@promptev/context-engine 0.0.2 → 0.0.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (30) hide show
  1. package/README.md +81 -0
  2. package/dist/cli.js +12494 -11031
  3. package/dist/cli.js.map +1 -1
  4. package/dist/express.cjs.map +1 -1
  5. package/dist/express.js.map +1 -1
  6. package/dist/fastify.cjs.map +1 -1
  7. package/dist/fastify.js.map +1 -1
  8. package/dist/graph/index.cjs +6 -5
  9. package/dist/graph/index.cjs.map +1 -1
  10. package/dist/graph/index.js +6 -5
  11. package/dist/graph/index.js.map +1 -1
  12. package/dist/hono.cjs.map +1 -1
  13. package/dist/hono.js.map +1 -1
  14. package/dist/index.cjs +8064 -6538
  15. package/dist/index.cjs.map +1 -1
  16. package/dist/index.d.cts +334 -26
  17. package/dist/index.d.ts +334 -26
  18. package/dist/index.js +8045 -6525
  19. package/dist/index.js.map +1 -1
  20. package/dist/mcp-uirRbluA.d.cts +208 -0
  21. package/dist/mcp-uirRbluA.d.ts +208 -0
  22. package/dist/mcp.cjs +936 -70
  23. package/dist/mcp.cjs.map +1 -1
  24. package/dist/mcp.d.cts +2 -31
  25. package/dist/mcp.d.ts +2 -31
  26. package/dist/mcp.js +936 -70
  27. package/dist/mcp.js.map +1 -1
  28. package/dist/skills/context-engine/SKILL.md +58 -2
  29. package/package.json +1 -1
  30. package/src/skills/context-engine/SKILL.md +58 -2
package/dist/hono.cjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/errors.ts","../src/tools/executors/db.ts","../src/hono.ts","../src/sentinels.ts","../src/routing-core.ts","../src/tools/router.ts","../src/tools/acl.ts","../src/tools/approval.ts","../src/tools/config.ts","../src/crypto.ts","../src/tools/egress.ts","../src/version.ts","../src/tools/executors/mcp-client.ts","../src/tools/governance.ts","../src/hooks.ts","../src/redaction.ts","../src/tools/audit.ts","../src/tools/executors/http.ts","../src/tools/registry.ts","../src/tools/mcp-oauth.ts"],"names":["require","createRequire","z","randomUUID","out","randomBytes","createCipheriv","createDecipheriv","createHmac","dns","isIP","msg","UUID_RE","contentType","note","key","testConnection","checkEgress","createHash"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA,IAGa,iBAAA,EAsBA,oBAOA,eAAA,EAqBA,iBAAA;AArDb,IAAA,WAAA,GAAA,KAAA,CAAA;AAAA,EAAA,eAAA,GAAA;AAGO,IAAM,iBAAA,GAAN,cAAgC,KAAA,CAAM;AAAA,MAC3C,YAAY,OAAA,EAAiB;AAC3B,QAAA,KAAA,CAAM,OAAO,CAAA;AACb,QAAA,IAAA,CAAK,IAAA,GAAO,mBAAA;AAAA,MACd;AAAA,KACF;AAiBO,IAAM,kBAAA,GAAN,cAAiC,KAAA,CAAM;AAAA,MAC5C,WAAA,CAAY,UAAU,yBAAA,EAA2B;AAC/C,QAAA,KAAA,CAAM,OAAO,CAAA;AACb,QAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AAAA,MACd;AAAA,KACF;AAEO,IAAM,eAAA,GAAN,cAA8B,KAAA,CAAM;AAAA,MACzC,WAAA,CAAY,UAAU,sBAAA,EAAwB;AAC5C,QAAA,KAAA,CAAM,OAAO,CAAA;AACb,QAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AAAA,MACd;AAAA,KACF;AAgBO,IAAM,iBAAA,GAAN,cAAgC,KAAA,CAAM;AAAA,MAC3C,WAAA,CAAY,KAAA,EAAe,GAAA,EAAa,IAAA,EAAc;AACpD,QAAA,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,eAAA,EAAkB,GAAG,8BAA8B,KAAK,CAAA,eAAA,EAAkB,GAAG,CAAA,CAAE,CAAA;AAC5F,QAAA,IAAA,CAAK,IAAA,GAAO,mBAAA;AAAA,MACd;AAAA,KACF;AAAA,EAAA;AAAA,CAAA,CAAA;;;AC1DA,IAAA,UAAA,GAAA,EAAA;AAAA,QAAA,CAAA,UAAA,EAAA;AAAA,EAAA,QAAA,EAAA,MAAA,QAAA;AAAA,EAAA,kBAAA,EAAA,MAAA,kBAAA;AAAA,EAAA,SAAA,EAAA,MAAA,SAAA;AAAA,EAAA,YAAA,EAAA,MAAA,YAAA;AAAA,EAAA,WAAA,EAAA,MAAA,WAAA;AAAA,EAAA,aAAA,EAAA,MAAA,aAAA;AAAA,EAAA,aAAA,EAAA,MAAA,aAAA;AAAA,EAAA,cAAA,EAAA,MAAA;AAAA,CAAA,CAAA;AAgDO,SAAS,cAAc,GAAA,EAAqB;AACjD,EAAA,OAAO,GAAA,CAAI,QAAQ,YAAA,EAAc,CAAC,MAAM,GAAA,CAAI,MAAA,CAAO,CAAA,CAAE,MAAM,CAAC,CAAA;AAC9D;AAGA,SAAS,uBAAuB,GAAA,EAAqB;AACnD,EAAA,OAAO,GAAA,CAAI,QAAQ,sBAAA,EAAwB,CAAC,MAAM,GAAA,CAAI,MAAA,CAAO,CAAA,CAAE,MAAM,CAAC,CAAA;AACxE;AAEA,SAAS,UAAA,CAAW,UAAkB,OAAA,EAA0B;AAC9D,EAAA,OAAO,IAAI,MAAA,CAAO,CAAA,GAAA,EAAM,OAAO,CAAA,GAAA,CAAK,CAAA,CAAE,KAAK,QAAQ,CAAA;AACrD;AAEO,SAAS,mBAAmB,MAAA,EAAyC;AAC1E,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,MAAA,IAAU,YAAY,CAAA;AACnD,EAAA,IAAI,WAAW,QAAA,EAAU,OAAO,CAAA,UAAA,EAAa,MAAA,CAAO,YAAY,EAAE,CAAA,CAAA;AAElE,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,MAAA,CAAO,IAAA,IAAQ,WAAW,CAAA;AAC9C,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,MAAA,CAAO,IAAA,IAAQ,IAAI,CAAA;AACvC,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,CAAO,QAAA,IAAY,EAAE,CAAA;AAC7C,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,CAAO,QAAA,IAAY,EAAE,CAAA;AAC7C,EAAA,MAAM,WAAW,kBAAA,CAAmB,MAAA,CAAO,MAAA,CAAO,QAAA,IAAY,EAAE,CAAC,CAAA;AAEjE,EAAA,IAAI,WAAW,QAAA,EAAU;AACvB,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,MAAA,CAAO,YAAA,IAAgB,QAAQ,CAAA;AAC1D,IAAA,OAAO,CAAA,SAAA,EAAY,QAAQ,CAAA,CAAA,EAAI,QAAQ,IAAI,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,eAAA,EAAkB,WAAW,CAAA,CAAA;AAAA,EACtF;AACA,EAAA,IAAI,WAAW,WAAA,EAAa;AAC1B,IAAA,MAAM,UAAA,GAAa,MAAA,CAAO,MAAA,CAAO,WAAA,IAAe,QAAQ,CAAA;AACxD,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,MAAA,CAAO,SAAA,IAAa,EAAE,CAAA;AAC/C,IAAA,IAAI,GAAA,GAAM,CAAA,YAAA,EAAe,QAAQ,CAAA,CAAA,EAAI,QAAQ,IAAI,IAAI,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA;AAC/E,IAAA,IAAI,SAAA,EAAW,GAAA,IAAO,CAAA,WAAA,EAAc,SAAS,CAAA,CAAA;AAC7C,IAAA,OAAO,GAAA;AAAA,EACT;AACA,EAAA,IAAI,WAAW,YAAA,EAAc;AAC3B,IAAA,MAAM,SAAS,CAAC,IAAA,EAAM,MAAM,GAAG,CAAA,CAAE,SAAS,IAAI,CAAA;AAC9C,IAAA,OAAO,CAAA,aAAA,EAAgB,QAAQ,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,EAAI,QAAQ,CAAA,EAAG,MAAA,GAAS,iBAAiB,EAAE,CAAA,CAAA;AAAA,EACxG;AACA,EAAA,IAAI,MAAA,KAAW,OAAA,IAAW,MAAA,KAAW,SAAA,EAAW;AAC9C,IAAA,OAAO,CAAA,QAAA,EAAW,QAAQ,CAAA,CAAA,EAAI,QAAQ,IAAI,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA;AAAA,EACpE;AACA,EAAA,IAAI,WAAW,OAAA,EAAS;AACtB,IAAA,OAAO,CAAA,QAAA,EAAW,QAAQ,CAAA,CAAA,EAAI,QAAQ,IAAI,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA;AAAA,EACpE;AACA,EAAA,OAAO,CAAA,aAAA,EAAgB,QAAQ,CAAA,CAAA,EAAI,QAAQ,IAAI,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA;AACzE;AAEA,SAAS,WAAW,IAAA,EAA8C;AAChE,EAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,OAAO,EAAA;AACzB,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,CAAC,CAAE,CAAA;AACpC,EAAA,MAAM,KAAA,GAAQ,CAAC,OAAA,CAAQ,IAAA,CAAK,GAAI,CAAC,CAAA;AACjC,EAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,IAAA,KAAA,CAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,CAAC,QAAQ,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,IAAK,EAAE,CAAC,CAAA,CAAE,IAAA,CAAK,GAAI,CAAC,CAAA;AAAA,EACpE;AACA,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AACxB;AAQA,eAAe,aAAA,CACb,MAAA,EACA,GAAA,EACA,OAAA,EACA,WAAW,KAAA,EACW;AACtB,EAAA,IAAI,EAAA;AACJ,EAAA,IAAI;AACF,IAAA,EAAA,GAAKA,SAAQ,IAAI,CAAA;AAAA,EACnB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA,CAAkB,UAAA,EAAY,IAAA,EAAM,wBAAwB,CAAA;AAAA,EACxE;AACA,EAAA,MAAM,MAAM,kBAAA,CAAmB,EAAE,GAAG,MAAA,EAAQ,MAAA,EAAQ,cAAc,CAAA;AAClE,EAAA,MAAM,MAAA,GAAS,IAAI,EAAA,CAAG,MAAA,CAAO;AAAA,IAC3B,gBAAA,EAAkB,GAAA;AAAA,IAClB,yBAAyB,eAAA,GAAkB,GAAA;AAAA,IAC3C,iBAAA,EAAmB;AAAA,GACpB,CAAA;AACD,EAAA,MAAM,OAAO,OAAA,EAAQ;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,CAAO,MAAM,OAAO,CAAA;AAC1B,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,CAAO,MAAM,2BAA2B,CAAA;AAAA,MAChD,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,MAAA,CAAO,MAAM,UAAU,CAAA;AAC7B,QAAA,OAAA,CAAQ,IAAA;AAAA,UACN,kJAAA;AAAA,UAEA;AAAA,SACF;AACA,QAAA,MAAM,MAAA,CAAO,MAAM,OAAO,CAAA;AAAA,MAC5B;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA;AACrC,IAAA,MAAM,MAAA,CAAO,MAAM,QAAQ,CAAA;AAC3B,IAAA,MAAM,OAAA,GAAU,OAAO,MAAA,EAAQ,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAA,KAAM,MAAA,CAAO,KAAK,CAAC,CAAA,GAAI,OAAO,IAAA,CAAK,MAAA,CAAO,KAAK,CAAC,CAAC,IAAI,EAAC,CAAA;AACtG,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,OAAO,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,MAAO,EAAE,GAAG,GAAE,CAAE,CAAA;AAChE,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,UAAU,MAAA,CAAO,QAAA,IAAY,KAAK,MAAA,EAAO;AAAA,EACnE,SAAS,CAAA,EAAG;AACV,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,CAAO,MAAM,UAAU,CAAA;AAAA,IAC/B,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,CAAA;AAAA,EACR,CAAA,SAAE;AACA,IAAA,MAAM,OAAO,GAAA,EAAI;AAAA,EACnB;AACF;AAEA,eAAe,UAAA,CACb,MAAA,EACA,GAAA,EACA,OAAA,EACsB;AACtB,EAAA,IAAI,KAAA;AAMJ,EAAA,IAAI;AACF,IAAA,KAAA,GAAQA,SAAQ,gBAAgB,CAAA;AAAA,EAClC,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA,CAAkB,OAAA,EAAS,QAAA,EAAU,6BAA6B,CAAA;AAAA,EAC9E;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,gBAAA,CAAiB;AAAA,IACxC,IAAA,EAAM,OAAO,IAAA,IAAQ,WAAA;AAAA,IACrB,IAAA,EAAM,MAAA,CAAO,MAAA,CAAO,IAAA,IAAQ,IAAI,CAAA;AAAA,IAChC,IAAA,EAAM,OAAO,QAAA,IAAY,EAAA;AAAA,IACzB,QAAA,EAAU,OAAO,QAAA,IAAY,EAAA;AAAA,IAC7B,QAAA,EAAU,OAAO,QAAA,IAAY,EAAA;AAAA,IAC7B,gBAAgB,eAAA,GAAkB;AAAA,GACnC,CAAA;AACD,EAAA,IAAI;AACF,IAAA,MAAM,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,IAAA,CAAK,MAAM,GAAG,CAAA;AAC3C,IAAA,MAAM,OAAO,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,GAAK,OAA0C,EAAC;AAC/E,IAAA,MAAM,OAAA,GAAA,CAAW,UAAU,EAAC,EAAG,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAChD,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,IAAA,CAAK,KAAA,CAAM,GAAG,OAAO,CAAA,EAAG,QAAA,EAAU,IAAA,CAAK,MAAA,EAAO;AAAA,EACxE,CAAA,SAAE;AACA,IAAA,MAAM,KAAK,GAAA,EAAI;AAAA,EACjB;AACF;AAEA,eAAe,UAAA,CACb,MAAA,EACA,GAAA,EACA,OAAA,EACA,WAAW,KAAA,EACW;AACtB,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,MAAA,IAAU,YAAY,CAAA;AACnD,EAAA,IAAI,WAAW,YAAA,EAAc,OAAO,cAAc,MAAA,EAAQ,GAAA,EAAK,SAAS,QAAQ,CAAA;AAChF,EAAA,IAAI,MAAA,KAAW,WAAW,MAAA,KAAW,SAAA,SAAkB,UAAA,CAAW,MAAA,EAAQ,KAAK,OAAO,CAAA;AACtF,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,CAAA,oBAAA,EAAuB,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA,wEAAA;AAAA,GAE/C;AACF;AAEO,SAAS,aACd,MAAA,EACA,GAAA,EACA,OAAA,GAAkB,QAAA,EAClB,aAAqB,UAAA,EACa;AAClC,EAAA,OAAO,iBAAA,CAAkB,MAAA,EAAQ,GAAA,EAAK,OAAA,EAAS,UAAU,CAAA;AAC3D;AAEA,eAAe,iBAAA,CACb,MAAA,EACA,GAAA,EACA,OAAA,EACA,aAAA,EACkC;AAClC,EAAA,MAAM,aAAc,aAAA,IAAiB,UAAA;AACrC,EAAA,IAAI,CAAE,oBAAA,CAA2C,QAAA,CAAS,UAAU,CAAA,EAAG;AACrE,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,uBAAuB,IAAA,CAAK,SAAA,CAAU,aAAa,CAAC,oBAAoB,oBAAoB,CAAA;AAAA,KAC9F;AAAA,EACF;AAIA,EAAA,MAAM,WAAA,GAAc;AAAA,IAClB,aAAA,CAAc,GAAG,CAAA,CAAE,IAAA,GAAO,WAAA,EAAY;AAAA,IACtC,sBAAA,CAAuB,GAAG,CAAA,CAAE,IAAA,GAAO,WAAA;AAAY,GACjD;AACA,EAAA,MAAM,QAAA,GAAW,YAAY,CAAC,CAAA;AAM9B,EAAA,KAAA,MAAW,WAAW,cAAA,EAAgB;AACpC,IAAA,IAAI,CAAC,GAAG,WAAA,EAAa,GAAA,CAAI,aAAa,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,OAAO,CAAC,CAAA,EAAG;AAC3E,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,CAAA,EAAG,OAAO,CAAA,wBAAA,CAAA,EAA2B;AAAA,IACvE;AAAA,EACF;AAEA,EAAA,IAAI,eAAe,UAAA,EAAY;AAC7B,IAAA,IAAI,CAAC,WAAA,CAAY,KAAA,CAAM,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,QAAQ,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,MAAM,CAAC,CAAA,EAAG;AAC7E,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,mDAAA,EAAoD;AAAA,IACtF;AACA,IAAA,KAAA,MAAW,WAAW,gBAAA,EAAkB;AACtC,MAAA,IAAI,WAAA,CAAY,KAAK,CAAC,CAAA,KAAM,WAAW,CAAA,EAAG,OAAO,CAAC,CAAA,EAAG;AACnD,QAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,CAAA,EAAG,OAAO,CAAA,0CAAA,CAAA,EAA6C;AAAA,MACzF;AAAA,IACF;AAAA,EACF,CAAA,MAAA,IAAW,eAAe,WAAA,EAAa;AACrC,IAAA,KAAA,MAAW,WAAW,iBAAA,EAAmB;AACvC,MAAA,IAAI,WAAA,CAAY,KAAK,CAAC,CAAA,KAAM,WAAW,CAAA,EAAG,OAAO,CAAC,CAAA,EAAG;AACnD,QAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,CAAA,EAAG,OAAO,CAAA,2CAAA,CAAA,EAA8C;AAAA,MAC1F;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,MAAM,UAAA,CAAW,QAAQ,GAAA,EAAK,OAAA,EAAS,eAAe,UAAU,CAAA;AAE/E,IAAA,IAAI,CAAC,SAAS,UAAA,CAAW,QAAQ,KAAK,CAAC,QAAA,CAAS,UAAA,CAAW,MAAM,CAAA,EAAG;AAClE,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,IAAA;AAAA,QACT,SAAS,EAAC;AAAA,QACV,MAAM,EAAC;AAAA,QACP,WAAW,MAAA,CAAO,QAAA;AAAA,QAClB,eAAe,MAAA,CAAO,QAAA;AAAA,QACtB,SAAA,EAAW;AAAA,OACb;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,IAAA;AAAA,MACT,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,SAAA,EAAW,OAAO,IAAA,CAAK,MAAA;AAAA,MACvB,SAAA,EAAW,MAAA,CAAO,IAAA,CAAK,MAAA,IAAU,OAAA;AAAA,MACjC,IAAA,EAAM,UAAA,CAAW,MAAA,CAAO,IAAI;AAAA,KAC9B;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,MAAA,CAAO,CAAC,CAAA,EAAE;AAAA,EAC5C;AACF;AAEA,eAAsB,SAAA,CACpB,QACA,GAAA,EACkC;AAClC,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,MAAA,CAAO,QAAA,IAAY,QAAQ,CAAA;AAClD,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,MAAA,CAAO,WAAA,IAAe,UAAU,CAAA;AAC1D,EAAA,OAAO,iBAAA,CAAkB,MAAA,EAAQ,GAAA,EAAK,OAAA,EAAS,UAAU,CAAA;AAC3D;AAEA,eAAsB,eAAe,MAAA,EAAmE;AACtG,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,MAAA,CAAO,MAAA,IAAU,YAAY,CAAA;AACvD,EAAA,MAAM,cAAA,GAAyC;AAAA,IAC7C,UAAA,EAAY,kBAAA;AAAA,IACZ,KAAA,EAAO,kBAAA;AAAA,IACP,OAAA,EAAS,kBAAA;AAAA,IACT,KAAA,EAAO,kBAAA;AAAA,IACP,MAAA,EAAQ,yBAAA;AAAA,IACR,MAAA,EAAQ,+CAAA;AAAA,IACR,UAAA,EAAY,kBAAA;AAAA,IACZ,SAAA,EAAW;AAAA,GACb;AACA,EAAA,MAAM,CAAA,GAAI,cAAA,CAAe,UAAU,CAAA,IAAK,kBAAA;AACxC,EAAA,MAAM,SAAS,MAAM,iBAAA,CAAkB,MAAA,EAAQ,CAAA,EAAG,GAAG,UAAU,CAAA;AAC/D,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,MAAA,CAAO,KAAA,EAAM;AAClE,EAAA,MAAM,OAAA,GAAW,MAAA,CAAO,IAAA,GAA0C,CAAC,CAAA,GAC/D,MAAA,CAAO,MAAA,CAAQ,MAAA,CAAO,IAAA,CAAwC,CAAC,CAAE,CAAA,CAAE,CAAC,CAAA,GACpE,IAAA;AACJ,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,IAAA;AAAA,IACT,OAAA,EAAS,OAAO,OAAO,CAAA;AAAA,IACvB,MAAM,MAAA,CAAO,IAAA;AAAA,IACb,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,MAAA,EAAQ;AAAA,GACV;AACF;AAEA,eAAsB,WAAA,CACpB,QACA,cAAA,EACkC;AAClC,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,MAAA,IAAU,YAAY,CAAA;AACnD,EAAA,IAAI,WAAW,YAAA,EAAc;AAC3B,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,CAAA,wDAAA,EAA2D,MAAM,CAAA,CAAA,CAAA,EAAI;AAAA,EACvG;AACA,EAAA,IAAI,EAAA;AACJ,EAAA,IAAI;AACF,IAAA,EAAA,GAAKA,SAAQ,IAAI,CAAA;AAAA,EACnB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA,CAAkB,UAAA,EAAY,IAAA,EAAM,wBAAwB,CAAA;AAAA,EACxE;AACA,EAAA,MAAM,MAAA,GAAS,IAAI,EAAA,CAAG,MAAA,CAAO,EAAE,gBAAA,EAAkB,kBAAA,CAAmB,MAAM,CAAA,EAAG,CAAA;AAC7E,EAAA,MAAM,OAAO,OAAA,EAAQ;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,UAAA,GAAa,MAAA,CAAO,MAAA,CAAO,WAAA,IAAe,QAAQ,CAAA;AACxD,IAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,KAAA;AAAA,MAC7B,CAAA,oFAAA,CAAA;AAAA,MACA,CAAC,UAAU;AAAA,KACb;AACA,IAAA,IAAI,KAAA,GAAQ,SAAA,CAAU,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,MACrC,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,UAAU,CAAA;AAAA,MACzB,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,UAAU,CAAA,CAAE,aAAY,CAAE,QAAA,CAAS,MAAM,CAAA,GAAI,MAAA,GAAS;AAAA,KACvE,CAAE,CAAA;AACF,IAAA,IAAI,gBAAgB,MAAA,EAAQ;AAC1B,MAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,cAAc,CAAA;AACvC,MAAA,KAAA,GAAQ,KAAA,CAAM,OAAO,CAAC,CAAA,KAAM,SAAS,GAAA,CAAI,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA,IAClD;AACA,IAAA,MAAM,SAAS,EAAC;AAChB,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,KAAA;AAAA,QACxB,CAAA;AAAA,8EAAA,CAAA;AAAA,QAEA,CAAC,UAAA,EAAY,IAAA,CAAK,IAAI;AAAA,OACxB;AACA,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACV,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,OAAA,EAAS,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,UAC7B,MAAM,CAAA,CAAE,WAAA;AAAA,UACR,MAAM,CAAA,CAAE,SAAA;AAAA,UACR,QAAA,EAAU,EAAE,WAAA,KAAgB;AAAA,SAC9B,CAAE,CAAA;AAAA,QACF,SAAA,EAAW;AAAA,OACZ,CAAA;AAAA,IACH;AACA,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,IAAA;AAAA,MACT,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,MAAA,EAAQ,UAAA;AAAA,MACR,MAAA;AAAA,MACA,aAAa,MAAA,CAAO,MAAA;AAAA,MACpB,YAAY,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,IAAI;AAAA,KACrC;AAAA,EACF,CAAA,SAAE;AACA,IAAA,MAAM,OAAO,GAAA,EAAI;AAAA,EACnB;AACF;AAEA,eAAsB,aAAA,CACpB,QACA,cAAA,EACiB;AACjB,EAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,MAAA,EAAQ,cAAc,CAAA;AACvD,EAAA,MAAM,aAA6C,EAAC;AACpD,EAAA,KAAA,MAAW,KAAA,IAAU,MAAA,CAAO,MAAA,IAAyD,EAAC,EAAG;AACvF,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,IAAQ,OAAA;AAC3B,IAAA,KAAA,MAAW,CAAA,IAAM,KAAA,CAAM,OAAA,IAA8C,EAAC,EAAG;AACvE,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,OAAO,KAAA,CAAM,IAAA;AAAA,QACb,UAAA,EAAY,IAAA;AAAA,QACZ,QAAQ,CAAA,CAAE,IAAA;AAAA,QACV,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,IAAI,EAAE,WAAA,EAAY;AAAA,QACjC,EAAA,EAAI,EAAE,EAAA,IAAM,KAAA;AAAA,QACZ,EAAA,EAAI,EAAE,EAAA,IAAM,EAAA;AAAA,QACZ,MAAM,KAAA,CAAM;AAAA,OACb,CAAA;AAAA,IACH;AAAA,EACF;AACA,EAAA,OAAO,WAAW,UAAU,CAAA;AAC9B;AA7ZA,IAGMA,QAAAA,EAEO,UACP,eAAA,EACA,gBAAA,EAEA,gBACA,gBAAA,EAeA,iBAAA,EACA,sBAKA,YAAA,EASA,sBAAA;AAxCN,IAAA,OAAA,GAAA,KAAA,CAAA;AAAA,EAAA,2BAAA,GAAA;AACA,IAAA,WAAA,EAAA;AAEA,IAAMA,QAAAA,GAAUC,sBAAA,CAAc,0PAAe,CAAA;AAEtC,IAAM,QAAA,GAAW,GAAA;AACxB,IAAM,eAAA,GAAkB,EAAA;AACxB,IAAM,gBAAA,GAAmB,GAAA;AAEzB,IAAM,cAAA,GAAiB,CAAC,OAAA,EAAS,QAAQ,CAAA;AACzC,IAAM,gBAAA,GAAmB;AAAA,MACvB,QAAA;AAAA,MACA,QAAA;AAAA,MACA,QAAA;AAAA,MACA,OAAA;AAAA,MACA,MAAA;AAAA,MACA,OAAA;AAAA,MACA,QAAA;AAAA,MACA,UAAA;AAAA,MACA,IAAA;AAAA,MACA;AAAA,KACF;AAIA,IAAM,oBAAoB,CAAC,QAAA,EAAU,MAAA,EAAQ,UAAA,EAAY,MAAM,MAAM,CAAA;AACrE,IAAM,oBAAA,GAAuB,CAAC,UAAA,EAAY,WAAA,EAAa,MAAM,CAAA;AAK7D,IAAM,YAAA,GAAe,2EAAA;AASrB,IAAM,sBAAA,GAAyB,sDAAA;AAAA,EAAA;AAAA,CAAA,CAAA;;;ACvC/B,WAAA,EAAA;;;ACiBO,IAAM,OAAA,mBAAyB,MAAA,CAAO,GAAA,CAAI,wBAAwB,CAAA;;;ACflE,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EACtC,MAAA;AAAA,EACA,MAAA;AAAA,EACA,WAAA,CAAY,QAAgB,MAAA,EAAiB;AAC3C,IAAA,KAAA,CAAM,OAAO,MAAA,KAAW,QAAA,GAAW,SAAS,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA;AAClE,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AACF,CAAA;AAEO,IAAM,uBAAA,GAA0BC,MACpC,MAAA,CAAO;AAAA,EACN,IAAA,EAAMA,MAAE,MAAA,EAAO;AAAA,EACf,IAAA,EAAMA,MAAE,MAAA,EAAO;AAAA,EACf,WAAWA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,GAAW,QAAA,EAAS;AAAA,EAC1C,aAAaA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,GAAW,QAAA,EAAS;AAAA,EAC5C,aAAaA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,GAAW,QAAA,EAAS;AAAA,EAC5C,SAAA,EAAWA,MAAE,MAAA,CAAOA,KAAA,CAAE,SAAS,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,EAAS;AAAA,EACrD,GAAA,EAAKA,MAAE,KAAA,CAAMA,KAAA,CAAE,QAAQ,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,EAAS;AAAA,EAC7C,IAAA,EAAMA,KAAA,CAAE,IAAA,CAAK,CAAC,QAAA,EAAU,OAAO,CAAC,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,EAAS;AAAA,EACtD,oBAAoBA,KAAA,CAAE,OAAA,GAAU,QAAA,EAAS,CAAE,QAAQ,KAAK,CAAA;AAAA,EACxD,OAAOA,KAAA,CAAE,OAAA,GAAU,QAAA,EAAS,CAAE,QAAQ,KAAK;AAC7C,CAAC,EACA,KAAA,EAAM;AAEF,IAAM,mBAAA,GAAsBA,MAChC,MAAA,CAAO;AAAA,EACN,GAAA,EAAKA,MAAE,KAAA,CAAMA,KAAA,CAAE,QAAQ,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,EAAS;AAAA,EAC7C,MAAMA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,GAAW,QAAA,EAAS;AAAA,EACrC,aAAaA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,GAAW,QAAA,EAAS;AAAA,EAC5C,SAAA,EAAWA,MAAE,MAAA,CAAOA,KAAA,CAAE,SAAS,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA;AAC9C,CAAC,EACA,MAAA,EAAO;AAEH,IAAM,mBAAA,GAAsBA,MAChC,MAAA,CAAO;AAAA,EACN,KAAA,EAAOA,MAAE,MAAA,EAAO;AAAA,EAChB,UAAA,EAAYA,MAAE,KAAA,CAAMA,KAAA,CAAE,QAAQ,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,EAAS;AAAA;AAAA;AAAA;AAAA,EAIpD,YAAA,EAAcA,MAAE,KAAA,CAAMA,KAAA,CAAE,QAAQ,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,EAAS;AAAA,EACtD,KAAA,EAAOA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,EAAE,CAAA;AAAA,EAC7C,IAAA,EAAMA,KAAA,CAAE,IAAA,CAAK,CAAC,QAAA,EAAU,OAAO,CAAC,CAAA,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,QAAQ,CAAA;AAAA,EAC7D,kBAAA,EAAoBA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,GAAW,QAAA;AAClD,CAAC,EACA,KAAA,EAAM;AAgBT,IAAM,OAAA,GAAU,iEAAA;AAET,SAAS,iBAAiB,UAAA,EAA0B;AACzD,EAAA,IAAI,CAAC,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,UAAU,CAAC,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,aAAa,GAAA,EAAK,CAAA,qBAAA,EAAwB,KAAK,SAAA,CAAU,UAAU,CAAC,CAAA,CAAE,CAAA;AAAA,EAClF;AACF;AAEO,SAAS,SAAS,KAAA,EAAyB;AAChD,EAAA,IAAI,OAAO,KAAA,KAAU,SAAA,EAAW,OAAO,KAAA;AACvC,EAAA,IAAI,KAAA,IAAS,MAAM,OAAO,KAAA;AAC1B,EAAA,OAAO,CAAC,GAAA,EAAK,MAAA,EAAQ,KAAA,EAAO,IAAI,CAAA,CAAE,QAAA,CAAS,MAAA,CAAO,KAAK,CAAA,CAAE,IAAA,EAAK,CAAE,aAAa,CAAA;AAC/E;AAEO,SAAS,SAAS,KAAA,EAAyB;AAChD,EAAA,IAAI,UAAU,MAAA,IAAa,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,IAAI,OAAO,IAAA;AAClE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,KAAA;AACtC,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,EACjC,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,aAAa,GAAA,EAAK,CAAA,uBAAA,EAA0B,KAAK,SAAA,CAAU,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/E;AACF;AAEO,SAAS,QAAQ,KAAA,EAA+B;AACrD,EAAA,OAAO,KAAA,KAAU,UAAa,KAAA,KAAU,IAAA,IAAQ,UAAU,EAAA,GAAK,IAAA,GAAO,OAAO,KAAK,CAAA;AACpF;AAEO,SAAS,wBAAA,CAAyB,OAAgB,IAAA,EAA+C;AAKtG,EAAA,IAAI,KAAA,KAAU,SAAS,OAAO,OAAA;AAC9B,EAAA,IAAI,SAAS,IAAA,EAAM;AACjB,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,GAAA;AAAA,MACA,CAAA,EAAG,KAAK,OAAO,CAAA,qWAAA;AAAA,KAMjB;AAAA,EACF;AAIA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,OAAO,CAAA,KAAM,QAAQ,CAAA,EAAG;AACrE,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,GAAA;AAAA,MACA,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,2HAAA,EACsD,OAAO,KAAK,CAAA,CAAA;AAAA,KACnF;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,YAAA,CAAa,WAAoB,UAAA,EAA6C;AAC5F,EAAA,IAAI,SAAA,IAAa,IAAA,IAAQ,UAAA,IAAc,IAAA,IAAQ,eAAe,OAAA,EAAS;AACvE,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,yCAAyC,CAAA;AAAA,EACvE;AAEA,EAAA,MAAM,IAAA,GAAO,IAAI,GAAA,CAAI,UAAsB,CAAA;AAC3C,EAAA,MAAM,SAAA,GAAY,CAAC,GAAG,IAAI,IAAI,SAAA,CAAU,GAAA,CAAI,MAAM,CAAC,CAAC,EAAE,MAAA,CAAO,CAAC,MAAM,CAAC,IAAA,CAAK,IAAI,CAAC,CAAC,EAAE,IAAA,EAAK;AACvF,EAAA,IAAI,UAAU,MAAA,EAAQ;AACpB,IAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,CAAA,mDAAA,EAAsD,SAAS,CAAA,CAAE,CAAA;AAAA,EAC/F;AACF;AAEA,SAAS,OAAO,GAAA,EAAuB;AACrC,EAAA,IAAI,GAAA,IAAO,MAAM,OAAO,GAAA;AACxB,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,OAAQ,GAAA,CAAmC,WAAW,UAAA,EAAY;AAC/F,IAAA,OAAQ,IAAkC,MAAA,EAAO;AAAA,EACnD;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,SAAS,GAAA,EAA+B;AAC/C,EAAA,OAAO,IAAI,YAAA;AAAA,IACT,GAAA;AAAA,IACA,GAAA,CAAI,MAAA,CAAO,GAAA,CAAI,CAAC,OAAO,EAAE,GAAA,EAAK,CAAA,CAAE,IAAA,EAAM,KAAK,CAAA,CAAE,OAAA,EAAS,IAAA,EAAM,CAAA,CAAE,MAAK,CAAE;AAAA,GACvE;AACF;AAEA,eAAe,SAAA,CAAU,QAA2B,MAAA,EAAmD;AACrG,EAAA,IAAI;AACF,IAAA,OAAO,MAAA,CAAO,MAAM,MAAA,CAAO,MAAA,CAAO,MAAM,CAAC,CAAA;AAAA,EAC3C,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,eAAe,SAAA,IAAc,GAAA,YAAe,KAAA,IAAS,GAAA,CAAI,SAAS,WAAA,EAAc;AAClF,MAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,IACzC;AACA,IAAA,IAAI,GAAA,YAAe,SAAS,GAAA,CAAI,IAAA,KAAS,WAAW,mBAAA,CAAoB,IAAA,CAAK,GAAA,CAAI,OAAO,CAAA,EAAG;AACzF,MAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,IACzC;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAEA,eAAsB,gBAAA,CACpB,MAAA,EACA,OAAA,EACA,UAAA,EACkB;AAClB,EAAA,MAAM,WAAW,wBAAA,CAAyB,UAAA,EAAY,EAAE,OAAA,EAAS,sBAAsB,CAAA;AACvF,EAAA,MAAM,MAAA,GAAS,uBAAA,CAAwB,SAAA,CAAU,OAAO,CAAA;AACxD,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,QAAA,CAAS,OAAO,KAAK,CAAA;AAChD,EAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AACpB,EAAA,YAAA,CAAa,IAAA,CAAK,KAAK,QAAQ,CAAA;AAC/B,EAAA,OAAO,UAAU,MAAA,EAAQ;AAAA,IACvB,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,aAAa,IAAA,CAAK,WAAA;AAAA,IAClB,UAAU,IAAA,CAAK,SAAA;AAAA,IACf,YAAY,IAAA,CAAK,WAAA;AAAA,IACjB,UAAU,IAAA,CAAK,SAAA;AAAA,IACf,KAAK,IAAA,CAAK,GAAA;AAAA,IACV,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,mBAAmB,IAAA,CAAK,kBAAA;AAAA,IACxB,OAAO,IAAA,CAAK;AAAA,GACb,CAAA;AACH;AAEA,eAAsB,gBAAA,CACpB,QACA,IAAA,EAMkB;AAClB,EAAA,MAAM,WAAW,wBAAA,CAAyB,IAAA,CAAK,YAAY,EAAE,OAAA,EAAS,sBAAsB,CAAA;AAC5F,EAAA,MAAM,IAAA,GAAO,KAAK,IAAA,YAAgB,GAAA,GAAM,OAAO,WAAA,CAAY,IAAA,CAAK,IAAI,CAAA,GAAI,IAAA,CAAK,IAAA;AAC7E,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,IAAA,CAAK,GAAG,CAAA;AAC7B,EAAA,YAAA,CAAa,KAAK,QAAQ,CAAA;AAC1B,EAAA,OAAO,UAAU,MAAA,EAAQ;AAAA,IACvB,SAAS,IAAA,CAAK,OAAA;AAAA,IACd,UAAU,IAAA,CAAK,QAAA;AAAA,IACf,IAAA,EAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,KAAK,IAAA,CAAK,QAAA;AAAA,IACjC,WAAA,EAAa,OAAA,CAAQ,IAAA,CAAK,WAAW,CAAA;AAAA,IACrC,QAAA,EAAU,OAAA,CAAQ,IAAA,CAAK,SAAS,CAAA;AAAA,IAChC,UAAA,EAAY,OAAA,CAAQ,IAAA,CAAK,WAAW,CAAA;AAAA,IACpC,QAAA,EAAU,QAAA,CAAS,IAAA,CAAK,SAAS,CAAA;AAAA,IACjC,GAAA;AAAA,IACA,IAAA,EAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA;AAAA,IACvB,iBAAA,EAAmB,QAAA,CAAS,IAAA,CAAK,kBAAkB,CAAA;AAAA,IACnD,KAAA,EAAO,QAAA,CAAS,IAAA,CAAK,KAAK;AAAA,GAC3B,CAAA;AACH;AAEA,eAAsB,mBAAA,CACpB,QACA,IAAA,EAMkB;AAClB,EAAA,MAAM,WAAW,wBAAA,CAAyB,IAAA,CAAK,YAAY,EAAE,OAAA,EAAS,yBAAyB,CAAA;AAC/F,EAAA,IAAI,YAAA,GAAwB,IAAA;AAC5B,EAAA,IAAI,KAAK,MAAA,EAAQ;AACf,IAAA,IAAI;AACF,MAAA,YAAA,GAAe,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,MAAM,CAAA;AAAA,IACvC,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,aAAa,GAAA,EAAK,CAAA,gBAAA,EAAmB,KAAK,SAAA,CAAU,IAAA,CAAK,MAAM,CAAC,CAAA,CAAE,CAAA;AAAA,IAC9E;AAAA,EACF;AACA,EAAA,OAAO,OAAO,aAAA,CAAc;AAAA,IAC1B,QAAA,EAAU,KAAK,QAAA,IAAY,IAAA;AAAA,IAC3B,UAAA,EAAY,QAAA;AAAA,IACZ,MAAA,EAAQ,YAAA;AAAA,IACR,OAAO,IAAA,CAAK;AAAA,GACb,CAAA;AACH;AAEA,eAAsB,iBAAA,CACpB,MAAA,EACA,UAAA,EACA,UAAA,EACkB;AAClB,EAAA,MAAM,WAAW,wBAAA,CAAyB,UAAA,EAAY,EAAE,OAAA,EAAS,uBAAuB,CAAA;AACxF,EAAA,gBAAA,CAAiB,UAAU,CAAA;AAC3B,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,MAAA,CAAO,WAAA,CAAY,YAAY,EAAE,UAAA,EAAY,UAAU,CAAA;AAAA,EACtE,SAAS,GAAA,EAAK;AACZ,IAAA,IACE,eAAe,KAAA,KACd,GAAA,CAAI,SAAS,uBAAA,IAA2B,GAAA,YAAe,cAAc,KAAA,CAAA,EACtE;AACA,MAAA,MAAM,GAAA,GAAM,OAAO,GAAG,CAAA;AACtB,MAAA,IAAI,aAAa,IAAA,CAAK,GAAG,CAAA,IAAK,GAAA,CAAI,SAAS,uBAAA,EAAyB;AAClE,QAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,IAAI,OAAA,CAAQ,YAAA,EAAc,EAAE,CAAC,CAAA;AAAA,MAC3D;AAAA,IACF;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAEA,eAAsB,oBAAA,CACpB,MAAA,EACA,UAAA,EACA,UAAA,EACkB;AAClB,EAAA,MAAM,WAAW,wBAAA,CAAyB,UAAA,EAAY,EAAE,OAAA,EAAS,0BAA0B,CAAA;AAC3F,EAAA,gBAAA,CAAiB,UAAU,CAAA;AAC3B,EAAA,IAAI;AACF,IAAA,MAAM,OAAO,cAAA,CAAe,UAAA,EAAY,EAAE,UAAA,EAAY,UAAU,CAAA;AAAA,EAClE,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,GAAA,GAAM,OAAO,GAAG,CAAA;AACtB,IAAA,IAAI,YAAA,CAAa,KAAK,GAAG,CAAA,IAAM,eAAe,KAAA,IAAS,GAAA,CAAI,SAAS,uBAAA,EAA0B;AAC5F,MAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,IAAI,OAAA,CAAQ,YAAA,EAAc,EAAE,CAAC,CAAA;AAAA,IAC3D;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AACA,EAAA,OAAO,EAAE,SAAS,UAAA,EAAW;AAC/B;AAEA,eAAsB,oBAAA,CACpB,MAAA,EACA,UAAA,EACA,OAAA,EACA,UAAA,EACkB;AAClB,EAAA,MAAM,WAAW,wBAAA,CAAyB,UAAA,EAAY,EAAE,OAAA,EAAS,0BAA0B,CAAA;AAC3F,EAAA,gBAAA,CAAiB,UAAU,CAAA;AAC3B,EAAA,MAAM,MAAA,GAAS,mBAAA,CAAoB,SAAA,CAAU,OAAO,CAAA;AACpD,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,QAAA,CAAS,OAAO,KAAK,CAAA;AAChD,EAAA,MAAM,WAAoC,EAAC;AAC3C,EAAA,MAAM,GAAA,GAAM,OAAA;AACZ,EAAA,KAAA,MAAW,OAAO,CAAC,KAAA,EAAO,MAAA,EAAQ,aAAA,EAAe,WAAW,CAAA,EAAY;AACtE,IAAA,IAAI,MAAA,CAAO,MAAA,CAAO,GAAA,EAAK,GAAG,CAAA,EAAG;AAC3B,MAAA,QAAA,CAAS,QAAQ,WAAA,GAAc,UAAA,GAAa,GAAG,CAAA,GAAI,IAAI,GAAG,CAAA;AAAA,IAC5D;AAAA,EACF;AACA,EAAA,IAAI,KAAA,IAAS,QAAA,EAAU,YAAA,CAAa,QAAA,CAAS,KAAK,QAAQ,CAAA;AAC1D,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,cAAA,CAAe,UAAA,EAAY,EAAE,UAAA,EAAY,QAAA,EAAU,GAAG,QAAA,EAAU,CAAA;AAC7F,IAAA,OAAO,EAAE,OAAA,EAAQ;AAAA,EACnB,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,GAAA,GAAM,OAAO,GAAG,CAAA;AACtB,IAAA,IAAI,YAAA,CAAa,KAAK,GAAG,CAAA,IAAM,eAAe,KAAA,IAAS,GAAA,CAAI,SAAS,uBAAA,EAA0B;AAC5F,MAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,IAAI,OAAA,CAAQ,YAAA,EAAc,EAAE,CAAC,CAAA;AAAA,IAC3D;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAEA,eAAsB,YAAA,CACpB,MAAA,EACA,OAAA,EACA,UAAA,EACkB;AAClB,EAAA,MAAM,WAAW,wBAAA,CAAyB,UAAA,EAAY,EAAE,OAAA,EAAS,iBAAiB,CAAA;AAClF,EAAA,MAAM,MAAA,GAAS,mBAAA,CAAoB,SAAA,CAAU,OAAO,CAAA;AACpD,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,QAAA,CAAS,OAAO,KAAK,CAAA;AAChD,EAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AAKpB,EAAA,KAAA,MAAW,OAAO,IAAA,CAAK,YAAA,IAAgB,EAAC,mBAAoB,GAAG,CAAA;AAC/D,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO,KAAK,KAAA,EAAO;AAAA,MAC7C,WAAW,IAAA,CAAK,UAAA;AAAA,MAChB,aAAa,IAAA,CAAK,YAAA;AAAA,MAClB,UAAA,EAAY,QAAA;AAAA,MACZ,MAAM,IAAA,CAAK,KAAA;AAAA,MACX,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,kBAAkB,IAAA,CAAK;AAAA,KACxB,CAAA;AACD,IAAA,MAAM,IAAA,GAAA,CAAQ,MAAA,CAAO,IAAA,IAAQ,EAAC,EAAG,IAAI,CAAC,GAAA,KAAQ,MAAA,CAAO,GAAG,CAAC,CAAA;AACzD,IAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,MAAA,CAAO,KAAA,EAAM;AAAA,EACrC,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,eAAe,KAAA,IAAS,yBAAA,CAA0B,IAAA,CAAK,GAAA,CAAI,OAAO,CAAA,EAAG;AACvE,MAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,IACzC;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAEA,eAAsB,WAAA,CACpB,QACA,QAAA,EACkB;AAClB,EAAA,OAAO,MAAA,CAAO,KAAA,CAAM,QAAA,IAAY,IAAI,CAAA;AACtC;;;AClWA,WAAA,EAAA;;;ACEO,SAAS,UAAA,CACd,KACA,UAAA,EACS;AAGT,EAAA,IAAI,UAAA,KAAe,IAAA,IAAQ,UAAA,KAAe,OAAA,EAAS,OAAO,IAAA;AAC1D,EAAA,IAAI,GAAA,IAAO,MAAM,OAAO,IAAA;AACxB,EAAA,IAAI,CAAC,GAAA,CAAI,MAAA,EAAQ,OAAO,KAAA;AACxB,EAAA,MAAM,IAAA,GAAO,IAAI,GAAA,CAAK,UAAA,IAAuC,EAAE,CAAA;AAC/D,EAAA,OAAO,IAAI,IAAA,CAAK,CAAC,MAAM,IAAA,CAAK,GAAA,CAAI,CAAC,CAAC,CAAA;AACpC;;;ACZA,WAAA,EAAA;AAOO,IAAM,uBAAA,GAA0B,EAAA;AAChC,IAAM,kBAAA,GAAqB,EAAA;AAC3B,IAAM,cAAA,GAAiB,GAAA;AAE9B,IAAM,YAAA,GAAe,oFAAA;AA0BrB,SAAS,YAAY,GAAA,EAAsB;AACzC,EAAA,MAAM,OAAA,GAAU,IAAI,IAAA,EAAK;AACzB,EAAA,IACE,QAAQ,MAAA,IAAU,CAAA,IAClB,QAAQ,CAAC,CAAA,KAAM,QAAQ,OAAA,CAAQ,MAAA,GAAS,CAAC,CAAA,KACxC,QAAQ,CAAC,CAAA,KAAM,OAAO,OAAA,CAAQ,CAAC,MAAM,GAAA,CAAA,EACtC;AACA,IAAA,OAAO,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAAA,EAC5B;AACA,EAAA,IAAI,SAAA,CAAU,KAAK,OAAO,CAAA,SAAU,MAAA,CAAO,QAAA,CAAS,SAAS,EAAE,CAAA;AAC/D,EAAA,IAAI,eAAe,IAAA,CAAK,OAAO,GAAG,OAAO,MAAA,CAAO,WAAW,OAAO,CAAA;AAClE,EAAA,OAAO,OAAA;AACT;AAEA,SAAS,iBAAA,CAAkB,WAAoB,IAAA,EAAwC;AACrF,EAAA,IAAI,OAAO,SAAA,KAAc,QAAA,EAAU,OAAO,IAAA;AAC1C,EAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,IAAA,CAAK,SAAS,CAAA;AACzC,EAAA,IAAI,CAAC,KAAA,EAAO,MAAA,EAAQ,OAAO,IAAA;AAC3B,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,KAAA;AAC/B,EAAA,MAAM,EAAA,GAAK,MAAM,MAAA,CAAO,EAAA;AACxB,EAAA,IAAI,EAAE,SAAA,IAAa,IAAA,CAAA,EAAO,OAAO,IAAA;AACjC,EAAA,MAAM,IAAA,GAAO,KAAK,SAAS,CAAA;AAC3B,EAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,KAAA,CAAM,MAAA,CAAO,KAAM,CAAA;AAC7C,EAAA,IAAI;AACF,IAAA,QAAQ,EAAA;AAAI,MACV,KAAK,GAAA;AACH,QAAA,OAAQ,IAAA,GAAmB,KAAA;AAAA,MAC7B,KAAK,IAAA;AACH,QAAA,OAAQ,IAAA,IAAoB,KAAA;AAAA,MAC9B,KAAK,GAAA;AACH,QAAA,OAAQ,IAAA,GAAmB,KAAA;AAAA,MAC7B,KAAK,IAAA;AACH,QAAA,OAAQ,IAAA,IAAoB,KAAA;AAAA,MAC9B,KAAK,IAAA;AACH,QAAA,OAAO,IAAA,KAAS,KAAA;AAAA,MAClB,KAAK,IAAA;AACH,QAAA,OAAO,IAAA,KAAS,KAAA;AAAA,MAClB;AACE,QAAA,OAAO,IAAA;AAAA;AACX,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEO,SAAS,qBAAA,CACd,IACA,IAAA,EACS;AACT,EAAA,IAAI,EAAA,CAAG,kBAAkB,OAAO,IAAA;AAChC,EAAA,MAAM,MAAA,GAAS,EAAA,CAAG,cAAA,IAAkB,EAAC;AACrC,EAAA,MAAM,YAAY,MAAA,CAAO,SAAA;AACzB,EAAA,IAAI,CAAC,WAAW,OAAO,KAAA;AACvB,EAAA,OAAO,iBAAA,CAAkB,SAAA,EAAW,IAAA,IAAQ,EAAE,CAAA;AAChD;AAEA,SAAS,YAAY,GAAA,EAA8C;AACjE,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,MAAA,CAAO,GAAA,CAAI,EAAE,CAAA;AAAA,IACjB,QAAA,EAAU,MAAA,CAAO,GAAA,CAAI,SAAS,CAAA;AAAA,IAC9B,cAAA,EAAiB,GAAA,CAAI,gBAAA,IAAgD,EAAC;AAAA,IACtE,QAAA,EAAW,IAAI,SAAA,IAA+B,IAAA;AAAA,IAC9C,aAAA,EAAgB,IAAI,cAAA,IAAoC,IAAA;AAAA,IACxD,YAAY,GAAA,CAAI,UAAA;AAAA,IAChB,MAAA,EAAQ,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AAAA,IACzB,QAAA,EAAW,IAAI,QAAA,IAA8B,IAAA;AAAA,IAC7C,YAAA,EAAe,IAAI,aAAA,IAAoD,IAAA;AAAA,IACvE,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,UAAU,CAAA;AAAA,IAChC,UAAA,EAAY,MAAA,CAAO,GAAA,CAAI,WAAW,CAAA;AAAA,IAClC,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,UAAU;AAAA,GAClC;AACF;AAUA,SAAS,OAAO,KAAA,EAA6B;AAC3C,EAAA,IAAI,KAAA,IAAS,MAAM,OAAO,IAAA;AAC1B,EAAA,IAAI,KAAA,YAAiB,MAAM,OAAO,KAAA;AAClC,EAAA,OAAO,IAAI,IAAA,CAAK,MAAA,CAAO,KAAK,CAAC,CAAA;AAC/B;AAEA,SAAS,aAAA,CACP,YACA,UAAA,EACoC;AAGpC,EAAA,IAAI,UAAA,KAAe,IAAA,IAAQ,UAAA,KAAe,OAAA,EAAS,OAAO,EAAE,GAAA,EAAK,MAAA,EAAQ,MAAA,EAAQ,EAAC,EAAE;AACpF,EAAA,UAAA,GAAa,UAAA;AACb,EAAA,IAAI,CAAC,WAAW,MAAA,EAAQ;AACtB,IAAA,OAAO,EAAE,GAAA,EAAK,CAAA,kDAAA,CAAA,EAAsD,MAAA,EAAQ,EAAC,EAAE;AAAA,EACjF;AACA,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,uEAAuE,UAAU,CAAA,SAAA,CAAA;AAAA,IACtF,MAAA,EAAQ,CAAC,UAAU;AAAA,GACrB;AACF;AAcO,SAAS,kBAAA,CACd,YACA,UAAA,EACoC;AACpC,EAAA,IAAI,UAAA,KAAe,IAAA,IAAQ,UAAA,KAAe,OAAA,EAAS,OAAO,EAAE,GAAA,EAAK,MAAA,EAAQ,MAAA,EAAQ,EAAC,EAAE;AACpF,EAAA,MAAM,MAAA,GAAS,CAAA,4EAAA,CAAA;AACf,EAAA,UAAA,GAAa,UAAA;AACb,EAAA,IAAI,CAAC,UAAA,CAAW,MAAA,EAAQ,OAAO,EAAE,GAAA,EAAK,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA,CAAA,EAAK,MAAA,EAAQ,EAAC,EAAE;AAChE,EAAA,OAAO,EAAE,GAAA,EAAK,CAAA,CAAA,EAAI,MAAM,CAAA,mBAAA,EAAsB,UAAU,CAAA,SAAA,CAAA,EAAa,MAAA,EAAQ,CAAC,UAAU,CAAA,EAAE;AAC5F;AAQO,SAAS,sBAAsB,aAAA,EAAuC;AAC3E,EAAA,IAAI,aAAA,KAAkB,IAAA,IAAQ,aAAA,KAAkB,MAAA,EAAW,OAAO,IAAA;AAClE,EAAA,IAAI,OAAO,kBAAkB,QAAA,EAAU;AACrC,IAAA,MAAM,IAAI,SAAA,CAAU,CAAA,sDAAA,EAAyD,OAAO,aAAa,CAAA,CAAE,CAAA;AAAA,EACrG;AACA,EAAA,IAAI,CAAC,aAAA,EAAe,MAAM,IAAI,MAAM,0DAA0D,CAAA;AAC9F,EAAA,OAAO,aAAA;AACT;AAYA,SAAS,UAAA,CAAW,MAAmB,aAAA,EAA8B;AACnE,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,MAAA,IAAU,EAAC;AAC/B,EAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,IAAA,CAAK,IAAI,CAAA;AACxC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,oBAAO,IAAI,IAAA,EAAK;AACvC,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,MAAA,CAAO,eAAA,IAAmB,uBAAuB,CAAA;AACxE,EAAA,MAAM,YAAY,IAAI,IAAA,CAAK,UAAU,OAAA,EAAQ,GAAI,UAAU,GAAM,CAAA;AAIjE,EAAA,MAAM,UAAA,GAAa,KAAK,UAAA,KAAe,MAAA,IAAa,KAAK,UAAA,KAAe,OAAA,GAAU,OAAO,IAAA,CAAK,UAAA;AAC9F,EAAA,OAAO,EAAE,MAAA,EAAQ,SAAA,EAAW,SAAA,EAAW,YAAY,aAAA,EAAc;AACnE;AAEA,eAAe,aAAA,CACb,MAAA,EACA,IAAA,EACA,GAAA,EACyB;AACzB,EAAA,MAAM,KAAKC,iBAAA,EAAW;AACtB,EAAA,MAAM,OAAO,IAAA,CAAK,KAAA;AAAA,IAChB,CAAA;AAAA;AAAA,6DAAA,CAAA;AAAA,IAGA;AAAA,MACE,EAAA;AAAA,MACA,IAAA,CAAK,QAAA;AAAA,MACL,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA;AAAA,MACzB,KAAK,QAAA,IAAY,IAAA;AAAA,MACjB,GAAA,CAAI,aAAA;AAAA,MACJ,IAAI,UAAA,KAAe,IAAA,GAAO,OAAO,IAAA,CAAK,SAAA,CAAU,IAAI,UAAU,CAAA;AAAA,MAC9D,GAAA,CAAI,SAAA;AAAA,MACJ,GAAA,CAAI;AAAA;AACN,GACF;AACA,EAAA,OAAO;AAAA,IACL,EAAA;AAAA,IACA,UAAU,IAAA,CAAK,QAAA;AAAA,IACf,gBAAgB,GAAA,CAAI,MAAA;AAAA,IACpB,QAAA,EAAU,KAAK,QAAA,IAAY,IAAA;AAAA,IAC3B,eAAe,GAAA,CAAI,aAAA;AAAA,IACnB,YAAY,GAAA,CAAI,UAAA;AAAA,IAChB,MAAA,EAAQ,SAAA;AAAA,IACR,QAAA,EAAU,IAAA;AAAA,IACV,YAAA,EAAc,IAAA;AAAA,IACd,WAAW,GAAA,CAAI,SAAA;AAAA,IACf,UAAA,EAAY,IAAA;AAAA,IACZ,WAAW,GAAA,CAAI;AAAA,GACjB;AACF;AASA,eAAsB,aAAA,CAAc,QAAoB,IAAA,EAA4C;AAClG,EAAA,MAAM,aAAA,GAAgB,qBAAA,CAAsB,IAAA,CAAK,aAAa,CAAA;AAC9D,EAAA,OAAO,cAAc,MAAA,EAAQ,IAAA,EAAM,UAAA,CAAW,IAAA,EAAM,aAAa,CAAC,CAAA;AACpE;AA4BA,eAAsB,mBAAA,CACpB,QACA,IAAA,EACyB;AACzB,EAAA,MAAM,aAAA,GAAgB,qBAAA,CAAsB,IAAA,CAAK,aAAa,CAAA;AAC9D,EAAA,IAAI,aAAA,KAAkB,IAAA;AACpB,IAAA,MAAM,IAAI,MAAM,kEAAkE,CAAA;AACpF,EAAA,MAAM,GAAA,GAAM,UAAA,CAAW,IAAA,EAAM,aAAa,CAAA;AAC1C,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA;AAC5C,EAAA,MAAM,QAAA,GAAW,CAAA,uEAAA,CAAA;AACjB,EAAA,MAAM,SAAS,CAAC,IAAA,CAAK,UAAU,aAAA,EAAe,UAAA,EAAY,IAAI,SAAS,CAAA;AAGvE,EAAA,MAAM,OAAO,IAAA,CAAK,KAAA;AAAA,IAChB,CAAA;AAAA,WAAA,EACS,QAAQ,CAAA,4CAAA,CAAA;AAAA,IACjB;AAAA,GACF;AAIA,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,GAAU,CAAA,EAAG,OAAA,EAAA,EAAW;AAE5C,IAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,IAAA,CAAK,KAAA;AAAA,MAC9B,CAAA;AAAA,aAAA,EACS,QAAQ,CAAA;AAAA,sCAAA,CAAA;AAAA,MAEjB;AAAA,KACF;AACA,IAAA,IAAI,KAAA,CAAM,KAAK,CAAC,CAAA,SAAU,WAAA,CAAY,KAAA,CAAM,IAAA,CAAK,CAAC,CAAC,CAAA;AAEnD,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,aAAA,CAAc,MAAA,EAAQ,IAAA,EAAM,GAAG,CAAA;AAAA,IAC9C,SAAS,GAAA,EAAK;AACZ,MAAA,IAAK,GAAA,EAA2B,IAAA,KAAS,OAAA,EAAS,MAAM,GAAA;AAAA,IAC1D;AAAA,EACF;AACA,EAAA,MAAM,IAAI,MAAM,+EAA+E,CAAA;AACjG;AAEA,eAAsB,eAAA,CACpB,QACA,UAAA,EACA,QAAA,EACA,UACA,IAAA,GAAuC,IAAA,EACvC,IAAA,GAAmD,EAAC,EAC3B;AACzB,EAAA,IAAI,QAAA,KAAa,UAAA,IAAc,QAAA,KAAa,UAAA,EAAY;AACtD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,KAAK,SAAA,CAAU,QAAQ,CAAC,CAAA,oCAAA,CAAsC,CAAA;AAAA,EACrG;AACA,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,UAAA,KAAe,MAAA,GAAY,OAAO,IAAA,CAAK,UAAA;AAC/D,EAAA,MAAM,GAAA,GAAM,aAAA,CAAc,UAAA,EAAY,CAAC,CAAA;AACvC,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,CAAK,KAAA;AAAA,IAC/B,CAAA;AAAA;AAAA;AAAA;AAAA,WAAA,EAIS,IAAI,GAAG;AAAA,gBAAA,CAAA;AAAA,IAEhB,CAAC,QAAA,EAAU,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAA,IAAQ,EAAE,CAAA,EAAG,UAAA,EAAY,GAAG,GAAA,CAAI,MAAM;AAAA,GAC5E;AACA,EAAA,IAAI,MAAA,CAAO,aAAa,CAAA,EAAG,OAAO,YAAY,MAAA,CAAO,IAAA,CAAK,CAAC,CAAE,CAAA;AAE7D,EAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,yDAAA,CAAA,EAA6D;AAAA,IACpG;AAAA,GACD,CAAA;AACD,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,IAAA,CAAK,CAAC,CAAA;AAC3B,EAAA,MAAM,aAAA,GACJ,KAAK,UAAA,IAAc,IAAA,IAAQ,IAAI,UAAA,KAAe,IAAA,GAAO,OAAQ,GAAA,CAAI,UAAA;AACnE,EAAA,IAAI,CAAC,GAAA,IAAO,CAAC,UAAA,CAAW,KAAA,CAAM,OAAA,CAAQ,aAAa,CAAA,GAAI,aAAA,GAAgB,IAAA,EAAM,UAAU,CAAA,EAAG;AACxF,IAAA,MAAM,IAAI,mBAAmB,WAAW,CAAA;AAAA,EAC1C;AACA,EAAA,IAAI,GAAA,CAAI,WAAW,SAAA,EAAW;AAC5B,IAAA,MAAM,OAAO,IAAA,CAAK,KAAA;AAAA,MAChB,CAAA,gGAAA,CAAA;AAAA,MACA,CAAC,UAAU;AAAA,KACb;AACA,IAAA,MAAM,IAAI,eAAA,EAAgB;AAAA,EAC5B;AACA,EAAA,MAAM,IAAI,kBAAA,CAAmB,MAAA,CAAO,GAAA,CAAI,MAAM,CAAC,CAAA;AACjD;AASA,eAAsB,aAAA,CACpB,MAAA,EACA,IAAA,GAMI,EAAC,EACsB;AAC3B,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,KAAA,IAAS,kBAAkB,CAAA,EAAG,cAAc,CAAC,CAAA;AAC5F,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,UAAA,KAAe,MAAA,GAAY,OAAO,IAAA,CAAK,UAAA;AAC/D,EAAA,MAAM,SAAoB,EAAC;AAC3B,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,IAAI,IAAA,CAAK,UAAU,IAAA,EAAM;AACvB,IAAA,MAAA,CAAO,IAAA,CAAK,KAAK,MAAM,CAAA;AACvB,IAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,UAAA,EAAa,MAAA,CAAO,MAAM,CAAA,CAAE,CAAA;AAAA,EAC3C;AACA,EAAA,IAAI,IAAA,CAAK,YAAY,IAAA,EAAM;AACzB,IAAA,MAAA,CAAO,IAAA,CAAK,KAAK,QAAQ,CAAA;AACzB,IAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,aAAA,EAAgB,MAAA,CAAO,MAAM,CAAA,CAAE,CAAA;AAAA,EAC9C;AACA,EAAA,IAAI,IAAA,CAAK,iBAAiB,IAAA,EAAM;AAC9B,IAAA,MAAA,CAAO,IAAA,CAAK,KAAK,aAAa,CAAA;AAC9B,IAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,kBAAA,EAAqB,MAAA,CAAO,MAAM,CAAA,CAAE,CAAA;AAAA,EACnD;AACA,EAAA,MAAM,GAAA,GAAM,aAAA,CAAc,UAAA,EAAY,MAAA,CAAO,SAAS,CAAC,CAAA;AACvD,EAAA,OAAA,CAAQ,IAAA,CAAK,IAAI,GAAG,CAAA;AACpB,EAAA,MAAA,CAAO,IAAA,CAAK,GAAG,GAAA,CAAI,MAAM,CAAA;AACzB,EAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AACjB,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,CAAK,KAAA;AAAA,IAC/B,CAAA;AAAA,WAAA,EACS,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAC;AAAA;AAAA,YAAA,EAEpB,OAAO,MAAM,CAAA,CAAA;AAAA,IACvB;AAAA,GACF;AACA,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,GAAA,CAAI,WAAW,CAAA;AACpC;;;ACpZA,IAAM,KAAA,GAA6B,CAAC,MAAA,EAAQ,IAAA,EAAM,OAAO,UAAU,CAAA;AAwB5D,IAAM,UAAA,GAAN,MAAM,WAAA,CAAW;AAAA,EACtB,EAAA;AAAA,EACA,IAAA;AAAA,EACA,IAAA;AAAA,EACA,WAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,GAAA;AAAA,EACA,gBAAA;AAAA,EACA,cAAA;AAAA,EACA,OAAA;AAAA;AAAA;AAAA;AAAA,EAIA,QAAA;AAAA,EAEA,YAAY,IAAA,EAAsB;AAChC,IAAA,IAAA,CAAK,EAAA,GAAK,KAAK,EAAA,IAAM,IAAA;AACrB,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,WAAA,GAAc,KAAK,WAAA,IAAe,EAAA;AACvC,IAAA,IAAA,CAAK,MAAA,GAAS,IAAA,CAAK,MAAA,IAAU,EAAC;AAC9B,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA,CAAK,QAAA,IAAY,IAAA,CAAK,SAAA,IAAa,IAAA;AACnD,IAAA,IAAA,CAAK,GAAA,GAAM,KAAK,GAAA,IAAO,IAAA;AACvB,IAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA,CAAK,gBAAA,IAAoB,IAAA,CAAK,iBAAA,IAAqB,KAAA;AAC3E,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAA,CAAK,cAAA,IAAkB,IAAA,CAAK,mBAAmB,EAAC;AACtE,IAAA,IAAA,CAAK,OAAA,GAAU,KAAK,OAAA,IAAW,IAAA;AAC/B,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA,CAAK,QAAA,IAAY,IAAA,CAAK,aAAa,EAAC;AAAA,EACtD;AAAA,EAEA,OAAO,YAAY,IAAA,EAA2B;AAC5C,IAAA,IAAI,CAAC,QAAQ,OAAO,IAAA,KAAS,YAAY,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AAC5D,MAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,IACjD;AACA,IAAA,MAAM,CAAA,GAAI,IAAA;AACV,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,CAAA,CAAE,IAAA,IAAQ,EAAE,CAAA;AAChC,IAAA,IAAI,CAAC,KAAA,CAAM,QAAA,CAAS,IAAI,CAAA,EAAG;AACzB,MAAA,MAAM,IAAI,MAAM,CAAA,0CAAA,EAA6C,IAAA,CAAK,UAAU,CAAA,CAAE,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,IACvF;AACA,IAAA,MAAM,OAAO,MAAA,CAAO,CAAA,CAAE,IAAA,IAAQ,EAAE,EAAE,IAAA,EAAK;AACvC,IAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,kBAAkB,CAAA;AAC7C,IAAA,OAAO,IAAI,WAAA,CAAW;AAAA,MACpB,IAAI,CAAA,CAAE,EAAA,IAAM,OAAO,MAAA,CAAO,CAAA,CAAE,EAAE,CAAA,GAAI,IAAA;AAAA,MAClC,IAAA;AAAA,MACA,IAAA;AAAA,MACA,aAAa,CAAA,CAAE,WAAA,IAAe,OAAO,MAAA,CAAO,CAAA,CAAE,WAAW,CAAA,GAAI,EAAA;AAAA,MAC7D,MAAA,EAAS,CAAA,CAAE,MAAA,IAAkD,EAAC;AAAA,MAC9D,QAAA,EAAW,CAAA,CAAE,QAAA,IAAY,CAAA,CAAE,SAAA;AAAA,MAC3B,GAAA,EAAM,EAAE,GAAA,IAAuC,IAAA;AAAA,MAC/C,kBAAkB,OAAA,CAAQ,CAAA,CAAE,gBAAA,IAAoB,CAAA,CAAE,qBAAqB,KAAK,CAAA;AAAA,MAC5E,cAAA,EAAiB,CAAA,CAAE,cAAA,IAAkB,CAAA,CAAE,mBAAmB,EAAC;AAAA,MAC3D,SAAS,CAAA,CAAE,OAAA,KAAY,SAAY,IAAA,GAAO,OAAA,CAAQ,EAAE,OAAO,CAAA;AAAA,MAC3D,QAAA,EAAW,CAAA,CAAE,QAAA,IAAY,CAAA,CAAE,aAAa;AAAC,KAC1C,CAAA;AAAA,EACH;AACF,CAAA;AAEA,IAAM,OAAA,GAAqD;AAAA,EACzD,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,GAAA,EAAK,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,yCAAA,EAA0C;AAAA,MAC9E,MAAA,EAAQ;AAAA,QACN,IAAA,EAAM,QAAA;AAAA,QACN,MAAM,CAAC,KAAA,EAAO,MAAA,EAAQ,KAAA,EAAO,SAAS,QAAQ,CAAA;AAAA,QAC9C,OAAA,EAAS;AAAA,OACX;AAAA,MACA,OAAA,EAAS;AAAA,QACP,IAAA,EAAM,QAAA;AAAA,QACN,oBAAA,EAAsB,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,QACvC,SAAA,EAAW;AAAA,OACb;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,IAAA,EAAM;AAAA,QACJ,WAAA,EAAa;AAAA,OACf;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,WAAA,EAAa;AAAA,QACX,IAAA,EAAM,SAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,UAAA,EAAY;AAAA,QACV,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa,iDAAA;AAAA;AAAA,QAEb,SAAA,EAAW;AAAA,OACb;AAAA,MACA,aAAA,EAAe;AAAA,QACb,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,kBAAA,EAAoB;AAAA,QAClB,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa;AAAA;AACf,KACF;AAAA,IACA,QAAA,EAAU,CAAC,KAAA,EAAO,QAAQ;AAAA,GAC5B;AAAA,EACA,EAAA,EAAI;AAAA,IACF,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,MAAA,EAAQ;AAAA,QACN,IAAA,EAAM,QAAA;AAAA,QACN,IAAA,EAAM,CAAC,YAAA,EAAc,OAAA,EAAS,WAAW,OAAA,EAAS,QAAA,EAAU,QAAA,EAAU,YAAA,EAAc,WAAW;AAAA,OACjG;AAAA,MACA,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,MACvB,IAAA,EAAM,EAAE,IAAA,EAAM,SAAA,EAAU;AAAA,MACxB,QAAA,EAAU,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,MAC3B,QAAA,EAAU,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,MAC3B,QAAA,EAAU,EAAE,IAAA,EAAM,QAAA,EAAU,WAAW,IAAA,EAAK;AAAA,MAC5C,WAAA,EAAa;AAAA,QACX,IAAA,EAAM,QAAA;AAAA,QACN,IAAA,EAAM,CAAC,UAAA,EAAY,WAAA,EAAa,MAAM,CAAA;AAAA,QACtC,OAAA,EAAS;AAAA,OACX;AAAA,MACA,QAAA,EAAU,EAAE,IAAA,EAAM,SAAA,EAAW,SAAS,GAAA,EAAK;AAAA,MAC3C,eAAA,EAAiB,EAAE,IAAA,EAAM,OAAA,EAAS,OAAO,EAAE,IAAA,EAAM,UAAS,EAAE;AAAA;AAAA;AAAA;AAAA,MAI5D,YAAA,EAAc,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,MAC/B,WAAA,EAAa,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,MAC9B,SAAA,EAAW,EAAE,IAAA,EAAM,QAAA;AAAS,KAC9B;AAAA,IACA,QAAA,EAAU,CAAC,QAAA,EAAU,UAAU;AAAA,GACjC;AAAA,EACA,GAAA,EAAK;AAAA,IACH,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,GAAA,EAAK,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,MACtB,SAAA,EAAW,EAAE,IAAA,EAAM,QAAA,EAAU,MAAM,CAAC,KAAA,EAAO,MAAA,EAAQ,WAAW,CAAA,EAAE;AAAA,MAChE,KAAA,EAAO;AAAA,QACL,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa,iCAAA;AAAA,QACb,SAAA,EAAW;AAAA,OACb;AAAA,MACA,OAAA,EAAS;AAAA,QACP,IAAA,EAAM,QAAA;AAAA,QACN,oBAAA,EAAsB,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,QACvC,SAAA,EAAW;AAAA;AACb,KACF;AAAA,IACA,QAAA,EAAU,CAAC,KAAA,EAAO,WAAW;AAAA,GAC/B;AAAA,EACA,QAAA,EAAU;AAAA,IACR,IAAA,EAAM,QAAA;AAAA,IACN,YAAY;AAAC;AAEjB,CAAA;AAEO,SAAS,aAAa,IAAA,EAAyC;AACpE,EAAA,MAAM,MAAA,GAAS,QAAQ,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,KAAA,CAAM,sBAAsB,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA,CAAE,CAAA;AACzE,EAAA,OAAO,MAAA;AACT;AAcO,IAAM,iBAAA,GAAoB,cAAA;AAK1B,IAAM,mBAAA,GAAN,cAAkC,KAAA,CAAM;AAAC,CAAA;AAEhD,SAAS,cAAc,KAAA,EAAkD;AACvE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAEA,SAAS,UAAU,KAAA,EAAyB;AAK1C,EAAA,IAAI,aAAA,CAAc,KAAK,CAAA,EAAG;AACxB,IAAA,MAAM,MAA+B,EAAC;AACtC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,GAAI,SAAA,CAAU,CAAC,CAAA;AAChE,IAAA,OAAO,GAAA;AAAA,EACT;AACA,EAAA,IAAI,MAAM,OAAA,CAAQ,KAAK,GAAG,OAAO,KAAA,CAAM,IAAI,SAAS,CAAA;AACpD,EAAA,OAAO,iBAAA;AACT;AAEO,SAAS,iBAAiB,KAAA,EAAyB;AACxD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,KAAA,KAAU,iBAAA;AAChD,EAAA,IAAI,MAAM,OAAA,CAAQ,KAAK,GAAG,OAAO,KAAA,CAAM,KAAK,gBAAgB,CAAA;AAC5D,EAAA,IAAI,aAAA,CAAc,KAAK,CAAA,EAAG,OAAO,OAAO,MAAA,CAAO,KAAK,CAAA,CAAE,IAAA,CAAK,gBAAgB,CAAA;AAC3E,EAAA,OAAO,KAAA;AACT;AAOO,SAAS,YAAA,CAAa,MAAc,MAAA,EAA0D;AACnG,EAAA,MAAM,SACF,OAAA,CAAQ,IAAgB,GAAG,UAAA,IAA0D,OAAO,EAAC;AACjG,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AAIjD,IAAA,IAAI,IAAA,KAAS,MAAA,IAAU,GAAA,KAAQ,MAAA,EAAQ;AACrC,MAAA,GAAA,CAAI,GAAG,IAAI,MAAA,CAAO,WAAA,KAAgB,QAAQ,eAAA,CAAgB,KAAK,CAAA,GAAI,SAAA,CAAU,KAAK,CAAA;AAClF,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,MAAM,GAAG,CAAA;AACtB,IAAA,IAAI,IAAA,KAAS,MAAA,IAAa,IAAA,CAAK,SAAA,EAAW;AACxC,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,SAAA,CAAU,KAAK,CAAA;AAAA,IAC5B,CAAA,MAAO;AACL,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,eAAA,CAAgB,KAAK,CAAA;AAAA,IAClC;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAWO,SAAS,aAAA,CACd,UACA,MAAA,EACyB;AACzB,EAAA,MAAM,OAAA,GAAU,CAAC,KAAA,EAAgB,IAAA,EAAe,aAAsB,IAAA,KAA0B;AAC9F,IAAA,IAAI,aAAA,CAAc,KAAK,CAAA,EAAG;AACxB,MAAA,MAAM,QAAA,GAAW,aAAA,CAAc,IAAI,CAAA,GAAI,OAAO,EAAC;AAC/C,MAAA,MAAMC,OAA+B,EAAC;AACtC,MAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC1C,QAAAA,KAAI,CAAC,CAAA,GAAI,OAAA,CAAQ,CAAA,EAAG,SAAS,CAAC,CAAA,EAAG,CAAA,IAAK,QAAA,EAAU,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,CAAC,KAAK,CAAC,CAAA;AAAA,MAC3E;AACA,MAAA,OAAOA,IAAAA;AAAA,IACT;AACA,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAKxB,MAAA,MAAM,WAAW,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,GAAI,OAAO,EAAC;AAC/C,MAAA,OAAO,MAAM,GAAA,CAAI,CAAC,GAAG,CAAA,KAAM,OAAA,CAAQ,GAAG,QAAA,CAAS,CAAC,CAAA,EAAG,CAAA,GAAI,SAAS,MAAA,EAAQ,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,CAAC,GAAG,CAAC,CAAA;AAAA,IAC1F;AACA,IAAA,IAAI,UAAU,iBAAA,EAAmB;AAC/B,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,MAAM,IAAI,mBAAA;AAAA,UACR,UAAU,IAAI,CAAA,IAAA,EAAO,IAAA,CAAK,SAAA,CAAU,iBAAiB,CAAC,CAAA,kFAAA;AAAA,SAExD;AAAA,MACF;AACA,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AACA,EAAA,MAAM,QAAA,GAAW,UAAU,EAAC;AAC5B,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,CAAA,EAAG;AAC7C,IAAA,GAAA,CAAI,CAAC,IAAI,OAAA,CAAQ,CAAA,EAAG,SAAS,CAAC,CAAA,EAAG,CAAA,IAAK,QAAA,EAAU,CAAC,CAAA;AAAA,EACnD;AACA,EAAA,OAAO,GAAA;AACT;AC1SO,SAAS,WAAA,CAAY,MAA+B,GAAA,EAAqB;AAC9E,EAAA,MAAM,KAAA,GAAQC,mBAAY,EAAE,CAAA;AAC5B,EAAA,MAAM,MAAA,GAASC,qBAAA,CAAe,aAAA,EAAe,GAAA,EAAK,KAAK,CAAA;AACvD,EAAA,MAAM,YAAY,MAAA,CAAO,IAAA,CAAK,KAAK,SAAA,CAAU,IAAI,GAAG,MAAM,CAAA;AAC1D,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA,EAAG,MAAA,CAAO,KAAA,EAAO,CAAC,CAAA;AAC3E,EAAA,MAAM,GAAA,GAAM,OAAO,UAAA,EAAW;AAC9B,EAAA,OAAO,MAAA,CAAO,OAAO,CAAC,KAAA,EAAO,YAAY,GAAG,CAAC,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AAClE;AAEO,SAAS,WAAA,CAAY,OAAe,GAAA,EAAsC;AAC/E,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,KAAA,EAAO,QAAQ,CAAA;AACvC,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,QAAA,CAAS,CAAA,EAAG,EAAE,CAAA;AAChC,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,QAAA,CAAS,GAAA,CAAI,SAAS,EAAE,CAAA;AACxC,EAAA,MAAM,aAAa,GAAA,CAAI,QAAA,CAAS,EAAA,EAAI,GAAA,CAAI,SAAS,EAAE,CAAA;AACnD,EAAA,MAAM,QAAA,GAAWC,uBAAA,CAAiB,aAAA,EAAe,GAAA,EAAK,KAAK,CAAA;AAC3D,EAAA,QAAA,CAAS,WAAW,GAAG,CAAA;AACvB,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,MAAA,CAAO,CAAC,QAAA,CAAS,MAAA,CAAO,UAAU,CAAA,EAAG,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AAC/E,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,SAAA,CAAU,QAAA,CAAS,MAAM,CAAC,CAAA;AAC9C;AAEO,SAAS,aAAa,MAAA,EAA+C;AAC1E,EAAA,MAAM,YAAY,MAAA,CAAO,SAAA;AACzB,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KAGF;AAAA,EACF;AACA,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,SAAA,EAAW,WAAW,CAAA;AAC3C;AAEO,SAAS,aAAA,CAAc,KAAsB,KAAA,EAAuB;AACzE,EAAA,MAAM,IAAI,OAAO,GAAA,KAAQ,WAAW,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,GAAI,GAAA;AACvD,EAAA,OAAOC,iBAAA,CAAW,UAAU,CAAC,CAAA,CAAE,OAAO,KAAA,EAAO,MAAM,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AACnE;ACRO,IAAM,kBAAA,GAAqB,GAAA;AAG3B,IAAM,aAAA,GAAgB,CAAA;AAgBtB,SAAS,WAAW,IAAA,EAAkD;AAC3E,EAAA,OAAQ,KAAK,MAAA,IAAU,GAAA,IAAO,KAAK,MAAA,GAAS,GAAA,IAAQ,KAAK,IAAA,KAAS,gBAAA;AACpE;AAOO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EACtC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AAAA,EACd;AACF,CAAA;AAMO,IAAM,QAAA,GAAW;AAAA,EACtB,MAAM,OAAO,IAAA,EAAiC;AAC5C,IAAA,MAAM,OAAA,GAAU,MAAMC,YAAA,CAAI,MAAA,CAAO,IAAA,EAAM,EAAE,GAAA,EAAK,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,CAAA;AACpE,IAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,OAAO,CAAA;AAAA,EACrC;AACF,CAAA;AAQA,IAAM,UAAA,GAAsC;AAAA,EAC1C,CAAC,WAAW,CAAC,CAAA;AAAA;AAAA,EACb,CAAC,YAAY,CAAC,CAAA;AAAA;AAAA,EACd,CAAC,cAAc,EAAE,CAAA;AAAA;AAAA,EACjB,CAAC,aAAa,CAAC,CAAA;AAAA;AAAA,EACf,CAAC,eAAe,EAAE,CAAA;AAAA;AAAA,EAClB,CAAC,cAAc,EAAE,CAAA;AAAA;AAAA,EACjB,CAAC,eAAe,EAAE,CAAA;AAAA;AAAA,EAClB,CAAC,aAAa,CAAC,CAAA;AAAA;AAAA,EACf,CAAC,aAAa,CAAC,CAAA;AAAA;AAAA,EACf,CAAC,mBAAmB,EAAE;AAAA;AACxB,CAAA;AAEA,IAAM,UAAA,GAAsC;AAAA,EAC1C,CAAC,MAAM,GAAG,CAAA;AAAA;AAAA,EACV,CAAC,OAAO,GAAG,CAAA;AAAA;AAAA,EACX,CAAC,cAAc,EAAE,CAAA;AAAA;AAAA,EACjB,CAAC,aAAa,EAAE,CAAA;AAAA;AAAA,EAChB,CAAC,UAAU,EAAE,CAAA;AAAA;AAAA,EACb,CAAC,UAAU,CAAC,CAAA;AAAA;AAAA,EACZ,CAAC,UAAU,EAAE,CAAA;AAAA;AAAA,EACb,CAAC,UAAU,EAAE,CAAA;AAAA;AAAA,EACb,CAAC,UAAU,CAAC,CAAA;AAAA;AAAA,EACZ,CAAC,UAAU,EAAE;AAAA;AACf,CAAA;AAGA,SAAS,QAAQ,IAAA,EAAiC;AAChD,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC5B,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAC/B,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,CAAC,CAAA;AAC5B,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK;AAC1B,IAAA,MAAM,IAAA,GAAO,MAAM,CAAC,CAAA;AACpB,IAAA,IAAI,CAAC,WAAA,CAAY,IAAA,CAAK,IAAI,GAAG,OAAO,IAAA;AACpC,IAAA,MAAM,KAAA,GAAQ,OAAO,IAAI,CAAA;AACzB,IAAA,IAAI,KAAA,GAAQ,KAAK,OAAO,IAAA;AACxB,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,KAAA;AAAA,EACX;AACA,EAAA,OAAO,GAAA;AACT;AAMA,SAAS,QAAQ,IAAA,EAAiC;AAChD,EAAA,IAAI,OAAO,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,EAAA;AACjC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AACtC,EAAA,IAAI,SAAA,GAAY,GAAG,OAAO,IAAA;AAC1B,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,SAAA,GAAY,CAAC,CAAA;AACrC,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG;AACtB,IAAA,MAAM,EAAA,GAAK,QAAQ,IAAI,CAAA;AACvB,IAAA,IAAI,CAAC,IAAI,OAAO,IAAA;AAChB,IAAA,MAAM,EAAA,GAAA,CAAQ,GAAG,CAAC,CAAA,IAAgB,IAAM,EAAA,CAAG,CAAC,CAAA,EAAc,QAAA,CAAS,EAAE,CAAA;AACrE,IAAA,MAAM,EAAA,GAAA,CAAQ,GAAG,CAAC,CAAA,IAAgB,IAAM,EAAA,CAAG,CAAC,CAAA,EAAc,QAAA,CAAS,EAAE,CAAA;AACrE,IAAA,IAAA,GAAO,CAAA,EAAG,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,SAAA,GAAY,CAAC,CAAC,CAAA,EAAG,EAAE,CAAA,CAAA,EAAI,EAAE,CAAA,CAAA;AAAA,EACnD;AACA,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC9B,EAAA,IAAI,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG,OAAO,IAAA;AAC9B,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,CAAC,CAAA,GAAK,MAAA,CAAO,CAAC,CAAA,CAAa,KAAA,CAAM,GAAG,CAAA,GAAI,EAAC;AAC7D,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,MAAA,KAAW,CAAA,IAAK,MAAA,CAAO,CAAC,CAAA,GAAK,MAAA,CAAO,CAAC,CAAA,CAAa,KAAA,CAAM,GAAG,IAAI,EAAC;AACpF,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACvB,IAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAC9B,IAAA,MAAA,GAAS,IAAA;AAAA,EACX,CAAA,MAAO;AACL,IAAA,MAAM,OAAA,GAAU,CAAA,GAAI,IAAA,CAAK,MAAA,GAAS,IAAA,CAAK,MAAA;AACvC,IAAA,IAAI,OAAA,GAAU,GAAG,OAAO,IAAA;AACxB,IAAA,MAAA,GAAS,CAAC,GAAG,IAAA,EAAM,GAAG,KAAA,CAAM,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,EAAG,GAAG,IAAI,CAAA;AAAA,EACzD;AACA,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,EAAE,CAAA;AAC7B,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK;AAC1B,IAAA,MAAM,KAAA,GAAQ,OAAO,CAAC,CAAA;AACtB,IAAA,IAAI,CAAC,kBAAA,CAAmB,IAAA,CAAK,KAAK,GAAG,OAAO,IAAA;AAC5C,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,QAAA,CAAS,KAAA,EAAO,EAAE,CAAA;AACvC,IAAA,GAAA,CAAI,CAAA,GAAI,CAAC,CAAA,GAAI,KAAA,IAAS,CAAA;AACtB,IAAA,GAAA,CAAI,CAAA,GAAI,CAAA,GAAI,CAAC,CAAA,GAAI,KAAA,GAAQ,GAAA;AAAA,EAC3B;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,aAAa,IAAA,EAAiC;AACrD,EAAA,MAAM,MAAA,GAASC,SAAK,IAAI,CAAA;AACxB,EAAA,IAAI,MAAA,KAAW,CAAA,EAAG,OAAO,OAAA,CAAQ,IAAI,CAAA;AACrC,EAAA,IAAI,MAAA,KAAW,CAAA,EAAG,OAAO,OAAA,CAAQ,IAAI,CAAA;AACrC,EAAA,OAAO,IAAA;AACT;AAGA,SAAS,KAAA,CAAM,IAAA,EAAkB,GAAA,EAAiB,MAAA,EAAyB;AACzE,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,GAAA,CAAI,MAAA,EAAQ,OAAO,KAAA;AACvC,EAAA,MAAM,QAAQ,MAAA,IAAU,CAAA;AACxB,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,EAAO,CAAA,EAAA,EAAK,IAAI,IAAA,CAAK,CAAC,CAAA,KAAM,GAAA,CAAI,CAAC,CAAA,EAAG,OAAO,KAAA;AAC/D,EAAA,MAAM,OAAO,MAAA,GAAS,CAAA;AACtB,EAAA,IAAI,IAAA,KAAS,GAAG,OAAO,IAAA;AACvB,EAAA,MAAM,IAAA,GAAO,OAAS,CAAA,GAAI,IAAA;AAC1B,EAAA,OAAA,CAAS,KAAK,KAAK,CAAA,GAAe,IAAA,OAAY,GAAA,CAAI,KAAK,CAAA,GAAe,IAAA,CAAA;AACxE;AAEA,SAAS,QAAQ,KAAA,EAA6D;AAC5E,EAAA,OAAO,MAAM,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,MAAM,CAAA,KAAM;AACnC,IAAA,MAAM,KAAA,GAAQ,aAAa,IAAI,CAAA;AAC/B,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,IAAI,CAAA,CAAE,CAAA;AACjE,IAAA,OAAO,CAAC,OAAO,MAAM,CAAA;AAAA,EACvB,CAAC,CAAA;AACH;AAEA,IAAM,OAAA,GAAU,QAAQ,UAAU,CAAA;AAClC,IAAM,OAAA,GAAU,QAAQ,UAAU,CAAA;AAElC,IAAM,SAAA,GAAY,QAAQ,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAA,CAAE,CAAC,CAAA;AACjD,IAAM,KAAA,GAAQ,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAA,CAAE,CAAC,CAAA;AAC5C,IAAM,SAAA,GAAY,QAAQ,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA,CAAE,CAAC,CAAA;AAQ7C,SAAS,WAAW,KAAA,EAAsC;AACxD,EAAA,IAAI,MAAM,KAAA,EAAO,SAAA,CAAU,CAAC,CAAA,EAAG,UAAU,CAAC,CAAC,CAAA,IAAK,KAAA,CAAM,OAAO,KAAA,CAAM,CAAC,GAAG,KAAA,CAAM,CAAC,CAAC,CAAA,EAAG;AAChF,IAAA,OAAO,KAAA,CAAM,QAAA,CAAS,EAAA,EAAI,EAAE,CAAA;AAAA,EAC9B;AACA,EAAA,IAAI,KAAA,CAAM,KAAA,EAAO,SAAA,CAAU,CAAC,CAAA,EAAG,SAAA,CAAU,CAAC,CAAC,CAAA,EAAG,OAAO,KAAA,CAAM,QAAA,CAAS,GAAG,CAAC,CAAA;AACxE,EAAA,OAAO,IAAA;AACT;AAGA,SAAS,iBAAiB,OAAA,EAA0B;AAClD,EAAA,MAAM,KAAA,GAAQ,aAAa,OAAO,CAAA;AAClC,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,QAAQ,IAAA,CAAK,CAAC,CAAC,GAAA,EAAK,MAAM,CAAA,KAAM,KAAA,CAAM,KAAA,EAAO,GAAA,EAAK,MAAM,CAAC,CAAA;AACxF,EAAA,MAAM,QAAA,GAAW,WAAW,KAAK,CAAA;AACjC,EAAA,IAAI,QAAA,IAAY,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAC,GAAA,EAAK,MAAM,CAAA,KAAM,KAAA,CAAM,QAAA,EAAU,GAAA,EAAK,MAAM,CAAC,GAAG,OAAO,IAAA;AACtF,EAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAC,GAAA,EAAK,MAAM,CAAA,KAAM,KAAA,CAAM,KAAA,EAAO,GAAA,EAAK,MAAM,CAAC,CAAA;AAClE;AAWA,eAAsB,iBAAiB,IAAA,EAAgC;AACrE,EAAA,IAAI,IAAA,GAAA,CAAQ,QAAQ,EAAA,EACjB,IAAA,GACA,WAAA,EAAY,CACZ,OAAA,CAAQ,YAAA,EAAc,EAAE,CAAA;AAC3B,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,IAAI,IAAA,KAAS,aAAa,OAAO,IAAA;AAGjC,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,IAAK,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAEvE,EAAA,IAAIA,QAAA,CAAK,IAAI,CAAA,EAAG,OAAO,iBAAiB,IAAI,CAAA;AAE5C,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,SAAA,GAAY,MAAM,QAAA,CAAS,MAAA,CAAO,IAAI,CAAA;AAAA,EACxC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI,CAAC,SAAA,CAAU,MAAA,EAAQ,OAAO,IAAA;AAC9B,EAAA,OAAO,SAAA,CAAU,IAAA,CAAK,CAAC,OAAA,KAAY,gBAAA,CAAiB,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,OAAO,CAAC,CAAA;AACvF;AASA,eAAsB,mBAAA,CAAoB,KAAa,IAAA,EAAgD;AACrG,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAI,GAAA,CAAI,GAAA,IAAO,EAAE,CAAA;AAAA,EAC5B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,YAAA,CAAa,CAAA,eAAA,EAAkB,KAAK,SAAA,CAAU,GAAG,CAAC,CAAA,mBAAA,CAAqB,CAAA;AAAA,EACnF;AACA,EAAA,MAAM,SAAS,MAAA,CAAO,QAAA,CAAS,QAAQ,IAAA,EAAM,EAAE,EAAE,WAAA,EAAY;AAC7D,EAAA,IAAI,MAAA,KAAW,MAAA,IAAU,MAAA,KAAW,OAAA,EAAS;AAC3C,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,CAAA,sCAAA,EAAyC,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA,4CAAA;AAAA,KAEjE;AAAA,EACF;AACA,EAAA,IAAI,KAAK,YAAA,EAAc;AACvB,EAAA,MAAM,OAAO,MAAA,CAAO,QAAA;AACpB,EAAA,IAAI,MAAM,gBAAA,CAAiB,IAAI,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,CAAA,eAAA,EAAkB,QAAQ,WAAW,CAAA,4FAAA;AAAA,KAEvC;AAAA,EACF;AACF;;;AC7RO,IAAM,WAAA,GAAc,OAAA;;;ACqB3B,eAAe,WAAA,CAAY,KAAa,YAAA,EAAsC;AAC5E,EAAA,IAAI,OAAA,GAAU,GAAA;AACd,EAAA,MAAM,MAAA,GAAA,CAAU,oBAAoB,IAAA,CAAK,GAAA,IAAO,EAAE,CAAA,GAAI,CAAC,CAAA,IAAK,EAAA,EAAI,WAAA,EAAY;AAC5E,EAAA,IAAI,MAAA,KAAW,MAAM,OAAA,GAAU,CAAA,KAAA,EAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,MAAA,GAAS,CAAC,CAAC,CAAA,CAAA;AAAA,OAAA,IAC1D,MAAA,KAAW,OAAO,OAAA,GAAU,CAAA,MAAA,EAAS,IAAI,KAAA,CAAM,MAAA,CAAO,MAAA,GAAS,CAAC,CAAC,CAAA,CAAA;AAC1E,EAAA,MAAM,mBAAA,CAAoB,OAAA,EAAS,EAAE,YAAA,EAAc,CAAA;AACrD;AAGA,IAAM,gBAAA,GAAmB,+CAAA;AAElB,IAAM,QAAA,GAAN,MAAM,SAAA,SAAiB,KAAA,CAAM;AAAA,EAClC,IAAA;AAAA,EACA,IAAA;AAAA,EACA,WAAA,CAAY,IAAA,EAAc,OAAA,EAAiB,IAAA,GAAgB,IAAA,EAAM;AAC/D,IAAA,KAAA,CAAM,CAAA,CAAA,EAAI,IAAI,CAAA,EAAA,EAAK,OAAO,CAAA,CAAE,CAAA;AAC5B,IAAA,IAAA,CAAK,IAAA,GAAO,UAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AAAA,EACA,OAAO,YAAY,GAAA,EAAwC;AACzD,IAAA,OAAO,IAAI,SAAA,CAAS,MAAA,CAAO,GAAA,CAAI,IAAA,IAAQ,KAAM,CAAA,EAAG,MAAA,CAAO,GAAA,CAAI,OAAA,IAAW,WAAW,CAAA,EAAG,IAAI,IAAI,CAAA;AAAA,EAC9F;AACF,CAAA;AAWA,SAAS,eAAe,GAAA,EAA6C;AACnE,EAAA,MAAM,SAAA,GAAY,IACf,KAAA,CAAM,IAAI,EACV,MAAA,CAAO,CAAC,OAAO,EAAA,CAAG,UAAA,CAAW,OAAO,CAAC,CAAA,CACrC,IAAI,CAAC,EAAA,KAAO,GAAG,KAAA,CAAM,CAAC,CAAA,CAAE,SAAA,EAAW,CAAA;AACtC,EAAA,IAAI,CAAC,SAAA,CAAU,MAAA,EAAQ,OAAO,IAAA;AAC9B,EAAA,IAAI;AACF,IAAA,MAAM,UAAU,IAAA,CAAK,KAAA,CAAM,SAAA,CAAU,IAAA,CAAK,IAAI,CAAC,CAAA;AAC/C,IAAA,IAAI,WAAW,OAAO,OAAA,KAAY,aAAa,QAAA,IAAY,OAAA,IAAW,WAAW,OAAA,CAAA,EAAU;AACzF,MAAA,OAAO,OAAA;AAAA,IACT;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,IAAA;AACT;AAEO,IAAM,gBAAN,MAAyC;AAAA,EAC9C,IAAA,GAAO,MAAA;AAAA,EACP,GAAA;AAAA,EACA,YAAA;AAAA,EACQ,WAAA;AAAA,EACA,SAAA,GAA2B,IAAA;AAAA,EAEnC,WAAA,CAAY,GAAA,EAAa,OAAA,EAAiC,YAAA,GAAe,KAAA,EAAO;AAC9E,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AACX,IAAA,IAAA,CAAK,YAAA,GAAe,YAAA;AACpB,IAAA,IAAA,CAAK,WAAA,GAAc;AAAA,MACjB,GAAG,OAAA;AAAA,MACH,cAAA,EAAgB,kBAAA;AAAA,MAChB,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AAAA,EAEA,MAAM,OAAA,GAAyB;AAG7B,IAAA,MAAM,WAAA,CAAY,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,YAAY,CAAA;AAAA,EAC/C;AAAA,EAEA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA;AAAA,EACnB;AAAA,EAEQ,YAAA,GAAuC;AAC7C,IAAA,MAAM,IAAA,GAAO,EAAE,GAAG,IAAA,CAAK,WAAA,EAAY;AACnC,IAAA,IAAI,IAAA,CAAK,SAAA,EAAW,IAAA,CAAK,gBAAgB,IAAI,IAAA,CAAK,SAAA;AAClD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,QAAQ,GAAA,EAAgE;AAC5E,IAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,IAAA,CAAK,GAAA,EAAK;AAAA,MACjC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,KAAK,YAAA,EAAa;AAAA,MAC3B,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,GAAG,CAAA;AAAA;AAAA;AAAA;AAAA,MAIxB,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AAC7C,IAAA,IAAI,GAAA,OAAU,SAAA,GAAY,GAAA;AAC1B,IAAA,IAAI,UAAA,CAAW,IAAI,CAAA,EAAG;AACpB,MAAA,MAAM,IAAI,QAAA,CAAS,IAAA,CAAK,MAAA,EAAQ,gBAAgB,CAAA;AAAA,IAClD;AACA,IAAA,IAAI,IAAA,CAAK,UAAU,GAAA,EAAK;AACtB,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,EAAK;AAC7B,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,iBAAA,EAAoB,IAAA,CAAK,MAAM,CAAA,MAAA,EAAS,IAAA,CAAK,GAAG,CAAA,EAAA,EAAK,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,CAAA;AACvF,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,KAAA,EAAQ,IAAA,CAAK,MAAM,CAAA,EAAA,EAAK,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,IAC9D;AACA,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AACxD,IAAA,IAAI,WAAA,CAAY,QAAA,CAAS,mBAAmB,CAAA,EAAG;AAC7C,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,EAAK;AAC7B,MAAA,IAAI,SAAkC,EAAC;AACvC,MAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,KAAA,CAAM,YAAY,CAAA,EAAG;AAC5C,QAAA,MAAM,MAAA,GAAS,eAAe,KAAK,CAAA;AACnC,QAAA,IAAI,QAAQ,MAAA,GAAS,MAAA;AAAA,MACvB;AACA,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,OAAQ,MAAM,KAAK,IAAA,EAAK;AAAA,EAC1B;AAAA,EAEA,MAAM,KAAK,GAAA,EAA6C;AACtD,IAAA,MAAM,IAAA,CAAK,QAAQ,GAAG,CAAA;AAAA,EACxB;AAAA,EAEA,MAAM,IAAA,GAAyC;AAC7C,IAAA,OAAO,EAAC;AAAA,EACV;AAAA,EAEA,cAAA,GAAyC;AACvC,IAAA,OAAO,EAAE,GAAG,IAAA,CAAK,WAAA,EAAY;AAAA,EAC/B;AACF,CAAA;AAEO,IAAM,eAAN,MAAwC;AAAA,EAC7C,IAAA,GAAO,KAAA;AAAA,EACP,SAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,YAAA;AAAA;AAAA;AAAA;AAAA,EAIQ,OAAA,GAAyB,IAAA;AAAA;AAAA;AAAA;AAAA,EAIzB,cAAA,GAAgC,IAAA;AAAA,EAChC,QAAwC,EAAC;AAAA,EACzC,UAAuD,EAAC;AAAA,EACxD,KAAA,GAAgC,IAAA;AAAA,EAExC,WAAA,CAAY,GAAA,EAAa,OAAA,EAAiC,YAAA,GAAe,KAAA,EAAO;AAC9E,IAAA,IAAA,CAAK,YAAA,GAAe,YAAA;AACpB,IAAA,IAAA,CAAK,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACtC,IAAA,IAAI,GAAA,CAAI,SAAS,SAAS,CAAA,OAAQ,OAAA,GAAU,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAAA,SAAA,IAClD,GAAA,CAAI,SAAS,MAAM,CAAA,OAAQ,OAAA,GAAU,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAAA,SACxD,IAAA,CAAK,OAAA,GAAU,GAAA,CAAI,OAAA,CAAQ,OAAO,EAAE,CAAA;AACzC,IAAA,IAAA,CAAK,OAAA,GAAU,EAAE,GAAG,OAAA,EAAQ;AAAA,EAC9B;AAAA,EAEQ,QAAQ,GAAA,EAAoC;AAClD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,KAAA,EAAM;AAClC,IAAA,IAAI,MAAA,SAAe,GAAG,CAAA;AAAA,SACjB,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA;AAAA,EAC1B;AAAA,EAEA,MAAM,OAAA,GAAyB;AAC7B,IAAA,MAAM,WAAA,CAAY,IAAA,CAAK,SAAA,EAAW,IAAA,CAAK,YAAY,CAAA;AACnD,IAAA,IAAA,CAAK,KAAA,GAAQ,IAAI,eAAA,EAAgB;AACjC,IAAA,KAAK,KAAK,MAAA,EAAO;AAAA,EACnB;AAAA,EAEA,MAAc,MAAA,GAAwB;AACpC,IAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,IAAA,CAAK,SAAA,EAAW;AAAA,MACvC,SAAS,EAAE,GAAG,IAAA,CAAK,OAAA,EAAS,QAAQ,mBAAA,EAAoB;AAAA,MACxD,MAAA,EAAQ,KAAK,KAAA,EAAO,MAAA;AAAA,MACpB,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,IAAI,UAAA,CAAW,IAAI,CAAA,EAAG;AACpB,MAAA,MAAM,IAAI,QAAA,CAAS,IAAA,CAAK,MAAA,EAAQ,gBAAgB,CAAA;AAAA,IAClD;AACA,IAAA,IAAI,CAAC,KAAK,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,IAAA,EAAO,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAClD,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAC1D,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,CAAK,SAAA,EAAU;AACnC,IAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,IAAA,IAAI,GAAA,GAAM,EAAA;AACV,IAAA,IAAI,SAAA,GAA2B,IAAA;AAC/B,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,OAAO,IAAA,EAAM;AACX,MAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,OAAO,IAAA,EAAK;AAC1C,MAAA,IAAI,IAAA,EAAM;AACV,MAAA,GAAA,IAAO,QAAQ,MAAA,CAAO,KAAA,EAAO,EAAE,MAAA,EAAQ,MAAM,CAAA;AAC7C,MAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA;AAC5B,MAAA,GAAA,GAAM,KAAA,CAAM,KAAI,IAAK,EAAA;AACrB,MAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,QAAA,IAAI,IAAA,KAAS,EAAA,IAAM,IAAA,KAAS,IAAA,EAAM;AAChC,UAAA,IAAA,CAAK,aAAA,CAAc,OAAO,SAAS,CAAA;AACnC,UAAA,KAAA,CAAM,MAAA,GAAS,CAAA;AACf,UAAA,SAAA,GAAY,IAAA;AACZ,UAAA;AAAA,QACF;AACA,QAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACvC,QAAA,IAAI,QAAA,CAAS,WAAW,QAAQ,CAAA,cAAe,QAAA,CAAS,KAAA,CAAM,CAAC,CAAA,CAAE,IAAA,EAAK;AACtE,QAAA,KAAA,CAAM,KAAK,QAAQ,CAAA;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,aAAA,CAAc,KAAe,SAAA,EAAgC;AACnE,IAAA,MAAM,YAAY,GAAA,CAAI,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,OAAO,CAAC,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,MAAM,CAAC,CAAA,CAAE,WAAW,CAAA;AAC5F,IAAA,IAAI,CAAC,UAAU,MAAA,EAAQ;AACvB,IAAA,MAAM,OAAA,GAAU,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA;AACnC,IAAA,IAAI,cAAc,UAAA,EAAY;AAC5B,MAAA,MAAM,QAAA,GAAW,QAAQ,IAAA,EAAK;AAC9B,MAAA,IAAA,CAAK,OAAA,GAAU,QAAA,CAAS,UAAA,CAAW,GAAG,CAAA,GAAI,GAAG,IAAA,CAAK,OAAO,CAAA,EAAG,QAAQ,CAAA,CAAA,GAAK,QAAA;AACzE,MAAA;AAAA,IACF;AACA,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,KAAA,CAAM,OAAO,CAA4B,CAAA;AAAA,IAC7D,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,EACpB;AAAA,EAEA,MAAM,KAAK,GAAA,EAA6C;AACtD,IAAA,IAAI,CAAC,KAAK,OAAA,EAAS;AACjB,MAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK;AAC3B,QAAA,IAAI,KAAK,OAAA,EAAS;AAClB,QAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,MAAM,UAAA,CAAW,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,MAC7C;AAAA,IACF;AACA,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,IAAW,IAAA,CAAK,OAAA;AAIrC,IAAA,IAAI,OAAA,KAAY,KAAK,cAAA,EAAgB;AACnC,MAAA,MAAM,WAAA,CAAY,OAAA,EAAS,IAAA,CAAK,YAAY,CAAA;AAC5C,MAAA,IAAA,CAAK,cAAA,GAAiB,OAAA;AAAA,IACxB;AACA,IAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,OAAA,EAAS;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,SAAS,EAAE,GAAG,IAAA,CAAK,OAAA,EAAS,gBAAgB,kBAAA,EAAmB;AAAA,MAC/D,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,GAAG,CAAA;AAAA,MACxB,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,IAAI,UAAA,CAAW,IAAI,CAAA,EAAG;AACpB,MAAA,MAAM,IAAI,QAAA,CAAS,IAAA,CAAK,MAAA,EAAQ,gBAAgB,CAAA;AAAA,IAClD;AACA,IAAA,IAAI,CAAC,KAAK,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,SAAA,EAAY,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AACvD,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAQ,MAAM,IAAA,CAAK,IAAA,EAAK;AAC9B,MAAA,IAAI,QAAQ,OAAO,IAAA,KAAS,aAAa,QAAA,IAAY,IAAA,IAAQ,WAAW,IAAA,CAAA,EAAO;AAC7E,QAAA,IAAA,CAAK,QAAQ,IAAI,CAAA;AAAA,MACnB;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAM,IAAA,GAAyC;AAC7C,IAAA,IAAI,KAAK,KAAA,CAAM,MAAA,EAAQ,OAAO,IAAA,CAAK,MAAM,KAAA,EAAM;AAC/C,IAAA,OAAO,IAAI,QAAQ,CAAC,OAAA,KAAY,KAAK,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAC,CAAA;AAAA,EAC5D;AACF,CAAA;AAEO,IAAM,cAAN,MAAuC;AAAA,EAC5C,IAAA,GAAO,WAAA;AAAA,EACP,GAAA;AAAA,EACA,OAAA;AAAA,EACA,YAAA;AAAA,EACQ,EAAA,GAAuB,IAAA;AAAA,EACvB,QAAwC,EAAC;AAAA,EACzC,UAAuD,EAAC;AAAA,EAEhE,WAAA,CAAY,GAAA,EAAa,OAAA,EAAiC,YAAA,GAAe,KAAA,EAAO;AAC9E,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AACX,IAAA,IAAA,CAAK,YAAA,GAAe,YAAA;AACpB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AAAA,EAEA,MAAM,OAAA,GAAyB;AAO7B,IAAA,MAAM,WAAA,CAAY,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,YAAY,CAAA;AAC7C,IAAA,MAAM,KAAK,UAAA,CAAW,SAAA;AACtB,IAAA,IAAI,CAAC,EAAA,EAAI,MAAM,IAAI,MAAM,4CAA4C,CAAA;AACrE,IAAA,IAAA,CAAK,EAAA,GAAK,IAAI,EAAA,CAAG,IAAA,CAAK,GAAG,CAAA;AACzB,IAAA,IAAA,CAAK,EAAA,CAAG,gBAAA,CAAiB,SAAA,EAAW,CAAC,EAAA,KAAO;AAC1C,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAQ,EAAA,CAAoB,IAAI,CAAC,CAAA;AACzD,QAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,KAAA,EAAM;AAClC,QAAA,IAAI,MAAA,SAAe,IAAI,CAAA;AAAA,aAClB,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA;AAAA,MAC3B,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF,CAAC,CAAA;AACD,IAAA,MAAM,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AAC3C,MAAA,IAAA,CAAK,EAAA,CAAI,gBAAA,CAAiB,MAAA,EAAQ,MAAM,SAAS,CAAA;AACjD,MAAA,IAAA,CAAK,EAAA,CAAI,iBAAiB,OAAA,EAAS,MAAM,OAAO,IAAI,KAAA,CAAM,iBAAiB,CAAC,CAAC,CAAA;AAAA,IAC/E,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAA,CAAK,IAAI,KAAA,EAAM;AACf,IAAA,IAAA,CAAK,EAAA,GAAK,IAAA;AAAA,EACZ;AAAA,EAEA,MAAM,KAAK,GAAA,EAA6C;AACtD,IAAA,IAAI,CAAC,IAAA,CAAK,EAAA,EAAI,MAAM,IAAI,MAAM,eAAe,CAAA;AAC7C,IAAA,IAAA,CAAK,EAAA,CAAG,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA;AAAA,EAClC;AAAA,EAEA,MAAM,IAAA,GAAyC;AAC7C,IAAA,IAAI,KAAK,KAAA,CAAM,MAAA,EAAQ,OAAO,IAAA,CAAK,MAAM,KAAA,EAAM;AAC/C,IAAA,OAAO,IAAI,QAAQ,CAAC,OAAA,KAAY,KAAK,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAC,CAAA;AAAA,EAC5D;AACF,CAAA;AAEO,IAAM,SAAA,GAAN,MAAM,UAAA,CAAU;AAAA,EACrB,GAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA,GAAY,KAAA;AAAA,EACJ,EAAA,GAAK,CAAA;AAAA,EACL,OAAA,uBAAc,GAAA,EAGpB;AAAA,EACF,eAAwC,EAAC;AAAA,EACzC,QAAwC,EAAC;AAAA,EACzC,YAA4C,EAAC;AAAA,EACrC,OAAA;AAAA,EACR,YAAA;AAAA,EAEA,YACE,GAAA,EACA,OAAA,GAAyC,IAAA,EACzC,IAAA,GAAmC,EAAC,EACpC;AACA,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AACX,IAAA,IAAA,CAAK,OAAA,GAAU,WAAW,EAAC;AAC3B,IAAA,IAAA,CAAK,YAAA,GAAe,KAAK,YAAA,IAAgB,KAAA;AACzC,IAAA,IAAA,CAAK,YAAY,UAAA,CAAU,eAAA,CAAgB,KAAK,IAAA,CAAK,OAAA,EAAS,KAAK,YAAY,CAAA;AAAA,EACjF;AAAA,EAEA,OAAO,eAAA,CAAgB,GAAA,EAAa,OAAA,EAAiC,eAAe,KAAA,EAAkB;AACpG,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,IAAK,QAAQ,OAAA,EAAS;AAC/C,MAAA,MAAM,IAAI,MAAM,iFAAiF,CAAA;AAAA,IACnG;AACA,IAAA,IAAI,IAAI,UAAA,CAAW,OAAO,KAAK,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG;AACvD,MAAA,OAAO,IAAI,WAAA,CAAY,GAAA,EAAK,OAAA,EAAS,YAAY,CAAA;AAAA,IACnD;AACA,IAAA,IACE,GAAA,CAAI,UAAA,CAAW,aAAa,CAAA,IAC5B,IAAI,UAAA,CAAW,cAAc,CAAA,IAC7B,GAAA,CAAI,SAAS,SAAS,CAAA,IACtB,GAAA,CAAI,QAAA,CAAS,MAAM,CAAA,EACnB;AACA,MAAA,MAAM,KAAA,GAAQ,IAAI,OAAA,CAAQ,aAAA,EAAe,SAAS,CAAA,CAAE,OAAA,CAAQ,gBAAgB,UAAU,CAAA;AACtF,MAAA,OAAO,IAAI,YAAA,CAAa,KAAA,EAAO,OAAA,EAAS,YAAY,CAAA;AAAA,IACtD;AACA,IAAA,IAAI,IAAI,UAAA,CAAW,SAAS,KAAK,GAAA,CAAI,UAAA,CAAW,UAAU,CAAA,EAAG;AAC3D,MAAA,OAAO,IAAI,aAAA,CAAc,GAAA,EAAK,OAAA,EAAS,YAAY,CAAA;AAAA,IACrD;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iBAAA,EAAoB,GAAG,CAAA,uCAAA,CAAyC,CAAA;AAAA,EAClF;AAAA,EAEQ,MAAA,GAAiB;AACvB,IAAA,IAAA,CAAK,EAAA,IAAM,CAAA;AACX,IAAA,OAAO,MAAA,CAAO,KAAK,EAAE,CAAA;AAAA,EACvB;AAAA,EAEA,MAAc,QAAA,GAA0B;AACtC,IAAA,OAAO,KAAK,SAAA,EAAW;AACrB,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAAU,IAAA,EAAK;AACtC,MAAA,IAAI,CAAC,GAAA,EAAK;AACV,MAAA,MAAM,MAAM,GAAA,CAAI,EAAA,IAAM,OAAO,MAAA,CAAO,GAAA,CAAI,EAAE,CAAA,GAAI,IAAA;AAC9C,MAAA,IAAI,GAAA,KAAQ,QAAA,IAAY,GAAA,IAAO,OAAA,IAAW,GAAA,CAAA,EAAM;AAC9C,QAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAChC,QAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,GAAG,CAAA;AACvB,QAAA,GAAA,EAAK,QAAQ,GAAG,CAAA;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,GAAA,CACZ,MAAA,EACA,MAAA,GAAyC,IAAA,EACzC,UAAU,GAAA,EACQ;AAClB,IAAA,MAAM,GAAA,GAAM,KAAK,MAAA,EAAO;AACxB,IAAA,MAAM,OAAA,GAAU,EAAE,OAAA,EAAS,KAAA,EAAO,EAAA,EAAI,KAAK,MAAA,EAAQ,MAAA,EAAQ,MAAA,IAAU,EAAC,EAAE;AACxE,IAAA,IAAI,IAAA,CAAK,qBAAqB,aAAA,EAAe;AAC3C,MAAA,MAAMC,IAAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAAU,QAAQ,OAAO,CAAA;AAChD,MAAA,IAAIA,KAAI,KAAA,EAAO,MAAM,QAAA,CAAS,WAAA,CAAYA,KAAI,KAAgC,CAAA;AAC9E,MAAA,OAAOA,IAAAA,CAAI,UAAU,EAAC;AAAA,IACxB;AACA,IAAA,MAAM,MAAM,MAAM,IAAI,OAAA,CAAiC,CAAC,SAAS,MAAA,KAAW;AAC1E,MAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,QAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,GAAG,CAAA;AACvB,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,SAAA,EAAY,MAAM,CAAA,kBAAA,EAAqB,OAAO,IAAI,CAAC,CAAA;AAAA,MACtE,GAAG,OAAO,CAAA;AACV,MAAA,IAAA,CAAK,OAAA,CAAQ,IAAI,GAAA,EAAK;AAAA,QACpB,OAAA,EAAS,CAAC,CAAA,KAAM;AACd,UAAA,YAAA,CAAa,KAAK,CAAA;AAClB,UAAA,OAAA,CAAQ,CAAC,CAAA;AAAA,QACX,CAAA;AAAA,QACA;AAAA,OACD,CAAA;AACD,MAAA,KAAK,KAAK,SAAA,CAAU,IAAA,CAAK,OAAO,CAAA,CAAE,KAAA,CAAM,CAAC,CAAA,KAAM;AAC7C,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,GAAG,CAAA;AACvB,QAAA,MAAA,CAAO,CAAC,CAAA;AAAA,MACV,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AACD,IAAA,IAAI,IAAI,KAAA,EAAO,MAAM,QAAA,CAAS,WAAA,CAAY,IAAI,KAAgC,CAAA;AAC9E,IAAA,OAAO,GAAA,CAAI,UAAU,EAAC;AAAA,EACxB;AAAA,EAEA,MAAc,MAAA,CAAO,MAAA,EAAgB,MAAA,GAAyC,IAAA,EAAqB;AACjG,IAAA,MAAM,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,MAAA,EAAQ,MAAA,IAAU,EAAC,EAAG,CAAA;AAAA,EAC5E;AAAA,EAEA,MAAM,OAAA,GAAyB;AAC7B,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,UAAU,OAAA,EAAQ;AAAA,IAC/B,SAAS,CAAA,EAAG;AAKV,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,CAAK,UAAU,KAAA,EAAM;AAAA,MAC7B,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,MAAM,CAAA;AAAA,IACR;AACA,IAAA,IAAI,EAAE,IAAA,CAAK,SAAA,YAAqB,aAAA,CAAA,EAAgB;AAC9C,MAAA,IAAA,CAAK,SAAA,GAAY,IAAA;AACjB,MAAA,KAAK,KAAK,QAAA,EAAS;AAAA,IACrB;AACA,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAQ,MAAM,IAAA,CAAK,GAAA,CAAI,YAAA,EAAc;AAAA,QACzC,eAAA,EAAiB,YAAA;AAAA,QACjB,YAAA,EAAc,EAAE,KAAA,EAAO,EAAE,aAAa,IAAA,EAAK,EAAG,QAAA,EAAU,EAAC,EAAE;AAAA,QAC3D,UAAA,EAAY,EAAE,IAAA,EAAM,gBAAA,EAAkB,SAAS,WAAA;AAAY,OAC5D,CAAA;AACD,MAAA,IAAA,CAAK,YAAA,GAAgB,IAAA,CAAK,YAAA,IAA4C,EAAC;AACvE,MAAA,MAAM,IAAA,CAAK,OAAO,2BAA2B,CAAA;AAC7C,MAAA,IAAA,CAAK,SAAA,GAAY,IAAA;AAAA,IACnB,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,KAAK,KAAA,EAAM;AACjB,MAAA,MAAM,CAAA;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAA,CAAK,SAAA,GAAY,KAAA;AACjB,IAAA,KAAA,MAAW,GAAG,GAAG,CAAA,IAAK,IAAA,CAAK,OAAA,EAAS,GAAA,CAAI,MAAA,CAAO,IAAI,KAAA,CAAM,QAAQ,CAAC,CAAA;AAClE,IAAA,IAAA,CAAK,QAAQ,KAAA,EAAM;AACnB,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,UAAU,KAAA,EAAM;AAAA,IAC7B,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAM,SAAA,GAAqD;AACzD,IAAA,MAAM,GAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,YAAY,CAAA;AACxC,IAAA,IAAA,CAAK,KAAA,GAAS,GAAA,CAAI,KAAA,IAA4C,EAAC;AAC/D,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,aAAA,GAAyD;AAC7D,IAAA,IAAI;AACF,MAAA,MAAM,MAAO,MAAM,IAAA,CAAK,GAAA,CAAI,gBAAA,EAAkB,MAAM,GAAM,CAAA;AAC1D,MAAA,IAAA,CAAK,SAAA,GAAa,GAAA,CAAI,SAAA,IAAgD,EAAC;AAAA,IACzE,CAAA,CAAA,MAAQ;AACN,MAAA,IAAA,CAAK,YAAY,EAAC;AAAA,IACpB;AACA,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACd;AAAA,EAEA,MAAM,QAAA,CAAS,QAAA,EAAkB,UAAA,EAAqC,UAAU,IAAA,EAA2B;AACzG,IAAA,OAAO,IAAA,CAAK,IAAI,YAAA,EAAc,EAAE,MAAM,QAAA,EAAU,SAAA,EAAW,UAAA,EAAW,EAAG,OAAO,CAAA;AAAA,EAClF;AAAA,EAEA,MAAM,IAAA,GAAyB;AAC7B,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,MAAA,EAAQ,IAAI,GAAM,CAAA;AACjC,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,qBAAA,CACJ,QAAA,EACA,UAAA,EACA,UAAU,IAAA,EACQ;AAClB,IAAA,IAAI;AACF,MAAA,IAAI,CAAC,IAAA,CAAK,SAAA,EAAW,MAAM,IAAI,MAAM,eAAe,CAAA;AACpD,MAAA,OAAO,MAAM,IAAA,CAAK,QAAA,CAAS,QAAA,EAAU,YAAY,OAAO,CAAA;AAAA,IAC1D,SAAS,CAAA,EAAG;AACV,MAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,wCAAA,EAA2C,QAAQ,CAAA,gBAAA,CAAA,EAAoB,CAAC,CAAA;AACrF,MAAA,IAAI;AACF,QAAA,MAAM,KAAK,SAAA,EAAU;AACrB,QAAA,OAAO,MAAM,IAAA,CAAK,QAAA,CAAS,QAAA,EAAU,YAAY,OAAO,CAAA;AAAA,MAC1D,SAAS,QAAA,EAAU;AACjB,QAAA,MAAM,IAAI,MAAM,CAAA,kBAAA,EAAqB,QAAQ,IAAI,EAAE,KAAA,EAAO,GAAG,CAAA;AAAA,MAC/D;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,SAAA,GAA2B;AAC/B,IAAA,MAAM,MAAM,IAAA,CAAK,GAAA;AACjB,IAAA,IAAI,UAAkC,EAAC;AACvC,IAAA,IAAI,IAAA,CAAK,qBAAqB,aAAA,EAAe;AAC3C,MAAA,OAAA,GAAU,IAAA,CAAK,UAAU,cAAA,EAAe;AACxC,MAAA,OAAO,QAAQ,cAAc,CAAA;AAC7B,MAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,IACjB,WAAW,IAAA,CAAK,SAAA,YAAqB,YAAA,IAAgB,IAAA,CAAK,qBAAqB,WAAA,EAAa;AAC1F,MAAA,OAAA,GAAU,EAAE,GAAG,IAAA,CAAK,SAAA,CAAU,OAAA,EAAQ;AAAA,IACxC;AACA,IAAA,IAAI;AACF,MAAA,MAAM,KAAK,KAAA,EAAM;AAAA,IACnB,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,IAAA,CAAK,EAAA,GAAK,CAAA;AACV,IAAA,IAAA,CAAK,QAAQ,KAAA,EAAM;AACnB,IAAA,IAAA,CAAK,YAAY,UAAA,CAAU,eAAA,CAAgB,GAAA,EAAK,OAAA,EAAS,KAAK,YAAY,CAAA;AAC1E,IAAA,MAAM,KAAK,OAAA,EAAQ;AACnB,IAAA,MAAM,KAAK,SAAA,EAAU;AAAA,EACvB;AACF,CAAA;AAEO,IAAM,cAAN,MAAkB;AAAA,EACf,OAAA,uBAAc,GAAA,EAAuB;AAAA,EACrC,UAAA,GAAoD,IAAA;AAAA,EAE5D,MAAM,QACJ,IAAA,EACA,GAAA,EACA,UAAyC,IAAA,EACzC,KAAA,GAAuB,IAAA,EACvB,YAAA,GAAe,KAAA,EACA;AACf,IAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,IAAI,CAAA;AACxB,IAAA,MAAM,IAAA,GAAO,EAAE,GAAI,OAAA,IAAW,EAAC,EAAG;AAClC,IAAA,IAAI,OAAO,IAAA,CAAK,aAAA,GAAgB,IAAA,CAAK,aAAA,IAAiB,UAAU,KAAK,CAAA,CAAA;AACrE,IAAA,MAAM,SAAS,IAAI,SAAA,CAAU,KAAK,IAAA,EAAM,EAAE,cAAc,CAAA;AACxD,IAAA,MAAM,OAAO,OAAA,EAAQ;AACrB,IAAA,MAAM,OAAO,SAAA,EAAU;AACvB,IAAA,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,IAAA,EAAM,MAAM,CAAA;AAC7B,IAAA,IAAI,CAAC,KAAK,UAAA,EAAY;AACpB,MAAA,IAAA,CAAK,aAAa,WAAA,CAAY,MAAM,KAAK,IAAA,CAAK,cAAA,IAAkB,GAAM,CAAA;AAAA,IACxE;AAAA,EACF;AAAA,EAEA,MAAc,cAAA,GAAgC;AAC5C,IAAA,KAAA,MAAW,CAAC,IAAA,EAAM,MAAM,CAAA,IAAK,CAAC,GAAG,IAAA,CAAK,OAAA,CAAQ,OAAA,EAAS,CAAA,EAAG;AACxD,MAAA,IAAI,CAAC,OAAO,SAAA,EAAW;AACvB,MAAA,IAAI;AACF,QAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,IAAA,EAAK;AAChC,QAAA,IAAI,CAAC,KAAA,EAAO,MAAM,MAAA,CAAO,SAAA,EAAU;AAAA,MACrC,SAAS,CAAA,EAAG;AACV,QAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,aAAA,EAAgB,IAAI,CAAA,oBAAA,CAAA,EAAwB,CAAC,CAAA;AAC1D,QAAA,IAAI;AACF,UAAA,MAAM,OAAO,SAAA,EAAU;AAAA,QACzB,CAAA,CAAA,MAAQ;AACN,UAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,IAAI,CAAA;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,IAAI,IAAA,EAAyB;AAC3B,IAAA,MAAM,CAAA,GAAI,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA;AAC/B,IAAA,IAAI,CAAC,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,qBAAA,EAAwB,IAAI,CAAA,CAAA,CAAG,CAAA;AACvD,IAAA,OAAO,CAAA;AAAA,EACT;AAAA,EAEA,IAAI,IAAA,EAAuB;AACzB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA;AAAA,EAC9B;AAAA,EAEA,MAAM,WAAW,IAAA,EAA6B;AAC5C,IAAA,MAAM,CAAA,GAAI,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA;AAC/B,IAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,IAAI,CAAA;AACxB,IAAA,IAAI,CAAA,EAAG;AACL,MAAA,IAAI;AACF,QAAA,MAAM,EAAE,KAAA,EAAM;AAAA,MAChB,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,QAAA,GAA0B;AAC9B,IAAA,IAAI,KAAK,UAAA,EAAY;AACnB,MAAA,aAAA,CAAc,KAAK,UAAU,CAAA;AAC7B,MAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAAA,IACpB;AACA,IAAA,KAAA,MAAW,IAAA,IAAQ,CAAC,GAAG,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,CAAA,EAAG,MAAM,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA;AAAA,EACzE;AACF,CAAA;AAEO,IAAM,cAAN,MAAkB;AAAA,EACvB,OAAA,GAAU,IAAI,WAAA,EAAY;AAAA,EAC1B,YAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,WAAA,CAAY,IAAA,GAAmC,EAAC,EAAG;AACjD,IAAA,IAAA,CAAK,YAAA,GAAe,KAAK,YAAA,IAAgB,KAAA;AAAA,EAC3C;AAAA,EAEA,MAAM,SAAA,CACJ,IAAA,EACA,GAAA,EACA,IAAA,GAA2E,EAAC,EAC7D;AACf,IAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,IAAA,EAAM,GAAA,EAAK,IAAA,CAAK,OAAA,IAAW,IAAA,EAAM,IAAA,CAAK,KAAA,IAAS,IAAA,EAAM,IAAA,CAAK,YAAY,CAAA;AAAA,EACnG;AAAA,EAEA,MAAM,QAAA,GAA0B;AAC9B,IAAA,MAAM,IAAA,CAAK,QAAQ,QAAA,EAAS;AAAA,EAC9B;AACF,CAAA;;;ACnpBA,WAAA,EAAA;;;ACDA,IAAM,GAAA,GAAM;AAAA,EACV,MAAM,CAAA,GAAI,IAAA,KAAoB,QAAQ,IAAA,CAAK,kBAAA,EAAoB,GAAG,IAAI,CAAA;AAAA,EACtE,OAAO,CAAA,GAAI,IAAA,KAAoB,QAAQ,KAAA,CAAM,kBAAA,EAAoB,GAAG,IAAI;AAC1E,CAAA;AA0BO,SAAS,SAAA,CAAU,OAAiC,KAAA,EAAyB;AAClF,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACrB,EAAA,IAAI;AACF,IAAA,KAAA,CAAM,QAAQ,KAAK,CAAA;AAAA,EACrB,CAAA,CAAA,MAAQ;AACN,IAAA,GAAA,CAAI,KAAK,qCAAqC,CAAA;AAAA,EAChD;AACF;AAEO,SAAS,SAAA,CAAU,KAAA,EAAiC,GAAA,EAAc,GAAA,EAAoC;AAC3G,EAAA,GAAA,CAAI,KAAA,CAAM,uBAAA,EAAyB,GAAA,EAAK,QAAA,EAAU,GAAG,CAAA;AACrD,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACrB,EAAA,IAAI;AACF,IAAA,KAAA,CAAM,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,GAAA,CAAI,KAAK,qCAAqC,CAAA;AAAA,EAChD;AACF;AAYO,SAAS,YAAA,CAAa,OAAiC,KAAA,EAAsC;AAClG,EAAA,IAAI,CAAC,OAAO,UAAA,EAAY;AACxB,EAAA,IAAI;AACF,IAAA,KAAA,CAAM,WAAW,KAAK,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,GAAA,CAAI,KAAK,wCAAwC,CAAA;AAAA,EACnD;AACF;;;AC2CA,IAAM,QAAA,GAAW,iDAAA;AACjB,IAAM,QAAA,GAAW,sBAAA;AACjB,IAAM,MAAA,GAAS,iCAAA;AACf,IAAM,OAAA,GAAU,oCAAA;AAChB,IAAM,OAAA,GAAU,8DAAA;AAChB,IAAM,aAAA,GAAgB,kBAAA;AACtB,IAAM,oBAAoB,IAAI,MAAA;AAAA,EAC5B,CAAA,KAAA,EAAQ,aAAa,CAAA,wIAAA,EAA2I,aAAa,CAAA,EAAA,CAAA;AAAA,EAC7K;AACF,CAAA;AACA,IAAM,qBAAqB,IAAI,MAAA;AAAA,EAC7B,CAAA,KAAA,EAAQ,aAAa,CAAA,GAAA,EAAM,aAAa,aAAa,aAAa,CAAA,EAAA,CAAA;AAAA,EAClE;AACF,CAAA;AACA,IAAMC,QAAAA,GAAU,+EAAA;AAEhB,SAAS,SAAA,CAAU,IAAY,IAAA,EAAsB;AACnD,EAAA,MAAM,MAAc,EAAC;AACrB,EAAA,EAAA,CAAG,SAAA,GAAY,CAAA;AACf,EAAA,IAAI,CAAA,GAAI,EAAA,CAAG,IAAA,CAAK,IAAI,CAAA;AACpB,EAAA,OAAO,MAAM,IAAA,EAAM;AACjB,IAAA,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA,CAAE,KAAA,EAAO,CAAA,CAAE,QAAQ,CAAA,CAAE,CAAC,CAAA,CAAE,MAAM,CAAC,CAAA;AACzC,IAAA,IAAI,CAAA,CAAE,CAAC,CAAA,CAAE,MAAA,KAAW,GAAG,EAAA,CAAG,SAAA,EAAA;AAC1B,IAAA,CAAA,GAAI,EAAA,CAAG,KAAK,IAAI,CAAA;AAAA,EAClB;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,OAAO,MAAA,EAAyB;AACvC,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,MAAM,GAAA,GAAM,CAAC,GAAG,MAAM,EAAE,OAAA,EAAQ;AAChC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK;AACnC,IAAA,IAAI,CAAA,GAAI,MAAA,CAAO,GAAA,CAAI,CAAC,CAAC,CAAA;AACrB,IAAA,IAAI,CAAA,GAAI,MAAM,CAAA,EAAG;AACf,MAAA,CAAA,IAAK,CAAA;AACL,MAAA,IAAI,CAAA,GAAI,GAAG,CAAA,IAAK,CAAA;AAAA,IAClB;AACA,IAAA,KAAA,IAAS,CAAA;AAAA,EACX;AACA,EAAA,OAAO,QAAQ,EAAA,KAAO,CAAA;AACxB;AAEA,SAAS,iBAAiB,IAAA,EAAsB;AAC9C,EAAA,MAAM,QAAgB,EAAC;AACvB,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,GAAG,KAAK,SAAA,CAAU,OAAA,EAAS,IAAI,CAAA,EAAG;AACnD,IAAA,MAAM,MAAA,GAAS,KAAK,KAAA,CAAM,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,SAAS,EAAE,CAAA;AACzD,IAAA,IAAI,MAAA,CAAO,UAAU,EAAA,IAAM,MAAA,CAAO,UAAU,EAAA,IAAM,MAAA,CAAO,MAAM,CAAA,EAAG;AAChE,MAAA,KAAA,CAAM,IAAA,CAAK,CAAC,KAAA,EAAO,GAAG,CAAC,CAAA;AAAA,IACzB;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,uBAAuB,KAAA,EAAwB;AACtD,EAAA,IAAIA,QAAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,KAAA;AAChC,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,IAAI,CAAA,IAAK,GAAA,IAAO,CAAA,IAAK,GAAA,EAAK,QAAA,GAAW,IAAA;AAAA,SAAA,IAC5B,CAAA,IAAK,GAAA,IAAO,CAAA,IAAK,GAAA,EAAK,QAAA,GAAW,IAAA;AAAA,SAAA,IACjC,CAAA,IAAK,GAAA,IAAO,CAAA,IAAK,GAAA,EAAK,QAAA,GAAW,IAAA;AAAA,EAC5C;AACA,EAAA,OAAO,YAAY,QAAA,IAAY,QAAA;AACjC;AAEA,SAAS,aAAa,IAAA,EAAsB;AAC1C,EAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,iBAAA,EAAmB,IAAI,CAAA;AAC/C,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,GAAG,KAAK,SAAA,CAAU,kBAAA,EAAoB,IAAI,CAAA,EAAG;AAC9D,IAAA,IAAI,KAAA,CAAM,IAAA,CAAK,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAM,KAAA,GAAQ,CAAA,IAAK,CAAA,GAAI,GAAG,CAAA,EAAG;AAClD,IAAA,IAAI,sBAAA,CAAuB,IAAA,CAAK,KAAA,CAAM,KAAA,EAAO,GAAG,CAAC,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,CAAC,KAAA,EAAO,GAAG,CAAC,CAAA;AAAA,EAC7E;AACA,EAAA,OAAO,KAAA;AACT;AAEA,IAAM,OAAA,GAAsC;AAAA,EAC1C,KAAA,EAAO,CAAC,CAAA,KAAM,SAAA,CAAU,UAAU,CAAC,CAAA;AAAA,EACnC,KAAA,EAAO,CAAC,CAAA,KAAM,SAAA,CAAU,UAAU,CAAC,CAAA;AAAA,EACnC,GAAA,EAAK,CAAC,CAAA,KAAM,SAAA,CAAU,QAAQ,CAAC,CAAA;AAAA,EAC/B,WAAA,EAAa,gBAAA;AAAA,EACb,IAAA,EAAM,CAAC,CAAA,KAAM,SAAA,CAAU,SAAS,CAAC,CAAA;AAAA,EACjC,OAAA,EAAS;AACX,CAAA;AAEO,SAAS,aAAA,CAAc,MAAc,IAAA,EAAsB;AAChE,EAAA,MAAM,QAAA,GAAW,QAAQ,IAAI,CAAA;AAC7B,EAAA,IAAI,CAAC,QAAA,EAAU,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,IAAI,CAAA,CAAE,CAAA;AACnE,EAAA,IAAI,CAAC,IAAA,EAAM,OAAO,EAAC;AACnB,EAAA,OAAO,QAAA,CAAS,IAAI,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,CAAC,CAAA,GAAI,CAAA,CAAE,CAAC,CAAC,CAAA;AAClD;AAEO,SAAS,WAAA,CACd,MACA,IAAA,EACS;AACT,EAAA,IAAI,KAAK,OAAA,KAAY,MAAA,IAAU,KAAK,OAAA,KAAY,IAAA,CAAK,OAAO,OAAO,KAAA;AAEnE,EAAA,IAAI,CAAC,IAAA,CAAK,MAAA,CAAO,MAAA,EAAQ,OAAO,IAAA;AAChC,EAAA,IAAI,IAAA,CAAK,UAAA,KAAe,IAAA,EAAM,OAAO,KAAA;AACrC,EAAA,MAAM,IAAA,GAAO,IAAI,GAAA,CAAI,IAAA,CAAK,UAAU,CAAA;AACpC,EAAA,OAAO,CAAC,KAAK,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,IAAA,CAAK,GAAA,CAAI,CAAC,CAAC,CAAA;AAC7C;AAEA,SAAS,YAAA,CAAa,IAAA,EAAqB,IAAA,EAAc,MAAA,EAAiC;AACxF,EAAA,IAAI,IAAA,CAAK,YAAY,IAAA,EAAM;AACzB,IAAA,MAAM,EAAA,GAAK,KAAK,SAAA,EAAU,IAAK,IAAI,MAAA,CAAO,IAAA,CAAK,SAAS,GAAG,CAAA;AAC3D,IAAA,OAAO,SAAA,CAAU,IAAI,IAAI,CAAA;AAAA,EAC3B;AACA,EAAA,IAAI,IAAA,CAAK,aAAa,IAAA,EAAM;AAC1B,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,eAAA,CAAgB,IAAA,CAAK,QAAQ,CAAA;AACnD,IAAA,IAAI,QAAQ,OAAO,CAAC,GAAG,MAAA,CAAO,IAAI,CAAC,CAAA;AACnC,IAAA,OAAO,aAAA,CAAc,IAAA,CAAK,QAAA,EAAU,IAAI,CAAA;AAAA,EAC1C;AACA,EAAA,OAAO,EAAC;AACV;AAEA,IAAM,gBAAA,GAAmB,EAAA;AAEzB,SAAS,SAAA,CAAU,OAAe,SAAA,EAAuD;AACvF,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,GAAI,SAAA,GAAY,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,SAAA,IAAa,EAAE,CAAC,CAAA;AACxF,EAAA,OAAO,cAAc,GAAA,EAAK,KAAK,CAAA,CAAE,KAAA,CAAM,GAAG,gBAAgB,CAAA;AAC5D;AAQO,SAAS,cAAA,CACd,IAAA,EACA,MAAA,EACA,IAAA,EAMyB;AACzB,EAAA,IAAI,CAAC,QAAQ,MAAA,CAAO,OAAA,IAAW,OAAO,CAAC,IAAA,EAAM,EAAE,CAAA;AAC/C,EAAA,MAAM,UAAA,GAAa,KAAK,UAAA,IAAc,IAAA;AACtC,EAAA,MAAM,YAAoD,EAAC;AAC3D,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,MAAM,SAAmB,EAAC;AAE1B,EAAA,KAAA,MAAW,IAAA,IAAQ,OAAO,KAAA,EAAO;AAC/B,IAAA,IAAI,CAAC,YAAY,IAAA,EAAM,EAAE,OAAO,IAAA,CAAK,KAAA,EAAO,UAAA,EAAY,CAAA,EAAG;AAC3D,IAAA,IAAI,IAAA,CAAK,MAAA,KAAW,MAAA,IAAU,CAAC,KAAK,SAAA,EAAW;AAC7C,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,MAAA,EAAS,KAAK,IAAI,CAAA,4GAAA;AAAA,OAEpB;AAAA,IACF;AACA,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,YAAA,CAAa,IAAA,EAAM,IAAA,EAAM,MAAM,CAAA;AAC3C,MAAA,MAAM,YAAoB,EAAC;AAC3B,MAAA,IAAI,OAAA,GAAU,KAAA;AACd,MAAA,KAAA,MAAW,QAAQ,GAAA,EAAK;AACtB,QAAA,MAAM,KAAA,GAAQ,OAAO,CAAC,CAAA;AACtB,QAAA,MAAM,GAAA,GAAM,OAAO,CAAC,CAAA;AACpB,QAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,OAAO,QAAQ,QAAA,EAAU;AACxD,UAAA,OAAA,GAAU,IAAA;AACV,UAAA;AAAA,QACF;AACA,QAAA,IAAI,EAAE,KAAA,IAAS,CAAA,IAAK,QAAQ,GAAA,IAAO,GAAA,IAAO,KAAK,MAAA,CAAA,EAAS;AACtD,UAAA,OAAA,GAAU,IAAA;AACV,UAAA;AAAA,QACF;AACA,QAAA,SAAA,CAAU,IAAA,CAAK,CAAC,KAAA,EAAO,GAAG,CAAC,CAAA;AAAA,MAC7B;AACA,MAAA,IAAI,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,IAAI,CAAA;AAClC,MAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,SAAA,EAAW,SAAA,CAAU,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,EAAG,IAAI,CAAC,CAAA;AAAA,IAC7D,SAAS,GAAA,EAAK;AACZ,MAAA,MAAA,CAAO,IAAA,CAAK,KAAK,IAAI,CAAA;AACrB,MAAA,IAAI,IAAA,CAAK,KAAA,EAAO,SAAA,CAAU,IAAA,CAAK,KAAA,EAAO,GAAA,EAAK,EAAE,KAAA,EAAO,WAAA,EAAa,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,CAAA;AAAA,IACpF;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,UAAU,MAAA,EAAQ;AACrB,IAAA,IAAI,MAAA,CAAO,MAAA,EAAQ,OAAO,CAAC,IAAA,EAAM,EAAE,WAAA,EAAa,EAAC,EAAG,KAAA,EAAO,CAAA,EAAG,YAAA,EAAc,QAAQ,CAAA;AACpF,IAAA,OAAO,CAAC,IAAA,EAAM,EAAE,CAAA;AAAA,EAClB;AAEA,EAAA,SAAA,CAAU,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,EAAE,CAAC,CAAA,GAAI,EAAE,CAAC,CAAA,IAAK,EAAE,CAAC,CAAA,GAAI,EAAE,CAAC,CAAA,IAAK,EAAE,CAAC,CAAA,GAAI,CAAA,CAAE,CAAC,CAAA,CAAE,CAAA;AACnE,EAAA,MAAM,SAAiD,EAAC;AACxD,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,GAAA,EAAK,IAAI,KAAK,SAAA,EAAW;AAC1C,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,MAAA,CAAO,MAAA,GAAS,CAAC,CAAA;AACrC,IAAA,IAAI,IAAA,IAAQ,KAAA,GAAQ,IAAA,CAAK,CAAC,CAAA,EAAG;AAC3B,MAAA,IAAI,MAAM,IAAA,CAAK,CAAC,CAAA,EAAG,IAAA,CAAK,CAAC,CAAA,GAAI,GAAA;AAC7B,MAAA;AAAA,IACF;AACA,IAAA,MAAA,CAAO,IAAA,CAAK,CAAC,KAAA,EAAO,GAAA,EAAK,IAAI,CAAC,CAAA;AAAA,EAChC;AAEA,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,GAAA,EAAK,IAAI,KAAK,MAAA,EAAQ;AACvC,IAAA,GAAA,CAAI,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ,KAAK,CAAC,CAAA;AAClC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,KAAA,EAAO,GAAG,CAAA;AACtC,IAAA,IAAI,KAAK,MAAA,KAAW,MAAA,MAAY,IAAA,CAAK,IAAA,CAAK,sBAAsB,CAAA;AAAA,SAAA,IACvD,IAAA,CAAK,WAAW,MAAA,EAAQ;AAC/B,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,CAAA,EAAI,IAAA,CAAK,IAAA,CAAK,WAAA,EAAa,CAAA,CAAA,EAAI,SAAA,CAAU,QAAA,EAAU,IAAA,CAAK,SAAS,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,IAChF;AACA,IAAA,IAAI,CAAC,MAAM,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,IAAI,CAAA;AACpD,IAAA,MAAA,GAAS,GAAA;AAAA,EACX;AACA,EAAA,GAAA,CAAI,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,MAAM,CAAC,CAAA;AAE3B,EAAA,MAAM,OAAsB,EAAE,WAAA,EAAa,KAAA,EAAO,KAAA,EAAO,OAAO,MAAA,EAAO;AACvE,EAAA,IAAI,MAAA,CAAO,MAAA,EAAQ,IAAA,CAAK,YAAA,GAAe,MAAA;AACvC,EAAA,OAAO,CAAC,GAAA,CAAI,IAAA,CAAK,EAAE,GAAG,IAAI,CAAA;AAC5B;AC9TO,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,sBAAA,GAAyB,GAAA;AAO/B,IAAM,gBAAN,MAAoB;AAAA,EACjB,OAAA,GAAyB,IAAA;AAAA,EACzB,KAAA,GAAuB,IAAA;AAAA,EAE/B,KAAA,GAAc;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,KAAK,GAAA,EAAI;AACxB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,IAAA,GAAa;AACX,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAK,GAAA,EAAI;AACtB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,IAAI,UAAA,GAA4B;AAC9B,IAAA,IAAI,KAAK,OAAA,IAAW,IAAA,IAAQ,IAAA,CAAK,KAAA,IAAS,MAAM,OAAO,IAAA;AACvD,IAAA,OAAO,IAAA,CAAK,QAAQ,IAAA,CAAK,OAAA;AAAA,EAC3B;AACF,CAAA;AAEA,SAAS,SAAS,GAAA,EAAuB;AACvC,EAAA,IAAI,GAAA,IAAO,MAAM,OAAO,GAAA;AACxB,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,EAAA,EAAI,CAAA,KAAO,OAAO,MAAM,QAAA,GAAW,MAAA,CAAO,CAAC,CAAA,GAAI,CAAE,CAAC,CAAA;AAAA,EAC3F,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,IAAA,EAAM,MAAA,CAAO,GAAG,CAAA,EAAE;AAAA,EAC7B;AACF;AAEA,SAAS,eAAe,YAAA,EAA2C;AACjE,EAAA,IAAI,YAAA,IAAgB,IAAA,EAAM,OAAO,CAAC,MAAM,KAAK,CAAA;AAC7C,EAAA,IAAI,UAAA;AACJ,EAAA,IAAI;AACF,IAAA,UAAA,GAAa,IAAA,CAAK,UAAU,YAAY,CAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AACN,IAAA,UAAA,GAAa,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,YAAY,CAAC,CAAA;AAAA,EAClD;AACA,EAAA,IAAI,UAAA,CAAW,UAAU,eAAA,EAAiB;AACxC,IAAA,IAAI;AACF,MAAA,OAAO,CAAC,IAAA,CAAK,KAAA,CAAM,UAAU,GAAG,KAAK,CAAA;AAAA,IACvC,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,CAAC,cAAc,KAAK,CAAA;AAAA,IAC7B;AAAA,EACF;AACA,EAAA,OAAO,CAAC,EAAE,UAAA,EAAY,UAAA,CAAW,KAAA,CAAM,CAAA,EAAG,eAAe,CAAA,EAAG,cAAA,EAAgB,UAAA,CAAW,MAAA,EAAO,EAAG,IAAI,CAAA;AACvG;AAEA,SAAS,aAAa,KAAA,EAA+B;AACnD,EAAA,IAAI,KAAA,IAAS,MAAM,OAAO,IAAA;AAC1B,EAAA,MAAM,OAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AAClE,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,sBAAsB,CAAA;AAC7C;AAEA,eAAsB,WAAA,CACpB,QACA,GAAA,EAee;AACf,EAAA,MAAM,KAAA,GAAQ;AAAA,IACZ,SAAS,GAAA,CAAI,MAAA,IAAU,OAAO,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA,GAAI,IAAA;AAAA,IACnD,WAAW,GAAA,CAAI,QAAA;AAAA,IACf,MAAM,GAAA,CAAI,IAAA;AAAA,IACV,UAAA,EAAY,IAAI,SAAA,IAAa,IAAA;AAAA,IAC7B,UAAU,GAAA,CAAI,OAAA,IAAW,OAAO,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,GAAI,IAAA;AAAA,IACtD,MAAA,EAAQ,IAAI,MAAA,IAAU,IAAA;AAAA,IACtB,UAAA,EAAY,GAAA,CAAI,SAAA,IAAa,EAAC;AAAA,IAC9B,eAAe,GAAA,CAAI,YAAA;AAAA,IACnB,OAAA,EAAS,IAAI,OAAA,IAAW,IAAA;AAAA,IACxB,OAAO,GAAA,CAAI,KAAA,IAAS,OAAO,MAAA,CAAO,GAAA,CAAI,KAAK,CAAA,GAAI,IAAA;AAAA,IAC/C,WAAA,EAAa,IAAI,UAAA,IAAc,IAAA;AAAA,IAC/B,KAAA,EAAO,IAAI,KAAA,IAAS,IAAA;AAAA,IACpB,WAAA,EAAa,IAAI,UAAA,IAAc;AAAA,GACjC;AACA,EAAA,IAAI;AACF,IAAA,YAAA,CAAa,MAAA,CAAO,OAAO,KAAK,CAAA;AAAA,EAClC,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI;AACF,IAAA,MAAM,CAAC,MAAA,EAAQ,SAAS,CAAA,GAAI,cAAA,CAAe,IAAI,YAAY,CAAA;AAC3D,IAAA,MAAM,OAAO,QAAA,CAAS,GAAA,CAAI,aAAa,EAAE,KAAK,EAAC;AAC/C,IAAA,MAAM,OAAO,IAAA,CAAK,KAAA;AAAA,MAChB,CAAA;AAAA;AAAA;AAAA,gFAAA,CAAA;AAAA,MAIA;AAAA,QACET,iBAAAA,EAAW;AAAA,QACX,IAAI,MAAA,IAAU,IAAA;AAAA,QACd,GAAA,CAAI,QAAA;AAAA,QACJ,GAAA,CAAI,IAAA;AAAA,QACJ,IAAI,SAAA,IAAa,IAAA;AAAA,QACjB,IAAI,OAAA,IAAW,IAAA,GAAO,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,GAAI,IAAA;AAAA,QAC5C,IAAI,MAAA,IAAU,KAAA;AAAA,QACd,IAAA,CAAK,UAAU,IAAI,CAAA;AAAA,QACnB,IAAA,CAAK,UAAU,MAAM,CAAA;AAAA,QACrB,SAAA;AAAA,QACA,IAAI,OAAA,IAAW,IAAA;AAAA,QACf,YAAA,CAAa,IAAI,KAAK,CAAA;AAAA,QACtB,IAAI,UAAA,IAAc,IAAA;AAAA,QAClB,IAAI,KAAA,IAAS,CAAA;AAAA,QACb,IAAI,UAAA,IAAc;AAAA;AACpB,KACF;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;;;AHzGA,OAAA,EAAA;;;AI1BA,WAAA,EAAA;AAGA,IAAM,UAAA,GAAa,GAAA;AAEnB,IAAM,0BAAA,uBAAiC,GAAA,CAAI;AAAA,EACzC,YAAA;AAAA,EACA,aAAA;AAAA,EACA,eAAA;AAAA,EACA,oBAAA;AAAA,EACA;AACF,CAAC,CAAA;AAOD,IAAM,eAAA,uBAAsB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAKzD,IAAM,uCAAuB,IAAI,GAAA,CAAI,CAAC,eAAA,EAAiB,qBAAA,EAAuB,QAAQ,CAAC,CAAA;AAEvF,SAAS,cAAc,KAAA,EAAuB;AAC5C,EAAA,OAAO,kBAAA,CAAmB,KAAK,CAAA,CAAE,OAAA;AAAA,IAC/B,UAAA;AAAA,IACA,CAAC,CAAA,KAAM,CAAA,CAAA,EAAI,CAAA,CAAE,UAAA,CAAW,CAAC,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,WAAA,EAAa,CAAA;AAAA,GACvD;AACF;AAEA,SAAS,OAAA,CACP,QACA,IAAA,EACyB;AACzB,EAAA,IAAI,CAAC,MAAA,EAAQ,OAAO,EAAC;AACrB,EAAA,MAAM,UAAA,GAAc,MAAA,CAAO,UAAA,IAAsD,EAAC;AAClF,EAAA,MAAM,QAAA,GAAY,MAAA,CAAO,QAAA,IAAsC,EAAC;AAChE,EAAA,MAAM,SAAkC,EAAC;AACzC,EAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA,EAAG;AACzC,IAAA,MAAM,KAAA,GAAQ,KAAK,GAAG,CAAA;AACtB,IAAA,IAAI,QAAA,CAAS,SAAS,GAAG,CAAA,KAAM,UAAU,MAAA,IAAa,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,EAAA,CAAA,EAAK;AACrF,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gCAAA,EAAmC,GAAG,CAAA,CAAE,CAAA;AAAA,IAC1D;AACA,IAAA,IAAI,UAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAAM,MAAA,CAAO,GAAG,CAAA,GAAI,KAAA;AAAA,EAC3D;AACA,EAAA,OAAO,MAAA;AACT;AAkBA,SAAS,SAAA,CAAU,KAAa,MAAA,EAAyC;AACvE,EAAA,MAAM,GAAA,GAAM,IAAI,eAAA,EAAgB;AAChC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AAC3C,IAAA,IAAI,CAAA,KAAM,MAAA,IAAa,CAAA,KAAM,IAAA,EAAM;AACnC,IAAA,GAAA,CAAI,GAAA,CAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACtB;AACA,EAAA,MAAM,CAAA,GAAI,IAAI,QAAA,EAAS;AACvB,EAAA,IAAI,CAAC,GAAG,OAAO,GAAA;AACf,EAAA,OAAO,GAAA,CAAI,QAAA,CAAS,GAAG,CAAA,GAAI,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA,GAAK,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA;AACxD;AAsBA,eAAe,WAAW,IAAA,EAA+D;AACvF,EAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,OAAO,EAAE,IAAA,EAAM,MAAM,IAAA,CAAK,IAAA,EAAK,EAAG,SAAA,EAAW,KAAA,EAAM;AACnE,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,CAAK,SAAA,EAAU;AACnC,EAAA,MAAM,SAAmB,EAAC;AAC1B,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,IAAI,SAAA,GAAY,KAAA;AAChB,EAAA,WAAS;AACP,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,OAAO,IAAA,EAAK;AAC1C,IAAA,IAAI,IAAA,EAAM;AACV,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,KAAK,CAAC,CAAA;AAC9B,MAAA,IAAA,IAAQ,KAAA,CAAM,UAAA;AAAA,IAChB;AACA,IAAA,IAAI,OAAO,kBAAA,EAAoB;AAC7B,MAAA,SAAA,GAAY,IAAA;AACZ,MAAA,MAAM,OAAO,MAAA,EAAO;AACpB,MAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA;AAClC,EAAA,OAAO;AAAA,IACL,IAAA,EAAA,CAAO,YAAY,KAAA,CAAM,QAAA,CAAS,GAAG,kBAAkB,CAAA,GAAI,KAAA,EAAO,QAAA,CAAS,MAAM,CAAA;AAAA,IACjF;AAAA,GACF;AACF;AAEA,eAAe,eAAe,IAAA,EAOL;AACvB,EAAA,IAAI,MAAM,IAAA,CAAK,GAAA;AACf,EAAA,IAAI,KAAK,MAAA,EAAQ,GAAA,GAAM,SAAA,CAAU,GAAA,EAAK,KAAK,MAAM,CAAA;AACjD,EAAA,MAAM,UAAkC,EAAE,GAAI,IAAA,CAAK,OAAA,IAAW,EAAC,EAAG;AAKlE,EAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,WAAA,EAAY,KAAM,iBAAiB,CAAA,EAAG;AAC5E,IAAA,OAAA,CAAQ,iBAAiB,CAAA,GAAI,UAAA;AAAA,EAC/B;AACA,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI,IAAA,CAAK,SAAS,MAAA,EAAW;AAC3B,IAAA,OAAA,CAAQ,cAAc,CAAA,GAAI,OAAA,CAAQ,cAAc,CAAA,IAAK,OAAA,CAAQ,cAAc,CAAA,IAAK,kBAAA;AAChF,IAAA,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA;AAAA,EACjC,CAAA,MAAA,IAAW,IAAA,CAAK,OAAA,KAAY,MAAA,EAAW;AACrC,IAAA,IAAA,GAAO,IAAA,CAAK,OAAA;AAAA,EACd;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,IAC5B,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,OAAA;AAAA,IACA,IAAA;AAAA;AAAA;AAAA,IAGA,QAAA,EAAU,QAAA;AAAA,IACV,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,UAAU;AAAA,GACvC,CAAA;AACD,EAAA,MAAM,cAAsC,EAAC;AAC7C,EAAA,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,CAAC,CAAA,EAAG,CAAA,KAAM;AAC7B,IAAA,WAAA,CAAY,CAAC,CAAA,GAAI,CAAA;AAAA,EACnB,CAAC,CAAA;AACD,EAAA,MAAM,EAAE,IAAA,EAAM,SAAA,EAAU,GAAI,MAAM,WAAW,IAAI,CAAA;AACjD,EAAA,OAAO;AAAA,IACL,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,OAAA,EAAS,WAAA;AAAA,IACT,SAAA;AAAA,IACA,MAAM,IAAA,GAAO;AAKX,MAAA,OAAO,KAAK,KAAA,CAAM,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,EAAE,CAAC,CAAA;AAAA,IAC1C,CAAA;AAAA,IACA,MAAM,IAAA,GAAO;AACX,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,GACF;AACF;AAaA,SAAS,OAAA,CAAQ,IAAA,EAAoB,MAAA,EAAgB,QAAA,EAAgC;AACnF,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,IAAA,CAAK,GAAG,CAAA;AAChC,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,QAAA,EAAU,OAAO,CAAA;AACxC,EAAA,IAAI,SAAS,IAAA,CAAK,MAAA;AAClB,EAAA,IAAA,CAAK,WAAW,GAAA,IAAO,MAAA,KAAW,GAAA,KAAQ,MAAA,KAAW,QAAQ,MAAA,GAAS,KAAA;AAAA,OAAA,IAC7D,MAAA,KAAW,GAAA,IAAO,MAAA,KAAW,MAAA,EAAQ,MAAA,GAAS,KAAA;AAEvD,EAAA,IAAI,UAAU,EAAE,GAAI,IAAA,CAAK,OAAA,IAAW,EAAC,EAAG;AACxC,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,MAAA,CAAO,MAAA,EAAQ;AACpC,IAAA,OAAA,GAAU,MAAA,CAAO,WAAA;AAAA,MACf,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,CAAE,OAAO,CAAC,CAAC,CAAC,CAAA,KAAM,CAAC,oBAAA,CAAqB,GAAA,CAAI,CAAA,CAAE,WAAA,EAAa,CAAC;AAAA,KACpF;AAAA,EACF;AACA,EAAA,MAAM,MAAoB,EAAE,MAAA,EAAQ,KAAK,MAAA,CAAO,QAAA,IAAY,OAAA,EAAQ;AACpE,EAAA,IAAI,MAAA,KAAW,KAAK,MAAA,EAAQ;AAC1B,IAAA,IAAI,IAAA,CAAK,IAAA,KAAS,MAAA,EAAW,GAAA,CAAI,OAAO,IAAA,CAAK,IAAA;AAC7C,IAAA,IAAI,IAAA,CAAK,OAAA,KAAY,MAAA,EAAW,GAAA,CAAI,UAAU,IAAA,CAAK,OAAA;AAAA,EACrD;AACA,EAAA,OAAO,GAAA;AACT;AAWA,eAAsB,WAAA,CACpB,MAAA,EACA,IAAA,EACA,IAAA,GAAmE,EAAC,EAClC;AAClC,EAAA,MAAM,SAAS,MAAA,CAAO,MAAA,CAAO,MAAA,IAAU,KAAK,EAAE,WAAA,EAAY;AAC1D,EAAA,IAAI,MAAM,MAAA,CAAO,GAAA;AACjB,EAAA,MAAM,UAAU,EAAE,GAAK,MAAA,CAAO,OAAA,IAAkD,EAAC,EAAG;AACpF,EAAA,MAAM,eAAe,EAAE,GAAK,MAAA,CAAO,UAAA,IAAsD,EAAC,EAAG;AAC7F,EAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AACpB,EAAA,MAAM,WAAA,GAAc,QAAQ,EAAC;AAE7B,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,MAAA,CAAO,kBAAA,EAA2D,WAAW,CAAA;AACzG,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,MAAA,CAAO,aAAA,EAAsD,WAAW,CAAA;AAEnG,EAAA,IAAI,GAAA,EAAK,QAAA,CAAS,IAAI,CAAA,EAAG;AACvB,IAAA,KAAA,MAAW,MAAA,IAAU,CAAC,WAAA,EAAa,UAAU,CAAA,EAAG;AAC9C,MAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,EAAG;AACrC,QAAA,MAAM,WAAA,GAAc,KAAK,GAAG,CAAA,EAAA,CAAA;AAC5B,QAAA,IAAI,GAAA,CAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AAC7B,UAAA,GAAA,GAAM,GAAA,CAAI,WAAW,WAAA,EAAa,aAAA,CAAc,OAAO,MAAA,CAAO,GAAG,CAAC,CAAC,CAAC,CAAA;AACpE,UAAA,OAAO,OAAO,GAAG,CAAA;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAI,WAAA,GAA4B;AAAA,IAC9B,MAAA;AAAA,IACA,KAAK,GAAA,IAAO,EAAA;AAAA,IACZ;AAAA,GACF;AAEA,EAAA,IAAI,MAAA,KAAW,KAAA,IAAS,MAAA,KAAW,QAAA,EAAU;AAC3C,IAAA,MAAM,QAAQ,EAAE,GAAG,cAAc,GAAG,WAAA,EAAa,GAAG,UAAA,EAAW;AAC/D,IAAA,IAAI,OAAO,IAAA,CAAK,KAAK,CAAA,CAAE,MAAA,cAAoB,MAAA,GAAS,KAAA;AAAA,EACtD,CAAA,MAAO;AACL,IAAA,MAAM,KAAA,GAAQ,EAAE,GAAG,YAAA,EAAc,GAAG,WAAA,EAAY;AAChD,IAAA,IAAI,OAAO,IAAA,CAAK,KAAK,CAAA,CAAE,MAAA,cAAoB,MAAA,GAAS,KAAA;AAEpD,IAAA,IAAI,WAAoC,EAAC;AACzC,IAAA,IAAI,IAAA,KAAS,MAAA,IAAa,IAAA,KAAS,IAAA,EAAM;AACvC,MAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACpD,QAAA,QAAA,GAAW,EAAE,GAAI,IAAA,EAAiC;AAAA,MACpD,CAAA,MAAA,IAAW,OAAO,IAAA,KAAS,QAAA,EAAU;AACnC,QAAA,IAAI;AACF,UAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC9B,UAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAClE,YAAA,QAAA,GAAW,MAAA;AAAA,UACb;AAAA,QACF,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AACA,IAAA,MAAA,CAAO,MAAA,CAAO,UAAU,UAAU,CAAA;AAClC,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA,CAAE,MAAA,EAAQ;AAChC,MAAA,WAAA,CAAY,IAAA,GAAO,QAAA;AAAA,IACrB,CAAA,MAAA,IAAW,IAAA,KAAS,MAAA,IAAa,IAAA,KAAS,IAAA,EAAM;AAC9C,MAAA,MAAMU,eAAc,OAAA,CAAQ,cAAc,CAAA,IAAK,OAAA,CAAQ,cAAc,CAAA,IAAK,EAAA;AAC1E,MAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,CAACA,YAAAA,CAAY,QAAA,CAAS,kBAAkB,CAAA,EAAG;AACzE,QAAA,WAAA,CAAY,OAAA,GAAU,IAAA;AAAA,MACxB;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAS,IAAA,CAAK,MAAA;AACpB,EAAA,MAAM,YAAA,GAAe,KAAK,YAAA,IAAgB,KAAA;AAC1C,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,WAAS;AACP,IAAA,MAAM,mBAAA,CAAoB,WAAA,CAAY,GAAA,EAAK,EAAE,cAAc,CAAA;AAC3D,IAAA,IAAA,GAAO,MAAA,GAAS,MAAM,MAAA,CAAO,OAAA,CAAQ,WAAW,CAAA,GAAI,MAAM,eAAe,WAAW,CAAA;AACpF,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,QAAA,IAAY,KAAK,OAAA,CAAQ,QAAA;AACvD,IAAA,IAAI,CAAC,eAAA,CAAgB,GAAA,CAAI,KAAK,MAAM,CAAA,IAAK,CAAC,QAAA,EAAU;AACpD,IAAA,IAAI,QAAQ,aAAA,EAAe;AACzB,MAAA,MAAM,IAAI,iBAAA,CAAkB,CAAA,8BAAA,EAAiC,aAAa,CAAA,cAAA,EAAiB,GAAG,CAAA,CAAE,CAAA;AAAA,IAClG;AACA,IAAA,IAAA,IAAQ,CAAA;AACR,IAAA,WAAA,GAAc,OAAA,CAAQ,WAAA,EAAa,IAAA,CAAK,MAAA,EAAQ,QAAQ,CAAA;AAAA,EAC1D;AAEA,EAAA,MAAM,WAAA,GAAc,KAAK,OAAA,CAAQ,cAAc,KAAK,IAAA,CAAK,OAAA,CAAQ,cAAc,CAAA,IAAK,EAAA;AACpF,EAAA,IAAI,IAAA,GAAO,EAAA;AACX,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,KAAK,IAAA,EAAK;AAAA,EACzB,CAAA,CAAA,MAAQ;AACN,IAAA,IAAA,GAAO,EAAA;AAAA,EACT;AACA,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,IAAA,CAAK,IAAA,EAAM,MAAM,CAAA;AAGtC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,KAAc,IAAA,IAAQ,MAAM,UAAA,GAAa,kBAAA;AAChE,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI,SAAA,EAAW;AAGb,IAAA,IAAA,GAAO,MAAM,QAAA,CAAS,CAAA,EAAG,kBAAkB,CAAA,CAAE,SAAS,MAAM,CAAA;AAAA,EAC9D,CAAA,MAAO;AACL,IAAA,IAAI;AACF,MAAA,IAAA,GAAO,YAAY,QAAA,CAAS,kBAAkB,IAAI,MAAM,IAAA,CAAK,MAAK,GAAI,IAAA;AAAA,IACxE,CAAA,CAAA,MAAQ;AACN,MAAA,IAAA,GAAO,IAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,MAAM,cAAsC,EAAC;AAC7C,EAAA,KAAA,MAAW,CAAC,GAAG,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAA,EAAG;AACjD,IAAA,IAAI,CAAC,2BAA2B,GAAA,CAAI,CAAA,CAAE,aAAa,CAAA,EAAG,WAAA,CAAY,CAAC,CAAA,GAAI,CAAA;AAAA,EACzE;AAEA,EAAA,MAAM,MAAA,GAAkC;AAAA,IACtC,aAAa,IAAA,CAAK,MAAA;AAAA,IAClB,OAAA,EAAS,WAAA;AAAA,IACT;AAAA,GACF;AACA,EAAA,IAAI,SAAA,SAAkB,SAAA,GAAY,IAAA;AAClC,EAAA,OAAO,MAAA;AACT;;;AClUA,SAAS,iBAAiB,MAAA,EAA0D;AAClF,EAAA,MAAM,aAAsC,EAAC;AAC7C,EAAA,MAAM,WAAqB,EAAC;AAC5B,EAAA,KAAA,MAAW,GAAA,IAAO,CAAC,eAAA,EAAiB,oBAAoB,CAAA,EAAG;AACzD,IAAA,MAAM,GAAA,GAAO,MAAA,CAAO,GAAG,CAAA,IAA6C,EAAC;AACrE,IAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,QAAA,EAAU;AACrC,IAAA,MAAA,CAAO,MAAA,CAAO,UAAA,EAAa,GAAA,CAAI,UAAA,IAAsD,EAAE,CAAA;AACvF,IAAA,MAAM,MAAM,GAAA,CAAI,QAAA;AAChB,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG,QAAA,CAAS,KAAK,GAAG,GAAA,CAAI,GAAA,CAAI,MAAM,CAAC,CAAA;AAAA,EAC1D;AACA,EAAA,OAAO,EAAE,IAAA,EAAM,QAAA,EAAU,UAAA,EAAY,QAAA,EAAS;AAChD;AAEA,SAAS,eAAe,EAAA,EAAiC;AACvD,EAAA,MAAM,MAAA,GAAS,EAAA,CAAG,MAAA,IAAU,EAAC;AAC7B,EAAA,MAAM,UAAA,GAAc,MAAA,CAAO,gBAAA,IAAmE,EAAC;AAC/F,EAAA,IAAI,CAAC,WAAW,MAAA,EAAQ;AACtB,IAAA,OAAO;AAAA,MACL;AAAA,QACE,EAAA,EAAI,GAAG,EAAA,IAAM,IAAA;AAAA,QACb,IAAA,EAAM,KAAA;AAAA,QACN,QAAA,EAAU,CAAA,IAAA,EAAO,EAAA,CAAG,IAAI,CAAA,CAAA;AAAA,QACxB,aAAa,EAAA,CAAG,IAAA;AAAA,QAChB,WAAA,EAAa,GAAG,WAAA,IAAe,UAAA;AAAA,QAC/B,YAAA,EAAc,EAAE,IAAA,EAAM,QAAA,EAAU,YAAY,EAAC,EAAG,QAAA,EAAU,EAAC,EAAE;AAAA,QAC7D,kBAAkB,EAAA,CAAG,gBAAA;AAAA,QACrB,gBAAgB,EAAA,CAAG,cAAA;AAAA,QACnB,UAAU,EAAA,CAAG,QAAA;AAAA,QACb,KAAK,EAAA,CAAG,GAAA;AAAA,QACR,GAAA,EAAK;AAAA;AACP,KACF;AAAA,EACF;AACA,EAAA,MAAM,QAAyB,EAAC;AAChC,EAAA,KAAA,MAAW,MAAM,UAAA,EAAY;AAC3B,IAAA,IAAI,EAAA,CAAG,YAAY,KAAA,EAAO;AAC1B,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,EAAA,CAAG,IAAA,IAAQ,SAAS,CAAA;AACxC,IAAA,MAAM,MAAA,GAAU,EAAA,CAAG,WAAA,IAChB,EAAA,CAAG,YAAA,IAAwD;AAAA,MAC1D,IAAA,EAAM,QAAA;AAAA,MACN,YAAY,EAAC;AAAA,MACb,UAAU;AAAC,KACb;AACF,IAAA,MAAM,eAAe,EAAA,CAAG,iBAAA;AACxB,IAAA,MAAM,qBAAqB,EAAA,CAAG,eAAA;AAC9B,IAAA,KAAA,CAAM,IAAA,CAAK;AAAA,MACT,EAAA,EAAI,GAAG,EAAA,IAAM,IAAA;AAAA,MACb,IAAA,EAAM,KAAA;AAAA,MACN,QAAA,EAAU,OAAO,IAAI,CAAA,CAAA;AAAA,MACrB,WAAA,EAAa,IAAA;AAAA,MACb,aAAa,MAAA,CAAO,EAAA,CAAG,WAAA,IAAe,CAAA,UAAA,EAAa,IAAI,CAAA,CAAE,CAAA;AAAA,MACzD,YAAA,EAAc,MAAA;AAAA,MACd,kBAAkB,YAAA,KAAiB,MAAA,GAAY,OAAA,CAAQ,YAAY,IAAI,EAAA,CAAG,gBAAA;AAAA,MAC1E,cAAA,EAAgB,sBAAsB,EAAA,CAAG,cAAA;AAAA,MACzC,UAAU,EAAA,CAAG,QAAA;AAAA,MACb,KAAK,EAAA,CAAG,GAAA;AAAA,MACR,GAAA,EAAK,EAAE,GAAG,MAAA,EAAQ,WAAW,IAAA;AAAK,KACnC,CAAA;AAAA,EACH;AACA,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,oBAAoB,EAAA,EAAiC;AACnE,EAAA,IAAI,EAAA,CAAG,SAAS,MAAA,EAAQ;AACtB,IAAA,OAAO;AAAA,MACL;AAAA,QACE,EAAA,EAAI,GAAG,EAAA,IAAM,IAAA;AAAA,QACb,IAAA,EAAM,MAAA;AAAA,QACN,QAAA,EAAU,CAAA,KAAA,EAAQ,EAAA,CAAG,IAAI,CAAA,CAAA;AAAA,QACzB,aAAa,EAAA,CAAG,IAAA;AAAA,QAChB,WAAA,EAAa,EAAA,CAAG,WAAA,IAAe,CAAA,sBAAA,EAAyB,GAAG,IAAI,CAAA,CAAA;AAAA,QAC/D,YAAA,EAAc,gBAAA,CAAiB,EAAA,CAAG,MAAA,IAAU,EAAE,CAAA;AAAA,QAC9C,kBAAkB,EAAA,CAAG,gBAAA;AAAA,QACrB,gBAAgB,EAAA,CAAG,cAAA;AAAA,QACnB,UAAU,EAAA,CAAG,QAAA;AAAA,QACb,KAAK,EAAA,CAAG,GAAA;AAAA,QACR,GAAA,EAAK,EAAA,CAAG,MAAA,IAAU;AAAC;AACrB,KACF;AAAA,EACF;AACA,EAAA,IAAI,EAAA,CAAG,SAAS,IAAA,EAAM;AACpB,IAAA,OAAO;AAAA,MACL;AAAA,QACE,EAAA,EAAI,GAAG,EAAA,IAAM,IAAA;AAAA,QACb,IAAA,EAAM,IAAA;AAAA,QACN,QAAA,EAAU,CAAA,GAAA,EAAM,EAAA,CAAG,IAAI,CAAA,CAAA;AAAA,QACvB,aAAa,EAAA,CAAG,IAAA;AAAA,QAChB,WAAA,EAAa,EAAA,CAAG,WAAA,IAAe,CAAA,gBAAA,EAAmB,GAAG,IAAI,CAAA,CAAA;AAAA,QACzD,YAAA,EAAc;AAAA,UACZ,IAAA,EAAM,QAAA;AAAA,UACN,UAAA,EAAY;AAAA,YACV,KAAA,EAAO;AAAA,cACL,IAAA,EAAM,QAAA;AAAA,cACN,WAAA,EAAa;AAAA;AACf,WACF;AAAA,UACA,QAAA,EAAU,CAAC,OAAO;AAAA,SACpB;AAAA,QACA,kBAAkB,EAAA,CAAG,gBAAA;AAAA,QACrB,gBAAgB,EAAA,CAAG,cAAA;AAAA,QACnB,UAAU,EAAA,CAAG,QAAA;AAAA,QACb,KAAK,EAAA,CAAG,GAAA;AAAA,QACR,GAAA,EAAK,EAAA,CAAG,MAAA,IAAU;AAAC;AACrB,KACF;AAAA,EACF;AACA,EAAA,IAAI,EAAA,CAAG,IAAA,KAAS,KAAA,EAAO,OAAO,eAAe,EAAE,CAAA;AAC/C,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,CAAA,0CAAA,EAA6C,IAAA,CAAK,SAAA,CAAU,EAAA,CAAG,IAAI,CAAC,CAAA,4FAAA;AAAA,GAEtE;AACF;AAEO,SAAS,QAAA,CAAS,OAAwB,QAAA,EAA6C;AAC5F,EAAA,OAAO,MAAM,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,QAAQ,CAAA;AAClD;;;ALpGO,IAAM,gBAAA,GAAmB,GAAA;AACzB,IAAM,eAAA,GAAkB,GAAA;AAE/B,IAAM,iBAAA,uBAAwB,GAAA,CAAI;AAAA,EAChC,MAAA;AAAA,EACA,MAAA;AAAA,EACA,aAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,KAAA;AAAA,EACA,kBAAA;AAAA,EACA,mBAAA;AAAA,EACA,gBAAA;AAAA,EACA,iBAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAC,CAAA;AAgBM,SAAS,mBAAmB,MAAA,EAA6B;AAC9D,EAAA,OAAO,OAAA,CAAS,MAAA,EAAQ,MAAA,EAAyD,kBAAkB,CAAA;AACrG;AAEO,SAAS,WAAA,CAAY,IAAmB,UAAA,EAA4D;AACzG,EAAA,OAAO,UAAA,CAAW,EAAA,CAAG,GAAA,EAAK,UAAU,CAAA;AACtC;AAEO,SAAS,oBACd,IAAA,EACyB;AACzB,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,CAAC,GAAG,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQ,IAAA,IAAQ,EAAE,CAAA,EAAG;AAC/C,IAAA,IAAI,CAAC,OAAO,CAAC,CAAA,CAAE,WAAW,GAAG,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EAC3C;AACA,EAAA,OAAO,GAAA;AACT;AAEO,SAAS,WAAA,CACd,MAAA,EACA,IAAA,GAAgD,EAAC,EAC7B;AACpB,EAAA,MAAM,QAAA,GAAW,KAAK,QAAA,IAAY,gBAAA;AAClC,EAAA,MAAM,OAAA,GAAU,KAAK,OAAA,IAAW,eAAA;AAChC,EAAA,IAAI,SAAA,GAAY,KAAA;AAChB,EAAA,IAAI,MAAA,GAAS,MAAA;AAEb,EAAA,IACE,MAAA,IACA,OAAO,MAAA,KAAW,QAAA,IAClB,KAAA,CAAM,OAAA,CAAS,MAAA,CAA8B,IAAI,CAAA,IAChD,MAAA,CAA+B,IAAA,CAAK,MAAA,GAAS,OAAA,EAC9C;AACA,IAAA,MAAM,OAAQ,MAAA,CAA+B,IAAA;AAC7C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,OAAO,CAAA;AAClC,IAAA,MAAA,GAAS;AAAA,MACP,GAAI,MAAA;AAAA,MACJ,IAAA,EAAM,IAAA;AAAA,MACN,eAAA,EAAiB,EAAE,aAAA,EAAe,IAAA,CAAK,QAAQ,YAAA,EAAc,IAAA,CAAK,MAAA,GAAS,IAAA,CAAK,MAAA;AAAO,KACzF;AACA,IAAA,SAAA,GAAY,IAAA;AAAA,EACd;AAEA,EAAA,IAAI,UAAA;AACJ,EAAA,IAAI;AACF,IAAA,UAAA,GAAa,IAAA,CAAK,UAAU,MAAM,CAAA;AAAA,EACpC,CAAA,CAAA,MAAQ;AACN,IAAA,UAAA,GAAa,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,MAAM,CAAC,CAAA;AAAA,EAC5C;AACA,EAAA,IAAI,UAAA,CAAW,SAAS,QAAA,EAAU;AAChC,IAAA,OAAO;AAAA,MACL;AAAA,QACE,UAAA,EAAY,UAAA,CAAW,KAAA,CAAM,CAAA,EAAG,QAAQ,CAAA;AAAA,QACxC,gBAAgB,UAAA,CAAW,MAAA;AAAA,QAC3B,KAAA,EAAO;AAAA,OACT;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,CAAC,QAAQ,SAAS,CAAA;AAC3B;AAEO,SAAS,gBAAA,CACd,MAAA,EACA,MAAA,EACA,IAAA,EAKoC;AACpC,EAAA,IAAI,OAAO,OAAA,EAAQ,SAAU,CAAC,MAAA,EAAQ,EAAE,CAAA;AACxC,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,MAAM,SAAmB,EAAC;AAC1B,EAAA,IAAI,KAAA,GAAQ,CAAA;AAEZ,EAAA,MAAM,IAAA,GAAO,CAAC,IAAA,KAA2B;AACvC,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,MAAA,MAAM,CAAC,IAAA,EAAMC,KAAI,CAAA,GAAI,cAAA,CAAe,MAAM,MAAA,EAAQ;AAAA,QAChD,KAAA,EAAO,QAAA;AAAA,QACP,UAAA,EAAY,KAAK,UAAA,IAAc,IAAA;AAAA,QAC/B,WAAW,IAAA,CAAK,SAAA;AAAA,QAChB,OAAO,IAAA,CAAK;AAAA,OACb,CAAA;AACD,MAAA,IAAIA,KAAAA,IAAQ,MAAA,CAAO,IAAA,CAAKA,KAAI,EAAE,MAAA,EAAQ;AACpC,QAAA,KAAA,IAASA,MAAK,KAAA,IAAS,CAAA;AACvB,QAAA,KAAA,MAAW,IAAA,IAAQA,KAAAA,CAAK,WAAA,IAAe,EAAC,EAAG;AACzC,UAAA,IAAI,CAAC,KAAA,CAAM,QAAA,CAAS,IAAI,CAAA,EAAG,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,QAC5C;AACA,QAAA,KAAA,MAAW,IAAA,IAAQA,KAAAA,CAAK,YAAA,IAAgB,EAAC,EAAG;AAC1C,UAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,EAAG,MAAA,CAAO,KAAK,IAAI,CAAA;AAAA,QAC9C;AAAA,MACF;AACA,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,IAAI,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AACpC,MAAA,IAAI,MAAM,OAAA,CAAQ,IAAI,GAAG,OAAO,IAAA,CAAK,IAAI,IAAI,CAAA;AAC7C,MAAA,MAAM,MAA+B,EAAC;AACtC,MAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,OAAA,CAAQ,IAA+B,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,GAAI,IAAA,CAAK,CAAC,CAAA;AACrF,MAAA,OAAO,GAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,QAAA,GAAW,KAAK,MAAM,CAAA;AAC5B,EAAA,IAAI,CAAC,KAAA,CAAM,MAAA,IAAU,CAAC,MAAA,CAAO,QAAQ,OAAO,CAAC,QAAA,EAAU,EAAE,CAAA;AACzD,EAAA,MAAM,IAAA,GAAgC,EAAE,WAAA,EAAa,KAAA,EAAO,OAAO,KAAA,EAAM;AACzE,EAAA,IAAI,MAAA,CAAO,MAAA,EAAQ,IAAA,CAAK,YAAA,GAAe,MAAA;AACvC,EAAA,OAAO,CAAC,UAAU,IAAI,CAAA;AACxB;AAiBA,SAAS,UAAU,MAAA,EAA4B;AAG7C,EAAA,MAAM,GAAA,GAAM,YAAA,CAAa,MAAA,CAAO,MAAM,CAAA;AACtC,EAAA,IAAI,GAAA,CAAI,WAAW,EAAA,EAAI;AACrB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uCAAA,EAA0C,GAAA,CAAI,MAAM,CAAA,eAAA,CAAiB,CAAA;AAAA,EACvF;AACA,EAAA,OAAO,GAAA;AACT;AAOA,SAAS,gBAAA,CAAiB,KAA8B,MAAA,EAA6C;AACnG,EAAA,IAAI,CAAC,GAAA,CAAI,gBAAA,EAAkB,OAAO,EAAC;AACnC,EAAA,OAAO,YAAY,MAAA,CAAO,GAAA,CAAI,gBAAgB,CAAA,EAAG,SAAA,CAAU,MAAM,CAAC,CAAA;AACpE;AAOA,SAAS,eAAA,CACP,GAAA,EACA,MAAA,EACA,MAAA,EACY;AACZ,EAAA,MAAA,KAAW,gBAAA,CAAiB,KAAK,MAAM,CAAA;AACvC,EAAA,OAAO,IAAI,UAAA,CAAW;AAAA,IACpB,EAAA,EAAI,MAAA,CAAO,GAAA,CAAI,EAAE,CAAA;AAAA,IACjB,IAAA,EAAM,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA;AAAA,IACrB,MAAM,GAAA,CAAI,IAAA;AAAA,IACV,WAAA,EAAa,MAAA,CAAO,GAAA,CAAI,WAAA,IAAe,EAAE,CAAA;AAAA,IACzC,MAAA;AAAA,IACA,QAAA,EAAW,IAAI,SAAA,IAA+B,IAAA;AAAA,IAC9C,GAAA,EAAK,IAAI,GAAA,IAAO,IAAA,GAAO,CAAC,GAAI,GAAA,CAAI,GAAgB,CAAA,GAAI,IAAA;AAAA,IACpD,gBAAA,EAAkB,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA;AAAA,IAC/C,cAAA,EAAiB,GAAA,CAAI,eAAA,IAA+C,EAAC;AAAA,IACrE,OAAA,EAAS,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA;AAAA,IAC5B,QAAA,EAAW,GAAA,CAAI,SAAA,IAAyC;AAAC,GAC1D,CAAA;AACH;AAwBA,SAAS,sBAAA,CAAuB,KAA8B,MAAA,EAAuC;AACnG,EAAA,IAAI,CAAC,IAAI,gBAAA,EAAkB,OAAO,gBAAgB,GAAA,EAAK,MAAA,EAAQ,EAAE,CAAA;AACjE,EAAA,MAAM,GAAA,GAAM,UAAU,MAAM,CAAA;AAC5B,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,WAAA,CAAY,MAAA,CAAO,GAAA,CAAI,gBAAgB,GAAG,GAAG,CAAA;AAAA,EACxD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,CAAA,KAAA,EAAQ,OAAO,GAAA,CAAI,EAAE,CAAC,CAAA,EAAA,EAAK,MAAA,CAAO,GAAA,CAAI,IAAI,CAAC,CAAA,6HAAA;AAAA,KAE7C;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,eAAA,CAAgB,GAAA,EAAK,MAAA,EAAQ,MAAM,CAAA;AAC5C;AAEA,eAAe,uBAAA,CACb,QACA,QAAA,EAC0B;AAC1B,EAAA,MAAM,SAAoB,EAAC;AAC3B,EAAA,IAAI,GAAA,GAAM,CAAA,wDAAA,CAAA;AACV,EAAA,IAAI,YAAY,IAAA,EAAM;AACpB,IAAA,MAAA,CAAO,KAAK,QAAQ,CAAA;AACpB,IAAA,GAAA,IAAO,CAAA,mBAAA,CAAA;AAAA,EACT;AACA,EAAA,MAAM,SAAS,MAAM,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,KAAK,MAAM,CAAA;AAClD,EAAA,MAAM,aAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,GAAA,IAAO,OAAO,IAAA,EAAM;AAC7B,IAAA,MAAM,EAAA,GAAK,sBAAA,CAAuB,GAAA,EAAK,MAAM,CAAA;AAC7C,IAAA,IAAI,OAAO,IAAA,EAAM;AACjB,IAAA,UAAA,CAAW,IAAA,CAAK,GAAG,mBAAA,CAAoB,EAAE,CAAC,CAAA;AAAA,EAC5C;AACA,EAAA,OAAO,UAAA;AACT;AAEA,eAAe,WAAA,CAAY,QAAoB,QAAA,EAAmD;AAChG,EAAA,MAAM,SAAA,GAAY,MAAM,uBAAA,CAAwB,MAAA,EAAQ,QAAQ,CAAA;AAChE,EAAA,MAAM,YAAY,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,cAAA,IAAkB,EAAE,CAAA;AAC3D,EAAA,OAAO,CAAC,GAAG,SAAA,EAAW,GAAG,SAAS,CAAA;AACpC;AAWA,eAAsB,YAAA,CAAa,QAAoB,EAAA,EAAiC;AACtF,EAAA,mBAAA,CAAoB,EAAE,CAAA;AACtB,EAAA,MAAM,MAAA,GAAS,EAAA,CAAG,MAAA,IAAU,EAAC;AAI7B,EAAA,IAAI,gBAAA,CAAiB,MAAM,CAAA,EAAG;AAC5B,IAAA,MAAM,IAAI,mBAAA;AAAA,MACR,CAAA,oBAAA,EAAuB,IAAA,CAAK,SAAA,CAAU,iBAAiB,CAAC,CAAA,sGAAA;AAAA,KAE1D;AAAA,EACF;AACA,EAAA,MAAM,eAAA,GAAkB,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,MAAA,GAAS,WAAA,CAAY,MAAA,EAAQ,SAAA,CAAU,MAAM,CAAC,CAAA,GAAI,IAAA;AAC9F,EAAA,MAAM,KAAKX,iBAAAA,EAAW;AACtB,EAAA,MAAM,OAAO,IAAA,CAAK,KAAA;AAAA,IAChB,CAAA;AAAA;AAAA;AAAA,wEAAA,CAAA;AAAA,IAIA;AAAA,MACE,EAAA;AAAA,MACA,EAAA,CAAG,IAAA;AAAA,MACH,EAAA,CAAG,IAAA;AAAA,MACH,GAAG,WAAA,IAAe,EAAA;AAAA,MAClB,EAAA,CAAG,QAAA;AAAA,MACH,EAAA,CAAG,GAAA;AAAA,MACH,eAAA;AAAA,MACA,EAAA,CAAG,gBAAA;AAAA,MACH,IAAA,CAAK,SAAA,CAAU,EAAA,CAAG,cAAA,IAAkB,EAAE,CAAA;AAAA,MACtC,EAAA,CAAG,OAAA;AAAA,MACH,IAAA,CAAK,SAAA,CAAU,EAAA,CAAG,QAAA,IAAY,EAAE;AAAA;AAClC,GACF;AACA,EAAA,OAAO,EAAA;AACT;AAEA,eAAsB,UAAA,CACpB,MAAA,EACA,EAAA,EACA,IAAA,EACqB;AACrB,EAAA,MAAM,EAAE,UAAA,GAAa,IAAA,EAAM,GAAG,QAAO,GAAI,IAAA;AACzC,EAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,gDAAA,CAAA,EAAoD,CAAC,EAAE,CAAC,CAAA;AACjG,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,IAAA,CAAK,CAAC,CAAA;AAC3B,EAAA,IAAI,CAAC,GAAA,IAAO,CAAC,UAAA,CAAW,IAAI,GAAA,IAAO,IAAA,GAAO,CAAC,GAAG,GAAA,CAAI,GAAG,CAAA,GAAI,IAAA,EAAM,UAAU,CAAA,EAAG;AAC1E,IAAA,MAAM,IAAI,iBAAA,CAAkB,CAAA,gBAAA,EAAmB,EAAE,CAAA,CAAE,CAAA;AAAA,EACrD;AACA,EAAA,MAAM,OAAiB,EAAC;AACxB,EAAA,MAAM,SAAoB,EAAC;AAC3B,EAAA,IAAI,CAAA,GAAI,CAAA;AACR,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AACjD,IAAA,IAAI,QAAQ,QAAA,EAAU;AAQpB,MAAA,IAAI,MAAA,GAAS,KAAA;AACb,MAAA,IAAI,MAAA,IAAU,gBAAA,CAAiB,MAAM,CAAA,EAAG;AAItC,QAAA,IAAI,MAAA,CAAO,OAAO,MAAA,EAAQ,MAAM,KAAK,MAAA,CAAO,IAAA,KAAS,IAAI,IAAA,EAAM;AAC7D,UAAA,MAAM,IAAI,mBAAA;AAAA,YACR;AAAA,WACF;AAAA,QACF;AAKA,QAAA,IAAI,OAAO,WAAA,KAAgB,KAAA,IAAS,gBAAA,CAAiB,MAAA,CAAO,IAAI,CAAA,EAAG;AACjE,UAAA,MAAM,IAAI,mBAAA;AAAA,YACR,CAAA,+DAAA,EACK,IAAA,CAAK,SAAA,CAAU,iBAAiB,CAAC,CAAA,0CAAA;AAAA,WACxC;AAAA,QACF;AACA,QAAA,IAAI,CAAC,IAAI,gBAAA,EAAkB;AACzB,UAAA,MAAM,IAAI,mBAAA;AAAA,YACR,CAAA,gBAAA,EAAmB,IAAA,CAAK,SAAA,CAAU,iBAAiB,CAAC,CAAA,6EAAA;AAAA,WAEtD;AAAA,QACF;AAIA,QAAA,MAAMY,IAAAA,GAAM,UAAU,MAAM,CAAA;AAC5B,QAAA,IAAI,MAAA;AACJ,QAAA,IAAI;AACF,UAAA,MAAA,GAAS,WAAA,CAAY,MAAA,CAAO,GAAA,CAAI,gBAAgB,GAAGA,IAAG,CAAA;AAAA,QACxD,SAAS,GAAA,EAAK;AACZ,UAAA,MAAM,IAAI,mBAAA;AAAA,YACR,CAAA,gHAAA,EAC0C,IAAA,CAAK,SAAA,CAAU,iBAAiB,CAAC,CAAA,OAAA,CAAA;AAAA,YAC3E,EAAE,OAAO,GAAA;AAAI,WACf;AAAA,QACF;AACA,QAAA,MAAA,GAAS,aAAA,CAAc,QAAQ,MAAM,CAAA;AAAA,MACvC;AACA,MAAA,IAAA,CAAK,IAAA,CAAK,CAAA,oBAAA,EAAuB,CAAA,EAAG,CAAA,CAAE,CAAA;AAEtC,MAAA,MAAA,CAAO,IAAA,CAAK,MAAA,IAAU,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,MAAA,GAAS,WAAA,CAAY,MAAA,EAAQ,SAAA,CAAU,MAAM,CAAC,IAAI,IAAI,CAAA;AAAA,IAClG,CAAA,MAAA,IAAW,iBAAA,CAAkB,GAAA,CAAI,GAAG,CAAA,EAAG;AACrC,MAAA,MAAM,GAAA,GACJ,GAAA,KAAQ,UAAA,GACJ,WAAA,GACA,GAAA,KAAQ,kBAAA,GACN,mBAAA,GACA,GAAA,KAAQ,gBAAA,GACN,iBAAA,GACA,GAAA,KAAQ,UAAA,GACN,WAAA,GACA,GAAA;AACZ,MAAA,IAAA,CAAK,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,IAAA,EAAO,GAAG,CAAA,CAAE,CAAA;AAC5B,MAAA,MAAA,CAAO,IAAA,CAAK,GAAA,KAAQ,iBAAA,IAAqB,GAAA,KAAQ,WAAA,GAAc,IAAA,CAAK,SAAA,CAAU,KAAA,IAAS,EAAE,CAAA,GAAI,KAAK,CAAA;AAAA,IACpG;AAAA,EACF;AACA,EAAA,IAAA,CAAK,KAAK,CAAA,kBAAA,CAAoB,CAAA;AAC9B,EAAA,MAAA,CAAO,KAAK,EAAE,CAAA;AACd,EAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,IAAA,CAAK,KAAA;AAAA,IAChC,mCAAmC,IAAA,CAAK,IAAA,CAAK,IAAI,CAAC,gBAAgB,CAAC,CAAA,YAAA,CAAA;AAAA,IACnE;AAAA,GACF;AAIA,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA;AAC3B,EAAA,OAAO,sBAAA,CAAuB,MAAM,MAAM,CAAA,IAAK,gBAAgB,IAAA,EAAM,MAAA,EAAQ,EAAE,CAAA;AACjF;AAEA,eAAsB,UAAA,CACpB,MAAA,EACA,EAAA,EACA,IAAA,GAAmD,EAAC,EACrC;AACf,EAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,gDAAA,CAAA,EAAoD,CAAC,EAAE,CAAC,CAAA;AACjG,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,IAAA,CAAK,CAAC,CAAA;AAC3B,EAAA,IAAI,CAAC,GAAA,IAAO,CAAC,UAAA,CAAW,GAAA,CAAI,OAAO,IAAA,GAAO,CAAC,GAAG,GAAA,CAAI,GAAG,CAAA,GAAI,IAAA,EAAM,IAAA,CAAK,UAAA,IAAc,IAAI,CAAA,EAAG;AACvF,IAAA,MAAM,IAAI,iBAAA,CAAkB,CAAA,gBAAA,EAAmB,EAAE,CAAA,CAAE,CAAA;AAAA,EACrD;AACA,EAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAM,CAAA,8CAAA,CAAA,EAAkD,CAAC,EAAE,CAAC,CAAA;AAChF;AA8BA,IAAM,UAAA,GAAa;AAAA,EACjB,uBAAA;AAAA,EACA,QAAA;AAAA,EACA,mBAAA;AAAA,EACA,eAAA;AAAA,EACA,UAAA;AAAA,EACA,cAAA;AAAA,EACA,WAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA;AACF,CAAA;AACA,IAAM,iBAAA,GAAoB;AAAA,EACxB,oBAAA;AAAA,EACA,mBAAA;AAAA,EACA,2BAAA;AAAA,EACA,uBAAA;AAAA,EACA,kBAAA;AAAA,EACA,wBAAA;AAAA,EACA,sCAAA;AAAA,EACA,aAAA;AAAA,EACA,kBAAA;AAAA,EACA,cAAA;AAAA,EACA,cAAA;AAAA,EACA;AACF,CAAA;AACA,IAAM,aAAA,GAAgB,CAAC,WAAA,EAAa,SAAA,EAAW,SAAS,CAAA;AACxD,IAAM,mBAAA,GAAsB;AAAA,EAC1B,gBAAA;AAAA,EACA,SAAA;AAAA,EACA,kBAAA;AAAA,EACA,cAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,eAAA;AAAA,EACA;AACF,CAAA;AAEA,SAAS,mBAAmB,GAAA,EAAsB;AAChD,EAAA,IAAI,GAAA,YAAe,YAAA,IAAgB,GAAA,CAAI,IAAA,KAAS,gBAAgB,OAAO,SAAA;AACvE,EAAA,MAAM,IAAA,GAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,IAAA,GAAO,EAAA;AAC/C,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,SAAS,CAAA,EAAG,OAAO,SAAA;AACrC,EAAA,IAAI,CAAC,cAAA,EAAgB,iBAAA,EAAmB,cAAA,EAAgB,WAAW,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,IAAA,CAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG;AAClG,IAAA,IAAI,IAAA,KAAS,WAAA,IAAe,CAAC,MAAA,CAAO,GAAG,EAAE,WAAA,EAAY,CAAE,QAAA,CAAS,OAAO,CAAA,EAAG,CAE1E,MAAA,IAAW,IAAA,KAAS,WAAA,EAAa,OAAO,aAAA;AAAA,EAC1C;AACA,EAAA,IAAI,CAAC,MAAA,EAAQ,YAAA,EAAc,WAAA,EAAa,cAAc,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,IAAA,CAAK,QAAA,CAAS,CAAC,CAAC,GAAG,OAAO,aAAA;AAC9F,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,GAAG,CAAA,CAAE,WAAA,EAAY;AACrC,EAAA,IAAI,aAAA,CAAc,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,OAAO,SAAA;AACxD,EAAA,IAAI,UAAA,CAAW,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,OAAO,aAAA;AACrD,EAAA,IAAI,iBAAA,CAAkB,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,OAAO,aAAA;AAC5D,EAAA,IAAI,mBAAA,CAAoB,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,OAAO,eAAA;AAC9D,EAAA,OAAO,OAAA;AACT;AAEA,SAAS,YAAA,CAAa,KAAc,IAAA,EAAuC;AACzE,EAAA,MAAM,QAAA,GAAW,mBAAmB,GAAG,CAAA;AACvC,EAAA,OAAA,CAAQ,KAAK,CAAA,eAAA,EAAkB,IAAI,CAAA,SAAA,CAAA,EAAa,GAAA,EAAK,MAAM,QAAQ,CAAA;AACnE,EAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,QAAA,EAAS;AACtC;AAEA,eAAsB,QAAA,CAAS,QAAoB,EAAA,EAAkD;AACnG,EAAA,MAAM,OAAO,EAAA,CAAG,IAAA;AAChB,EAAA,MAAM,MAAA,GAAS,EAAA,CAAG,MAAA,IAAU,EAAC;AAM7B,EAAA,IAAI,gBAAA,CAAiB,MAAM,CAAA,EAAG;AAC5B,IAAA,MAAM,IAAI,mBAAA;AAAA,MACR,CAAA,oBAAA,EAAuB,IAAA,CAAK,SAAA,CAAU,iBAAiB,CAAC,CAAA,gGAAA;AAAA,KAE1D;AAAA,EACF;AACA,EAAA,IAAI,SAAS,MAAA,EAAQ;AACnB,IAAA,MAAM,MAAM,MAAA,CAAO,GAAA;AACnB,IAAA,IAAI,CAAC,GAAA,EAAK,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAO,2BAAA,EAA4B;AAKjE,IAAA,IAAI;AACF,MAAA,MAAM,oBAAoB,GAAA,EAAK,EAAE,cAAc,kBAAA,CAAmB,MAAM,GAAG,CAAA;AAAA,IAC7E,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,eAAe,YAAA,EAAc;AAC/B,QAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,6BAAA,EAAgC,GAAA,CAAI,OAAO,CAAA,CAAE,CAAA;AAC1D,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,eAAA,EAAgB;AAAA,MAC7C;AACA,MAAA,MAAM,GAAA;AAAA,IACR;AACA,IAAA,MAAM,MAAA,GAAS,QAAQ,eAAA,IAAmB,IAAA;AAC1C,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAA,GACT,MAAM,MAAA,CAAO,OAAA,CAAQ;AAAA,QACnB,MAAA,EAAQ,MAAA;AAAA,QACR,GAAA;AAAA,QACA,OAAA,EAAU,MAAA,CAAO,OAAA,IAAsC;AAAC,OACzD,CAAA,GACD,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,QACf,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAU,MAAA,CAAO,OAAA,IAAsC,EAAC;AAAA;AAAA;AAAA,QAGxD,QAAA,EAAU,QAAA;AAAA,QACV,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAM;AAAA,OACnC,CAAA;AACL,MAAA,OAAO,EAAE,EAAA,EAAI,IAAA,CAAK,SAAS,GAAA,EAAK,WAAA,EAAa,KAAK,MAAA,EAAO;AAAA,IAC3D,SAAS,GAAA,EAAK;AACZ,MAAA,OAAO,YAAA,CAAa,KAAK,MAAM,CAAA;AAAA,IACjC;AAAA,EACF;AACA,EAAA,IAAI,SAAS,IAAA,EAAM;AACjB,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,cAAA,EAAAC,eAAAA,EAAe,GAAI,MAAM,OAAA,CAAA,OAAA,EAAA,CAAA,IAAA,CAAA,OAAA,OAAA,EAAA,EAAA,UAAA,CAAA,CAAA;AACjC,MAAA,MAAM,MAAA,GAAS,MAAMA,eAAAA,CAAe,MAAM,CAAA;AAC1C,MAAA,OAAO,EAAE,IAAI,OAAA,CAAQ,MAAA,CAAO,WAAW,MAAA,CAAO,EAAE,CAAA,EAAG,GAAG,MAAA,EAAO;AAAA,IAC/D,SAAS,GAAA,EAAK;AACZ,MAAA,OAAO,YAAA,CAAa,KAAK,IAAI,CAAA;AAAA,IAC/B;AAAA,EACF;AACA,EAAA,IAAI,SAAS,KAAA,EAAO;AAClB,IAAA,MAAM,MAAM,MAAA,CAAO,GAAA;AACnB,IAAA,IAAI,CAAC,GAAA,EAAK,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAO,0BAAA,EAA2B;AAChE,IAAA,MAAM,KAAA,GAAS,MAAA,CAAO,WAAA,IAAe,MAAA,CAAO,UAAU,MAAA,CAAO,YAAA;AAM7D,IAAA,MAAM,GAAA,GAAM,IAAI,WAAA,CAAY,EAAE,cAAc,kBAAA,CAAmB,MAAM,GAAG,CAAA;AACxE,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,CAAI,UAAU,EAAA,CAAG,IAAA,EAAM,KAAK,EAAE,KAAA,EAAO,KAAA,IAAS,IAAA,EAAM,CAAA;AAC1D,MAAA,MAAM,MAAA,GAAS,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,GAAG,IAAI,CAAA;AACtC,MAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,KAAA,EAAO,MAAA,CAAO,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAA,EAAE;AAAA,IAC5D,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,eAAe,YAAA,EAAc;AAC/B,QAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,4BAAA,EAA+B,GAAA,CAAI,OAAO,CAAA,CAAE,CAAA;AACzD,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,eAAA,EAAgB;AAAA,MAC7C;AACA,MAAA,OAAO,YAAA,CAAa,KAAK,KAAK,CAAA;AAAA,IAChC,CAAA,SAAE;AACA,MAAA,MAAM,IAAI,QAAA,EAAS;AAAA,IACrB;AAAA,EACF;AACA,EAAA,OAAO,EAAE,IAAI,KAAA,EAAO,KAAA,EAAO,mCAAmC,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA,CAAA,EAAG;AACvF;AAeA,eAAe,qBACb,MAAA,EACA,QAAA,EACA,IAAA,EACA,QAAA,EACA,YACA,aAAA,EACwB;AACxB,EAAA,MAAM,SAAA,uBAAgB,IAAA,EAAK;AAC3B,EAAA,MAAM,MAAA,GAAoB,CAAC,QAAQ,CAAA;AACnC,EAAA,IAAI,QAAA,GAAW,wBAAA;AACf,EAAA,IAAI,kBAAkB,IAAA,EAAM;AAC1B,IAAA,MAAA,CAAO,KAAK,aAAa,CAAA;AACzB,IAAA,QAAA,GAAW,CAAA,kBAAA,EAAqB,OAAO,MAAM,CAAA,CAAA;AAAA,EAC/C;AACA,EAAA,MAAM,IAAA,GAAO,kBAAA,CAAmB,UAAA,EAAY,MAAA,CAAO,SAAS,CAAC,CAAA;AAC7D,EAAA,MAAA,CAAO,IAAA,CAAK,GAAG,IAAA,CAAK,MAAM,CAAA;AAC1B,EAAA,MAAM,UAAA,GAAa,MAAM,MAAA,CAAO,IAAA,CAAK,KAAA;AAAA,IACnC,CAAA;AAAA,sDAAA,EACoD,QAAQ,CAAA,KAAA,EAAQ,IAAA,CAAK,GAAG,CAAA,CAAA;AAAA,IAC5E;AAAA,GACF;AACA,EAAA,KAAA,MAAW,GAAA,IAAO,WAAW,IAAA,EAAM;AACjC,IAAA,IAAA,CAAK,GAAA,CAAI,SAAA,IAAa,IAAA,OAAW,QAAA,IAAY,IAAA,CAAA,EAAO;AACpD,IAAA,MAAM,MAAA,GAAS,GAAA,CAAI,gBAAA,IAAoB,EAAC;AACxC,IAAA,IAAI,KAAK,SAAA,CAAU,MAAM,MAAM,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG;AACrD,IAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,CAAK,KAAA;AAAA,MAC/B,CAAA;AAAA;AAAA;AAAA,mBAAA,CAAA;AAAA,MAIA,CAAC,SAAA,EAAW,GAAA,CAAI,EAAE;AAAA,KACpB;AACA,IAAA,IAAI,OAAO,QAAA,KAAa,CAAA,EAAG,OAAO,MAAA,CAAO,IAAI,EAAE,CAAA;AAAA,EACjD;AACA,EAAA,OAAO,IAAA;AACT;AAWA,eAAe,YACb,EAAA,EACA,MAAA,EACA,IAAA,EACA,IAAA,GAAmC,EAAC,EAClB;AAClB,EAAA,MAAM,MAAM,MAAA,CAAO,GAAA;AACnB,EAAA,IAAI,CAAC,KAAK,MAAM,IAAI,kBAAkB,CAAA,SAAA,EAAY,EAAA,CAAG,QAAQ,CAAA,qBAAA,CAAuB,CAAA;AACpF,EAAA,MAAM,UAAU,EAAE,GAAK,MAAA,CAAO,OAAA,IAAsC,EAAC,EAAG;AACxE,EAAA,MAAM,KAAA,GAAS,MAAA,CAAO,WAAA,IAAe,MAAA,CAAO,UAAU,MAAA,CAAO,YAAA;AAC7D,EAAA,MAAM,SAAS,MAAA,CAAO,OAAA;AACtB,EAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,KAAK,CAAA,CAAA;AAAA,OAAA,IACzC,MAAA,EAAQ,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,MAAM,CAAA,CAAA;AACzD,EAAA,MAAM,WAAW,MAAA,CAAO,EAAA,CAAG,GAAA,EAAK,SAAA,IAAa,GAAG,WAAW,CAAA;AAC3D,EAAA,MAAM,GAAA,GAAM,IAAI,WAAA,CAAY,EAAE,cAAc,IAAA,CAAK,YAAA,IAAgB,OAAO,CAAA;AACxE,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,CAAI,SAAA,CAAU,EAAA,CAAG,QAAA,EAAU,KAAK,EAAE,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,MAAA,GAAS,OAAA,GAAU,MAAM,CAAA;AAC/F,IAAA,MAAM,MAAA,GAAS,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,GAAG,QAAQ,CAAA;AAC1C,IAAA,OAAO,MAAM,MAAA,CAAO,qBAAA,CAAsB,QAAA,EAAU,IAAI,CAAA;AAAA,EAC1D,CAAA,SAAE;AACA,IAAA,MAAM,IAAI,QAAA,EAAS;AAAA,EACrB;AACF;AAEA,eAAe,QAAA,CACb,MAAA,EACA,EAAA,EACA,MAAA,EACA,IAAA,EACkB;AAClB,EAAA,IAAI,EAAA,CAAG,SAAS,MAAA,EAAQ;AACtB,IAAA,OAAO,WAAA,CAAY,QAAQ,IAAA,EAAM;AAAA,MAC/B,MAAA,EAAQ,OAAO,eAAA,IAAmB,IAAA;AAAA,MAClC,YAAA,EAAc,mBAAmB,MAAM;AAAA,KACxC,CAAA;AAAA,EACH;AACA,EAAA,IAAI,EAAA,CAAG,SAAS,IAAA,EAAM;AACpB,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,IAAA,CAAK,KAAA,IAAS,EAAE,CAAA;AACrC,IAAA,IAAI,MAAM,IAAA,EAAK,CAAE,aAAY,CAAE,UAAA,CAAW,WAAW,CAAA,EAAG;AACtD,MAAA,MAAM,MAAA,GAAS,MACZ,KAAA,CAAM,KAAA,CAAM,QAAQ,GAAG,CAAA,GAAI,CAAC,CAAA,CAC5B,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,MAAM,CAAA,CACnB,OAAO,OAAO,CAAA;AACjB,MAAA,MAAM,aAAa,MAAM,aAAA,CAAc,QAAQ,MAAA,CAAO,MAAA,GAAS,SAAS,IAAI,CAAA;AAC5E,MAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,MAAA,EAAQ,UAAA,EAAW;AAAA,IAC7C;AACA,IAAA,MAAM,MAAA,GAAS,MAAM,SAAA,CAAU,MAAA,EAAQ,KAAK,CAAA;AAC5C,IAAA,IAAI,UAAU,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,YAAY,KAAA,EAAO;AACpE,MAAA,MAAM,IAAI,iBAAA,CAAkB,MAAA,CAAO,MAAA,CAAO,KAAA,IAAS,uBAAuB,CAAC,CAAA;AAAA,IAC7E;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,EAAA,CAAG,SAAS,KAAA,EAAO;AACrB,IAAA,OAAO,WAAA,CAAY,IAAI,MAAA,EAAQ,IAAA,EAAM,EAAE,YAAA,EAAc,kBAAA,CAAmB,MAAM,CAAA,EAAG,CAAA;AAAA,EACnF;AACA,EAAA,IAAI,EAAA,CAAG,SAAS,UAAA,EAAY;AAC1B,IAAA,MAAM,EAAA,GAAK,GAAG,GAAA,EAAK,QAAA;AACnB,IAAA,IAAI,CAAC,IAAI,MAAM,IAAI,kBAAkB,CAAA,cAAA,EAAiB,EAAA,CAAG,QAAQ,CAAA,gBAAA,CAAkB,CAAA;AACnF,IAAA,OAAO,MAAM,EAAA,CAAG,GAAG,SAAA,CAAU,EAAA,EAAI,IAAI,CAAC,CAAA;AAAA,EACxC;AACA,EAAA,MAAM,IAAI,kBAAkB,CAAA,uBAAA,EAA0B,IAAA,CAAK,UAAU,EAAA,CAAG,IAAI,CAAC,CAAA,CAAE,CAAA;AACjF;AAEA,SAAS,SAAA,CAAU,IAAkC,IAAA,EAA0C;AAC7F,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,SAAA,CAAU,QAAA,CAAS,KAAK,EAAE,CAAA;AAC/C,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,aAAa,CAAA;AACrC,EAAA,MAAM,KAAA,GAAA,CAAS,QAAQ,CAAC,CAAA,IAAK,IAC1B,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,IAAA,EAAK,CAAE,KAAA,CAAM,MAAM,CAAA,CAAE,CAAC,GAAG,IAAA,EAAM,CAAA,CAC5C,MAAA,CAAO,OAAO,CAAA;AACjB,EAAA,IAAI,CAAC,KAAA,CAAM,MAAA,EAAQ,OAAO,MAAA,CAAO,OAAO,IAAI,CAAA;AAC5C,EAAA,OAAO,MAAM,GAAA,CAAI,CAAC,CAAA,KAAM,IAAA,CAAK,CAAE,CAAC,CAAA;AAClC;AAEA,eAAe,eAAA,CAAgB,QAAoB,MAAA,EAAkD;AACnG,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,+DAAA,CAAA,EAAmE;AAAA,IACxG;AAAA,GACD,CAAA;AACD,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA;AACzB,EAAA,IAAI,CAAC,GAAA,EAAK,gBAAA,EAAkB,OAAO,EAAC;AACpC,EAAA,OAAO,YAAY,MAAA,CAAO,GAAA,CAAI,gBAAgB,CAAA,EAAG,SAAA,CAAU,MAAM,CAAC,CAAA;AACpE;AAEA,IAAM,cAAA,uBAAqB,GAAA,EAAY;AAEvC,SAAS,qBAAqB,QAAA,EAAwB;AACpD,EAAA,IAAI,cAAA,CAAe,GAAA,CAAI,QAAQ,CAAA,EAAG;AAClC,EAAA,cAAA,CAAe,IAAI,QAAQ,CAAA;AAC3B,EAAA,OAAA,CAAQ,WAAA;AAAA,IACN,CAAA,YAAA,EAAe,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC,CAAA,8TAAA,CAAA;AAAA,IAKvC,EAAE,IAAA,EAAM,oBAAA,EAAsB,IAAA,EAAM,2BAAA;AAA4B,GAClE;AACF;AAEA,eAAsB,YACpB,MAAA,EACA,QAAA,EACA,IAAA,EACA,IAAA,GAcI,EAAC,EAC6B;AAClC,EAAA,MAAM,WAAA,GAAc,QAAQ,EAAC;AAC7B,EAAA,MAAM,aAAA,GAAgB,qBAAA,CAAsB,IAAA,CAAK,aAAa,CAAA;AAC9D,EAAA,MAAM,EAAA,GAAK,SAAS,MAAM,WAAA,CAAY,QAAQ,IAAA,CAAK,QAAA,IAAY,IAAI,CAAA,EAAG,QAAQ,CAAA;AAC9E,EAAA,IAAI,CAAC,EAAA,EAAI,MAAM,IAAI,iBAAA,CAAkB,CAAA,gBAAA,EAAmB,QAAQ,CAAA,CAAE,CAAA;AAClE,EAAA,IAAI,CAAC,WAAA,CAAY,EAAA,EAAI,IAAA,CAAK,UAAA,IAAc,IAAI,CAAA,EAAG;AAC7C,IAAA,MAAM,IAAI,iBAAA,CAAkB,CAAA,gBAAA,EAAmB,QAAQ,CAAA,CAAE,CAAA;AAAA,EAC3D;AAEA,EAAA,MAAM,UAAA,GAAa,oBAAoB,WAAW,CAAA;AAClD,EAAA,IAAI,UAAA,GAA4B,IAAA;AAChC,EAAA,IAAI,qBAAA,CAAsB,EAAA,EAAI,UAAU,CAAA,EAAG;AACzC,IAAA,IAAI,aAAA,KAAkB,IAAA,EAAM,oBAAA,CAAqB,QAAQ,CAAA;AACzD,IAAA,UAAA,GAAa,MAAM,oBAAA;AAAA,MACjB,MAAA;AAAA,MACA,EAAA,CAAG,QAAA;AAAA,MACH,UAAA;AAAA,MACA,KAAK,QAAA,IAAY,IAAA;AAAA,MACjB,KAAK,UAAA,IAAc,IAAA;AAAA,MACnB;AAAA,KACF;AACA,IAAA,IAAI,cAAc,IAAA,EAAM;AACtB,MAAA,MAAM,WAAA,GAAc;AAAA,QAClB,UAAU,EAAA,CAAG,QAAA;AAAA,QACb,IAAA,EAAM,UAAA;AAAA,QACN,QAAA,EAAU,KAAK,QAAA,IAAY,IAAA;AAAA,QAC3B,UAAA,EAAY,KAAK,UAAA,IAAc,IAAA;AAAA,QAC/B,MAAA,EAAQ,EAAA,CAAG,cAAA,IAAkB;AAAC,OAChC;AACA,MAAA,MAAM,MAAA,GACJ,aAAA,KAAkB,IAAA,GACd,MAAM,cAAc,MAAA,EAAQ,WAAW,CAAA,GACvC,MAAM,oBAAoB,MAAA,EAAQ,EAAE,GAAG,WAAA,EAAa,eAAe,CAAA;AACzE,MAAA,MAAM,SAAS,EAAA,CAAG,gBAAA,GACd,2BACA,CAAA,+BAAA,EAAkC,EAAA,CAAG,gBAAgB,SAAS,CAAA,CAAA;AAClE,MAAA,OAAO;AAAA,QACL,iBAAA,EAAmB;AAAA,UACjB,WAAA,EAAa,MAAA,CAAO,MAAA,CAAO,EAAE,CAAA;AAAA,UAC7B,WAAW,EAAA,CAAG,QAAA;AAAA,UACd,IAAA,EAAM,UAAA;AAAA,UACN,MAAA;AAAA,UACA,YAAY,MAAA,CAAO,SAAA,GAAY,MAAA,CAAO,SAAA,CAAU,aAAY,GAAI;AAAA;AAClE,OACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAI,SAAkC,EAAC;AACvC,EAAA,IAAI,EAAA,CAAG,IAAA,KAAS,UAAA,IAAc,EAAA,CAAG,MAAM,IAAA,EAAM;AAC3C,IAAA,MAAA,GAAS,MAAM,eAAA,CAAgB,MAAA,EAAQ,EAAA,CAAG,EAAE,CAAA;AAAA,EAC9C;AAEA,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,EAAO,IAAA,IAAQ,IAAA;AACtC,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,EAAO,EAAA,IAAM,IAAA;AAClC,EAAA,IAAI,SAAA,GAAqB,IAAA;AACzB,EAAA,IAAI,GAAA,GAAe,IAAA;AACnB,EAAA,MAAM,KAAA,GAAQ,IAAI,aAAA,EAAc,CAAE,KAAA,EAAM;AACxC,EAAA,IAAI;AACF,IAAA,SAAA,GAAY,MAAM,QAAA,CAAS,MAAA,EAAQ,EAAA,EAAI,QAAQ,UAAU,CAAA;AAAA,EAC3D,SAAS,CAAA,EAAG;AACV,IAAA,GAAA,GAAM,CAAA;AAAA,EACR;AACA,EAAA,KAAA,CAAM,IAAA,EAAK;AAEX,EAAA,IAAI,UAAU,GAAA,IAAO,IAAA;AACrB,EAAA,IAAI,MAAA,GAAkB,IAAA;AACtB,EAAA,IAAI,SAAA,GAAY,KAAA;AAChB,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,IAAI;AAIF,MAAA,MAAM,mBACJ,IAAA,CAAK,UAAA,KAAe,OAAA,GAAU,IAAA,GAAS,KAAK,UAAA,IAAc,IAAA;AAC5D,MAAA,MAAM,CAAC,QAAQ,CAAA,GAAI,iBAAiB,SAAA,EAAW,MAAA,CAAO,OAAO,SAAA,EAAW;AAAA,QACtE,UAAA,EAAY,gBAAA;AAAA,QACZ,SAAA,EAAW,OAAO,MAAA,CAAO,SAAA;AAAA,QACzB,OAAO,MAAA,CAAO;AAAA,OACf,CAAA;AACD,MAAA,SAAA,GAAY,QAAA;AACZ,MAAA,CAAC,MAAA,EAAQ,SAAS,CAAA,GAAI,WAAA,CAAY,SAAS,CAAA;AAAA,IAC7C,SAAS,CAAA,EAAG;AACV,MAAA,GAAA,GAAM,CAAA;AACN,MAAA,OAAA,GAAU,KAAA;AAAA,IACZ;AAAA,EACF;AAEA,EAAA,MAAM,YAAY,MAAA,EAAQ;AAAA,IACxB,QAAQ,EAAA,CAAG,EAAA;AAAA,IACX,UAAU,EAAA,CAAG,QAAA;AAAA,IACb,MAAM,EAAA,CAAG,IAAA;AAAA,IACT,SAAA;AAAA,IACA,OAAA;AAAA,IACA,MAAA,EAAQ,KAAK,MAAA,IAAU,KAAA;AAAA,IACvB,SAAA,EAAW,UAAA;AAAA,IACX,YAAA,EAAc,UAAU,SAAA,GAAY,IAAA;AAAA,IACpC,OAAA;AAAA,IACA,KAAA,EAAO,GAAA;AAAA,IACP,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,KAAA,EAAO,UAAU,CAAA,GAAI,CAAA;AAAA,IACrB;AAAA,GACD,CAAA;AAED,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,iBAAA,CAAkB,CAAA,uBAAA,EAA0B,GAAG,QAAQ,CAAA,EAAA,EAAK,GAAG,CAAA,CAAE,CAAA;AAAA,EAC7E;AAEA,EAAA,MAAM,KAAA,GAAoB;AAAA,IACxB,IAAA,EAAM,MAAA;AAAA,IACN,KAAA,EAAO,CAAA;AAAA,IACP,MAAA,EAAQ,EAAE,SAAA,EAAW,EAAA,CAAG,UAAU,IAAA,EAAM,EAAA,CAAG,MAAM,SAAA;AAAU,GAC7D;AACA,EAAA,SAAA,CAAU,MAAA,CAAO,OAAO,KAAK,CAAA;AAE7B,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,MAAA;AAAA,IACR,KAAA,EAAO,EAAE,KAAA,EAAO,CAAA,EAAG,MAAM,MAAA,EAAQ,SAAA,EAAW,EAAA,CAAG,QAAA,EAAU,SAAA;AAAU,GACrE;AACF;AM35BO,IAAM,iBAAA,GAAoB,GAAA;AACjC,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,gBAAA,GAAmB,IAAA;AACzB,IAAM,gBAAA,GAAmB,GAAA;AACzB,IAAM,mBAAA,GAAsB,GAAA;AAmB5B,eAAeC,YAAAA,CAAY,KAAa,YAAA,EAAsC;AAC5E,EAAA,MAAM,mBAAA,CAAoB,GAAA,EAAK,EAAE,YAAA,EAAc,CAAA;AACjD;AAEA,SAAS,MAAA,CAAO,KAAA,EAAiC,GAAA,EAAc,GAAA,EAAoC;AACjG,EAAA,IAAI,KAAA,EAAO,SAAA,CAAU,KAAA,EAAO,GAAA,EAAK,GAAG,CAAA;AAAA,OAC/B,OAAA,CAAQ,KAAA,CAAM,mCAAA,EAAqC,GAAA,EAAK,UAAU,GAAG,CAAA;AAC5E;AAOO,IAAM,uBAAN,MAAmD;AAAA,EAChD,KAAA,uBAAY,GAAA,EAAkE;AAAA,EAE9E,cAAA,GAAuB;AAC7B,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA;AACzB,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,KAAK,KAAA,EAAO;AAC/B,MAAA,IAAI,EAAE,SAAA,IAAa,GAAA,EAAK,IAAA,CAAK,KAAA,CAAM,OAAO,CAAC,CAAA;AAAA,IAC7C;AAAA,EACF;AAAA,EAEA,GAAA,CAAI,KAAA,EAAe,IAAA,EAA+B,UAAA,GAAqB,iBAAA,EAAyB;AAC9F,IAAA,IAAA,CAAK,cAAA,EAAe;AACpB,IAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,KAAA,EAAO,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA,GAAO,UAAA,EAAY,CAAA;AAAA,EAC3E;AAAA,EAEA,IAAI,KAAA,EAA+C;AACjD,IAAA,IAAA,CAAK,cAAA,EAAe;AACpB,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,KAAK,CAAA;AAClC,IAAA,IAAA,CAAK,KAAA,CAAM,OAAO,KAAK,CAAA;AACvB,IAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,IAAA,IAAI,MAAM,SAAA,IAAa,IAAA,CAAK,GAAA,EAAI,GAAI,KAAM,OAAO,IAAA;AACjD,IAAA,OAAO,KAAA,CAAM,IAAA;AAAA,EACf;AACF,CAAA;AAsCA,eAAe,SAAA,CACb,GAAA,EACA,IAAA,GAMI,EAAC,EACiG;AACtG,EAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,IAC5B,MAAA,EAAQ,KAAK,MAAA,IAAU,KAAA;AAAA,IACvB,SAAS,IAAA,CAAK,OAAA;AAAA,IACd,MAAM,IAAA,CAAK,IAAA;AAAA;AAAA;AAAA,IAGX,QAAA,EAAU,KAAK,QAAA,IAAY,QAAA;AAAA,IAC3B,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,IAAA,CAAK,WAAW,oBAAoB;AAAA,GACjE,CAAA;AACD,EAAA,OAAO;AAAA;AAAA;AAAA,IAGL,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,IAAA,EAAM,MAAM,IAAA,CAAK,IAAA,EAAK;AAAA,IACtB,IAAA,EAAM,MAAM,IAAA,CAAK,IAAA;AAAK,GACxB;AACF;AAWA,eAAsB,qBAAA,CACpB,SAAA,EACA,IAAA,GAAyD,EAAC,EACjB;AACzC,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,SAAS,CAAA;AAChC,EAAA,MAAM,OAAO,CAAA,EAAG,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK,OAAO,IAAI,CAAA,CAAA;AAC/C,EAAA,MAAMA,YAAAA,CAAY,IAAA,EAAM,IAAA,CAAK,YAAA,IAAgB,KAAK,CAAA;AAElD,EAAA,MAAM,YAAA,GAAe,GAAG,IAAI,CAAA,uCAAA,CAAA;AAC5B,EAAA,IAAI;AACF,IAAA,MAAM,OAAO,MAAM,SAAA,CAAU,cAAc,EAAE,OAAA,EAAS,sBAAsB,CAAA;AAC5E,IAAA,IAAI,IAAA,CAAK,WAAW,GAAA,EAAK;AACvB,MAAA,MAAM,IAAA,GAAQ,MAAM,IAAA,CAAK,IAAA,EAAK;AAC9B,MAAA,IAAI,IAAA,CAAK,sBAAA,IAA0B,IAAA,CAAK,cAAA,EAAgB;AACtD,QAAA,OAAO;AAAA,UACL,wBAAwB,IAAA,CAAK,sBAAA;AAAA,UAC7B,gBAAgB,IAAA,CAAK,cAAA;AAAA,UACrB,uBAAuB,IAAA,CAAK,qBAAA;AAAA,UAC5B,gBAAA,EAAkB,IAAA,CAAK,gBAAA,IAAoB,EAAC;AAAA,UAC5C,wBAAA,EAA0B,IAAA,CAAK,wBAAA,IAA4B,EAAC;AAAA,UAC5D,gCAAA,EAAkC,IAAA,CAAK,gCAAA,IAAoC,CAAC,MAAM,CAAA;AAAA,UAClF,MAAA,EAAQ,KAAK,MAAA,IAAU;AAAA,SACzB;AAAA,MACF;AAAA,IACF;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,IAAI,EAAE,CAAA,YAAa,SAAA,CAAA,IAAc,EAAE,aAAa,YAAA,CAAA,EAAe;AAC7D,MAAA,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,EAAG,EAAE,OAAO,8BAAA,EAAgC,GAAA,EAAK,cAAc,CAAA;AAAA,IACpF;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,GAAG,IAAI,CAAA,iCAAA,CAAA;AACvB,EAAA,IAAI;AACF,IAAA,MAAM,OAAO,MAAM,SAAA,CAAU,SAAS,EAAE,OAAA,EAAS,sBAAsB,CAAA;AACvE,IAAA,IAAI,IAAA,CAAK,WAAW,GAAA,EAAK;AACvB,MAAA,MAAM,IAAA,GAAQ,MAAM,IAAA,CAAK,IAAA,EAAK;AAC9B,MAAA,IAAI,IAAA,CAAK,sBAAA,IAA0B,IAAA,CAAK,cAAA,EAAgB;AACtD,QAAA,OAAO;AAAA,UACL,wBAAwB,IAAA,CAAK,sBAAA;AAAA,UAC7B,gBAAgB,IAAA,CAAK,cAAA;AAAA,UACrB,uBAAuB,IAAA,CAAK,qBAAA;AAAA,UAC5B,gBAAA,EAAkB,IAAA,CAAK,gBAAA,IAAoB,EAAC;AAAA,UAC5C,gCAAA,EAAkC,IAAA,CAAK,gCAAA,IAAoC,CAAC,MAAM,CAAA;AAAA,UAClF,MAAA,EAAQ,KAAK,MAAA,IAAU;AAAA,SACzB;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,KAAA,MAAW,CAAC,QAAA,EAAU,SAAS,CAAA,IAAK;AAAA,IAClC,CAAC,oBAAoB,cAAc,CAAA;AAAA,IACnC,CAAC,cAAc,QAAQ,CAAA;AAAA,IACvB,CAAC,qBAAqB,eAAe;AAAA,GACvC,EAAY;AACV,IAAA,IAAI;AACF,MAAA,MAAM,OAAO,MAAM,SAAA,CAAU,GAAG,IAAI,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI;AAAA,QACjD,OAAA,EAAS,gBAAA;AAAA,QACT,QAAA,EAAU;AAAA,OACX,CAAA;AAOD,MAAA,IACE,IAAA,CAAK,MAAA,KAAW,GAAA,IAChB,IAAA,CAAK,WAAW,GAAA,IAChB,IAAA,CAAK,MAAA,KAAW,GAAA,IAChB,IAAA,CAAK,MAAA,KAAW,GAAA,IAChB,IAAA,CAAK,SAAS,gBAAA,EACd;AACA,QAAA,OAAO;AAAA,UACL,sBAAA,EAAwB,CAAA,EAAG,IAAI,CAAA,EAAG,QAAQ,CAAA,CAAA;AAAA,UAC1C,cAAA,EAAgB,CAAA,EAAG,IAAI,CAAA,EAAG,SAAS,CAAA,CAAA;AAAA,UACnC,MAAA,EAAQ,IAAA;AAAA,UACR,kBAAkB,EAAC;AAAA,UACnB,gCAAA,EAAkC,CAAC,MAAM;AAAA,SAC3C;AAAA,MACF;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAAC;AAAA,EACX;AACA,EAAA,OAAO,IAAA;AACT;AASA,eAAsB,oBACpB,oBAAA,EACA,WAAA,EACA,aAAa,yBAAA,EACb,IAAA,GAAyD,EAAC,EACxB;AAClC,EAAA,MAAMA,YAAAA,CAAY,oBAAA,EAAsB,IAAA,CAAK,YAAA,IAAgB,KAAK,CAAA;AAClE,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,WAAA,EAAa,UAAA;AAAA,IACb,aAAA,EAAe,CAAC,WAAW,CAAA;AAAA,IAC3B,WAAA,EAAa,CAAC,oBAAA,EAAsB,eAAe,CAAA;AAAA,IACnD,cAAA,EAAgB,CAAC,MAAM,CAAA;AAAA,IACvB,0BAAA,EAA4B;AAAA,GAC9B;AACA,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,UAAU,oBAAA,EAAsB;AAAA,MAC3C,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,mBAAA;AAAA,MACT,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,MAC9C,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,OAAO;AAAA,KAC7B,CAAA;AAAA,EACH,SAAS,CAAA,EAAG;AACV,IAAA,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,EAAG,EAAE,OAAO,uBAAA,EAAyB,qBAAA,EAAuB,sBAAsB,CAAA;AACrG,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oCAAA,EAAuC,CAAC,CAAA,CAAE,CAAA;AAAA,EAC5D;AACA,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,GAAA,IAAO,IAAA,CAAK,WAAW,GAAA,EAAK;AAC9C,IAAA,MAAM,QAAQ,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AACpE,IAAA,MAAA,CAAO,IAAA,CAAK,OAAO,KAAA,EAAO;AAAA,MACxB,KAAA,EAAO,uBAAA;AAAA,MACP,qBAAA,EAAuB,oBAAA;AAAA,MACvB,aAAa,IAAA,CAAK;AAAA,KACnB,CAAA;AACD,IAAA,MAAM,KAAA;AAAA,EACR;AACA,EAAA,OAAQ,MAAM,KAAK,IAAA,EAAK;AAC1B;AAEA,eAAsB,iBAAA,CACpB,UACA,SAAA,EACA,MAAA,EACA,aACA,KAAA,EACA,IAAA,GAKI,EAAC,EAC8C;AACnD,EAAA,MAAM,eAAe,QAAA,CAAS,sBAAA;AAC9B,EAAA,MAAM,gBAAgB,QAAA,CAAS,cAAA;AAC/B,EAAA,IAAI,CAAC,YAAA,EAAc,MAAM,IAAI,MAAM,iDAAiD,CAAA;AACpF,EAAA,IAAI,CAAC,aAAA,EAAe,MAAM,IAAI,MAAM,yCAAyC,CAAA;AAE7E,EAAA,MAAM,YAAA,GAAeZ,mBAAY,EAAE,CAAA,CAAE,SAAS,WAAW,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AACvE,EAAA,MAAM,MAAA,GAASa,kBAAW,QAAQ,CAAA,CAAE,OAAO,YAAA,EAAc,OAAO,EAAE,MAAA,EAAO;AACzE,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,QAAA,CAAS,WAAW,CAAA;AACjD,EAAA,MAAM,KAAA,GAAQb,kBAAAA,CAAY,EAAE,CAAA,CAAE,SAAS,WAAW,CAAA;AAElD,EAAA,MAAM,OAAA,CAAQ,OAAA;AAAA,IACZ,KAAA,CAAM,GAAA;AAAA,MACJ,KAAA;AAAA,MACA;AAAA,QACE,UAAA,EAAY,SAAA;AAAA,QACZ,aAAA,EAAe,YAAA;AAAA,QACf,OAAA,EAAS,MAAA;AAAA,QACT,YAAA,EAAc,WAAA;AAAA,QACd,cAAA,EAAgB,aAAA;AAAA,QAChB,SAAA,EAAW,KAAK,QAAA,IAAY,IAAA;AAAA,QAC5B,aAAA,EAAe,KAAK,YAAA,IAAgB;AAAA,OACtC;AAAA,MACA,KAAK,UAAA,IAAc;AAAA;AACrB,GACF;AAEA,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,IACjC,aAAA,EAAe,MAAA;AAAA,IACf,KAAA;AAAA,IACA,YAAA,EAAc,WAAA;AAAA,IACd,cAAA,EAAgB,aAAA;AAAA,IAChB,qBAAA,EAAuB;AAAA,GACxB,CAAA;AACD,EAAA,IAAI,KAAK,QAAA,EAAU,MAAA,CAAO,GAAA,CAAI,WAAA,EAAa,KAAK,QAAQ,CAAA;AACxD,EAAA,IAAI,KAAK,MAAA,EAAQ,MAAA,CAAO,GAAA,CAAI,OAAA,EAAS,KAAK,MAAM,CAAA;AAEhD,EAAA,OAAO,EAAE,eAAe,CAAA,EAAG,YAAY,IAAI,MAAA,CAAO,QAAA,EAAU,CAAA,CAAA,EAAI,KAAA,EAAM;AACxE;AAEA,eAAsB,qBACpB,KAAA,EACA,IAAA,EACA,KAAA,EACA,IAAA,GAAuF,EAAC,EACtD;AAClC,EAAA,MAAM,UAAU,MAAM,OAAA,CAAQ,QAAQ,KAAA,CAAM,GAAA,CAAI,KAAK,CAAC,CAAA;AACtD,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,mEAA8D,CAAA;AAC5F,EAAA,MAAM,gBAAgB,OAAA,CAAQ,cAAA;AAC9B,EAAA,IAAI,CAAC,aAAA,EAAe,MAAM,IAAI,MAAM,yCAAyC,CAAA;AAI7E,EAAA,MAAMY,YAAAA,CAAY,aAAA,EAAe,IAAA,CAAK,YAAA,IAAgB,KAAK,CAAA;AAE3D,EAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,IAC/B,UAAA,EAAY,oBAAA;AAAA,IACZ,IAAA;AAAA,IACA,YAAA,EAAc,MAAA,CAAO,OAAA,CAAQ,YAAY,CAAA;AAAA,IACzC,aAAA,EAAe,MAAA,CAAO,OAAA,CAAQ,aAAa;AAAA,GAC5C,CAAA;AACD,EAAA,IAAI,OAAA,CAAQ,WAAW,IAAA,CAAK,GAAA,CAAI,aAAa,MAAA,CAAO,OAAA,CAAQ,SAAS,CAAC,CAAA;AACtE,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,YAAA,IAAiB,OAAA,CAAQ,aAAA;AAC7C,EAAA,IAAI,QAAQ,IAAA,CAAK,GAAA,CAAI,eAAA,EAAiB,MAAA,CAAO,MAAM,CAAC,CAAA;AAEpD,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,UAAU,aAAA,EAAe;AAAA,MACpC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,gBAAA;AAAA,MACT,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D;AAAA,KACD,CAAA;AAAA,EACH,SAAS,CAAA,EAAG;AACV,IAAA,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,EAAG,EAAE,OAAO,yBAAA,EAA2B,cAAA,EAAgB,eAAe,CAAA;AACzF,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gCAAA,EAAmC,CAAC,CAAA,CAAE,CAAA;AAAA,EACxD;AACA,EAAA,IAAI,IAAA,CAAK,WAAW,GAAA,EAAK;AACvB,IAAA,MAAM,QAAQ,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAC/D,IAAA,MAAA,CAAO,IAAA,CAAK,OAAO,KAAA,EAAO;AAAA,MACxB,KAAA,EAAO,yBAAA;AAAA,MACP,cAAA,EAAgB,aAAA;AAAA,MAChB,aAAa,IAAA,CAAK;AAAA,KACnB,CAAA;AACD,IAAA,MAAM,KAAA;AAAA,EACR;AAEA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,SAAA,GAAa,MAAM,KAAK,IAAA,EAAK;AAAA,EAC/B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,EAAK;AAC7B,IAAA,SAAA,GAAY,MAAA,CAAO,WAAA,CAAY,IAAI,eAAA,CAAgB,IAAI,CAAC,CAAA;AAAA,EAC1D;AACA,EAAA,MAAM,cAAc,SAAA,CAAU,YAAA;AAC9B,EAAA,IAAI,CAAC,WAAA,EAAa;AAChB,IAAA,MAAM,KAAA,GAAQ,IAAI,KAAA,CAAM,qCAAqC,CAAA;AAC7D,IAAA,MAAA,CAAO,IAAA,CAAK,OAAO,KAAA,EAAO,EAAE,OAAO,yBAAA,EAA2B,cAAA,EAAgB,eAAe,CAAA;AAC7F,IAAA,MAAM,KAAA;AAAA,EACR;AACA,EAAA,OAAO;AAAA,IACL,YAAA,EAAc,WAAA;AAAA,IACd,eAAe,SAAA,CAAU,aAAA;AAAA,IACzB,UAAA,EAAY,UAAU,UAAA,IAAc,QAAA;AAAA,IACpC,YAAY,SAAA,CAAU,UAAA;AAAA,IACtB,OAAO,SAAA,CAAU,KAAA;AAAA,IACjB,SAAS,OAAA,CAAQ,OAAA;AAAA,IACjB,YAAY,OAAA,CAAQ;AAAA,GACtB;AACF;;;AdxWO,IAAM,uBAAA,GAA0B,qBAAA;AAEvC,IAAML,QAAAA,GAAU,iEAAA;AAEhB,SAAS,WAAW,KAAA,EAAuB;AACzC,EAAA,IAAI,CAACA,QAAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,KAAK,CAAC,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,aAAa,GAAA,EAAK,CAAA,YAAA,EAAe,KAAK,SAAA,CAAU,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,EACpE;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,aAAA,CACP,GAAA,EACA,IAAA,GAA4D,EAAC,EACpC;AACzB,EAAA,MAAM,GAAA,GAA+B;AAAA,IACnC,EAAA,EAAI,MAAA,CAAO,GAAA,CAAI,EAAE,CAAA;AAAA,IACjB,MAAM,GAAA,CAAI,IAAA;AAAA,IACV,MAAM,GAAA,CAAI,IAAA;AAAA,IACV,WAAA,EAAa,IAAI,WAAA,IAAe,EAAA;AAAA,IAChC,WAAW,GAAA,CAAI,SAAA;AAAA,IACf,GAAA,EAAK,IAAI,GAAA,IAAO,IAAA,GAAO,CAAC,GAAI,GAAA,CAAI,GAAgB,CAAA,GAAI,IAAA;AAAA,IACpD,mBAAmB,GAAA,CAAI,iBAAA;AAAA,IACvB,eAAA,EAAiB,GAAA,CAAI,eAAA,IAAmB,EAAC;AAAA,IACzC,SAAS,GAAA,CAAI,OAAA;AAAA;AAAA;AAAA;AAAA,IAIb,SAAA,EAAW,GAAA,CAAI,SAAA,IAAa;AAAC,GAC/B;AAKA,EAAA,IAAI,IAAA,CAAK,QAAA,IAAY,GAAA,CAAI,gBAAA,EAAkB;AACzC,IAAA,IAAI;AACF,MAAA,IAAI,CAAC,IAAA,CAAK,WAAA,EAAa,MAAM,IAAI,MAAM,0BAA0B,CAAA;AACjE,MAAA,GAAA,CAAI,eAAA,GAAkB,YAAA;AAAA,QACpB,MAAA,CAAO,IAAI,IAAI,CAAA;AAAA,QACf,YAAY,MAAA,CAAO,GAAA,CAAI,gBAAgB,CAAA,EAAG,KAAK,WAAW;AAAA,OAC5D;AAAA,IACF,CAAA,CAAA,MAAQ;AACN,MAAA,GAAA,CAAI,YAAA,GAAe,eAAA;AAAA,IACrB;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAKA,SAAS,WAAW,IAAA,EAAsB;AACxC,EAAA,OAAO,KACJ,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA,CACrB,OAAA,CAAQ,MAAM,MAAM,CAAA,CACpB,QAAQ,IAAA,EAAM,MAAM,EACpB,OAAA,CAAQ,IAAA,EAAM,QAAQ,CAAA,CACtB,OAAA,CAAQ,MAAM,QAAQ,CAAA;AAC3B;AAOA,SAAS,gBAAA,CAAiB,WAAoB,UAAA,EAAsC;AAClF,EAAA,IAAI,SAAA,IAAa,IAAA,IAAQ,UAAA,KAAe,OAAA,EAAS;AAC/C,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,GAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,YAAA,CAAa,WAAW,UAAU,CAAA;AACpC;AAEA,SAAS,aAAA,CAAc,OAAgB,OAAA,EAAqC;AAK1E,EAAA,OAAO,wBAAA,CAAyB,KAAA,EAAO,EAAE,OAAA,EAAS,CAAA;AACpD;AAEA,SAAS,aAAa,MAAA,EAAiD;AACrE,EAAA,OAAO;AAAA,IACL,IAAI,MAAA,CAAO,EAAA;AAAA,IACX,WAAW,MAAA,CAAO,QAAA;AAAA,IAClB,kBAAkB,MAAA,CAAO,cAAA;AAAA,IACzB,WAAW,MAAA,CAAO,QAAA;AAAA,IAClB,YAAY,MAAA,CAAO,UAAA;AAAA,IACnB,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,eAAe,MAAA,CAAO,YAAA;AAAA,IACtB,UAAA,EAAY,MAAA,CAAO,SAAA,EAAW,WAAA,EAAY,IAAK,IAAA;AAAA,IAC/C,WAAA,EAAa,MAAA,CAAO,UAAA,EAAY,WAAA,EAAY,IAAK,IAAA;AAAA,IACjD,UAAA,EAAY,MAAA,CAAO,SAAA,EAAW,WAAA,EAAY,IAAK;AAAA,GACjD;AACF;AAEO,SAAS,cAAA,CACd,OAAA,EACA,OAAA,EACA,YAAA,EACA,YAA4C,IAAA,EACpC;AACR,EAAA,MAAM,MAAA,GAAS,UAAU,SAAA,GAAY,OAAA;AACrC,EAAA,MAAM,UAAmC,EAAE,IAAA,EAAM,CAAA,UAAA,EAAa,MAAM,IAAI,OAAA,EAAQ;AAChF,EAAA,IAAI,SAAA,IAAa,OAAA,EAAS,OAAA,CAAQ,KAAA,GAAQ,SAAA;AAC1C,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA,EAAG,MAAM,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AAC9E,EAAA,MAAM,KAAA,GAAQ,UAAU,WAAA,GAAc,QAAA;AACtC,EAAA,OACE,CAAA,iJAAA,EAEO,KAAK,CAAA,QAAA,EACN,UAAA,CAAW,OAAO,CAAC,CAAA,uHAAA,EAIK,OAAO,CAAA,uDAAA,EACiB,YAAY,CAAA,kIAAA,CAAA;AAMtE;AAeO,SAAS,mBAAA,CACd,MAAA,EACA,IAAA,GASI,EAAC,EACL;AACA,EAAA,MAAM,KAAA,GAAsB,IAAA,CAAK,YAAA,IAAgB,IAAI,oBAAA,EAAqB;AAC1E,EAAA,MAAM,cAAA,GAAiB,KAAK,cAAA,IAAkB,KAAA;AAS9C,EAAA,MAAM,cAAc,MAAqB;AACvC,IAAA,IAAI,CAAC,gBAAgB,OAAO,IAAA;AAC5B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,YAAA,CAAa,OAAO,MAAM,CAAA;AAAA,IAClC,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,IAAI,GAAA,CAAI,WAAW,EAAA,EAAI;AACrB,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,uCAAA,EAA0C,IAAI,MAAM,CAAA,mEAAA;AAAA,OAEtD;AACA,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,GAAA;AAAA,EACT,CAAA;AACA,EAAA,MAAM,mBAAmB,IAAA,CAAK,eAAA,IAAmB,EAAA,EAAI,OAAA,CAAQ,OAAO,EAAE,CAAA;AACtE,EAAA,IAAI,YAAA,GAAe,EAAA;AACnB,EAAA,IAAI;AACF,IAAA,IAAI,eAAA,EAAiB,YAAA,GAAe,IAAI,GAAA,CAAI,eAAe,CAAA,CAAE,MAAA;AAAA,EAC/D,CAAA,CAAA,MAAQ;AACN,IAAA,YAAA,GAAe,EAAA;AAAA,EACjB;AACA,EAAA,MAAM,cAAc,eAAA,GAAkB,CAAA,EAAG,eAAe,CAAA,EAAG,uBAAuB,CAAA,CAAA,GAAK,EAAA;AAEvF,EAAA,OAAO;AAAA,IACL,MAAM,UAAA,CAAW,IAAA,EAAe,UAAA,EAAuD;AACrF,MAAA,MAAM,MAAA,GAAS,aAAA,CAAc,UAAA,EAAY,aAAa,CAAA;AACtD,MAAA,MAAM,EAAA,GAAK,UAAA,CAAW,WAAA,CAAY,IAAI,CAAA;AACtC,MAAA,gBAAA,CAAiB,EAAA,CAAG,KAAK,MAAM,CAAA;AAC/B,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,MAAA,CAAO,YAAA,GAAe,MAAM,MAAA,CAAO,YAAA,CAAa,EAAE,CAAA,GAAI,MAAM,YAAA,CAAa,MAAA,EAAQ,EAAE,CAAA;AAClG,QAAA,OAAO,EAAE,IAAI,MAAA,EAAO;AAAA,MACtB,SAAS,GAAA,EAAK;AACZ,QAAA,IAAI,eAAe,mBAAA,EAAqB,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,IAAI,OAAO,CAAA;AAC/E,QAAA,IAAI,eAAe,KAAA,IAAS,2BAAA,CAA4B,IAAA,CAAK,GAAA,CAAI,OAAO,CAAA,EAAG;AACzE,UAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,QACzC;AACA,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,cAAA,CACJ,KAAA,EACA,UAAA,EACkC;AAClC,MAAA,MAAM,MAAA,GAAS,aAAA,CAAc,UAAA,EAAY,YAAY,CAAA;AACrD,MAAA,MAAM,SAAoB,EAAC;AAC3B,MAAA,IAAI,GAAA,GAAM,CAAA,kCAAA,CAAA;AACV,MAAA,IAAI,KAAA,CAAM,aAAa,IAAA,EAAM;AAC3B,QAAA,MAAA,CAAO,IAAA,CAAK,MAAM,SAAS,CAAA;AAC3B,QAAA,GAAA,IAAO,CAAA,qBAAA,CAAA;AAAA,MACT;AACA,MAAA,MAAM,SAAS,MAAM,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,KAAK,MAAM,CAAA;AAClD,MAAA,MAAM,MAAM,WAAA,EAAY;AACxB,MAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,IAAA,CAClB,MAAA,CAAO,CAAC,GAAA,KAAQ,UAAA,CAAW,GAAA,CAAI,GAAA,IAAO,IAAA,GAAO,CAAC,GAAG,IAAI,GAAG,CAAA,GAAI,IAAA,EAAM,MAAM,CAAC,CAAA,CACzE,GAAA,CAAI,CAAC,GAAA,KAAQ,aAAA,CAAc,GAAA,EAAK,EAAE,QAAA,EAAU,cAAA,EAAgB,WAAA,EAAa,GAAA,EAAK,CAAC,CAAA;AAClF,MAAA,OAAO,EAAE,KAAA,EAAM;AAAA,IACjB,CAAA;AAAA,IAEA,MAAM,OAAA,CAAQ,MAAA,EAAgB,UAAA,EAAuD;AACnF,MAAA,MAAM,MAAA,GAAS,aAAA,CAAc,UAAA,EAAY,sBAAsB,CAAA;AAC/D,MAAA,MAAM,QAAA,GAAW,WAAW,MAAM,CAAA;AAClC,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,gDAAA,CAAA,EAAoD,CAAC,QAAQ,CAAC,CAAA;AACrG,MAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA;AACzB,MAAA,IAAI,CAAC,GAAA,IAAO,CAAC,UAAA,CAAW,IAAI,GAAA,IAAO,IAAA,GAAO,CAAC,GAAG,GAAA,CAAI,GAAG,CAAA,GAAI,IAAA,EAAM,MAAM,CAAA,EAAG;AACtE,QAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,CAAA,gBAAA,EAAmB,MAAM,CAAA,CAAE,CAAA;AAAA,MACzD;AACA,MAAA,OAAO,aAAA,CAAc,KAAK,EAAE,QAAA,EAAU,gBAAgB,WAAA,EAAa,WAAA,IAAe,CAAA;AAAA,IACpF,CAAA;AAAA,IAEA,MAAM,eAAA,CACJ,MAAA,EACA,IAAA,EACA,UAAA,EACkC;AAClC,MAAA,MAAM,MAAA,GAAS,aAAA,CAAc,UAAA,EAAY,wBAAwB,CAAA;AACjE,MAAA,UAAA,CAAW,MAAM,CAAA;AACjB,MAAA,MAAM,SAAkC,EAAC;AACzC,MAAA,MAAM,GAAA,GAA8B;AAAA,QAClC,IAAA,EAAM,MAAA;AAAA,QACN,IAAA,EAAM,MAAA;AAAA,QACN,WAAA,EAAa,aAAA;AAAA,QACb,MAAA,EAAQ,QAAA;AAAA,QACR,SAAA,EAAW,UAAA;AAAA,QACX,GAAA,EAAK,KAAA;AAAA,QACL,iBAAA,EAAmB,kBAAA;AAAA,QACnB,eAAA,EAAiB,gBAAA;AAAA,QACjB,OAAA,EAAS,SAAA;AAAA,QACT,SAAA,EAAW;AAAA,OACb;AACA,MAAA,KAAA,MAAW,CAAC,CAAA,EAAG,IAAI,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AAC3C,QAAA,IAAI,MAAA,CAAO,OAAO,IAAA,EAAM,CAAC,GAAG,MAAA,CAAO,IAAI,CAAA,GAAI,IAAA,CAAK,CAAC,CAAA;AAAA,MACnD;AAMA,MAAA,MAAM,QAAA,GAAmC;AAAA,QACvC,gBAAA,EAAkB,mBAAA;AAAA,QAClB,cAAA,EAAgB,iBAAA;AAAA,QAChB,QAAA,EAAU;AAAA,OACZ;AACA,MAAA,KAAA,MAAW,KAAA,IAAS;AAAA,QAClB,MAAA;AAAA,QACA,MAAA;AAAA,QACA,aAAA;AAAA,QACA,kBAAA;AAAA,QACA,gBAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACF,EAAG;AACD,QAAA,IAAI,KAAA,IAAS,MAAA,IAAU,MAAA,CAAO,KAAK,KAAK,IAAA,EAAM;AAC5C,UAAA,MAAM,IAAI,aAAa,GAAA,EAAK,CAAA,EAAG,SAAS,KAAK,CAAA,IAAK,KAAK,CAAA,eAAA,CAAiB,CAAA;AAAA,QAC1E;AAAA,MACF;AACA,MAAA,IAAI,KAAA,IAAS,MAAA,EAAQ,gBAAA,CAAiB,MAAA,CAAO,KAAK,MAAM,CAAA;AACxD,MAAA,IAAI;AACF,QAAA,MAAM,OAAA,GAAU,OAAO,UAAA,GACnB,MAAM,OAAO,UAAA,CAAW,MAAA,EAAQ,EAAE,UAAA,EAAY,MAAA,EAAQ,GAAG,QAAQ,CAAA,GACjE,MAAM,UAAA,CAAW,MAAA,EAAQ,MAAA,EAAQ,EAAE,UAAA,EAAY,MAAA,EAAQ,GAAG,MAAA,EAAQ,CAAA;AACtE,QAAA,OAAO;AAAA,UACL,IAAI,OAAA,CAAQ,EAAA;AAAA,UACZ,MAAM,OAAA,CAAQ,IAAA;AAAA,UACd,MAAM,OAAA,CAAQ,IAAA;AAAA,UACd,aAAa,OAAA,CAAQ,WAAA;AAAA,UACrB,WAAW,OAAA,CAAQ,QAAA;AAAA,UACnB,KAAK,OAAA,CAAQ,GAAA;AAAA,UACb,mBAAmB,OAAA,CAAQ,gBAAA;AAAA,UAC3B,iBAAiB,OAAA,CAAQ,cAAA;AAAA,UACzB,SAAS,OAAA,CAAQ,OAAA;AAAA,UACjB,WAAW,OAAA,CAAQ;AAAA,SACrB;AAAA,MACF,SAAS,GAAA,EAAK;AAGZ,QAAA,IAAI,eAAe,mBAAA,EAAqB,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,IAAI,OAAO,CAAA;AAC/E,QAAA,IAAI,GAAA,YAAe,mBAAmB,MAAM,IAAI,aAAa,GAAA,EAAK,MAAA,CAAO,GAAA,CAAI,OAAO,CAAC,CAAA;AACrF,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,eAAA,CAAgB,MAAA,EAAgB,UAAA,EAAuD;AAC3F,MAAA,MAAM,MAAA,GAAS,aAAA,CAAc,UAAA,EAAY,yBAAyB,CAAA;AAClE,MAAA,UAAA,CAAW,MAAM,CAAA;AACjB,MAAA,IAAI;AACF,QAAA,IAAI,MAAA,CAAO,YAAY,MAAM,MAAA,CAAO,WAAW,MAAA,EAAQ,EAAE,UAAA,EAAY,MAAA,EAAQ,CAAA;AAAA,mBAClE,UAAA,CAAW,MAAA,EAAQ,QAAQ,EAAE,UAAA,EAAY,QAAQ,CAAA;AAAA,MAC9D,SAAS,GAAA,EAAK;AACZ,QAAA,IAAI,GAAA,YAAe,mBAAmB,MAAM,IAAI,aAAa,GAAA,EAAK,MAAA,CAAO,GAAA,CAAI,OAAO,CAAC,CAAA;AACrF,QAAA,MAAM,GAAA;AAAA,MACR;AACA,MAAA,OAAO,EAAE,SAAS,MAAA,EAAO;AAAA,IAC3B,CAAA;AAAA,IAEA,MAAM,cAAc,IAAA,EAAiD;AACnE,MAAA,MAAM,EAAA,GAAK,UAAA,CAAW,WAAA,CAAY,IAAI,CAAA;AACtC,MAAA,IAAI;AACF,QAAA,OAAO,OAAO,OAAO,QAAA,GAAW,MAAA,CAAO,SAAS,EAAE,CAAA,GAAI,QAAA,CAAS,MAAA,EAAQ,EAAE,CAAA,CAAA;AAAA,MAC3E,SAAS,GAAA,EAAK;AAGZ,QAAA,IAAI,eAAe,mBAAA,EAAqB,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,IAAI,OAAO,CAAA;AAC/E,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IAEA,gBAAgB,IAAA,EAAuC;AACrD,MAAA,IAAI;AACF,QAAA,OAAO,aAAa,IAAgB,CAAA;AAAA,MACtC,CAAA,CAAA,MAAQ;AACN,QAAA,MAAM,IAAI,aAAa,GAAA,EAAK,CAAA,mBAAA,EAAsB,KAAK,SAAA,CAAU,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,MAC1E;AAAA,IACF,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWA,MAAM,gBAAA,CACJ,IAAA,EACA,UAAA,EACA,gBAAyB,IAAA,EACS;AAClC,MAAA,MAAM,MAAA,GAAS,aAAA,CAAc,UAAA,EAAY,qBAAqB,CAAA;AAC9D,MAAA,IAAI,CAAC,IAAA,CAAK,SAAA,QAAiB,IAAI,YAAA,CAAa,KAAK,uBAAuB,CAAA;AACxE,MAAA,IAAI,KAAA;AACJ,MAAA,IAAI;AACF,QAAA,KAAA,GAAQ,sBAAsB,aAAa,CAAA;AAAA,MAC7C,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,CAAA,wBAAA,EAA4B,GAAA,CAAc,OAAO,CAAA,CAAE,CAAA;AAAA,MACjF;AACA,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,MAAA,CAAO,WAAA,KAAgB,CAAC,CAAA,EAAG,CAAA,EAAG,CAAA,KAAM,WAAA,CAAY,MAAA,EAAQ,CAAA,EAAG,CAAA,EAAG,CAAC,CAAA,CAAA;AAC5E,QAAA,OAAO,MAAM,IAAA,CAAK,IAAA,CAAK,SAAA,EAAW,IAAA,CAAK,QAAQ,IAAA,EAAM;AAAA,UACnD,UAAU,IAAA,CAAK,SAAA;AAAA,UACf,UAAA,EAAY,MAAA;AAAA,UACZ,aAAA,EAAe;AAAA,SAChB,CAAA;AAAA,MACH,SAAS,GAAA,EAAK;AACZ,QAAA,IAAI,GAAA,YAAe,mBAAmB,MAAM,IAAI,aAAa,GAAA,EAAK,MAAA,CAAO,GAAA,CAAI,OAAO,CAAC,CAAA;AACrF,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,kBAAkB,IAAA,EAMa;AACnC,MAAA,MAAM,GAAA,GAAM,IAAI,WAAA,CAAY,EAAE,cAAc,kBAAA,CAAmB,MAAM,GAAG,CAAA;AACxE,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,CAAI,SAAA,CAAU,IAAA,CAAK,WAAA,EAAa,IAAA,CAAK,GAAA,EAAK,EAAE,KAAA,EAAO,IAAA,CAAK,KAAA,EAAO,OAAA,EAAS,IAAA,CAAK,SAAS,CAAA;AAC5F,QAAA,MAAM,MAAA,GAAS,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,KAAK,WAAW,CAAA;AAC/C,QAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,SAAA,EAAU;AACrC,QAAA,MAAM,YAAY,IAAA,CAAK,iBAAA,GAAoB,MAAM,MAAA,CAAO,eAAc,GAAI,IAAA;AAC1E,QAAA,OAAO;AAAA,UACL,QAAQ,IAAA,CAAK,WAAA;AAAA,UACb,KAAK,MAAA,CAAO,GAAA;AAAA,UACZ,SAAA,EAAW,OAAO,SAAA,CAAU,IAAA;AAAA,UAC5B,KAAA;AAAA,UACA,SAAA;AAAA,UACA,cAAA,EAAgB;AAAA,SAClB;AAAA,MACF,SAAS,GAAA,EAAK;AAQZ,QAAA,IAAI,GAAA,YAAe,cAAc,MAAM,IAAI,aAAa,GAAA,EAAK,MAAA,CAAO,GAAA,CAAI,OAAO,CAAC,CAAA;AAChF,QAAA,MAAM,GAAA,GAAM,OAAO,GAAG,CAAA;AACtB,QAAA,MAAM,WAAA,GAAc,gBAAA,CAAiB,IAAA,CAAK,GAAG,CAAA;AAC7C,QAAA,IAAI,WAAA,IAAe,SAAA,CAAU,IAAA,CAAK,GAAG,CAAA,EAAG;AAKtC,UAAA,IAAI,QAAA;AACJ,UAAA,IAAI;AACF,YAAA,QAAA,GAAW,MAAM,qBAAA,CAAsB,IAAA,CAAK,GAAA,EAAK;AAAA,cAC/C,OAAO,MAAA,CAAO,KAAA;AAAA,cACd,YAAA,EAAc,mBAAmB,MAAM;AAAA,aACxC,CAAA;AAAA,UACH,SAAS,MAAA,EAAQ;AACf,YAAA,IAAI,MAAA,YAAkB,cAAc,MAAM,IAAI,aAAa,GAAA,EAAK,MAAA,CAAO,MAAA,CAAO,OAAO,CAAC,CAAA;AACtF,YAAA,MAAM,MAAA;AAAA,UACR;AACA,UAAA,IAAI,QAAA,EAAU;AACZ,YAAA,OAAO;AAAA,cACL,QAAQ,IAAA,CAAK,WAAA;AAAA,cACb,KAAK,IAAA,CAAK,GAAA;AAAA,cACV,SAAA,EAAW,eAAA;AAAA,cACX,OAAO,EAAC;AAAA,cACR,SAAA,EAAW,IAAA;AAAA,cACX,cAAA,EAAgB;AAAA,aAClB;AAAA,UACF;AACA,UAAA,MAAM,IAAI,YAAA;AAAA,YACR,GAAA;AAAA,YACA,CAAA,oBAAA,EAAuB,WAAA,GAAc,CAAC,CAAA,IAAK,SAAS,CAAA,gEAAA;AAAA,WACtD;AAAA,QACF;AACA,QAAA,IAAI,GAAA,YAAe,UAAU,MAAM,IAAI,aAAa,GAAA,EAAK,CAAA,oBAAA,EAAuB,GAAG,CAAA,CAAE,CAAA;AACrF,QAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,CAAA,yBAAA,EAA4B,GAAG,CAAA,CAAE,CAAA;AAAA,MAC/D,CAAA,SAAE;AACA,QAAA,MAAM,IAAI,QAAA,EAAS;AAAA,MACrB;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,cAAc,IAAA,EAMiB;AACnC,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,gDAAgD,CAAA;AAAA,MAC9E;AACA,MAAA,IAAI,QAAA;AACJ,MAAA,IAAI;AACF,QAAA,QAAA,GAAW,MAAM,qBAAA,CAAsB,IAAA,CAAK,UAAA,EAAY;AAAA,UACtD,OAAO,MAAA,CAAO,KAAA;AAAA,UACd,YAAA,EAAc,mBAAmB,MAAM;AAAA,SACxC,CAAA;AAAA,MACH,SAAS,GAAA,EAAK;AACZ,QAAA,IAAI,GAAA,YAAe,cAAc,MAAM,IAAI,aAAa,GAAA,EAAK,MAAA,CAAO,GAAA,CAAI,OAAO,CAAC,CAAA;AAChF,QAAA,MAAM,GAAA;AAAA,MACR;AACA,MAAA,IAAI,CAAC,QAAA,EAAU;AACb,QAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,0EAAqE,CAAA;AAAA,MACnG;AACA,MAAA,IAAI,QAAA,GAAW,KAAK,SAAA,IAAa,IAAA;AACjC,MAAA,IAAI,YAAA,GAAe,KAAK,aAAA,IAAiB,IAAA;AACzC,MAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,qBAAA,EAAuB;AAC/C,QAAA,IAAI;AACF,UAAA,MAAM,MAAM,MAAM,mBAAA;AAAA,YAChB,MAAA,CAAO,SAAS,qBAAqB,CAAA;AAAA,YACrC,WAAA;AAAA,YACA,yBAAA;AAAA,YACA,EAAE,KAAA,EAAO,MAAA,CAAO,OAAO,YAAA,EAAc,kBAAA,CAAmB,MAAM,CAAA;AAAE,WAClE;AACA,UAAA,QAAA,GAAY,IAAI,SAAA,IAAoC,IAAA;AACpD,UAAA,YAAA,GAAgB,IAAI,aAAA,IAAwC,YAAA;AAAA,QAC9D,SAAS,GAAA,EAAK;AAGZ,UAAA,IAAI,GAAA,YAAe,cAAc,MAAM,IAAI,aAAa,GAAA,EAAK,MAAA,CAAO,GAAA,CAAI,OAAO,CAAC,CAAA;AAAA,QAElF;AAAA,MACF;AACA,MAAA,IAAI;AACF,QAAA,OAAO,MAAM,kBAAkB,QAAA,EAAU,IAAA,CAAK,YAAY,IAAA,CAAK,OAAA,IAAW,EAAA,EAAI,WAAA,EAAa,KAAA,EAAO;AAAA,UAChG,QAAA;AAAA,UACA,YAAA;AAAA,UACA,QAAQ,IAAA,CAAK;AAAA,SACd,CAAA;AAAA,MACH,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,MACzC;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,iBAAiB,KAAA,EAK4B;AACjD,MAAA,MAAM,IAAA,GAAO,CAAC,OAAA,EAAkB,OAAA,EAAiB,KAAA,GAAwC,SACvF,cAAA,CAAe,OAAA,EAAS,OAAA,EAAS,YAAA,EAAc,KAAK,CAAA;AACtD,MAAA,IAAI,MAAM,KAAA,EAAO;AACf,QAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,KAAA,EAAO,KAAA,CAAM,qBAAqB,KAAA,CAAM,KAAK,CAAA,EAAG,WAAA,EAAa,WAAA,EAAY;AAAA,MAC/F;AACA,MAAA,IAAI,CAAC,KAAA,CAAM,IAAA,IAAQ,CAAC,MAAM,KAAA,EAAO;AAC/B,QAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,OAAO,iCAAiC,CAAA,EAAG,aAAa,WAAA,EAAY;AAAA,MAC1F;AACA,MAAA,IAAI;AACF,QAAA,MAAM,cAAc,MAAM,oBAAA,CAAqB,MAAM,KAAA,EAAO,KAAA,CAAM,MAAM,KAAA,EAAO;AAAA,UAC7E,OAAO,MAAA,CAAO,KAAA;AAAA,UACd,YAAA,EAAc,mBAAmB,MAAM;AAAA,SACxC,CAAA;AACD,QAAA,OAAO;AAAA,UACL,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,wBAAA,EAA0B;AAAA,YACzC,cAAc,WAAA,CAAY,YAAA;AAAA,YAC1B,eAAe,WAAA,CAAY,aAAA;AAAA,YAC3B,UAAA,EAAY,YAAY,UAAA,IAAc,QAAA;AAAA,YACtC,YAAY,WAAA,CAAY,UAAA;AAAA,YACxB,OAAO,WAAA,CAAY,KAAA;AAAA,YACnB,SAAS,WAAA,CAAY;AAAA,WACtB,CAAA;AAAA,UACD,WAAA,EAAa;AAAA,SACf;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,OAAO,EAAE,MAAM,IAAA,CAAK,KAAA,EAAO,OAAO,GAAG,CAAC,CAAA,EAAG,WAAA,EAAa,WAAA,EAAY;AAAA,MACpE;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,kBAAA,CACJ,KAAA,EACA,UAAA,EACkC;AAClC,MAAA,MAAM,MAAA,GAAS,aAAA,CAAc,UAAA,EAAY,gBAAgB,CAAA;AACzD,MAAA,MAAM,OAAA,GAAU,MAAM,aAAA,CAAc,MAAA,EAAQ;AAAA,QAC1C,QAAQ,KAAA,CAAM,MAAA;AAAA,QACd,UAAU,KAAA,CAAM,SAAA;AAAA,QAChB,UAAA,EAAY;AAAA,OACb,CAAA;AACD,MAAA,OAAO,EAAE,SAAA,EAAW,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA,EAAE;AAAA,IAChD,CAAA;AAAA,IAEA,MAAM,oBAAA,CACJ,UAAA,EACA,IAAA,EACA,UAAA,EACkC;AAClC,MAAA,MAAM,MAAA,GAAS,aAAA,CAAc,UAAA,EAAY,uCAAuC,CAAA;AAChF,MAAA,MAAM,QAAA,GAAW,WAAW,UAAU,CAAA;AACtC,MAAA,IAAI;AACF,QAAA,MAAM,SAAS,MAAM,eAAA;AAAA,UACnB,MAAA;AAAA,UACA,QAAA;AAAA,UACA,IAAA,CAAK,QAAA;AAAA,UACL,IAAA,CAAK,QAAA;AAAA,UACL,KAAK,IAAA,IAAQ,IAAA;AAAA,UACb;AAAA,YACE,UAAA,EAAY;AAAA;AACd,SACF;AACA,QAAA,OAAO,aAAa,MAAM,CAAA;AAAA,MAC5B,SAAS,GAAA,EAAK;AACZ,QAAA,IAAI,eAAe,kBAAA,EAAoB;AACrC,UAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,CAAA,sBAAA,EAAyB,GAAA,CAAI,OAAO,CAAA,CAAE,CAAA;AAAA,QACpE;AACA,QAAA,IAAI,eAAe,eAAA,EAAiB;AAClC,UAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,kBAAkB,CAAA;AAAA,QAChD;AACA,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF;AAAA,GACF;AACF;;;AH/lBA,IAAMZ,QAAAA,GAAUC,sBAAAA,CAAc,0PAAe,CAAA;AAmD7C,SAAS,WAAA,GAA2C;AAClD,EAAA,IAAI;AACF,IAAA,OAAOD,SAAQ,MAAM,CAAA;AAAA,EACvB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA,CAAkB,MAAA,EAAQ,MAAA,EAAQ,kBAAkB,CAAA;AAAA,EAChE;AACF;AAEA,SAAS,SAAA,CAAU,GAAkD,GAAA,EAAmB;AACtF,EAAA,OAAO,CAAA,CAAE,KAAK,EAAE,MAAA,EAAQ,IAAI,MAAA,EAAO,EAAG,IAAI,MAAa,CAAA;AACzD;AAEA,eAAe,SACb,CAAA,EAC2F;AAC3F,EAAA,MAAM,IAAA,GAAO,MAAM,CAAA,CAAE,GAAA,CAAI,UAAU,EAAE,GAAA,EAAK,MAAM,CAAA;AAChD,EAAA,MAAM,OAAO,IAAA,CAAK,IAAA;AAClB,EAAA,MAAM,SAAkC,EAAC;AACzC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,IAAI,CAAA,EAAG;AACzC,IAAA,IAAI,CAAA,KAAM,MAAA,EAAQ,MAAA,CAAO,CAAC,CAAA,GAAI,CAAA;AAAA,EAChC;AACA,EAAA,OAAO,EAAE,MAAM,MAAA,EAAO;AACxB;AAEO,SAAS,gBAAA,CAAiB,QAAgB,IAAA,EAAyB;AACxE,EAAA,IAAI,CAAC,IAAA,EAAM,IAAA,IAAQ,CAAC,MAAM,UAAA,EAAY;AACpC,IAAA,MAAM,IAAI,UAAU,+CAA+C,CAAA;AAAA,EACrE;AACA,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,WAAA,EAAY;AAC7B,EAAA,MAAM,GAAA,GAAM,IAAI,IAAA,EAAK;AACrB,EAAA,MAAM,QAAQ,mBAAA,CAAoB,MAAA,EAAQ,EAAE,eAAA,EAAiB,IAAA,CAAK,iBAAiB,CAAA;AAEnF,EAAA,GAAA,CAAI,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA,EAAG,IAAA,KAAS;AAC9B,IAAA,IAAI,CAAA,CAAE,GAAA,CAAI,IAAA,KAAS,uBAAA,SAAgC,IAAA,EAAK;AACxD,IAAA,MAAM,IAAA,CAAK,KAAK,CAAC,CAAA;AACjB,IAAA,MAAM,IAAA,EAAK;AAAA,EACb,CAAC,CAAA;AAED,EAAA,MAAM,IAAA,GAAO,CAAC,EAAA,KAA6C,OAAO,CAAA,KAAmB;AACnF,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,EAAA,CAAG,CAAC,CAAA;AACzB,MAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,UAAW,MAAA,EAAmB;AACxE,QAAA,MAAM,IAAA,GAAO,MAAA;AACb,QAAA,OAAO,CAAA,CAAE,IAAA,CAAK,IAAA,CAAK,IAAI,CAAA;AAAA,MACzB;AACA,MAAA,OAAO,CAAA,CAAE,KAAK,MAAM,CAAA;AAAA,IACtB,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAe,YAAA,EAAc,OAAO,SAAA,CAAU,GAAG,GAAG,CAAA;AACxD,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAA;AAEA,EAAA,GAAA,CAAI,IAAA;AAAA,IACF,YAAA;AAAA,IACA,IAAA,CAAK,OAAO,CAAA,KAAM;AAChB,MAAA,MAAM,EAAA,GAAK,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,cAAc,CAAA,IAAK,EAAA;AAC3C,MAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC,CAAA;AAC1C,MAAA,IAAI,EAAA,CAAG,UAAA,CAAW,qBAAqB,CAAA,EAAG;AACxC,QAAA,MAAM,EAAE,IAAA,EAAM,MAAA,EAAO,GAAI,MAAM,SAAS,CAAC,CAAA;AACzC,QAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,YAAA,CAAa,KAAK,0CAA0C,CAAA;AACjF,QAAA,MAAM,UAAU,IAAA,CAAK,IAAA,IAAQ,MAAA,CAAO,IAAA,CAAK,EAAE,CAAA;AAC3C,QAAA,OAAO,iBAAiB,MAAA,EAAQ;AAAA,UAC9B,OAAA;AAAA,UACA,QAAA,EAAU,KAAK,QAAA,IAAY,IAAA;AAAA,UAC3B,IAAA,EAAM,MAAA;AAAA,UACN;AAAA,SACD,CAAA;AAAA,MACH;AACA,MAAA,IAAI,EAAA,CAAG,UAAA,CAAW,kBAAkB,CAAA,EAAG;AACrC,QAAA,MAAM,OAAA,GAAU,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,EAAK;AACjC,QAAA,OAAO,gBAAA,CAAiB,MAAA,EAAQ,OAAA,EAAS,UAAU,CAAA;AAAA,MACrD;AACA,MAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,8DAA8D,CAAA;AAAA,IAC5F,CAAC;AAAA,GACH;AAEA,EAAA,GAAA,CAAI,GAAA;AAAA,IACF,YAAA;AAAA,IACA,IAAA;AAAA,MAAK,OAAO,CAAA,KACV,mBAAA,CAAoB,MAAA,EAAQ;AAAA,QAC1B,QAAA,EAAU,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,WAAW,CAAA,IAAK,IAAA;AAAA,QACtC,OAAO,MAAA,CAAO,CAAA,CAAE,IAAI,KAAA,CAAM,OAAO,KAAK,EAAE,CAAA;AAAA,QACxC,MAAA,EAAQ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,QAAQ,CAAA,IAAK,IAAA;AAAA,QACjC,UAAA,EAAY,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC;AAAA,OACpC;AAAA;AACH,GACF;AAEA,EAAA,GAAA,CAAI,GAAA;AAAA,IACF,yBAAA;AAAA,IACA,IAAA,CAAK,OAAO,CAAA,KAAM,iBAAA,CAAkB,QAAQ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,aAAa,GAAG,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC,CAAC,CAAC;AAAA,GACnG;AACA,EAAA,GAAA,CAAI,MAAA;AAAA,IACF,yBAAA;AAAA,IACA,IAAA,CAAK,OAAO,CAAA,KAAM,oBAAA,CAAqB,QAAQ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,aAAa,GAAG,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC,CAAC,CAAC;AAAA,GACtG;AACA,EAAA,GAAA,CAAI,KAAA;AAAA,IACF,yBAAA;AAAA,IACA,IAAA;AAAA,MAAK,OAAO,CAAA,KACV,oBAAA,CAAqB,QAAQ,CAAA,CAAE,GAAA,CAAI,MAAM,aAAa,CAAA,EAAG,MAAM,CAAA,CAAE,IAAI,IAAA,EAAK,EAAG,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC,CAAC;AAAA;AACvG,GACF;AACA,EAAA,GAAA,CAAI,IAAA;AAAA,IACF,SAAA;AAAA,IACA,IAAA,CAAK,OAAO,CAAA,KAAM,YAAA,CAAa,QAAQ,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,IAAQ,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC,CAAC,CAAC;AAAA,GACtF;AACA,EAAA,GAAA,CAAI,GAAA;AAAA,IACF,QAAA;AAAA,IACA,IAAA,CAAK,OAAO,CAAA,KAAM,WAAA,CAAY,MAAA,EAAQ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,WAAW,CAAA,IAAK,IAAI,CAAC;AAAA,GACzE;AAEA,EAAA,GAAA,CAAI,IAAA;AAAA,IACF,QAAA;AAAA,IACA,IAAA,CAAK,OAAO,CAAA,KAAM,KAAA,CAAM,WAAW,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,IAAQ,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC,CAAC,CAAC;AAAA,GAClF;AACA,EAAA,GAAA,CAAI,GAAA;AAAA,IACF,QAAA;AAAA,IACA,IAAA;AAAA,MAAK,OAAO,CAAA,KACV,KAAA,CAAM,cAAA,CAAe,EAAE,WAAW,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,WAAW,GAAE,EAAG,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC,CAAC;AAAA;AACxF,GACF;AACA,EAAA,GAAA,CAAI,GAAA;AAAA,IACF,qBAAA;AAAA,IACA,IAAA,CAAK,OAAO,CAAA,KAAM,KAAA,CAAM,eAAA,CAAgB,EAAE,GAAA,CAAI,KAAA,CAAM,MAAM,CAAC,CAAC;AAAA,GAC9D;AACA,EAAA,GAAA,CAAI,IAAA;AAAA,IACF,aAAA;AAAA,IACA,IAAA,CAAK,OAAO,CAAA,KAAM,KAAA,CAAM,aAAA,CAAc,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,EAAM,CAAC;AAAA,GAC3D;AACA,EAAA,GAAA,CAAI,IAAA;AAAA,IACF,gBAAA;AAAA,IACA,IAAA;AAAA,MAAK,OAAO,MACV,KAAA,CAAM,gBAAA;AAAA,QACH,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,EAAK;AAAA,QAClB,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC,CAAA;AAAA,QACvB,KAAK,aAAA,GAAgB,MAAM,IAAA,CAAK,aAAA,CAAc,CAAC,CAAA,GAAI;AAAA;AACrD;AACF,GACF;AACA,EAAA,GAAA,CAAI,GAAA;AAAA,IACF,iBAAA;AAAA,IACA,IAAA,CAAK,OAAO,CAAA,KAAM,KAAA,CAAM,QAAQ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,SAAS,GAAG,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC,CAAC,CAAC;AAAA,GACnF;AACA,EAAA,GAAA,CAAI,KAAA;AAAA,IACF,iBAAA;AAAA,IACA,IAAA;AAAA,MAAK,OAAO,MACV,KAAA,CAAM,eAAA;AAAA,QACJ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,SAAS,CAAA;AAAA,QACpB,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,EAAK;AAAA,QAClB,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC;AAAA;AACzB;AACF,GACF;AACA,EAAA,GAAA,CAAI,MAAA;AAAA,IACF,iBAAA;AAAA,IACA,IAAA,CAAK,OAAO,CAAA,KAAM,KAAA,CAAM,gBAAgB,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,SAAS,GAAG,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC,CAAC,CAAC;AAAA,GAC3F;AACA,EAAA,GAAA,CAAI,IAAA;AAAA,IACF,uBAAA;AAAA,IACA,IAAA,CAAK,OAAO,CAAA,KAAM,KAAA,CAAM,iBAAA,CAAmB,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,EAA+C,CAAC;AAAA,GACzG;AACA,EAAA,GAAA,CAAI,IAAA;AAAA,IACF,kBAAA;AAAA,IACA,IAAA,CAAK,OAAO,CAAA,KAAM,KAAA,CAAM,aAAA,CAAe,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,EAAiC,CAAC;AAAA,GACvF;AACA,EAAA,GAAA,CAAI,GAAA;AAAA,IACF,uBAAA;AAAA,IACA,IAAA,CAAK,OAAO,CAAA,KAAM,KAAA,CAAM,iBAAiB,CAAA,CAAE,GAAA,CAAI,KAAA,EAAO,CAAC;AAAA,GACzD;AACA,EAAA,GAAA,CAAI,GAAA;AAAA,IACF,YAAA;AAAA,IACA,IAAA;AAAA,MAAK,OAAO,MACV,KAAA,CAAM,kBAAA;AAAA,QACJ,EAAE,MAAA,EAAQ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,QAAQ,CAAA,EAAG,SAAA,EAAW,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,WAAW,CAAA,EAAE;AAAA,QACrE,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC;AAAA;AACzB;AACF,GACF;AACA,EAAA,GAAA,CAAI,IAAA;AAAA,IACF,iCAAA;AAAA,IACA,IAAA;AAAA,MAAK,OAAO,MACV,KAAA,CAAM,oBAAA;AAAA,QACJ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,aAAa,CAAA;AAAA,QACxB,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,EAAK;AAAA,QAClB,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC;AAAA;AACzB;AACF,GACF;AAEA,EAAA,OAAO,GAAA;AACT;AAEO,IAAM,aAAA,GAAgB","file":"hono.cjs","sourcesContent":["/** Action-surface errors — user-facing / data-dependent failures (not found, ACL, bad input).\n * Config/programming errors stay as TypeError / RangeError / Error.\n */\nexport class EngineActionError extends Error {\n constructor(message: string) {\n super(message);\n this.name = \"EngineActionError\";\n }\n}\n\n/** Missing vs forbidden document: identical message so callers cannot distinguish. */\nexport class DocumentNotFoundError extends Error {\n constructor(documentId: string) {\n super(`document not found: ${documentId}`);\n this.name = \"DocumentNotFoundError\";\n }\n}\n\nexport class GraphLegUnavailable extends Error {\n constructor(message = \"graph ranked list was not supplied\") {\n super(message);\n this.name = \"GraphLegUnavailable\";\n }\n}\n\nexport class ApprovalNotPending extends Error {\n constructor(message = \"approval is not pending\") {\n super(message);\n this.name = \"ApprovalNotPending\";\n }\n}\n\nexport class ApprovalExpired extends Error {\n constructor(message = \"approval has expired\") {\n super(message);\n this.name = \"ApprovalExpired\";\n }\n}\n\nexport class CodeExecutionError extends Error {\n constructor(message: string) {\n super(message);\n this.name = \"CodeExecutionError\";\n }\n}\n\nexport class CodeExecutionTimeout extends Error {\n constructor(message = \"code execution timed out\") {\n super(message);\n this.name = \"CodeExecutionTimeout\";\n }\n}\n\nexport class ExtraMissingError extends Error {\n constructor(extra: string, pkg: string, what: string) {\n super(`${what} requires the '${pkg}' package (optional extra: ${extra}): npm install ${pkg}`);\n this.name = \"ExtraMissingError\";\n }\n}\n","import { createRequire } from \"node:module\";\nimport { ExtraMissingError } from \"../../errors.js\";\n\nconst require = createRequire(import.meta.url);\n\nexport const MAX_ROWS = 1000;\nconst CONNECT_TIMEOUT = 10;\nconst QUERY_TIMEOUT_MS = 30_000;\n\nconst ALWAYS_BLOCKED = [\"GRANT\", \"REVOKE\"] as const;\nconst READONLY_BLOCKED = [\n \"INSERT\",\n \"UPDATE\",\n \"DELETE\",\n \"MERGE\",\n \"DROP\",\n \"ALTER\",\n \"CREATE\",\n \"TRUNCATE\",\n \"DO\",\n \"CALL\",\n] as const;\n// `DO` blocks and `CALL`ed procedures run arbitrary server-side code the\n// keyword guard cannot see through, so below `full` mode they are refused\n// outright; in `full` mode the database role's own privileges are the boundary.\nconst READWRITE_BLOCKED = [\"DELETE\", \"DROP\", \"TRUNCATE\", \"DO\", \"CALL\"] as const;\nconst ALLOWED_ACCESS_MODES = [\"readonly\", \"readwrite\", \"full\"] as const;\ntype AccessMode = (typeof ALLOWED_ACCESS_MODES)[number];\n\n// STANDARD lexing model: '' is the only escape inside '...', except in an\n// E'...' literal, which Postgres always reads with backslash escapes.\nconst SQL_NOISE_RE = /\\b[eE]'(?:[^'\\\\]|\\\\[\\s\\S]|'')*'|'(?:[^']|'')*'|--[^\\n]*|\\/\\*[\\s\\S]*?\\*\\//g;\n\n// The same noise under the BACKSLASH lexing model: MySQL (and Postgres with\n// `standard_conforming_strings` off) escapes a quote inside a plain '...'\n// literal with a backslash. The two models disagree about where a literal\n// ENDS, so a query can be a harmless SELECT under one and carry a `DROP`\n// under the other (`SELECT 'a\\' x '; DROP TABLE t; -- '`). The guard cannot\n// know which model the target engine speaks — it checks BOTH and refuses if\n// either reveals a blocked statement (fail closed).\nconst SQL_NOISE_BACKSLASH_RE = /'(?:[^'\\\\]|\\\\[\\s\\S]|'')*'|--[^\\n]*|\\/\\*[\\s\\S]*?\\*\\//g;\n\n// Dollar-quoted bodies (`$$...$$`, `$tag$...$tag$`) are deliberately NOT\n// blanked by either regex. They are CODE — `DO` blocks and function bodies —\n// far more often than data, and a `DELETE` inside one is exactly what this\n// guard exists to see. Blanking them let `DO $$ BEGIN DELETE FROM t; END $$`\n// pass read-write mode. A keyword inside a dollar-quoted string literal is\n// a false positive that fails closed.\nexport function stripSqlNoise(sql: string): string {\n return sql.replace(SQL_NOISE_RE, (m) => \" \".repeat(m.length));\n}\n\n/** `stripSqlNoise` under the backslash lexing model — see `SQL_NOISE_BACKSLASH_RE`. */\nfunction stripSqlNoiseBackslash(sql: string): string {\n return sql.replace(SQL_NOISE_BACKSLASH_RE, (m) => \" \".repeat(m.length));\n}\n\nfunction hasKeyword(sqlUpper: string, keyword: string): boolean {\n return new RegExp(`\\\\b${keyword}\\\\b`).test(sqlUpper);\n}\n\nexport function buildConnectionUrl(config: Record<string, unknown>): string {\n const engine = String(config.engine ?? \"postgresql\");\n if (engine === \"sqlite\") return `sqlite:///${config.database ?? \"\"}`;\n\n const host = String(config.host ?? \"localhost\");\n const port = Number(config.port ?? 5432);\n const database = String(config.database ?? \"\");\n const username = String(config.username ?? \"\");\n const password = encodeURIComponent(String(config.password ?? \"\"));\n\n if (engine === \"oracle\") {\n const serviceName = String(config.service_name ?? database);\n return `oracle://${username}:${password}@${host}:${port}/?service_name=${serviceName}`;\n }\n if (engine === \"snowflake\") {\n const schemaName = String(config.schema_name ?? \"PUBLIC\");\n const warehouse = String(config.warehouse ?? \"\");\n let url = `snowflake://${username}:${password}@${host}/${database}/${schemaName}`;\n if (warehouse) url += `?warehouse=${warehouse}`;\n return url;\n }\n if (engine === \"clickhouse\") {\n const secure = [9440, 8443, 443].includes(port);\n return `clickhouse://${username}:${password}@${host}:${port}/${database}${secure ? \"?secure=True\" : \"\"}`;\n }\n if (engine === \"mysql\" || engine === \"mariadb\") {\n return `mysql://${username}:${password}@${host}:${port}/${database}`;\n }\n if (engine === \"mssql\") {\n return `mssql://${username}:${password}@${host}:${port}/${database}`;\n }\n return `postgresql://${username}:${password}@${host}:${port}/${database}`;\n}\n\nfunction rowsToText(rows: Array<Record<string, unknown>>): string {\n if (!rows.length) return \"\";\n const columns = Object.keys(rows[0]!);\n const lines = [columns.join(\"\\t\")];\n for (const row of rows) {\n lines.push(columns.map((col) => String(row[col] ?? \"\")).join(\"\\t\"));\n }\n return lines.join(\"\\n\");\n}\n\ntype QueryResult = {\n columns: string[];\n rows: Array<Record<string, unknown>>;\n rowCount: number;\n};\n\nasync function runOnPostgres(\n config: Record<string, unknown>,\n sql: string,\n maxRows: number,\n readOnly = false,\n): Promise<QueryResult> {\n let pg: typeof import(\"pg\");\n try {\n pg = require(\"pg\") as typeof import(\"pg\");\n } catch {\n throw new ExtraMissingError(\"postgres\", \"pg\", \"database tool executor\");\n }\n const url = buildConnectionUrl({ ...config, engine: \"postgresql\" });\n const client = new pg.Client({\n connectionString: url,\n connectionTimeoutMillis: CONNECT_TIMEOUT * 1000,\n statement_timeout: QUERY_TIMEOUT_MS,\n });\n await client.connect();\n try {\n await client.query(\"BEGIN\");\n if (readOnly) {\n try {\n await client.query(\"SET TRANSACTION READ ONLY\");\n } catch (exc) {\n await client.query(\"ROLLBACK\");\n console.warn(\n \"[context-engine] db executor: engine rejected SET TRANSACTION READ ONLY; \" +\n \"read-only mode is enforced by statement inspection alone for this query\",\n exc,\n );\n await client.query(\"BEGIN\");\n }\n }\n const result = await client.query(sql);\n await client.query(\"COMMIT\");\n const columns = result.fields?.map((f) => f.name) ?? (result.rows[0] ? Object.keys(result.rows[0]) : []);\n const rows = result.rows.slice(0, maxRows).map((r) => ({ ...r }));\n return { columns, rows, rowCount: result.rowCount ?? rows.length };\n } catch (e) {\n try {\n await client.query(\"ROLLBACK\");\n } catch {\n /* ignore */\n }\n throw e;\n } finally {\n await client.end();\n }\n}\n\nasync function runOnMysql(\n config: Record<string, unknown>,\n sql: string,\n maxRows: number,\n): Promise<QueryResult> {\n let mysql: {\n createConnection: (opts: Record<string, unknown>) => Promise<{\n query: (sql: string) => Promise<[unknown[], { name: string }[]]>;\n end: () => Promise<void>;\n }>;\n };\n try {\n mysql = require(\"mysql2/promise\");\n } catch {\n throw new ExtraMissingError(\"mysql\", \"mysql2\", \"MySQL/MariaDB tool executor\");\n }\n const conn = await mysql.createConnection({\n host: config.host ?? \"localhost\",\n port: Number(config.port ?? 3306),\n user: config.username ?? \"\",\n password: config.password ?? \"\",\n database: config.database ?? \"\",\n connectTimeout: CONNECT_TIMEOUT * 1000,\n });\n try {\n const [rows, fields] = await conn.query(sql);\n const list = Array.isArray(rows) ? (rows as Array<Record<string, unknown>>) : [];\n const columns = (fields ?? []).map((f) => f.name);\n return { columns, rows: list.slice(0, maxRows), rowCount: list.length };\n } finally {\n await conn.end();\n }\n}\n\nasync function executeRaw(\n config: Record<string, unknown>,\n sql: string,\n maxRows: number,\n readOnly = false,\n): Promise<QueryResult> {\n const engine = String(config.engine ?? \"postgresql\");\n if (engine === \"postgresql\") return runOnPostgres(config, sql, maxRows, readOnly);\n if (engine === \"mysql\" || engine === \"mariadb\") return runOnMysql(config, sql, maxRows);\n throw new Error(\n `db executor: engine ${JSON.stringify(engine)} is not supported in the JS port ` +\n `(supported: postgresql, mysql, mariadb)`,\n );\n}\n\nexport function executeQuery(\n config: Record<string, unknown>,\n sql: string,\n maxRows: number = MAX_ROWS,\n accessMode: string = \"readonly\",\n): Promise<Record<string, unknown>> {\n return executeQueryAsync(config, sql, maxRows, accessMode);\n}\n\nasync function executeQueryAsync(\n config: Record<string, unknown>,\n sql: string,\n maxRows: number,\n accessModeRaw: string,\n): Promise<Record<string, unknown>> {\n const accessMode = (accessModeRaw || \"readonly\") as AccessMode;\n if (!(ALLOWED_ACCESS_MODES as readonly string[]).includes(accessMode)) {\n throw new Error(\n `Invalid access_mode ${JSON.stringify(accessModeRaw)}; must be one of ${ALLOWED_ACCESS_MODES}`,\n );\n }\n\n // Both lexing models are checked and BOTH must pass — see\n // SQL_NOISE_BACKSLASH_RE for the smuggle either one alone allows.\n const sqlVariants = [\n stripSqlNoise(sql).trim().toUpperCase(),\n stripSqlNoiseBackslash(sql).trim().toUpperCase(),\n ];\n const sqlUpper = sqlVariants[0]!;\n\n // Privilege escalation is refused in every mode, and checked against the\n // RAW text too: dynamic SQL (`EXECUTE 'GRANT ...'` in a DO block) carries\n // the keyword inside a string literal the strippers blank. A false\n // positive on the word \"grant\" in data is the price; it fails closed.\n for (const keyword of ALWAYS_BLOCKED) {\n if ([...sqlVariants, sql.toUpperCase()].some((v) => hasKeyword(v, keyword))) {\n return { success: false, error: `${keyword} queries are not allowed` };\n }\n }\n\n if (accessMode === \"readonly\") {\n if (!sqlVariants.every((v) => v.startsWith(\"SELECT\") || v.startsWith(\"WITH\"))) {\n return { success: false, error: \"Only SELECT queries are allowed in read-only mode\" };\n }\n for (const keyword of READONLY_BLOCKED) {\n if (sqlVariants.some((v) => hasKeyword(v, keyword))) {\n return { success: false, error: `${keyword} queries are not allowed in read-only mode` };\n }\n }\n } else if (accessMode === \"readwrite\") {\n for (const keyword of READWRITE_BLOCKED) {\n if (sqlVariants.some((v) => hasKeyword(v, keyword))) {\n return { success: false, error: `${keyword} queries are not allowed in read-write mode` };\n }\n }\n }\n\n try {\n const result = await executeRaw(config, sql, maxRows, accessMode === \"readonly\");\n\n if (!sqlUpper.startsWith(\"SELECT\") && !sqlUpper.startsWith(\"WITH\")) {\n return {\n success: true,\n columns: [],\n rows: [],\n row_count: result.rowCount,\n affected_rows: result.rowCount,\n truncated: false,\n };\n }\n\n return {\n success: true,\n columns: result.columns,\n rows: result.rows,\n row_count: result.rows.length,\n truncated: result.rows.length >= maxRows,\n text: rowsToText(result.rows),\n };\n } catch (e) {\n return { success: false, error: String(e) };\n }\n}\n\nexport async function executeDb(\n config: Record<string, unknown>,\n sql: string,\n): Promise<Record<string, unknown>> {\n const maxRows = Number(config.max_rows ?? MAX_ROWS);\n const accessMode = String(config.access_mode ?? \"readonly\");\n return executeQueryAsync(config, sql, maxRows, accessMode);\n}\n\nexport async function testConnection(config: Record<string, unknown>): Promise<Record<string, unknown>> {\n const engineType = String(config.engine ?? \"postgresql\");\n const versionQueries: Record<string, string> = {\n postgresql: \"SELECT version()\",\n mysql: \"SELECT version()\",\n mariadb: \"SELECT version()\",\n mssql: \"SELECT @@VERSION\",\n sqlite: \"SELECT sqlite_version()\",\n oracle: \"SELECT banner FROM v$version WHERE ROWNUM = 1\",\n clickhouse: \"SELECT version()\",\n snowflake: \"SELECT CURRENT_VERSION()\",\n };\n const q = versionQueries[engineType] ?? \"SELECT version()\";\n const result = await executeQueryAsync(config, q, 1, \"readonly\");\n if (!result.success) return { success: false, error: result.error };\n const version = (result.rows as Array<Record<string, unknown>>)?.[0]\n ? Object.values((result.rows as Array<Record<string, unknown>>)[0]!)[0]\n : null;\n return {\n success: true,\n version: String(version),\n host: config.host,\n database: config.database,\n engine: engineType,\n };\n}\n\nexport async function fetchSchema(\n config: Record<string, unknown>,\n selectedTables?: string[] | null,\n): Promise<Record<string, unknown>> {\n const engine = String(config.engine ?? \"postgresql\");\n if (engine !== \"postgresql\") {\n return { success: false, error: `schema introspection is implemented for postgresql (got ${engine})` };\n }\n let pg: typeof import(\"pg\");\n try {\n pg = require(\"pg\") as typeof import(\"pg\");\n } catch {\n throw new ExtraMissingError(\"postgres\", \"pg\", \"database tool executor\");\n }\n const client = new pg.Client({ connectionString: buildConnectionUrl(config) });\n await client.connect();\n try {\n const schemaName = String(config.schema_name ?? \"public\");\n const tablesRes = await client.query(\n `SELECT table_name, table_type FROM information_schema.tables WHERE table_schema = $1`,\n [schemaName],\n );\n let items = tablesRes.rows.map((r) => ({\n name: String(r.table_name),\n type: String(r.table_type).toLowerCase().includes(\"view\") ? \"view\" : \"table\",\n }));\n if (selectedTables?.length) {\n const selected = new Set(selectedTables);\n items = items.filter((i) => selected.has(i.name));\n }\n const tables = [];\n for (const item of items) {\n const cols = await client.query(\n `SELECT column_name, data_type, is_nullable FROM information_schema.columns\n WHERE table_schema = $1 AND table_name = $2 ORDER BY ordinal_position`,\n [schemaName, item.name],\n );\n tables.push({\n name: item.name,\n type: item.type,\n columns: cols.rows.map((c) => ({\n name: c.column_name,\n type: c.data_type,\n nullable: c.is_nullable === \"YES\",\n })),\n row_count: 0,\n });\n }\n return {\n success: true,\n database: config.database,\n schema: schemaName,\n tables,\n table_count: tables.length,\n all_tables: items.map((i) => i.name),\n };\n } finally {\n await client.end();\n }\n}\n\nexport async function getSchemaText(\n config: Record<string, unknown>,\n selectedTables?: string[] | null,\n): Promise<string> {\n const schema = await fetchSchema(config, selectedTables);\n const schemaRows: Array<Record<string, unknown>> = [];\n for (const table of (schema.tables as Array<Record<string, unknown>> | undefined) ?? []) {\n const kind = table.type ?? \"table\";\n for (const c of (table.columns as Array<Record<string, unknown>>) ?? []) {\n schemaRows.push({\n table: table.name,\n table_type: kind,\n column: c.name,\n type: String(c.type).toUpperCase(),\n pk: c.pk ?? false,\n fk: c.fk ?? \"\",\n rows: table.row_count,\n });\n }\n }\n return rowsToText(schemaRows);\n}\n","import { createRequire } from \"node:module\";\nimport { ExtraMissingError } from \"./errors.js\";\n\nconst require = createRequire(import.meta.url);\n\nimport {\n HandlerError,\n handleDeleteDocument,\n handleGetDocument,\n handleIngestFile,\n handleIngestJson,\n handleListDocuments,\n handleSearch,\n handleStats,\n handleUpdateDocument,\n} from \"./routing-core.js\";\nimport { createToolsHandlers, MCP_OAUTH_CALLBACK_PATH } from \"./tools/router.js\";\n\ntype Engine = Parameters<typeof handleIngestJson>[0] & Parameters<typeof createToolsHandlers>[0];\n\nexport type HonoRouterOptions = {\n auth: (c: unknown) => unknown | Promise<unknown>;\n principals: (c: unknown) => unknown | Promise<unknown>;\n /** Server-side resolver for the approval claim scope on `POST\n * /tools/execute` (a run id is the expected shape). Never read from the\n * body. Omitted = unscoped execution, the deprecated legacy path. */\n approvalScope?: (c: unknown) => unknown | Promise<unknown>;\n redirectBaseUrl?: string;\n};\n\ntype HonoContext = {\n req: {\n path: string;\n header: (name: string) => string | undefined;\n query: {\n (): Record<string, string>;\n (name: string): string | undefined;\n };\n param: (name: string) => string;\n json: () => Promise<unknown>;\n parseBody: (opts?: Record<string, unknown>) => Promise<Record<string, unknown>>;\n };\n json: (body: unknown, status?: number) => unknown;\n html: (html: string) => unknown;\n};\n\ntype HonoApp = {\n use: (path: string, handler: (c: HonoContext, next: () => Promise<void>) => Promise<unknown>) => unknown;\n post: (path: string, handler: (c: HonoContext) => Promise<unknown>) => unknown;\n get: (path: string, handler: (c: HonoContext) => Promise<unknown>) => unknown;\n delete: (path: string, handler: (c: HonoContext) => Promise<unknown>) => unknown;\n patch: (path: string, handler: (c: HonoContext) => Promise<unknown>) => unknown;\n};\n\nfunction requireHono(): { Hono: new () => HonoApp } {\n try {\n return require(\"hono\") as { Hono: new () => HonoApp };\n } catch {\n throw new ExtraMissingError(\"hono\", \"hono\", \"createHonoRouter\");\n }\n}\n\nfunction jsonError(c: { json: (b: unknown, s?: number) => unknown }, exc: HandlerError) {\n return c.json({ detail: exc.detail }, exc.status as 400);\n}\n\nasync function readForm(\n c: HonoContext,\n): Promise<{ file?: { data?: Buffer; filename?: string }; fields: Record<string, unknown> }> {\n const body = await c.req.parseBody({ all: true });\n const file = body.file as { data?: Buffer; filename?: string } | undefined;\n const fields: Record<string, unknown> = {};\n for (const [k, v] of Object.entries(body)) {\n if (k !== \"file\") fields[k] = v;\n }\n return { file, fields };\n}\n\nexport function createHonoRouter(engine: Engine, opts: HonoRouterOptions) {\n if (!opts?.auth || !opts?.principals) {\n throw new TypeError(\"createHonoRouter requires auth and principals\");\n }\n const { Hono } = requireHono();\n const app = new Hono();\n const tools = createToolsHandlers(engine, { redirectBaseUrl: opts.redirectBaseUrl });\n\n app.use(\"*\", async (c, next) => {\n if (c.req.path === MCP_OAUTH_CALLBACK_PATH) return next();\n await opts.auth(c);\n await next();\n });\n\n const wrap = (fn: (c: HonoContext) => Promise<unknown>) => async (c: HonoContext) => {\n try {\n const result = await fn(c);\n if (result && typeof result === \"object\" && \"html\" in (result as object)) {\n const html = result as { html: string; contentType?: string };\n return c.html(html.html);\n }\n return c.json(result);\n } catch (exc) {\n if (exc instanceof HandlerError) return jsonError(c, exc);\n throw exc;\n }\n };\n\n app.post(\n \"/documents\",\n wrap(async (c) => {\n const ct = c.req.header(\"content-type\") ?? \"\";\n const principals = await opts.principals(c);\n if (ct.startsWith(\"multipart/form-data\")) {\n const { file, fields } = await readForm(c);\n if (!file) throw new HandlerError(400, \"multipart upload requires a 'file' field\");\n const content = file.data ?? Buffer.from([]);\n return handleIngestFile(engine, {\n content,\n filename: file.filename ?? null,\n form: fields,\n principals,\n });\n }\n if (ct.startsWith(\"application/json\")) {\n const payload = await c.req.json();\n return handleIngestJson(engine, payload, principals);\n }\n throw new HandlerError(415, \"Content-Type must be multipart/form-data or application/json\");\n }),\n );\n\n app.get(\n \"/documents\",\n wrap(async (c) =>\n handleListDocuments(engine, {\n sourceId: c.req.query(\"source_id\") ?? null,\n limit: Number(c.req.query(\"limit\") ?? 