SAAS,YACP,eACA,WACA,QACA,SACA,SACM;AACN,gBAAc,iBAAiB;AAAA,IAC7B,MAAM;AAAA,IACN,MAAM;AAAA,IACN,QAAQ,EAAE,WAAW,OAAO;AAAA,EAC9B,CAAC;AACD,gBAAc,iBAAiB;AAAA,IAC7B,MAAM;AAAA,IACN,MAAM;AAAA,IACN,QAAQ,EAAE,WAAW,OAAO;AAAA,IAC5B,OAAO,UAAU;AAAA,IACjB,SAAS,CAAC,KAAK,MAAM,KAAK,GAAG,GAAG,GAAG,IAAI,IAAI,EAAE;AAAA,EAC/C,CAAC;AACD,gBAAc,KAAK,iDAAiD;AAAA,IAClE,UAAU;AAAA,IACV;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;;;ACjLA,SAAS,kBAAkB;AAE3B;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAEP,IAAM,kBAAkB;AACxB,IAAM,wBAAwB;AAC9B,IAAM,qBAAqB;AA4DpB,SAAS,8BACd,OACA,UAMiC;AACjC,MAAI,CAAC,SAAS,MAAM,YAAY,KAAK,MAAM,SAAS,uBAAwB,QAAO;AACnF,MACE,MAAM,iBAAiB,SAAS,gBAChC,MAAM,uBAAuB,SAAS,sBACtC,MAAM,aAAa,SAAS,YAC5B,MAAM,YAAY,SAAS,WAC3B,OAAO,MAAM,eAAe,YAC5B,MAAM,WAAW,SAAS,KAC1B,MAAM,WAAW,SAAS,yBAC1B,OAAO,MAAM,cAAc,YAC3B,MAAM,UAAU,SAAS,KACzB,MAAM,UAAU,SAAS,mBACzB,OAAO,MAAM,qBAAqB,YAClC,CAAC,OAAO,cAAc,MAAM,gBAAgB,KAC5C,MAAM,mBAAmB,KACzB,OAAO,MAAM,6BAA6B,YAC1C,CAAC,OAAO,SAAS,KAAK,MAAM,MAAM,wBAAwB,CAAC,KAC3D,OAAO,MAAM,6BAA6B,YAC1C,CAAC,OAAO,SAAS,KAAK,MAAM,MAAM,wBAAwB,CAAC,GAC3D;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,8BAA8B,OAUjB;AAC3B,SAAO;AAAA,IACL,SAAS;AAAA,IACT,MAAM;AAAA,IACN,cAAc,MAAM;AAAA,IACpB,oBAAoB,MAAM;AAAA,IAC1B,UAAU,MAAM;AAAA,IAChB,SAAS,MAAM;AAAA,IACf,YAAY,kBAAkB,MAAM,UAAU;AAAA,IAC9C,WAAW,aAAa,MAAM,SAAS;AAAA,IACvC,kBAAkB,MAAM,qBAAqB;AAAA,IAC7C,0BAA0B,MAAM,aAAa,YAAY;AAAA,IACzD,0BAA0B,IAAI;AAAA,MAC5B,MAAM,aAAa,QAAQ,IAAI,MAAM;AAAA,IACvC,EAAE,YAAY;AAAA,EAChB;AACF;AAEO,SAAS,gCACd,QACA,WAC0B;AAC1B,SAAO;AAAA,IACL,GAAG;AAAA,IACH,WAAW,aAAa,SAAS;AAAA,IACjC,kBAAkB,OAAO,mBAAmB;AAAA,EAC9C;AACF;AAEO,SAAS,iCAAiC,QAAkC,KAAW;AAC5F,SAAO,KAAK,MAAM,OAAO,wBAAwB,KAAK,IAAI,QAAQ;AACpE;AAEA,eAAsB,oCAAoC,OAGtC;AAClB,MAAI,MAAM,OAAO,OAAO,UAAU,MAAM,OAAO,YAAY,MAAM;AAC/D,WAAO,kBAAkB,MAAM,OAAO,EAAE;AAAA,EAC1C;AACA,QAAM,OAAO,MAAM,MAAM,QAAQ,MAAM;AACvC,MAAI,CAAC,QAAQ,KAAK,aAAa,iCAAiC,KAAK,SAAS;AAC5E,UAAM,IAAI,gCAAgC,oCAAoC;AAAA,EAChF;AACA,SAAO,kBAAkB,KAAK,EAAE;AAClC;AAEO,SAAS,kCACd,OACA,QACqC;AACrC,MAAI;AACF,WAAO,oBAAoB,OAAO,MAAM;AAAA,EAC1C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,wBAAwB,OAaH;AACzC,QAAM,MAAM,MAAM,OAAO,KAAK;AAC9B,QAAM,YAAY,IAAI;AACtB,QAAM,aAAa,MAAM,aAAa,oBAAoB,MAAM,YAAY,KAAK,IAAI;AACrF,MAAI,YAAY,aAAa,YAAY,aAAa,MAAM,OAAO,SAAS;AAC5E,MAAI,6BAA6B,YAAY,8BAA8B;AAC3E,QAAM,sBAAsB,IAAI,IAAI,YAAY,uBAAuB,CAAC,CAAC;AACzE,QAAM,gBAAgB,YAAY,UAAU,YAAY;AACxD,QAAM,SAAS,EAAE,GAAG,cAAc;AAClC,QAAM,UAAU,oBAAI,IAAuC;AAE3D,SAAO,MAAM;AACX,UAAM,sBAAsB,KAAK,IAAI,GAAG,IAAI,IAAI,SAAS;AACzD,WAAO,YAAY,cAAc,YAAY;AAC7C,UAAM,aAAa,YAAY,QAAQ,OAAO,mBAAmB;AACjE,QAAI,YAAY;AACd,aAAO;AAAA,QACL,QAAQ;AAAA,QACR;AAAA,QACA,SAAS,CAAC,GAAG,QAAQ,OAAO,CAAC;AAAA,QAC7B,YAAY;AAAA,UACV,SAAS;AAAA,UACT;AAAA,UACA;AAAA,UACA,qBAAqB,CAAC,GAAG,mBAAmB;AAAA,UAC5C,QAAQ,EAAE,GAAG,OAAO;AAAA,QACtB;AAAA,QACA,mBAAmB;AAAA,QACnB;AAAA,QACA,kBAAkB,OAAO;AAAA,QACzB,WAAW,OAAO;AAAA,QAClB,QAAQ,EAAE,GAAG,OAAO;AAAA,QACpB,kBACE,eAAe,wBAAwB,OAAO,aAAa,MAAM;AAAA,MACrE;AAAA,IACF;AAEA,UAAM,gBAAgB,WAAW,QAAQ,EAAE,OAAO,SAAS,EAAE,OAAO,KAAK;AACzE,QAAI,oBAAoB,IAAI,aAAa,GAAG;AAC1C,YAAM,IAAI,gCAAgC,uCAAuC;AAAA,IACnF;AACA,wBAAoB,IAAI,aAAa;AACrC,WAAO,oBAAoB;AAC3B,UAAM,WAAW,KAAK,IAAI,KAAK,MAAM,WAAW,OAAO,aAAa;AACpE,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,MAAM,YAAY,WAAW,QAAQ;AAAA,IACpD,SAAS,OAAO;AACd,aAAO,YAAY,cAAc,YAAY,KAAK,IAAI,GAAG,IAAI,IAAI,SAAS;AAC1E,UAAI,iBAAiB,8BAA+B,OAAM,SAAS,EAAE,GAAG,OAAO;AAC/E,YAAM;AAAA,IACR;AACA,QAAI,KAAK,QAAQ,SAAS,UAAU;AAClC,YAAM,IAAI,gCAAgC,+CAA+C;AAAA,IAC3F;AACA,WAAO,iBAAiB,KAAK,QAAQ;AAErC,UAAM,mBAAmB,oBAAI,IAAY;AACzC,eAAW,UAAU,KAAK,SAAS;AACjC,UAAI,OAAO,WAAW,CAAC,OAAO,QAAQ,OAAO,KAAK,SAAS;AACzD,yBAAiB,IAAI,OAAO,MAAM;AAClC;AAAA,MACF;AACA,YAAM,aAAa,MAAM,eAAe;AAAA,QACtC,MAAM,OAAO;AAAA,QACb,YAAY,MAAM,OAAO;AAAA,QACzB,SAAS,OAAO,WAAW;AACzB,gBAAM,oBAAoB,KAAK,IAAI,GAAG,IAAI,IAAI,SAAS;AACvD,iBAAO,YAAY,cAAc,YAAY;AAC7C,cACE,OAAO,oBAAoB,MAAM,uBACjC,OAAO,aAAa,MAAM,gBAC1B,qBAAqB,MAAM,wBAC3B;AACA,mBAAO;AAAA,UACT;AACA,iBAAO,oBAAoB;AAC3B,gBAAM,SAAS,MAAM,MAAM,QAAQ,MAAM;AACzC,iBAAO,YAAY,cAAc,YAAY,KAAK,IAAI,GAAG,IAAI,IAAI,SAAS;AAC1E,iBAAO;AAAA,QACT;AAAA,MACF,CAAC;AACD,UAAI,OAAO,KAAK,aAAa,+BAA+B;AAC1D,gBAAQ,OAAO,OAAO,MAAM;AAC5B,YAAI,eAAe,UAAW,8BAA6B;AAAA,YACtD,kBAAiB,IAAI,OAAO,MAAM;AACvC;AAAA,MACF;AACA,UAAI,eAAe,UAAU;AAC3B,gBAAQ,IAAI,OAAO,QAAQ,iBAAiB,OAAO,MAAM,MAAM,QAAQ,MAAM,YAAY,CAAC;AAAA,MAC5F,WAAW,eAAe,WAAW;AACnC,gBAAQ,OAAO,OAAO,MAAM;AAC5B,qCAA6B;AAAA,MAC/B,OAAO;AACL,yBAAiB,IAAI,OAAO,MAAM;AAAA,MACpC;AAAA,IACF;AACA,QAAI,iBAAiB,OAAO,GAAG;AAC7B,iBAAW,UAAU,kBAAkB;AACrC,YAAI,QAAQ,OAAO,MAAM,EAAG,8BAA6B;AAAA,MAC3D;AACA,YAAM,WAAW,MAAM,MAAM,0BAA0B,CAAC,GAAG,gBAAgB,CAAC;AAC5E,UAAI,SAAS,OAAO,EAAG,8BAA6B;AAAA,IACtD;AACA,QAAI,KAAK,eAAe;AACtB,kBAAY,aAAa,KAAK,aAAa;AAC3C;AAAA,IACF;AACA,QAAI,CAAC,KAAK,mBAAmB;AAC3B,YAAM,IAAI,gCAAgC,6CAA6C;AAAA,IACzF;AACA,WAAO,YAAY,cAAc,YAAY,KAAK,IAAI,GAAG,IAAI,IAAI,SAAS;AAC1E,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,SAAS,CAAC,GAAG,QAAQ,OAAO,CAAC;AAAA,MAC7B,YAAY;AAAA,MACZ,mBAAmB,aAAa,KAAK,iBAAiB;AAAA,MACtD;AAAA,MACA,kBAAkB,OAAO;AAAA,MACzB,WAAW,OAAO;AAAA,MAClB,QAAQ,EAAE,GAAG,OAAO;AAAA,MACpB,kBAAkB;AAAA,IACpB;AAAA,EACF;AACF;AAEA,eAAe,eAAe,OAIgB;AAC5C,MAAI,MAAM,KAAK,OAAO,MAAM,WAAY,QAAO;AAC/C,MAAI,UAAU,MAAM,KAAK;AACzB,QAAM,OAAO,oBAAI,IAAY,CAAC,MAAM,KAAK,EAAE,CAAC;AAC5C,WAAS,QAAQ,GAAG,QAAQ,oBAAoB,SAAS,GAAG;AAC1D,QAAI,QAAQ,SAAS,MAAM,UAAU,EAAG,QAAO;AAC/C,UAAM,OAAO,QAAQ,KAAK,CAACE,YAAW,CAAC,KAAK,IAAIA,OAAM,CAAC;AACvD,QAAI,CAAC,KAAM,QAAO;AAClB,SAAK,IAAI,IAAI;AACb,UAAM,SAAS,MAAM,MAAM,QAAQ,IAAI;AACvC,QAAI,CAAC,OAAQ,QAAO;AACpB,cAAU,OAAO;AAAA,EACnB;AACA,SAAO;AACT;AAEA,SAAS,iBACP,MACA,QACA,cAC2B;AAC3B,SAAO;AAAA,IACL,kBAAkB,KAAK;AAAA,IACvB,mBAAmB,KAAK,WAAW,KAAK,gBAAgB,KAAK;AAAA,IAC7D,UAAU,OAAO;AAAA,IACjB,gBAAgB,KAAK,QAAQ,CAAC,KAAK,OAAO;AAAA,IAC1C,SAAS,KAAK,WAAW,OAAO;AAAA,IAChC,OAAO,KAAK;AAAA,IACZ,UAAU,KAAK;AAAA,IACf,cAAc,KAAK;AAAA,IACnB,aAAa,KAAK;AAAA,IAClB,WACE,KAAK,eAAe,oCAAoC,mBAAmB,KAAK,EAAE,CAAC;AAAA,IACrF,UAAU,wBAAwB,MAAM,YAAY;AAAA,EACtD;AACF;AAEA,SAAS,oBACP,OACA,QAC8B;AAC9B,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AACA,QAAM,aAAa;AACnB,QAAM,SAAS,WAAW;AAC1B,MACE,WAAW,YAAY,KACvB,OAAO,WAAW,+BAA+B,aACjD,CAAC,MAAM,QAAQ,WAAW,mBAAmB,KAC7C,WAAW,oBAAoB,KAAK,CAAC,SAAS,CAAC,iBAAiB,KAAK,IAAI,CAAC,KAC1E,IAAI,IAAI,WAAW,mBAAmB,EAAE,SAAS,WAAW,oBAAoB,UAChF,WAAW,oBAAoB,SAAS,OAAO,uBAC/C,CAAC,UACD,OAAO,WAAW,UAClB;AACA,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AACA,MAAI,OAAO,WAAW,cAAc,UAAU;AAC5C,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AACA,eAAa,WAAW,SAAS;AACjC,QAAM,YAAY;AAClB,aAAW,CAAC,KAAK,OAAO,KAAK;AAAA,IAC3B,CAAC,iBAAiB,OAAO,QAAQ;AAAA,IACjC,CAAC,oBAAoB,OAAO,mBAAmB;AAAA,IAC/C,CAAC,aAAa,OAAO,YAAY;AAAA,EACnC,GAAY;AACV,UAAM,cAAc,UAAU,GAAG;AACjC,QACE,CAAC,OAAO,cAAc,WAAW,KACjC,OAAO,WAAW,IAAI,KACtB,OAAO,WAAW,IAAI,SACtB;AACA,YAAM,IAAI,MAAM,gDAAgD;AAAA,IAClE;AAAA,EACF;AACA,MAAI,WAAW,oBAAoB,SAAS,OAAO,UAAU,gBAAgB,GAAG;AAC9E,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,SAAO;AACT;AAEA,SAAS,YACP,QACA,OAMA,qBACqC;AACrC,MAAI,OAAO,iBAAiB,MAAM,SAAU,QAAO;AACnD,MAAI,OAAO,oBAAoB,MAAM,oBAAqB,QAAO;AACjE,MACE,OAAO,aAAa,MAAM,gBAC1B,uBAAuB,MAAM,wBAC7B;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,cAAqC;AAC5C,SAAO,EAAE,eAAe,GAAG,kBAAkB,GAAG,WAAW,EAAE;AAC/D;AAEA,SAAS,aAAa,OAAuB;AAC3C,MAAI,MAAM,SAAS,KAAK,MAAM,SAAS,iBAAiB;AACtD,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACtD;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,OAAuB;AAChD,MAAI,MAAM,SAAS,KAAK,MAAM,SAAS,uBAAuB;AAC5D,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AACA,SAAO;AACT;AAEO,IAAM,gCAAN,cAA4C,MAAM;AAAA,EACvD,SAAuC;AAAA,EAEvC,cAAc;AACZ,UAAM,qCAAqC;AAC3C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,kCAAN,cAA8C,MAAM;AAAA,EACzD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;;;AFnUA,IAAM,yBAAyB,IAAI,kBAA0C;AAC7E,IAAM,cAA4B,OAAO;AAAA,EACvC,UAAU,SAAmC;AAC3C,UAAM,uBAAuB,SAAS,IAAI;AAC1C,WAAO,MAAM,GAAG,IAAI;AAAA,EACtB;AAAA,EACA,EAAE,YAAY,MAAM,WAAW;AACjC;AAEA,IAAM,iBAAiB;AACvB,IAAM,uBAAuB,IAAI,OAAO;AACxC,IAAM,+CAA+C,KAAK,KAAK,KAAK;AACpE,IAAM,wCAAwC;AAC9C,IAAM,8CAA8C,IAAI,OAAO;AAC/D,IAAM,gCAAgC,KAAK,KAAK,KAAK;AACrD,IAAM,kCAAkC;AACxC,IAAM,qBAAqB;AAC3B,IAAM,2BAA2B,IAAI,OAAO;AAsBrC,SAAS,+BAA+B,MAAoC;AACjF,SAAO,SAAS,iBACZ,EAAE,kBAAkB,qBAA8B,2BAA2B,KAAK,IAClF,EAAE,kBAAkB,qBAA8B,2BAA2B,MAAM;AACzF;AAEO,SAAS,oCACd,UACA,yBACA;AACA,QAAM,qBAAqB,yBAAyB,UAAU,uBAAuB;AACrF,SAAO;AAAA,IACL,6BAA6B,OAC3B,UAC+C;AAC/C,YAAM,EAAE,UAAU,IAAI,eAAe,cAAc,IAAI,MAAM,SAAS;AACtE,UAAI,CAAC,cAAe,OAAM,IAAI,MAAM,kCAAkC;AAGtE,UAAI,CAAC,MAAM;AACT,eAAO,EAAE,QAAQ,UAAU,cAAc,OAAO,WAAW,0BAA0B;AACvF,YAAM,UAAU;AAAA,QACd,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,OAAO,MAAM;AAAA,MACf;AACA,UAAI,cAA+D;AACnE,YAAM,YAAY,YAAY;AAC5B,cAAM,SAAS,MAAM,0BAA0B,IAAI,OAAO;AAC1D,YAAI,OAAO,uBAAuB,MAAM;AACtC,gBAAM,IAAI,MAAM,yDAAyD;AAC3E,YAAI,aAAa;AACf,gBAAM,CAAC,aAAa,UAAU,IAAI,MAAM,QAAQ,IAAI;AAAA,YAClD,iBAAiB,IAAI,MAAM,aAAa,MAAM,MAAM;AAAA,YACpDC;AAAA,cACE;AAAA,cACA,MAAM;AAAA,cACN,YAAY,WAAW;AAAA,cACvB,YAAY;AAAA,YACd;AAAA,UACF,CAAC;AACD,gBAAM,UAAU,aAAa,SAAS;AAGtC,cACE,CAAC,eACD,YAAY,WAAW,YACvB,SAAS,kBAAkB,SAC3B,SAAS,qBAAqB,QAC9B,CAACC,mBAAkB,6BAA6B,WAAW,GAAG,WAAW,KACzE,CAAC,cACD,WAAW,WAAW,YACtB,WAAW,YAAY,YAAY,WAAW,qBAC9C,WAAW,cAAc,YAAY,WAAW;AAEhD,kBAAM,IAAI,YAAY,qBAAqB,KAAK;AAAA,QACpD;AACA,eAAO;AAAA,MACT;AACA,YAAM,UAAU;AAChB,YAAM,WAAW,MAAM,qCAAqC,IAAI;AAAA,QAC9D,aAAa,MAAM;AAAA,QACnB,OAAO,MAAM;AAAA,MACf,CAAC;AACD,YAAM,OAAO,UAAU;AACvB,YAAM,SAAS,OAAO,6BAA6B,IAAI,IAAI;AAC3D,YAAM,WAAW,MAAM,iBAAiB,IAAI,MAAM,aAAa,MAAM,MAAM;AAC3E,UACE,CAAC,QACD,CAAC,UACD,CAAC,YACD,SAAS,WAAW,YACpB,KAAK,OAAO,MAAM,UAClB,KAAK,cAAc,MAAM,aACzB,KAAK,OAAO,SAAS,gBACrB,OAAO,aAAa,MAAM,YAC1B,SAAS,yBAAyB,OAAO,qBACzC;AACA,eAAO,EAAE,QAAQ,UAAU,cAAc,MAAM;AAAA,MACjD;AACA,UAAI,+BAA+B,MAAM;AACvC,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,cAAc;AAAA,UACd,WAAW;AAAA,QACb;AACF,oBAAc;AACd,YAAM,UAAU;AAChB,YAAM,+BAA+B,IAAI,IAAI;AAC7C,YAAM,8BAA8B,IAAI;AAAA,QACtC,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,UAAU,MAAM;AAAA,QAChB,iBAAiB,KAAK;AAAA,QACtB,oBAAoB,MAAM;AAAA,QAC1B,OAAO;AAAA,QACP,aAAa,gBAAgB,MAAM,kBAAkB;AAAA,QACrD,wBAAwB,OAAO;AAAA,QAC/B,2BAA2B,OAAO;AAAA,MACpC,CAAC;AACD,YAAM,gBACJ,OAAO,WAAW,mBAAmB,4BACjC,cACA;AACN,UACE,OAAO,uBAAuB,MAAM,eACpC,OAAO,0BAA0B,KACjC,CAAC,OAAO,yBACR;AACA,eAAO,MAAM,oBAAoB,mBAAmB;AAAA,MACtD;AACA,YAAM,QAAQ,MAAM,8BAA8B,IAAI;AAAA,QACpD,GAAG;AAAA,QACH,eAAe,MAAM;AAAA,MACvB,CAAC;AACD,UAAI,MAAM,WAAW,WAAW;AAC9B,sBAAc,iBAAiB;AAAA,UAC7B,MAAM;AAAA,UACN,QAAQ,EAAE,UAAU,eAAe,SAAS,MAAM,OAAO;AAAA,QAC3D,CAAC;AACD,eAAO,EAAE,QAAQ,MAAM,OAAO;AAAA,MAChC;AAEA,UAAI,iBAAgC;AACpC,UAAI,6BAA4C;AAChD,YAAM,YAAY,KAAK,IAAI;AAC3B,YAAM,UAAyC;AAAA,QAC7C,OAAO;AAAA,QACP,SAAS;AAAA,QACT,UAAU;AAAA,QACV,WAAW;AAAA,QACX,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,kBAAkB;AAAA,QAClB,WAAW;AAAA,QACX,SAAS;AAAA,QACT,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,cAAc;AAAA,QAOd,cAAc;AAAA,QACd,mBAAmB;AAAA,QACnB,UAAU,CAAC;AAAA,MACb;AACA,oBAAc,KAAK,iCAAiC;AAAA,QAClD,UAAU;AAAA,QACV,SAAS;AAAA,MACX,CAAC;AACD,UAAI;AACF,gBAAQ,QAAQ;AAChB,cAAM,WAAW,MAAM,mCAAmC,IAAI;AAAA,UAC5D,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,UAAU,MAAM;AAAA,UAChB,qBAAqB,OAAO;AAAA,QAC9B,CAAC;AACD,YAAI,CAAC,YAAY,SAAS,OAAO,mBAAmB,UAAU;AAC5D,gBAAM,IAAI,YAAY,qBAAqB,KAAK;AAAA,QAClD;AACA,YACE,wBAAwB,SAAS,OAAO,KAAK,MAC7C,wBAAwB,OAAO,WAAW,GAC1C;AACA,gBAAM,IAAI,YAAY,qBAAqB,KAAK;AAAA,QAClD;AACA,cAAM,YAAY,MAAM,2CAA2C,IAAI;AAAA,UACrE,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,UAAU,MAAM;AAAA,UAChB,oBAAoB,MAAM;AAAA,UAC1B,qBAAqB,OAAO;AAAA,UAC5B,wBAAwB,OAAO;AAAA,UAC/B,2BAA2B,OAAO;AAAA,UAClC,0BAA0B,SAAS,OAAO;AAAA,QAC5C,CAAC;AACD,qCAA6B,SAAS,OAAO;AAC7C,cAAM,kBAAkB,sBAAsB,MAAM,kBAAkB;AACtE,cAAM,cAAc,MAAM,oCAAoC,IAAI;AAAA,UAChE,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,UAAU,MAAM;AAAA,UAChB,aAAa;AAAA,UACb,qBAAqB,OAAO;AAAA,QAC9B,CAAC;AACD,YAAI,eAAe,YAAY,UAAU,WAAW;AAClD,gBAAM,kBAAkB,8BAA8B,MAAM,YAAY,QAAQ;AAChF,gBAAM,kBAAwE;AAAA,YAC5E,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,UAAU,MAAM;AAAA,YAChB,oBAAoB,MAAM;AAAA,YAC1B,oBAAoB,YAAY;AAAA,YAChC,QAAQ,YAAY,UAAU,cAAc,cAAc;AAAA,YAC1D,SAAS;AAAA,YACT,OAAO,YAAY;AAAA,YACnB,wBAAwB,OAAO;AAAA,YAC/B,2BAA2B,OAAO;AAAA,YAClC,sBAAsB,YAAY;AAAA,YAClC,+BACE,YAAY,UAAU,cAAc,YAAY,sBAAsB,IAAI;AAAA,YAC5E,GAAI,YAAY,UAAU,eAC1B,YAAY,SAAS,kBACrB,OAAO,YAAY,SAAS,mBAAmB,WAC3C;AAAA,cACE,gBAAgB,YAAY,SAAS;AAAA,YACvC,IACA,CAAC;AAAA,UACP;AACA,gBAAMC,WACJ,YAAY,UAAU,YAAY,gBAAgB,oBAC9C,MAAM,+CAA+C,IAAI;AAAA,YACvD,iBAAiB;AAAA,cACf,WAAW,MAAM;AAAA,cACjB,aAAa,MAAM;AAAA,cACnB,UAAU,MAAM;AAAA,cAChB,UAAU,OAAO;AAAA,cACjB,aAAa,8BAA8B,MAAM,QAAQ,IAAI,OAAO,WAAW,iBAAiB,IAAI,YAAY,aAAa,+BAA+B;AAAA,cAC5J,YAAY;AAAA,cACZ,OAAO;AAAA,gBACL,MAAM;AAAA,gBACN,WAAW;AAAA,gBACX,0BAA0B,OAAO;AAAA,cACnC;AAAA,YACF;AAAA,YACA,YAAY;AAAA,UACd,CAAC,IACD,MAAM,+BAA+B,IAAI,eAAe;AAC9D,gBAAM,qBAAqB,aAAa,gBAAgB,SAAS,MAAM;AACvE,gBAAM,qBAAqB,SAAS,gBAAgB,UAAU,MAAM;AACpE,gBAAM,qBAAqB,SAAS,gBAAgB,OAAO,MAAM;AACjE,iBAAO;AAAA,YACL,QAAQ,YAAY,UAAU,cAAc,aAAa;AAAA,YACzD,SAAS;AAAA,YACT,GAAI,YAAY,YAAY,EAAE,WAAW,YAAY,UAAU,IAAI,CAAC;AAAA,YACpE,cAAcA,SAAQ;AAAA,YACtB,4BAA4BA,SAAQ;AAAA,UACtC;AAAA,QACF;AACA,cAAM,WAAW,MAAM,6BAA6B;AAAA,UAClD;AAAA,UACA;AAAA,UACA;AAAA,UACA,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB;AAAA,UACA,UAAU,MAAM;AAAA,UAChB,kBAAkB,SAAS,OAAO;AAAA,QACpC,CAAC;AACD,cAAM,sBAAsB,SAAS;AACrC,cAAM,oBAAoB,+BAA+B,SAAS,IAAI;AAEtE,YAAI,gBAAgB,SAAS,OAAO;AACpC,YAAI,MAAM,gBACN,MAAM,sCAAsC,IAAI;AAAA,UAC9C,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,UAAU,MAAM;AAAA,UAChB,YAAY;AAAA,UACZ,qBAAqB,OAAO;AAAA,QAC9B,CAAC,IACD;AACJ,cAAM,QAAQ;AAAA,UACZ,MAAM;AAAA,UACN,WAAW;AAAA,UACX,0BAA0B,OAAO;AAAA,QACnC;AACA,YAAI,CAAC,KAAK;AACR,gBAAM,MAAM,gCAAgC,IAAI;AAAA,YAC9C,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,UAAU,MAAM;AAAA,YAChB,UAAU,OAAO;AAAA,YACjB,mCAAmC,SAAS,OAAO;AAAA,YACnD,uBAAuB;AAAA,YACvB,YAAY;AAAA,YACZ,aAAa;AAAA,YACb,aAAa,sBAAsB,MAAM,QAAQ;AAAA,YACjD,YAAY;AAAA,YACZ;AAAA,UACF,CAAC;AACD,0BAAgB,IAAI;AAAA,QACtB;AAEA,cAAM,eACJ,eACC,MAAM,sBAAsB,IAAI;AAAA,UAC/B,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,UAAU,MAAM;AAAA,UAChB,mCAAmC,SAAS,OAAO;AAAA,UACnD,wBAAwB,SAAS,OAAO;AAAA,UACxC,aAAa;AAAA,UACb,aAAa;AAAA,UACb;AAAA,QACF,CAAC;AACH,yBAAiB,aAAa;AAE9B,cAAM,iBAAiB,SAAS;AAChC,cAAM,UAAU,eAAe;AAC/B,cAAM,SAAS;AAAA,UACb,GAAG;AAAA,UACH,WAAW,IAAI,SACb,uBAAuB,IAAI,WAAW,MAAM,eAAe,UAAU,GAAG,IAAI,CAAC;AAAA,UAC/E,cAAc,IAAI,SAChB,uBAAuB,IAAI,WAAW,MAAM,eAAe,aAAa,GAAG,IAAI,CAAC;AAAA,UAClF,GAAI,UACA;AAAA,YACE,SAAS,IAAI,SACX,uBAAuB,IAAI,WAAW,MAAM,QAAQ,GAAG,IAAI,CAAC;AAAA,UAChE,IACA,CAAC;AAAA,QACP;AACA,cAAM,UAAU;AAChB,cAAM,YAAY,MAAM,OAAO;AAAA,UAC7B,MAAM,MAAM;AAAA,UACZ,MAAM,MAAM;AAAA,QACd;AACA,gBAAQ,mBAAmB,UAAU;AACrC,gBAAQ,YAAY,UAAU;AAE9B,cAAM,OAAO,oBAAoB,eAC7B,MAAM,gBAAgB,IAAI,MAAM,aAAa,oBAAoB,YAAY,IAC7E,MAAM,kBAAkB,IAAI;AAAA,UAC1B,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,QACrB,CAAC;AACL,YAAI,CAAC,KAAM,OAAM,IAAI,YAAY,qBAAqB,KAAK;AAE3D,cAAM,sBAAsB,MAAM,4CAA4C,IAAI;AAAA,UAChF,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,UAAU,MAAM;AAAA,UAChB,oBAAoB,MAAM;AAAA,UAC1B,qBAAqB,OAAO;AAAA,UAC5B,gBAAgB,UAAU;AAAA,UAC1B,+BAA+B,MAAM,MAAM;AAAA,UAC3C,kBAAkB,kBAAkB;AAAA,UACpC,cAAc,UAAU,QAAQ,IAAI,CAAC,WAAW;AAAA,YAC9C,kBAAkB,MAAM;AAAA,YACxB,kBAAkB,MAAM;AAAA,YACxB,cAAc,kBAAkB,KAAK;AAAA,UACvC,EAAE;AAAA,QACJ,CAAC;AACD,cAAM,mBAAmB,kBAAkB,4BACvC,UAAU,QAAQ;AAAA,UAAO,CAAC,OAAO,UAC/B,2CAA2C;AAAA,YACzC;AAAA,YACA,aAAa,oBAAoB,KAAK;AAAA,YACtC,2BAA2B,SAAS,OAAO;AAAA,YAC3C;AAAA,UACF,CAAC;AAAA,QACH,IACA,UAAU;AACd,cAAM,wBAAwB,oBAAI,IAAiD;AACnF,mBAAW,eAAe,qBAAqB;AAC7C,gCAAsB,IAAI,YAAY,kBAAkB;AAAA,YACtD,kBAAkB,YAAY;AAAA,YAC9B,kBAAkB,YAAY;AAAA,YAC9B,cAAc,YAAY;AAAA,UAC5B,CAAC;AAAA,QACH;AACA,cAAM,oBAAoB,CAAC,GAAG,sBAAsB,OAAO,CAAC;AAC5D,cAAM,sBAAsB;AAAA,UAC1B,UAAU;AAAA,UACV;AAAA,UACA,OAAO,OAAO;AAAA,QAChB;AAEA,cAAM,uBAAuB,OAAO,YAa9B;AACJ,cAAI,CAAC,QAAQ,QAAQ,YAAY;AAC/B,kBAAM,IAAI,YAAY,qBAAqB,KAAK;AAAA,UAClD;AACA,cAAI,aACF,QAAQ,cACP,MAAM,gDAAgD,IAAI;AAAA,YACzD,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,4BAA4B,QAAQ,QAAQ;AAAA,YAC5C,qBAAqB,OAAO;AAAA,UAC9B,CAAC;AACH,cAAI,CAAC,YAAY;AACf,yBAAa,MAAM,0CAA0C,IAAI;AAAA,cAC/D,WAAW,MAAM;AAAA,cACjB,aAAa,MAAM;AAAA,cACnB,oBAAoB,MAAM;AAAA,cAC1B,UAAU,MAAM;AAAA,cAChB,sBAAsB,aAAa;AAAA,cACnC,qBAAqB,OAAO;AAAA,cAC5B,kBAAkB,QAAQ,MAAM;AAAA,cAChC,yBAAyB,QAAQ,OAAO;AAAA,cACxC,4BAA4B,QAAQ,QAAQ;AAAA,cAC5C,YAAY,QAAQ,QAAQ;AAAA,cAC5B,wBAAwB,OAAO;AAAA,cAC/B,2BAA2B,OAAO;AAAA,cAClC,2BAA2B,QAAQ,OAAO;AAAA,cAC1C,yBAAyB,QAAQ,QAAQ;AAAA,cACzC,iBAAiB,OAAO,gBAAgB,QAAQ,KAAK;AAAA,YACvD,CAAC;AAAA,UACH;AACA,cAAI,WAAW,eAAe,QAAQ,QAAQ,YAAY;AACxD,kBAAM,IAAI,YAAY,qBAAqB,KAAK;AAAA,UAClD;AACA,cAAI,WAAW,WAAW,aAAa,CAAC,QAAQ,cAAe,QAAO;AACtE,cAAI,WAAW,WAAW,aAAa,QAAQ,eAAe;AAC5D,oBAAQ,QAAQ;AAChB,gBAAI;AACF,oBAAM,kBAAkB,MAAM,mBAAmB,cAAc;AAAA,gBAC7D,WAAW,MAAM;AAAA,gBACjB,aAAa,MAAM;AAAA,gBACnB,YAAY,QAAQ,QAAQ;AAAA,gBAC5B,eAAe,OAAO,YAAY;AAAA,gBAClC,sBAAsB,OAAO,YAAY;AAAA,gBACzC,oBAAoB,OAAO,YAAY;AAAA,cACzC,CAAC;AACD,kBAAI,gBAAgB,WAAW,SAAS;AACtC,sBAAM,IAAI,MAAM,oCAAoC;AAAA,cACtD;AAAA,YACF,QAAQ;AACN,oBAAM,IAAI,YAAY,mBAAmB,IAAI;AAAA,YAC/C;AACA,mBAAO;AAAA,UACT;AACA,cAAI,WAAW,WAAW,UAAU;AAClC,kBAAM,UAAU,MAAM,wCAAwC,IAAI;AAAA,cAChE,WAAW,MAAM;AAAA,cACjB,aAAa,MAAM;AAAA,cACnB,cAAc,WAAW;AAAA,cACzB,oBAAoB,MAAM;AAAA,YAC5B,CAAC;AACD,gBAAI,YAAY,eAAe;AAC7B,oBAAM,IAAI,YAAY,qBAAqB,KAAK;AAAA,YAClD;AACA,yBAAa,EAAE,GAAG,YAAY,QAAQ,QAAQ;AAC9C,gBAAI,YAAY,UAAW,QAAO;AAAA,UACpC;AACA,cAAI,WAAW,WAAW,WAAW;AACnC,kBAAM,IAAI,YAAY,qBAAqB,KAAK;AAAA,UAClD;AACA,cAAI,QAAQ,eAAe;AACzB,oBAAQ,QAAQ;AAChB,gBAAI;AACF,oBAAM,kBAAkB,MAAM,mBAAmB,cAAc;AAAA,gBAC7D,WAAW,MAAM;AAAA,gBACjB,aAAa,MAAM;AAAA,gBACnB,YAAY,QAAQ,QAAQ;AAAA,gBAC5B,eAAe,OAAO,YAAY;AAAA,gBAClC,sBAAsB,OAAO,YAAY;AAAA,gBACzC,oBAAoB,OAAO,YAAY;AAAA,cACzC,CAAC;AACD,kBAAI,gBAAgB,WAAW,SAAS;AACtC,sBAAM,IAAI,MAAM,oCAAoC;AAAA,cACtD;AAAA,YACF,QAAQ;AACN,oBAAM,yCAAyC,IAAI;AAAA,gBACjD,WAAW,MAAM;AAAA,gBACjB,aAAa,MAAM;AAAA,gBACnB,cAAc,WAAW;AAAA,gBACzB,QAAQ;AAAA,gBACR,aAAa;AAAA,cACf,CAAC,EAAE,MAAM,MAAM,MAAS;AACxB,oBAAM,IAAI,YAAY,mBAAmB,IAAI;AAAA,YAC/C;AAAA,UACF;AACA,gBAAM,aAAa,MAAM,yCAAyC,IAAI;AAAA,YACpE,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,cAAc,WAAW;AAAA,YACzB,QAAQ;AAAA,UACV,CAAC;AACD,cAAI,eAAe,eAAe;AAChC,kBAAM,IAAI,YAAY,qBAAqB,KAAK;AAAA,UAClD;AACA,iBAAO,EAAE,GAAG,YAAY,QAAQ,UAAU;AAAA,QAC5C;AAEA,cAAM,iBAAiB,OAAO,YAQxB;AACJ,cAAI,CAAC,OAAO,WAAW,CAAC,SAAS,cAAc;AAC7C,mBAAO,EAAE,gBAAgB,WAAW,aAAa,KAAK;AAAA,UACxD;AACA,gBAAM,iCAAiC,IAAI;AAAA,YACzC,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,cAAc,QAAQ,WAAW;AAAA,YACjC,sBAAsB,QAAQ,WAAW;AAAA,YACzC,wBAAwB,OAAO;AAAA,YAC/B,2BAA2B,OAAO;AAAA,YAClC,2BAA2B,QAAQ,OAAO;AAAA,YAC1C,yBAAyB,QAAQ,QAAQ;AAAA,UAC3C,CAAC;AACD,gBAAM,4BACJ,OAAO,OAAO,sBAAsB,QAAQ;AAC9C,cAAI,4BAA4B,GAAG;AACjC,kBAAM,IAAI,YAAY,kBAAkB,KAAK;AAAA,UAC/C;AACA,gBAAM,UAAU;AAChB,gBAAM,WAAW,MAAM,OAAO,QAAQ,QAAQ,OAAO,yBAAyB;AAC9E,kBAAQ,oBAAoB,SAAS;AACrC,cAAI,QAAQ,mBAAmB,OAAO,OAAO,qBAAqB;AAChE,kBAAM,IAAI,YAAY,kBAAkB,KAAK;AAAA,UAC/C;AACA,gBAAM,WAAW,MAAM,mCAAmC,IAAI;AAAA,YAC5D,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,cAAc,QAAQ,WAAW;AAAA,YACjC,cAAc,SAAS,aAAa;AAAA,YACpC,mBAAmB,SAAS,aAAa;AAAA,YACzC,0BAA0B,SAAS,aAAa;AAAA,YAChD,sBAAsB,QAAQ,WAAW;AAAA,YACzC,wBAAwB,OAAO;AAAA,YAC/B,2BAA2B,OAAO;AAAA,YAClC,2BAA2B,QAAQ,OAAO;AAAA,YAC1C,yBAAyB,QAAQ,QAAQ;AAAA,YACzC,kBAAkB,SAAS;AAAA,YAC3B,SAAS,SAAS;AAAA,YAClB,aAAa,SAAS;AAAA,YACtB,aAAa,SAAS;AAAA,YACtB,YAAY,SAAS;AAAA,YACrB,WAAW,SAAS;AAAA,YACpB,iBAAiB,OAAO,gBAAgB,QAAQ,KAAK;AAAA,YACrD,aAAa,aAAa,QAAQ,WAAW,EAAE,IAAI,SAAS,WAAW;AAAA,YACvE,YAAY,SAAS;AAAA,UACvB,CAAC;AACD,iBAAO;AAAA,YACL,gBAAgB,SAAS;AAAA,YACzB,aAAa;AAAA,cACX,SAAS;AAAA,cACT,UAAU;AAAA,cACV,YAAY,SAAS;AAAA,cACrB,aAAa,SAAS;AAAA,cACtB,SAAS,SAAS;AAAA,cAClB,YAAY,SAAS;AAAA,cACrB,WAAW,SAAS;AAAA,YACtB;AAAA,UACF;AAAA,QACF;AAEA,cAAM,WAAW,CAAC;AAClB,mBAAW,SAAS,kBAAkB;AACpC,gBAAM,UAAU;AAChB,oBAAU,EAAE,UAAU,MAAM,UAAU,kBAAkB,MAAM,iBAAiB,CAAC;AAChF,gBAAM,mBAAmB,sBAAsB,IAAI,MAAM,gBAAgB;AACzE,cAAI,CAAC,iBAAkB,OAAM,IAAI,YAAY,4BAA4B,KAAK;AAC9E,gBAAM,kBAAkB;AAAA,YACtB,oBAAoB,MAAM;AAAA,YAC1B,gBAAgB,UAAU;AAAA,YAC1B,kBAAkB,iBAAiB;AAAA,YACnC,cAAc,iBAAiB;AAAA,UACjC;AACA,kBAAQ,WAAW;AACnB,cAAI,MAAM,SAAS,WAAW,QAAQ;AACpC,oBAAQ,WAAW;AACnB,qBAAS,KAAK;AAAA,cACZ,kBAAkB,MAAM;AAAA,cACxB,SAAS;AAAA,cACT,YAAY,MAAM,SAAS;AAAA,YAC7B,CAAC;AACD;AAAA,UACF;AACA,cAAI,MAAM,SAAS,WAAW,WAAY;AAC1C,cAAI;AACF,kBAAM,iBAAiB,MAAM,yCAAyC,IAAI;AAAA,cACxE,WAAW,MAAM;AAAA,cACjB,aAAa,MAAM;AAAA,cACnB,UAAU,MAAM;AAAA,cAChB,kBAAkB,MAAM;AAAA,cACxB,qBAAqB,OAAO;AAAA,YAC9B,CAAC;AACD,gBAAI,SACF,kBACC,MAAM,4BAA4B,IAAI;AAAA,cACrC,WAAW,MAAM;AAAA,cACjB,aAAa,MAAM;AAAA,cACnB,UAAU,MAAM;AAAA,cAChB,kBAAkB,MAAM;AAAA,cACxB,aAAa,iBAAiB,MAAM,QAAQ,IAAI,MAAM,gBAAgB;AAAA,cACtE;AAAA,YACF,CAAC;AACH,gBAAI,OAAO,mBAAmB,UAAU;AACtC,oBAAM,WAAW,MAAM,6BAA6B,IAAI;AAAA,gBACtD,WAAW,MAAM;AAAA,gBACjB,aAAa,MAAM;AAAA,gBACnB,UAAU,OAAO;AAAA,gBACjB,oBAAoB,OAAO;AAAA,gBAC3B,aAAa,iCAAiC,OAAO,EAAE,IAAI,UAAU,oBAAoB;AAAA,gBACzF,YAAY;AAAA,gBACZ;AAAA,cACF,CAAC;AACD,uBAAS;AAAA,gBACP,GAAG;AAAA,gBACH,gBAAgB;AAAA,gBAChB,qBAAqB,SAAS;AAAA,cAChC;AAAA,YACF;AACA,kBAAM,qBAAqB,OAAO,mBAC9B,MAAM,uDAAuD,IAAI;AAAA,cAC/D,WAAW,MAAM;AAAA,cACjB,aAAa,MAAM;AAAA,cACnB,WAAW,OAAO;AAAA,cAClB,qBAAqB,OAAO;AAAA,YAC9B,CAAC,IACD;AACJ,kBAAM,iBAAiB,oBAAoB,WAAW;AACtD,kBAAM,eAAe,kBAAkB,KAAK;AAC5C,kBAAM,2BACJ,OAAO,oBAAoB,eAAe,qBAAqB,WAC3D,mBAAmB,eAAe,mBAClC;AACN,kBAAM,uBACJ,OAAO,oBAAoB,eAAe,iBAAiB,WACvD,mBAAmB,eAAe,eAClC;AACN,kBAAM,oCAAoC;AAAA,cACxC,oBAAoB,eAAe,6BAA6B;AAAA,YAClE;AACA,kBAAM,oCAAoC;AAAA,cACxC,oBAAoB,eAAe,6BAA6B;AAAA,YAClE;AACA,kBAAM,oBAAoB,iBACtB,MAAM,gDAAgD,IAAI;AAAA,cACxD,WAAW,MAAM;AAAA,cACjB,aAAa,MAAM;AAAA,cACnB,4BAA4B,eAAe;AAAA,cAC3C,qBAAqB,OAAO;AAAA,YAC9B,CAAC,IACD;AACJ,gBACE,kBACA,eAAe,cACf,6BAA6B,MAAM,qBACnC,yBAAyB,gBACzB,eAAe,kBAAkB,iBACjC,sCAAsC,SAAS,OAAO,uBACtD,sCAAsC,OAAO,uBAC7C,mBAAmB,WAAW,eAC9B;AACA,oBAAM,iDAAiD,IAAI;AAAA,gBACzD,WAAW,MAAM;AAAA,gBACjB,aAAa,MAAM;AAAA,gBACnB,qBAAqB,OAAO;AAAA,gBAC5B,UAAU,MAAM;AAAA,gBAChB,mCAAmC,SAAS,OAAO;AAAA,gBACnD,UAAU,OAAO;AAAA,gBACjB,mCAAmC,OAAO;AAAA,gBAC1C,WAAW,eAAe;AAAA,gBAC1B,YAAY,eAAe;AAAA,gBAC3B,OAAO,MAAM;AAAA,gBACb,WAAW,MAAM;AAAA,gBACjB,eAAe,MAAM,qBAAqB,eAAe;AAAA,gBACzD,iBAAiB,MAAM;AAAA,gBACvB;AAAA,cACF,CAAC;AACD,oBAAMC,cAAa,MAAM,qBAAqB;AAAA,gBAC5C;AAAA,gBACA;AAAA,gBACA,SAAS;AAAA,gBACT,gBAAgB,oBAAoB,sBAAsB,OAAO;AAAA,gBACjE,YAAY;AAAA,cACd,CAAC;AACD,oBAAMC,aAAY,MAAM,eAAe;AAAA,gBACrC;AAAA,gBACA;AAAA,gBACA,SAAS;AAAA,gBACT,YAAAD;AAAA,cACF,CAAC;AACD,sBAAQ,aAAa;AACrB,uBAAS,KAAK;AAAA,gBACZ,kBAAkB,MAAM;AAAA,gBACxB,SAAS;AAAA,gBACT,eAAe,eAAe;AAAA,gBAC9B,kBAAkB,MAAM;AAAA,gBACxB;AAAA,gBACA,gBAAgBC,WAAU;AAAA,gBAC1B,aAAaA,WAAU;AAAA,gBACvB,mBAAmBD,YAAW;AAAA,cAChC,CAAC;AACD;AAAA,YACF;AACA,oBAAQ,QAAQ;AAChB,kBAAM,UAAU;AAChB,kBAAM,QAAQ,MAAM,OAAO,aAAa,OAAO,OAAO,OAAO,YAAY;AACzE,kBAAM,gBAAgBE,YAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACrE,kBAAM,iBAAiBA,YAAW,QAAQ,EACvC;AAAA,cACC,KAAK,UAAU;AAAA,gBACb,kBAAkB,MAAM;AAAA,gBACxB,kBAAkB,MAAM;AAAA,gBACxB;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA,2BAA2B,SAAS,OAAO;AAAA,gBAC3C,2BAA2B,OAAO;AAAA,cACpC,CAAC;AAAA,YACH,EACC,OAAO,KAAK;AACf,gBACE,gBAAgB,kBAAkB,iBAClC,eAAe,cACf,eAAe,QACf;AACA,oBAAMC,WAAU,MAAM,+BAA+B,IAAI;AAAA,gBACvD,WAAW,MAAM;AAAA,gBACjB,aAAa,MAAM;AAAA,gBACnB,UAAU,OAAO;AAAA,gBACjB,mCAAmC,SAAS,OAAO;AAAA,gBACnD,mCAAmC,OAAO;AAAA,gBAC1C,2BAA2B,OAAO;AAAA,gBAClC,mBAAmB,MAAM,qBAAqB;AAAA,gBAC9C;AAAA,gBACA,cAAc,GAAG,MAAM,gBAAgB,IAAI,cAAc;AAAA,gBACzD,cAAc;AAAA,gBACd,gBAAgB;AAAA,kBACd,OAAO,MAAM;AAAA,kBACb,UAAU,MAAM;AAAA,kBAChB,SAAS,MAAM;AAAA,kBACf,kBAAkB,MAAM;AAAA,kBACxB;AAAA,kBACA,gBAAgB;AAAA,kBAChB,2BAA2B,SAAS,OAAO;AAAA,kBAC3C,2BAA2B,OAAO;AAAA,gBACpC;AAAA,gBACA,iBAAiB,MAAM;AAAA,gBACvB,iBAAiB,MAAM;AAAA,gBACvB,cAAc,IAAI;AAAA,gBAClB;AAAA,gBACA,YAAY,eAAe;AAAA,gBAC3B,QAAQ,eAAe;AAAA,gBACvB,kBAAkB,EAAE,WAAW,MAAM,UAAU;AAAA,gBAC/C,6BAA6B;AAAA,kBAC3B,OAAO,MAAM;AAAA,kBACb,WAAW,MAAM;AAAA,kBACjB,eAAe,MAAM,qBAAqB;AAAA,kBAC1C,iBAAiB,MAAM;AAAA,gBACzB;AAAA,gBACA;AAAA,gBACA,aAAa,wBAAwB,OAAO,EAAE,IAAI,cAAc;AAAA,gBAChE,YAAY;AAAA,gBACZ;AAAA,cACF,CAAC;AACD,oBAAM,iDAAiD,IAAI;AAAA,gBACzD,WAAW,MAAM;AAAA,gBACjB,aAAa,MAAM;AAAA,gBACnB,qBAAqB,OAAO;AAAA,gBAC5B,UAAU,MAAM;AAAA,gBAChB,mCAAmC,SAAS,OAAO;AAAA,gBACnD,UAAU,OAAO;AAAA,gBACjB,mCAAmC,OAAO;AAAA,gBAC1C,WAAWA,SAAQ;AAAA,gBACnB,YAAY,eAAe;AAAA,gBAC3B,OAAO,MAAM;AAAA,gBACb,WAAW,MAAM;AAAA,gBACjB,eAAe,MAAM,qBAAqB;AAAA,gBAC1C,iBAAiB,MAAM;AAAA,gBACvB;AAAA,cACF,CAAC;AACD,oBAAMH,cAAa,MAAM,qBAAqB;AAAA,gBAC5C;AAAA,gBACA;AAAA,gBACA,SAAAG;AAAA,gBACA,gBAAgB,oBAAoB,sBAAsB,OAAO;AAAA,cACnE,CAAC;AACD,oBAAMF,aAAY,MAAM,eAAe,EAAE,OAAO,QAAQ,SAAAE,UAAS,YAAAH,YAAW,CAAC;AAC7E,sBAAQ,aAAa;AACrB,sBAAQ,WAAW;AACnB,kBAAIC,WAAU,mBAAmB,UAAW,SAAQ,cAAc;AAClE,uBAAS,KAAK;AAAA,gBACZ,kBAAkB,MAAM;AAAA,gBACxB,SAAS;AAAA,gBACT;AAAA,gBACA,WAAW,MAAM;AAAA,gBACjB,kBAAkB,MAAM;AAAA,gBACxB;AAAA,gBACA,gBAAgBA,WAAU;AAAA,gBAC1B,aAAaA,WAAU;AAAA,gBACvB,mBAAmBD,YAAW;AAAA,cAChC,CAAC;AACD;AAAA,YACF;AACA,kBAAM,SAAS;AAAA,cACb,kBAAkB,MAAM,SAAS,IAAI,MAAM,WAAW,IAAI,aAAa;AAAA,YACzE;AACA,kBAAM,YAAY,cAAc,MAAM,WAAW,oBAAoB,aAAa;AAClF,kBAAM,cAAc,UAAU;AAAA,cAC5B,KAAK;AAAA,cACL,aAAa,MAAM,SAAS;AAAA,cAC5B,MAAM;AAAA,cACN,QAAQ;AAAA,YACV,CAAC;AACD,kBAAM,OAAO,MAAM,8BAA8B,IAAI;AAAA,cACnD,WAAW,MAAM;AAAA,cACjB,aAAa,MAAM;AAAA,cACnB;AAAA,cACA,UAAU,MAAM,SAAS;AAAA,cACzB,cAAc,aAAa,MAAM,SAAS,QAAQ;AAAA,cAClD,aAAa,MAAM,SAAS;AAAA,cAC5B,WAAW,MAAM;AAAA,cACjB,QAAQ;AAAA,cACR,QAAQ,cAAc;AAAA,cACtB;AAAA,YACF,CAAC;AACD,kBAAM,WAAW,MAAM,kBAAkB,IAAI;AAAA,cAC3C,WAAW,MAAM;AAAA,cACjB,aAAa,MAAM;AAAA,cACnB,QAAQ,KAAK;AAAA,cACb,QAAQ,KAAK;AAAA,cACb,OAAO,MAAM;AAAA,cACb,YAAY;AAAA,cACZ,WAAW,MAAM;AAAA,cACjB,kBAAkB,MAAM;AAAA,cACxB,aAAa,MAAM;AAAA,cACnB,iBAAiB,MAAM,eAAe;AAAA,cACtC,iBAAiB,MAAM,gBAAgB;AAAA,cACvC,eAAe,MAAM,qBAAqB;AAAA,cAC1C,yBAAyB;AAAA,gBACvB,4BAA4B,OAAO,EAAE,IAAI,cAAc;AAAA,cACzD;AAAA,cACA,eAAe,OAAO,YAAY;AAAA,cAClC,WAAW,OAAO;AAAA,cAClB,qBAAqB,OAAO;AAAA,cAC5B,8BAA8B,OAAO,YAAY,SAAS;AAAA,cAC1D,aAAa;AAAA,cACb,gBAAgB;AAAA,cAChB,QAAQ,EAAE,iBAAiB,OAAO,oBAAoB;AAAA,YACxD,CAAC;AACD,kBAAM,UAAU,MAAM,+BAA+B,IAAI;AAAA,cACvD,WAAW,MAAM;AAAA,cACjB,aAAa,MAAM;AAAA,cACnB,UAAU,OAAO;AAAA,cACjB,mCAAmC,SAAS,OAAO;AAAA,cACnD,mCAAmC,OAAO;AAAA,cAC1C,2BAA2B,OAAO;AAAA,cAClC,mBAAmB,MAAM,qBAAqB;AAAA,cAC9C;AAAA,cACA,cAAc,GAAG,MAAM,gBAAgB,IAAI,cAAc;AAAA,cACzD,cAAc;AAAA,cACd,gBAAgB;AAAA,gBACd,OAAO,MAAM;AAAA,gBACb,UAAU,MAAM;AAAA,gBAChB,SAAS,MAAM;AAAA,gBACf,kBAAkB,MAAM;AAAA,gBACxB;AAAA,gBACA,gBAAgB;AAAA,gBAChB,2BAA2B,SAAS,OAAO;AAAA,gBAC3C,2BAA2B,OAAO;AAAA,cACpC;AAAA,cACA,iBAAiB,MAAM;AAAA,cACvB,iBAAiB,MAAM;AAAA,cACvB,cAAc,IAAI;AAAA,cAClB;AAAA,cACA,YAAY,SAAS;AAAA,cACrB,QAAQ,KAAK;AAAA,cACb,kBAAkB,EAAE,WAAW,MAAM,UAAU;AAAA,cAC/C;AAAA,cACA,aAAa,oBAAoB,OAAO,EAAE,IAAI,cAAc;AAAA,cAC5D,YAAY;AAAA,cACZ;AAAA,YACF,CAAC;AACD,kBAAM,aAAa,MAAM,qBAAqB;AAAA,cAC5C;AAAA,cACA;AAAA,cACA;AAAA,cACA,eAAe;AAAA,YACjB,CAAC;AACD,kBAAM,YAAY,MAAM,eAAe,EAAE,OAAO,QAAQ,SAAS,WAAW,CAAC;AAC7E,oBAAQ,WAAW;AACnB,oBAAQ,YAAY;AACpB,gBAAI,UAAU,mBAAmB,UAAW,SAAQ,cAAc;AAClE,oBAAQ,SAAS,MAAM;AACvB,qBAAS,KAAK;AAAA,cACZ,kBAAkB,MAAM;AAAA,cACxB,SAAS;AAAA,cACT;AAAA,cACA,WAAW,MAAM;AAAA,cACjB,kBAAkB,MAAM;AAAA,cACxB;AAAA,cACA,gBAAgB,UAAU;AAAA,cAC1B,aAAa,UAAU;AAAA,cACvB,mBAAmB,WAAW;AAAA,YAChC,CAAC;AAAA,UACH,SAAS,OAAO;AACd,gBAAI,iBAAiB,0CAA0C;AAC7D,oBAAM,IAAI,YAAY,4BAA4B,KAAK;AAAA,YACzD;AACA,kBAAM,UAAU,aAAa,KAAK;AAClC,kBAAM,cACJ,iBAAiB,cACb,QACA,IAAI,YAAY,0BAA0B,KAAK;AACrD,oBAAQ,UAAU;AAClB,oBAAQ,cAAc,YAAY;AAClC,gBAAI,QAAQ,SAAS,SAAS,OAAO,OAAO,mBAAmB;AAC7D,sBAAQ,SAAS,KAAK;AAAA,gBACpB,kBAAkB,MAAM;AAAA,gBACxB,MAAM,YAAY;AAAA,gBAClB,WAAW,YAAY;AAAA,gBACvB;AAAA,cACF,CAAC;AAAA,YACH;AACA,qBAAS,KAAK;AAAA,cACZ,kBAAkB,MAAM;AAAA,cACxB,SAAS;AAAA,cACT,YAAY,YAAY;AAAA,cACxB,QAAQ;AAAA,cACR,kBAAkB,MAAM;AAAA,cACxB,cAAc,kBAAkB,KAAK;AAAA,cACrC,gBAAgB;AAAA,YAClB,CAAC;AAAA,UACH;AAAA,QACF;AACA,cAAM,sCAAsC,IAAI;AAAA,UAC9C,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,oBAAoB,MAAM;AAAA,UAC1B,oBAAoB,aAAa;AAAA,UACjC,UAAU,MAAM;AAAA,UAChB,wBAAwB,OAAO;AAAA,UAC/B,2BAA2B,OAAO;AAAA,UAClC;AAAA,QACF,CAAC;AAED,YAAI,UAAU,WAAW,YAAY,UAAU,YAAY;AACzD,cACE,UAAU,eAAe,oBACzB,UAAU,eAAe,qBACzB;AACA,kBAAM,IAAI;AAAA,cACR,UAAU,eAAe,mBACrB,yBACA;AAAA,cACJ,UAAU,eAAe;AAAA,YAC3B;AAAA,UACF;AACA,cAAI,UAAU,kBAAkB;AAC9B,oBAAQ,eAAe,eAAe,UAAU,UAAU;AAC1D,kBAAM,IAAI,YAAY,kBAAkB,KAAK;AAAA,UAC/C;AACA,cAAI,UAAU,eAAe,sBAAsB;AACjD,oBAAQ,eAAe,eAAe,UAAU,UAAU;AAC1D,kBAAM,IAAI,YAAY,kBAAkB,KAAK;AAAA,UAC/C;AACA,kBAAQ,eAAe;AACvB,kBAAQ,QAAQ;AAChB,gBAAM,8BAA8B,IAAI;AAAA,YACtC,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,UAAU,MAAM;AAAA,YAChB,oBAAoB,MAAM;AAAA,YAC1B,wBAAwB,OAAO;AAAA,YAC/B,2BAA2B,OAAO;AAAA,YAClC;AAAA,YACA,kBAAkB;AAAA,cAChB,qBAAqB,OAAO;AAAA,cAC5B,gBAAgB,UAAU;AAAA,cAC1B,+BAA+B,MAAM,MAAM;AAAA,cAC3C,cAAc;AAAA,YAChB;AAAA,UACF,CAAC;AACD,iBAAO,EAAE,QAAQ,YAAY,QAAQ;AAAA,QACvC;AAEA,cAAM,8BAA8B,UAAU,wBAC1C,MAAM,yCAAyC,IAAI;AAAA,UACjD,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,UAAU,MAAM;AAAA,UAChB,oBAAoB,MAAM;AAAA,UAC1B,qBAAqB,OAAO;AAAA,UAC5B,sBAAsB,aAAa;AAAA,UACnC,wBAAwB,OAAO;AAAA,UAC/B,2BAA2B,OAAO;AAAA,UAClC,gBAAgB,UAAU;AAAA,QAC5B,CAAC,IACD,CAAC;AACL,YAAI,4BAA4B,SAAS,GAAG;AAC1C,kBAAQ,WAAW,4BAA4B;AAC/C,gBAAM,sCAAsC,IAAI;AAAA,YAC9C,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,oBAAoB,MAAM;AAAA,YAC1B,oBAAoB,aAAa;AAAA,YACjC,UAAU,MAAM;AAAA,YAChB,wBAAwB,OAAO;AAAA,YAC/B,2BAA2B,OAAO;AAAA,YAClC,UAAU,4BAA4B,IAAI,CAAC,sBAAsB;AAAA,cAC/D;AAAA,cACA,SAAS;AAAA,cACT,YAAY;AAAA,cACZ,gBAAgB;AAAA,YAClB,EAAE;AAAA,UACJ,CAAC;AAAA,QACH;AAEA,cAAM,yBAAyB,IAAI;AAAA,UACjC,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,qBAAqB,OAAO;AAAA,UAC5B,OAAO,aAAa;AAAA,UACpB,OAAO;AAAA,UACP,cAAc;AAAA,UACd,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,UAClC,UAAU,EAAE,GAAG,SAAS,gBAAgB,UAAU,eAAe;AAAA,UACjE,YAAY;AAAA,QACd,CAAC;AACD,gBAAQ,QAAQ;AAChB,gBAAQ,YAAY,KAAK,IAAI,IAAI;AACjC,cAAM,UAAU,MAAM,+BAA+B,IAAI;AAAA,UACvD,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,UAAU,MAAM;AAAA,UAChB,oBAAoB,MAAM;AAAA,UAC1B,oBAAoB,aAAa;AAAA,UACjC,QAAQ;AAAA,UACR;AAAA,UACA,wBAAwB,OAAO;AAAA,UAC/B,2BAA2B,OAAO;AAAA,UAClC,sBAAsB,aAAa;AAAA,UACnC,+BAA+B,aAAa,sBAAsB;AAAA,UAClE,gBAAgB,UAAU;AAAA,UAC1B,kBAAkB;AAAA,YAChB,qBAAqB,OAAO;AAAA,YAC5B,gBAAgB,UAAU;AAAA,YAC1B,+BAA+B,MAAM,MAAM;AAAA,YAC3C,cAAc;AAAA,UAChB;AAAA,QACF,CAAC;AACD,cAAM,qBAAqB,aAAa,QAAQ,SAAS,MAAM;AAC/D,cAAM,qBAAqB,SAAS,QAAQ,UAAU,MAAM;AAC5D,cAAM,qBAAqB,SAAS,QAAQ,OAAO,MAAM;AACzD,sBAAc,iBAAiB;AAAA,UAC7B,MAAM;AAAA,UACN,QAAQ,EAAE,UAAU,eAAe,SAAS,YAAY;AAAA,QAC1D,CAAC;AACD,sBAAc,iBAAiB;AAAA,UAC7B,MAAM;AAAA,UACN,QAAQ,EAAE,UAAU,eAAe,SAAS,WAAW;AAAA,UACvD,QAAQ,QAAQ;AAAA,QAClB,CAAC;AACD,mBAAW,WAAW,CAAC,aAAa,WAAW,QAAQ,GAAY;AACjE,wBAAc,iBAAiB;AAAA,YAC7B,MAAM;AAAA,YACN,QAAQ,EAAE,UAAU,eAAe,QAAQ;AAAA,YAC3C,QAAQ,QAAQ,OAAO;AAAA,UACzB,CAAC;AAAA,QACH;AACA,sBAAc,iBAAiB;AAAA,UAC7B,MAAM;AAAA,UACN,QAAQ,EAAE,UAAU,cAAc;AAAA,UAClC,QAAQ,QAAQ;AAAA,QAClB,CAAC;AACD,kCAA0B,eAAe,eAAe,SAAS,WAAW;AAC5E,eAAO;AAAA,UACL,QAAQ;AAAA,UACR;AAAA,UACA,cAAc,QAAQ;AAAA,UACtB,4BAA4B,QAAQ;AAAA,QACtC;AAAA,MACF,SAAS,OAAO;AACd,cAAM,UACJ,iBAAiB,cAAc,QAAQ,IAAI,YAAY,oBAAoB,KAAK;AAClF,gBAAQ,QAAQ;AAChB,gBAAQ,cAAc,QAAQ;AAC9B,gBAAQ,YAAY,KAAK,IAAI,IAAI;AACjC,gBAAQ,oBAAoB,QAAQ;AACpC,gBAAQ,SAAS,KAAK,IAAI,QAAQ,QAAQ,CAAC;AAC3C,YAAI,QAAQ,SAAS,WAAW,GAAG;AACjC,kBAAQ,SAAS,KAAK;AAAA,YACpB,kBAAkB,MAAM;AAAA,YACxB,MAAM,QAAQ;AAAA,YACd,WAAW,QAAQ;AAAA,YACnB,SAAS,aAAa,KAAK;AAAA,UAC7B,CAAC;AAAA,QACH;AACA,YAAI,gBAAgB;AAClB,gBAAM,yBAAyB,IAAI;AAAA,YACjC,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,qBAAqB,OAAO;AAAA,YAC5B,OAAO;AAAA,YACP,OAAO;AAAA,YACP,UAAU;AAAA,YACV,WAAW,QAAQ;AAAA,YACnB,YAAY;AAAA,UACd,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,QAC1B;AACA,cAAM,kBAAwE;AAAA,UAC5E,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,UAAU,MAAM;AAAA,UAChB,oBAAoB,MAAM;AAAA,UAC1B,oBAAoB;AAAA,UACpB,QAAQ;AAAA,UACR;AAAA,UACA,OAAO,QAAQ;AAAA,UACf,wBAAwB,OAAO;AAAA,UAC/B,2BAA2B,OAAO;AAAA,UAClC,sBAAsB,8BAA8B,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA,UAIhE,qBAAqB;AAAA,QACvB;AACA,cAAM,UAAU,QAAQ,oBACpB,MAAM,+CAA+C,IAAI;AAAA,UACvD,iBAAiB;AAAA,YACf,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,UAAU,MAAM;AAAA,YAChB,UAAU,OAAO;AAAA,YACjB,aAAa,8BAA8B,MAAM,QAAQ,IAAI,OAAO,WAAW,iBAAiB,IAAI,QAAQ,IAAI;AAAA,YAChH,YAAY;AAAA,YACZ,OAAO;AAAA,cACL,MAAM;AAAA,cACN,WAAW;AAAA,cACX,0BAA0B,OAAO;AAAA,YACnC;AAAA,UACF;AAAA,UACA,YAAY;AAAA,QACd,CAAC,IACD,MAAM,+BAA+B,IAAI,eAAe;AAC5D,cAAM,qBAAqB,aAAa,QAAQ,SAAS,MAAM;AAC/D,cAAM,qBAAqB,SAAS,QAAQ,UAAU,MAAM;AAC5D,cAAM,qBAAqB,SAAS,QAAQ,OAAO,MAAM;AACzD,sBAAc,iBAAiB;AAAA,UAC7B,MAAM;AAAA,UACN,QAAQ,EAAE,UAAU,eAAe,SAAS,SAAS;AAAA,QACvD,CAAC;AACD,mBAAW,WAAW,CAAC,YAAY,aAAa,WAAW,QAAQ,GAAY;AAC7E,wBAAc,iBAAiB;AAAA,YAC7B,MAAM;AAAA,YACN,QAAQ,EAAE,UAAU,eAAe,QAAQ;AAAA,YAC3C,QAAQ,QAAQ,OAAO;AAAA,UACzB,CAAC;AAAA,QACH;AACA,sBAAc,iBAAiB;AAAA,UAC7B,MAAM;AAAA,UACN,QAAQ,EAAE,UAAU,cAAc;AAAA,UAClC,QAAQ,QAAQ;AAAA,QAClB,CAAC;AACD,kCAA0B,eAAe,eAAe,SAAS,UAAU,OAAO;AAClF,eAAO;AAAA,UACL,QAAQ;AAAA,UACR;AAAA,UACA,WAAW,QAAQ;AAAA,UACnB,cAAc,QAAQ;AAAA,UACtB,4BAA4B,QAAQ;AAAA,QACtC;AAAA,MACF;AAEA,qBAAe,oBAAoB,MAA0D;AAC3F,cAAM,kBAAkB;AAAA,UACtB,OAAO;AAAA,UACP,SAAS;AAAA,UACT,UAAU;AAAA,UACV,WAAW;AAAA,UACX,SAAS;AAAA,UACT,QAAQ;AAAA,UACR,OAAO;AAAA,UACP,kBAAkB;AAAA,UAClB,WAAW;AAAA,UACX,SAAS;AAAA,UACT,YAAY;AAAA,UACZ,WAAW;AAAA,UACX,cAAc;AAAA,UACd,cAAc;AAAA,UACd,mBAAmB;AAAA,UACnB,UAAU;AAAA,YACR;AAAA,cACE,kBAAkB,MAAM;AAAA,cACxB,MAAM;AAAA,cACN,WAAW;AAAA,cACX,SAAS;AAAA,YACX;AAAA,UACF;AAAA,QACF;AACA,cAAM,uBAAuB,IAAI,MAAM,aAAa,MAAM,oBAAoB;AAAA,UAC5E,kBAAkB;AAAA,QACpB,CAAC,EAAE,MAAM,MAAM,MAAS;AACxB,cAAM,4CAA4C,IAAI;AAAA,UACpD,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,UAAU,MAAM;AAAA,UAChB,oBAAoB,MAAM;AAAA,QAC5B,CAAC,EAAE,MAAM,MAAM,MAAS;AACxB,cAAM,qBAAqB,aAAa,GAAG,MAAM,EAAE,MAAM,MAAM,MAAS;AACxE,sBAAc,iBAAiB;AAAA,UAC7B,MAAM;AAAA,UACN,QAAQ,EAAE,UAAU,WAAW,SAAS,mBAAmB;AAAA,QAC7D,CAAC;AACD,eAAO,EAAE,QAAQ,UAAU,cAAc,OAAO,SAAS,iBAAiB,WAAW,KAAK;AAAA,MAC5F;AAEA,qBAAe,qBACb,MACA,UACA,MACA;AACA,YAAI,aAAa,KAAK,SAAS,YAAa;AAC5C,cAAM,iBAAiB,IAAI;AAAA,UACzB,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,WAAW,yBAAyB,IAAI;AAAA,UACxC,UAAU,SAAS,cAAc,IAAI;AAAA,UACrC;AAAA,UACA,oBAAoB;AAAA,UACpB,kBAAkB,MAAM;AAAA,UACxB,WAAW,EAAE,MAAM,WAAW,WAAW,wBAAwB;AAAA,UACjE,kBAAkB;AAAA,YAChB,iBAAiB,MAAM;AAAA,YACvB,oBAAoB,MAAM;AAAA,UAC5B;AAAA,UACA,QAAQ;AAAA,UACR,gBAAgB,+BAA+B,IAAI,IAAI,MAAM,kBAAkB;AAAA,QACjF,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;AASA,eAAsB,+CACpB,IACA,OAIqE;AACrE,MAAI;AACF,UAAM,oCAAoC,IAAI,MAAM,eAAe;AAAA,EACrE,SAAS,OAAO;AACd,UAAM,wCAAwC,IAAI;AAAA,MAChD,WAAW,MAAM,WAAW;AAAA,MAC5B,aAAa,MAAM,WAAW;AAAA,MAC9B,UAAU,MAAM,WAAW;AAAA,MAC3B,oBAAoB,MAAM,WAAW;AAAA,IACvC,CAAC;AACD,UAAM;AAAA,EACR;AACA,SAAO,MAAM,+BAA+B,IAAI,MAAM,UAAU;AAClE;AAwBA,eAAe,6BAA6B,OAoBzC;AACD,QAAM,EAAE,OAAO,IAAI;AACnB,QAAM,aAAa,MAAMH;AAAA,IACvB,MAAM;AAAA,IACN,MAAM;AAAA,IACN,OAAO,WAAW;AAAA,IAClB,OAAO;AAAA,EACT;AACA,MACE,CAAC,cACD,WAAW,cAAc,MAAM,aAC/B,WAAW,cAAc,OAAO,WAAW,kBAC3C,WAAW,eAAe,YAAY,MAAM,OAAO,WAAW,eAAe,YAAY,KACzF,WAAW,SAAS,OAAO,WAAW,QACtC,WAAW,UAAU,OAAO,WAAW,qBACvC,WAAW,WAAW,UACtB;AACA,UAAM,IAAI,YAAY,iCAAiC,MAAM,IAAI;AAAA,EACnE;AAEA,QAAM,gBACJ,WAAW,mBAAmB,+BAC1B,8BAA8B,UAAU,WAAW,QAAQ,IAC3D;AACN,QAAM,mBACJ,WAAW,mBAAmB,4BAC1B,4BAA4B,UAAU,WAAW,QAAQ,IACzD;AACN,QAAM,2BAA2B,kBAAkB,UAAU,iBAAiB,OAAO;AACrF,MAAI,CAAC,eAAe,WAAW,CAAC,0BAA0B;AACxD,UAAM,IAAI,YAAY,qBAAqB,KAAK;AAAA,EAClD;AACA,MACE,eAAe,WACf,CAAC,iCAAiC,WAAW,eAAe,uBAAuB,GACnF;AACA,UAAM,IAAI,YAAY,iCAAiC,MAAM,IAAI;AAAA,EACnE;AACA,MAAI,kBAAkB,WAAW,CAAC,yBAAyB,WAAW,aAAa,GAAG;AACpF,UAAM,IAAI,YAAY,iCAAiC,MAAM,IAAI;AAAA,EACnE;AACA,QAAM,mBAAmB,eAAe,UACpC,cAAc,KAAK,YACnB,yBAA0B;AAC9B,MAAI,kBAAkB,SAAS,iBAAiB,UAAU,UAAU;AAClE,UAAM,IAAI,YAAY,iCAAiC,MAAM,IAAI;AAAA,EACnE;AACA,QAAM,gBAAgB,eAAe,UACjC,oBAAoB,cAAc,MAAM,MAAM,gBAAgB,IAC9D,wBAAwB,0BAA2B,MAAM,gBAAgB;AAC7E,MACE,CAAC,iBACD,CAAC,cAAc,eACf,cAAc,qBAAqB,OAAO,0BAC1C,CAAC,cAAc,eACf;AAAA,IACE,eAAe,UACX,0BAA0B,cAAc,WAAW,IACnD,wBAAwB,cAAc,WAAW;AAAA,EACvD,MAAM,wBAAwB,OAAO,WAAW,GAChD;AACA,UAAM,IAAI,YAAY,qBAAqB,KAAK;AAAA,EAClD;AAEA,QAAM,QAAQ,MAAM;AAAA,IAClB,MAAM;AAAA,IACN,MAAM;AAAA,EACR,EAAE;AAAA,IACA,aAAa,MAAM;AAAA,IACnB,WAAW,OAAO;AAAA,IAClB,UAAU;AAAA,IACV,eAAe;AAAA,MACb,cAAc,WAAW;AAAA,MACzB,gBAAgB,WAAW;AAAA,MAC3B,MAAM,WAAW;AAAA,MACjB,cAAc;AAAA,IAChB;AAAA,IACA,gBACE,WAAW,mBAAmB,4BAC1B,qBACA;AAAA,EACR,CAAC;AACD,MAAI,MAAM,WAAW,MAAM;AACzB,UAAM,IAAI,YAAY,iCAAiC,MAAM,IAAI;AAAA,EACnE;AACA,QAAM,qBAAqB,MAAMA;AAAA,IAC/B,MAAM;AAAA,IACN,MAAM;AAAA,IACN,OAAO,WAAW;AAAA,IAClB,OAAO;AAAA,EACT;AACA,MACE,CAAC,sBACD,mBAAmB,cAAc,MAAM,aACvC,mBAAmB,cAAc,OAAO,WAAW,kBACnD,mBAAmB,eAAe,YAAY,MAC5C,OAAO,WAAW,eAAe,YAAY,KAC/C,mBAAmB,SAAS,OAAO,WAAW,QAC9C,mBAAmB,YAAY,MAAM,qBACrC,mBAAmB,WAAW,UAC9B;AACA,UAAM,IAAI,YAAY,iCAAiC,MAAM,IAAI;AAAA,EACnE;AACA,QAAM,gBAAgB,MAAM,QAAQ,iBAAiB,MAAM,QAAQ;AACnE,MAAI,mBAAmB,mBAAmB,8BAA8B;AACtE,UAAM,WAAW,8BAA8B,MAAM,mBAAmB,QAAQ;AAChF,QACE,CAAC,qCAAqC;AAAA,MACpC,mBAAmB,mBAAmB;AAAA,MACtC,2BAA2B,MAAM;AAAA,MACjC,kBAAkB,mBAAmB;AAAA,MACrC,gBAAgB,SAAS,WAAW;AAAA,MACpC,eAAe,mBAAmB;AAAA,IACpC,CAAC,GACD;AACA,YAAM,IAAI,YAAY,iCAAiC,MAAM,IAAI;AAAA,IACnE;AACA,UAAM,SAAS,oBAAoB,UAAU,MAAM,gBAAgB;AACnE,QAAI,CAAC,oBAAoB,QAAQ,QAAQ,yBAAyB,GAAG;AACnE,YAAM,IAAI,YAAY,qBAAqB,KAAK;AAAA,IAClD;AACA,WAAO;AAAA,MACL,MAAM;AAAA,MACN,qBAAqB,OAAO;AAAA,MAC5B,cAAc;AAAA,QACZ,cAAc,mBAAmB;AAAA,QACjC,mBAAmB,mBAAmB;AAAA,QACtC,0BAA0B,SAAS;AAAA,MACrC;AAAA,MACA,QAAQ,sBAAsB;AAAA,QAC5B,+BAA+B,OAAO;AAAA,QACtC;AAAA,QACA,gBAAgB;AAAA,QAChB,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,qBAAqB,OAAO;AAAA,QAC5B;AAAA,QACA,OAAO,gCAAgC,MAAM,QAAQ;AAAA,QACrD,eAAe,MAAM;AAAA,QACrB,QAAQ,OAAO;AAAA,QACf,cAAc,mBAAmB;AAAA,QACjC,8BAA8B;AAAA,QAC9B,2BAA2B,OAAO,sBAChC,MAAM,iDAAiD,MAAM,IAAI;AAAA,UAC/D,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,UAAU,MAAM;AAAA,UAChB;AAAA,QACF,CAAC;AAAA,MACL,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,mBAAmB,mBAAmB,2BAA2B;AACnE,UAAM,WAAW,4BAA4B,MAAM,mBAAmB,QAAQ;AAC9E,QACE,SAAS,WAAW,UAAU,YAC9B,CAAC,yBAAyB,mBAAmB,aAAa,GAC1D;AACA,YAAM,IAAI,YAAY,iCAAiC,MAAM,IAAI;AAAA,IACnE;AACA,UAAM,SAAS,wBAAwB,UAAU,MAAM,gBAAgB;AACvE,QAAI,CAAC,oBAAoB,QAAQ,QAAQ,uBAAuB,GAAG;AACjE,YAAM,IAAI,YAAY,qBAAqB,KAAK;AAAA,IAClD;AACA,WAAO;AAAA,MACL,MAAM;AAAA,MACN,qBAAqB,OAAO;AAAA,MAC5B,cAAc;AAAA,MACd,QAAQ,oBAAoB;AAAA,QAC1B,+BAA+B,OAAO;AAAA,QACtC;AAAA,QACA,gBAAgB;AAAA,QAChB;AAAA,QACA,QAAQ,OAAO;AAAA,MACjB,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,IAAI,YAAY,qBAAqB,KAAK;AAClD;AAEA,SAAS,oBACP,QACA,QACA,OACwE;AACxE,SAAO;AAAA,IACL,UACA,OAAO,eACP,OAAO,qBAAqB,OAAO,0BACnC,OAAO,eACP,wBAAwB,MAAM,OAAO,WAAW,CAAC,MAC/C,wBAAwB,OAAO,WAAW;AAAA,EAC9C;AACF;AAEA,SAAS,wBACP,UACA,kBACgC;AAChC,SAAO,SAAS,gBAAgB,KAAK,CAAC,WAAW,OAAO,OAAO,gBAAgB,KAAK;AACtF;AAEA,SAAS,oBAAoB,OAYwD;AACnF,SAAO;AAAA,IACL,aAAa;AAAA,IACb,gBAAgB;AAAA,IAChB,yBAAyB,MAAM;AAAA,IAC/B,WAAW,OAAO,eAAe;AAC/B,YAAM,YAAY,MAAM,yBAAyB;AAAA,QAC/C,SAAS,MAAM,eAAe;AAAA,QAC9B,QAAQ,MAAM;AAAA,QACd,QAAQ;AAAA,UACN,UAAU,MAAM,OAAO;AAAA,UACvB,gBAAgB,MAAM,OAAO;AAAA,UAC7B,cAAc,MAAM,OAAO,oBAAoB;AAAA,UAC/C,UAAU,KAAK,IAAI,MAAM,OAAO,UAAU,GAAG;AAAA,QAC/C;AAAA,QACA;AAAA,QACA,UAAU,OAAO,QAAQ,aACvB,MAAM,mBAAmB,MAAM,gBAAgB,QAAQ,UAAU,MAAM,aAAa;AAAA,MACxF,CAAC;AACD,aAAO;AAAA,QACL,GAAG;AAAA,QACH,gBAAgB;AAAA,QAChB,uBAAuB,UAAU,WAAW;AAAA,QAC5C,mBAAmB;AAAA,QACnB,kBACE,UAAU,WAAW,YACrB,UAAU,eAAe,wBACzB,UAAU,eAAe;AAAA,MAC7B;AAAA,IACF;AAAA,IACA,cAAc,OAAO,OAAO,aAC1B,MAAM,sBAAsB,MAAM,gBAAgB,OAAO,MAAM,eAAe,QAAQ;AAAA,IACxF,iBAAiB,CAAC,WAAW;AAAA,MAC3B,SAAS;AAAA,MACT,aAAa;AAAA,MACb,yBAAyB,MAAM;AAAA,MAC/B,SAAS,MAAM,eAAe;AAAA,MAC9B,YAAY,MAAM,eAAe;AAAA,MACjC,kBAAkB,MAAM;AAAA,MACxB,WAAW,MAAM;AAAA,IACnB;AAAA,EACF;AACF;AAEO,SAAS,sBAAsB,OAqBmD;AACvF,QAAM,eAAe,MAAM,OAAO,oBAAoB;AACtD,QAAM,WAAwC,MAAM,YAAY;AAAA,IAC9D,mBAAmB,OAAO,YACxB,MAAM,uBAAuB,SAAS,MAAM,eAAe,MAAM,OAAO,MAAM,aAAa;AAAA,IAC7F,aAAa,OAAO,WAAW,SAAS,aACtC,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AAAA,IACF,SAAS,OAAO,WACd,MAAM,aAAa,QAAQ,MAAM,eAAe,MAAM,OAAO,MAAM,aAAa;AAAA,IAClF,cAAc,OAAO,YACnB,MAAM,kBAAkB,SAAS,MAAM,eAAe,MAAM,OAAO,MAAM,aAAa;AAAA,IACxF,iBAAiB,OAAO,YACtB,MAAM,qBAAqB,SAAS,MAAM,eAAe,MAAM,OAAO,MAAM,aAAa;AAAA,EAC7F;AACA,QAAM,QAAQ,SAAS,OAAO,KAAK;AACnC,QAAM,eAAe;AAAA,IACnB,UAAU,MAAM,OAAO;AAAA,IACvB,qBAAqB,MAAM,OAAO;AAAA,IAClC;AAAA,EACF;AACA,SAAO;AAAA,IACL,aAAa;AAAA,IACb,gBAAgB;AAAA,IAChB,yBAAyB,MAAM;AAAA,IAC/B,WAAW,OAAO,qBAAqB,mBAAmB;AACxD,YAAM,iBAAiB;AAAA,QACrB,cAAc,MAAM;AAAA,QACpB,oBAAoB,MAAM,SAAS;AAAA,QACnC,UAAU,MAAM,eAAe;AAAA,QAC/B,SAAS,MAAM,eAAe;AAAA,MAChC;AACA,YAAM,uBAAuB;AAAA,QAC3B;AAAA,QACA;AAAA,MACF;AACA,YAAM,SAAS,8BAA8B,gBAAgB,cAAc;AAC3E,YAAM,aAAa;AAAA,QACjB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM,MAAM,IAAI,KAAK,MAAM,CAAC;AAE5B,YAAM,wBAAwB,OAAO,SAQ/B;AACJ,cAAM,iBAAiB,KAAK,qBAAqB,OAAO,aAAa;AACrE,cAAM,4BAA4B,KAAK,qBAAqB,OAAO,mBAAmB;AACtF,cAAM,yBAAyB;AAAA,UAC7B,eAAe,KAAK,sBAAsB,gBAAgB;AAAA,UAC1D,kBAAkB,KAAK,sBAAsB,mBAAmB;AAAA,UAChE,WAAW,KAAK,sBAAsB,YAAY,KAAK;AAAA,QACzD;AACA,cAAM,iBAAiB,2BAA2B,wBAAwB,YAAY;AACtF,cAAM,iBAAiB,6CAA6C;AAAA,UAClE,GAAG;AAAA,UACH,GAAG;AAAA,QACL,CAAC;AACD,YAAI,gBAAgB;AAClB,iBAAO;AAAA,YACL,QAAQ;AAAA,YACR,YAAY;AAAA,YACZ,SAAS,CAAC;AAAA,YACV,YAAY;AAAA,YACZ;AAAA,YACA,uBAAuB;AAAA,YACvB,mBAAmB,KAAK;AAAA,YACxB,kBAAkB,uBAAuB;AAAA,YACzC,WAAW,uBAAuB;AAAA,YAClC,kBAAkB;AAAA,UACpB;AAAA,QACF;AAEA,cAAM,gBAAgB,MAAM,OAAO,WAAW,KAAK,sBAAsB;AACzE,cAAM,2BACJ,MAAM,OAAO,sBAAsB,KAAK,sBAAsB;AAChE,cAAM,qBAAqB,eAAe,uBAAuB;AACjE,cAAM,YAAY,MAAM,2BAA2B;AAAA,UACjD,oBAAoB,MAAM,SAAS;AAAA,UACnC,aAAa,MAAM,SAAS;AAAA,UAC5B,QAAQ,MAAM;AAAA,UACd,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,qBAAqB,MAAM;AAAA,UAC3B,QAAQ;AAAA,YACN,UAAU;AAAA,YACV,eAAe,MAAM,OAAO;AAAA,YAC5B,gBAAgB;AAAA,YAChB,cAAc,KAAK,IAAI,uCAAuC,kBAAkB;AAAA,YAChF,cAAc,MAAM,OAAO;AAAA,YAC3B,YAAY,KAAK,IAAI,gBAAgB,GAAG,GAAK;AAAA,YAC7C,UAAU,KAAK,IAAI,eAAe,GAAG;AAAA,UACvC;AAAA,UACA,YAAY,KAAK;AAAA,UACjB,cAAc,SAAS;AAAA,UACvB,KAAK;AAAA,QACP,CAAC;AACD,cAAM,qBAAqB,KAAK,qBAAqB,UAAU,IAAI;AACnE,cAAM,SAAS;AAAA,UACb,eAAe,KAAK,sBAAsB,gBAAgB,UAAU,OAAO;AAAA,UAC3E,kBACE,KAAK,sBAAsB,mBAAmB,UAAU,OAAO;AAAA,UACjE,WAAW,KAAK,sBAAsB,YAAY;AAAA,QACpD;AACA,cAAM,aAAa;AAAA,UACjB,UAAU;AAAA,UACV,KAAK;AAAA,UACL,MAAM,OAAO;AAAA,QACf;AACA,YAAI,WAAW,UAAU;AACvB,iBAAO;AAAA,YACL,QAAQ;AAAA,YACR,YAAY;AAAA,YACZ,SAAS,CAAC;AAAA,YACV,YAAY;AAAA,YACZ;AAAA,YACA,uBAAuB;AAAA,YACvB,mBAAmB,KAAK;AAAA,YACxB,kBAAkB,OAAO;AAAA,YACzB,WAAW,OAAO;AAAA,YAClB,kBAAkB;AAAA,UACpB;AAAA,QACF;AACA,cAAM,aACJ,UAAU,WAAW,aACjB,8BAA8B;AAAA,UAC5B,GAAG;AAAA,UACH,YAAY,KAAK;AAAA,UACjB,WAAW,KAAK;AAAA,UAChB,oBAAoB,QAAQ,oBAAoB;AAAA,UAChD,cAAc;AAAA,UACd,8BAA8B,MAAM;AAAA,QACtC,CAAC,IACD;AACN,eAAO;AAAA,UACL,QAAQ,UAAU;AAAA,UAClB,YAAY,UAAU;AAAA,UACtB,SAAS,WAAW;AAAA,UACpB,YACE,UAAU,WAAW,YAAY,UAAU,aACvC,6CAA6C;AAAA,YAC3C,GAAG;AAAA,YACH,YAAY,KAAK;AAAA,YACjB,gBAAgB,KAAK;AAAA,YACrB,mBAAmB,KAAK;AAAA,YACxB,uBAAuB,KAAK;AAAA,YAC5B;AAAA,YACA,qBAAqB,UAAU;AAAA,YAC/B,gBAAgB,WAAW;AAAA,UAC7B,CAAC,IACD;AAAA,UACN,gBAAgB;AAAA,UAChB,uBAAuB,UAAU,WAAW;AAAA,UAC5C,mBAAmB,KAAK;AAAA,UACxB,kBAAkB,OAAO;AAAA,UACzB,WAAW,OAAO;AAAA,UAClB,kBACE,UAAU,WAAW,YACrB,+BAA+B,UAAU,YAAY,QAAQ,YAAY;AAAA,QAC7E;AAAA,MACF;AAEA,YAAM,4BAA4B,OAAO,YAInC;AACJ,cAAM,uBAAuB,MAAM;AACnC,cAAM,mBAAmB,QAAQ,OAAO;AACxC,cAAM,SAAS,EAAE,GAAG,QAAQ,OAAO;AACnC,cAAM,iBAAiB,MAAM;AAC3B,iBAAO,YAAY,mBAAmB,KAAK,IAAI,GAAG,MAAM,IAAI,oBAAoB;AAAA,QAClF;AACA,cAAM,0BAA0B,MAAM;AACpC,yBAAe;AACf,cAAI,2BAA2B,QAAQ,YAAY,GAAG;AACpD,kBAAM,IAAI,YAAY,kBAAkB,KAAK;AAAA,UAC/C;AACA,iBAAO,oBAAoB;AAAA,QAC7B;AAEA,gCAAwB;AACxB,cAAM,iBAAiB,MAAM,SAAS,kBAAkB,MAAM,eAAe,OAAO;AACpF,uBAAe;AAEf,YAAI,aAAa,QAAQ;AACzB,YAAI,CAAC,YAAY;AACf,cAAI,MAAM,eAAe,OAAO,UAAU,MAAM,eAAe,YAAY,MAAM;AAC/E,oCAAwB;AACxB,gBAAI;AACF,2BAAa,MAAM,oCAAoC;AAAA,gBACrD,QAAQ,MAAM;AAAA,gBACd,SAAS,SAAS;AAAA,cACpB,CAAC;AAAA,YACH,SAAS,OAAO;AACd,kBAAI,iBAAiB,iCAAiC;AACpD,sBAAM,IAAI,YAAY,4BAA4B,KAAK;AAAA,cACzD;AACA,oBAAM;AAAA,YACR;AACA,2BAAe;AAAA,UACjB,OAAO;AACL,yBAAa,MAAM,eAAe;AAAA,UACpC;AAAA,QACF;AAEA,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA,mBAAmB,QAAQ;AAAA,UAC3B,uBAAuB;AAAA,UACvB,oBAAoB;AAAA,UACpB,qBAAqB;AAAA,UACrB,gBAAgB,CAAC;AAAA,QACnB;AAAA,MACF;AAEA,UAAI,YAAY,SAAS,oCAAoC;AAC3D,eAAO,MAAM,sBAAsB,UAAU;AAAA,MAC/C;AACA,UAAI,CAAC,QAAQ;AACX,cAAM,SACJ,YAAY,SAAS,yBACjB,WAAW,kBAAkB,SAC7B,2BAA2B;AACjC,eAAO,MAAM;AAAA,UACX,MAAM,0BAA0B;AAAA,YAC9B;AAAA,YACA,YAAY;AAAA,YACZ,mBAAmB,mBAAmB;AAAA,UACxC,CAAC;AAAA,QACH;AAAA,MACF;AACA,UAAI,CAAC,cAAc,CAAC,wBAAwB,iCAAiC,QAAQ,GAAG,GAAG;AACzF,eAAO,MAAM;AAAA,UACX,MAAM,0BAA0B;AAAA,YAC9B,QAAQ,2BAA2B;AAAA,YACnC,YAAY,OAAO;AAAA,YACnB,mBAAmB;AAAA,UACrB,CAAC;AAAA,QACH;AAAA,MACF;AAEA,UAAI;AACF,cAAM,0BACJ,wBAAwB,iCAAiC,QAAQ,GAAG;AACtE,cAAM,oBACJ,YAAY,SAAS,yBACjB;AAAA,UACE,GAAG,WAAW;AAAA,UACd,4BACE,WAAW,kBAAkB,8BAC7B;AAAA,QACJ,IACA;AACN,cAAM,UAAU,MAAM,wBAAwB;AAAA,UAC5C,QAAQ,MAAM;AAAA,UACd;AAAA,UACA,YAAY;AAAA,UACZ,UAAU,MAAM,OAAO;AAAA,UACvB,qBAAqB,MAAM,OAAO;AAAA,UAClC;AAAA,UACA,wBAAwB,KAAK,IAAI,uCAAuC,YAAY;AAAA,UACpF,cAAc,MAAM,OAAO;AAAA,UAC3B,aAAa,OAAO,WAAW,aAC7B,MAAM,SAAS,YAAY,WAAW,MAAM,eAAe,SAAS,QAAQ;AAAA,UAC9E,SAAS,SAAS;AAAA,UAClB,2BAA2B,MAAM;AAAA,UACjC,KAAK;AAAA,QACP,CAAC;AACD,YAAI,QAAQ,WAAW,YAAY,QAAQ,YAAY;AACrD,iBAAO;AAAA,YACL,QAAQ;AAAA,YACR,YAAY,QAAQ;AAAA,YACpB,SAAS,QAAQ;AAAA,YACjB,YAAY;AAAA,cACV,SAAS;AAAA,cACT,MAAM;AAAA,cACN,GAAG;AAAA,cACH,mBAAmB;AAAA,gBACjB,GAAG,QAAQ;AAAA,gBACX,4BACE,QAAQ,WAAW,8BAA8B;AAAA,cACrD;AAAA,YACF;AAAA,YACA;AAAA,YACA,uBAAuB;AAAA,YACvB,mBAAmB;AAAA,YACnB,kBAAkB,QAAQ;AAAA,YAC1B,WAAW,QAAQ;AAAA,YACnB,kBAAkB,QAAQ;AAAA,UAC5B;AAAA,QACF;AACA,YAAI,CAAC,QAAQ,kBAAmB,OAAM,IAAI,MAAM,qCAAqC;AACrF,YAAI,QAAQ,8BAA8B,yBAAyB;AACjE,gBAAM,iBAAiB,2BAA2B,QAAQ,QAAQ,YAAY;AAC9E,iBAAO;AAAA,YACL,QAAQ;AAAA,YACR,YAAY,kBAAmB;AAAA,YAC/B,SAAS,QAAQ;AAAA,YACjB,YAAY,6CAA6C;AAAA,cACvD,GAAG;AAAA,cACH,YAAY,OAAO;AAAA,cACnB,gBAAgB,QAAQ;AAAA,cACxB,mBAAmB;AAAA,cACnB,uBAAuB,QAAQ;AAAA,cAC/B,oBAAoB;AAAA,cACpB,qBAAqB;AAAA,cACrB,gBAAgB,yBAAyB,QAAQ,SAAS,MAAM,OAAO,QAAQ;AAAA,YACjF,CAAC;AAAA,YACD;AAAA,YACA,uBAAuB;AAAA,YACvB,mBAAmB;AAAA,YACnB,kBAAkB,QAAQ;AAAA,YAC1B,WAAW,QAAQ;AAAA,YACnB,kBAAkB,mBAAmB;AAAA,UACvC;AAAA,QACF;AACA,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,YAAY;AAAA,UACZ,SAAS,QAAQ;AAAA,UACjB,YAAY;AAAA,UACZ,gBAAgB,gCAAgC,QAAQ,QAAQ,iBAAiB;AAAA,UACjF,uBAAuB;AAAA,UACvB,mBAAmB;AAAA,UACnB,kBAAkB,QAAQ;AAAA,UAC1B,WAAW,QAAQ;AAAA,UACnB,kBAAkB;AAAA,QACpB;AAAA,MACF,SAAS,OAAO;AACd,YAAI,iBAAiB,iCAAiC;AACpD,gBAAM,IAAI,YAAY,4BAA4B,KAAK;AAAA,QACzD;AACA,YAAI,EAAE,iBAAiB,+BAAgC,OAAM;AAC7D,cAAM,OAAO,MAAM,0BAA0B;AAAA,UAC3C,QAAQ,MAAM,UAAU,2BAA2B;AAAA,UACnD