@productbrain/cli 0.1.0-beta.14 → 0.1.0-beta.14010

package/dist/lib/client.d.ts

@@ -1,39 +1,69 @@
 /**
  * MCP HTTP client — POST to Convex gateway with Bearer auth.
  *
- * TEN-729: Detects sandbox-blocked fetch (Claude Code, Cursor, etc.) and
- * provides an actionable error instead of the opaque "fetch failed".
+ * TEN-729: Detects sandbox-blocked fetch (Claude Code, Cursor, etc.) and provides an
+ * actionable error instead of the opaque "fetch failed".
  *
- * Sandbox proxy support: Node.js fetch (undici) ignores proxy env vars by
- * default. We detect HTTPS_PROXY and configure a ProxyAgent so pb works in
- * sandboxed environments (Claude Code, Cursor) without requiring
- * NODE_OPTIONS="--use-env-proxy".
+ * Sandbox proxy support: Node.js fetch (undici) ignores proxy env vars by default. We detect
+ * HTTPS_PROXY and configure a ProxyAgent so pb works in sandboxed environments (Claude Code,
+ * Cursor) without requiring NODE_OPTIONS="--use-env-proxy".
  */
-/** Structured field-level detail from a VALIDATION_FAILED response. */
-export interface ValidationErrorDetail {
-    fieldKey: string;
-    fieldLabel: string;
-    invalidValue: unknown;
-    validOptions?: string[];
-    errorType: 'type_mismatch' | 'invalid_option' | 'required';
-    message: string;
-}
-/** Error thrown by mcpCall/mcpCallWithSession when the server returns a non-OK response. */
-export declare class McpError extends Error {
+import type { ValidationErrorDetail } from './kernelEnvelope.js';
+import { CLIError } from './errors.js';
+import { type KernelCallOptions } from './rate-limit.js';
+export declare function isPerEntryAuthorizationRefusal(code?: string): boolean;
+/** Error thrown by kernelCall/kernelCallWithSession when the server returns a non-OK response. */
+export declare class McpError extends CLIError {
     details?: ValidationErrorDetail[];
-    code?: string;
-    constructor(message: string, code?: string, details?: ValidationErrorDetail[]);
+    /** Present only when code === 'rate-limited' — seconds until the caller may retry. */
+    retryAfterSeconds?: number;
+    missingRequiredFields?: string[];
+    constructor(message: string, code?: string, details?: ValidationErrorDetail[], retryAfterSeconds?: number, missingRequiredFields?: string[]);
 }
-export declare function mcpCall<T = unknown>(fn: string, args?: Record<string, unknown>): Promise<T>;
+export { resetRateLimitBackoff, resetTouchThrottle, type KernelCallOptions } from './rate-limit.js';
+export type { KernelEnvelope, ValidationErrorDetail } from './kernelEnvelope.js';
+/** Result of validateKey — used by `pb login` to verify a key before saving. */
+export type ValidateKeyResult = {
+    valid: true;
+    workspaceId: string;
+} | {
+    valid: false;
+    error: string;
+};
 /**
- * mcpCall variant that injects X-Agent-Session-Id header for write operations.
- * All write commands (update, relate, unrelate, capture) should use this.
+ * Validate an API key against the server before saving it.
+ * Uses `resolveWorkspace` as a lightweight health check — if it returns data, the key works.
+ *
+ * Returns { valid: true, workspaceId } on success.
+ * Returns { valid: false, error } on auth failure (401) or other server error.
+ * Throws on network/timeout errors so the caller can distinguish "bad key" from "can't reach server".
  *
- * After a successful write, fires a non-blocking `agent.touchSession` call to
- * renew the session TTL — mirroring MCP server behavior (DEC-299, BET-181 Slice 1).
- * The touch is fire-and-forget: it does not block the write response, and errors
- * are silently swallowed. No touch is attempted if no session is active or if
- * the write itself fails.
+ * WP-575: `timeoutMs` now DEFAULTS to `resolveWorkspace`'s declared budget instead of a
+ * local `5000` literal — that literal was the last connector-owned timeout on the gateway
+ * path, and the point of this work package is that no connector gets to pick its own. It
+ * stays an explicit parameter so a caller (or a test) can still override deliberately.
+ * Widening 5s -> the declared 10s costs nothing in the case people actually hit: an
+ * unreachable host fails with ECONNREFUSED/ENOTFOUND immediately, not by timeout. The
+ * timeout only governs a server that ACCEPTS the connection then stalls, where waiting the
+ * route's real declared budget before calling the key invalid is the correct behavior.
+ */
+export declare function validateKey(apiKey: string, siteUrl: string, timeoutMs?: number): Promise<ValidateKeyResult>;
+/** Get a human-friendly spinner label for an MCP function name; a route with a CLI command word names it (DEC-2441). */
+export declare function spinnerLabel(fn: string): string;
+/**
+ * POST to the admin gateway (/api/admin) — separate from /api/aki (STD-101, BR-109).
+ * Admin operations are not knowledge operations — they target the operator surface.
+ *
+ * No built-in spinner: callers wrap with withSpinner when appropriate.
+ * Throws CLIError on auth failure or non-OK response.
+ */
+export declare function adminCall(command: string, args?: Record<string, unknown>): Promise<unknown>;
+/**
+ * Headers every gateway request carries: connector identity and the command it serves. TASK-894 (DEC-2113):
+ * `sessionId` rides as `x-pb-session` and the gateway touches that session, so no second request does.
+ * TASK-1352: `actingSessionId` rides as `x-pb-acting-session` on every request, so the call log row names its session and role.