50),\n cursor: c.req.query(\"cursor\") ?? null,\n principals: await opts.principals(c),\n }),\n ),\n );\n\n app.get(\n \"/documents/:document_id\",\n wrap(async (c) => handleGetDocument(engine, c.req.param(\"document_id\"), await opts.principals(c))),\n );\n app.delete(\n \"/documents/:document_id\",\n wrap(async (c) => handleDeleteDocument(engine, c.req.param(\"document_id\"), await opts.principals(c))),\n );\n app.patch(\n \"/documents/:document_id\",\n wrap(async (c) =>\n handleUpdateDocument(engine, c.req.param(\"document_id\"), await c.req.json(), await opts.principals(c)),\n ),\n );\n app.post(\n \"/search\",\n wrap(async (c) => handleSearch(engine, await c.req.json(), await opts.principals(c))),\n );\n app.get(\n \"/stats\",\n wrap(async (c) => handleStats(engine, c.req.query(\"source_id\") ?? null)),\n );\n\n app.post(\n \"/tools\",\n wrap(async (c) => tools.createTool(await c.req.json(), await opts.principals(c))),\n );\n app.get(\n \"/tools\",\n wrap(async (c) =>\n tools.listToolsAdmin({ source_id: c.req.query(\"source_id\") }, await opts.principals(c)),\n ),\n );\n app.get(\n \"/tools/schema/:kind\",\n wrap(async (c) => tools.toolSchemaRoute(c.req.param(\"kind\"))),\n );\n app.post(\n \"/tools/test\",\n wrap(async (c) => tools.testToolRoute(await c.req.json())),\n );\n app.post(\n \"/tools/execute\",\n wrap(async (c) =>\n tools.executeToolRoute(\n (await c.req.json()) as { call_name?: string },\n await opts.principals(c),\n opts.approvalScope ? await opts.approvalScope(c) : null,\n ),\n ),\n );\n app.get(\n \"/tools/:tool_id\",\n wrap(async (c) => tools.getTool(c.req.param(\"tool_id\"), await opts.principals(c))),\n );\n app.patch(\n \"/tools/:tool_id\",\n wrap(async (c) =>\n tools.updateToolRoute(\n c.req.param(\"tool_id\"),\n (await c.req.json()) as Record<string, unknown>,\n await opts.principals(c),\n ),\n ),\n );\n app.delete(\n \"/tools/:tool_id\",\n wrap(async (c) => tools.deleteToolRoute(c.req.param(\"tool_id\"), await opts.principals(c))),\n );\n app.post(\n \"/mcp/connect-and-list\",\n wrap(async (c) => tools.mcpConnectAndList((await c.req.json()) as { server_name: string; url: string })),\n );\n app.post(\n \"/mcp/oauth/start\",\n wrap(async (c) => tools.mcpOauthStart((await c.req.json()) as { server_url: string })),\n );\n app.get(\n MCP_OAUTH_CALLBACK_PATH,\n wrap(async (c) => tools.mcpOauthCallback(c.req.query())),\n );\n app.get(\n \"/approvals\",\n wrap(async (c) =>\n tools.listApprovalsRoute(\n { status: c.req.query(\"status\"), source_id: c.req.query(\"source_id\") },\n await opts.principals(c),\n ),\n ),\n );\n app.post(\n \"/approvals/:approval_id/resolve\",\n wrap(async (c) =>\n tools.resolveApprovalRoute(\n c.req.param(\"approval_id\"),\n (await c.req.json()) as { decision: \"approved\" | \"rejected\"; approver: string },\n await opts.principals(c),\n ),\n ),\n );\n\n return app;\n}\n\nexport const createHonoApp = createHonoRouter;\n","/**\n * Sentinels distinguishing omitted arguments from real values, including null.\n *\n * UNSET: \"argument omitted\" vs null (e.g. updateDocument acl=null means unrestricted).\n * TRUSTED: trusted caller, ACL filtering disabled. Truthy on purpose so\n * `if (principals)` does not treat a trusted caller as anonymous.\n */\n\nexport const UNSET: unique symbol = Symbol.for(\"context_engine.UNSET\");\nexport type Unset = typeof UNSET;\n\n// Symbol.for (the process-global registry), NEVER a class instance: the\n// package ships per-entry bundles (tsup splitting:false), so dist/index.js\n// and dist/mcp.js each carry their own copy of this module. A class instance\n// is a different object per copy, and `result === TRUSTED` then fails for an\n// app importing TRUSTED from one entry while mounting another — every tool\n// call on a correctly configured trusted mount errors. UNSET above survives\n// bundle duplication for exactly this reason; TRUSTED must too.\nexport const TRUSTED: unique symbol = Symbol.for(\"context_engine.TRUSTED\");\nexport type Trusted = typeof TRUSTED;\n\nexport type Principals = string[] | null | typeof TRUSTED | undefined;\n\n// Once per method, matching Python's default warnings filter — before the\n// dedup, a legacy caller re-triggered the warning on EVERY request.\nconst warnedMethods = new Set<string>();\n\nexport function resolvePrincipals(value: Principals, method: string): string[] | null {\n if (value === TRUSTED) return null;\n if (value === undefined || value === null) {\n // `undefined` (omitted) is the same legacy trusted spelling as `null` —\n // Python's omitted `principals` defaults to None and warns identically.\n if (!warnedMethods.has(method)) {\n warnedMethods.add(method);\n process.emitWarning(\n `${method}(principals=${value === null ? \"null\" : \"undefined\"}) means TRUSTED CALLER — ` +\n `access control is disabled and every document is returned. If that is what ` +\n `you want, pass principals=TRUSTED (from @promptev/context-engine) to say so ` +\n `explicitly. If you meant 'no authenticated user', pass principals=[] instead. ` +\n `Passing null/omitting will raise in 1.0.`,\n { type: \"DeprecationWarning\", code: \"CE_PRINCIPALS_NULL\" },\n );\n }\n return null;\n }\n if (!Array.isArray(value)) {\n // NEVER coerce: a bare string (or any other object) coercing to null\n // used to mean full-corpus TRUSTED — an ACL bypass a caller could hit\n // with one wrong type. Fail loudly instead.\n throw new TypeError(\n `${method}(principals=...) must be an array of principal strings, [] for an ` +\n `anonymous caller, or TRUSTED — got ${typeof value}. A non-array value must ` +\n `never silently disable ACL filtering.`,\n );\n }\n return value;\n}\n\nexport function isTrusted(principals: string[] | null | undefined): boolean {\n return principals === null || principals === undefined;\n}\n","import { z } from \"zod\";\nimport { TRUSTED, type Trusted } from \"./sentinels.js\";\n\nexport class HandlerError extends Error {\n status: number;\n detail: unknown;\n constructor(status: number, detail: unknown) {\n super(typeof detail === \"string\" ? detail : JSON.stringify(detail));\n this.name = \"HandlerError\";\n this.status = status;\n this.detail = detail;\n }\n}\n\nexport const ingestJsonRequestSchema = z\n .object({\n text: z.string(),\n name: z.string(),\n source_id: z.string().nullable().optional(),\n external_id: z.string().nullable().optional(),\n description: z.string().nullable().optional(),\n meta_data: z.record(z.unknown()).nullable().optional(),\n acl: z.array(z.string()).nullable().optional(),\n mode: z.enum([\"hybrid\", \"graph\"]).nullable().optional(),\n extract_structured: z.boolean().optional().default(false),\n batch: z.boolean().optional().default(false),\n })\n .strip();\n\nexport const documentPatchSchema = z\n .object({\n acl: z.array(z.string()).nullable().optional(),\n name: z.string().nullable().optional(),\n description: z.string().nullable().optional(),\n meta_data: z.record(z.unknown()).nullable().optional(),\n })\n .strict();\n\nexport const searchRequestSchema = z\n .object({\n query: z.string(),\n source_ids: z.array(z.string()).nullable().optional(),\n // Narrows WITHIN a source and INTERSECTS with source_ids — it can only\n // shrink the result set (the ACL predicate still applies in the same SQL\n // conjunction), so exposing it needs no authorizeAcl-style grant check.\n document_ids: z.array(z.string()).nullable().optional(),\n top_k: z.number().int().optional().default(10),\n mode: z.enum([\"hybrid\", \"graph\"]).optional().default(\"hybrid\"),\n compress_to_tokens: z.number().int().nullable().optional(),\n })\n .strip();\n\nexport type IngestJSONRequest = z.infer<typeof ingestJsonRequestSchema>;\nexport type DocumentPatch = z.infer<typeof documentPatchSchema>;\nexport type SearchRequest = z.infer<typeof searchRequestSchema>;\n\nexport type ContextEngineLike = {\n ingest: (args: Record<string, unknown>) => Promise<unknown>;\n search: (query: string, opts?: Record<string, unknown>) => Promise<{ hits?: unknown[]; usage?: unknown }>;\n listDocuments: (opts: Record<string, unknown>) => Promise<unknown>;\n getDocument: (id: string, opts?: Record<string, unknown>) => Promise<unknown>;\n deleteDocument: (id: string, opts?: Record<string, unknown>) => Promise<unknown>;\n updateDocument: (id: string, opts?: Record<string, unknown>) => Promise<unknown>;\n stats: (sourceId?: string | null) => Promise<unknown>;\n};\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\nexport function requireValidUuid(documentId: string): void {\n if (!UUID_RE.test(String(documentId))) {\n throw new HandlerError(400, `invalid document id: ${JSON.stringify(documentId)}`);\n }\n}\n\nexport function formBool(value: unknown): boolean {\n if (typeof value === \"boolean\") return value;\n if (value == null) return false;\n return [\"1\", \"true\", \"yes\", \"on\"].includes(String(value).trim().toLowerCase());\n}\n\nexport function formJson(value: unknown): unknown {\n if (value === undefined || value === null || value === \"\") return null;\n if (typeof value === \"object\") return value;\n try {\n return JSON.parse(String(value));\n } catch {\n throw new HandlerError(400, `invalid JSON in field: ${JSON.stringify(value)}`);\n }\n}\n\nexport function formStr(value: unknown): string | null {\n return value === undefined || value === null || value === \"\" ? null : String(value);\n}\n\nexport function resolveRequestPrincipals(value: unknown, opts: { surface: string }): string[] | Trusted {\n // Hand the SENTINEL through, not null: every engine method resolves TRUSTED\n // silently, while `principals=null` triggers the deprecation warning aimed\n // at legacy in-process callers — collapsing here made a correctly\n // configured trusted mount re-trigger that warning on every request.\n if (value === TRUSTED) return TRUSTED;\n if (value == null) {\n throw new HandlerError(\n 500,\n `${opts.surface}: the \\`principals\\` dependency returned null, which means ` +\n `TRUSTED CALLER — it disables ACL filtering and skips the check that ` +\n `stops a caller filing documents under groups it does not hold. This ` +\n `mount is misconfigured: return [] for an unauthenticated caller, or ` +\n `pass TRUSTED explicitly (from @promptev/context-engine) if the surface really ` +\n `is trusted.`,\n );\n }\n // A runtime check, not a cast: `as string[]` let a plain-JS dependency\n // return a bare string that flowed into resolvePrincipals and (before its\n // own guard) coerced to full-corpus TRUSTED.\n if (!Array.isArray(value) || value.some((p) => typeof p !== \"string\")) {\n throw new HandlerError(\n 500,\n `${opts.surface}: the \\`principals\\` dependency must return a list of ` +\n `principal strings, [] for an anonymous caller, or TRUSTED — got ${typeof value}.`,\n );\n }\n return value;\n}\n\nexport function authorizeAcl(requested: unknown, principals: string[] | null | Trusted): void {\n if (requested == null || principals == null || principals === TRUSTED) return;\n if (!Array.isArray(requested)) {\n throw new HandlerError(422, \"acl must be a list of principal strings\");\n }\n // TRUSTED was excluded above, so what remains is the plain list.\n const held = new Set(principals as string[]);\n const ungranted = [...new Set(requested.map(String))].filter((p) => !held.has(p)).sort();\n if (ungranted.length) {\n throw new HandlerError(403, `cannot grant access to principals you do not hold: ${ungranted}`);\n }\n}\n\nfunction asDict(obj: unknown): unknown {\n if (obj == null) return obj;\n if (typeof obj === \"object\" && typeof (obj as { toJSON?: () => unknown }).toJSON === \"function\") {\n return (obj as { toJSON: () => unknown }).toJSON();\n }\n return obj;\n}\n\nfunction zodError(err: z.ZodError): HandlerError {\n return new HandlerError(\n 422,\n err.issues.map((i) => ({ loc: i.path, msg: i.message, type: i.code })),\n );\n}\n\nasync function runIngest(engine: ContextEngineLike, kwargs: Record<string, unknown>): Promise<unknown> {\n try {\n return asDict(await engine.ingest(kwargs));\n } catch (exc) {\n if (exc instanceof TypeError || (exc instanceof Error && exc.name === \"TypeError\")) {\n throw new HandlerError(400, String(exc));\n }\n if (exc instanceof Error && exc.name === \"Error\" && /invalid|required/i.test(exc.message)) {\n throw new HandlerError(400, String(exc));\n }\n throw exc;\n }\n}\n\nexport async function handleIngestJson(\n engine: ContextEngineLike,\n payload: unknown,\n principals: unknown,\n): Promise<unknown> {\n const resolved = resolveRequestPrincipals(principals, { surface: \"handle_ingest_json\" });\n const parsed = ingestJsonRequestSchema.safeParse(payload);\n if (!parsed.success) throw zodError(parsed.error);\n const body = parsed.data;\n authorizeAcl(body.acl, resolved);\n return runIngest(engine, {\n text: body.text,\n name: body.name,\n description: body.description,\n sourceId: body.source_id,\n externalId: body.external_id,\n metaData: body.meta_data,\n acl: body.acl,\n mode: body.mode,\n extractStructured: body.extract_structured,\n batch: body.batch,\n });\n}\n\nexport async function handleIngestFile(\n engine: ContextEngineLike,\n opts: {\n content: Buffer | Uint8Array;\n filename: string | null | undefined;\n form: Record<string, unknown> | Map<string, unknown>;\n principals: unknown;\n },\n): Promise<unknown> {\n const resolved = resolveRequestPrincipals(opts.principals, { surface: \"handle_ingest_file\" });\n const form = opts.form instanceof Map ? Object.fromEntries(opts.form) : opts.form;\n const acl = formJson(form.acl);\n authorizeAcl(acl, resolved);\n return runIngest(engine, {\n content: opts.content,\n filename: opts.filename,\n name: formStr(form.name) || opts.filename,\n description: formStr(form.description),\n sourceId: formStr(form.source_id),\n externalId: formStr(form.external_id),\n metaData: formJson(form.meta_data),\n acl,\n mode: formStr(form.mode),\n extractStructured: formBool(form.extract_structured),\n batch: formBool(form.batch),\n });\n}\n\nexport async function handleListDocuments(\n engine: ContextEngineLike,\n opts: {\n sourceId: string | null | undefined;\n limit: number;\n cursor: string | null | undefined;\n principals: unknown;\n },\n): Promise<unknown> {\n const resolved = resolveRequestPrincipals(opts.principals, { surface: \"handle_list_documents\" });\n let parsedCursor: unknown = null;\n if (opts.cursor) {\n try {\n parsedCursor = JSON.parse(opts.cursor);\n } catch {\n throw new HandlerError(400, `invalid cursor: ${JSON.stringify(opts.cursor)}`);\n }\n }\n return engine.listDocuments({\n sourceId: opts.sourceId ?? null,\n principals: resolved,\n cursor: parsedCursor,\n limit: opts.limit,\n });\n}\n\nexport async function handleGetDocument(\n engine: ContextEngineLike,\n documentId: string,\n principals: unknown,\n): Promise<unknown> {\n const resolved = resolveRequestPrincipals(principals, { surface: \"handle_get_document\" });\n requireValidUuid(documentId);\n try {\n return await engine.getDocument(documentId, { principals: resolved });\n } catch (exc) {\n if (\n exc instanceof Error &&\n (exc.name === \"DocumentNotFoundError\" || exc instanceof TypeError === false)\n ) {\n const msg = String(exc);\n if (/not found/i.test(msg) || exc.name === \"DocumentNotFoundError\") {\n throw new HandlerError(404, msg.replace(/^Error:\\s*/, \"\"));\n }\n }\n throw exc;\n }\n}\n\nexport async function handleDeleteDocument(\n engine: ContextEngineLike,\n documentId: string,\n principals: unknown,\n): Promise<unknown> {\n const resolved = resolveRequestPrincipals(principals, { surface: \"handle_delete_document\" });\n requireValidUuid(documentId);\n try {\n await engine.deleteDocument(documentId, { principals: resolved });\n } catch (exc) {\n const msg = String(exc);\n if (/not found/i.test(msg) || (exc instanceof Error && exc.name === \"DocumentNotFoundError\")) {\n throw new HandlerError(404, msg.replace(/^Error:\\s*/, \"\"));\n }\n throw exc;\n }\n return { deleted: documentId };\n}\n\nexport async function handleUpdateDocument(\n engine: ContextEngineLike,\n documentId: string,\n payload: unknown,\n principals: unknown,\n): Promise<unknown> {\n const resolved = resolveRequestPrincipals(principals, { surface: \"handle_update_document\" });\n requireValidUuid(documentId);\n const parsed = documentPatchSchema.safeParse(payload);\n if (!parsed.success) throw zodError(parsed.error);\n const provided: Record<string, unknown> = {};\n const raw = payload as Record<string, unknown>;\n for (const key of [\"acl\", \"name\", \"description\", \"meta_data\"] as const) {\n if (Object.hasOwn(raw, key)) {\n provided[key === \"meta_data\" ? \"metaData\" : key] = raw[key];\n }\n }\n if (\"acl\" in provided) authorizeAcl(provided.acl, resolved);\n try {\n const changed = await engine.updateDocument(documentId, { principals: resolved, ...provided });\n return { changed };\n } catch (exc) {\n const msg = String(exc);\n if (/not found/i.test(msg) || (exc instanceof Error && exc.name === \"DocumentNotFoundError\")) {\n throw new HandlerError(404, msg.replace(/^Error:\\s*/, \"\"));\n }\n throw exc;\n }\n}\n\nexport async function handleSearch(\n engine: ContextEngineLike,\n payload: unknown,\n principals: unknown,\n): Promise<unknown> {\n const resolved = resolveRequestPrincipals(principals, { surface: \"handle_search\" });\n const parsed = searchRequestSchema.safeParse(payload);\n if (!parsed.success) throw zodError(parsed.error);\n const body = parsed.data;\n // Early, like every sibling document endpoint: a malformed id must be a\n // clean 400 here, not a Postgres 22P02 raised inside every search leg —\n // whose 400-vs-500 mapping would otherwise hang on the ENGLISH pg error\n // text, with the raw DatabaseError echoed to the caller.\n for (const did of body.document_ids ?? []) requireValidUuid(did);\n try {\n const result = await engine.search(body.query, {\n sourceIds: body.source_ids,\n documentIds: body.document_ids,\n principals: resolved,\n topK: body.top_k,\n mode: body.mode,\n compressToTokens: body.compress_to_tokens,\n });\n const hits = (result.hits ?? []).map((hit) => asDict(hit));\n return { hits, usage: result.usage };\n } catch (exc) {\n if (exc instanceof Error && /invalid|required|graph/i.test(exc.message)) {\n throw new HandlerError(400, String(exc));\n }\n throw exc;\n }\n}\n\nexport async function handleStats(\n engine: ContextEngineLike,\n sourceId: string | null | undefined,\n): Promise<unknown> {\n return engine.stats(sourceId ?? null);\n}\n","import { EngineActionError } from \"../errors.js\";\nimport { authorizeAcl, HandlerError, resolveRequestPrincipals } from \"../routing-core.js\";\nimport { TRUSTED, type Trusted } from \"../sentinels.js\";\nimport { aclVisible } from \"./acl.js\";\nimport {\n ApprovalExpired,\n ApprovalNotPending,\n type ApprovalRecord,\n listApprovals,\n resolveApproval,\n validateApprovalScope,\n} from \"./approval.js\";\nimport { ConfigTemplateError, configSchema, redactConfig, ToolConfig, type ToolKind } from \"./config.js\";\nimport { decryptDict, getSecretKey } from \"./crypto.js\";\nimport { EgressDenied } from \"./egress.js\";\nimport { MCPError, PromptevMCP } from \"./executors/mcp-client.js\";\nimport {\n allowPrivateEgress,\n deleteTool,\n executeTool,\n registerTool,\n type ToolEngine,\n testTool,\n updateTool,\n} from \"./governance.js\";\nimport {\n buildAuthorizeUrl,\n discoverOauthMetadata,\n exchangeCodeForToken,\n InMemoryPendingStore,\n type PendingStore,\n registerOauthClient,\n} from \"./mcp-oauth.js\";\n\nexport const MCP_OAUTH_CALLBACK_PATH = \"/mcp/oauth/callback\";\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\nfunction coerceUuid(value: string): string {\n if (!UUID_RE.test(String(value))) {\n throw new HandlerError(400, `invalid id: ${JSON.stringify(value)}`);\n }\n return value;\n}\n\nfunction toolRowPublic(\n row: Record<string, unknown>,\n opts: { template?: boolean; templateKey?: Buffer | null } = {},\n): Record<string, unknown> {\n const out: Record<string, unknown> = {\n id: String(row.id),\n name: row.name,\n kind: row.kind,\n description: row.description || \"\",\n source_id: row.source_id,\n acl: row.acl != null ? [...(row.acl as string[])] : null,\n requires_approval: row.requires_approval,\n approval_policy: row.approval_policy ?? {},\n enabled: row.enabled,\n // Engine-opaque user metadata — admin surface only (the agent-facing\n // listTools/searchTools views never carry it), returned in clear:\n // secrets belong in `config`.\n meta_data: row.meta_data ?? {},\n };\n // Editor mounts only (`configTemplate` — see createToolsHandlers): the\n // masked request template. A blob that cannot be decrypted (no key, or the\n // key rotated) degrades to `config_error` — never an exception, so ONE\n // broken row cannot make the whole listing (or its own delete) unreachable.\n if (opts.template && row.config_encrypted) {\n try {\n if (!opts.templateKey) throw new Error(\"no secret key configured\");\n out.config_redacted = redactConfig(\n String(row.kind),\n decryptDict(String(row.config_encrypted), opts.templateKey),\n );\n } catch {\n out.config_error = \"undecryptable\";\n }\n }\n return out;\n}\n\n/** The callback is PUBLIC and `message` can come straight from the query\n * string (`error_description`); unescaped it is reflected XSS on the\n * consumer's origin — the origin the popup posts an OAuth token to. */\nfunction escapeHtml(text: string): string {\n return text\n .replace(/&/g, \"&amp;\")\n .replace(/</g, \"&lt;\")\n .replace(/>/g, \"&gt;\")\n .replace(/\"/g, \"&quot;\")\n .replace(/'/g, \"&#x27;\");\n}\n\n/** `authorizeAcl` plus the tool-surface rule: an omitted or null `acl` is\n * UNRESTRICTED (visible to every principal, anonymous included), which on a\n * capability is the planting attack with a wider radius and no grant to\n * check. Documents may be public; a tool may be made public only by a\n * trusted mount. */\nfunction authorizeToolAcl(requested: unknown, principals: string[] | Trusted): void {\n if (requested == null && principals !== TRUSTED) {\n throw new HandlerError(\n 403,\n \"a tool without an acl is visible to every principal; only a trusted mount may register one — pass acl with principals you hold\",\n );\n }\n authorizeAcl(requested, principals);\n}\n\nfunction resolveCaller(value: unknown, surface: string): string[] | Trusted {\n // The sentinel passes through raw: `aclVisible`, the approval visibility\n // clause, and every delegating engine method understand it directly, and\n // collapsing to null here would re-trigger the engine's principals=null\n // deprecation on every request of a correctly configured trusted mount.\n return resolveRequestPrincipals(value, { surface });\n}\n\nfunction recordToDict(record: ApprovalRecord): Record<string, unknown> {\n return {\n id: record.id,\n tool_name: record.toolName,\n tool_args_frozen: record.toolArgsFrozen,\n source_id: record.sourceId,\n principals: record.principals,\n status: record.status,\n approver: record.approver,\n approver_meta: record.approverMeta,\n expires_at: record.expiresAt?.toISOString() ?? null,\n resolved_at: record.resolvedAt?.toISOString() ?? null,\n created_at: record.createdAt?.toISOString() ?? null,\n };\n}\n\nexport function popupCloseHtml(\n success: boolean,\n message: string,\n targetOrigin: string,\n tokenData: Record<string, unknown> | null = null,\n): string {\n const status = success ? \"success\" : \"error\";\n const payload: Record<string, unknown> = { type: `mcp-oauth-${status}`, message };\n if (tokenData && success) payload.token = tokenData;\n const encoded = Buffer.from(JSON.stringify(payload), \"utf8\").toString(\"base64\");\n const title = success ? \"Connected\" : \"Failed\";\n return (\n `<!DOCTYPE html><html><head><title>Context Engine MCP OAuth</title></head>` +\n `<body style=\"font-family:system-ui;text-align:center;padding:40px;\">` +\n `<h2>${title}</h2>` +\n `<p>${escapeHtml(message)}</p>` +\n `<p style=\"font-size:12px;\">This window will close automatically&hellip;</p>` +\n `<script>` +\n `try {` +\n ` var d = JSON.parse(atob(\"${encoded}\"));` +\n ` if (window.opener) window.opener.postMessage(d, \"${targetOrigin}\");` +\n `} catch (e) { console.error('postMessage error', e); }` +\n `setTimeout(function () { window.close(); }, 1500);` +\n `</script>` +\n `</body></html>`\n );\n}\n\nexport type ToolsHandlerEngine = ToolEngine & {\n registerTool?: (tc: ToolConfig) => Promise<string>;\n updateTool?: (id: string, opts: Record<string, unknown>) => Promise<ToolConfig>;\n deleteTool?: (id: string, opts?: Record<string, unknown>) => Promise<void>;\n testTool?: (tc: ToolConfig) => Promise<Record<string, unknown>>;\n executeTool?: (\n callName: string,\n args: Record<string, unknown> | null,\n opts?: Record<string, unknown>,\n ) => Promise<Record<string, unknown>>;\n hooks?: ToolEngine[\"hooks\"];\n};\n\nexport function createToolsHandlers(\n engine: ToolsHandlerEngine,\n opts: {\n redirectBaseUrl?: string;\n pendingStore?: PendingStore | null;\n /** Serve `config_redacted` (the masked request template) on the GET\n * routes. Defaults OFF: those routes serve the same ACL-visible\n * population that may EXECUTE a tool, and even the redacted template is\n * editor-facing metadata an agent caller has no business reading. Enable\n * only on a mount that genuinely fronts an editor/admin UI. */\n configTemplate?: boolean;\n } = {},\n) {\n const store: PendingStore = opts.pendingStore ?? new InMemoryPendingStore();\n const configTemplate = opts.configTemplate ?? false;\n // Resolved ONCE per request (not per row) and never throwing: a keyless\n // deployment still serves the listing (encrypted rows degrade to\n // `config_error` in toolRowPublic).\n // A MISSING key degrades silently — the supported keyless deployment. A\n // present-but-malformed key degrades too, but with a warning: without it\n // the two are indistinguishable, and config_error's documented recovery\n // (re-enter every config in full) destroys recoverable secrets when the\n // actual fix is repairing the env var.\n const templateKey = (): Buffer | null => {\n if (!configTemplate) return null;\n let key: Buffer;\n try {\n key = getSecretKey(engine.config);\n } catch {\n return null; // no key configured\n }\n if (key.length !== 32) {\n console.warn(\n `CE_SECRET_KEY is malformed: decoded to ${key.length} bytes, need 32; ` +\n `tool config templates will degrade to config_error`,\n );\n return null;\n }\n return key;\n };\n const redirectBaseUrl = (opts.redirectBaseUrl ?? \"\").replace(/\\/$/, \"\");\n let targetOrigin = \"\";\n try {\n if (redirectBaseUrl) targetOrigin = new URL(redirectBaseUrl).origin;\n } catch {\n targetOrigin = \"\";\n }\n const redirectUri = redirectBaseUrl ? `${redirectBaseUrl}${MCP_OAUTH_CALLBACK_PATH}` : \"\";\n\n return {\n async createTool(body: unknown, principals: unknown): Promise<Record<string, unknown>> {\n const caller = resolveCaller(principals, \"POST /tools\");\n const tc = ToolConfig.fromUnknown(body);\n authorizeToolAcl(tc.acl, caller);\n try {\n const toolId = engine.registerTool ? await engine.registerTool(tc) : await registerTool(engine, tc);\n return { id: toolId };\n } catch (exc) {\n if (exc instanceof ConfigTemplateError) throw new HandlerError(400, exc.message);\n if (exc instanceof Error && /canonicalFromConfig|kind=/.test(exc.message)) {\n throw new HandlerError(400, String(exc));\n }\n throw exc;\n }\n },\n\n async listToolsAdmin(\n query: { source_id?: string | null },\n principals: unknown,\n ): Promise<Record<string, unknown>> {\n const caller = resolveCaller(principals, \"GET /tools\");\n const params: unknown[] = [];\n let sql = `SELECT * FROM context_engine_tools`;\n if (query.source_id != null) {\n params.push(query.source_id);\n sql += ` WHERE source_id = $1`;\n }\n const result = await engine.pool.query(sql, params);\n const key = templateKey();\n const tools = result.rows\n .filter((row) => aclVisible(row.acl != null ? [...row.acl] : null, caller))\n .map((row) => toolRowPublic(row, { template: configTemplate, templateKey: key }));\n return { tools };\n },\n\n async getTool(toolId: string, principals: unknown): Promise<Record<string, unknown>> {\n const caller = resolveCaller(principals, \"GET /tools/{tool_id}\");\n const parsedId = coerceUuid(toolId);\n const result = await engine.pool.query(`SELECT * FROM context_engine_tools WHERE id = $1`, [parsedId]);\n const row = result.rows[0];\n if (!row || !aclVisible(row.acl != null ? [...row.acl] : null, caller)) {\n throw new HandlerError(404, `tool not found: ${toolId}`);\n }\n return toolRowPublic(row, { template: configTemplate, templateKey: templateKey() });\n },\n\n async updateToolRoute(\n toolId: string,\n body: Record<string, unknown>,\n principals: unknown,\n ): Promise<Record<string, unknown>> {\n const caller = resolveCaller(principals, \"PATCH /tools/{tool_id}\");\n coerceUuid(toolId);\n const fields: Record<string, unknown> = {};\n const map: Record<string, string> = {\n name: \"name\",\n kind: \"kind\",\n description: \"description\",\n config: \"config\",\n source_id: \"sourceId\",\n acl: \"acl\",\n requires_approval: \"requiresApproval\",\n approval_policy: \"approvalPolicy\",\n enabled: \"enabled\",\n meta_data: \"metaData\",\n };\n for (const [k, dest] of Object.entries(map)) {\n if (Object.hasOwn(body, k)) fields[dest] = body[k];\n }\n // An EXPLICIT null for a non-nullable column would be written verbatim\n // (a `\"kind\": null` row breaks every later resolve; a null\n // approval_policy would be silently coerced to {}, wiping the policy\n // with a 200) — reject it. Clear description/approval_policy with \"\"\n // and {} respectively.\n const wireName: Record<string, string> = {\n requiresApproval: \"requires_approval\",\n approvalPolicy: \"approval_policy\",\n metaData: \"meta_data\",\n };\n for (const field of [\n \"name\",\n \"kind\",\n \"description\",\n \"requiresApproval\",\n \"approvalPolicy\",\n \"enabled\",\n \"metaData\",\n ]) {\n if (field in fields && fields[field] == null) {\n throw new HandlerError(400, `${wireName[field] ?? field} cannot be null`);\n }\n }\n if (\"acl\" in fields) authorizeToolAcl(fields.acl, caller);\n try {\n const updated = engine.updateTool\n ? await engine.updateTool(toolId, { principals: caller, ...fields })\n : await updateTool(engine, toolId, { principals: caller, ...fields });\n return {\n id: updated.id,\n name: updated.name,\n kind: updated.kind,\n description: updated.description,\n source_id: updated.sourceId,\n acl: updated.acl,\n requires_approval: updated.requiresApproval,\n approval_policy: updated.approvalPolicy,\n enabled: updated.enabled,\n meta_data: updated.metaData,\n };\n } catch (exc) {\n // A config the caller must fix (unresolvable sentinel, kind change\n // with sentinels, undecryptable stored blob) — see governance.\n if (exc instanceof ConfigTemplateError) throw new HandlerError(400, exc.message);\n if (exc instanceof EngineActionError) throw new HandlerError(404, String(exc.message));\n throw exc;\n }\n },\n\n async deleteToolRoute(toolId: string, principals: unknown): Promise<Record<string, unknown>> {\n const caller = resolveCaller(principals, \"DELETE /tools/{tool_id}\");\n coerceUuid(toolId);\n try {\n if (engine.deleteTool) await engine.deleteTool(toolId, { principals: caller });\n else await deleteTool(engine, toolId, { principals: caller });\n } catch (exc) {\n if (exc instanceof EngineActionError) throw new HandlerError(404, String(exc.message));\n throw exc;\n }\n return { deleted: toolId };\n },\n\n async testToolRoute(body: unknown): Promise<Record<string, unknown>> {\n const tc = ToolConfig.fromUnknown(body);\n try {\n return await (engine.testTool ? engine.testTool(tc) : testTool(engine, tc));\n } catch (exc) {\n // A sentinel-bearing config would probe the REAL endpoint with the\n // literal placeholder as its credential — same 400 as POST /tools.\n if (exc instanceof ConfigTemplateError) throw new HandlerError(400, exc.message);\n throw exc;\n }\n },\n\n toolSchemaRoute(kind: string): Record<string, unknown> {\n try {\n return configSchema(kind as ToolKind);\n } catch {\n throw new HandlerError(404, `unknown tool kind: ${JSON.stringify(kind)}`);\n }\n },\n\n /**\n * `approvalScope` is resolved by the adapter's `approvalScope` option —\n * SERVER-SIDE, never from the body. A body key of the same name is\n * ignored exactly like a body `principals`: a client that could name\n * its own scope could claim another scope's approvals. Absent, the\n * execution runs unscoped (the deprecated legacy path). A malformed\n * scope is the host's wiring bug, so it surfaces as a 500, never a 4xx\n * the client might \"fix\" by changing its body.\n */\n async executeToolRoute(\n body: { call_name?: string; args?: Record<string, unknown> | null; source_id?: string | null },\n principals: unknown,\n approvalScope: unknown = null,\n ): Promise<Record<string, unknown>> {\n const caller = resolveCaller(principals, \"POST /tools/execute\");\n if (!body.call_name) throw new HandlerError(422, \"call_name is required\");\n let scope: string | null;\n try {\n scope = validateApprovalScope(approvalScope);\n } catch (exc) {\n throw new HandlerError(500, `approvalScope resolver: ${(exc as Error).message}`);\n }\n try {\n const exec = engine.executeTool ?? ((n, a, o) => executeTool(engine, n, a, o));\n return await exec(body.call_name, body.args ?? null, {\n sourceId: body.source_id,\n principals: caller,\n approvalScope: scope,\n });\n } catch (exc) {\n if (exc instanceof EngineActionError) throw new HandlerError(404, String(exc.message));\n throw exc;\n }\n },\n\n async mcpConnectAndList(body: {\n server_name: string;\n url: string;\n token?: string | null;\n headers?: Record<string, string> | null;\n include_resources?: boolean;\n }): Promise<Record<string, unknown>> {\n const mcp = new PromptevMCP({ allowPrivate: allowPrivateEgress(engine) });\n try {\n await mcp.addServer(body.server_name, body.url, { token: body.token, headers: body.headers });\n const client = mcp.clients.get(body.server_name);\n const tools = await client.listTools();\n const resources = body.include_resources ? await client.listResources() : null;\n return {\n server: body.server_name,\n url: client.url,\n transport: client.transport.kind,\n tools,\n resources,\n requires_oauth: false,\n };\n } catch (exc) {\n // 400, not 403 and not 502: the URL arrived in THIS request body, and\n // it is the request that is wrong — the caller's identity grants\n // nothing here (no principal may reach the metadata service) and no\n // upstream server was ever spoken to. Same refusal the http probe\n // reports as `{ ok: false, error: \"egress_denied\" }`, in the shape a\n // route has for a bad body. Checked FIRST: the message can carry\n // digits the 401/403 heuristic below would misread.\n if (exc instanceof EgressDenied) throw new HandlerError(400, String(exc.message));\n const msg = String(exc);\n const statusMatch = /HTTP (401|403)/.exec(msg);\n if (statusMatch || /401|403/.test(msg)) {\n // The fallback discovers OAuth on the SAME caller-supplied URL, so\n // it can be denied for the same reason the connect can — and this\n // call sits INSIDE the catch, past the `EgressDenied` branch above,\n // so an unmapped refusal here left the handler throwing raw.\n let metadata: Record<string, unknown> | null;\n try {\n metadata = await discoverOauthMetadata(body.url, {\n hooks: engine.hooks,\n allowPrivate: allowPrivateEgress(engine),\n });\n } catch (denied) {\n if (denied instanceof EgressDenied) throw new HandlerError(400, String(denied.message));\n throw denied;\n }\n if (metadata) {\n return {\n server: body.server_name,\n url: body.url,\n transport: \"pending_oauth\",\n tools: [],\n resources: null,\n requires_oauth: true,\n };\n }\n throw new HandlerError(\n 502,\n `MCP server returned ${statusMatch?.[1] ?? \"401/403\"}. No OAuth endpoint found — provide a Bearer token instead.`,\n );\n }\n if (exc instanceof MCPError) throw new HandlerError(502, `MCP protocol error: ${exc}`);\n throw new HandlerError(502, `Cannot reach MCP server: ${exc}`);\n } finally {\n await mcp.shutdown();\n }\n },\n\n async mcpOauthStart(body: {\n server_url: string;\n tool_id?: string | null;\n client_id?: string | null;\n client_secret?: string | null;\n scopes?: string | null;\n }): Promise<Record<string, unknown>> {\n if (!redirectUri) {\n throw new HandlerError(500, \"redirectBaseUrl is required to start MCP OAuth\");\n }\n let metadata: Record<string, unknown> | null;\n try {\n metadata = await discoverOauthMetadata(body.server_url, {\n hooks: engine.hooks,\n allowPrivate: allowPrivateEgress(engine),\n });\n } catch (exc) {\n if (exc instanceof EgressDenied) throw new HandlerError(400, String(exc.message));\n throw exc;\n }\n if (!metadata) {\n throw new HandlerError(502, \"MCP server does not support OAuth — no authorization endpoint found\");\n }\n let clientId = body.client_id ?? null;\n let clientSecret = body.client_secret ?? null;\n if (!clientId && metadata.registration_endpoint) {\n try {\n const reg = await registerOauthClient(\n String(metadata.registration_endpoint),\n redirectUri,\n \"Promptev Context Engine\",\n { hooks: engine.hooks, allowPrivate: allowPrivateEgress(engine) },\n );\n clientId = (reg.client_id as string | undefined) ?? null;\n clientSecret = (reg.client_secret as string | undefined) || clientSecret;\n } catch (exc) {\n // A server pointing `registration_endpoint` at an internal address\n // must not look like a server that simply does not do DCR.\n if (exc instanceof EgressDenied) throw new HandlerError(400, String(exc.message));\n /* DCR optional */\n }\n }\n try {\n return await buildAuthorizeUrl(metadata, body.server_url, body.tool_id || \"\", redirectUri, store, {\n clientId,\n clientSecret,\n scopes: body.scopes,\n });\n } catch (exc) {\n throw new HandlerError(400, String(exc));\n }\n },\n\n async mcpOauthCallback(query: {\n code?: string | null;\n state?: string | null;\n error?: string | null;\n error_description?: string | null;\n }): Promise<{ html: string; contentType: string }> {\n const html = (success: boolean, message: string, token: Record<string, unknown> | null = null) =>\n popupCloseHtml(success, message, targetOrigin, token);\n if (query.error) {\n return { html: html(false, query.error_description || query.error), contentType: \"text/html\" };\n }\n if (!query.code || !query.state) {\n return { html: html(false, \"Missing code or state parameter\"), contentType: \"text/html\" };\n }\n try {\n const tokenResult = await exchangeCodeForToken(query.state, query.code, store, {\n hooks: engine.hooks,\n allowPrivate: allowPrivateEgress(engine),\n });\n return {\n html: html(true, \"Connected successfully\", {\n access_token: tokenResult.access_token,\n refresh_token: tokenResult.refresh_token,\n token_type: tokenResult.token_type ?? \"Bearer\",\n expires_in: tokenResult.expires_in,\n scope: tokenResult.scope,\n tool_id: tokenResult.tool_id,\n }),\n contentType: \"text/html\",\n };\n } catch (exc) {\n return { html: html(false, String(exc)), contentType: \"text/html\" };\n }\n },\n\n async listApprovalsRoute(\n query: { status?: string | null; source_id?: string | null },\n principals: unknown,\n ): Promise<Record<string, unknown>> {\n const caller = resolveCaller(principals, \"GET /approvals\");\n const records = await listApprovals(engine, {\n status: query.status,\n sourceId: query.source_id,\n principals: caller,\n });\n return { approvals: records.map(recordToDict) };\n },\n\n async resolveApprovalRoute(\n approvalId: string,\n body: { decision: \"approved\" | \"rejected\"; approver: string; meta?: Record<string, unknown> | null },\n principals: unknown,\n ): Promise<Record<string, unknown>> {\n const caller = resolveCaller(principals, \"POST /approvals/{approval_id}/resolve\");\n const parsedId = coerceUuid(approvalId);\n try {\n const record = await resolveApproval(\n engine,\n parsedId,\n body.decision,\n body.approver,\n body.meta ?? null,\n {\n principals: caller,\n },\n );\n return recordToDict(record);\n } catch (exc) {\n if (exc instanceof ApprovalNotPending) {\n throw new HandlerError(404, `approval not pending: ${exc.message}`);\n }\n if (exc instanceof ApprovalExpired) {\n throw new HandlerError(409, \"approval expired\");\n }\n throw exc;\n }\n },\n };\n}\n\nexport type ToolsHandlers = ReturnType<typeof createToolsHandlers>;\n","import { TRUSTED, type Trusted } from \"../sentinels.js\";\n\nexport function aclVisible(\n acl: string[] | null | undefined,\n principals: string[] | null | undefined | Trusted,\n): boolean {\n // `null` is the trusted internal caller; the TRUSTED sentinel (what a\n // trusted router mount resolves to) means exactly the same thing.\n if (principals === null || principals === TRUSTED) return true;\n if (acl == null) return true;\n if (!acl.length) return false;\n const held = new Set((principals as string[] | undefined) ?? []);\n return acl.some((p) => held.has(p));\n}\n","import { randomUUID } from \"node:crypto\";\nimport { ApprovalExpired, ApprovalNotPending } from \"../errors.js\";\nimport { TRUSTED, type Trusted } from \"../sentinels.js\";\nimport { aclVisible } from \"./acl.js\";\nimport type { CanonicalTool } from \"./registry.js\";\n\nexport { ApprovalExpired, ApprovalNotPending };\n\nexport const DEFAULT_TIMEOUT_MINUTES = 60;\nexport const DEFAULT_LIST_LIMIT = 50;\nexport const MAX_LIST_LIMIT = 200;\n\nconst CONDITION_RE = /^\\s*(?<field>[A-Za-z_][A-Za-z0-9_.]*)\\s*(?<op>>=|<=|==|!=|>|<)\\s*(?<value>.+?)\\s*$/;\n\nexport interface ApprovalRecord {\n id: string;\n toolName: string;\n toolArgsFrozen: Record<string, unknown>;\n sourceId: string | null;\n approvalScope: string | null;\n principals: unknown;\n status: string;\n approver: string | null;\n approverMeta: Record<string, unknown> | null;\n expiresAt: Date | null;\n resolvedAt: Date | null;\n createdAt: Date | null;\n}\n\ntype EngineLike = {\n pool: {\n query: (\n sql: string,\n params?: unknown[],\n ) => Promise<{ rows: Array<Record<string, unknown>>; rowCount?: number | null }>;\n };\n};\n\nfunction coerceValue(raw: string): unknown {\n const trimmed = raw.trim();\n if (\n trimmed.length >= 2 &&\n trimmed[0] === trimmed[trimmed.length - 1] &&\n (trimmed[0] === \"'\" || trimmed[0] === '\"')\n ) {\n return trimmed.slice(1, -1);\n }\n if (/^-?\\d+$/.test(trimmed)) return Number.parseInt(trimmed, 10);\n if (/^-?\\d+\\.\\d+$/.test(trimmed)) return Number.parseFloat(trimmed);\n return trimmed;\n}\n\nfunction evaluateCondition(condition: unknown, args: Record<string, unknown>): boolean {\n if (typeof condition !== \"string\") return true;\n const match = CONDITION_RE.exec(condition);\n if (!match?.groups) return true;\n const fieldName = match.groups.field!;\n const op = match.groups.op!;\n if (!(fieldName in args)) return true;\n const left = args[fieldName];\n const right = coerceValue(match.groups.value!);\n try {\n switch (op) {\n case \">\":\n return (left as number) > (right as number);\n case \">=\":\n return (left as number) >= (right as number);\n case \"<\":\n return (left as number) < (right as number);\n case \"<=\":\n return (left as number) <= (right as number);\n case \"==\":\n return left === right;\n case \"!=\":\n return left !== right;\n default:\n return true;\n }\n } catch {\n return true;\n }\n}\n\nexport function shouldRequireApproval(\n ct: Pick<CanonicalTool, \"requiresApproval\" | \"approvalPolicy\">,\n args: Record<string, unknown>,\n): boolean {\n if (ct.requiresApproval) return true;\n const policy = ct.approvalPolicy ?? {};\n const condition = policy.condition;\n if (!condition) return false;\n return evaluateCondition(condition, args ?? {});\n}\n\nfunction rowToRecord(row: Record<string, unknown>): ApprovalRecord {\n return {\n id: String(row.id),\n toolName: String(row.tool_name),\n toolArgsFrozen: (row.tool_args_frozen as Record<string, unknown>) ?? {},\n sourceId: (row.source_id as string | null) ?? null,\n approvalScope: (row.approval_scope as string | null) ?? null,\n principals: row.principals,\n status: String(row.status),\n approver: (row.approver as string | null) ?? null,\n approverMeta: (row.approver_meta as Record<string, unknown> | null) ?? null,\n expiresAt: toDate(row.expires_at),\n resolvedAt: toDate(row.resolved_at),\n createdAt: toDate(row.created_at),\n };\n}\n\n/**\n * `pg` hands TIMESTAMPTZ columns back as `Date` objects already. Routing one\n * through `new Date(String(date))` re-parses its locale string, which has NO\n * milliseconds — so a record read back from the database carried an\n * `expiresAt` up to 999ms earlier than the one returned at insert time. The\n * dedupe path (`findOrCreatePending`) returns read-back records to callers\n * that park on `expires_at`, which is where the drift became visible.\n */\nfunction toDate(value: unknown): Date | null {\n if (value == null) return null;\n if (value instanceof Date) return value;\n return new Date(String(value));\n}\n\nfunction visibilitySql(\n principals: string[] | null | Trusted,\n paramIndex: number,\n): { sql: string; params: unknown[] } {\n // `null` is the trusted internal caller; the TRUSTED sentinel (what a\n // trusted router mount resolves to) means the same thing — no filter.\n if (principals === null || principals === TRUSTED) return { sql: \"TRUE\", params: [] };\n principals = principals as string[];\n if (!principals.length) {\n return { sql: `(principals IS NULL OR principals = 'null'::jsonb)`, params: [] };\n }\n return {\n sql: `(principals IS NULL OR principals = 'null'::jsonb OR principals ?| $${paramIndex}::text[])`,\n params: [principals],\n };\n}\n\n/**\n * The principals wall for CLAIMING an approved record\n * (governance `findAndClaimApproved`) — `visibilitySql` plus one addition: a\n * record that carries NO principals imposes no wall. \"No principals\" is two\n * spellings and both count: `null` (a trusted caller opened it — public,\n * already in the base clause) and `[]` (an anonymous caller opened it). The\n * base clause treats `[]` as a real, empty ACL nobody overlaps — right for\n * `resolveApproval`, where an approver is never anonymous, but wrong here:\n * an anonymous caller must be able to re-drive its own approved call. The\n * scope (`approval_scope`) is the primary wall; this one only applies when\n * the record carries principals to check against.\n */\nexport function claimVisibilitySql(\n principals: string[] | null | Trusted,\n paramIndex: number,\n): { sql: string; params: unknown[] } {\n if (principals === null || principals === TRUSTED) return { sql: \"TRUE\", params: [] };\n const noWall = `principals IS NULL OR principals = 'null'::jsonb OR principals = '[]'::jsonb`;\n principals = principals as string[];\n if (!principals.length) return { sql: `(${noWall})`, params: [] };\n return { sql: `(${noWall} OR principals ?| $${paramIndex}::text[])`, params: [principals] };\n}\n\n/**\n * `null`/`undefined` (unscoped, legacy) passes through as `null`; anything\n * else must be a non-empty string. The scope is opaque — never parsed — but\n * a wrong type or an empty string is a wiring bug at the host, and letting\n * it through would silently open unclaimable or wrongly-shared records.\n */\nexport function validateApprovalScope(approvalScope: unknown): string | null {\n if (approvalScope === null || approvalScope === undefined) return null;\n if (typeof approvalScope !== \"string\") {\n throw new TypeError(`approvalScope must be a non-empty string or null, got ${typeof approvalScope}`);\n }\n if (!approvalScope) throw new Error(\"approvalScope must be a non-empty string or null, got ''\");\n return approvalScope;\n}\n\ntype PendingOpts = {\n toolName: string;\n args: Record<string, unknown>;\n sourceId?: string | null;\n principals?: unknown;\n policy?: Record<string, unknown>;\n now?: Date;\n approvalScope?: string | null;\n};\n\nfunction pendingRow(opts: PendingOpts, approvalScope: string | null) {\n const policy = opts.policy ?? {};\n const frozen = structuredClone(opts.args);\n const createdAt = opts.now ?? new Date();\n const timeout = Number(policy.timeout_minutes ?? DEFAULT_TIMEOUT_MINUTES);\n const expiresAt = new Date(createdAt.getTime() + timeout * 60_000);\n // The sentinel must NEVER be persisted (JSON.stringify(TRUSTED) is\n // `{}`): a trusted caller's approval is stored as NULL — public —\n // exactly what the Python port stores for a resolved trusted caller.\n const principals = opts.principals === undefined || opts.principals === TRUSTED ? null : opts.principals;\n return { frozen, createdAt, expiresAt, principals, approvalScope };\n}\n\nasync function insertPending(\n engine: EngineLike,\n opts: PendingOpts,\n row: ReturnType<typeof pendingRow>,\n): Promise<ApprovalRecord> {\n const id = randomUUID();\n await engine.pool.query(\n `INSERT INTO context_engine_tool_approvals\n (id, tool_name, tool_args_frozen, source_id, approval_scope, principals, status, expires_at, created_at)\n VALUES ($1,$2,$3::jsonb,$4,$5,$6::jsonb,'pending',$7,$8)`,\n [\n id,\n opts.toolName,\n JSON.stringify(row.frozen),\n opts.sourceId ?? null,\n row.approvalScope,\n row.principals === null ? null : JSON.stringify(row.principals),\n row.expiresAt,\n row.createdAt,\n ],\n );\n return {\n id,\n toolName: opts.toolName,\n toolArgsFrozen: row.frozen,\n sourceId: opts.sourceId ?? null,\n approvalScope: row.approvalScope,\n principals: row.principals,\n status: \"pending\",\n approver: null,\n approverMeta: null,\n expiresAt: row.expiresAt,\n resolvedAt: null,\n createdAt: row.createdAt,\n };\n}\n\n/**\n * Persist a new `pending` approval, FREEZING a deep copy of `args`. This is\n * the unconditional-insert primitive: `approvalScope` is stamped as given,\n * never deduped. The scoped execution path goes through\n * `findOrCreatePending` instead; this is what the unscoped (legacy) path\n * uses, and what tests reach for when they want N distinct rows.\n */\nexport async function createPending(engine: EngineLike, opts: PendingOpts): Promise<ApprovalRecord> {\n const approvalScope = validateApprovalScope(opts.approvalScope);\n return insertPending(engine, opts, pendingRow(opts, approvalScope));\n}\n\n/**\n * The scoped path's pending record: ONE per (tool, scope, frozen args).\n *\n * 1. Sweep — flip any `pending` row for this exact call whose `expires_at`\n * has passed to `expired`. Rows only expire lazily in this module, and an\n * expired pending row would otherwise sit under the unique index below\n * and block every new request for the same call forever.\n * 2. Find — return the surviving unexpired `pending` row if there is one.\n * This is the dedupe: a retrying agent loop gets the SAME approval id\n * (and the same `expires_at`) back, not a fresh row per retry.\n * 3. Insert — otherwise open a new row.\n *\n * Steps 2 and 3 are a read-then-write race, so the database enforces it: the\n * partial unique index `ux_context_engine_tool_approvals_pending_scope`\n * (0004_acl_indexes.sql) covers exactly (tool_name, approval_scope,\n * md5(tool_args_frozen::text)) WHERE status = 'pending'. Of N concurrent\n * identical calls exactly one INSERT commits; every loser sees a unique\n * violation (`23505`) and re-reads the winner's row. The lookup compares\n * `tool_args_frozen` as jsonb (semantic equality), which is the same\n * equivalence the index hashes, because jsonb's text form is canonical.\n *\n * Dedupe is on scope + tool + args and NOTHING less — never on tool + args\n * alone, or every caller's identical call would collapse into one decision.\n * `principals` and `sourceId` are stamped but are not part of the key,\n * since a scope is expected to belong to one caller.\n */\nexport async function findOrCreatePending(\n engine: EngineLike,\n opts: PendingOpts & { approvalScope: string },\n): Promise<ApprovalRecord> {\n const approvalScope = validateApprovalScope(opts.approvalScope);\n if (approvalScope === null)\n throw new Error(\"findOrCreatePending requires an approvalScope; use createPending\");\n const row = pendingRow(opts, approvalScope);\n const frozenJson = JSON.stringify(row.frozen);\n const sameCall = `tool_name = $1 AND approval_scope = $2 AND tool_args_frozen = $3::jsonb`;\n const params = [opts.toolName, approvalScope, frozenJson, row.createdAt];\n\n // (1) Sweep.\n await engine.pool.query(\n `UPDATE context_engine_tool_approvals SET status = 'expired'\n WHERE ${sameCall} AND status = 'pending' AND expires_at <= $4`,\n params,\n );\n\n // Two rounds: a loser of the INSERT race re-reads the winner; if the\n // winner was resolved in the gap, the second round inserts afresh.\n for (let attempt = 0; attempt < 2; attempt++) {\n // (2) Find.\n const found = await engine.pool.query(\n `SELECT * FROM context_engine_tool_approvals\n WHERE ${sameCall} AND status = 'pending' AND (expires_at IS NULL OR expires_at > $4)\n ORDER BY created_at ASC LIMIT 1`,\n params,\n );\n if (found.rows[0]) return rowToRecord(found.rows[0]);\n // (3) Insert.\n try {\n return await insertPending(engine, opts, row);\n } catch (exc) {\n if ((exc as { code?: string })?.code !== \"23505\") throw exc;\n }\n }\n throw new Error(\"findOrCreatePending: lost the insert race twice and found no live pending row\");\n}\n\nexport async function resolveApproval(\n engine: EngineLike,\n approvalId: string,\n decision: \"approved\" | \"rejected\",\n approver: string,\n meta: Record<string, unknown> | null = null,\n opts: { principals?: string[] | null | Trusted } = {},\n): Promise<ApprovalRecord> {\n if (decision !== \"approved\" && decision !== \"rejected\") {\n throw new Error(`invalid decision: ${JSON.stringify(decision)} (expected 'approved' or 'rejected')`);\n }\n const principals = opts.principals === undefined ? null : opts.principals;\n const vis = visibilitySql(principals, 5);\n const result = await engine.pool.query(\n `UPDATE context_engine_tool_approvals\n SET status = $1, approver = $2, approver_meta = $3::jsonb, resolved_at = now()\n WHERE id = $4 AND status = 'pending'\n AND (expires_at IS NULL OR expires_at > now())\n AND ${vis.sql}\n RETURNING *`,\n [decision, approver, JSON.stringify(meta ?? {}), approvalId, ...vis.params],\n );\n if (result.rowCount === 1) return rowToRecord(result.rows[0]!);\n\n const existing = await engine.pool.query(`SELECT * FROM context_engine_tool_approvals WHERE id = $1`, [\n approvalId,\n ]);\n const row = existing.rows[0];\n const rowPrincipals =\n row?.principals == null || row.principals === null ? null : (row.principals as string[]);\n if (!row || !aclVisible(Array.isArray(rowPrincipals) ? rowPrincipals : null, principals)) {\n throw new ApprovalNotPending(\"not_found\");\n }\n if (row.status === \"pending\") {\n await engine.pool.query(\n `UPDATE context_engine_tool_approvals SET status = 'expired' WHERE id = $1 AND status = 'pending'`,\n [approvalId],\n );\n throw new ApprovalExpired();\n }\n throw new ApprovalNotPending(String(row.status));\n}\n\nexport async function getApproval(engine: EngineLike, approvalId: string): Promise<ApprovalRecord | null> {\n const result = await engine.pool.query(`SELECT * FROM context_engine_tool_approvals WHERE id = $1`, [\n approvalId,\n ]);\n return result.rows[0] ? rowToRecord(result.rows[0]) : null;\n}\n\nexport async function listApprovals(\n engine: EngineLike,\n opts: {\n status?: string | null;\n sourceId?: string | null;\n limit?: number;\n principals?: string[] | null | Trusted;\n approvalScope?: string | null;\n } = {},\n): Promise<ApprovalRecord[]> {\n const limit = Math.max(1, Math.min(Number(opts.limit || DEFAULT_LIST_LIMIT), MAX_LIST_LIMIT));\n const principals = opts.principals === undefined ? null : opts.principals;\n const params: unknown[] = [];\n const clauses: string[] = [];\n if (opts.status != null) {\n params.push(opts.status);\n clauses.push(`status = $${params.length}`);\n }\n if (opts.sourceId != null) {\n params.push(opts.sourceId);\n clauses.push(`source_id = $${params.length}`);\n }\n if (opts.approvalScope != null) {\n params.push(opts.approvalScope);\n clauses.push(`approval_scope = $${params.length}`);\n }\n const vis = visibilitySql(principals, params.length + 1);\n clauses.push(vis.sql);\n params.push(...vis.params);\n params.push(limit);\n const result = await engine.pool.query(\n `SELECT * FROM context_engine_tool_approvals\n WHERE ${clauses.join(\" AND \")}\n ORDER BY created_at DESC\n LIMIT $${params.length}`,\n params,\n );\n return result.rows.map(rowToRecord);\n}\n","export type ToolKind = \"http\" | \"db\" | \"mcp\" | \"function\";\n\nconst KINDS: readonly ToolKind[] = [\"http\", \"db\", \"mcp\", \"function\"];\n\nexport interface ToolConfigInit {\n id?: string | null;\n name: string;\n kind: ToolKind;\n description?: string;\n config?: Record<string, unknown>;\n sourceId?: string | null;\n source_id?: string | null;\n acl?: string[] | null;\n requiresApproval?: boolean;\n requires_approval?: boolean;\n approvalPolicy?: Record<string, unknown>;\n approval_policy?: Record<string, unknown>;\n enabled?: boolean;\n metaData?: Record<string, unknown>;\n meta_data?: Record<string, unknown>;\n}\n\n/**\n * Caller-facing shape for registering a tool. Kind-specific `config` is\n * opaque here and encrypted at rest by governance when it holds secrets.\n */\nexport class ToolConfig {\n id: string | null;\n name: string;\n kind: ToolKind;\n description: string;\n config: Record<string, unknown>;\n sourceId: string | null;\n acl: string[] | null;\n requiresApproval: boolean;\n approvalPolicy: Record<string, unknown>;\n enabled: boolean;\n /** Engine-opaque user metadata (documents have the same column). Stored\n * and returned in CLEAR on the admin surface only — secrets go in\n * `config`, which is encrypted. */\n metaData: Record<string, unknown>;\n\n constructor(init: ToolConfigInit) {\n this.id = init.id ?? null;\n this.name = init.name;\n this.kind = init.kind;\n this.description = init.description ?? \"\";\n this.config = init.config ?? {};\n this.sourceId = init.sourceId ?? init.source_id ?? null;\n this.acl = init.acl ?? null;\n this.requiresApproval = init.requiresApproval ?? init.requires_approval ?? false;\n this.approvalPolicy = init.approvalPolicy ?? init.approval_policy ?? {};\n this.enabled = init.enabled ?? true;\n this.metaData = init.metaData ?? init.meta_data ?? {};\n }\n\n static fromUnknown(body: unknown): ToolConfig {\n if (!body || typeof body !== \"object\" || Array.isArray(body)) {\n throw new Error(\"tool config must be an object\");\n }\n const b = body as Record<string, unknown>;\n const kind = String(b.kind ?? \"\") as ToolKind;\n if (!KINDS.includes(kind)) {\n throw new Error(`canonicalFromConfig does not support kind=${JSON.stringify(b.kind)}`);\n }\n const name = String(b.name ?? \"\").trim();\n if (!name) throw new Error(\"name is required\");\n return new ToolConfig({\n id: b.id != null ? String(b.id) : null,\n name,\n kind,\n description: b.description != null ? String(b.description) : \"\",\n config: (b.config as Record<string, unknown> | undefined) ?? {},\n sourceId: (b.sourceId ?? b.source_id) as string | null | undefined,\n acl: (b.acl as string[] | null | undefined) ?? null,\n requiresApproval: Boolean(b.requiresApproval ?? b.requires_approval ?? false),\n approvalPolicy: (b.approvalPolicy ?? b.approval_policy ?? {}) as Record<string, unknown>,\n enabled: b.enabled === undefined ? true : Boolean(b.enabled),\n metaData: (b.metaData ?? b.meta_data ?? {}) as Record<string, unknown>,\n });\n }\n}\n\nconst SCHEMAS: Record<ToolKind, Record<string, unknown>> = {\n http: {\n type: \"object\",\n properties: {\n url: { type: \"string\", description: \"Endpoint URL, may contain {path} params\" },\n method: {\n type: \"string\",\n enum: [\"GET\", \"POST\", \"PUT\", \"PATCH\", \"DELETE\"],\n default: \"GET\",\n },\n headers: {\n type: \"object\",\n additionalProperties: { type: \"string\" },\n writeOnly: true,\n },\n // The request body TEMPLATE (the http executor reads it). Whether it\n // round-trips is the USER's call — see `body_secret` and the\n // conditional in `redactConfig`; listing it documents the shape, the\n // redactor decides.\n body: {\n description: \"Request body template; top-level keys merge with LLM parameters\",\n },\n // Salman (2026-08-18): \"give checkbox to user\" — the author declares\n // whether their body carries secrets. True (or ABSENT — every pre-flag\n // row, fail closed) masks body values like headers; an explicit false\n // round-trips the body in clear like `url`. The flag round-trips.\n body_secret: {\n type: \"boolean\",\n description: \"Body values are write-only (mask like headers)\",\n },\n parameters: {\n type: \"object\",\n description: \"Static/user-fixed parameters sent on every call\",\n // The canonical home of a static api_key — secret by position.\n writeOnly: true,\n },\n llmParameters: {\n type: \"object\",\n description: \"JSON-Schema-shaped parameters the LLM fills in per call\",\n },\n llmQueryParameters: {\n type: \"object\",\n description: \"LLM-filled parameters sent as the query string\",\n },\n },\n required: [\"url\", \"method\"],\n },\n db: {\n type: \"object\",\n properties: {\n engine: {\n type: \"string\",\n enum: [\"postgresql\", \"mysql\", \"mariadb\", \"mssql\", \"sqlite\", \"oracle\", \"clickhouse\", \"snowflake\"],\n },\n host: { type: \"string\" },\n port: { type: \"integer\" },\n database: { type: \"string\" },\n username: { type: \"string\" },\n password: { type: \"string\", writeOnly: true },\n access_mode: {\n type: \"string\",\n enum: [\"readonly\", \"readwrite\", \"full\"],\n default: \"readonly\",\n },\n max_rows: { type: \"integer\", default: 1000 },\n selected_tables: { type: \"array\", items: { type: \"string\" } },\n // Dialect connection identifiers the db executor reads — same\n // sensitivity class as `database`, listed so they round-trip instead\n // of dying to redactConfig's default-deny.\n service_name: { type: \"string\" },\n schema_name: { type: \"string\" },\n warehouse: { type: \"string\" },\n },\n required: [\"engine\", \"database\"],\n },\n mcp: {\n type: \"object\",\n properties: {\n url: { type: \"string\" },\n transport: { type: \"string\", enum: [\"sse\", \"http\", \"websocket\"] },\n oauth: {\n type: \"object\",\n description: \"Discovered OAuth config, if any\",\n writeOnly: true,\n },\n headers: {\n type: \"object\",\n additionalProperties: { type: \"string\" },\n writeOnly: true,\n },\n },\n required: [\"url\", \"transport\"],\n },\n function: {\n type: \"object\",\n properties: {},\n },\n};\n\nexport function configSchema(kind: ToolKind): Record<string, unknown> {\n const schema = SCHEMAS[kind];\n if (!schema) throw new Error(`unknown tool kind: ${JSON.stringify(kind)}`);\n return schema;\n}\n\n// ---------------------------------------------------------------------------\n// Redacted round-trip — mirror of tools/config.py, invariant by invariant.\n//\n// The schema above says which fields round-trip: everything NOT marked\n// `writeOnly` passes through AS STORED, and only because the schema says so —\n// a key the schema does not know (an off-schema `body`, a kind outside the\n// map) is masked, never passed through. Fail closed: `kind` is an\n// unconstrained column, and the executors read keys the schema never listed.\n// Every masked VALUE leaves the server only as this sentinel; an incoming\n// sentinel means \"keep what's stored\", never \"literally this string\".\n// ---------------------------------------------------------------------------\n\nexport const REDACTED_SENTINEL = \"__redacted__\";\n\n/** A config the caller must fix — an unresolvable sentinel, a template\n * registered as a new tool, an undecryptable stored blob. Routers map it to\n * 400, mirroring Python's ValueError contract on the same paths. */\nexport class ConfigTemplateError extends Error {}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction maskValue(value: unknown): unknown {\n // Container SHAPE survives (dict keys, list length) so a form can show\n // which entries exist; every leaf becomes the sentinel. Lists recurse for\n // the same reason dicts do — and so all three walkers (mask,\n // containsSentinel, merge-resolve) agree on every container type.\n if (isPlainObject(value)) {\n const out: Record<string, unknown> = {};\n for (const [k, v] of Object.entries(value)) out[k] = maskValue(v);\n return out;\n }\n if (Array.isArray(value)) return value.map(maskValue);\n return REDACTED_SENTINEL;\n}\n\nexport function containsSentinel(value: unknown): boolean {\n if (typeof value === \"string\") return value === REDACTED_SENTINEL;\n if (Array.isArray(value)) return value.some(containsSentinel);\n if (isPlainObject(value)) return Object.values(value).some(containsSentinel);\n return false;\n}\n\n/**\n * The prefillable public view of a decrypted `config`. Default-deny: a value\n * round-trips ONLY when its key is in `kind`'s schema and not marked\n * writeOnly; everything else is masked (dict keys kept, leaves sentineled).\n */\nexport function redactConfig(kind: string, config: Record<string, unknown>): Record<string, unknown> {\n const props =\n ((SCHEMAS[kind as ToolKind]?.properties as Record<string, Record<string, unknown>>) ?? {}) || {};\n const out: Record<string, unknown> = {};\n for (const [key, value] of Object.entries(config)) {\n // The http body's author decides (body_secret checkbox): masked when\n // true or ABSENT (fail closed for pre-flag rows); an explicit false\n // round-trips it in clear, exactly like `url`.\n if (kind === \"http\" && key === \"body\") {\n out[key] = config.body_secret === false ? structuredClone(value) : maskValue(value);\n continue;\n }\n const spec = props[key];\n if (spec === undefined || spec.writeOnly) {\n out[key] = maskValue(value);\n } else {\n out[key] = structuredClone(value);\n }\n }\n return out;\n}\n\n/**\n * Update-side twin of `redactConfig`: an incoming REDACTED_SENTINEL anywhere\n * is replaced by the stored value at the same path — the client is saying\n * \"unchanged\", never \"literally this string\". No schema is consulted:\n * redaction may have masked off-schema keys, so resolution is purely\n * path-for-path. A sentinel with NO stored counterpart throws — silently\n * dropping it once saved a config with no credential and a 200, and every\n * later execution failed auth with no signal at save time.\n */\nexport function mergeRedacted(\n incoming: Record<string, unknown>,\n stored: Record<string, unknown> | null | undefined,\n): Record<string, unknown> {\n const resolve = (value: unknown, kept: unknown, keptPresent: boolean, path: string): unknown => {\n if (isPlainObject(value)) {\n const keptDict = isPlainObject(kept) ? kept : {};\n const out: Record<string, unknown> = {};\n for (const [k, v] of Object.entries(value)) {\n out[k] = resolve(v, keptDict[k], k in keptDict, path ? `${path}.${k}` : k);\n }\n return out;\n }\n if (Array.isArray(value)) {\n // Same path-for-path contract as dicts, by index. Without this a\n // sentinel inside a list slipped through the bare return below and the\n // LITERAL placeholder was encrypted and stored (containsSentinel, which\n // opens the merge path, recurses lists — the resolver must too).\n const keptList = Array.isArray(kept) ? kept : [];\n return value.map((v, i) => resolve(v, keptList[i], i < keptList.length, `${path}[${i}]`));\n }\n if (value === REDACTED_SENTINEL) {\n if (!keptPresent) {\n throw new ConfigTemplateError(\n `config.${path} is ${JSON.stringify(REDACTED_SENTINEL)} but there is no stored ` +\n `value to keep — re-enter the secret or omit the field`,\n );\n }\n return kept;\n }\n return value;\n };\n const keptRoot = stored ?? {};\n const out: Record<string, unknown> = {};\n for (const [k, v] of Object.entries(incoming)) {\n out[k] = resolve(v, keptRoot[k], k in keptRoot, k);\n }\n return out;\n}\n","import { createCipheriv, createDecipheriv, createHmac, randomBytes } from \"node:crypto\";\n\n/**\n * AES-256-GCM crypto seam. Wire format is a compatibility promise with the\n * Python library and promptev-connectors:\n * base64(nonce[12] || AES-256-GCM ciphertext+tag)\n */\n\nexport function encryptDict(data: Record<string, unknown>, key: Buffer): string {\n const nonce = randomBytes(12);\n const cipher = createCipheriv(\"aes-256-gcm\", key, nonce);\n const plaintext = Buffer.from(JSON.stringify(data), \"utf8\");\n const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);\n const tag = cipher.getAuthTag();\n return Buffer.concat([nonce, ciphertext, tag]).toString(\"base64\");\n}\n\nexport function decryptDict(token: string, key: Buffer): Record<string, unknown> {\n const raw = Buffer.from(token, \"base64\");\n const nonce = raw.subarray(0, 12);\n const tag = raw.subarray(raw.length - 16);\n const ciphertext = raw.subarray(12, raw.length - 16);\n const decipher = createDecipheriv(\"aes-256-gcm\", key, nonce);\n decipher.setAuthTag(tag);\n const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);\n return JSON.parse(plaintext.toString(\"utf8\")) as Record<string, unknown>;\n}\n\nexport function getSecretKey(config: { secretKey?: string | null }): Buffer {\n const secretKey = config.secretKey;\n if (!secretKey) {\n throw new Error(\n \"ContextEngineConfig.secretKey (env CE_SECRET_KEY) is not configured — \" +\n \"a base64url-encoded 32-byte AES key is required to encrypt/decrypt \" +\n \"tool configs that hold secrets.\",\n );\n }\n return Buffer.from(secretKey, \"base64url\");\n}\n\nexport function hmacSha256Hex(key: string | Buffer, value: string): string {\n const k = typeof key === \"string\" ? Buffer.from(key) : key;\n return createHmac(\"sha256\", k).update(value, \"utf8\").digest(\"hex\");\n}\n","/**\n * Where the tool plane is allowed to connect, and how much it will read back.\n *\n * An `http` tool is a URL supplied by whoever registered the tool, fetched by\n * the SERVER. That is the classic server-side request forgery shape: from\n * inside a deployment, `http://127.0.0.1:8000/admin`,\n * `http://10.0.0.5/internal` and `http://169.254.169.254/latest/meta-data/`\n * (the cloud instance-metadata address, which hands out role credentials) are\n * all reachable, and reachable from nowhere else. The same holds for a\n * redirect the endpoint hands back, and for `testTool`'s HEAD probe.\n *\n * So every destination the tool plane connects to goes through\n * `assertEgressAllowed` first: the initial URL, and every redirect hop before\n * it is followed.\n *\n * Two limits accompany the check. `MAX_REDIRECTS` bounds the hop chain (a\n * redirect loop is otherwise an unbounded request amplifier), and\n * `MAX_RESPONSE_BYTES` bounds the body handed on to the caller — a tool\n * result lands in an audit row and in a model's context window, and neither\n * wants a gigabyte.\n *\n * The check is by RESOLVED address: a hostname is resolved and every answer\n * must be public. A name that re-resolves to a private address between this\n * check and the connect (DNS rebinding) is out of scope — closing that\n * requires pinning the connection to the checked address, which the HTTP\n * clients in use here do not expose.\n *\n * Mirrors `context_engine/tools/egress.py`. Dependency-free (`node:net`,\n * `node:dns`) so the policy can be read, tested and kept in step on its own.\n */\n\nimport { promises as dns } from \"node:dns\";\nimport { isIP } from \"node:net\";\n\n/** The body a tool call hands back, in bytes. Cut here, flagged `truncated`. */\nexport const MAX_RESPONSE_BYTES = 1_000_000;\n\n/** Redirect hops followed before the call is abandoned. */\nexport const MAX_REDIRECTS = 5;\n\n/**\n * Did this response redirect? A 3xx status — or the opaque stand-in a\n * browser/edge `fetch` hands back under `redirect: \"manual\"`, where `status`\n * is `0`, `type` is `\"opaqueredirect\"` and nothing else on it is readable.\n *\n * Every caller that refuses to chase a redirect asks through here: a bare\n * `status >= 300 && status < 400` reads the opaque one as a plain HTTP 0 and\n * falls through to the branch for a NON-redirect, which is how a refusal\n * turns into a generic error (or, on a probe, into a success).\n *\n * Structural on purpose — a real `Response`, and the shaped objects this\n * package passes around, both satisfy it. Node's `undici` reports the real\n * 3xx, so this is the same test there.\n */\nexport function isRedirect(resp: { status: number; type?: string }): boolean {\n return (resp.status >= 300 && resp.status < 400) || resp.type === \"opaqueredirect\";\n}\n\n/**\n * The tool plane refused to connect to a destination — it reports a caller's\n * configuration (a registered tool's URL, or the target of a redirect that\n * tool returned), not a transient failure.\n */\nexport class EgressDenied extends Error {\n constructor(message: string) {\n super(message);\n this.name = \"EgressDenied\";\n }\n}\n\n/**\n * The single seam that talks to the resolver — tests replace `lookup` and\n * nothing else in this module reaches DNS.\n */\nexport const resolver = {\n async lookup(host: string): Promise<string[]> {\n const answers = await dns.lookup(host, { all: true, verbatim: true });\n return answers.map((a) => a.address);\n },\n};\n\n// THE table. Membership in it is the whole policy, written out here rather\n// than delegated to a runtime's own \"is private\" helper: Python's `ipaddress`\n// internals move between releases and Node has no equivalent at all, so a\n// shared, explicit list is the only way the two ports can agree.\n// `src/context_engine/tools/egress.py` carries the same two lists, entry for\n// entry; changing one means changing both.\nconst V4_PRIVATE: Array<[string, number]> = [\n [\"0.0.0.0\", 8], // \"this network\" / unspecified\n [\"10.0.0.0\", 8], // RFC 1918\n [\"100.64.0.0\", 10], // RFC 6598 carrier-grade NAT — overlay VPNs, pod CIDRs\n [\"127.0.0.0\", 8], // loopback\n [\"169.254.0.0\", 16], // link-local, incl. the cloud metadata address\n [\"172.16.0.0\", 12], // RFC 1918\n [\"192.168.0.0\", 16], // RFC 1918\n [\"224.0.0.0\", 4], // multicast\n [\"240.0.0.0\", 4], // reserved\n [\"255.255.255.255\", 32], // broadcast (inside 240/4; spelled out anyway)\n];\n\nconst V6_PRIVATE: Array<[string, number]> = [\n [\"::\", 128], // unspecified\n [\"::1\", 128], // loopback\n [\"::ffff:0:0\", 96], // IPv4-mapped — the wrapped v4 is checked too\n [\"64:ff9b::\", 96], // NAT64 — the wrapped v4 is checked too\n [\"2002::\", 16], // 6to4 — the wrapped v4 is checked too, and this is denied\n [\"fc00::\", 7], // unique local\n [\"fe80::\", 10], // link-local\n [\"fec0::\", 10], // site-local (deprecated, still configured)\n [\"ff00::\", 8], // multicast\n [\"3fff::\", 20], // documentation\n];\n\n/** `1.2.3.4` -> its 4 bytes. `null` when it is not a dotted quad. */\nfunction parseV4(text: string): Uint8Array | null {\n const parts = text.split(\".\");\n if (parts.length !== 4) return null;\n const out = new Uint8Array(4);\n for (let i = 0; i < 4; i++) {\n const part = parts[i] as string;\n if (!/^\\d{1,3}$/.test(part)) return null;\n const value = Number(part);\n if (value > 255) return null;\n out[i] = value;\n }\n return out;\n}\n\n/**\n * An IPv6 literal -> its 16 bytes. Handles `::` compression and a trailing\n * dotted quad (`::ffff:127.0.0.1`). `null` when it does not parse.\n */\nfunction parseV6(text: string): Uint8Array | null {\n let body = text.split(\"%\")[0] ?? \"\";\n const lastColon = body.lastIndexOf(\":\");\n if (lastColon < 0) return null;\n const tail = body.slice(lastColon + 1);\n if (tail.includes(\".\")) {\n const v4 = parseV4(tail);\n if (!v4) return null;\n const hi = (((v4[0] as number) << 8) | (v4[1] as number)).toString(16);\n const lo = (((v4[2] as number) << 8) | (v4[3] as number)).toString(16);\n body = `${body.slice(0, lastColon + 1)}${hi}:${lo}`;\n }\n const halves = body.split(\"::\");\n if (halves.length > 2) return null;\n const head = halves[0] ? (halves[0] as string).split(\":\") : [];\n const rest = halves.length === 2 && halves[1] ? (halves[1] as string).split(\":\") : [];\n let groups: string[];\n if (halves.length === 1) {\n if (head.length !== 8) return null;\n groups = head;\n } else {\n const missing = 8 - head.length - rest.length;\n if (missing < 0) return null;\n groups = [...head, ...Array(missing).fill(\"0\"), ...rest];\n }\n const out = new Uint8Array(16);\n for (let i = 0; i < 8; i++) {\n const group = groups[i] as string;\n if (!/^[0-9a-f]{1,4}$/i.test(group)) return null;\n const value = Number.parseInt(group, 16);\n out[2 * i] = value >> 8;\n out[2 * i + 1] = value & 0xff;\n }\n return out;\n}\n\nfunction parseAddress(text: string): Uint8Array | null {\n const family = isIP(text);\n if (family === 4) return parseV4(text);\n if (family === 6) return parseV6(text);\n return null;\n}\n\n/** Bit-prefix membership: the first `prefix` bits of `addr` and `net` agree. */\nfunction inNet(addr: Uint8Array, net: Uint8Array, prefix: number): boolean {\n if (addr.length !== net.length) return false;\n const whole = prefix >> 3;\n for (let i = 0; i < whole; i++) if (addr[i] !== net[i]) return false;\n const bits = prefix & 7;\n if (bits === 0) return true;\n const mask = 0xff << (8 - bits);\n return ((addr[whole] as number) & mask) === ((net[whole] as number) & mask);\n}\n\nfunction compile(table: Array<[string, number]>): Array<[Uint8Array, number]> {\n return table.map(([cidr, prefix]) => {\n const bytes = parseAddress(cidr);\n if (!bytes) throw new Error(`egress: unparseable network ${cidr}`);\n return [bytes, prefix] as [Uint8Array, number];\n });\n}\n\nconst V4_NETS = compile(V4_PRIVATE);\nconst V6_NETS = compile(V6_PRIVATE);\n\nconst MAPPED_V4 = compile([[\"::ffff:0:0\", 96]])[0] as [Uint8Array, number];\nconst NAT64 = compile([[\"64:ff9b::\", 96]])[0] as [Uint8Array, number];\nconst SIXTOFOUR = compile([[\"2002::\", 16]])[0] as [Uint8Array, number];\n\n/**\n * The IPv4 address an IPv6 one wraps, if it wraps one — mapped, NAT64 or\n * 6to4. Each is unwrapped and checked against the v4 table, so\n * `2002:7f00:1::1` (6to4 of 127.0.0.1) and `64:ff9b::a00:1` (NAT64 of\n * 10.0.0.1) cannot reach something the v4 table forbids.\n */\nfunction embeddedV4(bytes: Uint8Array): Uint8Array | null {\n if (inNet(bytes, MAPPED_V4[0], MAPPED_V4[1]) || inNet(bytes, NAT64[0], NAT64[1])) {\n return bytes.subarray(12, 16);\n }\n if (inNet(bytes, SIXTOFOUR[0], SIXTOFOUR[1])) return bytes.subarray(2, 6);\n return null;\n}\n\n/** True when `address` is in the table above — the only definition of private. */\nfunction addressIsPrivate(address: string): boolean {\n const bytes = parseAddress(address);\n if (!bytes) return true; // not an address we can reason about\n if (bytes.length === 4) return V4_NETS.some(([net, prefix]) => inNet(bytes, net, prefix));\n const embedded = embeddedV4(bytes);\n if (embedded && V4_NETS.some(([net, prefix]) => inNet(embedded, net, prefix))) return true;\n return V6_NETS.some(([net, prefix]) => inNet(bytes, net, prefix));\n}\n\n/**\n * True when `host` names something inside the deployment.\n *\n * An IP literal is decided from the literal alone — no resolution. A hostname\n * is resolved and is private if ANY answer is private (a split-horizon name\n * that answers with one public and one internal address is an internal name).\n * A hostname that does not resolve is private too: an answer we could not\n * obtain is not an answer we can trust.\n */\nexport async function isPrivateAddress(host: string): Promise<boolean> {\n let name = (host ?? \"\")\n .trim()\n .toLowerCase()\n .replace(/^\\.+|\\.+$/g, \"\");\n if (!name) return true;\n if (name === \"localhost\") return true;\n // Bracketed IPv6 as it appears in a URL authority (`URL.hostname` keeps the\n // brackets).\n if (name.startsWith(\"[\") && name.endsWith(\"]\")) name = name.slice(1, -1);\n\n if (isIP(name)) return addressIsPrivate(name);\n\n let addresses: string[];\n try {\n addresses = await resolver.lookup(name);\n } catch {\n return true;\n }\n if (!addresses.length) return true;\n return addresses.some((address) => addressIsPrivate(address.split(\"%\")[0] ?? address));\n}\n\n/**\n * Throw `EgressDenied` unless the tool plane may connect to `url`.\n *\n * The message names the host the caller supplied and never the address it\n * resolved to — the resolution result is exactly the internal detail this\n * check exists to keep inside.\n */\nexport async function assertEgressAllowed(url: string, opts: { allowPrivate: boolean }): Promise<void> {\n let parsed: URL;\n try {\n parsed = new URL(url ?? \"\");\n } catch {\n throw new EgressDenied(`egress denied: ${JSON.stringify(url)} is not a valid URL`);\n }\n const scheme = parsed.protocol.replace(/:$/, \"\").toLowerCase();\n if (scheme !== \"http\" && scheme !== \"https\") {\n throw new EgressDenied(\n `egress denied: unsupported URL scheme ${JSON.stringify(scheme)} — ` +\n `http tools may only reach http/https`,\n );\n }\n if (opts.allowPrivate) return;\n const host = parsed.hostname;\n if (await isPrivateAddress(host)) {\n throw new EgressDenied(\n `egress denied: ${host || \"(no host)\"} is a private, loopback, link-local or ` +\n `metadata address; set allowPrivateEgress to permit it`,\n );\n }\n}\n","/** Bumped by CI on every main merge; 0.0.0 = pre-first-release. */\nexport const __version__ = \"0.0.0\";\n","import { __version__ } from \"../../version.js\";\nimport { assertEgressAllowed, isRedirect } from \"../egress.js\";\n\n/**\n * Every destination this module dials is cleared by the tool plane's egress\n * policy (`tools/egress.ts`) first. An MCP server URL is supplied by whoever\n * registered the tool and dialled by the SERVER — the same server-side\n * request forgery shape an `http` tool has — and one connection has two more\n * destinations beyond the configured URL: the POST endpoint an SSE server\n * hands back in its `endpoint` event, and a redirect. Both are checked, and\n * the HTTP/SSE transports refuse redirects outright rather than following one\n * somewhere no check ever saw.\n *\n * `ws`/`wss` are mapped onto `http`/`https` before the check rather than\n * added to the policy module's scheme table: that table answers which schemes\n * an `http` TOOL may name, and widening it there would quietly let one be\n * registered with a `ws://` URL. What matters for egress is the address a\n * socket is opened to, which a WebSocket URL names exactly the way an HTTP\n * one does.\n *\n * Mirrors `context_engine/tools/executors/mcp_client.py::_check_egress`.\n */\nasync function checkEgress(url: string, allowPrivate: boolean): Promise<void> {\n let checked = url;\n const scheme = (/^([a-z0-9+.-]+):/i.exec(url ?? \"\")?.[1] ?? \"\").toLowerCase();\n if (scheme === \"ws\") checked = `http:${url.slice(scheme.length + 1)}`;\n else if (scheme === \"wss\") checked = `https:${url.slice(scheme.length + 1)}`;\n await assertEgressAllowed(checked, { allowPrivate });\n}\n\n/** A 3xx from an MCP server. Named once so both transports say the same. */\nconst REDIRECT_MESSAGE = \"MCP server redirected; register the final URL\";\n\nexport class MCPError extends Error {\n code: number;\n data: unknown;\n constructor(code: number, message: string, data: unknown = null) {\n super(`[${code}] ${message}`);\n this.name = \"MCPError\";\n this.code = code;\n this.data = data;\n }\n static fromJsonrpc(err: Record<string, unknown>): MCPError {\n return new MCPError(Number(err.code ?? -32000), String(err.message ?? \"MCP error\"), err.data);\n }\n}\n\ninterface Transport {\n kind: string;\n connect(): Promise<void>;\n close(): Promise<void>;\n send(msg: Record<string, unknown>): Promise<void>;\n recv(): Promise<Record<string, unknown>>;\n request?(msg: Record<string, unknown>): Promise<Record<string, unknown>>;\n}\n\nfunction parseSseBuffer(raw: string): Record<string, unknown> | null {\n const dataLines = raw\n .split(\"\\n\")\n .filter((ln) => ln.startsWith(\"data:\"))\n .map((ln) => ln.slice(5).trimStart());\n if (!dataLines.length) return null;\n try {\n const payload = JSON.parse(dataLines.join(\"\\n\"));\n if (payload && typeof payload === \"object\" && (\"result\" in payload || \"error\" in payload)) {\n return payload as Record<string, unknown>;\n }\n } catch {\n /* ignore */\n }\n return null;\n}\n\nexport class HttpTransport implements Transport {\n kind = \"http\";\n url: string;\n allowPrivate: boolean;\n private baseHeaders: Record<string, string>;\n private sessionId: string | null = null;\n\n constructor(url: string, headers: Record<string, string>, allowPrivate = false) {\n this.url = url;\n this.allowPrivate = allowPrivate;\n this.baseHeaders = {\n ...headers,\n \"Content-Type\": \"application/json\",\n Accept: \"application/json, text/event-stream\",\n };\n }\n\n async connect(): Promise<void> {\n // Stateless HTTP: nothing to open, but the URL came from whoever\n // registered the tool and is cleared before the first request.\n await checkEgress(this.url, this.allowPrivate);\n }\n\n async close(): Promise<void> {\n this.sessionId = null;\n }\n\n private buildHeaders(): Record<string, string> {\n const hdrs = { ...this.baseHeaders };\n if (this.sessionId) hdrs[\"Mcp-Session-Id\"] = this.sessionId;\n return hdrs;\n }\n\n async request(msg: Record<string, unknown>): Promise<Record<string, unknown>> {\n const resp = await fetch(this.url, {\n method: \"POST\",\n headers: this.buildHeaders(),\n body: JSON.stringify(msg),\n // `redirect: \"manual\"`: a followed redirect would carry this POST —\n // headers, Authorization and all — to a destination `connect()`'s\n // check never saw. A 3xx is reported, never chased.\n redirect: \"manual\",\n });\n const sid = resp.headers.get(\"Mcp-Session-Id\");\n if (sid) this.sessionId = sid;\n if (isRedirect(resp)) {\n throw new MCPError(resp.status, REDIRECT_MESSAGE);\n }\n if (resp.status >= 400) {\n const body = await resp.text();\n console.error(`[HTTP Transport] ${resp.status} from ${this.url}: ${body.slice(0, 300)}`);\n throw new Error(`HTTP ${resp.status}: ${body.slice(0, 300)}`);\n }\n const contentType = resp.headers.get(\"Content-Type\") ?? \"\";\n if (contentType.includes(\"text/event-stream\")) {\n const text = await resp.text();\n let result: Record<string, unknown> = {};\n for (const frame of text.split(/\\r?\\n\\r?\\n/)) {\n const parsed = parseSseBuffer(frame);\n if (parsed) result = parsed;\n }\n return result;\n }\n return (await resp.json()) as Record<string, unknown>;\n }\n\n async send(msg: Record<string, unknown>): Promise<void> {\n await this.request(msg);\n }\n\n async recv(): Promise<Record<string, unknown>> {\n return {};\n }\n\n getBaseHeaders(): Record<string, string> {\n return { ...this.baseHeaders };\n }\n}\n\nexport class SseTransport implements Transport {\n kind = \"sse\";\n eventsUrl: string;\n baseUrl: string;\n headers: Record<string, string>;\n allowPrivate: boolean;\n /** Where the server told us to POST — it arrives in an `endpoint` event on\n * the stream, so it is server-chosen and hence checked. Private: the only\n * way in is the parser, which is the path a real server takes. */\n private postUrl: string | null = null;\n /** The last POST endpoint cleared by the egress check. The check costs a\n * DNS resolution and the endpoint changes at most once per connection, so\n * it is not repeated per message. */\n private checkedPostUrl: string | null = null;\n private queue: Array<Record<string, unknown>> = [];\n private waiters: Array<(v: Record<string, unknown>) => void> = [];\n private abort: AbortController | null = null;\n\n constructor(url: string, headers: Record<string, string>, allowPrivate = false) {\n this.allowPrivate = allowPrivate;\n this.eventsUrl = url.replace(/\\/$/, \"\");\n if (url.endsWith(\"/events\")) this.baseUrl = url.slice(0, -7);\n else if (url.endsWith(\"/sse\")) this.baseUrl = url.slice(0, -4);\n else this.baseUrl = url.replace(/\\/$/, \"\");\n this.headers = { ...headers };\n }\n\n private enqueue(msg: Record<string, unknown>): void {\n const waiter = this.waiters.shift();\n if (waiter) waiter(msg);\n else this.queue.push(msg);\n }\n\n async connect(): Promise<void> {\n await checkEgress(this.eventsUrl, this.allowPrivate);\n this.abort = new AbortController();\n void this.listen();\n }\n\n private async listen(): Promise<void> {\n const resp = await fetch(this.eventsUrl, {\n headers: { ...this.headers, Accept: \"text/event-stream\" },\n signal: this.abort?.signal,\n redirect: \"manual\",\n });\n if (isRedirect(resp)) {\n throw new MCPError(resp.status, REDIRECT_MESSAGE);\n }\n if (!resp.ok) throw new Error(`SSE ${resp.status}`);\n if (!resp.body) throw new Error(\"SSE response has no body\");\n const reader = resp.body.getReader();\n const decoder = new TextDecoder();\n let buf = \"\";\n let eventType: string | null = null;\n const frame: string[] = [];\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n buf += decoder.decode(value, { stream: true });\n const lines = buf.split(/\\n/);\n buf = lines.pop() ?? \"\";\n for (const line of lines) {\n if (line === \"\" || line === \"\\r\") {\n this.dispatchFrame(frame, eventType);\n frame.length = 0;\n eventType = null;\n continue;\n }\n const stripped = line.replace(/\\r$/, \"\");\n if (stripped.startsWith(\"event:\")) eventType = stripped.slice(6).trim();\n frame.push(stripped);\n }\n }\n }\n\n private dispatchFrame(buf: string[], eventType: string | null): void {\n const dataLines = buf.filter((l) => l.startsWith(\"data:\")).map((l) => l.slice(5).trimStart());\n if (!dataLines.length) return;\n const payload = dataLines.join(\"\\n\");\n if (eventType === \"endpoint\") {\n const endpoint = payload.trim();\n this.postUrl = endpoint.startsWith(\"/\") ? `${this.baseUrl}${endpoint}` : endpoint;\n return;\n }\n try {\n this.enqueue(JSON.parse(payload) as Record<string, unknown>);\n } catch {\n /* non-JSON frame */\n }\n }\n\n async close(): Promise<void> {\n this.abort?.abort();\n }\n\n async send(msg: Record<string, unknown>): Promise<void> {\n if (!this.postUrl) {\n for (let i = 0; i < 30; i++) {\n if (this.postUrl) break;\n await new Promise((r) => setTimeout(r, 100));\n }\n }\n const postUrl = this.postUrl || this.baseUrl;\n // The `endpoint` event is the server naming a SECOND destination, one it\n // chose: a public SSE server can hand back `http://169.254.169.254/`.\n // Checked before the first POST to it, and again whenever it changes.\n if (postUrl !== this.checkedPostUrl) {\n await checkEgress(postUrl, this.allowPrivate);\n this.checkedPostUrl = postUrl;\n }\n const resp = await fetch(postUrl, {\n method: \"POST\",\n headers: { ...this.headers, \"Content-Type\": \"application/json\" },\n body: JSON.stringify(msg),\n redirect: \"manual\",\n });\n if (isRedirect(resp)) {\n throw new MCPError(resp.status, REDIRECT_MESSAGE);\n }\n if (!resp.ok) throw new Error(`SSE POST ${resp.status}`);\n try {\n const data = (await resp.json()) as Record<string, unknown>;\n if (data && typeof data === \"object\" && (\"result\" in data || \"error\" in data)) {\n this.enqueue(data);\n }\n } catch {\n /* response will come via SSE stream */\n }\n }\n\n async recv(): Promise<Record<string, unknown>> {\n if (this.queue.length) return this.queue.shift()!;\n return new Promise((resolve) => this.waiters.push(resolve));\n }\n}\n\nexport class WsTransport implements Transport {\n kind = \"websocket\";\n url: string;\n headers: Record<string, string>;\n allowPrivate: boolean;\n private ws: WebSocket | null = null;\n private queue: Array<Record<string, unknown>> = [];\n private waiters: Array<(v: Record<string, unknown>) => void> = [];\n\n constructor(url: string, headers: Record<string, string>, allowPrivate = false) {\n this.url = url;\n this.allowPrivate = allowPrivate;\n this.headers = headers;\n }\n\n async connect(): Promise<void> {\n // `ws`/`wss` are mapped onto `http`/`https` for the check — see\n // `checkEgress`. The WebSocket constructor exposes no redirect option and\n // needs none: Node's implementation (undici) runs the handshake with\n // `redirect: \"error\"`, so a 3xx fails there rather than being followed.\n // The Python port has to add the refusal by hand — aiohttp's handshake\n // GET follows by default (see `mcp_client.py::_refuse_redirects_trace`).