@sixb/core 0.1.20 → 0.1.21

package/dist/chunk-6rqgmkde.js.map

@@ -0,0 +1,29 @@
+{
+  "version": 3,
+  "sources": ["../src/runtime/ontology-mutations.ts", "../src/activity/device.ts", "../src/activity/connection.ts", "../src/activity/shares.ts", "../src/assert-never.ts", "../src/objects/clearance-redaction.ts", "../src/objects/query/clearance-admission.ts", "../src/objects/query/link-query-clearance.ts", "../src/objects/telemetry/workload.ts", "../src/objects/authorized-ontology-view.ts", "../src/execution/object-reader-ontology.ts", "../src/objects/query/selected-read-admission.ts", "../src/execution/object-reader-clearance.ts", "../src/execution/object-reader-security.ts", "../src/execution/authorized-object-reader.ts", "../src/actions/run-authorization.ts", "../src/runtime/ai-cost.ts", "../src/activity/timeline.ts", "../src/activity/execution.ts", "../src/models/execution/session.ts"],
+  "sourcesContent": [
+    "import type {\n  EditCommitResult,\n  OntologyEditCommit,\n  ProjectionCommitResult,\n  ProjectionRunFinishInput,\n  ProjectionSourceRef,\n  ProjectionSourceReplacement,\n  TelemetryAppend,\n  TelemetryCommitResult,\n} from \"../materialization/model\"\nimport type { BoundOntologyMaterializer } from \"../materializer\"\nimport type { OntologySourceRecord } from \"../storage/ontology\"\n\nexport interface OntologyMutationRuntime {\n  getProjectionSource?(source: ProjectionSourceRef): Promise<OntologySourceRecord | null>\n  commitEdits(input: OntologyEditCommit): Promise<EditCommitResult>\n  replaceProjection(input: ProjectionSourceReplacement): Promise<ProjectionCommitResult>\n  finishProjection(input: ProjectionRunFinishInput): Promise<void>\n  appendTelemetry(input: TelemetryAppend): Promise<TelemetryCommitResult>\n}\n\nconst ontologyMutationRuntimeKey: unique symbol = Symbol(\"sixb.ontologyMutationRuntime\")\n\ninterface OntologyMutationRuntimeOwner {\n  readonly [ontologyMutationRuntimeKey]?: OntologyMutationRuntime\n}\n\nexport function registerOntologyMutationRuntime(\n  owner: object,\n  runtime: OntologyMutationRuntime\n): void {\n  const registered = (owner as OntologyMutationRuntimeOwner)[ontologyMutationRuntimeKey]\n  if (registered && registered !== runtime) {\n    throw new Error(\"[Sixb] Ontology mutation runtime is already registered for this owner.\")\n  }\n  Object.defineProperty(owner, ontologyMutationRuntimeKey, {\n    configurable: false,\n    enumerable: true,\n    value: runtime,\n    writable: false,\n  })\n}\n\nexport function getOntologyMutationRuntime(owner: object): OntologyMutationRuntime {\n  const runtime = (owner as OntologyMutationRuntimeOwner)[ontologyMutationRuntimeKey]\n  if (runtime) return runtime\n  throw new Error(\"[Sixb] Ontology mutation runtime is not registered for this runtime context.\")\n}\n\n/** Copies the opaque capability when an internal runtime context is reconstructed. */\nexport function shareOntologyMutationRuntime(source: object, target: object): void {\n  registerOntologyMutationRuntime(target, getOntologyMutationRuntime(source))\n}\n\n/** Adapt an already-bound Materializer to the internal ontology mutation runtime. */\nexport function createOntologyMutationRuntime(input: {\n  readonly materializer: BoundOntologyMaterializer\n  readonly notifyCommittedFacts: () => void\n  /** Called once a projection may have changed the dataset version its source applied. */\n  readonly onProjectionApplied?: () => void\n}): OntologyMutationRuntime {\n  const applied = <TResult>(work: Promise<TResult>): Promise<TResult> =>\n    work.finally(() => notifyWithoutAffecting(input.onProjectionApplied))\n\n  const runtime: OntologyMutationRuntime = {\n    getProjectionSource: (source) => input.materializer.projections.getActive(source),\n    commitEdits: (command) =>\n      commitAndNotify(() => input.materializer.edits.commit(command), input.notifyCommittedFacts),\n    replaceProjection: (command) =>\n      applied(\n        commitAndNotify(\n          () => input.materializer.projections.replace(command),\n          input.notifyCommittedFacts\n        )\n      ),\n    finishProjection: (command) => applied(input.materializer.projections.finishRun(command)),\n    appendTelemetry: (command) =>\n      commitAndNotify(\n        () => input.materializer.telemetry.append(command),\n        input.notifyCommittedFacts\n      ),\n  }\n  return Object.freeze(runtime)\n}\n\nasync function commitAndNotify<TResult extends { readonly eventCount: number }>(\n  commit: () => Promise<TResult>,\n  notify: () => void\n): Promise<TResult> {\n  const result = await commit()\n  if (result.eventCount > 0) notifyWithoutAffectingCommit(notify)\n  return result\n}\n\nfunction notifyWithoutAffectingCommit(notify: () => void): void {\n  try {\n    notify()\n  } catch (error) {\n    // The ontology commit is already durable. A wake-up failure must never turn it into an apparent\n    // mutation failure; API-hosted ontology maintenance remains the correctness fallback.\n    console.error(\"[Sixb] Failed to wake the ontology outbox dispatcher:\", error)\n  }\n}\n\nfunction notifyWithoutAffecting(notify: (() => void) | undefined): void {\n  try {\n    notify?.()\n  } catch (error) {\n    console.error(\"[Sixb] Failed to report an applied projection:\", error)\n  }\n}\n",
+    "/** What a user agent says about the device that signed in. Display only, never authorization. */\nexport interface ActivityDevice {\n  readonly browser?: string\n  readonly os?: string\n}\n\n// First match wins: Edge and Opera also name Chrome, Chrome names Safari, iOS names Mac OS X, and\n// Android names Linux.\nconst BROWSERS: readonly (readonly [RegExp, string])[] = [\n  [/\\bEdg(?:e|A|iOS)?\\//, \"Edge\"],\n  [/\\b(?:OPR|Opera)\\//, \"Opera\"],\n  [/\\bSamsungBrowser\\//, \"Samsung Internet\"],\n  [/\\b(?:Firefox|FxiOS)\\//, \"Firefox\"],\n  [/\\b(?:Chrome|Chromium|CriOS|HeadlessChrome)\\//, \"Chrome\"],\n  [/\\bVersion\\/[\\d.]+.*\\bSafari\\//, \"Safari\"],\n]\n\nconst SYSTEMS: readonly (readonly [RegExp, string])[] = [\n  [/\\bWindows\\b/, \"Windows\"],\n  [/\\biPad\\b/, \"iPadOS\"],\n  [/\\b(?:iPhone|iPod)\\b/, \"iOS\"],\n  [/\\bAndroid\\b/, \"Android\"],\n  [/\\bCrOS\\b/, \"ChromeOS\"],\n  [/\\bMac OS X\\b|\\bMacintosh\\b/, \"macOS\"],\n  [/\\bLinux\\b/, \"Linux\"],\n]\n\n/** The browser and operating system a user agent names, when it names a common one. */\nexport function describeUserAgent(userAgent: string | undefined): ActivityDevice {\n  if (!userAgent) {\n    return {}\n  }\n\n  const browser = BROWSERS.find(([pattern]) => pattern.test(userAgent))?.[1]\n  const os = SYSTEMS.find(([pattern]) => pattern.test(userAgent))?.[1]\n\n  return {\n    ...(browser === undefined ? {} : { browser }),\n    ...(os === undefined ? {} : { os }),\n  }\n}\n",
+    "import type { SixbRuntimeContext } from \"../runtime/types\"\nimport type { ActivityVisit, StoredActivityVisitPage } from \"../storage/activity/types\"\nimport type { SessionRecord } from \"../storage/auth\"\nimport type { ShareGrantRecord } from \"../storage/share-grants\"\nimport { type ActivityDevice, describeUserAgent } from \"./device\"\nimport type { ActivityService } from \"./service\"\n\nexport type ActivityConnectionStatus = \"active\" | \"expired\" | \"revoked\"\n\n/** A signed-in session. No address or token is kept here. */\nexport interface ActivitySessionConnection {\n  readonly type: \"session\"\n  readonly device: ActivityDevice\n  /** A native client's own label, such as a CLI's. */\n  readonly clientName?: string\n  readonly status: ActivityConnectionStatus\n  readonly createdAt: Date\n  readonly lastSeenAt?: Date\n  readonly revokedAt?: Date\n}\n\n/** The shared link a visitor opened, and the session it gave them. */\nexport interface ActivityShareConnection {\n  readonly type: \"share\"\n  readonly grantId: string\n  /** Absent once the link's grant is gone. */\n  readonly definitionId?: string\n  readonly status: ActivityConnectionStatus\n  readonly createdAt: Date\n  readonly revokedAt?: Date\n}\n\nexport type ActivityConnection = ActivitySessionConnection | ActivityShareConnection\n\n/** A user's sign-in, with the visits it opened. */\nexport interface ActivityUserConnection extends ActivitySessionConnection {\n  /** Every visit the session opened. */\n  readonly visits: number\n  /** Its latest visits, newest first. */\n  readonly latestVisits: readonly ActivityVisit[]\n}\n\nexport interface ActivityConnectionsPage {\n  readonly connections: readonly ActivityUserConnection[]\n  /** Pass it back as `cursor` for the next, older connections; absent on the last page. */\n  readonly nextCursor?: string\n}\n\nexport interface ActivityConnectionsQuery {\n  readonly userId: string\n  /** 1 to 100. Default: 20. */\n  readonly limit?: number\n  /** The previous page's `nextCursor`. */\n  readonly cursor?: string\n}\n\n/** Where a list of sessions continues: a creation time, and how many created then it returned. */\nexport interface ActivityConnectionsCursor {\n  readonly createdAt: Date\n  readonly skip: number\n}\n\n/** A user's sign-ins, newest first, revoked and expired ones too: one read per store. */\nexport async function readActivityConnections(\n  runtime: SixbRuntimeContext,\n  service: ActivityService,\n  query: ActivityConnectionsQuery,\n  now: Date\n): Promise<ActivityConnectionsPage> {\n  const { userId, limit, before } = service.connectionsQuery(query)\n  const sessions = runtime.storage.auth?.sessions\n  if (!sessions) {\n    return { connections: [] }\n  }\n\n  const page = await sessions.listByUserId({\n    projectId: runtime.projectId,\n    userId,\n    limit,\n    ...(before === undefined ? {} : { before }),\n  })\n  const visits = await service.sessionVisits({\n    userId,\n    sessionIds: page.sessions.map((session) => session.id),\n  })\n  const bySession = new Map(visits.map((entry) => [entry.sessionId, entry]))\n\n  const connections = page.sessions.map((session) => ({\n    ...sessionConnection(session, now),\n    visits: bySession.get(session.id)?.visits ?? 0,\n    latestVisits: bySession.get(session.id)?.latest ?? [],\n  }))\n  const last = page.sessions.at(-1)\n\n  return {\n    connections,\n    ...(page.hasMore && last\n      ? { nextCursor: nextConnectionsCursor(page.sessions, last, before) }\n      : {}),\n  }\n}\n\n/**\n * The cursor after a page: its last creation time, and how many sessions created then this page\n * and the ones before it returned. It names no session, so the session id never leaves core.\n */\nfunction nextConnectionsCursor(\n  sessions: readonly SessionRecord[],\n  last: SessionRecord,\n  before: ActivityConnectionsCursor | undefined\n): string {\n  const { createdAt } = last\n  const tied = sessions.filter((session) => session.createdAt.getTime() === createdAt.getTime())\n  const earlier = before && before.createdAt.getTime() === createdAt.getTime() ? before.skip : 0\n\n  return encodeActivityConnectionsCursor({ createdAt, skip: earlier + tied.length })\n}\n\nexport function encodeActivityConnectionsCursor(cursor: ActivityConnectionsCursor): string {\n  return Buffer.from(JSON.stringify([cursor.createdAt.toISOString(), cursor.skip])).toString(\n    \"base64url\"\n  )\n}\n\nexport function decodeActivityConnectionsCursor(value: string): ActivityConnectionsCursor {\n  try {\n    const parsed: unknown = JSON.parse(Buffer.from(value, \"base64url\").toString(\"utf8\"))\n    if (Array.isArray(parsed) && parsed.length === 2) {\n      const [at, skip] = parsed\n      const createdAt = new Date(typeof at === \"string\" ? at : Number.NaN)\n      if (Number.isFinite(createdAt.getTime()) && Number.isSafeInteger(skip) && skip >= 0) {\n        return { createdAt, skip }\n      }\n    }\n  } catch {\n    // Reported below, like any other malformed cursor.\n  }\n  throw new Error(\"[Sixb] Invalid activity connections cursor.\")\n}\n\n/**\n * The session a visit came through: a sign-in, or a shared link, whose grant the caller read with\n * the visit's share name.\n */\nexport async function readActivityConnection(\n  runtime: SixbRuntimeContext,\n  page: StoredActivityVisitPage,\n  grant: ShareGrantRecord | undefined,\n  now: Date\n): Promise<ActivityConnection | undefined> {\n  const { storage, projectId } = runtime\n  const { actor } = page.visit\n\n  if (actor.type === \"user\") {\n    const session = await storage.auth?.sessions.getById({ projectId, id: page.sessionId })\n    return session ? sessionConnection(session, now) : undefined\n  }\n\n  const session = await storage.shareSessions?.getById({ projectId, id: page.sessionId })\n  if (!session) {\n    return undefined\n  }\n\n  // A session lasts no longer than its link: revoking or expiring the grant ends it too.\n  const revokedAt = [session.revokedAt, grant?.revokedAt]\n    .flatMap((at) => (at === undefined ? [] : [at.getTime()]))\n    .sort((left, right) => left - right)[0]\n  const statuses = [\n    connectionStatus(session, now),\n    ...(grant ? [connectionStatus(grant, now)] : []),\n  ]\n  const status = statuses.includes(\"revoked\")\n    ? \"revoked\"\n    : statuses.includes(\"expired\")\n      ? \"expired\"\n      : \"active\"\n\n  return {\n    type: \"share\",\n    grantId: actor.grantId,\n    ...(grant ? { definitionId: grant.definitionId } : {}),\n    status,\n    createdAt: new Date(session.createdAt),\n    ...(revokedAt === undefined ? {} : { revokedAt: new Date(revokedAt) }),\n  }\n}\n\nfunction connectionStatus(\n  session: {\n    readonly expiresAt: Date\n    readonly absoluteExpiresAt?: Date\n    readonly revokedAt?: Date\n  },\n  now: Date\n): ActivityConnectionStatus {\n  if (session.revokedAt) {\n    return \"revoked\"\n  }\n\n  const expired =\n    session.expiresAt <= now ||\n    (session.absoluteExpiresAt !== undefined && session.absoluteExpiresAt <= now)\n  return expired ? \"expired\" : \"active\"\n}\n\n/** A signed-in session as a connection, from its record and the time it is read at. */\nfunction sessionConnection(session: SessionRecord, now: Date): ActivitySessionConnection {\n  return {\n    type: \"session\",\n    device: describeUserAgent(session.userAgent),\n    ...(session.bearer === undefined ? {} : { clientName: session.bearer.clientName }),\n    status: connectionStatus(session, now),\n    createdAt: new Date(session.createdAt),\n    ...(session.lastSeenAt === undefined ? {} : { lastSeenAt: new Date(session.lastSeenAt) }),\n    ...(session.revokedAt === undefined ? {} : { revokedAt: new Date(session.revokedAt) }),\n  }\n}\n",
+    "import type { SixbRuntimeContext } from \"../runtime/types\"\nimport type { ActivityActor, ActivityVisit } from \"../storage/activity/types\"\nimport type { ShareGrantRecord } from \"../storage/share-grants\"\n\n/** Who a visit belongs to, as `sixb.activity` returns it: a shared link also names its share. */\nexport type ActivityVisitActor =\n  | Extract<ActivityActor, { readonly type: \"user\" }>\n  | (Extract<ActivityActor, { readonly type: \"share\" }> & {\n      /** The link's share definition; absent once its grant is gone. */\n      readonly definitionId?: string\n    })\n\n/** A visit as `sixb.activity` returns it. */\nexport interface ActivityVisitView extends Omit<ActivityVisit, \"actor\"> {\n  readonly actor: ActivityVisitActor\n}\n\n/** Visits named by their links' shares, from one grant read for all of them. */\nexport async function nameSharedVisits(\n  runtime: SixbRuntimeContext,\n  visits: readonly ActivityVisit[]\n): Promise<readonly ActivityVisitView[]> {\n  const grants = await readGrants(runtime, visits)\n  return visits.map((visit) => withShare(visit, grants))\n}\n\n/** One visit named by its link's share, with that link's grant when it still exists. */\nexport async function nameSharedVisit(\n  runtime: SixbRuntimeContext,\n  visit: ActivityVisit\n): Promise<{ readonly visit: ActivityVisitView; readonly grant?: ShareGrantRecord }> {\n  const grants = await readGrants(runtime, [visit])\n  const grant = visit.actor.type === \"share\" ? grants.get(visit.actor.grantId) : undefined\n\n  return { visit: withShare(visit, grants), ...(grant === undefined ? {} : { grant }) }\n}\n\nasync function readGrants(\n  runtime: SixbRuntimeContext,\n  visits: readonly ActivityVisit[]\n): Promise<ReadonlyMap<string, ShareGrantRecord>> {\n  const ids = visits.flatMap((visit) => (visit.actor.type === \"share\" ? [visit.actor.grantId] : []))\n  if (ids.length === 0 || !runtime.storage.shareGrants) {\n    return new Map()\n  }\n\n  const grants = await runtime.storage.shareGrants.getByIds({ projectId: runtime.projectId, ids })\n  return new Map(grants.map((grant) => [grant.id, grant]))\n}\n\nfunction withShare(\n  visit: ActivityVisit,\n  grants: ReadonlyMap<string, ShareGrantRecord>\n): ActivityVisitView {\n  const { actor } = visit\n  const grant = actor.type === \"share\" ? grants.get(actor.grantId) : undefined\n  if (actor.type !== \"share\" || grant === undefined) {\n    return visit\n  }\n\n  return { ...visit, actor: { ...actor, definitionId: grant.definitionId } }\n}\n",
+    "/**\n * Closes a switch over a union: the call stops compiling when a new member has no case, and throws\n * if an untyped value reaches it at runtime.\n */\nexport function assertNever(_value: never, message: string): never {\n  throw new Error(message)\n}\n",
+    "import type { StoredDomainEvent } from \"../events/types\"\nimport type { ExpandedLinkValue, ExpandedObjectRow, ObjectRow } from \"../storage\"\nimport type { PropertyClearance } from \"./property-clearance\"\n\n/**\n * Omit unreadable properties from a row and the objects expanded under it, and list them in\n * `redactions`. The row is not modified: what changes is copied, the rest is shared.\n */\nexport function redactObjectRow<TRow extends ObjectRow>(\n  row: TRow,\n  clearance: PropertyClearance\n): TRow {\n  return redactRow(row, clearance, true)\n}\n\n/**\n * {@link redactObjectRow} without the `redactions` records, for rows about to be deep-copied.\n *\n * Omitting hidden values before the copy keeps them out of it and copies each row once. The copy\n * then receives its records from {@link attachRedactions}: they are frozen and owned by the\n * clearance, so they are shared rather than copied with each row.\n */\nexport function omitHiddenProperties<TRow extends ObjectRow>(\n  row: TRow,\n  clearance: PropertyClearance\n): TRow {\n  return redactRow(row, clearance, false)\n}\n\n/**\n * Set `redactions` on a row returned by {@link omitHiddenProperties} and since deep-copied, and on\n * the objects expanded under it. It modifies the row, so it only accepts the caller's own copy.\n */\nexport function attachRedactions(row: ObjectRow, clearance: PropertyClearance): void {\n  const hidden = clearance.hiddenProperties(row.objectTypeId)\n  if (hidden !== undefined) row.redactions = hidden.redactions\n\n  if (row.links === undefined) return\n\n  for (const value of Object.values(row.links)) {\n    if (value === null) continue\n    if (Array.isArray(value)) {\n      for (const linked of value) attachRedactions(linked, clearance)\n    } else {\n      attachRedactions(value as ExpandedObjectRow, clearance)\n    }\n  }\n}\n\nfunction redactRow<TRow extends ObjectRow>(\n  row: TRow,\n  clearance: PropertyClearance,\n  withRedactions: boolean\n): TRow {\n  const hidden = clearance.hiddenProperties(row.objectTypeId)\n  const links = row.links\n  if (hidden === undefined && links === undefined) return row\n\n  const redacted: TRow = { ...row }\n  if (hidden !== undefined) {\n    redacted.properties = withoutKeys(row.properties, hidden.ids)\n    if (withRedactions) redacted.redactions = hidden.redactions\n  }\n\n  if (links !== undefined) {\n    redacted.links = Object.fromEntries(\n      Object.entries(links).map(([linkId, value]) => [\n        linkId,\n        redactLinkValue(value, clearance, withRedactions),\n      ])\n    )\n  }\n  return redacted\n}\n\nfunction redactLinkValue(\n  value: ExpandedLinkValue,\n  clearance: PropertyClearance,\n  withRedactions: boolean\n): ExpandedLinkValue {\n  if (value === null) return null\n  if (Array.isArray(value)) {\n    return value.map((row) => redactRow(row, clearance, withRedactions))\n  }\n\n  // Array.isArray does not narrow a readonly[] away, so assert the single-object case.\n  return redactRow(value as ExpandedObjectRow, clearance, withRedactions)\n}\n\n/**\n * Omit unreadable properties from an object event, under the same contract as rows. Other events\n * carry no markable value: link properties and telemetry properties cannot be marked.\n */\nexport function redactDomainEvent(\n  event: StoredDomainEvent,\n  clearance: PropertyClearance\n): StoredDomainEvent {\n  if (event.topic !== \"objects\") return event\n\n  const hidden = clearance.hiddenProperties(event.payload.objectTypeId)\n  if (hidden === undefined) return event\n\n  if (event.type === \"object.deleted\") {\n    return {\n      ...event,\n      payload: {\n        ...event.payload,\n        propertyChanges: withoutKeys(event.payload.propertyChanges, hidden.ids),\n        redactions: hidden.redactions,\n      },\n    }\n  }\n\n  return {\n    ...event,\n    payload: {\n      ...event.payload,\n      properties: withoutKeys(event.payload.properties, hidden.ids),\n      propertyChanges: withoutKeys(event.payload.propertyChanges, hidden.ids),\n      redactions: hidden.redactions,\n    },\n  }\n}\n\n/**\n * A copy of the record's own properties without the hidden keys.\n *\n * Spreading the record and deleting the few hidden keys is several times faster than assigning\n * each kept key, and the spread defines every key as an own property, even `__proto__`.\n */\nfunction withoutKeys<TValue>(\n  record: Readonly<Record<string, TValue>>,\n  hidden: ReadonlySet<string>\n): Record<string, TValue> {\n  const kept: Record<string, TValue> = { ...record }\n  for (const key of hidden) delete kept[key]\n  return kept\n}\n",
+    "import { AuthorizationError } from \"../../authorization/errors\"\nimport { type PropertyClearance, type Unreadable, unreadableError } from \"../property-clearance\"\nimport type {\n  ObjectQueryAdmissionState,\n  ObjectQueryPropertyUse,\n  ObjectQuerySemanticAdmission,\n} from \"./validate\"\n\n/**\n * Reject every query use of a property the reader cannot read, except projection.\n *\n * Filtering, ordering, searching, or faceting by a hidden value would reveal it through which\n * objects match and in what order. Projection only shapes the output, which is redacted anyway.\n */\nexport function createClearanceQueryAdmission(\n  clearance: PropertyClearance\n): ObjectQuerySemanticAdmission {\n  // Each state stands for the object types a query has reached so far. A property without an\n  // explicit type is checked against all of them.\n  const reachedTypes = new WeakMap<ObjectQueryAdmissionState, readonly string[]>()\n  const state = (objectTypeIds: readonly string[]): ObjectQueryAdmissionState => {\n    const created = Object.freeze({})\n    reachedTypes.set(created, Object.freeze([...objectTypeIds]))\n    return created\n  }\n\n  const reached = (input: ObjectQueryAdmissionState): readonly string[] => {\n    const objectTypeIds = reachedTypes.get(input)\n    if (!objectTypeIds) {\n      throw new Error(\"[Sixb] Clearance query admission received a state it did not create.\")\n    }\n    return objectTypeIds\n  }\n\n  const empty = state([])\n\n  const admission: ObjectQuerySemanticAdmission = {\n    empty: () => empty,\n    // An object type or link the reader cannot read is denied like one it has no view grant for.\n    source: (input) => ({\n      state: state(input.result.objectTypeIds),\n      ...denied(unreadableTypeAmong(clearance, input.result.objectTypeIds)),\n    }),\n    edge: (input) => {\n      // A link is keyed by its source type: the reached types going out, the result coming in.\n      const sourceTypeIds =\n        input.direction === \"outgoing\"\n          ? reached(input.state)\n          : [\n              ...input.result.objectTypeIds,\n              ...(input.sourceObjectTypeId ? [input.sourceObjectTypeId] : []),\n            ]\n\n      const link = sourceTypeIds\n        .map((objectTypeId) => clearance.unreadableLink(objectTypeId, input.linkId))\n        .find((unreadable) => unreadable !== undefined)\n\n      return {\n        state: state(input.result.objectTypeIds),\n        ...denied(link ?? unreadableTypeAmong(clearance, input.result.objectTypeIds)),\n      }\n    },\n    // A difference only returns objects of its first input.\n    set: (input) =>\n      input.op === \"subtract\"\n        ? (input.states[0] ?? empty)\n        : state([...new Set(input.states.flatMap(reached))]),\n    property: (input) => {\n      if (input.use === \"project\") return undefined\n\n      const objectTypeIds =\n        input.objectTypeId === undefined ? reached(input.state) : [input.objectTypeId]\n      for (const objectTypeId of objectTypeIds) {\n        const marking = clearance.missingMarking(objectTypeId, input.propertyId)\n        if (marking === undefined) continue\n        return new AuthorizationError(\n          `clearance:marking:${marking}`,\n          `[Sixb] Cannot ${PROPERTY_USE_VERBS[input.use]} '${objectTypeId}.${input.propertyId}' at '${input.path}': it requires clearance for marking '${marking}'.`\n        )\n      }\n\n      return undefined\n    },\n  }\n\n  return Object.freeze(admission)\n}\n\nfunction unreadableTypeAmong(\n  clearance: PropertyClearance,\n  objectTypeIds: readonly string[]\n): Unreadable | undefined {\n  for (const objectTypeId of objectTypeIds) {\n    const unreadable = clearance.unreadableType(objectTypeId)\n    if (unreadable) return unreadable\n  }\n  return undefined\n}\n\nfunction denied(unreadable: Unreadable | undefined): { readonly denial?: Error } {\n  return unreadable ? { denial: unreadableError(unreadable) } : {}\n}\n\nconst PROPERTY_USE_VERBS: Readonly<Record<ObjectQueryPropertyUse, string>> = {\n  filter: \"filter by\",\n  text: \"search\",\n  vector: \"run a vector search over\",\n  sort: \"sort by\",\n  project: \"project\",\n  \"expand.orderBy\": \"order expanded objects by\",\n  facet: \"facet by\",\n}\n",
+    "import type { OntologyRegistry } from \"../../ontology\"\nimport { type PropertyClearance, unreadableError } from \"../property-clearance\"\nimport type { ObjectQuery } from \"./ir\"\nimport { type ExecuteObjectQueryLinksInput, preflightObjectQueryLinks } from \"./links\"\n\n/**\n * Refuse a link query that could return a link, or an endpoint, the reader cannot read.\n *\n * A link query returns every link incident to the objects it selects, a page at a time. The page\n * cannot be filtered afterward without breaking its cursor, so what the reader cannot read is\n * refused before the page is read, from the definitions: a link that is unreadable, or that leads\n * to an unreadable object type, whether or not such a link exists.\n */\nexport function assertLinkQueryReadable(input: {\n  readonly ontology: OntologyRegistry\n  readonly clearance: PropertyClearance\n  readonly query: ObjectQuery\n  readonly request: Omit<ExecuteObjectQueryLinksInput, \"query\">\n  /** Whether grants alone let the reader view the type: storage already leaves out the others. */\n  readonly viewableByGrants: (objectTypeId: string) => boolean\n}): void {\n  const { ontology, clearance } = input\n  const { types, links } = clearance.unreadable()\n  if (types.size === 0 && links.length === 0) return\n\n  const preflight = preflightObjectQueryLinks(\n    { ...input.request, query: input.query },\n    { ontology }\n  )\n\n  const selected = preflight.validated.result.objectTypeIds\n  const outgoing = preflight.direction !== \"incoming\"\n  const incoming = preflight.direction !== \"outgoing\"\n\n  const named = (linkId: string) => preflight.linkId === undefined || preflight.linkId === linkId\n  const targets = (expected: string | readonly string[], objectTypeId: string) =>\n    (typeof expected === \"string\" ? [expected] : expected).some((target) =>\n      ontology.isValidLinkTarget(target, objectTypeId)\n    )\n\n  for (const link of links) {\n    if (!named(link.linkId)) continue\n    if (\n      (outgoing && selected.includes(link.objectTypeId)) ||\n      (incoming && selected.some((id) => targets(link.targetObjectTypeId, id)))\n    ) {\n      throw unreadableError(link)\n    }\n  }\n\n  const sealed = [...types].filter(([id]) => input.viewableByGrants(id))\n  if (sealed.length === 0) return\n\n  for (const objectType of ontology.listObjectTypes()) {\n    for (const link of objectType.links) {\n      if (!named(link.id)) continue\n      if (outgoing && selected.includes(objectType.id)) {\n        const other = sealed.find(([id]) => targets(link.targetObjectTypeId, id))\n        if (other) throw unreadableError(other[1])\n      }\n\n      const source = types.get(objectType.id)\n      if (\n        incoming &&\n        source &&\n        input.viewableByGrants(objectType.id) &&\n        selected.some((id) => targets(link.targetObjectTypeId, id))\n      ) {\n        throw unreadableError(source)\n      }\n    }\n  }\n}\n",
+    "const MAX_DELEGATED_TELEMETRY_HISTORY_SERIES = 100\nconst MAX_DELEGATED_TELEMETRY_HISTORY_POINTS = 10_000\nconst DEFAULT_DELEGATED_TELEMETRY_HISTORY_LIMIT_PER_SERIES = 100\n\nexport interface TelemetryHistoryReadWorkloadInput {\n  readonly seriesCount: number\n  readonly limitPerSeries?: number\n}\n\nexport interface TelemetryHistoryReadAdmission {\n  readonly limitPerSeries?: number\n  readonly maxPointOccurrences?: number\n}\n\ntype TelemetryHistoryWorkloadMetric = \"series\" | \"points\"\n\nclass TelemetryHistoryWorkloadExceededError extends Error {\n  readonly name = \"TelemetryHistoryWorkloadExceededError\"\n  readonly code = \"telemetry_history_workload_exceeded\"\n\n  constructor(\n    readonly metric: TelemetryHistoryWorkloadMetric,\n    readonly limit: number\n  ) {\n    super(`[Sixb] Delegated telemetry history exceeded its ${metric} limit (${limit}).`)\n  }\n}\n\n/** Resolve one history request without exposing the authority that selected its policy. */\nexport function admitTelemetryHistoryReadWorkload(\n  input: TelemetryHistoryReadWorkloadInput,\n  delegated: boolean\n): TelemetryHistoryReadAdmission {\n  const seriesCount = input.seriesCount\n  const limitPerSeries = input.limitPerSeries\n  if (!Number.isSafeInteger(seriesCount) || seriesCount < 0) {\n    throw new Error(\"[Sixb] Telemetry history series must have a non-negative safe integer length.\")\n  }\n  if (\n    limitPerSeries !== undefined &&\n    (!Number.isSafeInteger(limitPerSeries) || limitPerSeries < 0)\n  ) {\n    throw new Error(\"[Sixb] Telemetry history limit must be a non-negative safe integer.\")\n  }\n\n  if (!delegated) {\n    const admission: TelemetryHistoryReadAdmission =\n      limitPerSeries === undefined ? {} : { limitPerSeries }\n    return Object.freeze(admission)\n  }\n  if (seriesCount > MAX_DELEGATED_TELEMETRY_HISTORY_SERIES) {\n    throw new TelemetryHistoryWorkloadExceededError(\n      \"series\",\n      MAX_DELEGATED_TELEMETRY_HISTORY_SERIES\n    )\n  }\n  if (seriesCount === 0) {\n    return Object.freeze({\n      ...(limitPerSeries === undefined ? {} : { limitPerSeries }),\n      maxPointOccurrences: MAX_DELEGATED_TELEMETRY_HISTORY_POINTS,\n    })\n  }\n\n  const maxLimitPerSeries = Math.floor(MAX_DELEGATED_TELEMETRY_HISTORY_POINTS / seriesCount)\n  const effectiveLimitPerSeries =\n    limitPerSeries ??\n    Math.min(DEFAULT_DELEGATED_TELEMETRY_HISTORY_LIMIT_PER_SERIES, maxLimitPerSeries)\n  if (effectiveLimitPerSeries > maxLimitPerSeries) {\n    throw new TelemetryHistoryWorkloadExceededError(\n      \"points\",\n      MAX_DELEGATED_TELEMETRY_HISTORY_POINTS\n    )\n  }\n\n  return Object.freeze({\n    limitPerSeries: effectiveLimitPerSeries,\n    maxPointOccurrences: MAX_DELEGATED_TELEMETRY_HISTORY_POINTS,\n  })\n}\n",
+    "import {\n  formatUnknownObjectTypeMessage,\n  OntologyNotFoundError,\n  OntologyValidationError,\n} from \"../ontology/errors\"\nimport type { OntologyDefinitionCatalog } from \"../ontology/registry\"\nimport type { ObjectTypeWithPropertyTokens } from \"../ontology/tokens\"\nimport { createLinkTokenMap, createPropertyTokenMap } from \"../ontology/tokens\"\nimport type {\n  ObjectLink,\n  ObjectType,\n  ObjectTypeSearchMetadata,\n  Property,\n  PropertyQueryMetadata,\n  Schema,\n  ValueType,\n} from \"../ontology/types\"\nimport { snapshotVectorProfiles } from \"../ontology/vector-profiles\"\nimport type { CompiledSelectedObjectReadScope } from \"../storage/objects/types\"\n\n/** Public ontology operations that may cross an execution-bound authorization boundary. */\nexport type AuthorizedOntologyView = Pick<\n  OntologyDefinitionCatalog,\n  | \"listObjectTypes\"\n  | \"getObjectTypeById\"\n  | \"resolveObjectType\"\n  | \"getValueTypesById\"\n  | \"getPrimaryPropertyId\"\n  | \"listSubTypes\"\n  | \"isValidLinkTarget\"\n>\n\nexport type AuthorizedOntologySelection =\n  | { readonly kind: \"all\" }\n  | { readonly kind: \"types\"; readonly objectTypeIds: readonly string[] }\n  | { readonly kind: \"selected\"; readonly scope: CompiledSelectedObjectReadScope }\n\ninterface LinkSelection {\n  readonly targetObjectTypeIds: Set<string>\n  readonly propertyIds: Set<string>\n}\n\ninterface SelectedSchema {\n  readonly propertyIdsByObjectType: ReadonlyMap<string, ReadonlySet<string>>\n  readonly linksBySourceType: ReadonlyMap<string, ReadonlyMap<string, LinkSelection>>\n}\n\n/**\n * Project inert ontology metadata from one already-captured authority.\n *\n * Query validation intentionally keeps using the complete internal registry. This view is only\n * the discovery surface returned to application code and HTTP serializers.\n */\nexport function createAuthorizedOntologyView(input: {\n  readonly ontology: OntologyDefinitionCatalog\n  readonly selection: AuthorizedOntologySelection\n  readonly assertOutputWithinLimit?: (value: unknown) => void\n}): AuthorizedOntologyView {\n  const allObjectTypes = input.ontology.listObjectTypes()\n  const registeredObjectTypeIds = new Set(allObjectTypes.map((objectType) => objectType.id))\n  const requestedObjectTypeIds = selectedObjectTypeIds(input.selection, allObjectTypes)\n  const visibleObjectTypeIds = new Set(\n    [...requestedObjectTypeIds].filter((objectTypeId) => registeredObjectTypeIds.has(objectTypeId))\n  )\n  const selectedSchema =\n    input.selection.kind === \"selected\" ? collectSelectedSchema(input.selection.scope) : undefined\n  const projectedObjectTypes: ObjectTypeWithPropertyTokens[] = []\n\n  for (const objectType of allObjectTypes) {\n    if (!visibleObjectTypeIds.has(objectType.id)) continue\n    const propertyIds =\n      selectedSchema?.propertyIdsByObjectType.get(objectType.id) ??\n      new Set(objectType.properties.map((property) => property.id))\n    const links = selectedSchema\n      ? (selectedSchema.linksBySourceType.get(objectType.id) ?? new Map())\n      : input.selection.kind === \"all\"\n        ? allDeclaredLinks(objectType)\n        : allVisibleLinks(input.ontology, objectType, visibleObjectTypeIds)\n    projectedObjectTypes.push(\n      projectObjectType({\n        objectType,\n        propertyIds,\n        links,\n        visibleObjectTypeIds,\n        ontology: input.ontology,\n        targetMode:\n          input.selection.kind === \"all\"\n            ? \"original\"\n            : input.selection.kind === \"types\"\n              ? \"principal\"\n              : \"exact\",\n        exposeContracts: input.selection.kind !== \"selected\",\n      })\n    )\n  }\n\n  const objectTypes = projectedObjectTypes\n  const objectTypesById = new Map(objectTypes.map((objectType) => [objectType.id, objectType]))\n  const valueTypesById =\n    input.selection.kind === \"selected\"\n      ? collectVisibleValueTypes(input.ontology.getValueTypesById(), objectTypes)\n      : snapshotAllValueTypes(input.ontology.getValueTypesById())\n  const release = <T>(value: T, budgetValue: unknown = value): T => {\n    input.assertOutputWithinLimit?.(budgetValue)\n    return value\n  }\n  const cloneObjectType = (objectType: ObjectTypeWithPropertyTokens) => structuredClone(objectType)\n  const cloneValueTypes = () =>\n    new Map(\n      [...valueTypesById].map(([valueTypeId, valueType]) => [\n        valueTypeId,\n        structuredClone(valueType),\n      ])\n    )\n\n  return Object.freeze({\n    listObjectTypes: () => release(objectTypes.map(cloneObjectType)),\n    getObjectTypeById: (objectTypeId: string) => {\n      const objectType = objectTypesById.get(objectTypeId)\n      return release(objectType ? cloneObjectType(objectType) : null)\n    },\n    resolveObjectType: (objectTypeId: string) => {\n      const objectType = objectTypesById.get(objectTypeId)\n      return objectType ? release(cloneObjectType(objectType)) : unknownObjectType(objectTypeId)\n    },\n    getValueTypesById: () => {\n      const valueTypes = cloneValueTypes()\n      return release(valueTypes, [...valueTypes.entries()])\n    },\n    getPrimaryPropertyId: (objectTypeId: string) => {\n      const objectType = objectTypesById.get(objectTypeId)\n      if (!objectType) return unknownObjectType(objectTypeId)\n      const primary = objectType.properties.find((property) => property.primary)\n      if (!primary) {\n        throw new OntologyValidationError(\n          `[Sixb] Object type '${objectTypeId}' does not expose its primary property in this execution scope.`\n        )\n      }\n      return release(primary.id)\n    },\n    listSubTypes: (objectTypeId: string) => {\n      const subTypes = visibleObjectTypeIds.has(objectTypeId)\n        ? input.ontology\n            .listSubTypes(objectTypeId)\n            .filter((subTypeId) => visibleObjectTypeIds.has(subTypeId))\n        : []\n      return release(subTypes)\n    },\n    isValidLinkTarget: (expected: string | string[], actual: string) => {\n      if (input.selection.kind === \"all\") {\n        return release(input.ontology.isValidLinkTarget(expected, actual))\n      }\n      if (!visibleObjectTypeIds.has(actual)) return release(false)\n      const expectedTypes = Array.isArray(expected) ? expected : [expected]\n      if (input.selection.kind === \"selected\") {\n        return release(\n          expectedTypes.some((expectedType) => expectedType === \"*\" || expectedType === actual)\n        )\n      }\n      return release(\n        expectedTypes.some(\n          (expectedType) =>\n            expectedType === \"*\" ||\n            (visibleObjectTypeIds.has(expectedType) &&\n              input.ontology.isValidLinkTarget(expectedType, actual))\n        )\n      )\n    },\n  })\n}\n\nfunction selectedObjectTypeIds(\n  selection: AuthorizedOntologySelection,\n  allObjectTypes: readonly ObjectTypeWithPropertyTokens[]\n): ReadonlySet<string> {\n  switch (selection.kind) {\n    case \"all\":\n      return new Set(allObjectTypes.map((objectType) => objectType.id))\n    case \"types\":\n      return new Set(selection.objectTypeIds)\n    case \"selected\":\n      return new Set(selection.scope.objects.map((object) => object.objectTypeId))\n  }\n}\n\nfunction collectSelectedSchema(scope: CompiledSelectedObjectReadScope): SelectedSchema {\n  const propertyIdsByObjectType = new Map<string, Set<string>>()\n  for (const object of scope.objects) {\n    const properties = propertyIdsByObjectType.get(object.objectTypeId) ?? new Set<string>()\n    for (const propertyId of object.propertyIds) properties.add(propertyId)\n    propertyIdsByObjectType.set(object.objectTypeId, properties)\n  }\n\n  const linksBySourceType = new Map<string, Map<string, LinkSelection>>()\n  for (const step of scope.steps) {\n    const links = linksBySourceType.get(step.sourceObjectTypeId) ?? new Map()\n    const selected = links.get(step.linkId) ?? {\n      targetObjectTypeIds: new Set<string>(),\n      propertyIds: new Set<string>(),\n    }\n    selected.targetObjectTypeIds.add(step.targetObjectTypeId)\n    for (const propertyId of step.propertyIds) selected.propertyIds.add(propertyId)\n    links.set(step.linkId, selected)\n    linksBySourceType.set(step.sourceObjectTypeId, links)\n  }\n\n  return { propertyIdsByObjectType, linksBySourceType }\n}\n\nfunction allDeclaredLinks(\n  objectType: ObjectTypeWithPropertyTokens\n): ReadonlyMap<string, LinkSelection> {\n  return new Map(\n    objectType.links.map((link) => [\n      link.id,\n      {\n        targetObjectTypeIds: new Set(\n          typeof link.targetObjectTypeId === \"string\"\n            ? [link.targetObjectTypeId]\n            : link.targetObjectTypeId\n        ),\n        propertyIds: new Set(link.properties?.map((property) => property.id) ?? []),\n      },\n    ])\n  )\n}\n\nfunction allVisibleLinks(\n  ontology: OntologyDefinitionCatalog,\n  objectType: ObjectTypeWithPropertyTokens,\n  visibleObjectTypeIds: ReadonlySet<string>\n): ReadonlyMap<string, LinkSelection> {\n  const links = new Map<string, LinkSelection>()\n  for (const link of objectType.links) {\n    const targetObjectTypeIds = new Set(\n      [...visibleObjectTypeIds].filter((targetObjectTypeId) =>\n        ontology.isValidLinkTarget(link.targetObjectTypeId, targetObjectTypeId)\n      )\n    )\n    if (targetObjectTypeIds.size === 0) continue\n    links.set(link.id, {\n      targetObjectTypeIds,\n      propertyIds: new Set(link.properties?.map((property) => property.id) ?? []),\n    })\n  }\n  return links\n}\n\nfunction projectObjectType(input: {\n  readonly ontology: OntologyDefinitionCatalog\n  readonly objectType: ObjectTypeWithPropertyTokens\n  readonly propertyIds: ReadonlySet<string>\n  readonly links: ReadonlyMap<string, LinkSelection>\n  readonly visibleObjectTypeIds: ReadonlySet<string>\n  readonly targetMode: \"original\" | \"principal\" | \"exact\"\n  readonly exposeContracts: boolean\n}): ObjectTypeWithPropertyTokens {\n  const properties = input.objectType.properties\n    .filter((property) => input.propertyIds.has(property.id))\n    .map(snapshotProperty)\n  const visiblePropertyIds = new Set(properties.map((property) => property.id))\n  const links = input.objectType.links.flatMap((link): ObjectLink[] => {\n    const selected = input.links.get(link.id)\n    if (!selected) return []\n    if (input.targetMode === \"original\") {\n      return [snapshotLink(link, snapshotLinkTarget(link.targetObjectTypeId), selected.propertyIds)]\n    }\n    const targetObjectTypeIds = new Set(\n      [...selected.targetObjectTypeIds].filter(\n        (targetObjectTypeId) =>\n          input.visibleObjectTypeIds.has(targetObjectTypeId) &&\n          input.ontology.isValidLinkTarget(link.targetObjectTypeId, targetObjectTypeId)\n      )\n    )\n    if (targetObjectTypeIds.size === 0) return []\n    const target =\n      input.targetMode === \"principal\"\n        ? principalLinkTargets(link, targetObjectTypeIds, input.visibleObjectTypeIds)\n        : exactLinkTargets(targetObjectTypeIds)\n    return [snapshotLink(link, target, selected.propertyIds, { omitEmptyProperties: true })]\n  })\n\n  // Whitelist top-level metadata so future cross-ontology fields remain closed until reviewed.