  */
-export declare function mcpCallWithSession<T = unknown>(fn: string, args?: Record<string, unknown>): Promise<T>;
+export declare function gatewayHeaders(apiKey: string, sessionId?: string, actingSessionId?: string): Record<string, string>;
+export declare function kernelCall<T = unknown>(fn: string, args?: Record<string, unknown>, options?: KernelCallOptions): Promise<T>;
+export declare function kernelCallWithSession<T = unknown>(fn: string, args?: Record<string, unknown>, options?: KernelCallOptions): Promise<T>;
 //# sourceMappingURL=client.d.ts.map

package/dist/lib/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,uEAAuE;AACvE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,eAAe,GAAG,gBAAgB,GAAG,UAAU,CAAC;IAC3D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,4FAA4F;AAC5F,qBAAa,QAAS,SAAQ,KAAK;IACjC,OAAO,CAAC,EAAE,qBAAqB,EAAE,CAAC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;gBAEF,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,EAAE;CAM9E;AAuCD,wBAAsB,OAAO,CAAC,CAAC,GAAG,OAAO,EACvC,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,CAAC,CAAC,CAsBZ;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,GAAG,OAAO,EAClD,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,CAAC,CAAC,CAoCZ"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAaH,OAAO,KAAK,EAAkB,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAMjF,OAAO,EAAE,QAAQ,EAAiC,MAAM,aAAa,CAAC;AAGtE,OAAO,EAAkC,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAoBzF,wBAAgB,8BAA8B,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAErE;AA8CD,kGAAkG;AAClG,qBAAa,QAAS,SAAQ,QAAQ;IACpC,OAAO,CAAC,EAAE,qBAAqB,EAAE,CAAC;IAClC,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;gBAEjD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,EAAE,EAAE,iBAAiB,CAAC,EAAE,MAAM,EAAE,qBAAqB,CAAC,EAAE,MAAM,EAAE;CAe5I;AAGD,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAKpG,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAmDjF,gFAAgF;AAChF,MAAM,MAAM,iBAAiB,GACzB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,SAAS,SAA8C,GACtD,OAAO,CAAC,iBAAiB,CAAC,CAqC5B;AA4BD,wHAAwH;AACxH,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,OAAO,CAAC,CAqClB;AAkBD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAUnH;AAsED,wBAAsB,UAAU,CAAC,CAAC,GAAG,OAAO,EAC1C,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EAClC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,CAAC,CAAC,CAQZ;AAoBD,wBAAsB,qBAAqB,CAAC,CAAC,GAAG,OAAO,EACrD,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EAClC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,CAAC,CAAC,CAiBZ"}

package/dist/lib/client.js

@@ -1,27 +1,125 @@
 /**
  * MCP HTTP client — POST to Convex gateway with Bearer auth.
  *
- * TEN-729: Detects sandbox-blocked fetch (Claude Code, Cursor, etc.) and
- * provides an actionable error instead of the opaque "fetch failed".
+ * TEN-729: Detects sandbox-blocked fetch (Claude Code, Cursor, etc.) and provides an
+ * actionable error instead of the opaque "fetch failed".
  *
- * Sandbox proxy support: Node.js fetch (undici) ignores proxy env vars by
- * default. We detect HTTPS_PROXY and configure a ProxyAgent so pb works in
- * sandboxed environments (Claude Code, Cursor) without requiring
- * NODE_OPTIONS="--use-env-proxy".
+ * Sandbox proxy support: Node.js fetch (undici) ignores proxy env vars by default. We detect
+ * HTTPS_PROXY and configure a ProxyAgent so pb works in sandboxed environments (Claude Code,
+ * Cursor) without requiring NODE_OPTIONS="--use-env-proxy".
  */
+import { routeCommandWord } from './routeCommandWords.js'; // TASK-1352: one map with the close line (RULE-664)
+import { randomUUID } from 'node:crypto';
+// WP-575 (TEN-2917): every gateway call is bounded by the budget DECLARED at the route
+// contract — see ./gatewayTimeout.ts for why a copy, and why the CLI had none before.
+import { latencyBudgetMsForRoute } from '../generated/routeLatencyBudget.generated.js';
+import { ORGANISATIONAL_AUTHORITY_REFUSAL_CODES as ORGANISATIONAL_AUTHORITY_REFUSAL_CODES_LIST } from '../generated/organisationalAuthorityRefusalCodes.generated.js';
+import { gatewayTimeoutError, isTimeoutAbort } from './gatewayTimeout.js';
+// The envelope's shape and how to read one off a Response — including the body-phase budget
+// abort (WP-575 review). Split out under STD-2/DEC-1504; see ./kernelEnvelope.ts's header for
+// why the seam is real and not a line-count dodge.
+import { parseKernelEnvelope, recordLatestFromResponse, authorityFromDetails, askNextLine, questionDoorLines } from './kernelEnvelope.js';
 import { getConfig } from './config.js';
-import { readSession } from './session.js';
-/** Error thrown by mcpCall/mcpCallWithSession when the server returns a non-OK response. */
-export class McpError extends Error {
+import { resolveAdminConfig } from './adminConfig.js';
+import { emitEffectiveTenantNotice, describeCurrentTenantForRefusal, guardAdminCall } from './workspaceNotice.js';
+import { clearSession, readSession, readSessionBySessionId } from './session.js';
+import { assertSessionStillBound, fingerprintOf } from './sessionBinding.js';
+import { CLIError, ErrorCode, isEndedSessionCode } from './errors.js';
+import { withSpinner } from './spinner.js';
+import { maybeRetry, shouldTouchSession } from './rate-limit.js';
+/** Map MCP server error codes to CLIError categories. Keeps backward compat: McpError.code is
+ * still a free string from the server, but category and guidance are derived for the handler. */
+// WP-753 O5a fix round 1 (item 5/8): GENERATED from kernel/organisationalAuthority/types.ts's `OrganisationalAuthorityRefusal` union via generate-kernel-value-sets.mjs (no more hand-sync) — a thrown org-authority refusal (http.ts's category:'auth' branch) arrives as one of these, none 'AUTH'-prefixed, so it fell through to 'internal' (found live on O5a's own preview walk: pb unrelate showed the real reason but the wrong category).
+const ORGANISATIONAL_AUTHORITY_REFUSAL_CODES = new Set(ORGANISATIONAL_AUTHORITY_REFUSAL_CODES_LIST);
+// WP-753 O5a fix round 2 (MAJOR) + round 3: category 'auth' is right, but entryAccept.ts's batch
+// abort predicate conflated "fails every id identically" with "category is auth" — an
+// org-authority refusal is PER-ENTRY (entry B's ownership is unrelated to A/C), unlike a real
+// credential failure, so this is excluded from entryAccept.ts's GLOBAL_PRECONDITION_CATEGORIES
+// rethrow, keeping INS-1813's "one bad id never aborts the batch" true for 'auth' too — EXCEPT
+// the actor-wide codes (`actor_inactive`, `no_role`, `multi_role`), each a GLOBAL precondition (judge.ts:12 refuses on !facts.actorIsActive
+// before any entry-specific check, managementJudge.ts:16 same shape), which still aborts. No
+// `code === 'AUTHZ_PERMISSION_DENIED'` clause: it could never match (normalizeMcpCode below
+// folds every AUTHZ_* code to ErrorCode.AUTH_DENIED, errors.test.ts:121-123 asserts it).