,YAAY,OAAO;AAAA,UACnB,mBAAmB;AAAA,QACrB,CAAC;AACD,cAAM,iBAAiB,2BAA2B,KAAK,uBAAuB,YAAY;AAC1F,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,YAAY,kBAAmB;AAAA,UAC/B,SAAS,CAAC;AAAA,UACV,YAAY,6CAA6C;AAAA,YACvD,GAAG;AAAA,YACH,GAAG;AAAA,UACL,CAAC;AAAA,UACD;AAAA,UACA,uBAAuB;AAAA,UACvB,mBAAmB;AAAA,UACnB,kBAAkB,KAAK,sBAAsB;AAAA,UAC7C,WAAW,KAAK,sBAAsB;AAAA,UACtC,kBAAkB,mBAAmB;AAAA,QACvC;AAAA,MACF;AAAA,IACF;AAAA,IACA,cAAc,OAAO,OAAO,aAC1B,MAAM,gBAAgB,OAAO,MAAM,eAAe,UAAU,MAAM,OAAO,MAAM,aAAa;AAAA,IAC9F,SAAS,OAAO,OAAO,wBAAwB;AAC7C,UAAI,CAAC,SAAS,iBAAiB;AAC7B,cAAM,IAAI,YAAY,qBAAqB,KAAK;AAAA,MAClD;AACA,aAAO,MAAM,8BAA8B;AAAA,QACzC;AAAA,QACA;AAAA,QACA,iBAAiB,SAAS;AAAA,QAC1B,SAAS,SAAS;AAAA,QAClB,KAAK;AAAA,MACP,CAAC;AAAA,IACH;AAAA,IACA,iBAAiB,CAAC,WAAW;AAAA,MAC3B,SAAS;AAAA,MACT,aAAa;AAAA,MACb,yBAAyB,MAAM;AAAA,MAC/B,kBAAkB,MAAM;AAAA,MACxB,kBAAkB,MAAM;AAAA,MACxB,SAAS,MAAM;AAAA,MACf,WAAW,MAAM;AAAA,IACnB;AAAA,EACF;AACF;AAiCA,SAAS,gDACP,OACA,UACS;AACT,SACE,OAAO,YAAY,KACnB,MAAM,SAAS,sCACf,MAAM,iBAAiB,SAAS,gBAChC,MAAM,uBAAuB,SAAS,sBACtC,MAAM,aAAa,SAAS,YAC5B,MAAM,YAAY,SAAS,WAC3B,iBAAiB,KAAK,KAAK;AAE/B;AAEA,SAAS,oCACP,OACA,UACA,QACuC;AACvC,MACE,CAAC,SACD,MAAM,iBAAiB,SAAS,gBAChC,MAAM,uBAAuB,SAAS,sBACtC,MAAM,aAAa,SAAS,YAC5B,MAAM,YAAY,SAAS,WAC3B,iBAAiB,KAAK,IAAI,6CAC1B;AACA,WAAO;AAAA,EACT;AACA,MAAI,MAAM,YAAY,KAAK,MAAM,SAAS,wBAAwB;AAChE,UAAM,oBAAoB,kCAAkC,MAAM,mBAAmB,MAAM;AAC3F,WAAO,oBACF,EAAE,GAAG,OAAO,kBAAkB,IAC/B;AAAA,EACN;AACA,MAAI,MAAM,YAAY,KAAK,MAAM,SAAS,oCAAoC;AAC5E,UAAM,wBAAwB,2BAA2B,MAAM,uBAAuB,MAAM;AAC5F,UAAM,iBAAiB,+BAA+B,MAAM,gBAAgB,OAAO,QAAQ;AAC3F,QACE,OAAO,MAAM,eAAe,YAC5B,MAAM,WAAW,SAAS,KAC1B,MAAM,WAAW,SAAS,QAC1B,OAAO,MAAM,mBAAmB,YAChC,MAAM,eAAe,SAAS,KAC9B,MAAM,eAAe,SAAS,QAC9B,OAAO,MAAM,sBAAsB,aACnC,CAAC,yBACD,CAAC,kBACD,CAAC,OAAO,cAAc,MAAM,kBAAkB,KAC9C,OAAO,MAAM,kBAAkB,IAAI,KACnC,OAAO,MAAM,kBAAkB,IAAI,OAAO,gBAC1C,sBAAsB,YAAY,OAAO,MAAM,kBAAkB,IAAI,OAAO,gBAC3E,MAAM,wBAAwB,SAC5B,CAAC,MAAM,uBACN,OAAO,MAAM,wBAAwB,YACrC,MAAM,QAAQ,MAAM,mBAAmB,IAC3C;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,MACL,GAAG;AAAA,MACH;AAAA,MACA,oBAAoB,OAAO,MAAM,kBAAkB;AAAA,MACnD;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,6CACP,OACyC;AACzC,QAAM,aAAa;AAAA,IACjB,SAAS;AAAA,IACT,MAAM;AAAA,IACN,GAAG;AAAA,IACH,gBAAgB,MAAM,eAAe,IAAI,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC;AAAA,EAChE;AACA,MAAI,iBAAiB,UAAU,IAAI,6CAA6C;AAC9E,UAAM,IAAI,YAAY,kBAAkB,KAAK;AAAA,EAC/C;AACA,SAAO;AACT;AAEA,SAAS,+BACP,OACA,UACmC;AACnC,MAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,SAAU,QAAO;AAC7D,QAAM,SAAqC,CAAC;AAC5C,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,SAAS,OAAO;AACzB,QACE,CAAC,MAAM,QAAQ,KAAK,KACpB,MAAM,WAAW,KACjB,OAAO,MAAM,CAAC,MAAM,YACpB,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,KACzB,MAAM,CAAC,EAAE,SAAS,QACjB,MAAM,CAAC,MAAM,SACX,OAAO,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,EAAE,SAAS,KAAK,MAAM,CAAC,EAAE,SAAS,QAC5E,KAAK,IAAI,MAAM,CAAC,CAAC,GACjB;AACA,aAAO;AAAA,IACT;AACA,SAAK,IAAI,MAAM,CAAC,CAAC;AACjB,WAAO,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;AAAA,EAClC;AACA,SAAO;AACT;AAEA,SAAS,yBACP,SACA,UAC4B;AAC5B,QAAM,aAAa,mCAAmC,SAAS,CAAC,GAAG,QAAQ;AAC3E,MAAI,WAAW,SAAU,OAAM,IAAI,YAAY,4BAA4B,KAAK;AAChF,SAAO,WAAW;AACpB;AAEO,SAAS,2CAA2C,OAK/C;AACV,MAAI,MAAM,YAAY,qBAAqB,MAAM,MAAM,kBAAkB;AACvE,UAAM,IAAI,YAAY,4BAA4B,KAAK;AAAA,EACzD;AACA,MACE,MAAM,YAAY,gBAAgB,cAClC,MAAM,YAAY,gBAAgB,YAClC;AACA,WAAO;AAAA,EACT;AACA,MAAI,MAAM,YAAY,gBAAgB,YAAY;AAChD,UAAM,IAAI,YAAY,4BAA4B,KAAK;AAAA,EACzD;AACA,QAAM,UAAU,MAAM,YAAY;AAClC,QAAM,aAAa,UACf;AAAA,IACE,QAAQ;AAAA,IACR,MAAM,YAAY;AAAA,EACpB,IACA;AACJ,QAAM,iBACJ,YAAY,QACZ,QAAQ,yBAAyB,YACjC,QAAQ,8BAA8B,MAAM,6BAC5C,QAAQ,8BAA8B,QAAQ,oCAC9C,QAAQ,kBAAkB,MAAM,iBAChC,QAAQ,0BAA0B,aAClC,eAAe,QACf,cAAc,MACb,aAAa,KAAK,QAAQ,iBAAiB,MAAM,YAAY;AAChE,MAAI,CAAC,eAAgB,OAAM,IAAI,YAAY,4BAA4B,KAAK;AAC5E,SAAO;AACT;AAEO,SAAS,yCACd,YACA,cACA,UACgC;AAChC,MACE,CAAC,cACD,WAAW,YAAY,KACvB,WAAW,SAAS,oCACpB;AACA,WAAO;AAAA,EACT;AACA,QAAM,eAAe,+BAA+B,WAAW,gBAAgB,QAAQ;AACvF,MAAI,CAAC,aAAc,OAAM,IAAI,YAAY,4BAA4B,KAAK;AAC1E,QAAM,SAAS,IAAI,IAA2B,YAAY;AAC1D,aAAW,eAAe,cAAc;AACtC,WAAO,IAAI,YAAY,kBAAkB,YAAY,gBAAgB;AAAA,EACvE;AACA,MAAI,OAAO,OAAO,SAAU,OAAM,IAAI,YAAY,kBAAkB,KAAK;AACzE,QAAM,SAAS;AAAA,IACb,GAAG;AAAA,IACH,gBAAgB,CAAC,GAAG,MAAM;AAAA,EAC5B;AACA,MAAI,iBAAiB,MAAM,IAAI,6CAA6C;AAC1E,UAAM,IAAI,YAAY,kBAAkB,KAAK;AAAA,EAC/C;AACA,SAAO;AACT;AAEA,SAAS,mCACP,SACA,gBACA,UAKA;AACA,QAAM,SAAS,IAAI,IAA2B,cAAc;AAC5D,QAAM,WAAwC,CAAC;AAC/C,aAAW,SAAS,SAAS;AAC3B,QAAI,CAAC,OAAO,IAAI,MAAM,gBAAgB,GAAG;AACvC,aAAO,IAAI,MAAM,kBAAkB,MAAM,iBAAiB;AAC1D,eAAS,KAAK,KAAK;AAAA,IACrB,OAAO;AACL,YAAM,aAAa;AAAA,QACjB,MAAM;AAAA,QACN,OAAO,IAAI,MAAM,gBAAgB,KAAK;AAAA,MACxC;AACA,UAAI,eAAe,MAAM;AACvB,eAAO;AAAA,UACL,SAAS,CAAC;AAAA,UACV,gBAAgB,CAAC,GAAG,MAAM;AAAA,UAC1B,UAAU;AAAA,QACZ;AAAA,MACF;AACA,UAAI,aAAa,GAAG;AAClB,eAAO,IAAI,MAAM,kBAAkB,MAAM,iBAAiB;AAC1D,iBAAS,KAAK,KAAK;AAAA,MACrB;AAAA,IACF;AACA,QAAI,OAAO,OAAO,SAAU,OAAM,IAAI,YAAY,kBAAkB,KAAK;AAAA,EAC3E;AACA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,gBAAgB,CAAC,GAAG,MAAM;AAAA,IAC1B,UAAU;AAAA,EACZ;AACF;AAEA,SAAS,iBAAiB,OAAwB;AAChD,MAAI;AACF,WAAO,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,EACzD,QAAQ;AACN,WAAO,OAAO;AAAA,EAChB;AACF;AAEA,SAAS,2BACP,OACA,QAC8B;AAC9B,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAM,MAAM;AACZ,aAAW,CAAC,KAAK,OAAO,KAAK;AAAA,IAC3B,CAAC,iBAAiB,OAAO,QAAQ;AAAA,IACjC,CAAC,oBAAoB,OAAO,mBAAmB;AAAA,IAC/C,CAAC,aAAa,OAAO,YAAY;AAAA,EACnC,GAAY;AACV,UAAM,cAAc,IAAI,GAAG;AAC3B,QACE,CAAC,OAAO,cAAc,WAAW,KACjC,OAAO,WAAW,IAAI,KACtB,OAAO,WAAW,IAAI,SACtB;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,6BAAoD;AAC3D,SAAO,EAAE,eAAe,GAAG,kBAAkB,GAAG,WAAW,EAAE;AAC/D;AAEA,SAAS,2BACP,QACA,QAIO;AACP,MAAI,OAAO,iBAAiB,OAAO,SAAU,QAAO;AACpD,MAAI,OAAO,oBAAoB,OAAO,oBAAqB,QAAO;AAClE,MAAI,OAAO,aAAa,OAAO,aAAc,QAAO;AACpD,SAAO;AACT;AAEA,SAAS,+BACP,QACA,QACA,QACS;AACT,MAAI,WAAW,uBAAuB,WAAW,gBAAgB,WAAW,oBAAoB;AAC9F,WAAO;AAAA,EACT;AACA,SAAO,WAAW,wBAAwB,OAAO,aAAa,OAAO;AACvE;AAEA,eAAe,uBACb,SACA,eACA,OACA,eACiB;AACjB,MAAI,CAAC,cAAe,OAAM,IAAI,YAAY,iCAAiC,MAAM,IAAI;AACrF,QAAM,MAAM,IAAI,IAAI,GAAG,cAAc,yBAAyB;AAC9D,MAAI,aAAa,IAAI,qBAAqB,MAAM;AAChD,MAAI,QAAS,KAAI,aAAa,IAAI,WAAW,OAAO;AACpD,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA,EAAE,SAAS,EAAE,eAAe,QAAQ,mBAAmB,EAAE;AAAA,IACzD;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,SAAS,GAAI,0BAAyB,QAAQ;AACnD,QAAM,UAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO,eAAe,QAAQ,gBAAgB,kBAAkB;AAClE;AAEA,eAAe,iBACb,WACA,SACA,UACA,eACA,OACA,eACiC;AACjC,MAAI,CAAC,cAAe,OAAM,IAAI,YAAY,iCAAiC,MAAM,IAAI;AACrF,QAAM,MAAM,IAAI,IAAI,GAAG,cAAc,UAAU;AAC/C,MAAI,aAAa,IAAI,aAAa,SAAS;AAC3C,MAAI,aAAa,IAAI,YAAY,OAAO,QAAQ,CAAC;AACjD,MAAI,aAAa,IAAI,qBAAqB,MAAM;AAChD,MAAI,aAAa,IAAI,6BAA6B,MAAM;AACxD,MAAI,aAAa,IAAI,UAAU,OAAO;AACtC,MAAI,aAAa;AAAA,IACf;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAS,KAAI,aAAa,IAAI,WAAW,OAAO;AACpD,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA,EAAE,SAAS,EAAE,eAAe,QAAQ,mBAAmB,EAAE;AAAA,IACzD;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,SAAS,WAAW,IAAK,OAAM,IAAI,8BAA8B;AACrE,MAAI,CAAC,SAAS,GAAI,0BAAyB,QAAQ;AACnD,QAAM,UAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,UAAU,MAAM,QAAQ,QAAQ,OAAO,IAAI,QAAQ,UAAU,CAAC;AACpE,SAAO;AAAA,IACL,SAAS,QAAQ,IAAI,CAAC,UAAU;AAC9B,YAAM,MAAM,SAAS,OAAO,UAAU,WAAY,QAAoC,CAAC;AACvF,YAAM,SAAS,eAAe,IAAI,QAAQ,gBAAgB;AAC1D,aAAO;AAAA,QACL;AAAA,QACA,SAAS,IAAI,YAAY;AAAA,QACzB,MAAM,IAAI,QAAQ,OAAO,IAAI,SAAS,WAAW,uBAAuB,IAAI,IAAI,IAAI;AAAA,MACtF;AAAA,IACF,CAAC;AAAA,IACD,eAAe,eAAe,QAAQ,aAAa;AAAA,IACnD,mBAAmB,eAAe,QAAQ,iBAAiB;AAAA,EAC7D;AACF;AAEA,eAAe,aACb,QACA,eACA,OACA,eACkD;AAClD,MAAI,CAAC,cAAe,OAAM,IAAI,YAAY,iCAAiC,MAAM,IAAI;AACrF,QAAM,MAAM,IAAI,IAAI,GAAG,cAAc,UAAU,mBAAmB,MAAM,CAAC,EAAE;AAC3E,MAAI,aAAa,IAAI,qBAAqB,MAAM;AAChD,MAAI,aAAa;AAAA,IACf;AAAA,IACA;AAAA,EACF;AACA,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA,EAAE,SAAS,EAAE,eAAe,QAAQ,mBAAmB,EAAE;AAAA,IACzD;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,SAAS,WAAW,IAAK,QAAO;AACpC,MAAI,CAAC,SAAS,GAAI,0BAAyB,QAAQ;AACnD,SAAO;AAAA,IACL,MAAM,wBAAwB,UAAU,sBAAsB,4BAA4B;AAAA,EAC5F;AACF;AAEA,eAAe,qBACb,OACA,eACA,OACA,eACqC;AACrC,MAAI,CAAC,cAAe,OAAM,IAAI,YAAY,iCAAiC,MAAM,IAAI;AACrF,QAAM,MAAM,IAAI,IAAI,GAAG,cAAc,UAAU,mBAAmB,MAAM,MAAM,CAAC,cAAc;AAC7F,MAAI,aAAa,IAAI,qBAAqB,MAAM;AAChD,MAAI,aAAa,IAAI,YAAY,OAAO,MAAM,QAAQ,CAAC;AACvD,MAAI,aAAa;AAAA,IACf;AAAA,IACA;AAAA,EACF;AACA,MAAI,MAAM,UAAW,KAAI,aAAa,IAAI,aAAa,MAAM,SAAS;AACtE,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA,EAAE,SAAS,EAAE,eAAe,QAAQ,mBAAmB,EAAE;AAAA,IACzD;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KAAK;AACtD,WAAO,EAAE,aAAa,CAAC,GAAG,eAAe,MAAM,QAAQ,KAAK;AAAA,EAC9D;AACA,MAAI,CAAC,SAAS,GAAI,0BAAyB,QAAQ;AACnD,QAAM,UAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,iBAAiB,MAAM,QAAQ,QAAQ,WAAW,IAAI,QAAQ,cAAc;AAClF,MAAI,CAAC,eAAgB,OAAM,IAAI,YAAY,4BAA4B,KAAK;AAC5E,SAAO;AAAA,IACL,aAAa,eAAe,IAAI,oBAAoB;AAAA,IACpD,eAAe,eAAe,QAAQ,aAAa;AAAA,IACnD,QAAQ;AAAA,EACV;AACF;AAEA,eAAsB,8BAA8B,OAMR;AAC1C,MAAI,CAAC,OAAO,cAAc,MAAM,mBAAmB,KAAK,MAAM,sBAAsB,GAAG;AACrF,UAAM,IAAI,YAAY,kBAAkB,KAAK;AAAA,EAC/C;AACA,QAAM,MAAM,MAAM,OAAO,KAAK;AAC9B,QAAM,aAAa,IAAI,KAAK,IAAI,CAAC;AACjC,MAAI,CAAC,OAAO,SAAS,WAAW,QAAQ,CAAC,GAAG;AAC1C,UAAM,IAAI,YAAY,4BAA4B,KAAK;AAAA,EACzD;AACA,QAAM,cAAuC,CAAC;AAC9C,QAAM,aAAa,oBAAI,IAAY;AACnC,MAAI,YAA2B;AAC/B,MAAI,mBAAmB;AACvB,MAAI,uBAAuB;AAC3B,KAAG;AACD,QAAI,oBAAoB,MAAM,qBAAqB;AACjD,YAAM,IAAI,YAAY,kBAAkB,KAAK;AAAA,IAC/C;AACA,wBAAoB;AACpB,UAAM,OAAO,MAAM,MAAM,gBAAgB;AAAA,MACvC,QAAQ,MAAM,MAAM;AAAA,MACpB;AAAA,MACA,UAAU,KAAK,IAAI,KAAK,kCAAkC,YAAY,MAAM;AAAA,IAC9E,CAAC;AACD,QAAI,KAAK,QAAQ;AACf,6BAAuB;AACvB;AAAA,IACF;AACA,gBAAY,KAAK,GAAG,KAAK,WAAW;AACpC,QAAI,YAAY,SAAS,iCAAiC;AACxD,YAAM,IAAI,YAAY,kBAAkB,KAAK;AAAA,IAC/C;AACA,gBAAY,KAAK;AACjB,QAAI,WAAW;AACb,UAAI,UAAU,SAAS,QAAQ,WAAW,IAAI,SAAS,GAAG;AACxD,cAAM,IAAI,YAAY,4BAA4B,KAAK;AAAA,MACzD;AACA,iBAAW,IAAI,SAAS;AAAA,IAC1B;AAAA,EACF,SAAS;AAET,MAAI,sBAAsB;AACxB,QAAI,CAAC,MAAM,WAAW,oBAAoB,MAAM,qBAAqB;AACnE,aAAO,6BAA6B,MAAM,OAAO,YAAY,gBAAgB;AAAA,IAC/E;AACA,wBAAoB;AACpB,UAAM,UAAU,MAAM,MAAM,QAAQ,MAAM,MAAM,gBAAgB;AAChE,QAAI,CAAC,WAAW,QAAQ,SAAS;AAC/B,aAAO,6BAA6B,MAAM,OAAO,YAAY,gBAAgB;AAAA,IAC/E;AACA,UAAMO,eAAcF,YAAW,QAAQ,EACpC;AAAA,MACC,KAAK,UAAU;AAAA,QACb,SAAS;AAAA,QACT,MAAM;AAAA,QACN,kBAAkB,MAAM,MAAM;AAAA,QAC9B,kBAAkB,MAAM,MAAM;AAAA,MAChC,CAAC;AAAA,IACH,EACC,OAAO,KAAK;AACf,WAAO;AAAA,MACL,aAAa;AAAA,MACb,kBAAkB,MAAM,MAAM;AAAA,MAC9B,SAAS,MAAM,MAAM;AAAA,MACrB,aAAAE;AAAA,MACA,YAAY,WAAW,YAAY;AAAA,MACnC,WAAW,IAAI,KAAK,WAAW,QAAQ,IAAI,6BAA6B,EAAE,YAAY;AAAA,MACtF;AAAA,MACA,YAAY,CAAC;AAAA,IACf;AAAA,EACF;AAEA,QAAM,uBAAuB,YAC1B,IAAI,CAAC,gBAAgB;AAAA,IACpB,IAAI,WAAW;AAAA,IACf,MAAM,WAAW;AAAA,IACjB,MAAM,WAAW;AAAA,IACjB,cAAc,WAAW;AAAA,IACzB,QAAQ,WAAW;AAAA,IACnB,oBAAoB,WAAW;AAAA,IAC/B,gBAAgB,WAAW;AAAA,IAC3B,WAAW,WAAW;AAAA,EACxB,EAAE,EACD,KAAK,CAAC,MAAM,UAAU,KAAK,UAAU,IAAI,EAAE,cAAc,KAAK,UAAU,KAAK,CAAC,CAAC;AAClF,QAAM,cAAcF,YAAW,QAAQ,EACpC;AAAA,IACC,KAAK,UAAU;AAAA,MACb,SAAS;AAAA,MACT,kBAAkB,MAAM,MAAM;AAAA,MAC9B,kBAAkB,MAAM,MAAM;AAAA,MAC9B,aAAa;AAAA,IACf,CAAC;AAAA,EACH,EACC,OAAO,KAAK;AACf,SAAO;AAAA,IACL,aAAa;AAAA,IACb,kBAAkB,MAAM,MAAM;AAAA,IAC9B,SAAS,MAAM,MAAM;AAAA,IACrB;AAAA,IACA,YAAY,WAAW,YAAY;AAAA,IACnC,WAAW,IAAI,KAAK,WAAW,QAAQ,IAAI,6BAA6B,EAAE,YAAY;AAAA,IACtF;AAAA,IACA,YAAY,qBAAqB,IAAI,CAAC,gBAAgB;AAAA,MACpD,MAAM,WAAW;AAAA,MACjB,cAAc,WAAW;AAAA,MACzB,cAAc,WAAW;AAAA,MACzB,QAAQ,WAAW;AAAA,MACnB,MAAM,WAAW;AAAA,MACjB,WAAW,WAAW;AAAA,MACtB,oBAAoB,WAAW;AAAA,MAC/B,gBAAgB,WAAW;AAAA,IAC7B,EAAE;AAAA,EACJ;AACF;AAEA,SAAS,6BACP,OACA,YACA,kBACA;AACA,SAAO;AAAA,IACL,aAAa;AAAA,IACb,kBAAkB,MAAM;AAAA,IACxB,SAAS,MAAM;AAAA,IACf,aAAaA,YAAW,QAAQ,EAC7B;AAAA,MACC,KAAK,UAAU;AAAA,QACb,SAAS;AAAA,QACT,MAAM;AAAA,QACN,kBAAkB,MAAM;AAAA,QACxB,kBAAkB,MAAM;AAAA,MAC1B,CAAC;AAAA,IACH,EACC,OAAO,KAAK;AAAA,IACf,YAAY,WAAW,YAAY;AAAA,IACnC,WAAW,IAAI,KAAK,WAAW,QAAQ,IAAI,6BAA6B,EAAE,YAAY;AAAA,IACtF;AAAA,IACA,YAAY,CAAC;AAAA,EACf;AACF;AAEA,SAAS,qBAAqB,OAAuC;AACnE,QAAM,MAAM,aAAa,KAAK;AAC9B,MAAI,IAAI,YAAY,KAAM,OAAM,IAAI,YAAY,4BAA4B,KAAK;AACjF,QAAM,OAAO,eAAe,IAAI,MAAM,iBAAiB;AACvD,MAAI,SAAS,UAAU,SAAS,WAAW,SAAS,YAAY,SAAS,UAAU;AACjF,UAAM,IAAI,YAAY,4BAA4B,KAAK;AAAA,EACzD;AACA,QAAM,OAAO,eAAe,IAAI,MAAM,iBAAiB;AACvD,MACE,SAAS,WACT,SAAS,eACT,SAAS,mBACT,SAAS,YACT,SAAS,eACT,SAAS,UACT;AACA,UAAM,IAAI,YAAY,4BAA4B,KAAK;AAAA,EACzD;AACA,QAAM,oBAAoB,MAAM,QAAQ,IAAI,iBAAiB,IAAI,IAAI,oBAAoB,CAAC;AAC1F,SAAO;AAAA,IACL,IAAI,eAAe,IAAI,IAAI,eAAe;AAAA,IAC1C;AAAA,IACA;AAAA,IACA,cAAc,eAAe,IAAI,YAAY;AAAA,IAC7C,QAAQ,eAAe,IAAI,MAAM;AAAA,IACjC,oBAAoB,OAAO,IAAI,uBAAuB,YAAY,IAAI,qBAAqB;AAAA,IAC3F,gBAAgB,+BAA+B,IAAI,cAAc;AAAA,IACjE,WAAW,kBAAkB,KAAK,CAAC,WAAW,aAAa,MAAM,EAAE,cAAc,IAAI;AAAA,EACvF;AACF;AAEA,SAAS,+BAA+B,OAA+B;AACrE,QAAM,YAAY,eAAe,KAAK;AACtC,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,SAAS,IAAI,KAAK,SAAS;AACjC,MAAI,CAAC,OAAO,SAAS,OAAO,QAAQ,CAAC,EAAG,OAAM,IAAI,YAAY,4BAA4B,KAAK;AAC/F,SAAO,OAAO,YAAY;AAC5B;AAEA,SAAS,yBAAyB,UAA2B;AAC3D,MAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KAAK;AACtD,UAAM,IAAI,YAAY,iCAAiC,MAAM,IAAI;AAAA,EACnE;AACA,QAAM,IAAI;AAAA,IACR,SAAS,UAAU,OAAO,SAAS,WAAW,MAC1C,yBACA;AAAA,IACJ,SAAS,UAAU,OAAO,SAAS,WAAW;AAAA,EAChD;AACF;AAEA,eAAe,mBACb,KACA,MACA,WACA,OACA,eACmB;AACnB,MAAI;AACF,WAAO,MAAM,yBAAyB;AAAA,MACpC,WAAW;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA,WAAW,CAAC,YAAY,UAAU,EAAE,UAAU,gBAAgB,GAAG,QAAQ,CAAC;AAAA,IAC5E,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,mCAAmC;AACtD,YAAM,IAAI,YAAY,wBAAwB,IAAI;AAAA,IACpD;AACA,UAAM;AAAA,EACR;AACF;AAEA,SAAS,oBACP,UACA,kBACkC;AAClC,QAAM,UACJ,SAAS,oBAAoB,SAAS,iBAAiB,CAAC,SAAS,cAAc,IAAI,CAAC;AACtF,SAAO,QAAQ,KAAK,CAAC,WAAW,OAAO,OAAO,gBAAgB,KAAK;AACrE;AAEO,SAAS,qCAAqC,OAMzC;AACV,SACE,MAAM,8BAA8B,UACpC,MAAM,sBAAsB,MAAM,6BAClC,MAAM,qBAAqB,aAC1B,MAAM,mBAAmB,UAAa,MAAM,mBAAmB,aAChE,iCAAiC,MAAM,eAAe,uBAAuB;AAEjF;AAEA,eAAe,kBACb,OACA,eACA,OACA,eACmC;AACnC,MAAI,CAAC,cAAe,OAAM,IAAI,YAAY,iCAAiC,MAAM,IAAI;AACrF,QAAM,MAAM,IAAI,IAAI,GAAG,cAAc,QAAQ;AAC7C,MAAI,aAAa;AAAA,IACf;AAAA,IACA,IAAI,MAAM,SAAS,WAAW,KAAK,KAAK,CAAC;AAAA,EAC3C;AACA,MAAI,aAAa,IAAI,YAAY,OAAO,MAAM,QAAQ,CAAC;AACvD,MAAI,aAAa,IAAI,qBAAqB,MAAM;AAChD,MAAI,aAAa,IAAI,6BAA6B,MAAM;AACxD,MAAI,aAAa;AAAA,IACf;AAAA,IACA;AAAA,EACF;AACA,MAAI,MAAM,UAAW,KAAI,aAAa,IAAI,aAAa,MAAM,SAAS;AACtE,MAAI,MAAM,SAAS;AACjB,QAAI,aAAa,IAAI,WAAW,OAAO;AACvC,QAAI,aAAa,IAAI,WAAW,MAAM,OAAO;AAAA,EAC/C;AACA,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA,EAAE,SAAS,EAAE,eAAe,QAAQ,mBAAmB,EAAE;AAAA,IACzD;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,SAAS,IAAI;AAChB,QAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KAAK;AACtD,YAAM,IAAI,YAAY,iCAAiC,MAAM,IAAI;AAAA,IACnE;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,SAAS,UAAU,OAAO,SAAS,WAAW;AAAA,IAChD;AAAA,EACF;AACA,QAAM,UAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,WAAW,MAAM,QAAQ,QAAQ,KAAK,IAAI,QAAQ,QAAQ,CAAC;AACjE,SAAO;AAAA,IACL,OAAO,SAAS,IAAI,sBAAsB;AAAA,IAC1C,eAAe,OAAO,QAAQ,kBAAkB,WAAW,QAAQ,gBAAgB;AAAA,IACnF,kBAAkB,QAAQ,qBAAqB;AAAA,EACjD;AACF;AAEA,SAAS,uBAAuB,OAAkD;AAChF,QAAM,MAAM,SAAS,OAAO,UAAU,WAAY,QAAoC,CAAC;AACvF,SAAO;AAAA,IACL,IAAI,eAAe,IAAI,IAAI,IAAI;AAAA,IAC/B,MAAM,eAAe,IAAI,MAAM,MAAM;AAAA,IACrC,UAAU,eAAe,IAAI,UAAU,UAAU;AAAA,IACjD,SAAS,eAAe,IAAI,OAAO;AAAA,IACnC,SAAS,MAAM,QAAQ,IAAI,OAAO,IAC9B,IAAI,QAAQ,OAAO,CAAC,SAAyB,OAAO,SAAS,QAAQ,IACrE,CAAC;AAAA,IACL,cAAc,eAAe,IAAI,YAAY;AAAA,IAC7C,aAAa,eAAe,IAAI,WAAW;AAAA,IAC3C,SAAS,eAAe,IAAI,OAAO;AAAA,IACnC,aAAa,eAAe,IAAI,WAAW;AAAA,IAC3C,MAAM,eAAe,IAAI,IAAI;AAAA,IAC7B,aAAa,eAAe,IAAI,WAAW;AAAA,IAC3C,SAAS,IAAI,YAAY;AAAA,EAC3B;AACF;AAEA,eAAe,gBACb,OACA,eACA,UACA,OACA,eACqB;AACrB,MAAI,CAAC,cAAe,OAAM,IAAI,YAAY,iCAAiC,MAAM,IAAI;AACrF,QAAM,MACJ,MAAM,SAAS,WAAW,WACtB,IAAI,IAAI,GAAG,cAAc,UAAU,mBAAmB,MAAM,gBAAgB,CAAC,SAAS,IACtF,IAAI,IAAI,GAAG,cAAc,UAAU,mBAAmB,MAAM,gBAAgB,CAAC,EAAE;AACrF,MAAI,MAAM,SAAS,WAAW,UAAU;AACtC,QAAI,aAAa,IAAI,YAAY,MAAM,SAAS,WAAW;AAAA,EAC7D,OAAO;AACL,QAAI,aAAa,IAAI,OAAO,OAAO;AACnC,QAAI,aAAa,IAAI,qBAAqB,MAAM;AAAA,EAClD;AACA,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA,EAAE,SAAS,EAAE,cAAc,EAAE;AAAA,IAC7B,MAAM,SAAS,WAAW,WAAW,WAAW;AAAA,IAChD;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,SAAS,IAAI;AAChB,QAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KAAK;AACtD,YAAM,IAAI,YAAY,iCAAiC,MAAM,IAAI;AAAA,IACnE;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,SAAS,UAAU,OAAO,SAAS,WAAW;AAAA,IAChD;AAAA,EACF;AACA,QAAM,WAAW,OAAO,SAAS,QAAQ,IAAI,gBAAgB,KAAK,GAAG;AACrE,MAAI,OAAO,SAAS,QAAQ,KAAK,WAAW,UAAU;AACpD,UAAM,IAAI,YAAY,qBAAqB,KAAK;AAAA,EAClD;AACA,MAAI,CAAC,SAAS,MAAM;AAClB,UAAMG,SAAQ,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC;AACzD,QAAIA,OAAM,aAAa,SAAU,OAAM,IAAI,YAAY,qBAAqB,KAAK;AACjF,WAAOA;AAAA,EACT;AACA,QAAM,SAAS,SAAS,KAAK,UAAU;AACvC,QAAM,SAAuB,CAAC;AAC9B,MAAI,QAAQ;AACZ,SAAO,MAAM;AACX,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,QAAI,KAAM;AACV,aAAS,MAAM;AACf,QAAI,QAAQ,UAAU;AACpB,YAAM,OAAO,OAAO;AACpB,YAAM,IAAI,YAAY,qBAAqB,KAAK;AAAA,IAClD;AACA,WAAO,KAAK,KAAK;AAAA,EACnB;AACA,QAAM,QAAQ,IAAI,WAAW,KAAK;AAClC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,UAAM,IAAI,OAAO,MAAM;AACvB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAEA,eAAe,mBACb,QACA,QACA,UACA,eACiC;AACjC,MAAI,CAAC,cAAe,OAAM,IAAI,YAAY,iCAAiC,MAAM,IAAI;AACrF,MAAI,OAAO,SAAS,gBAAgB;AAClC,UAAMC,OAAM,IAAI;AAAA,MACd,GAAG,kBAAkB,YAAY,mBAAmB,OAAO,OAAO,CAAC;AAAA,IACrE;AACA,IAAAA,KAAI,aAAa;AAAA,MACf;AAAA,MACA,cAAc,OAAO,IAAI,WAAW,KAAK,KAAK,CAAC;AAAA,IACjD;AACA,IAAAA,KAAI,aAAa,IAAI,cAAc,OAAO,QAAQ,CAAC;AACnD,IAAAA,KAAI,aAAa,IAAI,UAAU,yBAAyB;AACxD,QAAI,OAAQ,CAAAA,KAAI,aAAa,IAAI,iBAAiB,MAAM;AACxD,UAAMC,WAAU,aAAa,MAAM,qBAAqBD,MAAK,eAAe,iBAAiB,CAAC;AAC9F,UAAM,SAAS,MAAM,QAAQC,SAAQ,MAAM,IAAIA,SAAQ,SAAS,CAAC;AACjE,WAAO;AAAA,MACL,OAAO,OAAO,IAAI,CAAC,QAAQ;AACzB,cAAM,MAAM,aAAa,GAAG;AAC5B,cAAM,SAAS,aAAa,IAAI,MAAM;AACtC,cAAM,KAAK,wBAAwB,IAAI,IAAI,UAAU;AACrD,cAAM,MAAM,wBAAwB,IAAI,KAAK,WAAW;AACxD,cAAM,YAAY,eAAe,OAAO,OAAO;AAC/C,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA,OAAO,wBAAwB,OAAO,SAAS,eAAe;AAAA,UAC9D,SAAS;AAAA,UACT,WAAW,eAAe,OAAO,OAAO;AAAA,UACxC;AAAA,UACA,QAAQ,IAAI,IAAI,WAAW,mBAAmB,GAAG,CAAC,IAAI,OAAO,OAAO,EAAE,SAAS;AAAA,QACjF;AAAA,MACF,CAAC;AAAA,MACD,YAAY,eAAeA,SAAQ,aAAa;AAAA,IAClD;AAAA,EACF;AAEA,QAAM,MAAM,IAAI;AAAA,IACd,GAAG,kBAAkB,kBAAkB,mBAAmB,OAAO,OAAO,CAAC,uBAAuB,mBAAmB,OAAO,UAAU,CAAC;AAAA,EACvI;AACA,MAAI,aAAa,IAAI,SAAS,OAAO,QAAQ,CAAC;AAC9C,MAAI,aAAa,IAAI,QAAQ,IAAI;AACjC,MAAI,OAAQ,KAAI,aAAa,IAAI,UAAU,MAAM;AACjD,QAAM,UAAU;AAAA,IACd,MAAM,qBAAqB,KAAK,eAAe,sBAAsB;AAAA,EACvE;AACA,QAAM,QAAQ,MAAM,QAAQ,QAAQ,OAAO,IAAI,QAAQ,UAAU,CAAC;AAClE,SAAO;AAAA,IACL,OAAO,MAAM,IAAI,CAAC,QAAQ;AACxB,YAAM,MAAM,aAAa,GAAG;AAC5B,YAAM,UAAU,aAAa,IAAI,OAAO;AACxC,YAAM,KAAK,wBAAwB,IAAI,IAAI,SAAS;AACpD,YAAM,QAAQ,eAAe,aAAa,IAAI,MAAM,EAAE,KAAK;AAC3D,YAAM,gBAAgB,YAAY,QAAQ,MAAM;AAChD,aAAO;AAAA,QACL;AAAA,QACA,KAAK;AAAA,QACL,OAAO,wBAAwB,IAAI,OAAO,YAAY;AAAA,QACtD,SAAS,kBAAkB,SAAY,OAAO,OAAO,aAAa;AAAA,QAClE,WAAW,eAAe,IAAI,SAAS;AAAA,QACvC,WAAW,eAAe,QAAQ,SAAS;AAAA,QAC3C,QAAQ,QACJ,IAAI,IAAI,MAAM,WAAW,QAAQ,IAAI,QAAQ,QAAQ,KAAK,IAAI,OAAO,OAAO,EAAE,SAAS,IACvF,IAAI;AAAA,UACF,gBAAgB,mBAAmB,OAAO,GAAG,CAAC,UAAU,mBAAmB,EAAE,CAAC;AAAA,UAC9E,OAAO;AAAA,QACT,EAAE,SAAS;AAAA,MACjB;AAAA,IACF,CAAC;AAAA,IACD,YAAY,iBAAiB,aAAa,QAAQ,MAAM,EAAE,IAAI;AAAA,EAChE;AACF;AAEA,eAAe,sBACb,QACA,OACA,eACA,UACqB;AACrB,MAAI,CAAC,cAAe,OAAM,IAAI,YAAY,iCAAiC,MAAM,IAAI;AACrF,QAAM,WAAW,MAAM,iBAAiB,MAAM,MAAM,iBAAiB,QAAQ,GAAG,IAAI,CAAC;AACrF,QAAM,WACJ,OAAO,SAAS,iBACZ,MAAM,kBAAkB,QAAQ,UAAU,OAAO,aAAa,IAC9D,MAAM,uBAAuB,QAAQ,UAAU,OAAO,aAAa;AACzE,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,QAAQ;AAC/C,MAAI,MAAM,aAAa,SAAU,OAAM,IAAI,YAAY,qBAAqB,KAAK;AACjF,SAAO;AACT;AAEA,eAAe,kBACb,QACA,SACA,OACA,eACiB;AACjB,QAAM,WAAW,IAAI;AAAA,IACnB,GAAG,kBAAkB,YAAY,mBAAmB,OAAO,OAAO,CAAC,qBAAqB,mBAAmB,OAAO,CAAC;AAAA,EACrH;AACA,WAAS,aAAa;AAAA,IACpB;AAAA,IACA;AAAA,EACF;AACA,QAAM,QAAQ,aAAa,MAAM,qBAAqB,UAAU,eAAe,YAAY,CAAC;AAC5F,QAAM,SAAS,aAAa,MAAM,MAAM;AACxC,QAAM,QAAQ;AAAA,IACZ,KAAK,MAAM,KAAK;AAAA,IAChB;AAAA,IACA,UAAU,eAAe,MAAM,GAAG,KAAK,MAAM,KAAK;AAAA,IAClD,WAAW,eAAe,aAAa,OAAO,SAAS,EAAE,IAAI,KAAK,SAAS;AAAA,IAC3E,aAAa,eAAe,aAAa,OAAO,MAAM,EAAE,IAAI,KAAK,SAAS;AAAA,IAC1E,eAAe,eAAe,aAAa,OAAO,QAAQ,EAAE,IAAI,KAAK,MAAM;AAAA,IAC3E,eAAe,eAAe,aAAa,OAAO,QAAQ,EAAE,WAAW,KAAK,YAAY;AAAA,IACxF,eAAe,eAAe,aAAa,OAAO,QAAQ,EAAE,WAAW,KAAK,SAAS;AAAA,IACrF,cAAc,eAAe,OAAO,OAAO,KAAK,SAAS;AAAA,IACzD,aAAa,MAAM,SAAS;AAAA,IAC5B;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc,OAAO,WAAW,KAAK;AAAA,EACvC;AACA,QAAM,SAAS,MAAM,QAAQ,OAAO,MAAM,IACtC,OAAO,OAAO,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ,IAC1E,CAAC;AACL,MAAI,OAAO,SAAS,EAAG,OAAM,OAAO,GAAG,GAAG,aAAa,OAAO,KAAK,IAAI,CAAC,EAAE;AAC1E,QAAM,WAAW,MAAM,aAAa,QAAQ,SAAS,aAAa;AAClE,MAAI,SAAS,SAAS,GAAG;AACvB,UAAM,KAAK,IAAI,eAAe,EAAE;AAChC,eAAW,WAAW,UAAU;AAC9B,YAAM,MAAM,aAAa,OAAO;AAChC,YAAM,SAAS,eAAe,aAAa,IAAI,MAAM,EAAE,WAAW,KAAK;AACvE,YAAM,UAAU,eAAe,IAAI,OAAO,KAAK;AAC/C,YAAM,KAAK,OAAO,MAAM,SAAM,OAAO,IAAI,IAAI,cAAc,IAAI,IAAI,GAAG,EAAE;AAAA,IAC1E;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,eAAe,aACb,QACA,SACA,eACoB;AACpB,QAAM,WAAsB,CAAC;AAC7B,MAAI,UAAU;AACd,WAAS,OAAO,GAAG,OAAO,IAAI,QAAQ,GAAG;AACvC,UAAM,MAAM,IAAI;AAAA,MACd,GAAG,kBAAkB,YAAY,mBAAmB,OAAO,OAAO,CAAC,qBAAqB,mBAAmB,OAAO,CAAC;AAAA,IACrH;AACA,QAAI,aAAa,IAAI,WAAW,OAAO,OAAO,CAAC;AAC/C,QAAI,aAAa,IAAI,cAAc,KAAK;AACxC,QAAI,aAAa,IAAI,WAAW,SAAS;AACzC,UAAM,UAAU,aAAa,MAAM,qBAAqB,KAAK,eAAe,eAAe,CAAC;AAC5F,UAAM,eAAe,MAAM,QAAQ,QAAQ,QAAQ,IAAI,QAAQ,WAAW,CAAC;AAC3E,aAAS,KAAK,GAAG,YAAY;AAC7B,UAAM,QAAQ,YAAY,QAAQ,KAAK,KAAK,SAAS;AACrD,QAAI,SAAS,UAAU,SAAS,aAAa,WAAW,EAAG;AAC3D,eAAW,aAAa;AAAA,EAC1B;AACA,SAAO;AACT;AAEA,eAAe,uBACb,QACA,QACA,OACA,eACiB;AACjB,QAAM,UAAU,IAAI;AAAA,IAClB,GAAG,kBAAkB,kBAAkB,mBAAmB,OAAO,OAAO,CAAC,sBAAsB,mBAAmB,MAAM,CAAC;AAAA,EAC3H;AACA,UAAQ,aAAa,IAAI,eAAe,SAAS;AACjD,QAAM,OAAO,aAAa,MAAM,qBAAqB,SAAS,eAAe,iBAAiB,CAAC;AAC/F,QAAM,UAAU,aAAa,aAAa,KAAK,IAAI,EAAE,OAAO;AAC5D,QAAM,QAAQ;AAAA,IACZ,KAAK,MAAM,KAAK;AAAA,IAChB;AAAA,IACA,YAAY,OAAO,IAAI,KAAK,OAAO,GAAG;AAAA,IACtC,cAAc,MAAM,gBAAgB,SAAS;AAAA,IAC7C,aAAa,MAAM,SAAS;AAAA,IAC5B;AAAA,IACA;AAAA,IACA;AAAA,IACA,eAAe,QAAQ,KAAK,KAAK;AAAA,EACnC;AACA,QAAM,WAAW,MAAM,yBAAyB,QAAQ,QAAQ,aAAa;AAC7E,MAAI,SAAS,SAAS,GAAG;AACvB,UAAM,KAAK,IAAI,eAAe,EAAE;AAChC,eAAW,WAAW,UAAU;AAC9B,YAAM,MAAM,aAAa,OAAO;AAChC,YAAM,OAAO,aAAa,aAAa,IAAI,IAAI,EAAE,OAAO;AACxD,YAAM,UAAU,aAAa,IAAI,OAAO;AACxC,YAAM;AAAA,QACJ,oBAAiB,eAAe,QAAQ,SAAS,KAAK,cAAc;AAAA,QACpE;AAAA,QACA,eAAe,KAAK,KAAK,KAAK;AAAA,QAC9B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,eAAe,yBACb,QACA,QACA,eACoB;AACpB,QAAM,WAAsB,CAAC;AAC7B,MAAI,SAAwB;AAC5B,WAAS,OAAO,GAAG,OAAO,IAAI,QAAQ,GAAG;AACvC,UAAM,MAAM,IAAI;AAAA,MACd,GAAG,kBAAkB,kBAAkB,mBAAmB,OAAO,OAAO,CAAC,sBAAsB,mBAAmB,MAAM,CAAC;AAAA,IAC3H;AACA,QAAI,aAAa,IAAI,eAAe,SAAS;AAC7C,QAAI,aAAa,IAAI,SAAS,KAAK;AACnC,QAAI,OAAQ,KAAI,aAAa,IAAI,UAAU,MAAM;AACjD,UAAM,UAAU;AAAA,MACd,MAAM,qBAAqB,KAAK,eAAe,0BAA0B;AAAA,IAC3E;AACA,UAAM,UAAU,MAAM,QAAQ,QAAQ,OAAO,IAAI,QAAQ,UAAU,CAAC;AACpE,aAAS,KAAK,GAAG,OAAO;AACxB,aAAS,iBAAiB,aAAa,QAAQ,MAAM,EAAE,IAAI;AAC3D,QAAI,CAAC,OAAQ;AAAA