\n  const projected: ObjectType = {\n    id: input.objectType.id,\n    name: input.objectType.name,\n    description: input.objectType.description,\n    quantityKind: input.objectType.quantityKind,\n    seeAlso: input.objectType.seeAlso ? [...input.objectType.seeAlso] : undefined,\n    extends:\n      input.objectType.extends && input.visibleObjectTypeIds.has(input.objectType.extends)\n        ? input.objectType.extends\n        : undefined,\n    parents: projectOptionalIds(\n      input.objectType.parents,\n      input.visibleObjectTypeIds,\n      input.targetMode === \"original\"\n    ),\n    implements:\n      input.exposeContracts && input.objectType.implements\n        ? [...input.objectType.implements]\n        : undefined,\n    properties,\n    links,\n    search: projectSearch(input.objectType.search, visiblePropertyIds, {\n      preserveEmpty: input.targetMode !== \"exact\",\n    }),\n  }\n  const withTokens = {\n    ...projected,\n    p: createPropertyTokenMap(projected),\n    l: createLinkTokenMap(projected),\n  }\n  return deepFreeze(withTokens) as ObjectTypeWithPropertyTokens\n}\n\nfunction principalLinkTargets(\n  link: ObjectLink,\n  allowedTargetObjectTypeIds: ReadonlySet<string>,\n  visibleObjectTypeIds: ReadonlySet<string>\n): string | string[] {\n  if (link.targetObjectTypeId === \"*\") return exactLinkTargets(allowedTargetObjectTypeIds)\n  const declared = Array.isArray(link.targetObjectTypeId)\n    ? link.targetObjectTypeId\n    : [link.targetObjectTypeId]\n  if (declared.every((objectTypeId) => visibleObjectTypeIds.has(objectTypeId))) {\n    return snapshotLinkTarget(link.targetObjectTypeId)\n  }\n  return exactLinkTargets(allowedTargetObjectTypeIds)\n}\n\nfunction exactLinkTargets(targetObjectTypeIds: ReadonlySet<string>): string | string[] {\n  const targets = [...targetObjectTypeIds].sort()\n  return targets.length === 1 ? targets[0]! : targets\n}\n\nfunction projectOptionalIds(\n  ids: readonly string[] | undefined,\n  visibleObjectTypeIds: ReadonlySet<string>,\n  preserveOriginal: boolean\n): string[] | undefined {\n  if (!ids) return undefined\n  if (preserveOriginal) return [...ids]\n  const visible = ids.filter((id) => visibleObjectTypeIds.has(id))\n  return visible.length > 0 ? visible : undefined\n}\n\nfunction snapshotLink(\n  link: ObjectLink,\n  targetObjectTypeId: string | string[],\n  propertyIds: ReadonlySet<string>,\n  options: { readonly omitEmptyProperties?: boolean } = {}\n): ObjectLink {\n  const properties = link.properties\n    ?.filter((property) => propertyIds.has(property.id))\n    .map(snapshotProperty)\n  return {\n    id: link.id,\n    name: link.name,\n    description: link.description,\n    targetObjectTypeId,\n    cardinality: link.cardinality,\n    properties: options.omitEmptyProperties && properties?.length === 0 ? undefined : properties,\n  }\n}\n\nfunction snapshotLinkTarget(target: string | readonly string[]): string | string[] {\n  return typeof target === \"string\" ? target : [...target]\n}\n\nfunction snapshotProperty(property: Property): Property {\n  return {\n    id: property.id,\n    name: property.name,\n    schema: snapshotSchema(property.schema),\n    description: property.description,\n    required: property.required,\n    nullable: property.nullable,\n    primary: property.primary,\n    mode: property.mode,\n    semanticType: property.semanticType,\n    query: snapshotPropertyQuery(property.query),\n  }\n}\n\nfunction snapshotPropertyQuery(\n  query: PropertyQueryMetadata | undefined\n): PropertyQueryMetadata | undefined {\n  if (!query) return undefined\n  return {\n    searchable: query.searchable,\n    filterable: query.filterable,\n    sortable: query.sortable,\n    text: query.text,\n    exact: query.exact,\n    facet: query.facet,\n    weight: query.weight,\n  }\n}\n\nfunction projectSearch(\n  search: ObjectTypeSearchMetadata | undefined,\n  visiblePropertyIds: ReadonlySet<string>,\n  options: { readonly preserveEmpty: boolean }\n): ObjectTypeSearchMetadata | undefined {\n  if (!search) return undefined\n  const title = search.title && visiblePropertyIds.has(search.title) ? search.title : undefined\n  const selectedDefaultText = search.defaultText?.filter((propertyId) =>\n    visiblePropertyIds.has(propertyId)\n  )\n  const selectedExact = search.exact?.filter((propertyId) => visiblePropertyIds.has(propertyId))\n  const defaultText =\n    options.preserveEmpty || selectedDefaultText?.length ? selectedDefaultText : undefined\n  const exact = options.preserveEmpty || selectedExact?.length ? selectedExact : undefined\n  const vectors =\n    search.vectors === undefined\n      ? undefined\n      : snapshotVectorProfiles(\n          Object.fromEntries(\n            Object.entries(search.vectors).filter(([, profile]) =>\n              profile.source.every((id) => visiblePropertyIds.has(id))\n            )\n          )\n        )\n  const projected: ObjectTypeSearchMetadata = {\n    ...(vectors === undefined || Object.keys(vectors).length === 0 ? {} : { vectors }),\n    ...(title === undefined ? {} : { title }),\n    ...(defaultText === undefined ? {} : { defaultText }),\n    ...(exact === undefined ? {} : { exact }),\n  }\n  return Object.keys(projected).length > 0 || options.preserveEmpty ? projected : undefined\n}\n\nfunction snapshotAllValueTypes(\n  registered: ReadonlyMap<string, ValueType>\n): ReadonlyMap<string, ValueType> {\n  return new Map(\n    [...registered.values()].map((valueType) => {\n      const snapshot = snapshotValueType(valueType)\n      return [snapshot.id, snapshot] as const\n    })\n  )\n}\n\nfunction collectVisibleValueTypes(\n  registered: ReadonlyMap<string, ValueType>,\n  objectTypes: readonly ObjectTypeWithPropertyTokens[]\n): ReadonlyMap<string, ValueType> {\n  const referencedIds = new Set<string>()\n  const pendingSchemas: Schema[] = []\n  const visitedSchemas = new Set<object>()\n  for (const objectType of objectTypes) {\n    for (const property of objectType.properties) pendingSchemas.push(property.schema)\n    for (const link of objectType.links) {\n      for (const property of link.properties ?? []) pendingSchemas.push(property.schema)\n    }\n  }\n\n  while (pendingSchemas.length > 0) {\n    const schema = pendingSchemas.pop()!\n    if (typeof schema === \"string\" || visitedSchemas.has(schema)) continue\n    visitedSchemas.add(schema)\n    if (schema.type === \"valueTypeRef\") {\n      if (!referencedIds.has(schema.valueTypeId)) {\n        referencedIds.add(schema.valueTypeId)\n        const valueType = registered.get(schema.valueTypeId)\n        if (valueType) pendingSchemas.push(valueType.schema)\n      }\n      if (schema._resolved) pendingSchemas.push(schema._resolved)\n    } else if (schema.type === \"object\") {\n      for (const field of Object.values(schema.properties)) pendingSchemas.push(field.schema)\n    } else if (schema.type === \"array\") {\n      pendingSchemas.push(schema.items)\n    } else if (schema.type === \"map\") {\n      pendingSchemas.push(schema.valueSchema)\n    }\n  }\n\n  return new Map(\n    [...referencedIds]\n      .map((valueTypeId) => registered.get(valueTypeId))\n      .filter((valueType): valueType is ValueType => valueType !== undefined)\n      .map((valueType) => {\n        const snapshot = snapshotValueType(valueType)\n        return [snapshot.id, snapshot] as const\n      })\n  )\n}\n\nfunction snapshotValueType(valueType: ValueType): ValueType {\n  return deepFreeze({\n    id: valueType.id,\n    name: valueType.name,\n    description: valueType.description,\n    schema: snapshotSchema(valueType.schema),\n    semanticType: valueType.semanticType,\n  })\n}\n\nfunction snapshotSchema(schema: Schema): Schema {\n  return deepFreeze(structuredClone(schema))\n}\n\nfunction deepFreeze<T>(value: T, seen: Set<object> = new Set()): T {\n  if (typeof value !== \"object\" || value === null || seen.has(value)) return value\n  seen.add(value)\n  for (const key of Reflect.ownKeys(value)) {\n    const descriptor = Object.getOwnPropertyDescriptor(value, key)\n    if (descriptor && \"value\" in descriptor) deepFreeze(descriptor.value, seen)\n  }\n  return Object.freeze(value)\n}\n\nfunction unknownObjectType(objectTypeId: string): never {\n  throw new OntologyNotFoundError(formatUnknownObjectTypeMessage(objectTypeId))\n}\n",
+    "import { isAllowed } from \"../authorization\"\nimport {\n  type AuthorizedOntologySelection,\n  type AuthorizedOntologyView,\n  createAuthorizedOntologyView,\n} from \"../objects/authorized-ontology-view\"\nimport type { OntologyRegistry } from \"../ontology\"\nimport { assertObjectReadOutputWithinLimit } from \"../storage\"\nimport type { ResolvedExecutionAuthority } from \"./object-reader-security\"\n\n/** The ontology a reader resolves against, and the part of it its authority may describe. */\nexport class ObjectReaderOntology {\n  readonly registry: OntologyRegistry\n  readonly #authority: ResolvedExecutionAuthority\n  #view?: AuthorizedOntologyView\n\n  constructor(registry: OntologyRegistry, authority: ResolvedExecutionAuthority) {\n    this.registry = registry\n    this.#authority = authority\n    Object.freeze(this)\n  }\n\n  /** Inert metadata for the types the authority may view, built on first use. */\n  view(): AuthorizedOntologyView {\n    const authority = this.#authority\n    this.#view ??= createAuthorizedOntologyView({\n      ontology: this.registry,\n      selection: selectionForAuthority(authority, this.registry),\n      ...(authority.type === \"delegated\"\n        ? {\n            assertOutputWithinLimit: (value: unknown) =>\n              assertObjectReadOutputWithinLimit(value, authority.objectRead.limits),\n          }\n        : {}),\n    })\n    return this.#view\n  }\n}\n\nfunction selectionForAuthority(\n  authority: ResolvedExecutionAuthority,\n  ontology: OntologyRegistry\n): AuthorizedOntologySelection {\n  switch (authority.type) {\n    case \"unrestricted\":\n      return { kind: \"all\" }\n    case \"principal\":\n      return {\n        kind: \"types\",\n        objectTypeIds: ontology\n          .listObjectTypes()\n          .filter((objectType) =>\n            isAllowed(authority.context, {\n              kind: \"object.view\",\n              objectTypeId: objectType.id,\n            })\n          )\n          .map((objectType) => objectType.id),\n      }\n    case \"delegated\":\n      return { kind: \"selected\", scope: authority.objectRead.scope }\n  }\n}\n",
+    "import { AuthorizationError } from \"../../authorization/errors\"\nimport type {\n  CompiledObjectReadObjectSelection,\n  CompiledObjectReadStep,\n  CompiledSelectedObjectReadScope,\n} from \"../../storage/objects/types\"\nimport type {\n  ObjectQueryAdmissionState,\n  ObjectQueryAdmissionTransition,\n  ObjectQueryEdgeUse,\n  ObjectQueryPropertyUse,\n  ObjectQuerySemanticAdmission,\n} from \"./validate\"\n\nconst selectedStateBrand = Symbol(\"sixb.selected-object-query-admission-state\")\n\ninterface SelectedObjectQueryState extends ObjectQueryAdmissionState {\n  readonly [selectedStateBrand]: true\n  readonly selections: readonly CompiledObjectReadObjectSelection[]\n}\n\nexport interface SelectedObjectQueryAdmission extends ObjectQuerySemanticAdmission {\n  /** Terminal hook for property-bearing operations outside the query IR, such as facets. */\n  assertPropertySelected(input: {\n    readonly state: ObjectQueryAdmissionState\n    readonly propertyId: string\n    readonly objectTypeId?: string\n    readonly use: ObjectQueryPropertyUse\n    readonly path: string\n  }): void\n  /** Terminal hook for the physical-link selector that sits outside `queryLinks.query`. */\n  assertIncidentEdgeSelected(input: {\n    readonly state: ObjectQueryAdmissionState\n    readonly linkId?: string\n    readonly direction: \"outgoing\" | \"incoming\" | \"both\"\n    readonly path: string\n  }): void\n}\n\n/**\n * Build an immutable semantic admission over one already-compiled selected reader scope.\n *\n * Object identities remain provider-owned: query admission follows exact path occurrences while\n * the selected storage relation decides which live roots and linked instances exist.\n */\nexport function createSelectedObjectQueryAdmission(\n  scope: CompiledSelectedObjectReadScope\n): SelectedObjectQueryAdmission {\n  const selectionByKey = new Map<string, CompiledObjectReadObjectSelection>()\n  const selectionsByType = new Map<string, CompiledObjectReadObjectSelection[]>()\n  const propertiesBySelection = new Map<string, ReadonlySet<string>>()\n\n  for (const selection of scope.objects) {\n    const key = selectionKey(selection.nodeId, selection.objectTypeId)\n    selectionByKey.set(key, selection)\n    propertiesBySelection.set(key, new Set(selection.propertyIds))\n    const byType = selectionsByType.get(selection.objectTypeId) ?? []\n    byType.push(selection)\n    selectionsByType.set(selection.objectTypeId, byType)\n  }\n\n  const outgoing = indexSteps(scope.steps, \"outgoing\", selectionByKey)\n  const incoming = indexSteps(scope.steps, \"incoming\", selectionByKey)\n  const emptyState = selectedState([])\n\n  const admission: SelectedObjectQueryAdmission = {\n    empty: () => emptyState,\n    source: (input) => {\n      const selections = input.result.objectTypeIds.flatMap(\n        (objectTypeId) => selectionsByType.get(objectTypeId) ?? []\n      )\n      const state = selectedState(selections)\n\n      if (input.kind === \"refs\") {\n        const missingType = [...new Set(input.refs?.map((ref) => ref.objectTypeId) ?? [])]\n          .sort()\n          .find((objectTypeId) => !selectionsByType.has(objectTypeId))\n        if (missingType) {\n          return denied(\n            state,\n            new AuthorizationError(\n              `view:object:${missingType}`,\n              `[Sixb] Delegated query cannot reference object type '${missingType}' at '${input.path}': the selected object scope does not contain that type.`\n            )\n          )\n        }\n      }\n\n      if (state.selections.length > 0) return { state }\n      const objectTypeId = input.objectTypeId ?? input.result.objectTypeIds[0] ?? \"unknown\"\n      return denied(\n        state,\n        new AuthorizationError(\n          `view:object:${objectTypeId}`,\n          `[Sixb] Delegated query cannot start from object type '${objectTypeId}' at '${input.path}': the selected object scope does not contain that type.`\n        )\n      )\n    },\n    property: (input) =>\n      propertyDenial(\n        asSelectedState(input.state),\n        input.propertyId,\n        input.objectTypeId,\n        input.use,\n        input.path,\n        propertiesBySelection\n      ),\n    edge: (input) => {\n      const state = asSelectedState(input.state)\n      const next = followEdge(\n        state,\n        input.linkId,\n        input.direction,\n        input.sourceObjectTypeId,\n        outgoing,\n        incoming,\n        input.result.objectTypeIds\n      )\n      if (next.selections.length > 0 || state.selections.length === 0) return { state: next }\n      return denied(\n        next,\n        edgeDenial(\n          state,\n          input.linkId,\n          input.direction,\n          input.sourceObjectTypeId,\n          input.use,\n          input.path\n        )\n      )\n    },\n    set: ({ op, states }) => {\n      if (op === \"subtract\") return asSelectedState(states[0] ?? emptyState)\n      return selectedState(states.flatMap((state) => asSelectedState(state).selections))\n    },\n    assertPropertySelected: (input) => {\n      const denial = propertyDenial(\n        asSelectedState(input.state),\n        input.propertyId,\n        input.objectTypeId,\n        input.use,\n        input.path,\n        propertiesBySelection\n      )\n      if (denial) throw denial\n    },\n    assertIncidentEdgeSelected: (input) => {\n      if (input.linkId === undefined) return\n      const state = asSelectedState(input.state)\n      const directions: readonly (\"outgoing\" | \"incoming\")[] =\n        input.direction === \"both\" ? [\"outgoing\", \"incoming\"] : [input.direction]\n      const next = selectedState(\n        directions.flatMap(\n          (direction) =>\n            followEdge(state, input.linkId!, direction, undefined, outgoing, incoming).selections\n        )\n      )\n      if (next.selections.length > 0 || state.selections.length === 0) return\n      throw edgeDenial(state, input.linkId, input.direction, undefined, \"queryLinks\", input.path)\n    },\n  }\n\n  return Object.freeze(admission)\n}\n\nfunction indexSteps(\n  steps: readonly CompiledObjectReadStep[],\n  direction: \"outgoing\" | \"incoming\",\n  selectionByKey: ReadonlyMap<string, CompiledObjectReadObjectSelection>\n): ReadonlyMap<string, readonly CompiledObjectReadObjectSelection[]> {\n  const index = new Map<string, CompiledObjectReadObjectSelection[]>()\n  for (const step of steps) {\n    const fromKey =\n      direction === \"outgoing\"\n        ? selectionKey(step.parentNodeId, step.sourceObjectTypeId)\n        : selectionKey(step.nodeId, step.targetObjectTypeId)\n    const toKey =\n      direction === \"outgoing\"\n        ? selectionKey(step.nodeId, step.targetObjectTypeId)\n        : selectionKey(step.parentNodeId, step.sourceObjectTypeId)\n    const target = selectionByKey.get(toKey)\n    if (!selectionByKey.has(fromKey) || !target) {\n      throw new Error(\"[Sixb] Compiled selected object scope contains an invalid query path step.\")\n    }\n    const key = edgeKey(\n      direction === \"outgoing\" ? step.parentNodeId : step.nodeId,\n      direction === \"outgoing\" ? step.sourceObjectTypeId : step.targetObjectTypeId,\n      step.linkId\n    )\n    const targets = index.get(key) ?? []\n    targets.push(target)\n    index.set(key, targets)\n  }\n  return index\n}\n\nfunction followEdge(\n  state: SelectedObjectQueryState,\n  linkId: string,\n  direction: \"outgoing\" | \"incoming\",\n  sourceObjectTypeId: string | undefined,\n  outgoing: ReadonlyMap<string, readonly CompiledObjectReadObjectSelection[]>,\n  incoming: ReadonlyMap<string, readonly CompiledObjectReadObjectSelection[]>,\n  resultObjectTypeIds?: readonly string[]\n): SelectedObjectQueryState {\n  const index = direction === \"outgoing\" ? outgoing : incoming\n  const resultTypes = resultObjectTypeIds ? new Set(resultObjectTypeIds) : undefined\n  const selections = state.selections.flatMap((selection) => {\n    const candidates = index.get(edgeKey(selection.nodeId, selection.objectTypeId, linkId)) ?? []\n    return candidates.filter(\n      (candidate) =>\n        (resultTypes === undefined || resultTypes.has(candidate.objectTypeId)) &&\n        (direction === \"outgoing\" ||\n          sourceObjectTypeId === undefined ||\n          candidate.objectTypeId === sourceObjectTypeId)\n    )\n  })\n  return selectedState(selections)\n}\n\nfunction propertyDenial(\n  state: SelectedObjectQueryState,\n  propertyId: string,\n  objectTypeId: string | undefined,\n  use: ObjectQueryPropertyUse,\n  path: string,\n  propertiesBySelection: ReadonlyMap<string, ReadonlySet<string>>\n): AuthorizationError | undefined {\n  const candidates = objectTypeId\n    ? state.selections.filter((selection) => selection.objectTypeId === objectTypeId)\n    : state.selections\n  // A selected reader has no rows for result types absent from this provenance. Those empty\n  // branches cannot observe a property and must not make includeSubtypes queries fail closed.