+// Recorded gap, not fixed here (TEN-3687): the per-entry authority BLOCK on this same route
+// (entries.ts:2284-2289, no propose_change) also arrives as AUTH_DENIED and still aborts a
+// batch, since AUTH_DENIED is overloaded with genuinely global denials too (http.ts:896-899, :918-922) — no serverCode field to split them.
+const ACTOR_GLOBAL_REFUSALS = new Set(['actor_inactive', 'no_role', 'multi_role']);
+export function isPerEntryAuthorizationRefusal(code) {
+    return Boolean(code) && !ACTOR_GLOBAL_REFUSALS.has(code) && ORGANISATIONAL_AUTHORITY_REFUSAL_CODES.has(code);
+}
+function mcpCodeToCategory(code) {
+    if (!code)
+        return 'internal';
+    if (code.startsWith('AUTH') || code === 'UNAUTHORIZED' || ORGANISATIONAL_AUTHORITY_REFUSAL_CODES.has(code) || code === ErrorCode.ROLE_SWITCH_REFUSED)
+        return 'auth';
+    if (code === 'VALIDATION_FAILED' || code === 'QUALITY_GATE_BLOCKED' ||
+        code === 'GROUNDING_GATE_BLOCKED' || code === 'SEMANTIC_QUALITY_GATE_BLOCKED' || code === 'STRATEGY_SINGLETON_BLOCKED' ||
+        // WP-477 / FEAT-1350: both are 400s the caller fixes by changing an argument (pass the issued cursor verbatim / ask for a smaller numItems) — not internal faults.
+        code === 'CURSOR_QUERY_MISMATCH' || code === 'PAGE_SPLIT_REQUIRED' ||
+        // TEN-2647: Convex's own arg-validator rejection — a 400 the caller fixes by correcting the offending argument (missing/unknown/wrong-typed), not an internal fault.
+        code === 'ARGUMENT_VALIDATION_FAILED' || code === 'CHANGE_REASON_REQUIRED' || // TASK-381: the caller fixes it by passing --change-reason
+        // WP-494 (TEN-2742): `pb feedback submit` refused because the workspace switched off agent-submitted feedback — a policy gate, not an internal fault (mirrors the GATE_BLOCKED family above).
+        code === 'AGENT_FEEDBACK_DISABLED')
+        return 'validation';
+    if (code === 'SESSION_REQUIRED' || isEndedSessionCode(code) || code === ErrorCode.ORIENTATION_REQUIRED)
+        return 'session';
+    // TEN-656: per-key API quota — a 429 the caller fixes by WAITING, not by changing the
+    // call. Categorized as network so the global handler renders it as retryable, never
+    // as an internal fault.
+    if (code === 'rate-limited')
+        return 'network';
+    return 'internal';
+}
+function normalizeMcpCode(code) {
+    // Convex names the internal protocol condition; the public CLI exposes its stable,
+    // harness-independent error taxonomy to people and agents. WP-584 S4 review round 1 (P2-3):
+    // the WHOLE AUTHZ_* family maps here, not just AUTHZ_PERMISSION_DENIED — a narrower match let
+    // AUTHZ_INSUFFICIENT_ROLE (BR-227's own code, convex/http.ts's vendor-gate 403) fall through
+    // the `as` cast below and publish Convex's raw internal code as a real CLI ErrorCodeValue.
+    // Mirrors mcpCodeToCategory's own `code.startsWith('AUTH')` breadth, above.
+    if (code?.startsWith('AUTHZ_'))
+        return ErrorCode.AUTH_DENIED;
+    if (code === 'CHANGE_REASON_REQUIRED')
+        return ErrorCode.VALIDATION_FAILED; // TASK-381: caller-fixable
+    return code ?? ErrorCode.INTERNAL;
+}
+/** The command after the kernel's line for a session refusal: an ended session starts anew, an unoriented one orients. */
+function sessionGuidance(code) {
+    if (isEndedSessionCode(code))
+        return 'Run `pb session start` first.';
+    if (code === ErrorCode.ORIENTATION_REQUIRED)
+        return 'Run `pb orient --task "<your task>"` first.';
+    return undefined;
+}
+/** An authority refusal's guidance: who decides, then (TASK-1334) the ask line naming that role when the caller has no way in. */
+function authorityGuidance(details) {
+    return [authorityFromDetails(details)?.requiredAction, askNextLine(details)].filter(Boolean).join('\n') || undefined;
+}
+/** Error thrown by kernelCall/kernelCallWithSession when the server returns a non-OK response. */
+export class McpError extends CLIError {
     details;
-    code;
-    constructor(message, code, details) {
-        super(message);
+    /** Present only when code === 'rate-limited' — seconds until the caller may retry. */
+    retryAfterSeconds;
+    missingRequiredFields; // TASK-680 (TEN-4567): the fields an accept refusal names as data
+    constructor(message, code, details, retryAfterSeconds, missingRequiredFields) {
+        // TASK-1373: a capture refused as a question reads this surface's line, then the question door.
+        super(questionDoorLines(details)?.line ?? message, {
+            code: normalizeMcpCode(code),
+            category: mcpCodeToCategory(code),
+            // TEN-656 / TEN-2655: the rate-limit refusal must be agent-legible — say exactly what to
+            // do (wait, then retry unchanged), because autonomous chained runs have no human to interpret a bare 429.
+            guidance: code === 'rate-limited'
+                ? 'This API key hit its request quota (HTTP 429). Wait the number of seconds in the message (also in the Retry-After header), then retry the same call unchanged — it is safe to retry.'
+                : questionDoorLines(details)?.next ?? sessionGuidance(code) ?? authorityGuidance(details), authority: authorityFromDetails(details), // who decides, from a thrown authority refusal's details
+        });
         this.name = 'McpError';
-        this.code = code;
         this.details = details;
+        this.retryAfterSeconds = retryAfterSeconds;
+        this.missingRequiredFields = missingRequiredFields;
     }
 }
+// WP-579: the rate-limit retry and touch throttle live in rate-limit.ts — self-contained policies with their own state, kept out of this module's budget (STD-2).
+export { resetRateLimitBackoff, resetTouchThrottle } from './rate-limit.js';
 // Configure proxy at module load — runs once, before any fetch call.