\n await checkEgress(this.url, this.allowPrivate);\n const WS = globalThis.WebSocket;\n if (!WS) throw new Error(\"WebSocket is not available in this runtime\");\n this.ws = new WS(this.url);\n this.ws.addEventListener(\"message\", (ev) => {\n try {\n const data = JSON.parse(String((ev as MessageEvent).data)) as Record<string, unknown>;\n const waiter = this.waiters.shift();\n if (waiter) waiter(data);\n else this.queue.push(data);\n } catch {\n /* ignore */\n }\n });\n await new Promise<void>((resolve, reject) => {\n this.ws!.addEventListener(\"open\", () => resolve());\n this.ws!.addEventListener(\"error\", () => reject(new Error(\"WebSocket error\")));\n });\n }\n\n async close(): Promise<void> {\n this.ws?.close();\n this.ws = null;\n }\n\n async send(msg: Record<string, unknown>): Promise<void> {\n if (!this.ws) throw new Error(\"Not connected\");\n this.ws.send(JSON.stringify(msg));\n }\n\n async recv(): Promise<Record<string, unknown>> {\n if (this.queue.length) return this.queue.shift()!;\n return new Promise((resolve) => this.waiters.push(resolve));\n }\n}\n\nexport class MCPClient {\n url: string;\n transport: Transport;\n connected = false;\n private id = 0;\n private pending = new Map<\n string,\n { resolve: (v: Record<string, unknown>) => void; reject: (e: unknown) => void }\n >();\n capabilities: Record<string, unknown> = {};\n tools: Array<Record<string, unknown>> = [];\n resources: Array<Record<string, unknown>> = [];\n private headers: Record<string, string>;\n allowPrivate: boolean;\n\n constructor(\n url: string,\n headers: Record<string, string> | null = null,\n opts: { allowPrivate?: boolean } = {},\n ) {\n this.url = url;\n this.headers = headers ?? {};\n this.allowPrivate = opts.allowPrivate ?? false;\n this.transport = MCPClient.createTransport(url, this.headers, this.allowPrivate);\n }\n\n static createTransport(url: string, headers: Record<string, string>, allowPrivate = false): Transport {\n if (url.startsWith(\"stdio:\") || url === \"stdio\") {\n throw new Error(\"stdio MCP transport is not supported (cloud deployments use SSE/HTTP/WebSocket)\");\n }\n if (url.startsWith(\"ws://\") || url.startsWith(\"wss://\")) {\n return new WsTransport(url, headers, allowPrivate);\n }\n if (\n url.startsWith(\"sse+http://\") ||\n url.startsWith(\"sse+https://\") ||\n url.endsWith(\"/events\") ||\n url.endsWith(\"/sse\")\n ) {\n const clean = url.replace(\"sse+http://\", \"http://\").replace(\"sse+https://\", \"https://\");\n return new SseTransport(clean, headers, allowPrivate);\n }\n if (url.startsWith(\"http://\") || url.startsWith(\"https://\")) {\n return new HttpTransport(url, headers, allowPrivate);\n }\n throw new Error(`Unsupported URL: ${url} (use http(s)://, ws(s)://, or .../sse)`);\n }\n\n private nextId(): string {\n this.id += 1;\n return String(this.id);\n }\n\n private async recvLoop(): Promise<void> {\n while (this.connected) {\n const msg = await this.transport.recv();\n if (!msg) continue;\n const mid = msg.id != null ? String(msg.id) : null;\n if (mid && (\"result\" in msg || \"error\" in msg)) {\n const fut = this.pending.get(mid);\n this.pending.delete(mid);\n fut?.resolve(msg);\n }\n }\n }\n\n private async rpc(\n method: string,\n params: Record<string, unknown> | null = null,\n timeout = 60_000,\n ): Promise<unknown> {\n const mid = this.nextId();\n const payload = { jsonrpc: \"2.0\", id: mid, method, params: params ?? {} };\n if (this.transport instanceof HttpTransport) {\n const msg = await this.transport.request(payload);\n if (msg.error) throw MCPError.fromJsonrpc(msg.error as Record<string, unknown>);\n return msg.result ?? {};\n }\n const msg = await new Promise<Record<string, unknown>>((resolve, reject) => {\n const timer = setTimeout(() => {\n this.pending.delete(mid);\n reject(new Error(`MCP RPC '${method}' timed out after ${timeout}ms`));\n }, timeout);\n this.pending.set(mid, {\n resolve: (v) => {\n clearTimeout(timer);\n resolve(v);\n },\n reject,\n });\n void this.transport.send(payload).catch((e) => {\n clearTimeout(timer);\n this.pending.delete(mid);\n reject(e);\n });\n });\n if (msg.error) throw MCPError.fromJsonrpc(msg.error as Record<string, unknown>);\n return msg.result ?? {};\n }\n\n private async notify(method: string, params: Record<string, unknown> | null = null): Promise<void> {\n await this.transport.send({ jsonrpc: \"2.0\", method, params: params ?? {} });\n }\n\n async connect(): Promise<void> {\n try {\n await this.transport.connect();\n } catch (e) {\n // A transport can create its socket and THEN fail — a refused upgrade,\n // a redirected handshake, an SSE endpoint the policy denies. This dial\n // used to sit outside the `try` below, so nothing closed it. Every\n // transport's `close()` is a no-op when nothing was opened.\n try {\n await this.transport.close();\n } catch {\n /* ignore */\n }\n throw e;\n }\n if (!(this.transport instanceof HttpTransport)) {\n this.connected = true;\n void this.recvLoop();\n }\n try {\n const init = (await this.rpc(\"initialize\", {\n protocolVersion: \"2024-11-05\",\n capabilities: { roots: { listChanged: true }, sampling: {} },\n clientInfo: { name: \"context-engine\", version: __version__ },\n })) as Record<string, unknown>;\n this.capabilities = (init.capabilities as Record<string, unknown>) ?? {};\n await this.notify(\"notifications/initialized\");\n this.connected = true;\n } catch (e) {\n await this.close();\n throw e;\n }\n }\n\n async close(): Promise<void> {\n this.connected = false;\n for (const [, fut] of this.pending) fut.reject(new Error(\"closed\"));\n this.pending.clear();\n try {\n await this.transport.close();\n } catch {\n /* ignore */\n }\n }\n\n async listTools(): Promise<Array<Record<string, unknown>>> {\n const res = (await this.rpc(\"tools/list\")) as Record<string, unknown>;\n this.tools = (res.tools as Array<Record<string, unknown>>) ?? [];\n return this.tools;\n }\n\n async listResources(): Promise<Array<Record<string, unknown>>> {\n try {\n const res = (await this.rpc(\"resources/list\", null, 10_000)) as Record<string, unknown>;\n this.resources = (res.resources as Array<Record<string, unknown>>) ?? [];\n } catch {\n this.resources = [];\n }\n return this.resources;\n }\n\n async callTool(toolName: string, arguments_: Record<string, unknown>, timeout = 120_000): Promise<unknown> {\n return this.rpc(\"tools/call\", { name: toolName, arguments: arguments_ }, timeout);\n }\n\n async ping(): Promise<boolean> {\n try {\n await this.rpc(\"ping\", {}, 10_000);\n return true;\n } catch {\n return false;\n }\n }\n\n async callToolWithReconnect(\n toolName: string,\n arguments_: Record<string, unknown>,\n timeout = 120_000,\n ): Promise<unknown> {\n try {\n if (!this.connected) throw new Error(\"Not connected\");\n return await this.callTool(toolName, arguments_, timeout);\n } catch (e) {\n console.warn(`[MCP] Connection issue during call_tool(${toolName}), reconnecting:`, e);\n try {\n await this.reconnect();\n return await this.callTool(toolName, arguments_, timeout);\n } catch (retryErr) {\n throw new Error(`Reconnect failed: ${retryErr}`, { cause: e });\n }\n }\n }\n\n async reconnect(): Promise<void> {\n const url = this.url;\n let headers: Record<string, string> = {};\n if (this.transport instanceof HttpTransport) {\n headers = this.transport.getBaseHeaders();\n delete headers[\"Content-Type\"];\n delete headers.Accept;\n } else if (this.transport instanceof SseTransport || this.transport instanceof WsTransport) {\n headers = { ...this.transport.headers };\n }\n try {\n await this.close();\n } catch {\n /* ignore */\n }\n this.id = 0;\n this.pending.clear();\n this.transport = MCPClient.createTransport(url, headers, this.allowPrivate);\n await this.connect();\n await this.listTools();\n }\n}\n\nexport class MCPRegistry {\n private clients = new Map<string, MCPClient>();\n private healthTask: ReturnType<typeof setInterval> | null = null;\n\n async connect(\n name: string,\n url: string,\n headers: Record<string, string> | null = null,\n token: string | null = null,\n allowPrivate = false,\n ): Promise<void> {\n this.clients.delete(name);\n const hdrs = { ...(headers ?? {}) };\n if (token) hdrs.Authorization = hdrs.Authorization ?? `Bearer ${token}`;\n const client = new MCPClient(url, hdrs, { allowPrivate });\n await client.connect();\n await client.listTools();\n this.clients.set(name, client);\n if (!this.healthTask) {\n this.healthTask = setInterval(() => void this.healthLoopOnce(), 60_000);\n }\n }\n\n private async healthLoopOnce(): Promise<void> {\n for (const [name, client] of [...this.clients.entries()]) {\n if (!client.connected) continue;\n try {\n const alive = await client.ping();\n if (!alive) await client.reconnect();\n } catch (e) {\n console.warn(`[MCP Health] ${name} health check error:`, e);\n try {\n await client.reconnect();\n } catch {\n this.clients.delete(name);\n }\n }\n }\n }\n\n get(name: string): MCPClient {\n const c = this.clients.get(name);\n if (!c) throw new Error(`Unknown MCP server: '${name}'`);\n return c;\n }\n\n has(name: string): boolean {\n return this.clients.has(name);\n }\n\n async disconnect(name: string): Promise<void> {\n const c = this.clients.get(name);\n this.clients.delete(name);\n if (c) {\n try {\n await c.close();\n } catch {\n /* ignore */\n }\n }\n }\n\n async shutdown(): Promise<void> {\n if (this.healthTask) {\n clearInterval(this.healthTask);\n this.healthTask = null;\n }\n for (const name of [...this.clients.keys()]) await this.disconnect(name);\n }\n}\n\nexport class PromptevMCP {\n clients = new MCPRegistry();\n allowPrivate: boolean;\n\n /**\n * `allowPrivate` is the operator knob `allowPrivateEgress`, carried down to\n * every transport this facade builds. It defaults to `false`, so a\n * construction site that forgets to pass it denies private destinations\n * rather than permitting them.\n */\n constructor(opts: { allowPrivate?: boolean } = {}) {\n this.allowPrivate = opts.allowPrivate ?? false;\n }\n\n async addServer(\n name: string,\n url: string,\n opts: { token?: string | null; headers?: Record<string, string> | null } = {},\n ): Promise<void> {\n await this.clients.connect(name, url, opts.headers ?? null, opts.token ?? null, this.allowPrivate);\n }\n\n async shutdown(): Promise<void> {\n await this.clients.shutdown();\n }\n}\n","import { randomUUID } from \"node:crypto\";\nimport type { Pool } from \"pg\";\nimport type { ContextEngineConfig } from \"../config.js\";\nimport { EngineActionError } from \"../errors.js\";\nimport { emitUsage, type Hooks } from \"../hooks.js\";\nimport { applyRedaction, type RedactionPolicy } from \"../redaction.js\";\nimport { TRUSTED, type Trusted } from \"../sentinels.js\";\nimport type { UsageEvent } from \"../usage.js\";\nimport { aclVisible } from \"./acl.js\";\nimport {\n claimVisibilitySql,\n createPending,\n findOrCreatePending,\n shouldRequireApproval,\n validateApprovalScope,\n} from \"./approval.js\";\nimport { logToolCall, ToolCallTimer } from \"./audit.js\";\nimport {\n ConfigTemplateError,\n containsSentinel,\n mergeRedacted,\n REDACTED_SENTINEL,\n ToolConfig,\n} from \"./config.js\";\nimport { decryptDict, encryptDict, getSecretKey } from \"./crypto.js\";\nimport { assertEgressAllowed, EgressDenied } from \"./egress.js\";\nimport { executeDb, getSchemaText } from \"./executors/db.js\";\nimport { executeHttp, type ToolHttpClient } from \"./executors/http.js\";\nimport { PromptevMCP } from \"./executors/mcp-client.js\";\nimport { type CanonicalTool, canonicalFromConfig, findTool } from \"./registry.js\";\n\nexport const RESULT_MAX_CHARS = 8_000;\nexport const RESULT_MAX_ROWS = 100;\n\nconst UPDATABLE_COLUMNS = new Set([\n \"name\",\n \"kind\",\n \"description\",\n \"sourceId\",\n \"source_id\",\n \"acl\",\n \"requiresApproval\",\n \"requires_approval\",\n \"approvalPolicy\",\n \"approval_policy\",\n \"enabled\",\n \"metaData\",\n \"meta_data\",\n]);\n\nexport type ToolEngine = {\n pool: Pool;\n config: ContextEngineConfig;\n hooks?: Hooks | null;\n _functionTools?: Record<string, CanonicalTool>;\n _toolHttpClient?: ToolHttpClient | null;\n};\n\n/**\n * The operator knob `ContextEngineConfig.allowPrivateEgress`, read off the\n * engine for every outbound tool fetch — executor, probe, MCP connection and\n * OAuth call. Exported so `router.ts` reads the same value from the same\n * place for its MCP and OAuth routes.\n */\nexport function allowPrivateEgress(engine: ToolEngine): boolean {\n return Boolean((engine?.config as { allowPrivateEgress?: boolean } | undefined)?.allowPrivateEgress);\n}\n\nexport function toolVisible(ct: CanonicalTool, principals: string[] | null | undefined | Trusted): boolean {\n return aclVisible(ct.acl, principals);\n}\n\nexport function stripUnderscoreArgs(\n args: Record<string, unknown> | null | undefined,\n): Record<string, unknown> {\n const out: Record<string, unknown> = {};\n for (const [k, v] of Object.entries(args ?? {})) {\n if (!String(k).startsWith(\"_\")) out[k] = v;\n }\n return out;\n}\n\nexport function shapeResult(\n result: unknown,\n opts: { maxChars?: number; maxRows?: number } = {},\n): [unknown, boolean] {\n const maxChars = opts.maxChars ?? RESULT_MAX_CHARS;\n const maxRows = opts.maxRows ?? RESULT_MAX_ROWS;\n let truncated = false;\n let shaped = result;\n\n if (\n result &&\n typeof result === \"object\" &&\n Array.isArray((result as { rows?: unknown }).rows) &&\n (result as { rows: unknown[] }).rows.length > maxRows\n ) {\n const rows = (result as { rows: unknown[] }).rows;\n const kept = rows.slice(0, maxRows);\n shaped = {\n ...(result as object),\n rows: kept,\n _result_shaping: { rows_returned: kept.length, rows_omitted: rows.length - kept.length },\n };\n truncated = true;\n }\n\n let serialized: string;\n try {\n serialized = JSON.stringify(shaped);\n } catch {\n serialized = JSON.stringify(String(shaped));\n }\n if (serialized.length > maxChars) {\n return [\n {\n _truncated: serialized.slice(0, maxChars),\n _original_size: serialized.length,\n _note: \"tool result exceeded the context budget and was truncated\",\n },\n true,\n ];\n }\n return [shaped, truncated];\n}\n\nexport function redactToolResult(\n result: unknown,\n policy: RedactionPolicy,\n opts: {\n principals?: readonly string[] | null;\n secretKey?: string | Buffer | null;\n hooks?: Hooks | null;\n },\n): [unknown, Record<string, unknown>] {\n if (policy.isEmpty()) return [result, {}];\n const fired: string[] = [];\n const failed: string[] = [];\n let total = 0;\n\n const walk = (node: unknown): unknown => {\n if (typeof node === \"string\") {\n const [text, note] = applyRedaction(node, policy, {\n phase: \"output\",\n principals: opts.principals ?? null,\n secretKey: opts.secretKey,\n hooks: opts.hooks,\n });\n if (note && Object.keys(note).length) {\n total += note.spans ?? 0;\n for (const name of note.rules_fired ?? []) {\n if (!fired.includes(name)) fired.push(name);\n }\n for (const name of note.rules_failed ?? []) {\n if (!failed.includes(name)) failed.push(name);\n }\n }\n return text;\n }\n if (node && typeof node === \"object\") {\n if (Array.isArray(node)) return node.map(walk);\n const out: Record<string, unknown> = {};\n for (const [k, v] of Object.entries(node as Record<string, unknown>)) out[k] = walk(v);\n return out;\n }\n return node;\n };\n\n const redacted = walk(result);\n if (!fired.length && !failed.length) return [redacted, {}];\n const note: Record<string, unknown> = { rules_fired: fired, spans: total };\n if (failed.length) note.rules_failed = failed;\n return [redacted, note];\n}\n\n/**\n * `getSecretKey`, with malformed-key failures kept OPERATOR-shaped.\n *\n * `Buffer.from(s, \"base64url\")` neither throws on junk nor checks length, so a\n * wrong-length `CE_SECRET_KEY` used to travel all the way to\n * `createCipheriv`/`createDecipheriv` and fail there with \"Invalid key\n * length\" — inside the lenient decrypt `try` below, which reads that as \"was\n * this row's key rotated?\" and drops EVERY tool with a stored config from\n * list/search/execute. A key that cannot be used is an operator fault exactly\n * like a missing one, so it says so, naming the env var. (A key that fails to\n * decode cleanly is not detected separately: base64url tolerates junk, and\n * whatever it decodes to will not be 32 bytes.)\n *\n * Mirrors `context_engine.tools.governance._crypto_key`.\n */\nfunction cryptoKey(engine: ToolEngine): Buffer {\n // The missing-key error is re-thrown unchanged — it already names the\n // config field and the env var.\n const key = getSecretKey(engine.config);\n if (key.length !== 32) {\n throw new Error(`CE_SECRET_KEY is malformed: decoded to ${key.length} bytes, need 32`);\n }\n return key;\n}\n\n/**\n * A row's stored config, decrypted. Throws whatever the crypto layer throws,\n * so a caller that means to survive a rotated key has to catch broadly (see\n * `rowToToolConfigLenient`). A row with no config never touches the key.\n */\nfunction decryptRowConfig(row: Record<string, unknown>, engine: ToolEngine): Record<string, unknown> {\n if (!row.config_encrypted) return {};\n return decryptDict(String(row.config_encrypted), cryptoKey(engine));\n}\n\n/**\n * Rebuild a `ToolConfig` from a persisted row. `config` overrides the stored\n * blob (the lenient path below passes what it managed to read); otherwise the\n * blob is decrypted strictly and a failure propagates.\n */\nfunction rowToToolConfig(\n row: Record<string, unknown>,\n engine: ToolEngine,\n config?: Record<string, unknown>,\n): ToolConfig {\n config ??= decryptRowConfig(row, engine);\n return new ToolConfig({\n id: String(row.id),\n name: String(row.name),\n kind: row.kind as ToolConfig[\"kind\"],\n description: String(row.description ?? \"\"),\n config,\n sourceId: (row.source_id as string | null) ?? null,\n acl: row.acl != null ? [...(row.acl as string[])] : null,\n requiresApproval: Boolean(row.requires_approval),\n approvalPolicy: (row.approval_policy as Record<string, unknown>) ?? {},\n enabled: Boolean(row.enabled),\n metaData: (row.meta_data as Record<string, unknown>) ?? {},\n });\n}\n\n/**\n * `rowToToolConfig`, except that a row whose stored config cannot be\n * decrypted yields `null` after one warning naming the tool.\n *\n * Every `listTools`/`searchTools`/`executeTool` resolves the WHOLE enabled\n * set. Letting one row left behind by a key rotation throw out of that loop\n * took down every OTHER tool with it, function tools included — and the\n * documented recoveries (disable the row, or re-enter its config) went\n * through the same rebuild, so they failed too. A row nobody can read is one\n * nobody can call: it is left out, and calling it by name then fails exactly\n * the way an unknown tool fails.\n *\n * Leniency covers a row that cannot be decrypted — never a deployment with no\n * usable key at all. The key is therefore obtained OUTSIDE the `try`: an unset\n * or malformed `CE_SECRET_KEY` (say, after an upgrade) is an operator fault,\n * and swallowing it made EVERY tool with a stored config vanish from\n * list/search/execute behind a per-row \"was the key rotated?\" warning. Only a\n * decrypt failure — wrong key, corrupt blob — is lenient.\n *\n * The warning carries the id, the name and the phrase `config_error` — never\n * the ciphertext, never the key.\n */\nfunction rowToToolConfigLenient(row: Record<string, unknown>, engine: ToolEngine): ToolConfig | null {\n if (!row.config_encrypted) return rowToToolConfig(row, engine, {});\n const key = cryptoKey(engine);\n let config: Record<string, unknown>;\n try {\n config = decryptDict(String(row.config_encrypted), key);\n } catch {\n console.warn(\n `tool ${String(row.id)} (${String(row.name)}): config_error — its stored config ` +\n `could not be decrypted (was the secret key rotated?); leaving it out of the tool set`,\n );\n return null;\n }\n return rowToToolConfig(row, engine, config);\n}\n\nasync function loadPersistedCanonicals(\n engine: ToolEngine,\n sourceId: string | null,\n): Promise<CanonicalTool[]> {\n const params: unknown[] = [];\n let sql = `SELECT * FROM context_engine_tools WHERE enabled IS TRUE`;\n if (sourceId != null) {\n params.push(sourceId);\n sql += ` AND source_id = $1`;\n }\n const result = await engine.pool.query(sql, params);\n const canonicals: CanonicalTool[] = [];\n for (const row of result.rows) {\n const tc = rowToToolConfigLenient(row, engine);\n if (tc === null) continue;\n canonicals.push(...canonicalFromConfig(tc));\n }\n return canonicals;\n}\n\nasync function mergedTools(engine: ToolEngine, sourceId: string | null): Promise<CanonicalTool[]> {\n const persisted = await loadPersistedCanonicals(engine, sourceId);\n const functions = Object.values(engine._functionTools ?? {});\n return [...persisted, ...functions];\n}\n\nfunction canonicalToPublic(ct: CanonicalTool): Record<string, unknown> {\n return {\n name: ct.callName,\n kind: ct.kind,\n description: ct.description,\n params_schema: ct.paramsSchema,\n };\n}\n\nexport async function registerTool(engine: ToolEngine, tc: ToolConfig): Promise<string> {\n canonicalFromConfig(tc);\n const config = tc.config ?? {};\n // The natural duplicate-a-tool flow (GET → copy config_redacted → POST)\n // would otherwise encrypt the literal sentinel as a live credential and\n // send \"Authorization: __redacted__\" to the real endpoint on every call.\n if (containsSentinel(config)) {\n throw new ConfigTemplateError(\n `config contains the ${JSON.stringify(REDACTED_SENTINEL)} placeholder — a redacted ` +\n `template cannot be registered as a new tool; re-enter the secret values`,\n );\n }\n const configEncrypted = Object.keys(config).length ? encryptDict(config, cryptoKey(engine)) : null;\n const id = randomUUID();\n await engine.pool.query(\n `INSERT INTO context_engine_tools\n (id, name, kind, description, source_id, acl, config_encrypted,\n requires_approval, approval_policy, enabled, meta_data)\n VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9::jsonb, $10, $11::jsonb)`,\n [\n id,\n tc.name,\n tc.kind,\n tc.description || \"\",\n tc.sourceId,\n tc.acl,\n configEncrypted,\n tc.requiresApproval,\n JSON.stringify(tc.approvalPolicy ?? {}),\n tc.enabled,\n JSON.stringify(tc.metaData ?? {}),\n ],\n );\n return id;\n}\n\nexport async function updateTool(\n engine: ToolEngine,\n id: string,\n opts: { principals?: string[] | null | Trusted } & Record<string, unknown>,\n): Promise<ToolConfig> {\n const { principals = null, ...fields } = opts;\n const existing = await engine.pool.query(`SELECT * FROM context_engine_tools WHERE id = $1`, [id]);\n const row = existing.rows[0];\n if (!row || !aclVisible(row.acl != null ? [...row.acl] : null, principals)) {\n throw new EngineActionError(`tool not found: ${id}`);\n }\n const sets: string[] = [];\n const params: unknown[] = [];\n let i = 1;\n for (const [key, value] of Object.entries(fields)) {\n if (key === \"config\") {\n // Redacted round-trip (tools/config.ts): a client that prefilled its\n // form from `config_redacted` sends REDACTED_SENTINEL for every secret\n // it did not retype — substitute the stored values before\n // re-encrypting, so an ordinary re-save can never corrupt credentials.\n // The stored blob is decrypted ONLY when a sentinel needs resolving: a\n // sentinel-FREE config replaces outright, which is precisely the\n // recovery path after a key rotation.\n let config = value as Record<string, unknown> | null;\n if (config && containsSentinel(config)) {\n // Presence check, not a value coalesce: an explicit `kind: null`\n // must hit this guard (Python checks `\"kind\" in fields`), never\n // slip past it into the merge and an UPDATE that nulls the column.\n if (Object.hasOwn(fields, \"kind\") && fields.kind !== row.kind) {\n throw new ConfigTemplateError(\n \"cannot change kind and keep redacted secrets in one PATCH — re-enter the config in full\",\n );\n }\n // A masked→clear transition on the body must not ride on the merge:\n // flipping body_secret off while the body still echoes sentinels\n // would resolve the STORED secret body and serve it in clear on the\n // next GET.\n if (config.body_secret === false && containsSentinel(config.body)) {\n throw new ConfigTemplateError(\n `body_secret cannot be turned off while the body still contains ` +\n `${JSON.stringify(REDACTED_SENTINEL)} — re-enter the body to declassify it`,\n );\n }\n if (!row.config_encrypted) {\n throw new ConfigTemplateError(\n `config contains ${JSON.stringify(REDACTED_SENTINEL)} but this tool has no ` +\n `stored config to keep — re-enter the secret values`,\n );\n }\n // The key is obtained OUTSIDE the `try`: a missing or malformed\n // key is an operator fault (500), not the caller's \"re-enter the\n // config\" 400 the catch below reports for a rotated/corrupt blob.\n const key = cryptoKey(engine);\n let stored: Record<string, unknown>;\n try {\n stored = decryptDict(String(row.config_encrypted), key);\n } catch (exc) {\n throw new ConfigTemplateError(\n `the stored config cannot be decrypted (was the secret key rotated?) — ` +\n `re-enter the config in full, without ${JSON.stringify(REDACTED_SENTINEL)} values`,\n { cause: exc },\n );\n }\n config = mergeRedacted(config, stored);\n }\n sets.push(`config_encrypted = $${i++}`);\n // An empty config clears to NULL, matching Python's falsy-dict branch.\n params.push(config && Object.keys(config).length ? encryptDict(config, cryptoKey(engine)) : null);\n } else if (UPDATABLE_COLUMNS.has(key)) {\n const col =\n key === \"sourceId\"\n ? \"source_id\"\n : key === \"requiresApproval\"\n ? \"requires_approval\"\n : key === \"approvalPolicy\"\n ? \"approval_policy\"\n : key === \"metaData\"\n ? \"meta_data\"\n : key;\n sets.push(`${col} = $${i++}`);\n params.push(col === \"approval_policy\" || col === \"meta_data\" ? JSON.stringify(value ?? {}) : value);\n }\n }\n sets.push(`updated_at = now()`);\n params.push(id);\n const updated = await engine.pool.query(\n `UPDATE context_engine_tools SET ${sets.join(\", \")} WHERE id = $${i} RETURNING *`,\n params,\n );\n // The update is already persisted, so an undecryptable blob must not turn a\n // successful PATCH into a failure — the response reports the columns and an\n // empty config, with the warning above logged.\n const row_ = updated.rows[0];\n return rowToToolConfigLenient(row_, engine) ?? rowToToolConfig(row_, engine, {});\n}\n\nexport async function deleteTool(\n engine: ToolEngine,\n id: string,\n opts: { principals?: string[] | null | Trusted } = {},\n): Promise<void> {\n const existing = await engine.pool.query(`SELECT * FROM context_engine_tools WHERE id = $1`, [id]);\n const row = existing.rows[0];\n if (!row || !aclVisible(row.acl != null ? [...row.acl] : null, opts.principals ?? null)) {\n throw new EngineActionError(`tool not found: ${id}`);\n }\n await engine.pool.query(`DELETE FROM context_engine_tools WHERE id = $1`, [id]);\n}\n\nexport async function listTools(\n engine: ToolEngine,\n opts: { sourceId?: string | null; principals?: string[] | null | Trusted } = {},\n): Promise<Array<Record<string, unknown>>> {\n const tools = await mergedTools(engine, opts.sourceId ?? null);\n return tools.filter((ct) => toolVisible(ct, opts.principals ?? null)).map(canonicalToPublic);\n}\n\nexport async function searchTools(\n engine: ToolEngine,\n query: string,\n opts: { sourceId?: string | null; principals?: string[] | null | Trusted; limit?: number } = {},\n): Promise<Array<Record<string, unknown>>> {\n const listed = await listTools(engine, { sourceId: opts.sourceId, principals: opts.principals });\n const limit = opts.limit ?? 10;\n const normalized = (query || \"\").toLowerCase().trim();\n if (!normalized) return listed.slice(0, limit);\n const terms = normalized.split(/\\s+/);\n const scored: Array<[number, Record<string, unknown>]> = [];\n for (const tool of listed) {\n const haystack = `${tool.name} ${tool.description}`.toLowerCase();\n const score = terms.reduce((n, term) => n + (haystack.includes(term) ? 1 : 0), 0);\n if (score > 0) scored.push([score, tool]);\n }\n scored.sort((a, b) => b[0] - a[0]);\n return scored.slice(0, limit).map(([, t]) => t);\n}\n\nconst PROBE_AUTH = [\n \"authentication failed\",\n \"pg_hba\",\n \"permission denied\",\n \"access denied\",\n \"password\",\n \"unauthorized\",\n \"forbidden\",\n \"401\",\n \"403\",\n \"invalid credentials\",\n];\nconst PROBE_UNREACHABLE = [\n \"connection refused\",\n \"could not connect\",\n \"name or service not known\",\n \"nodename nor servname\",\n \"no route to host\",\n \"network is unreachable\",\n \"temporary failure in name resolution\",\n \"getaddrinfo\",\n \"connection reset\",\n \"fetch failed\",\n \"econnrefused\",\n \"enotfound\",\n];\nconst PROBE_TIMEOUT = [\"timed out\", \"timeout\", \"aborted\"];\nconst PROBE_MISCONFIGURED = [\n \"does not exist\",\n \"invalid\",\n \"unknown database\",\n \"syntax error\",\n \"no such\",\n \"missing\",\n \"not supported\",\n \"unsupported\",\n];\n\nfunction classifyProbeError(exc: unknown): string {\n if (exc instanceof DOMException && exc.name === \"TimeoutError\") return \"timeout\";\n const name = exc instanceof Error ? exc.name : \"\";\n if (name.includes(\"Timeout\")) return \"timeout\";\n if ([\"ConnectError\", \"ConnectionError\", \"NetworkError\", \"TypeError\"].some((t) => name.includes(t))) {\n if (name === \"TypeError\" && !String(exc).toLowerCase().includes(\"fetch\")) {\n /* fall through */\n } else if (name !== \"TypeError\") return \"unreachable\";\n }\n if ([\"Auth\", \"Permission\", \"Forbidden\", \"Unauthorized\"].some((t) => name.includes(t))) return \"auth_failed\";\n const text = String(exc).toLowerCase();\n if (PROBE_TIMEOUT.some((t) => text.includes(t))) return \"timeout\";\n if (PROBE_AUTH.some((t) => text.includes(t))) return \"auth_failed\";\n if (PROBE_UNREACHABLE.some((t) => text.includes(t))) return \"unreachable\";\n if (PROBE_MISCONFIGURED.some((t) => text.includes(t))) return \"misconfigured\";\n return \"error\";\n}\n\nfunction probeFailure(exc: unknown, kind: string): Record<string, unknown> {\n const category = classifyProbeError(exc);\n console.warn(`test_tool(kind=${kind}) failed:`, exc, \"->\", category);\n return { ok: false, error: category };\n}\n\nexport async function testTool(engine: ToolEngine, tc: ToolConfig): Promise<Record<string, unknown>> {\n const kind = tc.kind;\n const config = tc.config ?? {};\n // A form prefilled from `config_redacted` still holds the sentinel for\n // every secret the user did not retype; probing with it would send the\n // literal placeholder as the credential to the REAL endpoint and report a\n // misleading auth failure. No stored row to merge from on this inline\n // path — same caller error as POST /tools.\n if (containsSentinel(config)) {\n throw new ConfigTemplateError(\n `config contains the ${JSON.stringify(REDACTED_SENTINEL)} placeholder — a probe ` +\n `would send it verbatim as the credential; re-enter the secret values`,\n );\n }\n if (kind === \"http\") {\n const url = config.url as string | undefined;\n if (!url) return { ok: false, error: \"http config missing 'url'\" };\n // The probe is the same outbound fetch the executor makes, behind a\n // different button — it gets the same egress policy (tools/egress.ts). A\n // refusal is a result, not an exception: this function's contract is\n // `{ ok, error: <category> }`.\n try {\n await assertEgressAllowed(url, { allowPrivate: allowPrivateEgress(engine) });\n } catch (exc) {\n if (exc instanceof EgressDenied) {\n console.warn(`testTool(kind=http) refused: ${exc.message}`);\n return { ok: false, error: \"egress_denied\" };\n }\n throw exc;\n }\n const client = engine?._toolHttpClient ?? null;\n try {\n const resp = client\n ? await client.request({\n method: \"HEAD\",\n url,\n headers: (config.headers as Record<string, string>) ?? {},\n })\n : await fetch(url, {\n method: \"HEAD\",\n headers: (config.headers as Record<string, string>) ?? {},\n // No automatic follow: a redirect would reach a destination the\n // check above never saw.\n redirect: \"manual\",\n signal: AbortSignal.timeout(10_000),\n });\n return { ok: resp.status < 500, status_code: resp.status };\n } catch (exc) {\n return probeFailure(exc, \"http\");\n }\n }\n if (kind === \"db\") {\n try {\n const { testConnection } = await import(\"./executors/db.js\");\n const result = await testConnection(config);\n return { ok: Boolean(result.success ?? result.ok), ...result };\n } catch (exc) {\n return probeFailure(exc, \"db\");\n }\n }\n if (kind === \"mcp\") {\n const url = config.url as string | undefined;\n if (!url) return { ok: false, error: \"mcp config missing 'url'\" };\n const token = (config.oauth_token ?? config.bearer ?? config.access_token) as string | undefined;\n // Same egress policy as the http probe, applied where the MCP client\n // dials (see `executors/mcp-client.ts`): the server URL, the SSE POST\n // endpoint the server hands back, the WebSocket URL. A refusal is a\n // result, not an exception — the same `{ ok: false, error:\n // \"egress_denied\" }` the http branch returns.\n const mcp = new PromptevMCP({ allowPrivate: allowPrivateEgress(engine) });\n try {\n await mcp.addServer(tc.name, url, { token: token ?? null });\n const client = mcp.clients.get(tc.name);\n return { ok: true, tools: client.tools.map((t) => t.name) };\n } catch (exc) {\n if (exc instanceof EgressDenied) {\n console.warn(`testTool(kind=mcp) refused: ${exc.message}`);\n return { ok: false, error: \"egress_denied\" };\n }\n return probeFailure(exc, \"mcp\");\n } finally {\n await mcp.shutdown();\n }\n }\n return { ok: false, error: `test_tool does not support kind=${JSON.stringify(kind)}` };\n}\n\n/**\n * Find an `approved` approval matching this exact call and atomically claim\n * it (flip `approved` -> `executed`), returning its id; `null` if none.\n *\n * \"This exact call\" is four equalities and one wall, all of which must hold:\n * tool name, frozen args and `source_id` (the call as issued);\n * `approval_scope`, the PRIMARY wall — `null` only matches `null`, a scoped\n * record matches only its own scope, so records never share one pool across\n * callers; and `principals`, the second wall (`claimVisibilitySql`) — when\n * the record carries principals the caller must overlap them, a record\n * carrying none imposes no wall. The wall alone is what closes the\n * cross-caller claim on the unscoped legacy path for every signed-in caller.\n */\nasync function findAndClaimApproved(\n engine: ToolEngine,\n toolName: string,\n args: Record<string, unknown>,\n sourceId: string | null,\n principals: string[] | null | Trusted,\n approvalScope: string | null,\n): Promise<string | null> {\n const claimedAt = new Date();\n const params: unknown[] = [toolName];\n let scopeSql = \"approval_scope IS NULL\";\n if (approvalScope !== null) {\n params.push(approvalScope);\n scopeSql = `approval_scope = $${params.length}`;\n }\n const wall = claimVisibilitySql(principals, params.length + 1);\n params.push(...wall.params);\n const candidates = await engine.pool.query(\n `SELECT * FROM context_engine_tool_approvals\n WHERE tool_name = $1 AND status = 'approved' AND ${scopeSql} AND ${wall.sql}`,\n params,\n );\n for (const row of candidates.rows) {\n if ((row.source_id ?? null) !== (sourceId ?? null)) continue;\n const frozen = row.tool_args_frozen ?? {};\n if (JSON.stringify(frozen) !== JSON.stringify(args)) continue;\n const result = await engine.pool.query(\n `UPDATE context_engine_tool_approvals\n SET status = 'executed', resolved_at = $1\n WHERE id = $2 AND status = 'approved'\n RETURNING id`,\n [claimedAt, row.id],\n );\n if (result.rowCount === 1) return String(row.id);\n }\n return null;\n}\n\n/**\n * Execute one MCP tool call via a short-lived `PromptevMCP` connection.\n *\n * `allowPrivate` is the operator knob, threaded down to every destination the\n * client dials. It defaults to `false`: a call site that forgets it denies\n * rather than permits, and an `EgressDenied` raised out of the connect\n * surfaces from `executeTool` as the `EngineActionError` any executor failure\n * surfaces as.\n */\nasync function dispatchMcp(\n ct: CanonicalTool,\n config: Record<string, unknown>,\n args: Record<string, unknown>,\n opts: { allowPrivate?: boolean } = {},\n): Promise<unknown> {\n const url = config.url as string | undefined;\n if (!url) throw new EngineActionError(`mcp tool ${ct.callName} config missing 'url'`);\n const headers = { ...((config.headers as Record<string, string>) ?? {}) };\n const token = (config.oauth_token ?? config.bearer ?? config.access_token) as string | undefined;\n const apiKey = config.api_key as string | undefined;\n if (token) headers.Authorization = `Bearer ${token}`;\n else if (apiKey) headers.Authorization = `Bearer ${apiKey}`;\n const toolName = String(ct.raw?.tool_name ?? ct.displayName);\n const mcp = new PromptevMCP({ allowPrivate: opts.allowPrivate ?? false });\n try {\n await mcp.addServer(ct.callName, url, { headers: Object.keys(headers).length ? headers : null });\n const client = mcp.clients.get(ct.callName);\n return await client.callToolWithReconnect(toolName, args);\n } finally {\n await mcp.shutdown();\n }\n}\n\nasync function dispatch(\n engine: ToolEngine,\n ct: CanonicalTool,\n config: Record<string, unknown>,\n args: Record<string, unknown>,\n): Promise<unknown> {\n if (ct.kind === \"http\") {\n return executeHttp(config, args, {\n client: engine._toolHttpClient ?? null,\n allowPrivate: allowPrivateEgress(engine),\n });\n }\n if (ct.kind === \"db\") {\n const query = String(args.query ?? \"\");\n if (query.trim().toLowerCase().startsWith(\"describe:\")) {\n const tables = query\n .slice(query.indexOf(\":\") + 1)\n .split(\",\")\n .map((t) => t.trim())\n .filter(Boolean);\n const schemaText = await getSchemaText(config, tables.length ? tables : null);\n return { success: true, schema: schemaText };\n }\n const result = await executeDb(config, query);\n if (result && typeof result === \"object\" && result.success === false) {\n throw new EngineActionError(String(result.error || \"database query failed\"));\n }\n return result;\n }\n if (ct.kind === \"mcp\") {\n return dispatchMcp(ct, config, args, { allowPrivate: allowPrivateEgress(engine) });\n }\n if (ct.kind === \"function\") {\n const fn = ct.raw?.callable as ((...a: unknown[]) => unknown) | undefined;\n if (!fn) throw new EngineActionError(`function tool ${ct.callName} has no callable`);\n return await fn(...namedArgs(fn, args));\n }\n throw new EngineActionError(`unsupported tool kind: ${JSON.stringify(ct.kind)}`);\n}\n\nfunction namedArgs(fn: (...a: unknown[]) => unknown, args: Record<string, unknown>): unknown[] {\n const src = Function.prototype.toString.call(fn);\n const match = src.match(/\\(([^)]*)\\)/);\n const names = (match?.[1] ?? \"\")\n .split(\",\")\n .map((p) => p.trim().split(/\\s*=/)[0]?.trim())\n .filter(Boolean);\n if (!names.length) return Object.values(args);\n return names.map((n) => args[n!]);\n}\n\nasync function decryptCtConfig(engine: ToolEngine, toolId: string): Promise<Record<string, unknown>> {\n const result = await engine.pool.query(`SELECT config_encrypted FROM context_engine_tools WHERE id = $1`, [\n toolId,\n ]);\n const row = result.rows[0];\n if (!row?.config_encrypted) return {};\n return decryptDict(String(row.config_encrypted), cryptoKey(engine));\n}\n\nconst warnedUnscoped = new Set<string>();\n\nfunction warnUnscopedApproval(callName: string): void {\n if (warnedUnscoped.has(callName)) return;\n warnedUnscoped.add(callName);\n process.emitWarning(\n `executeTool(${JSON.stringify(callName)}) needs an approval but was called without ` +\n \"approvalScope. The record is opened and matched UNSCOPED (tool + args + \" +\n \"sourceId, behind the principals wall). Pass approvalScope: <opaque string> \" +\n \"(e.g. a run id) so approvals are claimable only within that scope; a gated \" +\n \"call without one will be refused in the next release.\",\n { type: \"DeprecationWarning\", code: \"CE_APPROVAL_SCOPE_MISSING\" },\n );\n}\n\nexport async function executeTool(\n engine: ToolEngine,\n callName: string,\n args: Record<string, unknown> | null | undefined,\n opts: {\n sourceId?: string | null;\n principals?: string[] | null | Trusted;\n actor?: { type?: string; id?: unknown } | null;\n source?: string;\n /** Opaque host-chosen claim scope for approvals (a run id is the\n * expected shape) — SEPARATE from `sourceId`, which scopes tool LOOKUP.\n * Stamped on the pending record this call opens and the primary wall on\n * the record a later call may claim; identical gated calls within a\n * scope share one pending record. Resolve it SERVER-SIDE — never from a\n * request body or a model's arguments. `null`/omitted is the legacy\n * unscoped path, kept for one release with a DeprecationWarning; the\n * next release refuses a gated call without a scope. */\n approvalScope?: string | null;\n } = {},\n): Promise<Record<string, unknown>> {\n const runtimeArgs = args ?? {};\n const approvalScope = validateApprovalScope(opts.approvalScope);\n const ct = findTool(await mergedTools(engine, opts.sourceId ?? null), callName);\n if (!ct) throw new EngineActionError(`tool not found: ${callName}`);\n if (!toolVisible(ct, opts.principals ?? null)) {\n throw new EngineActionError(`tool not found: ${callName}`);\n }\n\n const publicArgs = stripUnderscoreArgs(runtimeArgs);\n let approvalId: string | null = null;\n if (shouldRequireApproval(ct, publicArgs)) {\n if (approvalScope === null) warnUnscopedApproval(callName);\n approvalId = await findAndClaimApproved(\n engine,\n ct.callName,\n publicArgs,\n opts.sourceId ?? null,\n opts.principals ?? null,\n approvalScope,\n );\n if (approvalId == null) {\n const pendingOpts = {\n toolName: ct.callName,\n args: publicArgs,\n sourceId: opts.sourceId ?? null,\n principals: opts.principals ?? null,\n policy: ct.approvalPolicy ?? {},\n };\n const record =\n approvalScope === null\n ? await createPending(engine, pendingOpts)\n : await findOrCreatePending(engine, { ...pendingOpts, approvalScope });\n const reason = ct.requiresApproval\n ? \"tool requires approval\"\n : `approval policy condition met: ${ct.approvalPolicy?.condition}`;\n return {\n approval_required: {\n approval_id: String(record.id),\n tool_name: ct.callName,\n args: publicArgs,\n reason,\n expires_at: record.expiresAt ? record.expiresAt.toISOString() : null,\n },\n };\n }\n }\n\n let config: Record<string, unknown> = {};\n if (ct.kind !== \"function\" && ct.id != null) {\n config = await decryptCtConfig(engine, ct.id);\n }\n\n const actorType = opts.actor?.type ?? null;\n const actorId = opts.actor?.id ?? null;\n let rawResult: unknown = null;\n let exc: unknown = null;\n const timer = new ToolCallTimer().start();\n try {\n rawResult = await dispatch(engine, ct, config, publicArgs);\n } catch (e) {\n exc = e;\n }\n timer.stop();\n\n let success = exc == null;\n let shaped: unknown = null;\n let truncated = false;\n if (success) {\n try {\n // Redaction speaks the resolved form only — the sentinel means null.\n // (Cast: `=== TRUSTED` excludes the sentinel at runtime, but TS does\n // not narrow a class-instance union member on equality.)\n const redactPrincipals =\n opts.principals === TRUSTED ? null : ((opts.principals ?? null) as string[] | null);\n const [redacted] = redactToolResult(rawResult, engine.config.redaction, {\n principals: redactPrincipals,\n secretKey: engine.config.secretKey,\n hooks: engine.hooks,\n });\n rawResult = redacted;\n [shaped, truncated] = shapeResult(rawResult);\n } catch (e) {\n exc = e;\n success = false;\n }\n }\n\n await logToolCall(engine, {\n toolId: ct.id,\n toolName: ct.callName,\n kind: ct.kind,\n actorType,\n actorId,\n source: opts.source ?? \"api\",\n inputArgs: publicArgs,\n outputResult: success ? rawResult : null,\n success,\n error: exc,\n durationMs: timer.durationMs,\n units: success ? 1 : 0,\n approvalId,\n });\n\n if (!success) {\n throw new EngineActionError(`tool execution failed: ${ct.callName}: ${exc}`);\n }\n\n const usage: UsageEvent = {\n kind: \"tool\",\n units: 1,\n detail: { tool_name: ct.callName, kind: ct.kind, truncated },\n };\n emitUsage(engine.hooks, usage);\n\n return {\n result: shaped,\n usage: { units: 1, kind: \"tool\", tool_name: ct.callName, truncated },\n };\n}\n","import type { UsageEvent } from \"./usage.js\";\n\nconst log = {\n warn: (...args: unknown[]) => console.warn(\"[context-engine]\", ...args),\n error: (...args: unknown[]) => console.error(\"[context-engine]\", ...args),\n};\n\n/**\n * One ingest stage boundary. `documentId` is null until the row is claimed\n * (extraction runs before that, so dedup can decide from the extracted\n * text); `sourceId` + `externalId` are the caller's own identity and exist\n * on every event. `detail` is per stage and always JSON-serialisable.\n */\nexport interface ProgressEvent {\n sourceId: string | null;\n externalId: string | null;\n documentId: string | null;\n name: string;\n stage: \"extract\" | \"redact\" | \"chunk\" | \"embed\" | \"structured\" | \"graph\";\n state: \"started\" | \"done\";\n detail: Record<string, unknown>;\n}\n\nexport interface Hooks {\n onUsage?: ((event: UsageEvent) => void) | null;\n onError?: ((exc: unknown, ctx: Record<string, unknown>) => void) | null;\n onToolCall?: ((event: Record<string, unknown>) => void) | null;\n /** Ingest stage boundaries, for live progress UIs. Never raises outward. */\n onProgress?: ((event: ProgressEvent) => void) | null;\n}\n\nexport function emitUsage(hooks: Hooks | null | undefined, event: UsageEvent): void {\n if (!hooks?.onUsage) return;\n try {\n hooks.onUsage(event);\n } catch {\n log.warn(\"onUsage callback raised; swallowing\");\n }\n}\n\nexport function emitError(hooks: Hooks | null | undefined, exc: unknown, ctx: Record<string, unknown>): void {\n log.error(\"context_engine error:\", exc, \"| ctx=\", ctx);\n if (!hooks?.onError) return;\n try {\n hooks.onError(exc, ctx);\n } catch {\n log.warn(\"onError callback raised; swallowing\");\n }\n}\n\n/** Report an ingest stage boundary to `hooks.onProgress`, if set. Never raises. */\nexport function emitProgress(hooks: Hooks | null | undefined, event: ProgressEvent): void {\n if (!hooks?.onProgress) return;\n try {\n hooks.onProgress(event);\n } catch {\n log.warn(\"onProgress callback raised; swallowing\");\n }\n}\n\nexport function emitToolCall(hooks: Hooks | null | undefined, event: Record<string, unknown>): void {\n if (!hooks?.onToolCall) return;\n try {\n hooks.onToolCall(event);\n } catch {\n log.warn(\"onToolCall callback raised; swallowing\");\n }\n}\n","import { hmacSha256Hex } from \"./crypto.js\";\nimport { emitError, type Hooks } from \"./hooks.js\";\n\nexport type Span = [number, number];\nexport type DetectorFn = (text: string) => Span[];\nexport type RedactionAction = \"mask\" | \"hash\" | \"remove\";\nexport type ApplyAt = \"ingest\" | \"output\" | \"both\";\nexport type RedactionPhase = \"ingest\" | \"output\";\n\nexport const BUILTIN_DETECTOR_NAMES = new Set([\"email\", \"phone\", \"ssn\", \"credit_card\", \"iban\", \"api_key\"]);\n\nexport interface RedactionRuleInit {\n name: string;\n detector?: string | null;\n pattern?: string | null;\n field?: string | null;\n action?: RedactionAction;\n placeholder?: string | null;\n applyAt?: ApplyAt;\n unless?: string[];\n}\n\nexport class RedactionRule {\n name: string;\n detector: string | null;\n pattern: string | null;\n field: string | null;\n action: RedactionAction;\n placeholder: string | null;\n applyAt: ApplyAt;\n unless: string[];\n private compiled: RegExp | null = null;\n\n constructor(init: RedactionRuleInit) {\n this.name = init.name;\n this.detector = init.detector ?? null;\n this.pattern = init.pattern ?? null;\n this.field = init.field ?? null;\n this.action = init.action ?? \"mask\";\n this.placeholder = init.placeholder ?? null;\n this.applyAt = init.applyAt ?? \"output\";\n this.unless = init.unless ?? [];\n this.validate();\n }\n\n private validate(): void {\n if (this.field !== null) {\n throw new Error(\n `rule '${this.name}': field-targeted rules are not implemented yet; use detector or pattern instead`,\n );\n }\n const targets = [this.detector, this.pattern].filter((t) => t !== null);\n if (targets.length !== 1) {\n throw new Error(`rule '${this.name}': exactly one of detector/pattern must be set`);\n }\n if (this.pattern !== null) {\n try {\n this.compiled = new RegExp(this.pattern, \"g\");\n } catch (exc) {\n throw new Error(`rule '${this.name}': invalid regex: ${exc}`);\n }\n }\n if (this.unless.length && this.applyAt === \"ingest\") {\n throw new Error(\n `rule '${this.name}': unless is output-time only and cannot be set on an applyAt='ingest' rule`,\n );\n }\n }\n\n patternRe(): RegExp | null {\n return this.compiled;\n }\n\n effectivePlaceholder(): string {\n return this.placeholder || `[${this.name.toUpperCase()}]`;\n }\n}\n\nexport interface RedactionPolicyInit {\n rules?: RedactionRule[] | RedactionRuleInit[];\n customDetectors?: Record<string, DetectorFn>;\n}\n\nexport class RedactionPolicy {\n rules: RedactionRule[];\n customDetectors: Record<string, DetectorFn>;\n\n constructor(init: RedactionPolicyInit = {}) {\n this.rules = (init.rules ?? []).map((r) => (r instanceof RedactionRule ? r : new RedactionRule(r)));\n this.customDetectors = init.customDetectors ?? {};\n const seen = new Set<string>();\n for (const rule of this.rules) {\n if (seen.has(rule.name)) throw new Error(`duplicate rule name: '${rule.name}'`);\n seen.add(rule.name);\n if (rule.detector !== null) {\n const known = BUILTIN_DETECTOR_NAMES.has(rule.detector) || rule.detector in this.customDetectors;\n if (!known) {\n throw new Error(\n `rule '${rule.name}': unknown detector '${rule.detector}' (not built-in and not in customDetectors)`,\n );\n }\n }\n }\n }\n\n isEmpty(): boolean {\n return this.rules.length === 0;\n }\n}\n\nconst EMAIL_RE = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}/g;\nconst PHONE_RE = /\\+\\d[\\d\\s-]{7,17}\\d/g;\nconst SSN_RE = /(?<!\\d)\\d{3}-\\d{2}-\\d{4}(?!\\d)/g;\nconst CARD_RE = /(?<!\\d)(?:\\d[ -]?){12,18}\\d(?!\\d)/g;\nconst IBAN_RE = /(?<![A-Za-z0-9])[A-Z]{2}\\d{2}[A-Z0-9]{10,30}(?![A-Za-z0-9])/g;\nconst API_KEY_ALNUM = \"A-Za-z0-9_\\\\-+/=\";\nconst API_KEY_PREFIX_RE = new RegExp(\n `(?<![${API_KEY_ALNUM}])(?:(?:AKIA|ASIA)[0-9A-Z]{16}|sk-[A-Za-z0-9]{20,}|gh[opsu]_[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9\\\\-]{10,}|AIza[0-9A-Za-z_\\\\-]{35})(?![${API_KEY_ALNUM}])`,\n \"g\",\n);\nconst API_KEY_GENERIC_RE = new RegExp(\n `(?<![${API_KEY_ALNUM}])[${API_KEY_ALNUM}]{24,}(?![${API_KEY_ALNUM}])`,\n \"g\",\n);\nconst UUID_RE = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;\n\nfunction spansFrom(re: RegExp, text: string): Span[] {\n const out: Span[] = [];\n re.lastIndex = 0;\n let m = re.exec(text);\n while (m !== null) {\n out.push([m.index, m.index + m[0].length]);\n if (m[0].length === 0) re.lastIndex++;\n m = re.exec(text);\n }\n return out;\n}\n\nfunction luhnOk(digits: string): boolean {\n let total = 0;\n const rev = [...digits].reverse();\n for (let i = 0; i < rev.length; i++) {\n let d = Number(rev[i]);\n if (i % 2 === 1) {\n d *= 2;\n if (d > 9) d -= 9;\n }\n total += d;\n }\n return total % 10 === 0;\n}\n\nfunction detectCreditCard(text: string): Span[] {\n const spans: Span[] = [];\n for (const [start, end] of spansFrom(CARD_RE, text)) {\n const digits = text.slice(start, end).replace(/[ -]/g, \"\");\n if (digits.length >= 13 && digits.length <= 19 && luhnOk(digits)) {\n spans.push([start, end]);\n }\n }\n return spans;\n}\n\nfunction looksLikeGenericSecret(token: string): boolean {\n if (UUID_RE.test(token)) return false;\n let hasUpper = false;\n let hasLower = false;\n let hasDigit = false;\n for (const c of token) {\n if (c >= \"A\" && c <= \"Z\") hasUpper = true;\n else if (c >= \"a\" && c <= \"z\") hasLower = true;\n else if (c >= \"0\" && c <= \"9\") hasDigit = true;\n }\n return hasUpper && hasLower && hasDigit;\n}\n\nfunction detectApiKey(text: string): Span[] {\n const spans = spansFrom(API_KEY_PREFIX_RE, text);\n for (const [start, end] of spansFrom(API_KEY_GENERIC_RE, text)) {\n if (spans.some(([s, e]) => start < e && s < end)) continue;\n if (looksLikeGenericSecret(text.slice(start, end))) spans.push([start, end]);\n }\n return spans;\n}\n\nconst BUILTIN: Record<string, DetectorFn> = {\n email: (t) => spansFrom(EMAIL_RE, t),\n phone: (t) => spansFrom(PHONE_RE, t),\n ssn: (t) => spansFrom(SSN_RE, t),\n credit_card: detectCreditCard,\n iban: (t) => spansFrom(IBAN_RE, t),\n api_key: detectApiKey,\n};\n\nexport function detectBuiltin(name: string, text: string): Span[] {\n const detector = BUILTIN[name];\n if (!detector) throw new Error(`unknown built-in detector: ${name}`);\n if (!text) return [];\n return detector(text).sort((a, b) => a[0] - b[0]);\n}\n\nexport function ruleApplies(\n rule: RedactionRule,\n opts: { phase: RedactionPhase; principals: readonly string[] | null },\n): boolean {\n if (rule.applyAt !== \"both\" && rule.applyAt !== opts.phase) return false;\n if (opts.phase === \"ingest\") return true;\n if (!rule.unless.length) return true;\n if (opts.principals === null) return false;\n const held = new Set(opts.principals);\n return !rule.unless.some((p) => held.has(p));\n}\n\nfunction spansForRule(rule: RedactionRule, text: string, policy: RedactionPolicy): Span[] {\n if (rule.pattern !== null) {\n const re = rule.patternRe() ?? new RegExp(rule.pattern, \"g\");\n return spansFrom(re, text);\n }\n if (rule.detector !== null) {\n const custom = policy.customDetectors[rule.detector];\n if (custom) return [...custom(text)];\n return detectBuiltin(rule.detector, text);\n }\n return [];\n}\n\nconst HASH_TOKEN_CHARS = 16;\n\nfunction hashToken(value: string, secretKey: string | Buffer | null | undefined): string {\n const key = Buffer.isBuffer(secretKey) ? secretKey : Buffer.from(String(secretKey ?? \"\"));\n return hmacSha256Hex(key, value).slice(0, HASH_TOKEN_CHARS);\n}\n\nexport interface RedactionNote {\n rules_fired?: string[];\n spans?: number;\n rules_failed?: string[];\n}\n\nexport function applyRedaction(\n text: string,\n policy: RedactionPolicy,\n opts: {\n phase: RedactionPhase;\n principals?: readonly string[] | null;\n secretKey?: string | Buffer | null;\n hooks?: Hooks | null;\n },\n): [string, RedactionNote] {\n if (!text || policy.isEmpty()) return [text, {}];\n const principals = opts.principals ?? null;\n const collected: Array<[number, number, RedactionRule]> = [];\n const fired: string[] = [];\n const failed: string[] = [];\n\n for (const rule of policy.rules) {\n if (!ruleApplies(rule, { phase: opts.phase, principals })) continue;\n if (rule.action === \"hash\" && !opts.secretKey) {\n throw new Error(\n `rule '${rule.name}': action='hash' requires a non-empty secretKey ` +\n `(an unkeyed HMAC is a reversible pseudonym, not a redaction)`,\n );\n }\n try {\n const raw = spansForRule(rule, text, policy);\n const ruleSpans: Span[] = [];\n let invalid = false;\n for (const item of raw) {\n const start = item?.[0];\n const end = item?.[1];\n if (typeof start !== \"number\" || typeof end !== \"number\") {\n invalid = true;\n continue;\n }\n if (!(start >= 0 && start < end && end <= text.length)) {\n invalid = true;\n continue;\n }\n ruleSpans.push([start, end]);\n }\n if (invalid) failed.push(rule.name);\n for (const [s, e] of ruleSpans) collected.push([s, e, rule]);\n } catch (exc) {\n failed.push(rule.name);\n if (opts.hooks) emitError(opts.hooks, exc, { stage: \"redaction\", rule: rule.name });\n }\n }\n\n if (!collected.length) {\n if (failed.length) return [text, { rules_fired: [], spans: 0, rules_failed: failed }];\n return [text, {}];\n }\n\n collected.sort((a, b) => a[0] - b[0] || b[1] - b[0] - (a[1] - a[0]));\n const merged: Array<[number, number, RedactionRule]> = [];\n for (const [start, end, rule] of collected) {\n const last = merged[merged.length - 1];\n if (last && start < last[1]) {\n if (end > last[1]) last[1] = end;\n continue;\n }\n merged.push([start, end, rule]);\n }\n\n const out: string[] = [];\n let cursor = 0;\n for (const [start, end, rule] of merged) {\n out.push(text.slice(cursor, start));\n const original = text.slice(start, end);\n if (rule.action === \"mask\") out.push(rule.effectivePlaceholder());\n else if (rule.action === \"hash\") {\n out.push(`[${rule.name.toUpperCase()}:${hashToken(original, opts.secretKey)}]`);\n }\n if (!fired.includes(rule.name)) fired.push(rule.name);\n cursor = end;\n }\n out.push(text.slice(cursor));\n\n const note: RedactionNote = { rules_fired: fired, spans: merged.length };\n if (failed.length) note.rules_failed = failed;\n return [out.join(\"\"), note];\n}\n","import { randomUUID } from \"node:crypto\";\nimport { emitToolCall, type Hooks } from \"../hooks.js\";\n\nexport const MAX_OUTPUT_SIZE = 50_000;\nexport const MAX_ERROR_MESSAGE_SIZE = 2_000;\n\ntype EngineLike = {\n pool: { query: (sql: string, params?: unknown[]) => Promise<unknown> };\n hooks?: Hooks | null;\n};\n\nexport class ToolCallTimer {\n private started: number | null = null;\n private ended: number | null = null;\n\n start(): this {\n this.started = Date.now();\n return this;\n }\n\n stop(): this {\n this.ended = Date.now();\n return this;\n }\n\n get durationMs(): number | null {\n if (this.started == null || this.ended == null) return null;\n return this.ended - this.started;\n }\n}\n\nfunction sanitize(obj: unknown): unknown {\n if (obj == null) return obj;\n try {\n return JSON.parse(JSON.stringify(obj, (_k, v) => (typeof v === \"bigint\" ? String(v) : v)));\n } catch {\n return { _raw: String(obj) };\n }\n}\n\nfunction truncateOutput(outputResult: unknown): [unknown, boolean] {\n if (outputResult == null) return [null, false];\n let serialized: string;\n try {\n serialized = JSON.stringify(outputResult);\n } catch {\n serialized = JSON.stringify(String(outputResult));\n }\n if (serialized.length <= MAX_OUTPUT_SIZE) {\n try {\n return [JSON.parse(serialized), false];\n } catch {\n return [outputResult, false];\n }\n }\n return [{ _truncated: serialized.slice(0, MAX_OUTPUT_SIZE), _original_size: serialized.length }, true];\n}\n\nfunction errorMessage(error: unknown): string | null {\n if (error == null) return null;\n const text = error instanceof Error ? error.message : String(error);\n return text.slice(0, MAX_ERROR_MESSAGE_SIZE);\n}\n\nexport async function logToolCall(\n engine: EngineLike,\n row: {\n toolId?: string | null;\n toolName: string;\n kind: string;\n actorType?: string | null;\n actorId?: unknown;\n source?: string | null;\n inputArgs?: Record<string, unknown> | null;\n outputResult?: unknown;\n success?: boolean | null;\n error?: unknown;\n durationMs?: number | null;\n units?: number | null;\n approvalId?: string | null;\n },\n): Promise<void> {\n const event = {\n tool_id: row.toolId != null ? String(row.toolId) : null,\n tool_name: row.toolName,\n kind: row.kind,\n actor_type: row.actorType ?? null,\n actor_id: row.actorId != null ? String(row.actorId) : null,\n source: row.source ?? null,\n input_args: row.inputArgs ?? {},\n output_result: row.outputResult,\n success: row.success ?? null,\n error: row.error != null ? String(row.error) : null,\n duration_ms: row.durationMs ?? null,\n units: row.units ?? null,\n approval_id: row.approvalId ?? null,\n };\n try {\n emitToolCall(engine.hooks, event);\n } catch {\n /* hook must not skip the row */\n }\n try {\n const [stored, truncated] = truncateOutput(row.outputResult);\n const args = sanitize(row.inputArgs ?? {}) ?? {};\n await engine.pool.query(\n `INSERT INTO context_engine_tool_calls\n (id, tool_id, tool_name, kind, actor_type, actor_id, source, input_args, output_result,\n output_truncated, success, error_message, duration_ms, units, approval_id)\n VALUES ($1,$2,$3,$4,$5,$6,$7,$8::jsonb,$9::jsonb,$10,$11,$12,$13,$14,$15)`,\n [\n randomUUID(),\n row.toolId ?? null,\n row.toolName,\n row.kind,\n row.actorType ?? null,\n row.actorId != null ? String(row.actorId) : null,\n row.source ?? \"api\",\n JSON.stringify(args),\n JSON.stringify(stored),\n truncated,\n row.success ?? null,\n errorMessage(row.error),\n row.durationMs ?? null,\n row.units ?? 1,\n row.approvalId ?? null,\n ],\n );\n } catch {\n /* never raises */\n }\n}\n","import { EngineActionError } from \"../../errors.js\";\nimport { assertEgressAllowed, MAX_REDIRECTS, MAX_RESPONSE_BYTES } from \"../egress.js\";\n\nconst TIMEOUT_MS = 30_000;\n\nconst SENSITIVE_RESPONSE_HEADERS = new Set([\n \"set-cookie\",\n \"set-cookie2\",\n \"authorization\",\n \"proxy-authenticate\",\n \"www-authenticate\",\n]);\n\n// The statuses this executor follows BY HAND. Deliberately not `isRedirect`:\n// following needs a `Location`, and the opaque response a browser `fetch`\n// returns under `redirect: \"manual\"` exposes no headers at all — so it can\n// never be followed, and falls out of the loop as the status-0 response it\n// is, with nothing chased.\nconst REDIRECT_STATUS = new Set([301, 302, 303, 307, 308]);\n\n// Dropped when a redirect crosses to a different origin — the credential was\n// issued for the host the tool config names, and handing it to whatever that\n// host redirects to is how a tool's API key ends up somewhere else.\nconst CROSS_ORIGIN_HEADERS = new Set([\"authorization\", \"proxy-authorization\", \"cookie\"]);\n\nfunction percentEncode(value: string): string {\n return encodeURIComponent(value).replace(\n /[!'()*]/g,\n (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`,\n );\n}\n\nfunction extract(\n schema: Record<string, unknown> | null | undefined,\n args: Record<string, unknown>,\n): Record<string, unknown> {\n if (!schema) return {};\n const properties = (schema.properties as Record<string, unknown> | undefined) ?? {};\n const required = (schema.required as unknown[] | undefined) ?? [];\n const values: Record<string, unknown> = {};\n for (const key of Object.keys(properties)) {\n const value = args[key];\n if (required.includes(key) && (value === undefined || value === null || value === \"\")) {\n throw new Error(`Missing required LLM parameter: ${key}`);\n }\n if (value !== undefined && value !== null) values[key] = value;\n }\n return values;\n}\n\nexport type ToolHttpClient = {\n request(init: {\n method: string;\n url: string;\n headers?: Record<string, string>;\n params?: Record<string, unknown>;\n json?: unknown;\n content?: string;\n }): Promise<{\n status: number;\n headers: Record<string, string>;\n json(): Promise<unknown>;\n text(): Promise<string>;\n }>;\n};\n\nfunction withQuery(url: string, params: Record<string, unknown>): string {\n const usp = new URLSearchParams();\n for (const [k, v] of Object.entries(params)) {\n if (v === undefined || v === null) continue;\n usp.set(k, String(v));\n }\n const q = usp.toString();\n if (!q) return url;\n return url.includes(\"?\") ? `${url}&${q}` : `${url}?${q}`;\n}\n\n/**\n * What one hop returns. `ToolHttpClient`'s buffered shape, plus the flag the\n * owned (streaming) path sets when it stopped reading at the cap.\n */\ntype HopResponse = {\n status: number;\n headers: Record<string, string>;\n json(): Promise<unknown>;\n text(): Promise<string>;\n truncated?: boolean;\n};\n\n/**\n * Read a response body chunk by chunk, stopping once the cap is passed and\n * cancelling the rest.\n *\n * Reading the whole body and slicing afterwards would leave the original\n * defect in place: the point of the cap is that an endless response never\n * lands in memory, not that the caller is handed a short string.\n */\nasync function readCapped(resp: Response): Promise<{ text: string; truncated: boolean }> {\n if (!resp.body) return { text: await resp.text(), truncated: false };\n const reader = resp.body.getReader();\n const chunks: Buffer[] = [];\n let size = 0;\n let truncated = false;\n for (;;) {\n const { done, value } = await reader.read();\n if (done) break;\n if (value) {\n chunks.push(Buffer.from(value));\n size += value.byteLength;\n }\n if (size > MAX_RESPONSE_BYTES) {\n truncated = true;\n await reader.cancel();\n break;\n }\n }\n const bytes = Buffer.concat(chunks);\n return {\n text: (truncated ? bytes.subarray(0, MAX_RESPONSE_BYTES) : bytes).toString(\"utf8\"),\n truncated,\n };\n}\n\nasync function defaultRequest(init: {\n method: string;\n url: string;\n headers?: Record<string, string>;\n params?: Record<string, unknown>;\n json?: unknown;\n content?: string;\n}): Promise<HopResponse> {\n let url = init.url;\n if (init.params) url = withQuery(url, init.params);\n const headers: Record<string, string> = { ...(init.headers ?? {}) };\n // `readCapped` counts DECODED bytes, so a compressed body defeats the cap:\n // one raw chunk of gzip can expand ~1000x before the reader gets to stop.\n // Only on this owned path, and only when the tool config did not ask for an\n // encoding itself.\n if (!Object.keys(headers).some((k) => k.toLowerCase() === \"accept-encoding\")) {\n headers[\"Accept-Encoding\"] = \"identity\";\n }\n let body: string | undefined;\n if (init.json !== undefined) {\n headers[\"Content-Type\"] = headers[\"Content-Type\"] ?? headers[\"content-type\"] ?? \"application/json\";\n body = JSON.stringify(init.json);\n } else if (init.content !== undefined) {\n body = init.content;\n }\n const resp = await fetch(url, {\n method: init.method,\n headers,\n body,\n // Redirects are followed by hand in `executeHttp` — an automatic follow\n // would jump to a destination no egress check ever saw.\n redirect: \"manual\",\n signal: AbortSignal.timeout(TIMEOUT_MS),\n });\n const respHeaders: Record<string, string> = {};\n resp.headers.forEach((v, k) => {\n respHeaders[k] = v;\n });\n const { text, truncated } = await readCapped(resp);\n return {\n status: resp.status,\n headers: respHeaders,\n truncated,\n async json() {\n // A leading BOM is common from .NET/Java writers and is not part of the\n // JSON. The body is decoded by hand above (the read stops at the cap),\n // so nothing else strips it and `JSON.parse` would throw, dropping the\n // caller back to raw text.\n return JSON.parse(text.replace(/^/, \"\"));\n },\n async text() {\n return text;\n },\n };\n}\n\ntype RequestInit_ = Parameters<ToolHttpClient[\"request\"]>[0];\n\n/**\n * The request for the redirect at `location`.\n *\n * `location` is resolved against the URL that produced it, so a relative\n * target works. Method semantics: 303 and 302 turn anything but HEAD into a\n * GET, 301 turns a POST into a GET; a method that becomes GET drops the body.\n * The query string is not carried over — it belonged to the URL that\n * redirected, and the target carries its own.\n */\nfunction nextHop(init: RequestInit_, status: number, location: string): RequestInit_ {\n const current = new URL(init.url);\n const target = new URL(location, current);\n let method = init.method;\n if ((status === 302 || status === 303) && method !== \"HEAD\") method = \"GET\";\n else if (status === 301 && method === \"POST\") method = \"GET\";\n\n let headers = { ...(init.headers ?? {}) };\n if (current.origin !== target.origin) {\n headers = Object.fromEntries(\n Object.entries(headers).filter(([k]) => !CROSS_ORIGIN_HEADERS.has(k.toLowerCase())),\n );\n }\n const hop: RequestInit_ = { method, url: target.toString(), headers };\n if (method === init.method) {\n if (init.json !== undefined) hop.json = init.json;\n if (init.content !== undefined) hop.content = init.content;\n }\n return hop;\n}\n\n/**\n * Execute an HTTP tool call. Returns `{status_code, headers, data}`, plus\n * `truncated: true` when the body was cut at `MAX_RESPONSE_BYTES`.\n *\n * Throws `EgressDenied` when the URL — or any redirect it leads to — names a\n * private/loopback/link-local/metadata address and `allowPrivate` is false\n * (the operator knob `ContextEngineConfig.allowPrivateEgress`), and\n * `EngineActionError` when the redirect chain outruns `MAX_REDIRECTS`.\n */\nexport async function executeHttp(\n config: Record<string, unknown>,\n args: Record<string, unknown>,\n opts: { client?: ToolHttpClient | null; allowPrivate?: boolean } = {},\n): Promise<Record<string, unknown>> {\n const method = String(config.method ?? \"GET\").toUpperCase();\n let url = config.url as string | undefined;\n const headers = { ...((config.headers as Record<string, string> | undefined) ?? {}) };\n const staticParams = { ...((config.parameters as Record<string, unknown> | undefined) ?? {}) };\n const body = config.body;\n const runtimeArgs = args ?? {};\n\n const queryValues = extract(config.llmQueryParameters as Record<string, unknown> | undefined, runtimeArgs);\n const bodyValues = extract(config.llmParameters as Record<string, unknown> | undefined, runtimeArgs);\n\n if (url?.includes(\"{{\")) {\n for (const source of [queryValues, bodyValues]) {\n for (const key of Object.keys(source)) {\n const placeholder = `{{${key}}}`;\n if (url.includes(placeholder)) {\n url = url.replaceAll(placeholder, percentEncode(String(source[key])));\n delete source[key];\n }\n }\n }\n }\n\n let requestInit: RequestInit_ = {\n method,\n url: url ?? \"\",\n headers,\n };\n\n if (method === \"GET\" || method === \"DELETE\") {\n const query = { ...staticParams, ...queryValues, ...bodyValues };\n if (Object.keys(query).length) requestInit.params = query;\n } else {\n const query = { ...staticParams, ...queryValues };\n if (Object.keys(query).length) requestInit.params = query;\n\n let jsonBody: Record<string, unknown> = {};\n if (body !== undefined && body !== null) {\n if (typeof body === \"object\" && !Array.isArray(body)) {\n jsonBody = { ...(body as Record<string, unknown>) };\n } else if (typeof body === \"string\") {\n try {\n const parsed = JSON.parse(body);\n if (parsed && typeof parsed === \"object\" && !Array.isArray(parsed)) {\n jsonBody = parsed as Record<string, unknown>;\n }\n } catch {\n /* raw string body */\n }\n }\n }\n Object.assign(jsonBody, bodyValues);\n if (Object.keys(jsonBody).length) {\n requestInit.json = jsonBody;\n } else if (body !== undefined && body !== null) {\n const contentType = headers[\"Content-Type\"] ?? headers[\"content-type\"] ?? \"\";\n if (typeof body === \"string\" && !contentType.includes(\"application/json\")) {\n requestInit.content = body;\n }\n }\n }\n\n const client = opts.client;\n const allowPrivate = opts.allowPrivate ?? false;\n let resp: HopResponse;\n let hops = 0;\n for (;;) {\n await assertEgressAllowed(requestInit.url, { allowPrivate });\n resp = client ? await client.request(requestInit) : await defaultRequest(requestInit);\n const location = resp.headers.location ?? resp.headers.Location;\n if (!REDIRECT_STATUS.has(resp.status) || !location) break;\n if (hops >= MAX_REDIRECTS) {\n throw new EngineActionError(`too many redirects (more than ${MAX_REDIRECTS}) starting at ${url}`);\n }\n hops += 1;\n requestInit = nextHop(requestInit, resp.status, location);\n }\n\n const contentType = resp.headers[\"content-type\"] ?? resp.headers[\"Content-Type\"] ?? \"\";\n let text = \"\";\n try {\n text = await resp.text();\n } catch {\n text = \"\";\n }\n const bytes = Buffer.from(text, \"utf8\");\n // The owned path already stopped at the cap and says so; the injected seam\n // is buffered by contract, so what it hands back is capped here.\n const truncated = resp.truncated === true || bytes.byteLength > MAX_RESPONSE_BYTES;\n let data: unknown;\n if (truncated) {\n // A body cut mid-stream is no longer valid JSON — hand back the text that\n // was read rather than failing the call on a parse error.\n data = bytes.subarray(0, MAX_RESPONSE_BYTES).toString(\"utf8\");\n } else {\n try {\n data = contentType.includes(\"application/json\") ? await resp.json() : text;\n } catch {\n data = text;\n }\n }\n\n const safeHeaders: Record<string, string> = {};\n for (const [k, v] of Object.entries(resp.headers)) {\n if (!SENSITIVE_RESPONSE_HEADERS.has(k.toLowerCase())) safeHeaders[k] = v;\n }\n\n const result: Record<string, unknown> = {\n status_code: resp.status,\n headers: safeHeaders,\n data,\n };\n if (truncated) result.truncated = true;\n return result;\n}\n","import type { ToolConfig, ToolKind } from \"./config.js\";\n\nexport interface CanonicalTool {\n id: string | null;\n kind: ToolKind;\n callName: string;\n displayName: string;\n description: string;\n paramsSchema: Record<string, unknown>;\n requiresApproval: boolean;\n approvalPolicy: Record<string, unknown>;\n sourceId: string | null;\n acl: string[] | null;\n raw: Record<string, unknown>;\n}\n\nfunction httpParamsSchema(config: Record<string, unknown>): Record<string, unknown> {\n const properties: Record<string, unknown> = {};\n const required: string[] = [];\n for (const key of [\"llmParameters\", \"llmQueryParameters\"]) {\n const src = (config[key] as Record<string, unknown> | undefined) ?? {};\n if (!src || typeof src !== \"object\") continue;\n Object.assign(properties, (src.properties as Record<string, unknown> | undefined) ?? {});\n const req = src.required;\n if (Array.isArray(req)) required.push(...req.map(String));\n }\n return { type: \"object\", properties, required };\n}\n\nfunction expandMcpTools(tc: ToolConfig): CanonicalTool[] {\n const config = tc.config ?? {};\n const discovered = (config.discovered_tools as Array<Record<string, unknown>> | undefined) ?? [];\n if (!discovered.length) {\n return [\n {\n id: tc.id ?? null,\n kind: \"mcp\",\n callName: `mcp_${tc.name}`,\n displayName: tc.name,\n description: tc.description || \"MCP tool\",\n paramsSchema: { type: \"object\", properties: {}, required: [] },\n requiresApproval: tc.requiresApproval,\n approvalPolicy: tc.approvalPolicy,\n sourceId: tc.sourceId,\n acl: tc.acl,\n raw: config,\n },\n ];\n }\n const tools: CanonicalTool[] = [];\n for (const dt of discovered) {\n if (dt.enabled === false) continue;\n const name = String(dt.name ?? \"unknown\");\n const schema = (dt.inputSchema as Record<string, unknown> | undefined) ??\n (dt.input_schema as Record<string, unknown> | undefined) ?? {\n type: \"object\",\n properties: {},\n required: [],\n };\n const toolApproval = dt.requires_approval as boolean | undefined;\n const toolApprovalPolicy = dt.approval_policy as Record<string, unknown> | undefined;\n tools.push({\n id: tc.id ?? null,\n kind: \"mcp\",\n callName: `mcp_${name}`,\n displayName: name,\n description: String(dt.description ?? `MCP tool: ${name}`),\n paramsSchema: schema,\n requiresApproval: toolApproval !== undefined ? Boolean(toolApproval) : tc.requiresApproval,\n approvalPolicy: toolApprovalPolicy ?? tc.approvalPolicy,\n sourceId: tc.sourceId,\n acl: tc.acl,\n raw: { ...config, tool_name: name },\n });\n }\n return tools;\n}\n\nexport function canonicalFromConfig(tc: ToolConfig): CanonicalTool[] {\n if (tc.kind === \"http\") {\n return [\n {\n id: tc.id ?? null,\n kind: \"http\",\n callName: `http_${tc.name}`,\n displayName: tc.name,\n description: tc.description || `Execute HTTP request: ${tc.name}`,\n paramsSchema: httpParamsSchema(tc.config ?? {}),\n requiresApproval: tc.requiresApproval,\n approvalPolicy: tc.approvalPolicy,\n sourceId: tc.sourceId,\n acl: tc.acl,\n raw: tc.config ?? {},\n },\n ];\n }\n if (tc.kind === \"db\") {\n return [\n {\n id: tc.id ?? null,\n kind: \"db\",\n callName: `db_${tc.name}`,\n displayName: tc.name,\n description: tc.description || `Query database: ${tc.name}`,\n paramsSchema: {\n type: \"object\",\n properties: {\n query: {\n type: \"string\",\n description: \"Either 'describe:table1,table2' to get column details, or a SQL query to execute\",\n },\n },\n required: [\"query\"],\n },\n requiresApproval: tc.requiresApproval,\n approvalPolicy: tc.approvalPolicy,\n sourceId: tc.sourceId,\n acl: tc.acl,\n raw: tc.config ?? {},\n },\n ];\n }\n if (tc.kind === \"mcp\") return expandMcpTools(tc);\n throw new Error(\n `canonicalFromConfig does not support kind=${JSON.stringify(tc.kind)}; function ` +\n \"tools have no serializable config — build them with functionTool(fn) instead\",\n );\n}\n\nexport function findTool(tools: CanonicalTool[], callName: string): CanonicalTool | undefined {\n return tools.find((t) => t.callName === callName);\n}\n","import { createHash, randomBytes } from \"node:crypto\";\nimport type { Pool } from \"pg\";\nimport { emitError, type Hooks } from \"../hooks.js\";\nimport { assertEgressAllowed } from \"./egress.js\";\n\nexport const STATE_TTL_SECONDS = 600;\nconst DISCOVERY_TIMEOUT_MS = 10_000;\nconst TOKEN_TIMEOUT_MS = 15_000;\nconst PROBE_TIMEOUT_MS = 5_000;\nconst REGISTER_TIMEOUT_MS = 10_000;\n\n/**\n * Clear one OAuth destination through the tool plane's egress policy\n * (`tools/egress.ts`), the same check `http` and `mcp` tools pass.\n *\n * Three of the four URLs this module fetches are chosen by the SERVER, not\n * the operator: `registration_endpoint` and `token_endpoint` come out of the\n * server's own discovery document, and the stored pending state carries the\n * token endpoint forward to the callback. A hostile MCP server advertising\n * `http://169.254.169.254/token` would otherwise have this library POST to\n * the cloud metadata service on its behalf — with a client secret attached.\n *\n * `authorization_endpoint` is deliberately NOT checked: it is never fetched,\n * only handed to the caller to redirect a BROWSER to, where the request\n * leaves the user's machine and not this server.\n *\n * Mirrors `context_engine/tools/mcp_oauth.py::_check_egress`.\n */\nasync function checkEgress(url: string, allowPrivate: boolean): Promise<void> {\n await assertEgressAllowed(url, { allowPrivate });\n}\n\nfunction report(hooks: Hooks | null | undefined, exc: unknown, ctx: Record<string, unknown>): void {\n if (hooks) emitError(hooks, exc, ctx);\n else console.error(\"[context-engine] mcp_oauth error:\", exc, \"| ctx=\", ctx);\n}\n\nexport interface PendingStore {\n put(state: string, data: Record<string, unknown>, ttlSeconds?: number): void | Promise<void>;\n pop(state: string): Record<string, unknown> | null | Promise<Record<string, unknown> | null>;\n}\n\nexport class InMemoryPendingStore implements PendingStore {\n private store = new Map<string, { data: Record<string, unknown>; expiresAt: number }>();\n\n private cleanupExpired(): void {\n const now = Date.now() / 1000;\n for (const [k, v] of this.store) {\n if (v.expiresAt <= now) this.store.delete(k);\n }\n }\n\n put(state: string, data: Record<string, unknown>, ttlSeconds: number = STATE_TTL_SECONDS): void {\n this.cleanupExpired();\n this.store.set(state, { data, expiresAt: Date.now() / 1000 + ttlSeconds });\n }\n\n pop(state: string): Record<string, unknown> | null {\n this.cleanupExpired();\n const entry = this.store.get(state);\n this.store.delete(state);\n if (!entry) return null;\n if (entry.expiresAt <= Date.now() / 1000) return null;\n return entry.data;\n }\n}\n\nexport class PostgresPendingStore implements PendingStore {\n constructor(private pool: Pool) {}\n\n private async reapExpired(): Promise<void> {\n await this.pool.query(\"DELETE FROM context_engine_oauth_pending WHERE expires_at < now()\");\n }\n\n async put(\n state: string,\n data: Record<string, unknown>,\n ttlSeconds: number = STATE_TTL_SECONDS,\n ): Promise<void> {\n await this.reapExpired();\n const expiresAt = new Date(Date.now() + ttlSeconds * 1000);\n await this.pool.query(\n `INSERT INTO context_engine_oauth_pending (state, data, expires_at)\n VALUES ($1, $2::jsonb, $3)\n ON CONFLICT (state) DO UPDATE SET data = EXCLUDED.data, expires_at = EXCLUDED.expires_at`,\n [state, JSON.stringify(data), expiresAt],\n );\n }\n\n async pop(state: string): Promise<Record<string, unknown> | null> {\n await this.reapExpired();\n const result = await this.pool.query(\n `DELETE FROM context_engine_oauth_pending WHERE state = $1 RETURNING data, expires_at`,\n [state],\n );\n const row = result.rows[0];\n if (!row) return null;\n const expiresAt = new Date(row.expires_at);\n if (expiresAt.getTime() <= Date.now()) return null;\n return row.data as Record<string, unknown>;\n }\n}\n\nasync function fetchJson(\n url: string,\n opts: {\n method?: string;\n timeout?: number;\n headers?: Record<string, string>;\n body?: string | Buffer | Uint8Array | URLSearchParams | null;\n redirect?: \"follow\" | \"error\" | \"manual\";\n } = {},\n): Promise<{ status: number; type: string; json: () => Promise<unknown>; text: () => Promise<string> }> {\n const resp = await fetch(url, {\n method: opts.method ?? \"GET\",\n headers: opts.headers,\n body: opts.body,\n // Never followed: a redirect reaches a destination no egress check saw,\n // and on the token endpoint it would forward the client secret with it.\n redirect: opts.redirect ?? \"manual\",\n signal: AbortSignal.timeout(opts.timeout ?? DISCOVERY_TIMEOUT_MS),\n });\n return {\n // `type` rides along so callers can tell an opaque redirect (status 0)\n // from a request that simply failed — see `isRedirect`.\n status: resp.status,\n type: resp.type,\n json: () => resp.json(),\n text: () => resp.text(),\n };\n}\n\n/**\n * Discover OAuth metadata for the MCP server at `serverUrl`.\n *\n * Throws `EgressDenied` when the server is somewhere the tool plane may not\n * connect. The check is on the ORIGIN, once, outside every `try` below: every\n * URL this function fetches is `${base}${path}`, and the `try`s are there to\n * turn a 404/timeout into \"this server does not do OAuth\" — a refusal\n * swallowed by one of them would look exactly like that.\n */\nexport async function discoverOauthMetadata(\n serverUrl: string,\n opts: { hooks?: Hooks | null; allowPrivate?: boolean } = {},\n): Promise<Record<string, unknown> | null> {\n const parsed = new URL(serverUrl);\n const base = `${parsed.protocol}//${parsed.host}`;\n await checkEgress(base, opts.allowPrivate ?? false);\n\n const wellKnownUrl = `${base}/.well-known/oauth-authorization-server`;\n try {\n const resp = await fetchJson(wellKnownUrl, { timeout: DISCOVERY_TIMEOUT_MS });\n if (resp.status === 200) {\n const data = (await resp.json()) as Record<string, unknown>;\n if (data.authorization_endpoint && data.token_endpoint) {\n return {\n authorization_endpoint: data.authorization_endpoint,\n token_endpoint: data.token_endpoint,\n registration_endpoint: data.registration_endpoint,\n scopes_supported: data.scopes_supported ?? [],\n response_types_supported: data.response_types_supported ?? [],\n code_challenge_methods_supported: data.code_challenge_methods_supported ?? [\"S256\"],\n issuer: data.issuer ?? base,\n };\n }\n }\n } catch (e) {\n if (!(e instanceof TypeError) && !(e instanceof DOMException)) {\n report(opts.hooks, e, { stage: \"discover_oauth_metadata_8414\", url: wellKnownUrl });\n }\n }\n\n const oidcUrl = `${base}/.well-known/openid-configuration`;\n try {\n const resp = await fetchJson(oidcUrl, { timeout: DISCOVERY_TIMEOUT_MS });\n if (resp.status === 200) {\n const data = (await resp.json()) as Record<string, unknown>;\n if (data.authorization_endpoint && data.token_endpoint) {\n return {\n authorization_endpoint: data.authorization_endpoint,\n token_endpoint: data.token_endpoint,\n registration_endpoint: data.registration_endpoint,\n scopes_supported: data.scopes_supported ?? [],\n code_challenge_methods_supported: data.code_challenge_methods_supported ?? [\"S256\"],\n issuer: data.issuer ?? base,\n };\n }\n }\n } catch {\n /* continue */\n }\n\n for (const [authPath, tokenPath] of [\n [\"/oauth/authorize\", \"/oauth/token\"],\n [\"/authorize\", \"/token\"],\n [\"/oauth2/authorize\", \"/oauth2/token\"],\n ] as const) {\n try {\n const resp = await fetchJson(`${base}${authPath}`, {\n timeout: PROBE_TIMEOUT_MS,\n redirect: \"manual\",\n });\n // 200, 302/303 (redirect to login), 400 (missing params) all indicate\n // the endpoint exists — the same four the Python port accepts. Plus the\n // opaque response a browser `fetch` returns under `redirect: \"manual\"`:\n // it hides the status, so a 302 to a login page arrives indistinguishable\n // from any other redirect and is accepted on that basis (httpx has no\n // such case, which is why the Python list has no fifth entry).\n if (\n resp.status === 200 ||\n resp.status === 400 ||\n resp.status === 302 ||\n resp.status === 303 ||\n resp.type === \"opaqueredirect\"\n ) {\n return {\n authorization_endpoint: `${base}${authPath}`,\n token_endpoint: `${base}${tokenPath}`,\n issuer: base,\n scopes_supported: [],\n code_challenge_methods_supported: [\"S256\"],\n };\n }\n } catch {}\n }\n return null;\n}\n\n/**\n * Register as an OAuth client with the MCP server (RFC 7591 DCR).\n *\n * Throws `EgressDenied` when `registrationEndpoint` — which the SERVER\n * supplied, in its own discovery document — is somewhere the tool plane may\n * not connect.\n */\nexport async function registerOauthClient(\n registrationEndpoint: string,\n redirectUri: string,\n clientName = \"Promptev Context Engine\",\n opts: { hooks?: Hooks | null; allowPrivate?: boolean } = {},\n): Promise<Record<string, unknown>> {\n await checkEgress(registrationEndpoint, opts.allowPrivate ?? false);\n const payload = {\n client_name: clientName,\n redirect_uris: [redirectUri],\n grant_types: [\"authorization_code\", \"refresh_token\"],\n response_types: [\"code\"],\n token_endpoint_auth_method: \"none\",\n };\n let resp: Awaited<ReturnType<typeof fetchJson>>;\n try {\n resp = await fetchJson(registrationEndpoint, {\n method: \"POST\",\n timeout: REGISTER_TIMEOUT_MS,\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify(payload),\n });\n } catch (e) {\n report(opts.hooks, e, { stage: \"register_oauth_client\", registration_endpoint: registrationEndpoint });\n throw new Error(`Cannot reach registration endpoint: ${e}`);\n }\n if (resp.status !== 200 && resp.status !== 201) {\n const error = new Error(`Client registration failed: ${resp.status}`);\n report(opts.hooks, error, {\n stage: \"register_oauth_client\",\n registration_endpoint: registrationEndpoint,\n status_code: resp.status,\n });\n throw error;\n }\n return (await resp.json()) as Record<string, unknown>;\n}\n\nexport async function buildAuthorizeUrl(\n metadata: Record<string, unknown>,\n serverUrl: string,\n toolId: string,\n redirectUri: string,\n store: PendingStore,\n opts: {\n clientId?: string | null;\n clientSecret?: string | null;\n scopes?: string | null;\n ttlSeconds?: number;\n } = {},\n): Promise<{ authorize_url: string; state: string }> {\n const authEndpoint = metadata.authorization_endpoint as string | undefined;\n const tokenEndpoint = metadata.token_endpoint as string | undefined;\n if (!authEndpoint) throw new Error(\"OAuth metadata missing 'authorization_endpoint'\");\n if (!tokenEndpoint) throw new Error(\"OAuth metadata missing 'token_endpoint'\");\n\n const codeVerifier = randomBytes(64).toString(\"base64url\").slice(0, 128);\n const digest = createHash(\"sha256\").update(codeVerifier, \"ascii\").digest();\n const codeChallenge = digest.toString(\"base64url\");\n const state = randomBytes(32).toString(\"base64url\");\n\n await Promise.resolve(\n store.put(\n state,\n {\n server_url: serverUrl,\n code_verifier: codeVerifier,\n tool_id: toolId,\n redirect_uri: redirectUri,\n token_endpoint: tokenEndpoint,\n client_id: opts.clientId ?? null,\n client_secret: opts.clientSecret ?? null,\n },\n opts.ttlSeconds ?? STATE_TTL_SECONDS,\n ),\n );\n\n const params = new URLSearchParams({\n response_type: \"code\",\n state,\n redirect_uri: redirectUri,\n code_challenge: codeChallenge,\n code_challenge_method: \"S256\",\n });\n if (opts.clientId) params.set(\"client_id\", opts.clientId);\n if (opts.scopes) params.set(\"scope\", opts.scopes);\n\n return { authorize_url: `${authEndpoint}?${params.toString()}`, state };\n}\n\nexport async function exchangeCodeForToken(\n state: string,\n code: string,\n store: PendingStore,\n opts: { clientSecret?: string | null; hooks?: Hooks | null; allowPrivate?: boolean } = {},\n): Promise<Record<string, unknown>> {\n const pending = await Promise.resolve(store.pop(state));\n if (!pending) throw new Error(\"Invalid or expired OAuth state — please try connecting again\");\n const tokenEndpoint = pending.token_endpoint as string | undefined;\n if (!tokenEndpoint) throw new Error(\"No token_endpoint in stored OAuth state\");\n // The stored state carries a value that came from the SERVER's discovery\n // document, so the endpoint is re-checked here rather than trusted because\n // it was checked (as part of the origin) at discovery time.\n await checkEgress(tokenEndpoint, opts.allowPrivate ?? false);\n\n const body = new URLSearchParams({\n grant_type: \"authorization_code\",\n code,\n redirect_uri: String(pending.redirect_uri),\n code_verifier: String(pending.code_verifier),\n });\n if (pending.client_id) body.set(\"client_id\", String(pending.client_id));\n const secret = opts.clientSecret || (pending.client_secret as string | null);\n if (secret) body.set(\"client_secret\", String(secret));\n\n let resp: Awaited<ReturnType<typeof fetchJson>>;\n try {\n resp = await fetchJson(tokenEndpoint, {\n method: \"POST\",\n timeout: TOKEN_TIMEOUT_MS,\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body,\n });\n } catch (e) {\n report(opts.hooks, e, { stage: \"exchange_code_for_token\", token_endpoint: tokenEndpoint });\n throw new Error(`Could not reach token endpoint: ${e}`);\n }\n if (resp.status !== 200) {\n const error = new Error(`Token exchange failed: ${resp.status}`);\n report(opts.hooks, error, {\n stage: \"exchange_code_for_token\",\n token_endpoint: tokenEndpoint,\n status_code: resp.status,\n });\n throw error;\n }\n\n let tokenData: Record<string, unknown>;\n try {\n tokenData = (await resp.json()) as Record<string, unknown>;\n } catch {\n const text = await resp.text();\n tokenData = Object.fromEntries(new URLSearchParams(text));\n }\n const accessToken = tokenData.access_token;\n if (!accessToken) {\n const error = new Error(\"Token response missing access_token\");\n report(opts.hooks, error, { stage: \"exchange_code_for_token\", token_endpoint: tokenEndpoint });\n throw error;\n }\n return {\n access_token: accessToken,\n refresh_token: tokenData.refresh_token,\n token_type: tokenData.token_type ?? \"Bearer\",\n expires_in: tokenData.expires_in,\n scope: tokenData.scope,\n tool_id: pending.tool_id,\n server_url: pending.server_url,\n };\n}\n\nexport async function refreshAccessToken(\n tokenEndpoint: string,\n refreshToken: string,\n opts: {\n clientId?: string | null;\n clientSecret?: string | null;\n hooks?: Hooks | null;\n allowPrivate?: boolean;\n } = {},\n): Promise<Record<string, unknown>> {\n await checkEgress(tokenEndpoint, opts.allowPrivate ?? false);\n const body = new URLSearchParams({\n grant_type: \"refresh_token\",\n refresh_token: refreshToken,\n });\n if (opts.clientId) body.set(\"client_id\", opts.clientId);\n if (opts.clientSecret) body.set(\"client_secret\", opts.clientSecret);\n\n let resp: Awaited<ReturnType<typeof fetchJson>>;\n try {\n resp = await fetchJson(tokenEndpoint, {\n method: \"POST\",\n timeout: TOKEN_TIMEOUT_MS,\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body,\n });\n } catch (e) {\n report(opts.hooks, e, { stage: \"refresh_access_token\", token_endpoint: tokenEndpoint });\n throw new Error(`Could not reach token endpoint: ${e}`);\n }\n if (resp.status !== 200) {\n const error = new Error(`Token refresh failed: ${resp.status}`);\n report(opts.hooks, error, {\n stage: \"refresh_access_token\",\n token_endpoint: tokenEndpoint,\n status_code: resp.status,\n });\n throw error;\n }\n const tokenData = (await resp.json()) as Record<string, unknown>;\n if (!tokenData.access_token) {\n const error = new Error(\"Refresh response missing access_token\");\n report(opts.hooks, error, { stage: \"refresh_access_token\", token_endpoint: tokenEndpoint });\n throw error;\n }\n return {\n access_token: tokenData.access_token,\n refresh_token: tokenData.refresh_token ?? refreshToken,\n expires_in: tokenData.expires_in,\n };\n}\n"]}