\n  if (candidates.length === 0) return undefined\n\n  const missing = candidates.find(\n    (selection) =>\n      !propertiesBySelection\n        .get(selectionKey(selection.nodeId, selection.objectTypeId))\n        ?.has(propertyId)\n  )\n  if (!missing) return undefined\n\n  const objectTypeIds = [...new Set(candidates.map((selection) => selection.objectTypeId))].sort()\n  return new AuthorizationError(\n    `view:object:${objectTypeIds.join(\",\")}:property:${propertyId}`,\n    `[Sixb] Delegated query cannot use property '${propertyId}' for ${use} at '${path}': it is not selected on every matching read-scope path (missing on ${formatSelection(missing)}).`\n  )\n}\n\nfunction edgeDenial(\n  state: SelectedObjectQueryState,\n  linkId: string,\n  direction: \"outgoing\" | \"incoming\" | \"both\",\n  sourceObjectTypeId: string | undefined,\n  use: ObjectQueryEdgeUse,\n  path: string\n): AuthorizationError {\n  const source = sourceObjectTypeId ? `:${sourceObjectTypeId}` : \"\"\n  return new AuthorizationError(\n    `view:link:${direction}${source}:${linkId}`,\n    `[Sixb] Delegated query cannot use ${direction} link '${linkId}' for ${use} from ${formatState(state)} at '${path}': that exact read-scope path is not selected.`\n  )\n}\n\nfunction formatState(state: SelectedObjectQueryState): string {\n  if (state.selections.length === 0) return \"an empty read-scope provenance\"\n  return `read-scope provenance ${state.selections.map(formatSelection).join(\", \")}`\n}\n\nfunction formatSelection(selection: CompiledObjectReadObjectSelection): string {\n  return `'${selection.objectTypeId}'@node ${selection.nodeId}`\n}\n\nfunction selectedState(\n  selections: readonly CompiledObjectReadObjectSelection[]\n): SelectedObjectQueryState {\n  const unique = new Map<string, CompiledObjectReadObjectSelection>()\n  for (const selection of selections) {\n    unique.set(selectionKey(selection.nodeId, selection.objectTypeId), selection)\n  }\n  return Object.freeze({\n    [selectedStateBrand]: true as const,\n    selections: Object.freeze(\n      [...unique.values()].sort(\n        (left, right) =>\n          left.nodeId - right.nodeId || left.objectTypeId.localeCompare(right.objectTypeId)\n      )\n    ),\n  })\n}\n\nfunction asSelectedState(state: ObjectQueryAdmissionState): SelectedObjectQueryState {\n  if ((state as Partial<SelectedObjectQueryState>)[selectedStateBrand] !== true) {\n    throw new Error(\"[Sixb] Object query admission state belongs to another semantic admission.\")\n  }\n  return state as SelectedObjectQueryState\n}\n\nfunction denied(state: SelectedObjectQueryState, denial: Error): ObjectQueryAdmissionTransition {\n  return { state, denial }\n}\n\nfunction selectionKey(nodeId: number, objectTypeId: string): string {\n  return JSON.stringify([nodeId, objectTypeId])\n}\n\nfunction edgeKey(nodeId: number, objectTypeId: string, linkId: string): string {\n  return JSON.stringify([nodeId, objectTypeId, linkId])\n}\n",
+    "import { type PropertyClearance, resolvePropertyClearance } from \"../objects/property-clearance\"\nimport type { OntologyRegistry } from \"../ontology\"\nimport type { AppliedMarkings } from \"../security/applied-markings\"\nimport type { EventOriginRef } from \"../security/applied-markings-contribution\"\nimport type { AppliedMarkingsSnapshot } from \"../security/applied-markings-snapshot\"\n\n/** What one read may not return; `undefined` when it reads everything. */\nexport type Clearance = PropertyClearance | undefined\n\n/**\n * What one authority cannot read: the markings the code declares, and those the dataset versions\n * projections applied add, for an authority they can affect.\n *\n * A reader they cannot affect, trusted code included, gets the code's clearance as a plain value:\n * awaiting it costs one microtask, not a refresh. Otherwise the clearance is resolved for each\n * snapshot, which rarely changes, so the last one is kept.\n */\nexport class ObjectReaderClearance {\n  readonly #ontology: OntologyRegistry\n  /** What the authority cannot read under the code's markings; absent when it reads everything. */\n  readonly #static: Clearance\n  /** The authority's clearances; absent when it is unrestricted. */\n  readonly #clearances?: ReadonlySet<string>\n  /** Present only when applied dataset versions can deny this authority more than the code. */\n  readonly #applied?: AppliedMarkings\n  #lastSnapshot?: AppliedMarkingsSnapshot\n  #lastClearance: Clearance\n\n  constructor(input: {\n    readonly ontology: OntologyRegistry\n    readonly clearances: ReadonlySet<string> | undefined\n    readonly appliedMarkings?: AppliedMarkings\n  }) {\n    this.#ontology = input.ontology\n    this.#clearances = input.clearances\n    this.#static = input.clearances && resolvePropertyClearance(input.ontology, input.clearances)\n\n    if (input.clearances && input.appliedMarkings?.affects(input.clearances)) {\n      this.#applied = input.appliedMarkings\n    }\n\n    Object.freeze(this)\n  }\n\n  /** What the authority cannot read now. */\n  current(): Clearance | Promise<Clearance> {\n    const applied = this.#applied\n    const clearances = this.#clearances\n    if (!applied || !clearances) return this.#static\n\n    return applied.current().then((snapshot) => {\n      if (snapshot !== this.#lastSnapshot) {\n        this.#lastClearance = resolvePropertyClearance(this.#ontology, clearances, snapshot)\n        this.#lastSnapshot = snapshot\n      }\n      return this.#lastClearance\n    })\n  }\n\n  /**\n   * What the authority cannot read in an object event. Reads the event's origin version only for\n   * an authority its markings affect.\n   */\n  forEvent(sources: EventSources): Clearance | Promise<Clearance> {\n    const applied = this.#applied\n    const clearances = this.#clearances\n    if (!applied || !clearances) return this.#static\n\n    return applied\n      .current()\n      .then((snapshot) =>\n        sources.origin ? applied.forEventOrigin(snapshot, sources.origin) : snapshot\n      )\n      .then((snapshot) =>\n        sources.earlier ? applied.forEarlierValues(snapshot, sources.objectTypeId) : snapshot\n      )\n      .then((snapshot) => resolvePropertyClearance(this.#ontology, clearances, snapshot))\n  }\n}\n\n/** Where the values of an object event came from. */\nexport interface EventSources {\n  readonly objectTypeId: string\n  /** The projection that emitted the event, and the version it applied. */\n  readonly origin?: EventOriginRef\n  /**\n   * Whether the event holds values from before it, which came from versions applied earlier: an\n   * update or a deletion, or a record an action or a direct write took of projected values.\n   */\n  readonly earlier: boolean\n}\n",
+    "import { assertAuthorized, isAllowed } from \"../authorization\"\nimport { AuthorizationError } from \"../authorization/errors\"\nimport type { AuthorizationContext } from \"../authorization/types\"\nimport { unreadableError } from \"../objects/property-clearance\"\nimport {\n  createSelectedObjectQueryAdmission,\n  type SelectedObjectQueryAdmission,\n} from \"../objects/query/selected-read-admission\"\nimport type { OntologyRegistry } from \"../ontology\"\nimport type { AppliedMarkings } from \"../security/applied-markings\"\nimport type { CompiledObjectReadStep, ObjectLinkRow } from \"../storage\"\nimport type { resolveExecutionScopeAuthorization } from \"./authorization\"\nimport { type Clearance, ObjectReaderClearance } from \"./object-reader-clearance\"\nimport type { RuntimeAuthorization } from \"./types\"\n\nexport type ResolvedExecutionAuthority = ReturnType<typeof resolveExecutionScopeAuthorization>\n\nexport type RuntimeReadAuthorization = {\n  readonly projectId: string\n  readonly runtimeAuthorization: RuntimeAuthorization\n  readonly authorization?: AuthorizationContext\n}\n\n/** What a delegated authority selected: the object types, links, and queries it may read. */\nexport interface ObjectReaderDelegation {\n  readonly objectTypeIds: ReadonlySet<string>\n  readonly linkDefinitions: ReadonlySet<string>\n  readonly queryAdmission: SelectedObjectQueryAdmission\n}\n\n/**\n * Who reads, and what it may read: the exact execution authority, the selection a delegated one\n * carries, and its clearance. It decides whether an object type or a link is viewable.\n */\nexport class ObjectReaderSecurity {\n  /** The registered authority the reader is bound to. */\n  readonly authorization: RuntimeAuthorization\n  readonly authority: ResolvedExecutionAuthority\n  /** The authority as generic authorization checks take it. */\n  readonly runtime: RuntimeReadAuthorization\n  /** Present for delegated authority only. */\n  readonly delegation?: ObjectReaderDelegation\n  readonly clearance: ObjectReaderClearance\n\n  constructor(input: {\n    readonly authorization: RuntimeAuthorization\n    readonly authority: ResolvedExecutionAuthority\n    readonly projectId: string\n    readonly ontology: OntologyRegistry\n    readonly appliedMarkings?: AppliedMarkings\n  }) {\n    const authority = input.authority\n    this.authorization = input.authorization\n    this.authority = authority\n    this.runtime = Object.freeze({\n      projectId: input.projectId,\n      runtimeAuthorization: input.authorization,\n      ...(authority.type === \"principal\" ? { authorization: authority.context } : {}),\n    })\n\n    if (authority.type === \"delegated\") {\n      const scope = authority.objectRead.scope\n      this.delegation = Object.freeze({\n        objectTypeIds: new Set(scope.objects.map((object) => object.objectTypeId)),\n        linkDefinitions: new Set(scope.steps.map(delegatedLinkDefinitionKey)),\n        queryAdmission: createSelectedObjectQueryAdmission(scope),\n      })\n    }\n\n    this.clearance = new ObjectReaderClearance({\n      ontology: input.ontology,\n      clearances: clearancesForAuthority(authority),\n      ...(input.appliedMarkings === undefined ? {} : { appliedMarkings: input.appliedMarkings }),\n    })\n\n    Object.freeze(this)\n  }\n\n  assertObjectTypesViewable(objectTypeIds: readonly string[], clearance: Clearance): void {\n    if (this.delegation) {\n      for (const objectTypeId of new Set(objectTypeIds)) {\n        if (this.delegation.objectTypeIds.has(objectTypeId)) continue\n        throw new AuthorizationError(\n          `delegated:object.view:${objectTypeId}`,\n          `[Sixb] Delegated authorization does not select object type '${objectTypeId}'.`\n        )\n      }\n    } else {\n      for (const objectTypeId of new Set(objectTypeIds)) {\n        assertAuthorized(this.runtime, { kind: \"object.view\", objectTypeId })\n      }\n    }\n\n    if (!clearance) return\n\n    for (const objectTypeId of new Set(objectTypeIds)) {\n      const unreadable = clearance.unreadableType(objectTypeId)\n      if (unreadable) throw unreadableError(unreadable)\n    }\n  }\n\n  isObjectTypeViewable(objectTypeId: string, clearance: Clearance): boolean {\n    if (clearance?.unreadableType(objectTypeId)) return false\n    if (this.delegation) return this.delegation.objectTypeIds.has(objectTypeId)\n    return isAllowed(this.runtime.authorization, { kind: \"object.view\", objectTypeId })\n  }\n\n  isLinkViewable(link: ObjectLinkRow, clearance: Clearance): boolean {\n    if (\n      !this.isObjectTypeViewable(link.sourceTypeId, clearance) ||\n      !this.isObjectTypeViewable(link.targetTypeId, clearance) ||\n      clearance?.unreadableLink(link.sourceTypeId, link.linkId)\n    ) {\n      return false\n    }\n\n    return this.delegation?.linkDefinitions.has(delegatedLinkDefinitionKey(link)) ?? true\n  }\n}\n\n/**\n * Unrestricted authority reads every property. A principal reads what its roles clear; delegated\n * shared access carries no clearance, so no share can expose a marked property.\n */\nfunction clearancesForAuthority(\n  authority: ResolvedExecutionAuthority\n): ReadonlySet<string> | undefined {\n  switch (authority.type) {\n    case \"unrestricted\":\n      return undefined\n    case \"principal\":\n      return authority.context.clearances ?? new Set()\n    case \"delegated\":\n      return new Set()\n  }\n}\n\nfunction delegatedLinkDefinitionKey(\n  input:\n    | Pick<CompiledObjectReadStep, \"sourceObjectTypeId\" | \"linkId\" | \"targetObjectTypeId\">\n    | Pick<ObjectLinkRow, \"sourceTypeId\" | \"linkId\" | \"targetTypeId\">\n): string {\n  return \"sourceObjectTypeId\" in input\n    ? JSON.stringify([input.sourceObjectTypeId, input.linkId, input.targetObjectTypeId])\n    : JSON.stringify([input.sourceTypeId, input.linkId, input.targetTypeId])\n}\n",
+    "import { assertNever } from \"../assert-never\"\nimport type { EmbeddingModelCatalog, RerankingModelCatalog } from \"../models/catalog\"\nimport type { AuthorizedOntologyView } from \"../objects/authorized-ontology-view\"\nimport {\n  attachRedactions,\n  omitHiddenProperties,\n  redactObjectRow,\n} from \"../objects/clearance-redaction\"\nimport { unreadableError } from \"../objects/property-clearance\"\nimport {\n  countObjects,\n  type ExecuteObjectCountInput,\n  type ExecuteObjectCountResult,\n  type ExecuteObjectExistsInput,\n  type ExecuteObjectExistsResult,\n  type ExecuteObjectFacetsInput,\n  type ExecuteObjectFacetsResult,\n  type ExecuteObjectQueryInput,\n  type ExecuteObjectQueryLinksInput,\n  type ExecuteObjectQueryLinksResult,\n  type ExecuteObjectQueryResult,\n  executeObjectQuery,\n  executeObjectQueryLinks,\n  existsObjects,\n  facetObjects,\n} from \"../objects/query\"\nimport { createClearanceQueryAdmission } from \"../objects/query/clearance-admission\"\nimport { ObjectQueryValidationError } from \"../objects/query/errors\"\nimport { validateObjectFacetRequests } from \"../objects/query/executor\"\nimport type { ObjectQuery } from \"../objects/query/ir\"\nimport { assertLinkQueryReadable } from \"../objects/query/link-query-clearance\"\nimport { preflightObjectQueryLinks } from \"../objects/query/links\"\nimport {\n  type AdmittedObjectQuery,\n  composeObjectQueryAdmissions,\n  type ObjectQuerySemanticAdmission,\n  validateObjectQuery,\n  validateObjectQueryWithAdmission,\n} from \"../objects/query/validate\"\nimport {\n  admitTelemetryHistoryReadWorkload,\n  type TelemetryHistoryReadAdmission,\n  type TelemetryHistoryReadWorkloadInput,\n} from \"../objects/telemetry/workload\"\nimport type { OntologyRegistry } from \"../ontology\"\nimport type { AppliedMarkings } from \"../security/applied-markings\"\nimport type {\n  LinkBatchKey,\n  ObjectFacetRequest,\n  ObjectLinkRow,\n  ObjectReadStorage,\n  ObjectRow,\n  ObjectStorage,\n} from \"../storage\"\nimport { assertObjectReadOutputWithinLimit, MAX_OBJECT_READ_FACETS } from \"../storage\"\nimport { captureExecutionScope, resolveExecutionScopeAuthorization } from \"./authorization\"\nimport type { Clearance, EventSources } from \"./object-reader-clearance\"\nimport { ObjectReaderOntology } from \"./object-reader-ontology\"\nimport { ObjectReaderSecurity, type ResolvedExecutionAuthority } from \"./object-reader-security\"\nimport type { ExecutionScope } from \"./types\"\n\ntype GetObjectInput = Omit<Parameters<ObjectReadStorage[\"getByPrimaryId\"]>[0], \"projectId\">\ntype GetObjectsInput = Omit<Parameters<ObjectReadStorage[\"getByPrimaryIdBatch\"]>[0], \"projectId\">\ntype SelectObjectPropertiesInput = Parameters<ObjectReadStorage[\"selectsObjectProperties\"]>[0]\ntype CanReadObjectPropertyInput = SelectObjectPropertiesInput[\"items\"][number]\ntype CanReadObjectPropertiesBatchInput = Omit<SelectObjectPropertiesInput, \"projectId\">\ntype ListObjectsInput = Omit<Parameters<ObjectReadStorage[\"list\"]>[0], \"projectId\">\ntype ListLinksInput = Omit<Parameters<ObjectReadStorage[\"listLinks\"]>[0], \"projectId\">\ntype ListLinksBatchInput = Omit<Parameters<ObjectReadStorage[\"listLinksBatch\"]>[0], \"projectId\">\n\n/** The model catalogs semantic and reranked search use. */\ninterface ObjectReaderModels {\n  readonly embedding?: EmbeddingModelCatalog\n  readonly reranking?: RerankingModelCatalog\n}\n\nconst readerConstructionKey = Object.freeze({})\n\n/**\n * Core-owned object read boundary for one exact execution authority.\n *\n * The implementation class is intentionally private to this module. Its private fields make the\n * exported instance type nominal, while the construction key prevents code that discovers the\n * JavaScript constructor through an instance from manufacturing another reader.\n *\n * Its state is grouped as a project is: the ontology it resolves against, the security of the\n * authority (its delegation and clearance included), the model catalogs search uses, and the\n * storage it reads. Each group decides what belongs to it; the reader composes them.\n */\nclass AuthorizedObjectReaderImpl {\n  readonly #ontology: ObjectReaderOntology\n  readonly #security: ObjectReaderSecurity\n  readonly #models: ObjectReaderModels\n  readonly #storage: ObjectReadStorage\n\n  constructor(\n    key: typeof readerConstructionKey,\n    input: {\n      readonly ontology: ObjectReaderOntology\n      readonly security: ObjectReaderSecurity\n      readonly models: ObjectReaderModels\n      readonly storage: ObjectReadStorage\n    }\n  ) {\n    if (key !== readerConstructionKey) {\n      throw new Error(\"[Sixb] AuthorizedObjectReader can only be created by Core.\")\n    }\n    this.#ontology = input.ontology\n    this.#security = input.security\n    this.#models = input.models\n    this.#storage = input.storage\n  }\n\n  static assertBound(reader: AuthorizedObjectReaderImpl, scope: ExecutionScope): void {\n    const capturedScope = captureExecutionScope(scope)\n    resolveExecutionScopeAuthorization(reader.#security.runtime.projectId, capturedScope)\n    if (capturedScope.authorization !== reader.#security.authorization) {\n      throw new Error(\n        \"[Sixb] AuthorizedObjectReader is not bound to this exact execution authority.\"\n      )\n    }\n  }\n\n  /** What the reader cannot read now, for surfaces such as events that redact on their own. */\n  static async clearance(reader: AuthorizedObjectReaderImpl): Promise<Clearance> {\n    return reader.#security.clearance.current()\n  }\n\n  /** What the reader cannot read in an object event. */\n  static eventClearance(\n    reader: AuthorizedObjectReaderImpl,\n    sources: EventSources\n  ): Clearance | Promise<Clearance> {\n    return reader.#security.clearance.forEvent(sources)\n  }\n\n  static ontologyView(reader: AuthorizedObjectReaderImpl): AuthorizedOntologyView {\n    return reader.#ontology.view()\n  }\n\n  /** Project identity carried by this nominal reader capability. */\n  get projectId(): string {\n    return this.#security.runtime.projectId\n  }\n\n  async getByPrimaryId(input: GetObjectInput): ReturnType<ObjectReadStorage[\"getByPrimaryId\"]> {\n    const request = snapshotReadValue({\n      objectTypeId: input.objectTypeId,\n      primaryId: input.primaryId,\n    })\n    const clearance = await this.#security.clearance.current()\n    this.#security.assertObjectTypesViewable([request.objectTypeId], clearance)\n    const row = await this.#storage.getByPrimaryId({\n      ...request,\n      projectId: this.#security.runtime.projectId,\n    })\n    return this.#detachRows(\n      row && this.#omitHidden(row, clearance),\n      (detached) => [detached],\n      clearance\n    )\n  }\n\n  async getByPrimaryIdBatch(\n    input: GetObjectsInput\n  ): ReturnType<ObjectReadStorage[\"getByPrimaryIdBatch\"]> {\n    const request = snapshotReadValue({\n      items: input.items.map((item) => ({\n        objectTypeId: item.objectTypeId,\n        primaryId: item.primaryId,\n      })),\n    })\n    const clearance = await this.#security.clearance.current()\n    this.#security.assertObjectTypesViewable(\n      request.items.map((item) => item.objectTypeId),\n      clearance\n    )\n    const rows = await this.#storage.getByPrimaryIdBatch({\n      ...request,\n      projectId: this.#security.runtime.projectId,\n    })\n    return this.#detachRows(\n      new Map([...rows].map(([key, row]) => [key, this.#omitHidden(row, clearance)] as const)),\n      (detached) => detached.values(),\n      clearance\n    )\n  }\n\n  async canReadObjectProperty(input: CanReadObjectPropertyInput): Promise<boolean> {\n    const request = snapshotReadValue({\n      objectTypeId: input.objectTypeId,\n      primaryId: input.primaryId,\n      propertyId: input.propertyId,\n    })\n    const clearance = await this.#security.clearance.current()\n    this.#security.assertObjectTypesViewable([request.objectTypeId], clearance)\n\n    if (hidesProperty(request, clearance)) return false\n    if (this.#security.authority.type !== \"delegated\") return true\n    const [readable] = await this.#storage.selectsObjectProperties({\n      projectId: this.#security.runtime.projectId,\n      items: [request],\n    })\n    return readable ?? false\n  }\n\n  async canReadObjectPropertiesBatch(\n    input: CanReadObjectPropertiesBatchInput\n  ): Promise<readonly boolean[]> {\n    const request = snapshotReadValue({\n      items: input.items.map((item) => ({\n        objectTypeId: item.objectTypeId,\n        primaryId: item.primaryId,\n        propertyId: item.propertyId,\n      })),\n    })\n    const clearance = await this.#security.clearance.current()\n    this.#security.assertObjectTypesViewable(\n      request.items.map((item) => item.objectTypeId),\n      clearance\n    )\n    const selected =\n      this.#security.authority.type === \"delegated\"\n        ? await this.#storage.selectsObjectProperties({\n            ...request,\n            projectId: this.#security.runtime.projectId,\n          })\n        : request.items.map(() => true)\n    return request.items.map(\n      (item, index) => !hidesProperty(item, clearance) && selected[index] === true\n    )\n  }\n\n  async list(input: ListObjectsInput): ReturnType<ObjectReadStorage[\"list\"]> {\n    const request = snapshotReadValue({\n      objectTypeId:\n        typeof input.objectTypeId === \"string\"\n          ? input.objectTypeId\n          : input.objectTypeId === undefined\n            ? undefined\n            : [...input.objectTypeId],\n      primaryIdPrefix: input.primaryIdPrefix,\n      primaryIdSuffix: input.primaryIdSuffix,\n      updatedAfter: input.updatedAfter,\n      updatedBefore: input.updatedBefore,\n      createdAfter: input.createdAfter,\n      createdBefore: input.createdBefore,\n      limit: input.limit,\n      offset: input.offset,\n      orderBy: input.orderBy,\n      order: input.order,\n    })\n    const clearance = await this.#security.clearance.current()\n    const objectTypeId = this.#resolveListObjectTypes(request.objectTypeId, clearance)\n\n    // An empty type selection means \"none\", never \"all\". Short-circuiting here prevents a\n    // provider with different empty-array semantics from turning a principal read into a broad one.\n    if (Array.isArray(objectTypeId) && objectTypeId.length === 0) {\n      return { objects: [], hasMore: false, total: 0 }\n    }\n\n    const page = await this.#storage.list({\n      ...request,\n      ...(objectTypeId === undefined ? {} : { objectTypeId }),\n      projectId: this.#security.runtime.projectId,\n    })\n    return this.#detachRows(\n      { ...page, objects: page.objects.map((row) => this.#omitHidden(row, clearance)) },\n      (detached) => detached.objects,\n      clearance\n    )\n  }\n\n  async listLinks(input: ListLinksInput): ReturnType<ObjectReadStorage[\"listLinks\"]> {\n    const request = snapshotReadValue({\n      objectTypeId: input.objectTypeId,\n      objectId: input.objectId,\n      linkId: input.linkId,\n      direction: input.direction,\n    })\n    const clearance = await this.#security.clearance.current()\n    this.#security.assertObjectTypesViewable([request.objectTypeId], clearance)\n    const links = detachReadResult(\n      await this.#storage.listLinks({\n        ...request,\n        projectId: this.#security.runtime.projectId,\n      })\n    )\n    return links.filter((link) => this.#security.isLinkViewable(link, clearance))\n  }\n\n  async listLinksBatch(\n    input: ListLinksBatchInput\n  ): ReturnType<ObjectReadStorage[\"listLinksBatch\"]> {\n    const request = snapshotReadValue({\n      direction: input.direction,\n      items: input.items.map((item) => ({\n        objectTypeId: item.objectTypeId,\n        objectId: item.objectId,\n        linkId: item.linkId,\n      })),\n    })\n    const clearance = await this.#security.clearance.current()\n    this.#security.assertObjectTypesViewable(\n      request.items.map((item) => item.objectTypeId),\n      clearance\n    )\n    const pages = detachReadResult(\n      await this.#storage.listLinksBatch({\n        ...request,\n        projectId: this.#security.runtime.projectId,\n      })\n    )\n    const filtered = new Map<LinkBatchKey, ObjectLinkRow[]>()\n    for (const [key, links] of pages) {\n      filtered.set(\n        key,\n        links.filter((link) => this.#security.isLinkViewable(link, clearance))\n      )\n    }\n    return filtered\n  }\n\n  async executeQuery(\n    input: Omit<ExecuteObjectQueryInput, \"projectId\">\n  ): Promise<ExecuteObjectQueryResult> {\n    const query = snapshotAuthoredQuery(input.query)\n    const includeTotal = snapshotReadValue(input.includeTotal)\n    const executionQuery = this.#admitDelegatedQuery(query)?.query ?? query\n    const clearance = await this.#security.clearance.current()\n    const result = await executeObjectQuery(\n      {\n        query: executionQuery,\n        ...(includeTotal === undefined ? {} : { includeTotal }),\n        projectId: this.#security.runtime.projectId,\n        signal: input.signal,\n      },\n      this.#queryExecutorOptions(clearance)\n    )\n    return this.#detachRows(\n      { ...result, objects: result.objects.map((row) => this.#omitHidden(row, clearance)) },\n      (detached) => detached.objects,\n      clearance\n    )\n  }\n\n  async queryLinks(\n    input: Omit<ExecuteObjectQueryLinksInput, \"projectId\">\n  ): Promise<ExecuteObjectQueryLinksResult> {\n    const query = snapshotAuthoredQuery(input.query)\n    const request = snapshotReadValue({\n      direction: input.direction,\n      linkId: input.linkId,\n      includeObjects: input.includeObjects,\n      pageSize: input.pageSize,\n      pageToken: input.pageToken,\n    })\n    let executionQuery = query\n    const admission = this.#security.delegation?.queryAdmission\n    if (admission) {\n      const preflight = preflightObjectQueryLinks(\n        { query, ...request, projectId: this.#security.runtime.projectId },\n        { ontology: this.#ontology.registry }\n      )\n      const admitted = validateObjectQueryWithAdmission(\n        preflight.validated.query,\n        { ontology: this.#ontology.registry, normalize: false },\n        admission\n      )\n      admission.assertIncidentEdgeSelected({\n        state: admitted.admissionState,\n        ...(preflight.linkId === undefined ? {} : { linkId: preflight.linkId }),\n        direction: preflight.direction,\n        path: \"$.linkId\",\n      })\n      executionQuery = admitted.query\n    }\n\n    const clearance = await this.#security.clearance.current()\n    if (clearance) {\n      assertLinkQueryReadable({\n        ontology: this.#ontology.registry,\n        clearance,\n        query,\n        request: { ...request, projectId: this.#security.runtime.projectId },\n        viewableByGrants: (objectTypeId) =>\n          this.#security.isObjectTypeViewable(objectTypeId, undefined),\n      })\n    }\n\n    const result = detachReadResult(\n      await executeObjectQueryLinks(\n        { query: executionQuery, ...request, projectId: this.#security.runtime.projectId },\n        this.#queryExecutorOptions(clearance)\n      )\n    )\n\n    // Link pagination is computed by the provider-facing executor. Filtering afterward would make\n    // its cursor and hasMore metadata describe hidden rows, so a provider contract violation must\n    // fail closed instead of returning a partially filtered page.\n    if (\n      result.objects.some(\n        (row) => !this.#security.isObjectTypeViewable(row.objectTypeId, clearance)\n      ) ||\n      result.links.some((link) => !this.#security.isLinkViewable(link, clearance))\n    ) {\n      throw new Error(\"[Sixb] Object storage returned a link page outside its authorized scope.\")\n    }\n\n    return {\n      ...result,\n      objects: result.objects.map((row) => (clearance ? redactObjectRow(row, clearance) : row)),\n    }\n  }\n\n  async count(\n    input: Omit<ExecuteObjectCountInput, \"projectId\">\n  ): Promise<ExecuteObjectCountResult> {\n    const query = snapshotAuthoredQuery(input.query)\n    const executionQuery = this.#admitDelegatedQuery(query)?.query ?? query\n    const clearance = await this.#security.clearance.current()\n    return detachReadResult(\n      await countObjects(\n        { query: executionQuery, projectId: this.#security.runtime.projectId },\n        this.#queryExecutorOptions(clearance)\n      )\n    )\n  }\n\n  async exists(\n    input: Omit<ExecuteObjectExistsInput, \"projectId\">\n  ): Promise<ExecuteObjectExistsResult> {\n    const query = snapshotAuthoredQuery(input.query)\n    const executionQuery = this.#admitDelegatedQuery(query)?.query ?? query\n    const clearance = await this.#security.clearance.current()\n    return detachReadResult(\n      await existsObjects(\n        { query: executionQuery, projectId: this.#security.runtime.projectId },\n        this.#queryExecutorOptions(clearance)\n      )\n    )\n  }\n\n  async facet(\n    input: Omit<ExecuteObjectFacetsInput, \"projectId\">\n  ): Promise<ExecuteObjectFacetsResult> {\n    const query = snapshotAuthoredQuery(input.query)\n    const facets = snapshotFacetRequests(input.facets)\n    let executionQuery = query\n    let executionFacets = facets\n    const admission = this.#security.delegation?.queryAdmission\n    if (admission) {\n      // Terminal arguments are ordinary validation errors, not an authorization oracle. Validate\n      // them against the canonical result shape before raising any delegated-scope denial.\n      const validated = validateObjectQuery(query, { ontology: this.#ontology.registry })\n      const normalizedFacets = validateObjectFacetRequests(facets, validated.result.objectTypeIds, {\n        ontology: this.#ontology.registry,\n      })\n      const admitted = validateObjectQueryWithAdmission(\n        validated.query,\n        { ontology: this.#ontology.registry, normalize: false },\n        admission\n      )\n      normalizedFacets.forEach((facet, index) => {\n        admission.assertPropertySelected({\n          state: admitted.admissionState,\n          propertyId: facet.propertyId,\n          use: \"facet\",\n          path: `$.facets[${index}].propertyId`,\n        })\n      })\n      executionQuery = admitted.query\n      executionFacets = normalizedFacets\n    }\n    const clearance = await this.#security.clearance.current()\n    return detachReadResult(\n      await facetObjects(\n        {\n          query: executionQuery,\n          facets: executionFacets,\n          projectId: this.#security.runtime.projectId,\n        },\n        this.#queryExecutorOptions(clearance)\n      )\n    )\n  }\n\n  /**\n   * Redact the rows a write of this object type returns. An upsert returns the merged effective\n   * row, which may hold marked values the writer never sent and cannot read. Resolved before the\n   * write, which it refuses when the writer cannot read the type at all.\n   */\n  async writtenRowRedactor(\n    objectTypeId: string\n  ): Promise<<TRow extends ObjectRow>(row: TRow) => TRow> {\n    const clearance = await this.#security.clearance.current()\n    assertTargetsReadable(clearance, { objectTypeIds: [objectTypeId] })\n    return (row) => (clearance ? redactObjectRow(row, clearance) : row)\n  }\n\n  /**\n   * Refuse a write or a request that names an object type or link this authority cannot read,\n   * before any lookup: it would answer whether what it names exists, and land where the reader\n   * cannot see.\n   */\n  async assertReadable(targets: ReadTargets): Promise<void> {\n    assertTargetsReadable(await this.#security.clearance.current(), targets)\n  }\n\n  /** Enforce the delegated response budget without exposing or recombining its limits. */\n  assertVisibleOutputWithinLimit(value: unknown): void {\n    if (this.#security.authority.type !== \"delegated\") return\n    assertObjectReadOutputWithinLimit(value, this.#security.authority.objectRead.limits)\n  }\n\n  /** Admit adjacent telemetry work without exposing which authority policy was selected. */\n  admitTelemetryHistoryRead(\n    input: TelemetryHistoryReadWorkloadInput\n  ): TelemetryHistoryReadAdmission {\n    return admitTelemetryHistoryReadWorkload(input, this.#security.authority.type === \"delegated\")\n  }\n\n  #queryExecutorOptions(clearance: Clearance) {\n    const admission = this.#executorAdmission(clearance)\n\n    if (this.#security.authority.type === \"delegated\") {\n      // The selected storage instance is the private execution capability. Passing the delegated\n      // runtime token into the generic executor would either reject this admitted query or tempt a\n      // forgeable bypass flag; neither is needed at this nominal boundary.\n      return {\n        ontology: this.#ontology.registry,\n        storage: this.#storage,\n        embeddingModels: this.#models.embedding,\n        rerankingModels: this.#models.reranking,\n        ...(admission === undefined ? {} : { admission }),\n      }\n    }\n    return {\n      ontology: this.#ontology.registry,\n      embeddingModels: this.#models.embedding,\n      rerankingModels: this.#models.reranking,\n      storage: this.#storage,\n      runtimeAuthorization: this.#security.runtime.runtimeAuthorization,\n      ...(this.#security.runtime.authorization === undefined\n        ? {}\n        : { authorization: this.#security.runtime.authorization }),\n      ...(admission === undefined ? {} : { admission }),\n    }\n  }\n\n  /**\n   * The executor validates the query it runs, and that validation resolves default text fields.\n   * Every admission that narrows those fields must therefore apply there, not only beforehand.\n   */\n  #executorAdmission(clearance: Clearance): ObjectQuerySemanticAdmission | undefined {\n    const admission = clearance && createClearanceQueryAdmission(clearance)\n    const selected = this.#security.delegation?.queryAdmission\n\n    if (selected && admission) return composeObjectQueryAdmissions(selected, admission)\n    return selected ?? admission\n  }\n\n  #omitHidden<TRow extends ObjectRow>(row: TRow, clearance: Clearance): TRow {\n    return clearance ? omitHiddenProperties(row, clearance) : row\n  }\n\n  /**\n   * Detach a result whose rows went through {@link #omitHidden}, then list their redactions on\n   * the copy. Each row is deep-copied once, and never with a hidden value.\n   */\n  #detachRows<TResult>(\n    result: TResult,\n    rows: (detached: TResult) => Iterable<ObjectRow | null>,\n    clearance: Clearance\n  ): TResult {\n    const detached = detachReadResult(result)\n    if (clearance) {\n      for (const row of rows(detached)) if (row) attachRedactions(row, clearance)\n    }\n\n    return detached\n  }\n\n  #admitDelegatedQuery(query: ObjectQuery): AdmittedObjectQuery | undefined {\n    const admission = this.#security.delegation?.queryAdmission\n    if (!admission) return undefined\n    return validateObjectQueryWithAdmission(query, { ontology: this.#ontology.registry }, admission)\n  }\n\n  #resolveListObjectTypes(\n    requested: ListObjectsInput[\"objectTypeId\"],\n    clearance: Clearance\n  ): ListObjectsInput[\"objectTypeId\"] {\n    if (requested !== undefined) {\n      const objectTypeIds = typeof requested === \"string\" ? [requested] : [...new Set(requested)]\n      for (const objectTypeId of objectTypeIds) {\n        this.#ontology.registry.resolveObjectType(objectTypeId)\n      }\n      this.#security.assertObjectTypesViewable(objectTypeIds, clearance)\n      return typeof requested === \"string\" ? requested : objectTypeIds\n    }\n\n    if (this.#security.authority.type === \"unrestricted\") return undefined\n    return this.#ontology.registry\n      .listObjectTypes()\n      .map((objectType) => objectType.id)\n      .filter((objectTypeId) => this.#security.isObjectTypeViewable(objectTypeId, clearance))\n  }\n}\n\nObject.freeze(AuthorizedObjectReaderImpl.prototype)\nObject.freeze(AuthorizedObjectReaderImpl)\n\nexport type AuthorizedObjectReader = AuthorizedObjectReaderImpl\n\n/** Build the sole application-facing object reader for one registered execution scope. */\nexport function createAuthorizedObjectReader(input: {\n  readonly scope: ExecutionScope\n  readonly ontology: OntologyRegistry\n  readonly embeddingModels?: EmbeddingModelCatalog\n  readonly rerankingModels?: RerankingModelCatalog\n  readonly objectStorage: ObjectStorage\n  /** Markings of the dataset versions projections applied; the code's markings alone without. */\n  readonly appliedMarkings?: AppliedMarkings\n}): AuthorizedObjectReader {\n  const scope = captureExecutionScope(input.scope)\n  const projectId = scope.execution.projectId\n  const authority = resolveExecutionScopeAuthorization(projectId, scope)\n  const storage = objectStorageForAuthority(authority, input.objectStorage)\n  const reader = new AuthorizedObjectReaderImpl(readerConstructionKey, {\n    ontology: new ObjectReaderOntology(input.ontology, authority),\n    security: new ObjectReaderSecurity({\n      authorization: scope.authorization,\n      authority,\n      projectId,\n      ontology: input.ontology,\n      ...(input.appliedMarkings === undefined ? {} : { appliedMarkings: input.appliedMarkings }),\n    }),\n    models: Object.freeze({\n      ...(input.embeddingModels === undefined ? {} : { embedding: input.embeddingModels }),\n      ...(input.rerankingModels === undefined ? {} : { reranking: input.rerankingModels }),\n    }),\n    storage,\n  })\n  Object.freeze(reader)\n  return reader\n}\n\n/** Reject recombining an authorized reader with any other execution authority. */\nexport function assertAuthorizedObjectReaderBinding(input: {\n  readonly reader: AuthorizedObjectReader\n  readonly scope: ExecutionScope\n}): void {\n  AuthorizedObjectReaderImpl.assertBound(input.reader, input.scope)\n}\n\n/** Return inert metadata projected from the exact authority already owned by the reader. */\nexport function getAuthorizedOntologyView(reader: AuthorizedObjectReader): AuthorizedOntologyView {\n  return AuthorizedObjectReaderImpl.ontologyView(reader)\n}\n\n/**\n * What a reader resolved for this authority cannot read now. Events redact with it: an event of an\n * object type the reader cannot read is not delivered, and the others are redacted like rows.\n */\nexport function readerClearance(reader: AuthorizedObjectReader): Promise<Clearance> {\n  return AuthorizedObjectReaderImpl.clearance(reader)\n}\n\n/**\n * What a reader cannot read in an object event: the current markings, with those of the versions\n * its values came from. A plain value for a reader those markings cannot affect, which reads no\n * version.\n */\nexport function readerEventClearance(\n  reader: AuthorizedObjectReader,\n  sources: EventSources\n): Clearance | Promise<Clearance> {\n  return AuthorizedObjectReaderImpl.eventClearance(reader, sources)\n}\n\n/** What a write or a request names: object types, and links by their source type. */\ninterface ReadTargets {\n  readonly objectTypeIds: readonly string[]\n  readonly links?: readonly { readonly objectTypeId: string; readonly linkId: string }[]\n}\n\nfunction assertTargetsReadable(clearance: Clearance, targets: ReadTargets): void {\n  if (!clearance) return\n\n  for (const objectTypeId of targets.objectTypeIds) {\n    const unreadable = clearance.unreadableType(objectTypeId)\n    if (unreadable) throw unreadableError(unreadable)\n  }\n\n  for (const link of targets.links ?? []) {\n    const unreadable = clearance.unreadableLink(link.objectTypeId, link.linkId)\n    if (unreadable) throw unreadableError(unreadable)\n  }\n}\n\nfunction hidesProperty(\n  item: { readonly objectTypeId: string; readonly propertyId: string },\n  clearance: Clearance\n): boolean {\n  return clearance?.missingMarking(item.objectTypeId, item.propertyId) !== undefined\n}\n\nfunction objectStorageForAuthority(\n  authority: ResolvedExecutionAuthority,\n  objectStorage: ObjectStorage\n): ObjectReadStorage {\n  switch (authority.type) {\n    case \"principal\":\n    case \"unrestricted\":\n      return objectStorage\n    case \"delegated\":\n      return objectStorage.createSelectedReadScope({\n        projectId: authority.projectId,\n        scope: authority.objectRead.scope,\n        limits: authority.objectRead.limits,\n      })\n    default:\n      return assertNever(\n        authority,\n        `[Sixb] Unsupported object reader authority '${String((authority as { type?: unknown }).type)}'.`\n      )\n  }\n}\n\n/**\n * Storage providers may optimize trusted reads with live references. Values crossing the\n * application-facing authorization boundary must not retain them.\n */\nfunction detachReadResult<T>(value: T): T {\n  return structuredClone(value)\n}\n\n/** Capture caller-owned values before authorization and execution. */\nfunction snapshotReadValue<T>(value: T): T {\n  return structuredClone(value)\n}\n\n/** Bound and capture facet arguments before reading any caller-owned element. */\nfunction snapshotFacetRequests(facets: readonly ObjectFacetRequest[]): ObjectFacetRequest[] {\n  if (!Array.isArray(facets)) {\n    throw new ObjectQueryValidationError([\n      {\n        path: \"$.facets\",\n        code: \"invalid_facets\",\n        message: \"facets must be an array\",\n      },\n    ])\n  }\n  const length = facets.length\n  if (!Number.isSafeInteger(length) || length > MAX_OBJECT_READ_FACETS) {\n    throw new ObjectQueryValidationError([\n      {\n        path: \"$.facets\",\n        code: \"too_many_facets\",\n        message: `facets must include at most ${MAX_OBJECT_READ_FACETS} facet requests`,\n      },\n    ])\n  }\n\n  const snapshot: ObjectFacetRequest[] = []\n  for (let index = 0; index < length; index += 1) {\n    const facet = facets[index]\n    snapshot.push({ propertyId: facet.propertyId, limit: facet.limit })\n  }\n  return snapshot\n}\n\n/** Capture one serializable query before either authorization or execution sees it. */\nfunction snapshotAuthoredQuery(query: ObjectQuery): ObjectQuery {\n  try {\n    const snapshot = structuredClone(query)\n    const pending = [snapshot]\n    const seen = new Set<ObjectQuery>()\n    for (const node of pending) {\n      if (seen.has(node)) continue\n      seen.add(node)\n      if (\n        node.kind === \"vector\" &&\n        (typeof node.vector !== \"string\" ||\n          typeof node.profile !== \"string\" ||\n          \"propertyId\" in node)\n      ) {\n        throw new ObjectQueryValidationError([\n          {\n            path: \"$\",\n            code: \"invalid_vector_search_input\",\n            message: \"Vector search requires a named profile and search text\",\n          },\n        ])\n      }\n      if (\"input\" in node) pending.push(node.input)\n      if (node.kind === \"set\") pending.push(...node.inputs)\n    }\n    return snapshot\n  } catch (error) {\n    if (error instanceof ObjectQueryValidationError) throw error\n    throw new ObjectQueryValidationError([\n      {\n        path: \"$\",\n        code: \"query_not_cloneable\",\n        message: \"Object query must contain only structured-cloneable data\",\n      },\n    ])\n  }\n}\n",