,EACf;AACA,SAAO;AACT;AAEA,eAAe,qBACb,KACA,eACAC,QACkB;AAClB,QAAM,WAAW,MAAM,YAAY,KAAK;AAAA,IACtC,SAAS,EAAE,eAAe,QAAQ,mBAAmB;AAAA,IACrD,UAAU;AAAA,IACV,QAAQ,YAAY,QAAQ,GAAM;AAAA,EACpC,CAAC;AACD,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,SAAS,MAAM,OAAO,EAAE,MAAM,MAAM,MAAS;AACnD,QAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KAAK;AACtD,YAAM,IAAI,YAAY,iCAAiC,MAAM,IAAI;AAAA,IACnE;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,SAAS,UAAU,OAAO,SAAS,WAAW;AAAA,IAChD;AAAA,EACF;AACA,SAAO,MAAM,wBAAwB,UAAU,0BAA0BA,MAAK;AAChF;AAEO,SAAS,iBAAiB,OAA+B;AAC9D,QAAM,OAAO,eAAe,KAAK;AACjC,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,MAAM,IAAI,IAAI,MAAM,kBAAkB;AAC5C,QAAM,SAAS,IAAI,aAAa,IAAI,QAAQ;AAC5C,MAAI,CAAC,UAAU,OAAO,SAAS,QAAS,kBAAkB,KAAK,MAAM,GAAG;AACtE,UAAM,IAAI,MAAM,2BAA2B;AAAA,EAC7C;AACA,SAAO;AACT;AAEO,SAAS,cAAc,OAAwB;AACpD,QAAM,OAAO,aAAa,KAAK;AAC/B,QAAM,OAAO,eAAe,KAAK,IAAI;AACrC,QAAM,WAAW,MAAM,QAAQ,KAAK,OAAO,IAAI,KAAK,QAAQ,IAAI,aAAa,EAAE,KAAK,EAAE,IAAI;AAC1F,MAAI,SAAS,QAAQ;AACnB,QAAI,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AACvD,UAAM,QAAQ,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC;AACxD,eAAW,WAAW,OAAO;AAC3B,YAAM,OAAO,aAAa,OAAO;AACjC,YAAM,WAAW,eAAe,KAAK,IAAI;AACzC,UAAI,aAAa,OAAQ,QAAO,KAAK,IAAI;AACzC,UAAI,aAAa,SAAU,QAAO,KAAK,IAAI;AAC3C,UAAI,aAAa,KAAM,QAAO,IAAI,IAAI;AACtC,UAAI,aAAa,SAAU,QAAO,KAAK,IAAI;AAC3C,UAAI,aAAa,QAAQ;AACvB,cAAM,OAAO,eAAe,aAAa,KAAK,KAAK,EAAE,IAAI;AACzD,YAAI,KAAM,QAAO,IAAI,IAAI,KAAK,IAAI;AAAA,MACpC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,MAAI,SAAS,YAAa,QAAO,GAAG,QAAQ;AAAA;AAAA;AAC5C,MAAI,SAAS,WAAW;AACtB,UAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,YAAY,aAAa,KAAK,KAAK,EAAE,KAAK,KAAK,GAAG,CAAC,GAAG,CAAC;AACvF,WAAO,GAAG,IAAI,OAAO,KAAK,CAAC,IAAI,SAAS,KAAK,CAAC;AAAA;AAAA;AAAA,EAChD;AACA,MAAI,SAAS,YAAa,QAAO;AACjC,MAAI,SAAS,OAAQ,QAAO;AAC5B,MAAI,SAAS,cAAc;AACzB,WAAO,GAAG,SACP,KAAK,EACL,MAAM,IAAI,EACV,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,EACzB,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA,EACf;AACA,MAAI,SAAS,cAAc;AACzB,WAAO,GAAG,SAAS,QAAQ,CAAC;AAAA;AAAA,EAC9B;AACA,MAAI,SAAS,eAAe;AAC1B,WAAO,GAAG,SAAS,QAAQ,CAAC;AAAA;AAAA,EAC9B;AACA,MAAI,SAAS,YAAY;AACvB,WAAO,KAAK,SAAS,KAAK,EAAE,WAAW,MAAM,MAAM,CAAC;AAAA;AAAA,EACtD;AACA,MAAI,SAAS,YAAa,QAAO;AAAA,EAAW,SAAS,QAAQ,CAAC;AAAA;AAAA;AAAA;AAC9D,MAAI,SAAS,UAAW,QAAO,IAAI,eAAe,aAAa,KAAK,KAAK,EAAE,IAAI,KAAK,MAAM;AAC1F,MAAI,SAAS,QAAS,QAAO,eAAe,aAAa,KAAK,KAAK,EAAE,IAAI,KAAK;AAC9E,MAAI,SAAS,cAAc;AACzB,UAAM,MAAM,eAAe,aAAa,KAAK,KAAK,EAAE,GAAG;AACvD,WAAO,MAAM,IAAI,GAAG,KAAK,GAAG,MAAM;AAAA,EACpC;AACA,SAAO;AACT;AAEA,SAAS,aAAa,OAAyC;AAC7D,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAC5D,QACD,CAAC;AACP;AAEA,SAAS,wBAAwB,OAAgBA,QAAuB;AACtE,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,KAAK,EAAG,OAAM,IAAI,MAAM,qBAAqBA,MAAK,EAAE;AAC5F,SAAO;AACT;AAEA,SAAS,kBAAkB,OAAuB;AAChD,QAAM,QAAQN,YAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE;AACxE,QAAM,CAAC,IAAK,MAAM,CAAC,IAAK,KAAQ;AAChC,QAAM,CAAC,IAAK,MAAM,CAAC,IAAK,KAAQ;AAChC,QAAM,MAAM,MAAM,SAAS,KAAK;AAChC,SAAO,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;AAC1G;AAEA,SAAS,aAAa,OAAuB;AAC3C,QAAM,aAAa,MAChB,UAAU,MAAM,EAChB,QAAQ,wBAAwB,GAAG,EACnC,KAAK;AACR,UAAQ,cAAc,YAAY,MAAM,GAAG,GAAG;AAChD;AAEA,SAAS,eAAe,OAAgBM,QAAuB;AAC7D,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,KAAK,EAAG,OAAM,IAAI,MAAM,wBAAwBA,MAAK,EAAE;AAC/F,SAAO;AACT;AAEA,SAAS,eAAe,OAA+B;AACrD,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AACjE;AAEA,SAAS,YAAY,OAAoC;AACvD,SAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,QAAQ;AACvE;AAEA,SAAS,aAAa,OAAwB;AAC5C,UAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,MAAM,GAAG,GAAI;AAC/E;AAEA,SAAS,kBAAkB,OAAmC;AAC5D,SAAON,YAAW,QAAQ,EACvB;AAAA,IACC,KAAK,UAAU;AAAA,MACb,kBAAkB,MAAM;AAAA,MACxB,mBAAmB,MAAM;AAAA,MACzB,OAAO,MAAM;AAAA,MACb,UAAU,MAAM;AAAA,MAChB,SAAS,MAAM;AAAA,MACf,cAAc,MAAM;AAAA,MACpB,aAAa,MAAM;AAAA,MACnB,WAAW,MAAM;AAAA,IACnB,CAAC;AAAA,EACH,EACC,OAAO,KAAK;AACjB;AAEA,SAAS,eACP,QAC+C;AAC/C,MAAI,WAAW,oBAAqB,QAAO;AAC3C,MAAI,WAAW,qBAAsB,QAAO;AAC5C,MAAI,WAAW,aAAc,QAAO;AACpC,MAAI,WAAW,mBAAoB,QAAO;AAC1C,SAAO;AACT;AAEA,SAAS,0BACP,eACA,UACA,SACA,SACA,SACM;AACN,gBAAc,iBAAiB;AAAA,IAC7B,MAAM;AAAA,IACN,MAAM;AAAA,IACN,QAAQ,EAAE,UAAU,QAAQ;AAAA,IAC5B,OAAO,KAAK,IAAI,GAAG,QAAQ,SAAS,IAAI;AAAA,EAC1C,CAAC;AACD,MAAI,QAAQ,mBAAmB,GAAG;AAChC,kBAAc,iBAAiB;AAAA,MAC7B,MAAM;AAAA,MACN,MAAM;AAAA,MACN,QAAQ,EAAE,UAAU,QAAQ;AAAA,MAC5B,QAAQ,QAAQ;AAAA,IAClB,CAAC;AAAA,EACH;AACA,MAAI,QAAQ,cAAc;AACxB,kBAAc,iBAAiB;AAAA,MAC7B,MAAM;AAAA,MACN,MAAM;AAAA,MACN,QAAQ,EAAE,UAAU,OAAO,QAAQ,aAAa;AAAA,IAClD,CAAC;AAAA,EACH;AACA,MAAI,QAAQ,mBAAmB;AAC7B,kBAAc,iBAAiB;AAAA,MAC7B,MAAM;AAAA,MACN,MAAM;AAAA,MACN,QAAQ,EAAE,SAAS;AAAA,IACrB,CAAC;AAAA,EACH;AACA,MAAI,SAAS;AACX,kBAAc,iBAAiB;AAAA,MAC7B,MAAM;AAAA,MACN,MAAM;AAAA,MACN,QAAQ;AAAA,QACN;AAAA,QACA,QAAQ,QAAQ;AAAA,QAChB,WAAW,QAAQ,YAAY,SAAS;AAAA,MAC1C;AAAA,IACF,CAAC;AACD,kBAAc,KAAK,gCAAgC;AAAA,MACjD;AAAA,MACA,SAAS,QAAQ,YAAY,qBAAqB;AAAA,MAClD,QAAQ,QAAQ;AAAA,MAChB,YAAY,QAAQ;AAAA,IACtB,CAAC;AACD;AAAA,EACF;AACA,gBAAc,KAAK,mCAAmC;AAAA,IACpD;AAAA,IACA,SAAS;AAAA,IACT,YAAY,QAAQ;AAAA,EACtB,CAAC;AACH;AAIA,IAAM,cAAN,cAA0B,MAAM;AAAA,EAC9B,YACW,MACA,WACA,oBAAoB,OAC7B;AACA,UAAM,IAAI;AAJD;AACA;AACA;AAGT,SAAK,OAAO;AAAA,EACd;AACF;;;AG74GA,SAAS,mCAAmC;;;ACY5C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,kBAAAO;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,4BAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAQK;AACP,SAAS,mCAAkD;AAE3D,SAAS,6BAAAC,kCAAiC;;;AC1C1C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,uCAAuC;AAChD;AAAA,EACE;AAAA,OAIK;AACP,SAAS,8CAA8C;AAMhD,SAAS,eACd,UACA,aACiC;AACjC,SAAO,iBAAiB,QAAQ,EAAE,QAAQ,CAAC,UAAU;AACnD,QAAI,MAAM,QAAQ,aAAa,cAAc,MAAM,iBAAiB,SAAS;AAC3E,aAAO,CAAC;AACV,UAAM,UAAU,YAAY;AAAA,MAAO,CAAC,OAClC;AAAA,QACE,yBAAyB,EAAE,EAAE;AAAA,QAC7B,MAAM;AAAA,MACR,EAAE,SAAS,MAAM,UAAU;AAAA,IAC7B;AACA,QAAI,QAAQ,SAAS,EAAG,OAAM,IAAI,MAAM,oCAAoC;AAC5E,UAAM,WAAW,QAAQ,CAAC;AAC1B,WAAO,WACH;AAAA,MACE;AAAA,QACE,IAAI,MAAM;AAAA,QACV;AAAA,QACA,iBAAiB,MAAM;AAAA,QACvB,iBAAiB,MAAM,aAAa,UAAU,QAAQ,SAClD,CAAC,GAAG,MAAM,aAAa,UAAU,OAAO,IACxC,CAAC,MAAM;AAAA,MACb;AAAA,IACF,IACA,CAAC;AAAA,EACP,CAAC;AACH;AAOA,eAAsB,6BACpB,IACA,UACA,UACA,gBACA,aAC0C;AAC1C,QAAM,WAAW,MAAM,gCAAgC,IAAI,UAAU;AAAA,IACnE,WAAW,SAAS;AAAA,IACpB,aAAa,SAAS;AAAA,IACtB,wBAAwB;AAAA,EAC1B,CAAC;AACD,MAAI,UAAU,SAAS;AACvB,MAAI,QAAQ,yBAA0B,WAAU,yBAAyB,OAAO;AAChF,MAAI,QAAQ,6BAA8B,WAAU,mCAAmC,OAAO;AAC9F,SAAO,eAAe,SAAS,WAAW;AAC5C;;;ACtEA;AAAA,EACE,4BAAAC;AAAA,OAGK;;;ACJP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AAEP,SAAS,kDAAkD;AAE3D,IAAM,oCAAoC;AAYnC,IAAM,qCAAqC,KAAK;AAShD,IAAM,uCAAuC,IAAI;AAExD,IAAM,gBAAgB,oBAAI,IAAoB;AAG9C,SAAS,kBAAkB,KAAa,KAAsB;AAC5D,QAAM,OAAO,cAAc,IAAI,GAAG;AAClC,MAAI,SAAS,UAAa,MAAM,OAAO,qCAAsC,QAAO;AACpF,MAAI,cAAc,QAAQ,KAAQ;AAChC,eAAW,CAAC,OAAO,EAAE,KAAK,eAAe;AACvC,UAAI,MAAM,MAAM,qCAAsC,eAAc,OAAO,KAAK;AAAA,IAClF;AAAA,EACF;AACA,gBAAc,IAAI,KAAK,GAAG;AAC1B,SAAO;AACT;AA0BA,eAAsB,uCAAuC,OAS3C;AAChB,QAAM,aAAa,MAAM,SAAS,QAAQ;AAC1C,QAAM,MAAM,MAAM,OAAO,KAAK,IAAI;AAClC,QAAM,OAAO;AAAA,IACX,eAAe;AAAA,IACf,GAAI,MAAM,QAAQ,EAAE,WAAW,MAAM,MAAM,IAAI,CAAC;AAAA,EAClD;AACA,QAAM,YAAsB,CAAC;AAC7B,MAAI,kBAAkB,GAAG,UAAU,IAAI,MAAM,SAAS,IAAI,MAAM,WAAW,WAAW,GAAG,GAAG;AAC1F,QAAI;AACF,gBAAU;AAAA,QACR,GAAI,MAAM;AAAA,UACR,MAAM;AAAA,QACR,EAAE;AAAA,UACA,MAAM;AAAA,UACN,MAAM;AAAA,UACN;AAAA,YACE,MAAM;AAAA,YACN,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,WAAW;AAAA,UACb;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AACA,QAAM,WAAW,MAAM;AACvB,MACE,YACA;AAAA,IACE,GAAG,UAAU,IAAI,MAAM,SAAS,IAAI,MAAM,WAAW,aAAa,SAAS,wBAAwB,IACjG;AAAA,MACE,SAAS;AAAA,MACT;AAAA,IACF,GAAG,uBAAuB,MAC5B;AAAA,IACA;AAAA,EACF,GACA;AACA,QAAI;AACF,gBAAU;AAAA,QACR,GAAI,MAAM;AAAA,UACR,MAAM;AAAA,QACR,EAAE;AAAA,UACA,MAAM;AAAA,UACN,MAAM;AAAA,UACN;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AACA,MAAI,UAAU,SAAS,GAAG;AACxB,UAAM,oCAAoC,MAAM,IAAI,YAAY;AAAA,MAC9D,WAAW,MAAM;AAAA,MACjB,QAAQ;AAAA,IACV,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EAC1B;AACF;;;ADjHA,eAAsB,+BAA+B,OAQnC;AAChB,QAAM,uCAAuC;AAAA,IAC3C,GAAG;AAAA,IACH,UAAUC,0BAAyB,OAAO;AAAA,EAC5C,CAAC;AACH;;;AEtCA,SAAS,mBAAmB,iBAAAC,sBAAqB;AAY1C,SAAS,+BAA+B,QAA6B;AAC1E,MAAI,WAAW,aAAa;AAC1B,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACF;AAEO,SAAS,4BACd,QACA,WACA,OACA,QACA,OACA,mBAAoD,CAAC,GACkB;AAIvE,QAAM,wBAAwB;AAAA,IAC5B,GAAG,IAAI;AAAA,MACL,iBACG,IAAI,CAAC,YAAY,QAAQ,QAAQ,EACjC,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,SAAS,KAAK,OAAO,QAAQ,CAAC;AAAA,IAC5F;AAAA,EACF,EAAE,KAAK;AACP,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAM;AAAA,IACN,iBAAiB;AAAA,IACjB,oBAAoB;AAAA,IACpB,GAAI,UAAU,SAAS,EAAE,UAAU,IAAI,CAAC;AAAA,IACxC,GAAI,MAAM,SAAS,EAAE,MAAM,IAAI,CAAC;AAAA,IAChC,GAAI,sBAAsB,SAAS,EAAE,sBAAsB,IAAI,CAAC;AAAA,EAClE;AACF;AAEO,SAAS,qBAAqB,WAA2B;AAC9D,SAAO,WAAW,SAAS;AAC7B;;;AJNO,IAAM,wCAAwC;AACrD,IAAM,iCAAiC;AACvC,IAAM,+BAA+B;AAG9B,SAAS,0BAA0B,cAA8B;AACtE,QAAM,WAAW,KAAK,IAAI,GAAG,KAAK,IAAI,eAAe,GAAG,EAAE,CAAC;AAC3D,SAAO,KAAK,IAAI,MAAQ,KAAK,UAAU,IAAI,GAAM;AACnD;AA8CO,IAAM,0BAA2C;AAAA,EACtD,UAAU;AAAA,EACV,KAAK,CAAC,IAAI,UAAU,qCAAqC,IAAI,KAAK;AAAA,EAClE,eAAe,CAAC,IAAI,UAAU,yCAAyC,IAAI,KAAK;AAAA,EAChF,eAAe,CAAC,IAAI,UAAU,mCAAmC,IAAI,KAAK;AAAA,EAC1E,eAAe,CAAC,IAAI,aAAa,6CAA6C,IAAI,QAAQ;AAAA,EAC1F,mBAAmB,CAAC,IAAI,YAAY,uCAAuC,IAAI,OAAO;AAAA,EACtF,aAAa,CAAC,IAAI,UAAU,yCAAyC,IAAI,KAAK;AAAA,EAC9E,iBAAiB,CAAC,IAAI,UAAU,2CAA2C,IAAI,KAAK;AAAA;AAAA;AAAA;AAAA,EAIpF,wBAAwB,CAAC,EAAE,IAAI,SAAS,GAAG,SACzC,+BAA+B;AAAA,IAC7B;AAAA,IACA;AAAA,IACA,WAAW,KAAK;AAAA,IAChB,aAAa,KAAK;AAAA,IAClB,cAAc;AAAA,EAChB,CAAC;AACL;AAkBA,eAAsB,kCACpB,UACA,OACsC;AACtC,QAAM,SAAsC;AAAA,IAC1C,SAAS;AAAA,IACT,WAAW;AAAA,IACX,SAAS;AAAA,IACT,WAAW;AAAA,EACb;AACA,QAAM,SAAS,SAAS;AAIxB,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,aAAa,MAAM;AAAA,IAAwC,SAAS;AAAA,IAAI;AAAA,IAAO,CAAC,OACpF,wCAAwC,IAAI;AAAA,MAC1C,OAAO;AAAA,MACP,YAAY;AAAA,IACd,CAAC;AAAA,EACH;AACA,SAAO,UAAU,WAAW;AAC5B,aAAW,YAAY,YAAY;AACjC,QAAI;AACF,YAAM,OAAO;AAAA,QACX,WAAW,SAAS;AAAA,QACpB,aAAa,SAAS;AAAA,QACtB,WAAW,SAAS;AAAA,QACpB,YAAY,qBAAqB,SAAS,SAAS;AAAA,QACnD,cAAc,SAAS;AAAA,MACzB,CAAC;AACD,YAAM;AAAA,QAAwC,SAAS;AAAA,QAAI;AAAA,QAAO,CAAC,OACjE,sCAAsC,IAAI,QAAQ;AAAA,MACpD;AACA,aAAO,aAAa;AAAA,IACtB,QAAQ;AACN,YAAM,YAAY,SAAS,gBAAgB;AAC3C,YAAM;AAAA,QAAwC,SAAS;AAAA,QAAI;AAAA,QAAO,CAAC,OACjE,YACI,wCAAwC,IAAI;AAAA,UAC1C,IAAI,SAAS;AAAA,UACb,iBAAiB,SAAS;AAAA,UAC1B,aAAa;AAAA,QACf,CAAC,IACD,sCAAsC,IAAI;AAAA,UACxC,IAAI,SAAS;AAAA,UACb,iBAAiB,SAAS;AAAA,UAC1B,WAAW,0BAA0B,SAAS,YAAY;AAAA,UAC1D,aAAa;AAAA,QACf,CAAC;AAAA,MACP,EAAE,MAAM,MAAM,KAAK;AACnB,UAAI,UAAW,QAAO,aAAa;AAAA,UAC9B,QAAO,WAAW;AAAA,IACzB;AAAA,EACF;AACA,SAAO;AACT;AAOA,eAAsB,2CACpB,UACA,OAC2C;AAC3C,SAAO,MAAM,sCAAsC,UAAU,yBAAyB,KAAK;AAC7F;AAGA,eAAsB,sCACpB,UACA,SACA,OAC2C;AAC3C,MAAI,SAA2C,CAAC;AAChD,MAAI;AACF,aAAS,MAAM,QAAQ,YAAY,SAAS,IAAI,KAAK;AAAA,EACvD,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,QAAM,QAAQ;AAAA,IACZ,OAAO,IAAI,CAAC,UAAU,kCAAkC,UAAU,KAAK,CAAC;AAAA,EAC1E;AACA,SAAO;AACT;AAiBA,eAAsB,wBACpB,UACA,SACA,OAC8C;AAC9C,QAAM,WAAW,MAAM,iCAAiC,SAAS,IAAI,KAAK;AAC1E,MAAI,CAAC,SAAU,QAAO,EAAE,MAAM,UAAU;AACxC,QAAM,QAAQ,MAAM,QAAQ,cAAc,SAAS,IAAI,KAAK;AAC5D,MAAI,CAAC,MAAO,QAAO,EAAE,MAAM,UAAU;AACrC,QAAM,yBAAyB,UAAU,SAAS,QAAQ;AAC1D,QAAM,WAAW,MAAM,4BAA4B,UAAU,SAAS,UAAU,KAAK;AACrF,MAAI,SAAU,QAAO;AACrB,QAAM,aAAa,MAAM,QAAQ,kBAAkB,SAAS,IAAI;AAAA,IAC9D;AAAA,IACA,gBAAgB,MAAM;AAAA,IACtB,gBAAgB,MAAM;AAAA,EACxB,CAAC;AACD,UAAQ,WAAW,MAAM;AAAA,IACvB,KAAK;AACH,aAAO,EAAE,MAAM,UAAU;AAAA,IAC3B,KAAK;AACH,aAAO,EAAE,MAAM,SAAS;AAAA,IAC1B,KAAK;AACH,aAAO,EAAE,MAAM,MAAM;AAAA,IACvB,KAAK;AACH,aAAO;AAAA,QACL,MAAM;AAAA,QACN,YAAY,WAAW;AAAA,QACvB,iBAAiB,WAAW;AAAA,QAC5B,eAAe,WAAW;AAAA,MAC5B;AAAA,EACJ;AACF;AAMA,eAAe,4BACb,UACA,MACA,UACA,OACqD;AACrD,QAAM,WAAW,SAAS;AAC1B,MAAI,CAAC,UAAU,yCAA0C,QAAO;AAChE,QAAM,UAAU,MAAM,iCAAiC,SAAS,IAAI,UAAU,OAAO,OAAO;AAC1F,UAAM,UAAU,MAAM,WAAW,IAAI,SAAS,aAAa,SAAS,SAAS;AAC7E,UAAM,OAAO,MAAMC,gBAAe,IAAI,SAAS,aAAa,SAAS,MAAM;AAC3E,QAAI,CAAC,WAAW,CAAC,QAAQ,KAAK,cAAc,SAAS,UAAW,QAAO;AACvE,UAAM,WAAWC,2BAA0B,KAAK,QAAQ;AACxD,WACE,QAAQ,wBAAwB,cAChC,KAAK,WAAW,gBAChB,SAAS,SAAS,WAClB,SAAS,OAAO,0BAA0B,UAC1C,SAAS,OAAO,mBAAmB,MAAM;AAAA,EAE7C,CAAC;AACD,MAAI,QAAQ,WAAW,eAAe,QAAQ,UAAU,KAAM,QAAO,EAAE,MAAM,UAAU;AACvF,MAAI,CAAC,QAAQ,MAAO,QAAO;AAC3B,QAAM,WAAW,6BAA6B;AAC9C,QAAM,SAAS,MAAM;AAAA,IACnB,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN,SAAS,IAAI,CAAC,YAAY,QAAQ,QAAQ;AAAA,EAC5C;AACA,MACE,CAAC,OAAO;AAAA,IACN,CAAC,cAAc,UAAU,OAAO,MAAM,kBAAkB,UAAU,aAAa,KAAK;AAAA,EACtF;AAEA,WAAO;AACT,QAAM,UAAU,EAAE,UAAU,GAAG,OAAO,QAAQ,8BAA8B,KAAK;AACjF,MAAI,aAAa,MAAM;AAAA,IACrB,SAAS;AAAA,IACTC,0BAAyB,KAAK,QAAQ;AAAA,IACtC;AAAA,EACF;AAIA,QAAM,aAAa,IAAI,IAAI,WAAW,sBAAsB,CAAC,CAAC;AAC9D,aAAW,WAAW,UAAU;AAC9B,QAAI,QAAQ,aAAa,KAAK,YAAY,CAAC,WAAW,IAAI,QAAQ,QAAQ,EAAG;AAC7E,UAAM,yBAAyB,UAAU,SAAS,QAAQ;AAC1D,UAAM,QACH,yBAAyB,EAAE,IAAI,SAAS,IAAI,SAAS,GAAG,QAAQ,EAChE,MAAM,MAAM,MAAS;AAAA,EAC1B;AACA,MAAI,CAAC,GAAG,UAAU,EAAE,KAAK,CAAC,aAAa,aAAa,KAAK,QAAQ,GAAG;AAClE,iBAAa,MAAM;AAAA,MACjB,SAAS;AAAA,MACTA,0BAAyB,KAAK,QAAQ;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AACA,UAAQ,WAAW,MAAM;AAAA,IACvB,KAAK;AACH,aAAO,EAAE,MAAM,UAAU;AAAA,IAC3B,KAAK;AACH,aAAO,EAAE,MAAM,SAAS;AAAA,IAC1B,KAAK;AACH,aAAO,EAAE,MAAM,OAAO,oBAAoB,WAAW,sBAAsB,CAAC,EAAE;AAAA,IAChF,KAAK;AAIH,UAAI,WAAW,WAAW;AACxB,eAAO,EAAE,MAAM,OAAO,oBAAoB,CAAC,EAAE;AAC/C,aAAO;AAAA,QACL,MAAM;AAAA,QACN,YAAY,WAAW;AAAA,QACvB,iBAAiB,WAAW;AAAA,QAC5B,eAAe,WAAW;AAAA,QAC1B,oBAAoB,WAAW,sBAAsB,CAAC;AAAA,MACxD;AAAA,EACJ;AACF;AAGA,eAAsB,8BACpB,UACA,UACiB;AACjB,SAAO,MAAM,yBAAyB,UAAU,yBAAyB,QAAQ;AACnF;AAGA,eAAsB,yBACpB,UACA,SACA,UACiB;AACjB,QAAM,YAAY,MAAM,QAAQ,cAAc,SAAS,IAAI,QAAQ,EAAE,MAAM,MAAM,CAAC;AAClF,MAAI,YAAY,GAAG;AACjB,UAAM,sCAAsC,UAAU,SAAS;AAAA,MAC7D,WAAW,SAAS;AAAA,MACpB,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,SAAO;AACT;AA6BA,eAAsB,0BACpB,UAKA,SACA,OAO0C;AAC1C,MAAI,SAAS,MAAM,QAAQ,cAAc,SAAS,IAAI,KAAK;AAC3D,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,kCAAkC,UAAU;AAAA,IAChD,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,EACrB,CAAC,EAAE,MAAM,MAAM,MAAS;AACxB,MAAI,OAAO,cAAc,MAAM,aAAa,OAAO,eAAe,MAAM,YAAY;AAClF,WAAO,EAAE,QAAQ,QAAQ;AAAA,EAC3B;AACA,MAAI,QAAQ,0BAA0B,SAAS,YAAY,OAAO,oBAAoB,OAAO;AAC3F,UAAM,OAAO,MAAM,iCAAiC,SAAS,IAAI;AAAA,MAC/D,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,WAAW,MAAM;AAAA,MACjB,QAAQ,OAAO;AAAA,IACjB,CAAC;AAED,QAAI,MAAM;AACR,YAAM,QACH,uBAAuB,EAAE,IAAI,SAAS,IAAI,UAAU,SAAS,SAAS,GAAG,IAAI,EAC7E,MAAM,MAAM,MAAS;AAAA,IAC1B;AAEA,aAAS,MAAM,QAAQ,cAAc,SAAS,IAAI,KAAK;AACvD,QAAI,CAAC,UAAU,OAAO,cAAc,MAAM,aAAa,OAAO,eAAe,MAAM;AACjF,aAAO,EAAE,QAAQ,QAAQ;AAAA,EAC7B;AAGA,QAAM,aACJ,OAAO,oBAAoB,QACvB,EAAE,MAAM,SAAS,IACjB,MAAM,wBAAwB,UAAU,SAAS;AAAA,IAC/C,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,IACjB,QAAQ,OAAO;AAAA,EACjB,CAAC;AACP,QAAM,SAAS,MAAM,QAAQ,gBAAgB,SAAS,IAAI;AAAA,IACxD,GAAG;AAAA,IACH,uBAAuB,OAAO;AAAA,IAC9B;AAAA,EACF,CAAC;AACD,QAAM;AAAA,IACJ,SAAS;AAAA,IACT,MAAM;AAAA,IACN,MAAM;AAAA,IACN,OAAO;AAAA,EACT;AACA,MAAI,OAAO,WAAW,WAAW;AAC/B,WAAO,EAAE,QAAQ,WAAW,GAAG,qCAAqC,OAAO,MAAM,EAAE;AAAA,EACrF;AACA,SAAO,EAAE,QAAQ,OAAO,OAAO;AACjC;;;AKneA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAIP,IAAM,SAAS;AAER,IAAM,2BAA4C;AAAA,EACvD,UAAU;AAAA,EACV,KAAK,CAAC,IAAI,UAAU,gCAAgC,IAAI,UAAU,KAAK;AAAA,EACvE,eAAe,OAAO,IAAI,UAAU;AAClC,UAAM,SAAS,MAAM,oCAAoC,IAAI,KAAK;AAClE,WAAO,QAAQ,aAAa,WAAW,SAAS;AAAA,EAClD;AAAA,EACA,eAAe,CAAC,IAAI,UAAU,8BAA8B,IAAI,KAAK;AAAA,EACrE,eAAe,CAAC,IAAI,aAClB,sBAAsB,MAAM,EAAE,wCAAwC,IAAI,QAAQ;AAAA,EACpF,mBAAmB,CAAC,IAAI,YACtB,sBAAsB,MAAM,EAAE,kCAAkC,IAAI,OAAO;AAAA,EAC7E,aAAa,CAAC,IAAI,UAAU,4CAA4C,IAAI,UAAU,KAAK;AAAA,EAC3F,iBAAiB,CAAC,IAAI,UACpB,sCAAsC,IAAI,EAAE,GAAG,OAAO,UAAU,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM5E,wBAAwB,CAAC,EAAE,IAAI,SAAS,GAAG,SACzC,uCAAuC;AAAA,IACrC,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA,WAAW,KAAK;AAAA,IAChB,aAAa,KAAK;AAAA,IAClB,cAAc;AAAA,EAChB,CAAC;AACL;;;AC1CA;AAAA,EACE,mCAAAC;AAAA,EACA,uCAAAC;AAAA,EACA,iCAAAC;AAAA,EACA,yCAAAC;AAAA,EACA,yBAAAC;AAAA,EACA,yBAAAC;AAAA,EACA,+CAAAC;AAAA,OAEK;;;ACfP;AAAA,EACE,uCAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA,wCAAAC;AAAA,EACA,uCAAAC;AAAA,OAGK;AAGP,IAAMC,qCAAoC;AAsB1C,eAAsB,6BAA6B,OAOjC;AAChB,QAAM,OAAO,MAAM,QAAQ,EAAE,WAAW,MAAM,MAAM,IAAI,CAAC;AACzD,QAAM,YAAsB,CAAC;AAC7B,MAAI;AACF,cAAU;AAAA,MACR,GAAI,MAAMF;AAAA,QACR;AAAA,MACF,EAAE;AAAA,QACA,MAAM;AAAA,QACN,MAAM;AAAA,QACN;AAAA,UACE,MAAM;AAAA,UACN,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,WAAWE;AAAA,QACb;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AACA,MAAI,MAAM,cAAc;AACtB,QAAI;AACF,gBAAU;AAAA,QACR,GAAI,MAAMD;AAAA,UACR;AAAA,QACF,EAAE;AAAA,UACA,MAAM;AAAA,UACN,MAAM;AAAA,UACN,MAAM;AAAA,UACN;AAAA,QACF;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AACA,MAAI,UAAU,SAAS,GAAG;AACxB,UAAMF,qCAAoC,MAAM,IAAI,gCAAgC;AAAA,MAClF,WAAW,MAAM;AAAA,MACjB,QAAQ;AAAA,IACV,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EAC1B;AACF;;;ADjEA,IAAM,MAAMI;AAEL,IAAM,wBAAyC;AAAA,EACpD,UAAU;AAAA,EACV,KAAK,CAAC,IAAI,UAAUC,iCAAgC,IAAI,OAAO,KAAK;AAAA,EACpE,eAAe,OAAO,IAAI,UAAU;AAClC,UAAM,SAAS,MAAMC,qCAAoC,IAAI,KAAK;AAClE,WAAO,QAAQ,aAAa,QAAQ,SAAS;AAAA,EAC/C;AAAA,EACA,eAAe,CAAC,IAAI,UAAUC,+BAA8B,IAAI,KAAK;AAAA,EACrE,eAAe,CAAC,IAAI,aAClBC,uBAAsB,GAAG,EAAE,wCAAwC,IAAI,QAAQ;AAAA,EACjF,mBAAmB,CAAC,IAAI,YACtBA,uBAAsB,GAAG,EAAE,kCAAkC,IAAI,OAAO;AAAA,EAC1E,aAAa,CAAC,IAAI,UAAUC,6CAA4C,IAAI,OAAO,KAAK;AAAA,EACxF,iBAAiB,CAAC,IAAI,UACpBC,uCAAsC,IAAI,EAAE,GAAG,OAAO,UAAU,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,EAIzE,wBAAwB,CAAC,EAAE,IAAI,SAAS,GAAG,SACzC,6BAA6B;AAAA,IAC3B;AAAA,IACA;AAAA,IACA,WAAW,KAAK;AAAA,IAChB,aAAa,KAAK;AAAA,IAClB,cAAc;AAAA,EAChB,CAAC;AACL;;;APzCO,SAAS,+BAAkD;AAChE,QAAM,aAAa,IAAI,IAAI,4BAA4B,CAAC;AACxD,SAAO,CAAC,yBAAyB,0BAA0B,qBAAqB,EAAE;AAAA,IAChF,CAAC,YAAY,WAAW,IAAI,QAAQ,QAAQ;AAAA,EAC9C;AACF;;;ASXA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;;;ACLP,SAAS,wDAAwD;AAEjE;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,eAAe;AAWjB,IAAM,oBAAoB;AACjC,IAAM,mBAAmB;AAIzB,IAAM,sBAAsB;AAE5B,IAAM,6BAAkD,oBAAI,IAAI;AAAA,EAC9D;AAAA,EACA;AACF,CAAC;AACD,IAAM,cAAc,IAAI,YAAY;AAKpC,SAAS,eAAe,OAAgD;AACtE,MAAI,CAAC,2BAA2B,IAAI,MAAM,IAAI,EAAG,QAAO;AACxD,aAAW,OAAO,OAAO,KAAK,KAAK,GAAG;AACpC,QAAI,QAAQ,UAAU,QAAQ,UAAW,QAAO;AAAA,EAClD;AACA,QAAM,UAAU,MAAM;AACtB,MAAI,YAAY,QAAQ,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,EAAG,QAAO;AACtF,QAAM,SAAS;AACf,MAAI,OAAO,OAAO,SAAS,SAAU,QAAO;AAC5C,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,QAAQ,UAAU,QAAQ,eAAe,QAAQ,QAAS,QAAO;AAAA,EACvE;AACA,MAAI,OAAO,cAAc,UAAa,OAAO,OAAO,cAAc,SAAU,QAAO;AACnF,MAAI,OAAO,UAAU,UAAa,OAAO,OAAO,UAAU,SAAU,QAAO;AAC3E,SAAO;AACT;AAUO,SAAS,wBAAwB,QAAgD;AACtF,QAAM,SAA6B,CAAC;AACpC,MAAI,MAMO;AACX,QAAM,WAAW,MAAM;AACrB,QAAI,CAAC,IAAK;AACV,WAAO;AAAA,MACL,IAAI,UAAU,IACV,IAAI,QACJ;AAAA,QACE,MAAM,IAAI,MAAM;AAAA,QAChB,SAAS;AAAA,UACP,MAAM,IAAI;AAAA,UACV,GAAI,IAAI,KAAK,cAAc,SAAY,EAAE,WAAW,IAAI,KAAK,UAAU,IAAI,CAAC;AAAA,UAC5E,GAAI,IAAI,KAAK,UAAU,SAAY,EAAE,OAAO,IAAI,KAAK,MAAM,IAAI,CAAC;AAAA,QAClE;AAAA,MACF;AAAA,IACN;AACA,UAAM;AAAA,EACR;AACA,aAAW,SAAS,QAAQ;AAC1B,UAAM,QAAQ,eAAe,KAAK;AAClC,QAAI,CAAC,OAAO;AACV,eAAS;AACT,aAAO,KAAK,KAAK;AACjB;AAAA,IACF;AACA,QACE,OACA,IAAI,MAAM,SAAS,MAAM,QACzB,IAAI,KAAK,cAAc,MAAM,aAC7B,IAAI,KAAK,UAAU,MAAM,OACzB;AACA,YAAM,SACH,MAAM,SAAS,0BACZ,wBAAwB,IAAI,MAAM,MAAM,IAAI,IAC5C,MAAM,MAAM;AAClB,YAAM,aAAa,YAAY,OAAO,KAAK,EAAE;AAC7C,UAAI,IAAI,QAAQ,cAAc,2CAA2C;AACvE,YAAI,QAAQ;AACZ,YAAI,SAAS;AACb,YAAI,SAAS;AACb;AAAA,MACF;AAAA,IACF;AACA,aAAS;AACT,UAAM;AAAA,MACJ,OAAO;AAAA,MACP,MAAM;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,OAAO;AAAA,MACP,OAAO,YAAY,OAAO,MAAM,IAAI,EAAE;AAAA,IACxC;AAAA,EACF;AACA,WAAS;AACT,SAAO;AACT;AAYO,SAAS,qBACd,aACA,UAAiC,CAAC,GAClC;AACA,QAAM,MAAM,QAAQ,QAAQ,MAAM,YAAY,IAAI;AAClD,MAAI,UAA8B,CAAC;AACnC,MAAI,YAAY,OAAO;AAKvB,MAAI,oBAAoB;AACxB,MAAI,gBAAsD;AAC1D,MAAI,kBAAkB;AAItB,MAAI,eAAqC;AAGzC,MAAI,cAAc;AAClB,MAAI;AASJ,QAAM,aAAa,oBAAI,IAAsB;AAAA,IAC3C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,SAAO;AAAA,IACL,MAAM,OAAO,UAAwD;AACnE,yBAAmB;AAGnB,cAAQ,KAAK,EAAE,MAAM,MAAM,MAAM,SAAS,MAAM,QAAQ,CAAC;AACzD,YAAM,UAAU,KAAK,IAAI,IAAI;AAC7B,UAAI,WAAW,IAAI,MAAM,IAAI,GAAG;AAC9B,cAAM,MAAM;AAGZ,4BAAoB;AACpB;AAAA,MACF;AACA,YAAM,YAAY,qBAAqB,2BAA2B,IAAI,MAAM,IAAI;AAChF,UAAI,UAAW,qBAAoB;AACnC,UAAI,aAAa,QAAQ,UAAU,oBAAoB,WAAW,mBAAmB;AAInF,aAAK,WAAW,EAAE,MAAM,MAAM,MAAS;AAAA,MACzC;AACA,UAAI,kBAAkB,QAAQ,UAAU,qBAAqB;AAC3D,cAAM,MAAM;AACZ;AAAA,MACF;AACA,uBAAiB;AAAA,IACnB;AAAA,IACA;AAAA,EACF;AAEA,WAAS,mBAAmB;AAC1B,QAAI,kBAAkB,MAAM;AAC1B;AAAA,IACF;AACA,oBAAgB,WAAW,MAAM;AAC/B,sBAAgB;AAGhB,WAAK,MAAM,EAAE,MAAM,MAAM,MAAS;AAAA,IACpC,GAAG,iBAAiB;AACpB,QAAI,WAAW,iBAAiB,OAAO,cAAc,UAAU,YAAY;AACzE,oBAAc,MAAM;AAAA,IACtB;AAAA,EACF;AAEA,WAAS,qBAAqB;AAC5B,QAAI,kBAAkB,MAAM;AAC1B,mBAAa,aAAa;AAC1B,sBAAgB;AAAA,IAClB;AAAA,EACF;AAEA,iBAAe,QAAuB;AACpC,uBAAmB;AACnB,uBAAmB;AACnB,UAAM,WAAW;AACjB,uBAAmB;AAAA,EACrB;AAEA,WAAS,aAA4B;AACnC,QAAI,cAAc;AAChB,aAAO;AAAA,IACT;AACA,QAAI,aAAa;AACf,aAAO,QAAQ,OAAO,YAAY;AAAA,IACpC;AACA,QAAI,QAAQ,WAAW,GAAG;AACxB,aAAO,QAAQ,QAAQ;AAAA,IACzB;AACA,uBAAmB;AAInB,QAAI,WAAW;AACf,UAAM,WAAW,YAAY;AAC3B,UAAI;AACF,eAAO,QAAQ,SAAS,GAAG;AACzB,gBAAM,SAAS,wBAAwB,QAAQ,OAAO,GAAG,gBAAgB,CAAC;AAC1E,4BAAkB,OAAO;AACzB,sBAAY,KAAK,IAAI;AACrB,gBAAM,YAAY,IAAI;AACtB,cAAI;AACF,kBAAM,YAAY,MAAM;AAAA,UAC1B,SAAS,OAAO;AACd,0BAAc;AACd,2BAAe;AACf,kBAAM;AAAA,UACR,UAAE;AACA,8BAAkB;AAClB,gBAAI,QAAQ,SAAS;AACnB,kBAAI;AACF,wBAAQ,QAAQ;AAAA,kBACd,QAAQ,OAAO;AAAA,kBACf,iBAAiB,KAAK,IAAI,IAAI,IAAI,IAAI,aAAa,GAAI;AAAA,gBACzD,CAAC;AAAA,cACH,QAAQ;AAAA,cAER;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF,UAAE;AACA,mBAAW;AACX,uBAAe;AAAA,MACjB;AAAA,IACF,GAAG;AACH,QAAI,CAAC,UAAU;AACb,qBAAe;AAAA,IACjB;AACA,WAAO;AAAA,EACT;AAEA,WAAS,qBAA2B;AAClC,QAAI,aAAa;AACf,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEO,SAAS,yBAAyC;AACvD,MAAI;AACF,WAAO,QAAQ,QAAQ;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,uBACd,SACA,SACA,WAA+B,aACQ;AACvC,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,SAAS,MAAM;AAC3B,YAAQ,UAAU,EAAE,GAAG,SAAS,KAAI,oBAAI,KAAK,GAAE,YAAY,EAAE,CAAC;AAAA,EAChE,GAAG,gDAAgD;AACnD,MAAI,WAAW,SAAS,OAAO,MAAM,UAAU,YAAY;AACzD,UAAM,MAAM;AAAA,EACd;AACA,SAAO;AACT;AAEA,eAAsB,gBACpB,UACA,SAC4B;AAC5B,MAAI,CAAC,SAAS;AACZ,WAAO,MAAM,SAAS,KAAK;AAAA,EAC7B;AACA,QAAM,SAAS,QAAQ;AACvB,MAAI,OAAO,SAAS;AAClB,UAAM,OAAO;AAAA,EACf;AAOA,SAAO,MAAM,IAAI,QAA2B,CAAC,SAAS,WAAW;AAC/D,QAAI,UAAU;AACd,UAAM,SAAS,CAAC,aAAyB;AACvC,UAAI,QAAS;AACb,gBAAU;AACV,aAAO,oBAAoB,SAAS,OAAO;AAC3C,eAAS;AAAA,IACX;AACA,UAAM,UAAU,MAAM,OAAO,MAAM,OAAO,OAAO,MAAM,CAAC;AAExD,WAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACxD,QAAI,OAAO,SAAS;AAClB,cAAQ;AACR;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,aAAO,SAAS,KAAK;AAAA,IACvB,SAAS,OAAO;AACd,aAAO,MAAM,OAAO,KAAK,CAAC;AAC1B;AAAA,IACF;AACA,SAAK,QAAQ,QAAQ,IAAI,EAAE;AAAA,MACzB,CAAC,WAAW,OAAO,MAAM,QAAQ,MAAM,CAAC;AAAA,MACxC,CAAC,UAAU,OAAO,MAAM,OAAO,KAAK,CAAC;AAAA,IACvC;AAAA,EACF,CAAC;AACH;;;AC5WA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAMK;AACP,