1
+ {"version":3,"sources":["../src/errors.ts","../src/tools/executors/db.ts","../src/hono.ts","../src/sentinels.ts","../src/routing-core.ts","../src/tools/router.ts","../src/tools/acl.ts","../src/tools/approval.ts","../src/tools/config.ts","../src/crypto.ts","../src/tools/egress.ts","../src/version.ts","../src/tools/executors/mcp-client.ts","../src/tools/governance.ts","../src/hooks.ts","../src/redaction.ts","../src/tools/audit.ts","../src/tools/executors/http.ts","../src/tools/registry.ts","../src/tools/mcp-oauth.ts"],"names":["require","createRequire","z","randomUUID","out","randomBytes","createCipheriv","createDecipheriv","createHmac","dns","isIP","msg","UUID_RE","contentType","note","key","testConnection","checkEgress","createHash"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA,IAGa,iBAAA,EAsBA,oBAOA,eAAA,EAqBA,iBAAA;AArDb,IAAA,WAAA,GAAA,KAAA,CAAA;AAAA,EAAA,eAAA,GAAA;AAGO,IAAM,iBAAA,GAAN,cAAgC,KAAA,CAAM;AAAA,MAC3C,YAAY,OAAA,EAAiB;AAC3B,QAAA,KAAA,CAAM,OAAO,CAAA;AACb,QAAA,IAAA,CAAK,IAAA,GAAO,mBAAA;AAAA,MACd;AAAA,KACF;AAiBO,IAAM,kBAAA,GAAN,cAAiC,KAAA,CAAM;AAAA,MAC5C,WAAA,CAAY,UAAU,yBAAA,EAA2B;AAC/C,QAAA,KAAA,CAAM,OAAO,CAAA;AACb,QAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AAAA,MACd;AAAA,KACF;AAEO,IAAM,eAAA,GAAN,cAA8B,KAAA,CAAM;AAAA,MACzC,WAAA,CAAY,UAAU,sBAAA,EAAwB;AAC5C,QAAA,KAAA,CAAM,OAAO,CAAA;AACb,QAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AAAA,MACd;AAAA,KACF;AAgBO,IAAM,iBAAA,GAAN,cAAgC,KAAA,CAAM;AAAA,MAC3C,WAAA,CAAY,KAAA,EAAe,GAAA,EAAa,IAAA,EAAc;AACpD,QAAA,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,eAAA,EAAkB,GAAG,8BAA8B,KAAK,CAAA,eAAA,EAAkB,GAAG,CAAA,CAAE,CAAA;AAC5F,QAAA,IAAA,CAAK,IAAA,GAAO,mBAAA;AAAA,MACd;AAAA,KACF;AAAA,EAAA;AAAA,CAAA,CAAA;;;AC1DA,IAAA,UAAA,GAAA,EAAA;AAAA,QAAA,CAAA,UAAA,EAAA;AAAA,EAAA,QAAA,EAAA,MAAA,QAAA;AAAA,EAAA,kBAAA,EAAA,MAAA,kBAAA;AAAA,EAAA,SAAA,EAAA,MAAA,SAAA;AAAA,EAAA,YAAA,EAAA,MAAA,YAAA;AAAA,EAAA,WAAA,EAAA,MAAA,WAAA;AAAA,EAAA,aAAA,EAAA,MAAA,aAAA;AAAA,EAAA,aAAA,EAAA,MAAA,aAAA;AAAA,EAAA,cAAA,EAAA,MAAA;AAAA,CAAA,CAAA;AAgDO,SAAS,cAAc,GAAA,EAAqB;AACjD,EAAA,OAAO,GAAA,CAAI,QAAQ,YAAA,EAAc,CAAC,MAAM,GAAA,CAAI,MAAA,CAAO,CAAA,CAAE,MAAM,CAAC,CAAA;AAC9D;AAGA,SAAS,uBAAuB,GAAA,EAAqB;AACnD,EAAA,OAAO,GAAA,CAAI,QAAQ,sBAAA,EAAwB,CAAC,MAAM,GAAA,CAAI,MAAA,CAAO,CAAA,CAAE,MAAM,CAAC,CAAA;AACxE;AAEA,SAAS,UAAA,CAAW,UAAkB,OAAA,EAA0B;AAC9D,EAAA,OAAO,IAAI,MAAA,CAAO,CAAA,GAAA,EAAM,OAAO,CAAA,GAAA,CAAK,CAAA,CAAE,KAAK,QAAQ,CAAA;AACrD;AAEO,SAAS,mBAAmB,MAAA,EAAyC;AAC1E,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,MAAA,IAAU,YAAY,CAAA;AACnD,EAAA,IAAI,WAAW,QAAA,EAAU,OAAO,CAAA,UAAA,EAAa,MAAA,CAAO,YAAY,EAAE,CAAA,CAAA;AAElE,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,MAAA,CAAO,IAAA,IAAQ,WAAW,CAAA;AAC9C,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,MAAA,CAAO,IAAA,IAAQ,IAAI,CAAA;AACvC,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,CAAO,QAAA,IAAY,EAAE,CAAA;AAC7C,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,CAAO,QAAA,IAAY,EAAE,CAAA;AAC7C,EAAA,MAAM,WAAW,kBAAA,CAAmB,MAAA,CAAO,MAAA,CAAO,QAAA,IAAY,EAAE,CAAC,CAAA;AAEjE,EAAA,IAAI,WAAW,QAAA,EAAU;AACvB,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,MAAA,CAAO,YAAA,IAAgB,QAAQ,CAAA;AAC1D,IAAA,OAAO,CAAA,SAAA,EAAY,QAAQ,CAAA,CAAA,EAAI,QAAQ,IAAI,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,eAAA,EAAkB,WAAW,CAAA,CAAA;AAAA,EACtF;AACA,EAAA,IAAI,WAAW,WAAA,EAAa;AAC1B,IAAA,MAAM,UAAA,GAAa,MAAA,CAAO,MAAA,CAAO,WAAA,IAAe,QAAQ,CAAA;AACxD,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,MAAA,CAAO,SAAA,IAAa,EAAE,CAAA;AAC/C,IAAA,IAAI,GAAA,GAAM,CAAA,YAAA,EAAe,QAAQ,CAAA,CAAA,EAAI,QAAQ,IAAI,IAAI,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA;AAC/E,IAAA,IAAI,SAAA,EAAW,GAAA,IAAO,CAAA,WAAA,EAAc,SAAS,CAAA,CAAA;AAC7C,IAAA,OAAO,GAAA;AAAA,EACT;AACA,EAAA,IAAI,WAAW,YAAA,EAAc;AAC3B,IAAA,MAAM,SAAS,CAAC,IAAA,EAAM,MAAM,GAAG,CAAA,CAAE,SAAS,IAAI,CAAA;AAC9C,IAAA,OAAO,CAAA,aAAA,EAAgB,QAAQ,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,EAAI,QAAQ,CAAA,EAAG,MAAA,GAAS,iBAAiB,EAAE,CAAA,CAAA;AAAA,EACxG;AACA,EAAA,IAAI,MAAA,KAAW,OAAA,IAAW,MAAA,KAAW,SAAA,EAAW;AAC9C,IAAA,OAAO,CAAA,QAAA,EAAW,QAAQ,CAAA,CAAA,EAAI,QAAQ,IAAI,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA;AAAA,EACpE;AACA,EAAA,IAAI,WAAW,OAAA,EAAS;AACtB,IAAA,OAAO,CAAA,QAAA,EAAW,QAAQ,CAAA,CAAA,EAAI,QAAQ,IAAI,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA;AAAA,EACpE;AACA,EAAA,OAAO,CAAA,aAAA,EAAgB,QAAQ,CAAA,CAAA,EAAI,QAAQ,IAAI,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA;AACzE;AAEA,SAAS,WAAW,IAAA,EAA8C;AAChE,EAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,OAAO,EAAA;AACzB,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,CAAC,CAAE,CAAA;AACpC,EAAA,MAAM,KAAA,GAAQ,CAAC,OAAA,CAAQ,IAAA,CAAK,GAAI,CAAC,CAAA;AACjC,EAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,IAAA,KAAA,CAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,CAAC,QAAQ,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,IAAK,EAAE,CAAC,CAAA,CAAE,IAAA,CAAK,GAAI,CAAC,CAAA;AAAA,EACpE;AACA,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AACxB;AAQA,eAAe,aAAA,CACb,MAAA,EACA,GAAA,EACA,OAAA,EACA,WAAW,KAAA,EACW;AACtB,EAAA,IAAI,EAAA;AACJ,EAAA,IAAI;AACF,IAAA,EAAA,GAAKA,SAAQ,IAAI,CAAA;AAAA,EACnB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA,CAAkB,UAAA,EAAY,IAAA,EAAM,wBAAwB,CAAA;AAAA,EACxE;AACA,EAAA,MAAM,MAAM,kBAAA,CAAmB,EAAE,GAAG,MAAA,EAAQ,MAAA,EAAQ,cAAc,CAAA;AAClE,EAAA,MAAM,MAAA,GAAS,IAAI,EAAA,CAAG,MAAA,CAAO;AAAA,IAC3B,gBAAA,EAAkB,GAAA;AAAA,IAClB,yBAAyB,eAAA,GAAkB,GAAA;AAAA,IAC3C,iBAAA,EAAmB;AAAA,GACpB,CAAA;AACD,EAAA,MAAM,OAAO,OAAA,EAAQ;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,CAAO,MAAM,OAAO,CAAA;AAC1B,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,CAAO,MAAM,2BAA2B,CAAA;AAAA,MAChD,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,MAAA,CAAO,MAAM,UAAU,CAAA;AAC7B,QAAA,OAAA,CAAQ,IAAA;AAAA,UACN,kJAAA;AAAA,UAEA;AAAA,SACF;AACA,QAAA,MAAM,MAAA,CAAO,MAAM,OAAO,CAAA;AAAA,MAC5B;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA;AACrC,IAAA,MAAM,MAAA,CAAO,MAAM,QAAQ,CAAA;AAC3B,IAAA,MAAM,OAAA,GAAU,OAAO,MAAA,EAAQ,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAA,KAAM,MAAA,CAAO,KAAK,CAAC,CAAA,GAAI,OAAO,IAAA,CAAK,MAAA,CAAO,KAAK,CAAC,CAAC,IAAI,EAAC,CAAA;AACtG,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,OAAO,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,MAAO,EAAE,GAAG,GAAE,CAAE,CAAA;AAChE,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,UAAU,MAAA,CAAO,QAAA,IAAY,KAAK,MAAA,EAAO;AAAA,EACnE,SAAS,CAAA,EAAG;AACV,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,CAAO,MAAM,UAAU,CAAA;AAAA,IAC/B,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,CAAA;AAAA,EACR,CAAA,SAAE;AACA,IAAA,MAAM,OAAO,GAAA,EAAI;AAAA,EACnB;AACF;AAEA,eAAe,UAAA,CACb,MAAA,EACA,GAAA,EACA,OAAA,EACsB;AACtB,EAAA,IAAI,KAAA;AAMJ,EAAA,IAAI;AACF,IAAA,KAAA,GAAQA,SAAQ,gBAAgB,CAAA;AAAA,EAClC,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA,CAAkB,OAAA,EAAS,QAAA,EAAU,6BAA6B,CAAA;AAAA,EAC9E;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,gBAAA,CAAiB;AAAA,IACxC,IAAA,EAAM,OAAO,IAAA,IAAQ,WAAA;AAAA,IACrB,IAAA,EAAM,MAAA,CAAO,MAAA,CAAO,IAAA,IAAQ,IAAI,CAAA;AAAA,IAChC,IAAA,EAAM,OAAO,QAAA,IAAY,EAAA;AAAA,IACzB,QAAA,EAAU,OAAO,QAAA,IAAY,EAAA;AAAA,IAC7B,QAAA,EAAU,OAAO,QAAA,IAAY,EAAA;AAAA,IAC7B,gBAAgB,eAAA,GAAkB;AAAA,GACnC,CAAA;AACD,EAAA,IAAI;AACF,IAAA,MAAM,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,IAAA,CAAK,MAAM,GAAG,CAAA;AAC3C,IAAA,MAAM,OAAO,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,GAAK,OAA0C,EAAC;AAC/E,IAAA,MAAM,OAAA,GAAA,CAAW,UAAU,EAAC,EAAG,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAChD,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,IAAA,CAAK,KAAA,CAAM,GAAG,OAAO,CAAA,EAAG,QAAA,EAAU,IAAA,CAAK,MAAA,EAAO;AAAA,EACxE,CAAA,SAAE;AACA,IAAA,MAAM,KAAK,GAAA,EAAI;AAAA,EACjB;AACF;AAEA,eAAe,UAAA,CACb,MAAA,EACA,GAAA,EACA,OAAA,EACA,WAAW,KAAA,EACW;AACtB,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,MAAA,IAAU,YAAY,CAAA;AACnD,EAAA,IAAI,WAAW,YAAA,EAAc,OAAO,cAAc,MAAA,EAAQ,GAAA,EAAK,SAAS,QAAQ,CAAA;AAChF,EAAA,IAAI,MAAA,KAAW,WAAW,MAAA,KAAW,SAAA,SAAkB,UAAA,CAAW,MAAA,EAAQ,KAAK,OAAO,CAAA;AACtF,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,CAAA,oBAAA,EAAuB,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA,wEAAA;AAAA,GAE/C;AACF;AAEO,SAAS,aACd,MAAA,EACA,GAAA,EACA,OAAA,GAAkB,QAAA,EAClB,aAAqB,UAAA,EACa;AAClC,EAAA,OAAO,iBAAA,CAAkB,MAAA,EAAQ,GAAA,EAAK,OAAA,EAAS,UAAU,CAAA;AAC3D;AAEA,eAAe,iBAAA,CACb,MAAA,EACA,GAAA,EACA,OAAA,EACA,aAAA,EACkC;AAClC,EAAA,MAAM,aAAc,aAAA,IAAiB,UAAA;AACrC,EAAA,IAAI,CAAE,oBAAA,CAA2C,QAAA,CAAS,UAAU,CAAA,EAAG;AACrE,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,uBAAuB,IAAA,CAAK,SAAA,CAAU,aAAa,CAAC,oBAAoB,oBAAoB,CAAA;AAAA,KAC9F;AAAA,EACF;AAIA,EAAA,MAAM,WAAA,GAAc;AAAA,IAClB,aAAA,CAAc,GAAG,CAAA,CAAE,IAAA,GAAO,WAAA,EAAY;AAAA,IACtC,sBAAA,CAAuB,GAAG,CAAA,CAAE,IAAA,GAAO,WAAA;AAAY,GACjD;AACA,EAAA,MAAM,QAAA,GAAW,YAAY,CAAC,CAAA;AAM9B,EAAA,KAAA,MAAW,WAAW,cAAA,EAAgB;AACpC,IAAA,IAAI,CAAC,GAAG,WAAA,EAAa,GAAA,CAAI,aAAa,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,OAAO,CAAC,CAAA,EAAG;AAC3E,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,CAAA,EAAG,OAAO,CAAA,wBAAA,CAAA,EAA2B;AAAA,IACvE;AAAA,EACF;AAEA,EAAA,IAAI,eAAe,UAAA,EAAY;AAC7B,IAAA,IAAI,CAAC,WAAA,CAAY,KAAA,CAAM,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,QAAQ,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,MAAM,CAAC,CAAA,EAAG;AAC7E,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,mDAAA,EAAoD;AAAA,IACtF;AACA,IAAA,KAAA,MAAW,WAAW,gBAAA,EAAkB;AACtC,MAAA,IAAI,WAAA,CAAY,KAAK,CAAC,CAAA,KAAM,WAAW,CAAA,EAAG,OAAO,CAAC,CAAA,EAAG;AACnD,QAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,CAAA,EAAG,OAAO,CAAA,0CAAA,CAAA,EAA6C;AAAA,MACzF;AAAA,IACF;AAAA,EACF,CAAA,MAAA,IAAW,eAAe,WAAA,EAAa;AACrC,IAAA,KAAA,MAAW,WAAW,iBAAA,EAAmB;AACvC,MAAA,IAAI,WAAA,CAAY,KAAK,CAAC,CAAA,KAAM,WAAW,CAAA,EAAG,OAAO,CAAC,CAAA,EAAG;AACnD,QAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,CAAA,EAAG,OAAO,CAAA,2CAAA,CAAA,EAA8C;AAAA,MAC1F;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,MAAM,UAAA,CAAW,QAAQ,GAAA,EAAK,OAAA,EAAS,eAAe,UAAU,CAAA;AAE/E,IAAA,IAAI,CAAC,SAAS,UAAA,CAAW,QAAQ,KAAK,CAAC,QAAA,CAAS,UAAA,CAAW,MAAM,CAAA,EAAG;AAClE,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,IAAA;AAAA,QACT,SAAS,EAAC;AAAA,QACV,MAAM,EAAC;AAAA,QACP,WAAW,MAAA,CAAO,QAAA;AAAA,QAClB,eAAe,MAAA,CAAO,QAAA;AAAA,QACtB,SAAA,EAAW;AAAA,OACb;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,IAAA;AAAA,MACT,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,SAAA,EAAW,OAAO,IAAA,CAAK,MAAA;AAAA,MACvB,SAAA,EAAW,MAAA,CAAO,IAAA,CAAK,MAAA,IAAU,OAAA;AAAA,MACjC,IAAA,EAAM,UAAA,CAAW,MAAA,CAAO,IAAI;AAAA,KAC9B;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,MAAA,CAAO,CAAC,CAAA,EAAE;AAAA,EAC5C;AACF;AAEA,eAAsB,SAAA,CACpB,QACA,GAAA,EACkC;AAClC,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,MAAA,CAAO,QAAA,IAAY,QAAQ,CAAA;AAClD,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,MAAA,CAAO,WAAA,IAAe,UAAU,CAAA;AAC1D,EAAA,OAAO,iBAAA,CAAkB,MAAA,EAAQ,GAAA,EAAK,OAAA,EAAS,UAAU,CAAA;AAC3D;AAEA,eAAsB,eAAe,MAAA,EAAmE;AACtG,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,MAAA,CAAO,MAAA,IAAU,YAAY,CAAA;AACvD,EAAA,MAAM,cAAA,GAAyC;AAAA,IAC7C,UAAA,EAAY,kBAAA;AAAA,IACZ,KAAA,EAAO,kBAAA;AAAA,IACP,OAAA,EAAS,kBAAA;AAAA,IACT,KAAA,EAAO,kBAAA;AAAA,IACP,MAAA,EAAQ,yBAAA;AAAA,IACR,MAAA,EAAQ,+CAAA;AAAA,IACR,UAAA,EAAY,kBAAA;AAAA,IACZ,SAAA,EAAW;AAAA,GACb;AACA,EAAA,MAAM,CAAA,GAAI,cAAA,CAAe,UAAU,CAAA,IAAK,kBAAA;AACxC,EAAA,MAAM,SAAS,MAAM,iBAAA,CAAkB,MAAA,EAAQ,CAAA,EAAG,GAAG,UAAU,CAAA;AAC/D,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,MAAA,CAAO,KAAA,EAAM;AAClE,EAAA,MAAM,OAAA,GAAW,MAAA,CAAO,IAAA,GAA0C,CAAC,CAAA,GAC/D,MAAA,CAAO,MAAA,CAAQ,MAAA,CAAO,IAAA,CAAwC,CAAC,CAAE,CAAA,CAAE,CAAC,CAAA,GACpE,IAAA;AACJ,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,IAAA;AAAA,IACT,OAAA,EAAS,OAAO,OAAO,CAAA;AAAA,IACvB,MAAM,MAAA,CAAO,IAAA;AAAA,IACb,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,MAAA,EAAQ;AAAA,GACV;AACF;AAEA,eAAsB,WAAA,CACpB,QACA,cAAA,EACkC;AAClC,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,MAAA,IAAU,YAAY,CAAA;AACnD,EAAA,IAAI,WAAW,YAAA,EAAc;AAC3B,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,CAAA,wDAAA,EAA2D,MAAM,CAAA,CAAA,CAAA,EAAI;AAAA,EACvG;AACA,EAAA,IAAI,EAAA;AACJ,EAAA,IAAI;AACF,IAAA,EAAA,GAAKA,SAAQ,IAAI,CAAA;AAAA,EACnB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA,CAAkB,UAAA,EAAY,IAAA,EAAM,wBAAwB,CAAA;AAAA,EACxE;AACA,EAAA,MAAM,MAAA,GAAS,IAAI,EAAA,CAAG,MAAA,CAAO,EAAE,gBAAA,EAAkB,kBAAA,CAAmB,MAAM,CAAA,EAAG,CAAA;AAC7E,EAAA,MAAM,OAAO,OAAA,EAAQ;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,UAAA,GAAa,MAAA,CAAO,MAAA,CAAO,WAAA,IAAe,QAAQ,CAAA;AACxD,IAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,KAAA;AAAA,MAC7B,CAAA,oFAAA,CAAA;AAAA,MACA,CAAC,UAAU;AAAA,KACb;AACA,IAAA,IAAI,KAAA,GAAQ,SAAA,CAAU,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,MACrC,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,UAAU,CAAA;AAAA,MACzB,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,UAAU,CAAA,CAAE,aAAY,CAAE,QAAA,CAAS,MAAM,CAAA,GAAI,MAAA,GAAS;AAAA,KACvE,CAAE,CAAA;AACF,IAAA,IAAI,gBAAgB,MAAA,EAAQ;AAC1B,MAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,cAAc,CAAA;AACvC,MAAA,KAAA,GAAQ,KAAA,CAAM,OAAO,CAAC,CAAA,KAAM,SAAS,GAAA,CAAI,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA,IAClD;AACA,IAAA,MAAM,SAAS,EAAC;AAChB,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,KAAA;AAAA,QACxB,CAAA;AAAA,8EAAA,CAAA;AAAA,QAEA,CAAC,UAAA,EAAY,IAAA,CAAK,IAAI;AAAA,OACxB;AACA,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACV,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,OAAA,EAAS,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,UAC7B,MAAM,CAAA,CAAE,WAAA;AAAA,UACR,MAAM,CAAA,CAAE,SAAA;AAAA,UACR,QAAA,EAAU,EAAE,WAAA,KAAgB;AAAA,SAC9B,CAAE,CAAA;AAAA,QACF,SAAA,EAAW;AAAA,OACZ,CAAA;AAAA,IACH;AACA,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,IAAA;AAAA,MACT,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,MAAA,EAAQ,UAAA;AAAA,MACR,MAAA;AAAA,MACA,aAAa,MAAA,CAAO,MAAA;AAAA,MACpB,YAAY,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,IAAI;AAAA,KACrC;AAAA,EACF,CAAA,SAAE;AACA,IAAA,MAAM,OAAO,GAAA,EAAI;AAAA,EACnB;AACF;AAEA,eAAsB,aAAA,CACpB,QACA,cAAA,EACiB;AACjB,EAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,MAAA,EAAQ,cAAc,CAAA;AACvD,EAAA,MAAM,aAA6C,EAAC;AACpD,EAAA,KAAA,MAAW,KAAA,IAAU,MAAA,CAAO,MAAA,IAAyD,EAAC,EAAG;AACvF,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,IAAQ,OAAA;AAC3B,IAAA,KAAA,MAAW,CAAA,IAAM,KAAA,CAAM,OAAA,IAA8C,EAAC,EAAG;AACvE,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,OAAO,KAAA,CAAM,IAAA;AAAA,QACb,UAAA,EAAY,IAAA;AAAA,QACZ,QAAQ,CAAA,CAAE,IAAA;AAAA,QACV,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,IAAI,EAAE,WAAA,EAAY;AAAA,QACjC,EAAA,EAAI,EAAE,EAAA,IAAM,KAAA;AAAA,QACZ,EAAA,EAAI,EAAE,EAAA,IAAM,EAAA;AAAA,QACZ,MAAM,KAAA,CAAM;AAAA,OACb,CAAA;AAAA,IACH;AAAA,EACF;AACA,EAAA,OAAO,WAAW,UAAU,CAAA;AAC9B;AA7ZA,IAGMA,QAAAA,EAEO,UACP,eAAA,EACA,gBAAA,EAEA,gBACA,gBAAA,EAeA,iBAAA,EACA,sBAKA,YAAA,EASA,sBAAA;AAxCN,IAAA,OAAA,GAAA,KAAA,CAAA;AAAA,EAAA,2BAAA,GAAA;AACA,IAAA,WAAA,EAAA;AAEA,IAAMA,QAAAA,GAAUC,sBAAA,CAAc,0PAAe,CAAA;AAEtC,IAAM,QAAA,GAAW,GAAA;AACxB,IAAM,eAAA,GAAkB,EAAA;AACxB,IAAM,gBAAA,GAAmB,GAAA;AAEzB,IAAM,cAAA,GAAiB,CAAC,OAAA,EAAS,QAAQ,CAAA;AACzC,IAAM,gBAAA,GAAmB;AAAA,MACvB,QAAA;AAAA,MACA,QAAA;AAAA,MACA,QAAA;AAAA,MACA,OAAA;AAAA,MACA,MAAA;AAAA,MACA,OAAA;AAAA,MACA,QAAA;AAAA,MACA,UAAA;AAAA,MACA,IAAA;AAAA,MACA;AAAA,KACF;AAIA,IAAM,oBAAoB,CAAC,QAAA,EAAU,MAAA,EAAQ,UAAA,EAAY,MAAM,MAAM,CAAA;AACrE,IAAM,oBAAA,GAAuB,CAAC,UAAA,EAAY,WAAA,EAAa,MAAM,CAAA;AAK7D,IAAM,YAAA,GAAe,2EAAA;AASrB,IAAM,sBAAA,GAAyB,sDAAA;AAAA,EAAA;AAAA,CAAA,CAAA;;;ACvC/B,WAAA,EAAA;;;ACiBO,IAAM,OAAA,mBAAyB,MAAA,CAAO,GAAA,CAAI,wBAAwB,CAAA;;;ACflE,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EACtC,MAAA;AAAA,EACA,MAAA;AAAA,EACA,WAAA,CAAY,QAAgB,MAAA,EAAiB;AAC3C,IAAA,KAAA,CAAM,OAAO,MAAA,KAAW,QAAA,GAAW,SAAS,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA;AAClE,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AACF,CAAA;AAEO,IAAM,uBAAA,GAA0BC,MACpC,MAAA,CAAO;AAAA,EACN,IAAA,EAAMA,MAAE,MAAA,EAAO;AAAA,EACf,IAAA,EAAMA,MAAE,MAAA,EAAO;AAAA,EACf,WAAWA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,GAAW,QAAA,EAAS;AAAA,EAC1C,aAAaA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,GAAW,QAAA,EAAS;AAAA,EAC5C,aAAaA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,GAAW,QAAA,EAAS;AAAA,EAC5C,SAAA,EAAWA,MAAE,MAAA,CAAOA,KAAA,CAAE,SAAS,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,EAAS;AAAA,EACrD,GAAA,EAAKA,MAAE,KAAA,CAAMA,KAAA,CAAE,QAAQ,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,EAAS;AAAA,EAC7C,IAAA,EAAMA,KAAA,CAAE,IAAA,CAAK,CAAC,QAAA,EAAU,OAAO,CAAC,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,EAAS;AAAA,EACtD,oBAAoBA,KAAA,CAAE,OAAA,GAAU,QAAA,EAAS,CAAE,QAAQ,KAAK,CAAA;AAAA,EACxD,OAAOA,KAAA,CAAE,OAAA,GAAU,QAAA,EAAS,CAAE,QAAQ,KAAK;AAC7C,CAAC,EACA,KAAA,EAAM;AAEF,IAAM,mBAAA,GAAsBA,MAChC,MAAA,CAAO;AAAA,EACN,GAAA,EAAKA,MAAE,KAAA,CAAMA,KAAA,CAAE,QAAQ,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,EAAS;AAAA,EAC7C,MAAMA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,GAAW,QAAA,EAAS;AAAA,EACrC,aAAaA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,GAAW,QAAA,EAAS;AAAA,EAC5C,SAAA,EAAWA,MAAE,MAAA,CAAOA,KAAA,CAAE,SAAS,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA;AAC9C,CAAC,EACA,MAAA,EAAO;AAEH,IAAM,mBAAA,GAAsBA,MAChC,MAAA,CAAO;AAAA,EACN,KAAA,EAAOA,MAAE,MAAA,EAAO;AAAA,EAChB,UAAA,EAAYA,MAAE,KAAA,CAAMA,KAAA,CAAE,QAAQ,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,EAAS;AAAA;AAAA;AAAA;AAAA,EAIpD,YAAA,EAAcA,MAAE,KAAA,CAAMA,KAAA,CAAE,QAAQ,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,EAAS;AAAA,EACtD,KAAA,EAAOA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,EAAE,CAAA;AAAA,EAC7C,IAAA,EAAMA,KAAA,CAAE,IAAA,CAAK,CAAC,QAAA,EAAU,OAAO,CAAC,CAAA,CAAE,QAAA,EAAS,CAAE,OAAA,CAAQ,QAAQ,CAAA;AAAA,EAC7D,kBAAA,EAAoBA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,GAAW,QAAA;AAClD,CAAC,EACA,KAAA,EAAM;AAgBT,IAAM,OAAA,GAAU,iEAAA;AAET,SAAS,iBAAiB,UAAA,EAA0B;AACzD,EAAA,IAAI,CAAC,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,UAAU,CAAC,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,aAAa,GAAA,EAAK,CAAA,qBAAA,EAAwB,KAAK,SAAA,CAAU,UAAU,CAAC,CAAA,CAAE,CAAA;AAAA,EAClF;AACF;AAEO,SAAS,SAAS,KAAA,EAAyB;AAChD,EAAA,IAAI,OAAO,KAAA,KAAU,SAAA,EAAW,OAAO,KAAA;AACvC,EAAA,IAAI,KAAA,IAAS,MAAM,OAAO,KAAA;AAC1B,EAAA,OAAO,CAAC,GAAA,EAAK,MAAA,EAAQ,KAAA,EAAO,IAAI,CAAA,CAAE,QAAA,CAAS,MAAA,CAAO,KAAK,CAAA,CAAE,IAAA,EAAK,CAAE,aAAa,CAAA;AAC/E;AAEO,SAAS,SAAS,KAAA,EAAyB;AAChD,EAAA,IAAI,UAAU,MAAA,IAAa,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,IAAI,OAAO,IAAA;AAClE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,KAAA;AACtC,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,EACjC,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,aAAa,GAAA,EAAK,CAAA,uBAAA,EAA0B,KAAK,SAAA,CAAU,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/E;AACF;AAEO,SAAS,QAAQ,KAAA,EAA+B;AACrD,EAAA,OAAO,KAAA,KAAU,UAAa,KAAA,KAAU,IAAA,IAAQ,UAAU,EAAA,GAAK,IAAA,GAAO,OAAO,KAAK,CAAA;AACpF;AAEO,SAAS,wBAAA,CAAyB,OAAgB,IAAA,EAA+C;AAKtG,EAAA,IAAI,KAAA,KAAU,SAAS,OAAO,OAAA;AAC9B,EAAA,IAAI,SAAS,IAAA,EAAM;AACjB,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,GAAA;AAAA,MACA,CAAA,EAAG,KAAK,OAAO,CAAA,qWAAA;AAAA,KAMjB;AAAA,EACF;AAIA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,OAAO,CAAA,KAAM,QAAQ,CAAA,EAAG;AACrE,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,GAAA;AAAA,MACA,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,2HAAA,EACsD,OAAO,KAAK,CAAA,CAAA;AAAA,KACnF;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,YAAA,CAAa,WAAoB,UAAA,EAA6C;AAC5F,EAAA,IAAI,SAAA,IAAa,IAAA,IAAQ,UAAA,IAAc,IAAA,IAAQ,eAAe,OAAA,EAAS;AACvE,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,yCAAyC,CAAA;AAAA,EACvE;AAEA,EAAA,MAAM,IAAA,GAAO,IAAI,GAAA,CAAI,UAAsB,CAAA;AAC3C,EAAA,MAAM,SAAA,GAAY,CAAC,GAAG,IAAI,IAAI,SAAA,CAAU,GAAA,CAAI,MAAM,CAAC,CAAC,EAAE,MAAA,CAAO,CAAC,MAAM,CAAC,IAAA,CAAK,IAAI,CAAC,CAAC,EAAE,IAAA,EAAK;AACvF,EAAA,IAAI,UAAU,MAAA,EAAQ;AACpB,IAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,CAAA,mDAAA,EAAsD,SAAS,CAAA,CAAE,CAAA;AAAA,EAC/F;AACF;AAEA,SAAS,OAAO,GAAA,EAAuB;AACrC,EAAA,IAAI,GAAA,IAAO,MAAM,OAAO,GAAA;AACxB,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,OAAQ,GAAA,CAAmC,WAAW,UAAA,EAAY;AAC/F,IAAA,OAAQ,IAAkC,MAAA,EAAO;AAAA,EACnD;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,SAAS,GAAA,EAA+B;AAC/C,EAAA,OAAO,IAAI,YAAA;AAAA,IACT,GAAA;AAAA,IACA,GAAA,CAAI,MAAA,CAAO,GAAA,CAAI,CAAC,OAAO,EAAE,GAAA,EAAK,CAAA,CAAE,IAAA,EAAM,KAAK,CAAA,CAAE,OAAA,EAAS,IAAA,EAAM,CAAA,CAAE,MAAK,CAAE;AAAA,GACvE;AACF;AAEA,eAAe,SAAA,CAAU,QAA2B,MAAA,EAAmD;AACrG,EAAA,IAAI;AACF,IAAA,OAAO,MAAA,CAAO,MAAM,MAAA,CAAO,MAAA,CAAO,MAAM,CAAC,CAAA;AAAA,EAC3C,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,eAAe,SAAA,IAAc,GAAA,YAAe,KAAA,IAAS,GAAA,CAAI,SAAS,WAAA,EAAc;AAClF,MAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,IACzC;AACA,IAAA,IAAI,GAAA,YAAe,SAAS,GAAA,CAAI,IAAA,KAAS,WAAW,mBAAA,CAAoB,IAAA,CAAK,GAAA,CAAI,OAAO,CAAA,EAAG;AACzF,MAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,IACzC;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAEA,eAAsB,gBAAA,CACpB,MAAA,EACA,OAAA,EACA,UAAA,EACkB;AAClB,EAAA,MAAM,WAAW,wBAAA,CAAyB,UAAA,EAAY,EAAE,OAAA,EAAS,sBAAsB,CAAA;AACvF,EAAA,MAAM,MAAA,GAAS,uBAAA,CAAwB,SAAA,CAAU,OAAO,CAAA;AACxD,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,QAAA,CAAS,OAAO,KAAK,CAAA;AAChD,EAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AACpB,EAAA,YAAA,CAAa,IAAA,CAAK,KAAK,QAAQ,CAAA;AAC/B,EAAA,OAAO,UAAU,MAAA,EAAQ;AAAA,IACvB,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,aAAa,IAAA,CAAK,WAAA;AAAA,IAClB,UAAU,IAAA,CAAK,SAAA;AAAA,IACf,YAAY,IAAA,CAAK,WAAA;AAAA,IACjB,UAAU,IAAA,CAAK,SAAA;AAAA,IACf,KAAK,IAAA,CAAK,GAAA;AAAA,IACV,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,mBAAmB,IAAA,CAAK,kBAAA;AAAA,IACxB,OAAO,IAAA,CAAK;AAAA,GACb,CAAA;AACH;AAEA,eAAsB,gBAAA,CACpB,QACA,IAAA,EAMkB;AAClB,EAAA,MAAM,WAAW,wBAAA,CAAyB,IAAA,CAAK,YAAY,EAAE,OAAA,EAAS,sBAAsB,CAAA;AAC5F,EAAA,MAAM,IAAA,GAAO,KAAK,IAAA,YAAgB,GAAA,GAAM,OAAO,WAAA,CAAY,IAAA,CAAK,IAAI,CAAA,GAAI,IAAA,CAAK,IAAA;AAC7E,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,IAAA,CAAK,GAAG,CAAA;AAC7B,EAAA,YAAA,CAAa,KAAK,QAAQ,CAAA;AAC1B,EAAA,OAAO,UAAU,MAAA,EAAQ;AAAA,IACvB,SAAS,IAAA,CAAK,OAAA;AAAA,IACd,UAAU,IAAA,CAAK,QAAA;AAAA,IACf,IAAA,EAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,KAAK,IAAA,CAAK,QAAA;AAAA,IACjC,WAAA,EAAa,OAAA,CAAQ,IAAA,CAAK,WAAW,CAAA;AAAA,IACrC,QAAA,EAAU,OAAA,CAAQ,IAAA,CAAK,SAAS,CAAA;AAAA,IAChC,UAAA,EAAY,OAAA,CAAQ,IAAA,CAAK,WAAW,CAAA;AAAA,IACpC,QAAA,EAAU,QAAA,CAAS,IAAA,CAAK,SAAS,CAAA;AAAA,IACjC,GAAA;AAAA,IACA,IAAA,EAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA;AAAA,IACvB,iBAAA,EAAmB,QAAA,CAAS,IAAA,CAAK,kBAAkB,CAAA;AAAA,IACnD,KAAA,EAAO,QAAA,CAAS,IAAA,CAAK,KAAK;AAAA,GAC3B,CAAA;AACH;AAEA,eAAsB,mBAAA,CACpB,QACA,IAAA,EAMkB;AAClB,EAAA,MAAM,WAAW,wBAAA,CAAyB,IAAA,CAAK,YAAY,EAAE,OAAA,EAAS,yBAAyB,CAAA;AAC/F,EAAA,IAAI,YAAA,GAAwB,IAAA;AAC5B,EAAA,IAAI,KAAK,MAAA,EAAQ;AACf,IAAA,IAAI;AACF,MAAA,YAAA,GAAe,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,MAAM,CAAA;AAAA,IACvC,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,aAAa,GAAA,EAAK,CAAA,gBAAA,EAAmB,KAAK,SAAA,CAAU,IAAA,CAAK,MAAM,CAAC,CAAA,CAAE,CAAA;AAAA,IAC9E;AAAA,EACF;AACA,EAAA,OAAO,OAAO,aAAA,CAAc;AAAA,IAC1B,QAAA,EAAU,KAAK,QAAA,IAAY,IAAA;AAAA,IAC3B,UAAA,EAAY,QAAA;AAAA,IACZ,MAAA,EAAQ,YAAA;AAAA,IACR,OAAO,IAAA,CAAK;AAAA,GACb,CAAA;AACH;AAEA,eAAsB,iBAAA,CACpB,MAAA,EACA,UAAA,EACA,UAAA,EACkB;AAClB,EAAA,MAAM,WAAW,wBAAA,CAAyB,UAAA,EAAY,EAAE,OAAA,EAAS,uBAAuB,CAAA;AACxF,EAAA,gBAAA,CAAiB,UAAU,CAAA;AAC3B,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,MAAA,CAAO,WAAA,CAAY,YAAY,EAAE,UAAA,EAAY,UAAU,CAAA;AAAA,EACtE,SAAS,GAAA,EAAK;AACZ,IAAA,IACE,eAAe,KAAA,KACd,GAAA,CAAI,SAAS,uBAAA,IAA2B,GAAA,YAAe,cAAc,KAAA,CAAA,EACtE;AACA,MAAA,MAAM,GAAA,GAAM,OAAO,GAAG,CAAA;AACtB,MAAA,IAAI,aAAa,IAAA,CAAK,GAAG,CAAA,IAAK,GAAA,CAAI,SAAS,uBAAA,EAAyB;AAClE,QAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,IAAI,OAAA,CAAQ,YAAA,EAAc,EAAE,CAAC,CAAA;AAAA,MAC3D;AAAA,IACF;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAEA,eAAsB,oBAAA,CACpB,MAAA,EACA,UAAA,EACA,UAAA,EACkB;AAClB,EAAA,MAAM,WAAW,wBAAA,CAAyB,UAAA,EAAY,EAAE,OAAA,EAAS,0BAA0B,CAAA;AAC3F,EAAA,gBAAA,CAAiB,UAAU,CAAA;AAC3B,EAAA,IAAI;AACF,IAAA,MAAM,OAAO,cAAA,CAAe,UAAA,EAAY,EAAE,UAAA,EAAY,UAAU,CAAA;AAAA,EAClE,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,GAAA,GAAM,OAAO,GAAG,CAAA;AACtB,IAAA,IAAI,YAAA,CAAa,KAAK,GAAG,CAAA,IAAM,eAAe,KAAA,IAAS,GAAA,CAAI,SAAS,uBAAA,EAA0B;AAC5F,MAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,IAAI,OAAA,CAAQ,YAAA,EAAc,EAAE,CAAC,CAAA;AAAA,IAC3D;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AACA,EAAA,OAAO,EAAE,SAAS,UAAA,EAAW;AAC/B;AAEA,eAAsB,oBAAA,CACpB,MAAA,EACA,UAAA,EACA,OAAA,EACA,UAAA,EACkB;AAClB,EAAA,MAAM,WAAW,wBAAA,CAAyB,UAAA,EAAY,EAAE,OAAA,EAAS,0BAA0B,CAAA;AAC3F,EAAA,gBAAA,CAAiB,UAAU,CAAA;AAC3B,EAAA,MAAM,MAAA,GAAS,mBAAA,CAAoB,SAAA,CAAU,OAAO,CAAA;AACpD,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,QAAA,CAAS,OAAO,KAAK,CAAA;AAChD,EAAA,MAAM,WAAoC,EAAC;AAC3C,EAAA,MAAM,GAAA,GAAM,OAAA;AACZ,EAAA,KAAA,MAAW,OAAO,CAAC,KAAA,EAAO,MAAA,EAAQ,aAAA,EAAe,WAAW,CAAA,EAAY;AACtE,IAAA,IAAI,MAAA,CAAO,MAAA,CAAO,GAAA,EAAK,GAAG,CAAA,EAAG;AAC3B,MAAA,QAAA,CAAS,QAAQ,WAAA,GAAc,UAAA,GAAa,GAAG,CAAA,GAAI,IAAI,GAAG,CAAA;AAAA,IAC5D;AAAA,EACF;AACA,EAAA,IAAI,KAAA,IAAS,QAAA,EAAU,YAAA,CAAa,QAAA,CAAS,KAAK,QAAQ,CAAA;AAC1D,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,cAAA,CAAe,UAAA,EAAY,EAAE,UAAA,EAAY,QAAA,EAAU,GAAG,QAAA,EAAU,CAAA;AAC7F,IAAA,OAAO,EAAE,OAAA,EAAQ;AAAA,EACnB,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,GAAA,GAAM,OAAO,GAAG,CAAA;AACtB,IAAA,IAAI,YAAA,CAAa,KAAK,GAAG,CAAA,IAAM,eAAe,KAAA,IAAS,GAAA,CAAI,SAAS,uBAAA,EAA0B;AAC5F,MAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,IAAI,OAAA,CAAQ,YAAA,EAAc,EAAE,CAAC,CAAA;AAAA,IAC3D;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAEA,eAAsB,YAAA,CACpB,MAAA,EACA,OAAA,EACA,UAAA,EACkB;AAClB,EAAA,MAAM,WAAW,wBAAA,CAAyB,UAAA,EAAY,EAAE,OAAA,EAAS,iBAAiB,CAAA;AAClF,EAAA,MAAM,MAAA,GAAS,mBAAA,CAAoB,SAAA,CAAU,OAAO,CAAA;AACpD,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,QAAA,CAAS,OAAO,KAAK,CAAA;AAChD,EAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AAKpB,EAAA,KAAA,MAAW,OAAO,IAAA,CAAK,YAAA,IAAgB,EAAC,mBAAoB,GAAG,CAAA;AAC/D,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO,KAAK,KAAA,EAAO;AAAA,MAC7C,WAAW,IAAA,CAAK,UAAA;AAAA,MAChB,aAAa,IAAA,CAAK,YAAA;AAAA,MAClB,UAAA,EAAY,QAAA;AAAA,MACZ,MAAM,IAAA,CAAK,KAAA;AAAA,MACX,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,kBAAkB,IAAA,CAAK;AAAA,KACxB,CAAA;AACD,IAAA,MAAM,IAAA,GAAA,CAAQ,MAAA,CAAO,IAAA,IAAQ,EAAC,EAAG,IAAI,CAAC,GAAA,KAAQ,MAAA,CAAO,GAAG,CAAC,CAAA;AACzD,IAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,MAAA,CAAO,KAAA,EAAM;AAAA,EACrC,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,eAAe,KAAA,IAAS,yBAAA,CAA0B,IAAA,CAAK,GAAA,CAAI,OAAO,CAAA,EAAG;AACvE,MAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,IACzC;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAEA,eAAsB,WAAA,CACpB,QACA,QAAA,EACkB;AAClB,EAAA,OAAO,MAAA,CAAO,KAAA,CAAM,QAAA,IAAY,IAAI,CAAA;AACtC;;;AClWA,WAAA,EAAA;;;ACEO,SAAS,UAAA,CACd,KACA,UAAA,EACS;AAGT,EAAA,IAAI,UAAA,KAAe,IAAA,IAAQ,UAAA,KAAe,OAAA,EAAS,OAAO,IAAA;AAC1D,EAAA,IAAI,GAAA,IAAO,MAAM,OAAO,IAAA;AACxB,EAAA,IAAI,CAAC,GAAA,CAAI,MAAA,EAAQ,OAAO,KAAA;AACxB,EAAA,MAAM,IAAA,GAAO,IAAI,GAAA,CAAK,UAAA,IAAuC,EAAE,CAAA;AAC/D,EAAA,OAAO,IAAI,IAAA,CAAK,CAAC,MAAM,IAAA,CAAK,GAAA,CAAI,CAAC,CAAC,CAAA;AACpC;;;ACZA,WAAA,EAAA;AAOO,IAAM,uBAAA,GAA0B,EAAA;AAChC,IAAM,kBAAA,GAAqB,EAAA;AAC3B,IAAM,cAAA,GAAiB,GAAA;AAE9B,IAAM,YAAA,GAAe,oFAAA;AA0BrB,SAAS,YAAY,GAAA,EAAsB;AACzC,EAAA,MAAM,OAAA,GAAU,IAAI,IAAA,EAAK;AACzB,EAAA,IACE,QAAQ,MAAA,IAAU,CAAA,IAClB,QAAQ,CAAC,CAAA,KAAM,QAAQ,OAAA,CAAQ,MAAA,GAAS,CAAC,CAAA,KACxC,QAAQ,CAAC,CAAA,KAAM,OAAO,OAAA,CAAQ,CAAC,MAAM,GAAA,CAAA,EACtC;AACA,IAAA,OAAO,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAAA,EAC5B;AACA,EAAA,IAAI,SAAA,CAAU,KAAK,OAAO,CAAA,SAAU,MAAA,CAAO,QAAA,CAAS,SAAS,EAAE,CAAA;AAC/D,EAAA,IAAI,eAAe,IAAA,CAAK,OAAO,GAAG,OAAO,MAAA,CAAO,WAAW,OAAO,CAAA;AAClE,EAAA,OAAO,OAAA;AACT;AAEA,SAAS,iBAAA,CAAkB,WAAoB,IAAA,EAAwC;AACrF,EAAA,IAAI,OAAO,SAAA,KAAc,QAAA,EAAU,OAAO,IAAA;AAC1C,EAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,IAAA,CAAK,SAAS,CAAA;AACzC,EAAA,IAAI,CAAC,KAAA,EAAO,MAAA,EAAQ,OAAO,IAAA;AAC3B,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,KAAA;AAC/B,EAAA,MAAM,EAAA,GAAK,MAAM,MAAA,CAAO,EAAA;AACxB,EAAA,IAAI,EAAE,SAAA,IAAa,IAAA,CAAA,EAAO,OAAO,IAAA;AACjC,EAAA,MAAM,IAAA,GAAO,KAAK,SAAS,CAAA;AAC3B,EAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,KAAA,CAAM,MAAA,CAAO,KAAM,CAAA;AAC7C,EAAA,IAAI;AACF,IAAA,QAAQ,EAAA;AAAI,MACV,KAAK,GAAA;AACH,QAAA,OAAQ,IAAA,GAAmB,KAAA;AAAA,MAC7B,KAAK,IAAA;AACH,QAAA,OAAQ,IAAA,IAAoB,KAAA;AAAA,MAC9B,KAAK,GAAA;AACH,QAAA,OAAQ,IAAA,GAAmB,KAAA;AAAA,MAC7B,KAAK,IAAA;AACH,QAAA,OAAQ,IAAA,IAAoB,KAAA;AAAA,MAC9B,KAAK,IAAA;AACH,QAAA,OAAO,IAAA,KAAS,KAAA;AAAA,MAClB,KAAK,IAAA;AACH,QAAA,OAAO,IAAA,KAAS,KAAA;AAAA,MAClB;AACE,QAAA,OAAO,IAAA;AAAA;AACX,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEO,SAAS,qBAAA,CACd,IACA,IAAA,EACS;AACT,EAAA,IAAI,EAAA,CAAG,kBAAkB,OAAO,IAAA;AAChC,EAAA,MAAM,MAAA,GAAS,EAAA,CAAG,cAAA,IAAkB,EAAC;AACrC,EAAA,MAAM,YAAY,MAAA,CAAO,SAAA;AACzB,EAAA,IAAI,CAAC,WAAW,OAAO,KAAA;AACvB,EAAA,OAAO,iBAAA,CAAkB,SAAA,EAAW,IAAA,IAAQ,EAAE,CAAA;AAChD;AAEA,SAAS,YAAY,GAAA,EAA8C;AACjE,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,MAAA,CAAO,GAAA,CAAI,EAAE,CAAA;AAAA,IACjB,QAAA,EAAU,MAAA,CAAO,GAAA,CAAI,SAAS,CAAA;AAAA,IAC9B,cAAA,EAAiB,GAAA,CAAI,gBAAA,IAAgD,EAAC;AAAA,IACtE,QAAA,EAAW,IAAI,SAAA,IAA+B,IAAA;AAAA,IAC9C,aAAA,EAAgB,IAAI,cAAA,IAAoC,IAAA;AAAA,IACxD,YAAY,GAAA,CAAI,UAAA;AAAA,IAChB,MAAA,EAAQ,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AAAA,IACzB,QAAA,EAAW,IAAI,QAAA,IAA8B,IAAA;AAAA,IAC7C,YAAA,EAAe,IAAI,aAAA,IAAoD,IAAA;AAAA,IACvE,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,UAAU,CAAA;AAAA,IAChC,UAAA,EAAY,MAAA,CAAO,GAAA,CAAI,WAAW,CAAA;AAAA,IAClC,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,UAAU;AAAA,GAClC;AACF;AAUA,SAAS,OAAO,KAAA,EAA6B;AAC3C,EAAA,IAAI,KAAA,IAAS,MAAM,OAAO,IAAA;AAC1B,EAAA,IAAI,KAAA,YAAiB,MAAM,OAAO,KAAA;AAClC,EAAA,OAAO,IAAI,IAAA,CAAK,MAAA,CAAO,KAAK,CAAC,CAAA;AAC/B;AAEA,SAAS,aAAA,CACP,YACA,UAAA,EACoC;AAGpC,EAAA,IAAI,UAAA,KAAe,IAAA,IAAQ,UAAA,KAAe,OAAA,EAAS,OAAO,EAAE,GAAA,EAAK,MAAA,EAAQ,MAAA,EAAQ,EAAC,EAAE;AACpF,EAAA,UAAA,GAAa,UAAA;AACb,EAAA,IAAI,CAAC,WAAW,MAAA,EAAQ;AACtB,IAAA,OAAO,EAAE,GAAA,EAAK,CAAA,kDAAA,CAAA,EAAsD,MAAA,EAAQ,EAAC,EAAE;AAAA,EACjF;AACA,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,uEAAuE,UAAU,CAAA,SAAA,CAAA;AAAA,IACtF,MAAA,EAAQ,CAAC,UAAU;AAAA,GACrB;AACF;AAcO,SAAS,kBAAA,CACd,YACA,UAAA,EACoC;AACpC,EAAA,IAAI,UAAA,KAAe,IAAA,IAAQ,UAAA,KAAe,OAAA,EAAS,OAAO,EAAE,GAAA,EAAK,MAAA,EAAQ,MAAA,EAAQ,EAAC,EAAE;AACpF,EAAA,MAAM,MAAA,GAAS,CAAA,4EAAA,CAAA;AACf,EAAA,UAAA,GAAa,UAAA;AACb,EAAA,IAAI,CAAC,UAAA,CAAW,MAAA,EAAQ,OAAO,EAAE,GAAA,EAAK,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA,CAAA,EAAK,MAAA,EAAQ,EAAC,EAAE;AAChE,EAAA,OAAO,EAAE,GAAA,EAAK,CAAA,CAAA,EAAI,MAAM,CAAA,mBAAA,EAAsB,UAAU,CAAA,SAAA,CAAA,EAAa,MAAA,EAAQ,CAAC,UAAU,CAAA,EAAE;AAC5F;AAQO,SAAS,sBAAsB,aAAA,EAAuC;AAC3E,EAAA,IAAI,aAAA,KAAkB,IAAA,IAAQ,aAAA,KAAkB,MAAA,EAAW,OAAO,IAAA;AAClE,EAAA,IAAI,OAAO,kBAAkB,QAAA,EAAU;AACrC,IAAA,MAAM,IAAI,SAAA,CAAU,CAAA,sDAAA,EAAyD,OAAO,aAAa,CAAA,CAAE,CAAA;AAAA,EACrG;AACA,EAAA,IAAI,CAAC,aAAA,EAAe,MAAM,IAAI,MAAM,0DAA0D,CAAA;AAC9F,EAAA,OAAO,aAAA;AACT;AAYA,SAAS,UAAA,CAAW,MAAmB,aAAA,EAA8B;AACnE,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,MAAA,IAAU,EAAC;AAC/B,EAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,IAAA,CAAK,IAAI,CAAA;AACxC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,oBAAO,IAAI,IAAA,EAAK;AACvC,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,MAAA,CAAO,eAAA,IAAmB,uBAAuB,CAAA;AACxE,EAAA,MAAM,YAAY,IAAI,IAAA,CAAK,UAAU,OAAA,EAAQ,GAAI,UAAU,GAAM,CAAA;AAIjE,EAAA,MAAM,UAAA,GAAa,KAAK,UAAA,KAAe,MAAA,IAAa,KAAK,UAAA,KAAe,OAAA,GAAU,OAAO,IAAA,CAAK,UAAA;AAC9F,EAAA,OAAO,EAAE,MAAA,EAAQ,SAAA,EAAW,SAAA,EAAW,YAAY,aAAA,EAAc;AACnE;AAEA,eAAe,aAAA,CACb,MAAA,EACA,IAAA,EACA,GAAA,EACyB;AACzB,EAAA,MAAM,KAAKC,iBAAA,EAAW;AACtB,EAAA,MAAM,OAAO,IAAA,CAAK,KAAA;AAAA,IAChB,CAAA;AAAA;AAAA,6DAAA,CAAA;AAAA,IAGA;AAAA,MACE,EAAA;AAAA,MACA,IAAA,CAAK,QAAA;AAAA,MACL,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA;AAAA,MACzB,KAAK,QAAA,IAAY,IAAA;AAAA,MACjB,GAAA,CAAI,aAAA;AAAA,MACJ,IAAI,UAAA,KAAe,IAAA,GAAO,OAAO,IAAA,CAAK,SAAA,CAAU,IAAI,UAAU,CAAA;AAAA,MAC9D,GAAA,CAAI,SAAA;AAAA,MACJ,GAAA,CAAI;AAAA;AACN,GACF;AACA,EAAA,OAAO;AAAA,IACL,EAAA;AAAA,IACA,UAAU,IAAA,CAAK,QAAA;AAAA,IACf,gBAAgB,GAAA,CAAI,MAAA;AAAA,IACpB,QAAA,EAAU,KAAK,QAAA,IAAY,IAAA;AAAA,IAC3B,eAAe,GAAA,CAAI,aAAA;AAAA,IACnB,YAAY,GAAA,CAAI,UAAA;AAAA,IAChB,MAAA,EAAQ,SAAA;AAAA,IACR,QAAA,EAAU,IAAA;AAAA,IACV,YAAA,EAAc,IAAA;AAAA,IACd,WAAW,GAAA,CAAI,SAAA;AAAA,IACf,UAAA,EAAY,IAAA;AAAA,IACZ,WAAW,GAAA,CAAI;AAAA,GACjB;AACF;AASA,eAAsB,aAAA,CAAc,QAAoB,IAAA,EAA4C;AAClG,EAAA,MAAM,aAAA,GAAgB,qBAAA,CAAsB,IAAA,CAAK,aAAa,CAAA;AAC9D,EAAA,OAAO,cAAc,MAAA,EAAQ,IAAA,EAAM,UAAA,CAAW,IAAA,EAAM,aAAa,CAAC,CAAA;AACpE;AA4BA,eAAsB,mBAAA,CACpB,QACA,IAAA,EACyB;AACzB,EAAA,MAAM,aAAA,GAAgB,qBAAA,CAAsB,IAAA,CAAK,aAAa,CAAA;AAC9D,EAAA,IAAI,aAAA,KAAkB,IAAA;AACpB,IAAA,MAAM,IAAI,MAAM,kEAAkE,CAAA;AACpF,EAAA,MAAM,GAAA,GAAM,UAAA,CAAW,IAAA,EAAM,aAAa,CAAA;AAC1C,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA;AAC5C,EAAA,MAAM,QAAA,GAAW,CAAA,uEAAA,CAAA;AACjB,EAAA,MAAM,SAAS,CAAC,IAAA,CAAK,UAAU,aAAA,EAAe,UAAA,EAAY,IAAI,SAAS,CAAA;AAGvE,EAAA,MAAM,OAAO,IAAA,CAAK,KAAA;AAAA,IAChB,CAAA;AAAA,WAAA,EACS,QAAQ,CAAA,4CAAA,CAAA;AAAA,IACjB;AAAA,GACF;AAIA,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,GAAU,CAAA,EAAG,OAAA,EAAA,EAAW;AAE5C,IAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,IAAA,CAAK,KAAA;AAAA,MAC9B,CAAA;AAAA,aAAA,EACS,QAAQ,CAAA;AAAA,sCAAA,CAAA;AAAA,MAEjB;AAAA,KACF;AACA,IAAA,IAAI,KAAA,CAAM,KAAK,CAAC,CAAA,SAAU,WAAA,CAAY,KAAA,CAAM,IAAA,CAAK,CAAC,CAAC,CAAA;AAEnD,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,aAAA,CAAc,MAAA,EAAQ,IAAA,EAAM,GAAG,CAAA;AAAA,IAC9C,SAAS,GAAA,EAAK;AACZ,MAAA,IAAK,GAAA,EAA2B,IAAA,KAAS,OAAA,EAAS,MAAM,GAAA;AAAA,IAC1D;AAAA,EACF;AACA,EAAA,MAAM,IAAI,MAAM,+EAA+E,CAAA;AACjG;AAEA,eAAsB,eAAA,CACpB,QACA,UAAA,EACA,QAAA,EACA,UACA,IAAA,GAAuC,IAAA,EACvC,IAAA,GAAmD,EAAC,EAC3B;AACzB,EAAA,IAAI,QAAA,KAAa,UAAA,IAAc,QAAA,KAAa,UAAA,EAAY;AACtD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,KAAK,SAAA,CAAU,QAAQ,CAAC,CAAA,oCAAA,CAAsC,CAAA;AAAA,EACrG;AACA,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,UAAA,KAAe,MAAA,GAAY,OAAO,IAAA,CAAK,UAAA;AAC/D,EAAA,MAAM,GAAA,GAAM,aAAA,CAAc,UAAA,EAAY,CAAC,CAAA;AACvC,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,CAAK,KAAA;AAAA,IAC/B,CAAA;AAAA;AAAA;AAAA;AAAA,WAAA,EAIS,IAAI,GAAG;AAAA,gBAAA,CAAA;AAAA,IAEhB,CAAC,QAAA,EAAU,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAA,IAAQ,EAAE,CAAA,EAAG,UAAA,EAAY,GAAG,GAAA,CAAI,MAAM;AAAA,GAC5E;AACA,EAAA,IAAI,MAAA,CAAO,aAAa,CAAA,EAAG,OAAO,YAAY,MAAA,CAAO,IAAA,CAAK,CAAC,CAAE,CAAA;AAE7D,EAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,yDAAA,CAAA,EAA6D;AAAA,IACpG;AAAA,GACD,CAAA;AACD,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,IAAA,CAAK,CAAC,CAAA;AAC3B,EAAA,MAAM,aAAA,GACJ,KAAK,UAAA,IAAc,IAAA,IAAQ,IAAI,UAAA,KAAe,IAAA,GAAO,OAAQ,GAAA,CAAI,UAAA;AACnE,EAAA,IAAI,CAAC,GAAA,IAAO,CAAC,UAAA,CAAW,KAAA,CAAM,OAAA,CAAQ,aAAa,CAAA,GAAI,aAAA,GAAgB,IAAA,EAAM,UAAU,CAAA,EAAG;AACxF,IAAA,MAAM,IAAI,mBAAmB,WAAW,CAAA;AAAA,EAC1C;AACA,EAAA,IAAI,GAAA,CAAI,WAAW,SAAA,EAAW;AAC5B,IAAA,MAAM,OAAO,IAAA,CAAK,KAAA;AAAA,MAChB,CAAA,gGAAA,CAAA;AAAA,MACA,CAAC,UAAU;AAAA,KACb;AACA,IAAA,MAAM,IAAI,eAAA,EAAgB;AAAA,EAC5B;AACA,EAAA,MAAM,IAAI,kBAAA,CAAmB,MAAA,CAAO,GAAA,CAAI,MAAM,CAAC,CAAA;AACjD;AASA,eAAsB,aAAA,CACpB,MAAA,EACA,IAAA,GAMI,EAAC,EACsB;AAC3B,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,KAAA,IAAS,kBAAkB,CAAA,EAAG,cAAc,CAAC,CAAA;AAC5F,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,UAAA,KAAe,MAAA,GAAY,OAAO,IAAA,CAAK,UAAA;AAC/D,EAAA,MAAM,SAAoB,EAAC;AAC3B,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,IAAI,IAAA,CAAK,UAAU,IAAA,EAAM;AACvB,IAAA,MAAA,CAAO,IAAA,CAAK,KAAK,MAAM,CAAA;AACvB,IAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,UAAA,EAAa,MAAA,CAAO,MAAM,CAAA,CAAE,CAAA;AAAA,EAC3C;AACA,EAAA,IAAI,IAAA,CAAK,YAAY,IAAA,EAAM;AACzB,IAAA,MAAA,CAAO,IAAA,CAAK,KAAK,QAAQ,CAAA;AACzB,IAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,aAAA,EAAgB,MAAA,CAAO,MAAM,CAAA,CAAE,CAAA;AAAA,EAC9C;AACA,EAAA,IAAI,IAAA,CAAK,iBAAiB,IAAA,EAAM;AAC9B,IAAA,MAAA,CAAO,IAAA,CAAK,KAAK,aAAa,CAAA;AAC9B,IAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,kBAAA,EAAqB,MAAA,CAAO,MAAM,CAAA,CAAE,CAAA;AAAA,EACnD;AACA,EAAA,MAAM,GAAA,GAAM,aAAA,CAAc,UAAA,EAAY,MAAA,CAAO,SAAS,CAAC,CAAA;AACvD,EAAA,OAAA,CAAQ,IAAA,CAAK,IAAI,GAAG,CAAA;AACpB,EAAA,MAAA,CAAO,IAAA,CAAK,GAAG,GAAA,CAAI,MAAM,CAAA;AACzB,EAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AACjB,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,CAAK,KAAA;AAAA,IAC/B,CAAA;AAAA,WAAA,EACS,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAC;AAAA;AAAA,YAAA,EAEpB,OAAO,MAAM,CAAA,CAAA;AAAA,IACvB;AAAA,GACF;AACA,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,GAAA,CAAI,WAAW,CAAA;AACpC;;;ACpZA,IAAM,KAAA,GAA6B,CAAC,MAAA,EAAQ,IAAA,EAAM,OAAO,UAAU,CAAA;AAwB5D,IAAM,UAAA,GAAN,MAAM,WAAA,CAAW;AAAA,EACtB,EAAA;AAAA,EACA,IAAA;AAAA,EACA,IAAA;AAAA,EACA,WAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,GAAA;AAAA,EACA,gBAAA;AAAA,EACA,cAAA;AAAA,EACA,OAAA;AAAA;AAAA;AAAA;AAAA,EAIA,QAAA;AAAA,EAEA,YAAY,IAAA,EAAsB;AAChC,IAAA,IAAA,CAAK,EAAA,GAAK,KAAK,EAAA,IAAM,IAAA;AACrB,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,WAAA,GAAc,KAAK,WAAA,IAAe,EAAA;AACvC,IAAA,IAAA,CAAK,MAAA,GAAS,IAAA,CAAK,MAAA,IAAU,EAAC;AAC9B,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA,CAAK,QAAA,IAAY,IAAA,CAAK,SAAA,IAAa,IAAA;AACnD,IAAA,IAAA,CAAK,GAAA,GAAM,KAAK,GAAA,IAAO,IAAA;AACvB,IAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA,CAAK,gBAAA,IAAoB,IAAA,CAAK,iBAAA,IAAqB,KAAA;AAC3E,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAA,CAAK,cAAA,IAAkB,IAAA,CAAK,mBAAmB,EAAC;AACtE,IAAA,IAAA,CAAK,OAAA,GAAU,KAAK,OAAA,IAAW,IAAA;AAC/B,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA,CAAK,QAAA,IAAY,IAAA,CAAK,aAAa,EAAC;AAAA,EACtD;AAAA,EAEA,OAAO,YAAY,IAAA,EAA2B;AAC5C,IAAA,IAAI,CAAC,QAAQ,OAAO,IAAA,KAAS,YAAY,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AAC5D,MAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,IACjD;AACA,IAAA,MAAM,CAAA,GAAI,IAAA;AACV,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,CAAA,CAAE,IAAA,IAAQ,EAAE,CAAA;AAChC,IAAA,IAAI,CAAC,KAAA,CAAM,QAAA,CAAS,IAAI,CAAA,EAAG;AACzB,MAAA,MAAM,IAAI,MAAM,CAAA,0CAAA,EAA6C,IAAA,CAAK,UAAU,CAAA,CAAE,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,IACvF;AACA,IAAA,MAAM,OAAO,MAAA,CAAO,CAAA,CAAE,IAAA,IAAQ,EAAE,EAAE,IAAA,EAAK;AACvC,IAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,kBAAkB,CAAA;AAC7C,IAAA,OAAO,IAAI,WAAA,CAAW;AAAA,MACpB,IAAI,CAAA,CAAE,EAAA,IAAM,OAAO,MAAA,CAAO,CAAA,CAAE,EAAE,CAAA,GAAI,IAAA;AAAA,MAClC,IAAA;AAAA,MACA,IAAA;AAAA,MACA,aAAa,CAAA,CAAE,WAAA,IAAe,OAAO,MAAA,CAAO,CAAA,CAAE,WAAW,CAAA,GAAI,EAAA;AAAA,MAC7D,MAAA,EAAS,CAAA,CAAE,MAAA,IAAkD,EAAC;AAAA,MAC9D,QAAA,EAAW,CAAA,CAAE,QAAA,IAAY,CAAA,CAAE,SAAA;AAAA,MAC3B,GAAA,EAAM,EAAE,GAAA,IAAuC,IAAA;AAAA,MAC/C,kBAAkB,OAAA,CAAQ,CAAA,CAAE,gBAAA,IAAoB,CAAA,CAAE,qBAAqB,KAAK,CAAA;AAAA,MAC5E,cAAA,EAAiB,CAAA,CAAE,cAAA,IAAkB,CAAA,CAAE,mBAAmB,EAAC;AAAA,MAC3D,SAAS,CAAA,CAAE,OAAA,KAAY,SAAY,IAAA,GAAO,OAAA,CAAQ,EAAE,OAAO,CAAA;AAAA,MAC3D,QAAA,EAAW,CAAA,CAAE,QAAA,IAAY,CAAA,CAAE,aAAa;AAAC,KAC1C,CAAA;AAAA,EACH;AACF,CAAA;AAEA,IAAM,OAAA,GAAqD;AAAA,EACzD,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,GAAA,EAAK,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,yCAAA,EAA0C;AAAA,MAC9E,MAAA,EAAQ;AAAA,QACN,IAAA,EAAM,QAAA;AAAA,QACN,MAAM,CAAC,KAAA,EAAO,MAAA,EAAQ,KAAA,EAAO,SAAS,QAAQ,CAAA;AAAA,QAC9C,OAAA,EAAS;AAAA,OACX;AAAA,MACA,OAAA,EAAS;AAAA,QACP,IAAA,EAAM,QAAA;AAAA,QACN,oBAAA,EAAsB,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,QACvC,SAAA,EAAW;AAAA,OACb;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,IAAA,EAAM;AAAA,QACJ,WAAA,EAAa;AAAA,OACf;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,WAAA,EAAa;AAAA,QACX,IAAA,EAAM,SAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,UAAA,EAAY;AAAA,QACV,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa,iDAAA;AAAA;AAAA,QAEb,SAAA,EAAW;AAAA,OACb;AAAA,MACA,aAAA,EAAe;AAAA,QACb,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,kBAAA,EAAoB;AAAA,QAClB,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa;AAAA;AACf,KACF;AAAA,IACA,QAAA,EAAU,CAAC,KAAA,EAAO,QAAQ;AAAA,GAC5B;AAAA,EACA,EAAA,EAAI;AAAA,IACF,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,MAAA,EAAQ;AAAA,QACN,IAAA,EAAM,QAAA;AAAA,QACN,IAAA,EAAM,CAAC,YAAA,EAAc,OAAA,EAAS,WAAW,OAAA,EAAS,QAAA,EAAU,QAAA,EAAU,YAAA,EAAc,WAAW;AAAA,OACjG;AAAA,MACA,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,MACvB,IAAA,EAAM,EAAE,IAAA,EAAM,SAAA,EAAU;AAAA,MACxB,QAAA,EAAU,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,MAC3B,QAAA,EAAU,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,MAC3B,QAAA,EAAU,EAAE,IAAA,EAAM,QAAA,EAAU,WAAW,IAAA,EAAK;AAAA,MAC5C,WAAA,EAAa;AAAA,QACX,IAAA,EAAM,QAAA;AAAA,QACN,IAAA,EAAM,CAAC,UAAA,EAAY,WAAA,EAAa,MAAM,CAAA;AAAA,QACtC,OAAA,EAAS;AAAA,OACX;AAAA,MACA,QAAA,EAAU,EAAE,IAAA,EAAM,SAAA,EAAW,SAAS,GAAA,EAAK;AAAA,MAC3C,eAAA,EAAiB,EAAE,IAAA,EAAM,OAAA,EAAS,OAAO,EAAE,IAAA,EAAM,UAAS,EAAE;AAAA;AAAA;AAAA;AAAA,MAI5D,YAAA,EAAc,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,MAC/B,WAAA,EAAa,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,MAC9B,SAAA,EAAW,EAAE,IAAA,EAAM,QAAA;AAAS,KAC9B;AAAA,IACA,QAAA,EAAU,CAAC,QAAA,EAAU,UAAU;AAAA,GACjC;AAAA,EACA,GAAA,EAAK;AAAA,IACH,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,GAAA,EAAK,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,MACtB,SAAA,EAAW,EAAE,IAAA,EAAM,QAAA,EAAU,MAAM,CAAC,KAAA,EAAO,MAAA,EAAQ,WAAW,CAAA,EAAE;AAAA,MAChE,KAAA,EAAO;AAAA,QACL,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa,iCAAA;AAAA,QACb,SAAA,EAAW;AAAA,OACb;AAAA,MACA,OAAA,EAAS;AAAA,QACP,IAAA,EAAM,QAAA;AAAA,QACN,oBAAA,EAAsB,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,QACvC,SAAA,EAAW;AAAA;AACb,KACF;AAAA,IACA,QAAA,EAAU,CAAC,KAAA,EAAO,WAAW;AAAA,GAC/B;AAAA,EACA,QAAA,EAAU;AAAA,IACR,IAAA,EAAM,QAAA;AAAA,IACN,YAAY;AAAC;AAEjB,CAAA;AAEO,SAAS,aAAa,IAAA,EAAyC;AACpE,EAAA,MAAM,MAAA,GAAS,QAAQ,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,KAAA,CAAM,sBAAsB,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA,CAAE,CAAA;AACzE,EAAA,OAAO,MAAA;AACT;AAcO,IAAM,iBAAA,GAAoB,cAAA;AAK1B,IAAM,mBAAA,GAAN,cAAkC,KAAA,CAAM;AAAC,CAAA;AAEhD,SAAS,cAAc,KAAA,EAAkD;AACvE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAEA,SAAS,UAAU,KAAA,EAAyB;AAK1C,EAAA,IAAI,aAAA,CAAc,KAAK,CAAA,EAAG;AACxB,IAAA,MAAM,MAA+B,EAAC;AACtC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,GAAI,SAAA,CAAU,CAAC,CAAA;AAChE,IAAA,OAAO,GAAA;AAAA,EACT;AACA,EAAA,IAAI,MAAM,OAAA,CAAQ,KAAK,GAAG,OAAO,KAAA,CAAM,IAAI,SAAS,CAAA;AACpD,EAAA,OAAO,iBAAA;AACT;AAEO,SAAS,iBAAiB,KAAA,EAAyB;AACxD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,KAAA,KAAU,iBAAA;AAChD,EAAA,IAAI,MAAM,OAAA,CAAQ,KAAK,GAAG,OAAO,KAAA,CAAM,KAAK,gBAAgB,CAAA;AAC5D,EAAA,IAAI,aAAA,CAAc,KAAK,CAAA,EAAG,OAAO,OAAO,MAAA,CAAO,KAAK,CAAA,CAAE,IAAA,CAAK,gBAAgB,CAAA;AAC3E,EAAA,OAAO,KAAA;AACT;AAOO,SAAS,YAAA,CAAa,MAAc,MAAA,EAA0D;AACnG,EAAA,MAAM,SACF,OAAA,CAAQ,IAAgB,GAAG,UAAA,IAA0D,OAAO,EAAC;AACjG,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AAIjD,IAAA,IAAI,IAAA,KAAS,MAAA,IAAU,GAAA,KAAQ,MAAA,EAAQ;AACrC,MAAA,GAAA,CAAI,GAAG,IAAI,MAAA,CAAO,WAAA,KAAgB,QAAQ,eAAA,CAAgB,KAAK,CAAA,GAAI,SAAA,CAAU,KAAK,CAAA;AAClF,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,MAAM,GAAG,CAAA;AACtB,IAAA,IAAI,IAAA,KAAS,MAAA,IAAa,IAAA,CAAK,SAAA,EAAW;AACxC,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,SAAA,CAAU,KAAK,CAAA;AAAA,IAC5B,CAAA,MAAO;AACL,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,eAAA,CAAgB,KAAK,CAAA;AAAA,IAClC;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAWO,SAAS,aAAA,CACd,UACA,MAAA,EACyB;AACzB,EAAA,MAAM,OAAA,GAAU,CAAC,KAAA,EAAgB,IAAA,EAAe,aAAsB,IAAA,KAA0B;AAC9F,IAAA,IAAI,aAAA,CAAc,KAAK,CAAA,EAAG;AACxB,MAAA,MAAM,QAAA,GAAW,aAAA,CAAc,IAAI,CAAA,GAAI,OAAO,EAAC;AAC/C,MAAA,MAAMC,OAA+B,EAAC;AACtC,MAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC1C,QAAAA,KAAI,CAAC,CAAA,GAAI,OAAA,CAAQ,CAAA,EAAG,SAAS,CAAC,CAAA,EAAG,CAAA,IAAK,QAAA,EAAU,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,CAAC,KAAK,CAAC,CAAA;AAAA,MAC3E;AACA,MAAA,OAAOA,IAAAA;AAAA,IACT;AACA,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAKxB,MAAA,MAAM,WAAW,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,GAAI,OAAO,EAAC;AAC/C,MAAA,OAAO,MAAM,GAAA,CAAI,CAAC,GAAG,CAAA,KAAM,OAAA,CAAQ,GAAG,QAAA,CAAS,CAAC,CAAA,EAAG,CAAA,GAAI,SAAS,MAAA,EAAQ,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,CAAC,GAAG,CAAC,CAAA;AAAA,IAC1F;AACA,IAAA,IAAI,UAAU,iBAAA,EAAmB;AAC/B,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,MAAM,IAAI,mBAAA;AAAA,UACR,UAAU,IAAI,CAAA,IAAA,EAAO,IAAA,CAAK,SAAA,CAAU,iBAAiB,CAAC,CAAA,kFAAA;AAAA,SAExD;AAAA,MACF;AACA,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AACA,EAAA,MAAM,QAAA,GAAW,UAAU,EAAC;AAC5B,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,CAAA,EAAG;AAC7C,IAAA,GAAA,CAAI,CAAC,IAAI,OAAA,CAAQ,CAAA,EAAG,SAAS,CAAC,CAAA,EAAG,CAAA,IAAK,QAAA,EAAU,CAAC,CAAA;AAAA,EACnD;AACA,EAAA,OAAO,GAAA;AACT;AC1SO,SAAS,WAAA,CAAY,MAA+B,GAAA,EAAqB;AAC9E,EAAA,MAAM,KAAA,GAAQC,mBAAY,EAAE,CAAA;AAC5B,EAAA,MAAM,MAAA,GAASC,qBAAA,CAAe,aAAA,EAAe,GAAA,EAAK,KAAK,CAAA;AACvD,EAAA,MAAM,YAAY,MAAA,CAAO,IAAA,CAAK,KAAK,SAAA,CAAU,IAAI,GAAG,MAAM,CAAA;AAC1D,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA,EAAG,MAAA,CAAO,KAAA,EAAO,CAAC,CAAA;AAC3E,EAAA,MAAM,GAAA,GAAM,OAAO,UAAA,EAAW;AAC9B,EAAA,OAAO,MAAA,CAAO,OAAO,CAAC,KAAA,EAAO,YAAY,GAAG,CAAC,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AAClE;AAEO,SAAS,WAAA,CAAY,OAAe,GAAA,EAAsC;AAC/E,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,KAAA,EAAO,QAAQ,CAAA;AACvC,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,QAAA,CAAS,CAAA,EAAG,EAAE,CAAA;AAChC,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,QAAA,CAAS,GAAA,CAAI,SAAS,EAAE,CAAA;AACxC,EAAA,MAAM,aAAa,GAAA,CAAI,QAAA,CAAS,EAAA,EAAI,GAAA,CAAI,SAAS,EAAE,CAAA;AACnD,EAAA,MAAM,QAAA,GAAWC,uBAAA,CAAiB,aAAA,EAAe,GAAA,EAAK,KAAK,CAAA;AAC3D,EAAA,QAAA,CAAS,WAAW,GAAG,CAAA;AACvB,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,MAAA,CAAO,CAAC,QAAA,CAAS,MAAA,CAAO,UAAU,CAAA,EAAG,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AAC/E,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,SAAA,CAAU,QAAA,CAAS,MAAM,CAAC,CAAA;AAC9C;AAEO,SAAS,aAAa,MAAA,EAA+C;AAC1E,EAAA,MAAM,YAAY,MAAA,CAAO,SAAA;AACzB,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KAGF;AAAA,EACF;AACA,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,SAAA,EAAW,WAAW,CAAA;AAC3C;AAEO,SAAS,aAAA,CAAc,KAAsB,KAAA,EAAuB;AACzE,EAAA,MAAM,IAAI,OAAO,GAAA,KAAQ,WAAW,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,GAAI,GAAA;AACvD,EAAA,OAAOC,iBAAA,CAAW,UAAU,CAAC,CAAA,CAAE,OAAO,KAAA,EAAO,MAAM,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AACnE;ACRO,IAAM,kBAAA,GAAqB,GAAA;AAG3B,IAAM,aAAA,GAAgB,CAAA;AAgBtB,SAAS,WAAW,IAAA,EAAkD;AAC3E,EAAA,OAAQ,KAAK,MAAA,IAAU,GAAA,IAAO,KAAK,MAAA,GAAS,GAAA,IAAQ,KAAK,IAAA,KAAS,gBAAA;AACpE;AAOO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EACtC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AAAA,EACd;AACF,CAAA;AAMO,IAAM,QAAA,GAAW;AAAA,EACtB,MAAM,OAAO,IAAA,EAAiC;AAC5C,IAAA,MAAM,OAAA,GAAU,MAAMC,YAAA,CAAI,MAAA,CAAO,IAAA,EAAM,EAAE,GAAA,EAAK,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,CAAA;AACpE,IAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,OAAO,CAAA;AAAA,EACrC;AACF,CAAA;AAQA,IAAM,UAAA,GAAsC;AAAA,EAC1C,CAAC,WAAW,CAAC,CAAA;AAAA;AAAA,EACb,CAAC,YAAY,CAAC,CAAA;AAAA;AAAA,EACd,CAAC,cAAc,EAAE,CAAA;AAAA;AAAA,EACjB,CAAC,aAAa,CAAC,CAAA;AAAA;AAAA,EACf,CAAC,eAAe,EAAE,CAAA;AAAA;AAAA,EAClB,CAAC,cAAc,EAAE,CAAA;AAAA;AAAA,EACjB,CAAC,eAAe,EAAE,CAAA;AAAA;AAAA,EAClB,CAAC,aAAa,CAAC,CAAA;AAAA;AAAA,EACf,CAAC,aAAa,CAAC,CAAA;AAAA;AAAA,EACf,CAAC,mBAAmB,EAAE;AAAA;AACxB,CAAA;AAEA,IAAM,UAAA,GAAsC;AAAA,EAC1C,CAAC,MAAM,GAAG,CAAA;AAAA;AAAA,EACV,CAAC,OAAO,GAAG,CAAA;AAAA;AAAA,EACX,CAAC,cAAc,EAAE,CAAA;AAAA;AAAA,EACjB,CAAC,aAAa,EAAE,CAAA;AAAA;AAAA,EAChB,CAAC,UAAU,EAAE,CAAA;AAAA;AAAA,EACb,CAAC,UAAU,CAAC,CAAA;AAAA;AAAA,EACZ,CAAC,UAAU,EAAE,CAAA;AAAA;AAAA,EACb,CAAC,UAAU,EAAE,CAAA;AAAA;AAAA,EACb,CAAC,UAAU,CAAC,CAAA;AAAA;AAAA,EACZ,CAAC,UAAU,EAAE;AAAA;AACf,CAAA;AAGA,SAAS,QAAQ,IAAA,EAAiC;AAChD,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC5B,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAC/B,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,CAAC,CAAA;AAC5B,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK;AAC1B,IAAA,MAAM,IAAA,GAAO,MAAM,CAAC,CAAA;AACpB,IAAA,IAAI,CAAC,WAAA,CAAY,IAAA,CAAK,IAAI,GAAG,OAAO,IAAA;AACpC,IAAA,MAAM,KAAA,GAAQ,OAAO,IAAI,CAAA;AACzB,IAAA,IAAI,KAAA,GAAQ,KAAK,OAAO,IAAA;AACxB,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,KAAA;AAAA,EACX;AACA,EAAA,OAAO,GAAA;AACT;AAMA,SAAS,QAAQ,IAAA,EAAiC;AAChD,EAAA,IAAI,OAAO,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,EAAA;AACjC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AACtC,EAAA,IAAI,SAAA,GAAY,GAAG,OAAO,IAAA;AAC1B,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,SAAA,GAAY,CAAC,CAAA;AACrC,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG;AACtB,IAAA,MAAM,EAAA,GAAK,QAAQ,IAAI,CAAA;AACvB,IAAA,IAAI,CAAC,IAAI,OAAO,IAAA;AAChB,IAAA,MAAM,EAAA,GAAA,CAAQ,GAAG,CAAC,CAAA,IAAgB,IAAM,EAAA,CAAG,CAAC,CAAA,EAAc,QAAA,CAAS,EAAE,CAAA;AACrE,IAAA,MAAM,EAAA,GAAA,CAAQ,GAAG,CAAC,CAAA,IAAgB,IAAM,EAAA,CAAG,CAAC,CAAA,EAAc,QAAA,CAAS,EAAE,CAAA;AACrE,IAAA,IAAA,GAAO,CAAA,EAAG,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,SAAA,GAAY,CAAC,CAAC,CAAA,EAAG,EAAE,CAAA,CAAA,EAAI,EAAE,CAAA,CAAA;AAAA,EACnD;AACA,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC9B,EAAA,IAAI,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG,OAAO,IAAA;AAC9B,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,CAAC,CAAA,GAAK,MAAA,CAAO,CAAC,CAAA,CAAa,KAAA,CAAM,GAAG,CAAA,GAAI,EAAC;AAC7D,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,MAAA,KAAW,CAAA,IAAK,MAAA,CAAO,CAAC,CAAA,GAAK,MAAA,CAAO,CAAC,CAAA,CAAa,KAAA,CAAM,GAAG,IAAI,EAAC;AACpF,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACvB,IAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAC9B,IAAA,MAAA,GAAS,IAAA;AAAA,EACX,CAAA,MAAO;AACL,IAAA,MAAM,OAAA,GAAU,CAAA,GAAI,IAAA,CAAK,MAAA,GAAS,IAAA,CAAK,MAAA;AACvC,IAAA,IAAI,OAAA,GAAU,GAAG,OAAO,IAAA;AACxB,IAAA,MAAA,GAAS,CAAC,GAAG,IAAA,EAAM,GAAG,KAAA,CAAM,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,EAAG,GAAG,IAAI,CAAA;AAAA,EACzD;AACA,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,EAAE,CAAA;AAC7B,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK;AAC1B,IAAA,MAAM,KAAA,GAAQ,OAAO,CAAC,CAAA;AACtB,IAAA,IAAI,CAAC,kBAAA,CAAmB,IAAA,CAAK,KAAK,GAAG,OAAO,IAAA;AAC5C,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,QAAA,CAAS,KAAA,EAAO,EAAE,CAAA;AACvC,IAAA,GAAA,CAAI,CAAA,GAAI,CAAC,CAAA,GAAI,KAAA,IAAS,CAAA;AACtB,IAAA,GAAA,CAAI,CAAA,GAAI,CAAA,GAAI,CAAC,CAAA,GAAI,KAAA,GAAQ,GAAA;AAAA,EAC3B;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,aAAa,IAAA,EAAiC;AACrD,EAAA,MAAM,MAAA,GAASC,SAAK,IAAI,CAAA;AACxB,EAAA,IAAI,MAAA,KAAW,CAAA,EAAG,OAAO,OAAA,CAAQ,IAAI,CAAA;AACrC,EAAA,IAAI,MAAA,KAAW,CAAA,EAAG,OAAO,OAAA,CAAQ,IAAI,CAAA;AACrC,EAAA,OAAO,IAAA;AACT;AAGA,SAAS,KAAA,CAAM,IAAA,EAAkB,GAAA,EAAiB,MAAA,EAAyB;AACzE,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,GAAA,CAAI,MAAA,EAAQ,OAAO,KAAA;AACvC,EAAA,MAAM,QAAQ,MAAA,IAAU,CAAA;AACxB,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,EAAO,CAAA,EAAA,EAAK,IAAI,IAAA,CAAK,CAAC,CAAA,KAAM,GAAA,CAAI,CAAC,CAAA,EAAG,OAAO,KAAA;AAC/D,EAAA,MAAM,OAAO,MAAA,GAAS,CAAA;AACtB,EAAA,IAAI,IAAA,KAAS,GAAG,OAAO,IAAA;AACvB,EAAA,MAAM,IAAA,GAAO,OAAS,CAAA,GAAI,IAAA;AAC1B,EAAA,OAAA,CAAS,KAAK,KAAK,CAAA,GAAe,IAAA,OAAY,GAAA,CAAI,KAAK,CAAA,GAAe,IAAA,CAAA;AACxE;AAEA,SAAS,QAAQ,KAAA,EAA6D;AAC5E,EAAA,OAAO,MAAM,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,MAAM,CAAA,KAAM;AACnC,IAAA,MAAM,KAAA,GAAQ,aAAa,IAAI,CAAA;AAC/B,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,IAAI,CAAA,CAAE,CAAA;AACjE,IAAA,OAAO,CAAC,OAAO,MAAM,CAAA;AAAA,EACvB,CAAC,CAAA;AACH;AAEA,IAAM,OAAA,GAAU,QAAQ,UAAU,CAAA;AAClC,IAAM,OAAA,GAAU,QAAQ,UAAU,CAAA;AAElC,IAAM,SAAA,GAAY,QAAQ,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAA,CAAE,CAAC,CAAA;AACjD,IAAM,KAAA,GAAQ,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAA,CAAE,CAAC,CAAA;AAC5C,IAAM,SAAA,GAAY,QAAQ,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA,CAAE,CAAC,CAAA;AAQ7C,SAAS,WAAW,KAAA,EAAsC;AACxD,EAAA,IAAI,MAAM,KAAA,EAAO,SAAA,CAAU,CAAC,CAAA,EAAG,UAAU,CAAC,CAAC,CAAA,IAAK,KAAA,CAAM,OAAO,KAAA,CAAM,CAAC,GAAG,KAAA,CAAM,CAAC,CAAC,CAAA,EAAG;AAChF,IAAA,OAAO,KAAA,CAAM,QAAA,CAAS,EAAA,EAAI,EAAE,CAAA;AAAA,EAC9B;AACA,EAAA,IAAI,KAAA,CAAM,KAAA,EAAO,SAAA,CAAU,CAAC,CAAA,EAAG,SAAA,CAAU,CAAC,CAAC,CAAA,EAAG,OAAO,KAAA,CAAM,QAAA,CAAS,GAAG,CAAC,CAAA;AACxE,EAAA,OAAO,IAAA;AACT;AAGA,SAAS,iBAAiB,OAAA,EAA0B;AAClD,EAAA,MAAM,KAAA,GAAQ,aAAa,OAAO,CAAA;AAClC,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,QAAQ,IAAA,CAAK,CAAC,CAAC,GAAA,EAAK,MAAM,CAAA,KAAM,KAAA,CAAM,KAAA,EAAO,GAAA,EAAK,MAAM,CAAC,CAAA;AACxF,EAAA,MAAM,QAAA,GAAW,WAAW,KAAK,CAAA;AACjC,EAAA,IAAI,QAAA,IAAY,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAC,GAAA,EAAK,MAAM,CAAA,KAAM,KAAA,CAAM,QAAA,EAAU,GAAA,EAAK,MAAM,CAAC,GAAG,OAAO,IAAA;AACtF,EAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAC,GAAA,EAAK,MAAM,CAAA,KAAM,KAAA,CAAM,KAAA,EAAO,GAAA,EAAK,MAAM,CAAC,CAAA;AAClE;AAWA,eAAsB,iBAAiB,IAAA,EAAgC;AACrE,EAAA,IAAI,IAAA,GAAA,CAAQ,QAAQ,EAAA,EACjB,IAAA,GACA,WAAA,EAAY,CACZ,OAAA,CAAQ,YAAA,EAAc,EAAE,CAAA;AAC3B,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,IAAI,IAAA,KAAS,aAAa,OAAO,IAAA;AAGjC,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,IAAK,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAEvE,EAAA,IAAIA,QAAA,CAAK,IAAI,CAAA,EAAG,OAAO,iBAAiB,IAAI,CAAA;AAE5C,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,SAAA,GAAY,MAAM,QAAA,CAAS,MAAA,CAAO,IAAI,CAAA;AAAA,EACxC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI,CAAC,SAAA,CAAU,MAAA,EAAQ,OAAO,IAAA;AAC9B,EAAA,OAAO,SAAA,CAAU,IAAA,CAAK,CAAC,OAAA,KAAY,gBAAA,CAAiB,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,OAAO,CAAC,CAAA;AACvF;AASA,eAAsB,mBAAA,CAAoB,KAAa,IAAA,EAAgD;AACrG,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAI,GAAA,CAAI,GAAA,IAAO,EAAE,CAAA;AAAA,EAC5B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,YAAA,CAAa,CAAA,eAAA,EAAkB,KAAK,SAAA,CAAU,GAAG,CAAC,CAAA,mBAAA,CAAqB,CAAA;AAAA,EACnF;AACA,EAAA,MAAM,SAAS,MAAA,CAAO,QAAA,CAAS,QAAQ,IAAA,EAAM,EAAE,EAAE,WAAA,EAAY;AAC7D,EAAA,IAAI,MAAA,KAAW,MAAA,IAAU,MAAA,KAAW,OAAA,EAAS;AAC3C,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,CAAA,sCAAA,EAAyC,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA,4CAAA;AAAA,KAEjE;AAAA,EACF;AACA,EAAA,IAAI,KAAK,YAAA,EAAc;AACvB,EAAA,MAAM,OAAO,MAAA,CAAO,QAAA;AACpB,EAAA,IAAI,MAAM,gBAAA,CAAiB,IAAI,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,CAAA,eAAA,EAAkB,QAAQ,WAAW,CAAA,4FAAA;AAAA,KAEvC;AAAA,EACF;AACF;;;AC7RO,IAAM,WAAA,GAAc,OAAA;;;ACqB3B,eAAe,WAAA,CAAY,KAAa,YAAA,EAAsC;AAC5E,EAAA,IAAI,OAAA,GAAU,GAAA;AACd,EAAA,MAAM,MAAA,GAAA,CAAU,oBAAoB,IAAA,CAAK,GAAA,IAAO,EAAE,CAAA,GAAI,CAAC,CAAA,IAAK,EAAA,EAAI,WAAA,EAAY;AAC5E,EAAA,IAAI,MAAA,KAAW,MAAM,OAAA,GAAU,CAAA,KAAA,EAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,MAAA,GAAS,CAAC,CAAC,CAAA,CAAA;AAAA,OAAA,IAC1D,MAAA,KAAW,OAAO,OAAA,GAAU,CAAA,MAAA,EAAS,IAAI,KAAA,CAAM,MAAA,CAAO,MAAA,GAAS,CAAC,CAAC,CAAA,CAAA;AAC1E,EAAA,MAAM,mBAAA,CAAoB,OAAA,EAAS,EAAE,YAAA,EAAc,CAAA;AACrD;AAGA,IAAM,gBAAA,GAAmB,+CAAA;AAElB,IAAM,QAAA,GAAN,MAAM,SAAA,SAAiB,KAAA,CAAM;AAAA,EAClC,IAAA;AAAA,EACA,IAAA;AAAA,EACA,WAAA,CAAY,IAAA,EAAc,OAAA,EAAiB,IAAA,GAAgB,IAAA,EAAM;AAC/D,IAAA,KAAA,CAAM,CAAA,CAAA,EAAI,IAAI,CAAA,EAAA,EAAK,OAAO,CAAA,CAAE,CAAA;AAC5B,IAAA,IAAA,CAAK,IAAA,GAAO,UAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AAAA,EACA,OAAO,YAAY,GAAA,EAAwC;AACzD,IAAA,OAAO,IAAI,SAAA,CAAS,MAAA,CAAO,GAAA,CAAI,IAAA,IAAQ,KAAM,CAAA,EAAG,MAAA,CAAO,GAAA,CAAI,OAAA,IAAW,WAAW,CAAA,EAAG,IAAI,IAAI,CAAA;AAAA,EAC9F;AACF,CAAA;AAWA,SAAS,eAAe,GAAA,EAA6C;AACnE,EAAA,MAAM,SAAA,GAAY,IACf,KAAA,CAAM,IAAI,EACV,MAAA,CAAO,CAAC,OAAO,EAAA,CAAG,UAAA,CAAW,OAAO,CAAC,CAAA,CACrC,IAAI,CAAC,EAAA,KAAO,GAAG,KAAA,CAAM,CAAC,CAAA,CAAE,SAAA,EAAW,CAAA;AACtC,EAAA,IAAI,CAAC,SAAA,CAAU,MAAA,EAAQ,OAAO,IAAA;AAC9B,EAAA,IAAI;AACF,IAAA,MAAM,UAAU,IAAA,CAAK,KAAA,CAAM,SAAA,CAAU,IAAA,CAAK,IAAI,CAAC,CAAA;AAC/C,IAAA,IAAI,WAAW,OAAO,OAAA,KAAY,aAAa,QAAA,IAAY,OAAA,IAAW,WAAW,OAAA,CAAA,EAAU;AACzF,MAAA,OAAO,OAAA;AAAA,IACT;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,IAAA;AACT;AAEO,IAAM,gBAAN,MAAyC;AAAA,EAC9C,IAAA,GAAO,MAAA;AAAA,EACP,GAAA;AAAA,EACA,YAAA;AAAA,EACQ,WAAA;AAAA,EACA,SAAA,GAA2B,IAAA;AAAA,EAEnC,WAAA,CAAY,GAAA,EAAa,OAAA,EAAiC,YAAA,GAAe,KAAA,EAAO;AAC9E,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AACX,IAAA,IAAA,CAAK,YAAA,GAAe,YAAA;AACpB,IAAA,IAAA,CAAK,WAAA,GAAc;AAAA,MACjB,GAAG,OAAA;AAAA,MACH,cAAA,EAAgB,kBAAA;AAAA,MAChB,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AAAA,EAEA,MAAM,OAAA,GAAyB;AAG7B,IAAA,MAAM,WAAA,CAAY,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,YAAY,CAAA;AAAA,EAC/C;AAAA,EAEA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA;AAAA,EACnB;AAAA,EAEQ,YAAA,GAAuC;AAC7C,IAAA,MAAM,IAAA,GAAO,EAAE,GAAG,IAAA,CAAK,WAAA,EAAY;AACnC,IAAA,IAAI,IAAA,CAAK,SAAA,EAAW,IAAA,CAAK,gBAAgB,IAAI,IAAA,CAAK,SAAA;AAClD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,QAAQ,GAAA,EAAgE;AAC5E,IAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,IAAA,CAAK,GAAA,EAAK;AAAA,MACjC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,KAAK,YAAA,EAAa;AAAA,MAC3B,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,GAAG,CAAA;AAAA;AAAA;AAAA;AAAA,MAIxB,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AAC7C,IAAA,IAAI,GAAA,OAAU,SAAA,GAAY,GAAA;AAC1B,IAAA,IAAI,UAAA,CAAW,IAAI,CAAA,EAAG;AACpB,MAAA,MAAM,IAAI,QAAA,CAAS,IAAA,CAAK,MAAA,EAAQ,gBAAgB,CAAA;AAAA,IAClD;AACA,IAAA,IAAI,IAAA,CAAK,UAAU,GAAA,EAAK;AACtB,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,EAAK;AAC7B,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,iBAAA,EAAoB,IAAA,CAAK,MAAM,CAAA,MAAA,EAAS,IAAA,CAAK,GAAG,CAAA,EAAA,EAAK,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,CAAA;AACvF,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,KAAA,EAAQ,IAAA,CAAK,MAAM,CAAA,EAAA,EAAK,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,IAC9D;AACA,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AACxD,IAAA,IAAI,WAAA,CAAY,QAAA,CAAS,mBAAmB,CAAA,EAAG;AAC7C,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,EAAK;AAC7B,MAAA,IAAI,SAAkC,EAAC;AACvC,MAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,KAAA,CAAM,YAAY,CAAA,EAAG;AAC5C,QAAA,MAAM,MAAA,GAAS,eAAe,KAAK,CAAA;AACnC,QAAA,IAAI,QAAQ,MAAA,GAAS,MAAA;AAAA,MACvB;AACA,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,OAAQ,MAAM,KAAK,IAAA,EAAK;AAAA,EAC1B;AAAA,EAEA,MAAM,KAAK,GAAA,EAA6C;AACtD,IAAA,MAAM,IAAA,CAAK,QAAQ,GAAG,CAAA;AAAA,EACxB;AAAA,EAEA,MAAM,IAAA,GAAyC;AAC7C,IAAA,OAAO,EAAC;AAAA,EACV;AAAA,EAEA,cAAA,GAAyC;AACvC,IAAA,OAAO,EAAE,GAAG,IAAA,CAAK,WAAA,EAAY;AAAA,EAC/B;AACF,CAAA;AAEO,IAAM,eAAN,MAAwC;AAAA,EAC7C,IAAA,GAAO,KAAA;AAAA,EACP,SAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,YAAA;AAAA;AAAA;AAAA;AAAA,EAIQ,OAAA,GAAyB,IAAA;AAAA;AAAA;AAAA;AAAA,EAIzB,cAAA,GAAgC,IAAA;AAAA,EAChC,QAAwC,EAAC;AAAA,EACzC,UAAuD,EAAC;AAAA,EACxD,KAAA,GAAgC,IAAA;AAAA,EAExC,WAAA,CAAY,GAAA,EAAa,OAAA,EAAiC,YAAA,GAAe,KAAA,EAAO;AAC9E,IAAA,IAAA,CAAK,YAAA,GAAe,YAAA;AACpB,IAAA,IAAA,CAAK,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACtC,IAAA,IAAI,GAAA,CAAI,SAAS,SAAS,CAAA,OAAQ,OAAA,GAAU,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAAA,SAAA,IAClD,GAAA,CAAI,SAAS,MAAM,CAAA,OAAQ,OAAA,GAAU,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAAA,SACxD,IAAA,CAAK,OAAA,GAAU,GAAA,CAAI,OAAA,CAAQ,OAAO,EAAE,CAAA;AACzC,IAAA,IAAA,CAAK,OAAA,GAAU,EAAE,GAAG,OAAA,EAAQ;AAAA,EAC9B;AAAA,EAEQ,QAAQ,GAAA,EAAoC;AAClD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,KAAA,EAAM;AAClC,IAAA,IAAI,MAAA,SAAe,GAAG,CAAA;AAAA,SACjB,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA;AAAA,EAC1B;AAAA,EAEA,MAAM,OAAA,GAAyB;AAC7B,IAAA,MAAM,WAAA,CAAY,IAAA,CAAK,SAAA,EAAW,IAAA,CAAK,YAAY,CAAA;AACnD,IAAA,IAAA,CAAK,KAAA,GAAQ,IAAI,eAAA,EAAgB;AACjC,IAAA,KAAK,KAAK,MAAA,EAAO;AAAA,EACnB;AAAA,EAEA,MAAc,MAAA,GAAwB;AACpC,IAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,IAAA,CAAK,SAAA,EAAW;AAAA,MACvC,SAAS,EAAE,GAAG,IAAA,CAAK,OAAA,EAAS,QAAQ,mBAAA,EAAoB;AAAA,MACxD,MAAA,EAAQ,KAAK,KAAA,EAAO,MAAA;AAAA,MACpB,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,IAAI,UAAA,CAAW,IAAI,CAAA,EAAG;AACpB,MAAA,MAAM,IAAI,QAAA,CAAS,IAAA,CAAK,MAAA,EAAQ,gBAAgB,CAAA;AAAA,IAClD;AACA,IAAA,IAAI,CAAC,KAAK,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,IAAA,EAAO,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAClD,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAC1D,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,CAAK,SAAA,EAAU;AACnC,IAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,IAAA,IAAI,GAAA,GAAM,EAAA;AACV,IAAA,IAAI,SAAA,GAA2B,IAAA;AAC/B,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,OAAO,IAAA,EAAM;AACX,MAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,OAAO,IAAA,EAAK;AAC1C,MAAA,IAAI,IAAA,EAAM;AACV,MAAA,GAAA,IAAO,QAAQ,MAAA,CAAO,KAAA,EAAO,EAAE,MAAA,EAAQ,MAAM,CAAA;AAC7C,MAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA;AAC5B,MAAA,GAAA,GAAM,KAAA,CAAM,KAAI,IAAK,EAAA;AACrB,MAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,QAAA,IAAI,IAAA,KAAS,EAAA,IAAM,IAAA,KAAS,IAAA,EAAM;AAChC,UAAA,IAAA,CAAK,aAAA,CAAc,OAAO,SAAS,CAAA;AACnC,UAAA,KAAA,CAAM,MAAA,GAAS,CAAA;AACf,UAAA,SAAA,GAAY,IAAA;AACZ,UAAA;AAAA,QACF;AACA,QAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACvC,QAAA,IAAI,QAAA,CAAS,WAAW,QAAQ,CAAA,cAAe,QAAA,CAAS,KAAA,CAAM,CAAC,CAAA,CAAE,IAAA,EAAK;AACtE,QAAA,KAAA,CAAM,KAAK,QAAQ,CAAA;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,aAAA,CAAc,KAAe,SAAA,EAAgC;AACnE,IAAA,MAAM,YAAY,GAAA,CAAI,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,OAAO,CAAC,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,MAAM,CAAC,CAAA,CAAE,WAAW,CAAA;AAC5F,IAAA,IAAI,CAAC,UAAU,MAAA,EAAQ;AACvB,IAAA,MAAM,OAAA,GAAU,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA;AACnC,IAAA,IAAI,cAAc,UAAA,EAAY;AAC5B,MAAA,MAAM,QAAA,GAAW,QAAQ,IAAA,EAAK;AAC9B,MAAA,IAAA,CAAK,OAAA,GAAU,QAAA,CAAS,UAAA,CAAW,GAAG,CAAA,GAAI,GAAG,IAAA,CAAK,OAAO,CAAA,EAAG,QAAQ,CAAA,CAAA,GAAK,QAAA;AACzE,MAAA;AAAA,IACF;AACA,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,KAAA,CAAM,OAAO,CAA4B,CAAA;AAAA,IAC7D,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,EACpB;AAAA,EAEA,MAAM,KAAK,GAAA,EAA6C;AACtD,IAAA,IAAI,CAAC,KAAK,OAAA,EAAS;AACjB,MAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK;AAC3B,QAAA,IAAI,KAAK,OAAA,EAAS;AAClB,QAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,MAAM,UAAA,CAAW,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,MAC7C;AAAA,IACF;AACA,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,IAAW,IAAA,CAAK,OAAA;AAIrC,IAAA,IAAI,OAAA,KAAY,KAAK,cAAA,EAAgB;AACnC,MAAA,MAAM,WAAA,CAAY,OAAA,EAAS,IAAA,CAAK,YAAY,CAAA;AAC5C,MAAA,IAAA,CAAK,cAAA,GAAiB,OAAA;AAAA,IACxB;AACA,IAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,OAAA,EAAS;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,SAAS,EAAE,GAAG,IAAA,CAAK,OAAA,EAAS,gBAAgB,kBAAA,EAAmB;AAAA,MAC/D,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,GAAG,CAAA;AAAA,MACxB,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,IAAI,UAAA,CAAW,IAAI,CAAA,EAAG;AACpB,MAAA,MAAM,IAAI,QAAA,CAAS,IAAA,CAAK,MAAA,EAAQ,gBAAgB,CAAA;AAAA,IAClD;AACA,IAAA,IAAI,CAAC,KAAK,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,SAAA,EAAY,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AACvD,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAQ,MAAM,IAAA,CAAK,IAAA,EAAK;AAC9B,MAAA,IAAI,QAAQ,OAAO,IAAA,KAAS,aAAa,QAAA,IAAY,IAAA,IAAQ,WAAW,IAAA,CAAA,EAAO;AAC7E,QAAA,IAAA,CAAK,QAAQ,IAAI,CAAA;AAAA,MACnB;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAM,IAAA,GAAyC;AAC7C,IAAA,IAAI,KAAK,KAAA,CAAM,MAAA,EAAQ,OAAO,IAAA,CAAK,MAAM,KAAA,EAAM;AAC/C,IAAA,OAAO,IAAI,QAAQ,CAAC,OAAA,KAAY,KAAK,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAC,CAAA;AAAA,EAC5D;AACF,CAAA;AAEO,IAAM,cAAN,MAAuC;AAAA,EAC5C,IAAA,GAAO,WAAA;AAAA,EACP,GAAA;AAAA,EACA,OAAA;AAAA,EACA,YAAA;AAAA,EACQ,EAAA,GAAuB,IAAA;AAAA,EACvB,QAAwC,EAAC;AAAA,EACzC,UAAuD,EAAC;AAAA,EAEhE,WAAA,CAAY,GAAA,EAAa,OAAA,EAAiC,YAAA,GAAe,KAAA,EAAO;AAC9E,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AACX,IAAA,IAAA,CAAK,YAAA,GAAe,YAAA;AACpB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AAAA,EAEA,MAAM,OAAA,GAAyB;AAO7B,IAAA,MAAM,WAAA,CAAY,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,YAAY,CAAA;AAC7C,IAAA,MAAM,KAAK,UAAA,CAAW,SAAA;AACtB,IAAA,IAAI,CAAC,EAAA,EAAI,MAAM,IAAI,MAAM,4CAA4C,CAAA;AACrE,IAAA,IAAA,CAAK,EAAA,GAAK,IAAI,EAAA,CAAG,IAAA,CAAK,GAAG,CAAA;AACzB,IAAA,IAAA,CAAK,EAAA,CAAG,gBAAA,CAAiB,SAAA,EAAW,CAAC,EAAA,KAAO;AAC1C,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAQ,EAAA,CAAoB,IAAI,CAAC,CAAA;AACzD,QAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,KAAA,EAAM;AAClC,QAAA,IAAI,MAAA,SAAe,IAAI,CAAA;AAAA,aAClB,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA;AAAA,MAC3B,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF,CAAC,CAAA;AACD,IAAA,MAAM,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AAC3C,MAAA,IAAA,CAAK,EAAA,CAAI,gBAAA,CAAiB,MAAA,EAAQ,MAAM,SAAS,CAAA;AACjD,MAAA,IAAA,CAAK,EAAA,CAAI,iBAAiB,OAAA,EAAS,MAAM,OAAO,IAAI,KAAA,CAAM,iBAAiB,CAAC,CAAC,CAAA;AAAA,IAC/E,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAA,CAAK,IAAI,KAAA,EAAM;AACf,IAAA,IAAA,CAAK,EAAA,GAAK,IAAA;AAAA,EACZ;AAAA,EAEA,MAAM,KAAK,GAAA,EAA6C;AACtD,IAAA,IAAI,CAAC,IAAA,CAAK,EAAA,EAAI,MAAM,IAAI,MAAM,eAAe,CAAA;AAC7C,IAAA,IAAA,CAAK,EAAA,CAAG,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA;AAAA,EAClC;AAAA,EAEA,MAAM,IAAA,GAAyC;AAC7C,IAAA,IAAI,KAAK,KAAA,CAAM,MAAA,EAAQ,OAAO,IAAA,CAAK,MAAM,KAAA,EAAM;AAC/C,IAAA,OAAO,IAAI,QAAQ,CAAC,OAAA,KAAY,KAAK,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAC,CAAA;AAAA,EAC5D;AACF,CAAA;AAEO,IAAM,SAAA,GAAN,MAAM,UAAA,CAAU;AAAA,EACrB,GAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA,GAAY,KAAA;AAAA,EACJ,EAAA,GAAK,CAAA;AAAA,EACL,OAAA,uBAAc,GAAA,EAGpB;AAAA,EACF,eAAwC,EAAC;AAAA,EACzC,QAAwC,EAAC;AAAA,EACzC,YAA4C,EAAC;AAAA,EACrC,OAAA;AAAA,EACR,YAAA;AAAA,EAEA,YACE,GAAA,EACA,OAAA,GAAyC,IAAA,EACzC,IAAA,GAAmC,EAAC,EACpC;AACA,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AACX,IAAA,IAAA,CAAK,OAAA,GAAU,WAAW,EAAC;AAC3B,IAAA,IAAA,CAAK,YAAA,GAAe,KAAK,YAAA,IAAgB,KAAA;AACzC,IAAA,IAAA,CAAK,YAAY,UAAA,CAAU,eAAA,CAAgB,KAAK,IAAA,CAAK,OAAA,EAAS,KAAK,YAAY,CAAA;AAAA,EACjF;AAAA,EAEA,OAAO,eAAA,CAAgB,GAAA,EAAa,OAAA,EAAiC,eAAe,KAAA,EAAkB;AACpG,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,IAAK,QAAQ,OAAA,EAAS;AAC/C,MAAA,MAAM,IAAI,MAAM,iFAAiF,CAAA;AAAA,IACnG;AACA,IAAA,IAAI,IAAI,UAAA,CAAW,OAAO,KAAK,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG;AACvD,MAAA,OAAO,IAAI,WAAA,CAAY,GAAA,EAAK,OAAA,EAAS,YAAY,CAAA;AAAA,IACnD;AACA,IAAA,IACE,GAAA,CAAI,UAAA,CAAW,aAAa,CAAA,IAC5B,IAAI,UAAA,CAAW,cAAc,CAAA,IAC7B,GAAA,CAAI,SAAS,SAAS,CAAA,IACtB,GAAA,CAAI,QAAA,CAAS,MAAM,CAAA,EACnB;AACA,MAAA,MAAM,KAAA,GAAQ,IAAI,OAAA,CAAQ,aAAA,EAAe,SAAS,CAAA,CAAE,OAAA,CAAQ,gBAAgB,UAAU,CAAA;AACtF,MAAA,OAAO,IAAI,YAAA,CAAa,KAAA,EAAO,OAAA,EAAS,YAAY,CAAA;AAAA,IACtD;AACA,IAAA,IAAI,IAAI,UAAA,CAAW,SAAS,KAAK,GAAA,CAAI,UAAA,CAAW,UAAU,CAAA,EAAG;AAC3D,MAAA,OAAO,IAAI,aAAA,CAAc,GAAA,EAAK,OAAA,EAAS,YAAY,CAAA;AAAA,IACrD;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iBAAA,EAAoB,GAAG,CAAA,uCAAA,CAAyC,CAAA;AAAA,EAClF;AAAA,EAEQ,MAAA,GAAiB;AACvB,IAAA,IAAA,CAAK,EAAA,IAAM,CAAA;AACX,IAAA,OAAO,MAAA,CAAO,KAAK,EAAE,CAAA;AAAA,EACvB;AAAA,EAEA,MAAc,QAAA,GAA0B;AACtC,IAAA,OAAO,KAAK,SAAA,EAAW;AACrB,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAAU,IAAA,EAAK;AACtC,MAAA,IAAI,CAAC,GAAA,EAAK;AACV,MAAA,MAAM,MAAM,GAAA,CAAI,EAAA,IAAM,OAAO,MAAA,CAAO,GAAA,CAAI,EAAE,CAAA,GAAI,IAAA;AAC9C,MAAA,IAAI,GAAA,KAAQ,QAAA,IAAY,GAAA,IAAO,OAAA,IAAW,GAAA,CAAA,EAAM;AAC9C,QAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAChC,QAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,GAAG,CAAA;AACvB,QAAA,GAAA,EAAK,QAAQ,GAAG,CAAA;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,GAAA,CACZ,MAAA,EACA,MAAA,GAAyC,IAAA,EACzC,UAAU,GAAA,EACQ;AAClB,IAAA,MAAM,GAAA,GAAM,KAAK,MAAA,EAAO;AACxB,IAAA,MAAM,OAAA,GAAU,EAAE,OAAA,EAAS,KAAA,EAAO,EAAA,EAAI,KAAK,MAAA,EAAQ,MAAA,EAAQ,MAAA,IAAU,EAAC,EAAE;AACxE,IAAA,IAAI,IAAA,CAAK,qBAAqB,aAAA,EAAe;AAC3C,MAAA,MAAMC,IAAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAAU,QAAQ,OAAO,CAAA;AAChD,MAAA,IAAIA,KAAI,KAAA,EAAO,MAAM,QAAA,CAAS,WAAA,CAAYA,KAAI,KAAgC,CAAA;AAC9E,MAAA,OAAOA,IAAAA,CAAI,UAAU,EAAC;AAAA,IACxB;AACA,IAAA,MAAM,MAAM,MAAM,IAAI,OAAA,CAAiC,CAAC,SAAS,MAAA,KAAW;AAC1E,MAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,QAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,GAAG,CAAA;AACvB,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,SAAA,EAAY,MAAM,CAAA,kBAAA,EAAqB,OAAO,IAAI,CAAC,CAAA;AAAA,MACtE,GAAG,OAAO,CAAA;AACV,MAAA,IAAA,CAAK,OAAA,CAAQ,IAAI,GAAA,EAAK;AAAA,QACpB,OAAA,EAAS,CAAC,CAAA,KAAM;AACd,UAAA,YAAA,CAAa,KAAK,CAAA;AAClB,UAAA,OAAA,CAAQ,CAAC,CAAA;AAAA,QACX,CAAA;AAAA,QACA;AAAA,OACD,CAAA;AACD,MAAA,KAAK,KAAK,SAAA,CAAU,IAAA,CAAK,OAAO,CAAA,CAAE,KAAA,CAAM,CAAC,CAAA,KAAM;AAC7C,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,GAAG,CAAA;AACvB,QAAA,MAAA,CAAO,CAAC,CAAA;AAAA,MACV,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AACD,IAAA,IAAI,IAAI,KAAA,EAAO,MAAM,QAAA,CAAS,WAAA,CAAY,IAAI,KAAgC,CAAA;AAC9E,IAAA,OAAO,GAAA,CAAI,UAAU,EAAC;AAAA,EACxB;AAAA,EAEA,MAAc,MAAA,CAAO,MAAA,EAAgB,MAAA,GAAyC,IAAA,EAAqB;AACjG,IAAA,MAAM,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,MAAA,EAAQ,MAAA,IAAU,EAAC,EAAG,CAAA;AAAA,EAC5E;AAAA,EAEA,MAAM,OAAA,GAAyB;AAC7B,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,UAAU,OAAA,EAAQ;AAAA,IAC/B,SAAS,CAAA,EAAG;AAKV,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,CAAK,UAAU,KAAA,EAAM;AAAA,MAC7B,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,MAAM,CAAA;AAAA,IACR;AACA,IAAA,IAAI,EAAE,IAAA,CAAK,SAAA,YAAqB,aAAA,CAAA,EAAgB;AAC9C,MAAA,IAAA,CAAK,SAAA,GAAY,IAAA;AACjB,MAAA,KAAK,KAAK,QAAA,EAAS;AAAA,IACrB;AACA,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAQ,MAAM,IAAA,CAAK,GAAA,CAAI,YAAA,EAAc;AAAA,QACzC,eAAA,EAAiB,YAAA;AAAA,QACjB,YAAA,EAAc,EAAE,KAAA,EAAO,EAAE,aAAa,IAAA,EAAK,EAAG,QAAA,EAAU,EAAC,EAAE;AAAA,QAC3D,UAAA,EAAY,EAAE,IAAA,EAAM,gBAAA,EAAkB,SAAS,WAAA;AAAY,OAC5D,CAAA;AACD,MAAA,IAAA,CAAK,YAAA,GAAgB,IAAA,CAAK,YAAA,IAA4C,EAAC;AACvE,MAAA,MAAM,IAAA,CAAK,OAAO,2BAA2B,CAAA;AAC7C,MAAA,IAAA,CAAK,SAAA,GAAY,IAAA;AAAA,IACnB,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,KAAK,KAAA,EAAM;AACjB,MAAA,MAAM,CAAA;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAA,CAAK,SAAA,GAAY,KAAA;AACjB,IAAA,KAAA,MAAW,GAAG,GAAG,CAAA,IAAK,IAAA,CAAK,OAAA,EAAS,GAAA,CAAI,MAAA,CAAO,IAAI,KAAA,CAAM,QAAQ,CAAC,CAAA;AAClE,IAAA,IAAA,CAAK,QAAQ,KAAA,EAAM;AACnB,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,UAAU,KAAA,EAAM;AAAA,IAC7B,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAM,SAAA,GAAqD;AACzD,IAAA,MAAM,GAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,YAAY,CAAA;AACxC,IAAA,IAAA,CAAK,KAAA,GAAS,GAAA,CAAI,KAAA,IAA4C,EAAC;AAC/D,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,aAAA,GAAyD;AAC7D,IAAA,IAAI;AACF,MAAA,MAAM,MAAO,MAAM,IAAA,CAAK,GAAA,CAAI,gBAAA,EAAkB,MAAM,GAAM,CAAA;AAC1D,MAAA,IAAA,CAAK,SAAA,GAAa,GAAA,CAAI,SAAA,IAAgD,EAAC;AAAA,IACzE,CAAA,CAAA,MAAQ;AACN,MAAA,IAAA,CAAK,YAAY,EAAC;AAAA,IACpB;AACA,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACd;AAAA,EAEA,MAAM,QAAA,CAAS,QAAA,EAAkB,UAAA,EAAqC,UAAU,IAAA,EAA2B;AACzG,IAAA,OAAO,IAAA,CAAK,IAAI,YAAA,EAAc,EAAE,MAAM,QAAA,EAAU,SAAA,EAAW,UAAA,EAAW,EAAG,OAAO,CAAA;AAAA,EAClF;AAAA,EAEA,MAAM,IAAA,GAAyB;AAC7B,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,MAAA,EAAQ,IAAI,GAAM,CAAA;AACjC,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,qBAAA,CACJ,QAAA,EACA,UAAA,EACA,UAAU,IAAA,EACQ;AAClB,IAAA,IAAI;AACF,MAAA,IAAI,CAAC,IAAA,CAAK,SAAA,EAAW,MAAM,IAAI,MAAM,eAAe,CAAA;AACpD,MAAA,OAAO,MAAM,IAAA,CAAK,QAAA,CAAS,QAAA,EAAU,YAAY,OAAO,CAAA;AAAA,IAC1D,SAAS,CAAA,EAAG;AACV,MAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,wCAAA,EAA2C,QAAQ,CAAA,gBAAA,CAAA,EAAoB,CAAC,CAAA;AACrF,MAAA,IAAI;AACF,QAAA,MAAM,KAAK,SAAA,EAAU;AACrB,QAAA,OAAO,MAAM,IAAA,CAAK,QAAA,CAAS,QAAA,EAAU,YAAY,OAAO,CAAA;AAAA,MAC1D,SAAS,QAAA,EAAU;AACjB,QAAA,MAAM,IAAI,MAAM,CAAA,kBAAA,EAAqB,QAAQ,IAAI,EAAE,KAAA,EAAO,GAAG,CAAA;AAAA,MAC/D;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,SAAA,GAA2B;AAC/B,IAAA,MAAM,MAAM,IAAA,CAAK,GAAA;AACjB,IAAA,IAAI,UAAkC,EAAC;AACvC,IAAA,IAAI,IAAA,CAAK,qBAAqB,aAAA,EAAe;AAC3C,MAAA,OAAA,GAAU,IAAA,CAAK,UAAU,cAAA,EAAe;AACxC,MAAA,OAAO,QAAQ,cAAc,CAAA;AAC7B,MAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,IACjB,WAAW,IAAA,CAAK,SAAA,YAAqB,YAAA,IAAgB,IAAA,CAAK,qBAAqB,WAAA,EAAa;AAC1F,MAAA,OAAA,GAAU,EAAE,GAAG,IAAA,CAAK,SAAA,CAAU,OAAA,EAAQ;AAAA,IACxC;AACA,IAAA,IAAI;AACF,MAAA,MAAM,KAAK,KAAA,EAAM;AAAA,IACnB,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,IAAA,CAAK,EAAA,GAAK,CAAA;AACV,IAAA,IAAA,CAAK,QAAQ,KAAA,EAAM;AACnB,IAAA,IAAA,CAAK,YAAY,UAAA,CAAU,eAAA,CAAgB,GAAA,EAAK,OAAA,EAAS,KAAK,YAAY,CAAA;AAC1E,IAAA,MAAM,KAAK,OAAA,EAAQ;AACnB,IAAA,MAAM,KAAK,SAAA,EAAU;AAAA,EACvB;AACF,CAAA;AAEO,IAAM,cAAN,MAAkB;AAAA,EACf,OAAA,uBAAc,GAAA,EAAuB;AAAA,EACrC,UAAA,GAAoD,IAAA;AAAA,EAE5D,MAAM,QACJ,IAAA,EACA,GAAA,EACA,UAAyC,IAAA,EACzC,KAAA,GAAuB,IAAA,EACvB,YAAA,GAAe,KAAA,EACA;AACf,IAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,IAAI,CAAA;AACxB,IAAA,MAAM,IAAA,GAAO,EAAE,GAAI,OAAA,IAAW,EAAC,EAAG;AAClC,IAAA,IAAI,OAAO,IAAA,CAAK,aAAA,GAAgB,IAAA,CAAK,aAAA,IAAiB,UAAU,KAAK,CAAA,CAAA;AACrE,IAAA,MAAM,SAAS,IAAI,SAAA,CAAU,KAAK,IAAA,EAAM,EAAE,cAAc,CAAA;AACxD,IAAA,MAAM,OAAO,OAAA,EAAQ;AACrB,IAAA,MAAM,OAAO,SAAA,EAAU;AACvB,IAAA,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,IAAA,EAAM,MAAM,CAAA;AAC7B,IAAA,IAAI,CAAC,KAAK,UAAA,EAAY;AACpB,MAAA,IAAA,CAAK,aAAa,WAAA,CAAY,MAAM,KAAK,IAAA,CAAK,cAAA,IAAkB,GAAM,CAAA;AAAA,IACxE;AAAA,EACF;AAAA,EAEA,MAAc,cAAA,GAAgC;AAC5C,IAAA,KAAA,MAAW,CAAC,IAAA,EAAM,MAAM,CAAA,IAAK,CAAC,GAAG,IAAA,CAAK,OAAA,CAAQ,OAAA,EAAS,CAAA,EAAG;AACxD,MAAA,IAAI,CAAC,OAAO,SAAA,EAAW;AACvB,MAAA,IAAI;AACF,QAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,IAAA,EAAK;AAChC,QAAA,IAAI,CAAC,KAAA,EAAO,MAAM,MAAA,CAAO,SAAA,EAAU;AAAA,MACrC,SAAS,CAAA,EAAG;AACV,QAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,aAAA,EAAgB,IAAI,CAAA,oBAAA,CAAA,EAAwB,CAAC,CAAA;AAC1D,QAAA,IAAI;AACF,UAAA,MAAM,OAAO,SAAA,EAAU;AAAA,QACzB,CAAA,CAAA,MAAQ;AACN,UAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,IAAI,CAAA;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,IAAI,IAAA,EAAyB;AAC3B,IAAA,MAAM,CAAA,GAAI,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA;AAC/B,IAAA,IAAI,CAAC,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,qBAAA,EAAwB,IAAI,CAAA,CAAA,CAAG,CAAA;AACvD,IAAA,OAAO,CAAA;AAAA,EACT;AAAA,EAEA,IAAI,IAAA,EAAuB;AACzB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA;AAAA,EAC9B;AAAA,EAEA,MAAM,WAAW,IAAA,EAA6B;AAC5C,IAAA,MAAM,CAAA,GAAI,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA;AAC/B,IAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,IAAI,CAAA;AACxB,IAAA,IAAI,CAAA,EAAG;AACL,MAAA,IAAI;AACF,QAAA,MAAM,EAAE,KAAA,EAAM;AAAA,MAChB,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,QAAA,GAA0B;AAC9B,IAAA,IAAI,KAAK,UAAA,EAAY;AACnB,MAAA,aAAA,CAAc,KAAK,UAAU,CAAA;AAC7B,MAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAAA,IACpB;AACA,IAAA,KAAA,MAAW,IAAA,IAAQ,CAAC,GAAG,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,CAAA,EAAG,MAAM,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA;AAAA,EACzE;AACF,CAAA;AAEO,IAAM,cAAN,MAAkB;AAAA,EACvB,OAAA,GAAU,IAAI,WAAA,EAAY;AAAA,EAC1B,YAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,WAAA,CAAY,IAAA,GAAmC,EAAC,EAAG;AACjD,IAAA,IAAA,CAAK,YAAA,GAAe,KAAK,YAAA,IAAgB,KAAA;AAAA,EAC3C;AAAA,EAEA,MAAM,SAAA,CACJ,IAAA,EACA,GAAA,EACA,IAAA,GAA2E,EAAC,EAC7D;AACf,IAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,IAAA,EAAM,GAAA,EAAK,IAAA,CAAK,OAAA,IAAW,IAAA,EAAM,IAAA,CAAK,KAAA,IAAS,IAAA,EAAM,IAAA,CAAK,YAAY,CAAA;AAAA,EACnG;AAAA,EAEA,MAAM,QAAA,GAA0B;AAC9B,IAAA,MAAM,IAAA,CAAK,QAAQ,QAAA,EAAS;AAAA,EAC9B;AACF,CAAA;;;ACnpBA,WAAA,EAAA;;;ACDA,IAAM,GAAA,GAAM;AAAA,EACV,MAAM,CAAA,GAAI,IAAA,KAAoB,QAAQ,IAAA,CAAK,kBAAA,EAAoB,GAAG,IAAI,CAAA;AAAA,EACtE,OAAO,CAAA,GAAI,IAAA,KAAoB,QAAQ,KAAA,CAAM,kBAAA,EAAoB,GAAG,IAAI;AAC1E,CAAA;AA0BO,SAAS,SAAA,CAAU,OAAiC,KAAA,EAAyB;AAClF,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACrB,EAAA,IAAI;AACF,IAAA,KAAA,CAAM,QAAQ,KAAK,CAAA;AAAA,EACrB,CAAA,CAAA,MAAQ;AACN,IAAA,GAAA,CAAI,KAAK,qCAAqC,CAAA;AAAA,EAChD;AACF;AAEO,SAAS,SAAA,CAAU,KAAA,EAAiC,GAAA,EAAc,GAAA,EAAoC;AAC3G,EAAA,GAAA,CAAI,KAAA,CAAM,uBAAA,EAAyB,GAAA,EAAK,QAAA,EAAU,GAAG,CAAA;AACrD,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACrB,EAAA,IAAI;AACF,IAAA,KAAA,CAAM,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,GAAA,CAAI,KAAK,qCAAqC,CAAA;AAAA,EAChD;AACF;AAYO,SAAS,YAAA,CAAa,OAAiC,KAAA,EAAsC;AAClG,EAAA,IAAI,CAAC,OAAO,UAAA,EAAY;AACxB,EAAA,IAAI;AACF,IAAA,KAAA,CAAM,WAAW,KAAK,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,GAAA,CAAI,KAAK,wCAAwC,CAAA;AAAA,EACnD;AACF;;;AC2CA,IAAM,QAAA,GAAW,iDAAA;AACjB,IAAM,QAAA,GAAW,sBAAA;AACjB,IAAM,MAAA,GAAS,iCAAA;AACf,IAAM,OAAA,GAAU,oCAAA;AAChB,IAAM,OAAA,GAAU,8DAAA;AAChB,IAAM,aAAA,GAAgB,kBAAA;AACtB,IAAM,oBAAoB,IAAI,MAAA;AAAA,EAC5B,CAAA,KAAA,EAAQ,aAAa,CAAA,wIAAA,EAA2I,aAAa,CAAA,EAAA,CAAA;AAAA,EAC7K;AACF,CAAA;AACA,IAAM,qBAAqB,IAAI,MAAA;AAAA,EAC7B,CAAA,KAAA,EAAQ,aAAa,CAAA,GAAA,EAAM,aAAa,aAAa,aAAa,CAAA,EAAA,CAAA;AAAA,EAClE;AACF,CAAA;AACA,IAAMC,QAAAA,GAAU,+EAAA;AAEhB,SAAS,SAAA,CAAU,IAAY,IAAA,EAAsB;AACnD,EAAA,MAAM,MAAc,EAAC;AACrB,EAAA,EAAA,CAAG,SAAA,GAAY,CAAA;AACf,EAAA,IAAI,CAAA,GAAI,EAAA,CAAG,IAAA,CAAK,IAAI,CAAA;AACpB,EAAA,OAAO,MAAM,IAAA,EAAM;AACjB,IAAA,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA,CAAE,KAAA,EAAO,CAAA,CAAE,QAAQ,CAAA,CAAE,CAAC,CAAA,CAAE,MAAM,CAAC,CAAA;AACzC,IAAA,IAAI,CAAA,CAAE,CAAC,CAAA,CAAE,MAAA,KAAW,GAAG,EAAA,CAAG,SAAA,EAAA;AAC1B,IAAA,CAAA,GAAI,EAAA,CAAG,KAAK,IAAI,CAAA;AAAA,EAClB;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,OAAO,MAAA,EAAyB;AACvC,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,MAAM,GAAA,GAAM,CAAC,GAAG,MAAM,EAAE,OAAA,EAAQ;AAChC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK;AACnC,IAAA,IAAI,CAAA,GAAI,MAAA,CAAO,GAAA,CAAI,CAAC,CAAC,CAAA;AACrB,IAAA,IAAI,CAAA,GAAI,MAAM,CAAA,EAAG;AACf,MAAA,CAAA,IAAK,CAAA;AACL,MAAA,IAAI,CAAA,GAAI,GAAG,CAAA,IAAK,CAAA;AAAA,IAClB;AACA,IAAA,KAAA,IAAS,CAAA;AAAA,EACX;AACA,EAAA,OAAO,QAAQ,EAAA,KAAO,CAAA;AACxB;AAEA,SAAS,iBAAiB,IAAA,EAAsB;AAC9C,EAAA,MAAM,QAAgB,EAAC;AACvB,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,GAAG,KAAK,SAAA,CAAU,OAAA,EAAS,IAAI,CAAA,EAAG;AACnD,IAAA,MAAM,MAAA,GAAS,KAAK,KAAA,CAAM,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,SAAS,EAAE,CAAA;AACzD,IAAA,IAAI,MAAA,CAAO,UAAU,EAAA,IAAM,MAAA,CAAO,UAAU,EAAA,IAAM,MAAA,CAAO,MAAM,CAAA,EAAG;AAChE,MAAA,KAAA,CAAM,IAAA,CAAK,CAAC,KAAA,EAAO,GAAG,CAAC,CAAA;AAAA,IACzB;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,uBAAuB,KAAA,EAAwB;AACtD,EAAA,IAAIA,QAAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,KAAA;AAChC,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,IAAI,CAAA,IAAK,GAAA,IAAO,CAAA,IAAK,GAAA,EAAK,QAAA,GAAW,IAAA;AAAA,SAAA,IAC5B,CAAA,IAAK,GAAA,IAAO,CAAA,IAAK,GAAA,EAAK,QAAA,GAAW,IAAA;AAAA,SAAA,IACjC,CAAA,IAAK,GAAA,IAAO,CAAA,IAAK,GAAA,EAAK,QAAA,GAAW,IAAA;AAAA,EAC5C;AACA,EAAA,OAAO,YAAY,QAAA,IAAY,QAAA;AACjC;AAEA,SAAS,aAAa,IAAA,EAAsB;AAC1C,EAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,iBAAA,EAAmB,IAAI,CAAA;AAC/C,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,GAAG,KAAK,SAAA,CAAU,kBAAA,EAAoB,IAAI,CAAA,EAAG;AAC9D,IAAA,IAAI,KAAA,CAAM,IAAA,CAAK,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAM,KAAA,GAAQ,CAAA,IAAK,CAAA,GAAI,GAAG,CAAA,EAAG;AAClD,IAAA,IAAI,sBAAA,CAAuB,IAAA,CAAK,KAAA,CAAM,KAAA,EAAO,GAAG,CAAC,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,CAAC,KAAA,EAAO,GAAG,CAAC,CAAA;AAAA,EAC7E;AACA,EAAA,OAAO,KAAA;AACT;AAEA,IAAM,OAAA,GAAsC;AAAA,EAC1C,KAAA,EAAO,CAAC,CAAA,KAAM,SAAA,CAAU,UAAU,CAAC,CAAA;AAAA,EACnC,KAAA,EAAO,CAAC,CAAA,KAAM,SAAA,CAAU,UAAU,CAAC,CAAA;AAAA,EACnC,GAAA,EAAK,CAAC,CAAA,KAAM,SAAA,CAAU,QAAQ,CAAC,CAAA;AAAA,EAC/B,WAAA,EAAa,gBAAA;AAAA,EACb,IAAA,EAAM,CAAC,CAAA,KAAM,SAAA,CAAU,SAAS,CAAC,CAAA;AAAA,EACjC,OAAA,EAAS;AACX,CAAA;AAEO,SAAS,aAAA,CAAc,MAAc,IAAA,EAAsB;AAChE,EAAA,MAAM,QAAA,GAAW,QAAQ,IAAI,CAAA;AAC7B,EAAA,IAAI,CAAC,QAAA,EAAU,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,IAAI,CAAA,CAAE,CAAA;AACnE,EAAA,IAAI,CAAC,IAAA,EAAM,OAAO,EAAC;AACnB,EAAA,OAAO,QAAA,CAAS,IAAI,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,CAAC,CAAA,GAAI,CAAA,CAAE,CAAC,CAAC,CAAA;AAClD;AAEO,SAAS,WAAA,CACd,MACA,IAAA,EACS;AACT,EAAA,IAAI,KAAK,OAAA,KAAY,MAAA,IAAU,KAAK,OAAA,KAAY,IAAA,CAAK,OAAO,OAAO,KAAA;AAEnE,EAAA,IAAI,CAAC,IAAA,CAAK,MAAA,CAAO,MAAA,EAAQ,OAAO,IAAA;AAChC,EAAA,IAAI,IAAA,CAAK,UAAA,KAAe,IAAA,EAAM,OAAO,KAAA;AACrC,EAAA,MAAM,IAAA,GAAO,IAAI,GAAA,CAAI,IAAA,CAAK,UAAU,CAAA;AACpC,EAAA,OAAO,CAAC,KAAK,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,IAAA,CAAK,GAAA,CAAI,CAAC,CAAC,CAAA;AAC7C;AAEA,SAAS,YAAA,CAAa,IAAA,EAAqB,IAAA,EAAc,MAAA,EAAiC;AACxF,EAAA,IAAI,IAAA,CAAK,YAAY,IAAA,EAAM;AACzB,IAAA,MAAM,EAAA,GAAK,KAAK,SAAA,EAAU,IAAK,IAAI,MAAA,CAAO,IAAA,CAAK,SAAS,GAAG,CAAA;AAC3D,IAAA,OAAO,SAAA,CAAU,IAAI,IAAI,CAAA;AAAA,EAC3B;AACA,EAAA,IAAI,IAAA,CAAK,aAAa,IAAA,EAAM;AAC1B,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,eAAA,CAAgB,IAAA,CAAK,QAAQ,CAAA;AACnD,IAAA,IAAI,QAAQ,OAAO,CAAC,GAAG,MAAA,CAAO,IAAI,CAAC,CAAA;AACnC,IAAA,OAAO,aAAA,CAAc,IAAA,CAAK,QAAA,EAAU,IAAI,CAAA;AAAA,EAC1C;AACA,EAAA,OAAO,EAAC;AACV;AAEA,IAAM,gBAAA,GAAmB,EAAA;AAEzB,SAAS,SAAA,CAAU,OAAe,SAAA,EAAuD;AACvF,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,GAAI,SAAA,GAAY,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,SAAA,IAAa,EAAE,CAAC,CAAA;AACxF,EAAA,OAAO,cAAc,GAAA,EAAK,KAAK,CAAA,CAAE,KAAA,CAAM,GAAG,gBAAgB,CAAA;AAC5D;AAQO,SAAS,cAAA,CACd,IAAA,EACA,MAAA,EACA,IAAA,EAMyB;AACzB,EAAA,IAAI,CAAC,QAAQ,MAAA,CAAO,OAAA,IAAW,OAAO,CAAC,IAAA,EAAM,EAAE,CAAA;AAC/C,EAAA,MAAM,UAAA,GAAa,KAAK,UAAA,IAAc,IAAA;AACtC,EAAA,MAAM,YAAoD,EAAC;AAC3D,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,MAAM,SAAmB,EAAC;AAE1B,EAAA,KAAA,MAAW,IAAA,IAAQ,OAAO,KAAA,EAAO;AAC/B,IAAA,IAAI,CAAC,YAAY,IAAA,EAAM,EAAE,OAAO,IAAA,CAAK,KAAA,EAAO,UAAA,EAAY,CAAA,EAAG;AAC3D,IAAA,IAAI,IAAA,CAAK,MAAA,KAAW,MAAA,IAAU,CAAC,KAAK,SAAA,EAAW;AAC7C,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,MAAA,EAAS,KAAK,IAAI,CAAA,4GAAA;AAAA,OAEpB;AAAA,IACF;AACA,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,YAAA,CAAa,IAAA,EAAM,IAAA,EAAM,MAAM,CAAA;AAC3C,MAAA,MAAM,YAAoB,EAAC;AAC3B,MAAA,IAAI,OAAA,GAAU,KAAA;AACd,MAAA,KAAA,MAAW,QAAQ,GAAA,EAAK;AACtB,QAAA,MAAM,KAAA,GAAQ,OAAO,CAAC,CAAA;AACtB,QAAA,MAAM,GAAA,GAAM,OAAO,CAAC,CAAA;AACpB,QAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,OAAO,QAAQ,QAAA,EAAU;AACxD,UAAA,OAAA,GAAU,IAAA;AACV,UAAA;AAAA,QACF;AACA,QAAA,IAAI,EAAE,KAAA,IAAS,CAAA,IAAK,QAAQ,GAAA,IAAO,GAAA,IAAO,KAAK,MAAA,CAAA,EAAS;AACtD,UAAA,OAAA,GAAU,IAAA;AACV,UAAA;AAAA,QACF;AACA,QAAA,SAAA,CAAU,IAAA,CAAK,CAAC,KAAA,EAAO,GAAG,CAAC,CAAA;AAAA,MAC7B;AACA,MAAA,IAAI,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,IAAI,CAAA;AAClC,MAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,SAAA,EAAW,SAAA,CAAU,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,EAAG,IAAI,CAAC,CAAA;AAAA,IAC7D,SAAS,GAAA,EAAK;AACZ,MAAA,MAAA,CAAO,IAAA,CAAK,KAAK,IAAI,CAAA;AACrB,MAAA,IAAI,IAAA,CAAK,KAAA,EAAO,SAAA,CAAU,IAAA,CAAK,KAAA,EAAO,GAAA,EAAK,EAAE,KAAA,EAAO,WAAA,EAAa,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,CAAA;AAAA,IACpF;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,UAAU,MAAA,EAAQ;AACrB,IAAA,IAAI,MAAA,CAAO,MAAA,EAAQ,OAAO,CAAC,IAAA,EAAM,EAAE,WAAA,EAAa,EAAC,EAAG,KAAA,EAAO,CAAA,EAAG,YAAA,EAAc,QAAQ,CAAA;AACpF,IAAA,OAAO,CAAC,IAAA,EAAM,EAAE,CAAA;AAAA,EAClB;AAEA,EAAA,SAAA,CAAU,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,EAAE,CAAC,CAAA,GAAI,EAAE,CAAC,CAAA,IAAK,EAAE,CAAC,CAAA,GAAI,EAAE,CAAC,CAAA,IAAK,EAAE,CAAC,CAAA,GAAI,CAAA,CAAE,CAAC,CAAA,CAAE,CAAA;AACnE,EAAA,MAAM,SAAiD,EAAC;AACxD,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,GAAA,EAAK,IAAI,KAAK,SAAA,EAAW;AAC1C,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,MAAA,CAAO,MAAA,GAAS,CAAC,CAAA;AACrC,IAAA,IAAI,IAAA,IAAQ,KAAA,GAAQ,IAAA,CAAK,CAAC,CAAA,EAAG;AAC3B,MAAA,IAAI,MAAM,IAAA,CAAK,CAAC,CAAA,EAAG,IAAA,CAAK,CAAC,CAAA,GAAI,GAAA;AAC7B,MAAA;AAAA,IACF;AACA,IAAA,MAAA,CAAO,IAAA,CAAK,CAAC,KAAA,EAAO,GAAA,EAAK,IAAI,CAAC,CAAA;AAAA,EAChC;AAEA,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,GAAA,EAAK,IAAI,KAAK,MAAA,EAAQ;AACvC,IAAA,GAAA,CAAI,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ,KAAK,CAAC,CAAA;AAClC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,KAAA,EAAO,GAAG,CAAA;AACtC,IAAA,IAAI,KAAK,MAAA,KAAW,MAAA,MAAY,IAAA,CAAK,IAAA,CAAK,sBAAsB,CAAA;AAAA,SAAA,IACvD,IAAA,CAAK,WAAW,MAAA,EAAQ;AAC/B,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,CAAA,EAAI,IAAA,CAAK,IAAA,CAAK,WAAA,EAAa,CAAA,CAAA,EAAI,SAAA,CAAU,QAAA,EAAU,IAAA,CAAK,SAAS,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,IAChF;AACA,IAAA,IAAI,CAAC,MAAM,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,IAAI,CAAA;AACpD,IAAA,MAAA,GAAS,GAAA;AAAA,EACX;AACA,EAAA,GAAA,CAAI,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,MAAM,CAAC,CAAA;AAE3B,EAAA,MAAM,OAAsB,EAAE,WAAA,EAAa,KAAA,EAAO,KAAA,EAAO,OAAO,MAAA,EAAO;AACvE,EAAA,IAAI,MAAA,CAAO,MAAA,EAAQ,IAAA,CAAK,YAAA,GAAe,MAAA;AACvC,EAAA,OAAO,CAAC,GAAA,CAAI,IAAA,CAAK,EAAE,GAAG,IAAI,CAAA;AAC5B;AC9TO,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,sBAAA,GAAyB,GAAA;AAO/B,IAAM,gBAAN,MAAoB;AAAA,EACjB,OAAA,GAAyB,IAAA;AAAA,EACzB,KAAA,GAAuB,IAAA;AAAA,EAE/B,KAAA,GAAc;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,KAAK,GAAA,EAAI;AACxB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,IAAA,GAAa;AACX,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAK,GAAA,EAAI;AACtB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,IAAI,UAAA,GAA4B;AAC9B,IAAA,IAAI,KAAK,OAAA,IAAW,IAAA,IAAQ,IAAA,CAAK,KAAA,IAAS,MAAM,OAAO,IAAA;AACvD,IAAA,OAAO,IAAA,CAAK,QAAQ,IAAA,CAAK,OAAA;AAAA,EAC3B;AACF,CAAA;AAEA,SAAS,SAAS,GAAA,EAAuB;AACvC,EAAA,IAAI,GAAA,IAAO,MAAM,OAAO,GAAA;AACxB,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,EAAA,EAAI,CAAA,KAAO,OAAO,MAAM,QAAA,GAAW,MAAA,CAAO,CAAC,CAAA,GAAI,CAAE,CAAC,CAAA;AAAA,EAC3F,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,IAAA,EAAM,MAAA,CAAO,GAAG,CAAA,EAAE;AAAA,EAC7B;AACF;AAEA,SAAS,eAAe,YAAA,EAA2C;AACjE,EAAA,IAAI,YAAA,IAAgB,IAAA,EAAM,OAAO,CAAC,MAAM,KAAK,CAAA;AAC7C,EAAA,IAAI,UAAA;AACJ,EAAA,IAAI;AACF,IAAA,UAAA,GAAa,IAAA,CAAK,UAAU,YAAY,CAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AACN,IAAA,UAAA,GAAa,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,YAAY,CAAC,CAAA;AAAA,EAClD;AACA,EAAA,IAAI,UAAA,CAAW,UAAU,eAAA,EAAiB;AACxC,IAAA,IAAI;AACF,MAAA,OAAO,CAAC,IAAA,CAAK,KAAA,CAAM,UAAU,GAAG,KAAK,CAAA;AAAA,IACvC,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,CAAC,cAAc,KAAK,CAAA;AAAA,IAC7B;AAAA,EACF;AACA,EAAA,OAAO,CAAC,EAAE,UAAA,EAAY,UAAA,CAAW,KAAA,CAAM,CAAA,EAAG,eAAe,CAAA,EAAG,cAAA,EAAgB,UAAA,CAAW,MAAA,EAAO,EAAG,IAAI,CAAA;AACvG;AAEA,SAAS,aAAa,KAAA,EAA+B;AACnD,EAAA,IAAI,KAAA,IAAS,MAAM,OAAO,IAAA;AAC1B,EAAA,MAAM,OAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AAClE,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,sBAAsB,CAAA;AAC7C;AAEA,eAAsB,WAAA,CACpB,QACA,GAAA,EAee;AACf,EAAA,MAAM,KAAA,GAAQ;AAAA,IACZ,SAAS,GAAA,CAAI,MAAA,IAAU,OAAO,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA,GAAI,IAAA;AAAA,IACnD,WAAW,GAAA,CAAI,QAAA;AAAA,IACf,MAAM,GAAA,CAAI,IAAA;AAAA,IACV,UAAA,EAAY,IAAI,SAAA,IAAa,IAAA;AAAA,IAC7B,UAAU,GAAA,CAAI,OAAA,IAAW,OAAO,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,GAAI,IAAA;AAAA,IACtD,MAAA,EAAQ,IAAI,MAAA,IAAU,IAAA;AAAA,IACtB,UAAA,EAAY,GAAA,CAAI,SAAA,IAAa,EAAC;AAAA,IAC9B,eAAe,GAAA,CAAI,YAAA;AAAA,IACnB,OAAA,EAAS,IAAI,OAAA,IAAW,IAAA;AAAA,IACxB,OAAO,GAAA,CAAI,KAAA,IAAS,OAAO,MAAA,CAAO,GAAA,CAAI,KAAK,CAAA,GAAI,IAAA;AAAA,IAC/C,WAAA,EAAa,IAAI,UAAA,IAAc,IAAA;AAAA,IAC/B,KAAA,EAAO,IAAI,KAAA,IAAS,IAAA;AAAA,IACpB,WAAA,EAAa,IAAI,UAAA,IAAc;AAAA,GACjC;AACA,EAAA,IAAI;AACF,IAAA,YAAA,CAAa,MAAA,CAAO,OAAO,KAAK,CAAA;AAAA,EAClC,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI;AACF,IAAA,MAAM,CAAC,MAAA,EAAQ,SAAS,CAAA,GAAI,cAAA,CAAe,IAAI,YAAY,CAAA;AAC3D,IAAA,MAAM,OAAO,QAAA,CAAS,GAAA,CAAI,aAAa,EAAE,KAAK,EAAC;AAC/C,IAAA,MAAM,OAAO,IAAA,CAAK,KAAA;AAAA,MAChB,CAAA;AAAA;AAAA;AAAA,gFAAA,CAAA;AAAA,MAIA;AAAA,QACET,iBAAAA,EAAW;AAAA,QACX,IAAI,MAAA,IAAU,IAAA;AAAA,QACd,GAAA,CAAI,QAAA;AAAA,QACJ,GAAA,CAAI,IAAA;AAAA,QACJ,IAAI,SAAA,IAAa,IAAA;AAAA,QACjB,IAAI,OAAA,IAAW,IAAA,GAAO,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,GAAI,IAAA;AAAA,QAC5C,IAAI,MAAA,IAAU,KAAA;AAAA,QACd,IAAA,CAAK,UAAU,IAAI,CAAA;AAAA,QACnB,IAAA,CAAK,UAAU,MAAM,CAAA;AAAA,QACrB,SAAA;AAAA,QACA,IAAI,OAAA,IAAW,IAAA;AAAA,QACf,YAAA,CAAa,IAAI,KAAK,CAAA;AAAA,QACtB,IAAI,UAAA,IAAc,IAAA;AAAA,QAClB,IAAI,KAAA,IAAS,CAAA;AAAA,QACb,IAAI,UAAA,IAAc;AAAA;AACpB,KACF;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;;;AHzGA,OAAA,EAAA;;;AI1BA,WAAA,EAAA;AAGA,IAAM,UAAA,GAAa,GAAA;AAEnB,IAAM,0BAAA,uBAAiC,GAAA,CAAI;AAAA,EACzC,YAAA;AAAA,EACA,aAAA;AAAA,EACA,eAAA;AAAA,EACA,oBAAA;AAAA,EACA;AACF,CAAC,CAAA;AAOD,IAAM,eAAA,uBAAsB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAKzD,IAAM,uCAAuB,IAAI,GAAA,CAAI,CAAC,eAAA,EAAiB,qBAAA,EAAuB,QAAQ,CAAC,CAAA;AAEvF,SAAS,cAAc,KAAA,EAAuB;AAC5C,EAAA,OAAO,kBAAA,CAAmB,KAAK,CAAA,CAAE,OAAA;AAAA,IAC/B,UAAA;AAAA,IACA,CAAC,CAAA,KAAM,CAAA,CAAA,EAAI,CAAA,CAAE,UAAA,CAAW,CAAC,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,WAAA,EAAa,CAAA;AAAA,GACvD;AACF;AAEA,SAAS,OAAA,CACP,QACA,IAAA,EACyB;AACzB,EAAA,IAAI,CAAC,MAAA,EAAQ,OAAO,EAAC;AACrB,EAAA,MAAM,UAAA,GAAc,MAAA,CAAO,UAAA,IAAsD,EAAC;AAClF,EAAA,MAAM,QAAA,GAAY,MAAA,CAAO,QAAA,IAAsC,EAAC;AAChE,EAAA,MAAM,SAAkC,EAAC;AACzC,EAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA,EAAG;AACzC,IAAA,MAAM,KAAA,GAAQ,KAAK,GAAG,CAAA;AACtB,IAAA,IAAI,QAAA,CAAS,SAAS,GAAG,CAAA,KAAM,UAAU,MAAA,IAAa,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,EAAA,CAAA,EAAK;AACrF,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gCAAA,EAAmC,GAAG,CAAA,CAAE,CAAA;AAAA,IAC1D;AACA,IAAA,IAAI,UAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAAM,MAAA,CAAO,GAAG,CAAA,GAAI,KAAA;AAAA,EAC3D;AACA,EAAA,OAAO,MAAA;AACT;AAkBA,SAAS,SAAA,CAAU,KAAa,MAAA,EAAyC;AACvE,EAAA,MAAM,GAAA,GAAM,IAAI,eAAA,EAAgB;AAChC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AAC3C,IAAA,IAAI,CAAA,KAAM,MAAA,IAAa,CAAA,KAAM,IAAA,EAAM;AACnC,IAAA,GAAA,CAAI,GAAA,CAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACtB;AACA,EAAA,MAAM,CAAA,GAAI,IAAI,QAAA,EAAS;AACvB,EAAA,IAAI,CAAC,GAAG,OAAO,GAAA;AACf,EAAA,OAAO,GAAA,CAAI,QAAA,CAAS,GAAG,CAAA,GAAI,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA,GAAK,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA;AACxD;AAsBA,eAAe,WAAW,IAAA,EAA+D;AACvF,EAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,OAAO,EAAE,IAAA,EAAM,MAAM,IAAA,CAAK,IAAA,EAAK,EAAG,SAAA,EAAW,KAAA,EAAM;AACnE,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,CAAK,SAAA,EAAU;AACnC,EAAA,MAAM,SAAmB,EAAC;AAC1B,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,IAAI,SAAA,GAAY,KAAA;AAChB,EAAA,WAAS;AACP,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,OAAO,IAAA,EAAK;AAC1C,IAAA,IAAI,IAAA,EAAM;AACV,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,KAAK,CAAC,CAAA;AAC9B,MAAA,IAAA,IAAQ,KAAA,CAAM,UAAA;AAAA,IAChB;AACA,IAAA,IAAI,OAAO,kBAAA,EAAoB;AAC7B,MAAA,SAAA,GAAY,IAAA;AACZ,MAAA,MAAM,OAAO,MAAA,EAAO;AACpB,MAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA;AAClC,EAAA,OAAO;AAAA,IACL,IAAA,EAAA,CAAO,YAAY,KAAA,CAAM,QAAA,CAAS,GAAG,kBAAkB,CAAA,GAAI,KAAA,EAAO,QAAA,CAAS,MAAM,CAAA;AAAA,IACjF;AAAA,GACF;AACF;AAEA,eAAe,eAAe,IAAA,EAOL;AACvB,EAAA,IAAI,MAAM,IAAA,CAAK,GAAA;AACf,EAAA,IAAI,KAAK,MAAA,EAAQ,GAAA,GAAM,SAAA,CAAU,GAAA,EAAK,KAAK,MAAM,CAAA;AACjD,EAAA,MAAM,UAAkC,EAAE,GAAI,IAAA,CAAK,OAAA,IAAW,EAAC,EAAG;AAKlE,EAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,WAAA,EAAY,KAAM,iBAAiB,CAAA,EAAG;AAC5E,IAAA,OAAA,CAAQ,iBAAiB,CAAA,GAAI,UAAA;AAAA,EAC/B;AACA,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI,IAAA,CAAK,SAAS,MAAA,EAAW;AAC3B,IAAA,OAAA,CAAQ,cAAc,CAAA,GAAI,OAAA,CAAQ,cAAc,CAAA,IAAK,OAAA,CAAQ,cAAc,CAAA,IAAK,kBAAA;AAChF,IAAA,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA;AAAA,EACjC,CAAA,MAAA,IAAW,IAAA,CAAK,OAAA,KAAY,MAAA,EAAW;AACrC,IAAA,IAAA,GAAO,IAAA,CAAK,OAAA;AAAA,EACd;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,IAC5B,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,OAAA;AAAA,IACA,IAAA;AAAA;AAAA;AAAA,IAGA,QAAA,EAAU,QAAA;AAAA,IACV,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,UAAU;AAAA,GACvC,CAAA;AACD,EAAA,MAAM,cAAsC,EAAC;AAC7C,EAAA,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,CAAC,CAAA,EAAG,CAAA,KAAM;AAC7B,IAAA,WAAA,CAAY,CAAC,CAAA,GAAI,CAAA;AAAA,EACnB,CAAC,CAAA;AACD,EAAA,MAAM,EAAE,IAAA,EAAM,SAAA,EAAU,GAAI,MAAM,WAAW,IAAI,CAAA;AACjD,EAAA,OAAO;AAAA,IACL,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,OAAA,EAAS,WAAA;AAAA,IACT,SAAA;AAAA,IACA,MAAM,IAAA,GAAO;AAKX,MAAA,OAAO,KAAK,KAAA,CAAM,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,EAAE,CAAC,CAAA;AAAA,IAC1C,CAAA;AAAA,IACA,MAAM,IAAA,GAAO;AACX,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,GACF;AACF;AAaA,SAAS,OAAA,CAAQ,IAAA,EAAoB,MAAA,EAAgB,QAAA,EAAgC;AACnF,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,IAAA,CAAK,GAAG,CAAA;AAChC,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,QAAA,EAAU,OAAO,CAAA;AACxC,EAAA,IAAI,SAAS,IAAA,CAAK,MAAA;AAClB,EAAA,IAAA,CAAK,WAAW,GAAA,IAAO,MAAA,KAAW,GAAA,KAAQ,MAAA,KAAW,QAAQ,MAAA,GAAS,KAAA;AAAA,OAAA,IAC7D,MAAA,KAAW,GAAA,IAAO,MAAA,KAAW,MAAA,EAAQ,MAAA,GAAS,KAAA;AAEvD,EAAA,IAAI,UAAU,EAAE,GAAI,IAAA,CAAK,OAAA,IAAW,EAAC,EAAG;AACxC,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,MAAA,CAAO,MAAA,EAAQ;AACpC,IAAA,OAAA,GAAU,MAAA,CAAO,WAAA;AAAA,MACf,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,CAAE,OAAO,CAAC,CAAC,CAAC,CAAA,KAAM,CAAC,oBAAA,CAAqB,GAAA,CAAI,CAAA,CAAE,WAAA,EAAa,CAAC;AAAA,KACpF;AAAA,EACF;AACA,EAAA,MAAM,MAAoB,EAAE,MAAA,EAAQ,KAAK,MAAA,CAAO,QAAA,IAAY,OAAA,EAAQ;AACpE,EAAA,IAAI,MAAA,KAAW,KAAK,MAAA,EAAQ;AAC1B,IAAA,IAAI,IAAA,CAAK,IAAA,KAAS,MAAA,EAAW,GAAA,CAAI,OAAO,IAAA,CAAK,IAAA;AAC7C,IAAA,IAAI,IAAA,CAAK,OAAA,KAAY,MAAA,EAAW,GAAA,CAAI,UAAU,IAAA,CAAK,OAAA;AAAA,EACrD;AACA,EAAA,OAAO,GAAA;AACT;AAWA,eAAsB,WAAA,CACpB,MAAA,EACA,IAAA,EACA,IAAA,GAAmE,EAAC,EAClC;AAClC,EAAA,MAAM,SAAS,MAAA,CAAO,MAAA,CAAO,MAAA,IAAU,KAAK,EAAE,WAAA,EAAY;AAC1D,EAAA,IAAI,MAAM,MAAA,CAAO,GAAA;AACjB,EAAA,MAAM,UAAU,EAAE,GAAK,MAAA,CAAO,OAAA,IAAkD,EAAC,EAAG;AACpF,EAAA,MAAM,eAAe,EAAE,GAAK,MAAA,CAAO,UAAA,IAAsD,EAAC,EAAG;AAC7F,EAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AACpB,EAAA,MAAM,WAAA,GAAc,QAAQ,EAAC;AAE7B,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,MAAA,CAAO,kBAAA,EAA2D,WAAW,CAAA;AACzG,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,MAAA,CAAO,aAAA,EAAsD,WAAW,CAAA;AAEnG,EAAA,IAAI,GAAA,EAAK,QAAA,CAAS,IAAI,CAAA,EAAG;AACvB,IAAA,KAAA,MAAW,MAAA,IAAU,CAAC,WAAA,EAAa,UAAU,CAAA,EAAG;AAC9C,MAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,EAAG;AACrC,QAAA,MAAM,WAAA,GAAc,KAAK,GAAG,CAAA,EAAA,CAAA;AAC5B,QAAA,IAAI,GAAA,CAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AAC7B,UAAA,GAAA,GAAM,GAAA,CAAI,WAAW,WAAA,EAAa,aAAA,CAAc,OAAO,MAAA,CAAO,GAAG,CAAC,CAAC,CAAC,CAAA;AACpE,UAAA,OAAO,OAAO,GAAG,CAAA;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAI,WAAA,GAA4B;AAAA,IAC9B,MAAA;AAAA,IACA,KAAK,GAAA,IAAO,EAAA;AAAA,IACZ;AAAA,GACF;AAEA,EAAA,IAAI,MAAA,KAAW,KAAA,IAAS,MAAA,KAAW,QAAA,EAAU;AAC3C,IAAA,MAAM,QAAQ,EAAE,GAAG,cAAc,GAAG,WAAA,EAAa,GAAG,UAAA,EAAW;AAC/D,IAAA,IAAI,OAAO,IAAA,CAAK,KAAK,CAAA,CAAE,MAAA,cAAoB,MAAA,GAAS,KAAA;AAAA,EACtD,CAAA,MAAO;AACL,IAAA,MAAM,KAAA,GAAQ,EAAE,GAAG,YAAA,EAAc,GAAG,WAAA,EAAY;AAChD,IAAA,IAAI,OAAO,IAAA,CAAK,KAAK,CAAA,CAAE,MAAA,cAAoB,MAAA,GAAS,KAAA;AAEpD,IAAA,IAAI,WAAoC,EAAC;AACzC,IAAA,IAAI,IAAA,KAAS,MAAA,IAAa,IAAA,KAAS,IAAA,EAAM;AACvC,MAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACpD,QAAA,QAAA,GAAW,EAAE,GAAI,IAAA,EAAiC;AAAA,MACpD,CAAA,MAAA,IAAW,OAAO,IAAA,KAAS,QAAA,EAAU;AACnC,QAAA,IAAI;AACF,UAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC9B,UAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAClE,YAAA,QAAA,GAAW,MAAA;AAAA,UACb;AAAA,QACF,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AACA,IAAA,MAAA,CAAO,MAAA,CAAO,UAAU,UAAU,CAAA;AAClC,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA,CAAE,MAAA,EAAQ;AAChC,MAAA,WAAA,CAAY,IAAA,GAAO,QAAA;AAAA,IACrB,CAAA,MAAA,IAAW,IAAA,KAAS,MAAA,IAAa,IAAA,KAAS,IAAA,EAAM;AAC9C,MAAA,MAAMU,eAAc,OAAA,CAAQ,cAAc,CAAA,IAAK,OAAA,CAAQ,cAAc,CAAA,IAAK,EAAA;AAC1E,MAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,CAACA,YAAAA,CAAY,QAAA,CAAS,kBAAkB,CAAA,EAAG;AACzE,QAAA,WAAA,CAAY,OAAA,GAAU,IAAA;AAAA,MACxB;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAS,IAAA,CAAK,MAAA;AACpB,EAAA,MAAM,YAAA,GAAe,KAAK,YAAA,IAAgB,KAAA;AAC1C,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,WAAS;AACP,IAAA,MAAM,mBAAA,CAAoB,WAAA,CAAY,GAAA,EAAK,EAAE,cAAc,CAAA;AAC3D,IAAA,IAAA,GAAO,MAAA,GAAS,MAAM,MAAA,CAAO,OAAA,CAAQ,WAAW,CAAA,GAAI,MAAM,eAAe,WAAW,CAAA;AACpF,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,QAAA,IAAY,KAAK,OAAA,CAAQ,QAAA;AACvD,IAAA,IAAI,CAAC,eAAA,CAAgB,GAAA,CAAI,KAAK,MAAM,CAAA,IAAK,CAAC,QAAA,EAAU;AACpD,IAAA,IAAI,QAAQ,aAAA,EAAe;AACzB,MAAA,MAAM,IAAI,iBAAA,CAAkB,CAAA,8BAAA,EAAiC,aAAa,CAAA,cAAA,EAAiB,GAAG,CAAA,CAAE,CAAA;AAAA,IAClG;AACA,IAAA,IAAA,IAAQ,CAAA;AACR,IAAA,WAAA,GAAc,OAAA,CAAQ,WAAA,EAAa,IAAA,CAAK,MAAA,EAAQ,QAAQ,CAAA;AAAA,EAC1D;AAEA,EAAA,MAAM,WAAA,GAAc,KAAK,OAAA,CAAQ,cAAc,KAAK,IAAA,CAAK,OAAA,CAAQ,cAAc,CAAA,IAAK,EAAA;AACpF,EAAA,IAAI,IAAA,GAAO,EAAA;AACX,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,KAAK,IAAA,EAAK;AAAA,EACzB,CAAA,CAAA,MAAQ;AACN,IAAA,IAAA,GAAO,EAAA;AAAA,EACT;AACA,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,IAAA,CAAK,IAAA,EAAM,MAAM,CAAA;AAGtC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,KAAc,IAAA,IAAQ,MAAM,UAAA,GAAa,kBAAA;AAChE,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI,SAAA,EAAW;AAGb,IAAA,IAAA,GAAO,MAAM,QAAA,CAAS,CAAA,EAAG,kBAAkB,CAAA,CAAE,SAAS,MAAM,CAAA;AAAA,EAC9D,CAAA,MAAO;AACL,IAAA,IAAI;AACF,MAAA,IAAA,GAAO,YAAY,QAAA,CAAS,kBAAkB,IAAI,MAAM,IAAA,CAAK,MAAK,GAAI,IAAA;AAAA,IACxE,CAAA,CAAA,MAAQ;AACN,MAAA,IAAA,GAAO,IAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,MAAM,cAAsC,EAAC;AAC7C,EAAA,KAAA,MAAW,CAAC,GAAG,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAA,EAAG;AACjD,IAAA,IAAI,CAAC,2BAA2B,GAAA,CAAI,CAAA,CAAE,aAAa,CAAA,EAAG,WAAA,CAAY,CAAC,CAAA,GAAI,CAAA;AAAA,EACzE;AAEA,EAAA,MAAM,MAAA,GAAkC;AAAA,IACtC,aAAa,IAAA,CAAK,MAAA;AAAA,IAClB,OAAA,EAAS,WAAA;AAAA,IACT;AAAA,GACF;AACA,EAAA,IAAI,SAAA,SAAkB,SAAA,GAAY,IAAA;AAClC,EAAA,OAAO,MAAA;AACT;;;AClUA,SAAS,iBAAiB,MAAA,EAA0D;AAClF,EAAA,MAAM,aAAsC,EAAC;AAC7C,EAAA,MAAM,WAAqB,EAAC;AAC5B,EAAA,KAAA,MAAW,GAAA,IAAO,CAAC,eAAA,EAAiB,oBAAoB,CAAA,EAAG;AACzD,IAAA,MAAM,GAAA,GAAO,MAAA,CAAO,GAAG,CAAA,IAA6C,EAAC;AACrE,IAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,QAAA,EAAU;AACrC,IAAA,MAAA,CAAO,MAAA,CAAO,UAAA,EAAa,GAAA,CAAI,UAAA,IAAsD,EAAE,CAAA;AACvF,IAAA,MAAM,MAAM,GAAA,CAAI,QAAA;AAChB,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG,QAAA,CAAS,KAAK,GAAG,GAAA,CAAI,GAAA,CAAI,MAAM,CAAC,CAAA;AAAA,EAC1D;AACA,EAAA,OAAO,EAAE,IAAA,EAAM,QAAA,EAAU,UAAA,EAAY,QAAA,EAAS;AAChD;AAEA,SAAS,eAAe,EAAA,EAAiC;AACvD,EAAA,MAAM,MAAA,GAAS,EAAA,CAAG,MAAA,IAAU,EAAC;AAC7B,EAAA,MAAM,UAAA,GAAc,MAAA,CAAO,gBAAA,IAAmE,EAAC;AAC/F,EAAA,IAAI,CAAC,WAAW,MAAA,EAAQ;AACtB,IAAA,OAAO;AAAA,MACL;AAAA,QACE,EAAA,EAAI,GAAG,EAAA,IAAM,IAAA;AAAA,QACb,IAAA,EAAM,KAAA;AAAA,QACN,QAAA,EAAU,CAAA,IAAA,EAAO,EAAA,CAAG,IAAI,CAAA,CAAA;AAAA,QACxB,aAAa,EAAA,CAAG,IAAA;AAAA,QAChB,WAAA,EAAa,GAAG,WAAA,IAAe,UAAA;AAAA,QAC/B,YAAA,EAAc,EAAE,IAAA,EAAM,QAAA,EAAU,YAAY,EAAC,EAAG,QAAA,EAAU,EAAC,EAAE;AAAA,QAC7D,kBAAkB,EAAA,CAAG,gBAAA;AAAA,QACrB,gBAAgB,EAAA,CAAG,cAAA;AAAA,QACnB,UAAU,EAAA,CAAG,QAAA;AAAA,QACb,KAAK,EAAA,CAAG,GAAA;AAAA,QACR,GAAA,EAAK;AAAA;AACP,KACF;AAAA,EACF;AACA,EAAA,MAAM,QAAyB,EAAC;AAChC,EAAA,KAAA,MAAW,MAAM,UAAA,EAAY;AAC3B,IAAA,IAAI,EAAA,CAAG,YAAY,KAAA,EAAO;AAC1B,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,EAAA,CAAG,IAAA,IAAQ,SAAS,CAAA;AACxC,IAAA,MAAM,MAAA,GAAU,EAAA,CAAG,WAAA,IAChB,EAAA,CAAG,YAAA,IAAwD;AAAA,MAC1D,IAAA,EAAM,QAAA;AAAA,MACN,YAAY,EAAC;AAAA,MACb,UAAU;AAAC,KACb;AACF,IAAA,MAAM,eAAe,EAAA,CAAG,iBAAA;AACxB,IAAA,MAAM,qBAAqB,EAAA,CAAG,eAAA;AAC9B,IAAA,KAAA,CAAM,IAAA,CAAK;AAAA,MACT,EAAA,EAAI,GAAG,EAAA,IAAM,IAAA;AAAA,MACb,IAAA,EAAM,KAAA;AAAA,MACN,QAAA,EAAU,OAAO,IAAI,CAAA,CAAA;AAAA,MACrB,WAAA,EAAa,IAAA;AAAA,MACb,aAAa,MAAA,CAAO,EAAA,CAAG,WAAA,IAAe,CAAA,UAAA,EAAa,IAAI,CAAA,CAAE,CAAA;AAAA,MACzD,YAAA,EAAc,MAAA;AAAA,MACd,kBAAkB,YAAA,KAAiB,MAAA,GAAY,OAAA,CAAQ,YAAY,IAAI,EAAA,CAAG,gBAAA;AAAA,MAC1E,cAAA,EAAgB,sBAAsB,EAAA,CAAG,cAAA;AAAA,MACzC,UAAU,EAAA,CAAG,QAAA;AAAA,MACb,KAAK,EAAA,CAAG,GAAA;AAAA,MACR,GAAA,EAAK,EAAE,GAAG,MAAA,EAAQ,WAAW,IAAA;AAAK,KACnC,CAAA;AAAA,EACH;AACA,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,oBAAoB,EAAA,EAAiC;AACnE,EAAA,IAAI,EAAA,CAAG,SAAS,MAAA,EAAQ;AACtB,IAAA,OAAO;AAAA,MACL;AAAA,QACE,EAAA,EAAI,GAAG,EAAA,IAAM,IAAA;AAAA,QACb,IAAA,EAAM,MAAA;AAAA,QACN,QAAA,EAAU,CAAA,KAAA,EAAQ,EAAA,CAAG,IAAI,CAAA,CAAA;AAAA,QACzB,aAAa,EAAA,CAAG,IAAA;AAAA,QAChB,WAAA,EAAa,EAAA,CAAG,WAAA,IAAe,CAAA,sBAAA,EAAyB,GAAG,IAAI,CAAA,CAAA;AAAA,QAC/D,YAAA,EAAc,gBAAA,CAAiB,EAAA,CAAG,MAAA,IAAU,EAAE,CAAA;AAAA,QAC9C,kBAAkB,EAAA,CAAG,gBAAA;AAAA,QACrB,gBAAgB,EAAA,CAAG,cAAA;AAAA,QACnB,UAAU,EAAA,CAAG,QAAA;AAAA,QACb,KAAK,EAAA,CAAG,GAAA;AAAA,QACR,GAAA,EAAK,EAAA,CAAG,MAAA,IAAU;AAAC;AACrB,KACF;AAAA,EACF;AACA,EAAA,IAAI,EAAA,CAAG,SAAS,IAAA,EAAM;AACpB,IAAA,OAAO;AAAA,MACL;AAAA,QACE,EAAA,EAAI,GAAG,EAAA,IAAM,IAAA;AAAA,QACb,IAAA,EAAM,IAAA;AAAA,QACN,QAAA,EAAU,CAAA,GAAA,EAAM,EAAA,CAAG,IAAI,CAAA,CAAA;AAAA,QACvB,aAAa,EAAA,CAAG,IAAA;AAAA,QAChB,WAAA,EAAa,EAAA,CAAG,WAAA,IAAe,CAAA,gBAAA,EAAmB,GAAG,IAAI,CAAA,CAAA;AAAA,QACzD,YAAA,EAAc;AAAA,UACZ,IAAA,EAAM,QAAA;AAAA,UACN,UAAA,EAAY;AAAA,YACV,KAAA,EAAO;AAAA,cACL,IAAA,EAAM,QAAA;AAAA,cACN,WAAA,EAAa;AAAA;AACf,WACF;AAAA,UACA,QAAA,EAAU,CAAC,OAAO;AAAA,SACpB;AAAA,QACA,kBAAkB,EAAA,CAAG,gBAAA;AAAA,QACrB,gBAAgB,EAAA,CAAG,cAAA;AAAA,QACnB,UAAU,EAAA,CAAG,QAAA;AAAA,QACb,KAAK,EAAA,CAAG,GAAA;AAAA,QACR,GAAA,EAAK,EAAA,CAAG,MAAA,IAAU;AAAC;AACrB,KACF;AAAA,EACF;AACA,EAAA,IAAI,EAAA,CAAG,IAAA,KAAS,KAAA,EAAO,OAAO,eAAe,EAAE,CAAA;AAC/C,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,CAAA,0CAAA,EAA6C,IAAA,CAAK,SAAA,CAAU,EAAA,CAAG,IAAI,CAAC,CAAA,4FAAA;AAAA,GAEtE;AACF;AAEO,SAAS,QAAA,CAAS,OAAwB,QAAA,EAA6C;AAC5F,EAAA,OAAO,MAAM,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,QAAQ,CAAA;AAClD;;;ALpGO,IAAM,gBAAA,GAAmB,GAAA;AACzB,IAAM,eAAA,GAAkB,GAAA;AAE/B,IAAM,iBAAA,uBAAwB,GAAA,CAAI;AAAA,EAChC,MAAA;AAAA,EACA,MAAA;AAAA,EACA,aAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,KAAA;AAAA,EACA,kBAAA;AAAA,EACA,mBAAA;AAAA,EACA,gBAAA;AAAA,EACA,iBAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAC,CAAA;AAgBM,SAAS,mBAAmB,MAAA,EAA6B;AAC9D,EAAA,OAAO,OAAA,CAAS,MAAA,EAAQ,MAAA,EAAyD,kBAAkB,CAAA;AACrG;AAEO,SAAS,WAAA,CAAY,IAAmB,UAAA,EAA4D;AACzG,EAAA,OAAO,UAAA,CAAW,EAAA,CAAG,GAAA,EAAK,UAAU,CAAA;AACtC;AAEO,SAAS,oBACd,IAAA,EACyB;AACzB,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,CAAC,GAAG,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQ,IAAA,IAAQ,EAAE,CAAA,EAAG;AAC/C,IAAA,IAAI,CAAC,OAAO,CAAC,CAAA,CAAE,WAAW,GAAG,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EAC3C;AACA,EAAA,OAAO,GAAA;AACT;AAEO,SAAS,WAAA,CACd,MAAA,EACA,IAAA,GAAgD,EAAC,EAC7B;AACpB,EAAA,MAAM,QAAA,GAAW,KAAK,QAAA,IAAY,gBAAA;AAClC,EAAA,MAAM,OAAA,GAAU,KAAK,OAAA,IAAW,eAAA;AAChC,EAAA,IAAI,SAAA,GAAY,KAAA;AAChB,EAAA,IAAI,MAAA,GAAS,MAAA;AAEb,EAAA,IACE,MAAA,IACA,OAAO,MAAA,KAAW,QAAA,IAClB,KAAA,CAAM,OAAA,CAAS,MAAA,CAA8B,IAAI,CAAA,IAChD,MAAA,CAA+B,IAAA,CAAK,MAAA,GAAS,OAAA,EAC9C;AACA,IAAA,MAAM,OAAQ,MAAA,CAA+B,IAAA;AAC7C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,OAAO,CAAA;AAClC,IAAA,MAAA,GAAS;AAAA,MACP,GAAI,MAAA;AAAA,MACJ,IAAA,EAAM,IAAA;AAAA,MACN,eAAA,EAAiB,EAAE,aAAA,EAAe,IAAA,CAAK,QAAQ,YAAA,EAAc,IAAA,CAAK,MAAA,GAAS,IAAA,CAAK,MAAA;AAAO,KACzF;AACA,IAAA,SAAA,GAAY,IAAA;AAAA,EACd;AAEA,EAAA,IAAI,UAAA;AACJ,EAAA,IAAI;AACF,IAAA,UAAA,GAAa,IAAA,CAAK,UAAU,MAAM,CAAA;AAAA,EACpC,CAAA,CAAA,MAAQ;AACN,IAAA,UAAA,GAAa,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,MAAM,CAAC,CAAA;AAAA,EAC5C;AACA,EAAA,IAAI,UAAA,CAAW,SAAS,QAAA,EAAU;AAChC,IAAA,OAAO;AAAA,MACL;AAAA,QACE,UAAA,EAAY,UAAA,CAAW,KAAA,CAAM,CAAA,EAAG,QAAQ,CAAA;AAAA,QACxC,gBAAgB,UAAA,CAAW,MAAA;AAAA,QAC3B,KAAA,EAAO;AAAA,OACT;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,CAAC,QAAQ,SAAS,CAAA;AAC3B;AAEO,SAAS,gBAAA,CACd,MAAA,EACA,MAAA,EACA,IAAA,EAKoC;AACpC,EAAA,IAAI,OAAO,OAAA,EAAQ,SAAU,CAAC,MAAA,EAAQ,EAAE,CAAA;AACxC,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,MAAM,SAAmB,EAAC;AAC1B,EAAA,IAAI,KAAA,GAAQ,CAAA;AAEZ,EAAA,MAAM,IAAA,GAAO,CAAC,IAAA,KAA2B;AACvC,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,MAAA,MAAM,CAAC,IAAA,EAAMC,KAAI,CAAA,GAAI,cAAA,CAAe,MAAM,MAAA,EAAQ;AAAA,QAChD,KAAA,EAAO,QAAA;AAAA,QACP,UAAA,EAAY,KAAK,UAAA,IAAc,IAAA;AAAA,QAC/B,WAAW,IAAA,CAAK,SAAA;AAAA,QAChB,OAAO,IAAA,CAAK;AAAA,OACb,CAAA;AACD,MAAA,IAAIA,KAAAA,IAAQ,MAAA,CAAO,IAAA,CAAKA,KAAI,EAAE,MAAA,EAAQ;AACpC,QAAA,KAAA,IAASA,MAAK,KAAA,IAAS,CAAA;AACvB,QAAA,KAAA,MAAW,IAAA,IAAQA,KAAAA,CAAK,WAAA,IAAe,EAAC,EAAG;AACzC,UAAA,IAAI,CAAC,KAAA,CAAM,QAAA,CAAS,IAAI,CAAA,EAAG,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,QAC5C;AACA,QAAA,KAAA,MAAW,IAAA,IAAQA,KAAAA,CAAK,YAAA,IAAgB,EAAC,EAAG;AAC1C,UAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,EAAG,MAAA,CAAO,KAAK,IAAI,CAAA;AAAA,QAC9C;AAAA,MACF;AACA,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,IAAI,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AACpC,MAAA,IAAI,MAAM,OAAA,CAAQ,IAAI,GAAG,OAAO,IAAA,CAAK,IAAI,IAAI,CAAA;AAC7C,MAAA,MAAM,MAA+B,EAAC;AACtC,MAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,OAAA,CAAQ,IAA+B,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,GAAI,IAAA,CAAK,CAAC,CAAA;AACrF,MAAA,OAAO,GAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,QAAA,GAAW,KAAK,MAAM,CAAA;AAC5B,EAAA,IAAI,CAAC,KAAA,CAAM,MAAA,IAAU,CAAC,MAAA,CAAO,QAAQ,OAAO,CAAC,QAAA,EAAU,EAAE,CAAA;AACzD,EAAA,MAAM,IAAA,GAAgC,EAAE,WAAA,EAAa,KAAA,EAAO,OAAO,KAAA,EAAM;AACzE,EAAA,IAAI,MAAA,CAAO,MAAA,EAAQ,IAAA,CAAK,YAAA,GAAe,MAAA;AACvC,EAAA,OAAO,CAAC,UAAU,IAAI,CAAA;AACxB;AAiBA,SAAS,UAAU,MAAA,EAA4B;AAG7C,EAAA,MAAM,GAAA,GAAM,YAAA,CAAa,MAAA,CAAO,MAAM,CAAA;AACtC,EAAA,IAAI,GAAA,CAAI,WAAW,EAAA,EAAI;AACrB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uCAAA,EAA0C,GAAA,CAAI,MAAM,CAAA,eAAA,CAAiB,CAAA;AAAA,EACvF;AACA,EAAA,OAAO,GAAA;AACT;AAOA,SAAS,gBAAA,CAAiB,KAA8B,MAAA,EAA6C;AACnG,EAAA,IAAI,CAAC,GAAA,CAAI,gBAAA,EAAkB,OAAO,EAAC;AACnC,EAAA,OAAO,YAAY,MAAA,CAAO,GAAA,CAAI,gBAAgB,CAAA,EAAG,SAAA,CAAU,MAAM,CAAC,CAAA;AACpE;AAOA,SAAS,eAAA,CACP,GAAA,EACA,MAAA,EACA,MAAA,EACY;AACZ,EAAA,MAAA,KAAW,gBAAA,CAAiB,KAAK,MAAM,CAAA;AACvC,EAAA,OAAO,IAAI,UAAA,CAAW;AAAA,IACpB,EAAA,EAAI,MAAA,CAAO,GAAA,CAAI,EAAE,CAAA;AAAA,IACjB,IAAA,EAAM,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA;AAAA,IACrB,MAAM,GAAA,CAAI,IAAA;AAAA,IACV,WAAA,EAAa,MAAA,CAAO,GAAA,CAAI,WAAA,IAAe,EAAE,CAAA;AAAA,IACzC,MAAA;AAAA,IACA,QAAA,EAAW,IAAI,SAAA,IAA+B,IAAA;AAAA,IAC9C,GAAA,EAAK,IAAI,GAAA,IAAO,IAAA,GAAO,CAAC,GAAI,GAAA,CAAI,GAAgB,CAAA,GAAI,IAAA;AAAA,IACpD,gBAAA,EAAkB,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA;AAAA,IAC/C,cAAA,EAAiB,GAAA,CAAI,eAAA,IAA+C,EAAC;AAAA,IACrE,OAAA,EAAS,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA;AAAA,IAC5B,QAAA,EAAW,GAAA,CAAI,SAAA,IAAyC;AAAC,GAC1D,CAAA;AACH;AAwBA,SAAS,sBAAA,CAAuB,KAA8B,MAAA,EAAuC;AACnG,EAAA,IAAI,CAAC,IAAI,gBAAA,EAAkB,OAAO,gBAAgB,GAAA,EAAK,MAAA,EAAQ,EAAE,CAAA;AACjE,EAAA,MAAM,GAAA,GAAM,UAAU,MAAM,CAAA;AAC5B,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,WAAA,CAAY,MAAA,CAAO,GAAA,CAAI,gBAAgB,GAAG,GAAG,CAAA;AAAA,EACxD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,CAAA,KAAA,EAAQ,OAAO,GAAA,CAAI,EAAE,CAAC,CAAA,EAAA,EAAK,MAAA,CAAO,GAAA,CAAI,IAAI,CAAC,CAAA,6HAAA;AAAA,KAE7C;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,eAAA,CAAgB,GAAA,EAAK,MAAA,EAAQ,MAAM,CAAA;AAC5C;AAEA,eAAe,uBAAA,CACb,QACA,QAAA,EAC0B;AAC1B,EAAA,MAAM,SAAoB,EAAC;AAC3B,EAAA,IAAI,GAAA,GAAM,CAAA,wDAAA,CAAA;AACV,EAAA,IAAI,YAAY,IAAA,EAAM;AACpB,IAAA,MAAA,CAAO,KAAK,QAAQ,CAAA;AACpB,IAAA,GAAA,IAAO,CAAA,mBAAA,CAAA;AAAA,EACT;AACA,EAAA,MAAM,SAAS,MAAM,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,KAAK,MAAM,CAAA;AAClD,EAAA,MAAM,aAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,GAAA,IAAO,OAAO,IAAA,EAAM;AAC7B,IAAA,MAAM,EAAA,GAAK,sBAAA,CAAuB,GAAA,EAAK,MAAM,CAAA;AAC7C,IAAA,IAAI,OAAO,IAAA,EAAM;AACjB,IAAA,UAAA,CAAW,IAAA,CAAK,GAAG,mBAAA,CAAoB,EAAE,CAAC,CAAA;AAAA,EAC5C;AACA,EAAA,OAAO,UAAA;AACT;AAEA,eAAe,WAAA,CAAY,QAAoB,QAAA,EAAmD;AAChG,EAAA,MAAM,SAAA,GAAY,MAAM,uBAAA,CAAwB,MAAA,EAAQ,QAAQ,CAAA;AAChE,EAAA,MAAM,YAAY,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,cAAA,IAAkB,EAAE,CAAA;AAC3D,EAAA,OAAO,CAAC,GAAG,SAAA,EAAW,GAAG,SAAS,CAAA;AACpC;AAWA,eAAsB,YAAA,CAAa,QAAoB,EAAA,EAAiC;AACtF,EAAA,mBAAA,CAAoB,EAAE,CAAA;AACtB,EAAA,MAAM,MAAA,GAAS,EAAA,CAAG,MAAA,IAAU,EAAC;AAI7B,EAAA,IAAI,gBAAA,CAAiB,MAAM,CAAA,EAAG;AAC5B,IAAA,MAAM,IAAI,mBAAA;AAAA,MACR,CAAA,oBAAA,EAAuB,IAAA,CAAK,SAAA,CAAU,iBAAiB,CAAC,CAAA,sGAAA;AAAA,KAE1D;AAAA,EACF;AACA,EAAA,MAAM,eAAA,GAAkB,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,MAAA,GAAS,WAAA,CAAY,MAAA,EAAQ,SAAA,CAAU,MAAM,CAAC,CAAA,GAAI,IAAA;AAC9F,EAAA,MAAM,KAAKX,iBAAAA,EAAW;AACtB,EAAA,MAAM,OAAO,IAAA,CAAK,KAAA;AAAA,IAChB,CAAA;AAAA;AAAA;AAAA,wEAAA,CAAA;AAAA,IAIA;AAAA,MACE,EAAA;AAAA,MACA,EAAA,CAAG,IAAA;AAAA,MACH,EAAA,CAAG,IAAA;AAAA,MACH,GAAG,WAAA,IAAe,EAAA;AAAA,MAClB,EAAA,CAAG,QAAA;AAAA,MACH,EAAA,CAAG,GAAA;AAAA,MACH,eAAA;AAAA,MACA,EAAA,CAAG,gBAAA;AAAA,MACH,IAAA,CAAK,SAAA,CAAU,EAAA,CAAG,cAAA,IAAkB,EAAE,CAAA;AAAA,MACtC,EAAA,CAAG,OAAA;AAAA,MACH,IAAA,CAAK,SAAA,CAAU,EAAA,CAAG,QAAA,IAAY,EAAE;AAAA;AAClC,GACF;AACA,EAAA,OAAO,EAAA;AACT;AAEA,eAAsB,UAAA,CACpB,MAAA,EACA,EAAA,EACA,IAAA,EACqB;AACrB,EAAA,MAAM,EAAE,UAAA,GAAa,IAAA,EAAM,GAAG,QAAO,GAAI,IAAA;AACzC,EAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,gDAAA,CAAA,EAAoD,CAAC,EAAE,CAAC,CAAA;AACjG,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,IAAA,CAAK,CAAC,CAAA;AAC3B,EAAA,IAAI,CAAC,GAAA,IAAO,CAAC,UAAA,CAAW,IAAI,GAAA,IAAO,IAAA,GAAO,CAAC,GAAG,GAAA,CAAI,GAAG,CAAA,GAAI,IAAA,EAAM,UAAU,CAAA,EAAG;AAC1E,IAAA,MAAM,IAAI,iBAAA,CAAkB,CAAA,gBAAA,EAAmB,EAAE,CAAA,CAAE,CAAA;AAAA,EACrD;AACA,EAAA,MAAM,OAAiB,EAAC;AACxB,EAAA,MAAM,SAAoB,EAAC;AAC3B,EAAA,IAAI,CAAA,GAAI,CAAA;AACR,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AACjD,IAAA,IAAI,QAAQ,QAAA,EAAU;AAQpB,MAAA,IAAI,MAAA,GAAS,KAAA;AACb,MAAA,IAAI,MAAA,IAAU,gBAAA,CAAiB,MAAM,CAAA,EAAG;AAItC,QAAA,IAAI,MAAA,CAAO,OAAO,MAAA,EAAQ,MAAM,KAAK,MAAA,CAAO,IAAA,KAAS,IAAI,IAAA,EAAM;AAC7D,UAAA,MAAM,IAAI,mBAAA;AAAA,YACR;AAAA,WACF;AAAA,QACF;AAKA,QAAA,IAAI,OAAO,WAAA,KAAgB,KAAA,IAAS,gBAAA,CAAiB,MAAA,CAAO,IAAI,CAAA,EAAG;AACjE,UAAA,MAAM,IAAI,mBAAA;AAAA,YACR,CAAA,+DAAA,EACK,IAAA,CAAK,SAAA,CAAU,iBAAiB,CAAC,CAAA,0CAAA;AAAA,WACxC;AAAA,QACF;AACA,QAAA,IAAI,CAAC,IAAI,gBAAA,EAAkB;AACzB,UAAA,MAAM,IAAI,mBAAA;AAAA,YACR,CAAA,gBAAA,EAAmB,IAAA,CAAK,SAAA,CAAU,iBAAiB,CAAC,CAAA,6EAAA;AAAA,WAEtD;AAAA,QACF;AAIA,QAAA,MAAMY,IAAAA,GAAM,UAAU,MAAM,CAAA;AAC5B,QAAA,IAAI,MAAA;AACJ,QAAA,IAAI;AACF,UAAA,MAAA,GAAS,WAAA,CAAY,MAAA,CAAO,GAAA,CAAI,gBAAgB,GAAGA,IAAG,CAAA;AAAA,QACxD,SAAS,GAAA,EAAK;AACZ,UAAA,MAAM,IAAI,mBAAA;AAAA,YACR,CAAA,gHAAA,EAC0C,IAAA,CAAK,SAAA,CAAU,iBAAiB,CAAC,CAAA,OAAA,CAAA;AAAA,YAC3E,EAAE,OAAO,GAAA;AAAI,WACf;AAAA,QACF;AACA,QAAA,MAAA,GAAS,aAAA,CAAc,QAAQ,MAAM,CAAA;AAAA,MACvC;AACA,MAAA,IAAA,CAAK,IAAA,CAAK,CAAA,oBAAA,EAAuB,CAAA,EAAG,CAAA,CAAE,CAAA;AAEtC,MAAA,MAAA,CAAO,IAAA,CAAK,MAAA,IAAU,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,MAAA,GAAS,WAAA,CAAY,MAAA,EAAQ,SAAA,CAAU,MAAM,CAAC,IAAI,IAAI,CAAA;AAAA,IAClG,CAAA,MAAA,IAAW,iBAAA,CAAkB,GAAA,CAAI,GAAG,CAAA,EAAG;AACrC,MAAA,MAAM,GAAA,GACJ,GAAA,KAAQ,UAAA,GACJ,WAAA,GACA,GAAA,KAAQ,kBAAA,GACN,mBAAA,GACA,GAAA,KAAQ,gBAAA,GACN,iBAAA,GACA,GAAA,KAAQ,UAAA,GACN,WAAA,GACA,GAAA;AACZ,MAAA,IAAA,CAAK,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,IAAA,EAAO,GAAG,CAAA,CAAE,CAAA;AAC5B,MAAA,MAAA,CAAO,IAAA,CAAK,GAAA,KAAQ,iBAAA,IAAqB,GAAA,KAAQ,WAAA,GAAc,IAAA,CAAK,SAAA,CAAU,KAAA,IAAS,EAAE,CAAA,GAAI,KAAK,CAAA;AAAA,IACpG;AAAA,EACF;AACA,EAAA,IAAA,CAAK,KAAK,CAAA,kBAAA,CAAoB,CAAA;AAC9B,EAAA,MAAA,CAAO,KAAK,EAAE,CAAA;AACd,EAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,IAAA,CAAK,KAAA;AAAA,IAChC,mCAAmC,IAAA,CAAK,IAAA,CAAK,IAAI,CAAC,gBAAgB,CAAC,CAAA,YAAA,CAAA;AAAA,IACnE;AAAA,GACF;AAIA,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA;AAC3B,EAAA,OAAO,sBAAA,CAAuB,MAAM,MAAM,CAAA,IAAK,gBAAgB,IAAA,EAAM,MAAA,EAAQ,EAAE,CAAA;AACjF;AAEA,eAAsB,UAAA,CACpB,MAAA,EACA,EAAA,EACA,IAAA,GAAmD,EAAC,EACrC;AACf,EAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,gDAAA,CAAA,EAAoD,CAAC,EAAE,CAAC,CAAA;AACjG,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,IAAA,CAAK,CAAC,CAAA;AAC3B,EAAA,IAAI,CAAC,GAAA,IAAO,CAAC,UAAA,CAAW,GAAA,CAAI,OAAO,IAAA,GAAO,CAAC,GAAG,GAAA,CAAI,GAAG,CAAA,GAAI,IAAA,EAAM,IAAA,CAAK,UAAA,IAAc,IAAI,CAAA,EAAG;AACvF,IAAA,MAAM,IAAI,iBAAA,CAAkB,CAAA,gBAAA,EAAmB,EAAE,CAAA,CAAE,CAAA;AAAA,EACrD;AACA,EAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAM,CAAA,8CAAA,CAAA,EAAkD,CAAC,EAAE,CAAC,CAAA;AAChF;AA8BA,IAAM,UAAA,GAAa;AAAA,EACjB,uBAAA;AAAA,EACA,QAAA;AAAA,EACA,mBAAA;AAAA,EACA,eAAA;AAAA,EACA,UAAA;AAAA,EACA,cAAA;AAAA,EACA,WAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA;AACF,CAAA;AACA,IAAM,iBAAA,GAAoB;AAAA,EACxB,oBAAA;AAAA,EACA,mBAAA;AAAA,EACA,2BAAA;AAAA,EACA,uBAAA;AAAA,EACA,kBAAA;AAAA,EACA,wBAAA;AAAA,EACA,sCAAA;AAAA,EACA,aAAA;AAAA,EACA,kBAAA;AAAA,EACA,cAAA;AAAA,EACA,cAAA;AAAA,EACA;AACF,CAAA;AACA,IAAM,aAAA,GAAgB,CAAC,WAAA,EAAa,SAAA,EAAW,SAAS,CAAA;AACxD,IAAM,mBAAA,GAAsB;AAAA,EAC1B,gBAAA;AAAA,EACA,SAAA;AAAA,EACA,kBAAA;AAAA,EACA,cAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,eAAA;AAAA,EACA;AACF,CAAA;AAEA,SAAS,mBAAmB,GAAA,EAAsB;AAChD,EAAA,IAAI,GAAA,YAAe,YAAA,IAAgB,GAAA,CAAI,IAAA,KAAS,gBAAgB,OAAO,SAAA;AACvE,EAAA,MAAM,IAAA,GAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,IAAA,GAAO,EAAA;AAC/C,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,SAAS,CAAA,EAAG,OAAO,SAAA;AACrC,EAAA,IAAI,CAAC,cAAA,EAAgB,iBAAA,EAAmB,cAAA,EAAgB,WAAW,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,IAAA,CAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG;AAClG,IAAA,IAAI,IAAA,KAAS,WAAA,IAAe,CAAC,MAAA,CAAO,GAAG,EAAE,WAAA,EAAY,CAAE,QAAA,CAAS,OAAO,CAAA,EAAG,CAE1E,MAAA,IAAW,IAAA,KAAS,WAAA,EAAa,OAAO,aAAA;AAAA,EAC1C;AACA,EAAA,IAAI,CAAC,MAAA,EAAQ,YAAA,EAAc,WAAA,EAAa,cAAc,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,IAAA,CAAK,QAAA,CAAS,CAAC,CAAC,GAAG,OAAO,aAAA;AAC9F,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,GAAG,CAAA,CAAE,WAAA,EAAY;AACrC,EAAA,IAAI,aAAA,CAAc,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,OAAO,SAAA;AACxD,EAAA,IAAI,UAAA,CAAW,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,OAAO,aAAA;AACrD,EAAA,IAAI,iBAAA,CAAkB,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,OAAO,aAAA;AAC5D,EAAA,IAAI,mBAAA,CAAoB,KAAK,CAAC,CAAA,KAAM,KAAK,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,OAAO,eAAA;AAC9D,EAAA,OAAO,OAAA;AACT;AAEA,SAAS,YAAA,CAAa,KAAc,IAAA,EAAuC;AACzE,EAAA,MAAM,QAAA,GAAW,mBAAmB,GAAG,CAAA;AACvC,EAAA,OAAA,CAAQ,KAAK,CAAA,eAAA,EAAkB,IAAI,CAAA,SAAA,CAAA,EAAa,GAAA,EAAK,MAAM,QAAQ,CAAA;AACnE,EAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,QAAA,EAAS;AACtC;AAEA,eAAsB,QAAA,CAAS,QAAoB,EAAA,EAAkD;AACnG,EAAA,MAAM,OAAO,EAAA,CAAG,IAAA;AAChB,EAAA,MAAM,MAAA,GAAS,EAAA,CAAG,MAAA,IAAU,EAAC;AAM7B,EAAA,IAAI,gBAAA,CAAiB,MAAM,CAAA,EAAG;AAC5B,IAAA,MAAM,IAAI,mBAAA;AAAA,MACR,CAAA,oBAAA,EAAuB,IAAA,CAAK,SAAA,CAAU,iBAAiB,CAAC,CAAA,gGAAA;AAAA,KAE1D;AAAA,EACF;AACA,EAAA,IAAI,SAAS,MAAA,EAAQ;AACnB,IAAA,MAAM,MAAM,MAAA,CAAO,GAAA;AACnB,IAAA,IAAI,CAAC,GAAA,EAAK,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAO,2BAAA,EAA4B;AAKjE,IAAA,IAAI;AACF,MAAA,MAAM,oBAAoB,GAAA,EAAK,EAAE,cAAc,kBAAA,CAAmB,MAAM,GAAG,CAAA;AAAA,IAC7E,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,eAAe,YAAA,EAAc;AAC/B,QAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,6BAAA,EAAgC,GAAA,CAAI,OAAO,CAAA,CAAE,CAAA;AAC1D,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,eAAA,EAAgB;AAAA,MAC7C;AACA,MAAA,MAAM,GAAA;AAAA,IACR;AACA,IAAA,MAAM,MAAA,GAAS,QAAQ,eAAA,IAAmB,IAAA;AAC1C,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAA,GACT,MAAM,MAAA,CAAO,OAAA,CAAQ;AAAA,QACnB,MAAA,EAAQ,MAAA;AAAA,QACR,GAAA;AAAA,QACA,OAAA,EAAU,MAAA,CAAO,OAAA,IAAsC;AAAC,OACzD,CAAA,GACD,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,QACf,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAU,MAAA,CAAO,OAAA,IAAsC,EAAC;AAAA;AAAA;AAAA,QAGxD,QAAA,EAAU,QAAA;AAAA,QACV,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAM;AAAA,OACnC,CAAA;AACL,MAAA,OAAO,EAAE,EAAA,EAAI,IAAA,CAAK,SAAS,GAAA,EAAK,WAAA,EAAa,KAAK,MAAA,EAAO;AAAA,IAC3D,SAAS,GAAA,EAAK;AACZ,MAAA,OAAO,YAAA,CAAa,KAAK,MAAM,CAAA;AAAA,IACjC;AAAA,EACF;AACA,EAAA,IAAI,SAAS,IAAA,EAAM;AACjB,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,cAAA,EAAAC,eAAAA,EAAe,GAAI,MAAM,OAAA,CAAA,OAAA,EAAA,CAAA,IAAA,CAAA,OAAA,OAAA,EAAA,EAAA,UAAA,CAAA,CAAA;AACjC,MAAA,MAAM,MAAA,GAAS,MAAMA,eAAAA,CAAe,MAAM,CAAA;AAC1C,MAAA,OAAO,EAAE,IAAI,OAAA,CAAQ,MAAA,CAAO,WAAW,MAAA,CAAO,EAAE,CAAA,EAAG,GAAG,MAAA,EAAO;AAAA,IAC/D,SAAS,GAAA,EAAK;AACZ,MAAA,OAAO,YAAA,CAAa,KAAK,IAAI,CAAA;AAAA,IAC/B;AAAA,EACF;AACA,EAAA,IAAI,SAAS,KAAA,EAAO;AAClB,IAAA,MAAM,MAAM,MAAA,CAAO,GAAA;AACnB,IAAA,IAAI,CAAC,GAAA,EAAK,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAO,0BAAA,EAA2B;AAChE,IAAA,MAAM,KAAA,GAAS,MAAA,CAAO,WAAA,IAAe,MAAA,CAAO,UAAU,MAAA,CAAO,YAAA;AAM7D,IAAA,MAAM,GAAA,GAAM,IAAI,WAAA,CAAY,EAAE,cAAc,kBAAA,CAAmB,MAAM,GAAG,CAAA;AACxE,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,CAAI,UAAU,EAAA,CAAG,IAAA,EAAM,KAAK,EAAE,KAAA,EAAO,KAAA,IAAS,IAAA,EAAM,CAAA;AAC1D,MAAA,MAAM,MAAA,GAAS,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,GAAG,IAAI,CAAA;AACtC,MAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,KAAA,EAAO,MAAA,CAAO,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAA,EAAE;AAAA,IAC5D,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,eAAe,YAAA,EAAc;AAC/B,QAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,4BAAA,EAA+B,GAAA,CAAI,OAAO,CAAA,CAAE,CAAA;AACzD,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,eAAA,EAAgB;AAAA,MAC7C;AACA,MAAA,OAAO,YAAA,CAAa,KAAK,KAAK,CAAA;AAAA,IAChC,CAAA,SAAE;AACA,MAAA,MAAM,IAAI,QAAA,EAAS;AAAA,IACrB;AAAA,EACF;AACA,EAAA,OAAO,EAAE,IAAI,KAAA,EAAO,KAAA,EAAO,mCAAmC,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA,CAAA,EAAG;AACvF;AAeA,eAAe,qBACb,MAAA,EACA,QAAA,EACA,IAAA,EACA,QAAA,EACA,YACA,aAAA,EACwB;AACxB,EAAA,MAAM,SAAA,uBAAgB,IAAA,EAAK;AAC3B,EAAA,MAAM,MAAA,GAAoB,CAAC,QAAQ,CAAA;AACnC,EAAA,IAAI,QAAA,GAAW,wBAAA;AACf,EAAA,IAAI,kBAAkB,IAAA,EAAM;AAC1B,IAAA,MAAA,CAAO,KAAK,aAAa,CAAA;AACzB,IAAA,QAAA,GAAW,CAAA,kBAAA,EAAqB,OAAO,MAAM,CAAA,CAAA;AAAA,EAC/C;AACA,EAAA,MAAM,IAAA,GAAO,kBAAA,CAAmB,UAAA,EAAY,MAAA,CAAO,SAAS,CAAC,CAAA;AAC7D,EAAA,MAAA,CAAO,IAAA,CAAK,GAAG,IAAA,CAAK,MAAM,CAAA;AAC1B,EAAA,MAAM,UAAA,GAAa,MAAM,MAAA,CAAO,IAAA,CAAK,KAAA;AAAA,IACnC,CAAA;AAAA,sDAAA,EACoD,QAAQ,CAAA,KAAA,EAAQ,IAAA,CAAK,GAAG,CAAA,CAAA;AAAA,IAC5E;AAAA,GACF;AACA,EAAA,KAAA,MAAW,GAAA,IAAO,WAAW,IAAA,EAAM;AACjC,IAAA,IAAA,CAAK,GAAA,CAAI,SAAA,IAAa,IAAA,OAAW,QAAA,IAAY,IAAA,CAAA,EAAO;AACpD,IAAA,MAAM,MAAA,GAAS,GAAA,CAAI,gBAAA,IAAoB,EAAC;AACxC,IAAA,IAAI,KAAK,SAAA,CAAU,MAAM,MAAM,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG;AACrD,IAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,CAAK,KAAA;AAAA,MAC/B,CAAA;AAAA;AAAA;AAAA,mBAAA,CAAA;AAAA,MAIA,CAAC,SAAA,EAAW,GAAA,CAAI,EAAE;AAAA,KACpB;AACA,IAAA,IAAI,OAAO,QAAA,KAAa,CAAA,EAAG,OAAO,MAAA,CAAO,IAAI,EAAE,CAAA;AAAA,EACjD;AACA,EAAA,OAAO,IAAA;AACT;AAWA,eAAe,YACb,EAAA,EACA,MAAA,EACA,IAAA,EACA,IAAA,GAAmC,EAAC,EAClB;AAClB,EAAA,MAAM,MAAM,MAAA,CAAO,GAAA;AACnB,EAAA,IAAI,CAAC,KAAK,MAAM,IAAI,kBAAkB,CAAA,SAAA,EAAY,EAAA,CAAG,QAAQ,CAAA,qBAAA,CAAuB,CAAA;AACpF,EAAA,MAAM,UAAU,EAAE,GAAK,MAAA,CAAO,OAAA,IAAsC,EAAC,EAAG;AACxE,EAAA,MAAM,KAAA,GAAS,MAAA,CAAO,WAAA,IAAe,MAAA,CAAO,UAAU,MAAA,CAAO,YAAA;AAC7D,EAAA,MAAM,SAAS,MAAA,CAAO,OAAA;AACtB,EAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,KAAK,CAAA,CAAA;AAAA,OAAA,IACzC,MAAA,EAAQ,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,MAAM,CAAA,CAAA;AACzD,EAAA,MAAM,WAAW,MAAA,CAAO,EAAA,CAAG,GAAA,EAAK,SAAA,IAAa,GAAG,WAAW,CAAA;AAC3D,EAAA,MAAM,GAAA,GAAM,IAAI,WAAA,CAAY,EAAE,cAAc,IAAA,CAAK,YAAA,IAAgB,OAAO,CAAA;AACxE,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,CAAI,SAAA,CAAU,EAAA,CAAG,QAAA,EAAU,KAAK,EAAE,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,MAAA,GAAS,OAAA,GAAU,MAAM,CAAA;AAC/F,IAAA,MAAM,MAAA,GAAS,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,GAAG,QAAQ,CAAA;AAC1C,IAAA,OAAO,MAAM,MAAA,CAAO,qBAAA,CAAsB,QAAA,EAAU,IAAI,CAAA;AAAA,EAC1D,CAAA,SAAE;AACA,IAAA,MAAM,IAAI,QAAA,EAAS;AAAA,EACrB;AACF;AAEA,eAAe,QAAA,CACb,MAAA,EACA,EAAA,EACA,MAAA,EACA,IAAA,EACkB;AAClB,EAAA,IAAI,EAAA,CAAG,SAAS,MAAA,EAAQ;AACtB,IAAA,OAAO,WAAA,CAAY,QAAQ,IAAA,EAAM;AAAA,MAC/B,MAAA,EAAQ,OAAO,eAAA,IAAmB,IAAA;AAAA,MAClC,YAAA,EAAc,mBAAmB,MAAM;AAAA,KACxC,CAAA;AAAA,EACH;AACA,EAAA,IAAI,EAAA,CAAG,SAAS,IAAA,EAAM;AACpB,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,IAAA,CAAK,KAAA,IAAS,EAAE,CAAA;AACrC,IAAA,IAAI,MAAM,IAAA,EAAK,CAAE,aAAY,CAAE,UAAA,CAAW,WAAW,CAAA,EAAG;AACtD,MAAA,MAAM,MAAA,GAAS,MACZ,KAAA,CAAM,KAAA,CAAM,QAAQ,GAAG,CAAA,GAAI,CAAC,CAAA,CAC5B,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,MAAM,CAAA,CACnB,OAAO,OAAO,CAAA;AACjB,MAAA,MAAM,aAAa,MAAM,aAAA,CAAc,QAAQ,MAAA,CAAO,MAAA,GAAS,SAAS,IAAI,CAAA;AAC5E,MAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,MAAA,EAAQ,UAAA,EAAW;AAAA,IAC7C;AACA,IAAA,MAAM,MAAA,GAAS,MAAM,SAAA,CAAU,MAAA,EAAQ,KAAK,CAAA;AAC5C,IAAA,IAAI,UAAU,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,YAAY,KAAA,EAAO;AACpE,MAAA,MAAM,IAAI,iBAAA,CAAkB,MAAA,CAAO,MAAA,CAAO,KAAA,IAAS,uBAAuB,CAAC,CAAA;AAAA,IAC7E;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,EAAA,CAAG,SAAS,KAAA,EAAO;AACrB,IAAA,OAAO,WAAA,CAAY,IAAI,MAAA,EAAQ,IAAA,EAAM,EAAE,YAAA,EAAc,kBAAA,CAAmB,MAAM,CAAA,EAAG,CAAA;AAAA,EACnF;AACA,EAAA,IAAI,EAAA,CAAG,SAAS,UAAA,EAAY;AAC1B,IAAA,MAAM,EAAA,GAAK,GAAG,GAAA,EAAK,QAAA;AACnB,IAAA,IAAI,CAAC,IAAI,MAAM,IAAI,kBAAkB,CAAA,cAAA,EAAiB,EAAA,CAAG,QAAQ,CAAA,gBAAA,CAAkB,CAAA;AACnF,IAAA,OAAO,MAAM,EAAA,CAAG,GAAG,SAAA,CAAU,EAAA,EAAI,IAAI,CAAC,CAAA;AAAA,EACxC;AACA,EAAA,MAAM,IAAI,kBAAkB,CAAA,uBAAA,EAA0B,IAAA,CAAK,UAAU,EAAA,CAAG,IAAI,CAAC,CAAA,CAAE,CAAA;AACjF;AAEA,SAAS,SAAA,CAAU,IAAkC,IAAA,EAA0C;AAC7F,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,SAAA,CAAU,QAAA,CAAS,KAAK,EAAE,CAAA;AAC/C,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,aAAa,CAAA;AACrC,EAAA,MAAM,KAAA,GAAA,CAAS,QAAQ,CAAC,CAAA,IAAK,IAC1B,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,IAAA,EAAK,CAAE,KAAA,CAAM,MAAM,CAAA,CAAE,CAAC,GAAG,IAAA,EAAM,CAAA,CAC5C,MAAA,CAAO,OAAO,CAAA;AACjB,EAAA,IAAI,CAAC,KAAA,CAAM,MAAA,EAAQ,OAAO,MAAA,CAAO,OAAO,IAAI,CAAA;AAC5C,EAAA,OAAO,MAAM,GAAA,CAAI,CAAC,CAAA,KAAM,IAAA,CAAK,CAAE,CAAC,CAAA;AAClC;AAEA,eAAe,eAAA,CAAgB,QAAoB,MAAA,EAAkD;AACnG,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,+DAAA,CAAA,EAAmE;AAAA,IACxG;AAAA,GACD,CAAA;AACD,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA;AACzB,EAAA,IAAI,CAAC,GAAA,EAAK,gBAAA,EAAkB,OAAO,EAAC;AACpC,EAAA,OAAO,YAAY,MAAA,CAAO,GAAA,CAAI,gBAAgB,CAAA,EAAG,SAAA,CAAU,MAAM,CAAC,CAAA;AACpE;AAEA,IAAM,cAAA,uBAAqB,GAAA,EAAY;AAEvC,SAAS,qBAAqB,QAAA,EAAwB;AACpD,EAAA,IAAI,cAAA,CAAe,GAAA,CAAI,QAAQ,CAAA,EAAG;AAClC,EAAA,cAAA,CAAe,IAAI,QAAQ,CAAA;AAC3B,EAAA,OAAA,CAAQ,WAAA;AAAA,IACN,CAAA,YAAA,EAAe,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC,CAAA,8TAAA,CAAA;AAAA,IAKvC,EAAE,IAAA,EAAM,oBAAA,EAAsB,IAAA,EAAM,2BAAA;AAA4B,GAClE;AACF;AAEA,eAAsB,YACpB,MAAA,EACA,QAAA,EACA,IAAA,EACA,IAAA,GAcI,EAAC,EAC6B;AAClC,EAAA,MAAM,WAAA,GAAc,QAAQ,EAAC;AAC7B,EAAA,MAAM,aAAA,GAAgB,qBAAA,CAAsB,IAAA,CAAK,aAAa,CAAA;AAC9D,EAAA,MAAM,EAAA,GAAK,SAAS,MAAM,WAAA,CAAY,QAAQ,IAAA,CAAK,QAAA,IAAY,IAAI,CAAA,EAAG,QAAQ,CAAA;AAC9E,EAAA,IAAI,CAAC,EAAA,EAAI,MAAM,IAAI,iBAAA,CAAkB,CAAA,gBAAA,EAAmB,QAAQ,CAAA,CAAE,CAAA;AAClE,EAAA,IAAI,CAAC,WAAA,CAAY,EAAA,EAAI,IAAA,CAAK,UAAA,IAAc,IAAI,CAAA,EAAG;AAC7C,IAAA,MAAM,IAAI,iBAAA,CAAkB,CAAA,gBAAA,EAAmB,QAAQ,CAAA,CAAE,CAAA;AAAA,EAC3D;AAEA,EAAA,MAAM,UAAA,GAAa,oBAAoB,WAAW,CAAA;AAClD,EAAA,IAAI,UAAA,GAA4B,IAAA;AAChC,EAAA,IAAI,qBAAA,CAAsB,EAAA,EAAI,UAAU,CAAA,EAAG;AACzC,IAAA,IAAI,aAAA,KAAkB,IAAA,EAAM,oBAAA,CAAqB,QAAQ,CAAA;AACzD,IAAA,UAAA,GAAa,MAAM,oBAAA;AAAA,MACjB,MAAA;AAAA,MACA,EAAA,CAAG,QAAA;AAAA,MACH,UAAA;AAAA,MACA,KAAK,QAAA,IAAY,IAAA;AAAA,MACjB,KAAK,UAAA,IAAc,IAAA;AAAA,MACnB;AAAA,KACF;AACA,IAAA,IAAI,cAAc,IAAA,EAAM;AACtB,MAAA,MAAM,WAAA,GAAc;AAAA,QAClB,UAAU,EAAA,CAAG,QAAA;AAAA,QACb,IAAA,EAAM,UAAA;AAAA,QACN,QAAA,EAAU,KAAK,QAAA,IAAY,IAAA;AAAA,QAC3B,UAAA,EAAY,KAAK,UAAA,IAAc,IAAA;AAAA,QAC/B,MAAA,EAAQ,EAAA,CAAG,cAAA,IAAkB;AAAC,OAChC;AACA,MAAA,MAAM,MAAA,GACJ,aAAA,KAAkB,IAAA,GACd,MAAM,cAAc,MAAA,EAAQ,WAAW,CAAA,GACvC,MAAM,oBAAoB,MAAA,EAAQ,EAAE,GAAG,WAAA,EAAa,eAAe,CAAA;AACzE,MAAA,MAAM,SAAS,EAAA,CAAG,gBAAA,GACd,2BACA,CAAA,+BAAA,EAAkC,EAAA,CAAG,gBAAgB,SAAS,CAAA,CAAA;AAClE,MAAA,OAAO;AAAA,QACL,iBAAA,EAAmB;AAAA,UACjB,WAAA,EAAa,MAAA,CAAO,MAAA,CAAO,EAAE,CAAA;AAAA,UAC7B,WAAW,EAAA,CAAG,QAAA;AAAA,UACd,IAAA,EAAM,UAAA;AAAA,UACN,MAAA;AAAA,UACA,YAAY,MAAA,CAAO,SAAA,GAAY,MAAA,CAAO,SAAA,CAAU,aAAY,GAAI;AAAA;AAClE,OACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAI,SAAkC,EAAC;AACvC,EAAA,IAAI,EAAA,CAAG,IAAA,KAAS,UAAA,IAAc,EAAA,CAAG,MAAM,IAAA,EAAM;AAC3C,IAAA,MAAA,GAAS,MAAM,eAAA,CAAgB,MAAA,EAAQ,EAAA,CAAG,EAAE,CAAA;AAAA,EAC9C;AAEA,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,EAAO,IAAA,IAAQ,IAAA;AACtC,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,EAAO,EAAA,IAAM,IAAA;AAClC,EAAA,IAAI,SAAA,GAAqB,IAAA;AACzB,EAAA,IAAI,GAAA,GAAe,IAAA;AACnB,EAAA,MAAM,KAAA,GAAQ,IAAI,aAAA,EAAc,CAAE,KAAA,EAAM;AACxC,EAAA,IAAI;AACF,IAAA,SAAA,GAAY,MAAM,QAAA,CAAS,MAAA,EAAQ,EAAA,EAAI,QAAQ,UAAU,CAAA;AAAA,EAC3D,SAAS,CAAA,EAAG;AACV,IAAA,GAAA,GAAM,CAAA;AAAA,EACR;AACA,EAAA,KAAA,CAAM,IAAA,EAAK;AAEX,EAAA,IAAI,UAAU,GAAA,IAAO,IAAA;AACrB,EAAA,IAAI,MAAA,GAAkB,IAAA;AACtB,EAAA,IAAI,SAAA,GAAY,KAAA;AAChB,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,IAAI;AAIF,MAAA,MAAM,mBACJ,IAAA,CAAK,UAAA,KAAe,OAAA,GAAU,IAAA,GAAS,KAAK,UAAA,IAAc,IAAA;AAC5D,MAAA,MAAM,CAAC,QAAQ,CAAA,GAAI,iBAAiB,SAAA,EAAW,MAAA,CAAO,OAAO,SAAA,EAAW;AAAA,QACtE,UAAA,EAAY,gBAAA;AAAA,QACZ,SAAA,EAAW,OAAO,MAAA,CAAO,SAAA;AAAA,QACzB,OAAO,MAAA,CAAO;AAAA,OACf,CAAA;AACD,MAAA,SAAA,GAAY,QAAA;AACZ,MAAA,CAAC,MAAA,EAAQ,SAAS,CAAA,GAAI,WAAA,CAAY,SAAS,CAAA;AAAA,IAC7C,SAAS,CAAA,EAAG;AACV,MAAA,GAAA,GAAM,CAAA;AACN,MAAA,OAAA,GAAU,KAAA;AAAA,IACZ;AAAA,EACF;AAEA,EAAA,MAAM,YAAY,MAAA,EAAQ;AAAA,IACxB,QAAQ,EAAA,CAAG,EAAA;AAAA,IACX,UAAU,EAAA,CAAG,QAAA;AAAA,IACb,MAAM,EAAA,CAAG,IAAA;AAAA,IACT,SAAA;AAAA,IACA,OAAA;AAAA,IACA,MAAA,EAAQ,KAAK,MAAA,IAAU,KAAA;AAAA,IACvB,SAAA,EAAW,UAAA;AAAA,IACX,YAAA,EAAc,UAAU,SAAA,GAAY,IAAA;AAAA,IACpC,OAAA;AAAA,IACA,KAAA,EAAO,GAAA;AAAA,IACP,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,KAAA,EAAO,UAAU,CAAA,GAAI,CAAA;AAAA,IACrB;AAAA,GACD,CAAA;AAED,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,iBAAA,CAAkB,CAAA,uBAAA,EAA0B,GAAG,QAAQ,CAAA,EAAA,EAAK,GAAG,CAAA,CAAE,CAAA;AAAA,EAC7E;AAEA,EAAA,MAAM,KAAA,GAAoB;AAAA,IACxB,IAAA,EAAM,MAAA;AAAA,IACN,KAAA,EAAO,CAAA;AAAA,IACP,MAAA,EAAQ,EAAE,SAAA,EAAW,EAAA,CAAG,UAAU,IAAA,EAAM,EAAA,CAAG,MAAM,SAAA;AAAU,GAC7D;AACA,EAAA,SAAA,CAAU,MAAA,CAAO,OAAO,KAAK,CAAA;AAE7B,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,MAAA;AAAA,IACR,KAAA,EAAO,EAAE,KAAA,EAAO,CAAA,EAAG,MAAM,MAAA,EAAQ,SAAA,EAAW,EAAA,CAAG,QAAA,EAAU,SAAA;AAAU,GACrE;AACF;AM35BO,IAAM,iBAAA,GAAoB,GAAA;AACjC,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,gBAAA,GAAmB,IAAA;AACzB,IAAM,gBAAA,GAAmB,GAAA;AACzB,IAAM,mBAAA,GAAsB,GAAA;AAmB5B,eAAeC,YAAAA,CAAY,KAAa,YAAA,EAAsC;AAC5E,EAAA,MAAM,mBAAA,CAAoB,GAAA,EAAK,EAAE,YAAA,EAAc,CAAA;AACjD;AAEA,SAAS,MAAA,CAAO,KAAA,EAAiC,GAAA,EAAc,GAAA,EAAoC;AACjG,EAAA,IAAI,KAAA,EAAO,SAAA,CAAU,KAAA,EAAO,GAAA,EAAK,GAAG,CAAA;AAAA,OAC/B,OAAA,CAAQ,KAAA,CAAM,mCAAA,EAAqC,GAAA,EAAK,UAAU,GAAG,CAAA;AAC5E;AAOO,IAAM,uBAAN,MAAmD;AAAA,EAChD,KAAA,uBAAY,GAAA,EAAkE;AAAA,EAE9E,cAAA,GAAuB;AAC7B,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA;AACzB,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,KAAK,KAAA,EAAO;AAC/B,MAAA,IAAI,EAAE,SAAA,IAAa,GAAA,EAAK,IAAA,CAAK,KAAA,CAAM,OAAO,CAAC,CAAA;AAAA,IAC7C;AAAA,EACF;AAAA,EAEA,GAAA,CAAI,KAAA,EAAe,IAAA,EAA+B,UAAA,GAAqB,iBAAA,EAAyB;AAC9F,IAAA,IAAA,CAAK,cAAA,EAAe;AACpB,IAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,KAAA,EAAO,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA,GAAO,UAAA,EAAY,CAAA;AAAA,EAC3E;AAAA,EAEA,IAAI,KAAA,EAA+C;AACjD,IAAA,IAAA,CAAK,cAAA,EAAe;AACpB,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,KAAK,CAAA;AAClC,IAAA,IAAA,CAAK,KAAA,CAAM,OAAO,KAAK,CAAA;AACvB,IAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,IAAA,IAAI,MAAM,SAAA,IAAa,IAAA,CAAK,GAAA,EAAI,GAAI,KAAM,OAAO,IAAA;AACjD,IAAA,OAAO,KAAA,CAAM,IAAA;AAAA,EACf;AACF,CAAA;AAsCA,eAAe,SAAA,CACb,GAAA,EACA,IAAA,GAMI,EAAC,EACiG;AACtG,EAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,IAC5B,MAAA,EAAQ,KAAK,MAAA,IAAU,KAAA;AAAA,IACvB,SAAS,IAAA,CAAK,OAAA;AAAA,IACd,MAAM,IAAA,CAAK,IAAA;AAAA;AAAA;AAAA,IAGX,QAAA,EAAU,KAAK,QAAA,IAAY,QAAA;AAAA,IAC3B,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,IAAA,CAAK,WAAW,oBAAoB;AAAA,GACjE,CAAA;AACD,EAAA,OAAO;AAAA;AAAA;AAAA,IAGL,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,IAAA,EAAM,MAAM,IAAA,CAAK,IAAA,EAAK;AAAA,IACtB,IAAA,EAAM,MAAM,IAAA,CAAK,IAAA;AAAK,GACxB;AACF;AAWA,eAAsB,qBAAA,CACpB,SAAA,EACA,IAAA,GAAyD,EAAC,EACjB;AACzC,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,SAAS,CAAA;AAChC,EAAA,MAAM,OAAO,CAAA,EAAG,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK,OAAO,IAAI,CAAA,CAAA;AAC/C,EAAA,MAAMA,YAAAA,CAAY,IAAA,EAAM,IAAA,CAAK,YAAA,IAAgB,KAAK,CAAA;AAElD,EAAA,MAAM,YAAA,GAAe,GAAG,IAAI,CAAA,uCAAA,CAAA;AAC5B,EAAA,IAAI;AACF,IAAA,MAAM,OAAO,MAAM,SAAA,CAAU,cAAc,EAAE,OAAA,EAAS,sBAAsB,CAAA;AAC5E,IAAA,IAAI,IAAA,CAAK,WAAW,GAAA,EAAK;AACvB,MAAA,MAAM,IAAA,GAAQ,MAAM,IAAA,CAAK,IAAA,EAAK;AAC9B,MAAA,IAAI,IAAA,CAAK,sBAAA,IAA0B,IAAA,CAAK,cAAA,EAAgB;AACtD,QAAA,OAAO;AAAA,UACL,wBAAwB,IAAA,CAAK,sBAAA;AAAA,UAC7B,gBAAgB,IAAA,CAAK,cAAA;AAAA,UACrB,uBAAuB,IAAA,CAAK,qBAAA;AAAA,UAC5B,gBAAA,EAAkB,IAAA,CAAK,gBAAA,IAAoB,EAAC;AAAA,UAC5C,wBAAA,EAA0B,IAAA,CAAK,wBAAA,IAA4B,EAAC;AAAA,UAC5D,gCAAA,EAAkC,IAAA,CAAK,gCAAA,IAAoC,CAAC,MAAM,CAAA;AAAA,UAClF,MAAA,EAAQ,KAAK,MAAA,IAAU;AAAA,SACzB;AAAA,MACF;AAAA,IACF;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,IAAI,EAAE,CAAA,YAAa,SAAA,CAAA,IAAc,EAAE,aAAa,YAAA,CAAA,EAAe;AAC7D,MAAA,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,EAAG,EAAE,OAAO,8BAAA,EAAgC,GAAA,EAAK,cAAc,CAAA;AAAA,IACpF;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,GAAG,IAAI,CAAA,iCAAA,CAAA;AACvB,EAAA,IAAI;AACF,IAAA,MAAM,OAAO,MAAM,SAAA,CAAU,SAAS,EAAE,OAAA,EAAS,sBAAsB,CAAA;AACvE,IAAA,IAAI,IAAA,CAAK,WAAW,GAAA,EAAK;AACvB,MAAA,MAAM,IAAA,GAAQ,MAAM,IAAA,CAAK,IAAA,EAAK;AAC9B,MAAA,IAAI,IAAA,CAAK,sBAAA,IAA0B,IAAA,CAAK,cAAA,EAAgB;AACtD,QAAA,OAAO;AAAA,UACL,wBAAwB,IAAA,CAAK,sBAAA;AAAA,UAC7B,gBAAgB,IAAA,CAAK,cAAA;AAAA,UACrB,uBAAuB,IAAA,CAAK,qBAAA;AAAA,UAC5B,gBAAA,EAAkB,IAAA,CAAK,gBAAA,IAAoB,EAAC;AAAA,UAC5C,gCAAA,EAAkC,IAAA,CAAK,gCAAA,IAAoC,CAAC,MAAM,CAAA;AAAA,UAClF,MAAA,EAAQ,KAAK,MAAA,IAAU;AAAA,SACzB;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,KAAA,MAAW,CAAC,QAAA,EAAU,SAAS,CAAA,IAAK;AAAA,IAClC,CAAC,oBAAoB,cAAc,CAAA;AAAA,IACnC,CAAC,cAAc,QAAQ,CAAA;AAAA,IACvB,CAAC,qBAAqB,eAAe;AAAA,GACvC,EAAY;AACV,IAAA,IAAI;AACF,MAAA,MAAM,OAAO,MAAM,SAAA,CAAU,GAAG,IAAI,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI;AAAA,QACjD,OAAA,EAAS,gBAAA;AAAA,QACT,QAAA,EAAU;AAAA,OACX,CAAA;AAOD,MAAA,IACE,IAAA,CAAK,MAAA,KAAW,GAAA,IAChB,IAAA,CAAK,WAAW,GAAA,IAChB,IAAA,CAAK,MAAA,KAAW,GAAA,IAChB,IAAA,CAAK,MAAA,KAAW,GAAA,IAChB,IAAA,CAAK,SAAS,gBAAA,EACd;AACA,QAAA,OAAO;AAAA,UACL,sBAAA,EAAwB,CAAA,EAAG,IAAI,CAAA,EAAG,QAAQ,CAAA,CAAA;AAAA,UAC1C,cAAA,EAAgB,CAAA,EAAG,IAAI,CAAA,EAAG,SAAS,CAAA,CAAA;AAAA,UACnC,MAAA,EAAQ,IAAA;AAAA,UACR,kBAAkB,EAAC;AAAA,UACnB,gCAAA,EAAkC,CAAC,MAAM;AAAA,SAC3C;AAAA,MACF;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAAC;AAAA,EACX;AACA,EAAA,OAAO,IAAA;AACT;AASA,eAAsB,oBACpB,oBAAA,EACA,WAAA,EACA,aAAa,yBAAA,EACb,IAAA,GAAyD,EAAC,EACxB;AAClC,EAAA,MAAMA,YAAAA,CAAY,oBAAA,EAAsB,IAAA,CAAK,YAAA,IAAgB,KAAK,CAAA;AAClE,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,WAAA,EAAa,UAAA;AAAA,IACb,aAAA,EAAe,CAAC,WAAW,CAAA;AAAA,IAC3B,WAAA,EAAa,CAAC,oBAAA,EAAsB,eAAe,CAAA;AAAA,IACnD,cAAA,EAAgB,CAAC,MAAM,CAAA;AAAA,IACvB,0BAAA,EAA4B;AAAA,GAC9B;AACA,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,UAAU,oBAAA,EAAsB;AAAA,MAC3C,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,mBAAA;AAAA,MACT,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,MAC9C,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,OAAO;AAAA,KAC7B,CAAA;AAAA,EACH,SAAS,CAAA,EAAG;AACV,IAAA,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,EAAG,EAAE,OAAO,uBAAA,EAAyB,qBAAA,EAAuB,sBAAsB,CAAA;AACrG,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oCAAA,EAAuC,CAAC,CAAA,CAAE,CAAA;AAAA,EAC5D;AACA,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,GAAA,IAAO,IAAA,CAAK,WAAW,GAAA,EAAK;AAC9C,IAAA,MAAM,QAAQ,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AACpE,IAAA,MAAA,CAAO,IAAA,CAAK,OAAO,KAAA,EAAO;AAAA,MACxB,KAAA,EAAO,uBAAA;AAAA,MACP,qBAAA,EAAuB,oBAAA;AAAA,MACvB,aAAa,IAAA,CAAK;AAAA,KACnB,CAAA;AACD,IAAA,MAAM,KAAA;AAAA,EACR;AACA,EAAA,OAAQ,MAAM,KAAK,IAAA,EAAK;AAC1B;AAEA,eAAsB,iBAAA,CACpB,UACA,SAAA,EACA,MAAA,EACA,aACA,KAAA,EACA,IAAA,GAKI,EAAC,EAC8C;AACnD,EAAA,MAAM,eAAe,QAAA,CAAS,sBAAA;AAC9B,EAAA,MAAM,gBAAgB,QAAA,CAAS,cAAA;AAC/B,EAAA,IAAI,CAAC,YAAA,EAAc,MAAM,IAAI,MAAM,iDAAiD,CAAA;AACpF,EAAA,IAAI,CAAC,aAAA,EAAe,MAAM,IAAI,MAAM,yCAAyC,CAAA;AAE7E,EAAA,MAAM,YAAA,GAAeZ,mBAAY,EAAE,CAAA,CAAE,SAAS,WAAW,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AACvE,EAAA,MAAM,MAAA,GAASa,kBAAW,QAAQ,CAAA,CAAE,OAAO,YAAA,EAAc,OAAO,EAAE,MAAA,EAAO;AACzE,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,QAAA,CAAS,WAAW,CAAA;AACjD,EAAA,MAAM,KAAA,GAAQb,kBAAAA,CAAY,EAAE,CAAA,CAAE,SAAS,WAAW,CAAA;AAElD,EAAA,MAAM,OAAA,CAAQ,OAAA;AAAA,IACZ,KAAA,CAAM,GAAA;AAAA,MACJ,KAAA;AAAA,MACA;AAAA,QACE,UAAA,EAAY,SAAA;AAAA,QACZ,aAAA,EAAe,YAAA;AAAA,QACf,OAAA,EAAS,MAAA;AAAA,QACT,YAAA,EAAc,WAAA;AAAA,QACd,cAAA,EAAgB,aAAA;AAAA,QAChB,SAAA,EAAW,KAAK,QAAA,IAAY,IAAA;AAAA,QAC5B,aAAA,EAAe,KAAK,YAAA,IAAgB;AAAA,OACtC;AAAA,MACA,KAAK,UAAA,IAAc;AAAA;AACrB,GACF;AAEA,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,IACjC,aAAA,EAAe,MAAA;AAAA,IACf,KAAA;AAAA,IACA,YAAA,EAAc,WAAA;AAAA,IACd,cAAA,EAAgB,aAAA;AAAA,IAChB,qBAAA,EAAuB;AAAA,GACxB,CAAA;AACD,EAAA,IAAI,KAAK,QAAA,EAAU,MAAA,CAAO,GAAA,CAAI,WAAA,EAAa,KAAK,QAAQ,CAAA;AACxD,EAAA,IAAI,KAAK,MAAA,EAAQ,MAAA,CAAO,GAAA,CAAI,OAAA,EAAS,KAAK,MAAM,CAAA;AAEhD,EAAA,OAAO,EAAE,eAAe,CAAA,EAAG,YAAY,IAAI,MAAA,CAAO,QAAA,EAAU,CAAA,CAAA,EAAI,KAAA,EAAM;AACxE;AAEA,eAAsB,qBACpB,KAAA,EACA,IAAA,EACA,KAAA,EACA,IAAA,GAAuF,EAAC,EACtD;AAClC,EAAA,MAAM,UAAU,MAAM,OAAA,CAAQ,QAAQ,KAAA,CAAM,GAAA,CAAI,KAAK,CAAC,CAAA;AACtD,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,mEAA8D,CAAA;AAC5F,EAAA,MAAM,gBAAgB,OAAA,CAAQ,cAAA;AAC9B,EAAA,IAAI,CAAC,aAAA,EAAe,MAAM,IAAI,MAAM,yCAAyC,CAAA;AAI7E,EAAA,MAAMY,YAAAA,CAAY,aAAA,EAAe,IAAA,CAAK,YAAA,IAAgB,KAAK,CAAA;AAE3D,EAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,IAC/B,UAAA,EAAY,oBAAA;AAAA,IACZ,IAAA;AAAA,IACA,YAAA,EAAc,MAAA,CAAO,OAAA,CAAQ,YAAY,CAAA;AAAA,IACzC,aAAA,EAAe,MAAA,CAAO,OAAA,CAAQ,aAAa;AAAA,GAC5C,CAAA;AACD,EAAA,IAAI,OAAA,CAAQ,WAAW,IAAA,CAAK,GAAA,CAAI,aAAa,MAAA,CAAO,OAAA,CAAQ,SAAS,CAAC,CAAA;AACtE,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,YAAA,IAAiB,OAAA,CAAQ,aAAA;AAC7C,EAAA,IAAI,QAAQ,IAAA,CAAK,GAAA,CAAI,eAAA,EAAiB,MAAA,CAAO,MAAM,CAAC,CAAA;AAEpD,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,UAAU,aAAA,EAAe;AAAA,MACpC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,gBAAA;AAAA,MACT,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D;AAAA,KACD,CAAA;AAAA,EACH,SAAS,CAAA,EAAG;AACV,IAAA,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,EAAG,EAAE,OAAO,yBAAA,EAA2B,cAAA,EAAgB,eAAe,CAAA;AACzF,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gCAAA,EAAmC,CAAC,CAAA,CAAE,CAAA;AAAA,EACxD;AACA,EAAA,IAAI,IAAA,CAAK,WAAW,GAAA,EAAK;AACvB,IAAA,MAAM,QAAQ,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAC/D,IAAA,MAAA,CAAO,IAAA,CAAK,OAAO,KAAA,EAAO;AAAA,MACxB,KAAA,EAAO,yBAAA;AAAA,MACP,cAAA,EAAgB,aAAA;AAAA,MAChB,aAAa,IAAA,CAAK;AAAA,KACnB,CAAA;AACD,IAAA,MAAM,KAAA;AAAA,EACR;AAEA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,SAAA,GAAa,MAAM,KAAK,IAAA,EAAK;AAAA,EAC/B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,EAAK;AAC7B,IAAA,SAAA,GAAY,MAAA,CAAO,WAAA,CAAY,IAAI,eAAA,CAAgB,IAAI,CAAC,CAAA;AAAA,EAC1D;AACA,EAAA,MAAM,cAAc,SAAA,CAAU,YAAA;AAC9B,EAAA,IAAI,CAAC,WAAA,EAAa;AAChB,IAAA,MAAM,KAAA,GAAQ,IAAI,KAAA,CAAM,qCAAqC,CAAA;AAC7D,IAAA,MAAA,CAAO,IAAA,CAAK,OAAO,KAAA,EAAO,EAAE,OAAO,yBAAA,EAA2B,cAAA,EAAgB,eAAe,CAAA;AAC7F,IAAA,MAAM,KAAA;AAAA,EACR;AACA,EAAA,OAAO;AAAA,IACL,YAAA,EAAc,WAAA;AAAA,IACd,eAAe,SAAA,CAAU,aAAA;AAAA,IACzB,UAAA,EAAY,UAAU,UAAA,IAAc,QAAA;AAAA,IACpC,YAAY,SAAA,CAAU,UAAA;AAAA,IACtB,OAAO,SAAA,CAAU,KAAA;AAAA,IACjB,SAAS,OAAA,CAAQ,OAAA;AAAA,IACjB,YAAY,OAAA,CAAQ;AAAA,GACtB;AACF;;;AdxWO,IAAM,uBAAA,GAA0B,qBAAA;AAEvC,IAAML,QAAAA,GAAU,iEAAA;AAEhB,SAAS,WAAW,KAAA,EAAuB;AACzC,EAAA,IAAI,CAACA,QAAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,KAAK,CAAC,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,aAAa,GAAA,EAAK,CAAA,YAAA,EAAe,KAAK,SAAA,CAAU,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,EACpE;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,aAAA,CACP,GAAA,EACA,IAAA,GAA4D,EAAC,EACpC;AACzB,EAAA,MAAM,GAAA,GAA+B;AAAA,IACnC,EAAA,EAAI,MAAA,CAAO,GAAA,CAAI,EAAE,CAAA;AAAA,IACjB,MAAM,GAAA,CAAI,IAAA;AAAA,IACV,MAAM,GAAA,CAAI,IAAA;AAAA,IACV,WAAA,EAAa,IAAI,WAAA,IAAe,EAAA;AAAA,IAChC,WAAW,GAAA,CAAI,SAAA;AAAA,IACf,GAAA,EAAK,IAAI,GAAA,IAAO,IAAA,GAAO,CAAC,GAAI,GAAA,CAAI,GAAgB,CAAA,GAAI,IAAA;AAAA,IACpD,mBAAmB,GAAA,CAAI,iBAAA;AAAA,IACvB,eAAA,EAAiB,GAAA,CAAI,eAAA,IAAmB,EAAC;AAAA,IACzC,SAAS,GAAA,CAAI,OAAA;AAAA;AAAA;AAAA;AAAA,IAIb,SAAA,EAAW,GAAA,CAAI,SAAA,IAAa;AAAC,GAC/B;AAKA,EAAA,IAAI,IAAA,CAAK,QAAA,IAAY,GAAA,CAAI,gBAAA,EAAkB;AACzC,IAAA,IAAI;AACF,MAAA,IAAI,CAAC,IAAA,CAAK,WAAA,EAAa,MAAM,IAAI,MAAM,0BAA0B,CAAA;AACjE,MAAA,GAAA,CAAI,eAAA,GAAkB,YAAA;AAAA,QACpB,MAAA,CAAO,IAAI,IAAI,CAAA;AAAA,QACf,YAAY,MAAA,CAAO,GAAA,CAAI,gBAAgB,CAAA,EAAG,KAAK,WAAW;AAAA,OAC5D;AAAA,IACF,CAAA,CAAA,MAAQ;AACN,MAAA,GAAA,CAAI,YAAA,GAAe,eAAA;AAAA,IACrB;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAKA,SAAS,WAAW,IAAA,EAAsB;AACxC,EAAA,OAAO,KACJ,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA,CACrB,OAAA,CAAQ,MAAM,MAAM,CAAA,CACpB,QAAQ,IAAA,EAAM,MAAM,EACpB,OAAA,CAAQ,IAAA,EAAM,QAAQ,CAAA,CACtB,OAAA,CAAQ,MAAM,QAAQ,CAAA;AAC3B;AAOA,SAAS,gBAAA,CAAiB,WAAoB,UAAA,EAAsC;AAClF,EAAA,IAAI,SAAA,IAAa,IAAA,IAAQ,UAAA,KAAe,OAAA,EAAS;AAC/C,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,GAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,YAAA,CAAa,WAAW,UAAU,CAAA;AACpC;AAEA,SAAS,aAAA,CAAc,OAAgB,OAAA,EAAqC;AAK1E,EAAA,OAAO,wBAAA,CAAyB,KAAA,EAAO,EAAE,OAAA,EAAS,CAAA;AACpD;AAEA,SAAS,aAAa,MAAA,EAAiD;AACrE,EAAA,OAAO;AAAA,IACL,IAAI,MAAA,CAAO,EAAA;AAAA,IACX,WAAW,MAAA,CAAO,QAAA;AAAA,IAClB,kBAAkB,MAAA,CAAO,cAAA;AAAA,IACzB,WAAW,MAAA,CAAO,QAAA;AAAA,IAClB,YAAY,MAAA,CAAO,UAAA;AAAA,IACnB,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,eAAe,MAAA,CAAO,YAAA;AAAA,IACtB,UAAA,EAAY,MAAA,CAAO,SAAA,EAAW,WAAA,EAAY,IAAK,IAAA;AAAA,IAC/C,WAAA,EAAa,MAAA,CAAO,UAAA,EAAY,WAAA,EAAY,IAAK,IAAA;AAAA,IACjD,UAAA,EAAY,MAAA,CAAO,SAAA,EAAW,WAAA,EAAY,IAAK;AAAA,GACjD;AACF;AAEO,SAAS,cAAA,CACd,OAAA,EACA,OAAA,EACA,YAAA,EACA,YAA4C,IAAA,EACpC;AACR,EAAA,MAAM,MAAA,GAAS,UAAU,SAAA,GAAY,OAAA;AACrC,EAAA,MAAM,UAAmC,EAAE,IAAA,EAAM,CAAA,UAAA,EAAa,MAAM,IAAI,OAAA,EAAQ;AAChF,EAAA,IAAI,SAAA,IAAa,OAAA,EAAS,OAAA,CAAQ,KAAA,GAAQ,SAAA;AAC1C,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA,EAAG,MAAM,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AAC9E,EAAA,MAAM,KAAA,GAAQ,UAAU,WAAA,GAAc,QAAA;AACtC,EAAA,OACE,CAAA,iJAAA,EAEO,KAAK,CAAA,QAAA,EACN,UAAA,CAAW,OAAO,CAAC,CAAA,uHAAA,EAIK,OAAO,CAAA,uDAAA,EACiB,YAAY,CAAA,kIAAA,CAAA;AAMtE;AAeO,SAAS,mBAAA,CACd,MAAA,EACA,IAAA,GASI,EAAC,EACL;AACA,EAAA,MAAM,KAAA,GAAsB,IAAA,CAAK,YAAA,IAAgB,IAAI,oBAAA,EAAqB;AAC1E,EAAA,MAAM,cAAA,GAAiB,KAAK,cAAA,IAAkB,KAAA;AAS9C,EAAA,MAAM,cAAc,MAAqB;AACvC,IAAA,IAAI,CAAC,gBAAgB,OAAO,IAAA;AAC5B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,YAAA,CAAa,OAAO,MAAM,CAAA;AAAA,IAClC,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,IAAI,GAAA,CAAI,WAAW,EAAA,EAAI;AACrB,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,uCAAA,EAA0C,IAAI,MAAM,CAAA,mEAAA;AAAA,OAEtD;AACA,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,GAAA;AAAA,EACT,CAAA;AACA,EAAA,MAAM,mBAAmB,IAAA,CAAK,eAAA,IAAmB,EAAA,EAAI,OAAA,CAAQ,OAAO,EAAE,CAAA;AACtE,EAAA,IAAI,YAAA,GAAe,EAAA;AACnB,EAAA,IAAI;AACF,IAAA,IAAI,eAAA,EAAiB,YAAA,GAAe,IAAI,GAAA,CAAI,eAAe,CAAA,CAAE,MAAA;AAAA,EAC/D,CAAA,CAAA,MAAQ;AACN,IAAA,YAAA,GAAe,EAAA;AAAA,EACjB;AACA,EAAA,MAAM,cAAc,eAAA,GAAkB,CAAA,EAAG,eAAe,CAAA,EAAG,uBAAuB,CAAA,CAAA,GAAK,EAAA;AAEvF,EAAA,OAAO;AAAA,IACL,MAAM,UAAA,CAAW,IAAA,EAAe,UAAA,EAAuD;AACrF,MAAA,MAAM,MAAA,GAAS,aAAA,CAAc,UAAA,EAAY,aAAa,CAAA;AACtD,MAAA,MAAM,EAAA,GAAK,UAAA,CAAW,WAAA,CAAY,IAAI,CAAA;AACtC,MAAA,gBAAA,CAAiB,EAAA,CAAG,KAAK,MAAM,CAAA;AAC/B,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,MAAA,CAAO,YAAA,GAAe,MAAM,MAAA,CAAO,YAAA,CAAa,EAAE,CAAA,GAAI,MAAM,YAAA,CAAa,MAAA,EAAQ,EAAE,CAAA;AAClG,QAAA,OAAO,EAAE,IAAI,MAAA,EAAO;AAAA,MACtB,SAAS,GAAA,EAAK;AACZ,QAAA,IAAI,eAAe,mBAAA,EAAqB,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,IAAI,OAAO,CAAA;AAC/E,QAAA,IAAI,eAAe,KAAA,IAAS,2BAAA,CAA4B,IAAA,CAAK,GAAA,CAAI,OAAO,CAAA,EAAG;AACzE,UAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,QACzC;AACA,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,cAAA,CACJ,KAAA,EACA,UAAA,EACkC;AAClC,MAAA,MAAM,MAAA,GAAS,aAAA,CAAc,UAAA,EAAY,YAAY,CAAA;AACrD,MAAA,MAAM,SAAoB,EAAC;AAC3B,MAAA,IAAI,GAAA,GAAM,CAAA,kCAAA,CAAA;AACV,MAAA,IAAI,KAAA,CAAM,aAAa,IAAA,EAAM;AAC3B,QAAA,MAAA,CAAO,IAAA,CAAK,MAAM,SAAS,CAAA;AAC3B,QAAA,GAAA,IAAO,CAAA,qBAAA,CAAA;AAAA,MACT;AACA,MAAA,MAAM,SAAS,MAAM,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,KAAK,MAAM,CAAA;AAClD,MAAA,MAAM,MAAM,WAAA,EAAY;AACxB,MAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,IAAA,CAClB,MAAA,CAAO,CAAC,GAAA,KAAQ,UAAA,CAAW,GAAA,CAAI,GAAA,IAAO,IAAA,GAAO,CAAC,GAAG,IAAI,GAAG,CAAA,GAAI,IAAA,EAAM,MAAM,CAAC,CAAA,CACzE,GAAA,CAAI,CAAC,GAAA,KAAQ,aAAA,CAAc,GAAA,EAAK,EAAE,QAAA,EAAU,cAAA,EAAgB,WAAA,EAAa,GAAA,EAAK,CAAC,CAAA;AAClF,MAAA,OAAO,EAAE,KAAA,EAAM;AAAA,IACjB,CAAA;AAAA,IAEA,MAAM,OAAA,CAAQ,MAAA,EAAgB,UAAA,EAAuD;AACnF,MAAA,MAAM,MAAA,GAAS,aAAA,CAAc,UAAA,EAAY,sBAAsB,CAAA;AAC/D,MAAA,MAAM,QAAA,GAAW,WAAW,MAAM,CAAA;AAClC,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,gDAAA,CAAA,EAAoD,CAAC,QAAQ,CAAC,CAAA;AACrG,MAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA;AACzB,MAAA,IAAI,CAAC,GAAA,IAAO,CAAC,UAAA,CAAW,IAAI,GAAA,IAAO,IAAA,GAAO,CAAC,GAAG,GAAA,CAAI,GAAG,CAAA,GAAI,IAAA,EAAM,MAAM,CAAA,EAAG;AACtE,QAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,CAAA,gBAAA,EAAmB,MAAM,CAAA,CAAE,CAAA;AAAA,MACzD;AACA,MAAA,OAAO,aAAA,CAAc,KAAK,EAAE,QAAA,EAAU,gBAAgB,WAAA,EAAa,WAAA,IAAe,CAAA;AAAA,IACpF,CAAA;AAAA,IAEA,MAAM,eAAA,CACJ,MAAA,EACA,IAAA,EACA,UAAA,EACkC;AAClC,MAAA,MAAM,MAAA,GAAS,aAAA,CAAc,UAAA,EAAY,wBAAwB,CAAA;AACjE,MAAA,UAAA,CAAW,MAAM,CAAA;AACjB,MAAA,MAAM,SAAkC,EAAC;AACzC,MAAA,MAAM,GAAA,GAA8B;AAAA,QAClC,IAAA,EAAM,MAAA;AAAA,QACN,IAAA,EAAM,MAAA;AAAA,QACN,WAAA,EAAa,aAAA;AAAA,QACb,MAAA,EAAQ,QAAA;AAAA,QACR,SAAA,EAAW,UAAA;AAAA,QACX,GAAA,EAAK,KAAA;AAAA,QACL,iBAAA,EAAmB,kBAAA;AAAA,QACnB,eAAA,EAAiB,gBAAA;AAAA,QACjB,OAAA,EAAS,SAAA;AAAA,QACT,SAAA,EAAW;AAAA,OACb;AACA,MAAA,KAAA,MAAW,CAAC,CAAA,EAAG,IAAI,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AAC3C,QAAA,IAAI,MAAA,CAAO,OAAO,IAAA,EAAM,CAAC,GAAG,MAAA,CAAO,IAAI,CAAA,GAAI,IAAA,CAAK,CAAC,CAAA;AAAA,MACnD;AAMA,MAAA,MAAM,QAAA,GAAmC;AAAA,QACvC,gBAAA,EAAkB,mBAAA;AAAA,QAClB,cAAA,EAAgB,iBAAA;AAAA,QAChB,QAAA,EAAU;AAAA,OACZ;AACA,MAAA,KAAA,MAAW,KAAA,IAAS;AAAA,QAClB,MAAA;AAAA,QACA,MAAA;AAAA,QACA,aAAA;AAAA,QACA,kBAAA;AAAA,QACA,gBAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACF,EAAG;AACD,QAAA,IAAI,KAAA,IAAS,MAAA,IAAU,MAAA,CAAO,KAAK,KAAK,IAAA,EAAM;AAC5C,UAAA,MAAM,IAAI,aAAa,GAAA,EAAK,CAAA,EAAG,SAAS,KAAK,CAAA,IAAK,KAAK,CAAA,eAAA,CAAiB,CAAA;AAAA,QAC1E;AAAA,MACF;AACA,MAAA,IAAI,KAAA,IAAS,MAAA,EAAQ,gBAAA,CAAiB,MAAA,CAAO,KAAK,MAAM,CAAA;AACxD,MAAA,IAAI;AACF,QAAA,MAAM,OAAA,GAAU,OAAO,UAAA,GACnB,MAAM,OAAO,UAAA,CAAW,MAAA,EAAQ,EAAE,UAAA,EAAY,MAAA,EAAQ,GAAG,QAAQ,CAAA,GACjE,MAAM,UAAA,CAAW,MAAA,EAAQ,MAAA,EAAQ,EAAE,UAAA,EAAY,MAAA,EAAQ,GAAG,MAAA,EAAQ,CAAA;AACtE,QAAA,OAAO;AAAA,UACL,IAAI,OAAA,CAAQ,EAAA;AAAA,UACZ,MAAM,OAAA,CAAQ,IAAA;AAAA,UACd,MAAM,OAAA,CAAQ,IAAA;AAAA,UACd,aAAa,OAAA,CAAQ,WAAA;AAAA,UACrB,WAAW,OAAA,CAAQ,QAAA;AAAA,UACnB,KAAK,OAAA,CAAQ,GAAA;AAAA,UACb,mBAAmB,OAAA,CAAQ,gBAAA;AAAA,UAC3B,iBAAiB,OAAA,CAAQ,cAAA;AAAA,UACzB,SAAS,OAAA,CAAQ,OAAA;AAAA,UACjB,WAAW,OAAA,CAAQ;AAAA,SACrB;AAAA,MACF,SAAS,GAAA,EAAK;AAGZ,QAAA,IAAI,eAAe,mBAAA,EAAqB,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,IAAI,OAAO,CAAA;AAC/E,QAAA,IAAI,GAAA,YAAe,mBAAmB,MAAM,IAAI,aAAa,GAAA,EAAK,MAAA,CAAO,GAAA,CAAI,OAAO,CAAC,CAAA;AACrF,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,eAAA,CAAgB,MAAA,EAAgB,UAAA,EAAuD;AAC3F,MAAA,MAAM,MAAA,GAAS,aAAA,CAAc,UAAA,EAAY,yBAAyB,CAAA;AAClE,MAAA,UAAA,CAAW,MAAM,CAAA;AACjB,MAAA,IAAI;AACF,QAAA,IAAI,MAAA,CAAO,YAAY,MAAM,MAAA,CAAO,WAAW,MAAA,EAAQ,EAAE,UAAA,EAAY,MAAA,EAAQ,CAAA;AAAA,mBAClE,UAAA,CAAW,MAAA,EAAQ,QAAQ,EAAE,UAAA,EAAY,QAAQ,CAAA;AAAA,MAC9D,SAAS,GAAA,EAAK;AACZ,QAAA,IAAI,GAAA,YAAe,mBAAmB,MAAM,IAAI,aAAa,GAAA,EAAK,MAAA,CAAO,GAAA,CAAI,OAAO,CAAC,CAAA;AACrF,QAAA,MAAM,GAAA;AAAA,MACR;AACA,MAAA,OAAO,EAAE,SAAS,MAAA,EAAO;AAAA,IAC3B,CAAA;AAAA,IAEA,MAAM,cAAc,IAAA,EAAiD;AACnE,MAAA,MAAM,EAAA,GAAK,UAAA,CAAW,WAAA,CAAY,IAAI,CAAA;AACtC,MAAA,IAAI;AACF,QAAA,OAAO,OAAO,OAAO,QAAA,GAAW,MAAA,CAAO,SAAS,EAAE,CAAA,GAAI,QAAA,CAAS,MAAA,EAAQ,EAAE,CAAA,CAAA;AAAA,MAC3E,SAAS,GAAA,EAAK;AAGZ,QAAA,IAAI,eAAe,mBAAA,EAAqB,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,IAAI,OAAO,CAAA;AAC/E,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IAEA,gBAAgB,IAAA,EAAuC;AACrD,MAAA,IAAI;AACF,QAAA,OAAO,aAAa,IAAgB,CAAA;AAAA,MACtC,CAAA,CAAA,MAAQ;AACN,QAAA,MAAM,IAAI,aAAa,GAAA,EAAK,CAAA,mBAAA,EAAsB,KAAK,SAAA,CAAU,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,MAC1E;AAAA,IACF,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWA,MAAM,gBAAA,CACJ,IAAA,EACA,UAAA,EACA,gBAAyB,IAAA,EACS;AAClC,MAAA,MAAM,MAAA,GAAS,aAAA,CAAc,UAAA,EAAY,qBAAqB,CAAA;AAC9D,MAAA,IAAI,CAAC,IAAA,CAAK,SAAA,QAAiB,IAAI,YAAA,CAAa,KAAK,uBAAuB,CAAA;AACxE,MAAA,IAAI,KAAA;AACJ,MAAA,IAAI;AACF,QAAA,KAAA,GAAQ,sBAAsB,aAAa,CAAA;AAAA,MAC7C,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,CAAA,wBAAA,EAA4B,GAAA,CAAc,OAAO,CAAA,CAAE,CAAA;AAAA,MACjF;AACA,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,MAAA,CAAO,WAAA,KAAgB,CAAC,CAAA,EAAG,CAAA,EAAG,CAAA,KAAM,WAAA,CAAY,MAAA,EAAQ,CAAA,EAAG,CAAA,EAAG,CAAC,CAAA,CAAA;AAC5E,QAAA,OAAO,MAAM,IAAA,CAAK,IAAA,CAAK,SAAA,EAAW,IAAA,CAAK,QAAQ,IAAA,EAAM;AAAA,UACnD,UAAU,IAAA,CAAK,SAAA;AAAA,UACf,UAAA,EAAY,MAAA;AAAA,UACZ,aAAA,EAAe;AAAA,SAChB,CAAA;AAAA,MACH,SAAS,GAAA,EAAK;AACZ,QAAA,IAAI,GAAA,YAAe,mBAAmB,MAAM,IAAI,aAAa,GAAA,EAAK,MAAA,CAAO,GAAA,CAAI,OAAO,CAAC,CAAA;AACrF,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,kBAAkB,IAAA,EAMa;AACnC,MAAA,MAAM,GAAA,GAAM,IAAI,WAAA,CAAY,EAAE,cAAc,kBAAA,CAAmB,MAAM,GAAG,CAAA;AACxE,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,CAAI,SAAA,CAAU,IAAA,CAAK,WAAA,EAAa,IAAA,CAAK,GAAA,EAAK,EAAE,KAAA,EAAO,IAAA,CAAK,KAAA,EAAO,OAAA,EAAS,IAAA,CAAK,SAAS,CAAA;AAC5F,QAAA,MAAM,MAAA,GAAS,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,KAAK,WAAW,CAAA;AAC/C,QAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,SAAA,EAAU;AACrC,QAAA,MAAM,YAAY,IAAA,CAAK,iBAAA,GAAoB,MAAM,MAAA,CAAO,eAAc,GAAI,IAAA;AAC1E,QAAA,OAAO;AAAA,UACL,QAAQ,IAAA,CAAK,WAAA;AAAA,UACb,KAAK,MAAA,CAAO,GAAA;AAAA,UACZ,SAAA,EAAW,OAAO,SAAA,CAAU,IAAA;AAAA,UAC5B,KAAA;AAAA,UACA,SAAA;AAAA,UACA,cAAA,EAAgB;AAAA,SAClB;AAAA,MACF,SAAS,GAAA,EAAK;AAQZ,QAAA,IAAI,GAAA,YAAe,cAAc,MAAM,IAAI,aAAa,GAAA,EAAK,MAAA,CAAO,GAAA,CAAI,OAAO,CAAC,CAAA;AAChF,QAAA,MAAM,GAAA,GAAM,OAAO,GAAG,CAAA;AACtB,QAAA,MAAM,WAAA,GAAc,gBAAA,CAAiB,IAAA,CAAK,GAAG,CAAA;AAC7C,QAAA,IAAI,WAAA,IAAe,SAAA,CAAU,IAAA,CAAK,GAAG,CAAA,EAAG;AAKtC,UAAA,IAAI,QAAA;AACJ,UAAA,IAAI;AACF,YAAA,QAAA,GAAW,MAAM,qBAAA,CAAsB,IAAA,CAAK,GAAA,EAAK;AAAA,cAC/C,OAAO,MAAA,CAAO,KAAA;AAAA,cACd,YAAA,EAAc,mBAAmB,MAAM;AAAA,aACxC,CAAA;AAAA,UACH,SAAS,MAAA,EAAQ;AACf,YAAA,IAAI,MAAA,YAAkB,cAAc,MAAM,IAAI,aAAa,GAAA,EAAK,MAAA,CAAO,MAAA,CAAO,OAAO,CAAC,CAAA;AACtF,YAAA,MAAM,MAAA;AAAA,UACR;AACA,UAAA,IAAI,QAAA,EAAU;AACZ,YAAA,OAAO;AAAA,cACL,QAAQ,IAAA,CAAK,WAAA;AAAA,cACb,KAAK,IAAA,CAAK,GAAA;AAAA,cACV,SAAA,EAAW,eAAA;AAAA,cACX,OAAO,EAAC;AAAA,cACR,SAAA,EAAW,IAAA;AAAA,cACX,cAAA,EAAgB;AAAA,aAClB;AAAA,UACF;AACA,UAAA,MAAM,IAAI,YAAA;AAAA,YACR,GAAA;AAAA,YACA,CAAA,oBAAA,EAAuB,WAAA,GAAc,CAAC,CAAA,IAAK,SAAS,CAAA,gEAAA;AAAA,WACtD;AAAA,QACF;AACA,QAAA,IAAI,GAAA,YAAe,UAAU,MAAM,IAAI,aAAa,GAAA,EAAK,CAAA,oBAAA,EAAuB,GAAG,CAAA,CAAE,CAAA;AACrF,QAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,CAAA,yBAAA,EAA4B,GAAG,CAAA,CAAE,CAAA;AAAA,MAC/D,CAAA,SAAE;AACA,QAAA,MAAM,IAAI,QAAA,EAAS;AAAA,MACrB;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,cAAc,IAAA,EAMiB;AACnC,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,gDAAgD,CAAA;AAAA,MAC9E;AACA,MAAA,IAAI,QAAA;AACJ,MAAA,IAAI;AACF,QAAA,QAAA,GAAW,MAAM,qBAAA,CAAsB,IAAA,CAAK,UAAA,EAAY;AAAA,UACtD,OAAO,MAAA,CAAO,KAAA;AAAA,UACd,YAAA,EAAc,mBAAmB,MAAM;AAAA,SACxC,CAAA;AAAA,MACH,SAAS,GAAA,EAAK;AACZ,QAAA,IAAI,GAAA,YAAe,cAAc,MAAM,IAAI,aAAa,GAAA,EAAK,MAAA,CAAO,GAAA,CAAI,OAAO,CAAC,CAAA;AAChF,QAAA,MAAM,GAAA;AAAA,MACR;AACA,MAAA,IAAI,CAAC,QAAA,EAAU;AACb,QAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,0EAAqE,CAAA;AAAA,MACnG;AACA,MAAA,IAAI,QAAA,GAAW,KAAK,SAAA,IAAa,IAAA;AACjC,MAAA,IAAI,YAAA,GAAe,KAAK,aAAA,IAAiB,IAAA;AACzC,MAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,qBAAA,EAAuB;AAC/C,QAAA,IAAI;AACF,UAAA,MAAM,MAAM,MAAM,mBAAA;AAAA,YAChB,MAAA,CAAO,SAAS,qBAAqB,CAAA;AAAA,YACrC,WAAA;AAAA,YACA,yBAAA;AAAA,YACA,EAAE,KAAA,EAAO,MAAA,CAAO,OAAO,YAAA,EAAc,kBAAA,CAAmB,MAAM,CAAA;AAAE,WAClE;AACA,UAAA,QAAA,GAAY,IAAI,SAAA,IAAoC,IAAA;AACpD,UAAA,YAAA,GAAgB,IAAI,aAAA,IAAwC,YAAA;AAAA,QAC9D,SAAS,GAAA,EAAK;AAGZ,UAAA,IAAI,GAAA,YAAe,cAAc,MAAM,IAAI,aAAa,GAAA,EAAK,MAAA,CAAO,GAAA,CAAI,OAAO,CAAC,CAAA;AAAA,QAElF;AAAA,MACF;AACA,MAAA,IAAI;AACF,QAAA,OAAO,MAAM,kBAAkB,QAAA,EAAU,IAAA,CAAK,YAAY,IAAA,CAAK,OAAA,IAAW,EAAA,EAAI,WAAA,EAAa,KAAA,EAAO;AAAA,UAChG,QAAA;AAAA,UACA,YAAA;AAAA,UACA,QAAQ,IAAA,CAAK;AAAA,SACd,CAAA;AAAA,MACH,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,MACzC;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,iBAAiB,KAAA,EAK4B;AACjD,MAAA,MAAM,IAAA,GAAO,CAAC,OAAA,EAAkB,OAAA,EAAiB,KAAA,GAAwC,SACvF,cAAA,CAAe,OAAA,EAAS,OAAA,EAAS,YAAA,EAAc,KAAK,CAAA;AACtD,MAAA,IAAI,MAAM,KAAA,EAAO;AACf,QAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,KAAA,EAAO,KAAA,CAAM,qBAAqB,KAAA,CAAM,KAAK,CAAA,EAAG,WAAA,EAAa,WAAA,EAAY;AAAA,MAC/F;AACA,MAAA,IAAI,CAAC,KAAA,CAAM,IAAA,IAAQ,CAAC,MAAM,KAAA,EAAO;AAC/B,QAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,OAAO,iCAAiC,CAAA,EAAG,aAAa,WAAA,EAAY;AAAA,MAC1F;AACA,MAAA,IAAI;AACF,QAAA,MAAM,cAAc,MAAM,oBAAA,CAAqB,MAAM,KAAA,EAAO,KAAA,CAAM,MAAM,KAAA,EAAO;AAAA,UAC7E,OAAO,MAAA,CAAO,KAAA;AAAA,UACd,YAAA,EAAc,mBAAmB,MAAM;AAAA,SACxC,CAAA;AACD,QAAA,OAAO;AAAA,UACL,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,wBAAA,EAA0B;AAAA,YACzC,cAAc,WAAA,CAAY,YAAA;AAAA,YAC1B,eAAe,WAAA,CAAY,aAAA;AAAA,YAC3B,UAAA,EAAY,YAAY,UAAA,IAAc,QAAA;AAAA,YACtC,YAAY,WAAA,CAAY,UAAA;AAAA,YACxB,OAAO,WAAA,CAAY,KAAA;AAAA,YACnB,SAAS,WAAA,CAAY;AAAA,WACtB,CAAA;AAAA,UACD,WAAA,EAAa;AAAA,SACf;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,OAAO,EAAE,MAAM,IAAA,CAAK,KAAA,EAAO,OAAO,GAAG,CAAC,CAAA,EAAG,WAAA,EAAa,WAAA,EAAY;AAAA,MACpE;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,kBAAA,CACJ,KAAA,EACA,UAAA,EACkC;AAClC,MAAA,MAAM,MAAA,GAAS,aAAA,CAAc,UAAA,EAAY,gBAAgB,CAAA;AACzD,MAAA,MAAM,OAAA,GAAU,MAAM,aAAA,CAAc,MAAA,EAAQ;AAAA,QAC1C,QAAQ,KAAA,CAAM,MAAA;AAAA,QACd,UAAU,KAAA,CAAM,SAAA;AAAA,QAChB,UAAA,EAAY;AAAA,OACb,CAAA;AACD,MAAA,OAAO,EAAE,SAAA,EAAW,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA,EAAE;AAAA,IAChD,CAAA;AAAA,IAEA,MAAM,oBAAA,CACJ,UAAA,EACA,IAAA,EACA,UAAA,EACkC;AAClC,MAAA,MAAM,MAAA,GAAS,aAAA,CAAc,UAAA,EAAY,uCAAuC,CAAA;AAChF,MAAA,MAAM,QAAA,GAAW,WAAW,UAAU,CAAA;AACtC,MAAA,IAAI;AACF,QAAA,MAAM,SAAS,MAAM,eAAA;AAAA,UACnB,MAAA;AAAA,UACA,QAAA;AAAA,UACA,IAAA,CAAK,QAAA;AAAA,UACL,IAAA,CAAK,QAAA;AAAA,UACL,KAAK,IAAA,IAAQ,IAAA;AAAA,UACb;AAAA,YACE,UAAA,EAAY;AAAA;AACd,SACF;AACA,QAAA,OAAO,aAAa,MAAM,CAAA;AAAA,MAC5B,SAAS,GAAA,EAAK;AACZ,QAAA,IAAI,eAAe,kBAAA,EAAoB;AACrC,UAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,CAAA,sBAAA,EAAyB,GAAA,CAAI,OAAO,CAAA,CAAE,CAAA;AAAA,QACpE;AACA,QAAA,IAAI,eAAe,eAAA,EAAiB;AAClC,UAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,kBAAkB,CAAA;AAAA,QAChD;AACA,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF;AAAA,GACF;AACF;;;AH/lBA,IAAMZ,QAAAA,GAAUC,sBAAAA,CAAc,0PAAe,CAAA;AAmD7C,SAAS,WAAA,GAA2C;AAClD,EAAA,IAAI;AACF,IAAA,OAAOD,SAAQ,MAAM,CAAA;AAAA,EACvB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA,CAAkB,MAAA,EAAQ,MAAA,EAAQ,kBAAkB,CAAA;AAAA,EAChE;AACF;AAEA,SAAS,SAAA,CAAU,GAAkD,GAAA,EAAmB;AACtF,EAAA,OAAO,CAAA,CAAE,KAAK,EAAE,MAAA,EAAQ,IAAI,MAAA,EAAO,EAAG,IAAI,MAAa,CAAA;AACzD;AAEA,eAAe,SACb,CAAA,EAC2F;AAC3F,EAAA,MAAM,IAAA,GAAO,MAAM,CAAA,CAAE,GAAA,CAAI,UAAU,EAAE,GAAA,EAAK,MAAM,CAAA;AAChD,EAAA,MAAM,OAAO,IAAA,CAAK,IAAA;AAClB,EAAA,MAAM,SAAkC,EAAC;AACzC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,IAAI,CAAA,EAAG;AACzC,IAAA,IAAI,CAAA,KAAM,MAAA,EAAQ,MAAA,CAAO,CAAC,CAAA,GAAI,CAAA;AAAA,EAChC;AACA,EAAA,OAAO,EAAE,MAAM,MAAA,EAAO;AACxB;AAEO,SAAS,gBAAA,CAAiB,QAAgB,IAAA,EAAyB;AACxE,EAAA,IAAI,CAAC,IAAA,EAAM,IAAA,IAAQ,CAAC,MAAM,UAAA,EAAY;AACpC,IAAA,MAAM,IAAI,UAAU,+CAA+C,CAAA;AAAA,EACrE;AACA,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,WAAA,EAAY;AAC7B,EAAA,MAAM,GAAA,GAAM,IAAI,IAAA,EAAK;AACrB,EAAA,MAAM,QAAQ,mBAAA,CAAoB,MAAA,EAAQ,EAAE,eAAA,EAAiB,IAAA,CAAK,iBAAiB,CAAA;AAEnF,EAAA,GAAA,CAAI,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA,EAAG,IAAA,KAAS;AAC9B,IAAA,IAAI,CAAA,CAAE,GAAA,CAAI,IAAA,KAAS,uBAAA,SAAgC,IAAA,EAAK;AACxD,IAAA,MAAM,IAAA,CAAK,KAAK,CAAC,CAAA;AACjB,IAAA,MAAM,IAAA,EAAK;AAAA,EACb,CAAC,CAAA;AAED,EAAA,MAAM,IAAA,GAAO,CAAC,EAAA,KAA6C,OAAO,CAAA,KAAmB;AACnF,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,EAAA,CAAG,CAAC,CAAA;AACzB,MAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,UAAW,MAAA,EAAmB;AACxE,QAAA,MAAM,IAAA,GAAO,MAAA;AACb,QAAA,OAAO,CAAA,CAAE,IAAA,CAAK,IAAA,CAAK,IAAI,CAAA;AAAA,MACzB;AACA,MAAA,OAAO,CAAA,CAAE,KAAK,MAAM,CAAA;AAAA,IACtB,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAe,YAAA,EAAc,OAAO,SAAA,CAAU,GAAG,GAAG,CAAA;AACxD,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAA;AAEA,EAAA,GAAA,CAAI,IAAA;AAAA,IACF,YAAA;AAAA,IACA,IAAA,CAAK,OAAO,CAAA,KAAM;AAChB,MAAA,MAAM,EAAA,GAAK,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,cAAc,CAAA,IAAK,EAAA;AAC3C,MAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC,CAAA;AAC1C,MAAA,IAAI,EAAA,CAAG,UAAA,CAAW,qBAAqB,CAAA,EAAG;AACxC,QAAA,MAAM,EAAE,IAAA,EAAM,MAAA,EAAO,GAAI,MAAM,SAAS,CAAC,CAAA;AACzC,QAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,YAAA,CAAa,KAAK,0CAA0C,CAAA;AACjF,QAAA,MAAM,UAAU,IAAA,CAAK,IAAA,IAAQ,MAAA,CAAO,IAAA,CAAK,EAAE,CAAA;AAC3C,QAAA,OAAO,iBAAiB,MAAA,EAAQ;AAAA,UAC9B,OAAA;AAAA,UACA,QAAA,EAAU,KAAK,QAAA,IAAY,IAAA;AAAA,UAC3B,IAAA,EAAM,MAAA;AAAA,UACN;AAAA,SACD,CAAA;AAAA,MACH;AACA,MAAA,IAAI,EAAA,CAAG,UAAA,CAAW,kBAAkB,CAAA,EAAG;AACrC,QAAA,MAAM,OAAA,GAAU,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,EAAK;AACjC,QAAA,OAAO,gBAAA,CAAiB,MAAA,EAAQ,OAAA,EAAS,UAAU,CAAA;AAAA,MACrD;AACA,MAAA,MAAM,IAAI,YAAA,CAAa,GAAA,EAAK,8DAA8D,CAAA;AAAA,IAC5F,CAAC;AAAA,GACH;AAEA,EAAA,GAAA,CAAI,GAAA;AAAA,IACF,YAAA;AAAA,IACA,IAAA;AAAA,MAAK,OAAO,CAAA,KACV,mBAAA,CAAoB,MAAA,EAAQ;AAAA,QAC1B,QAAA,EAAU,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,WAAW,CAAA,IAAK,IAAA;AAAA,QACtC,OAAO,MAAA,CAAO,CAAA,CAAE,IAAI,KAAA,CAAM,OAAO,KAAK,EAAE,CAAA;AAAA,QACxC,MAAA,EAAQ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,QAAQ,CAAA,IAAK,IAAA;AAAA,QACjC,UAAA,EAAY,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC;AAAA,OACpC;AAAA;AACH,GACF;AAEA,EAAA,GAAA,CAAI,GAAA;AAAA,IACF,yBAAA;AAAA,IACA,IAAA,CAAK,OAAO,CAAA,KAAM,iBAAA,CAAkB,QAAQ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,aAAa,GAAG,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC,CAAC,CAAC;AAAA,GACnG;AACA,EAAA,GAAA,CAAI,MAAA;AAAA,IACF,yBAAA;AAAA,IACA,IAAA,CAAK,OAAO,CAAA,KAAM,oBAAA,CAAqB,QAAQ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,aAAa,GAAG,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC,CAAC,CAAC;AAAA,GACtG;AACA,EAAA,GAAA,CAAI,KAAA;AAAA,IACF,yBAAA;AAAA,IACA,IAAA;AAAA,MAAK,OAAO,CAAA,KACV,oBAAA,CAAqB,QAAQ,CAAA,CAAE,GAAA,CAAI,MAAM,aAAa,CAAA,EAAG,MAAM,CAAA,CAAE,IAAI,IAAA,EAAK,EAAG,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC,CAAC;AAAA;AACvG,GACF;AACA,EAAA,GAAA,CAAI,IAAA;AAAA,IACF,SAAA;AAAA,IACA,IAAA,CAAK,OAAO,CAAA,KAAM,YAAA,CAAa,QAAQ,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,IAAQ,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC,CAAC,CAAC;AAAA,GACtF;AACA,EAAA,GAAA,CAAI,GAAA;AAAA,IACF,QAAA;AAAA,IACA,IAAA,CAAK,OAAO,CAAA,KAAM,WAAA,CAAY,MAAA,EAAQ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,WAAW,CAAA,IAAK,IAAI,CAAC;AAAA,GACzE;AAEA,EAAA,GAAA,CAAI,IAAA;AAAA,IACF,QAAA;AAAA,IACA,IAAA,CAAK,OAAO,CAAA,KAAM,KAAA,CAAM,WAAW,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,IAAQ,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC,CAAC,CAAC;AAAA,GAClF;AACA,EAAA,GAAA,CAAI,GAAA;AAAA,IACF,QAAA;AAAA,IACA,IAAA;AAAA,MAAK,OAAO,CAAA,KACV,KAAA,CAAM,cAAA,CAAe,EAAE,WAAW,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,WAAW,GAAE,EAAG,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC,CAAC;AAAA;AACxF,GACF;AACA,EAAA,GAAA,CAAI,GAAA;AAAA,IACF,qBAAA;AAAA,IACA,IAAA,CAAK,OAAO,CAAA,KAAM,KAAA,CAAM,eAAA,CAAgB,EAAE,GAAA,CAAI,KAAA,CAAM,MAAM,CAAC,CAAC;AAAA,GAC9D;AACA,EAAA,GAAA,CAAI,IAAA;AAAA,IACF,aAAA;AAAA,IACA,IAAA,CAAK,OAAO,CAAA,KAAM,KAAA,CAAM,aAAA,CAAc,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,EAAM,CAAC;AAAA,GAC3D;AACA,EAAA,GAAA,CAAI,IAAA;AAAA,IACF,gBAAA;AAAA,IACA,IAAA;AAAA,MAAK,OAAO,MACV,KAAA,CAAM,gBAAA;AAAA,QACH,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,EAAK;AAAA,QAClB,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC,CAAA;AAAA,QACvB,KAAK,aAAA,GAAgB,MAAM,IAAA,CAAK,aAAA,CAAc,CAAC,CAAA,GAAI;AAAA;AACrD;AACF,GACF;AACA,EAAA,GAAA,CAAI,GAAA;AAAA,IACF,iBAAA;AAAA,IACA,IAAA,CAAK,OAAO,CAAA,KAAM,KAAA,CAAM,QAAQ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,SAAS,GAAG,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC,CAAC,CAAC;AAAA,GACnF;AACA,EAAA,GAAA,CAAI,KAAA;AAAA,IACF,iBAAA;AAAA,IACA,IAAA;AAAA,MAAK,OAAO,MACV,KAAA,CAAM,eAAA;AAAA,QACJ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,SAAS,CAAA;AAAA,QACpB,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,EAAK;AAAA,QAClB,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC;AAAA;AACzB;AACF,GACF;AACA,EAAA,GAAA,CAAI,MAAA;AAAA,IACF,iBAAA;AAAA,IACA,IAAA,CAAK,OAAO,CAAA,KAAM,KAAA,CAAM,gBAAgB,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,SAAS,GAAG,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC,CAAC,CAAC;AAAA,GAC3F;AACA,EAAA,GAAA,CAAI,IAAA;AAAA,IACF,uBAAA;AAAA,IACA,IAAA,CAAK,OAAO,CAAA,KAAM,KAAA,CAAM,iBAAA,CAAmB,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,EAA+C,CAAC;AAAA,GACzG;AACA,EAAA,GAAA,CAAI,IAAA;AAAA,IACF,kBAAA;AAAA,IACA,IAAA,CAAK,OAAO,CAAA,KAAM,KAAA,CAAM,aAAA,CAAe,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,EAAiC,CAAC;AAAA,GACvF;AACA,EAAA,GAAA,CAAI,GAAA;AAAA,IACF,uBAAA;AAAA,IACA,IAAA,CAAK,OAAO,CAAA,KAAM,KAAA,CAAM,iBAAiB,CAAA,CAAE,GAAA,CAAI,KAAA,EAAO,CAAC;AAAA,GACzD;AACA,EAAA,GAAA,CAAI,GAAA;AAAA,IACF,YAAA;AAAA,IACA,IAAA;AAAA,MAAK,OAAO,MACV,KAAA,CAAM,kBAAA;AAAA,QACJ,EAAE,MAAA,EAAQ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,QAAQ,CAAA,EAAG,SAAA,EAAW,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,WAAW,CAAA,EAAE;AAAA,QACrE,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC;AAAA;AACzB;AACF,GACF;AACA,EAAA,GAAA,CAAI,IAAA;AAAA,IACF,iCAAA;AAAA,IACA,IAAA;AAAA,MAAK,OAAO,MACV,KAAA,CAAM,oBAAA;AAAA,QACJ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,aAAa,CAAA;AAAA,QACxB,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,EAAK;AAAA,QAClB,MAAM,IAAA,CAAK,UAAA,CAAW,CAAC;AAAA;AACzB;AACF,GACF;AAEA,EAAA,OAAO,GAAA;AACT;AAEO,IAAM,aAAA,GAAgB","file":"hono.cjs","sourcesContent":["/** Action-surface errors — user-facing / data-dependent failures (not found, ACL, bad input).\n * Config/programming errors stay as TypeError / RangeError / Error.\n */\nexport class EngineActionError extends Error {\n constructor(message: string) {\n super(message);\n this.name = \"EngineActionError\";\n }\n}\n\n/** Missing vs forbidden document: identical message so callers cannot distinguish. */\nexport class DocumentNotFoundError extends Error {\n constructor(documentId: string) {\n super(`document not found: ${documentId}`);\n this.name = \"DocumentNotFoundError\";\n }\n}\n\nexport class GraphLegUnavailable extends Error {\n constructor(message = \"graph ranked list was not supplied\") {\n super(message);\n this.name = \"GraphLegUnavailable\";\n }\n}\n\nexport class ApprovalNotPending extends Error {\n constructor(message = \"approval is not pending\") {\n super(message);\n this.name = \"ApprovalNotPending\";\n }\n}\n\nexport class ApprovalExpired extends Error {\n constructor(message = \"approval has expired\") {\n super(message);\n this.name = \"ApprovalExpired\";\n }\n}\n\nexport class CodeExecutionError extends Error {\n constructor(message: string) {\n super(message);\n this.name = \"CodeExecutionError\";\n }\n}\n\nexport class CodeExecutionTimeout extends Error {\n constructor(message = \"code execution timed out\") {\n super(message);\n this.name = \"CodeExecutionTimeout\";\n }\n}\n\nexport class ExtraMissingError extends Error {\n constructor(extra: string, pkg: string, what: string) {\n super(`${what} requires the '${pkg}' package (optional extra: ${extra}): npm install ${pkg}`);\n this.name = \"ExtraMissingError\";\n }\n}\n","import { createRequire } from \"node:module\";\nimport { ExtraMissingError } from \"../../errors.js\";\n\nconst require = createRequire(import.meta.url);\n\nexport const MAX_ROWS = 1000;\nconst CONNECT_TIMEOUT = 10;\nconst QUERY_TIMEOUT_MS = 30_000;\n\nconst ALWAYS_BLOCKED = [\"GRANT\", \"REVOKE\"] as const;\nconst READONLY_BLOCKED = [\n \"INSERT\",\n \"UPDATE\",\n \"DELETE\",\n \"MERGE\",\n \"DROP\",\n \"ALTER\",\n \"CREATE\",\n \"TRUNCATE\",\n \"DO\",\n \"CALL\",\n] as const;\n// `DO` blocks and `CALL`ed procedures run arbitrary server-side code the\n// keyword guard cannot see through, so below `full` mode they are refused\n// outright; in `full` mode the database role's own privileges are the boundary.\nconst READWRITE_BLOCKED = [\"DELETE\", \"DROP\", \"TRUNCATE\", \"DO\", \"CALL\"] as const;\nconst ALLOWED_ACCESS_MODES = [\"readonly\", \"readwrite\", \"full\"] as const;\ntype AccessMode = (typeof ALLOWED_ACCESS_MODES)[number];\n\n// STANDARD lexing model: '' is the only escape inside '...', except in an\n// E'...' literal, which Postgres always reads with backslash escapes.\nconst SQL_NOISE_RE = /\\b[eE]'(?:[^'\\\\]|\\\\[\\s\\S]|'')*'|'(?:[^']|'')*'|--[^\\n]*|\\/\\*[\\s\\S]*?\\*\\//g;\n\n// The same noise under the BACKSLASH lexing model: MySQL (and Postgres with\n// `standard_conforming_strings` off) escapes a quote inside a plain '...'\n// literal with a backslash. The two models disagree about where a literal\n// ENDS, so a query can be a harmless SELECT under one and carry a `DROP`\n// under the other (`SELECT 'a\\' x '; DROP TABLE t; -- '`). The guard cannot\n// know which model the target engine speaks — it checks BOTH and refuses if\n// either reveals a blocked statement (fail closed).\nconst SQL_NOISE_BACKSLASH_RE = /'(?:[^'\\\\]|\\\\[\\s\\S]|'')*'|--[^\\n]*|\\/\\*[\\s\\S]*?\\*\\//g;\n\n// Dollar-quoted bodies (`$$...$$`, `$tag$...$tag$`) are deliberately NOT\n// blanked by either regex. They are CODE — `DO` blocks and function bodies —\n// far more often than data, and a `DELETE` inside one is exactly what this\n// guard exists to see. Blanking them let `DO $$ BEGIN DELETE FROM t; END $$`\n// pass read-write mode. A keyword inside a dollar-quoted string literal is\n// a false positive that fails closed.\nexport function stripSqlNoise(sql: string): string {\n return sql.replace(SQL_NOISE_RE, (m) => \" \".repeat(m.length));\n}\n\n/** `stripSqlNoise` under the backslash lexing model — see `SQL_NOISE_BACKSLASH_RE`. */\nfunction stripSqlNoiseBackslash(sql: string): string {\n return sql.replace(SQL_NOISE_BACKSLASH_RE, (m) => \" \".repeat(m.length));\n}\n\nfunction hasKeyword(sqlUpper: string, keyword: string): boolean {\n return new RegExp(`\\\\b${keyword}\\\\b`).test(sqlUpper);\n}\n\nexport function buildConnectionUrl(config: Record<string, unknown>): string {\n const engine = String(config.engine ?? \"postgresql\");\n if (engine === \"sqlite\") return `sqlite:///${config.database ?? \"\"}`;\n\n const host = String(config.host ?? \"localhost\");\n const port = Number(config.port ?? 5432);\n const database = String(config.database ?? \"\");\n const username = String(config.username ?? \"\");\n const password = encodeURIComponent(String(config.password ?? \"\"));\n\n if (engine === \"oracle\") {\n const serviceName = String(config.service_name ?? database);\n return `oracle://${username}:${password}@${host}:${port}/?service_name=${serviceName}`;\n }\n if (engine === \"snowflake\") {\n const schemaName = String(config.schema_name ?? \"PUBLIC\");\n const warehouse = String(config.warehouse ?? \"\");\n let url = `snowflake://${username}:${password}@${host}/${database}/${schemaName}`;\n if (warehouse) url += `?warehouse=${warehouse}`;\n return url;\n }\n if (engine === \"clickhouse\") {\n const secure = [9440, 8443, 443].includes(port);\n return `clickhouse://${username}:${password}@${host}:${port}/${database}${secure ? \"?secure=True\" : \"\"}`;\n }\n if (engine === \"mysql\" || engine === \"mariadb\") {\n return `mysql://${username}:${password}@${host}:${port}/${database}`;\n }\n if (engine === \"mssql\") {\n return `mssql://${username}:${password}@${host}:${port}/${database}`;\n }\n return `postgresql://${username}:${password}@${host}:${port}/${database}`;\n}\n\nfunction rowsToText(rows: Array<Record<string, unknown>>): string {\n if (!rows.length) return \"\";\n const columns = Object.keys(rows[0]!);\n const lines = [columns.join(\"\\t\")];\n for (const row of rows) {\n lines.push(columns.map((col) => String(row[col] ?? \"\")).join(\"\\t\"));\n }\n return lines.join(\"\\n\");\n}\n\ntype QueryResult = {\n columns: string[];\n rows: Array<Record<string, unknown>>;\n rowCount: number;\n};\n\nasync function runOnPostgres(\n config: Record<string, unknown>,\n sql: string,\n maxRows: number,\n readOnly = false,\n): Promise<QueryResult> {\n let pg: typeof import(\"pg\");\n try {\n pg = require(\"pg\") as typeof import(\"pg\");\n } catch {\n throw new ExtraMissingError(\"postgres\", \"pg\", \"database tool executor\");\n }\n const url = buildConnectionUrl({ ...config, engine: \"postgresql\" });\n const client = new pg.Client({\n connectionString: url,\n connectionTimeoutMillis: CONNECT_TIMEOUT * 1000,\n statement_timeout: QUERY_TIMEOUT_MS,\n });\n await client.connect();\n try {\n await client.query(\"BEGIN\");\n if (readOnly) {\n try {\n await client.query(\"SET TRANSACTION READ ONLY\");\n } catch (exc) {\n await client.query(\"ROLLBACK\");\n console.warn(\n \"[context-engine] db executor: engine rejected SET TRANSACTION READ ONLY; \" +\n \"read-only mode is enforced by statement inspection alone for this query\",\n exc,\n );\n await client.query(\"BEGIN\");\n }\n }\n const result = await client.query(sql);\n await client.query(\"COMMIT\");\n const columns = result.fields?.map((f) => f.name) ?? (result.rows[0] ? Object.keys(result.rows[0]) : []);\n const rows = result.rows.slice(0, maxRows).map((r) => ({ ...r }));\n return { columns, rows, rowCount: result.rowCount ?? rows.length };\n } catch (e) {\n try {\n await client.query(\"ROLLBACK\");\n } catch {\n /* ignore */\n }\n throw e;\n } finally {\n await client.end();\n }\n}\n\nasync function runOnMysql(\n config: Record<string, unknown>,\n sql: string,\n maxRows: number,\n): Promise<QueryResult> {\n let mysql: {\n createConnection: (opts: Record<string, unknown>) => Promise<{\n query: (sql: string) => Promise<[unknown[], { name: string }[]]>;\n end: () => Promise<void>;\n }>;\n };\n try {\n mysql = require(\"mysql2/promise\");\n } catch {\n throw new ExtraMissingError(\"mysql\", \"mysql2\", \"MySQL/MariaDB tool executor\");\n }\n const conn = await mysql.createConnection({\n host: config.host ?? \"localhost\",\n port: Number(config.port ?? 3306),\n user: config.username ?? \"\",\n password: config.password ?? \"\",\n database: config.database ?? \"\",\n connectTimeout: CONNECT_TIMEOUT * 1000,\n });\n try {\n const [rows, fields] = await conn.query(sql);\n const list = Array.isArray(rows) ? (rows as Array<Record<string, unknown>>) : [];\n const columns = (fields ?? []).map((f) => f.name);\n return { columns, rows: list.slice(0, maxRows), rowCount: list.length };\n } finally {\n await conn.end();\n }\n}\n\nasync function executeRaw(\n config: Record<string, unknown>,\n sql: string,\n maxRows: number,\n readOnly = false,\n): Promise<QueryResult> {\n const engine = String(config.engine ?? \"postgresql\");\n if (engine === \"postgresql\") return runOnPostgres(config, sql, maxRows, readOnly);\n if (engine === \"mysql\" || engine === \"mariadb\") return runOnMysql(config, sql, maxRows);\n throw new Error(\n `db executor: engine ${JSON.stringify(engine)} is not supported in the JS port ` +\n `(supported: postgresql, mysql, mariadb)`,\n );\n}\n\nexport function executeQuery(\n config: Record<string, unknown>,\n sql: string,\n maxRows: number = MAX_ROWS,\n accessMode: string = \"readonly\",\n): Promise<Record<string, unknown>> {\n return executeQueryAsync(config, sql, maxRows, accessMode);\n}\n\nasync function executeQueryAsync(\n config: Record<string, unknown>,\n sql: string,\n maxRows: number,\n accessModeRaw: string,\n): Promise<Record<string, unknown>> {\n const accessMode = (accessModeRaw || \"readonly\") as AccessMode;\n if (!(ALLOWED_ACCESS_MODES as readonly string[]).includes(accessMode)) {\n throw new Error(\n `Invalid access_mode ${JSON.stringify(accessModeRaw)}; must be one of ${ALLOWED_ACCESS_MODES}`,\n );\n }\n\n // Both lexing models are checked and BOTH must pass — see\n // SQL_NOISE_BACKSLASH_RE for the smuggle either one alone allows.\n const sqlVariants = [\n stripSqlNoise(sql).trim().toUpperCase(),\n stripSqlNoiseBackslash(sql).trim().toUpperCase(),\n ];\n const sqlUpper = sqlVariants[0]!;\n\n // Privilege escalation is refused in every mode, and checked against the\n // RAW text too: dynamic SQL (`EXECUTE 'GRANT ...'` in a DO block) carries\n // the keyword inside a string literal the strippers blank. A false\n // positive on the word \"grant\" in data is the price; it fails closed.\n for (const keyword of ALWAYS_BLOCKED) {\n if ([...sqlVariants, sql.toUpperCase()].some((v) => hasKeyword(v, keyword))) {\n return { success: false, error: `${keyword} queries are not allowed` };\n }\n }\n\n if (accessMode === \"readonly\") {\n if (!sqlVariants.every((v) => v.startsWith(\"SELECT\") || v.startsWith(\"WITH\"))) {\n return { success: false, error: \"Only SELECT queries are allowed in read-only mode\" };\n }\n for (const keyword of READONLY_BLOCKED) {\n if (sqlVariants.some((v) => hasKeyword(v, keyword))) {\n return { success: false, error: `${keyword} queries are not allowed in read-only mode` };\n }\n }\n } else if (accessMode === \"readwrite\") {\n for (const keyword of READWRITE_BLOCKED) {\n if (sqlVariants.some((v) => hasKeyword(v, keyword))) {\n return { success: false, error: `${keyword} queries are not allowed in read-write mode` };\n }\n }\n }\n\n try {\n const result = await executeRaw(config, sql, maxRows, accessMode === \"readonly\");\n\n if (!sqlUpper.startsWith(\"SELECT\") && !sqlUpper.startsWith(\"WITH\")) {\n return {\n success: true,\n columns: [],\n rows: [],\n row_count: result.rowCount,\n affected_rows: result.rowCount,\n truncated: false,\n };\n }\n\n return {\n success: true,\n columns: result.columns,\n rows: result.rows,\n row_count: result.rows.length,\n truncated: result.rows.length >= maxRows,\n text: rowsToText(result.rows),\n };\n } catch (e) {\n return { success: false, error: String(e) };\n }\n}\n\nexport async function executeDb(\n config: Record<string, unknown>,\n sql: string,\n): Promise<Record<string, unknown>> {\n const maxRows = Number(config.max_rows ?? MAX_ROWS);\n const accessMode = String(config.access_mode ?? \"readonly\");\n return executeQueryAsync(config, sql, maxRows, accessMode);\n}\n\nexport async function testConnection(config: Record<string, unknown>): Promise<Record<string, unknown>> {\n const engineType = String(config.engine ?? \"postgresql\");\n const versionQueries: Record<string, string> = {\n postgresql: \"SELECT version()\",\n mysql: \"SELECT version()\",\n mariadb: \"SELECT version()\",\n mssql: \"SELECT @@VERSION\",\n sqlite: \"SELECT sqlite_version()\",\n oracle: \"SELECT banner FROM v$version WHERE ROWNUM = 1\",\n clickhouse: \"SELECT version()\",\n snowflake: \"SELECT CURRENT_VERSION()\",\n };\n const q = versionQueries[engineType] ?? \"SELECT version()\";\n const result = await executeQueryAsync(config, q, 1, \"readonly\");\n if (!result.success) return { success: false, error: result.error };\n const version = (result.rows as Array<Record<string, unknown>>)?.[0]\n ? Object.values((result.rows as Array<Record<string, unknown>>)[0]!)[0]\n : null;\n return {\n success: true,\n version: String(version),\n host: config.host,\n database: config.database,\n engine: engineType,\n };\n}\n\nexport async function fetchSchema(\n config: Record<string, unknown>,\n selectedTables?: string[] | null,\n): Promise<Record<string, unknown>> {\n const engine = String(config.engine ?? \"postgresql\");\n if (engine !== \"postgresql\") {\n return { success: false, error: `schema introspection is implemented for postgresql (got ${engine})` };\n }\n let pg: typeof import(\"pg\");\n try {\n pg = require(\"pg\") as typeof import(\"pg\");\n } catch {\n throw new ExtraMissingError(\"postgres\", \"pg\", \"database tool executor\");\n }\n const client = new pg.Client({ connectionString: buildConnectionUrl(config) });\n await client.connect();\n try {\n const schemaName = String(config.schema_name ?? \"public\");\n const tablesRes = await client.query(\n `SELECT table_name, table_type FROM information_schema.tables WHERE table_schema = $1`,\n [schemaName],\n );\n let items = tablesRes.rows.map((r) => ({\n name: String(r.table_name),\n type: String(r.table_type).toLowerCase().includes(\"view\") ? \"view\" : \"table\",\n }));\n if (selectedTables?.length) {\n const selected = new Set(selectedTables);\n items = items.filter((i) => selected.has(i.name));\n }\n const tables = [];\n for (const item of items) {\n const cols = await client.query(\n `SELECT column_name, data_type, is_nullable FROM information_schema.columns\n WHERE table_schema = $1 AND table_name = $2 ORDER BY ordinal_position`,\n [schemaName, item.name],\n );\n tables.push({\n name: item.name,\n type: item.type,\n columns: cols.rows.map((c) => ({\n name: c.column_name,\n type: c.data_type,\n nullable: c.is_nullable === \"YES\",\n })),\n row_count: 0,\n });\n }\n return {\n success: true,\n database: config.database,\n schema: schemaName,\n tables,\n table_count: tables.length,\n all_tables: items.map((i) => i.name),\n };\n } finally {\n await client.end();\n }\n}\n\nexport async function getSchemaText(\n config: Record<string, unknown>,\n selectedTables?: string[] | null,\n): Promise<string> {\n const schema = await fetchSchema(config, selectedTables);\n const schemaRows: Array<Record<string, unknown>> = [];\n for (const table of (schema.tables as Array<Record<string, unknown>> | undefined) ?? []) {\n const kind = table.type ?? \"table\";\n for (const c of (table.columns as Array<Record<string, unknown>>) ?? []) {\n schemaRows.push({\n table: table.name,\n table_type: kind,\n column: c.name,\n type: String(c.type).toUpperCase(),\n pk: c.pk ?? false,\n fk: c.fk ?? \"\",\n rows: table.row_count,\n });\n }\n }\n return rowsToText(schemaRows);\n}\n","import { createRequire } from \"node:module\";\nimport { ExtraMissingError } from \"./errors.js\";\n\nconst require = createRequire(import.meta.url);\n\nimport {\n HandlerError,\n handleDeleteDocument,\n handleGetDocument,\n handleIngestFile,\n handleIngestJson,\n handleListDocuments,\n handleSearch,\n handleStats,\n handleUpdateDocument,\n} from \"./routing-core.js\";\nimport { createToolsHandlers, MCP_OAUTH_CALLBACK_PATH } from \"./tools/router.js\";\n\ntype Engine = Parameters<typeof handleIngestJson>[0] & Parameters<typeof createToolsHandlers>[0];\n\nexport type HonoRouterOptions = {\n auth: (c: unknown) => unknown | Promise<unknown>;\n principals: (c: unknown) => unknown | Promise<unknown>;\n /** Server-side resolver for the approval claim scope on `POST\n * /tools/execute` (a run id is the expected shape). Never read from the\n * body. Omitted = unscoped execution, the deprecated legacy path. */\n approvalScope?: (c: unknown) => unknown | Promise<unknown>;\n redirectBaseUrl?: string;\n};\n\ntype HonoContext = {\n req: {\n path: string;\n header: (name: string) => string | undefined;\n query: {\n (): Record<string, string>;\n (name: string): string | undefined;\n };\n param: (name: string) => string;\n json: () => Promise<unknown>;\n parseBody: (opts?: Record<string, unknown>) => Promise<Record<string, unknown>>;\n };\n json: (body: unknown, status?: number) => unknown;\n html: (html: string) => unknown;\n};\n\ntype HonoApp = {\n use: (path: string, handler: (c: HonoContext, next: () => Promise<void>) => Promise<unknown>) => unknown;\n post: (path: string, handler: (c: HonoContext) => Promise<unknown>) => unknown;\n get: (path: string, handler: (c: HonoContext) => Promise<unknown>) => unknown;\n delete: (path: string, handler: (c: HonoContext) => Promise<unknown>) => unknown;\n patch: (path: string, handler: (c: HonoContext) => Promise<unknown>) => unknown;\n};\n\nfunction requireHono(): { Hono: new () => HonoApp } {\n try {\n return require(\"hono\") as { Hono: new () => HonoApp };\n } catch {\n throw new ExtraMissingError(\"hono\", \"hono\", \"createHonoRouter\");\n }\n}\n\nfunction jsonError(c: { json: (b: unknown, s?: number) => unknown }, exc: HandlerError) {\n return c.json({ detail: exc.detail }, exc.status as 400);\n}\n\nasync function readForm(\n c: HonoContext,\n): Promise<{ file?: { data?: Buffer; filename?: string }; fields: Record<string, unknown> }> {\n const body = await c.req.parseBody({ all: true });\n const file = body.file as { data?: Buffer; filename?: string } | undefined;\n const fields: Record<string, unknown> = {};\n for (const [k, v] of Object.entries(body)) {\n if (k !== \"file\") fields[k] = v;\n }\n return { file, fields };\n}\n\nexport function createHonoRouter(engine: Engine, opts: HonoRouterOptions) {\n if (!opts?.auth || !opts?.principals) {\n throw new TypeError(\"createHonoRouter requires auth and principals\");\n }\n const { Hono } = requireHono();\n const app = new Hono();\n const tools = createToolsHandlers(engine, { redirectBaseUrl: opts.redirectBaseUrl });\n\n app.use(\"*\", async (c, next) => {\n if (c.req.path === MCP_OAUTH_CALLBACK_PATH) return next();\n await opts.auth(c);\n await next();\n });\n\n const wrap = (fn: (c: HonoContext) => Promise<unknown>) => async (c: HonoContext) => {\n try {\n const result = await fn(c);\n if (result && typeof result === \"object\" && \"html\" in (result as object)) {\n const html = result as { html: string; contentType?: string };\n return c.html(html.html);\n }\n return c.json(result);\n } catch (exc) {\n if (exc instanceof HandlerError) return jsonError(c, exc);\n throw exc;\n }\n };\n\n app.post(\n \"/documents\",\n wrap(async (c) => {\n const ct = c.req.header(\"content-type\") ?? \"\";\n const principals = await opts.principals(c);\n if (ct.startsWith(\"multipart/form-data\")) {\n const { file, fields } = await readForm(c);\n if (!file) throw new HandlerError(400, \"multipart upload requires a 'file' field\");\n const content = file.data ?? Buffer.from([]);\n return handleIngestFile(engine, {\n content,\n filename: file.filename ?? null,\n form: fields,\n principals,\n });\n }\n if (ct.startsWith(\"application/json\")) {\n const payload = await c.req.json();\n return handleIngestJson(engine, payload, principals);\n }\n throw new HandlerError(415, \"Content-Type must be multipart/form-data or application/json\");\n }),\n );\n\n app.get(\n \"/documents\",\n wrap(async (c) =>\n handleListDocuments(engine, {\n sourceId: c.req.query(\"source_id\") ?? null,\n limit: Number(c.req.query(\"limit\") ?? 50),\n cursor: c.req.query(\"cursor\") ?? null,\n principals: await opts.principals(c),\n }),\n ),\n );\n\n app.get(\n \"/documents/:document_id\",\n wrap(async (c) => handleGetDocument(engine, c.req.param(\"document_id\"), await opts.principals(c))),\n );\n app.delete(\n \"/documents/:document_id\",\n wrap(async (c) => handleDeleteDocument(engine, c.req.param(\"document_id\"), await opts.principals(c))),\n );\n app.patch(\n \"/documents/:document_id\",\n wrap(async (c) =>\n handleUpdateDocument(engine, c.req.param(\"document_id\"), await c.req.json(), await opts.principals(c)),\n ),\n );\n app.post(\n \"/search\",\n wrap(async (c) => handleSearch(engine, await c.req.json(), await opts.principals(c))),\n );\n app.get(\n \"/stats\",\n wrap(async (c) => handleStats(engine, c.req.query(\"source_id\") ?? null)),\n );\n\n app.post(\n \"/tools\",\n wrap(async (c) => tools.createTool(await c.req.json(), await opts.principals(c))),\n );\n app.get(\n \"/tools\",\n wrap(async (c) =>\n tools.listToolsAdmin({ source_id: c.req.query(\"source_id\") }, await opts.principals(c)),\n ),\n );\n app.get(\n \"/tools/schema/:kind\",\n wrap(async (c) => tools.toolSchemaRoute(c.req.param(\"kind\"))),\n );\n app.post(\n \"/tools/test\",\n wrap(async (c) => tools.testToolRoute(await c.req.json())),\n );\n app.post(\n \"/tools/execute\",\n wrap(async (c) =>\n tools.executeToolRoute(\n (await c.req.json()) as { call_name?: string },\n await opts.principals(c),\n opts.approvalScope ? await opts.approvalScope(c) : null,\n ),\n ),\n );\n app.get(\n \"/tools/:tool_id\",\n wrap(async (c) => tools.getTool(c.req.param(\"tool_id\"), await opts.principals(c))),\n );\n app.patch(\n \"/tools/:tool_id\",\n wrap(async (c) =>\n tools.updateToolRoute(\n c.req.param(\"tool_id\"),\n (await c.req.json()) as Record<string, unknown>,\n await opts.principals(c),\n ),\n ),\n );\n app.delete(\n \"/tools/:tool_id\",\n wrap(async (c) => tools.deleteToolRoute(c.req.param(\"tool_id\"), await opts.principals(c))),\n );\n app.post(\n \"/mcp/connect-and-list\",\n wrap(async (c) => tools.mcpConnectAndList((await c.req.json()) as { server_name: string; url: string })),\n );\n app.post(\n \"/mcp/oauth/start\",\n wrap(async (c) => tools.mcpOauthStart((await c.req.json()) as { server_url: string })),\n );\n app.get(\n MCP_OAUTH_CALLBACK_PATH,\n wrap(async (c) => tools.mcpOauthCallback(c.req.query())),\n );\n app.get(\n \"/approvals\",\n wrap(async (c) =>\n tools.listApprovalsRoute(\n { status: c.req.query(\"status\"), source_id: c.req.query(\"source_id\") },\n await opts.principals(c),\n ),\n ),\n );\n app.post(\n \"/approvals/:approval_id/resolve\",\n wrap(async (c) =>\n tools.resolveApprovalRoute(\n c.req.param(\"approval_id\"),\n (await c.req.json()) as { decision: \"approved\" | \"rejected\"; approver: string },\n await opts.principals(c),\n ),\n ),\n );\n\n return app;\n}\n\nexport const createHonoApp = createHonoRouter;\n","/**\n * Sentinels distinguishing omitted arguments from real values, including null.