+    "import type { ResolvedRuntimeAuthorization } from \"../execution/authorization\"\nimport { type AuthorizedObjectReader, readerClearance } from \"../execution/authorized-object-reader\"\nimport type { Storage } from \"../storage\"\nimport type { ActionRunRecord } from \"../storage/action-runs\"\nimport { findPrimitiveParentRequestExecution } from \"../storage/executions/run-link\"\n\n/**\n * Whether the reader can read the object type of a run's subject under the markings of the\n * versions projections applied. A run names its subject's id, so a run on a type the reader\n * cannot read is hidden like one on a type it has no view grant for.\n */\nexport async function canReadActionRunSubject(\n  objectReader: AuthorizedObjectReader,\n  run: Pick<ActionRunRecord, \"subject\">\n): Promise<boolean> {\n  if (run.subject.kind !== \"object\") return true\n  const clearance = await readerClearance(objectReader)\n  return clearance?.unreadableType(run.subject.objectTypeId) === undefined\n}\n\n/** The object types whose runs the reader cannot read, to leave out of a run listing. */\nexport async function unreadableActionRunTypes(\n  objectReader: AuthorizedObjectReader\n): Promise<ReadonlySet<string>> {\n  const clearance = await readerClearance(objectReader)\n  return new Set(clearance?.unreadable().types.keys())\n}\n\n/** Check both current grant scope and immutable request provenance for a delegated Action run. */\nexport async function canDelegationAccessActionRun(input: {\n  readonly storage: Storage\n  readonly projectId: string\n  readonly authority: Extract<ResolvedRuntimeAuthorization, { readonly type: \"delegated\" }>\n  readonly run: ActionRunRecord\n}): Promise<boolean> {\n  const subject = input.run.subject\n  if (\n    !input.authority.delegation ||\n    subject.kind !== \"object\" ||\n    !input.authority.actionApply.some(\n      (target) =>\n        target.actionId === input.run.actionId &&\n        target.subject.objectTypeId === subject.objectTypeId &&\n        target.subject.primaryId === subject.primaryId\n    )\n  ) {\n    return false\n  }\n  return actionRunBelongsToShareGrant({\n    storage: input.storage,\n    projectId: input.projectId,\n    run: input.run,\n    grantId: input.authority.delegation.grantId,\n  })\n}\n\n/** Session ids remain audit provenance; the issued grant is the durable capability identity. */\nexport async function actionRunBelongsToShareGrant(input: {\n  readonly storage: Storage\n  readonly projectId: string\n  readonly run: Pick<ActionRunRecord, \"id\" | \"actionId\" | \"executionId\">\n  readonly grantId: string\n}): Promise<boolean> {\n  const parent = await findPrimitiveParentRequestExecution({\n    executions: input.storage.executions,\n    projectId: input.projectId,\n    executionId: input.run.executionId,\n    primitive: { kind: \"action\", id: input.run.actionId, runId: input.run.id },\n  })\n  const authorization = parent?.authorizationRef\n  return (\n    authorization?.type === \"delegated\" &&\n    authorization.delegation.kind === \"share\" &&\n    authorization.delegation.grantId === input.grantId\n  )\n}\n",
+    "import type { AiCostStorage, AiCostSummary } from \"../storage/ai-cost\"\n\n/** Resolve preferred cost summaries in input order without inventing unavailable accounting. */\nexport async function resolveExecutionCosts(input: {\n  readonly storage: AiCostStorage | undefined\n  readonly projectId: string\n  readonly executionIds: readonly string[]\n}): Promise<readonly (AiCostSummary | undefined)[]> {\n  if (input.executionIds.length === 0) return []\n  if (!input.storage) return input.executionIds.map(() => undefined)\n  return input.storage.summarizeExecutions({\n    projectId: input.projectId,\n    executionIds: input.executionIds,\n  })\n}\n",
+    "import type { ActionObjectSubject } from \"../actions\"\nimport { unreadableActionRunTypes } from \"../actions/run-authorization\"\nimport { AuthorizationError, canViewActionRun, canViewWorkflowRun } from \"../authorization\"\nimport { resolveExecutionCosts } from \"../runtime/ai-cost\"\nimport type { SixbRuntimeContext } from \"../runtime/types\"\nimport type { ActionRunStatus } from \"../storage/action-runs\"\nimport { ACTIVITY_MAX_VISIT_MS, ACTIVITY_MIN_IDLE_TIMEOUT_MS } from \"../storage/activity/policy\"\nimport type { ActivityVisit, StoredActivityVisitPage } from \"../storage/activity/types\"\nimport type { AgentRunStatus, ConversationAgentRunRecord } from \"../storage/agents\"\nimport type { AiCostSummary } from \"../storage/ai-cost\"\nimport type { ExecutionRecord } from \"../storage/executions\"\nimport { objectBatchKey } from \"../storage/objects/keys\"\nimport type { ShareGrantRecord } from \"../storage/share-grants\"\nimport type { WorkflowRunStatus } from \"../storage/workflow-runs\"\nimport { type ActivityConnection, readActivityConnection } from \"./connection\"\nimport type { ActivityVisitView } from \"./shares\"\n\n/**\n * At most this many page views and interactions together, and as many recorded executions, make a\n * visit's timeline.\n */\nexport const ACTIVITY_TIMELINE_LIMIT = 200\n\n/**\n * How far around its activity a visit claims its session's executions. A click right after a\n * return reaches the server before the activity that opens the visit, and the last action before\n * leaving may come after the last activity sent. Half the shortest idle timeout keeps the visits of\n * one session from claiming the same execution.\n */\nconst SESSION_GRACE_MS = ACTIVITY_MIN_IDLE_TIMEOUT_MS / 2\n\nexport interface ActivityPageEntry {\n  readonly kind: \"page\"\n  readonly at: Date\n  readonly sequence: number\n  readonly route: string\n}\n\n/** An interaction the app marked, on the page it happened on. */\nexport interface ActivityInteractionEntry {\n  readonly kind: \"interaction\"\n  readonly at: Date\n  readonly sequence: number\n  readonly name: string\n  readonly route: string\n}\n\nexport interface ActivityActionEntry {\n  readonly kind: \"action\"\n  readonly at: Date\n  readonly executionId: string\n  readonly actionId: string\n  readonly runId: string\n  /** `incomplete` when no outcome is recorded: the run is in flight, or was interrupted. */\n  readonly status: ActionRunStatus | \"incomplete\"\n  /** Whether the viewer may read the run itself, as Observability › Runs shows it. */\n  readonly runVisible: boolean\n  /** The object it applied to, only when the viewer can read that object. */\n  readonly object?: { readonly objectTypeId: string; readonly primaryId: string }\n}\n\nexport interface ActivityWorkflowEntry {\n  readonly kind: \"workflow\"\n  readonly at: Date\n  readonly executionId: string\n  readonly workflowId: string\n  readonly runId: string\n  readonly status: WorkflowRunStatus | \"incomplete\"\n  /** Whether the viewer may read the run itself, as Observability › Runs shows it. */\n  readonly runVisible: boolean\n}\n\n/** A conversation's run: its metadata only, never its title or messages. */\nexport interface ActivityAgentEntry {\n  readonly kind: \"agent\"\n  readonly at: Date\n  readonly executionId: string\n  readonly runId: string\n  readonly threadId: string\n  readonly status: AgentRunStatus\n  /** Messages in the thread now, every run's. */\n  readonly messages: number\n  /** The run's model calls with those of its subagents and tools; absent without any. */\n  readonly cost?: AiCostSummary\n}\n\nexport type ActivityTimelineEntry =\n  | ActivityPageEntry\n  | ActivityInteractionEntry\n  | ActivityActionEntry\n  | ActivityWorkflowEntry\n  | ActivityAgentEntry\n\nexport interface ActivityVisitTimeline {\n  readonly visit: ActivityVisitView\n  /** Absent once the session is gone, or without an auth or share store. */\n  readonly connection?: ActivityConnection\n  /**\n   * By time. Page views and interactions come in their sequence, and before executions at the same\n   * instant.\n   */\n  readonly entries: readonly ActivityTimelineEntry[]\n  /**\n   * More than {@link ACTIVITY_TIMELINE_LIMIT} page views and interactions, or recorded executions.\n   * The timeline then stops at the last page view or interaction, or the last root execution, it\n   * could keep.\n   */\n  readonly truncated: boolean\n}\n\n/**\n * A visit's timeline: its page views and interactions, and what its session started while it\n * lasted. One bounded read per source, each batched over the visit; see `README.md`.\n */\nexport async function composeActivityTimeline(\n  runtime: SixbRuntimeContext,\n  input: {\n    readonly page: StoredActivityVisitPage\n    /** The visit, named by its link's share. */\n    readonly visit: ActivityVisitView\n    /** That link's grant, read with the name. */\n    readonly grant?: ShareGrantRecord\n  },\n  now: Date\n): Promise<ActivityVisitTimeline> {\n  const { page, visit } = input\n  const { storage, projectId } = runtime\n\n  const [ledger, connection] = await Promise.all([\n    storage.executions.listBySession({\n      projectId,\n      session: { type: visit.actor.type, id: page.sessionId },\n      ...sessionWindow(visit),\n      limit: ACTIVITY_TIMELINE_LIMIT,\n    }),\n    readActivityConnection(runtime, page, input.grant, now),\n  ])\n  const executions = ledger.executions\n\n  const ofKind = (kind: \"action\" | \"workflow\") =>\n    executions.flatMap((execution) =>\n      execution.executor.type === \"primitive\" && execution.executor.kind === kind\n        ? [execution.id]\n        : []\n    )\n  const agentRunIds = executions.flatMap((execution) =>\n    execution.executor.type === \"agent\" ? [execution.executor.runId] : []\n  )\n\n  // Only what an Agent ran can count toward a conversation's cost.\n  const byId = new Map(executions.map((execution) => [execution.id, execution]))\n  const withAgent = executions.filter((execution) =>\n    lineage(execution, byId).some((ancestor) => ancestor.executor.type === \"agent\")\n  )\n\n  const [actionRuns, workflowRuns, agentRuns, costs] = await Promise.all([\n    storage.actionRuns?.getByExecutionIds({ projectId, executionIds: ofKind(\"action\") }) ?? [],\n    storage.workflowRuns?.getByExecutionIds({ projectId, executionIds: ofKind(\"workflow\") }) ?? [],\n    storage.agents?.runs.getByIds({ projectId, ids: agentRunIds }) ?? [],\n    resolveExecutionCosts({\n      storage: storage.aiCosts,\n      projectId,\n      executionIds: withAgent.map((execution) => execution.id),\n    }),\n  ])\n\n  // A subagent's cost goes to the conversation above it. A Workflow's Agent steps have none.\n  const conversations = new Map(\n    agentRuns.flatMap((run) =>\n      run.kind === \"conversation\" ? [[run.executionId, run] as const] : []\n    )\n  )\n  const subjects = actionRuns.flatMap((run) => (run.subject.kind === \"object\" ? [run.subject] : []))\n\n  const [threads, readable, unreadableRunTypes] = await Promise.all([\n    storage.agents?.threads.getByIds({\n      projectId,\n      ids: [...conversations.values()].map((run) => run.threadId),\n    }) ?? [],\n    readableObjects(runtime, subjects),\n    subjects.length > 0 ? unreadableActionRunTypes(runtime.objectReader) : new Set<string>(),\n  ])\n\n  const actionRunByExecution = new Map(actionRuns.map((run) => [run.executionId, run]))\n  const workflowRunByExecution = new Map(workflowRuns.map((run) => [run.executionId, run]))\n  const messagesByThread = new Map(threads.map((thread) => [thread.id, thread.messageCount]))\n  const costByAgent = rollUpCosts(byId, conversations, withAgent, costs)\n\n  const executionEntries = executions.flatMap((execution): ActivityTimelineEntry[] => {\n    const at = new Date(execution.createdAt)\n    const executor = execution.executor\n    const authority = execution.authorizationRef\n\n    if (executor.type === \"primitive\" && authority.type === \"trustedPrimitive\") {\n      if (executor.kind === \"action\") {\n        const run = actionRunByExecution.get(execution.id)\n        const subject = run?.subject.kind === \"object\" ? run.subject : undefined\n        const object =\n          subject && readable.has(objectBatchKey(subject.objectTypeId, subject.primaryId))\n            ? { objectTypeId: subject.objectTypeId, primaryId: subject.primaryId }\n            : undefined\n\n        // As the runs page decides: the action and its subject's type, and the type's markings.\n        const runVisible =\n          run !== undefined &&\n          canViewActionRun(runtime.authorization, run) &&\n          (subject === undefined || !unreadableRunTypes.has(subject.objectTypeId))\n\n        return [\n          {\n            kind: \"action\",\n            at,\n            executionId: execution.id,\n            actionId: authority.primitive.id,\n            runId: executor.runId,\n            status: run?.status ?? \"incomplete\",\n            runVisible,\n            ...(object === undefined ? {} : { object }),\n          },\n        ]\n      }\n\n      if (executor.kind === \"workflow\") {\n        const run = workflowRunByExecution.get(execution.id)\n        return [\n          {\n            kind: \"workflow\",\n            at,\n            executionId: execution.id,\n            workflowId: authority.primitive.id,\n            runId: executor.runId,\n            status: run?.status ?? \"incomplete\",\n            runVisible: run !== undefined && canViewWorkflowRun(runtime.authorization, run),\n          },\n        ]\n      }\n    }\n\n    const conversation = conversations.get(execution.id)\n    if (conversation) {\n      const cost = costByAgent.get(execution.id)\n      return [\n        {\n          kind: \"agent\",\n          at,\n          executionId: execution.id,\n          runId: conversation.id,\n          threadId: conversation.threadId,\n          status: conversation.status,\n          messages: messagesByThread.get(conversation.threadId) ?? 0,\n          ...(cost === undefined ? {} : { cost }),\n        },\n      ]\n    }\n\n    return []\n  })\n\n  // Recorded entries come first at an equal instant, in their sequence: the sort is stable.\n  const recorded = [\n    ...page.pageViews.map(\n      (pageView): ActivityPageEntry => ({\n        kind: \"page\",\n        at: new Date(pageView.receivedAt),\n        sequence: pageView.sequence,\n        route: pageView.route,\n      })\n    ),\n    ...page.interactions.map(\n      (interaction): ActivityInteractionEntry => ({\n        kind: \"interaction\",\n        at: new Date(interaction.receivedAt),\n        sequence: interaction.sequence,\n        name: interaction.name,\n        route: interaction.route,\n      })\n    ),\n  ].sort((left, right) => left.sequence - right.sequence)\n\n  // Past the last page view, interaction or root kept, a source left rows out: the timeline stops\n  // there.\n  const cutoffs = [\n    page.hasMore ? recorded.at(-1)?.at : undefined,\n    ledger.truncated\n      ? executions.filter((execution) => execution.source.type !== \"execution\").at(-1)?.createdAt\n      : undefined,\n  ].flatMap((at) => (at === undefined ? [] : [at.getTime()]))\n  const cutoff = cutoffs.length > 0 ? Math.min(...cutoffs) : Number.POSITIVE_INFINITY\n\n  const entries = [...recorded, ...executionEntries]\n    .filter((entry) => entry.at.getTime() <= cutoff)\n    .sort((left, right) => left.at.getTime() - right.at.getTime())\n\n  return {\n    visit,\n    ...(connection === undefined ? {} : { connection }),\n    entries,\n    truncated: page.hasMore || ledger.truncated,\n  }\n}\n\n/**\n * Roots created in `[start - grace, last activity + grace)`, cut where the session's next visit\n * may start once this one is a day old.\n */\nfunction sessionWindow(visit: ActivityVisit): { readonly from: Date; readonly to: Date } {\n  const startedAt = visit.startedAt.getTime()\n  return {\n    from: new Date(startedAt - SESSION_GRACE_MS),\n    to: new Date(\n      Math.min(\n        visit.lastSeenAt.getTime() + SESSION_GRACE_MS,\n        startedAt + ACTIVITY_MAX_VISIT_MS - SESSION_GRACE_MS\n      )\n    ),\n  }\n}\n\n/** An execution, then its parent and the parent's, as far as the visit's executions go. */\nfunction lineage(\n  execution: ExecutionRecord,\n  byId: ReadonlyMap<string, ExecutionRecord>\n): readonly ExecutionRecord[] {\n  const chain: ExecutionRecord[] = []\n  let current: ExecutionRecord | undefined = execution\n\n  while (current) {\n    chain.push(current)\n    current = current.source.type === \"execution\" ? byId.get(current.source.executionId) : undefined\n  }\n  return chain\n}\n\n/** Each conversation's cost: its own calls and those of everything below it, each counted once. */\nfunction rollUpCosts(\n  byId: ReadonlyMap<string, ExecutionRecord>,\n  conversations: ReadonlyMap<string, ConversationAgentRunRecord>,\n  withAgent: readonly ExecutionRecord[],\n  costs: readonly (AiCostSummary | undefined)[]\n): ReadonlyMap<string, AiCostSummary> {\n  const grouped = new Map<string, AiCostSummary[]>()\n\n  withAgent.forEach((execution, index) => {\n    const cost = costs[index]\n    const owner = lineage(execution, byId).find((ancestor) => conversations.has(ancestor.id))\n    if (!cost || !owner) {\n      return\n    }\n\n    const summaries = grouped.get(owner.id) ?? []\n    summaries.push(cost)\n    grouped.set(owner.id, summaries)\n  })\n\n  return new Map(\n    [...grouped].flatMap(([owner, summaries]) => {\n      const total = addCosts(summaries)\n      return total ? [[owner, total] as const] : []\n    })\n  )\n}\n\nfunction addCosts(summaries: readonly AiCostSummary[]): AiCostSummary | undefined {\n  const amounts = new Map<string, bigint>()\n  let ratedCallCount = 0\n  let unpriceableCallCount = 0\n  let unvaluedCallCount = 0\n\n  for (const summary of summaries) {\n    for (const money of summary.amounts) {\n      amounts.set(money.currency, (amounts.get(money.currency) ?? 0n) + BigInt(money.amountNanos))\n    }\n    ratedCallCount += summary.ratedCallCount\n    unpriceableCallCount += summary.unpriceableCallCount\n    unvaluedCallCount += summary.unvaluedCallCount\n  }\n\n  if (ratedCallCount + unpriceableCallCount + unvaluedCallCount === 0) {\n    return undefined\n  }\n\n  return {\n    amounts: [...amounts]\n      .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))\n      .map(([currency, amount]) => ({ currency, amountNanos: amount.toString() })),\n    ratedCallCount,\n    unpriceableCallCount,\n    unvaluedCallCount,\n  }\n}\n\n/**\n * The action subjects the viewer can read, through its own object reader: object type grants,\n * markings and existence alike. One batch per object type, as a type the viewer cannot see fails\n * its whole batch.\n */\nasync function readableObjects(\n  runtime: SixbRuntimeContext,\n  subjects: readonly ActionObjectSubject[]\n): Promise<ReadonlySet<string>> {\n  const byType = new Map<string, Map<string, ActionObjectSubject>>()\n  for (const subject of subjects) {\n    const items = byType.get(subject.objectTypeId) ?? new Map()\n    items.set(subject.primaryId, subject)\n    byType.set(subject.objectTypeId, items)\n  }\n\n  const readable = new Set<string>()\n  await Promise.all(\n    [...byType.values()].map(async (items) => {\n      try {\n        const rows = await runtime.objectReader.getByPrimaryIdBatch({ items: [...items.values()] })\n        for (const key of rows.keys()) {\n          readable.add(key)\n        }\n      } catch (error) {\n        if (!(error instanceof AuthorizationError)) {\n          throw error\n        }\n      }\n    })\n  )\n  return readable\n}\n",