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,qBAAAC,0BAAyB;AAoD3B,IAAM,iDAAiD;AAkBvD,SAAS,sCACd,aACA,mBACuC;AACvC,QAAM,YAAY;AAClB,QAAM,iBAAiB,UAAU;AACjC,QAAM,eAAe,UAAU;AAC/B,MAAI,mBAAmB,UAAa,iBAAiB,UAAa,CAAC,mBAAmB;AACpF,WAAO,EAAE,QAAQ,eAAe;AAAA,EAClC;AACA,MAAI,mBAAmB,wBAAwB,iBAAiB,QAAW;AACzE,WAAO,EAAE,QAAQ,WAAW,QAAQ,sCAAsC;AAAA,EAC5E;AAEA,QAAM,SAAS,2BAA2B,UAAU,YAAY;AAChE,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,oBAAoB,OAAO,MAAM,OAAO,KAAK,CAAC,UAAU,MAAM,KAAK,CAAC,MAAM,YAAY;AAC5F,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ,oBACJ,oCACA;AAAA,IACN;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,YAAY,WAAW,OAAO,KAAK;AACtD;AAOO,SAAS,mCACd,OACkC;AAClC,QAAM,cAAc;AAAA,IAClB,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AACA,MAAI,YAAY,WAAW,WAAY,QAAO;AAC9C,QAAM,YAAY,YAAY;AAE9B,MAAI,CAAC,MAAM,UAAU,kBAAkB;AACrC,WAAO,QAAQ,qCAAqC;AAAA,EACtD;AAEA,MACE,UAAU,kBAAkB;AAAA,IAC1B,CAAC,aACC,CAAC,MAAM,UAAU,UAAU,KAAK,CAAC,aAAaA,mBAAkB,UAAU,QAAQ,CAAC;AAAA,EACvF,GACA;AACA,WAAO,QAAQ,kCAAkC;AAAA,EACnD;AAEA,QAAM,uBAAuB,IAAI,IAAI,MAAM,UAAU,YAAY;AACjE,MAAI,UAAU,qBAAqB,KAAK,CAAC,OAAO,CAAC,qBAAqB,IAAI,EAAE,CAAC,GAAG;AAC9E,WAAO,QAAQ,kCAAkC;AAAA,EACnD;AAEA,QAAM,0BAA0B,IAAI,IAAI,MAAM,UAAU,kBAAkB;AAC1E,MAAI,UAAU,2BAA2B,KAAK,CAAC,SAAS,CAAC,wBAAwB,IAAI,IAAI,CAAC,GAAG;AAC3F,WAAO,QAAQ,kCAAkC;AAAA,EACnD;AAEA,QAAM,gCAAgC,IAAI,IAAI,MAAM,UAAU,wBAAwB;AACtF,MACE,UAAU,iCAAiC;AAAA,IACzC,CAAC,eAAe,CAAC,8BAA8B,IAAI,UAAU;AAAA,EAC/D,GACA;AACA,WAAO,QAAQ,kCAAkC;AAAA,EACnD;AAEA,MAAI,UAAU,eAAe,CAAC,aAAa,MAAM,UAAU,KAAK,UAAU,WAAW,GAAG;AACtF,WAAO,QAAQ,kCAAkC;AAAA,EACnD;AAEA,QAAM,eAAe,IAAI;AAAA,IACvB,MAAM,UAAU,OAAO,IAAI,CAAC,UAAU,CAAC,cAAc,MAAM,IAAI,GAAG,KAAK,CAAC;AAAA,EAC1E;AACA,MAAI,UAAU,yBAAyB,KAAK,CAAC,SAAS,CAAC,aAAa,IAAI,cAAc,IAAI,CAAC,CAAC,GAAG;AAC7F,WAAO,QAAQ,kCAAkC;AAAA,EACnD;AACA,QAAM,qBAAqB,IAAI;AAAA,IAC7B,MAAM,UAAU,OAAO,QAAQ,CAAC,UAAU,MAAM,MAAM,IAAI,CAAC,SAAS,cAAc,KAAK,IAAI,CAAC,CAAC;AAAA,EAC/F;AACA,MACE,UAAU,sBAAsB,KAAK,CAAC,SAAS,CAAC,mBAAmB,IAAI,cAAc,IAAI,CAAC,CAAC,GAC3F;AACA,WAAO,QAAQ,kCAAkC;AAAA,EACnD;AAEA,QAAM,QAAQ,UAAU,WAAW;AACnC,MAAI,MAAM,SAAS,SAAS,CAAC,qBAAqB,IAAI,MAAM,QAAQ,GAAG;AACrE,WAAO,QAAQ,kCAAkC;AAAA,EACnD;AACA,MAAI,MAAM,SAAS,iBAAiB,CAAC,wBAAwB,IAAI,MAAM,IAAI,GAAG;AAC5E,WAAO,QAAQ,kCAAkC;AAAA,EACnD;AACA,MAAI,MAAM,SAAS,gBAAgB;AACjC,UAAM,WAAW,aAAa,IAAI,cAAc,MAAM,eAAe,CAAC;AACtE,UAAM,QAAQ,IAAI,IAAI,UAAU,MAAM,IAAI,CAAC,SAAS,cAAc,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC;AACnF,QAAI,CAAC,YAAY,MAAM,cAAc,KAAK,CAAC,SAAS,CAAC,MAAM,IAAI,cAAc,IAAI,CAAC,CAAC,GAAG;AACpF,aAAO,QAAQ,kCAAkC;AAAA,IACnD;AAAA,EACF;AACA,MACE,MAAM,SAAS,yBACf,CAAC,aAAa,MAAM,UAAU,KAAK;AAAA,IACjC,MAAM,UAAU,aAAa,QAAQ;AAAA,IACrC,mBAAmB,CAAC,MAAM,gBAAgB;AAAA,EAC5C,CAAC,GACD;AACA,WAAO,QAAQ,kCAAkC;AAAA,EACnD;AAEA,MAAI,CAAC,wBAAwB,UAAU,UAAU,GAAG;AAClD,WAAO,QAAQ,iCAAiC;AAAA,EAClD;AACA,MAAI,CAAC,sBAAsB,UAAU,YAAY,MAAM,qBAAqB,GAAG;AAC7E,WAAO,QAAQ,iCAAiC;AAAA,EAClD;AACA,SAAO,EAAE,QAAQ,QAAQ;AAC3B;AAEO,SAAS,gCAAgC,OAIL;AACzC,QAAM,EAAE,MAAM,UAAU,IAAI;AAC5B,MAAI,UAAU,sBAAsB,KAAM,QAAO;AACjD,QAAM,cAAc;AAAA,IAClB,KAAK;AAAA,IACL,MAAM,0BAA0B;AAAA,EAClC;AACA,MAAI,YAAY,WAAW,cAAc,CAAC,MAAM,sBAAuB,QAAO;AAC9E,QAAM,kBAAkB,YAAY,UAAU,WAAW,oBACtD,IAAI,CAACC,WAAU,CAACA,QAAO,MAAM,wBAAwBA,MAAK,CAAC,CAAU,EACrE,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,cAAc,KAAK,CAAC;AACtD,MAAI,gBAAgB,KAAK,CAAC,CAAC,EAAE,KAAK,MAAM,OAAO,UAAU,YAAY,MAAM,WAAW,CAAC,GAAG;AACxF,WAAO;AAAA,EACT;AACA,QAAM,aAAa;AAAA,IACjB,kBAAkB,UAAU;AAAA,IAC5B,WAAW,CAAC,GAAG,UAAU,SAAS,EAAE,IAAI,CAAC,aAAa,WAAW,QAAQ,CAAC,EAAE,KAAK;AAAA,IACjF,cAAc,CAAC,GAAG,UAAU,YAAY,EAAE,KAAK;AAAA,IAC/C,oBAAoB,CAAC,GAAG,UAAU,kBAAkB,EAAE,KAAK;AAAA,IAC3D,0BAA0B,CAAC,GAAG,UAAU,wBAAwB,EAAE,KAAK;AAAA,IACvE,KAAK,UAAU,MACX;AAAA,MACE,MAAM,UAAU,IAAI;AAAA,MACpB,iBAAiB,CAAC,GAAG,UAAU,IAAI,eAAe,EAAE,KAAK;AAAA,MACzD,aAAa,UAAU,IAAI;AAAA,IAC7B,IACA;AAAA,IACJ,QAAQ,CAAC,GAAG,UAAU,MAAM,EACzB,IAAI,CAAC,WAAW;AAAA,MACf,MAAM,MAAM;AAAA,MACZ,OAAO,MAAM,MAAM,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,KAAK;AAAA,IACnD,EAAE,EACD,KAAK,CAAC,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;AAAA,EAC9D;AACA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,mBAAmB,UAAU;AAAA,IAC7B,iBAAiBF,YAAW,QAAQ,EAAE,OAAO,WAAW,UAAU,CAAC,EAAE,OAAO,KAAK;AAAA,IACjF,YAAYA,YAAW,QAAQ,EAAE,OAAO,WAAW,IAAI,CAAC,EAAE,OAAO,KAAK;AAAA,IACtE,qBAAqBA,YAAW,QAAQ,EAAE,OAAO,WAAW,eAAe,CAAC,EAAE,OAAO,KAAK;AAAA,EAC5F;AACF;AAEO,SAAS,qCACd,SACwC;AACxC,QAAM,MAAM,QAAQ,8CAA8C;AAClE,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,EAAG,QAAO;AAClE,QAAM,QAAQ;AACd,SAAO,MAAM,YAAY,KACvB,OAAO,MAAM,sBAAsB,YACnC,OAAO,UAAU,MAAM,iBAAiB,KACxC,MAAM,oBAAoB,KAC1B,OAAO,MAAM,oBAAoB,YACjC,iBAAiB,KAAK,MAAM,eAAe,KAC3C,OAAO,MAAM,eAAe,YAC5B,iBAAiB,KAAK,MAAM,UAAU,KACtC,OAAO,MAAM,wBAAwB,YACrC,iBAAiB,KAAK,MAAM,mBAAmB,IAC7C;AAAA,IACE,SAAS;AAAA,IACT,mBAAmB,MAAM;AAAA,IACzB,iBAAiB,MAAM;AAAA,IACvB,YAAY,MAAM;AAAA,IAClB,qBAAqB,MAAM;AAAA,EAC7B,IACA;AACN;AAEA,SAAS,QAAQ,QAAiF;AAChG,SAAO,EAAE,QAAQ,WAAW,OAAO;AACrC;AAEA,SAAS,aACP,KACA,UACS;AACT,MAAI,CAAC,OAAO,IAAI,SAAS,SAAS,QAAQ,IAAI,gBAAgB,WAAW;AACvE,WAAO;AAAA,EACT;AACA,QAAM,UAAU,IAAI,IAAI,IAAI,eAAe;AAC3C,SAAO,SAAS,kBAAkB,MAAM,CAAC,WAAW,QAAQ,IAAI,MAAM,CAAC;AACzE;AAEA,SAAS,wBAAwB,YAA+D;AAC9F,MAAI,WAAW,cAAc,mBAAmB,WAAW,cAAc,uBAAuB;AAC9F,WAAO;AAAA,EACT;AACA,SAAO,WAAW,eAAe;AAAA,IAAM,CAAC,aACtC,WAAW,gBAAgB,KAAK,CAAC,cAAc;AAC7C,UAAI,UAAU,WAAW,SAAS,OAAQ,QAAO;AACjD,YAAM,SAAS,IAAI,IAAI,UAAU,MAAM;AACvC,aACE,OAAO,IAAI,WAAW,cAAc,KAAK,SAAS,OAAO,MAAM,CAACE,WAAU,OAAO,IAAIA,MAAK,CAAC;AAAA,IAE/F,CAAC;AAAA,EACH;AACF;AAEA,SAAS,sBACP,YACA,kBACS;AACT,MAAI,CAAC,iBAAkB,QAAO;AAC9B,SAAO,WAAW,oBAAoB;AAAA,IACpC,CAACA,WACCA,WAAU,WAAW,kBACrB,OAAO,iBAAiBA,MAAK,MAAM,YACnC,iBAAiBA,MAAK,EAAG,SAAS,KAClC,WAAW,eAAe,MAAM,CAAC,WAAW,OAAO,OAAO,SAASA,MAAK,CAAC,KACzE,WAAW,gBAAgB;AAAA,MACzB,CAAC,WACC,WAAW,eAAe,KAAK,CAAC,aAAa,SAAS,WAAW,OAAO,MAAM,KAC9E,OAAO,OAAO,SAAS,WAAW,cAAc,KAChD,OAAO,OAAO,SAASA,MAAK;AAAA,IAChC;AAAA,EACJ;AACF;;;ACxUA;AAAA,EACE;AAAA,OAMK;AACP,SAAS,4BAA4B,gCAAgC;AACrE;AAAA,EACE;AAAA,EACA;AAAA,EACA,wCAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,kBAAAC;AAAA,EACA,oBAAAC;AAAA,OAEK;AACP;AAAA,EACE,oCAAAC;AAAA,EACA;AAAA,OAEK;AAkBP,eAAe,+BAA+B,OAIO;AACnD,QAAM,cAAc,sCAAsC,MAAM,KAAK,aAAa,IAAI;AACtF,MAAI,YAAY,WAAW,WAAY,QAAO,CAAC;AAC/C,QAAM,YAAY,YAAY;AAC9B,MACE,UAAU,yBAAyB,WAAW,KAC9C,UAAU,sBAAsB,WAAW,KAC3C,UAAU,WAAW,MAAM,SAAS,gBACpC;AACA,WAAO,CAAC;AAAA,EACV;AACA,QAAM,UAAU;AAAA,IACd,MAAM;AAAA,IACN,WAAW,MAAM,KAAK;AAAA,IACtB,aAAa,MAAM,KAAK;AAAA,IACxB,WAAW,MAAM;AAAA,EACnB;AACA,QAAM,SAAS,MAAM,KAAK,eAAe,EAAE,MAAM,MAAe;AAChE,MAAI;AACF,UAAM,aACJ,MAAM,qBAAqB,MAAM,IAAI,SAAS,EAAE,aAAa,MAAM,KAAK,YAAY,CAAC,GACrF,OAAO,CAAC,UAAU,OAAO,SAAS,SAAS,OAAO,SAAS,SAAS,MAAM,EAAE,CAAC;AAC/E,UAAM,SAA2C,CAAC;AAClD,eAAW,SAAS,WAAW;AAC7B,YAAM,QAA4B,CAAC;AACnC,UAAI;AACJ,SAAG;AACD,cAAM,OAAO,MAAM,eAAe,MAAM,IAAI,SAAS;AAAA,UACnD,SAAS,MAAM;AAAA,UACf,OAAO;AAAA,UACP,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,QAC7B,CAAC;AACD,cAAM,KAAK,GAAG,KAAK,MAAM,IAAI,CAAC,UAAU,EAAE,MAAM,KAAK,KAAK,EAAE,CAAC;AAC7D,iBAAS,KAAK,cAAc;AAAA,MAC9B,SAAS;AACT,aAAO,KAAK,EAAE,MAAM,MAAM,MAAM,MAAM,CAAC;AAAA,IACzC;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAsB,0CAA0C,OAwBhB;AAC9C,QAAM,CAAC,qBAAqB,uBAAuB,IAAI,MAAM,QAAQ,IAAI;AAAA,IACvE,kCAAkC,MAAM,IAAI,MAAM,KAAK,WAAW;AAAA,IAClE;AAAA,MACE,MAAM;AAAA,MACN,MAAM,KAAK;AAAA,MACX,MAAM;AAAA,IACR;AAAA,EACF,CAAC;AACD,QAAM,eAAe,MAAM,kBACvB,MAAM,gBAAgB,QACtB,MAAM,UACJ,MAAM,QAAQ,QACb,MAAM,gBAAgB,oBAAoB,MAAM,UAAU,MAAM,KAAK,YAAY,KAAK;AAC7F,QAAM,qBAAqB,4CAA4C;AAAA,IACrE,sBAAsB,MAAM,SAAS,WAAW,IAAI,CAAC,WAAW,OAAO,EAAE;AAAA,IACzE;AAAA,IACA;AAAA,IACA,GAAI,MAAM,kBACN,EAAE,6BAA6B,MAAM,gBAAgB,aAAa,IAClE,CAAC;AAAA,IACL,SAAS,MAAM,kBACX;AAAA,MACE,YAAY,MAAM,gBAAgB,aAAa,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;AAAA,MACnE,OAAO,MAAM,gBAAgB;AAAA,MAC7B,YAAY,MAAM,gBAAgB;AAAA,IACpC,IACA,MAAM;AAAA,IACV,cAAc;AAAA,EAChB,CAAC;AAED,MAAI,mBAAmB;AACvB,MAAI,MAAiD;AACrD,MAAI,MAAM,mBAAmB,MAAM,SAAS;AAC1C,UAAM,QAAQ,MAAM,iBAAiB,SAAS,MAAM,SAAS,SAAS;AACtE,UAAM,eAAe,MAAM,iBAAiB,gBAAgB,MAAM,SAAS,gBAAgB;AAC3F,QAAK,UAAU,UAAW,iBAAiB,OAAO;AAChD,yBAAmB;AAAA,IACrB,WAAW,SAAS,cAAc;AAChC,YAAM,WAAW,MAAM;AAAA,QACrB,MAAM;AAAA,QACN;AAAA,UACE,WAAW,MAAM,KAAK;AAAA,UACtB,aAAa,MAAM,KAAK;AAAA,UACxB,WAAW,MAAM,sCAAsC,MAAM,KAAK,UAAU;AAAA,QAC9E;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,UAAI,CAAC,UAAU;AACb,2BAAmB;AAAA,MACrB,OAAO;AACL,cAAM;AAAA,UACJ,MAAM,SAAS;AAAA,UACf,iBAAiB,SAAS,QAAQ;AAAA,UAClC,aAAa,SAAS,OAAO;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAAA,EACF,OAAO;AACL,QAAI,MAAM,KAAK,OAAO;AACpB,YAAM,cAAc,MAAM;AAAA,QACxB,MAAM;AAAA,QACN;AAAA,UACE,WAAW,MAAM,KAAK;AAAA,UACtB,aAAa,MAAM,KAAK;AAAA,UACxB,WAAW,MAAM,sCAAsC,MAAM,KAAK,UAAU;AAAA,QAC9E;AAAA,QACA,MAAM,KAAK;AAAA,MACb;AACA,UAAI,CAAC,aAAa,iBAAiB,CAAC,YAAY,qBAAqB;AACnE,2BAAmB;AAAA,MACrB,OAAO;AACL,cAAM;AAAA,UACJ,MAAM,YAAY;AAAA,UAClB,iBAAiB,YAAY,cAAc;AAAA,UAC3C,aAAa,YAAY,oBAAoB;AAAA,QAC/C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,+BAA+B;AAAA,IAClD,IAAI,MAAM;AAAA,IACV,MAAM,MAAM;AAAA,IACZ,WAAW,MAAM,sCAAsC,MAAM,KAAK,UAAU;AAAA,EAC9E,CAAC;AACD,MAAI,WAAW,KAAM,oBAAmB;AAExC,SAAO;AAAA,IACL;AAAA,IACA,WAAW,MAAM,kBACb,MAAM,KAAK,YAAY,YACtB,MAAM,SAAS,aAAa,MAAM,KAAK,YAAY;AAAA,IACxD,cAAc,mBAAmB,SAAS,IAAI,CAAC,SAAS,KAAK,EAAE;AAAA,IAC/D,oBAAoB,MAAM,kBACtB,MAAM,gBAAgB,qBACtB,MAAM,UACJC;AAAA,MACE,MAAM;AAAA,MACN,MAAM;AAAA,OACL,MAAMC,kBAAiB,MAAM,IAAI,MAAM,KAAK,WAAW,GAAG;AAAA,IAC7D,IACA,+BAA+B,MAAM,QAAQ,EAAE;AAAA,IACrD,0BAA0B,MAAM,kBAC3B,MAAM,gBAAgB,4BAA4B,sCAClD,MAAM,SAAS,4BAA4B;AAAA,IAChD;AAAA,IACA,QAAQ,UAAU,CAAC;AAAA,IACnB,mBACE,MAAM,iBAAiB,qBAAqB,MAAM,SAAS,qBAAqB;AAAA,EACpF;AACF;AAGO,SAAS,4CAA4C,OAWzD;AACD,QAAM,+BAA+B,IAAI,IAAI,MAAM,oBAAoB;AACvE,aAAW,MAAM,MAAM,oBAAqB,8BAA6B,IAAI,EAAE;AAC/E,aAAW,MAAM,MAAM,wBAAyB,8BAA6B,IAAI,EAAE;AACnF,aAAW,MAAM,MAAM,+BAA+B,CAAC,GAAG;AACxD,iCAA6B,IAAI,EAAE;AAAA,EACrC;AAEA,QAAM,wBAAwB,IAAI,IAAI,4BAA4B;AAClE,aAAW,UAAU,MAAM,SAAS,cAAc,CAAC,GAAG;AACpD,0BAAsB,IAAI,OAAO,EAAE;AAAA,EACrC;AAEA,SAAO,yBAAyB;AAAA,IAC9B,YAAY,MAAM,SAAS,cAAc;AAAA,MACvC,MAAM;AAAA,MACN,wBAAwB;AAAA,IAC1B;AAAA,IACA,cAAc,MAAM;AAAA,IACpB;AAAA,IACA,qBAAqB;AAAA,MACnB,CAAC,GAAG,4BAA4B,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;AAAA,IACxD;AAAA,EACF,CAAC;AACH;AAGA,eAAsB,+CAA+C,OAMI;AACvE,MAAI,EAAE,kDAAkD,MAAM,OAAO,UAAU;AAC7E,WAAO,EAAE,QAAQ,SAAS;AAAA,EAC5B;AACA,QAAM,QAAQ,qCAAqC,MAAM,OAAO,OAAO;AACvE,QAAM,UAAU,MAAM,OAAO;AAC7B,QAAM,SAAS,MAAM,OAAO,QAAQ;AACpC,QAAM,QAAQ,QAAQ,SAAS,yBAAyB,QAAQ,qBAAqB;AACrF,QAAM,SAAS,YAAY;AACzB,QAAI,OAAO;AACT,YAAM,mDAAmD,MAAM,IAAI;AAAA,QACjE,aAAa,MAAM;AAAA,QACnB,WAAW,MAAM;AAAA,QACjB;AAAA,MACF,CAAC;AAAA,IACH;AACA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,EACF;AACA,MAAI,CAAC,SAAS,OAAO,WAAW,YAAY,CAAC,MAAO,QAAO,MAAM,OAAO;AAExE,QAAM,UAAU,MAAMC,gBAAe,MAAM,IAAI,MAAM,aAAa,MAAM,SAAS;AACjF,QAAM,oBAAoB,MAAMC,sCAAqC,MAAM,IAAI;AAAA,IAC7E,aAAa,MAAM;AAAA,IACnB;AAAA,EACF,CAAC;AACD,MACE,CAAC,qBACD,kBAAkB,KAAK,OAAO,UAC9B,CAAC,kBAAkB,2BACnB;AACA,WAAO,MAAM,OAAO;AAAA,EACtB;AACA,QAAM,OAAO,kBAAkB;AAC/B,QAAM,gCAAgC,kBAAkB;AACxD,QAAM,YAAY,MAAM,0CAA0C;AAAA,IAChE,IAAI,MAAM;AAAA,IACV,UAAU,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA,oCAAoC,kBAAkB;AAAA,IACtD,iBAAiB,kBAAkB,yBAC/B;AAAA,MACE,OAAO,kBAAkB,uBAAuB;AAAA,MAChD,oBACE,kBAAkB,uBAAuB,+BACzC,kBAAkB,uBAAuB;AAAA,MAC3C,0BACE,kBAAkB,uBAAuB;AAAA,MAC3C,OAAO,kBAAkB,uBAAuB;AAAA,MAChD,cAAc,kBAAkB,uBAAuB;AAAA,MACvD,YAAY,kBAAkB,uBAAuB;AAAA,MACrD,cAAc,kBAAkB,uBAAuB;AAAA,MACvD,mBAAmB,kBAAkB,uBAAuB;AAAA,IAC9D,IACA;AAAA,MACE,OAAO,kBAAkB;AAAA,MACzB,oBAAoB,kBAAkB;AAAA,MACtC,0BAA0B,kBAAkB;AAAA,MAC5C,OAAO,kBAAkB,aAAa,MAAM;AAAA,MAC5C,cAAc,kBAAkB,aAAa,aAAa;AAAA,MAC1D,YAAY,QAAQ;AAAA,MACpB,cAAc,CAAC;AAAA,MACf,mBAAmB,QAAQ;AAAA,IAC7B;AAAA,EACN,CAAC;AACD,QAAM,YAAY,mCAAmC;AAAA,IACnD,aAAa,KAAK;AAAA,IAClB,mBAAmB,kBAAkB,0BAA0B;AAAA,IAC/D,uBAAuB,kBAAkB;AAAA,IACzC;AAAA,EACF,CAAC;AACD,MAAI,UAAU,WAAW,QAAS,QAAO,MAAM,OAAO;AACtD,QAAM,UAAU,gCAAgC;AAAA,IAC9C;AAAA,IACA;AAAA,IACA,uBAAuB,kBAAkB;AAAA,EAC3C,CAAC;AACD,SAAO,WACL,QAAQ,sBAAsB,MAAM,qBACpC,QAAQ,oBAAoB,MAAM,mBAClC,QAAQ,eAAe,MAAM,cAC7B,QAAQ,wBAAwB,MAAM,sBACpC,EAAE,QAAQ,SAAS,IACnB,MAAM,OAAO;AACnB;;;ACxWO,IAAM,kCAAN,cAA8C,MAAM;AAAA,EAChD,OAAO;AAAA,EAEhB,cAAc;AACZ,UAAM,8EAA8E;AACpF,SAAK,OAAO;AAAA,EACd;AACF;AAQA,eAAsB,wCACpB,aACA,OAKe;AACf,QAAM,YAAY,2BAA2B,EAAE,gBAAgB,KAAK,CAAC;AAIrE,MAAI,OAAO,4BAA4B,UAAU,MAAM,gBAAgB;AACrE,UAAM,SAAS,MAAM,MAAM,kBAAkB;AAC7C,QAAI,QAAQ,gBAAiB,OAAM,IAAI,gCAAgC;AAAA,EACzE;AACF;;;ACjCA,SAAS,2BAA2B,yCAAyC;AAuBtE,IAAM,sCAAsC;AACnD,IAAM,oBAAoB;AAC1B,IAAM,kBAAkB,CAAC,GAAG,KAAK,GAAK;AAEtC,IAAM,OAAO,oBAAI,IAAmB;AAG7B,IAAM,gCAAgC;AAOtC,IAAM,mCAAmC;AAGzC,SAAS,2BAA2B,OAAyB;AAClE,MAAI,UAAU;AACd,WAAS,QAAQ,GAAG,QAAQ,KAAK,WAAW,OAAO,YAAY,UAAU,SAAS,GAAG;AACnF,QAAI,mBAAmB,mCAAmC;AACxD,aAAO,QAAQ,WAAW;AAAA,IAC5B;AACA,cAAW,QAAgC;AAAA,EAC7C;AACA,SAAO;AACT;AAEO,SAAS,wBAAwB,OAAc,SAAwC;AAC5F,MAAI,QAAQ,KAAK,IAAI,QAAQ,SAAS;AACtC,MAAI,CAAC,OAAO;AACV,QAAI,KAAK,QAAQ,mBAAmB;AAGlC,YAAM,SAAS,KAAK,KAAK,EAAE,KAAK,EAAE;AAClC,UAAI,WAAW,OAAW,MAAK,OAAO,MAAM;AAAA,IAC9C;AACA,YAAQ,EAAE,WAAW,MAAM,WAAW,aAAa,MAAM,aAAa,UAAU,oBAAI,IAAI,EAAE;AAC1F,SAAK,IAAI,QAAQ,WAAW,KAAK;AAAA,EACnC;AACA,QAAM,SAAS,IAAI,QAAQ,UAAU,OAAO;AAC9C;AAGO,SAAS,gCAAgC,QAA2C;AACzF,QAAM,WAAsC,CAAC;AAC7C,aAAW,SAAS,KAAK,OAAO,GAAG;AACjC,eAAW,WAAW,MAAM,SAAS,OAAO,GAAG;AAC7C,UAAI,QAAQ,WAAW,OAAQ,UAAS,KAAK,OAAO;AACpD,UAAI,SAAS,UAAU,oCAAqC,QAAO;AAAA,IACrE;AAAA,EACF;AACA,SAAO;AACT;AAmBO,SAAS,6CAA6C,OAKjD;AACV,QAAM,QAAQ,KAAK,IAAI,MAAM,SAAS;AACtC,QAAM,UAAU,OAAO,SAAS,IAAI,MAAM,QAAQ;AAClD,MAAI,CAAC,SAAS,CAAC,QAAS,QAAO;AAC/B,MAAI,QAAQ,iBAAiB,MAAM,aAAc,QAAO;AACxD,MAAI,QAAQ,iBAAiB,QAAQ,QAAQ,kBAAkB,MAAM,cAAe,QAAO;AAC3F,QAAM,SAAS,OAAO,MAAM,QAAQ;AACpC,MAAI,MAAM,SAAS,SAAS,KAAK,KAAK,IAAI,MAAM,SAAS,MAAM,OAAO;AACpE,SAAK,OAAO,MAAM,SAAS;AAAA,EAC7B;AACA,SAAO;AACT;AAGA,eAAsB,0BACpB,IACA,OACA,UACe;AACf,aAAW,WAAW,UAAU;AAC9B,UAAM,0BAA0B,IAAI;AAAA,MAClC,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,WAAW,QAAQ;AAAA,MACnB,UAAU,QAAQ;AAAA,MAClB,QAAQ,QAAQ;AAAA,MAChB,cAAc,QAAQ;AAAA,MACtB,eAAe,QAAQ,iBAAiB,OAAO,OAAO,QAAQ;AAAA,MAC9D,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AACF;AAQA,eAAsB,8BACpB,IACA,WACe;AACf,QAAM,QAAQ,KAAK,IAAI,SAAS;AAChC,MAAI,CAAC,SAAS,MAAM,SAAS,SAAS,EAAG;AACzC,MAAI;AACJ,aAAW,SAAS,iBAAiB;AACnC,QAAI,QAAQ,EAAG,OAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,KAAK,CAAC;AACxE,QAAI;AAEF,aAAO,MAAM,SAAS,OAAO,GAAG;AAC9B,mBAAW,CAAC,UAAU,OAAO,KAAK,CAAC,GAAG,MAAM,QAAQ,GAAG;AACrD,gBAAM,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC;AACpD,gBAAM,SAAS,OAAO,QAAQ;AAAA,QAChC;AAAA,MACF;AACA,UAAI,MAAM,SAAS,SAAS,KAAK,KAAK,IAAI,SAAS,MAAM,MAAO,MAAK,OAAO,SAAS;AACrF;AAAA,IACF,SAAS,OAAO;AACd,kBAAY;AAAA,IACd;AAAA,EACF;AACA,QAAM;AACR;;;ACpKA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AACP,SAAS,uDAAuD;AAGzD,IAAM,mCAAN,cAA+C,MAAM;AAAA,EAE1D,YAAqB,iBAAgC;AACnD,UAAM,gFAAgF;AADnE;AAEnB,SAAK,OAAO;AAAA,EACd;AAAA,EAJS,OAAO;AAKlB;AAEO,IAAM,iCAAN,cAA6C,MAAM;AAAA,EAC/C,OAAO;AAAA,EAChB,cAAc;AACZ;AAAA,MACE;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,2BACd,OAC0E;AAC1E,QAAM,OAAO,oBAAI,IAAY;AAC7B,WAAS,QAAQ,GAAG,QAAQ,KAAK,SAAS,OAAO,UAAU,UAAU,SAAS;AAC5E,QAAI,KAAK,IAAI,KAAK,EAAG;AACrB,SAAK,IAAI,KAAK;AACd,QACE,iBAAiB,oCACjB,iBAAiB;AAEjB,aAAO;AACT,YAAS,MAA8B;AAAA,EACzC;AACA,SAAO;AACT;AAGO,SAAS,uBAAuB,OASpC;AACD,QAAM,MAAM,MAAM,OAAO,KAAK;AAC9B,QAAM,YACJ,MAAM,cACL,OAAOC,WAA8B;AACpC,UAAM,SAAS,OAAO,MAAM,cAAc,iBAAiB;AAAA,MACzD,GAAGA;AAAA,MACH,eAAe;AAAA,IACjB,CAAC;AACD,QAAI,OAAO,WAAW,IAAK,OAAM,IAAI,4BAA4B;AACjE,WAAO,oBAAoB,OAAO,QAAQ,OAAO,OAAO;AAAA,EAC1D;AACF,MAAI,QAAmC;AAEvC,MAAI,WAA+B;AACnC,MAAI,kBACF;AACF,MAAI,sBAAsB;AAC1B,MAAI,gBAA+B,QAAQ,QAAQ;AACnD,QAAM,UAAU,CAAC,SAAmC;AAClD,QAAI,YAAY,KAAK,UAAU,QAAQ,IAAI,SAAS,UAAU,QAAQ,EAAG;AACzE;AACA,eAAW;AAAA,MACT,WAAW,KAAK;AAAA,MAChB,SAAS;AAAA,QACP,EAAE,MAAM,KAAK,oBAAoB,OAAO,KAAK,eAAe;AAAA,QAC5D,EAAE,MAAM,KAAK,sBAAsB,OAAO,KAAK,iBAAiB;AAAA,MAClE;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAQ,CAAC,OAAoB,OAAwB;AACzD,UAAM,UAAU,MAAM;AACtB,UAAM,YAAY,QAAQ,OAAO,CAAC,MAAM,EAAE,QAAQ,QAAQ,CAAC,EAAE,SAAS,EAAE,MAAM,QAAQ,IAAI,GAAG;AAC7F,QAAI,UAAU,QAAQ;AACpB,YAAM,QAAQ,UAAU,MAAM,CAAC,MAAM,EAAE,KAAK,IACxC,KAAK,IAAI,GAAG,UAAU,IAAI,CAAC,MAAM,EAAE,MAAO,QAAQ,CAAC,CAAC,IACpD;AACJ,YAAM,IAAI;AAAA,QACR,UAAU,OAAO,OAAO,KAAK,MAAM,QAAQ,MAAM,GAAI;AAAA,MACvD;AAAA,IACF;AAEA,WAAO,QAAQ,MAAM,CAAC,MAAM,OAAO,SAAS,EAAE,IAAI,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,QAAQ,IAAI,GAAG;AAAA,EAC7F;AACA,QAAM,oBAAoB,YAAY;AACpC,QAAI,MAAM,kBAAmB;AAC7B,UAAM,KAAK,IAAI;AAIf,QAAI,SAAU,OAAM,UAAU,EAAE;AAChC,QAAI,CAAC,MAAO,OAAM,IAAI,+BAA+B;AACrD,UAAM,iBAAiB;AACvB,QAAI;AACJ,QAAI;AACF,cAAQ,MAAM,UAAU,KAAK;AAAA,IAC/B,SAAS,OAAO;AACd,UAAI,iBAAiB,gDAAiD,OAAM;AAC5E,UAAI,iBAAiB,+BAA+B,MAAM,cAAc;AAGtE,gBAAQ,MAAM,MAAM,aAAa;AACjC,gBAAQ,MAAM,UAAU,KAAK,EAAE,MAAM,CAAC,eAAwB;AAC5D,cAAI,sBAAsB;AACxB,kBAAM;AACR,iBAAO;AAAA,QACT,CAAC;AAAA,MACH,OAAO;AACL,gBAAQ;AAAA,MACV;AAAA,IACF;AACA,QAAI,CAAC,SAAS,MAAM,WAAW,WAAW,MAAM,WAAW;AACzD,YAAM,IAAI,+BAA+B;AAC3C,UAAM,UAAU,CAAC,MAAM,UAAU,MAAM,MAAM,EAAE;AAAA,MAAQ,CAAC,WACtD,SACI;AAAA,QACE;AAAA,UACE,MAAM,OAAO;AAAA,UACb,OAAO,OAAO,UAAU,IAAI,KAAK,OAAO,OAAO,IAAI;AAAA,QACrD;AAAA,MACF,IACA,CAAC;AAAA,IACP;AACA,QAAI,CAAC,QAAQ,QAAQ;AACnB,UAAI,MAAM,gBAAgB,MAAM,WAAW;AACzC,cAAM,IAAI,iCAAiC,IAAI;AACjD,YAAM,IAAI,+BAA+B;AAAA,IAC3C;AACA,UAAM,OAAoB,EAAE,SAAS,WAAW,IAAI,KAAK,IAAI,CAAC,EAAE;AAGhE,QAAI,wBAAwB,eAAgB,YAAW;AAEvD,QAAI,MAAM,YAAY,MAAM,UAAU,wBAAwB;AAC5D,YAAM,UAAU;AAAA,QACd,oBAAoB,MAAM,SAAS;AAAA,QACnC,gBAAgB,MAAM,SAAS,UAAU,IAAI,KAAK,MAAM,SAAS,OAAO,IAAI;AAAA,QAC5E,sBAAsB,MAAM,OAAO;AAAA,QACnC,kBAAkB,MAAM,OAAO,UAAU,IAAI,KAAK,MAAM,OAAO,OAAO,IAAI;AAAA,QAC1E,WAAW,KAAK;AAAA,MAClB,CAAC;AACH,QAAI,SAAU,OAAM,UAAU,IAAI,CAAC;AACnC,QAAI,CAAC,MAAM,MAAM,IAAI,CAAC,EAAG,OAAM,IAAI,+BAA+B;AAIlE,eAAW,SAAS,MAAM,oBAAoB,CAAC,GAAG;AAChD,UAAI,MAAM,uBAAwB,OAAM,IAAI,iCAAiC,IAAI;AACjF,YAAM,iBAAiB,CAAC,MAAM,UAAU,MAAM,MAAM,EAAE;AAAA,QAAQ,CAAC,WAC7D,SACI;AAAA,UACE;AAAA,YACE,MAAM,OAAO;AAAA,YACb,OAAO,OAAO,UAAU,IAAI,KAAK,OAAO,OAAO,IAAI;AAAA,UACrD;AAAA,QACF,IACA,CAAC;AAAA,MACP;AACA,UACE,eAAe,UACf,CAAC,MAAM,EAAE,SAAS,gBAAgB,WAAW,KAAK,UAAU,GAAG,IAAI,CAAC,GACpE;AACA,cAAM,IAAI,+BAA+B;AAAA,MAC3C;AAAA,IACF;AACA,QAAI,MAAM,gBAAgB,MAAM,WAAW;AACzC,YAAM,IAAI,iCAAiC,IAAI;AAAA,EACnD;AACA,SAAO;AAAA,IACL,UAAU,CAAC,SAA6B;AACtC,cAAQ;AAAA,IACV;AAAA,IACA;AAAA,IACA,mCAAmC,YAAY;AAC7C,UAAI,MAAM,kBAAmB;AAC7B,YAAM,UAAU;AAChB,UAAI,mBAAmB,kCAAkC;AACvD,cAAM,UAAU,MAAM,MAAM,kBAAkB;AAG9C,YAAI,oBAAoB,SAAS;AAC/B,cAAI,gBAAiB,OAAM;AAC3B,cAAI,SAAU,OAAM,UAAU,IAAI,CAAC;AACnC;AAAA,QACF;AACA,YAAI,QAAS;AAAA,MACf;AACA,UAAI,gBAAiB,OAAM;AAC3B,UAAI,SAAU,OAAM,UAAU,IAAI,CAAC;AAAA,IACrC;AAAA,IACA,mBAAmB,MAAM;AAGvB,YAAM,YAAY,cAAc,KAAK,YAAY;AAC/C,YAAI;AACF,gBAAM,kBAAkB;AAGxB,4BAAkB;AAAA,QACpB,SAAS,OAAO;AACd,cACE,iBAAiB,oCACjB,iBAAiB;AAEjB,8BAAkB;AACpB,cACE,iBAAiB,oCAChB,MAAM,MAAM,kBAAkB,KAC/B,oBAAoB,OACpB;AACA;AAAA,UACF;AACA,gBAAM;AAAA,QACR;AAAA,MACF,CAAC;AACD,sBAAgB,UAAU,MAAM,MAAM,MAAS;AAC/C,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,IAAM,8BAAN,cAA0C,MAAM;AAAC;AAGjD,eAAsB,6BACpB,eACA,aACe;AACf,QAAM,cAAc;AACpB,QAAM,YAAY;AACpB;;;ACtPA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,wBAAwB;AAUjC,SAAS,cAAAC,mBAAkB;AA+BpB,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAGrD,YAAqB,QAAiB;AACpC,UAAM,qDAAqD;AAAA,MACzD,GAAI,kBAAkB,QAAQ,EAAE,OAAO,OAAO,IAAI,CAAC;AAAA,IACrD,CAAC;AAHkB;AAAA,EAIrB;AAAA,EANS,OAAO;AAOlB;AAEO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EAGtD,YACW,gBACA,YACT;AACA;AAAA,MACE,WAAW,cAAc,0DAA0D,UAAU;AAAA,IAC/F;AALS;AACA;AAAA,EAKX;AAAA,EATS,OAAO;AAUlB;AAUO,SAAS,iCAAiC,OAAyC;AACxF,MAAI,iBAAiB,iBAAkB,QAAO;AAC9C,MAAI,EAAE,iBAAiB,6BAA8B,QAAO;AAC5D,SAAO,MAAM,kBAAkB,mBAC3B,MAAM,SACN,IAAI,iBAAiB,oCAAoC,CAAC,GAAG,KAAK;AACxE;AAEO,SAAS,8BAA8B,QAAuC;AACnF,MAAI,QAAQ,SAAS;AACnB,UAAM,IAAI,4BAA4B,OAAO,MAAM;AAAA,EACrD;AACF;AAEA,eAAsB,qBACpB,WACA,QACA,mBACY;AACZ,MAAI,CAAC,OAAQ,QAAO,MAAM;AAE1B,MAAI;AACJ,QAAM,YAAY,IAAI,QAAe,CAAC,UAAU,WAAW;AACzD,yBAAqB;AAAA,EACvB,CAAC;AACD,QAAM,SAAS,MAAY;AACzB,yBAAqB,IAAI,4BAA4B,OAAO,MAAM,CAAC;AAAA,EACrE;AACA,SAAO,iBAAiB,SAAS,QAAQ,EAAE,MAAM,KAAK,CAAC;AACvD,MAAI,OAAO,QAAS,QAAO;AAE3B,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,KAAK,CAAC,WAAW,SAAS,CAAC;AAIxD,QAAI,OAAO,SAAS;AAClB,YAAM,IAAI,4BAA4B,OAAO,MAAM;AAAA,IACrD;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,OAAO,SAAS;AAIlB,WAAK,UACF,KAAK,OAAO,WAAW,MAAM,oBAAoB,MAAM,CAAC,EACxD,MAAM,MAAM,MAAS;AAKxB,UAAI,EAAE,iBAAiB,8BAA8B;AACnD,cAAM,IAAI,4BAA4B,OAAO,MAAM;AAAA,MACrD;AAAA,IACF;AACA,UAAM;AAAA,EACR,UAAE;AACA,WAAO,oBAAoB,SAAS,MAAM;AAAA,EAC5C;AACF;AAOO,IAAM,2CAA2C;AAIjD,SAAS,2BACd,UACA,WACY;AACZ,WAAS,IAAI,SAAS;AACtB,QAAM,SAAS,MAAY;AACzB,aAAS,OAAO,SAAS;AAAA,EAC3B;AACA,YAAU,KAAK,QAAQ,MAAM;AAC7B,SAAO;AACT;AAcA,eAAsB,4BACpB,UACA,YAAoB,0CACuB;AAC3C,MAAI,SAAS,SAAS,EAAG,QAAO;AAChC,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK;AAAA,MACxB,QAAQ,WAAW,CAAC,GAAG,QAAQ,CAAC,EAAE,KAAK,MAAM,SAAkB;AAAA,MAC/D,IAAI,QAAqB,CAAC,YAAY;AACpC,gBAAQ,WAAW,MAAM,QAAQ,WAAW,GAAG,KAAK,IAAI,GAAG,SAAS,CAAC;AAAA,MACvE,CAAC;AAAA,IACH,CAAC;AAAA,EACH,UAAE;AACA,QAAI,MAAO,cAAa,KAAK;AAAA,EAC/B;AACF;AAEO,SAAS,MAAM,IAA2B;AAC/C,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AACzD;AAEO,SAAS,2BAA2B,OAA2B;AACpE,QAAM,QAAmB,CAAC;AAC1B,QAAM,OAAO,oBAAI,IAAY;AAC7B,MAAI,UAAU;AACd,WAAS,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG;AACzC,UAAM,KAAK,OAAO;AAClB,QAAI,CAAC,WAAW,OAAO,YAAY,YAAY,KAAK,IAAI,OAAO,EAAG;AAClE,SAAK,IAAI,OAAO;AAChB,QAAI,mBAAmB,4BAA4B;AACjD,gBAAU,QAAQ;AAClB;AAAA,IACF;AACA,UAAM,QAAQ,QAAQ,IAAI,SAAS,OAAO;AAC1C,QAAI,UAAU,UAAa,UAAU,QAAS;AAC9C,cAAU;AAAA,EACZ;AACA,SAAO;AACT;AAEO,SAAS,oBACd,OACA,aACU;AACV,SAAO,MAAM,KAAK,CAAC,UAAsB,iBAAiB,WAAW,KAAK;AAC5E;AAOO,SAAS,uCACd,SACA,OACgC;AAChC,QAAM,QAAQ,2BAA2B,KAAK;AAC9C,QAAM,eACJ,MAAM,IAAI,CAAC,UAAU,6BAA6B,KAAK,CAAC,EAAE,KAAK,CAAC,UAAU,UAAU,IAAI,KACxF;AACF,QAAM,UACJ,MAAM;AAAA,IACJ,CAAC,UAA+C,iBAAiB;AAAA,EACnE,KAAK;AACP,MAAI,SAAS;AACX,UAAM,gBAAgB,QAAQ,UAAU;AACxC,WAAO;AAAA,MACL,UAAU,gBAAgB,mBAAmB;AAAA,MAC7C,OAAO,gBAAgB,mBAAmB;AAAA,MAC1C,MAAM,QAAQ;AAAA,MACd,UAAU;AAAA,MACV,WAAW;AAAA,IACb;AAAA,EACF;AACA,QAAM,YAAY,oBAAoB,OAAO,yBAAyB;AACtE,MAAI,WAAW;AACb,WAAO;AAAA,MACL,UAAU;AAAA,MACV,OAAO;AAAA,MACP,MAAM,UAAU;AAAA,MAChB,UAAU;AAAA,MACV,WAAW;AAAA,IACb;AAAA,EACF;AACA,QAAM,aAAa,oBAAoB,OAAO,2BAA2B;AACzE,MAAI,YAAY;AACd,WAAO;AAAA,MACL,UAAU;AAAA,MACV,OAAO;AAAA,MACP,MAAM;AAAA,MACN,UAAU;AAAA,MACV,WAAW;AAAA,IACb;AAAA,EACF;AACA,QAAM,aAAa,oBAAoB,OAAO,2BAA2B;AACzE,MAAI,YAAY;AACd,WAAO;AAAA,MACL,UAAU;AAAA,MACV,OAAO;AAAA,MACP,MAAM,WAAW;AAAA,MACjB,UAAU;AAAA,MACV,WAAW;AAAA,IACb;AAAA,EACF;AACA,QAAM,mBAAmB,oBAAoB,OAAO,4BAA4B;AAChF,MAAI,kBAAkB;AACpB,WAAO;AAAA,MACL,UAAU;AAAA,MACV,OAAO;AAAA,MACP,MAAM;AAAA,MACN,UAAU;AAAA,MACV,WAAW;AAAA,IACb;AAAA,EACF;AACA,QAAM,kBAAkB,oBAAoB,OAAO,gCAAgC;AACnF,MAAI,iBAAiB;AACnB,WAAO;AAAA,MACL,UAAU;AAAA,MACV,OAAO;AAAA,MACP,MAAM,gBAAgB;AAAA,MACtB,UAAU;AAAA,MACV,WAAW;AAAA,IACb;AAAA,EACF;AACA,QAAM,UAAU,oBAAoB,OAAO,8BAA8B;AACzE,MAAI,SAAS;AACX,WAAO;AAAA,MACL,UAAU;AAAA,MACV,OAAO;AAAA,MACP,MAAM,QAAQ;AAAA,MACd,UAAU;AAAA,MACV,WAAW,QAAQ;AAAA,IACrB;AAAA,EACF;AACA,QAAM,aAAa,oBAAoB,OAAO,yCAAyC;AACvF,MAAI,YAAY;AACd,WAAO;AAAA,MACL,UAAU;AAAA,MACV,