 // Node.js fetch (undici) ignores HTTPS_PROXY env vars. We detect the proxy
 // and install a ProxyAgent as the global dispatcher so all fetch() calls
@@ -37,90 +135,291 @@ catch {
     // undici unavailable or proxy config failed — rethrowWithGuidance handles it.
 }
 /** Detect a sandbox/network-blocked fetch and re-throw with guidance. */
-function rethrowWithGuidance(err, siteUrl) {
+function rethrowWithGuidance(err, siteUrl, 
+// WP-575: the route being called, the budget it was given, and the call's own args, so a
+// budget abort can be reported as itself rather than collapsing into "Could not reach
+// <host>" — and so a dry run is never told its write may have landed (see ./gatewayTimeout.ts).
+route) {
     const msg = err instanceof Error ? err.message : String(err);
+    // WP-575: a budget abort is not an unreachable host — the connection succeeded, we stopped
+    // waiting, and for a write route the server may have finished. See ./gatewayTimeout.ts.
+    if (route && isTimeoutAbort(err))
+        throw gatewayTimeoutError(route.fn, route.budgetMs, route.args);
     if (msg === 'fetch failed' || msg.includes('ECONNREFUSED') || msg.includes('ENOTFOUND')) {
         const host = new URL(siteUrl).hostname;
         const proxy = process.env.https_proxy || process.env.HTTPS_PROXY;
-        // When a proxy is set, the sandbox is routing traffic through it.
-        // Node.js fetch (undici) does NOT respect proxy env vars by default.
-        // The fix is --use-env-proxy (Node 22.14+), not adding the host to the allowlist.
         const proxyHint = proxy
             ? `A proxy is configured (${proxy}) but Node.js fetch() is not using it.\n` +
                 `Fix: set NODE_OPTIONS="--use-env-proxy" in your environment,\n` +
-                `  or re-run with: NODE_OPTIONS="--use-env-proxy" pb <command>\n`
+                `  or re-run with: NODE_OPTIONS="--use-env-proxy" pb <command>`
             : `If you are running inside an AI code editor sandbox (Claude Code, Cursor, etc.),\n` +
                 `the sandbox may be blocking outbound connections.\n\n` +
                 `Fix: add "${host}" to your sandbox network allowlist.\n` +
-                `  • Claude Code: run /sandbox → add network host\n` +
-                `  • Or re-run: pb handshake --init (configures sandbox automatically)\n`;
-        throw new Error(`Could not reach ${host}.\n\n${proxyHint}`);
+                `  - Claude Code: run /sandbox -> add network host`;
+        throw new CLIError(`Could not reach ${host}.`, {
+            code: ErrorCode.NETWORK_UNREACHABLE,
+            category: 'network',
+            guidance: proxyHint,
+        });
     }
     throw err;
 }
-export async function mcpCall(fn, args = {}) {
-    const { apiKey, siteUrl } = getConfig();
+/**
+ * Validate an API key against the server before saving it.
+ * Uses `resolveWorkspace` as a lightweight health check — if it returns data, the key works.
+ *
+ * Returns { valid: true, workspaceId } on success.
+ * Returns { valid: false, error } on auth failure (401) or other server error.
+ * Throws on network/timeout errors so the caller can distinguish "bad key" from "can't reach server".
+ *
+ * WP-575: `timeoutMs` now DEFAULTS to `resolveWorkspace`'s declared budget instead of a
+ * local `5000` literal — that literal was the last connector-owned timeout on the gateway
+ * path, and the point of this work package is that no connector gets to pick its own. It
+ * stays an explicit parameter so a caller (or a test) can still override deliberately.
+ * Widening 5s -> the declared 10s costs nothing in the case people actually hit: an
+ * unreachable host fails with ECONNREFUSED/ENOTFOUND immediately, not by timeout. The
+ * timeout only governs a server that ACCEPTS the connection then stalls, where waiting the
+ * route's real declared budget before calling the key invalid is the correct behavior.
+ */
+export async function validateKey(apiKey, siteUrl, timeoutMs = latencyBudgetMsForRoute('resolveWorkspace')) {
+    return withSpinner('Validating API key', async () => {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        try {
+            const res = await fetch(`${siteUrl}/api/aki`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    Authorization: `Bearer ${apiKey}`,
+                },
+                body: JSON.stringify({ fn: 'resolveWorkspace', args: {} }),
+                signal: controller.signal,
+            });
+            clearTimeout(timer);
+            // Record header BEFORE the 401/403 short-circuit — auth-fail responses still carry the version skew signal.
+            recordLatestFromResponse(res);
+            if (res.status === 401 || res.status === 403) {
+                return { valid: false, error: 'Invalid API key.' };
+            }
+            const envelope = await parseKernelEnvelope(res);
+            if (!res.ok || envelope.ok === false) {
+                return { valid: false, error: envelope.message || envelope.error || `Server error (${res.status})` };
+            }
+            return { valid: true, workspaceId: envelope.data?._id ?? 'unknown' };
+        }
+        catch (err) {
+            clearTimeout(timer);
+            // Re-throw network/timeout errors — caller handles the "offline" case
+            throw err;
+        }
+    });
+}
+/**
+ * Map MCP function names to human-friendly spinner labels.
+ * Unknown functions get a generic fallback.
+ */
+const SPINNER_LABELS = {
+    orient: 'Loading workspace overview',
+    'entries.get': 'Loading entry',
+    'entries.search': 'Searching entries',
+    'entries.create': 'Creating entry',
+    'entries.update': 'Updating entry',
+    'capture-quick': 'Capturing to Chain',
+    'propose-capture': 'Preparing capture',
+    'commit-entry': 'Accepting entry',
+    'agent.startSession': 'Starting session',
+    'agent.closeSession': 'Closing session',
+    'agent.touchSession': 'Refreshing session',
+    resolveWorkspace: 'Resolving workspace',
+    context: 'Loading context',
+    'entries.relate': 'Creating relation',
+    'entries.unrelate': 'Removing relation',
+    constellation: 'Loading constellation',
+    'conflicts.list': 'Loading open conflicts',
+    'conflicts.resolve': 'Recording verdict',
+    'conflicts.summary': 'Loading precision summary',
+};
+/** Get a human-friendly spinner label for an MCP function name; a route with a CLI command word names it (DEC-2441). */
+export function spinnerLabel(fn) {
+    return SPINNER_LABELS[fn] || (routeCommandWord(fn) !== fn ? `Running ${routeCommandWord(fn)}` : `Loading ${fn.replace(/\./g, ' ')}`);
+}
+/**
+ * POST to the admin gateway (/api/admin) — separate from /api/aki (STD-101, BR-109).