\n *\n * UNSET: \"argument omitted\" vs null (e.g. updateDocument acl=null means unrestricted).\n * TRUSTED: trusted caller, ACL filtering disabled. Truthy on purpose so\n * `if (principals)` does not treat a trusted caller as anonymous.\n */\n\nexport const UNSET: unique symbol = Symbol.for(\"context_engine.UNSET\");\nexport type Unset = typeof UNSET;\n\n// Symbol.for (the process-global registry), NEVER a class instance: the\n// package ships per-entry bundles (tsup splitting:false), so dist/index.js\n// and dist/mcp.js each carry their own copy of this module. A class instance\n// is a different object per copy, and `result === TRUSTED` then fails for an\n// app importing TRUSTED from one entry while mounting another — every tool\n// call on a correctly configured trusted mount errors. UNSET above survives\n// bundle duplication for exactly this reason; TRUSTED must too.\nexport const TRUSTED: unique symbol = Symbol.for(\"context_engine.TRUSTED\");\n\n// The SCOPE ceiling's \"no ceiling at all\". Symbol.for for the same reason\n// TRUSTED is: a class instance breaks `===` across per-entry bundles.\n//\n// Scope has the same shape of danger `principals` has, so it gets the same\n// treatment. A host maps its own word — project, matter, workspace, customer —\n// onto a list of source ids, and that ceiling is what the mounted tool may\n// ever reach. `null`/omitted is the spelling of an oversight, and would\n// otherwise mean a corpus-wide search: exactly the accident worth making\n// impossible. A host running one shared private corpus types UNSCOPED and\n// thereby says it meant it.\nexport const UNSCOPED: unique symbol = Symbol.for(\"context_engine.UNSCOPED\");\nexport type Trusted = typeof TRUSTED;\n\nexport type Principals = string[] | null | typeof TRUSTED | undefined;\n\n// Once per method, matching Python's default warnings filter — before the\n// dedup, a legacy caller re-triggered the warning on EVERY request.\nconst warnedMethods = new Set<string>();\n\nexport function resolvePrincipals(value: Principals, method: string): string[] | null {\n if (value === TRUSTED) return null;\n if (value === undefined || value === null) {\n // `undefined` (omitted) is the same legacy trusted spelling as `null` —\n // Python's omitted `principals` defaults to None and warns identically.\n if (!warnedMethods.has(method)) {\n warnedMethods.add(method);\n process.emitWarning(\n `${method}(principals=${value === null ? \"null\" : \"undefined\"}) means TRUSTED CALLER — ` +\n `access control is disabled and every document is returned. If that is what ` +\n `you want, pass principals=TRUSTED (from @promptev/context-engine) to say so ` +\n `explicitly. If you meant 'no authenticated user', pass principals=[] instead. ` +\n `Passing null/omitting will raise in 1.0.`,\n { type: \"DeprecationWarning\", code: \"CE_PRINCIPALS_NULL\" },\n );\n }\n return null;\n }\n if (!Array.isArray(value)) {\n // NEVER coerce: a bare string (or any other object) coercing to null\n // used to mean full-corpus TRUSTED — an ACL bypass a caller could hit\n // with one wrong type. Fail loudly instead.\n throw new TypeError(\n `${method}(principals=...) must be an array of principal strings, [] for an ` +\n `anonymous caller, or TRUSTED — got ${typeof value}. A non-array value must ` +\n `never silently disable ACL filtering.`,\n );\n }\n return value;\n}\n\nexport function isTrusted(principals: string[] | null | undefined): boolean {\n return principals === null || principals === undefined;\n}\n","import { z } from \"zod\";\nimport { TRUSTED, type Trusted } from \"./sentinels.js\";\n\nexport class HandlerError extends Error {\n status: number;\n detail: unknown;\n constructor(status: number, detail: unknown) {\n super(typeof detail === \"string\" ? detail : JSON.stringify(detail));\n this.name = \"HandlerError\";\n this.status = status;\n this.detail = detail;\n }\n}\n\nexport const ingestJsonRequestSchema = z\n .object({\n text: z.string(),\n name: z.string(),\n source_id: z.string().nullable().optional(),\n external_id: z.string().nullable().optional(),\n description: z.string().nullable().optional(),\n meta_data: z.record(z.unknown()).nullable().optional(),\n acl: z.array(z.string()).nullable().optional(),\n mode: z.enum([\"hybrid\", \"graph\"]).nullable().optional(),\n extract_structured: z.boolean().optional().default(false),\n batch: z.boolean().optional().default(false),\n })\n .strip();\n\nexport const documentPatchSchema = z\n .object({\n acl: z.array(z.string()).nullable().optional(),\n name: z.string().nullable().optional(),\n description: z.string().nullable().optional(),\n meta_data: z.record(z.unknown()).nullable().optional(),\n })\n .strict();\n\nexport const searchRequestSchema = z\n .object({\n query: z.string(),\n source_ids: z.array(z.string()).nullable().optional(),\n // Narrows WITHIN a source and INTERSECTS with source_ids — it can only\n // shrink the result set (the ACL predicate still applies in the same SQL\n // conjunction), so exposing it needs no authorizeAcl-style grant check.\n document_ids: z.array(z.string()).nullable().optional(),\n top_k: z.number().int().optional().default(10),\n mode: z.enum([\"hybrid\", \"graph\"]).optional().default(\"hybrid\"),\n compress_to_tokens: z.number().int().nullable().optional(),\n })\n .strip();\n\nexport type IngestJSONRequest = z.infer<typeof ingestJsonRequestSchema>;\nexport type DocumentPatch = z.infer<typeof documentPatchSchema>;\nexport type SearchRequest = z.infer<typeof searchRequestSchema>;\n\nexport type ContextEngineLike = {\n ingest: (args: Record<string, unknown>) => Promise<unknown>;\n search: (query: string, opts?: Record<string, unknown>) => Promise<{ hits?: unknown[]; usage?: unknown }>;\n listDocuments: (opts: Record<string, unknown>) => Promise<unknown>;\n getDocument: (id: string, opts?: Record<string, unknown>) => Promise<unknown>;\n deleteDocument: (id: string, opts?: Record<string, unknown>) => Promise<unknown>;\n updateDocument: (id: string, opts?: Record<string, unknown>) => Promise<unknown>;\n stats: (sourceId?: string | null) => Promise<unknown>;\n};\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\nexport function requireValidUuid(documentId: string): void {\n if (!UUID_RE.test(String(documentId))) {\n throw new HandlerError(400, `invalid document id: ${JSON.stringify(documentId)}`);\n }\n}\n\nexport function formBool(value: unknown): boolean {\n if (typeof value === \"boolean\") return value;\n if (value == null) return false;\n return [\"1\", \"true\", \"yes\", \"on\"].includes(String(value).trim().toLowerCase());\n}\n\nexport function formJson(value: unknown): unknown {\n if (value === undefined || value === null || value === \"\") return null;\n if (typeof value === \"object\") return value;\n try {\n return JSON.parse(String(value));\n } catch {\n throw new HandlerError(400, `invalid JSON in field: ${JSON.stringify(value)}`);\n }\n}\n\nexport function formStr(value: unknown): string | null {\n return value === undefined || value === null || value === \"\" ? null : String(value);\n}\n\nexport function resolveRequestPrincipals(value: unknown, opts: { surface: string }): string[] | Trusted {\n // Hand the SENTINEL through, not null: every engine method resolves TRUSTED\n // silently, while `principals=null` triggers the deprecation warning aimed\n // at legacy in-process callers — collapsing here made a correctly\n // configured trusted mount re-trigger that warning on every request.\n if (value === TRUSTED) return TRUSTED;\n if (value == null) {\n throw new HandlerError(\n 500,\n `${opts.surface}: the \\`principals\\` dependency returned null, which means ` +\n `TRUSTED CALLER — it disables ACL filtering and skips the check that ` +\n `stops a caller filing documents under groups it does not hold. This ` +\n `mount is misconfigured: return [] for an unauthenticated caller, or ` +\n `pass TRUSTED explicitly (from @promptev/context-engine) if the surface really ` +\n `is trusted.`,\n );\n }\n // A runtime check, not a cast: `as string[]` let a plain-JS dependency\n // return a bare string that flowed into resolvePrincipals and (before its\n // own guard) coerced to full-corpus TRUSTED.\n if (!Array.isArray(value) || value.some((p) => typeof p !== \"string\")) {\n throw new HandlerError(\n 500,\n `${opts.surface}: the \\`principals\\` dependency must return a list of ` +\n `principal strings, [] for an anonymous caller, or TRUSTED — got ${typeof value}.`,\n );\n }\n return value;\n}\n\nexport function authorizeAcl(requested: unknown, principals: string[] | null | Trusted): void {\n if (requested == null || principals == null || principals === TRUSTED) return;\n if (!Array.isArray(requested)) {\n throw new HandlerError(422, \"acl must be a list of principal strings\");\n }\n // TRUSTED was excluded above, so what remains is the plain list.\n const held = new Set(principals as string[]);\n const ungranted = [...new Set(requested.map(String))].filter((p) => !held.has(p)).sort();\n if (ungranted.length) {\n throw new HandlerError(403, `cannot grant access to principals you do not hold: ${ungranted}`);\n }\n}\n\nfunction asDict(obj: unknown): unknown {\n if (obj == null) return obj;\n if (typeof obj === \"object\" && typeof (obj as { toJSON?: () => unknown }).toJSON === \"function\") {\n return (obj as { toJSON: () => unknown }).toJSON();\n }\n return obj;\n}\n\nfunction zodError(err: z.ZodError): HandlerError {\n return new HandlerError(\n 422,\n err.issues.map((i) => ({ loc: i.path, msg: i.message, type: i.code })),\n );\n}\n\nasync function runIngest(engine: ContextEngineLike, kwargs: Record<string, unknown>): Promise<unknown> {\n try {\n return asDict(await engine.ingest(kwargs));\n } catch (exc) {\n if (exc instanceof TypeError || (exc instanceof Error && exc.name === \"TypeError\")) {\n throw new HandlerError(400, String(exc));\n }\n if (exc instanceof Error && exc.name === \"Error\" && /invalid|required/i.test(exc.message)) {\n throw new HandlerError(400, String(exc));\n }\n throw exc;\n }\n}\n\nexport async function handleIngestJson(\n engine: ContextEngineLike,\n payload: unknown,\n principals: unknown,\n): Promise<unknown> {\n const resolved = resolveRequestPrincipals(principals, { surface: \"handle_ingest_json\" });\n const parsed = ingestJsonRequestSchema.safeParse(payload);\n if (!parsed.success) throw zodError(parsed.error);\n const body = parsed.data;\n authorizeAcl(body.acl, resolved);\n return runIngest(engine, {\n text: body.text,\n name: body.name,\n description: body.description,\n sourceId: body.source_id,\n externalId: body.external_id,\n metaData: body.meta_data,\n acl: body.acl,\n mode: body.mode,\n extractStructured: body.extract_structured,\n batch: body.batch,\n });\n}\n\nexport async function handleIngestFile(\n engine: ContextEngineLike,\n opts: {\n content: Buffer | Uint8Array;\n filename: string | null | undefined;\n form: Record<string, unknown> | Map<string, unknown>;\n principals: unknown;\n },\n): Promise<unknown> {\n const resolved = resolveRequestPrincipals(opts.principals, { surface: \"handle_ingest_file\" });\n const form = opts.form instanceof Map ? Object.fromEntries(opts.form) : opts.form;\n const acl = formJson(form.acl);\n authorizeAcl(acl, resolved);\n return runIngest(engine, {\n content: opts.content,\n filename: opts.filename,\n name: formStr(form.name) || opts.filename,\n description: formStr(form.description),\n sourceId: formStr(form.source_id),\n externalId: formStr(form.external_id),\n metaData: formJson(form.meta_data),\n acl,\n mode: formStr(form.mode),\n extractStructured: formBool(form.extract_structured),\n batch: formBool(form.batch),\n });\n}\n\nexport async function handleListDocuments(\n engine: ContextEngineLike,\n opts: {\n sourceId: string | null | undefined;\n limit: number;\n cursor: string | null | undefined;\n principals: unknown;\n },\n): Promise<unknown> {\n const resolved = resolveRequestPrincipals(opts.principals, { surface: \"handle_list_documents\" });\n let parsedCursor: unknown = null;\n if (opts.cursor) {\n try {\n parsedCursor = JSON.parse(opts.cursor);\n } catch {\n throw new HandlerError(400, `invalid cursor: ${JSON.stringify(opts.cursor)}`);\n }\n }\n return engine.listDocuments({\n sourceId: opts.sourceId ?? null,\n principals: resolved,\n cursor: parsedCursor,\n limit: opts.limit,\n });\n}\n\nexport async function handleGetDocument(\n engine: ContextEngineLike,\n documentId: string,\n principals: unknown,\n): Promise<unknown> {\n const resolved = resolveRequestPrincipals(principals, { surface: \"handle_get_document\" });\n requireValidUuid(documentId);\n try {\n return await engine.getDocument(documentId, { principals: resolved });\n } catch (exc) {\n if (\n exc instanceof Error &&\n (exc.name === \"DocumentNotFoundError\" || exc instanceof TypeError === false)\n ) {\n const msg = String(exc);\n if (/not found/i.test(msg) || exc.name === \"DocumentNotFoundError\") {\n throw new HandlerError(404, msg.replace(/^Error:\\s*/, \"\"));\n }\n }\n throw exc;\n }\n}\n\nexport async function handleDeleteDocument(\n engine: ContextEngineLike,\n documentId: string,\n principals: unknown,\n): Promise<unknown> {\n const resolved = resolveRequestPrincipals(principals, { surface: \"handle_delete_document\" });\n requireValidUuid(documentId);\n try {\n await engine.deleteDocument(documentId, { principals: resolved });\n } catch (exc) {\n const msg = String(exc);\n if (/not found/i.test(msg) || (exc instanceof Error && exc.name === \"DocumentNotFoundError\")) {\n throw new HandlerError(404, msg.replace(/^Error:\\s*/, \"\"));\n }\n throw exc;\n }\n return { deleted: documentId };\n}\n\nexport async function handleUpdateDocument(\n engine: ContextEngineLike,\n documentId: string,\n payload: unknown,\n principals: unknown,\n): Promise<unknown> {\n const resolved = resolveRequestPrincipals(principals, { surface: \"handle_update_document\" });\n requireValidUuid(documentId);\n const parsed = documentPatchSchema.safeParse(payload);\n if (!parsed.success) throw zodError(parsed.error);\n const provided: Record<string, unknown> = {};\n const raw = payload as Record<string, unknown>;\n for (const key of [\"acl\", \"name\", \"description\", \"meta_data\"] as const) {\n if (Object.hasOwn(raw, key)) {\n provided[key === \"meta_data\" ? \"metaData\" : key] = raw[key];\n }\n }\n if (\"acl\" in provided) authorizeAcl(provided.acl, resolved);\n try {\n const changed = await engine.updateDocument(documentId, { principals: resolved, ...provided });\n return { changed };\n } catch (exc) {\n const msg = String(exc);\n if (/not found/i.test(msg) || (exc instanceof Error && exc.name === \"DocumentNotFoundError\")) {\n throw new HandlerError(404, msg.replace(/^Error:\\s*/, \"\"));\n }\n throw exc;\n }\n}\n\nexport async function handleSearch(\n engine: ContextEngineLike,\n payload: unknown,\n principals: unknown,\n): Promise<unknown> {\n const resolved = resolveRequestPrincipals(principals, { surface: \"handle_search\" });\n const parsed = searchRequestSchema.safeParse(payload);\n if (!parsed.success) throw zodError(parsed.error);\n const body = parsed.data;\n // Early, like every sibling document endpoint: a malformed id must be a\n // clean 400 here, not a Postgres 22P02 raised inside every search leg —\n // whose 400-vs-500 mapping would otherwise hang on the ENGLISH pg error\n // text, with the raw DatabaseError echoed to the caller.\n for (const did of body.document_ids ?? []) requireValidUuid(did);\n try {\n const result = await engine.search(body.query, {\n sourceIds: body.source_ids,\n documentIds: body.document_ids,\n principals: resolved,\n topK: body.top_k,\n mode: body.mode,\n compressToTokens: body.compress_to_tokens,\n });\n const hits = (result.hits ?? []).map((hit) => asDict(hit));\n return { hits, usage: result.usage };\n } catch (exc) {\n if (exc instanceof Error && /invalid|required|graph/i.test(exc.message)) {\n throw new HandlerError(400, String(exc));\n }\n throw exc;\n }\n}\n\nexport async function handleStats(\n engine: ContextEngineLike,\n sourceId: string | null | undefined,\n): Promise<unknown> {\n return engine.stats(sourceId ?? null);\n}\n","import { EngineActionError } from \"../errors.js\";\nimport { authorizeAcl, HandlerError, resolveRequestPrincipals } from \"../routing-core.js\";\nimport { TRUSTED, type Trusted } from \"../sentinels.js\";\nimport { aclVisible } from \"./acl.js\";\nimport {\n ApprovalExpired,\n ApprovalNotPending,\n type ApprovalRecord,\n listApprovals,\n resolveApproval,\n validateApprovalScope,\n} from \"./approval.js\";\nimport { ConfigTemplateError, configSchema, redactConfig, ToolConfig, type ToolKind } from \"./config.js\";\nimport { decryptDict, getSecretKey } from \"./crypto.js\";\nimport { EgressDenied } from \"./egress.js\";\nimport { MCPError, PromptevMCP } from \"./executors/mcp-client.js\";\nimport {\n allowPrivateEgress,\n deleteTool,\n executeTool,\n registerTool,\n type ToolEngine,\n testTool,\n updateTool,\n} from \"./governance.js\";\nimport {\n buildAuthorizeUrl,\n discoverOauthMetadata,\n exchangeCodeForToken,\n InMemoryPendingStore,\n type PendingStore,\n registerOauthClient,\n} from \"./mcp-oauth.js\";\n\nexport const MCP_OAUTH_CALLBACK_PATH = \"/mcp/oauth/callback\";\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\nfunction coerceUuid(value: string): string {\n if (!UUID_RE.test(String(value))) {\n throw new HandlerError(400, `invalid id: ${JSON.stringify(value)}`);\n }\n return value;\n}\n\nfunction toolRowPublic(\n row: Record<string, unknown>,\n opts: { template?: boolean; templateKey?: Buffer | null } = {},\n): Record<string, unknown> {\n const out: Record<string, unknown> = {\n id: String(row.id),\n name: row.name,\n kind: row.kind,\n description: row.description || \"\",\n source_id: row.source_id,\n acl: row.acl != null ? [...(row.acl as string[])] : null,\n requires_approval: row.requires_approval,\n approval_policy: row.approval_policy ?? {},\n enabled: row.enabled,\n // Engine-opaque user metadata — admin surface only (the agent-facing\n // listTools/searchTools views never carry it), returned in clear:\n // secrets belong in `config`.\n meta_data: row.meta_data ?? {},\n };\n // Editor mounts only (`configTemplate` — see createToolsHandlers): the\n // masked request template. A blob that cannot be decrypted (no key, or the\n // key rotated) degrades to `config_error` — never an exception, so ONE\n // broken row cannot make the whole listing (or its own delete) unreachable.\n if (opts.template && row.config_encrypted) {\n try {\n if (!opts.templateKey) throw new Error(\"no secret key configured\");\n out.config_redacted = redactConfig(\n String(row.kind),\n decryptDict(String(row.config_encrypted), opts.templateKey),\n );\n } catch {\n out.config_error = \"undecryptable\";\n }\n }\n return out;\n}\n\n/** The callback is PUBLIC and `message` can come straight from the query\n * string (`error_description`); unescaped it is reflected XSS on the\n * consumer's origin — the origin the popup posts an OAuth token to. */\nfunction escapeHtml(text: string): string {\n return text\n .replace(/&/g, \"&amp;\")\n .replace(/</g, \"&lt;\")\n .replace(/>/g, \"&gt;\")\n .replace(/\"/g, \"&quot;\")\n .replace(/'/g, \"&#x27;\");\n}\n\n/** `authorizeAcl` plus the tool-surface rule: an omitted or null `acl` is\n * UNRESTRICTED (visible to every principal, anonymous included), which on a\n * capability is the planting attack with a wider radius and no grant to\n * check. Documents may be public; a tool may be made public only by a\n * trusted mount. */\nfunction authorizeToolAcl(requested: unknown, principals: string[] | Trusted): void {\n if (requested == null && principals !== TRUSTED) {\n throw new HandlerError(\n 403,\n \"a tool without an acl is visible to every principal; only a trusted mount may register one — pass acl with principals you hold\",\n );\n }\n authorizeAcl(requested, principals);\n}\n\nfunction resolveCaller(value: unknown, surface: string): string[] | Trusted {\n // The sentinel passes through raw: `aclVisible`, the approval visibility\n // clause, and every delegating engine method understand it directly, and\n // collapsing to null here would re-trigger the engine's principals=null\n // deprecation on every request of a correctly configured trusted mount.\n return resolveRequestPrincipals(value, { surface });\n}\n\nfunction recordToDict(record: ApprovalRecord): Record<string, unknown> {\n return {\n id: record.id,\n tool_name: record.toolName,\n tool_args_frozen: record.toolArgsFrozen,\n source_id: record.sourceId,\n principals: record.principals,\n status: record.status,\n approver: record.approver,\n approver_meta: record.approverMeta,\n expires_at: record.expiresAt?.toISOString() ?? null,\n resolved_at: record.resolvedAt?.toISOString() ?? null,\n created_at: record.createdAt?.toISOString() ?? null,\n };\n}\n\nexport function popupCloseHtml(\n success: boolean,\n message: string,\n targetOrigin: string,\n tokenData: Record<string, unknown> | null = null,\n): string {\n const status = success ? \"success\" : \"error\";\n const payload: Record<string, unknown> = { type: `mcp-oauth-${status}`, message };\n if (tokenData && success) payload.token = tokenData;\n const encoded = Buffer.from(JSON.stringify(payload), \"utf8\").toString(\"base64\");\n const title = success ? \"Connected\" : \"Failed\";\n return (\n `<!DOCTYPE html><html><head><title>Context Engine MCP OAuth</title></head>` +\n `<body style=\"font-family:system-ui;text-align:center;padding:40px;\">` +\n `<h2>${title}</h2>` +\n `<p>${escapeHtml(message)}</p>` +\n `<p style=\"font-size:12px;\">This window will close automatically&hellip;</p>` +\n `<script>` +\n `try {` +\n ` var d = JSON.parse(atob(\"${encoded}\"));` +\n ` if (window.opener) window.opener.postMessage(d, \"${targetOrigin}\");` +\n `} catch (e) { console.error('postMessage error', e); }` +\n `setTimeout(function () { window.close(); }, 1500);` +\n `</script>` +\n `</body></html>`\n );\n}\n\nexport type ToolsHandlerEngine = ToolEngine & {\n registerTool?: (tc: ToolConfig) => Promise<string>;\n updateTool?: (id: string, opts: Record<string, unknown>) => Promise<ToolConfig>;\n deleteTool?: (id: string, opts?: Record<string, unknown>) => Promise<void>;\n testTool?: (tc: ToolConfig) => Promise<Record<string, unknown>>;\n executeTool?: (\n callName: string,\n args: Record<string, unknown> | null,\n opts?: Record<string, unknown>,\n ) => Promise<Record<string, unknown>>;\n hooks?: ToolEngine[\"hooks\"];\n};\n\nexport function createToolsHandlers(\n engine: ToolsHandlerEngine,\n opts: {\n redirectBaseUrl?: string;\n pendingStore?: PendingStore | null;\n /** Serve `config_redacted` (the masked request template) on the GET\n * routes. Defaults OFF: those routes serve the same ACL-visible\n * population that may EXECUTE a tool, and even the redacted template is\n * editor-facing metadata an agent caller has no business reading. Enable\n * only on a mount that genuinely fronts an editor/admin UI. */\n configTemplate?: boolean;\n } = {},\n) {\n const store: PendingStore = opts.pendingStore ?? new InMemoryPendingStore();\n const configTemplate = opts.configTemplate ?? false;\n // Resolved ONCE per request (not per row) and never throwing: a keyless\n // deployment still serves the listing (encrypted rows degrade to\n // `config_error` in toolRowPublic).\n // A MISSING key degrades silently — the supported keyless deployment. A\n // present-but-malformed key degrades too, but with a warning: without it\n // the two are indistinguishable, and config_error's documented recovery\n // (re-enter every config in full) destroys recoverable secrets when the\n // actual fix is repairing the env var.\n const templateKey = (): Buffer | null => {\n if (!configTemplate) return null;\n let key: Buffer;\n try {\n key = getSecretKey(engine.config);\n } catch {\n return null; // no key configured\n }\n if (key.length !== 32) {\n console.warn(\n `CE_SECRET_KEY is malformed: decoded to ${key.length} bytes, need 32; ` +\n `tool config templates will degrade to config_error`,\n );\n return null;\n }\n return key;\n };\n const redirectBaseUrl = (opts.redirectBaseUrl ?? \"\").replace(/\\/$/, \"\");\n let targetOrigin = \"\";\n try {\n if (redirectBaseUrl) targetOrigin = new URL(redirectBaseUrl).origin;\n } catch {\n targetOrigin = \"\";\n }\n const redirectUri = redirectBaseUrl ? `${redirectBaseUrl}${MCP_OAUTH_CALLBACK_PATH}` : \"\";\n\n return {\n async createTool(body: unknown, principals: unknown): Promise<Record<string, unknown>> {\n const caller = resolveCaller(principals, \"POST /tools\");\n const tc = ToolConfig.fromUnknown(body);\n authorizeToolAcl(tc.acl, caller);\n try {\n const toolId = engine.registerTool ? await engine.registerTool(tc) : await registerTool(engine, tc);\n return { id: toolId };\n } catch (exc) {\n if (exc instanceof ConfigTemplateError) throw new HandlerError(400, exc.message);\n if (exc instanceof Error && /canonicalFromConfig|kind=/.test(exc.message)) {\n throw new HandlerError(400, String(exc));\n }\n throw exc;\n }\n },\n\n async listToolsAdmin(\n query: { source_id?: string | null },\n principals: unknown,\n ): Promise<Record<string, unknown>> {\n const caller = resolveCaller(principals, \"GET /tools\");\n const params: unknown[] = [];\n let sql = `SELECT * FROM context_engine_tools`;\n if (query.source_id != null) {\n params.push(query.source_id);\n sql += ` WHERE source_id = $1`;\n }\n const result = await engine.pool.query(sql, params);\n const key = templateKey();\n const tools = result.rows\n .filter((row) => aclVisible(row.acl != null ? [...row.acl] : null, caller))\n .map((row) => toolRowPublic(row, { template: configTemplate, templateKey: key }));\n return { tools };\n },\n\n async getTool(toolId: string, principals: unknown): Promise<Record<string, unknown>> {\n const caller = resolveCaller(principals, \"GET /tools/{tool_id}\");\n const parsedId = coerceUuid(toolId);\n const result = await engine.pool.query(`SELECT * FROM context_engine_tools WHERE id = $1`, [parsedId]);\n const row = result.rows[0];\n if (!row || !aclVisible(row.acl != null ? [...row.acl] : null, caller)) {\n throw new HandlerError(404, `tool not found: ${toolId}`);\n }\n return toolRowPublic(row, { template: configTemplate, templateKey: templateKey() });\n },\n\n async updateToolRoute(\n toolId: string,\n body: Record<string, unknown>,\n principals: unknown,\n ): Promise<Record<string, unknown>> {\n const caller = resolveCaller(principals, \"PATCH /tools/{tool_id}\");\n coerceUuid(toolId);\n const fields: Record<string, unknown> = {};\n const map: Record<string, string> = {\n name: \"name\",\n kind: \"kind\",\n description: \"description\",\n config: \"config\",\n source_id: \"sourceId\",\n acl: \"acl\",\n requires_approval: \"requiresApproval\",\n approval_policy: \"approvalPolicy\",\n enabled: \"enabled\",\n meta_data: \"metaData\",\n };\n for (const [k, dest] of Object.entries(map)) {\n if (Object.hasOwn(body, k)) fields[dest] = body[k];\n }\n // An EXPLICIT null for a non-nullable column would be written verbatim\n // (a `\"kind\": null` row breaks every later resolve; a null\n // approval_policy would be silently coerced to {}, wiping the policy\n // with a 200) — reject it. Clear description/approval_policy with \"\"\n // and {} respectively.\n const wireName: Record<string, string> = {\n requiresApproval: \"requires_approval\",\n approvalPolicy: \"approval_policy\",\n metaData: \"meta_data\",\n };\n for (const field of [\n \"name\",\n \"kind\",\n \"description\",\n \"requiresApproval\",\n \"approvalPolicy\",\n \"enabled\",\n \"metaData\",\n ]) {\n if (field in fields && fields[field] == null) {\n throw new HandlerError(400, `${wireName[field] ?? field} cannot be null`);\n }\n }\n if (\"acl\" in fields) authorizeToolAcl(fields.acl, caller);\n try {\n const updated = engine.updateTool\n ? await engine.updateTool(toolId, { principals: caller, ...fields })\n : await updateTool(engine, toolId, { principals: caller, ...fields });\n return {\n id: updated.id,\n name: updated.name,\n kind: updated.kind,\n description: updated.description,\n source_id: updated.sourceId,\n acl: updated.acl,\n requires_approval: updated.requiresApproval,\n approval_policy: updated.approvalPolicy,\n enabled: updated.enabled,\n meta_data: updated.metaData,\n };\n } catch (exc) {\n // A config the caller must fix (unresolvable sentinel, kind change\n // with sentinels, undecryptable stored blob) — see governance.\n if (exc instanceof ConfigTemplateError) throw new HandlerError(400, exc.message);\n if (exc instanceof EngineActionError) throw new HandlerError(404, String(exc.message));\n throw exc;\n }\n },\n\n async deleteToolRoute(toolId: string, principals: unknown): Promise<Record<string, unknown>> {\n const caller = resolveCaller(principals, \"DELETE /tools/{tool_id}\");\n coerceUuid(toolId);\n try {\n if (engine.deleteTool) await engine.deleteTool(toolId, { principals: caller });\n else await deleteTool(engine, toolId, { principals: caller });\n } catch (exc) {\n if (exc instanceof EngineActionError) throw new HandlerError(404, String(exc.message));\n throw exc;\n }\n return { deleted: toolId };\n },\n\n async testToolRoute(body: unknown): Promise<Record<string, unknown>> {\n const tc = ToolConfig.fromUnknown(body);\n try {\n return await (engine.testTool ? engine.testTool(tc) : testTool(engine, tc));\n } catch (exc) {\n // A sentinel-bearing config would probe the REAL endpoint with the\n // literal placeholder as its credential — same 400 as POST /tools.\n if (exc instanceof ConfigTemplateError) throw new HandlerError(400, exc.message);\n throw exc;\n }\n },\n\n toolSchemaRoute(kind: string): Record<string, unknown> {\n try {\n return configSchema(kind as ToolKind);\n } catch {\n throw new HandlerError(404, `unknown tool kind: ${JSON.stringify(kind)}`);\n }\n },\n\n /**\n * `approvalScope` is resolved by the adapter's `approvalScope` option —\n * SERVER-SIDE, never from the body. A body key of the same name is\n * ignored exactly like a body `principals`: a client that could name\n * its own scope could claim another scope's approvals. Absent, the\n * execution runs unscoped (the deprecated legacy path). A malformed\n * scope is the host's wiring bug, so it surfaces as a 500, never a 4xx\n * the client might \"fix\" by changing its body.\n */\n async executeToolRoute(\n body: { call_name?: string; args?: Record<string, unknown> | null; source_id?: string | null },\n principals: unknown,\n approvalScope: unknown = null,\n ): Promise<Record<string, unknown>> {\n const caller = resolveCaller(principals, \"POST /tools/execute\");\n if (!body.call_name) throw new HandlerError(422, \"call_name is required\");\n let scope: string | null;\n try {\n scope = validateApprovalScope(approvalScope);\n } catch (exc) {\n throw new HandlerError(500, `approvalScope resolver: ${(exc as Error).message}`);\n }\n try {\n const exec = engine.executeTool ?? ((n, a, o) => executeTool(engine, n, a, o));\n return await exec(body.call_name, body.args ?? null, {\n sourceId: body.source_id,\n principals: caller,\n approvalScope: scope,\n });\n } catch (exc) {\n if (exc instanceof EngineActionError) throw new HandlerError(404, String(exc.message));\n throw exc;\n }\n },\n\n async mcpConnectAndList(body: {\n server_name: string;\n url: string;\n token?: string | null;\n headers?: Record<string, string> | null;\n include_resources?: boolean;\n }): Promise<Record<string, unknown>> {\n const mcp = new PromptevMCP({ allowPrivate: allowPrivateEgress(engine) });\n try {\n await mcp.addServer(body.server_name, body.url, { token: body.token, headers: body.headers });\n const client = mcp.clients.get(body.server_name);\n const tools = await client.listTools();\n const resources = body.include_resources ? await client.listResources() : null;\n return {\n server: body.server_name,\n url: client.url,\n transport: client.transport.kind,\n tools,\n resources,\n requires_oauth: false,\n };\n } catch (exc) {\n // 400, not 403 and not 502: the URL arrived in THIS request body, and\n // it is the request that is wrong — the caller's identity grants\n // nothing here (no principal may reach the metadata service) and no\n // upstream server was ever spoken to. Same refusal the http probe\n // reports as `{ ok: false, error: \"egress_denied\" }`, in the shape a\n // route has for a bad body. Checked FIRST: the message can carry\n // digits the 401/403 heuristic below would misread.\n if (exc instanceof EgressDenied) throw new HandlerError(400, String(exc.message));\n const msg = String(exc);\n const statusMatch = /HTTP (401|403)/.exec(msg);\n if (statusMatch || /401|403/.test(msg)) {\n // The fallback discovers OAuth on the SAME caller-supplied URL, so\n // it can be denied for the same reason the connect can — and this\n // call sits INSIDE the catch, past the `EgressDenied` branch above,\n // so an unmapped refusal here left the handler throwing raw.\n let metadata: Record<string, unknown> | null;\n try {\n metadata = await discoverOauthMetadata(body.url, {\n hooks: engine.hooks,\n allowPrivate: allowPrivateEgress(engine),\n });\n } catch (denied) {\n if (denied instanceof EgressDenied) throw new HandlerError(400, String(denied.message));\n throw denied;\n }\n if (metadata) {\n return {\n server: body.server_name,\n url: body.url,\n transport: \"pending_oauth\",\n tools: [],\n resources: null,\n requires_oauth: true,\n };\n }\n throw new HandlerError(\n 502,\n `MCP server returned ${statusMatch?.[1] ?? \"401/403\"}. No OAuth endpoint found — provide a Bearer token instead.`,\n );\n }\n if (exc instanceof MCPError) throw new HandlerError(502, `MCP protocol error: ${exc}`);\n throw new HandlerError(502, `Cannot reach MCP server: ${exc}`);\n } finally {\n await mcp.shutdown();\n }\n },\n\n async mcpOauthStart(body: {\n server_url: string;\n tool_id?: string | null;\n client_id?: string | null;\n client_secret?: string | null;\n scopes?: string | null;\n }): Promise<Record<string, unknown>> {\n if (!redirectUri) {\n throw new HandlerError(500, \"redirectBaseUrl is required to start MCP OAuth\");\n }\n let metadata: Record<string, unknown> | null;\n try {\n metadata = await discoverOauthMetadata(body.server_url, {\n hooks: engine.hooks,\n allowPrivate: allowPrivateEgress(engine),\n });\n } catch (exc) {\n if (exc instanceof EgressDenied) throw new HandlerError(400, String(exc.message));\n throw exc;\n }\n if (!metadata) {\n throw new HandlerError(502, \"MCP server does not support OAuth — no authorization endpoint found\");\n }\n let clientId = body.client_id ?? null;\n let clientSecret = body.client_secret ?? null;\n if (!clientId && metadata.registration_endpoint) {\n try {\n const reg = await registerOauthClient(\n String(metadata.registration_endpoint),\n redirectUri,\n \"Promptev Context Engine\",\n { hooks: engine.hooks, allowPrivate: allowPrivateEgress(engine) },\n );\n clientId = (reg.client_id as string | undefined) ?? null;\n clientSecret = (reg.client_secret as string | undefined) || clientSecret;\n } catch (exc) {\n // A server pointing `registration_endpoint` at an internal address\n // must not look like a server that simply does not do DCR.\n if (exc instanceof EgressDenied) throw new HandlerError(400, String(exc.message));\n /* DCR optional */\n }\n }\n try {\n return await buildAuthorizeUrl(metadata, body.server_url, body.tool_id || \"\", redirectUri, store, {\n clientId,\n clientSecret,\n scopes: body.scopes,\n });\n } catch (exc) {\n throw new HandlerError(400, String(exc));\n }\n },\n\n async mcpOauthCallback(query: {\n code?: string | null;\n state?: string | null;\n error?: string | null;\n error_description?: string | null;\n }): Promise<{ html: string; contentType: string }> {\n const html = (success: boolean, message: string, token: Record<string, unknown> | null = null) =>\n popupCloseHtml(success, message, targetOrigin, token);\n if (query.error) {\n return { html: html(false, query.error_description || query.error), contentType: \"text/html\" };\n }\n if (!query.code || !query.state) {\n return { html: html(false, \"Missing code or state parameter\"), contentType: \"text/html\" };\n }\n try {\n const tokenResult = await exchangeCodeForToken(query.state, query.code, store, {\n hooks: engine.hooks,\n allowPrivate: allowPrivateEgress(engine),\n });\n return {\n html: html(true, \"Connected successfully\", {\n access_token: tokenResult.access_token,\n refresh_token: tokenResult.refresh_token,\n token_type: tokenResult.token_type ?? \"Bearer\",\n expires_in: tokenResult.expires_in,\n scope: tokenResult.scope,\n tool_id: tokenResult.tool_id,\n }),\n contentType: \"text/html\",\n };\n } catch (exc) {\n return { html: html(false, String(exc)), contentType: \"text/html\" };\n }\n },\n\n async listApprovalsRoute(\n query: { status?: string | null; source_id?: string | null },\n principals: unknown,\n ): Promise<Record<string, unknown>> {\n const caller = resolveCaller(principals, \"GET /approvals\");\n const records = await listApprovals(engine, {\n status: query.status,\n sourceId: query.source_id,\n principals: caller,\n });\n return { approvals: records.map(recordToDict) };\n },\n\n async resolveApprovalRoute(\n approvalId: string,\n body: { decision: \"approved\" | \"rejected\"; approver: string; meta?: Record<string, unknown> | null },\n principals: unknown,\n ): Promise<Record<string, unknown>> {\n const caller = resolveCaller(principals, \"POST /approvals/{approval_id}/resolve\");\n const parsedId = coerceUuid(approvalId);\n try {\n const record = await resolveApproval(\n engine,\n parsedId,\n body.decision,\n body.approver,\n body.meta ?? null,\n {\n principals: caller,\n },\n );\n return recordToDict(record);\n } catch (exc) {\n if (exc instanceof ApprovalNotPending) {\n throw new HandlerError(404, `approval not pending: ${exc.message}`);\n }\n if (exc instanceof ApprovalExpired) {\n throw new HandlerError(409, \"approval expired\");\n }\n throw exc;\n }\n },\n };\n}\n\nexport type ToolsHandlers = ReturnType<typeof createToolsHandlers>;\n","import { TRUSTED, type Trusted } from \"../sentinels.js\";\n\nexport function aclVisible(\n acl: string[] | null | undefined,\n principals: string[] | null | undefined | Trusted,\n): boolean {\n // `null` is the trusted internal caller; the TRUSTED sentinel (what a\n // trusted router mount resolves to) means exactly the same thing.\n if (principals === null || principals === TRUSTED) return true;\n if (acl == null) return true;\n if (!acl.length) return false;\n const held = new Set((principals as string[] | undefined) ?? []);\n return acl.some((p) => held.has(p));\n}\n","import { randomUUID } from \"node:crypto\";\nimport { ApprovalExpired, ApprovalNotPending } from \"../errors.js\";\nimport { TRUSTED, type Trusted } from \"../sentinels.js\";\nimport { aclVisible } from \"./acl.js\";\nimport type { CanonicalTool } from \"./registry.js\";\n\nexport { ApprovalExpired, ApprovalNotPending };\n\nexport const DEFAULT_TIMEOUT_MINUTES = 60;\nexport const DEFAULT_LIST_LIMIT = 50;\nexport const MAX_LIST_LIMIT = 200;\n\nconst CONDITION_RE = /^\\s*(?<field>[A-Za-z_][A-Za-z0-9_.]*)\\s*(?<op>>=|<=|==|!=|>|<)\\s*(?<value>.+?)\\s*$/;\n\nexport interface ApprovalRecord {\n id: string;\n toolName: string;\n toolArgsFrozen: Record<string, unknown>;\n sourceId: string | null;\n approvalScope: string | null;\n principals: unknown;\n status: string;\n approver: string | null;\n approverMeta: Record<string, unknown> | null;\n expiresAt: Date | null;\n resolvedAt: Date | null;\n createdAt: Date | null;\n}\n\ntype EngineLike = {\n pool: {\n query: (\n sql: string,\n params?: unknown[],\n ) => Promise<{ rows: Array<Record<string, unknown>>; rowCount?: number | null }>;\n };\n};\n\nfunction coerceValue(raw: string): unknown {\n const trimmed = raw.trim();\n if (\n trimmed.length >= 2 &&\n trimmed[0] === trimmed[trimmed.length - 1] &&\n (trimmed[0] === \"'\" || trimmed[0] === '\"')\n ) {\n return trimmed.slice(1, -1);\n }\n if (/^-?\\d+$/.test(trimmed)) return Number.parseInt(trimmed, 10);\n if (/^-?\\d+\\.\\d+$/.test(trimmed)) return Number.parseFloat(trimmed);\n return trimmed;\n}\n\nfunction evaluateCondition(condition: unknown, args: Record<string, unknown>): boolean {\n if (typeof condition !== \"string\") return true;\n const match = CONDITION_RE.exec(condition);\n if (!match?.groups) return true;\n const fieldName = match.groups.field!;\n const op = match.groups.op!;\n if (!(fieldName in args)) return true;\n const left = args[fieldName];\n const right = coerceValue(match.groups.value!);\n try {\n switch (op) {\n case \">\":\n return (left as number) > (right as number);\n case \">=\":\n return (left as number) >= (right as number);\n case \"<\":\n return (left as number) < (right as number);\n case \"<=\":\n return (left as number) <= (right as number);\n case \"==\":\n return left === right;\n case \"!=\":\n return left !== right;\n default:\n return true;\n }\n } catch {\n return true;\n }\n}\n\nexport function shouldRequireApproval(\n ct: Pick<CanonicalTool, \"requiresApproval\" | \"approvalPolicy\">,\n args: Record<string, unknown>,\n): boolean {\n if (ct.requiresApproval) return true;\n const policy = ct.approvalPolicy ?? {};\n const condition = policy.condition;\n if (!condition) return false;\n return evaluateCondition(condition, args ?? {});\n}\n\nfunction rowToRecord(row: Record<string, unknown>): ApprovalRecord {\n return {\n id: String(row.id),\n toolName: String(row.tool_name),\n toolArgsFrozen: (row.tool_args_frozen as Record<string, unknown>) ?? {},\n sourceId: (row.source_id as string | null) ?? null,\n approvalScope: (row.approval_scope as string | null) ?? null,\n principals: row.principals,\n status: String(row.status),\n approver: (row.approver as string | null) ?? null,\n approverMeta: (row.approver_meta as Record<string, unknown> | null) ?? null,\n expiresAt: toDate(row.expires_at),\n resolvedAt: toDate(row.resolved_at),\n createdAt: toDate(row.created_at),\n };\n}\n\n/**\n * `pg` hands TIMESTAMPTZ columns back as `Date` objects already. Routing one\n * through `new Date(String(date))` re-parses its locale string, which has NO\n * milliseconds — so a record read back from the database carried an\n * `expiresAt` up to 999ms earlier than the one returned at insert time. The\n * dedupe path (`findOrCreatePending`) returns read-back records to callers\n * that park on `expires_at`, which is where the drift became visible.\n */\nfunction toDate(value: unknown): Date | null {\n if (value == null) return null;\n if (value instanceof Date) return value;\n return new Date(String(value));\n}\n\nfunction visibilitySql(\n principals: string[] | null | Trusted,\n paramIndex: number,\n): { sql: string; params: unknown[] } {\n // `null` is the trusted internal caller; the TRUSTED sentinel (what a\n // trusted router mount resolves to) means the same thing — no filter.\n if (principals === null || principals === TRUSTED) return { sql: \"TRUE\", params: [] };\n principals = principals as string[];\n if (!principals.length) {\n return { sql: `(principals IS NULL OR principals = 'null'::jsonb)`, params: [] };\n }\n return {\n sql: `(principals IS NULL OR principals = 'null'::jsonb OR principals ?| $${paramIndex}::text[])`,\n params: [principals],\n };\n}\n\n/**\n * The principals wall for CLAIMING an approved record\n * (governance `findAndClaimApproved`) — `visibilitySql` plus one addition: a\n * record that carries NO principals imposes no wall. \"No principals\" is two\n * spellings and both count: `null` (a trusted caller opened it — public,\n * already in the base clause) and `[]` (an anonymous caller opened it). The\n * base clause treats `[]` as a real, empty ACL nobody overlaps — right for\n * `resolveApproval`, where an approver is never anonymous, but wrong here:\n * an anonymous caller must be able to re-drive its own approved call. The\n * scope (`approval_scope`) is the primary wall; this one only applies when\n * the record carries principals to check against.\n */\nexport function claimVisibilitySql(\n principals: string[] | null | Trusted,\n paramIndex: number,\n): { sql: string; params: unknown[] } {\n if (principals === null || principals === TRUSTED) return { sql: \"TRUE\", params: [] };\n const noWall = `principals IS NULL OR principals = 'null'::jsonb OR principals = '[]'::jsonb`;\n principals = principals as string[];\n if (!principals.length) return { sql: `(${noWall})`, params: [] };\n return { sql: `(${noWall} OR principals ?| $${paramIndex}::text[])`, params: [principals] };\n}\n\n/**\n * `null`/`undefined` (unscoped, legacy) passes through as `null`; anything\n * else must be a non-empty string. The scope is opaque — never parsed — but\n * a wrong type or an empty string is a wiring bug at the host, and letting\n * it through would silently open unclaimable or wrongly-shared records.\n */\nexport function validateApprovalScope(approvalScope: unknown): string | null {\n if (approvalScope === null || approvalScope === undefined) return null;\n if (typeof approvalScope !== \"string\") {\n throw new TypeError(`approvalScope must be a non-empty string or null, got ${typeof approvalScope}`);\n }\n if (!approvalScope) throw new Error(\"approvalScope must be a non-empty string or null, got ''\");\n return approvalScope;\n}\n\ntype PendingOpts = {\n toolName: string;\n args: Record<string, unknown>;\n sourceId?: string | null;\n principals?: unknown;\n policy?: Record<string, unknown>;\n now?: Date;\n approvalScope?: string | null;\n};\n\nfunction pendingRow(opts: PendingOpts, approvalScope: string | null) {\n const policy = opts.policy ?? {};\n const frozen = structuredClone(opts.args);\n const createdAt = opts.now ?? new Date();\n const timeout = Number(policy.timeout_minutes ?? DEFAULT_TIMEOUT_MINUTES);\n const expiresAt = new Date(createdAt.getTime() + timeout * 60_000);\n // The sentinel must NEVER be persisted (JSON.stringify(TRUSTED) is\n // `{}`): a trusted caller's approval is stored as NULL — public —\n // exactly what the Python port stores for a resolved trusted caller.\n const principals = opts.principals === undefined || opts.principals === TRUSTED ? null : opts.principals;\n return { frozen, createdAt, expiresAt, principals, approvalScope };\n}\n\nasync function insertPending(\n engine: EngineLike,\n opts: PendingOpts,\n row: ReturnType<typeof pendingRow>,\n): Promise<ApprovalRecord> {\n const id = randomUUID();\n await engine.pool.query(\n `INSERT INTO context_engine_tool_approvals\n (id, tool_name, tool_args_frozen, source_id, approval_scope, principals, status, expires_at, created_at)\n VALUES ($1,$2,$3::jsonb,$4,$5,$6::jsonb,'pending',$7,$8)`,\n [\n id,\n opts.toolName,\n JSON.stringify(row.frozen),\n opts.sourceId ?? null,\n row.approvalScope,\n row.principals === null ? null : JSON.stringify(row.principals),\n row.expiresAt,\n row.createdAt,\n ],\n );\n return {\n id,\n toolName: opts.toolName,\n toolArgsFrozen: row.frozen,\n sourceId: opts.sourceId ?? null,\n approvalScope: row.approvalScope,\n principals: row.principals,\n status: \"pending\",\n approver: null,\n approverMeta: null,\n expiresAt: row.expiresAt,\n resolvedAt: null,\n createdAt: row.createdAt,\n };\n}\n\n/**\n * Persist a new `pending` approval, FREEZING a deep copy of `args`. This is\n * the unconditional-insert primitive: `approvalScope` is stamped as given,\n * never deduped. The scoped execution path goes through\n * `findOrCreatePending` instead; this is what the unscoped (legacy) path\n * uses, and what tests reach for when they want N distinct rows.\n */\nexport async function createPending(engine: EngineLike, opts: PendingOpts): Promise<ApprovalRecord> {\n const approvalScope = validateApprovalScope(opts.approvalScope);\n return insertPending(engine, opts, pendingRow(opts, approvalScope));\n}\n\n/**\n * The scoped path's pending record: ONE per (tool, scope, frozen args).\n *\n * 1. Sweep — flip any `pending` row for this exact call whose `expires_at`\n * has passed to `expired`. Rows only expire lazily in this module, and an\n * expired pending row would otherwise sit under the unique index below\n * and block every new request for the same call forever.\n * 2. Find — return the surviving unexpired `pending` row if there is one.\n * This is the dedupe: a retrying agent loop gets the SAME approval id\n * (and the same `expires_at`) back, not a fresh row per retry.\n * 3. Insert — otherwise open a new row.\n *\n * Steps 2 and 3 are a read-then-write race, so the database enforces it: the\n * partial unique index `ux_context_engine_tool_approvals_pending_scope`\n * (0004_acl_indexes.sql) covers exactly (tool_name, approval_scope,\n * md5(tool_args_frozen::text)) WHERE status = 'pending'. Of N concurrent\n * identical calls exactly one INSERT commits; every loser sees a unique\n * violation (`23505`) and re-reads the winner's row. The lookup compares\n * `tool_args_frozen` as jsonb (semantic equality), which is the same\n * equivalence the index hashes, because jsonb's text form is canonical.\n *\n * Dedupe is on scope + tool + args and NOTHING less — never on tool + args\n * alone, or every caller's identical call would collapse into one decision.\n * `principals` and `sourceId` are stamped but are not part of the key,\n * since a scope is expected to belong to one caller.\n */\nexport async function findOrCreatePending(\n engine: EngineLike,\n opts: PendingOpts & { approvalScope: string },\n): Promise<ApprovalRecord> {\n const approvalScope = validateApprovalScope(opts.approvalScope);\n if (approvalScope === null)\n throw new Error(\"findOrCreatePending requires an approvalScope; use createPending\");\n const row = pendingRow(opts, approvalScope);\n const frozenJson = JSON.stringify(row.frozen);\n const sameCall = `tool_name = $1 AND approval_scope = $2 AND tool_args_frozen = $3::jsonb`;\n const params = [opts.toolName, approvalScope, frozenJson, row.createdAt];\n\n // (1) Sweep.\n await engine.pool.query(\n `UPDATE context_engine_tool_approvals SET status = 'expired'\n WHERE ${sameCall} AND status = 'pending' AND expires_at <= $4`,\n params,\n );\n\n // Two rounds: a loser of the INSERT race re-reads the winner; if the\n // winner was resolved in the gap, the second round inserts afresh.\n for (let attempt = 0; attempt < 2; attempt++) {\n // (2) Find.\n const found = await engine.pool.query(\n `SELECT * FROM context_engine_tool_approvals\n WHERE ${sameCall} AND status = 'pending' AND (expires_at IS NULL OR expires_at > $4)\n ORDER BY created_at ASC LIMIT 1`,\n params,\n );\n if (found.rows[0]) return rowToRecord(found.rows[0]);\n // (3) Insert.\n try {\n return await insertPending(engine, opts, row);\n } catch (exc) {\n if ((exc as { code?: string })?.code !== \"23505\") throw exc;\n }\n }\n throw new Error(\"findOrCreatePending: lost the insert race twice and found no live pending row\");\n}\n\nexport async function resolveApproval(\n engine: EngineLike,\n approvalId: string,\n decision: \"approved\" | \"rejected\",\n approver: string,\n meta: Record<string, unknown> | null = null,\n opts: { principals?: string[] | null | Trusted } = {},\n): Promise<ApprovalRecord> {\n if (decision !== \"approved\" && decision !== \"rejected\") {\n throw new Error(`invalid decision: ${JSON.stringify(decision)} (expected 'approved' or 'rejected')`);\n }\n const principals = opts.principals === undefined ? null : opts.principals;\n const vis = visibilitySql(principals, 5);\n const result = await engine.pool.query(\n `UPDATE context_engine_tool_approvals\n SET status = $1, approver = $2, approver_meta = $3::jsonb, resolved_at = now()\n WHERE id = $4 AND status = 'pending'\n AND (expires_at IS NULL OR expires_at > now())\n AND ${vis.sql}\n RETURNING *`,\n [decision, approver, JSON.stringify(meta ?? {}), approvalId, ...vis.params],\n );\n if (result.rowCount === 1) return rowToRecord(result.rows[0]!);\n\n const existing = await engine.pool.query(`SELECT * FROM context_engine_tool_approvals WHERE id = $1`, [\n approvalId,\n ]);\n const row = existing.rows[0];\n const rowPrincipals =\n row?.principals == null || row.principals === null ? null : (row.principals as string[]);\n if (!row || !aclVisible(Array.isArray(rowPrincipals) ? rowPrincipals : null, principals)) {\n throw new ApprovalNotPending(\"not_found\");\n }\n if (row.status === \"pending\") {\n await engine.pool.query(\n `UPDATE context_engine_tool_approvals SET status = 'expired' WHERE id = $1 AND status = 'pending'`,\n [approvalId],\n );\n throw new ApprovalExpired();\n }\n throw new ApprovalNotPending(String(row.status));\n}\n\nexport async function getApproval(engine: EngineLike, approvalId: string): Promise<ApprovalRecord | null> {\n const result = await engine.pool.query(`SELECT * FROM context_engine_tool_approvals WHERE id = $1`, [\n approvalId,\n ]);\n return result.rows[0] ? rowToRecord(result.rows[0]) : null;\n}\n\nexport async function listApprovals(\n engine: EngineLike,\n opts: {\n status?: string | null;\n sourceId?: string | null;\n limit?: number;\n principals?: string[] | null | Trusted;\n approvalScope?: string | null;\n } = {},\n): Promise<ApprovalRecord[]> {\n const limit = Math.max(1, Math.min(Number(opts.limit || DEFAULT_LIST_LIMIT), MAX_LIST_LIMIT));\n const principals = opts.principals === undefined ? null : opts.principals;\n const params: unknown[] = [];\n const clauses: string[] = [];\n if (opts.status != null) {\n params.push(opts.status);\n clauses.push(`status = $${params.length}`);\n }\n if (opts.sourceId != null) {\n params.push(opts.sourceId);\n clauses.push(`source_id = $${params.length}`);\n }\n if (opts.approvalScope != null) {\n params.push(opts.approvalScope);\n clauses.push(`approval_scope = $${params.length}`);\n }\n const vis = visibilitySql(principals, params.length + 1);\n clauses.push(vis.sql);\n params.push(...vis.params);\n params.push(limit);\n const result = await engine.pool.query(\n `SELECT * FROM context_engine_tool_approvals\n WHERE ${clauses.join(\" AND \")}\n ORDER BY created_at DESC\n LIMIT $${params.length}`,\n params,\n );\n return result.rows.map(rowToRecord);\n}\n","export type ToolKind = \"http\" | \"db\" | \"mcp\" | \"function\";\n\nconst KINDS: readonly ToolKind[] = [\"http\", \"db\", \"mcp\", \"function\"];\n\nexport interface ToolConfigInit {\n id?: string | null;\n name: string;\n kind: ToolKind;\n description?: string;\n config?: Record<string, unknown>;\n sourceId?: string | null;\n source_id?: string | null;\n acl?: string[] | null;\n requiresApproval?: boolean;\n requires_approval?: boolean;\n approvalPolicy?: Record<string, unknown>;\n approval_policy?: Record<string, unknown>;\n enabled?: boolean;\n metaData?: Record<string, unknown>;\n meta_data?: Record<string, unknown>;\n}\n\n/**\n * Caller-facing shape for registering a tool. Kind-specific `config` is\n * opaque here and encrypted at rest by governance when it holds secrets.\n */\nexport class ToolConfig {\n id: string | null;\n name: string;\n kind: ToolKind;\n description: string;\n config: Record<string, unknown>;\n sourceId: string | null;\n acl: string[] | null;\n requiresApproval: boolean;\n approvalPolicy: Record<string, unknown>;\n enabled: boolean;\n /** Engine-opaque user metadata (documents have the same column). Stored\n * and returned in CLEAR on the admin surface only — secrets go in\n * `config`, which is encrypted. */\n metaData: Record<string, unknown>;\n\n constructor(init: ToolConfigInit) {\n this.id = init.id ?? null;\n this.name = init.name;\n this.kind = init.kind;\n this.description = init.description ?? \"\";\n this.config = init.config ?? {};\n this.sourceId = init.sourceId ?? init.source_id ?? null;\n this.acl = init.acl ?? null;\n this.requiresApproval = init.requiresApproval ?? init.requires_approval ?? false;\n this.approvalPolicy = init.approvalPolicy ?? init.approval_policy ?? {};\n this.enabled = init.enabled ?? true;\n this.metaData = init.metaData ?? init.meta_data ?? {};\n }\n\n static fromUnknown(body: unknown): ToolConfig {\n if (!body || typeof body !== \"object\" || Array.isArray(body)) {\n throw new Error(\"tool config must be an object\");\n }\n const b = body as Record<string, unknown>;\n const kind = String(b.kind ?? \"\") as ToolKind;\n if (!KINDS.includes(kind)) {\n throw new Error(`canonicalFromConfig does not support kind=${JSON.stringify(b.kind)}`);\n }\n const name = String(b.name ?? \"\").trim();\n if (!name) throw new Error(\"name is required\");\n return new ToolConfig({\n id: b.id != null ? String(b.id) : null,\n name,\n kind,\n description: b.description != null ? String(b.description) : \"\",\n config: (b.config as Record<string, unknown> | undefined) ?? {},\n sourceId: (b.sourceId ?? b.source_id) as string | null | undefined,\n acl: (b.acl as string[] | null | undefined) ?? null,\n requiresApproval: Boolean(b.requiresApproval ?? b.requires_approval ?? false),\n approvalPolicy: (b.approvalPolicy ?? b.approval_policy ?? {}) as Record<string, unknown>,\n enabled: b.enabled === undefined ? true : Boolean(b.enabled),\n metaData: (b.metaData ?? b.meta_data ?? {}) as Record<string, unknown>,\n });\n }\n}\n\nconst SCHEMAS: Record<ToolKind, Record<string, unknown>> = {\n http: {\n type: \"object\",\n properties: {\n url: { type: \"string\", description: \"Endpoint URL, may contain {path} params\" },\n method: {\n type: \"string\",\n enum: [\"GET\", \"POST\", \"PUT\", \"PATCH\", \"DELETE\"],\n default: \"GET\",\n },\n headers: {\n type: \"object\",\n additionalProperties: { type: \"string\" },\n writeOnly: true,\n },\n // The request body TEMPLATE (the http executor reads it). Whether it\n // round-trips is the USER's call — see `body_secret` and the\n // conditional in `redactConfig`; listing it documents the shape, the\n // redactor decides.\n body: {\n description: \"Request body template; top-level keys merge with LLM parameters\",\n },\n // Salman (2026-08-18): \"give checkbox to user\" — the author declares\n // whether their body carries secrets. True (or ABSENT — every pre-flag\n // row, fail closed) masks body values like headers; an explicit false\n // round-trips the body in clear like `url`. The flag round-trips.\n body_secret: {\n type: \"boolean\",\n description: \"Body values are write-only (mask like headers)\",\n },\n parameters: {\n type: \"object\",\n description: \"Static/user-fixed parameters sent on every call\",\n // The canonical home of a static api_key — secret by position.\n writeOnly: true,\n },\n llmParameters: {\n type: \"object\",\n description: \"JSON-Schema-shaped parameters the LLM fills in per call\",\n },\n llmQueryParameters: {\n type: \"object\",\n description: \"LLM-filled parameters sent as the query string\",\n },\n },\n required: [\"url\", \"method\"],\n },\n db: {\n type: \"object\",\n properties: {\n engine: {\n type: \"string\",\n enum: [\"postgresql\", \"mysql\", \"mariadb\", \"mssql\", \"sqlite\", \"oracle\", \"clickhouse\", \"snowflake\"],\n },\n host: { type: \"string\" },\n port: { type: \"integer\" },\n database: { type: \"string\" },\n username: { type: \"string\" },\n password: { type: \"string\", writeOnly: true },\n access_mode: {\n type: \"string\",\n enum: [\"readonly\", \"readwrite\", \"full\"],\n default: \"readonly\",\n },\n max_rows: { type: \"integer\", default: 1000 },\n selected_tables: { type: \"array\", items: { type: \"string\" } },\n // Dialect connection identifiers the db executor reads — same\n // sensitivity class as `database`, listed so they round-trip instead\n // of dying to redactConfig's default-deny.\n service_name: { type: \"string\" },\n schema_name: { type: \"string\" },\n warehouse: { type: \"string\" },\n },\n required: [\"engine\", \"database\"],\n },\n mcp: {\n type: \"object\",\n properties: {\n url: { type: \"string\" },\n transport: { type: \"string\", enum: [\"sse\", \"http\", \"websocket\"] },\n oauth: {\n type: \"object\",\n description: \"Discovered OAuth config, if any\",\n writeOnly: true,\n },\n headers: {\n type: \"object\",\n additionalProperties: { type: \"string\" },\n writeOnly: true,\n },\n },\n required: [\"url\", \"transport\"],\n },\n function: {\n type: \"object\",\n properties: {},\n },\n};\n\nexport function configSchema(kind: ToolKind): Record<string, unknown> {\n const schema = SCHEMAS[kind];\n if (!schema) throw new Error(`unknown tool kind: ${JSON.stringify(kind)}`);\n return schema;\n}\n\n// ---------------------------------------------------------------------------\n// Redacted round-trip — mirror of tools/config.py, invariant by invariant.\n//\n// The schema above says which fields round-trip: everything NOT marked\n// `writeOnly` passes through AS STORED, and only because the schema says so —\n// a key the schema does not know (an off-schema `body`, a kind outside the\n// map) is masked, never passed through. Fail closed: `kind` is an\n// unconstrained column, and the executors read keys the schema never listed.\n// Every masked VALUE leaves the server only as this sentinel; an incoming\n// sentinel means \"keep what's stored\", never \"literally this string\".\n// ---------------------------------------------------------------------------\n\nexport const REDACTED_SENTINEL = \"__redacted__\";\n\n/** A config the caller must fix — an unresolvable sentinel, a template\n * registered as a new tool, an undecryptable stored blob. Routers map it to\n * 400, mirroring Python's ValueError contract on the same paths. */\nexport class ConfigTemplateError extends Error {}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction maskValue(value: unknown): unknown {\n // Container SHAPE survives (dict keys, list length) so a form can show\n // which entries exist; every leaf becomes the sentinel. Lists recurse for\n // the same reason dicts do — and so all three walkers (mask,\n // containsSentinel, merge-resolve) agree on every container type.\n if (isPlainObject(value)) {\n const out: Record<string, unknown> = {};\n for (const [k, v] of Object.entries(value)) out[k] = maskValue(v);\n return out;\n }\n if (Array.isArray(value)) return value.map(maskValue);\n return REDACTED_SENTINEL;\n}\n\nexport function containsSentinel(value: unknown): boolean {\n if (typeof value === \"string\") return value === REDACTED_SENTINEL;\n if (Array.isArray(value)) return value.some(containsSentinel);\n if (isPlainObject(value)) return Object.values(value).some(containsSentinel);\n return false;\n}\n\n/**\n * The prefillable public view of a decrypted `config`. Default-deny: a value\n * round-trips ONLY when its key is in `kind`'s schema and not marked\n * writeOnly; everything else is masked (dict keys kept, leaves sentineled).\n */\nexport function redactConfig(kind: string, config: Record<string, unknown>): Record<string, unknown> {\n const props =\n ((SCHEMAS[kind as ToolKind]?.properties as Record<string, Record<string, unknown>>) ?? {}) || {};\n const out: Record<string, unknown> = {};\n for (const [key, value] of Object.entries(config)) {\n // The http body's author decides (body_secret checkbox): masked when\n // true or ABSENT (fail closed for pre-flag rows); an explicit false\n // round-trips it in clear, exactly like `url`.\n if (kind === \"http\" && key === \"body\") {\n out[key] = config.body_secret === false ? structuredClone(value) : maskValue(value);\n continue;\n }\n const spec = props[key];\n if (spec === undefined || spec.writeOnly) {\n out[key] = maskValue(value);\n } else {\n out[key] = structuredClone(value);\n }\n }\n return out;\n}\n\n/**\n * Update-side twin of `redactConfig`: an incoming REDACTED_SENTINEL anywhere\n * is replaced by the stored value at the same path — the client is saying\n * \"unchanged\", never \"literally this string\". No schema is consulted:\n * redaction may have masked off-schema keys, so resolution is purely\n * path-for-path. A sentinel with NO stored counterpart throws — silently\n * dropping it once saved a config with no credential and a 200, and every\n * later execution failed auth with no signal at save time.\n */\nexport function mergeRedacted(\n incoming: Record<string, unknown>,\n stored: Record<string, unknown> | null | undefined,\n): Record<string, unknown> {\n const resolve = (value: unknown, kept: unknown, keptPresent: boolean, path: string): unknown => {\n if (isPlainObject(value)) {\n const keptDict = isPlainObject(kept) ? kept : {};\n const out: Record<string, unknown> = {};\n for (const [k, v] of Object.entries(value)) {\n out[k] = resolve(v, keptDict[k], k in keptDict, path ? `${path}.${k}` : k);\n }\n return out;\n }\n if (Array.isArray(value)) {\n // Same path-for-path contract as dicts, by index. Without this a\n // sentinel inside a list slipped through the bare return below and the\n // LITERAL placeholder was encrypted and stored (containsSentinel, which\n // opens the merge path, recurses lists — the resolver must too).\n const keptList = Array.isArray(kept) ? kept : [];\n return value.map((v, i) => resolve(v, keptList[i], i < keptList.length, `${path}[${i}]`));\n }\n if (value === REDACTED_SENTINEL) {\n if (!keptPresent) {\n throw new ConfigTemplateError(\n `config.${path} is ${JSON.stringify(REDACTED_SENTINEL)} but there is no stored ` +\n `value to keep — re-enter the secret or omit the field`,\n );\n }\n return kept;\n }\n return value;\n };\n const keptRoot = stored ?? {};\n const out: Record<string, unknown> = {};\n for (const [k, v] of Object.entries(incoming)) {\n out[k] = resolve(v, keptRoot[k], k in keptRoot, k);\n }\n return out;\n}\n","import { createCipheriv, createDecipheriv, createHmac, randomBytes } from \"node:crypto\";\n\n/**\n * AES-256-GCM crypto seam. Wire format is a compatibility promise with the\n * Python library and promptev-connectors:\n * base64(nonce[12] || AES-256-GCM ciphertext+tag)\n */\n\nexport function encryptDict(data: Record<string, unknown>, key: Buffer): string {\n const nonce = randomBytes(12);\n const cipher = createCipheriv(\"aes-256-gcm\", key, nonce);\n const plaintext = Buffer.from(JSON.stringify(data), \"utf8\");\n const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);\n const tag = cipher.getAuthTag();\n return Buffer.concat([nonce, ciphertext, tag]).toString(\"base64\");\n}\n\nexport function decryptDict(token: string, key: Buffer): Record<string, unknown> {\n const raw = Buffer.from(token, \"base64\");\n const nonce = raw.subarray(0, 12);\n const tag = raw.subarray(raw.length - 16);\n const ciphertext = raw.subarray(12, raw.length - 16);\n const decipher = createDecipheriv(\"aes-256-gcm\", key, nonce);\n decipher.setAuthTag(tag);\n const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);\n return JSON.parse(plaintext.toString(\"utf8\")) as Record<string, unknown>;\n}\n\nexport function getSecretKey(config: { secretKey?: string | null }): Buffer {\n const secretKey = config.secretKey;\n if (!secretKey) {\n throw new Error(\n \"ContextEngineConfig.secretKey (env CE_SECRET_KEY) is not configured — \" +\n \"a base64url-encoded 32-byte AES key is required to encrypt/decrypt \" +\n \"tool configs that hold secrets.\",\n );\n }\n return Buffer.from(secretKey, \"base64url\");\n}\n\nexport function hmacSha256Hex(key: string | Buffer, value: string): string {\n const k = typeof key === \"string\" ? Buffer.from(key) : key;\n return createHmac(\"sha256\", k).update(value, \"utf8\").digest(\"hex\");\n}\n","/**\n * Where the tool plane is allowed to connect, and how much it will read back.\n *\n * An `http` tool is a URL supplied by whoever registered the tool, fetched by\n * the SERVER. That is the classic server-side request forgery shape: from\n * inside a deployment, `http://127.0.0.1:8000/admin`,\n * `http://10.0.0.5/internal` and `http://169.254.169.254/latest/meta-data/`\n * (the cloud instance-metadata address, which hands out role credentials) are\n * all reachable, and reachable from nowhere else. The same holds for a\n * redirect the endpoint hands back, and for `testTool`'s HEAD probe.\n *\n * So every destination the tool plane connects to goes through\n * `assertEgressAllowed` first: the initial URL, and every redirect hop before\n * it is followed.\n *\n * Two limits accompany the check. `MAX_REDIRECTS` bounds the hop chain (a\n * redirect loop is otherwise an unbounded request amplifier), and\n * `MAX_RESPONSE_BYTES` bounds the body handed on to the caller — a tool\n * result lands in an audit row and in a model's context window, and neither\n * wants a gigabyte.\n *\n * The check is by RESOLVED address: a hostname is resolved and every answer\n * must be public. A name that re-resolves to a private address between this\n * check and the connect (DNS rebinding) is out of scope — closing that\n * requires pinning the connection to the checked address, which the HTTP\n * clients in use here do not expose.\n *\n * Mirrors `context_engine/tools/egress.py`. Dependency-free (`node:net`,\n * `node:dns`) so the policy can be read, tested and kept in step on its own.\n */\n\nimport { promises as dns } from \"node:dns\";\nimport { isIP } from \"node:net\";\n\n/** The body a tool call hands back, in bytes. Cut here, flagged `truncated`. */\nexport const MAX_RESPONSE_BYTES = 1_000_000;\n\n/** Redirect hops followed before the call is abandoned. */\nexport const MAX_REDIRECTS = 5;\n\n/**\n * Did this response redirect? A 3xx status — or the opaque stand-in a\n * browser/edge `fetch` hands back under `redirect: \"manual\"`, where `status`\n * is `0`, `type` is `\"opaqueredirect\"` and nothing else on it is readable.\n *\n * Every caller that refuses to chase a redirect asks through here: a bare\n * `status >= 300 && status < 400` reads the opaque one as a plain HTTP 0 and\n * falls through to the branch for a NON-redirect, which is how a refusal\n * turns into a generic error (or, on a probe, into a success).\n *\n * Structural on purpose — a real `Response`, and the shaped objects this\n * package passes around, both satisfy it. Node's `undici` reports the real\n * 3xx, so this is the same test there.\n */\nexport function isRedirect(resp: { status: number; type?: string }): boolean {\n return (resp.status >= 300 && resp.status < 400) || resp.type === \"opaqueredirect\";\n}\n\n/**\n * The tool plane refused to connect to a destination — it reports a caller's\n * configuration (a registered tool's URL, or the target of a redirect that\n * tool returned), not a transient failure.\n */\nexport class EgressDenied extends Error {\n constructor(message: string) {\n super(message);\n this.name = \"EgressDenied\";\n }\n}\n\n/**\n * The single seam that talks to the resolver — tests replace `lookup` and\n * nothing else in this module reaches DNS.\n */\nexport const resolver = {\n async lookup(host: string): Promise<string[]> {\n const answers = await dns.lookup(host, { all: true, verbatim: true });\n return answers.map((a) => a.address);\n },\n};\n\n// THE table. Membership in it is the whole policy, written out here rather\n// than delegated to a runtime's own \"is private\" helper: Python's `ipaddress`\n// internals move between releases and Node has no equivalent at all, so a\n// shared, explicit list is the only way the two ports can agree.\n// `src/context_engine/tools/egress.py` carries the same two lists, entry for\n// entry; changing one means changing both.\nconst V4_PRIVATE: Array<[string, number]> = [\n [\"0.0.0.0\", 8], // \"this network\" / unspecified\n [\"10.0.0.0\", 8], // RFC 1918\n [\"100.64.0.0\", 10], // RFC 6598 carrier-grade NAT — overlay VPNs, pod CIDRs\n [\"127.0.0.0\", 8], // loopback\n [\"169.254.0.0\", 16], // link-local, incl. the cloud metadata address\n [\"172.16.0.0\", 12], // RFC 1918\n [\"192.168.0.0\", 16], // RFC 1918\n [\"224.0.0.0\", 4], // multicast\n [\"240.0.0.0\", 4], // reserved\n [\"255.255.255.255\", 32], // broadcast (inside 240/4; spelled out anyway)\n];\n\nconst V6_PRIVATE: Array<[string, number]> = [\n [\"::\", 128], // unspecified\n [\"::1\", 128], // loopback\n [\"::ffff:0:0\", 96], // IPv4-mapped — the wrapped v4 is checked too\n [\"64:ff9b::\", 96], // NAT64 — the wrapped v4 is checked too\n [\"2002::\", 16], // 6to4 — the wrapped v4 is checked too, and this is denied\n [\"fc00::\", 7], // unique local\n [\"fe80::\", 10], // link-local\n [\"fec0::\", 10], // site-local (deprecated, still configured)\n [\"ff00::\", 8], // multicast\n [\"3fff::\", 20], // documentation\n];\n\n/** `1.2.3.4` -> its 4 bytes. `null` when it is not a dotted quad. */\nfunction parseV4(text: string): Uint8Array | null {\n const parts = text.split(\".\");\n if (parts.length !== 4) return null;\n const out = new Uint8Array(4);\n for (let i = 0; i < 4; i++) {\n const part = parts[i] as string;\n if (!/^\\d{1,3}$/.test(part)) return null;\n const value = Number(part);\n if (value > 255) return null;\n out[i] = value;\n }\n return out;\n}\n\n/**\n * An IPv6 literal -> its 16 bytes. Handles `::` compression and a trailing\n * dotted quad (`::ffff:127.0.0.1`). `null` when it does not parse.\n */\nfunction parseV6(text: string): Uint8Array | null {\n let body = text.split(\"%\")[0] ?? \"\";\n const lastColon = body.lastIndexOf(\":\");\n if (lastColon < 0) return null;\n const tail = body.slice(lastColon + 1);\n if (tail.includes(\".\")) {\n const v4 = parseV4(tail);\n if (!v4) return null;\n const hi = (((v4[0] as number) << 8) | (v4[1] as number)).toString(16);\n const lo = (((v4[2] as number) << 8) | (v4[3] as number)).toString(16);\n body = `${body.slice(0, lastColon + 1)}${hi}:${lo}`;\n }\n const halves = body.split(\"::\");\n if (halves.length > 2) return null;\n const head = halves[0] ? (halves[0] as string).split(\":\") : [];\n const rest = halves.length === 2 && halves[1] ? (halves[1] as string).split(\":\") : [];\n let groups: string[];\n if (halves.length === 1) {\n if (head.length !== 8) return null;\n groups = head;\n } else {\n const missing = 8 - head.length - rest.length;\n if (missing < 0) return null;\n groups = [...head, ...Array(missing).fill(\"0\"), ...rest];\n }\n const out = new Uint8Array(16);\n for (let i = 0; i < 8; i++) {\n const group = groups[i] as string;\n if (!/^[0-9a-f]{1,4}$/i.test(group)) return null;\n const value = Number.parseInt(group, 16);\n out[2 * i] = value >> 8;\n out[2 * i + 1] = value & 0xff;\n }\n return out;\n}\n\nfunction parseAddress(text: string): Uint8Array | null {\n const family = isIP(text);\n if (family === 4) return parseV4(text);\n if (family === 6) return parseV6(text);\n return null;\n}\n\n/** Bit-prefix membership: the first `prefix` bits of `addr` and `net` agree. */\nfunction inNet(addr: Uint8Array, net: Uint8Array, prefix: number): boolean {\n if (addr.length !== net.length) return false;\n const whole = prefix >> 3;\n for (let i = 0; i < whole; i++) if (addr[i] !== net[i]) return false;\n const bits = prefix & 7;\n if (bits === 0) return true;\n const mask = 0xff << (8 - bits);\n return ((addr[whole] as number) & mask) === ((net[whole] as number) & mask);\n}\n\nfunction compile(table: Array<[string, number]>): Array<[Uint8Array, number]> {\n return table.map(([cidr, prefix]) => {\n const bytes = parseAddress(cidr);\n if (!bytes) throw new Error(`egress: unparseable network ${cidr}`);\n return [bytes, prefix] as [Uint8Array, number];\n });\n}\n\nconst V4_NETS = compile(V4_PRIVATE);\nconst V6_NETS = compile(V6_PRIVATE);\n\nconst MAPPED_V4 = compile([[\"::ffff:0:0\", 96]])[0] as [Uint8Array, number];\nconst NAT64 = compile([[\"64:ff9b::\", 96]])[0] as [Uint8Array, number];\nconst SIXTOFOUR = compile([[\"2002::\", 16]])[0] as [Uint8Array, number];\n\n/**\n * The IPv4 address an IPv6 one wraps, if it wraps one — mapped, NAT64 or\n * 6to4. Each is unwrapped and checked against the v4 table, so\n * `2002:7f00:1::1` (6to4 of 127.0.0.1) and `64:ff9b::a00:1` (NAT64 of\n * 10.0.0.1) cannot reach something the v4 table forbids.\n */\nfunction embeddedV4(bytes: Uint8Array): Uint8Array | null {\n if (inNet(bytes, MAPPED_V4[0], MAPPED_V4[1]) || inNet(bytes, NAT64[0], NAT64[1])) {\n return bytes.subarray(12, 16);\n }\n if (inNet(bytes, SIXTOFOUR[0], SIXTOFOUR[1])) return bytes.subarray(2, 6);\n return null;\n}\n\n/** True when `address` is in the table above — the only definition of private. */\nfunction addressIsPrivate(address: string): boolean {\n const bytes = parseAddress(address);\n if (!bytes) return true; // not an address we can reason about\n if (bytes.length === 4) return V4_NETS.some(([net, prefix]) => inNet(bytes, net, prefix));\n const embedded = embeddedV4(bytes);\n if (embedded && V4_NETS.some(([net, prefix]) => inNet(embedded, net, prefix))) return true;\n return V6_NETS.some(([net, prefix]) => inNet(bytes, net, prefix));\n}\n\n/**\n * True when `host` names something inside the deployment.\n *\n * An IP literal is decided from the literal alone — no resolution. A hostname\n * is resolved and is private if ANY answer is private (a split-horizon name\n * that answers with one public and one internal address is an internal name).\n * A hostname that does not resolve is private too: an answer we could not\n * obtain is not an answer we can trust.\n */\nexport async function isPrivateAddress(host: string): Promise<boolean> {\n let name = (host ?? \"\")\n .trim()\n .toLowerCase()\n .replace(/^\\.+|\\.+$/g, \"\");\n if (!name) return true;\n if (name === \"localhost\") return true;\n // Bracketed IPv6 as it appears in a URL authority (`URL.hostname` keeps the\n // brackets).\n if (name.startsWith(\"[\") && name.endsWith(\"]\")) name = name.slice(1, -1);\n\n if (isIP(name)) return addressIsPrivate(name);\n\n let addresses: string[];\n try {\n addresses = await resolver.lookup(name);\n } catch {\n return true;\n }\n if (!addresses.length) return true;\n return addresses.some((address) => addressIsPrivate(address.split(\"%\")[0] ?? address));\n}\n\n/**\n * Throw `EgressDenied` unless the tool plane may connect to `url`.\n *\n * The message names the host the caller supplied and never the address it\n * resolved to — the resolution result is exactly the internal detail this\n * check exists to keep inside.\n */\nexport async function assertEgressAllowed(url: string, opts: { allowPrivate: boolean }): Promise<void> {\n let parsed: URL;\n try {\n parsed = new URL(url ?? \"\");\n } catch {\n throw new EgressDenied(`egress denied: ${JSON.stringify(url)} is not a valid URL`);\n }\n const scheme = parsed.protocol.replace(/:$/, \"\").toLowerCase();\n if (scheme !== \"http\" && scheme !== \"https\") {\n throw new EgressDenied(\n `egress denied: unsupported URL scheme ${JSON.stringify(scheme)} — ` +\n `http tools may only reach http/https`,\n );\n }\n if (opts.allowPrivate) return;\n const host = parsed.hostname;\n if (await isPrivateAddress(host)) {\n throw new EgressDenied(\n `egress denied: ${host || \"(no host)\"} is a private, loopback, link-local or ` +\n `metadata address; set allowPrivateEgress to permit it`,\n );\n }\n}\n","/** Bumped by CI on every main merge; 0.0.0 = pre-first-release. */\nexport const __version__ = \"0.0.0\";\n","import { __version__ } from \"../../version.js\";\nimport { assertEgressAllowed, isRedirect } from \"../egress.js\";\n\n/**\n * Every destination this module dials is cleared by the tool plane's egress\n * policy (`tools/egress.ts`) first. An MCP server URL is supplied by whoever\n * registered the tool and dialled by the SERVER — the same server-side\n * request forgery shape an `http` tool has — and one connection has two more\n * destinations beyond the configured URL: the POST endpoint an SSE server\n * hands back in its `endpoint` event, and a redirect. Both are checked, and\n * the HTTP/SSE transports refuse redirects outright rather than following one\n * somewhere no check ever saw.\n *\n * `ws`/`wss` are mapped onto `http`/`https` before the check rather than\n * added to the policy module's scheme table: that table answers which schemes\n * an `http` TOOL may name, and widening it there would quietly let one be\n * registered with a `ws://` URL. What matters for egress is the address a\n * socket is opened to, which a WebSocket URL names exactly the way an HTTP\n * one does.\n *\n * Mirrors `context_engine/tools/executors/mcp_client.py::_check_egress`.\n */\nasync function checkEgress(url: string, allowPrivate: boolean): Promise<void> {\n let checked = url;\n const scheme = (/^([a-z0-9+.-]+):/i.exec(url ?? \"\")?.[1] ?? \"\").toLowerCase();\n if (scheme === \"ws\") checked = `http:${url.slice(scheme.length + 1)}`;\n else if (scheme === \"wss\") checked = `https:${url.slice(scheme.length + 1)}`;\n await assertEgressAllowed(checked, { allowPrivate });\n}\n\n/** A 3xx from an MCP server. Named once so both transports say the same. */\nconst REDIRECT_MESSAGE = \"MCP server redirected; register the final URL\";\n\nexport class MCPError extends Error {\n code: number;\n data: unknown;\n constructor(code: number, message: string, data: unknown = null) {\n super(`[${code}] ${message}`);\n this.name = \"MCPError\";\n this.code = code;\n this.data = data;\n }\n static fromJsonrpc(err: Record<string, unknown>): MCPError {\n return new MCPError(Number(err.code ?? -32000), String(err.message ?? \"MCP error\"), err.data);\n }\n}\n\ninterface Transport {\n kind: string;\n connect(): Promise<void>;\n close(): Promise<void>;\n send(msg: Record<string, unknown>): Promise<void>;\n recv(): Promise<Record<string, unknown>>;\n request?(msg: Record<string, unknown>): Promise<Record<string, unknown>>;\n}\n\nfunction parseSseBuffer(raw: string): Record<string, unknown> | null {\n const dataLines = raw\n .split(\"\\n\")\n .filter((ln) => ln.startsWith(\"data:\"))\n .map((ln) => ln.slice(5).trimStart());\n if (!dataLines.length) return null;\n try {\n const payload = JSON.parse(dataLines.join(\"\\n\"));\n if (payload && typeof payload === \"object\" && (\"result\" in payload || \"error\" in payload)) {\n return payload as Record<string, unknown>;\n }\n } catch {\n /* ignore */\n }\n return null;\n}\n\nexport class HttpTransport implements Transport {\n kind = \"http\";\n url: string;\n allowPrivate: boolean;\n private baseHeaders: Record<string, string>;\n private sessionId: string | null = null;\n\n constructor(url: string, headers: Record<string, string>, allowPrivate = false) {\n this.url = url;\n this.allowPrivate = allowPrivate;\n this.baseHeaders = {\n ...headers,\n \"Content-Type\": \"application/json\",\n Accept: \"application/json, text/event-stream\",\n };\n }\n\n async connect(): Promise<void> {\n // Stateless HTTP: nothing to open, but the URL came from whoever\n // registered the tool and is cleared before the first request.\n await checkEgress(this.url, this.allowPrivate);\n }\n\n async close(): Promise<void> {\n this.sessionId = null;\n }\n\n private buildHeaders(): Record<string, string> {\n const hdrs = { ...this.baseHeaders };\n if (this.sessionId) hdrs[\"Mcp-Session-Id\"] = this.sessionId;\n return hdrs;\n }\n\n async request(msg: Record<string, unknown>): Promise<Record<string, unknown>> {\n const resp = await fetch(this.url, {\n method: \"POST\",\n headers: this.buildHeaders(),\n body: JSON.stringify(msg),\n // `redirect: \"manual\"`: a followed redirect would carry this POST —\n // headers, Authorization and all — to a destination `connect()`'s\n // check never saw. A 3xx is reported, never chased.\n redirect: \"manual\",\n });\n const sid = resp.headers.get(\"Mcp-Session-Id\");\n if (sid) this.sessionId = sid;\n if (isRedirect(resp)) {\n throw new MCPError(resp.status, REDIRECT_MESSAGE);\n }\n if (resp.status >= 400) {\n const body = await resp.text();\n console.error(`[HTTP Transport] ${resp.status} from ${this.url}: ${body.slice(0, 300)}`);\n throw new Error(`HTTP ${resp.status}: ${body.slice(0, 300)}`);\n }\n const contentType = resp.headers.get(\"Content-Type\") ?? \"\";\n if (contentType.includes(\"text/event-stream\")) {\n const text = await resp.text();\n let result: Record<string, unknown> = {};\n for (const frame of text.split(/\\r?\\n\\r?\\n/)) {\n const parsed = parseSseBuffer(frame);\n if (parsed) result = parsed;\n }\n return result;\n }\n return (await resp.json()) as Record<string, unknown>;\n }\n\n async send(msg: Record<string, unknown>): Promise<void> {\n await this.request(msg);\n }\n\n async recv(): Promise<Record<string, unknown>> {\n return {};\n }\n\n getBaseHeaders(): Record<string, string> {\n return { ...this.baseHeaders };\n }\n}\n\nexport class SseTransport implements Transport {\n kind = \"sse\";\n eventsUrl: string;\n baseUrl: string;\n headers: Record<string, string>;\n allowPrivate: boolean;\n /** Where the server told us to POST — it arrives in an `endpoint` event on\n * the stream, so it is server-chosen and hence checked. Private: the only\n * way in is the parser, which is the path a real server takes. */\n private postUrl: string | null = null;\n /** The last POST endpoint cleared by the egress check. The check costs a\n * DNS resolution and the endpoint changes at most once per connection, so\n * it is not repeated per message. */\n private checkedPostUrl: string | null = null;\n private queue: Array<Record<string, unknown>> = [];\n private waiters: Array<(v: Record<string, unknown>) => void> = [];\n private abort: AbortController | null = null;\n\n constructor(url: string, headers: Record<string, string>, allowPrivate = false) {\n this.allowPrivate = allowPrivate;\n this.eventsUrl = url.replace(/\\/$/, \"\");\n if (url.endsWith(\"/events\")) this.baseUrl = url.slice(0, -7);\n else if (url.endsWith(\"/sse\")) this.baseUrl = url.slice(0, -4);\n else this.baseUrl = url.replace(/\\/$/, \"\");\n this.headers = { ...headers };\n }\n\n private enqueue(msg: Record<string, unknown>): void {\n const waiter = this.waiters.shift();\n if (waiter) waiter(msg);\n else this.queue.push(msg);\n }\n\n async connect(): Promise<void> {\n await checkEgress(this.eventsUrl, this.allowPrivate);\n this.abort = new AbortController();\n void this.listen();\n }\n\n private async listen(): Promise<void> {\n const resp = await fetch(this.eventsUrl, {\n headers: { ...this.headers, Accept: \"text/event-stream\" },\n signal: this.abort?.signal,\n redirect: \"manual\",\n });\n if (isRedirect(resp)) {\n throw new MCPError(resp.status, REDIRECT_MESSAGE);\n }\n if (!resp.ok) throw new Error(`SSE ${resp.status}`);\n if (!resp.body) throw new Error(\"SSE response has no body\");\n const reader = resp.body.getReader();\n const decoder = new TextDecoder();\n let buf = \"\";\n let eventType: string | null = null;\n const frame: string[] = [];\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n buf += decoder.decode(value, { stream: true });\n const lines = buf.split(/\\n/);\n buf = lines.pop() ?? \"\";\n for (const line of lines) {\n if (line === \"\" || line === \"\\r\") {\n this.dispatchFrame(frame, eventType);\n frame.length = 0;\n eventType = null;\n continue;\n }\n const stripped = line.replace(/\\r$/, \"\");\n if (stripped.startsWith(\"event:\")) eventType = stripped.slice(6).trim();\n frame.push(stripped);\n }\n }\n }\n\n private dispatchFrame(buf: string[], eventType: string | null): void {\n const dataLines = buf.filter((l) => l.startsWith(\"data:\")).map((l) => l.slice(5).trimStart());\n if (!dataLines.length) return;\n const payload = dataLines.join(\"\\n\");\n if (eventType === \"endpoint\") {\n const endpoint = payload.trim();\n this.postUrl = endpoint.startsWith(\"/\") ? `${this.baseUrl}${endpoint}` : endpoint;\n return;\n }\n try {\n this.enqueue(JSON.parse(payload) as Record<string, unknown>);\n } catch {\n /* non-JSON frame */\n }\n }\n\n async close(): Promise<void> {\n this.abort?.abort();\n }\n\n async send(msg: Record<string, unknown>): Promise<void> {\n if (!this.postUrl) {\n for (let i = 0; i < 30; i++) {\n if (this.postUrl) break;\n await new Promise((r) => setTimeout(r, 100));\n }\n }\n const postUrl = this.postUrl || this.baseUrl;\n // The `endpoint` event is the server naming a SECOND destination, one it\n // chose: a public SSE server can hand back `http://169.254.169.254/`.\n // Checked before the first POST to it, and again whenever it changes.\n if (postUrl !== this.checkedPostUrl) {\n await checkEgress(postUrl, this.allowPrivate);\n this.checkedPostUrl = postUrl;\n }\n const resp = await fetch(postUrl, {\n method: \"POST\",\n headers: { ...this.headers, \"Content-Type\": \"application/json\" },\n body: JSON.stringify(msg),\n redirect: \"manual\",\n });\n if (isRedirect(resp)) {\n throw new MCPError(resp.status, REDIRECT_MESSAGE);\n }\n if (!resp.ok) throw new Error(`SSE POST ${resp.status}`);\n try {\n const data = (await resp.json()) as Record<string, unknown>;\n if (data && typeof data === \"object\" && (\"result\" in data || \"error\" in data)) {\n this.enqueue(data);\n }\n } catch {\n /* response will come via SSE stream */\n }\n }\n\n async recv(): Promise<Record<string, unknown>> {\n if (this.queue.length) return this.queue.shift()!;\n return new Promise((resolve) => this.waiters.push(resolve));\n }\n}\n\nexport class WsTransport implements Transport {\n kind = \"websocket\";\n url: string;\n headers: Record<string, string>;\n allowPrivate: boolean;\n private ws: WebSocket | null = null;\n private queue: Array<Record<string, unknown>> = [];\n private waiters: Array<(v: Record<string, unknown>) => void> = [];\n\n constructor(url: string, headers: Record<string, string>, allowPrivate = false) {\n this.url = url;\n this.allowPrivate = allowPrivate;\n this.headers = headers;\n }\n\n async connect(): Promise<void> {\n // `ws`/`wss` are mapped onto `http`/`https` for the check — see\n // `checkEgress`. The WebSocket constructor exposes no redirect option and\n // needs none: Node's implementation (undici) runs the handshake with\n // `redirect: \"error\"`, so a 3xx fails there rather than being followed.\n // The Python port has to add the refusal by hand — aiohttp's handshake\n // GET follows by default (see `mcp_client.py::_refuse_redirects_trace`).