OAAO;AAAA,MACP,MAAM;AAAA,MACN,UAAU;AAAA,MACV,WAAW,WAAW;AAAA,IACxB;AAAA,EACF;AACA,QAAM,gBAAgB,MAAM;AAAA,IAC1B,CAAC,UACC,iBAAiB,sBACjB,iBAAiB,mCACjB,iBAAiB,6BACjB,iBAAiB;AAAA,EACrB;AACA,MAAI,eAAe;AACjB,WAAO;AAAA,MACL,UAAU;AAAA,MACV,OAAO,gBAAgB;AAAA,MACvB,MACE,yBAAyB,4BACrB,mBACA,yBAAyB,0BACvB,iBACA,yBAAyB,kCACvB,yBACA;AAAA,MACV,UAAU;AAAA,MACV,WAAW;AAAA,IACb;AAAA,EACF;AACA,QAAM,gBAAgB,MAAM;AAAA,IAC1B,CAAC,UACC,iBAAiB,sCACjB,iBAAiB,sCACjB,iBAAiB,yCACjB,iBAAiB,mCACjB,iBAAiB;AAAA,EACrB;AACA,MAAI,eAAe;AACjB,WAAO;AAAA,MACL,UAAU;AAAA,MACV,OAAO;AAAA,MACP,MACE,yBAAyB,qCACrB,6BACA,yBAAyB,qCACvB,6BACA,yBAAyB,wCACvB,gCACA,yBAAyB,kCACvB,0BACA;AAAA,MACZ,UAAU;AAAA,MACV,WAAW;AAAA,IACb;AAAA,EACF;AACA,QAAM,kBAAkB,+BAA+B,SAAS,KAAK;AACrE,MAAI,gBAAgB,SAAS,uBAAuB;AAClD,WAAO;AAAA,MACL,UAAU;AAAA,MACV,OAAO,gBAAgB;AAAA,MACvB,MAAM,gBAAgB;AAAA,MACtB,UAAU;AAAA;AAAA;AAAA,MAGV,WAAW;AAAA,IACb;AAAA,EACF;AACA,MAAI,cAAc;AAChB,WAAO;AAAA,MACL,UAAU;AAAA,MACV,OAAO;AAAA,MACP,MAAM,GAAG,YAAY;AAAA,MACrB,UAAU;AAAA,MACV,WAAW;AAAA,IACb;AAAA,EACF;AACA,SAAO;AAAA,IACL,UAAU;AAAA,IACV,OAAO;AAAA,IACP,MAAM;AAAA,IACN,UAAU;AAAA,IACV,WAAW;AAAA,EACb;AACF;AAEO,SAAS,gCAAgC,OAAyB;AACvE,QAAM,QAAQ,2BAA2B,KAAK;AAG9C,MACE,MAAM;AAAA,IACJ,CAAC,UACC,iBAAiB,+BAA+B,MAAM,WAAW;AAAA,EACrE;AAEA,WAAO;AACT,MACE,MAAM;AAAA,IACJ,CAAC,UACC,iBAAiB,6BACjB,iBAAiB,2BACjB,iBAAiB;AAAA,EACrB,GACA;AACA,WAAO;AAAA,EACT;AACA,QAAM,UAAU,oBAAoB,OAAO,8BAA8B;AACzE,MAAI,SAAS;AACX,WAAO,QAAQ;AAAA,EACjB;AACA,MACE,MAAM;AAAA,IACJ,CAAC,UACC,iBAAiB,+BACjB,iBAAiB;AAAA,EACrB,GACA;AACA,WAAO;AAAA,EACT;AACA,MAAI,MAAM,KAAK,CAAC,UAAU,iBAAiB,0BAA0B,GAAG;AACtE,WAAO;AAAA,EACT;AAIA,SAAO;AACT;AAKO,SAAS,uCACd,UACQ;AAGR,SAAO,KAAK,IAAI,KAAO,SAAS,0BAA0B;AAC5D;AAEO,SAAS,6BACd,WACA,UAgBI,CAAC,GACsB;AAC3B,QAAM,aAAa,QAAQ,cAAc;AACzC,QAAM,YAAY,QAAQ,aAAa;AACvC,MAAI,OAA0B;AAE9B,QAAM,MAAM,OACV,aACA,cACqD;AACrD,QAAI,mBAAmB;AACvB,WAAO,MAAM;AACX,0BAAoB;AACpB,gBAAU,gBAAgB;AAC1B,YAAM,YAAY,YAAY,IAAI;AAClC,UAAI;AACF,sCAA8B,QAAQ,MAAM;AAC5C,cAAM,YAAY,UAAU;AAC5B,cAAM,SAAS,MAAM,qBAAqB,WAAW,QAAQ,QAAQ,QAAQ,aAAa;AAC1F,cAAM,QAAQ,mBAAmB;AAAA,UAC/B;AAAA,UACA,SAAS;AAAA,UACT,SAAS;AAAA,UACT,YAAY,YAAY,IAAI,IAAI;AAAA,UAChC;AAAA,QACF,CAAC;AACD,eAAO,EAAE,QAAQ,iBAAiB;AAAA,MACpC,SAAS,OAAO;AACd,cAAM,WAAW,EACf,iBAAiB,+BACjB,mBAAmB,cACnB,CAAC,gCAAgC,KAAK;AAExC,cAAM,QAAQ,mBAAmB;AAAA,UAC/B;AAAA,UACA,SAAS;AAAA,UACT,SAAS,WAAW,aAAa;AAAA,UACjC,YAAY,YAAY,IAAI,IAAI;AAAA,UAChC;AAAA,QACF,CAAC;AACD,YAAI,CAAC,UAAU;AACb,gBAAM;AAAA,QACR;AACA,cAAM,MAAM,YAAY,gBAAgB;AAAA,MAC1C;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAkB;AAChB,UAAI,CAAC,MAAM;AACT,cAAM,cAAc,QAAQ,qBAAqB,KAAKA,YAAW;AACjE,gBAAQ,YAAY;AAClB,gBAAM,YAAY,YAAY,IAAI;AAClC,wCAA8B,QAAQ,MAAM;AAC5C,gBAAM,QAAQ,YAAY,EAAE,YAAY,CAAC;AACzC,wCAA8B,QAAQ,MAAM;AAC5C,cAAI;AACJ,cAAI,mBAAmB;AACvB,cAAI,YAAY;AAChB,cAAI;AACF,kBAAM,YAAY,MAAM,IAAI,aAAa,CAAC,YAAY;AACpD,iCAAmB;AAAA,YACrB,CAAC;AACD,qBAAS,UAAU;AACnB,+BAAmB,UAAU;AAC7B,wBAAY;AACZ,0CAA8B,QAAQ,MAAM;AAC5C,kBAAM,QAAQ,kBAAkB,QAAQ;AAAA,cACtC;AAAA,cACA;AAAA,cACA,YAAY,YAAY,IAAI,IAAI;AAAA,YAClC,CAAC;AACD,0CAA8B,QAAQ,MAAM;AAC5C,kBAAM,QAAQ,cAAc,QAAQ;AAAA,cAClC;AAAA,cACA;AAAA,cACA,YAAY,YAAY,IAAI,IAAI;AAAA,YAClC,CAAC;AACD,mBAAO;AAAA,UACT,SAAS,OAAO;AACd,gBAAI,WAAW;AACb,oBAAM,QAAQ,gBAAgB,MAAW;AAAA,YAC3C;AACA,gBAAI,EAAE,iBAAiB,8BAA8B;AACnD,oBAAM,QAAQ,WAAW,OAAO;AAAA,gBAC9B;AAAA,gBACA,kBAAkB,KAAK,IAAI,GAAG,gBAAgB;AAAA,gBAC9C,YAAY,YAAY,IAAI,IAAI;AAAA,cAClC,CAAC;AAAA,YACH;AACA,kBAAM;AAAA,UACR;AAAA,QACF,GAAG,EAAE,MAAM,CAAC,UAAU;AAOpB,cAAI,gCAAgC,KAAK,GAAG;AAC1C,mBAAO;AAAA,UACT;AACA,gBAAM;AAAA,QACR,CAAC;AAAA,MACH;AACA,aAAO;AAAA,IACT;AAAA,IACA,aAAsB;AACpB,aAAO,SAAS;AAAA,IAClB;AAAA,IACA,MAAM,eAAe,WAAsC;AACzD,UAAI,CAAC,MAAM;AACT,eAAO;AAAA,MACT;AACA,UAAI;AACJ,UAAI;AACF,eAAO,MAAM,QAAQ,KAAK;AAAA,UACxB,KAAK,MAAM,MAAM,IAAI;AAAA,UACrB,IAAI,QAAc,CAAC,YAAY;AAC7B,oBAAQ,WAAW,MAAM,QAAQ,IAAI,GAAG,SAAS;AAAA,UACnD,CAAC;AAAA,QACH,CAAC;AAAA,MACH,UAAE;AACA,YAAI,OAAO;AACT,uBAAa,KAAK;AAAA,QACpB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ACxlBO,SAAS,qCAAqC,OAIzC;AACV,SACE,MAAM,mBAAmB,eACzB,CAAC,MAAM,yBACP,MAAM,8BAA8B;AAExC;AAQO,SAAS,qCAAqC,OAKzC;AACV,SACE,MAAM,+BACN,CAAC,MAAM,oBACP,CAAC,MAAM,4BACP,CAAC,MAAM;AAEX;AASO,SAAS,4CAA4C,OAInD;AACP,MAAI,CAAC,MAAM,yBAAyB,MAAM,gCAAiC;AAC3E,MAAI,MAAM,mBAAmB,MAAO,OAAM,MAAM;AAChD,QAAM,IAAI,MAAM,2DAA2D;AAAA,IACzE,OAAO,MAAM;AAAA,EACf,CAAC;AACH;AAMO,SAAS,8CAA8C,OAKrD;AACP,MACE,CAAC,MAAM,yBACP,CAAC,MAAM,mCACP,MAAM,uBACN;AACA;AAAA,EACF;AACA,MAAI,MAAM,mBAAmB,MAAO,OAAM,MAAM;AAChD,QAAM,IAAI,MAAM,gEAAgE;AAAA,IAC9E,OAAO,MAAM;AAAA,EACf,CAAC;AACH;AAEO,IAAM,2CAA2C;AACjD,IAAM,uCAAuC;AAC7C,IAAM,8BAA8B,IAAI;AACxC,IAAM,iCAAiC;AAKvC,SAAS,0BAA0B,OAK3B;AACb,MAAI,CAAC,MAAM,QAAS,QAAO,MAAM;AACjC,MAAI,QAAQ;AACZ,QAAM,QAAQ,WAAW,MAAM;AAC7B,QAAI,CAAC,MAAO;AACZ,UAAM,YAAY;AAClB,UAAM,gBAAgB;AAAA,EACxB,GAAG,MAAM,aAAa,2BAA2B;AACjD,QAAM,QAAQ;AACd,SAAO,MAAM;AACX,QAAI,CAAC,MAAO;AACZ,YAAQ;AACR,iBAAa,KAAK;AAAA,EACpB;AACF;AAKA,eAAsB,wCAAwC,OAc5B;AAChC,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,MAAM,eAAe;AAAA,EACvC,SAAS,cAAc;AACrB,UAAM,mBAAmB,YAAY;AACrC,QAAI,CAAC,MAAM,aAAa;AACtB,YAAM,IAAI,MAAM,4DAA4D;AAAA,QAC1E,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,UAAM,QAAQ,MAAM,SAAS;AAC7B,QAAI,UAAU;AACd,QAAI,UAAU;AACd,eAAS;AACP,UAAI;AACF,cAAM,MAAM,YAAY,MAAM,KAAK;AACnC,eAAO;AAAA,MACT,SAAS,aAAa;AACpB,cAAM,kBAAkB,aAAa,SAAS,OAAO;AACrD,YAAI;AACF,gBAAM,YAAY,SAAS,OAAO;AAAA,QACpC,QAAQ;AAAA,QAGR;AACA,cAAM,MAAM,OAAO;AACnB,kBAAU,KAAK,IAAI,UAAU,GAAG,oCAAoC;AACpE,mBAAW;AAAA,MACb;AAAA,IACF;AAAA,EACF;AAEA,MAAI,QAAQ,gBAAgB,MAAM,qBAAqB;AACrD,QAAI;AACF,YAAM,MAAM,oBAAoB,QAAQ,YAAY;AAAA,IACtD,SAAS,WAAW;AAGlB,YAAM,gBAAgB,SAAS;AAAA,IACjC;AAAA,EACF;AACA,MAAI;AACF,UAAM,MAAM,cAAc,QAAQ,MAAM;AAAA,EAC1C,SAAS,cAAc;AAGrB,UAAM,mBAAmB,YAAY;AAAA,EACvC;AACA,SAAO;AACT;AASA,eAAsB,gCAAgC,OAOpC;AAChB,QAAM,UAAU,cAAc;AAC9B,MAAI,MAAM,uBAAuB;AAC/B,UAAM,sBAAsB;AAAA,MAC1B,MAAM,sBAAsB,IAAI,MAAM,qBAAqB;AAAA,IAC7D;AACA,UAAM,MAAM,sBAAsB,kBAAkB;AAAA,EACtD;AACA,QAAM,UAAU,qBAAqB;AACrC,QAAM,QAAQ,IAAI,MAAM,sBAAsB,IAAI,OAAO,YAAY,MAAM,QAAQ,KAAK,CAAC,CAAC;AAC1F,QAAM,MAAM,sBAAsB,KAAK;AACvC,QAAM,MAAM,sBAAsB,KAAK;AACzC;AAOA,eAAsB,mCACpB,SACA,UAII,CAAC,GACU;AACf,QAAM,cAAc,KAAK,IAAI,GAAG,QAAQ,eAAe,CAAC;AACxD,QAAMC,gBAAe,KAAK,IAAI,GAAG,QAAQ,gBAAgB,EAAE;AAC3D,QAAM,OAAO,QAAQ,QAAQ;AAC7B,MAAI;AACJ,WAAS,UAAU,GAAG,WAAW,aAAa,WAAW,GAAG;AAC1D,QAAI;AACF,YAAM,QAAQ,QAAQ,EAAE,0BAA0B,KAAK,CAAC;AACxD;AAAA,IACF,SAAS,OAAO;AACd,kBAAY;AACZ,UAAI,UAAU,aAAa;AACzB,cAAM,KAAKA,gBAAe,OAAO;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AACA,QAAM;AACR;AAWA,eAAsB,yBACpB,WACA,QACA,YAAY,gCACY;AACxB,MAAI,QAAQ,SAAS;AACnB,SAAK,UAAU,MAAM,MAAM,MAAS;AACpC,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,QAAM,WAAW,IAAI,QAAmB,CAAC,YAAY;AACnD,sBAAkB,MAAM,QAAQ,MAAS;AAAA,EAC3C,CAAC;AACD,QAAM,SAAS,MAAY;AACzB,SAAK,UAAU,MAAM,MAAM,MAAS;AACpC,sBAAkB;AAAA,EACpB;AACA,UAAQ,iBAAiB,SAAS,QAAQ,EAAE,MAAM,KAAK,CAAC;AACxD,QAAM,UAAU,WAAW,QAAQ,KAAK,IAAI,GAAG,SAAS,CAAC;AACzD,UAAQ,QAAQ;AAChB,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK,CAAC,WAAW,QAAQ,CAAC;AAAA,EACjD,UAAE;AACA,iBAAa,OAAO;AACpB,YAAQ,oBAAoB,SAAS,MAAM;AAAA,EAC7C;AACF;AAQA,eAAsB,yBACpB,cACA,mBACA,QACe;AACf,QAAM,yBAAyB,cAAc,MAAM;AACnD,QAAM,yBAAyB,mBAAmB,MAAM;AAC1D;AAEO,IAAM,6BAAN,cAAyC,MAAM;AAAA,EAC3C,OAAO;AAAA,EAEhB,YAAY,UAAU,2DAA2D;AAC/E,UAAM,OAAO;AAAA,EACf;AACF;AAYA,eAAsB,sCAAsC,OAQ1C;AAChB,QAAM;AAAA,IACJ,MAAM;AAAA,IACN,MAAM,OAAO;AAAA,IACb,MAAM;AAAA,EACR;AAEA,MAAI,MAAM,0BAA0B,SAAS;AAC3C,UACE,MAAM,0BAA0B,UAChC,IAAI,2BAA2B,sDAAsD;AAAA,EAEzF;AACA,MAAI,MAAM,OAAO,UAAU,QAAQ,MAAM,OAAO,UAAU,QAAW;AACnE,UAAM,MAAM,OAAO;AAAA,EACrB;AACF;AAGO,SAAS,8BAA8B,WAA0B;AACtE,MAAI,WAAW;AACb,UAAM,IAAI,2BAA2B,sDAAsD;AAAA,EAC7F;AACF;AAMO,SAAS,8BACd,aACA,mBAAmB,OACV;AACT,MAAI,iBAAkB,QAAO;AAC7B,MAAI,gBAAgB,QAAW;AAC7B,UAAM,IAAI,2BAA2B;AAAA,EACvC;AACA,SAAO;AACT;AASA,eAAsB,wCAAwC,OAK5C;AAChB,MAAI;AACF,UAAM,MAAM,wBAAwB;AAAA,EACtC,SAAS,OAAO;AACd,UAAM,sBACJ,iBAAiB,SACjB,MAAM,SAAS,yCACd,MAAqC,SAAS,qBAC9C,MAAM,mBAAmB,UACxB,MAAM,mBAAmB,YACzB,MAAM,mBAAmB;AAC7B,QAAI,CAAC,oBAAqB,OAAM;AAChC,UAAM,sBAAsB;AAC5B,UAAM,MAAM,kBAAkB;AAAA,EAChC;AACF;AAEO,SAAS,gCACd,gBACA,gBACyB;AACzB,MAAI,mBAAmB,eAAe,gBAAgB,QAAS,QAAO;AACtE,QAAM,SAAS,IAAI,gBAAgB;AACnC,SAAO,MAAM,IAAI,MAAM,qBAAqB,CAAC;AAC7C,SAAO,OAAO;AAChB;AAUO,IAAM,mCAAN,cAA+C,MAAM;AAAA,EAI1D,YACW,OACT,OACA;AACA,UAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAHnD;AAIT,SAAK,QAAQ;AAAA,EACf;AAAA,EATS,OAAO;AAAA,EACP;AASX;AAEA,eAAsB,mCACpB,OACA,WACY;AACZ,MAAI;AACF,WAAO,MAAM,UAAU;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,IAAI,iCAAiC,OAAO,KAAK;AAAA,EACzD;AACF;AAOA,eAAsB,6BACpB,UACA,UACA,aACe;AACf,QAAM,aAAa,oBAAI,IAAuB;AAC9C,aAAW,WAAW,UAAU;AAC9B,UAAM,YAAY;AAClB,QAAI,OAAO,WAAW,wBAAwB,YAAY;AACxD,iBAAW,IAAI,SAA8B;AAAA,IAC/C;AAAA,EACF;AACA,MAAI,WAAW,SAAS,KAAK,UAAU;AACrC,eAAW,IAAI,QAAQ;AAAA,EACzB;AACA,aAAW,aAAa,YAAY;AAClC,QAAI;AACF,YAAM,UAAU,oBAAoB,WAAW;AAAA,IACjD,QAAQ;AAAA,IAER;AAAA,EACF;AACF;;;AC7cO,IAAM,kCAAkC;AACxC,IAAM,6CAA6C;AACnD,IAAM,uCAAuC,KAAK;AAElD,SAAS,mCAAmC,MAAe,OAAyB;AACzF,MAAI,UAAU,OAAW,QAAO,SAAS;AACzC,SACE,SAAS,mCACT,OAAO,UAAU,YACjB,OAAO,cAAc,KAAK,KAC1B,QAAQ,KACR,QAAQ;AAEZ;AAEO,SAAS,8BACd,UACoB;AACpB,QAAM,QACJ,OAAO,SAAS,8BAA8B,WAC1C,KAAK,MAAM,SAAS,yBAAyB,IAC7C;AACN,SAAO,OAAO,SAAS,KAAK,IAAI,QAAQ;AAC1C;;;ACxBA,SAAS,2CAA2C;;;ACA7C,IAAM,aAAa,OAAO,IAAI,oBAAoB;AAClD,IAAM,mBAAmB,OAAO,IAAI,0BAA0B;;;ACC9D,IAAM,eAAN,cAA2B,MAAM;EACvC,QAAiB,UAAU,IAAY;EAEvC,YAAY,EAAE,SAAS,MAAM,GAA0C;AACtE,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,QAAQ;EACd;AACD;AAEO,IAAM,oBAAN,MAAM,2BAA0B,MAAM;EAC5C,YACQ,OACA,QACS,OACf;AACD,UAAM,iBAAiB,KAAK;UAAa,MAAM,EAAE;AAJ1C,SAAA,QAAA;AACA,SAAA,SAAA;AACS,SAAA,QAAA;AAGhB,UAAM,kBAAkB,MAAM,kBAAiB;AAG/C,QAAI,MAAQ,MAAa,QAAQ;EAClC;AACD;AAEO,IAAM,2BAAN,cAAuC,aAAa;EAC1D,QAA0B,UAAU,IAAY;EAEhD,cAAc;AACb,UAAM,EAAE,SAAS,WAAW,CAAC;EAC9B;AACD;;;AF5BA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,+BAAAC;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,OAEK;AACP,SAAS,oBAAoB,oBAAAC,yBAAwB;;;AGvD9C,IAAM,4BAA4B;;;ACDzC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,6BAAAC;AAAA,EACA;AAAA,OAGK;AACP,SAAS,cAAAC,mBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;;;ACxBA,SAAS,gCAAgC,SAAiB,MAAgC;AAC/F,SACE,IAAI,OAAO,UAAU,IAAI;AAI7B;;;ADyBO,SAAS,gCACd,MAMA,SAKgC;AAChC,MAAI,QAAQ,YAAY,KAAM,QAAO,iCAAiC,IAAI;AAC1E,QAAM,YAAY,oBAAI,IAA+D;AACrF,QAAM,oBAAoB,oBAAI,IAA2B;AACzD,SAAO,KAAK,QAAQ,CAAC,QAAQ;AAC3B,QAAI,WAA0B;AAC9B,QAAI,IAAI,QAAQ;AACd,UAAI,CAAC,UAAU,IAAI,IAAI,MAAM,GAAG;AAC9B,YAAI;AACF,gBAAM,WAAW,QAAQ,aAAa,IAAI,IAAI,MAAM;AACpD,gBAAM,WAAWC,2BAA0B,QAAQ;AACnD,oBAAU,IAAI,IAAI,QAAQ,wBAAwB,QAAQ,CAAC;AAC3D,4BAAkB;AAAA,YAChB,IAAI;AAAA,YACJ,SAAS,SAAS,UAAU,SAAS,OAAO,aAAa;AAAA,UAC3D;AAAA,QACF,QAAQ;AAGN,oBAAU,IAAI,IAAI,QAAQ,IAAI;AAC9B,4BAAkB,IAAI,IAAI,QAAQ,IAAI;AAAA,QACxC;AAAA,MACF;AACA,iBAAW,kBAAkB,IAAI,IAAI,MAAM,KAAK;AAChD,YAAM,OAAO,UAAU,IAAI,IAAI,MAAM;AACrC,UAAI,MAAM,SAAS,SAAS;AAC1B,mBAAW,YAAY,KAAK,WAAW;AACrC,cAAI,SAAS,mBAAmB,IAAI,SAAU;AAC9C,qBAAW,SAAS,OAAO;AAAA,QAC7B;AAAA,MACF;AAAA,IACF;AACA,QACE,aAAa,QACb,aAAa,QAAQ,qBACrB,0BAA0B,IAAI,IAAI,GAClC;AACA,UAAI,IAAI,KAAK,SAAS,aAAc,QAAO,CAAC;AAC5C,aAAO,CAAC,iCAAiC,IAAI,IAAI,CAAC;AAAA,IACpD;AACA,WAAO,iCAAiC,CAAC,GAAG,CAAC;AAAA,EAC/C,CAAC;AACH;AAGO,SAAS,iCACd,MAIgC;AAChC,QAAM,MAAsC,CAAC;AAC7C,aAAW,OAAO,MAAM;AACtB,QAAI,CAAC,IAAI,+BAA+B;AACtC,UAAI,KAAK,IAAI,IAAI;AACjB;AAAA,IACF;AACA,UAAM,OAAO,OAAO,IAAI,KAAK,SAAS,WAAW,IAAI,KAAK,OAAO;AACjE,QAAI,SAAS,aAAa;AACxB,UAAI,KAAK,iCAAiC,IAAI,IAAI,CAAC;AACnD;AAAA,IACF;AACA,QAAI,SAAS,cAAc;AACzB;AAAA,IACF;AACA,QAAI,KAAK,IAAI,IAAI;AAAA,EACnB;AACA,SAAO;AACT;AAgEA,eAAe,+BACb,SACA,OACA,WACY;AACZ,QAAM,YAAY,YAAY,IAAI;AAClC,MAAI,UAAyD;AAC7D,MAAI;AACF,WAAO,MAAM,UAAU;AAAA,EACzB,SAAS,OAAO;AACd,cAAU;AACV,UAAM;AAAA,EACR,UAAE;AACA,QAAI;AACF,cAAQ,qBAAqB;AAAA,QAC3B;AAAA,QACA;AAAA,QACA,kBAAkB,YAAY,IAAI,IAAI,aAAa;AAAA,MACrD,CAAC;AAAA,IACH,QAAQ;AAAA,IAER;AAAA,EACF;AACF;AAEO,IAAM,oCAAoC,KAAK,OAAO;AAGtD,IAAM,sCAAsC,KAAK,OAAO;AAExD,IAAM,wCAAN,cAAoD,MAAM;AAAA,EAC/D,cAAc;AACZ;AAAA,MACE;AAAA,IAGF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AASO,IAAM,qCAAN,cAAiD,MAAM;AAAA,EACnD;AAAA,EAET,YAAY,SAA4B;AACtC,UAAM,sFAAsF;AAC5F,SAAK,OAAO;AACZ,SAAK,UAAU,CAAC,GAAG,OAAO;AAAA,EAC5B;AACF;AA2BA,IAAM,4BAA4B,oBAAI,IAAI,CAAC,aAAa,cAAc,aAAa,YAAY,CAAC;AAEhG,IAAM,2BAA2B,oBAAI,IAAI;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAKD,IAAM,6BAA6B,oBAAI,IAAI;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,cAAc,OAAwB;AAC7C,MAAI,EAAE,iBAAiB,OAAQ,QAAO,OAAO;AAC7C,QAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,SAAO,iCAAiC,KAAK,IAAI,IAAI,OAAO;AAC9D;AAEA,SAAS,0BACP,aAC6D;AAC7D,QAAM,aAAa,YAAY,YAAY,EAAE,MAAM,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,KAAK;AACzE,MAAI,0BAA0B,IAAI,UAAU,GAAG;AAC7C,WAAO,EAAE,MAAM,SAAS,aAAa,WAAW;AAAA,EAClD;AACA,MACE,yBAAyB,IAAI,UAAU,KACtC,WAAW,WAAW,OAAO,KAAK,CAAC,2BAA2B,IAAI,UAAU,GAC7E;AACA,WAAO,EAAE,MAAM,QAAQ,aAAa,WAAW;AAAA,EACjD;AACA,SAAO;AACT;AAEA,eAAsB,+BACpB,OACA,eACA,UAII,CAAC,GAC8B;AACnC,QAAM,WAID,CAAC;AACN,MAAI,iBAAiB,QAAQ,YACzB,OAAO,oBACP;AACJ,aAAW,QAAQ,OAAO;AACxB,UAAM,aAAa,0BAA0B,KAAK,WAAW;AAC7D,UAAM,WAAW,KAAK,QAAQ,KAAK,EAAE,YAAY,KAAK;AACtD,QACE,KAAK,WAAW,WAChB,CAAC,cACD,WAAW,SAAS,WACpB,KAAK,YAAY,qCACjB,KAAK,YAAY,kBACjB,CAAC,iBAAiB,KAAK,QAAQ,GAC/B;AACA;AAAA,IACF;AACA,aAAS,KAAK,EAAE,MAAM,YAAY,SAAS,CAAC;AAC5C,sBAAkB,KAAK;AAAA,EACzB;AAEA,QAAM,cAAc,IAAI,MAA0C,SAAS,MAAM;AACjF,MAAI,SAAS;AACb,QAAM,SAAS,YAAY;AACzB,WAAO,SAAS,SAAS,QAAQ;AAC/B,YAAM,QAAQ;AACd,YAAM,EAAE,MAAM,YAAY,SAAS,IAAI,SAAS,KAAK;AACrD,UAAI;AACF,cAAM,QAAQ,MAAM,cAAc,IAAI;AACtC,YAAI,MAAM,eAAe,KAAK,WAAW;AACvC,kBAAQ,MAAM,2DAA2D;AAAA,YACvE,QAAQ,KAAK;AAAA,YACb,mBAAmB,KAAK;AAAA,YACxB,iBAAiB,MAAM;AAAA,UACzB,CAAC;AACD,kBAAQ,gBAAgB,KAAK,IAAI,oBAAoB;AACrD;AAAA,QACF;AACA,YAAIC,YAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK,MAAM,UAAU;AACjE,kBAAQ,MAAM,8DAA8D;AAAA,YAC1E,QAAQ,KAAK;AAAA,UACf,CAAC;AACD,kBAAQ,gBAAgB,KAAK,IAAI,oBAAoB;AACrD;AAAA,QACF;AACA,oBAAY,KAAK,IAAI;AAAA,UACnB,MAAM,WAAW;AAAA,UACjB,QAAQ,KAAK;AAAA,UACb,UAAU,KAAK;AAAA,UACf,aAAa,WAAW;AAAA,UACxB,SAAS,QAAQ,WAAW,WAAW,WAAW,OAAO,KAAK,KAAK,EAAE,SAAS,QAAQ,CAAC;AAAA,QACzF;AAAA,MACF,SAAS,OAAO;AAId,gBAAQ,MAAM,yEAAyE;AAAA,UACrF,QAAQ,KAAK;AAAA,UACb,WAAW,cAAc,KAAK;AAAA,QAChC,CAAC;AACD,gBAAQ,gBAAgB,KAAK,IAAI,aAAa;AAAA,MAChD;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAQ;AAAA,IACZ,MAAM,KAAK,EAAE,QAAQ,KAAK,IAAI,GAAG,SAAS,MAAM,EAAE,GAAG,YAAY,MAAM,OAAO,CAAC;AAAA,EACjF;AACA,SAAO,YAAY;AAAA,IACjB,CAAC,eAAqD,eAAe;AAAA,EACvE;AACF;AAEA,SAAS,uBAAuB,MAAkD;AAChF,QAAM,MAAM,KAAK,2BAA2B;AAC5C,MAAI,CAAC,MAAM,QAAQ,GAAG,EAAG,QAAO,CAAC;AACjC,QAAM,OAA0B,CAAC;AACjC,aAAW,aAAa,KAAK;AAC3B,UAAM,SAAS,gBAAgB,UAAU,SAAS;AAClD,QAAI,OAAO,QAAS,MAAK,KAAK,OAAO,IAAI;AAAA,EAC3C;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,KAA8B;AAG3D,SACE,uBAAuB,IAAI,MAAM,oBAAoB,kBAAkB,GAAG,CAAC;AAI/E;AAQA,SAAS,iCAAiC,KAA8B;AACtE,SAAO,gCAAgC,sBAAsB,IAAI,MAAM,IAAI,MAAM;AACnF;AAGA,SAAS,qBAAqB,MAAmD;AAC/E,QAAM,MAAM,KAAK,0CAA0C;AAC3D,SAAO,OAAO,QAAQ,YAAY,OAAO,cAAc,GAAG,KAAK,OAAO,MAAM,OAAO,OAC/E,MACA;AACN;AAIA,IAAM,qBAAqB,oBAAI,IAAsD;AASrF,eAAe,uBACb,YACA,OACiC;AACjC,QAAM,WAAW,EAAE,OAAO,WAAW,SAAS,MAAM,GAAG;AACvD,QAAM,QAAQ,WAAW,QAAQ,QAAQ,GAAG;AAC5C,MAAI,QAAQ,EAAG,QAAO;AACtB,QAAM,OAAO,WAAW,QAAQ,MAAM,QAAQ,CAAC;AAC/C,MAAI,QAAQ,mBAAmB,IAAI,KAAK;AACxC,MAAI,CAAC,OAAO;AACV,YAAQ,sBAAsB,OAAO,KAAK,OAAO,MAAM,EAAE,aAAa,GAAG,CAAC;AAC1E,uBAAmB,IAAI,OAAO,KAAK;AAAA,EACrC;AACA,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,MAAM,WAAW,WAAW;AACtD,QAAI,MAAM,SAAS,QAAQ,MAAM,cAAc,WAAW,YAAa,QAAO;AAC9E,WAAO;AAAA,MACL,OAAO,QAAQ,MAAM,SAAS,WAAW,MAAM,IAAI;AAAA,MACnD,MACE,+BAA+B,MAAM,KAAK,IAAI,MAAM,MAAM,SACvD,MAAM,aAAa,IAAI,MAAM,cAAc;AAAA,IAClD;AAAA,EACF,SAAS,OAAO;AAGd,YAAQ,MAAM,iEAAiE;AAAA,MAC7E,QAAQ,WAAW;AAAA,MACnB,WAAW,cAAc,KAAK;AAAA,IAChC,CAAC;AACD,WAAO;AAAA,EACT;AACF;AASO,SAAS,sCACd,QACA,eACA,qBACiC;AACjC,QAAM,cAAc,oBAAI,IAAoC;AAC5D,QAAM,sBAAsB,oBAAI,IAAY;AAC5C,QAAM,WAAW,oBAAI,IAAuB;AAC5C,QAAM,kBAAkB,oBAAI,IAAY;AACxC,QAAM,oBAAoB,oBAAI,IAAoB;AAClD,QAAM,cAAc,oBAAI,IAAoC;AAE5D,SAAO,OAAO,OAAO,UAAU,CAAC,MAAM;AACpC,eAAW,QAAQ,QAAQ,eAAe,CAAC,GAAG;AAC5C,eAAS,IAAI,KAAK,IAAI,IAAI;AAC1B,sBAAgB,IAAI,KAAK,EAAE;AAAA,IAC7B;AACA,UAAM,cAAc,oBAAI,IAA+B;AACvD,UAAM,iBAA2B,CAAC;AAClC,UAAM,cAAc,oBAAI,IAAY;AACpC,aAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,YAAM,OAAO,uBAAuB,MAAM,KAAK,CAAE;AACjD,UAAI,KAAK,WAAW,EAAG;AACvB,kBAAY,IAAI,OAAO,IAAI;AAC3B,iBAAW,OAAO,MAAM;AACtB,YAAI,MAAM,KAAK,EAAG,+BAA+B,MAAM,QAAQ,YAAY,IAAI,IAAI,MAAM;AACvF;AACF,oBAAY,IAAI,IAAI,MAAM;AAC1B,uBAAe,KAAK,IAAI,MAAM;AAAA,MAChC;AAAA,IACF;AACA,QAAI,YAAY,SAAS,EAAG,QAAO;AACnC,UAAM,aAAa,eAAe,OAAO,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;AACzE,QAAI,uBAAuB,WAAW,SAAS,GAAG;AAChD,YAAM,QAAQ,MAAM,oBAAoB,UAAU;AAClD,iBAAW,QAAQ,MAAO,UAAS,IAAI,KAAK,IAAI,IAAI;AACpD,iBAAW,MAAM,WAAY,iBAAgB,IAAI,EAAE;AAAA,IACrD;AAEA,QAAI,eAAe;AACjB,YAAM,WAAW,IAAI,IAAI,iBAAiB;AAC1C,UAAI,oBAAoB;AACxB,iBAAW,CAAC,OAAO,IAAI,KAAK,aAAa;AACvC,YAAI,MAAM,KAAK,EAAG,+BAA+B,MAAM,KAAM;AAC7D,mBAAW,OAAO,MAAM;AACtB,gBAAM,OAAO,SAAS,IAAI,IAAI,MAAM;AACpC,cACE,CAAC,QACD,CAAC,OAAO,sBACR,KAAK,WAAW,WAChB,KAAK,YAAY,qCACjB,0BAA0B,KAAK,WAAW,GAAG,SAAS,WACtD,CAAC,kBAAkB,KAAK,KAAK,QAAQ,KAAK,KAAK,EAAE;AAEjD;AAEF,+BAAqB,KAAK;AAC1B,mBAAS,IAAI,KAAK,IAAI,KAAK,SAAS;AAAA,QACtC;AAAA,MACF;AACA,YAAM,iBAAiB,CAAC,GAAG,SAAS,OAAO,CAAC,EAAE,OAAO,CAAC,KAAK,UAAU,MAAM,OAAO,CAAC;AACnF,UACE,oBAAoB,uCACpB,iBAAiB,qCACjB;AACA,cAAM,IAAI,sCAAsC;AAAA,MAClD;AACA,iBAAW,CAAC,IAAI,KAAK,KAAK,SAAU,mBAAkB,IAAI,IAAI,KAAK;AAGnE,YAAM,WAAW,CAAC,GAAG,cAAc,EAChC,QAAQ,EACR,IAAI,CAAC,OAAO,SAAS,IAAI,EAAE,CAAC,EAC5B,OAAO,CAAC,SAA4B;AACnC,YAAI,CAAC,QAAQ,oBAAoB,IAAI,KAAK,EAAE,EAAG,QAAO;AACtD,cAAM,aAAa,0BAA0B,KAAK,WAAW;AAC7D,eAAO,QAAQ,cAAc,WAAW,SAAS,WAAW,OAAO,kBAAkB;AAAA,MACvF,CAAC;AACH,iBAAW,QAAQ,SAAU,qBAAoB,IAAI,KAAK,EAAE;AAC5D,YAAM,eAAe,oBAAI,IAAwC;AACjE,YAAM,UAAU,MAAM,+BAA+B,UAAU,eAAe;AAAA,QAC5E,WAAW;AAAA,QACX,eAAe,CAAC,QAAQ,YAAY,aAAa,IAAI,QAAQ,OAAO;AAAA,MACtE,CAAC;AACD,YAAM,YAAY,IAAI,IAAI,QAAQ,IAAI,CAAC,UAAU,MAAM,MAAM,CAAC;AAC9D,YAAM,UAAU,SAAS;AAAA,QACvB,CAAC,SACC,KAAK,WAAW,WAChB,KAAK,aAAa,qCAClB,kBAAkB,KAAK,KAAK,UAAU,EAAE,KACxC,CAAC,UAAU,IAAI,KAAK,EAAE;AAAA,MAC1B;AACA,UAAI,QAAQ,SAAS,GAAG;AAEtB,mBAAW,aAAa,SAAU,qBAAoB,OAAO,UAAU,EAAE;AACzE,cAAM,UAAU,QAAQ,KAAK,CAAC,SAAS,aAAa,IAAI,KAAK,EAAE,MAAM,oBAAoB;AACzF,YAAI,SAAS;AACX,gBAAM,IAAI,MAAM,qDAAqD,QAAQ,EAAE,EAAE;AAAA,QACnF;AACA,cAAM,IAAI,mCAAmC,QAAQ,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC;AAAA,MAC7E;AACA,iBAAW,cAAc,QAAS,aAAY,IAAI,WAAW,QAAQ,UAAU;AAAA,IACjF;AAEA,eAAW,CAAC,OAAO,IAAI,KAAK,aAAa;AACvC,YAAM,OAAO,MAAM,KAAK;AACxB,UAAI,KAAK,+BAA+B,MAAM,KAAM;AACpD,YAAM,QAAQ,qBAAqB,IAAI;AACvC,UAAI,UAAU,OAAW;AACzB,iBAAW,OAAO,MAAM;AACtB,cAAM,aAAa,SAAS,IAAI,IAAI,MAAM,IAAI,YAAY,IAAI,IAAI,MAAM,IAAI;AAC5E,cAAM,MAAM,GAAG,KAAK,IAAI,IAAI,MAAM;AAClC,YAAI,CAAC,cAAc,WAAW,SAAS,WAAW,YAAY,IAAI,GAAG,EAAG;AACxE,oBAAY,IAAI,KAAK,MAAM,uBAAuB,YAAY,KAAK,CAAC;AAAA,MACtE;AAAA,IACF;AAEA,UAAM,YAAY,CAAC,GAAG,KAAK;AAC3B,eAAW,CAAC,OAAO,IAAI,KAAK,aAAa;AACvC,YAAM,WAAW,MAAM,KAAK;AAC5B,UAAI,SAAS,uCAAuC,MAAM,MAAM;AAE9D,cAAMC,SAAiC,EAAE,GAAG,SAAS;AACrD,eAAOA,OAAM,2BAA2B;AACxC,kBAAU,KAAK,IAAIA;AACnB;AAAA,MACF;AACA,YAAM,kBAAkB,MAAM,QAAQ,SAAS,OAAO,IAClD,CAAC,GAAG,SAAS,OAAO,IACpB,CAAC,EAAE,MAAM,cAAc,MAAM,OAAO,SAAS,WAAW,EAAE,EAAE,CAAC;AACjE,YAAM,kBAAkB,KAAK,QAAQ,CAAC,QAAQ;AAC5C,cAAM,UAAU,SAAS,+BAA+B,MAAM;AAC9D,cAAM,cAAc,UAAU,SAAY,SAAS,IAAI,IAAI,MAAM;AAIjE,cAAM,WACJ,CAAC,WACD,wBAAwB,UACxB,gBAAgB,IAAI,IAAI,MAAM,KAC9B,gBAAgB;AAClB,cAAM,aAAa,cAAc,YAAY,IAAI,IAAI,MAAM,IAAI;AAC/D,YAAI,CAAC,cAAc,WAAW,SAAS,SAAS;AAC9C,iBAAO;AAAA,YACL;AAAA,cACE,MAAM;AAAA,cACN,MAAM,WAAW,iCAAiC,GAAG,IAAI,sBAAsB,GAAG;AAAA,YACpF;AAAA,UACF;AAAA,QACF;AACA,cAAM,QAAQ,qBAAqB,QAAQ;AAC3C,cAAM,UAAU,UAAU,SAAY,SAAY,YAAY,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,EAAE;AAC1F,eAAO;AAAA,UACL,EAAE,MAAM,cAAc,MAAM,sBAAsB,GAAG,KAAK,SAAS,QAAQ,IAAI;AAAA,UAC/E,EAAE,MAAM,eAAe,OAAO,SAAS,SAAS,WAAW,QAAQ;AAAA,QACrE;AAAA,MACF,CAAC;AACD,YAAM,QAAiC;AAAA,QACrC,GAAG;AAAA,QACH,SAAS,CAAC,GAAG,iBAAiB,GAAG,eAAe;AAAA,MAClD;AACA,aAAO,MAAM,2BAA2B;AACxC,gBAAU,KAAK,IAAI;AAAA,IACrB;AACA,WAAO;AAAA,EACT;AACF;AAGO,SAAS,8BACd,cACA,MACgC;AAChC,MAAI,KAAK,WAAW,EAAG,QAAO;AAI9B,QAAM,cAAc,IAAI;AAAA,IACtB,aAAa,QAAQ,CAAC,SAAS,uBAAuB,IAAI,EAAE,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC;AAAA,EACtF;AACA,QAAM,UAAU,KAAK,OAAO,CAAC,QAAQ,CAAC,YAAY,IAAI,IAAI,MAAM,CAAC;AACjE,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,WAAS,QAAQ,aAAa,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG;AAChE,UAAM,OAAO,aAAa,KAAK;AAC/B,QAAI,KAAK,+BAA+B,MAAM,KAAM;AACpD,QAAI,KAAK,SAAS,aAAa,KAAK,SAAS,OAAQ;AACrD,UAAM,WAAW,uBAAuB,IAAI;AAC5C,UAAM,cAAc,IAAI,IAAI,SAAS,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC;AAC7D,UAAM,YAAY,QAAQ,OAAO,CAAC,QAAQ,CAAC,YAAY,IAAI,IAAI,MAAM,CAAC;AACtE,QAAI,UAAU,WAAW,EAAG,QAAO;AACnC,UAAM,YAAY,CAAC,GAAG,YAAY;AAClC,cAAU,KAAK,IAAI,EAAE,GAAG,MAAM,CAAC,2BAA2B,GAAG,CAAC,GAAG,UAAU,GAAG,SAAS,EAAE;AACzF,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,eAAsB,UACpB,IACA,SACA,OACA,SACA,SAC4B;AAC5B,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,uBAAuB;AAAA,EACzC;AACA,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA,YACE,MAAM;AAAA,MACJ;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,EACJ;AAKA,MAAI,QAAQ,KAAK,CAAC,WAAW,CAAC,OAAO,sBAAsB,GAAG;AAC5D,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AACA,QAAM,kBAAkB;AAAA,IACtB,QAAQ,aACJ;AAAA,MACE;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI,IACX;AAAA,IACJ,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AACA,MAAI,QAAQ,SAAS,gBAAgB;AACnC,UAAM,UAAU,QAAQ;AAKxB,UAAM,iBAAiB,MAAM,QAAQ,QAAQ,WAAW,KAAK,QAAQ,YAAY,SAAS;AAC1F,QAAI,OAAO,QAAQ,SAAS,YAAa,QAAQ,KAAK,KAAK,EAAE,WAAW,KAAK,CAAC,gBAAiB;AAC7F,YAAM,IAAI,MAAM,sDAAsD;AAAA,IACxE;AACA,UAAM,YAAY,MAAM,QAAQ,QAAQ,SAAS,IAAK,QAAQ,YAA8B,CAAC;AAC7F,UAAM,kBAAkB,MAAM;AAAA,MAC5B;AAAA,MACA;AAAA,MACA,YACE,MAAM;AAAA,QACJ;AAAA,QACA,QAAQ,cAAc;AAAA,QACtB,QAAQ;AAAA,QACR,QAAQ,cAAc;AAAA,QACtB;AAAA,MACF;AAAA,IACJ;AACA,UAAM,oBAAoB,8BAA8B,eAAe;AACvE,WAAO,MAAM;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,oBAAoB,iBAAiB,iBAAiB;AAAA,MACtD;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAIA,MACE,QAAQ,SAAS,6BACjB,QAAQ,SAAS,wCACjB;AACA,QAAI,QAAQ,SAAS,6BAA6B,QAAQ,WAAW,GAAG;AACtE,YAAM,IAAI,MAAM,oDAAoD;AAAA,IACtE;AACA,WAAO,MAAM;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,CAAC;AAAA,MACD,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,2BAA2B,QAAQ,SAAS,2BAA2B;AAC1F,WAAO,MAAM,uBAAuB,IAAI,SAAS,OAAO,SAAS,iBAAiB,OAAO;AAAA,EAC3F;AACA,QAAM,IAAI,MAAM,mCAAmC,QAAQ,IAAI,EAAE;AACnE;AAEA,SAAS,uBAAuB,OAAsD;AACpF,QAAM,UAAU,MAAM,IAAI,CAAC,SAAS,MAAM,KAAK,CAAC,EAAE,OAAO,CAAC,SAAyB,QAAQ,IAAI,CAAC;AAChG,SAAO,QAAQ,SAAS,IAAI,QAAQ,KAAK,MAAM,IAAI;AACrD;AAEA,eAAe,uBACb,IACA,SACA,OACA,SACA,iBACA,SAC4B;AAC5B,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AACA,MAAI,WAAW,WAAW,KAAK,CAAC,QAAQ,kCAAkC;AACxE,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AACA,MAAI,WAAW,KAAK,CAAC,QAAQ,IAAI,cAAc,IAAI,GAAG;AACpD,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,SAAO,MAAM;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,CAAC;AAAA,IACD,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR;AAAA,EACF;AACF;AAGA,eAAe,aACb,IACA,SACA,OACA,SACA,MACA,iBACA,qBAAkD,CAAC,GACnD,cAAkC,aAClC,yBACA,yBACA,qBACA,oBAA8D,mCAC9D,qBAAyF,CAAC,GAC9D;AAC5B,QAAM,wBAAwB,mBAAmB,IAAI,CAAC,eAAe,WAAW,QAAQ;AACxF,QAAM,CAAC,QAAQ,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC3C;AAAA,MAA+B;AAAA,MAAoB;AAAA,MAAwB,YACzE,kBAAkB,IAAI,QAAQ,aAAa,QAAQ,SAAS;AAAA,IAC9D;AAAA,IACA;AAAA,MAA+B;AAAA,MAAoB;AAAA,MAAyB,YAC1E,0BAA0B,IAAI,QAAQ,aAAa,QAAQ,SAAS;AAAA,IACtE;AAAA,EACF,CAAC;AACD,QAAM,gBAAgB,MAAM;AAAA,IAC1B;AAAA,IACA;AAAA,IACA,YAAY;AACV,YAAM,aAAa,mBAAmB,oBAClC,MAAM;AAAA,QACJ;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,OAAO,IAAI,CAAC,QAAQ,IAAI,EAAE;AAAA,MAC5B,IACA;AACJ,YAAM,SACJ,cAAc,mBAAmB,oBAC7B;AAAA,QACE,OAAO,IAAI,CAAC,SAAS;AAAA,UACnB,GAAG;AAAA,UACH,QAAQ,WAAW,gBAAgB,IAAI,IAAI,EAAE,KAAK;AAAA,QACpD,EAAE;AAAA,QACF;AAAA,UACE,SAAS;AAAA,UACT,mBAAmB,mBAAmB;AAAA,UACtC,cAAc,WAAW;AAAA,QAC3B;AAAA,MACF,IACA,iCAAiC,MAAM;AAC7C,aAAO,0BAA0B,MAAM,wBAAwB,MAAM,IAAI;AAAA,IAC3E;AAAA,EACF;AACA,QAAM,eAAe,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,IACA,MAAM,0BAA0B,eAAe,WAAW;AAAA,EAC5D;AACA,QAAM,oBAAoB,MAAM;AAAA,IAC9B;AAAA,IACA;AAAA,IACA,MAAM,8BAA8B,cAAc,qBAAqB;AAAA,EACzE;AACA,QAAM,sBAAsB,MAAM;AAAA,IAChC;AAAA,IACA;AAAA,IACA,YACE,0BACI,MAAM,wBAAwB,iBAAiB,IAC/C;AAAA,EACR;AACA,QAAM,eAAe,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,IACA,YACE,sBACI,MAAM,oBAAoB,qBAAqB;AAAA,MAC7C,aAAa,mBAAmB,IAAI,CAAC,eAAe,WAAW,IAAI;AAAA,IACrE,CAAC,IACD;AAAA,EACR;AACA,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA,YACE,MAAM,QAAQ,aAAa,OAAO;AAAA,MAChC,MAAM;AAAA,MACN,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,MACvB,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;AAAA,MAC7C;AAAA,MACA,iBAAiB;AAAA,MACjB,GAAI,sBAAsB,EAAE,4BAA4B,KAAK,IAAI,CAAC;AAAA,IACpE,CAAC;AAAA,EACL;AACA,QAAM,6BAA6B,MAAM;AAAA,IACvC;AAAA,IACA;AAAA,IACA,MAAM;AACJ,YAAM,gBAAgB,MAAM,QAAQ,SAAS,KAAK,IAC9C,IAAI,IAAI,SAAS,KAAK,IACtB,oBAAI,IAAa;AACrB,aAAO;AAAA,QACL,qBAAqB,OAAO,IAAI,CAAC,QAAQ,IAAI,EAAE;AAAA,QAC/C,gBAAgB,OACb;AAAA,UACC,CAAC,QACC,IAAI,kCAAkC,QACtC,0BAA0B,IAAI,IAAI,KAClC,cAAc,IAAI,IAAI,IAAI;AAAA,QAC9B,EACC,IAAI,CAAC,QAAQ,IAAI,EAAE;AAAA,MACxB;AAAA,IACF;AAAA,EACF;AACA,SAAO;AAAA,IACL,OAAO;AAAA,IACP,uBAAuB,SAAS;AAAA,IAChC;AAAA,EACF;AACF;AA0BA,eAAe,kCACb,IACA,WACA,aACA,WACA,WACsC;AACtC,QAAM,gBAAgB,UAAU;AAAA,IAC9B,CAAC,aAA0C,SAAS,SAAS;AAAA,EAC/D;AACA,MAAI,cAAc,WAAW,EAAG,QAAO,CAAC;AACxC,QAAM,QAAQ,MAAM,mBAAmB,IAAI;AAAA,IACzC;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS,cAAc,IAAI,CAAC,aAAa,SAAS,MAAM;AAAA,EAC1D,CAAC;AACD,QAAM,WAAW,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AAC7D,SAAO,cAAc,IAAI,CAAC,aAAa;AACrC,UAAM,OAAO,SAAS,IAAI,SAAS,MAAM;AACzC,QAAI,CAAC,KAAM,OAAM,IAAI,MAAM,mBAAmB,SAAS,MAAM,EAAE;AAC/D,WAAO,EAAE,UAAU,KAAK;AAAA,EAC1B,CAAC;AACH;AAEA,SAAS,8BACP,aACoB;AACpB,QAAM,gBAAgB,YAAY;AAAA,IAChC,CAAC,EAAE,UAAU,KAAK,MAChB,KAAK,KAAK,QAAQ,KAAK,KAAK,WAAW,KAAK,KAAK,SAAS,YAAY,gBAAgB,UAAU,IAAI,CAAC;AAAA,EACzG;AACA,MAAI,cAAc,WAAW,GAAG;AAC9B,WAAO;AAAA,EACT;AACA,SAAO,CAAC,gDAAgD,GAAG,aAAa,EAAE,KAAK,IAAI;AACrF;AAEA,SAAS,gBACP,UACA,MACQ;AACR,SAAO,GAAG,kBAAkB,QAAQ,CAAC,IAAI,KAAK,YAAY;AAC5D;;;AJ97BA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;AM/DP,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AAEA,IAAM,8BAA8B;AACpC,IAAM,8BAA8B;AAiC3C,SAAS,cAAc,cAAqC;AAC1D,SAAO,eAAe,wBAAwB,YAAY,MAAM;AAClE;AAEA,SAAS,gBAAgB,WAAiE;AACxF,MAAI,CAAC,UAAW,QAAO;AACvB,SAAO,UAAU,aAAa,eAC1B,mCAAmC,UAAU,MAAM,yBACnD,2DAA2D,UAAU,MAAM;AACjF;AAGO,SAAS,mCAAmC,OAQZ;AACrC,QAAM,OAAO,qBAAqB,MAAM,QAAQ;AAChD,QAAM,QAAQ,MAAM,UAAU,uBAAuB,MAAM,OAAO,IAAI;AACtE,QAAM,OAAO,cAAc,MAAM,YAAY;AAC7C,QAAM,OAAO,MAAM,UACf,2EACA;AACJ,QAAM,QAAQ,OACV,GAAG,IAAI,IAAI,MAAM,cAAc,WAAW,IAAI,WAAW,IAAI,gCAAgC,KAAK,KAAK,IAAI,KAC3G,GAAG,IAAI,4BAA4B,KAAK,yBAAyB,IAAI;AACzE,QAAM,SAAS,gBAAgB,MAAM,aAAa,IAAI;AACtD,SAAO;AAAA,IACL;AAAA,IACA,MAAM;AAAA,IACN,WAAW;AAAA,IACX,UAAU,OAAO,aAAa,MAAM,QAAQ,IAAI;AAAA,IAChD,OAAO,MAAM;AAAA,IACb,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,EAC7B;AACF;AAMO,SAAS,mCAAmC,OAKZ;AACrC,QAAM,OAAO,qBAAqB,MAAM,QAAQ;AAChD,QAAM,OAAO,cAAc,MAAM,YAAY;AAC7C,QAAM,aACJ,MAAM,gBAAgB,QAClB,KACA,OACE,GAAG,IAAI,sBAAsB,IAAI,iDACjC,kDAAkD,KAAK,OAAO,CAAC,EAAE,YAAY,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC;AACtG,SAAO;AAAA,IACL,OACE,iDAAiD,MAAM,UAAU,MAAM,+BACpE,UAAU;AAAA,IACf,MAAM;AAAA,IACN,WAAW;AAAA,IACX,UAAU,OAAO,aAAa,MAAM,QAAQ,IAAI;AAAA,IAChD,GAAI,gBAAgB,MAAM,SAAS,IAAI,EAAE,QAAQ,gBAAgB,MAAM,SAAS,EAAG,IAAI,CAAC;AAAA,EAC1F;AACF;AAMO,IAAM,4BAAN,cAAwC,MAAM;AAAA,EAEnD,YAAqB,SAA6C;AAChE,UAAM,QAAQ,KAAK;AADA;AAEnB,SAAK,OAAO;AAAA,EACd;AAAA,EAJS,OAAO;AAKlB;;;AC3IA,SAAS,qCAAqC;AAC9C;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAUP,IAAM,uBAAuB;AAoCtB,IAAM,iCAAN,cAA6C,MAAM;AAAA,EAQxD,YACW,SACT,cAAsB,sBACtB;AACA,UAAM,QAAQ,KAAK;AAHV;AAIT,SAAK,OAAO;AACZ,SAAK,OAAO,QAAQ;AACpB,SAAK,cAAc;AAAA,EACrB;AAAA,EAfS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AAUX;AAEA,IAAM,YAAY,CAAC,UAA8C;AAAA,EAC/D,yBAAyB,OAAO,IAAI;AAAA,EACpC,4BAA4B,OAAO,IAAI;AAAA,EACvC,2BAA2B,OAAO,IAAI;AAAA,EACtC,sBAAsB,MAAM,IAAI;AAAA,EAChC,mBAAmB,qCAAqC,IAAI;AAAA,EAC5D,4BACE;AAAA,EACF,gCACE;AACJ;AAOO,SAAS,oCACd,QACA,iBACA,cAAsB,sBACG;AACzB,SAAO;AAAA,IACL,OAAO,mCAAmC,QAAQ,WAAW;AAAA,IAC7D,MAAM;AAAA,IACN,YAAY;AAAA,IACZ,GAAI,oCAAoC,MAAM,IAAI,EAAE,gBAAgB,KAAK,IAAI,CAAC;AAAA,IAC9E,GAAI,kBAAkB,EAAE,UAAU,gBAAgB,YAAY,EAAE,IAAI,CAAC;AAAA,EACvE;AACF;AAGO,SAAS,yCACd,UACA,aACA,cAAsB,sBACU;AAChC,SAAO,IAAI;AAAA,IACT;AAAA,MACE,OAAO,GAAG,WAAW;AAAA,MACrB,MAAM;AAAA,MACN,WAAW;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,gDACd,OACA,OACgC;AAChC,SAAO,IAAI;AAAA,IACT;AAAA,MACE,OACE;AAAA,MACF,MAAM;AAAA,MACN,WAAW;AAAA,MACX,eAAe;AAAA,MACf,kBAAkB;AAAA,IACpB;AAAA,IACA;AAAA,EACF;AACF;AAOO,SAAS,gCACd,QACA,iBACA,cAAsB,sBACU;AAChC,SAAO,IAAI;AAAA,IACT;AAAA,MACE,OAAO,UAAU,WAAW,EAAE,MAAM;AAAA,MACpC,MAAM;AAAA,MACN,WAAW;AAAA,MACX,YAAY;AAAA,MACZ,GAAI,kBAAkB,EAAE,UAAU,gBAAgB,YAAY,EAAE,IAAI,CAAC;AAAA,IACvE;AAAA,IACA;AAAA,EACF;AACF;AAOO,SAAS,iCACd,aACA,OACA,cAAsB,sBACU;AAChC,SAAO,IAAI;AAAA,IACT;AAAA,MACE,OACE,UAAU,qBACN,iBAAiB,WAAW,wEAC5B,mDAAmD,WAAW;AAAA,MACpE,MAAM;AAAA,MACN,WAAW;AAAA,MACX,GAAI,cAAc,EAAE,UAAU,YAAY,YAAY,EAAE,IAAI,CAAC;AAAA,IAC/D;AAAA,IACA;AAAA,EACF;AACF;AAGO,IAAM,yCAAyC;AAO/C,SAAS,iCACd,UACA,KACA,cACA,QAAgB,+BACR;AACR,QAAM,QAAQ,WAAW,KAAK,MAAM,QAAQ,IAAI,OAAO;AACvD,QAAM,YAAY,OAAO,SAAS,KAAK,IAAI,KAAK,IAAI,KAAK,IAAI,QAAQ,KAAK,CAAC,GAAG,KAAK,IAAI;AACvF,QAAM,SAAS,KAAK,IAAI,KAAK,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI;AACxD,SAAO,KAAK,IAAI,KAAO,KAAK,KAAK,YAAY,MAAM,CAAC;AACtD;AAQO,IAAM,sCAAsC,IAAI;AAQhD,SAAS,+BACd,QACA,qBACA,KACwE;AACxE,QAAM,YACJ,UAAU,OAAO,wBAAwB,sBAAsB,IAC3D,KAAK,IAAI,OAAO,WAAW,GAAG,IAC9B;AACN,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,WAAW,MAAM,aAAa;AAAA,EAChC;AACF;AAGO,SAAS,0CACd,cAAsB,sBACU;AAChC,SAAO,IAAI;AAAA,IACT;AAAA,MACE,OAAO,oDAAoD,WAAW;AAAA,MACtE,MAAM;AAAA,MACN,WAAW;AAAA,IACb;AAAA,IACA;AAAA,EACF;AACF;AAQA,IAAM,eAAe,CAAC,UAAkE;AAAA,EACtF,SAAS,OAAO,IAAI;AAAA,EACpB,WAAW,OAAO,IAAI;AAAA,EACtB,aAAa,OAAO,IAAI;AAAA,EACxB,aAAa,mCAAmC,IAAI;AACtD;AAQO,SAAS,sCACd,SACA,cAAsB,sBACU;AAChC,SAAO,IAAI;AAAA,IACT;AAAA,MACE,OAAO,aAAa,WAAW,EAAE,OAAO;AAAA,MACxC,MAAM;AAAA,MACN,WAAW;AAAA,MACX;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACF;AAGO,SAAS,mCACd,UACA,cAAsB,sBACU;AAChC,SAAO,IAAI;AAAA,IACT;AAAA,MACE,OAAO,GAAG,QAAQ,yBAAyB,WAAW;AAAA,MACtD,MAAM;AAAA,MACN,WAAW;AAAA,IACb;AAAA,IACA;AAAA,EACF;AACF;AAGO,SAAS,uCACd,cAAsB,sBACU;AAChC,SAAO,IAAI;AAAA,IACT;AAAA,MACE,OAAO,GAAG,WAAW;AAAA,MACrB,MAAM;AAAA,MACN,WAAW;AAAA,IACb;AAAA,IACA;AAAA,EACF;AACF;;;AP/NA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;AQuOA,IAAM,yBAAyB;AAC/B,IAAM,4BAA4B;AAmClC,IAAM,4CAA4C;AAClD,IAAM,+CACX;AAwBK,IAAM,4CAA4C;AAClD,IAAM,+CACX;;;ACrXK,IAAM,gCAAqD,oBAAI,IAAI;AAAA,EACxE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AASD,SAAS,MAAM,OAAiD;AAC9D,QAAM,UAAU,OAAO,UAAU,WAAW,MAAM,QAAQ,QAAQ,GAAG,EAAE,KAAK,IAAI;AAChF,SAAO,UAAU,QAAQ,MAAM,GAAG,GAAG,IAAI;AAC3C;AAGO,SAAS,wBAAwB,OAA0C;AAChF,QAAM,QAAQ,MAAM,MAAM,UAAU,KAAK;AACzC,QAAM,WAAW,MAAM,MAAM,aAAa;AAC1C,QAAM,KAAK,WAAW,qBAAqB,QAAQ,MAAM;AACzD,UAAQ,MAAM,MAAM;AAAA,IAClB,KAAK;AACH,aAAO,GAAG,KAAK,mBAAmB,EAAE;AAAA,IACtC,KAAK;AACH,aAAO,MAAM,sBAAsB,eAC/B,GAAG,KAAK,iBAAiB,EAAE,KAC3B,MAAM,sBAAsB,iBAC1B,GAAG,KAAK,sBAAsB,EAAE,KAChC,GAAG,KAAK,8BAA8B,EAAE;AAAA,IAChD,KAAK;AACH,aAAO,GAAG,KAAK;AAAA,IACjB,KAAK;AACH,aAAO,GAAG,KAAK;AAAA,IACjB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAGO,SAAS,iCACd,OACQ;AACR,QAAM,QAAQ,MAAM;AACpB,QAAM,UAAU,oBAAoB,KAAK,IAAI,UAAU,IAAI,SAAS,OAAO;AAC3E,QAAM,SAAS,8BAA8B,IAAI,MAAM,QAAQ,EAAE,IAC7D,4DACA;AACJ,SAAO,GAAG,wBAAwB,KAAK,CAAC,KAAK,OAAO,IAAI,MAAM;AAChE;;;AToDO,IAAM,iCAAiC;AACvC,IAAM,mCAAmC,CAAC,KAAO,KAAO,MAAQ,KAAQ,GAAM;AAC9E,IAAM,oCAAoC,iCAAiC;AAC3E,SAAS,sBAAsB,aAA8B;AAClE,SAAO,gBAAgB,kCACnB,6CACA;AACN;AAMO,IAAM,iCAAiC,CAAC,KAAQ,KAAQ,KAAQ,KAAQ,IAAO;AAE/E,SAAS,yBAAyB,SAAiB,QAAwB;AAChF,QAAM,UAAU,OAAO,SAAS,MAAM,IAAI,KAAK,IAAI,GAAG,KAAK,IAAI,QAAQ,CAAC,CAAC,IAAI;AAC7E,SAAO,KAAK,MAAM,KAAK,IAAI,KAAO,UAAU,GAAG,IAAI,OAAO;AAC5D;AACO,IAAM,0CAA0C;AAChD,IAAM,uCAAuC;AAEpD,SAAS,uCACP,OAC2C;AAC3C,MAAI,UAAU;AACd,QAAM,OAAO,oBAAI,IAAa;AAC9B,WAAS,QAAQ,GAAG,QAAQ,KAAK,WAAW,OAAO,YAAY,UAAU,SAAS,GAAG;AACnF,QAAI,mBAAmB,mCAAoC,QAAO;AAClE,QAAI,KAAK,IAAI,OAAO,EAAG;AACvB,SAAK,IAAI,OAAO;AAChB,cAAW,QAAgC;AAAA,EAC7C;AACA,SAAO;AACT;AAEO,IAAM,uCAAN,cAAmD,MAAM;AAAA,EACrD,OAAO;AAAA,EAEhB,cAAc;AACZ,UAAM,4EAA4E;AAClF,SAAK,OAAO;AAAA,EACd;AACF;AAeO,SAAS,uBAAuB,OAQZ;AACzB,QAAM,WAAW,MAAM,gBAAgB;AACvC,QAAM,QAAQ,sBAAsB,MAAM,WAAW;AACrD,QAAM,YAAY,CAChB,YAC8D;AAAA,IAC9D,QAAQ;AAAA,IACR,uBAAuB,KAAK,IAAI,KAAK,IAAI,MAAM,gBAAgB,GAAG,CAAC,GAAG,KAAK;AAAA,IAC3E,0BAA0B;AAAA,IAC1B,iCAAiC;AAAA,EACnC;AACA,MAAI,MAAM,gBAAgB,OAAO;AAC/B,QAAI,SAAU,QAAO,UAAU,aAAa;AAC5C,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,uBAAuB;AAAA,MACvB,0BAA0B;AAAA,IAC5B;AAAA,EACF;AACA,QAAM,MAAM,MAAM,OAAO,KAAK,IAAI;AAClC,QAAM,YAAY,MAAM,sBAAsB,MAAM,kBAAkB,IAAI,MAAM;AAChF,MAAI,aAAa,CAAC,OAAO,SAAS,SAAS,KAAK,CAAC,OAAO,SAAS,GAAG,KAAK,YAAY,MAAM;AACzF,WAAO,UAAU,eAAe;AAAA,EAClC;AACA,QAAM,gBACJ,MAAM,iBAAiB,QACvB,MAAM,iBAAiB,UACvB,OAAO,SAAS,MAAM,YAAY,KAClC,MAAM,eAAe,IACjB,KAAK,KAAK,MAAM,YAAY,IAC5B;AACN,QAAM,kBACJ,MAAM,gBAAgB,0BAClB,KAAK;AAAA,IACH,iBAAiB;AAAA,IACjB,+BACE,KAAK;AAAA,MACH,KAAK,IAAI,KAAK,MAAM,MAAM,aAAa,IAAI,GAAG,CAAC;AAAA,MAC/C,+BAA+B,SAAS;AAAA,IAC1C,CACF;AAAA,EACF,IACA,YACE,MAAM,gBAAgB,0BACtB,MAAM,gBAAgB,uCACtB,MAAM,gBAAgB,uCACtB,MAAM,gBAAgB,wCACtB,MAAM,gBAAgB,2BACtB,MAAM,gBAAgB,+BACtB,MAAM,gBAAgB,+CACtB,MAAM,gBAAgB,0CACtB,KAAK;AAAA,IACH,iBAAiB;AAAA,IACjB,iCACE,KAAK;AAAA,MACH,KAAK,IAAI,KAAK,MAAM,MAAM,aAAa,IAAI,GAAG,CAAC;AAAA,MAC/C,iCAAiC,SAAS;AAAA,IAC5C,CACF;AAAA,EACF,IACA;AACR,QAAM,UACJ,mBACC,YACD,MAAM,gBAAgB,2BACtB,MAAM,gBAAgB,0BACtB,MAAM,gBAAgB,sCAClB,yBAAyB,iBAAiB,MAAM,gBAAgB,CAAC,IACjE;AAEN,MAAI,YAAY,MAAM,WAAW,YAAY,sCAAsC;AACjF,WAAO,UAAU,UAAU;AAAA,EAC7B;AACA,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,iBAAiB;AAAA,IACjB,GAAI,WAAW,EAAE,0BAA0B,MAAM,IAAI,CAAC;AAAA,EACxD;AACF;AAGO,IAAM,uCAAN,cAAmD,MAAM;AAAA,EACrD;AAAA,EAET,YAAY,OAAe,QAAsD;AAC/E,UAAM,qEAAqE;AAC3E,SAAK,OAAO;AACZ,SAAK,UAAU;AAAA,MACb;AAAA,QACE,OAAO,KAAK;AAAA,QACZ,MAAM;AAAA,QACN,mBAAmB;AAAA,MACrB;AAAA,MACA;AAAA,QACE,QAAQ;AAAA;AAAA,QAER,uBAAuB,KAAK;AAAA,UAC1B;AAAA,UACA,KAAK,IAAI,GAAG,QAAQ,CAAC;AAAA,QACvB;AAAA,QACA,0BAA0B;AAAA,QAC1B,iCAAiC;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,qCAAqC,OAK5C;AACP,MAAI,MAAM,gBAAgB,mCAAmC,MAAM,0BAA0B,GAAG;AAC9F;AAAA,EACF;AACA,MAAI,MAAM,wBAAwB,4CAA4C;AAC5E,UAAM,IAAI,qCAAqC,MAAM,uBAAuB,aAAa;AAAA,EAC3F;AACA,QAAM,MAAM,MAAM,OAAO,KAAK,IAAI;AAClC,QAAM,YAAY,MAAM;AACxB,MACE,cAAc,UACd,CAAC,OAAO,SAAS,SAAS,KAC1B,CAAC,OAAO,SAAS,GAAG,KACpB,YAAY,KACZ;AACA,UAAM,IAAI,qCAAqC,MAAM,uBAAuB,eAAe;AAAA,EAC7F;AACA,MAAI,OAAO,YAAY,sCAAsC;AAC3D,UAAM,IAAI,qCAAqC,MAAM,uBAAuB,UAAU;AAAA,EACxF;AACF;AAEO,SAAS,iCAGd,SACA,UAQA;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,iCAAiC;AAAA,MACtC,MAAM,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,MACxD,mBAAmB,oBAAoB,QAAQ,iBAAiB,IAC5D,QAAQ,oBACR;AAAA,MACJ,YAAY,OAAO,QAAQ,eAAe,WAAW,QAAQ,aAAa;AAAA,MAC1E,eAAe,OAAO,QAAQ,kBAAkB,WAAW,QAAQ,gBAAgB;AAAA,MACnF,uBAAuB,SAAS;AAAA,IAClC,CAAC;AAAA,IACD,WAAW;AAAA,IACX,mBAAmB;AAAA,IACnB,uBAAuB,SAAS;AAAA,IAChC,0BAA0B,SAAS;AAAA,IACnC,GAAI,SAAS,kCACT,EAAE,iCAAiC,SAAS,gCAAgC,IAC5E,CAAC;AAAA,IACL,oBAAoB,QAAQ;AAAA,EAC9B;AACF;AAEA,SAAS,oBAAoB,OAA4C;AACvE,SACE,UAAU,gBACV,UAAU,iBACV,UAAU,kBACV,UAAU;AAEd;AAQO,SAAS,oCAGd,SAKA;AACA,QAAM,UAAU,wBAAwB;AAAA,IACtC,MAAM,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,IACxD,mBAAmB,oBAAoB,QAAQ,iBAAiB,IAC5D,QAAQ,oBACR;AAAA,IACJ,YAAY,OAAO,QAAQ,eAAe,WAAW,QAAQ,aAAa;AAAA,IAC1E,eAAe,OAAO,QAAQ,kBAAkB,WAAW,QAAQ,gBAAgB;AAAA,EACrF,CAAC;AACD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,GAAG,OAAO;AAAA,IACjB,WAAW;AAAA,IACX,mBAAmB;AAAA,IACnB,oBAAoB,QAAQ;AAAA,EAC9B;AACF;AAOO,SAAS,2BACd,SACA,OACqE;AACrE,MAAI,CAAC,SAAS,CAAC,QAAQ,QAAQ,CAAC,8BAA8B,IAAI,QAAQ,IAAI,EAAG,QAAO;AACxF,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,MAAM;AAAA,IACb,YAAY,MAAM;AAAA,IAClB,eAAe,MAAM;AAAA,EACvB;AACF;AAEO,SAAS,kCAAkC,UAA2C;AAC3F,QAAM,QAAQ,SAAS;AACvB,SAAO,OAAO,UAAU,YAAY,OAAO,cAAc,KAAK,KAAK,SAAS,IAAI,QAAQ;AAC1F;AAEO,SAAS,4CACd,cACA,OACQ;AACR,SAAO,UAAU,cAAc,IAAI;AACrC;AAEO,SAAS,YAAY,SAAkB,MAA6B;AACzE,MAAI,CAAC,WAAW,OAAO,YAAY,SAAU,QAAO;AACpD,QAAM,SAAU,QAA8B;AAC9C,MAAI,OAAO,WAAW,YAAY;AAChC,UAAM,QAAQ,OAAO,KAAK,SAAS,IAAI;AACvC,WAAO,OAAO,UAAU,WAAW,QAAQ;AAAA,EAC7C;AACA,QAAM,SAAS,KAAK,YAAY;AAChC,QAAM,QAAQ,OAAO,QAAQ,OAAkC,EAAE;AAAA,IAC/D,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,YAAY,MAAM,UAAU,OAAO,UAAU;AAAA,EACrE;AACA,SAAO,OAAO,QAAQ,CAAC,MAAM,WAAW,MAAM,CAAC,IAAI;AACrD;AAGO,SAAS,qBAAqB,OAAgB,QAAQ,KAAK,IAAI,GAAkB;AACtF,MAAI,UAAmB;AACvB,WAAS,QAAQ,GAAG,QAAQ,KAAK,WAAW,OAAO,YAAY,UAAU,SAAS,GAAG;AACnF,UAAM,QAAQ;AACd,UAAM,OACJ,MAAM,SAAS,OAAO,MAAM,UAAU,WACjC,MAAM,QACP;AACN,UAAM,eAAe;AAAA,MACnB,YAAY,MAAM,SAAS,gBAAgB,KACzC,YAAY,MAAM,iBAAiB,gBAAgB,KACnD,YAAY,MAAM,SAAS,gBAAgB,KAC3C;AAAA,IACJ;AACA,QAAI,OAAO,SAAS,YAAY,KAAK,eAAe,EAAG,QAAO,KAAK,KAAK,YAAY;AACpF,UAAM,gBAAgB;AAAA,MACpB,MAAM,uBAAuB,MAAM,uBAAuB,MAAM;AAAA,IAClE;AACA,UAAM,SACJ,YAAY,MAAM,SAAS,aAAa,KACxC,YAAY,MAAM,iBAAiB,aAAa,KAChD,YAAY,MAAM,SAAS,aAAa;AAC1C,UAAM,gBAAgB,WAAW,OAAO,OAAO,MAAM,OAAO,MAAM;AAClE,UAAM,aACJ,WAAW,QAAQ,CAAC,OAAO,SAAS,aAAa,IAAI,KAAK,MAAM,MAAM,IAAI,OAAO;AACnF,UAAM,UAAU,OAAO,SAAS,aAAa,IACzC,gBACA,OAAO,SAAS,aAAa,IAC3B,gBACA,OAAO,SAAS,UAAU,IACxB,KAAK,IAAI,IAAI,aAAa,SAAS,GAAK,IACxC,OAAO;AACf,QAAI,OAAO,SAAS,OAAO,KAAK,UAAU,EAAG,QAAO,KAAK,KAAK,UAAU,GAAK;AAC7E,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAQO,SAAS,iCAAiC,OAG1B;AACrB,MAAI,MAAM,gBAAgB,GAAG;AAC3B,WAAO;AAAA,EACT;AACA,QAAM,eAAe,KAAK,IAAI,GAAG,MAAM,eAAe,MAAM,WAAW,MAAM;AAC7E,QAAM,SAAS,MAAM,WAAW,IAAI,CAAC,OAAO,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI;AAChE,QAAM,YAAY,SACd,GAAG,MAAM,GAAG,eAAe,IAAI,UAAU,YAAY,sCAAsC,EAAE,KAC7F,GAAG,MAAM,YAAY;AACzB,SAAO,kJAAkJ,SAAS;AACpK;AAUO,SAAS,iCAAiC,OAInB;AAC5B,MACE,MAAM,gBAAgB,2BACtB,MAAM,uBACN,CAAC,OAAO,cAAc,MAAM,OAAO,mBAAmB,KACtD,MAAM,OAAO,uBAAuB,KACpC,CAAC,OAAO,cAAc,MAAM,OAAO,qBAAqB,KACxD,MAAM,OAAO,yBAAyB,KACtC,MAAM,OAAO,wBAAwB,qCACrC,CAAC,OAAO,cAAc,MAAM,OAAO,eAAe,KAClD,MAAM,OAAO,mBAAmB,GAChC;AACA,WAAO;AAAA,EACT;AACA,SAAO,mBAAmB,OAAO;AAAA,IAC/B,SAAS;AAAA,IACT,MAAM;AAAA,IACN,cAAc;AAAA,IACd,SAAS,CAAC,MAAM,MAAM;AAAA,EACxB,CAAC;AACH;AAUO,SAAS,yBAAyB,OAAoC;AAC3E,QAAM,qBAAqB,+BAA+B,KAAK,IAAI,QAAQ;AAC3E,QAAM,gBAAgB,6BAA6B,KAAK;AACxD,QAAM,gBACJ,oBAAoB,QAAQ,UAAU,4BACtC,mBAAmB,QAAQ,iBAAiB,mBAC5C,CAAC;AACH,QAAM,SAAgC;AAAA,IACpC,aAAa,gBACT,YACA,sBAAsB,gBACpB,cACA;AAAA,IACN,MAAM,iBAAiB,oBAAoB,QAAQ,QAAQ;AAAA,IAC3D,GAAI,sBAAsB,gBACtB;AAAA,MACE,UAAU,mBAAmB,QAAQ;AAAA,MACrC,QACE,mBAAmB,QAAQ,UAAU,4BACrC,mBAAmB,QAAQ,aAAa,UACnC,kCACD,mBAAmB,QAAQ,UAAU,4BACnC,mBAAmB,QAAQ,aAAa,UACvC,qCACA;AAAA,MACT,aAAa;AAAA,IACf,IACA,CAAC;AAAA,EACP;AACA,SAAO,mBAAmB,OAAO;AAAA,IAC/B,SAAS;AAAA,IACT,MAAM;AAAA,IACN,cAAc;AAAA,IACd,SAAS,CAAC,MAAM;AAAA,EAClB,CAAC;AACH;AAMA,SAAS,6BAA6B,OAAiD;AACrF,QAAM,QAAQ,oBAAI,IAAyB;AAC3C,QAAM,QAAkB,CAAC;AACzB,MAAI,QAAQ;AACZ,QAAM,MAAM,CAAC,UAA4B;AACvC,QAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,IAAI,KAAK,EAAG,QAAO;AACpE,QAAI,MAAM,QAAQ,GAAI,QAAO;AAC7B,UAAM,IAAI,OAAO,oBAAI,IAAI,CAAC;AAC1B,UAAM,KAAK,KAAK;AAChB,WAAO;AAAA,EACT;AACA,MAAI,CAAC,IAAI,KAAK,EAAG,QAAO;AACxB,MAAI;AACF,eAAW,WAAW,OAAO;AAC3B,YAAM,SAAS;AACf,YAAM,WAAW,MAAM,QAAQ,OAAO,IAClC,UACA,CAAC,SAAS,YAAY,eAAe,SAAS,QAAQ,EAAE,IAAI,CAAC,QAAQ,OAAO,GAAG,CAAC;AACpF,iBAAW,SAAS,UAAU;AAC5B,YAAI,EAAE,QAAQ,QAAQ,CAAC,IAAI,KAAK,EAAG,QAAO;AAC1C,YAAI,SAAS,OAAO,UAAU,SAAU,OAAM,IAAI,OAAO,EAAG,IAAI,KAAK;AAAA,MACvE;AAAA,IACF;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,6BACP,OACA,4BAA4B,OACoB;AAChD,MAAI;AACF,UAAM,QAAQ,6BAA6B,KAAK;AAChD,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,aAAa,oBAAI,IAAY;AACnC,UAAM,aAAa,oBAAI,IAAY;AACnC,UAAM,mBAAmB,oBAAI,IAAY;AACzC,UAAM,QAAQ,oBAAI,IAA6C;AAC/D,UAAM,cAAc,CAAC,SACnB,gBAAgB;AAAA;AAAA;AAAA,MAGZ,CAAC,GAAG,MAAM,IAAI,IAAI,CAAE,EAAE,OAAO,CAAC,UAAU,UAAU,KAAK,KAAK;AAAA,QAC5D,CAAC,GAAG,MAAM,IAAI,IAAI,CAAE;AAG1B,eAAW,QAAQ,MAAM,KAAK,GAAG;AAC/B,UAAI,qCAAqC,IAAI,KAAK,qCAAqC,IAAI;AACzF,eAAO;AACT,YAAM,SAAS;AACf,UACE,4BACI,sCAAsC,MAAM,IAC5C,oCAAoC,EAAE,MAAM,OAAO,MAAM,OAAO,OAAO,MAAM,CAAC;AAElF,mBAAW,IAAI,IAAI;AACrB,YAAM,WAAW,+BAA+B,IAAI,IAChD,KAAK,QAAQ,WACb,OAAO,SAAS,mBAAmB,OAAO,OAAO,SAAS,WACxD,OAAO,OACP;AACN,UACE,4BACI,wCAAwC,QAAQ,IAChD,6BAA6B,QAAQ;AAEzC,mBAAW,IAAI,IAAI;AACrB,UACE,gBAAgB,qBAChB,gBAAgB,4BAChB,+BAA+B,IAAI,GACnC;AAIA,cAAM,QAAkB,CAAC,IAAI;AAC7B,mBAAW,UAAU,OAAO;AAC1B,cAAI,iBAAiB,IAAI,MAAM,EAAG;AAClC,2BAAiB,IAAI,MAAM;AAC3B,gBAAM,KAAK,GAAG,YAAY,MAAM,CAAC;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AACA,UAAM,kBAAkB,CAAC,aAA8B;AACrD,YAAM,OAAO,oBAAI,IAAY;AAC7B,YAAM,QAAQ,CAAC,QAAQ;AACvB,iBAAW,QAAQ,OAAO;AACxB,YAAI,KAAK,IAAI,IAAI,EAAG;AACpB,aAAK,IAAI,IAAI;AACb,YAAI,WAAW,IAAI,IAAI,EAAG,QAAO;AACjC,cAAM,KAAK,GAAG,YAAY,IAAI,CAAC;AAAA,MACjC;AACA,aAAO;AAAA,IACT;AAIA,eAAW,QAAQ,MAAM,KAAK,GAAG;AAC/B,YAAM,SAAS;AACf,UAAI,gBAAgB,qBAAqB,gBAAgB,0BAA0B;AACjF,mBAAW,IAAI,IAAI;AACnB,YAAI,gBAAgB,IAAI,EAAG,OAAM,IAAI,YAAY;AAAA,MACnD;AACA,YAAM,QAAQ,+BAA+B,IAAI;AACjD,UAAI,CAAC,SAAS,OAAO,SAAS,gBAAiB;AAC/C,iBAAW,IAAI,IAAI;AACnB,YAAM,WAAW,QACb,KAAK,QAAQ,WACb,OAAO,OAAO,SAAS,WACrB,OAAO,OACP;AACN,YAAM,mBAAmB,4BACrB,wCAAwC,QAAQ,IAChD,6BAA6B,QAAQ;AAIzC,YAAM,aAAa,+BAA+B,QAAQ;AAC1D,YAAM,OAAO,QACT,gCAAgC,QAAQ,IACxC,oBAAoB,aAClB,oBAAoB,QAAQ,IAC5B;AACN,UACE,CAAC,QACA,6BACC,CAAC,oBACD,CAAC,cACD,EAAE,aAAa,QAAQ,gBAAgB,IAAI;AAE7C,eAAO;AACT,UAAI,CAAC,6BAA6B,iBAAiB,IAAI,IAAI,EAAG,OAAM,IAAI,IAAI;AAAA,IAC9E;AAGA,QAAI,CAAC,6BAA6B,WAAW,SAAS,KAAK,WAAW,OAAO;AAC3E,YAAM,IAAI,YAAY;AAExB,eAAW,QAAQ,CAAC,cAAc,eAAe,0BAA0B;AACzE,UAAI,MAAM,IAAI,IAAI,EAAG,QAAO;AAC9B,WAAO;AAAA,EACT,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEA,IAAM,wCAAwC,oBAAI,IAAI;AAAA;AAAA;AAAA;AAAA,EAIpD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,sCAAsC,QAA0C;AACvF,SAAO,CAAC,OAAO,MAAM,OAAO,KAAK,EAAE;AAAA,IACjC,CAAC,SAAS,OAAO,SAAS,YAAY,sCAAsC,IAAI,IAAI;AAAA,EACtF;AACF;AAEA,SAAS,wCAAwC,UAAkC;AACjF,SACE,aAAa,SACZ,kBAAkB,KAAK,QAAQ,KAAK,CAAC,SAAS,SAAS,OAAO,EAAE,SAAS,QAAQ;AAEtF;AAEA,SAAS,6BAA6B,UAAkC;AACtE,SACE,aAAa,SACZ,SAAS,WAAW,IAAI,KAAK,CAAC,SAAS,SAAS,OAAO,EAAE,SAAS,QAAQ;AAE/E;AAEA,SAAS,gCACP,UACgD;AAChD,MACE,EACE,aAAa,QACb,SAAS,WAAW,IAAI,KACxB,+BAA+B,QAAQ,KACvC,SAAS,WAAW,IAAI,KACxB,aAAa,WACb,aAAa,WACb,aAAa,WACb,aAAa,WACb,aAAa,WACb,SAAS,WAAW,IAAI,IAE1B;AACA,WAAO;AAAA,EACT;AACA,SAAO,oBAAoB,QAAQ;AACrC;AAOO,SAAS,qCAAqC,OAAyB;AAC5E,SAAO,6BAA6B,OAAO,IAAI,MAAM;AACvD;AAQO,SAAS,iCAAiC,OAcnB;AAC5B,QAAM,OAAO,6BAA6B,MAAM,OAAO,MAAM,yBAAyB;AACtF,MAAI,CAAC,QAAQ,MAAM,sBAAsB,EAAG,QAAO;AACnD,MACG,MAAM,8BAA8B,MAAM,kCACzC,MAAM,8BAA8B,MAAM,kCAC1C,MAAM,kBACR;AACA,WAAO;AAAA,EACT;AACA,MACE,MAAM,qBACL,CAAC,OAAO,cAAc,MAAM,iBAAiB,qBAAqB,KACjE,MAAM,iBAAiB,yBAAyB,KAChD,MAAM,iBAAiB,wBACrB,sBAAsB,MAAM,iBAAiB,WAAW,KAC1D,CAAC,yBAAyB,KAAK,MAAM,iBAAiB,WAAW,KACjE,CAAC;AAAA,IACC,MAAM,iBAAiB;AAAA,IACvB,MAAM,iBAAiB;AAAA,EACzB,IACF;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAA0C;AAAA,IAC9C,QAAQ,MAAM;AAAA,IACd,gBAAgB,MAAM;AAAA,IACtB,qBAAqB,MAAM;AAAA,IAC3B;AAAA,IACA,GAAI,MAAM,6BAA6B,EAAE,4BAA4B,KAAK,IAAI,CAAC;AAAA,IAC/E,GAAI,MAAM,gCAAgC,EAAE,+BAA+B,KAAK,IAAI,CAAC;AAAA,IACrF,GAAI,MAAM,mBACN;AAAA,MACE,qBAAqB,MAAM,iBAAiB;AAAA,MAC5C,uBAAuB,MAAM,iBAAiB;AAAA,MAC9C,GAAI,MAAM,iBAAiB,oBAAoB,SAC3C,EAAE,iCAAiC,MAAM,iBAAiB,gBAAgB,IAC1E,CAAC;AAAA,IACP,IACA,CAAC;AAAA,EACP;AAEA,QAAM,uBAAuB,gCAAgC,MAAM,MAAM;AACzE,MAAI,qBAAqB,SAAS,EAAG,QAAO,uBAAuB;AACnE,SAAO,mBAAmB,OAAO;AAAA,IAC/B,SAAS;AAAA,IACT,MAAM;AAAA,IACN,cAAc;AAAA,IACd,SAAS,CAAC,MAAM;AAAA,EAClB,CAAC;AACH;AASO,SAAS,6BAA6B,OAAyB;AACpE,SAAO,iBAAiBC,qBAAoB,MAAM,YAAY;AAChE;AAcO,SAAS,qCACd,OAC6C;AAC7C,QAAM,UAAqB,CAAC,KAAK;AACjC,QAAM,OAAO,oBAAI,QAAgB;AACjC,MAAI,YAAY;AAEhB,SAAO,QAAQ,SAAS,KAAK,YAAY,IAAI;AAC3C,UAAM,UAAU,QAAQ,MAAM;AAC9B,iBAAa;AACb,QAAI,CAAC,WAAW,OAAO,YAAY,YAAY,KAAK,IAAI,OAAO,EAAG;AAClE,SAAK,IAAI,OAAO;AAEhB,QAAI;AACF,YAAM,SAAS;AACf,YAAM,SAAS,OAAO;AACtB,WACG,mBAAmBC,gCAClB,OAAO,SAAS,kCAClB,OAAO,OAAO,mBAAmB,YACjC,OAAO,eAAe,SAAS,KAC/B,OAAO,OAAO,eAAe,YAC7B,OAAO,cAAc,OAAO,UAAU,KACtC,OAAO,cAAc,MACpB,WAAW,yBACV,WAAW,0BACX,WAAW,kCACb;AACA,eAAO;AAAA,UACL,gBAAgB,OAAO;AAAA,UACvB,YAAY,OAAO;AAAA,UACnB;AAAA,QACF;AAAA,MACF;AAEA,iBAAW,OAAO,CAAC,SAAS,OAAO,GAAY;AAC7C,cAAM,SAAS,OAAO,GAAG;AACzB,YAAI,UAAU,OAAO,WAAW,SAAU,SAAQ,KAAK,MAAM;AAAA,MAC/D;AACA,UAAI,MAAM,QAAQ,OAAO,MAAM,EAAG,SAAQ,KAAK,GAAG,OAAO,OAAO,MAAM,GAAG,EAAE,CAAC;AAAA,IAC9E,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,oCAAoC,OAAgB,YAAoB;AACtF,QAAM,aAAa,qCAAqC,KAAK;AAC7D,SAAO;AAAA,IACL,OAAO;AAAA,IACP,YAAY,KAAK,IAAI,GAAG,KAAK,MAAM,UAAU,CAAC;AAAA,IAC9C,oBAAoB,eAAe;AAAA,IACnC,GAAI,aACA;AAAA,MACE,iBAAiB;AAAA,MACjB,cAAc;AAAA,MACd,aAAa,WAAW;AAAA,MACxB,WAAW;AAAA,IACb,IACA,CAAC;AAAA,EACP;AACF;AAQO,SAAS,uCAAuC,YAAoB;AACzE,SAAO;AAAA,IACL,OAAO;AAAA,IACP,YAAY,KAAK,IAAI,GAAG,KAAK,MAAM,UAAU,CAAC;AAAA,IAC9C,oBAAoB;AAAA,IACpB,iBAAiB;AAAA,IACjB,cAAc;AAAA,IACd,aAAa;AAAA,IACb,WAAW;AAAA,EACb;AACF;AAqBA,SAAS,yCAAyC,OAAyB;AACzE,QAAM,QAAQ,6BAA6B,KAAK;AAChD,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,QAAQ;AACZ,MAAI;AACF,eAAW,QAAQ,MAAM,KAAK,GAAG;AAC/B,UACE,qCAAqC,IAAI,KACzC,qCAAqC,IAAI,KACzC,mCAAmC,IAAI,KACvC,uCAAuC,IAAI,KAC3C,6CAA6C,IAAI;AAEjD,eAAO;AACT,UAAI,gBAAgB,qCAAqC;AACvD,YACE,KAAK,OAAO,0BACZ,CAAC,OAAO,cAAc,KAAK,UAAU,KACrC,KAAK,aAAa,KAClB,CAAC,KAAK,aACL,KAAK,aAAa,aAAa,KAAK,aAAa;AAElD,iBAAO;AACT,gBAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,2BACd,OAMO;AACP,MAAI,yCAAyC,KAAK,GAAG;AACnD,WAAO;AAAA,EACT;AACA,QAAM,UAAqB,CAAC,KAAK;AACjC,QAAM,OAAO,oBAAI,QAAgB;AACjC,MAAI,YAAY;AAEhB,SAAO,QAAQ,SAAS,KAAK,YAAY,IAAI;AAC3C,UAAM,UAAU,QAAQ,MAAM;AAC9B,iBAAa;AACb,QAAI,CAAC,WAAW,OAAO,YAAY,YAAY,KAAK,IAAI,OAAO,EAAG;AAClE,SAAK,IAAI,OAAO;AAEhB,QAAI;AACF,YAAM,SAAS;AACf,WACG,mBAAmB,mCAClB,OAAO,SAAS,sCAClB,OAAO,SAAS,4CAChB;AACA,eAAO;AAAA,MACT;AACA,WACG,mBAAmB,kCAClB,OAAO,SAAS,qCAClB,OAAO,SAAS,8BAChB;AACA,eAAO;AAAA,MACT;AACA,UACE,mBAAmB,oCACnB,mBAAmB,uCACnB,OAAO,SAAS,sCAChB,OAAO,SAAS,uCAChB;AACA,eAAO;AAAA,MACT;AAEA,iBAAW,OAAO,CAAC,SAAS,OAAO,GAAY;AAC7C,cAAM,SAAS,OAAO,GAAG;AACzB,YAAI,UAAU,OAAO,WAAW,SAAU,SAAQ,KAAK,MAAM;AAAA,MAC/D;AACA,UAAI,MAAM,QAAQ,OAAO,MAAM,GAAG;AAChC,gBAAQ,KAAK,GAAG,OAAO,OAAO,MAAM,GAAG,EAAE,CAAC;AAAA,MAC5C;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,SAAO;AACT;AAiBO,SAAS,wBAAwB,QAAwB;AAC9D,SAAO,OAAO,WAAW,kCAAkC,IACvD,SACA,oCAAoC,MAAM;AAChD;AAgBO,SAAS,oBAAoB,OAAqC;AACvE,QAAM,aAAkC;AAAA,IACtC,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,QAAQ;AAAA,EACV;AACA,MAAI;AACF,QAAI,eAAe;AACnB,QAAI,iBAAiB,kCAAkC;AACrD,iBAAW,0BAA0B,MAAM;AAC3C,qBAAe,MAAM;AAAA,IACvB;AACA,QAAI,gBAAgB,OAAO,iBAAiB,UAAU;AACpD,YAAM,SAAS;AAAA,QACZ,aAA4D,UAC1D,aAA0C;AAAA,MAC/C;AACA,UAAI,OAAO,UAAU,MAAM,KAAK,UAAU,OAAO,UAAU,KAAK;AAC9D,mBAAW,SAAS;AAAA,MACtB;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAGR;AACA,SAAO;AACT;AAEO,SAAS,sBAAsB,OAAuB;AAC3D,QAAM,aAAa,oBAAoB,KAAK;AAC5C,QAAM,OAAO,IAAI,MAAM,yBAAyB;AAKhD,OAAK,OAAO;AACZ,OAAK,OAAO,WAAW;AACvB,MAAI,WAAW,WAAW,OAAW,MAAK,SAAS,WAAW;AAC9D,OAAK,SAAS,WAAW;AACzB,SAAO;AACT;AAOO,IAAM,yCACX;AAEK,SAAS,iCAAiC,OAAwB;AACvE,QAAM,YAAY,4BAA4B,KAAK;AACnD,MAAI,WAAW;AACb,WAAO;AAAA,MACL,uDAAuD,oCAAoC,SAAS,CAAC,oCAAoC,sCAAsC;AAAA,IACjL;AAAA,EACF;AAGA,QAAM,QAAQ,qCAAqC,KAAK;AACxD,MAAI,OAAO;AACT,WAAO;AAAA,MACL,GAAG,8BAA8B,MAAM,KAAK,CAAC;AAAA,IAC/C;AAAA,EACF;AACA,MACE,iBAAiB,mCACjB,iBAAiB,6BACjB;AACA,WAAO,wBAAwB,MAAM,OAAO;AAAA,EAC9C;AACA,QAAM,YAAY,iBAAiB,SAAS,MAAM,OAAO,MAAM,OAAO;AACtE,SAAO,wBAAwB,cAAc,SAAS,EAAE;AAC1D;AAQO,SAAS,kCACd,OACA,YAAgC,CAAC,GASjC;AACA,QAAM,YAAY,4BAA4B,KAAK;AAGnD,QAAM,QAAQ,YAAY,OAAO,qCAAqC,KAAK;AAC3E,SAAO;AAAA,IACL,OAAO,UAAU,SAAS,iCAAiC,KAAK;AAAA,IAChE,MAAM;AAAA,IACN,WAAW;AAAA,IACX,UAAU;AAAA,IACV,WAAW;AAAA,IACX,GAAI,YAAY,EAAE,mBAAmB,UAAU,IAAI,CAAC;AAAA,IACpD,GAAI,QAAQ,EAAE,YAAY,MAAM,MAAM,IAAI,CAAC;AAAA,EAC7C;AACF;AAEO,SAAS,2BAA2B,OAAyB;AAClE,SACE,iBAAiB,mCAAmC,iBAAiB;AAEzE;AAEO,SAAS,uCAAuC,OAAyB;AAC9E,MAAI,EAAE,iBAAiB,iCAAkC,QAAO;AAKhE,MAAI,2BAA2B,KAAK,EAAG,QAAO;AAC9C,MAAI,sBAAsB,KAAK,KAAK,6BAA6B,KAAK,EAAG,QAAO;AAKhF,QAAM,gBAAgB,mCAAmC,KAAK,IAC1D,4BAA4B,KAAK,IACjC;AACJ,MAAI,eAAe,SAAS,kBAAkB,eAAe,SAAS,eAAgB,QAAO;AAK7F,MAAI,wCAAwC,KAAK,EAAG,QAAO;AAM3D,MAAI,kCAAkC,KAAK,EAAG,QAAO;AACrD,SAAO,uBAAuB,KAAK,EAAE,cAAc;AACrD;AAEO,SAAS,mCACd,OAC4D;AAC5D,MAAI,wBAAwB,KAAK,EAAG,QAAO;AAC3C,QAAM,SAAS,oBAAoB,KAAK;AACxC,QAAM,UAAU,OAAO;AAAA,IACrB,CAAC,UACC,uCAAuC,KAAK,KAAK,KACjD,0CAA0C,KAAK,KAAK,KACpD,8BAA8B,KAAK,KAAK,KACxC,+BAA+B,KAAK,KAAK;AAAA,EAC7C;AACA,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AACA,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,QAAM,OAAO,OAAO,KAAK,CAAC,UAAU,uCAAuC,KAAK,KAAK,CAAC;AACtF,SAAO;AAAA,IACL;AAAA,IACA,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,IACvB,GAAI,WAAW,YAAY,UAAU,EAAE,QAAQ,QAAQ,IAAI,CAAC;AAAA,EAC9D;AACF;AAYO,SAAS,iCACd,OAC6C;AAC7C,QAAM,SAAS,oBAAoB,KAAK;AACxC,QAAM,cAAc,OAAO;AAAA,IACzB,CAAC,UACC,WAAW,KAAK,KAAK,KACrB,qFAAqF;AAAA,MACnF;AAAA,IACF,KACA,CAAC,6BAA6B,KAAK,KAAK;AAAA,EAC5C;AACA,QAAM,sBAAsB,yBAAyB,KAAK;AAC1D,MAAI,CAAC,eAAe,CAAC,qBAAqB;AACxC,WAAO;AAAA,EACT;AACA,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,QAAM,UAAU,eAAe,OAAO,KAAK,CAAC,UAAU,WAAW,KAAK,KAAK,CAAC;AAC5E,SAAO;AAAA,IACL;AAAA,IACA,GAAI,WAAW,YAAY,UAAU,EAAE,QAAQ,QAAQ,IAAI,CAAC;AAAA,EAC9D;AACF;AAEO,SAAS,oBAAoB,OAAgB,OAAO,oBAAI,QAAgB,GAAa;AAC1F,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,CAAC,KAAK;AAAA,EACf;AACA,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,WAAO,CAAC;AAAA,EACV;AACA,MAAI,KAAK,IAAI,KAAK,GAAG;AACnB,WAAO,CAAC;AAAA,EACV;AACA,OAAK,IAAI,KAAK;AACd,QAAM,MAAgB,CAAC;AAGvB,MAAI,iBAAiB,gCAAiC,KAAI,KAAK,MAAM,MAAM;AAC3E,QAAM,SAAS;AACf,aAAW,OAAO,CAAC,WAAW,QAAQ,QAAQ,QAAQ,OAAO,GAAG;AAC9D,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,UAAI,KAAK,KAAK;AAAA,IAChB;AAAA,EACF;AACA,aAAW,OAAO,CAAC,SAAS,SAAS,YAAY,MAAM,GAAG;AACxD,QAAI,KAAK,GAAG,oBAAoB,OAAO,GAAG,GAAG,IAAI,CAAC;AAAA,EACpD;AACA,SAAO;AACT;AA2CO,IAAM,2CACX;AAEK,IAAM,4CACX;AACF,IAAM,4CAA4C,oBAAI,IAAI;AAAA,EACxD;AAAA,EACA;AACF,CAAC;AAEM,SAAS,6CAA6C,SAA0B;AACrF,SAAO,0CAA0C,IAAI,QAAQ,KAAK,EAAE,YAAY,CAAC;AACnF;AAEA,IAAM,2BAA2B;AAOjC,SAAS,uBAAuB,OAAoC;AAClE,MAAI,UAAU;AACd,QAAM,OAAO,oBAAI,IAAa;AAC9B,WAAS,QAAQ,GAAG,QAAQ,KAAK,WAAW,OAAO,YAAY,UAAU,SAAS,GAAG;AACnF,QAAI,KAAK,IAAI,OAAO,EAAG;AACvB,SAAK,IAAI,OAAO;AAChB,UAAM,QAAQ;AACd,QAAI,OAAO,MAAM,SAAS,YAAY,yBAAyB,KAAK,MAAM,IAAI,GAAG;AAC/E,aAAO,MAAM;AAAA,IACf;AACA,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAEA,SAAS,gCAAgC,OAAoC;AAC3E,MAAI,iBAAiB,iCAAiC;AACpD,WAAO,MAAM,aAAa,WAAW,MAAM,SAAS;AAAA,EACtD;AACA,SAAO,oBAAoB,KAAK,EAAE;AAAA,IAChC,CAAC,UACC,uHAAuH;AAAA,MACrH;AAAA,IACF,KAAK,sDAAsD,KAAK,KAAK;AAAA,EACzE;AACF;AAEA,SAAS,wBAAwB,OAAyB;AACxD,SAAO,gCAAgC,KAAK,MAAM;AACpD;AAGA,SAAS,mBAAmB,OAAoC;AAC9D,MAAI,UAAU;AACd,QAAM,OAAO,oBAAI,IAAa;AAC9B,WAAS,QAAQ,GAAG,QAAQ,KAAK,WAAW,OAAO,YAAY,UAAU,SAAS,GAAG;AACnF,QAAI,KAAK,IAAI,OAAO,EAAG;AACvB,SAAK,IAAI,OAAO;AAChB,UAAM,QAAQ;AACd,UAAM,SAAS,OAAO,MAAM,UAAU,MAAM,UAAU;AACtD,QAAI,OAAO,UAAU,MAAM,KAAK,UAAU,OAAO,SAAS,IAAK,QAAO;AACtE,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAOO,SAAS,wBAAwB,OAAyB;AAC/D,MAAI,UAAmB;AACvB,QAAM,OAAO,oBAAI,IAAa;AAC9B,WAAS,QAAQ,GAAG,QAAQ,KAAK,WAAW,OAAO,YAAY,UAAU,SAAS,GAAG;AACnF,QAAI,KAAK,IAAI,OAAO,EAAG;AACvB,SAAK,IAAI,OAAO;AAChB,UAAM,QAAQ;AACd,QAAI,MAAM,SAAS,kBAAkB,MAAM,YAAY,4BAA4B;AACjF,aAAO;AAAA,IACT;AACA,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAEO,SAAS,yBAAyB,OAAyB;AAChE,MAAI,iBAAiB,iCAAiC;AACpD,WAAO,MAAM,aAAa;AAAA,EAC5B;AAEA,MAAI,wBAAwB,KAAK,EAAG,QAAO;AAC3C,QAAM,SAAS,mBAAmB,KAAK;AAMvC,MAAI,WAAW,UAAa,OAAO,SAAS,MAAM,GAAG;AACnD,WAAO,UAAU,OAAO,SAAS;AAAA,EACnC;AACA,MAAI,uBAAuB,KAAK,EAAG,QAAO;AAC1C,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,MAAI,6CAA6C,OAAO,GAAG;AACzD,WAAO;AAAA,EACT;AACA,SAAO,+HAA+H;AAAA,IACpI;AAAA,EACF;AACF;AAGA,SAAS,uBAAuB,OAAyB;AACvD,SAAO,oBAAoB,KAAK,EAAE,KAAK,CAAC,UAAU,MAAM,SAAS,4BAA4B,CAAC;AAChG;AAWO,SAAS,qCACd,OACgC;AAChC,MACE,sBAAsB,KAAK,KAC3B,gCAAgC,KAAK,KACrC,mCAAmC,KAAK;AAExC,WAAO;AAET,SAAO,2BAA2B,KAAK;AACzC;AAGO,SAAS,mCAAmC,OAAyB;AAC1E,MAAI,UAAmB;AACvB,WAAS,QAAQ,GAAG,QAAQ,KAAK,mBAAmB,OAAO,SAAS;AAClE,QAAI,mBAAmB,yBAAyB,QAAQ,aAAc,QAAO;AAC7E,cAAU,QAAQ;AAAA,EACpB;AACA,SAAO;AACT;AAWO,SAAS,yBAAyB,OAA6C;AACpF,MAAI,wBAAwB,KAAK,EAAG,QAAO;AAC3C,MAAI,UAAmB;AACvB,WAAS,QAAQ,GAAG,QAAQ,KAAK,WAAW,OAAO,YAAY,UAAU,SAAS,GAAG;AACnF,QAAI,mBAAmB,gCAAgC;AACrD,aAAO,EAAE,MAAM,eAAe;AAAA,IAChC;AACA,cAAW,QAAoC;AAAA,EACjD;AACA,MAAI,CAAC,gCAAgC,KAAK,EAAG,QAAO;AACpD,MAAI,UAAmB;AACvB,WAAS,QAAQ,GAAG,QAAQ,KAAK,WAAW,OAAO,YAAY,UAAU,SAAS,GAAG;AACnF,UAAM,QAAQ;AACd,UAAM,OACJ,MAAM,SAAS,OAAO,MAAM,UAAU,WACjC,MAAM,QACP;AACN,UAAM,SAAS,OAAO,MAAM,UAAU,MAAM,cAAc,MAAM,UAAU,MAAM,UAAU;AAC1F,UAAM,OAAO,OAAO,MAAM,QAAQ,MAAM,QAAQ,EAAE,EAAE,YAAY;AAChE,QAAI,WAAW,OAAO,SAAS,kBAAkB,SAAS,iBAAiB;AACzE,aAAO,EAAE,MAAM,eAAe;AAAA,IAChC;AACA,QAAI,WAAW,KAAK;AAClB,aAAO,EAAE,MAAM,YAAY;AAAA,IAC7B;AACA,UAAM,UAAU,OAAO,MAAM,WAAW,MAAM,WAAW,EAAE;AAC3D,QACE,qCAAqC;AAAA,MACnC;AAAA,MACA;AAAA,MACA,QAAQ,OAAO,UAAU,MAAM,IAAI,SAAS;AAAA,IAC9C,CAAC,GACD;AACA,aAAO,EAAE,MAAM,gBAAgB,cAAc,qBAAqB,KAAK,EAAE;AAAA,IAC3E;AACA,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAIA,SAAS,wBAAwB,OAAgD;AAC/E,QAAM,QAAmB,CAAC,KAAK;AAC/B,QAAM,OAAO,oBAAI,IAAa;AAC9B,WAAS,QAAQ,GAAG,QAAQ,MAAM,UAAU,QAAQ,IAAI,SAAS,GAAG;AAClE,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,WAAW,OAAO,YAAY,YAAY,KAAK,IAAI,OAAO,EAAG;AAClE,SAAK,IAAI,OAAO;AAChB,UAAM,SAAS;AACf,QAAI,OAAO,SAAS,gBAAiB,QAAO;AAC5C,eAAW,OAAO,CAAC,SAAS,YAAY,eAAe,SAAS,QAAQ,GAAG;AACzE,YAAM,SAAS,OAAO,GAAG;AACzB,UAAI,MAAM,QAAQ,MAAM,EAAG,OAAM,KAAK,GAAG,OAAO,MAAM,GAAG,EAAE,CAAC;AAAA,eACnD,WAAW,OAAW,OAAM,KAAK,MAAM;AAAA,IAClD;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,OAAyB;AACxD,SACE,iBAAiB,SACjB,WAAW,SACX,OAAO,MAAM,UAAU,YACvB,YAAY,SACZ,MAAM,QAAQ,MAAM,MAAM;AAE9B;AAEA,SAAS,2BAA2B,OAAmD;AACrF,MAAI,iBAAiB,sBAAuB,QAAO;AACnD,SAAO,iBAAiB,SAAS,MAAM,iBAAiB,wBACpD,MAAM,QACN;AACN;AAEA,SAAS,mCAAmC,OAAyB;AACnE,MAAI;AACF,WACE,iBAAiB,2CACjB,iBAAiB;AAAA,EAErB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,uBACd,OACA,UAAqC,CAAC,GACS;AAC/C,SAAO,sBAAsB,OAAO,+BAA+B,OAAO,OAAO,CAAC;AACpF;AAOA,SAAS,sBACP,OACA,SAC+C;AAC/C,MAAI,QAAQ,SAAS,yBAAyB;AAC5C,WAAO,EAAE,GAAG,SAAS,mBAAmB,eAAe;AAAA,EACzD;AACA,MAAI,QAAQ,SAAS,uBAAwB,QAAO;AACpD,MAAI,QAAQ,aAAc,QAAO,EAAE,GAAG,SAAS,mBAAmB,eAAe;AACjF,SAAO;AAAA,IACL,GAAG;AAAA,IACH,mBAAmB,wBAAwB,OAAO,OAAO,IAAI,eAAe;AAAA,EAC9E;AACF;AAGO,SAAS,wBACd,OACA,UAA+C,CAAC,GACvC;AACT,MAAI,mBAAmB,KAAK,MAAM,IAAK,QAAO;AAC9C,QAAM,YAAY,2BAA2B,KAAK;AAClD,SAAO,CAAC,GAAG,oBAAoB,KAAK,GAAG,WAAW,QAAQ,QAAQ,OAAO,QAAQ,MAAM,EAAE;AAAA,IACvF,CAAC,UAAU,OAAO,UAAU,YAAY,kCAAkC,KAAK,KAAK;AAAA,EACtF;AACF;AAGO,SAAS,qBACd,OACA,SACoB;AACpB,MAAI,QAAQ,SAAS,0BAA0B,CAAC,QAAQ,UAAW,QAAO,QAAQ;AAClF,QAAM,SAAS,mBAAmB,KAAK;AACvC,MAAI,UAAU;AACd,QAAM,OAAO,oBAAI,IAAa;AAC9B,WAAS,QAAQ,GAAG,QAAQ,KAAK,WAAW,OAAO,YAAY,UAAU,SAAS,GAAG;AACnF,QAAI,KAAK,IAAI,OAAO,EAAG;AACvB,SAAK,IAAI,OAAO;AAChB,QACE,mBAAmB,yBACnB,WAAW,UACX,UAAU,OACV,SAAS,QACR,WAAW,OAAO,QAAQ,cAAc,qBACzC;AACA,aAAO;AAAA,IACT;AACA,cAAW,QAAgC;AAAA,EAC7C;AACA,SAAO,QAAQ;AACjB;AAEA,SAAS,+BACP,OACA,UAAqC,CAAC,GACS;AAC/C,QAAM,YAAY,8BAA8B,KAAK;AACrD,MAAI;AACF,WAAO;AAAA,MACL,OAAO,UAAU;AAAA,MACjB,MAAM,UAAU;AAAA,MAChB,WAAW;AAAA,MACX,aAAa,UAAU;AAAA,MACvB,GAAI,UAAU,aAAa,EAAE,WAAW,UAAU,WAAW,IAAI,CAAC;AAAA,IACpE;AACF,QAAM,QAAQ,6BAA6B,KAAK;AAChD,QAAM,QAAQ,QAAQ,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC;AAC3C,QAAM,iBAAiB,MAAM,KAAK,oCAAoC;AACtE,MAAI,gBAAgB;AAGlB,UAAM,UAAU,MAAM;AAAA,MACpB,CAAC,SACC,qCAAqC,IAAI,KACzC,uCAAuC,IAAI,KAC3C,6CAA6C,IAAI,KACjD,mCAAmC,IAAI;AAAA,IAC3C;AACA,QAAI,QAAS,QAAO,EAAE,GAAG,2BAA2B,SAAS,OAAO,GAAG,WAAW,MAAM;AACxF,WAAO;AAAA,MACL,OAAO,eAAe;AAAA,MACtB,MAAM,eAAe;AAAA,MACrB,WAAW;AAAA,IACb;AAAA,EACF;AACA,QAAM,UAAU,MAAM,KAAK,CAAC,SAAS,gBAAgB,oCAAoC;AACzF,MAAI,mBAAmB,qCAAsC,QAAO,QAAQ;AAC5E,QAAM,UAAU,2BAA2B,OAAO,OAAO;AACzD,QAAM,aAAa,sCAAsC,KAAK;AAC9D,QAAM,YAAY,2BAA2B,KAAK;AAClD,MAAI,WAAW;AACb,UAAM,yBACJ,UAAU,WAAW,QACpB,UAAU,aACR,iBAAiB,SAAU,MAAuC,WAAW;AAClF,WAAO;AAAA,MACL,GAAG;AAAA,MACH,MACE,QAAQ,SACP,yBAAyB,mCAAmC,UAAU;AAAA,MACzE,WAAW,QAAQ,aAAa;AAAA,MAChC,GAAI,UAAU,SAAS,EAAE,QAAQ,UAAU,OAAO,IAAI,CAAC;AAAA,MACvD,GAAI,UAAU,aAAa,EAAE,WAAW,UAAU,WAAW,IAAI,CAAC;AAAA,IACpE;AAAA,EACF;AACA,SAAO,aAAa,EAAE,GAAG,SAAS,2BAA2B,WAAW,IAAI;AAC9E;AAGO,SAAS,+BACd,OACA,SAC2C;AAC3C,MAAI,CAAC,2BAA2B,KAAK,EAAG,QAAO;AAE/C,QAAM,WAAW,EAAE,GAAG,QAAQ;AAC9B,SAAO,SAAS;AAChB,SAAO;AACT;AAEA,SAAS,2BACP,OACA,UAAqC,CAAC,GAqCtC;AACA,MAAI,iBAAiB,yCAAyC;AAC5D,WAAO;AAAA,MACL,OAAO,MAAM;AAAA,MACb,MAAM,MAAM;AAAA,MACZ,WAAW;AAAA,MACX,2BAA2B,MAAM;AAAA,IACnC;AAAA,EACF;AACA,MAAI,iBAAiB,uCAAuC;AAC1D,WAAO,EAAE,OAAO,MAAM,SAAS,MAAM,uCAAuC,WAAW,MAAM;AAAA,EAC/F;AACA,MAAI,uCAAuC,KAAK,GAAG;AAGjD,WAAO;AAAA,MACL,OACE;AAAA,MACF,MAAM;AAAA,MACN,WAAW;AAAA,IACb;AAAA,EACF;AACA,MAAI,iBAAiB,kCAAkC;AACrD,UAAM,kBACJ,+BAA+B,MAAM,KAAK,KAC1C,wBAAwB,MAAM,KAAK,MAAM,QACzC,wBAAwB,MAAM,KAAK;AACrC,UAAM,aAAa,kBACf,uBAAuB,MAAM,OAAO,OAAO,IAC3C;AAAA,MACE,OAAO,MAAM,iBAAiB,QAAQ,MAAM,MAAM,UAAU,OAAO,MAAM,KAAK;AAAA,IAChF;AACJ,WAAO;AAAA,MACL,GAAG;AAAA,MACH,yBAAyB,MAAM;AAAA,IACjC;AAAA,EACF;AAIA,QAAM,sBAAsB,wBAAwB,KAAK;AACzD,QAAM,gBAAgB,wBAAwB,KAAK;AACnD,OAAK,uBAAuB,kBAAkB,CAAC,+BAA+B,KAAK,GAAG;AACpF,UAAM,WAAW,uBAAuB,uBAAuB,KAAK;AACpE,UAAM,WAAW,sBAAsB,uBAAuB,mBAAmB,IAAI;AACrF,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM,oBAAoB,QAAQ;AAAA,MAClC;AAAA,MACA,GAAI,OAAO,KAAK,QAAQ,EAAE,SAAS,IAAI,EAAE,SAAS,IAAI,CAAC;AAAA,IACzD;AAAA,EACF;AACA,MAAI,iBAAiB,qCAAqC;AACxD,WAAO,EAAE,OAAO,MAAM,SAAS,MAAM,MAAM,MAAM,WAAW,MAAM;AAAA,EACpE;AACA,MAAI,iBAAiB,4BAA4B;AAC/C,WAAO;AAAA,MACL,OAAO,MAAM;AAAA,MACb,MAAM,MAAM,SAAS,6BAA6B,4BAA4B,MAAM;AAAA,MACpF,WAAW;AAAA,MACX,GAAI,MAAM,aAAa,EAAE,WAAW,MAAM,WAAW,IAAI,CAAC;AAAA,IAC5D;AAAA,EACF;AACA,QAAM,0BAA0B,gCAAgC,KAAK;AACrE,MAAI,4BAA4B,QAAW;AACzC,WAAO;AAAA,MACL,OACE;AAAA,MACF,MAAM;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,IACV;AAAA,EACF;AACA,MAAI,iBAAiB,iCAAiC;AACpD,UAAMC,SACJ,MAAM,aAAa,aAAa,MAAM,aAAa,eAC/C,qCAAqC;AAAA,MACnC,MAAM,MAAM;AAAA,MACZ,OAAO,EAAE,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,SAAS,MAAM,OAAO;AAAA,MACnE,mBAAmB,MAAM;AAAA,IAC3B,CAAC,IACD;AACN,QAAIA,QAAO;AACT,aAAO;AAAA,QACL,OAAO,8BAA8BA,OAAM,KAAK;AAAA,QAChD,MAAM;AAAA,QACN,WAAW;AAAA,QACX,YAAYA,OAAM;AAAA,QAClB,QAAQ,MAAM;AAAA,MAChB;AAAA,IACF;AACA,WAAO;AAAA,MACL,OACE,MAAM,aAAa,eACf,wFACA,MAAM,aAAa,gBACjB,iGACA;AAAA,MACR,MACE,MAAM,aAAa,eACf,0BACA,MAAM,aAAa,gBACjB,yBACA;AAAA,MACR,WAAW,MAAM,aAAa,gBAAgB,MAAM,aAAa;AAAA,MACjE,QAAQ,MAAM;AAAA,IAChB;AAAA,EACF;AACA,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,QAAM,SAAS,mBAAmB,KAAK;AACvC,QAAM,OACJ,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,QACrD,OAAQ,MAA6B,IAAI,IACzC;AACN,MAAI,iBAAiB,wCAAwC;AAC3D,WAAO;AAAA,MACL,OACE;AAAA,MACF,MAAM,MAAM;AAAA,MACZ,WAAW;AAAA,MACX,QAAQ,MAAM;AAAA,IAChB;AAAA,EACF;AACA,MAAI,iBAAiB,oCAAoC;AACvD,WAAO;AAAA,MACL,OACE;AAAA,MACF,MAAM,MAAM;AAAA,MACZ,WAAW;AAAA,MACX,QAAQ,MAAM;AAAA,IAChB;AAAA,EACF;AACA,MAAI,iBAAiB,sCAAsC;AACzD,WAAO;AAAA,MACL,OACE;AAAA,MACF,MAAM;AAAA,MACN,WAAW;AAAA,IACb;AAAA,EACF;AACA,MAAI,6CAA6C,KAAK,GAAG;AACvD,WAAO;AAAA,MACL,OACE;AAAA,MACF,MAAM;AAAA,MACN,WAAW;AAAA,IACb;AAAA,EACF;AACA,MAAI,uCAAuC,KAAK,GAAG;AACjD,WAAO;AAAA,MACL,OACE;AAAA,MACF,MAAM;AAAA,MACN,WAAW;AAAA,IACb;AAAA,EACF;AACA,MACE,CAAC,qCAAqC,KAAK,KAC3C,gDAAgD,KAAK,GACrD;AACA,WAAO;AAAA,MACL,OACE;AAAA,MACF,MAAM;AAAA,MACN,WAAW;AAAA,IACb;AAAA,EACF;AAKA,MAAI,sBAAsB,KAAK,KAAK,SAAS,wBAAwB;AACnE,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,MACN,WAAW;AAAA,IACb;AAAA,EACF;AACA,MAAI,6CAA6C,KAAK,GAAG;AACvD,WAAO;AAAA,MACL,OACE;AAAA,MACF,MAAM;AAAA,MACN,WAAW;AAAA,IACb;AAAA,EACF;AACA,QAAM,oBAAoB,8CAA8C,KAAK;AAC7E,MAAI,mBAAmB;AACrB,WAAO;AAAA,MACL,OAAO,kBAAkB;AAAA,MACzB,MAAM,kBAAkB;AAAA,MACxB,WAAW,kBAAkB,WAAW;AAAA,MACxC,eAAe,kBAAkB;AAAA,MACjC,GAAI,kBAAkB,YAAY,EAAE,WAAW,kBAAkB,UAAU,IAAI,CAAC;AAAA,IAClF;AAAA,EACF;AACA,QAAM,mBAAmB,8CAA8C,KAAK;AAC5E,MAAI,kBAAkB;AACpB,WAAO;AAAA,MACL,OACE;AAAA,MACF,MAAM;AAAA,MACN,WAAW;AAAA,MACX,kBAAkB,iBAAiB;AAAA,MACnC,YAAY,iBAAiB;AAAA,MAC7B,mBAAmB,iBAAiB;AAAA,MACpC,GAAI,iBAAiB,YAAY,EAAE,WAAW,iBAAiB,UAAU,IAAI,CAAC;AAAA,MAC9E,GAAI,iBAAiB,gBAAgB,EAAE,eAAe,iBAAiB,cAAc,IAAI,CAAC;AAAA,IAC5F;AAAA,EACF;AACA,MAAI,+BAA+B,KAAK,GAAG;AACzC,UAAM,EAAE,QAAQ,IAAI;AACpB,WAAO;AAAA,MACL,OAAO,MAAM;AAAA,MACb,MAAM,QAAQ;AAAA,MACd,QACE,QAAQ,iBAAiB,cACrB,uDAAuD,QAAQ,QAAQ,eACvE;AAAA,MACN,eAAe,QAAQ;AAAA,MACvB,OAAO,QAAQ;AAAA,MACf,UAAU,QAAQ;AAAA,MAClB,UAAU,QAAQ;AAAA,MAClB,cAAc,QAAQ;AAAA,MACtB,GAAI,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,IAAI,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,IACnF;AAAA,EACF;AAIA,MAAI,iBAAiB,2BAA2B;AAC9C,WAAO,MAAM;AAAA,EACf;AAEA,MAAI,iBAAiB,gCAAgC;AACnD,WAAO,MAAM;AAAA,EACf;AACA,QAAM,uBAAuB,kCAAkC,KAAK;AACpE,MAAI,sBAAsB;AACxB,WAAO,qBAAqB,aAAa,qBACrC,mCAAmC;AAAA,MACjC,cAAc;AAAA,MACd,UAAU;AAAA,MACV,aAAa;AAAA,MACb,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC,IACD,mCAAmC;AAAA,MACjC,cAAc;AAAA,MACd,UAAU;AAAA,MACV,WAAW;AAAA,MACX,aAAa;AAAA,IACf,CAAC;AAAA,EACP;AAcA,QAAM,eAAe,2BAA2B,KAAK;AACrD,MAAI,cAAc;AAChB,WAAO,EAAE,OAAO,aAAa,SAAS,MAAM,aAAa,MAAM,WAAW,MAAM;AAAA,EAClF;AACA,QAAM,aAAa,6BAA6B,KAAK;AACrD,MAAI,eAAe,sBAAsB,KAAK,KAAK,uBAAuB,KAAK,IAAI;AACjF,WAAO,8BAA8B,YAAY,OAAO;AAAA,EAC1D;AACA,QAAM,eAAe,kCAAkC,OAAO;AAAA,IAC5D,2BAA2B,QAAQ,gBAAgB;AAAA,EACrD,CAAC;AACD,MAAI,cAAc;AAChB,WAAO;AAAA,MACL,OAAO,aAAa,mBAChB,2KACA;AAAA,MACJ,MAAM;AAAA,MACN,WAAW;AAAA,MACX,cAAc,aAAa;AAAA,MAC3B,kBAAkB,aAAa;AAAA,MAC/B,GAAI,aAAa,YAAY,EAAE,WAAW,aAAa,UAAU,IAAI,CAAC;AAAA,MACtE,GAAI,aAAa,UAAU,EAAE,QAAQ,aAAa,QAAQ,IAAI,CAAC;AAAA,IACjE;AAAA,EACF;AACA,QAAM,aAAa,iCAAiC,KAAK;AACzD,MAAI,YAAY;AACd,UAAM,yBAAyB,qCAAqC,KAAK;AACzE,WAAO;AAAA,MACL,OACE;AAAA,MACF,MAAM;AAAA,MACN,WAAW;AAAA,MACX,GAAI,WAAW,UAAU,WAAW,UAChC,EAAE,QAAQ,WAAW,UAAU,WAAW,QAAQ,IAClD,CAAC;AAAA,MACL,GAAI,yBAAyB,EAAE,uBAAuB,IAAI,CAAC;AAAA,IAC7D;AAAA,EACF;AACA,MAAI,gCAAgC,KAAK,GAAG;AAC1C,UAAM,yBAAyB,qCAAqC,KAAK;AACzE,WAAO;AAAA,MACL,OACE;AAAA,MACF,MAAM;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,GAAI,yBAAyB,EAAE,uBAAuB,IAAI,CAAC;AAAA,IAC7D;AAAA,EACF;AAOA,QAAM,aAAa,oCAAoC,KAAK;AAC5D,MAAI,YAAY;AACd,UAAM,UACJ,WAAW,kBAAkB,OAAO,KAAK,MAAM,WAAW,gBAAgB,GAAK,IAAI;AACrF,UAAM,SAAS,YAAY,OAAO,QAAQ,OAAO,MAAM;AACvD,WAAO;AAAA,MACL,OACE,WAAW,SAAS,aAChB,qFAAqF,MAAM,oDAC3F,mDAAmD,MAAM;AAAA,MAC/D,MAAM;AAAA,MACN,WAAW;AAAA,MACX,cAAc,WAAW,SAAS,aAAa,oBAAoB;AAAA,MACnE,kBAAkB;AAAA,MAClB,QAAQ,WAAW;AAAA,IACrB;AAAA,EACF;AACA,MAAI,WAAW,UAAa,wBAAwB,KAAK,GAAG;AAC1D,WAAO;AAAA,MACL,OACE;AAAA,MACF,MAAM;AAAA,MACN,WAAW;AAAA,MACX,cAAc;AAAA,MACd,QAAQ;AAAA,IACV;AAAA,EACF;AACA,MAAI,SAAS,kCAAkC;AAC7C,WAAO;AAAA,MACL,OACE;AAAA,MACF,MAAM;AAAA,MACN,WAAW;AAAA,IACb;AAAA,EACF;AAKA,MAAI,WAAW,OAAO,SAAS,2BAA2B;AACxD,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,MACN,WAAW;AAAA,MACX,GAAI,UAAU,EAAE,QAAQ,QAAQ,IAAI,CAAC;AAAA,IACvC;AAAA,EACF;AACA,QAAM,QAAQ,qCAAqC,KAAK;AACxD,MAAI,OAAO;AACT,WAAO;AAAA,MACL,OAAO,8BAA8B,MAAM,KAAK;AAAA,MAChD,MAAM;AAAA,MACN,WAAW;AAAA,MACX,YAAY,MAAM;AAAA,MAClB,GAAI,UAAU,EAAE,QAAQ,QAAQ,IAAI,CAAC;AAAA,IACvC;AAAA,EACF;AACA,MACE,WAAW,QACT,WAAW,UAAa,CAAC,OAAO,SAAS,MAAM,OAC9C,SAAS,yBACR,6CAA6C,KAAK,OAAO,IAC7D;AACA,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,MACN,WAAW;AAAA,MACX,GAAI,WAAW,YAAY,sBAAsB,EAAE,QAAQ,QAAQ,IAAI,CAAC;AAAA,IAC1E;AAAA,EACF;AAKA,MAAI,yBAAyB,KAAK,GAAG;AACnC,QAAI,6CAA6C,OAAO,GAAG;AACzD,aAAO;AAAA,QACL,OACE;AAAA,QACF,MAAM;AAAA,QACN,WAAW;AAAA,MACb;AAAA,IACF;AACA,WAAO,EAAE,OAAO,SAAS,MAAM,wBAAwB,WAAW,KAAK;AAAA,EACzE;AACA,SAAO,EAAE,OAAO,QAAQ;AAC1B;AAYO,IAAM,8BAA8B,IAAI,KAAK;AAS7C,SAAS,6BACd,SACA,SAIA,KACa;AACb,MACE,QAAQ,SAAS,UACjB,QAAQ,SAAS,eACjB,QAAQ,SAAS,oBACjB;AACA,WAAO;AAAA,EACT;AACA,QAAM,gBACJ,QAAQ,oBAAoB,QAC5B,OAAO,SAAS,QAAQ,eAAe,KACvC,QAAQ,kBAAkB,IACtB,IAAI,KAAK,IAAI,QAAQ,IAAI,KAAK,KAAK,QAAQ,eAAe,IAAI,GAAI,IAClE;AACN,MAAI,QAAQ,SAAS,cAAc;AACjC,WAAO,iBAAiB,IAAI,KAAK,IAAI,QAAQ,IAAI,8BAA8B;AAAA,EACjF;AACA,QAAM,iBAAiB,UACnB;AAAA,IACE,EAAE,MAAM,QAAQ,oBAAoB,OAAO,QAAQ,eAAe;AAAA,IAClE,EAAE,MAAM,QAAQ,sBAAsB,OAAO,QAAQ,iBAAiB;AAAA,EACxE,EACG;AAAA,IACC,CAAC,YACE,OAAO,QAAQ,MAAM,6BACtB,OAAO,iBAAiB,QACxB,OAAO,MAAM,QAAQ,IAAI,IAAI,QAAQ;AAAA,EACzC,EACC,IAAI,CAAC,WAAW,OAAO,KAAK,IAC/B,CAAC;AACL,QAAM,cAAc,gBAAgB,CAAC,GAAG,gBAAgB,aAAa,IAAI;AACzE,MAAI,YAAY,WAAW,GAAG;AAC5B,WAAO,IAAI,KAAK,IAAI,QAAQ,IAAI,2BAA2B;AAAA,EAC7D;AACA,SAAO,YAAY;AAAA,IAAO,CAAC,QAAQ,UACjC,MAAM,QAAQ,IAAI,OAAO,QAAQ,IAAI,QAAQ;AAAA,EAC/C;AACF;AAQO,SAAS,+BAA+B,OAA+C;AAC5F,QAAM,eAAe,2BAA2B,KAAK;AACrD,MAAI,wBAAwB,gCAAgC;AAG1D,WAAO,EAAE,MAAM,cAAc,iBAAiB,IAAI,QAAQ,4BAA4B;AAAA,EACxF;AACA,MAAI,wBAAwB,kCAAkC;AAC5D,WAAO;AAAA,MACL,MAAM;AAAA,MACN,iBAAiB,aAAa;AAAA,MAC9B,QAAQ;AAAA,IACV;AAAA,EACF;AAEA,MAAI,wBAAwB,KAAK,EAAG,QAAO;AAK3C,MAAI,eAAwB;AAC5B,WAAS,QAAQ,GAAG,QAAQ,KAAK,gBAAgB,OAAO,iBAAiB,UAAU,SAAS,GAAG;AAC7F,QAAI,wBAAwB,sBAAsB;AAChD,aAAO,EAAE,MAAM,QAAQ,iBAAiB,KAAK;AAAA,IAC/C;AACA,mBAAgB,aAAyC;AAAA,EAC3D;AAIA,MAAI,CAAC,sBAAsB,KAAK,GAAG;AACjC,WAAO;AAAA,EACT;AAIA,MAAI,kCAAkC,KAAK,GAAG;AAC5C,WAAO;AAAA,EACT;AACA,QAAM,aAAa,6BAA6B,KAAK;AACrD,MAAI,YAAY;AACd,WAAO,EAAE,MAAM,SAAS,iBAAiB,WAAW,gBAAgB;AAAA,EACtE;AACA,MAAI,MAAe;AACnB,WAAS,QAAQ,GAAG,QAAQ,KAAK,OAAO,OAAO,QAAQ,UAAU,SAAS;AACxE,UAAM,QAAQ;AACd,UAAM,OACJ,MAAM,SAAS,OAAO,MAAM,UAAU,WACjC,MAAM,QACP;AACN,UAAM,SAAS,OAAO,MAAM,UAAU,MAAM,cAAc,MAAM,UAAU,MAAM,UAAU;AAC1F,UAAM,OAAO,OAAO,MAAM,QAAQ,MAAM,QAAQ,EAAE,EAAE,YAAY;AAChE,UAAM,mBAAmB;AAAA,MACvB,MAAM,uBAAuB,MAAM,uBAAuB,MAAM;AAAA,IAClE;AACA,UAAM,mBACJ,YAAY,MAAM,SAAS,aAAa,KACxC,YAAY,MAAM,iBAAiB,aAAa,KAChD,YAAY,MAAM,SAAS,aAAa;AAC1C,UAAM,mBAAmB,qBAAqB,OAAO,OAAO,MAAM,OAAO,gBAAgB;AACzF,UAAM,iBACJ,qBAAqB,QAAQ,CAAC,OAAO,SAAS,gBAAgB,IAC1D,KAAK,MAAM,gBAAgB,IAC3B,OAAO;AACb,UAAM,aAAa,OAAO,SAAS,gBAAgB,IAC/C,mBACA,OAAO,SAAS,gBAAgB,IAC9B,mBACA,OAAO,SAAS,cAAc,IAC5B,KAAK,IAAI,IAAI,iBAAiB,KAAK,IAAI,KAAK,GAAI,IAChD,OAAO;AACf,UAAM,kBACJ,OAAO,SAAS,UAAU,KAAK,aAAa,IAAI,KAAK,KAAK,UAAU,IAAI;AAI1E,QACE,SAAS,wBACT,SAAS,oBACT,SAAS,8BACT;AACA,aAAO,EAAE,MAAM,SAAS,gBAAgB;AAAA,IAC1C;AACA,QAAI,WAAW,OAAO,SAAS,kBAAkB,SAAS,mBAAmB;AAC3E,aAAO,EAAE,MAAM,QAAQ,gBAAgB;AAAA,IACzC;AACA,QAAI,WAAW,KAAK;AAClB,aAAO,EAAE,MAAM,aAAa,gBAAgB;AAAA,IAC9C;AACA,QAAI,WAAW,OAAO,SAAS,yBAAyB,SAAS,qBAAqB;AACpF,aAAO,EAAE,MAAM,cAAc,gBAAgB;AAAA,IAC/C;AACA,UAAM,MAAM;AAAA,EACd;AACA,SAAO;AACT;AAGO,SAAS,oBAAoB,iBAAwC;AAC1E,MAAI,oBAAoB,QAAQ,CAAC,OAAO,SAAS,eAAe,KAAK,mBAAmB,GAAG;AACzF,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,KAAK,KAAK,eAAe;AACvC,MAAI,QAAQ,IAAI;AACd,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,KAAK,MAAM,QAAQ,IAAI;AACrC,QAAM,UAAU,KAAK,MAAO,QAAQ,OAAQ,EAAE;AAC9C,MAAI,QAAQ,GAAG;AACb,WAAO,UAAU,IAAI,YAAY,KAAK,KAAK,OAAO,MAAM,YAAY,KAAK;AAAA,EAC3E;AACA,SAAO,YAAY,OAAO;AAC5B;AAOO,SAAS,8BACd,MACA,QACA,MACoE;AAGpE,QAAM,QAAQ,MAAM,cAChB,8EAA8E,oBAAoB,KAAK,eAAe,CAAC,6GAEvH,+EAA+E,oBAAoB,KAAK,eAAe,CAAC;AAE5H,SAAO;AAAA,IACL;AAAA,IACA,MAAM;AAAA,IACN,WAAW;AAAA,IACX,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,EAC7B;AACF;AAKO,IAAM,kCAAkC,KAAK;AAc7C,SAAS,4BACd,OACA,SAC6B;AAC7B,MAAI,wBAAwB,KAAK,EAAG,QAAO;AAC3C,MAAI,UAAmB;AACvB,WAAS,QAAQ,GAAG,QAAQ,KAAK,mBAAmB,OAAO,SAAS;AAClE,QAAI,mBAAmB,oCAAqC,QAAO,EAAE,MAAM,eAAe;AAC1F,QAAI,mBAAmB,uBAAuB;AAC5C,UAAI,CAAC,QAAQ,aAAc,QAAO;AAClC,UAAI,QAAQ,WAAW,IAAK,QAAO,EAAE,MAAM,eAAe;AAC1D,UAAI,QAAQ,WAAW;AACrB,eAAO;AAAA,UACL,MAAM;AAAA,UACN,cAAc,qBAAqB,OAAO;AAAA,UAC1C,GAAI,YAAY,SAAY,CAAC,IAAI,EAAE,QAAQ;AAAA,QAC7C;AACF,UAAI,QAAQ,WAAW,OAAO,QAAQ,cAAc;AAClD,eAAO,EAAE,MAAM,aAAa;AAC9B,UAAI,QAAQ,WAAW,IAAK,QAAO,EAAE,MAAM,QAAQ;AACnD,aAAO;AAAA,IACT;AACA,cAAU,QAAQ;AAAA,EACpB;AACA,SAAO;AACT;","names":["delegation","readTurnExecutionPolicyV1","goalRunBudgetBlocked","readTurnExecutionPolicyV1","isDeepStrictEqual","createHash","getConnectionMetadata","sleep","delayMs","parent","getConnectionMetadata","isDeepStrictEqual","settled","obligation","objectAcl","createHash","version","aclRevision","bytes","url","payload","label","getSessionTurn","subscriptionCoreProvider","readTurnExecutionPolicyV1","subscriptionCoreProvider","subscriptionCoreProvider","mergeToolRefs","getSessionTurn","readTurnExecutionPolicyV1","subscriptionCoreProvider","armSubscriptionCoreCapacityWait","getSubscriptionCoreCapacityWaitById","readSubscriptionCoreTurnModel","reconcileSubscriptionCoreCapacityWait","SUBSCRIPTION_CORE_XAI","subscriptionCoreTurns","wakeSubscriptionCoreProviderCapacityWaiters","deliverSubscriptionCoreProviderWake","subscriptionCoreOperationConnections","subscriptionCorePersonalConnections","CORE_SUBSCRIPTION_SERVICE_SUBJECT","SUBSCRIPTION_CORE_XAI","armSubscriptionCoreCapacityWait","getSubscriptionCoreCapacityWaitById","readSubscriptionCoreTurnModel","subscriptionCoreTurns","wakeSubscriptionCoreProviderCapacityWaiters","reconcileSubscriptionCoreCapacityWait","createHash","isDeepStrictEqual","label","getScheduledTaskRunAcceptedExecution","requireSession","requireWorkspace","resolveSessionFirstPartyMcpTools","resolveSessionFirstPartyMcpTools","requireWorkspace","requireSession","getScheduledTaskRunAcceptedExecution","token","randomUUID","retryDelayMs","SandboxLeaseTransitionError","CancelledFailure","readTurnExecutionPolicyV1","createHash","readTurnExecutionPolicyV1","createHash","clone","CancelledFailure","SandboxLeaseTransitionError","quota"]}