+ * Admin operations are not knowledge operations — they target the operator surface.
+ *
+ * No built-in spinner: callers wrap with withSpinner when appropriate.
+ * Throws CLIError on auth failure or non-OK response.
+ */
+export async function adminCall(command, args) {
+    const { apiKey, siteUrl, source, profileName } = resolveAdminConfig();
+    // TEN-3398 (follow-up): `pb admin` previously carried neither the notice nor the binding
+    // guard — see workspaceNotice.ts's `guardAdminCall` doc comment for the full story.
+    guardAdminCall({ profileName, source }, boundSessionFor(args ?? {}), fingerprintOf(apiKey, siteUrl));
+    // WP-575 deliberately leaves /api/admin UNBOUNDED (PR #533 review, Codex P2 — an earlier
+    // round bounded it and that was the regression). Admin commands are long-running BULK
+    // operations (`manage:delete-workspace` cascading 100-row batches, `seed:backfill-starter`
+    // across workspaces) and are NOT in the route registry, so the fail-safe "widest" fallback
+    // is a real number for a route the contract describes and a guess for one it doesn't —
+    // an arbitrary ceiling on a destructive operation that can abort it mid-flight, which is
+    // worse than the hang it would prevent. (That fallback is whatever
+    // WIDEST_ROUTE_LATENCY_BUDGET_MS happens to be — today 330_000, since it spans the override
+    // table too — which is the point: a number that MOVES when an unrelated route's override
+    // changes is not a budget for this surface.) It needs its own MEASURED budget: follow-up work.
     let res;
     try {
-        res = await fetch(`${siteUrl}/api/mcp`, {
+        res = await fetch(`${siteUrl}/api/admin`, {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
                 Authorization: `Bearer ${apiKey}`,
             },
-            body: JSON.stringify({ fn, args }),
+            body: JSON.stringify({ command, args }),
         });
     }
     catch (err) {
         rethrowWithGuidance(err, siteUrl);
     }
-    const json = (await res.json());
-    if (!res.ok || json.error) {
-        throw new McpError(json.error ?? res.statusText, json.code, json.details);
+    const response = (await res.json().catch(() => ({})));
+    if (response.ok === false || (!res.ok && response.ok == null)) {
+        // TASK-1173: a person-only refusal carries its next step in details, printed under the reason.
+        throw new McpError((response.message ?? response.error ?? res.statusText) || 'Admin request failed', response.code, response.details);
     }
-    return json.data;
+    return response.data;
 }
 /**
- * mcpCall variant that injects X-Agent-Session-Id header for write operations.
- * All write commands (update, relate, unrelate, capture) should use this.
- *
- * After a successful write, fires a non-blocking `agent.touchSession` call to
- * renew the session TTL — mirroring MCP server behavior (DEC-299, BET-181 Slice 1).
- * The touch is fire-and-forget: it does not block the write response, and errors
- * are silently swallowed. No touch is attempted if no session is active or if
- * the write itself fails.
+ * Connector identity for the gateway's context.served shared seam (DEC-1207). Sent as the
+ * `x-pb-source` header on gateway calls so the server-side emit can attribute this connector;
+ * the gateway defaults to `api` if it is ever absent.
  */
-export async function mcpCallWithSession(fn, args = {}) {
-    const { apiKey, siteUrl } = getConfig();
-    const session = readSession();
-    const headers = {
+const PB_TELEMETRY_SOURCE = 'cli';
+/**
+ * TASK-893 (WP-849): one id per process, which is one user command, sent as `x-pb-command` so the
+ * gateway's query metric can count the requests and seconds behind each command.
+ */
+const PB_COMMAND_ID = randomUUID();
+/** TASK-1408: the start's own routes carry no touch; the seat they open is touched by the start itself. */
+const SESSION_OPEN_ROUTES = new Set(['agent.startSession', 'agent.resumeSession', 'agent.sessionStartNotes', 'agent.sessionStartStamp']);
+/**
+ * Headers every gateway request carries: connector identity and the command it serves. TASK-894 (DEC-2113):
+ * `sessionId` rides as `x-pb-session` and the gateway touches that session, so no second request does.
+ * TASK-1352: `actingSessionId` rides as `x-pb-acting-session` on every request, so the call log row names its session and role.
+ */
+export function gatewayHeaders(apiKey, sessionId, actingSessionId) {
+    return {
         'Content-Type': 'application/json',
         Authorization: `Bearer ${apiKey}`,
+        // DEC-1207: attribute this connector for the gateway's context.served seam.
+        'x-pb-source': PB_TELEMETRY_SOURCE,
+        'x-pb-command': PB_COMMAND_ID,
+        ...(sessionId ? { 'x-pb-session': sessionId } : {}),
+        ...(actingSessionId ? { 'x-pb-acting-session': actingSessionId } : {}),
     };
-    if (session?.sessionId) {
-        headers['X-Agent-Session-Id'] = session.sessionId;
-    }
-    let res;
+}
+/**
+ * Resolve the session to check the binding guard against: the ambient marker, unless `args`
+ * names a DIFFERENT session explicitly (TEN-3315 — e.g. `pb rework report --conversation A`
+ * selects a session other than the ambient one, and judging the ambient marker there would
+ * judge the wrong session). No extra IO on the ordinary path: the lookup only runs when an
+ * explicit id names a session different from the ambient marker.
+ */
+function boundSessionFor(args) {
+    const session = readSession();
+    const explicitSessionId = typeof args.sessionId === 'string' ? args.sessionId : null;
+    return explicitSessionId && explicitSessionId !== session?.sessionId
+        ? readSessionBySessionId(explicitSessionId)
+        : session;
+}
+/**
+ * The ONE gateway fetch every kernelCall path routes through (WP-711/712). Resolves config,
+ * runs the binding guard, POSTs to /api/aki, and returns the raw envelope.
+ *
+ * Before this slice only kernelCallWithSession ran assertSessionStillBound, so a moved tenant
+ * pin refused writes but not reads: `pb get`/`search`/`orient`/`context`/`brief`/`constellation`
+ * all go through plain kernelCall and silently followed a repointed pin. Two write commands
+ * (migrate-setup.ts, setup-ingest.ts) send their writes through plain kernelCall too and had
+ * each hand-duplicated the same guard call to cover that gap — exactly the "N copies of the pin
+ * cascade" shape WP-692's TEN-3239 warned about. Folding the check in here removes all three
+ * duplicates; every caller, read or write, now shares this one call site.