\n await checkEgress(this.url, this.allowPrivate);\n const WS = globalThis.WebSocket;\n if (!WS) throw new Error(\"WebSocket is not available in this runtime\");\n this.ws = new WS(this.url);\n this.ws.addEventListener(\"message\", (ev) => {\n try {\n const data = JSON.parse(String((ev as MessageEvent).data)) as Record<string, unknown>;\n const waiter = this.waiters.shift();\n if (waiter) waiter(data);\n else this.queue.push(data);\n } catch {\n /* ignore */\n }\n });\n await new Promise<void>((resolve, reject) => {\n this.ws!.addEventListener(\"open\", () => resolve());\n this.ws!.addEventListener(\"error\", () => reject(new Error(\"WebSocket error\")));\n });\n }\n\n async close(): Promise<void> {\n this.ws?.close();\n this.ws = null;\n }\n\n async send(msg: Record<string, unknown>): Promise<void> {\n if (!this.ws) throw new Error(\"Not connected\");\n this.ws.send(JSON.stringify(msg));\n }\n\n async recv(): Promise<Record<string, unknown>> {\n if (this.queue.length) return this.queue.shift()!;\n return new Promise((resolve) => this.waiters.push(resolve));\n }\n}\n\nexport class MCPClient {\n url: string;\n transport: Transport;\n connected = false;\n private id = 0;\n private pending = new Map<\n string,\n { resolve: (v: Record<string, unknown>) => void; reject: (e: unknown) => void }\n >();\n capabilities: Record<string, unknown> = {};\n tools: Array<Record<string, unknown>> = [];\n resources: Array<Record<string, unknown>> = [];\n private headers: Record<string, string>;\n allowPrivate: boolean;\n\n constructor(\n url: string,\n headers: Record<string, string> | null = null,\n opts: { allowPrivate?: boolean } = {},\n ) {\n this.url = url;\n this.headers = headers ?? {};\n this.allowPrivate = opts.allowPrivate ?? false;\n this.transport = MCPClient.createTransport(url, this.headers, this.allowPrivate);\n }\n\n static createTransport(url: string, headers: Record<string, string>, allowPrivate = false): Transport {\n if (url.startsWith(\"stdio:\") || url === \"stdio\") {\n throw new Error(\"stdio MCP transport is not supported (cloud deployments use SSE/HTTP/WebSocket)\");\n }\n if (url.startsWith(\"ws://\") || url.startsWith(\"wss://\")) {\n return new WsTransport(url, headers, allowPrivate);\n }\n if (\n url.startsWith(\"sse+http://\") ||\n url.startsWith(\"sse+https://\") ||\n url.endsWith(\"/events\") ||\n url.endsWith(\"/sse\")\n ) {\n const clean = url.replace(\"sse+http://\", \"http://\").replace(\"sse+https://\", \"https://\");\n return new SseTransport(clean, headers, allowPrivate);\n }\n if (url.startsWith(\"http://\") || url.startsWith(\"https://\")) {\n return new HttpTransport(url, headers, allowPrivate);\n }\n throw new Error(`Unsupported URL: ${url} (use http(s)://, ws(s)://, or .../sse)`);\n }\n\n private nextId(): string {\n this.id += 1;\n return String(this.id);\n }\n\n private async recvLoop(): Promise<void> {\n while (this.connected) {\n const msg = await this.transport.recv();\n if (!msg) continue;\n const mid = msg.id != null ? String(msg.id) : null;\n if (mid && (\"result\" in msg || \"error\" in msg)) {\n const fut = this.pending.get(mid);\n this.pending.delete(mid);\n fut?.resolve(msg);\n }\n }\n }\n\n private async rpc(\n method: string,\n params: Record<string, unknown> | null = null,\n timeout = 60_000,\n ): Promise<unknown> {\n const mid = this.nextId();\n const payload = { jsonrpc: \"2.0\", id: mid, method, params: params ?? {} };\n if (this.transport instanceof HttpTransport) {\n const msg = await this.transport.request(payload);\n if (msg.error) throw MCPError.fromJsonrpc(msg.error as Record<string, unknown>);\n return msg.result ?? {};\n }\n const msg = await new Promise<Record<string, unknown>>((resolve, reject) => {\n const timer = setTimeout(() => {\n this.pending.delete(mid);\n reject(new Error(`MCP RPC '${method}' timed out after ${timeout}ms`));\n }, timeout);\n this.pending.set(mid, {\n resolve: (v) => {\n clearTimeout(timer);\n resolve(v);\n },\n reject,\n });\n void this.transport.send(payload).catch((e) => {\n clearTimeout(timer);\n this.pending.delete(mid);\n reject(e);\n });\n });\n if (msg.error) throw MCPError.fromJsonrpc(msg.error as Record<string, unknown>);\n return msg.result ?? {};\n }\n\n private async notify(method: string, params: Record<string, unknown> | null = null): Promise<void> {\n await this.transport.send({ jsonrpc: \"2.0\", method, params: params ?? {} });\n }\n\n async connect(): Promise<void> {\n try {\n await this.transport.connect();\n } catch (e) {\n // A transport can create its socket and THEN fail — a refused upgrade,\n // a redirected handshake, an SSE endpoint the policy denies. This dial\n // used to sit outside the `try` below, so nothing closed it. Every\n // transport's `close()` is a no-op when nothing was opened.\n try {\n await this.transport.close();\n } catch {\n /* ignore */\n }\n throw e;\n }\n if (!(this.transport instanceof HttpTransport)) {\n this.connected = true;\n void this.recvLoop();\n }\n try {\n const init = (await this.rpc(\"initialize\", {\n protocolVersion: \"2024-11-05\",\n capabilities: { roots: { listChanged: true }, sampling: {} },\n clientInfo: { name: \"context-engine\", version: __version__ },\n })) as Record<string, unknown>;\n this.capabilities = (init.capabilities as Record<string, unknown>) ?? {};\n await this.notify(\"notifications/initialized\");\n this.connected = true;\n } catch (e) {\n await this.close();\n throw e;\n }\n }\n\n async close(): Promise<void> {\n this.connected = false;\n for (const [, fut] of this.pending) fut.reject(new Error(\"closed\"));\n this.pending.clear();\n try {\n await this.transport.close();\n } catch {\n /* ignore */\n }\n }\n\n async listTools(): Promise<Array<Record<string, unknown>>> {\n const res = (await this.rpc(\"tools/list\")) as Record<string, unknown>;\n this.tools = (res.tools as Array<Record<string, unknown>>) ?? [];\n return this.tools;\n }\n\n async listResources(): Promise<Array<Record<string, unknown>>> {\n try {\n const res = (await this.rpc(\"resources/list\", null, 10_000)) as Record<string, unknown>;\n this.resources = (res.resources as Array<Record<string, unknown>>) ?? [];\n } catch {\n this.resources = [];\n }\n return this.resources;\n }\n\n async callTool(toolName: string, arguments_: Record<string, unknown>, timeout = 120_000): Promise<unknown> {\n return this.rpc(\"tools/call\", { name: toolName, arguments: arguments_ }, timeout);\n }\n\n async ping(): Promise<boolean> {\n try {\n await this.rpc(\"ping\", {}, 10_000);\n return true;\n } catch {\n return false;\n }\n }\n\n async callToolWithReconnect(\n toolName: string,\n arguments_: Record<string, unknown>,\n timeout = 120_000,\n ): Promise<unknown> {\n try {\n if (!this.connected) throw new Error(\"Not connected\");\n return await this.callTool(toolName, arguments_, timeout);\n } catch (e) {\n console.warn(`[MCP] Connection issue during call_tool(${toolName}), reconnecting:`, e);\n try {\n await this.reconnect();\n return await this.callTool(toolName, arguments_, timeout);\n } catch (retryErr) {\n throw new Error(`Reconnect failed: ${retryErr}`, { cause: e });\n }\n }\n }\n\n async reconnect(): Promise<void> {\n const url = this.url;\n let headers: Record<string, string> = {};\n if (this.transport instanceof HttpTransport) {\n headers = this.transport.getBaseHeaders();\n delete headers[\"Content-Type\"];\n delete headers.Accept;\n } else if (this.transport instanceof SseTransport || this.transport instanceof WsTransport) {\n headers = { ...this.transport.headers };\n }\n try {\n await this.close();\n } catch {\n /* ignore */\n }\n this.id = 0;\n this.pending.clear();\n this.transport = MCPClient.createTransport(url, headers, this.allowPrivate);\n await this.connect();\n await this.listTools();\n }\n}\n\nexport class MCPRegistry {\n private clients = new Map<string, MCPClient>();\n private healthTask: ReturnType<typeof setInterval> | null = null;\n\n async connect(\n name: string,\n url: string,\n headers: Record<string, string> | null = null,\n token: string | null = null,\n allowPrivate = false,\n ): Promise<void> {\n this.clients.delete(name);\n const hdrs = { ...(headers ?? {}) };\n if (token) hdrs.Authorization = hdrs.Authorization ?? `Bearer ${token}`;\n const client = new MCPClient(url, hdrs, { allowPrivate });\n await client.connect();\n await client.listTools();\n this.clients.set(name, client);\n if (!this.healthTask) {\n this.healthTask = setInterval(() => void this.healthLoopOnce(), 60_000);\n }\n }\n\n private async healthLoopOnce(): Promise<void> {\n for (const [name, client] of [...this.clients.entries()]) {\n if (!client.connected) continue;\n try {\n const alive = await client.ping();\n if (!alive) await client.reconnect();\n } catch (e) {\n console.warn(`[MCP Health] ${name} health check error:`, e);\n try {\n await client.reconnect();\n } catch {\n this.clients.delete(name);\n }\n }\n }\n }\n\n get(name: string): MCPClient {\n const c = this.clients.get(name);\n if (!c) throw new Error(`Unknown MCP server: '${name}'`);\n return c;\n }\n\n has(name: string): boolean {\n return this.clients.has(name);\n }\n\n async disconnect(name: string): Promise<void> {\n const c = this.clients.get(name);\n this.clients.delete(name);\n if (c) {\n try {\n await c.close();\n } catch {\n /* ignore */\n }\n }\n }\n\n async shutdown(): Promise<void> {\n if (this.healthTask) {\n clearInterval(this.healthTask);\n this.healthTask = null;\n }\n for (const name of [...this.clients.keys()]) await this.disconnect(name);\n }\n}\n\nexport class PromptevMCP {\n clients = new MCPRegistry();\n allowPrivate: boolean;\n\n /**\n * `allowPrivate` is the operator knob `allowPrivateEgress`, carried down to\n * every transport this facade builds. It defaults to `false`, so a\n * construction site that forgets to pass it denies private destinations\n * rather than permitting them.\n */\n constructor(opts: { allowPrivate?: boolean } = {}) {\n this.allowPrivate = opts.allowPrivate ?? false;\n }\n\n async addServer(\n name: string,\n url: string,\n opts: { token?: string | null; headers?: Record<string, string> | null } = {},\n ): Promise<void> {\n await this.clients.connect(name, url, opts.headers ?? null, opts.token ?? null, this.allowPrivate);\n }\n\n async shutdown(): Promise<void> {\n await this.clients.shutdown();\n }\n}\n","import { randomUUID } from \"node:crypto\";\nimport type { Pool } from \"pg\";\nimport type { ContextEngineConfig } from \"../config.js\";\nimport { EngineActionError } from \"../errors.js\";\nimport { emitUsage, type Hooks } from \"../hooks.js\";\nimport { applyRedaction, type RedactionPolicy } from \"../redaction.js\";\nimport { TRUSTED, type Trusted } from \"../sentinels.js\";\nimport type { UsageEvent } from \"../usage.js\";\nimport { aclVisible } from \"./acl.js\";\nimport {\n claimVisibilitySql,\n createPending,\n findOrCreatePending,\n shouldRequireApproval,\n validateApprovalScope,\n} from \"./approval.js\";\nimport { logToolCall, ToolCallTimer } from \"./audit.js\";\nimport {\n ConfigTemplateError,\n containsSentinel,\n mergeRedacted,\n REDACTED_SENTINEL,\n ToolConfig,\n} from \"./config.js\";\nimport { decryptDict, encryptDict, getSecretKey } from \"./crypto.js\";\nimport { assertEgressAllowed, EgressDenied } from \"./egress.js\";\nimport { executeDb, getSchemaText } from \"./executors/db.js\";\nimport { executeHttp, type ToolHttpClient } from \"./executors/http.js\";\nimport { PromptevMCP } from \"./executors/mcp-client.js\";\nimport { type CanonicalTool, canonicalFromConfig, findTool } from \"./registry.js\";\n\nexport const RESULT_MAX_CHARS = 8_000;\nexport const RESULT_MAX_ROWS = 100;\n\nconst UPDATABLE_COLUMNS = new Set([\n \"name\",\n \"kind\",\n \"description\",\n \"sourceId\",\n \"source_id\",\n \"acl\",\n \"requiresApproval\",\n \"requires_approval\",\n \"approvalPolicy\",\n \"approval_policy\",\n \"enabled\",\n \"metaData\",\n \"meta_data\",\n]);\n\nexport type ToolEngine = {\n pool: Pool;\n config: ContextEngineConfig;\n hooks?: Hooks | null;\n _functionTools?: Record<string, CanonicalTool>;\n _toolHttpClient?: ToolHttpClient | null;\n};\n\n/**\n * The operator knob `ContextEngineConfig.allowPrivateEgress`, read off the\n * engine for every outbound tool fetch — executor, probe, MCP connection and\n * OAuth call. Exported so `router.ts` reads the same value from the same\n * place for its MCP and OAuth routes.\n */\nexport function allowPrivateEgress(engine: ToolEngine): boolean {\n return Boolean((engine?.config as { allowPrivateEgress?: boolean } | undefined)?.allowPrivateEgress);\n}\n\nexport function toolVisible(ct: CanonicalTool, principals: string[] | null | undefined | Trusted): boolean {\n return aclVisible(ct.acl, principals);\n}\n\nexport function stripUnderscoreArgs(\n args: Record<string, unknown> | null | undefined,\n): Record<string, unknown> {\n const out: Record<string, unknown> = {};\n for (const [k, v] of Object.entries(args ?? {})) {\n if (!String(k).startsWith(\"_\")) out[k] = v;\n }\n return out;\n}\n\nexport function shapeResult(\n result: unknown,\n opts: { maxChars?: number; maxRows?: number } = {},\n): [unknown, boolean] {\n const maxChars = opts.maxChars ?? RESULT_MAX_CHARS;\n const maxRows = opts.maxRows ?? RESULT_MAX_ROWS;\n let truncated = false;\n let shaped = result;\n\n if (\n result &&\n typeof result === \"object\" &&\n Array.isArray((result as { rows?: unknown }).rows) &&\n (result as { rows: unknown[] }).rows.length > maxRows\n ) {\n const rows = (result as { rows: unknown[] }).rows;\n const kept = rows.slice(0, maxRows);\n shaped = {\n ...(result as object),\n rows: kept,\n _result_shaping: { rows_returned: kept.length, rows_omitted: rows.length - kept.length },\n };\n truncated = true;\n }\n\n let serialized: string;\n try {\n serialized = JSON.stringify(shaped);\n } catch {\n serialized = JSON.stringify(String(shaped));\n }\n if (serialized.length > maxChars) {\n return [\n {\n _truncated: serialized.slice(0, maxChars),\n _original_size: serialized.length,\n _note: \"tool result exceeded the context budget and was truncated\",\n },\n true,\n ];\n }\n return [shaped, truncated];\n}\n\nexport function redactToolResult(\n result: unknown,\n policy: RedactionPolicy,\n opts: {\n principals?: readonly string[] | null;\n secretKey?: string | Buffer | null;\n hooks?: Hooks | null;\n },\n): [unknown, Record<string, unknown>] {\n if (policy.isEmpty()) return [result, {}];\n const fired: string[] = [];\n const failed: string[] = [];\n let total = 0;\n\n const walk = (node: unknown): unknown => {\n if (typeof node === \"string\") {\n const [text, note] = applyRedaction(node, policy, {\n phase: \"output\",\n principals: opts.principals ?? null,\n secretKey: opts.secretKey,\n hooks: opts.hooks,\n });\n if (note && Object.keys(note).length) {\n total += note.spans ?? 0;\n for (const name of note.rules_fired ?? []) {\n if (!fired.includes(name)) fired.push(name);\n }\n for (const name of note.rules_failed ?? []) {\n if (!failed.includes(name)) failed.push(name);\n }\n }\n return text;\n }\n if (node && typeof node === \"object\") {\n if (Array.isArray(node)) return node.map(walk);\n const out: Record<string, unknown> = {};\n for (const [k, v] of Object.entries(node as Record<string, unknown>)) out[k] = walk(v);\n return out;\n }\n return node;\n };\n\n const redacted = walk(result);\n if (!fired.length && !failed.length) return [redacted, {}];\n const note: Record<string, unknown> = { rules_fired: fired, spans: total };\n if (failed.length) note.rules_failed = failed;\n return [redacted, note];\n}\n\n/**\n * `getSecretKey`, with malformed-key failures kept OPERATOR-shaped.\n *\n * `Buffer.from(s, \"base64url\")` neither throws on junk nor checks length, so a\n * wrong-length `CE_SECRET_KEY` used to travel all the way to\n * `createCipheriv`/`createDecipheriv` and fail there with \"Invalid key\n * length\" — inside the lenient decrypt `try` below, which reads that as \"was\n * this row's key rotated?\" and drops EVERY tool with a stored config from\n * list/search/execute. A key that cannot be used is an operator fault exactly\n * like a missing one, so it says so, naming the env var. (A key that fails to\n * decode cleanly is not detected separately: base64url tolerates junk, and\n * whatever it decodes to will not be 32 bytes.)\n *\n * Mirrors `context_engine.tools.governance._crypto_key`.\n */\nfunction cryptoKey(engine: ToolEngine): Buffer {\n // The missing-key error is re-thrown unchanged — it already names the\n // config field and the env var.\n const key = getSecretKey(engine.config);\n if (key.length !== 32) {\n throw new Error(`CE_SECRET_KEY is malformed: decoded to ${key.length} bytes, need 32`);\n }\n return key;\n}\n\n/**\n * A row's stored config, decrypted. Throws whatever the crypto layer throws,\n * so a caller that means to survive a rotated key has to catch broadly (see\n * `rowToToolConfigLenient`). A row with no config never touches the key.\n */\nfunction decryptRowConfig(row: Record<string, unknown>, engine: ToolEngine): Record<string, unknown> {\n if (!row.config_encrypted) return {};\n return decryptDict(String(row.config_encrypted), cryptoKey(engine));\n}\n\n/**\n * Rebuild a `ToolConfig` from a persisted row. `config` overrides the stored\n * blob (the lenient path below passes what it managed to read); otherwise the\n * blob is decrypted strictly and a failure propagates.\n */\nfunction rowToToolConfig(\n row: Record<string, unknown>,\n engine: ToolEngine,\n config?: Record<string, unknown>,\n): ToolConfig {\n config ??= decryptRowConfig(row, engine);\n return new ToolConfig({\n id: String(row.id),\n name: String(row.name),\n kind: row.kind as ToolConfig[\"kind\"],\n description: String(row.description ?? \"\"),\n config,\n sourceId: (row.source_id as string | null) ?? null,\n acl: row.acl != null ? [...(row.acl as string[])] : null,\n requiresApproval: Boolean(row.requires_approval),\n approvalPolicy: (row.approval_policy as Record<string, unknown>) ?? {},\n enabled: Boolean(row.enabled),\n metaData: (row.meta_data as Record<string, unknown>) ?? {},\n });\n}\n\n/**\n * `rowToToolConfig`, except that a row whose stored config cannot be\n * decrypted yields `null` after one warning naming the tool.\n *\n * Every `listTools`/`searchTools`/`executeTool` resolves the WHOLE enabled\n * set. Letting one row left behind by a key rotation throw out of that loop\n * took down every OTHER tool with it, function tools included — and the\n * documented recoveries (disable the row, or re-enter its config) went\n * through the same rebuild, so they failed too. A row nobody can read is one\n * nobody can call: it is left out, and calling it by name then fails exactly\n * the way an unknown tool fails.\n *\n * Leniency covers a row that cannot be decrypted — never a deployment with no\n * usable key at all. The key is therefore obtained OUTSIDE the `try`: an unset\n * or malformed `CE_SECRET_KEY` (say, after an upgrade) is an operator fault,\n * and swallowing it made EVERY tool with a stored config vanish from\n * list/search/execute behind a per-row \"was the key rotated?\" warning. Only a\n * decrypt failure — wrong key, corrupt blob — is lenient.\n *\n * The warning carries the id, the name and the phrase `config_error` — never\n * the ciphertext, never the key.\n */\nfunction rowToToolConfigLenient(row: Record<string, unknown>, engine: ToolEngine): ToolConfig | null {\n if (!row.config_encrypted) return rowToToolConfig(row, engine, {});\n const key = cryptoKey(engine);\n let config: Record<string, unknown>;\n try {\n config = decryptDict(String(row.config_encrypted), key);\n } catch {\n console.warn(\n `tool ${String(row.id)} (${String(row.name)}): config_error — its stored config ` +\n `could not be decrypted (was the secret key rotated?); leaving it out of the tool set`,\n );\n return null;\n }\n return rowToToolConfig(row, engine, config);\n}\n\nasync function loadPersistedCanonicals(\n engine: ToolEngine,\n sourceId: string | null,\n): Promise<CanonicalTool[]> {\n const params: unknown[] = [];\n let sql = `SELECT * FROM context_engine_tools WHERE enabled IS TRUE`;\n if (sourceId != null) {\n params.push(sourceId);\n sql += ` AND source_id = $1`;\n }\n const result = await engine.pool.query(sql, params);\n const canonicals: CanonicalTool[] = [];\n for (const row of result.rows) {\n const tc = rowToToolConfigLenient(row, engine);\n if (tc === null) continue;\n canonicals.push(...canonicalFromConfig(tc));\n }\n return canonicals;\n}\n\nasync function mergedTools(engine: ToolEngine, sourceId: string | null): Promise<CanonicalTool[]> {\n const persisted = await loadPersistedCanonicals(engine, sourceId);\n const functions = Object.values(engine._functionTools ?? {});\n return [...persisted, ...functions];\n}\n\nfunction canonicalToPublic(ct: CanonicalTool): Record<string, unknown> {\n return {\n name: ct.callName,\n kind: ct.kind,\n description: ct.description,\n params_schema: ct.paramsSchema,\n };\n}\n\nexport async function registerTool(engine: ToolEngine, tc: ToolConfig): Promise<string> {\n canonicalFromConfig(tc);\n const config = tc.config ?? {};\n // The natural duplicate-a-tool flow (GET → copy config_redacted → POST)\n // would otherwise encrypt the literal sentinel as a live credential and\n // send \"Authorization: __redacted__\" to the real endpoint on every call.\n if (containsSentinel(config)) {\n throw new ConfigTemplateError(\n `config contains the ${JSON.stringify(REDACTED_SENTINEL)} placeholder — a redacted ` +\n `template cannot be registered as a new tool; re-enter the secret values`,\n );\n }\n const configEncrypted = Object.keys(config).length ? encryptDict(config, cryptoKey(engine)) : null;\n const id = randomUUID();\n await engine.pool.query(\n `INSERT INTO context_engine_tools\n (id, name, kind, description, source_id, acl, config_encrypted,\n requires_approval, approval_policy, enabled, meta_data)\n VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9::jsonb, $10, $11::jsonb)`,\n [\n id,\n tc.name,\n tc.kind,\n tc.description || \"\",\n tc.sourceId,\n tc.acl,\n configEncrypted,\n tc.requiresApproval,\n JSON.stringify(tc.approvalPolicy ?? {}),\n tc.enabled,\n JSON.stringify(tc.metaData ?? {}),\n ],\n );\n return id;\n}\n\nexport async function updateTool(\n engine: ToolEngine,\n id: string,\n opts: { principals?: string[] | null | Trusted } & Record<string, unknown>,\n): Promise<ToolConfig> {\n const { principals = null, ...fields } = opts;\n const existing = await engine.pool.query(`SELECT * FROM context_engine_tools WHERE id = $1`, [id]);\n const row = existing.rows[0];\n if (!row || !aclVisible(row.acl != null ? [...row.acl] : null, principals)) {\n throw new EngineActionError(`tool not found: ${id}`);\n }\n const sets: string[] = [];\n const params: unknown[] = [];\n let i = 1;\n for (const [key, value] of Object.entries(fields)) {\n if (key === \"config\") {\n // Redacted round-trip (tools/config.ts): a client that prefilled its\n // form from `config_redacted` sends REDACTED_SENTINEL for every secret\n // it did not retype — substitute the stored values before\n // re-encrypting, so an ordinary re-save can never corrupt credentials.\n // The stored blob is decrypted ONLY when a sentinel needs resolving: a\n // sentinel-FREE config replaces outright, which is precisely the\n // recovery path after a key rotation.\n let config = value as Record<string, unknown> | null;\n if (config && containsSentinel(config)) {\n // Presence check, not a value coalesce: an explicit `kind: null`\n // must hit this guard (Python checks `\"kind\" in fields`), never\n // slip past it into the merge and an UPDATE that nulls the column.\n if (Object.hasOwn(fields, \"kind\") && fields.kind !== row.kind) {\n throw new ConfigTemplateError(\n \"cannot change kind and keep redacted secrets in one PATCH — re-enter the config in full\",\n );\n }\n // A masked→clear transition on the body must not ride on the merge:\n // flipping body_secret off while the body still echoes sentinels\n // would resolve the STORED secret body and serve it in clear on the\n // next GET.\n if (config.body_secret === false && containsSentinel(config.body)) {\n throw new ConfigTemplateError(\n `body_secret cannot be turned off while the body still contains ` +\n `${JSON.stringify(REDACTED_SENTINEL)} — re-enter the body to declassify it`,\n );\n }\n if (!row.config_encrypted) {\n throw new ConfigTemplateError(\n `config contains ${JSON.stringify(REDACTED_SENTINEL)} but this tool has no ` +\n `stored config to keep — re-enter the secret values`,\n );\n }\n // The key is obtained OUTSIDE the `try`: a missing or malformed\n // key is an operator fault (500), not the caller's \"re-enter the\n // config\" 400 the catch below reports for a rotated/corrupt blob.\n const key = cryptoKey(engine);\n let stored: Record<string, unknown>;\n try {\n stored = decryptDict(String(row.config_encrypted), key);\n } catch (exc) {\n throw new ConfigTemplateError(\n `the stored config cannot be decrypted (was the secret key rotated?) — ` +\n `re-enter the config in full, without ${JSON.stringify(REDACTED_SENTINEL)} values`,\n { cause: exc },\n );\n }\n config = mergeRedacted(config, stored);\n }\n sets.push(`config_encrypted = $${i++}`);\n // An empty config clears to NULL, matching Python's falsy-dict branch.\n params.push(config && Object.keys(config).length ? encryptDict(config, cryptoKey(engine)) : null);\n } else if (UPDATABLE_COLUMNS.has(key)) {\n const col =\n key === \"sourceId\"\n ? \"source_id\"\n : key === \"requiresApproval\"\n ? \"requires_approval\"\n : key === \"approvalPolicy\"\n ? \"approval_policy\"\n : key === \"metaData\"\n ? \"meta_data\"\n : key;\n sets.push(`${col} = $${i++}`);\n params.push(col === \"approval_policy\" || col === \"meta_data\" ? JSON.stringify(value ?? {}) : value);\n }\n }\n sets.push(`updated_at = now()`);\n params.push(id);\n const updated = await engine.pool.query(\n `UPDATE context_engine_tools SET ${sets.join(\", \")} WHERE id = $${i} RETURNING *`,\n params,\n );\n // The update is already persisted, so an undecryptable blob must not turn a\n // successful PATCH into a failure — the response reports the columns and an\n // empty config, with the warning above logged.\n const row_ = updated.rows[0];\n return rowToToolConfigLenient(row_, engine) ?? rowToToolConfig(row_, engine, {});\n}\n\nexport async function deleteTool(\n engine: ToolEngine,\n id: string,\n opts: { principals?: string[] | null | Trusted } = {},\n): Promise<void> {\n const existing = await engine.pool.query(`SELECT * FROM context_engine_tools WHERE id = $1`, [id]);\n const row = existing.rows[0];\n if (!row || !aclVisible(row.acl != null ? [...row.acl] : null, opts.principals ?? null)) {\n throw new EngineActionError(`tool not found: ${id}`);\n }\n await engine.pool.query(`DELETE FROM context_engine_tools WHERE id = $1`, [id]);\n}\n\nexport async function listTools(\n engine: ToolEngine,\n opts: { sourceId?: string | null; principals?: string[] | null | Trusted } = {},\n): Promise<Array<Record<string, unknown>>> {\n const tools = await mergedTools(engine, opts.sourceId ?? null);\n return tools.filter((ct) => toolVisible(ct, opts.principals ?? null)).map(canonicalToPublic);\n}\n\nexport async function searchTools(\n engine: ToolEngine,\n query: string,\n opts: { sourceId?: string | null; principals?: string[] | null | Trusted; limit?: number } = {},\n): Promise<Array<Record<string, unknown>>> {\n const listed = await listTools(engine, { sourceId: opts.sourceId, principals: opts.principals });\n const limit = opts.limit ?? 10;\n const normalized = (query || \"\").toLowerCase().trim();\n if (!normalized) return listed.slice(0, limit);\n const terms = normalized.split(/\\s+/);\n const scored: Array<[number, Record<string, unknown>]> = [];\n for (const tool of listed) {\n const haystack = `${tool.name} ${tool.description}`.toLowerCase();\n const score = terms.reduce((n, term) => n + (haystack.includes(term) ? 1 : 0), 0);\n if (score > 0) scored.push([score, tool]);\n }\n scored.sort((a, b) => b[0] - a[0]);\n return scored.slice(0, limit).map(([, t]) => t);\n}\n\nconst PROBE_AUTH = [\n \"authentication failed\",\n \"pg_hba\",\n \"permission denied\",\n \"access denied\",\n \"password\",\n \"unauthorized\",\n \"forbidden\",\n \"401\",\n \"403\",\n \"invalid credentials\",\n];\nconst PROBE_UNREACHABLE = [\n \"connection refused\",\n \"could not connect\",\n \"name or service not known\",\n \"nodename nor servname\",\n \"no route to host\",\n \"network is unreachable\",\n \"temporary failure in name resolution\",\n \"getaddrinfo\",\n \"connection reset\",\n \"fetch failed\",\n \"econnrefused\",\n \"enotfound\",\n];\nconst PROBE_TIMEOUT = [\"timed out\", \"timeout\", \"aborted\"];\nconst PROBE_MISCONFIGURED = [\n \"does not exist\",\n \"invalid\",\n \"unknown database\",\n \"syntax error\",\n \"no such\",\n \"missing\",\n \"not supported\",\n \"unsupported\",\n];\n\nfunction classifyProbeError(exc: unknown): string {\n if (exc instanceof DOMException && exc.name === \"TimeoutError\") return \"timeout\";\n const name = exc instanceof Error ? exc.name : \"\";\n if (name.includes(\"Timeout\")) return \"timeout\";\n if ([\"ConnectError\", \"ConnectionError\", \"NetworkError\", \"TypeError\"].some((t) => name.includes(t))) {\n if (name === \"TypeError\" && !String(exc).toLowerCase().includes(\"fetch\")) {\n /* fall through */\n } else if (name !== \"TypeError\") return \"unreachable\";\n }\n if ([\"Auth\", \"Permission\", \"Forbidden\", \"Unauthorized\"].some((t) => name.includes(t))) return \"auth_failed\";\n const text = String(exc).toLowerCase();\n if (PROBE_TIMEOUT.some((t) => text.includes(t))) return \"timeout\";\n if (PROBE_AUTH.some((t) => text.includes(t))) return \"auth_failed\";\n if (PROBE_UNREACHABLE.some((t) => text.includes(t))) return \"unreachable\";\n if (PROBE_MISCONFIGURED.some((t) => text.includes(t))) return \"misconfigured\";\n return \"error\";\n}\n\nfunction probeFailure(exc: unknown, kind: string): Record<string, unknown> {\n const category = classifyProbeError(exc);\n console.warn(`test_tool(kind=${kind}) failed:`, exc, \"->\", category);\n return { ok: false, error: category };\n}\n\nexport async function testTool(engine: ToolEngine, tc: ToolConfig): Promise<Record<string, unknown>> {\n const kind = tc.kind;\n const config = tc.config ?? {};\n // A form prefilled from `config_redacted` still holds the sentinel for\n // every secret the user did not retype; probing with it would send the\n // literal placeholder as the credential to the REAL endpoint and report a\n // misleading auth failure. No stored row to merge from on this inline\n // path — same caller error as POST /tools.\n if (containsSentinel(config)) {\n throw new ConfigTemplateError(\n `config contains the ${JSON.stringify(REDACTED_SENTINEL)} placeholder — a probe ` +\n `would send it verbatim as the credential; re-enter the secret values`,\n );\n }\n if (kind === \"http\") {\n const url = config.url as string | undefined;\n if (!url) return { ok: false, error: \"http config missing 'url'\" };\n // The probe is the same outbound fetch the executor makes, behind a\n // different button — it gets the same egress policy (tools/egress.ts). A\n // refusal is a result, not an exception: this function's contract is\n // `{ ok, error: <category> }`.\n try {\n await assertEgressAllowed(url, { allowPrivate: allowPrivateEgress(engine) });\n } catch (exc) {\n if (exc instanceof EgressDenied) {\n console.warn(`testTool(kind=http) refused: ${exc.message}`);\n return { ok: false, error: \"egress_denied\" };\n }\n throw exc;\n }\n const client = engine?._toolHttpClient ?? null;\n try {\n const resp = client\n ? await client.request({\n method: \"HEAD\",\n url,\n headers: (config.headers as Record<string, string>) ?? {},\n })\n : await fetch(url, {\n method: \"HEAD\",\n headers: (config.headers as Record<string, string>) ?? {},\n // No automatic follow: a redirect would reach a destination the\n // check above never saw.\n redirect: \"manual\",\n signal: AbortSignal.timeout(10_000),\n });\n return { ok: resp.status < 500, status_code: resp.status };\n } catch (exc) {\n return probeFailure(exc, \"http\");\n }\n }\n if (kind === \"db\") {\n try {\n const { testConnection } = await import(\"./executors/db.js\");\n const result = await testConnection(config);\n return { ok: Boolean(result.success ?? result.ok), ...result };\n } catch (exc) {\n return probeFailure(exc, \"db\");\n }\n }\n if (kind === \"mcp\") {\n const url = config.url as string | undefined;\n if (!url) return { ok: false, error: \"mcp config missing 'url'\" };\n const token = (config.oauth_token ?? config.bearer ?? config.access_token) as string | undefined;\n // Same egress policy as the http probe, applied where the MCP client\n // dials (see `executors/mcp-client.ts`): the server URL, the SSE POST\n // endpoint the server hands back, the WebSocket URL. A refusal is a\n // result, not an exception — the same `{ ok: false, error:\n // \"egress_denied\" }` the http branch returns.\n const mcp = new PromptevMCP({ allowPrivate: allowPrivateEgress(engine) });\n try {\n await mcp.addServer(tc.name, url, { token: token ?? null });\n const client = mcp.clients.get(tc.name);\n return { ok: true, tools: client.tools.map((t) => t.name) };\n } catch (exc) {\n if (exc instanceof EgressDenied) {\n console.warn(`testTool(kind=mcp) refused: ${exc.message}`);\n return { ok: false, error: \"egress_denied\" };\n }\n return probeFailure(exc, \"mcp\");\n } finally {\n await mcp.shutdown();\n }\n }\n return { ok: false, error: `test_tool does not support kind=${JSON.stringify(kind)}` };\n}\n\n/**\n * Find an `approved` approval matching this exact call and atomically claim\n * it (flip `approved` -> `executed`), returning its id; `null` if none.\n *\n * \"This exact call\" is four equalities and one wall, all of which must hold:\n * tool name, frozen args and `source_id` (the call as issued);\n * `approval_scope`, the PRIMARY wall — `null` only matches `null`, a scoped\n * record matches only its own scope, so records never share one pool across\n * callers; and `principals`, the second wall (`claimVisibilitySql`) — when\n * the record carries principals the caller must overlap them, a record\n * carrying none imposes no wall. The wall alone is what closes the\n * cross-caller claim on the unscoped legacy path for every signed-in caller.\n */\nasync function findAndClaimApproved(\n engine: ToolEngine,\n toolName: string,\n args: Record<string, unknown>,\n sourceId: string | null,\n principals: string[] | null | Trusted,\n approvalScope: string | null,\n): Promise<string | null> {\n const claimedAt = new Date();\n const params: unknown[] = [toolName];\n let scopeSql = \"approval_scope IS NULL\";\n if (approvalScope !== null) {\n params.push(approvalScope);\n scopeSql = `approval_scope = $${params.length}`;\n }\n const wall = claimVisibilitySql(principals, params.length + 1);\n params.push(...wall.params);\n const candidates = await engine.pool.query(\n `SELECT * FROM context_engine_tool_approvals\n WHERE tool_name = $1 AND status = 'approved' AND ${scopeSql} AND ${wall.sql}`,\n params,\n );\n for (const row of candidates.rows) {\n if ((row.source_id ?? null) !== (sourceId ?? null)) continue;\n const frozen = row.tool_args_frozen ?? {};\n if (JSON.stringify(frozen) !== JSON.stringify(args)) continue;\n const result = await engine.pool.query(\n `UPDATE context_engine_tool_approvals\n SET status = 'executed', resolved_at = $1\n WHERE id = $2 AND status = 'approved'\n RETURNING id`,\n [claimedAt, row.id],\n );\n if (result.rowCount === 1) return String(row.id);\n }\n return null;\n}\n\n/**\n * Execute one MCP tool call via a short-lived `PromptevMCP` connection.\n *\n * `allowPrivate` is the operator knob, threaded down to every destination the\n * client dials. It defaults to `false`: a call site that forgets it denies\n * rather than permits, and an `EgressDenied` raised out of the connect\n * surfaces from `executeTool` as the `EngineActionError` any executor failure\n * surfaces as.\n */\nasync function dispatchMcp(\n ct: CanonicalTool,\n config: Record<string, unknown>,\n args: Record<string, unknown>,\n opts: { allowPrivate?: boolean } = {},\n): Promise<unknown> {\n const url = config.url as string | undefined;\n if (!url) throw new EngineActionError(`mcp tool ${ct.callName} config missing 'url'`);\n const headers = { ...((config.headers as Record<string, string>) ?? {}) };\n const token = (config.oauth_token ?? config.bearer ?? config.access_token) as string | undefined;\n const apiKey = config.api_key as string | undefined;\n if (token) headers.Authorization = `Bearer ${token}`;\n else if (apiKey) headers.Authorization = `Bearer ${apiKey}`;\n const toolName = String(ct.raw?.tool_name ?? ct.displayName);\n const mcp = new PromptevMCP({ allowPrivate: opts.allowPrivate ?? false });\n try {\n await mcp.addServer(ct.callName, url, { headers: Object.keys(headers).length ? headers : null });\n const client = mcp.clients.get(ct.callName);\n return await client.callToolWithReconnect(toolName, args);\n } finally {\n await mcp.shutdown();\n }\n}\n\nasync function dispatch(\n engine: ToolEngine,\n ct: CanonicalTool,\n config: Record<string, unknown>,\n args: Record<string, unknown>,\n): Promise<unknown> {\n if (ct.kind === \"http\") {\n return executeHttp(config, args, {\n client: engine._toolHttpClient ?? null,\n allowPrivate: allowPrivateEgress(engine),\n });\n }\n if (ct.kind === \"db\") {\n const query = String(args.query ?? \"\");\n if (query.trim().toLowerCase().startsWith(\"describe:\")) {\n const tables = query\n .slice(query.indexOf(\":\") + 1)\n .split(\",\")\n .map((t) => t.trim())\n .filter(Boolean);\n const schemaText = await getSchemaText(config, tables.length ? tables : null);\n return { success: true, schema: schemaText };\n }\n const result = await executeDb(config, query);\n if (result && typeof result === \"object\" && result.success === false) {\n throw new EngineActionError(String(result.error || \"database query failed\"));\n }\n return result;\n }\n if (ct.kind === \"mcp\") {\n return dispatchMcp(ct, config, args, { allowPrivate: allowPrivateEgress(engine) });\n }\n if (ct.kind === \"function\") {\n const fn = ct.raw?.callable as ((...a: unknown[]) => unknown) | undefined;\n if (!fn) throw new EngineActionError(`function tool ${ct.callName} has no callable`);\n return await fn(...namedArgs(fn, args));\n }\n throw new EngineActionError(`unsupported tool kind: ${JSON.stringify(ct.kind)}`);\n}\n\nfunction namedArgs(fn: (...a: unknown[]) => unknown, args: Record<string, unknown>): unknown[] {\n const src = Function.prototype.toString.call(fn);\n const match = src.match(/\\(([^)]*)\\)/);\n const names = (match?.[1] ?? \"\")\n .split(\",\")\n .map((p) => p.trim().split(/\\s*=/)[0]?.trim())\n .filter(Boolean);\n if (!names.length) return Object.values(args);\n return names.map((n) => args[n!]);\n}\n\nasync function decryptCtConfig(engine: ToolEngine, toolId: string): Promise<Record<string, unknown>> {\n const result = await engine.pool.query(`SELECT config_encrypted FROM context_engine_tools WHERE id = $1`, [\n toolId,\n ]);\n const row = result.rows[0];\n if (!row?.config_encrypted) return {};\n return decryptDict(String(row.config_encrypted), cryptoKey(engine));\n}\n\nconst warnedUnscoped = new Set<string>();\n\nfunction warnUnscopedApproval(callName: string): void {\n if (warnedUnscoped.has(callName)) return;\n warnedUnscoped.add(callName);\n process.emitWarning(\n `executeTool(${JSON.stringify(callName)}) needs an approval but was called without ` +\n \"approvalScope. The record is opened and matched UNSCOPED (tool + args + \" +\n \"sourceId, behind the principals wall). Pass approvalScope: <opaque string> \" +\n \"(e.g. a run id) so approvals are claimable only within that scope; a gated \" +\n \"call without one will be refused in the next release.\",\n { type: \"DeprecationWarning\", code: \"CE_APPROVAL_SCOPE_MISSING\" },\n );\n}\n\nexport async function executeTool(\n engine: ToolEngine,\n callName: string,\n args: Record<string, unknown> | null | undefined,\n opts: {\n sourceId?: string | null;\n principals?: string[] | null | Trusted;\n actor?: { type?: string; id?: unknown } | null;\n source?: string;\n /** Opaque host-chosen claim scope for approvals (a run id is the\n * expected shape) — SEPARATE from `sourceId`, which scopes tool LOOKUP.\n * Stamped on the pending record this call opens and the primary wall on\n * the record a later call may claim; identical gated calls within a\n * scope share one pending record. Resolve it SERVER-SIDE — never from a\n * request body or a model's arguments. `null`/omitted is the legacy\n * unscoped path, kept for one release with a DeprecationWarning; the\n * next release refuses a gated call without a scope. */\n approvalScope?: string | null;\n } = {},\n): Promise<Record<string, unknown>> {\n const runtimeArgs = args ?? {};\n const approvalScope = validateApprovalScope(opts.approvalScope);\n const ct = findTool(await mergedTools(engine, opts.sourceId ?? null), callName);\n if (!ct) throw new EngineActionError(`tool not found: ${callName}`);\n if (!toolVisible(ct, opts.principals ?? null)) {\n throw new EngineActionError(`tool not found: ${callName}`);\n }\n\n const publicArgs = stripUnderscoreArgs(runtimeArgs);\n let approvalId: string | null = null;\n if (shouldRequireApproval(ct, publicArgs)) {\n if (approvalScope === null) warnUnscopedApproval(callName);\n approvalId = await findAndClaimApproved(\n engine,\n ct.callName,\n publicArgs,\n opts.sourceId ?? null,\n opts.principals ?? null,\n approvalScope,\n );\n if (approvalId == null) {\n const pendingOpts = {\n toolName: ct.callName,\n args: publicArgs,\n sourceId: opts.sourceId ?? null,\n principals: opts.principals ?? null,\n policy: ct.approvalPolicy ?? {},\n };\n const record =\n approvalScope === null\n ? await createPending(engine, pendingOpts)\n : await findOrCreatePending(engine, { ...pendingOpts, approvalScope });\n const reason = ct.requiresApproval\n ? \"tool requires approval\"\n : `approval policy condition met: ${ct.approvalPolicy?.condition}`;\n return {\n approval_required: {\n approval_id: String(record.id),\n tool_name: ct.callName,\n args: publicArgs,\n reason,\n expires_at: record.expiresAt ? record.expiresAt.toISOString() : null,\n },\n };\n }\n }\n\n let config: Record<string, unknown> = {};\n if (ct.kind !== \"function\" && ct.id != null) {\n config = await decryptCtConfig(engine, ct.id);\n }\n\n const actorType = opts.actor?.type ?? null;\n const actorId = opts.actor?.id ?? null;\n let rawResult: unknown = null;\n let exc: unknown = null;\n const timer = new ToolCallTimer().start();\n try {\n rawResult = await dispatch(engine, ct, config, publicArgs);\n } catch (e) {\n exc = e;\n }\n timer.stop();\n\n let success = exc == null;\n let shaped: unknown = null;\n let truncated = false;\n if (success) {\n try {\n // Redaction speaks the resolved form only — the sentinel means null.\n // (Cast: `=== TRUSTED` excludes the sentinel at runtime, but TS does\n // not narrow a class-instance union member on equality.)\n const redactPrincipals =\n opts.principals === TRUSTED ? null : ((opts.principals ?? null) as string[] | null);\n const [redacted] = redactToolResult(rawResult, engine.config.redaction, {\n principals: redactPrincipals,\n secretKey: engine.config.secretKey,\n hooks: engine.hooks,\n });\n rawResult = redacted;\n [shaped, truncated] = shapeResult(rawResult);\n } catch (e) {\n exc = e;\n success = false;\n }\n }\n\n await logToolCall(engine, {\n toolId: ct.id,\n toolName: ct.callName,\n kind: ct.kind,\n actorType,\n actorId,\n source: opts.source ?? \"api\",\n inputArgs: publicArgs,\n outputResult: success ? rawResult : null,\n success,\n error: exc,\n durationMs: timer.durationMs,\n units: success ? 1 : 0,\n approvalId,\n });\n\n if (!success) {\n throw new EngineActionError(`tool execution failed: ${ct.callName}: ${exc}`);\n }\n\n const usage: UsageEvent = {\n kind: \"tool\",\n units: 1,\n detail: { tool_name: ct.callName, kind: ct.kind, truncated },\n };\n emitUsage(engine.hooks, usage);\n\n return {\n result: shaped,\n usage: { units: 1, kind: \"tool\", tool_name: ct.callName, truncated },\n };\n}\n","import type { UsageEvent } from \"./usage.js\";\n\nconst log = {\n warn: (...args: unknown[]) => console.warn(\"[context-engine]\", ...args),\n error: (...args: unknown[]) => console.error(\"[context-engine]\", ...args),\n};\n\n/**\n * One ingest stage boundary. `documentId` is null until the row is claimed\n * (extraction runs before that, so dedup can decide from the extracted\n * text); `sourceId` + `externalId` are the caller's own identity and exist\n * on every event. `detail` is per stage and always JSON-serialisable.\n */\nexport interface ProgressEvent {\n sourceId: string | null;\n externalId: string | null;\n documentId: string | null;\n name: string;\n stage: \"extract\" | \"redact\" | \"chunk\" | \"embed\" | \"structured\" | \"graph\";\n state: \"started\" | \"done\";\n detail: Record<string, unknown>;\n}\n\nexport interface Hooks {\n onUsage?: ((event: UsageEvent) => void) | null;\n onError?: ((exc: unknown, ctx: Record<string, unknown>) => void) | null;\n onToolCall?: ((event: Record<string, unknown>) => void) | null;\n /** Ingest stage boundaries, for live progress UIs. Never raises outward. */\n onProgress?: ((event: ProgressEvent) => void) | null;\n}\n\nexport function emitUsage(hooks: Hooks | null | undefined, event: UsageEvent): void {\n if (!hooks?.onUsage) return;\n try {\n hooks.onUsage(event);\n } catch {\n log.warn(\"onUsage callback raised; swallowing\");\n }\n}\n\nexport function emitError(hooks: Hooks | null | undefined, exc: unknown, ctx: Record<string, unknown>): void {\n log.error(\"context_engine error:\", exc, \"| ctx=\", ctx);\n if (!hooks?.onError) return;\n try {\n hooks.onError(exc, ctx);\n } catch {\n log.warn(\"onError callback raised; swallowing\");\n }\n}\n\n/** Report an ingest stage boundary to `hooks.onProgress`, if set. Never raises. */\nexport function emitProgress(hooks: Hooks | null | undefined, event: ProgressEvent): void {\n if (!hooks?.onProgress) return;\n try {\n hooks.onProgress(event);\n } catch {\n log.warn(\"onProgress callback raised; swallowing\");\n }\n}\n\nexport function emitToolCall(hooks: Hooks | null | undefined, event: Record<string, unknown>): void {\n if (!hooks?.onToolCall) return;\n try {\n hooks.onToolCall(event);\n } catch {\n log.warn(\"onToolCall callback raised; swallowing\");\n }\n}\n","import { hmacSha256Hex } from \"./crypto.js\";\nimport { emitError, type Hooks } from \"./hooks.js\";\n\nexport type Span = [number, number];\nexport type DetectorFn = (text: string) => Span[];\nexport type RedactionAction = \"mask\" | \"hash\" | \"remove\";\nexport type ApplyAt = \"ingest\" | \"output\" | \"both\";\nexport type RedactionPhase = \"ingest\" | \"output\";\n\nexport const BUILTIN_DETECTOR_NAMES = new Set([\"email\", \"phone\", \"ssn\", \"credit_card\", \"iban\", \"api_key\"]);\n\nexport interface RedactionRuleInit {\n name: string;\n detector?: string | null;\n pattern?: string | null;\n field?: string | null;\n action?: RedactionAction;\n placeholder?: string | null;\n applyAt?: ApplyAt;\n unless?: string[];\n}\n\nexport class RedactionRule {\n name: string;\n detector: string | null;\n pattern: string | null;\n field: string | null;\n action: RedactionAction;\n placeholder: string | null;\n applyAt: ApplyAt;\n unless: string[];\n private compiled: RegExp | null = null;\n\n constructor(init: RedactionRuleInit) {\n this.name = init.name;\n this.detector = init.detector ?? null;\n this.pattern = init.pattern ?? null;\n this.field = init.field ?? null;\n this.action = init.action ?? \"mask\";\n this.placeholder = init.placeholder ?? null;\n this.applyAt = init.applyAt ?? \"output\";\n this.unless = init.unless ?? [];\n this.validate();\n }\n\n private validate(): void {\n if (this.field !== null) {\n throw new Error(\n `rule '${this.name}': field-targeted rules are not implemented yet; use detector or pattern instead`,\n );\n }\n const targets = [this.detector, this.pattern].filter((t) => t !== null);\n if (targets.length !== 1) {\n throw new Error(`rule '${this.name}': exactly one of detector/pattern must be set`);\n }\n if (this.pattern !== null) {\n try {\n this.compiled = new RegExp(this.pattern, \"g\");\n } catch (exc) {\n throw new Error(`rule '${this.name}': invalid regex: ${exc}`);\n }\n }\n if (this.unless.length && this.applyAt === \"ingest\") {\n throw new Error(\n `rule '${this.name}': unless is output-time only and cannot be set on an applyAt='ingest' rule`,\n );\n }\n }\n\n patternRe(): RegExp | null {\n return this.compiled;\n }\n\n effectivePlaceholder(): string {\n return this.placeholder || `[${this.name.toUpperCase()}]`;\n }\n}\n\nexport interface RedactionPolicyInit {\n rules?: RedactionRule[] | RedactionRuleInit[];\n customDetectors?: Record<string, DetectorFn>;\n}\n\nexport class RedactionPolicy {\n rules: RedactionRule[];\n customDetectors: Record<string, DetectorFn>;\n\n constructor(init: RedactionPolicyInit = {}) {\n this.rules = (init.rules ?? []).map((r) => (r instanceof RedactionRule ? r : new RedactionRule(r)));\n this.customDetectors = init.customDetectors ?? {};\n const seen = new Set<string>();\n for (const rule of this.rules) {\n if (seen.has(rule.name)) throw new Error(`duplicate rule name: '${rule.name}'`);\n seen.add(rule.name);\n if (rule.detector !== null) {\n const known = BUILTIN_DETECTOR_NAMES.has(rule.detector) || rule.detector in this.customDetectors;\n if (!known) {\n throw new Error(\n `rule '${rule.name}': unknown detector '${rule.detector}' (not built-in and not in customDetectors)`,\n );\n }\n }\n }\n }\n\n isEmpty(): boolean {\n return this.rules.length === 0;\n }\n}\n\nconst EMAIL_RE = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}/g;\nconst PHONE_RE = /\\+\\d[\\d\\s-]{7,17}\\d/g;\nconst SSN_RE = /(?<!\\d)\\d{3}-\\d{2}-\\d{4}(?!\\d)/g;\nconst CARD_RE = /(?<!\\d)(?:\\d[ -]?){12,18}\\d(?!\\d)/g;\nconst IBAN_RE = /(?<![A-Za-z0-9])[A-Z]{2}\\d{2}[A-Z0-9]{10,30}(?![A-Za-z0-9])/g;\nconst API_KEY_ALNUM = \"A-Za-z0-9_\\\\-+/=\";\nconst API_KEY_PREFIX_RE = new RegExp(\n `(?<![${API_KEY_ALNUM}])(?:(?:AKIA|ASIA)[0-9A-Z]{16}|sk-[A-Za-z0-9]{20,}|gh[opsu]_[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9\\\\-]{10,}|AIza[0-9A-Za-z_\\\\-]{35})(?![${API_KEY_ALNUM}])`,\n \"g\",\n);\nconst API_KEY_GENERIC_RE = new RegExp(\n `(?<![${API_KEY_ALNUM}])[${API_KEY_ALNUM}]{24,}(?![${API_KEY_ALNUM}])`,\n \"g\",\n);\nconst UUID_RE = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;\n\nfunction spansFrom(re: RegExp, text: string): Span[] {\n const out: Span[] = [];\n re.lastIndex = 0;\n let m = re.exec(text);\n while (m !== null) {\n out.push([m.index, m.index + m[0].length]);\n if (m[0].length === 0) re.lastIndex++;\n m = re.exec(text);\n }\n return out;\n}\n\nfunction luhnOk(digits: string): boolean {\n let total = 0;\n const rev = [...digits].reverse();\n for (let i = 0; i < rev.length; i++) {\n let d = Number(rev[i]);\n if (i % 2 === 1) {\n d *= 2;\n if (d > 9) d -= 9;\n }\n total += d;\n }\n return total % 10 === 0;\n}\n\nfunction detectCreditCard(text: string): Span[] {\n const spans: Span[] = [];\n for (const [start, end] of spansFrom(CARD_RE, text)) {\n const digits = text.slice(start, end).replace(/[ -]/g, \"\");\n if (digits.length >= 13 && digits.length <= 19 && luhnOk(digits)) {\n spans.push([start, end]);\n }\n }\n return spans;\n}\n\nfunction looksLikeGenericSecret(token: string): boolean {\n if (UUID_RE.test(token)) return false;\n let hasUpper = false;\n let hasLower = false;\n let hasDigit = false;\n for (const c of token) {\n if (c >= \"A\" && c <= \"Z\") hasUpper = true;\n else if (c >= \"a\" && c <= \"z\") hasLower = true;\n else if (c >= \"0\" && c <= \"9\") hasDigit = true;\n }\n return hasUpper && hasLower && hasDigit;\n}\n\nfunction detectApiKey(text: string): Span[] {\n const spans = spansFrom(API_KEY_PREFIX_RE, text);\n for (const [start, end] of spansFrom(API_KEY_GENERIC_RE, text)) {\n if (spans.some(([s, e]) => start < e && s < end)) continue;\n if (looksLikeGenericSecret(text.slice(start, end))) spans.push([start, end]);\n }\n return spans;\n}\n\nconst BUILTIN: Record<string, DetectorFn> = {\n email: (t) => spansFrom(EMAIL_RE, t),\n phone: (t) => spansFrom(PHONE_RE, t),\n ssn: (t) => spansFrom(SSN_RE, t),\n credit_card: detectCreditCard,\n iban: (t) => spansFrom(IBAN_RE, t),\n api_key: detectApiKey,\n};\n\nexport function detectBuiltin(name: string, text: string): Span[] {\n const detector = BUILTIN[name];\n if (!detector) throw new Error(`unknown built-in detector: ${name}`);\n if (!text) return [];\n return detector(text).sort((a, b) => a[0] - b[0]);\n}\n\nexport function ruleApplies(\n rule: RedactionRule,\n opts: { phase: RedactionPhase; principals: readonly string[] | null },\n): boolean {\n if (rule.applyAt !== \"both\" && rule.applyAt !== opts.phase) return false;\n if (opts.phase === \"ingest\") return true;\n if (!rule.unless.length) return true;\n if (opts.principals === null) return false;\n const held = new Set(opts.principals);\n return !rule.unless.some((p) => held.has(p));\n}\n\nfunction spansForRule(rule: RedactionRule, text: string, policy: RedactionPolicy): Span[] {\n if (rule.pattern !== null) {\n const re = rule.patternRe() ?? new RegExp(rule.pattern, \"g\");\n return spansFrom(re, text);\n }\n if (rule.detector !== null) {\n const custom = policy.customDetectors[rule.detector];\n if (custom) return [...custom(text)];\n return detectBuiltin(rule.detector, text);\n }\n return [];\n}\n\nconst HASH_TOKEN_CHARS = 16;\n\nfunction hashToken(value: string, secretKey: string | Buffer | null | undefined): string {\n const key = Buffer.isBuffer(secretKey) ? secretKey : Buffer.from(String(secretKey ?? \"\"));\n return hmacSha256Hex(key, value).slice(0, HASH_TOKEN_CHARS);\n}\n\nexport interface RedactionNote {\n rules_fired?: string[];\n spans?: number;\n rules_failed?: string[];\n}\n\nexport function applyRedaction(\n text: string,\n policy: RedactionPolicy,\n opts: {\n phase: RedactionPhase;\n principals?: readonly string[] | null;\n secretKey?: string | Buffer | null;\n hooks?: Hooks | null;\n },\n): [string, RedactionNote] {\n if (!text || policy.isEmpty()) return [text, {}];\n const principals = opts.principals ?? null;\n const collected: Array<[number, number, RedactionRule]> = [];\n const fired: string[] = [];\n const failed: string[] = [];\n\n for (const rule of policy.rules) {\n if (!ruleApplies(rule, { phase: opts.phase, principals })) continue;\n if (rule.action === \"hash\" && !opts.secretKey) {\n throw new Error(\n `rule '${rule.name}': action='hash' requires a non-empty secretKey ` +\n `(an unkeyed HMAC is a reversible pseudonym, not a redaction)`,\n );\n }\n try {\n const raw = spansForRule(rule, text, policy);\n const ruleSpans: Span[] = [];\n let invalid = false;\n for (const item of raw) {\n const start = item?.[0];\n const end = item?.[1];\n if (typeof start !== \"number\" || typeof end !== \"number\") {\n invalid = true;\n continue;\n }\n if (!(start >= 0 && start < end && end <= text.length)) {\n invalid = true;\n continue;\n }\n ruleSpans.push([start, end]);\n }\n if (invalid) failed.push(rule.name);\n for (const [s, e] of ruleSpans) collected.push([s, e, rule]);\n } catch (exc) {\n failed.push(rule.name);\n if (opts.hooks) emitError(opts.hooks, exc, { stage: \"redaction\", rule: rule.name });\n }\n }\n\n if (!collected.length) {\n if (failed.length) return [text, { rules_fired: [], spans: 0, rules_failed: failed }];\n return [text, {}];\n }\n\n collected.sort((a, b) => a[0] - b[0] || b[1] - b[0] - (a[1] - a[0]));\n const merged: Array<[number, number, RedactionRule]> = [];\n for (const [start, end, rule] of collected) {\n const last = merged[merged.length - 1];\n if (last && start < last[1]) {\n if (end > last[1]) last[1] = end;\n continue;\n }\n merged.push([start, end, rule]);\n }\n\n const out: string[] = [];\n let cursor = 0;\n for (const [start, end, rule] of merged) {\n out.push(text.slice(cursor, start));\n const original = text.slice(start, end);\n if (rule.action === \"mask\") out.push(rule.effectivePlaceholder());\n else if (rule.action === \"hash\") {\n out.push(`[${rule.name.toUpperCase()}:${hashToken(original, opts.secretKey)}]`);\n }\n if (!fired.includes(rule.name)) fired.push(rule.name);\n cursor = end;\n }\n out.push(text.slice(cursor));\n\n const note: RedactionNote = { rules_fired: fired, spans: merged.length };\n if (failed.length) note.rules_failed = failed;\n return [out.join(\"\"), note];\n}\n","import { randomUUID } from \"node:crypto\";\nimport { emitToolCall, type Hooks } from \"../hooks.js\";\n\nexport const MAX_OUTPUT_SIZE = 50_000;\nexport const MAX_ERROR_MESSAGE_SIZE = 2_000;\n\ntype EngineLike = {\n pool: { query: (sql: string, params?: unknown[]) => Promise<unknown> };\n hooks?: Hooks | null;\n};\n\nexport class ToolCallTimer {\n private started: number | null = null;\n private ended: number | null = null;\n\n start(): this {\n this.started = Date.now();\n return this;\n }\n\n stop(): this {\n this.ended = Date.now();\n return this;\n }\n\n get durationMs(): number | null {\n if (this.started == null || this.ended == null) return null;\n return this.ended - this.started;\n }\n}\n\nfunction sanitize(obj: unknown): unknown {\n if (obj == null) return obj;\n try {\n return JSON.parse(JSON.stringify(obj, (_k, v) => (typeof v === \"bigint\" ? String(v) : v)));\n } catch {\n return { _raw: String(obj) };\n }\n}\n\nfunction truncateOutput(outputResult: unknown): [unknown, boolean] {\n if (outputResult == null) return [null, false];\n let serialized: string;\n try {\n serialized = JSON.stringify(outputResult);\n } catch {\n serialized = JSON.stringify(String(outputResult));\n }\n if (serialized.length <= MAX_OUTPUT_SIZE) {\n try {\n return [JSON.parse(serialized), false];\n } catch {\n return [outputResult, false];\n }\n }\n return [{ _truncated: serialized.slice(0, MAX_OUTPUT_SIZE), _original_size: serialized.length }, true];\n}\n\nfunction errorMessage(error: unknown): string | null {\n if (error == null) return null;\n const text = error instanceof Error ? error.message : String(error);\n return text.slice(0, MAX_ERROR_MESSAGE_SIZE);\n}\n\nexport async function logToolCall(\n engine: EngineLike,\n row: {\n toolId?: string | null;\n toolName: string;\n kind: string;\n actorType?: string | null;\n actorId?: unknown;\n source?: string | null;\n inputArgs?: Record<string, unknown> | null;\n outputResult?: unknown;\n success?: boolean | null;\n error?: unknown;\n durationMs?: number | null;\n units?: number | null;\n approvalId?: string | null;\n },\n): Promise<void> {\n const event = {\n tool_id: row.toolId != null ? String(row.toolId) : null,\n tool_name: row.toolName,\n kind: row.kind,\n actor_type: row.actorType ?? null,\n actor_id: row.actorId != null ? String(row.actorId) : null,\n source: row.source ?? null,\n input_args: row.inputArgs ?? {},\n output_result: row.outputResult,\n success: row.success ?? null,\n error: row.error != null ? String(row.error) : null,\n duration_ms: row.durationMs ?? null,\n units: row.units ?? null,\n approval_id: row.approvalId ?? null,\n };\n try {\n emitToolCall(engine.hooks, event);\n } catch {\n /* hook must not skip the row */\n }\n try {\n const [stored, truncated] = truncateOutput(row.outputResult);\n const args = sanitize(row.inputArgs ?? {}) ?? {};\n await engine.pool.query(\n `INSERT INTO context_engine_tool_calls\n (id, tool_id, tool_name, kind, actor_type, actor_id, source, input_args, output_result,\n output_truncated, success, error_message, duration_ms, units, approval_id)\n VALUES ($1,$2,$3,$4,$5,$6,$7,$8::jsonb,$9::jsonb,$10,$11,$12,$13,$14,$15)`,\n [\n randomUUID(),\n row.toolId ?? null,\n row.toolName,\n row.kind,\n row.actorType ?? null,\n row.actorId != null ? String(row.actorId) : null,\n row.source ?? \"api\",\n JSON.stringify(args),\n JSON.stringify(stored),\n truncated,\n row.success ?? null,\n errorMessage(row.error),\n row.durationMs ?? null,\n row.units ?? 1,\n row.approvalId ?? null,\n ],\n );\n } catch {\n /* never raises */\n }\n}\n","import { EngineActionError } from \"../../errors.js\";\nimport { assertEgressAllowed, MAX_REDIRECTS, MAX_RESPONSE_BYTES } from \"../egress.js\";\n\nconst TIMEOUT_MS = 30_000;\n\nconst SENSITIVE_RESPONSE_HEADERS = new Set([\n \"set-cookie\",\n \"set-cookie2\",\n \"authorization\",\n \"proxy-authenticate\",\n \"www-authenticate\",\n]);\n\n// The statuses this executor follows BY HAND. Deliberately not `isRedirect`:\n// following needs a `Location`, and the opaque response a browser `fetch`\n// returns under `redirect: \"manual\"` exposes no headers at all — so it can\n// never be followed, and falls out of the loop as the status-0 response it\n// is, with nothing chased.\nconst REDIRECT_STATUS = new Set([301, 302, 303, 307, 308]);\n\n// Dropped when a redirect crosses to a different origin — the credential was\n// issued for the host the tool config names, and handing it to whatever that\n// host redirects to is how a tool's API key ends up somewhere else.\nconst CROSS_ORIGIN_HEADERS = new Set([\"authorization\", \"proxy-authorization\", \"cookie\"]);\n\nfunction percentEncode(value: string): string {\n return encodeURIComponent(value).replace(\n /[!'()*]/g,\n (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`,\n );\n}\n\nfunction extract(\n schema: Record<string, unknown> | null | undefined,\n args: Record<string, unknown>,\n): Record<string, unknown> {\n if (!schema) return {};\n const properties = (schema.properties as Record<string, unknown> | undefined) ?? {};\n const required = (schema.required as unknown[] | undefined) ?? [];\n const values: Record<string, unknown> = {};\n for (const key of Object.keys(properties)) {\n const value = args[key];\n if (required.includes(key) && (value === undefined || value === null || value === \"\")) {\n throw new Error(`Missing required LLM parameter: ${key}`);\n }\n if (value !== undefined && value !== null) values[key] = value;\n }\n return values;\n}\n\nexport type ToolHttpClient = {\n request(init: {\n method: string;\n url: string;\n headers?: Record<string, string>;\n params?: Record<string, unknown>;\n json?: unknown;\n content?: string;\n }): Promise<{\n status: number;\n headers: Record<string, string>;\n json(): Promise<unknown>;\n text(): Promise<string>;\n }>;\n};\n\nfunction withQuery(url: string, params: Record<string, unknown>): string {\n const usp = new URLSearchParams();\n for (const [k, v] of Object.entries(params)) {\n if (v === undefined || v === null) continue;\n usp.set(k, String(v));\n }\n const q = usp.toString();\n if (!q) return url;\n return url.includes(\"?\") ? `${url}&${q}` : `${url}?${q}`;\n}\n\n/**\n * What one hop returns. `ToolHttpClient`'s buffered shape, plus the flag the\n * owned (streaming) path sets when it stopped reading at the cap.\n */\ntype HopResponse = {\n status: number;\n headers: Record<string, string>;\n json(): Promise<unknown>;\n text(): Promise<string>;\n truncated?: boolean;\n};\n\n/**\n * Read a response body chunk by chunk, stopping once the cap is passed and\n * cancelling the rest.\n *\n * Reading the whole body and slicing afterwards would leave the original\n * defect in place: the point of the cap is that an endless response never\n * lands in memory, not that the caller is handed a short string.\n */\nasync function readCapped(resp: Response): Promise<{ text: string; truncated: boolean }> {\n if (!resp.body) return { text: await resp.text(), truncated: false };\n const reader = resp.body.getReader();\n const chunks: Buffer[] = [];\n let size = 0;\n let truncated = false;\n for (;;) {\n const { done, value } = await reader.read();\n if (done) break;\n if (value) {\n chunks.push(Buffer.from(value));\n size += value.byteLength;\n }\n if (size > MAX_RESPONSE_BYTES) {\n truncated = true;\n await reader.cancel();\n break;\n }\n }\n const bytes = Buffer.concat(chunks);\n return {\n text: (truncated ? bytes.subarray(0, MAX_RESPONSE_BYTES) : bytes).toString(\"utf8\"),\n truncated,\n };\n}\n\nasync function defaultRequest(init: {\n method: string;\n url: string;\n headers?: Record<string, string>;\n params?: Record<string, unknown>;\n json?: unknown;\n content?: string;\n}): Promise<HopResponse> {\n let url = init.url;\n if (init.params) url = withQuery(url, init.params);\n const headers: Record<string, string> = { ...(init.headers ?? {}) };\n // `readCapped` counts DECODED bytes, so a compressed body defeats the cap:\n // one raw chunk of gzip can expand ~1000x before the reader gets to stop.\n // Only on this owned path, and only when the tool config did not ask for an\n // encoding itself.\n if (!Object.keys(headers).some((k) => k.toLowerCase() === \"accept-encoding\")) {\n headers[\"Accept-Encoding\"] = \"identity\";\n }\n let body: string | undefined;\n if (init.json !== undefined) {\n headers[\"Content-Type\"] = headers[\"Content-Type\"] ?? headers[\"content-type\"] ?? \"application/json\";\n body = JSON.stringify(init.json);\n } else if (init.content !== undefined) {\n body = init.content;\n }\n const resp = await fetch(url, {\n method: init.method,\n headers,\n body,\n // Redirects are followed by hand in `executeHttp` — an automatic follow\n // would jump to a destination no egress check ever saw.\n redirect: \"manual\",\n signal: AbortSignal.timeout(TIMEOUT_MS),\n });\n const respHeaders: Record<string, string> = {};\n resp.headers.forEach((v, k) => {\n respHeaders[k] = v;\n });\n const { text, truncated } = await readCapped(resp);\n return {\n status: resp.status,\n headers: respHeaders,\n truncated,\n async json() {\n // A leading BOM is common from .NET/Java writers and is not part of the\n // JSON. The body is decoded by hand above (the read stops at the cap),\n // so nothing else strips it and `JSON.parse` would throw, dropping the\n // caller back to raw text.\n return JSON.parse(text.replace(/^/, \"\"));\n },\n async text() {\n return text;\n },\n };\n}\n\ntype RequestInit_ = Parameters<ToolHttpClient[\"request\"]>[0];\n\n/**\n * The request for the redirect at `location`.\n *\n * `location` is resolved against the URL that produced it, so a relative\n * target works. Method semantics: 303 and 302 turn anything but HEAD into a\n * GET, 301 turns a POST into a GET; a method that becomes GET drops the body.\n * The query string is not carried over — it belonged to the URL that\n * redirected, and the target carries its own.\n */\nfunction nextHop(init: RequestInit_, status: number, location: string): RequestInit_ {\n const current = new URL(init.url);\n const target = new URL(location, current);\n let method = init.method;\n if ((status === 302 || status === 303) && method !== \"HEAD\") method = \"GET\";\n else if (status === 301 && method === \"POST\") method = \"GET\";\n\n let headers = { ...(init.headers ?? {}) };\n if (current.origin !== target.origin) {\n headers = Object.fromEntries(\n Object.entries(headers).filter(([k]) => !CROSS_ORIGIN_HEADERS.has(k.toLowerCase())),\n );\n }\n const hop: RequestInit_ = { method, url: target.toString(), headers };\n if (method === init.method) {\n if (init.json !== undefined) hop.json = init.json;\n if (init.content !== undefined) hop.content = init.content;\n }\n return hop;\n}\n\n/**\n * Execute an HTTP tool call. Returns `{status_code, headers, data}`, plus\n * `truncated: true` when the body was cut at `MAX_RESPONSE_BYTES`.\n *\n * Throws `EgressDenied` when the URL — or any redirect it leads to — names a\n * private/loopback/link-local/metadata address and `allowPrivate` is false\n * (the operator knob `ContextEngineConfig.allowPrivateEgress`), and\n * `EngineActionError` when the redirect chain outruns `MAX_REDIRECTS`.\n */\nexport async function executeHttp(\n config: Record<string, unknown>,\n args: Record<string, unknown>,\n opts: { client?: ToolHttpClient | null; allowPrivate?: boolean } = {},\n): Promise<Record<string, unknown>> {\n const method = String(config.method ?? \"GET\").toUpperCase();\n let url = config.url as string | undefined;\n const headers = { ...((config.headers as Record<string, string> | undefined) ?? {}) };\n const staticParams = { ...((config.parameters as Record<string, unknown> | undefined) ?? {}) };\n const body = config.body;\n const runtimeArgs = args ?? {};\n\n const queryValues = extract(config.llmQueryParameters as Record<string, unknown> | undefined, runtimeArgs);\n const bodyValues = extract(config.llmParameters as Record<string, unknown> | undefined, runtimeArgs);\n\n if (url?.includes(\"{{\")) {\n for (const source of [queryValues, bodyValues]) {\n for (const key of Object.keys(source)) {\n const placeholder = `{{${key}}}`;\n if (url.includes(placeholder)) {\n url = url.replaceAll(placeholder, percentEncode(String(source[key])));\n delete source[key];\n }\n }\n }\n }\n\n let requestInit: RequestInit_ = {\n method,\n url: url ?? \"\",\n headers,\n };\n\n if (method === \"GET\" || method === \"DELETE\") {\n const query = { ...staticParams, ...queryValues, ...bodyValues };\n if (Object.keys(query).length) requestInit.params = query;\n } else {\n const query = { ...staticParams, ...queryValues };\n if (Object.keys(query).length) requestInit.params = query;\n\n let jsonBody: Record<string, unknown> = {};\n if (body !== undefined && body !== null) {\n if (typeof body === \"object\" && !Array.isArray(body)) {\n jsonBody = { ...(body as Record<string, unknown>) };\n } else if (typeof body === \"string\") {\n try {\n const parsed = JSON.parse(body);\n if (parsed && typeof parsed === \"object\" && !Array.isArray(parsed)) {\n jsonBody = parsed as Record<string, unknown>;\n }\n } catch {\n /* raw string body */\n }\n }\n }\n Object.assign(jsonBody, bodyValues);\n if (Object.keys(jsonBody).length) {\n requestInit.json = jsonBody;\n } else if (body !== undefined && body !== null) {\n const contentType = headers[\"Content-Type\"] ?? headers[\"content-type\"] ?? \"\";\n if (typeof body === \"string\" && !contentType.includes(\"application/json\")) {\n requestInit.content = body;\n }\n }\n }\n\n const client = opts.client;\n const allowPrivate = opts.allowPrivate ?? false;\n let resp: HopResponse;\n let hops = 0;\n for (;;) {\n await assertEgressAllowed(requestInit.url, { allowPrivate });\n resp = client ? await client.request(requestInit) : await defaultRequest(requestInit);\n const location = resp.headers.location ?? resp.headers.Location;\n if (!REDIRECT_STATUS.has(resp.status) || !location) break;\n if (hops >= MAX_REDIRECTS) {\n throw new EngineActionError(`too many redirects (more than ${MAX_REDIRECTS}) starting at ${url}`);\n }\n hops += 1;\n requestInit = nextHop(requestInit, resp.status, location);\n }\n\n const contentType = resp.headers[\"content-type\"] ?? resp.headers[\"Content-Type\"] ?? \"\";\n let text = \"\";\n try {\n text = await resp.text();\n } catch {\n text = \"\";\n }\n const bytes = Buffer.from(text, \"utf8\");\n // The owned path already stopped at the cap and says so; the injected seam\n // is buffered by contract, so what it hands back is capped here.\n const truncated = resp.truncated === true || bytes.byteLength > MAX_RESPONSE_BYTES;\n let data: unknown;\n if (truncated) {\n // A body cut mid-stream is no longer valid JSON — hand back the text that\n // was read rather than failing the call on a parse error.\n data = bytes.subarray(0, MAX_RESPONSE_BYTES).toString(\"utf8\");\n } else {\n try {\n data = contentType.includes(\"application/json\") ? await resp.json() : text;\n } catch {\n data = text;\n }\n }\n\n const safeHeaders: Record<string, string> = {};\n for (const [k, v] of Object.entries(resp.headers)) {\n if (!SENSITIVE_RESPONSE_HEADERS.has(k.toLowerCase())) safeHeaders[k] = v;\n }\n\n const result: Record<string, unknown> = {\n status_code: resp.status,\n headers: safeHeaders,\n data,\n };\n if (truncated) result.truncated = true;\n return result;\n}\n","import type { ToolConfig, ToolKind } from \"./config.js\";\n\nexport interface CanonicalTool {\n id: string | null;\n kind: ToolKind;\n callName: string;\n displayName: string;\n description: string;\n paramsSchema: Record<string, unknown>;\n requiresApproval: boolean;\n approvalPolicy: Record<string, unknown>;\n sourceId: string | null;\n acl: string[] | null;\n raw: Record<string, unknown>;\n}\n\nfunction httpParamsSchema(config: Record<string, unknown>): Record<string, unknown> {\n const properties: Record<string, unknown> = {};\n const required: string[] = [];\n for (const key of [\"llmParameters\", \"llmQueryParameters\"]) {\n const src = (config[key] as Record<string, unknown> | undefined) ?? {};\n if (!src || typeof src !== \"object\") continue;\n Object.assign(properties, (src.properties as Record<string, unknown> | undefined) ?? {});\n const req = src.required;\n if (Array.isArray(req)) required.push(...req.map(String));\n }\n return { type: \"object\", properties, required };\n}\n\nfunction expandMcpTools(tc: ToolConfig): CanonicalTool[] {\n const config = tc.config ?? {};\n const discovered = (config.discovered_tools as Array<Record<string, unknown>> | undefined) ?? [];\n if (!discovered.length) {\n return [\n {\n id: tc.id ?? null,\n kind: \"mcp\",\n callName: `mcp_${tc.name}`,\n displayName: tc.name,\n description: tc.description || \"MCP tool\",\n paramsSchema: { type: \"object\", properties: {}, required: [] },\n requiresApproval: tc.requiresApproval,\n approvalPolicy: tc.approvalPolicy,\n sourceId: tc.sourceId,\n acl: tc.acl,\n raw: config,\n },\n ];\n }\n const tools: CanonicalTool[] = [];\n for (const dt of discovered) {\n if (dt.enabled === false) continue;\n const name = String(dt.name ?? \"unknown\");\n const schema = (dt.inputSchema as Record<string, unknown> | undefined) ??\n (dt.input_schema as Record<string, unknown> | undefined) ?? {\n type: \"object\",\n properties: {},\n required: [],\n };\n const toolApproval = dt.requires_approval as boolean | undefined;\n const toolApprovalPolicy = dt.approval_policy as Record<string, unknown> | undefined;\n tools.push({\n id: tc.id ?? null,\n kind: \"mcp\",\n callName: `mcp_${name}`,\n displayName: name,\n description: String(dt.description ?? `MCP tool: ${name}`),\n paramsSchema: schema,\n requiresApproval: toolApproval !== undefined ? Boolean(toolApproval) : tc.requiresApproval,\n approvalPolicy: toolApprovalPolicy ?? tc.approvalPolicy,\n sourceId: tc.sourceId,\n acl: tc.acl,\n raw: { ...config, tool_name: name },\n });\n }\n return tools;\n}\n\nexport function canonicalFromConfig(tc: ToolConfig): CanonicalTool[] {\n if (tc.kind === \"http\") {\n return [\n {\n id: tc.id ?? null,\n kind: \"http\",\n callName: `http_${tc.name}`,\n displayName: tc.name,\n description: tc.description || `Execute HTTP request: ${tc.name}`,\n paramsSchema: httpParamsSchema(tc.config ?? {}),\n requiresApproval: tc.requiresApproval,\n approvalPolicy: tc.approvalPolicy,\n sourceId: tc.sourceId,\n acl: tc.acl,\n raw: tc.config ?? {},\n },\n ];\n }\n if (tc.kind === \"db\") {\n return [\n {\n id: tc.id ?? null,\n kind: \"db\",\n callName: `db_${tc.name}`,\n displayName: tc.name,\n description: tc.description || `Query database: ${tc.name}`,\n paramsSchema: {\n type: \"object\",\n properties: {\n query: {\n type: \"string\",\n description: \"Either 'describe:table1,table2' to get column details, or a SQL query to execute\",\n },\n },\n required: [\"query\"],\n },\n requiresApproval: tc.requiresApproval,\n approvalPolicy: tc.approvalPolicy,\n sourceId: tc.sourceId,\n acl: tc.acl,\n raw: tc.config ?? {},\n },\n ];\n }\n if (tc.kind === \"mcp\") return expandMcpTools(tc);\n throw new Error(\n `canonicalFromConfig does not support kind=${JSON.stringify(tc.kind)}; function ` +\n \"tools have no serializable config — build them with functionTool(fn) instead\",\n );\n}\n\nexport function findTool(tools: CanonicalTool[], callName: string): CanonicalTool | undefined {\n return tools.find((t) => t.callName === callName);\n}\n","import { createHash, randomBytes } from \"node:crypto\";\nimport type { Pool } from \"pg\";\nimport { emitError, type Hooks } from \"../hooks.js\";\nimport { assertEgressAllowed } from \"./egress.js\";\n\nexport const STATE_TTL_SECONDS = 600;\nconst DISCOVERY_TIMEOUT_MS = 10_000;\nconst TOKEN_TIMEOUT_MS = 15_000;\nconst PROBE_TIMEOUT_MS = 5_000;\nconst REGISTER_TIMEOUT_MS = 10_000;\n\n/**\n * Clear one OAuth destination through the tool plane's egress policy\n * (`tools/egress.ts`), the same check `http` and `mcp` tools pass.\n *\n * Three of the four URLs this module fetches are chosen by the SERVER, not\n * the operator: `registration_endpoint` and `token_endpoint` come out of the\n * server's own discovery document, and the stored pending state carries the\n * token endpoint forward to the callback. A hostile MCP server advertising\n * `http://169.254.169.254/token` would otherwise have this library POST to\n * the cloud metadata service on its behalf — with a client secret attached.\n *\n * `authorization_endpoint` is deliberately NOT checked: it is never fetched,\n * only handed to the caller to redirect a BROWSER to, where the request\n * leaves the user's machine and not this server.\n *\n * Mirrors `context_engine/tools/mcp_oauth.py::_check_egress`.\n */\nasync function checkEgress(url: string, allowPrivate: boolean): Promise<void> {\n await assertEgressAllowed(url, { allowPrivate });\n}\n\nfunction report(hooks: Hooks | null | undefined, exc: unknown, ctx: Record<string, unknown>): void {\n if (hooks) emitError(hooks, exc, ctx);\n else console.error(\"[context-engine] mcp_oauth error:\", exc, \"| ctx=\", ctx);\n}\n\nexport interface PendingStore {\n put(state: string, data: Record<string, unknown>, ttlSeconds?: number): void | Promise<void>;\n pop(state: string): Record<string, unknown> | null | Promise<Record<string, unknown> | null>;\n}\n\nexport class InMemoryPendingStore implements PendingStore {\n private store = new Map<string, { data: Record<string, unknown>; expiresAt: number }>();\n\n private cleanupExpired(): void {\n const now = Date.now() / 1000;\n for (const [k, v] of this.store) {\n if (v.expiresAt <= now) this.store.delete(k);\n }\n }\n\n put(state: string, data: Record<string, unknown>, ttlSeconds: number = STATE_TTL_SECONDS): void {\n this.cleanupExpired();\n this.store.set(state, { data, expiresAt: Date.now() / 1000 + ttlSeconds });\n }\n\n pop(state: string): Record<string, unknown> | null {\n this.cleanupExpired();\n const entry = this.store.get(state);\n this.store.delete(state);\n if (!entry) return null;\n if (entry.expiresAt <= Date.now() / 1000) return null;\n return entry.data;\n }\n}\n\nexport class PostgresPendingStore implements PendingStore {\n constructor(private pool: Pool) {}\n\n private async reapExpired(): Promise<void> {\n await this.pool.query(\"DELETE FROM context_engine_oauth_pending WHERE expires_at < now()\");\n }\n\n async put(\n state: string,\n data: Record<string, unknown>,\n ttlSeconds: number = STATE_TTL_SECONDS,\n ): Promise<void> {\n await this.reapExpired();\n const expiresAt = new Date(Date.now() + ttlSeconds * 1000);\n await this.pool.query(\n `INSERT INTO context_engine_oauth_pending (state, data, expires_at)\n VALUES ($1, $2::jsonb, $3)\n ON CONFLICT (state) DO UPDATE SET data = EXCLUDED.data, expires_at = EXCLUDED.expires_at`,\n [state, JSON.stringify(data), expiresAt],\n );\n }\n\n async pop(state: string): Promise<Record<string, unknown> | null> {\n await this.reapExpired();\n const result = await this.pool.query(\n `DELETE FROM context_engine_oauth_pending WHERE state = $1 RETURNING data, expires_at`,\n [state],\n );\n const row = result.rows[0];\n if (!row) return null;\n const expiresAt = new Date(row.expires_at);\n if (expiresAt.getTime() <= Date.now()) return null;\n return row.data as Record<string, unknown>;\n }\n}\n\nasync function fetchJson(\n url: string,\n opts: {\n method?: string;\n timeout?: number;\n headers?: Record<string, string>;\n body?: string | Buffer | Uint8Array | URLSearchParams | null;\n redirect?: \"follow\" | \"error\" | \"manual\";\n } = {},\n): Promise<{ status: number; type: string; json: () => Promise<unknown>; text: () => Promise<string> }> {\n const resp = await fetch(url, {\n method: opts.method ?? \"GET\",\n headers: opts.headers,\n body: opts.body,\n // Never followed: a redirect reaches a destination no egress check saw,\n // and on the token endpoint it would forward the client secret with it.\n redirect: opts.redirect ?? \"manual\",\n signal: AbortSignal.timeout(opts.timeout ?? DISCOVERY_TIMEOUT_MS),\n });\n return {\n // `type` rides along so callers can tell an opaque redirect (status 0)\n // from a request that simply failed — see `isRedirect`.\n status: resp.status,\n type: resp.type,\n json: () => resp.json(),\n text: () => resp.text(),\n };\n}\n\n/**\n * Discover OAuth metadata for the MCP server at `serverUrl`.\n *\n * Throws `EgressDenied` when the server is somewhere the tool plane may not\n * connect. The check is on the ORIGIN, once, outside every `try` below: every\n * URL this function fetches is `${base}${path}`, and the `try`s are there to\n * turn a 404/timeout into \"this server does not do OAuth\" — a refusal\n * swallowed by one of them would look exactly like that.\n */\nexport async function discoverOauthMetadata(\n serverUrl: string,\n opts: { hooks?: Hooks | null; allowPrivate?: boolean } = {},\n): Promise<Record<string, unknown> | null> {\n const parsed = new URL(serverUrl);\n const base = `${parsed.protocol}//${parsed.host}`;\n await checkEgress(base, opts.allowPrivate ?? false);\n\n const wellKnownUrl = `${base}/.well-known/oauth-authorization-server`;\n try {\n const resp = await fetchJson(wellKnownUrl, { timeout: DISCOVERY_TIMEOUT_MS });\n if (resp.status === 200) {\n const data = (await resp.json()) as Record<string, unknown>;\n if (data.authorization_endpoint && data.token_endpoint) {\n return {\n authorization_endpoint: data.authorization_endpoint,\n token_endpoint: data.token_endpoint,\n registration_endpoint: data.registration_endpoint,\n scopes_supported: data.scopes_supported ?? [],\n response_types_supported: data.response_types_supported ?? [],\n code_challenge_methods_supported: data.code_challenge_methods_supported ?? [\"S256\"],\n issuer: data.issuer ?? base,\n };\n }\n }\n } catch (e) {\n if (!(e instanceof TypeError) && !(e instanceof DOMException)) {\n report(opts.hooks, e, { stage: \"discover_oauth_metadata_8414\", url: wellKnownUrl });\n }\n }\n\n const oidcUrl = `${base}/.well-known/openid-configuration`;\n try {\n const resp = await fetchJson(oidcUrl, { timeout: DISCOVERY_TIMEOUT_MS });\n if (resp.status === 200) {\n const data = (await resp.json()) as Record<string, unknown>;\n if (data.authorization_endpoint && data.token_endpoint) {\n return {\n authorization_endpoint: data.authorization_endpoint,\n token_endpoint: data.token_endpoint,\n registration_endpoint: data.registration_endpoint,\n scopes_supported: data.scopes_supported ?? [],\n code_challenge_methods_supported: data.code_challenge_methods_supported ?? [\"S256\"],\n issuer: data.issuer ?? base,\n };\n }\n }\n } catch {\n /* continue */\n }\n\n for (const [authPath, tokenPath] of [\n [\"/oauth/authorize\", \"/oauth/token\"],\n [\"/authorize\", \"/token\"],\n [\"/oauth2/authorize\", \"/oauth2/token\"],\n ] as const) {\n try {\n const resp = await fetchJson(`${base}${authPath}`, {\n timeout: PROBE_TIMEOUT_MS,\n redirect: \"manual\",\n });\n // 200, 302/303 (redirect to login), 400 (missing params) all indicate\n // the endpoint exists — the same four the Python port accepts. Plus the\n // opaque response a browser `fetch` returns under `redirect: \"manual\"`:\n // it hides the status, so a 302 to a login page arrives indistinguishable\n // from any other redirect and is accepted on that basis (httpx has no\n // such case, which is why the Python list has no fifth entry).\n if (\n resp.status === 200 ||\n resp.status === 400 ||\n resp.status === 302 ||\n resp.status === 303 ||\n resp.type === \"opaqueredirect\"\n ) {\n return {\n authorization_endpoint: `${base}${authPath}`,\n token_endpoint: `${base}${tokenPath}`,\n issuer: base,\n scopes_supported: [],\n code_challenge_methods_supported: [\"S256\"],\n };\n }\n } catch {}\n }\n return null;\n}\n\n/**\n * Register as an OAuth client with the MCP server (RFC 7591 DCR).\n *\n * Throws `EgressDenied` when `registrationEndpoint` — which the SERVER\n * supplied, in its own discovery document — is somewhere the tool plane may\n * not connect.\n */\nexport async function registerOauthClient(\n registrationEndpoint: string,\n redirectUri: string,\n clientName = \"Promptev Context Engine\",\n opts: { hooks?: Hooks | null; allowPrivate?: boolean } = {},\n): Promise<Record<string, unknown>> {\n await checkEgress(registrationEndpoint, opts.allowPrivate ?? false);\n const payload = {\n client_name: clientName,\n redirect_uris: [redirectUri],\n grant_types: [\"authorization_code\", \"refresh_token\"],\n response_types: [\"code\"],\n token_endpoint_auth_method: \"none\",\n };\n let resp: Awaited<ReturnType<typeof fetchJson>>;\n try {\n resp = await fetchJson(registrationEndpoint, {\n method: \"POST\",\n timeout: REGISTER_TIMEOUT_MS,\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify(payload),\n });\n } catch (e) {\n report(opts.hooks, e, { stage: \"register_oauth_client\", registration_endpoint: registrationEndpoint });\n throw new Error(`Cannot reach registration endpoint: ${e}`);\n }\n if (resp.status !== 200 && resp.status !== 201) {\n const error = new Error(`Client registration failed: ${resp.status}`);\n report(opts.hooks, error, {\n stage: \"register_oauth_client\",\n registration_endpoint: registrationEndpoint,\n status_code: resp.status,\n });\n throw error;\n }\n return (await resp.json()) as Record<string, unknown>;\n}\n\nexport async function buildAuthorizeUrl(\n metadata: Record<string, unknown>,\n serverUrl: string,\n toolId: string,\n redirectUri: string,\n store: PendingStore,\n opts: {\n clientId?: string | null;\n clientSecret?: string | null;\n scopes?: string | null;\n ttlSeconds?: number;\n } = {},\n): Promise<{ authorize_url: string; state: string }> {\n const authEndpoint = metadata.authorization_endpoint as string | undefined;\n const tokenEndpoint = metadata.token_endpoint as string | undefined;\n if (!authEndpoint) throw new Error(\"OAuth metadata missing 'authorization_endpoint'\");\n if (!tokenEndpoint) throw new Error(\"OAuth metadata missing 'token_endpoint'\");\n\n const codeVerifier = randomBytes(64).toString(\"base64url\").slice(0, 128);\n const digest = createHash(\"sha256\").update(codeVerifier, \"ascii\").digest();\n const codeChallenge = digest.toString(\"base64url\");\n const state = randomBytes(32).toString(\"base64url\");\n\n await Promise.resolve(\n store.put(\n state,\n {\n server_url: serverUrl,\n code_verifier: codeVerifier,\n tool_id: toolId,\n redirect_uri: redirectUri,\n token_endpoint: tokenEndpoint,\n client_id: opts.clientId ?? null,\n client_secret: opts.clientSecret ?? null,\n },\n opts.ttlSeconds ?? STATE_TTL_SECONDS,\n ),\n );\n\n const params = new URLSearchParams({\n response_type: \"code\",\n state,\n redirect_uri: redirectUri,\n code_challenge: codeChallenge,\n code_challenge_method: \"S256\",\n });\n if (opts.clientId) params.set(\"client_id\", opts.clientId);\n if (opts.scopes) params.set(\"scope\", opts.scopes);\n\n return { authorize_url: `${authEndpoint}?${params.toString()}`, state };\n}\n\nexport async function exchangeCodeForToken(\n state: string,\n code: string,\n store: PendingStore,\n opts: { clientSecret?: string | null; hooks?: Hooks | null; allowPrivate?: boolean } = {},\n): Promise<Record<string, unknown>> {\n const pending = await Promise.resolve(store.pop(state));\n if (!pending) throw new Error(\"Invalid or expired OAuth state — please try connecting again\");\n const tokenEndpoint = pending.token_endpoint as string | undefined;\n if (!tokenEndpoint) throw new Error(\"No token_endpoint in stored OAuth state\");\n // The stored state carries a value that came from the SERVER's discovery\n // document, so the endpoint is re-checked here rather than trusted because\n // it was checked (as part of the origin) at discovery time.\n await checkEgress(tokenEndpoint, opts.allowPrivate ?? false);\n\n const body = new URLSearchParams({\n grant_type: \"authorization_code\",\n code,\n redirect_uri: String(pending.redirect_uri),\n code_verifier: String(pending.code_verifier),\n });\n if (pending.client_id) body.set(\"client_id\", String(pending.client_id));\n const secret = opts.clientSecret || (pending.client_secret as string | null);\n if (secret) body.set(\"client_secret\", String(secret));\n\n let resp: Awaited<ReturnType<typeof fetchJson>>;\n try {\n resp = await fetchJson(tokenEndpoint, {\n method: \"POST\",\n timeout: TOKEN_TIMEOUT_MS,\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body,\n });\n } catch (e) {\n report(opts.hooks, e, { stage: \"exchange_code_for_token\", token_endpoint: tokenEndpoint });\n throw new Error(`Could not reach token endpoint: ${e}`);\n }\n if (resp.status !== 200) {\n const error = new Error(`Token exchange failed: ${resp.status}`);\n report(opts.hooks, error, {\n stage: \"exchange_code_for_token\",\n token_endpoint: tokenEndpoint,\n status_code: resp.status,\n });\n throw error;\n }\n\n let tokenData: Record<string, unknown>;\n try {\n tokenData = (await resp.json()) as Record<string, unknown>;\n } catch {\n const text = await resp.text();\n tokenData = Object.fromEntries(new URLSearchParams(text));\n }\n const accessToken = tokenData.access_token;\n if (!accessToken) {\n const error = new Error(\"Token response missing access_token\");\n report(opts.hooks, error, { stage: \"exchange_code_for_token\", token_endpoint: tokenEndpoint });\n throw error;\n }\n return {\n access_token: accessToken,\n refresh_token: tokenData.refresh_token,\n token_type: tokenData.token_type ?? \"Bearer\",\n expires_in: tokenData.expires_in,\n scope: tokenData.scope,\n tool_id: pending.tool_id,\n server_url: pending.server_url,\n };\n}\n\nexport async function refreshAccessToken(\n tokenEndpoint: string,\n refreshToken: string,\n opts: {\n clientId?: string | null;\n clientSecret?: string | null;\n hooks?: Hooks | null;\n allowPrivate?: boolean;\n } = {},\n): Promise<Record<string, unknown>> {\n await checkEgress(tokenEndpoint, opts.allowPrivate ?? false);\n const body = new URLSearchParams({\n grant_type: \"refresh_token\",\n refresh_token: refreshToken,\n });\n if (opts.clientId) body.set(\"client_id\", opts.clientId);\n if (opts.clientSecret) body.set(\"client_secret\", opts.clientSecret);\n\n let resp: Awaited<ReturnType<typeof fetchJson>>;\n try {\n resp = await fetchJson(tokenEndpoint, {\n method: \"POST\",\n timeout: TOKEN_TIMEOUT_MS,\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body,\n });\n } catch (e) {\n report(opts.hooks, e, { stage: \"refresh_access_token\", token_endpoint: tokenEndpoint });\n throw new Error(`Could not reach token endpoint: ${e}`);\n }\n if (resp.status !== 200) {\n const error = new Error(`Token refresh failed: ${resp.status}`);\n report(opts.hooks, error, {\n stage: \"refresh_access_token\",\n token_endpoint: tokenEndpoint,\n status_code: resp.status,\n });\n throw error;\n }\n const tokenData = (await resp.json()) as Record<string, unknown>;\n if (!tokenData.access_token) {\n const error = new Error(\"Refresh response missing access_token\");\n report(opts.hooks, error, { stage: \"refresh_access_token\", token_endpoint: tokenEndpoint });\n throw error;\n }\n return {\n access_token: tokenData.access_token,\n refresh_token: tokenData.refresh_token ?? refreshToken,\n expires_in: tokenData.expires_in,\n };\n}\n"]}