+ */
+async function fetchKernelEnvelope(fn, args, options, touchSessionId) {
+    const { apiKey, siteUrl } = getConfig();
+    // The ONE guard call site. `describeCurrentTenantForRefusal()` only runs inside the thunk, so
+    // it costs nothing on the ordinary (no session, or unchanged binding) path — invoked only
+    // once the guard has already decided to refuse. WP-715: names the credential ACTUALLY in
+    // play (sees an env/local/cwd-key override), never the pin it may shadow — see that
+    // function's doc comment in workspaceNotice.ts.
+    const bound = boundSessionFor(args);
+    assertSessionStillBound(bound, undefined, describeCurrentTenantForRefusal);
+    const label = spinnerLabel(fn);
+    const budgetMs = latencyBudgetMsForRoute(fn);
+    // Spinner OUTSIDE the retry: withSpinner reports a terminal `— failed` line on any throw,
+    // so a spinner per attempt would paint a false failure for a call that ultimately succeeds.
+    const envelope = await withSpinner(label, () => maybeRetry(async () => {
+        let res;
+        try {
+            res = await fetch(`${siteUrl}/api/aki`, {
+                method: 'POST',
+                signal: AbortSignal.timeout(budgetMs),
+                headers: gatewayHeaders(apiKey, touchSessionId, options?.actingSessionId ?? bound?.sessionId),
+                body: JSON.stringify(options?.recall ? { fn, args, recall: true } : { fn, args }), // TASK-911: a read-back
+            });
+        }
+        catch (err) {
+            rethrowWithGuidance(err, siteUrl, { fn, budgetMs, args });
+        }
+        const parsed = await parseKernelEnvelope(res, { fn, budgetMs, args });
+        if (!res.ok || parsed.ok === false) {
+            throw new McpError(parsed.message || parsed.error || res.statusText, parsed.code, parsed.details, parsed.retryAfterSeconds, Reflect.get(parsed, 'missingRequiredFields'));
+        }
+        return parsed;
+    }, options));
+    return envelope;
+}
+export async function kernelCall(fn, args = {}, options) {
+    // TASK-911 (DEC-2201): a read-back always names the ambient session, so the kernel can tell a later session's read. TASK-1408
+    // (INS-3420): every other call names it too, throttled like a write's touch, so read-only work keeps the seat live.
+    const ambient = readSession()?.sessionId;
+    const touch = options?.recall ? ambient : ambient && !options?.skipSessionTouch && !SESSION_OPEN_ROUTES.has(fn) && shouldTouchSession(ambient) ? ambient : undefined;
+    const envelope = await fetchKernelEnvelope(fn, args, options, touch);
+    await emitEffectiveTenantNotice(); // WP-714 S3: the read path announces too (once/process).
+    return envelope.data;
+}
+/**
+ * kernelCall variant for write operations. Callers that need server-side session
+ * validation (e.g. `chain.verifyEntry`) pass `sessionId` in `args` explicitly —
+ * it now travels in the request body, not a header (http.ts never read the old
+ * `X-Agent-Session-Id` header).
+ * All write commands (update, relate, unrelate, capture) should use this.
+ *
+ * WP-711/712: the binding guard lives in the shared fetchKernelEnvelope.
+ * TASK-894 (DEC-2113): the write carries the ambient session as `x-pb-session` and the gateway renews it
+ * (DEC-299, BET-181 Slice 1), so no second request follows the write. Throttled to the server's own 5 s
+ * no-op window (TEN-2923); `skipSessionTouch` opts a --dry-run-style caller out (WP-688 S2a, thread bb1oj).
+ */
+/** The session a write names: its `sessionId`, or the agent author `agent:<id>` an entry update sends as `changedBy`. */
+function sessionNamedBy(args) {
+    if (typeof args.sessionId === 'string')
+        return args.sessionId;
+    return typeof args.changedBy === 'string' && args.changedBy.startsWith('agent:') ? args.changedBy.slice('agent:'.length) : undefined;
+}
+export async function kernelCallWithSession(fn, args = {}, options) {
+    // The ambient marker, never `boundSessionFor(args)`: the touch renews the session actually in play locally.
+    const session = readSession();
+    const touch = !options?.skipSessionTouch && session?.sessionId && shouldTouchSession(session.sessionId) ? session.sessionId : undefined;
+    let envelope;
     try {
-        res = await fetch(`${siteUrl}/api/mcp`, {
-            method: 'POST',
-            headers,
-            body: JSON.stringify({ fn, args }),
-        });
+        envelope = await fetchKernelEnvelope(fn, args, options, touch);
     }
     catch (err) {
-        rethrowWithGuidance(err, siteUrl);
-    }
-    const json = (await res.json());
-    if (!res.ok || json.error) {
-        throw new McpError(json.error ?? res.statusText, json.code, json.details);
-    }
-    // Fire-and-forget session touch — best-effort, never blocks the write response.
-    // Only touch when a session is active. Uses mcpCall (not mcpCallWithSession) to
-    // avoid recursion.
-    if (session?.sessionId) {
-        mcpCall('agent.touchSession', { sessionId: session.sessionId }).catch(() => { });
+        // The kernel says the session ended. Close the marker that still names it, so the next `pb session start`
+        // resumes linked to it; re-read first, since another command may have replaced the marker while this call ran.
+        const named = sessionNamedBy(args);
+        if (err instanceof McpError && isEndedSessionCode(err.code) && named && readSession()?.sessionId === named)
+            clearSession();
+        throw err;
     }
-    return json.data;
+    // TEN-3398 (follow-up): the write path announces too — see workspaceNotice.ts's emitEffectiveTenantNotice.
+    await emitEffectiveTenantNotice();
+    return envelope.data;
 }
 //# sourceMappingURL=client.js.map

package/dist/lib/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAY3C,4FAA4F;AAC5F,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,OAAO,CAA2B;IAClC,IAAI,CAAU;IAEd,YAAY,OAAe,EAAE,IAAa,EAAE,OAAiC;QAC3E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,qEAAqE;AACrE,2EAA2E;AAC3E,yEAAyE;AACzE,iDAAiD;AACjD,IAAI,CAAC;IACH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAClE,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,UAAU,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnE,mBAAmB,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAAC,MAAM,CAAC;IACP,8EAA8E;AAChF,CAAC;AAED,yEAAyE;AACzE,SAAS,mBAAmB,CAAC,GAAY,EAAE,OAAe;IACxD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,GAAG,KAAK,cAAc,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;QACvC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QACjE,kEAAkE;QAClE,qEAAqE;QACrE,kFAAkF;QAClF,MAAM,SAAS,GAAG,KAAK;YACrB,CAAC,CAAC,0BAA0B,KAAK,0CAA0C;gBACzE,gEAAgE;gBAChE,iEAAiE;YACnE,CAAC,CAAC,oFAAoF;gBACpF,uDAAuD;gBACvD,aAAa,IAAI,wCAAwC;gBACzD,oDAAoD;gBACpD,yEAAyE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,QAAQ,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,EAAU,EACV,OAAgC,EAAE;IAElC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;IAExC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;YACtC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmF,CAAC;IAClH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC,IAAS,CAAC;AACxB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAU,EACV,OAAgC,EAAE;IAElC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAE9B,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,aAAa,EAAE,UAAU,MAAM,EAAE;KAClC,CAAC;IACF,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,oBAAoB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IACpD,CAAC;IAED,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;YACtC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmF,CAAC;IAClH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5E,CAAC;IAED,gFAAgF;IAChF,gFAAgF;IAChF,mBAAmB;IACnB,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,IAAI,CAAC,IAAS,CAAC;AACxB,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC,CAAC,oDAAoD;AAC/G,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,uFAAuF;AACvF,sFAAsF;AACtF,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AACvF,OAAO,EAAE,sCAAsC,IAAI,2CAA2C,EAAE,MAAM,+DAA+D,CAAC;AACtK,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1E,4FAA4F;AAC5F,8FAA8F;AAC9F,mDAAmD;AACnD,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE1I,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,+BAA+B,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAClH,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAA0B,MAAM,iBAAiB,CAAC;AAEzF;iGACiG;AACjG,mbAAmb;AACnb,MAAM,sCAAsC,GAAG,IAAI,GAAG,CAAS,2CAA2C,CAAC,CAAC;AAE5G,iGAAiG;AACjG,sFAAsF;AACtF,8FAA8F;AAC9F,+FAA+F;AAC/F,+FAA+F;AAC/F,4IAA4I;AAC5I,6FAA6F;AAC7F,4FAA4F;AAC5F,yFAAyF;AACzF,4FAA4F;AAC5F,2FAA2F;AAC3F,4IAA4I;AAC5I,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AACnF,MAAM,UAAU,8BAA8B,CAAC,IAAa;IAC1D,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAc,CAAC,IAAI,sCAAsC,CAAC,GAAG,CAAC,IAAc,CAAC,CAAC;AACnI,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,UAAU,CAAC;IAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,cAAc,IAAI,sCAAsC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,SAAS,CAAC,mBAAmB;QAAE,OAAO,MAAM,CAAC;IACpK,IACE,IAAI,KAAK,mBAAmB,IAAI,IAAI,KAAK,sBAAsB;QAC/D,IAAI,KAAK,wBAAwB,IAAI,IAAI,KAAK,+BAA+B,IAAI,IAAI,KAAK,4BAA4B;QACtH,mKAAmK;QACnK,IAAI,KAAK,uBAAuB,IAAI,IAAI,KAAK,qBAAqB;QAClE,qKAAqK;QACrK,IAAI,KAAK,4BAA4B,IAAI,IAAI,KAAK,wBAAwB,IAAI,2DAA2D;QACzI,8LAA8L;QAC9L,IAAI,KAAK,yBAAyB;QAClC,OAAO,YAAY,CAAC;IACtB,IAAI,IAAI,KAAK,kBAAkB,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,SAAS,CAAC,oBAAoB;QAAE,OAAO,SAAS,CAAC;IACzH,sFAAsF;IACtF,oFAAoF;IACpF,wBAAwB;IACxB,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACtC,mFAAmF;IACnF,4FAA4F;IAC5F,8FAA8F;IAC9F,6FAA6F;IAC7F,2FAA2F;IAC3F,4EAA4E;IAC5E,IAAI,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC,WAAW,CAAC;IAAC,IAAI,IAAI,KAAK,wBAAwB;QAAE,OAAO,SAAS,CAAC,iBAAiB,CAAC,CAAC,2BAA2B;IACpK,OAAQ,IAAmC,IAAI,SAAS,CAAC,QAAQ,CAAC;AACnE,CAAC;AAED,0HAA0H;AAC1H,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO,+BAA+B,CAAC;IACrE,IAAI,IAAI,KAAK,SAAS,CAAC,oBAAoB;QAAE,OAAO,6CAA6C,CAAC;IAClG,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,kIAAkI;AAClI,SAAS,iBAAiB,CAAC,OAAuC;IAChE,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;AACvH,CAAC;AAED,kGAAkG;AAClG,MAAM,OAAO,QAAS,SAAQ,QAAQ;IACpC,OAAO,CAA2B;IAClC,sFAAsF;IACtF,iBAAiB,CAAU;IAAC,qBAAqB,CAAY,CAAC,kEAAkE;IAEhI,YAAY,OAAe,EAAE,IAAa,EAAE,OAAiC,EAAE,iBAA0B,EAAE,qBAAgC;QACzI,gGAAgG;QAChG,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,IAAI,IAAI,OAAO,EAAE;YACpD,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC;YACzB,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC;YACjC,yFAAyF;YACzF,0GAA0G;YAC1G,QAAQ,EAAE,IAAI,KAAK,cAAc;gBAC/B,CAAC,CAAC,sLAAsL;gBACxL,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,yDAAyD;SACjM,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAAC,IAAI,CAAC,qBAAqB,GAAG,qBAAqB,CAAC;IACjG,CAAC;CACF;AAED,kKAAkK;AAClK,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAA0B,MAAM,iBAAiB,CAAC;AAOpG,qEAAqE;AACrE,2EAA2E;AAC3E,yEAAyE;AACzE,iDAAiD;AACjD,IAAI,CAAC;IACH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAClE,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,UAAU,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnE,mBAAmB,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAAC,MAAM,CAAC;IACP,8EAA8E;AAChF,CAAC;AAED,yEAAyE;AACzE,SAAS,mBAAmB,CAC1B,GAAY,EACZ,OAAe;AACf,yFAAyF;AACzF,sFAAsF;AACtF,gGAAgG;AAChG,KAAwD;IAExD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAE7D,2FAA2F;IAC3F,wFAAwF;IACxF,IAAI,KAAK,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,MAAM,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAElG,IAAI,GAAG,KAAK,cAAc,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;QACvC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QACjE,MAAM,SAAS,GAAG,KAAK;YACrB,CAAC,CAAC,0BAA0B,KAAK,0CAA0C;gBACzE,gEAAgE;gBAChE,+DAA+D;YACjE,CAAC,CAAC,oFAAoF;gBACpF,uDAAuD;gBACvD,aAAa,IAAI,wCAAwC;gBACzD,mDAAmD,CAAC;QACxD,MAAM,IAAI,QAAQ,CAAC,mBAAmB,IAAI,GAAG,EAAE;YAC7C,IAAI,EAAE,SAAS,CAAC,mBAAmB;YACnC,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAOD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,OAAe,EACf,SAAS,GAAG,uBAAuB,CAAC,kBAAkB,CAAC;IAEvD,OAAO,WAAW,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAE9D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;gBAC5C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;iBAClC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;gBAC1D,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,4GAA4G;YAC5G,wBAAwB,CAAC,GAAG,CAAC,CAAC;YAE9B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;YACrD,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAmB,GAAG,CAAC,CAAC;YAElE,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;gBACrC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,IAAI,iBAAiB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;YACvG,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,IAAI,SAAS,EAAE,CAAC;QACvE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,sEAAsE;YACtE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,cAAc,GAA2B;IAC7C,MAAM,EAAE,4BAA4B;IACpC,aAAa,EAAE,eAAe;IAC9B,gBAAgB,EAAE,mBAAmB;IACrC,gBAAgB,EAAE,gBAAgB;IAClC,gBAAgB,EAAE,gBAAgB;IAClC,eAAe,EAAE,oBAAoB;IACrC,iBAAiB,EAAE,mBAAmB;IACtC,cAAc,EAAE,iBAAiB;IACjC,oBAAoB,EAAE,kBAAkB;IACxC,oBAAoB,EAAE,iBAAiB;IACvC,oBAAoB,EAAE,oBAAoB;IAC1C,gBAAgB,EAAE,qBAAqB;IACvC,OAAO,EAAE,iBAAiB;IAC1B,gBAAgB,EAAE,mBAAmB;IACrC,kBAAkB,EAAE,mBAAmB;IACvC,aAAa,EAAE,uBAAuB;IACtC,gBAAgB,EAAE,wBAAwB;IAC1C,mBAAmB,EAAE,mBAAmB;IACxC,mBAAmB,EAAE,2BAA2B;CACjD,CAAC;AAEF,wHAAwH;AACxH,MAAM,UAAU,YAAY,CAAC,EAAU;IACrC,OAAO,cAAc,CAAC,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,WAAW,gBAAgB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AACvI,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAe,EACf,IAA8B;IAE9B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAEtE,yFAAyF;IACzF,oFAAoF;IACpF,cAAc,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,eAAe,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAErG,yFAAyF;IACzF,sFAAsF;IACtF,2FAA2F;IAC3F,2FAA2F;IAC3F,uFAAuF;IACvF,yFAAyF;IACzF,mEAAmE;IACnE,4FAA4F;IAC5F,yFAAyF;IACzF,+FAA+F;IAC/F,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,YAAY,EAAE;YACxC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAEG,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAyH,CAAC;IAClL,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QAC9D,+FAA+F;QAC/F,MAAM,IAAI,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,sBAAsB,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IACxI,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAElC;;;GAGG;AACH,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC;AAEnC,2GAA2G;AAC3G,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,oBAAoB,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,yBAAyB,CAAC,CAAC,CAAC;AAEzI;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,SAAkB,EAAE,eAAwB;IACzF,OAAO;QACL,cAAc,EAAE,kBAAkB;QAClC,aAAa,EAAE,UAAU,MAAM,EAAE;QACjC,4EAA4E;QAC5E,aAAa,EAAE,mBAAmB;QAClC,cAAc,EAAE,aAAa;QAC7B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,IAA6B;IACpD,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,MAAM,iBAAiB,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,OAAO,iBAAiB,IAAI,iBAAiB,KAAK,OAAO,EAAE,SAAS;QAClE,CAAC,CAAC,sBAAsB,CAAC,iBAAiB,CAAC;QAC3C,CAAC,CAAC,OAAO,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,mBAAmB,CAChC,EAAU,EACV,IAA6B,EAC7B,OAA2B,EAC3B,cAAuB;IAEvB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;IACxC,8FAA8F;IAC9F,0FAA0F;IAC1F,yFAAyF;IACzF,oFAAoF;IACpF,gDAAgD;IAChD,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACpC,uBAAuB,CAAC,KAAK,EAAE,SAAS,EAAE,+BAA+B,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAE7C,0FAA0F;IAC1F,4FAA4F;IAC5F,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;QACpE,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;gBACtC,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACrC,OAAO,EAAE,cAAc,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,IAAI,KAAK,EAAE,SAAS,CAAC;gBAC7F,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,wBAAwB;aAC5G,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAI,GAAG,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;YACnC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC,CAAC;QAC5K,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACb,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAU,EACV,OAAgC,EAAE,EAClC,OAA2B;IAE3B,8HAA8H;IAC9H,oHAAoH;IACpH,MAAM,OAAO,GAAG,WAAW,EAAE,EAAE,SAAS,CAAC;IACzC,MAAM,KAAK,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,gBAAgB,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACrK,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACxE,MAAM,yBAAyB,EAAE,CAAC,CAAC,yDAAyD;IAC5F,OAAO,QAAQ,CAAC,IAAS,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,yHAAyH;AACzH,SAAS,cAAc,CAAC,IAA6B;IACnD,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC;IAC9D,OAAO,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACvI,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,EAAU,EACV,OAAgC,EAAE,EAClC,OAA2B;IAE3B,4GAA4G;IAC5G,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,gBAAgB,IAAI,OAAO,EAAE,SAAS,IAAI,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACxI,IAAI,QAA2B,CAAC;IAChC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,mBAAmB,CAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0GAA0G;QAC1G,+GAA+G;QAC/G,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,GAAG,YAAY,QAAQ,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,WAAW,EAAE,EAAE,SAAS,KAAK,KAAK;YAAE,YAAY,EAAE,CAAC;QAC3H,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,2GAA2G;IAC3G,MAAM,yBAAyB,EAAE,CAAC;IAClC,OAAO,QAAQ,CAAC,IAAS,CAAC;AAC5B,CAAC"}