+    "import { AuthorizationError, assertAuthorized } from \"../authorization\"\nimport { getAuthorizationRef } from \"../execution/authorization\"\nimport type { SixbRuntimeContext } from \"../runtime/types\"\nimport type { ActivityEventInput, ActivitySummary, ActivityUser } from \"../storage/activity/types\"\nimport {\n  type ActivityConnectionsPage,\n  type ActivityConnectionsQuery,\n  readActivityConnections,\n} from \"./connection\"\nimport type {\n  ActivityCalendar,\n  ActivityCalendarQuery,\n  ActivityCaptureOptions,\n  ActivityCaptureResult,\n  ActivityPageQuery,\n  ActivityPeriodQuery,\n  ActivityService,\n  ActivitySource,\n} from \"./service\"\nimport { type ActivityVisitView, nameSharedVisit, nameSharedVisits } from \"./shares\"\nimport {\n  ACTIVITY_TIMELINE_LIMIT,\n  type ActivityVisitTimeline,\n  composeActivityTimeline,\n} from \"./timeline\"\n\nexport interface ActivityVisitList {\n  readonly visits: readonly ActivityVisitView[]\n  readonly hasMore: boolean\n}\n\nexport interface ActivityUsersResult {\n  /** `displayName` is the account's profile name; no other profile field is read. */\n  readonly users: readonly (ActivityUser & { readonly displayName?: string })[]\n  readonly hasMore: boolean\n}\n\n/** `sixb.activity`: the app's recorded visits. Every read needs `can.observe(project.activity)`. */\nexport interface ActivityRuntime {\n  /** Shared visits name their link's share: see `ActivityVisitView`. */\n  list(query: ActivityPageQuery): Promise<ActivityVisitList>\n  users(query: ActivityPageQuery): Promise<ActivityUsersResult>\n  summarize(query: ActivityPeriodQuery): Promise<ActivitySummary>\n  calendar(query: ActivityCalendarQuery): Promise<ActivityCalendar>\n  /**\n   * The visit's page views and interactions with the actions, workflows and Agent runs its session\n   * started, and the connection it came through. Bounded: see `truncated`.\n   */\n  timeline(visitId: string): Promise<ActivityVisitTimeline | null>\n  /** A user's sign-ins, newest first, with the visits each opened. */\n  connections(query: ActivityConnectionsQuery): Promise<ActivityConnectionsPage>\n}\n\n/**\n * Recording, for the server's capture route only: it is not on `sixb.activity`, so project code\n * cannot record visits under whatever authority it runs with.\n */\nexport interface ActivityCaptureRuntime {\n  /** The settings a browser session reads before it sends anything. */\n  captureOptions(): ActivityCaptureOptions\n  /** Records a batch for the calling user or shared session. */\n  capture(events: readonly ActivityEventInput[]): Promise<ActivityCaptureResult>\n}\n\n// Display names are read one account at a time; a page of users reads a few at once.\nconst PROFILE_READ_CONCURRENCY = 8\n\nexport function createActivityRuntime(\n  runtime: SixbRuntimeContext,\n  service: ActivityService\n): ActivityRuntime {\n  const assertObservable = () => assertAuthorized(runtime, { kind: \"activity.observe\" })\n\n  return {\n    async list(query) {\n      assertObservable()\n      const page = await service.list(query)\n      return { ...page, visits: await nameSharedVisits(runtime, page.visits) }\n    },\n\n    async users(query) {\n      assertObservable()\n      const page = await service.users(query)\n\n      // Only accounts in this bounded page are looked up, and only their name is kept.\n      const users = await mapInChunks(page.users, PROFILE_READ_CONCURRENCY, async (user) => {\n        const profile = await runtime.storage.auth?.users.getById({\n          projectId: runtime.projectId,\n          id: user.userId,\n        })\n        return profile?.displayName ? { ...user, displayName: profile.displayName } : user\n      })\n\n      return { users, hasMore: page.hasMore }\n    },\n\n    async summarize(query) {\n      assertObservable()\n      return service.summarize(query)\n    },\n\n    async calendar(query) {\n      assertObservable()\n      return service.calendar(query)\n    },\n\n    async timeline(visitId) {\n      assertObservable()\n      const page = await service.readWithSession({ id: visitId, limit: ACTIVITY_TIMELINE_LIMIT })\n      if (!page) {\n        return null\n      }\n\n      const shared = await nameSharedVisit(runtime, page.visit)\n      return composeActivityTimeline(runtime, { ...shared, page }, new Date())\n    },\n\n    async connections(query) {\n      assertObservable()\n      return readActivityConnections(runtime, service, query, new Date())\n    },\n  }\n}\n\nexport function createActivityCaptureRuntime(\n  runtime: SixbRuntimeContext,\n  service: ActivityService\n): ActivityCaptureRuntime {\n  return {\n    captureOptions() {\n      captureSource(runtime)\n      return service.captureOptions\n    },\n\n    async capture(events) {\n      return service.capture(captureSource(runtime), events)\n    },\n  }\n}\n\nconst activityCaptureKey: unique symbol = Symbol(\"sixb.activityCapture\")\n\ninterface ActivityCaptureOwner {\n  readonly [activityCaptureKey]?: ActivityCaptureRuntime\n}\n\nexport function registerActivityCaptureRuntime(\n  owner: object,\n  capture: ActivityCaptureRuntime\n): void {\n  Object.defineProperty(owner, activityCaptureKey, {\n    configurable: false,\n    enumerable: false,\n    value: capture,\n    writable: false,\n  })\n}\n\n/** The recording side of a bound SDK, such as a request's. */\nexport function getActivityCaptureRuntime(owner: object): ActivityCaptureRuntime {\n  const capture = (owner as ActivityCaptureOwner)[activityCaptureKey]\n  if (!capture) {\n    throw new Error(\"[Sixb] Activity capture is not registered for this execution.\")\n  }\n  return capture\n}\n\n/**\n * The session the batch came through, from verified authorization only. A browser never names an\n * actor, and an access token or a trusted primitive is not a visit.\n */\nfunction captureSource(runtime: SixbRuntimeContext): ActivitySource {\n  const ref = getAuthorizationRef(runtime.runtimeAuthorization)\n\n  if (\n    ref.type === \"principal\" &&\n    ref.principal.type === \"user\" &&\n    ref.credential?.type === \"session\"\n  ) {\n    return {\n      actor: { type: \"user\", userId: ref.principal.id },\n      sessionId: ref.credential.id,\n    }\n  }\n\n  if (ref.type === \"delegated\") {\n    return {\n      actor: { type: \"share\", grantId: ref.delegation.grantId },\n      sessionId: ref.delegation.sessionId,\n    }\n  }\n\n  throw new AuthorizationError(\n    \"activity.capture\",\n    \"[Sixb] Activity is recorded only for a signed-in user's session or a shared link's session.\"\n  )\n}\n\nasync function mapInChunks<T, R>(\n  items: readonly T[],\n  size: number,\n  map: (item: T) => Promise<R>\n): Promise<R[]> {\n  const results: R[] = []\n  for (let start = 0; start < items.length; start += size) {\n    const chunk = await Promise.all(items.slice(start, start + size).map(map))\n    results.push(...chunk)\n  }\n  return results\n}\n",
+    "import type { ExecutionContext, RuntimeAuthorization } from \"../../execution\"\nimport { ensureExecutionRecord, executionRecordInputFromRuntime } from \"../../execution/durable\"\nimport type { SixbHostContext } from \"../../runtime/types\"\nimport type { ModelExecutionAttempt } from \"./binding\"\nimport { requireAccountingCapabilities } from \"./model-call-accounting\"\nimport { createAiModelCallLimitController } from \"./model-call-limits\"\nimport { AiModelCallRecorder } from \"./model-call-recorder\"\nimport { enqueueAiModelCallRecovery } from \"./recovery-queue\"\n\n/** One accounting boundary shared by all model protocols in a bound execution. */\nexport class ModelExecutionSession {\n  private binding?: ModelExecutionAttempt\n  private recorder?: Promise<AiModelCallRecorder>\n\n  constructor(\n    private readonly runtime: SixbHostContext & { runtimeAuthorization: RuntimeAuthorization },\n    private readonly execution: ExecutionContext\n  ) {}\n\n  bind(input: ModelExecutionAttempt): void {\n    if (this.binding) throw new Error(\"[SixbModels] Execution attempt is already bound.\")\n    this.binding = { ...input }\n  }\n\n  signal(signal?: AbortSignal): AbortSignal {\n    const binding = this.requireBinding()\n    return signal ? AbortSignal.any([binding.signal, signal]) : binding.signal\n  }\n\n  async admitEmbeddingCall(admit: () => Promise<void>): Promise<void> {\n    const admission = this.requireBinding().embeddingAdmission\n    if (admission) await admission(admit)\n    else await admit()\n  }\n\n  accounting(): Promise<AiModelCallRecorder> {\n    const { accounting } = this.requireBinding()\n    this.recorder ??= accounting ? Promise.resolve(accounting) : this.createRecorder()\n    return this.recorder\n  }\n\n  private requireBinding(): ModelExecutionAttempt {\n    if (!this.binding) {\n      throw new Error(\n        \"[SixbModels] Model calls require a bound request or worker execution attempt.\"\n      )\n    }\n    return this.binding\n  }\n\n  private async createRecorder(): Promise<AiModelCallRecorder> {\n    const runtime = this.runtime\n    const execution = this.execution\n    const { attempt } = this.requireBinding()\n    const storage = {\n      ...requireAccountingCapabilities(runtime.storage),\n      transaction: runtime.storage.transaction.bind(runtime.storage),\n    }\n    const { requesterGroupIds } = await ensureExecutionRecord(\n      runtime.storage.executions,\n      executionRecordInputFromRuntime({\n        execution,\n        runtimeAuthorization: runtime.runtimeAuthorization,\n      })\n    )\n    return new AiModelCallRecorder({\n      storage,\n      projectId: runtime.projectId,\n      executionId: execution.id,\n      attempt,\n      requesterGroupIds,\n      limits: createAiModelCallLimitController({\n        storage,\n        projectId: runtime.projectId,\n        requestedBy: execution.requestedBy,\n        requesterGroupIds,\n      }),\n      recoverAiModelCall: (input) => enqueueAiModelCallRecovery(runtime.queues.agents, input),\n    })\n  }\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBA,IAAM,6BAA4C,OAAO,8BAA8B;AAMhF,SAAS,gCAA+B,CAC7C,OACA,SACM;AAAA,EACN,MAAM,aAAc,MAAuC;AAAA,EAC3D,IAAI,cAAc,eAAe,SAAS;AAAA,IACxC,MAAM,IAAI,MAAM,wEAAwE;AAAA,EAC1F;AAAA,EACA,OAAO,eAAe,OAAO,4BAA4B;AAAA,IACvD,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,OAAO;AAAA,IACP,UAAU;AAAA,EACZ,CAAC;AAAA;AAGI,SAAS,2BAA0B,CAAC,OAAwC;AAAA,EACjF,MAAM,UAAW,MAAuC;AAAA,EACxD,IAAI;AAAA,IAAS,OAAO;AAAA,EACpB,MAAM,IAAI,MAAM,8EAA8E;AAAA;AAIzF,SAAS,6BAA4B,CAAC,QAAgB,QAAsB;AAAA,EACjF,iCAAgC,QAAQ,4BAA2B,MAAM,CAAC;AAAA;AAIrE,SAAS,8BAA6B,CAAC,OAKlB;AAAA,EAC1B,MAAM,UAAU,CAAU,SACxB,KAAK,QAAQ,MAAM,uBAAuB,MAAM,mBAAmB,CAAC;AAAA,EAEtE,MAAM,UAAmC;AAAA,IACvC,qBAAqB,CAAC,WAAW,MAAM,aAAa,YAAY,UAAU,MAAM;AAAA,IAChF,aAAa,CAAC,YACZ,gBAAgB,MAAM,MAAM,aAAa,MAAM,OAAO,OAAO,GAAG,MAAM,oBAAoB;AAAA,IAC5F,mBAAmB,CAAC,YAClB,QACE,gBACE,MAAM,MAAM,aAAa,YAAY,QAAQ,OAAO,GACpD,MAAM,oBACR,CACF;AAAA,IACF,kBAAkB,CAAC,YAAY,QAAQ,MAAM,aAAa,YAAY,UAAU,OAAO,CAAC;AAAA,IACxF,iBAAiB,CAAC,YAChB,gBACE,MAAM,MAAM,aAAa,UAAU,OAAO,OAAO,GACjD,MAAM,oBACR;AAAA,EACJ;AAAA,EACA,OAAO,OAAO,OAAO,OAAO;AAAA;AAG9B,eAAe,eAAgE,CAC7E,QACA,QACkB;AAAA,EAClB,MAAM,SAAS,MAAM,OAAO;AAAA,EAC5B,IAAI,OAAO,aAAa;AAAA,IAAG,6BAA6B,MAAM;AAAA,EAC9D,OAAO;AAAA;AAGT,SAAS,4BAA4B,CAAC,QAA0B;AAAA,EAC9D,IAAI;AAAA,IACF,OAAO;AAAA,IACP,OAAO,OAAO;AAAA,IAGd,QAAQ,MAAM,yDAAyD,KAAK;AAAA;AAAA;AAIhF,SAAS,sBAAsB,CAAC,QAAwC;AAAA,EACtE,IAAI;AAAA,IACF,SAAS;AAAA,IACT,OAAO,OAAO;AAAA,IACd,QAAQ,MAAM,kDAAkD,KAAK;AAAA;AAAA;;;ACpGzE,IAAM,WAAmD;AAAA,EACvD,CAAC,uBAAuB,MAAM;AAAA,EAC9B,CAAC,qBAAqB,OAAO;AAAA,EAC7B,CAAC,sBAAsB,kBAAkB;AAAA,EACzC,CAAC,yBAAyB,SAAS;AAAA,EACnC,CAAC,gDAAgD,QAAQ;AAAA,EACzD,CAAC,iCAAiC,QAAQ;AAC5C;AAEA,IAAM,UAAkD;AAAA,EACtD,CAAC,eAAe,SAAS;AAAA,EACzB,CAAC,YAAY,QAAQ;AAAA,EACrB,CAAC,uBAAuB,KAAK;AAAA,EAC7B,CAAC,eAAe,SAAS;AAAA,EACzB,CAAC,YAAY,UAAU;AAAA,EACvB,CAAC,8BAA8B,OAAO;AAAA,EACtC,CAAC,aAAa,OAAO;AACvB;AAGO,SAAS,iBAAiB,CAAC,WAA+C;AAAA,EAC/E,IAAI,CAAC,WAAW;AAAA,IACd,OAAO,CAAC;AAAA,EACV;AAAA,EAEA,MAAM,UAAU,SAAS,KAAK,EAAE,aAAa,QAAQ,KAAK,SAAS,CAAC,IAAI;AAAA,EACxE,MAAM,KAAK,QAAQ,KAAK,EAAE,aAAa,QAAQ,KAAK,SAAS,CAAC,IAAI;AAAA,EAElE,OAAO;AAAA,OACD,YAAY,YAAY,CAAC,IAAI,EAAE,QAAQ;AAAA,OACvC,OAAO,YAAY,CAAC,IAAI,EAAE,GAAG;AAAA,EACnC;AAAA;;;ACwBF,eAAsB,uBAAuB,CAC3C,SACA,SACA,OACA,KACkC;AAAA,EAClC,QAAQ,QAAQ,OAAO,WAAW,QAAQ,iBAAiB,KAAK;AAAA,EAChE,MAAM,WAAW,QAAQ,QAAQ,MAAM;AAAA,EACvC,IAAI,CAAC,UAAU;AAAA,IACb,OAAO,EAAE,aAAa,CAAC,EAAE;AAAA,EAC3B;AAAA,EAEA,MAAM,OAAO,MAAM,SAAS,aAAa;AAAA,IACvC,WAAW,QAAQ;AAAA,IACnB;AAAA,IACA;AAAA,OACI,WAAW,YAAY,CAAC,IAAI,EAAE,OAAO;AAAA,EAC3C,CAAC;AAAA,EACD,MAAM,SAAS,MAAM,QAAQ,cAAc;AAAA,IACzC;AAAA,IACA,YAAY,KAAK,SAAS,IAAI,CAAC,YAAY,QAAQ,EAAE;AAAA,EACvD,CAAC;AAAA,EACD,MAAM,YAAY,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,WAAW,KAAK,CAAC,CAAC;AAAA,EAEzE,MAAM,cAAc,KAAK,SAAS,IAAI,CAAC,aAAa;AAAA,OAC/C,kBAAkB,SAAS,GAAG;AAAA,IACjC,QAAQ,UAAU,IAAI,QAAQ,EAAE,GAAG,UAAU;AAAA,IAC7C,cAAc,UAAU,IAAI,QAAQ,EAAE,GAAG,UAAU,CAAC;AAAA,EACtD,EAAE;AAAA,EACF,MAAM,OAAO,KAAK,SAAS,GAAG,EAAE;AAAA,EAEhC,OAAO;AAAA,IACL;AAAA,OACI,KAAK,WAAW,OAChB,EAAE,YAAY,sBAAsB,KAAK,UAAU,MAAM,MAAM,EAAE,IACjE,CAAC;AAAA,EACP;AAAA;AAOF,SAAS,qBAAqB,CAC5B,UACA,MACA,QACQ;AAAA,EACR,QAAQ,cAAc;AAAA,EACtB,MAAM,OAAO,SAAS,OAAO,CAAC,YAAY,QAAQ,UAAU,QAAQ,MAAM,UAAU,QAAQ,CAAC;AAAA,EAC7F,MAAM,UAAU,UAAU,OAAO,UAAU,QAAQ,MAAM,UAAU,QAAQ,IAAI,OAAO,OAAO;AAAA,EAE7F,OAAO,gCAAgC,EAAE,WAAW,MAAM,UAAU,KAAK,OAAO,CAAC;AAAA;AAG5E,SAAS,+BAA+B,CAAC,QAA2C;AAAA,EACzF,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,OAAO,UAAU,YAAY,GAAG,OAAO,IAAI,CAAC,CAAC,EAAE,SAChF,WACF;AAAA;AAGK,SAAS,+BAA+B,CAAC,OAA0C;AAAA,EACxF,IAAI;AAAA,IACF,MAAM,SAAkB,KAAK,MAAM,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,MAAM,CAAC;AAAA,IACnF,IAAI,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,GAAG;AAAA,MAChD,OAAO,IAAI,QAAQ;AAAA,MACnB,MAAM,YAAY,IAAI,KAAK,OAAO,OAAO,WAAW,KAAK,OAAO,GAAG;AAAA,MACnE,IAAI,OAAO,SAAS,UAAU,QAAQ,CAAC,KAAK,OAAO,cAAc,IAAI,KAAK,QAAQ,GAAG;AAAA,QACnF,OAAO,EAAE,WAAW,KAAK;AAAA,MAC3B;AAAA,IACF;AAAA,IACA,MAAM;AAAA,EAGR,MAAM,IAAI,MAAM,6CAA6C;AAAA;AAO/D,eAAsB,sBAAsB,CAC1C,SACA,MACA,OACA,KACyC;AAAA,EACzC,QAAQ,SAAS,cAAc;AAAA,EAC/B,QAAQ,UAAU,KAAK;AAAA,EAEvB,IAAI,MAAM,SAAS,QAAQ;AAAA,IACzB,MAAM,UAAU,MAAM,QAAQ,MAAM,SAAS,QAAQ,EAAE,WAAW,IAAI,KAAK,UAAU,CAAC;AAAA,IACtF,OAAO,UAAU,kBAAkB,SAAS,GAAG,IAAI;AAAA,EACrD;AAAA,EAEA,MAAM,UAAU,MAAM,QAAQ,eAAe,QAAQ,EAAE,WAAW,IAAI,KAAK,UAAU,CAAC;AAAA,EACtF,IAAI,CAAC,SAAS;AAAA,IACZ;AAAA,EACF;AAAA,EAGA,MAAM,YAAY,CAAC,QAAQ,WAAW,OAAO,SAAS,EACnD,QAAQ,CAAC,OAAQ,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAE,EACxD,KAAK,CAAC,MAAM,UAAU,OAAO,KAAK,EAAE;AAAA,EACvC,MAAM,WAAW;AAAA,IACf,iBAAiB,SAAS,GAAG;AAAA,IAC7B,GAAI,QAAQ,CAAC,iBAAiB,OAAO,GAAG,CAAC,IAAI,CAAC;AAAA,EAChD;AAAA,EACA,MAAM,SAAS,SAAS,SAAS,SAAS,IACtC,YACA,SAAS,SAAS,SAAS,IACzB,YACA;AAAA,EAEN,OAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,MAAM;AAAA,OACX,QAAQ,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,IACpD;AAAA,IACA,WAAW,IAAI,KAAK,QAAQ,SAAS;AAAA,OACjC,cAAc,YAAY,CAAC,IAAI,EAAE,WAAW,IAAI,KAAK,SAAS,EAAE;AAAA,EACtE;AAAA;AAGF,SAAS,gBAAgB,CACvB,SAKA,KAC0B;AAAA,EAC1B,IAAI,QAAQ,WAAW;AAAA,IACrB,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,UACJ,QAAQ,aAAa,OACpB,QAAQ,sBAAsB,aAAa,QAAQ,qBAAqB;AAAA,EAC3E,OAAO,UAAU,YAAY;AAAA;AAI/B,SAAS,iBAAiB,CAAC,SAAwB,KAAsC;AAAA,EACvF,OAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ,kBAAkB,QAAQ,SAAS;AAAA,OACvC,QAAQ,WAAW,YAAY,CAAC,IAAI,EAAE,YAAY,QAAQ,OAAO,WAAW;AAAA,IAChF,QAAQ,iBAAiB,SAAS,GAAG;AAAA,IACrC,WAAW,IAAI,KAAK,QAAQ,SAAS;AAAA,OACjC,QAAQ,eAAe,YAAY,CAAC,IAAI,EAAE,YAAY,IAAI,KAAK,QAAQ,UAAU,EAAE;AAAA,OACnF,QAAQ,cAAc,YAAY,CAAC,IAAI,EAAE,WAAW,IAAI,KAAK,QAAQ,SAAS,EAAE;AAAA,EACtF;AAAA;;;ACrMF,eAAsB,gBAAgB,CACpC,SACA,QACuC;AAAA,EACvC,MAAM,SAAS,MAAM,WAAW,SAAS,MAAM;AAAA,EAC/C,OAAO,OAAO,IAAI,CAAC,UAAU,UAAU,OAAO,MAAM,CAAC;AAAA;AAIvD,eAAsB,eAAe,CACnC,SACA,OACmF;AAAA,EACnF,MAAM,SAAS,MAAM,WAAW,SAAS,CAAC,KAAK,CAAC;AAAA,EAChD,MAAM,QAAQ,MAAM,MAAM,SAAS,UAAU,OAAO,IAAI,MAAM,MAAM,OAAO,IAAI;AAAA,EAE/E,OAAO,EAAE,OAAO,UAAU,OAAO,MAAM,MAAO,UAAU,YAAY,CAAC,IAAI,EAAE,MAAM,EAAG;AAAA;AAGtF,eAAe,UAAU,CACvB,SACA,QACgD;AAAA,EAChD,MAAM,MAAM,OAAO,QAAQ,CAAC,UAAW,MAAM,MAAM,SAAS,UAAU,CAAC,MAAM,MAAM,OAAO,IAAI,CAAC,CAAE;AAAA,EACjG,IAAI,IAAI,WAAW,KAAK,CAAC,QAAQ,QAAQ,aAAa;AAAA,IACpD,OAAO,IAAI;AAAA,EACb;AAAA,EAEA,MAAM,SAAS,MAAM,QAAQ,QAAQ,YAAY,SAAS,EAAE,WAAW,QAAQ,WAAW,IAAI,CAAC;AAAA,EAC/F,OAAO,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;AAAA;AAGzD,SAAS,SAAS,CAChB,OACA,QACmB;AAAA,EACnB,QAAQ,UAAU;AAAA,EAClB,MAAM,QAAQ,MAAM,SAAS,UAAU,OAAO,IAAI,MAAM,OAAO,IAAI;AAAA,EACnE,IAAI,MAAM,SAAS,WAAW,UAAU,WAAW;AAAA,IACjD,OAAO;AAAA,EACT;AAAA,EAEA,OAAO,KAAK,OAAO,OAAO,KAAK,OAAO,cAAc,MAAM,aAAa,EAAE;AAAA;;;ACxDpE,SAAS,WAAW,CAAC,QAAe,SAAwB;AAAA,EACjE,MAAM,IAAI,MAAM,OAAO;AAAA;;;ACGlB,SAAS,eAAuC,CACrD,KACA,WACM;AAAA,EACN,OAAO,UAAU,KAAK,WAAW,IAAI;AAAA;AAUhC,SAAS,oBAA4C,CAC1D,KACA,WACM;AAAA,EACN,OAAO,UAAU,KAAK,WAAW,KAAK;AAAA;AAOjC,SAAS,gBAAgB,CAAC,KAAgB,WAAoC;AAAA,EACnF,MAAM,SAAS,UAAU,iBAAiB,IAAI,YAAY;AAAA,EAC1D,IAAI,WAAW;AAAA,IAAW,IAAI,aAAa,OAAO;AAAA,EAElD,IAAI,IAAI,UAAU;AAAA,IAAW;AAAA,EAE7B,WAAW,SAAS,OAAO,OAAO,IAAI,KAAK,GAAG;AAAA,IAC5C,IAAI,UAAU;AAAA,MAAM;AAAA,IACpB,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,MACxB,WAAW,UAAU;AAAA,QAAO,iBAAiB,QAAQ,SAAS;AAAA,IAChE,EAAO;AAAA,MACL,iBAAiB,OAA4B,SAAS;AAAA;AAAA,EAE1D;AAAA;AAGF,SAAS,SAAiC,CACxC,KACA,WACA,gBACM;AAAA,EACN,MAAM,SAAS,UAAU,iBAAiB,IAAI,YAAY;AAAA,EAC1D,MAAM,QAAQ,IAAI;AAAA,EAClB,IAAI,WAAW,aAAa,UAAU;AAAA,IAAW,OAAO;AAAA,EAExD,MAAM,WAAiB,KAAK,IAAI;AAAA,EAChC,IAAI,WAAW,WAAW;AAAA,IACxB,SAAS,aAAa,YAAY,IAAI,YAAY,OAAO,GAAG;AAAA,IAC5D,IAAI;AAAA,MAAgB,SAAS,aAAa,OAAO;AAAA,EACnD;AAAA,EAEA,IAAI,UAAU,WAAW;AAAA,IACvB,SAAS,QAAQ,OAAO,YACtB,OAAO,QAAQ,KAAK,EAAE,IAAI,EAAE,QAAQ,WAAW;AAAA,MAC7C;AAAA,MACA,gBAAgB,OAAO,WAAW,cAAc;AAAA,IAClD,CAAC,CACH;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,eAAe,CACtB,OACA,WACA,gBACmB;AAAA,EACnB,IAAI,UAAU;AAAA,IAAM,OAAO;AAAA,EAC3B,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,OAAO,MAAM,IAAI,CAAC,QAAQ,UAAU,KAAK,WAAW,cAAc,CAAC;AAAA,EACrE;AAAA,EAGA,OAAO,UAAU,OAA4B,WAAW,cAAc;AAAA;AAOjE,SAAS,iBAAiB,CAC/B,OACA,WACmB;AAAA,EACnB,IAAI,MAAM,UAAU;AAAA,IAAW,OAAO;AAAA,EAEtC,MAAM,SAAS,UAAU,iBAAiB,MAAM,QAAQ,YAAY;AAAA,EACpE,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EAEjC,IAAI,MAAM,SAAS,kBAAkB;AAAA,IACnC,OAAO;AAAA,SACF;AAAA,MACH,SAAS;AAAA,WACJ,MAAM;AAAA,QACT,iBAAiB,YAAY,MAAM,QAAQ,iBAAiB,OAAO,GAAG;AAAA,QACtE,YAAY,OAAO;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,OACF;AAAA,IACH,SAAS;AAAA,SACJ,MAAM;AAAA,MACT,YAAY,YAAY,MAAM,QAAQ,YAAY,OAAO,GAAG;AAAA,MAC5D,iBAAiB,YAAY,MAAM,QAAQ,iBAAiB,OAAO,GAAG;AAAA,MACtE,YAAY,OAAO;AAAA,IACrB;AAAA,EACF;AAAA;AASF,SAAS,WAAmB,CAC1B,QACA,QACwB;AAAA,EACxB,MAAM,OAA+B,KAAK,OAAO;AAAA,EACjD,WAAW,OAAO;AAAA,IAAQ,OAAO,KAAK;AAAA,EACtC,OAAO;AAAA;;;AC1HF,SAAS,6BAA6B,CAC3C,WAC8B;AAAA,EAG9B,MAAM,eAAe,IAAI;AAAA,EACzB,MAAM,QAAQ,CAAC,kBAAgE;AAAA,IAC7E,MAAM,UAAU,OAAO,OAAO,CAAC,CAAC;AAAA,IAChC,aAAa,IAAI,SAAS,OAAO,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;AAAA,IAC3D,OAAO;AAAA;AAAA,EAGT,MAAM,UAAU,CAAC,UAAwD;AAAA,IACvE,MAAM,gBAAgB,aAAa,IAAI,KAAK;AAAA,IAC5C,IAAI,CAAC,eAAe;AAAA,MAClB,MAAM,IAAI,MAAM,sEAAsE;AAAA,IACxF;AAAA,IACA,OAAO;AAAA;AAAA,EAGT,MAAM,QAAQ,MAAM,CAAC,CAAC;AAAA,EAEtB,MAAM,YAA0C;AAAA,IAC9C,OAAO,MAAM;AAAA,IAEb,QAAQ,CAAC,WAAW;AAAA,MAClB,OAAO,MAAM,MAAM,OAAO,aAAa;AAAA,SACpC,OAAO,oBAAoB,WAAW,MAAM,OAAO,aAAa,CAAC;AAAA,IACtE;AAAA,IACA,MAAM,CAAC,UAAU;AAAA,MAEf,MAAM,gBACJ,MAAM,cAAc,aAChB,QAAQ,MAAM,KAAK,IACnB;AAAA,QACE,GAAG,MAAM,OAAO;AAAA,QAChB,GAAI,MAAM,qBAAqB,CAAC,MAAM,kBAAkB,IAAI,CAAC;AAAA,MAC/D;AAAA,MAEN,MAAM,OAAO,cACV,IAAI,CAAC,iBAAiB,UAAU,eAAe,cAAc,MAAM,MAAM,CAAC,EAC1E,KAAK,CAAC,eAAe,eAAe,SAAS;AAAA,MAEhD,OAAO;AAAA,QACL,OAAO,MAAM,MAAM,OAAO,aAAa;AAAA,WACpC,OAAO,QAAQ,oBAAoB,WAAW,MAAM,OAAO,aAAa,CAAC;AAAA,MAC9E;AAAA;AAAA,IAGF,KAAK,CAAC,UACJ,MAAM,OAAO,aACR,MAAM,OAAO,MAAM,QACpB,MAAM,CAAC,GAAG,IAAI,IAAI,MAAM,OAAO,QAAQ,OAAO,CAAC,CAAC,CAAC;AAAA,IACvD,UAAU,CAAC,UAAU;AAAA,MACnB,IAAI,MAAM,QAAQ;AAAA,QAAW;AAAA,MAE7B,MAAM,gBACJ,MAAM,iBAAiB,YAAY,QAAQ,MAAM,KAAK,IAAI,CAAC,MAAM,YAAY;AAAA,MAC/E,WAAW,gBAAgB,eAAe;AAAA,QACxC,MAAM,UAAU,UAAU,eAAe,cAAc,MAAM,UAAU;AAAA,QACvE,IAAI,YAAY;AAAA,UAAW;AAAA,QAC3B,OAAO,IAAI,oBACT,qBAAqB,WACrB,iBAAiB,mBAAmB,MAAM,SAAS,gBAAgB,MAAM,mBAAmB,MAAM,6CAA6C,WACjJ;AAAA,MACF;AAAA,MAEA;AAAA;AAAA,EAEJ;AAAA,EAEA,OAAO,OAAO,OAAO,SAAS;AAAA;AAGhC,SAAS,mBAAmB,CAC1B,WACA,eACwB;AAAA,EACxB,WAAW,gBAAgB,eAAe;AAAA,IACxC,MAAM,aAAa,UAAU,eAAe,YAAY;AAAA,IACxD,IAAI;AAAA,MAAY,OAAO;AAAA,EACzB;AAAA,EACA;AAAA;AAGF,SAAS,MAAM,CAAC,YAAiE;AAAA,EAC/E,OAAO,aAAa,EAAE,QAAQ,gBAAgB,UAAU,EAAE,IAAI,CAAC;AAAA;AAGjE,IAAM,qBAAuE;AAAA,EAC3E,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,SAAS;AAAA,EACT,kBAAkB;AAAA,EAClB,OAAO;AACT;;;AClGO,SAAS,uBAAuB,CAAC,OAO/B;AAAA,EACP,QAAQ,UAAU,cAAc;AAAA,EAChC,QAAQ,OAAO,UAAU,UAAU,WAAW;AAAA,EAC9C,IAAI,MAAM,SAAS,KAAK,MAAM,WAAW;AAAA,IAAG;AAAA,EAE5C,MAAM,YAAY,0BAChB,KAAK,MAAM,SAAS,OAAO,MAAM,MAAM,GACvC,EAAE,SAAS,CACb;AAAA,EAEA,MAAM,WAAW,UAAU,UAAU,OAAO;AAAA,EAC5C,MAAM,WAAW,UAAU,cAAc;AAAA,EACzC,MAAM,WAAW,UAAU,cAAc;AAAA,EAEzC,MAAM,QAAQ,CAAC,WAAmB,UAAU,WAAW,aAAa,UAAU,WAAW;AAAA,EACzF,MAAM,UAAU,CAAC,UAAsC,kBACpD,OAAO,aAAa,WAAW,CAAC,QAAQ,IAAI,UAAU,KAAK,CAAC,WAC3D,SAAS,kBAAkB,QAAQ,YAAY,CACjD;AAAA,EAEF,WAAW,QAAQ,OAAO;AAAA,IACxB,IAAI,CAAC,MAAM,KAAK,MAAM;AAAA,MAAG;AAAA,IACzB,IACG,YAAY,SAAS,SAAS,KAAK,YAAY,KAC/C,YAAY,SAAS,KAAK,CAAC,OAAO,QAAQ,KAAK,oBAAoB,EAAE,CAAC,GACvE;AAAA,MACA,MAAM,gBAAgB,IAAI;AAAA,IAC5B;AAAA,EACF;AAAA,EAEA,MAAM,SAAS,CAAC,GAAG,KAAK,EAAE,OAAO,EAAE,QAAQ,MAAM,iBAAiB,EAAE,CAAC;AAAA,EACrE,IAAI,OAAO,WAAW;AAAA,IAAG;AAAA,EAEzB,WAAW,cAAc,SAAS,gBAAgB,GAAG;AAAA,IACnD,WAAW,QAAQ,WAAW,OAAO;AAAA,MACnC,IAAI,CAAC,MAAM,KAAK,EAAE;AAAA,QAAG;AAAA,MACrB,IAAI,YAAY,SAAS,SAAS,WAAW,EAAE,GAAG;AAAA,QAChD,MAAM,QAAQ,OAAO,KAAK,EAAE,QAAQ,QAAQ,KAAK,oBAAoB,EAAE,CAAC;AAAA,QACxE,IAAI;AAAA,UAAO,MAAM,gBAAgB,MAAM,EAAE;AAAA,MAC3C;AAAA,MAEA,MAAM,SAAS,MAAM,IAAI,WAAW,EAAE;AAAA,MACtC,IACE,YACA,UACA,MAAM,iBAAiB,WAAW,EAAE,KACpC,SAAS,KAAK,CAAC,OAAO,QAAQ,KAAK,oBAAoB,EAAE,CAAC,GAC1D;AAAA,QACA,MAAM,gBAAgB,MAAM;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAAA;;;ACvEF,IAAM,yCAAyC;AAC/C,IAAM,yCAAyC;AAC/C,IAAM,uDAAuD;AAAA;AAc7D,MAAM,8CAA8C,MAAM;AAAA,EAK7C;AAAA,EACA;AAAA,EALF,OAAO;AAAA,EACP,OAAO;AAAA,EAEhB,WAAW,CACA,QACA,OACT;AAAA,IACA,MAAM,mDAAmD,iBAAiB,SAAS;AAAA,IAH1E;AAAA,IACA;AAAA;AAIb;AAGO,SAAS,iCAAiC,CAC/C,OACA,WAC+B;AAAA,EAC/B,MAAM,cAAc,MAAM;AAAA,EAC1B,MAAM,iBAAiB,MAAM;AAAA,EAC7B,IAAI,CAAC,OAAO,cAAc,WAAW,KAAK,cAAc,GAAG;AAAA,IACzD,MAAM,IAAI,MAAM,+EAA+E;AAAA,EACjG;AAAA,EACA,IACE,mBAAmB,cAClB,CAAC,OAAO,cAAc,cAAc,KAAK,iBAAiB,IAC3D;AAAA,IACA,MAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AAAA,EAEA,IAAI,CAAC,WAAW;AAAA,IACd,MAAM,YACJ,mBAAmB,YAAY,CAAC,IAAI,EAAE,eAAe;AAAA,IACvD,OAAO,OAAO,OAAO,SAAS;AAAA,EAChC;AAAA,EACA,IAAI,cAAc,wCAAwC;AAAA,IACxD,MAAM,IAAI,sCACR,UACA,sCACF;AAAA,EACF;AAAA,EACA,IAAI,gBAAgB,GAAG;AAAA,IACrB,OAAO,OAAO,OAAO;AAAA,SACf,mBAAmB,YAAY,CAAC,IAAI,EAAE,eAAe;AAAA,MACzD,qBAAqB;AAAA,IACvB,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,oBAAoB,KAAK,MAAM,yCAAyC,WAAW;AAAA,EACzF,MAAM,0BACJ,kBACA,KAAK,IAAI,sDAAsD,iBAAiB;AAAA,EAClF,IAAI,0BAA0B,mBAAmB;AAAA,IAC/C,MAAM,IAAI,sCACR,UACA,sCACF;AAAA,EACF;AAAA,EAEA,OAAO,OAAO,OAAO;AAAA,IACnB,gBAAgB;AAAA,IAChB,qBAAqB;AAAA,EACvB,CAAC;AAAA;;;ACxBI,SAAS,4BAA4B,CAAC,OAIlB;AAAA,EACzB,MAAM,iBAAiB,MAAM,SAAS,gBAAgB;AAAA,EACtD,MAAM,0BAA0B,IAAI,IAAI,eAAe,IAAI,CAAC,eAAe,WAAW,EAAE,CAAC;AAAA,EACzF,MAAM,yBAAyB,sBAAsB,MAAM,WAAW,cAAc;AAAA,EACpF,MAAM,uBAAuB,IAAI,IAC/B,CAAC,GAAG,sBAAsB,EAAE,OAAO,CAAC,iBAAiB,wBAAwB,IAAI,YAAY,CAAC,CAChG;AAAA,EACA,MAAM,iBACJ,MAAM,UAAU,SAAS,aAAa,sBAAsB,MAAM,UAAU,KAAK,IAAI;AAAA,EACvF,MAAM,uBAAuD,CAAC;AAAA,EAE9D,WAAW,cAAc,gBAAgB;AAAA,IACvC,IAAI,CAAC,qBAAqB,IAAI,WAAW,EAAE;AAAA,MAAG;AAAA,IAC9C,MAAM,cACJ,gBAAgB,wBAAwB,IAAI,WAAW,EAAE,KACzD,IAAI,IAAI,WAAW,WAAW,IAAI,CAAC,aAAa,SAAS,EAAE,CAAC;AAAA,IAC9D,MAAM,QAAQ,iBACT,eAAe,kBAAkB,IAAI,WAAW,EAAE,KAAK,IAAI,MAC5D,MAAM,UAAU,SAAS,QACvB,iBAAiB,UAAU,IAC3B,gBAAgB,MAAM,UAAU,YAAY,oBAAoB;AAAA,IACtE,qBAAqB,KACnB,kBAAkB;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,YACE,MAAM,UAAU,SAAS,QACrB,aACA,MAAM,UAAU,SAAS,UACvB,cACA;AAAA,MACR,iBAAiB,MAAM,UAAU,SAAS;AAAA,IAC5C,CAAC,CACH;AAAA,EACF;AAAA,EAEA,MAAM,cAAc;AAAA,EACpB,MAAM,kBAAkB,IAAI,IAAI,YAAY,IAAI,CAAC,eAAe,CAAC,WAAW,IAAI,UAAU,CAAC,CAAC;AAAA,EAC5F,MAAM,iBACJ,MAAM,UAAU,SAAS,aACrB,yBAAyB,MAAM,SAAS,kBAAkB,GAAG,WAAW,IACxE,sBAAsB,MAAM,SAAS,kBAAkB,CAAC;AAAA,EAC9D,MAAM,UAAU,CAAI,OAAU,cAAuB,UAAa;AAAA,IAChE,MAAM,0BAA0B,WAAW;AAAA,IAC3C,OAAO;AAAA;AAAA,EAET,MAAM,kBAAkB,CAAC,eAA6C,gBAAgB,UAAU;AAAA,EAChG,MAAM,kBAAkB,MACtB,IAAI,IACF,CAAC,GAAG,cAAc,EAAE,IAAI,EAAE,aAAa,eAAe;AAAA,IACpD;AAAA,IACA,gBAAgB,SAAS;AAAA,EAC3B,CAAC,CACH;AAAA,EAEF,OAAO,OAAO,OAAO;AAAA,IACnB,iBAAiB,MAAM,QAAQ,YAAY,IAAI,eAAe,CAAC;AAAA,IAC/D,mBAAmB,CAAC,iBAAyB;AAAA,MAC3C,MAAM,aAAa,gBAAgB,IAAI,YAAY;AAAA,MACnD,OAAO,QAAQ,aAAa,gBAAgB,UAAU,IAAI,IAAI;AAAA;AAAA,IAEhE,mBAAmB,CAAC,iBAAyB;AAAA,MAC3C,MAAM,aAAa,gBAAgB,IAAI,YAAY;AAAA,MACnD,OAAO,aAAa,QAAQ,gBAAgB,UAAU,CAAC,IAAI,kBAAkB,YAAY;AAAA;AAAA,IAE3F,mBAAmB,MAAM;AAAA,MACvB,MAAM,aAAa,gBAAgB;AAAA,MACnC,OAAO,QAAQ,YAAY,CAAC,GAAG,WAAW,QAAQ,CAAC,CAAC;AAAA;AAAA,IAEtD,sBAAsB,CAAC,iBAAyB;AAAA,MAC9C,MAAM,aAAa,gBAAgB,IAAI,YAAY;AAAA,MACnD,IAAI,CAAC;AAAA,QAAY,OAAO,kBAAkB,YAAY;AAAA,MACtD,MAAM,UAAU,WAAW,WAAW,KAAK,CAAC,aAAa,SAAS,OAAO;AAAA,MACzE,IAAI,CAAC,SAAS;AAAA,QACZ,MAAM,IAAI,yBACR,uBAAuB,6EACzB;AAAA,MACF;AAAA,MACA,OAAO,QAAQ,QAAQ,EAAE;AAAA;AAAA,IAE3B,cAAc,CAAC,iBAAyB;AAAA,MACtC,MAAM,WAAW,qBAAqB,IAAI,YAAY,IAClD,MAAM,SACH,aAAa,YAAY,EACzB,OAAO,CAAC,cAAc,qBAAqB,IAAI,SAAS,CAAC,IAC5D,CAAC;AAAA,MACL,OAAO,QAAQ,QAAQ;AAAA;AAAA,IAEzB,mBAAmB,CAAC,UAA6B,WAAmB;AAAA,MAClE,IAAI,MAAM,UAAU,SAAS,OAAO;AAAA,QAClC,OAAO,QAAQ,MAAM,SAAS,kBAAkB,UAAU,MAAM,CAAC;AAAA,MACnE;AAAA,MACA,IAAI,CAAC,qBAAqB,IAAI,MAAM;AAAA,QAAG,OAAO,QAAQ,KAAK;AAAA,MAC3D,MAAM,gBAAgB,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,QAAQ;AAAA,MACpE,IAAI,MAAM,UAAU,SAAS,YAAY;AAAA,QACvC,OAAO,QACL,cAAc,KAAK,CAAC,iBAAiB,iBAAiB,OAAO,iBAAiB,MAAM,CACtF;AAAA,MACF;AAAA,MACA,OAAO,QACL,cAAc,KACZ,CAAC,iBACC,iBAAiB,OAChB,qBAAqB,IAAI,YAAY,KACpC,MAAM,SAAS,kBAAkB,cAAc,MAAM,CAC3D,CACF;AAAA;AAAA,EAEJ,CAAC;AAAA;AAGH,SAAS,qBAAqB,CAC5B,WACA,gBACqB;AAAA,EACrB,QAAQ,UAAU;AAAA,SACX;AAAA,MACH,OAAO,IAAI,IAAI,eAAe,IAAI,CAAC,eAAe,WAAW,EAAE,CAAC;AAAA,SAC7D;AAAA,MACH,OAAO,IAAI,IAAI,UAAU,aAAa;AAAA,SACnC;AAAA,MACH,OAAO,IAAI,IAAI,UAAU,MAAM,QAAQ,IAAI,CAAC,WAAW,OAAO,YAAY,CAAC;AAAA;AAAA;AAIjF,SAAS,qBAAqB,CAAC,OAAwD;AAAA,EACrF,MAAM,0BAA0B,IAAI;AAAA,EACpC,WAAW,UAAU,MAAM,SAAS;AAAA,IAClC,MAAM,aAAa,wBAAwB,IAAI,OAAO,YAAY,KAAK,IAAI;AAAA,IAC3E,WAAW,cAAc,OAAO;AAAA,MAAa,WAAW,IAAI,UAAU;AAAA,IACtE,wBAAwB,IAAI,OAAO,cAAc,UAAU;AAAA,EAC7D;AAAA,EAEA,MAAM,oBAAoB,IAAI;AAAA,EAC9B,WAAW,QAAQ,MAAM,OAAO;AAAA,IAC9B,MAAM,QAAQ,kBAAkB,IAAI,KAAK,kBAAkB,KAAK,IAAI;AAAA,IACpE,MAAM,WAAW,MAAM,IAAI,KAAK,MAAM,KAAK;AAAA,MACzC,qBAAqB,IAAI;AAAA,MACzB,aAAa,IAAI;AAAA,IACnB;AAAA,IACA,SAAS,oBAAoB,IAAI,KAAK,kBAAkB;AAAA,IACxD,WAAW,cAAc,KAAK;AAAA,MAAa,SAAS,YAAY,IAAI,UAAU;AAAA,IAC9E,MAAM,IAAI,KAAK,QAAQ,QAAQ;AAAA,IAC/B,kBAAkB,IAAI,KAAK,oBAAoB,KAAK;AAAA,EACtD;AAAA,EAEA,OAAO,EAAE,yBAAyB,kBAAkB;AAAA;AAGtD,SAAS,gBAAgB,CACvB,YACoC;AAAA,EACpC,OAAO,IAAI,IACT,WAAW,MAAM,IAAI,CAAC,SAAS;AAAA,IAC7B,KAAK;AAAA,IACL;AAAA,MACE,qBAAqB,IAAI,IACvB,OAAO,KAAK,uBAAuB,WAC/B,CAAC,KAAK,kBAAkB,IACxB,KAAK,kBACX;AAAA,MACA,aAAa,IAAI,IAAI,KAAK,YAAY,IAAI,CAAC,aAAa,SAAS,EAAE,KAAK,CAAC,CAAC;AAAA,IAC5E;AAAA,EACF,CAAC,CACH;AAAA;AAGF,SAAS,eAAe,CACtB,UACA,YACA,sBACoC;AAAA,EACpC,MAAM,QAAQ,IAAI;AAAA,EAClB,WAAW,QAAQ,WAAW,OAAO;AAAA,IACnC,MAAM,sBAAsB,IAAI,IAC9B,CAAC,GAAG,oBAAoB,EAAE,OAAO,CAAC,uBAChC,SAAS,kBAAkB,KAAK,oBAAoB,kBAAkB,CACxE,CACF;AAAA,IACA,IAAI,oBAAoB,SAAS;AAAA,MAAG;AAAA,IACpC,MAAM,IAAI,KAAK,IAAI;AAAA,MACjB;AAAA,MACA,aAAa,IAAI,IAAI,KAAK,YAAY,IAAI,CAAC,aAAa,SAAS,EAAE,KAAK,CAAC,CAAC;AAAA,IAC5E,CAAC;AAAA,EACH;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,iBAAiB,CAAC,OAQM;AAAA,EAC/B,MAAM,aAAa,MAAM,WAAW,WACjC,OAAO,CAAC,aAAa,MAAM,YAAY,IAAI,SAAS,EAAE,CAAC,EACvD,IAAI,gBAAgB;AAAA,EACvB,MAAM,qBAAqB,IAAI,IAAI,WAAW,IAAI,CAAC,aAAa,SAAS,EAAE,CAAC;AAAA,EAC5E,MAAM,QAAQ,MAAM,WAAW,MAAM,QAAQ,CAAC,SAAuB;AAAA,IACnE,MAAM,WAAW,MAAM,MAAM,IAAI,KAAK,EAAE;AAAA,IACxC,IAAI,CAAC;AAAA,MAAU,OAAO,CAAC;AAAA,IACvB,IAAI,MAAM,eAAe,YAAY;AAAA,MACnC,OAAO,CAAC,aAAa,MAAM,mBAAmB,KAAK,kBAAkB,GAAG,SAAS,WAAW,CAAC;AAAA,IAC/F;AAAA,IACA,MAAM,sBAAsB,IAAI,IAC9B,CAAC,GAAG,SAAS,mBAAmB,EAAE,OAChC,CAAC,uBACC,MAAM,qBAAqB,IAAI,kBAAkB,KACjD,MAAM,SAAS,kBAAkB,KAAK,oBAAoB,kBAAkB,CAChF,CACF;AAAA,IACA,IAAI,oBAAoB,SAAS;AAAA,MAAG,OAAO,CAAC;AAAA,IAC5C,MAAM,SACJ,MAAM,eAAe,cACjB,qBAAqB,MAAM,qBAAqB,MAAM,oBAAoB,IAC1E,iBAAiB,mBAAmB;AAAA,IAC1C,OAAO,CAAC,aAAa,MAAM,QAAQ,SAAS,aAAa,EAAE,qBAAqB,KAAK,CAAC,CAAC;AAAA,GACxF;AAAA,EAGD,MAAM,YAAwB;AAAA,IAC5B,IAAI,MAAM,WAAW;AAAA,IACrB,MAAM,MAAM,WAAW;AAAA,IACvB,aAAa,MAAM,WAAW;AAAA,IAC9B,cAAc,MAAM,WAAW;AAAA,IAC/B,SAAS,MAAM,WAAW,UAAU,CAAC,GAAG,MAAM,WAAW,OAAO,IAAI;AAAA,IACpE,SACE,MAAM,WAAW,WAAW,MAAM,qBAAqB,IAAI,MAAM,WAAW,OAAO,IAC/E,MAAM,WAAW,UACjB;AAAA,IACN,SAAS,mBACP,MAAM,WAAW,SACjB,MAAM,sBACN,MAAM,eAAe,UACvB;AAAA,IACA,YACE,MAAM,mBAAmB,MAAM,WAAW,aACtC,CAAC,GAAG,MAAM,WAAW,UAAU,IAC/B;AAAA,IACN;AAAA,IACA;AAAA,IACA,QAAQ,cAAc,MAAM,WAAW,QAAQ,oBAAoB;AAAA,MACjE,eAAe,MAAM,eAAe;AAAA,IACtC,CAAC;AAAA,EACH;AAAA,EACA,MAAM,aAAa;AAAA,OACd;AAAA,IACH,GAAG,wBAAuB,SAAS;AAAA,IACnC,GAAG,oBAAmB,SAAS;AAAA,EACjC;AAAA,EACA,OAAO,WAAW,UAAU;AAAA;AAG9B,SAAS,oBAAoB,CAC3B,MACA,4BACA,sBACmB;AAAA,EACnB,IAAI,KAAK,uBAAuB;AAAA,IAAK,OAAO,iBAAiB,0BAA0B;AAAA,EACvF,MAAM,WAAW,MAAM,QAAQ,KAAK,kBAAkB,IAClD,KAAK,qBACL,CAAC,KAAK,kBAAkB;AAAA,EAC5B,IAAI,SAAS,MAAM,CAAC,iBAAiB,qBAAqB,IAAI,YAAY,CAAC,GAAG;AAAA,IAC5E,OAAO,mBAAmB,KAAK,kBAAkB;AAAA,EACnD;AAAA,EACA,OAAO,iBAAiB,0BAA0B;AAAA;AAGpD,SAAS,gBAAgB,CAAC,qBAA6D;AAAA,EACrF,MAAM,UAAU,CAAC,GAAG,mBAAmB,EAAE,KAAK;AAAA,EAC9C,OAAO,QAAQ,WAAW,IAAI,QAAQ,KAAM;AAAA;AAG9C,SAAS,kBAAkB,CACzB,KACA,sBACA,kBACsB;AAAA,EACtB,IAAI,CAAC;AAAA,IAAK;AAAA,EACV,IAAI;AAAA,IAAkB,OAAO,CAAC,GAAG,GAAG;AAAA,EACpC,MAAM,UAAU,IAAI,OAAO,CAAC,OAAO,qBAAqB,IAAI,EAAE,CAAC;AAAA,EAC/D,OAAO,QAAQ,SAAS,IAAI,UAAU;AAAA;AAGxC,SAAS,YAAY,CACnB,MACA,oBACA,aACA,UAAsD,CAAC,GAC3C;AAAA,EACZ,MAAM,aAAa,KAAK,YACpB,OAAO,CAAC,aAAa,YAAY,IAAI,SAAS,EAAE,CAAC,EAClD,IAAI,gBAAgB;AAAA,EACvB,OAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,MAAM,KAAK;AAAA,IACX,aAAa,KAAK;AAAA,IAClB;AAAA,IACA,aAAa,KAAK;AAAA,IAClB,YAAY,QAAQ,uBAAuB,YAAY,WAAW,IAAI,YAAY;AAAA,EACpF;AAAA;AAGF,SAAS,kBAAkB,CAAC,QAAuD;AAAA,EACjF,OAAO,OAAO,WAAW,WAAW,SAAS,CAAC,GAAG,MAAM;AAAA;AAGzD,SAAS,gBAAgB,CAAC,UAA8B;AAAA,EACtD,OAAO;AAAA,IACL,IAAI,SAAS;AAAA,IACb,MAAM,SAAS;AAAA,IACf,QAAQ,eAAe,SAAS,MAAM;AAAA,IACtC,aAAa,SAAS;AAAA,IACtB,UAAU,SAAS;AAAA,IACnB,UAAU,SAAS;AAAA,IACnB,SAAS,SAAS;AAAA,IAClB,MAAM,SAAS;AAAA,IACf,cAAc,SAAS;AAAA,IACvB,OAAO,sBAAsB,SAAS,KAAK;AAAA,EAC7C;AAAA;AAGF,SAAS,qBAAqB,CAC5B,OACmC;AAAA,EACnC,IAAI,CAAC;AAAA,IAAO;AAAA,EACZ,OAAO;AAAA,IACL,YAAY,MAAM;AAAA,IAClB,YAAY,MAAM;AAAA,IAClB,UAAU,MAAM;AAAA,IAChB,MAAM,MAAM;AAAA,IACZ,OAAO,MAAM;AAAA,IACb,OAAO,MAAM;AAAA,IACb,QAAQ,MAAM;AAAA,EAChB;AAAA;AAGF,SAAS,aAAa,CACpB,QACA,oBACA,SACsC;AAAA,EACtC,IAAI,CAAC;AAAA,IAAQ;AAAA,EACb,MAAM,QAAQ,OAAO,SAAS,mBAAmB,IAAI,OAAO,KAAK,IAAI,OAAO,QAAQ;AAAA,EACpF,MAAM,sBAAsB,OAAO,aAAa,OAAO,CAAC,eACtD,mBAAmB,IAAI,UAAU,CACnC;AAAA,EACA,MAAM,gBAAgB,OAAO,OAAO,OAAO,CAAC,eAAe,mBAAmB,IAAI,UAAU,CAAC;AAAA,EAC7F,MAAM,cACJ,QAAQ,iBAAiB,qBAAqB,SAAS,sBAAsB;AAAA,EAC/E,MAAM,QAAQ,QAAQ,iBAAiB,eAAe,SAAS,gBAAgB;AAAA,EAC/E,MAAM,UACJ,OAAO,YAAY,YACf,YACA,uBACE,OAAO,YACL,OAAO,QAAQ,OAAO,OAAO,EAAE,OAAO,IAAI,aACxC,QAAQ,OAAO,MAAM,CAAC,OAAO,mBAAmB,IAAI,EAAE,CAAC,CACzD,CACF,CACF;AAAA,EACN,MAAM,YAAsC;AAAA,OACtC,YAAY,aAAa,OAAO,KAAK,OAAO,EAAE,WAAW,IAAI,CAAC,IAAI,EAAE,QAAQ;AAAA,OAC5E,UAAU,YAAY,CAAC,IAAI,EAAE,MAAM;AAAA,OACnC,gBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY;AAAA,OAC/C,UAAU,YAAY,CAAC,IAAI,EAAE,MAAM;AAAA,EACzC;AAAA,EACA,OAAO,OAAO,KAAK,SAAS,EAAE,SAAS,KAAK,QAAQ,gBAAgB,YAAY;AAAA;AAGlF,SAAS,qBAAqB,CAC5B,YACgC;AAAA,EAChC,OAAO,IAAI,IACT,CAAC,GAAG,WAAW,OAAO,CAAC,EAAE,IAAI,CAAC,cAAc;AAAA,IAC1C,MAAM,WAAW,kBAAkB,SAAS;AAAA,IAC5C,OAAO,CAAC,SAAS,IAAI,QAAQ;AAAA,GAC9B,CACH;AAAA;AAGF,SAAS,wBAAwB,CAC/B,YACA,aACgC;AAAA,EAChC,MAAM,gBAAgB,IAAI;AAAA,EAC1B,MAAM,iBAA2B,CAAC;AAAA,EAClC,MAAM,iBAAiB,IAAI;AAAA,EAC3B,WAAW,cAAc,aAAa;AAAA,IACpC,WAAW,YAAY,WAAW;AAAA,MAAY,eAAe,KAAK,SAAS,MAAM;AAAA,IACjF,WAAW,QAAQ,WAAW,OAAO;AAAA,MACnC,WAAW,YAAY,KAAK,cAAc,CAAC;AAAA,QAAG,eAAe,KAAK,SAAS,MAAM;AAAA,IACnF;AAAA,EACF;AAAA,EAEA,OAAO,eAAe,SAAS,GAAG;AAAA,IAChC,MAAM,SAAS,eAAe,IAAI;AAAA,IAClC,IAAI,OAAO,WAAW,YAAY,eAAe,IAAI,MAAM;AAAA,MAAG;AAAA,IAC9D,eAAe,IAAI,MAAM;AAAA,IACzB,IAAI,OAAO,SAAS,gBAAgB;AAAA,MAClC,IAAI,CAAC,cAAc,IAAI,OAAO,WAAW,GAAG;AAAA,QAC1C,cAAc,IAAI,OAAO,WAAW;AAAA,QACpC,MAAM,YAAY,WAAW,IAAI,OAAO,WAAW;AAAA,QACnD,IAAI;AAAA,UAAW,eAAe,KAAK,UAAU,MAAM;AAAA,MACrD;AAAA,MACA,IAAI,OAAO;AAAA,QAAW,eAAe,KAAK,OAAO,SAAS;AAAA,IAC5D,EAAO,SAAI,OAAO,SAAS,UAAU;AAAA,MACnC,WAAW,SAAS,OAAO,OAAO,OAAO,UAAU;AAAA,QAAG,eAAe,KAAK,MAAM,MAAM;AAAA,IACxF,EAAO,SAAI,OAAO,SAAS,SAAS;AAAA,MAClC,eAAe,KAAK,OAAO,KAAK;AAAA,IAClC,EAAO,SAAI,OAAO,SAAS,OAAO;AAAA,MAChC,eAAe,KAAK,OAAO,WAAW;AAAA,IACxC;AAAA,EACF;AAAA,EAEA,OAAO,IAAI,IACT,CAAC,GAAG,aAAa,EACd,IAAI,CAAC,gBAAgB,WAAW,IAAI,WAAW,CAAC,EAChD,OAAO,CAAC,cAAsC,cAAc,SAAS,EACrE,IAAI,CAAC,cAAc;AAAA,IAClB,MAAM,WAAW,kBAAkB,SAAS;AAAA,IAC5C,OAAO,CAAC,SAAS,IAAI,QAAQ;AAAA,GAC9B,CACL;AAAA;AAGF,SAAS,iBAAiB,CAAC,WAAiC;AAAA,EAC1D,OAAO,WAAW;AAAA,IAChB,IAAI,UAAU;AAAA,IACd,MAAM,UAAU;AAAA,IAChB,aAAa,UAAU;AAAA,IACvB,QAAQ,eAAe,UAAU,MAAM;AAAA,IACvC,cAAc,UAAU;AAAA,EAC1B,CAAC;AAAA;AAGH,SAAS,cAAc,CAAC,QAAwB;AAAA,EAC9C,OAAO,WAAW,gBAAgB,MAAM,CAAC;AAAA;AAG3C,SAAS,UAAa,CAAC,OAAU,OAAoB,IAAI,KAAU;AAAA,EACjE,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,KAAK,IAAI,KAAK;AAAA,IAAG,OAAO;AAAA,EAC3E,KAAK,IAAI,KAAK;AAAA,EACd,WAAW,OAAO,QAAQ,QAAQ,KAAK,GAAG;AAAA,IACxC,MAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAAA,IAC7D,IAAI,cAAc,WAAW;AAAA,MAAY,WAAW,WAAW,OAAO,IAAI;AAAA,EAC5E;AAAA,EACA,OAAO,OAAO,OAAO,KAAK;AAAA;AAG5B,SAAS,iBAAiB,CAAC,cAA6B;AAAA,EACtD,MAAM,IAAI,uBAAsB,+BAA+B,YAAY,CAAC;AAAA;;;ACvfvE,MAAM,qBAAqB;AAAA,EACvB;AAAA,EACA;AAAA,EACT;AAAA,EAEA,WAAW,CAAC,UAA4B,WAAuC;AAAA,IAC7E,KAAK,WAAW;AAAA,IAChB,KAAK,aAAa;AAAA,IAClB,OAAO,OAAO,IAAI;AAAA;AAAA,EAIpB,IAAI,GAA2B;AAAA,IAC7B,MAAM,YAAY,KAAK;AAAA,IACvB,KAAK,UAAU,6BAA6B;AAAA,MAC1C,UAAU,KAAK;AAAA,MACf,WAAW,sBAAsB,WAAW,KAAK,QAAQ;AAAA,SACrD,UAAU,SAAS,cACnB;AAAA,QACE,yBAAyB,CAAC,UACxB,mCAAkC,OAAO,UAAU,WAAW,MAAM;AAAA,MACxE,IACA,CAAC;AAAA,IACP,CAAC;AAAA,IACD,OAAO,KAAK;AAAA;AAEhB;AAEA,SAAS,qBAAqB,CAC5B,WACA,UAC6B;AAAA,EAC7B,QAAQ,UAAU;AAAA,SACX;AAAA,MACH,OAAO,EAAE,MAAM,MAAM;AAAA,SAClB;AAAA,MACH,OAAO;AAAA,QACL,MAAM;AAAA,QACN,eAAe,SACZ,gBAAgB,EAChB,OAAO,CAAC,eACP,WAAU,UAAU,SAAS;AAAA,UAC3B,MAAM;AAAA,UACN,cAAc,WAAW;AAAA,QAC3B,CAAC,CACH,EACC,IAAI,CAAC,eAAe,WAAW,EAAE;AAAA,MACtC;AAAA,SACG;AAAA,MACH,OAAO,EAAE,MAAM,YAAY,OAAO,UAAU,WAAW,MAAM;AAAA;AAAA;;;AC9CnE,IAAM,qBAAqB,OAAO,4CAA4C;AA+BvE,SAAS,kCAAkC,CAChD,OAC8B;AAAA,EAC9B,MAAM,iBAAiB,IAAI;AAAA,EAC3B,MAAM,mBAAmB,IAAI;AAAA,EAC7B,MAAM,wBAAwB,IAAI;AAAA,EAElC,WAAW,aAAa,MAAM,SAAS;AAAA,IACrC,MAAM,MAAM,aAAa,UAAU,QAAQ,UAAU,YAAY;AAAA,IACjE,eAAe,IAAI,KAAK,SAAS;AAAA,IACjC,sBAAsB,IAAI,KAAK,IAAI,IAAI,UAAU,WAAW,CAAC;AAAA,IAC7D,MAAM,SAAS,iBAAiB,IAAI,UAAU,YAAY,KAAK,CAAC;AAAA,IAChE,OAAO,KAAK,SAAS;AAAA,IACrB,iBAAiB,IAAI,UAAU,cAAc,MAAM;AAAA,EACrD;AAAA,EAEA,MAAM,WAAW,WAAW,MAAM,OAAO,YAAY,cAAc;AAAA,EACnE,MAAM,WAAW,WAAW,MAAM,OAAO,YAAY,cAAc;AAAA,EACnE,MAAM,aAAa,cAAc,CAAC,CAAC;AAAA,EAEnC,MAAM,YAA0C;AAAA,IAC9C,OAAO,MAAM;AAAA,IACb,QAAQ,CAAC,UAAU;AAAA,MACjB,MAAM,aAAa,MAAM,OAAO,cAAc,QAC5C,CAAC,iBAAiB,iBAAiB,IAAI,YAAY,KAAK,CAAC,CAC3D;AAAA,MACA,MAAM,QAAQ,cAAc,UAAU;AAAA,MAEtC,IAAI,MAAM,SAAS,QAAQ;AAAA,QACzB,MAAM,cAAc,CAAC,GAAG,IAAI,IAAI,MAAM,MAAM,IAAI,CAAC,QAAQ,IAAI,YAAY,KAAK,CAAC,CAAC,CAAC,EAC9E,KAAK,EACL,KAAK,CAAC,iBAAiB,CAAC,iBAAiB,IAAI,YAAY,CAAC;AAAA,QAC7D,IAAI,aAAa;AAAA,UACf,OAAO,QACL,OACA,IAAI,oBACF,eAAe,eACf,wDAAwD,oBAAoB,MAAM,8DACpF,CACF;AAAA,QACF;AAAA,MACF;AAAA,MAEA,IAAI,MAAM,WAAW,SAAS;AAAA,QAAG,OAAO,EAAE,MAAM;AAAA,MAChD,MAAM,eAAe,MAAM,gBAAgB,MAAM,OAAO,cAAc,MAAM;AAAA,MAC5E,OAAO,QACL,OACA,IAAI,oBACF,eAAe,gBACf,yDAAyD,qBAAqB,MAAM,8DACtF,CACF;AAAA;AAAA,IAEF,UAAU,CAAC,UACT,eACE,gBAAgB,MAAM,KAAK,GAC3B,MAAM,YACN,MAAM,cACN,MAAM,KACN,MAAM,MACN,qBACF;AAAA,IACF,MAAM,CAAC,UAAU;AAAA,MACf,MAAM,QAAQ,gBAAgB,MAAM,KAAK;AAAA,MACzC,MAAM,OAAO,WACX,OACA,MAAM,QACN,MAAM,WACN,MAAM,oBACN,UACA,UACA,MAAM,OAAO,aACf;AAAA,MACA,IAAI,KAAK,WAAW,SAAS,KAAK,MAAM,WAAW,WAAW;AAAA,QAAG,OAAO,EAAE,OAAO,KAAK;AAAA,MACtF,OAAO,QACL,MACA,WACE,OACA,MAAM,QACN,MAAM,WACN,MAAM,oBACN,MAAM,KACN,MAAM,IACR,CACF;AAAA;AAAA,IAEF,KAAK,GAAG,IAAI,aAAa;AAAA,MACvB,IAAI,OAAO;AAAA,QAAY,OAAO,gBAAgB,OAAO,MAAM,UAAU;AAAA,MACrE,OAAO,cAAc,OAAO,QAAQ,CAAC,UAAU,gBAAgB,KAAK,EAAE,UAAU,CAAC;AAAA;AAAA,IAEnF,wBAAwB,CAAC,UAAU;AAAA,MACjC,MAAM,SAAS,eACb,gBAAgB,MAAM,KAAK,GAC3B,MAAM,YACN,MAAM,cACN,MAAM,KACN,MAAM,MACN,qBACF;AAAA,MACA,IAAI;AAAA,QAAQ,MAAM;AAAA;AAAA,IAEpB,4BAA4B,CAAC,UAAU;AAAA,MACrC,IAAI,MAAM,WAAW;AAAA,QAAW;AAAA,MAChC,MAAM,QAAQ,gBAAgB,MAAM,KAAK;AAAA,MACzC,MAAM,aACJ,MAAM,cAAc,SAAS,CAAC,YAAY,UAAU,IAAI,CAAC,MAAM,SAAS;AAAA,MAC1E,MAAM,OAAO,cACX,WAAW,QACT,CAAC,cACC,WAAW,OAAO,MAAM,QAAS,WAAW,WAAW,UAAU,QAAQ,EAAE,UAC/E,CACF;AAAA,MACA,IAAI,KAAK,WAAW,SAAS,KAAK,MAAM,WAAW,WAAW;AAAA,QAAG;AAAA,MACjE,MAAM,WAAW,OAAO,MAAM,QAAQ,MAAM,WAAW,WAAW,cAAc,MAAM,IAAI;AAAA;AAAA,EAE9F;AAAA,EAEA,OAAO,OAAO,OAAO,SAAS;AAAA;AAGhC,SAAS,UAAU,CACjB,OACA,WACA,gBACmE;AAAA,EACnE,MAAM,QAAQ,IAAI;AAAA,EAClB,WAAW,QAAQ,OAAO;AAAA,IACxB,MAAM,UACJ,cAAc,aACV,aAAa,KAAK,cAAc,KAAK,kBAAkB,IACvD,aAAa,KAAK,QAAQ,KAAK,kBAAkB;AAAA,IACvD,MAAM,QACJ,cAAc,aACV,aAAa,KAAK,QAAQ,KAAK,kBAAkB,IACjD,aAAa,KAAK,cAAc,KAAK,kBAAkB;AAAA,IAC7D,MAAM,SAAS,eAAe,IAAI,KAAK;AAAA,IACvC,IAAI,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,QAAQ;AAAA,MAC3C,MAAM,IAAI,MAAM,4EAA4E;AAAA,IAC9F;AAAA,IACA,MAAM,MAAM,QACV,cAAc,aAAa,KAAK,eAAe,KAAK,QACpD,cAAc,aAAa,KAAK,qBAAqB,KAAK,oBAC1D,KAAK,MACP;AAAA,IACA,MAAM,UAAU,MAAM,IAAI,GAAG,KAAK,CAAC;AAAA,IACnC,QAAQ,KAAK,MAAM;AAAA,IACnB,MAAM,IAAI,KAAK,OAAO;AAAA,EACxB;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,UAAU,CACjB,OACA,QACA,WACA,oBACA,UACA,UACA,qBAC0B;AAAA,EAC1B,MAAM,QAAQ,cAAc,aAAa,WAAW;AAAA,EACpD,MAAM,cAAc,sBAAsB,IAAI,IAAI,mBAAmB,IAAI;AAAA,EACzE,MAAM,aAAa,MAAM,WAAW,QAAQ,CAAC,cAAc;AAAA,IACzD,MAAM,aAAa,MAAM,IAAI,QAAQ,UAAU,QAAQ,UAAU,cAAc,MAAM,CAAC,KAAK,CAAC;AAAA,IAC5F,OAAO,WAAW,OAChB,CAAC,eACE,gBAAgB,aAAa,YAAY,IAAI,UAAU,YAAY,OACnE,cAAc,cACb,uBAAuB,aACvB,UAAU,iBAAiB,mBACjC;AAAA,GACD;AAAA,EACD,OAAO,cAAc,UAAU;AAAA;AAGjC,SAAS,cAAc,CACrB,OACA,YACA,cACA,KACA,MACA,uBACgC;AAAA,EAChC,MAAM,aAAa,eACf,MAAM,WAAW,OAAO,CAAC,cAAc,UAAU,iBAAiB,YAAY,IAC9E,MAAM;AAAA,EAGV,IAAI,WAAW,WAAW;AAAA,IAAG;AAAA,EAE7B,MAAM,UAAU,WAAW,KACzB,CAAC,cACC,CAAC,sBACE,IAAI,aAAa,UAAU,QAAQ,UAAU,YAAY,CAAC,GACzD,IAAI,UAAU,CACtB;AAAA,EACA,IAAI,CAAC;AAAA,IAAS;AAAA,EAEd,MAAM,gBAAgB,CAAC,GAAG,IAAI,IAAI,WAAW,IAAI,CAAC,cAAc,UAAU,YAAY,CAAC,CAAC,EAAE,KAAK;AAAA,EAC/F,OAAO,IAAI,oBACT,eAAe,cAAc,KAAK,GAAG,cAAc,cACnD,+CAA+C,mBAAmB,WAAW,2EAA2E,gBAAgB,OAAO,KACjL;AAAA;AAGF,SAAS,UAAU,CACjB,OACA,QACA,WACA,oBACA,KACA,MACoB;AAAA,EACpB,MAAM,SAAS,qBAAqB,IAAI,uBAAuB;AAAA,EAC/D,OAAO,IAAI,oBACT,aAAa,YAAY,UAAU,UACnC,qCAAqC,mBAAmB,eAAe,YAAY,YAAY,KAAK,SAAS,oDAC/G;AAAA;AAGF,SAAS,WAAW,CAAC,OAAyC;AAAA,EAC5D,IAAI,MAAM,WAAW,WAAW;AAAA,IAAG,OAAO;AAAA,EAC1C,OAAO,yBAAyB,MAAM,WAAW,IAAI,eAAe,EAAE,KAAK,IAAI;AAAA;AAGjF,SAAS,eAAe,CAAC,WAAsD;AAAA,EAC7E,OAAO,IAAI,UAAU,sBAAsB,UAAU;AAAA;AAGvD,SAAS,aAAa,CACpB,YAC0B;AAAA,EAC1B,MAAM,SAAS,IAAI;AAAA,EACnB,WAAW,aAAa,YAAY;AAAA,IAClC,OAAO,IAAI,aAAa,UAAU,QAAQ,UAAU,YAAY,GAAG,SAAS;AAAA,EAC9E;AAAA,EACA,OAAO,OAAO,OAAO;AAAA,KAClB,qBAAqB;AAAA,IACtB,YAAY,OAAO,OACjB,CAAC,GAAG,OAAO,OAAO,CAAC,EAAE,KACnB,CAAC,MAAM,UACL,KAAK,SAAS,MAAM,UAAU,KAAK,aAAa,cAAc,MAAM,YAAY,CACpF,CACF;AAAA,EACF,CAAC;AAAA;AAGH,SAAS,eAAe,CAAC,OAA4D;AAAA,EACnF,IAAK,MAA4C,wBAAwB,MAAM;AAAA,IAC7E,MAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,OAAM,CAAC,OAAiC,QAA+C;AAAA,EAC9F,OAAO,EAAE,OAAO,OAAO;AAAA;AAGzB,SAAS,YAAY,CAAC,QAAgB,cAA8B;AAAA,EAClE,OAAO,KAAK,UAAU,CAAC,QAAQ,YAAY,CAAC;AAAA;AAG9C,SAAS,OAAO,CAAC,QAAgB,cAAsB,QAAwB;AAAA,EAC7E,OAAO,KAAK,UAAU,CAAC,QAAQ,cAAc,MAAM,CAAC;AAAA;;;ACnS/C,MAAM,sBAAsB;AAAA,EACxB;AAAA,EAEA;AAAA,EAEA;AAAA,EAEA;AAAA,EACT;AAAA,EACA;AAAA,EAEA,WAAW,CAAC,OAIT;AAAA,IACD,KAAK,YAAY,MAAM;AAAA,IACvB,KAAK,cAAc,MAAM;AAAA,IACzB,KAAK,UAAU,MAAM,cAAc,yBAAyB,MAAM,UAAU,MAAM,UAAU;AAAA,IAE5F,IAAI,MAAM,cAAc,MAAM,iBAAiB,QAAQ,MAAM,UAAU,GAAG;AAAA,MACxE,KAAK,WAAW,MAAM;AAAA,IACxB;AAAA,IAEA,OAAO,OAAO,IAAI;AAAA;AAAA,EAIpB,OAAO,GAAmC;AAAA,IACxC,MAAM,UAAU,KAAK;AAAA,IACrB,MAAM,aAAa,KAAK;AAAA,IACxB,IAAI,CAAC,WAAW,CAAC;AAAA,MAAY,OAAO,KAAK;AAAA,IAEzC,OAAO,QAAQ,QAAQ,EAAE,KAAK,CAAC,aAAa;AAAA,MAC1C,IAAI,aAAa,KAAK,eAAe;AAAA,QACnC,KAAK,iBAAiB,yBAAyB,KAAK,WAAW,YAAY,QAAQ;AAAA,QACnF,KAAK,gBAAgB;AAAA,MACvB;AAAA,MACA,OAAO,KAAK;AAAA,KACb;AAAA;AAAA,EAOH,QAAQ,CAAC,SAAuD;AAAA,IAC9D,MAAM,UAAU,KAAK;AAAA,IACrB,MAAM,aAAa,KAAK;AAAA,IACxB,IAAI,CAAC,WAAW,CAAC;AAAA,MAAY,OAAO,KAAK;AAAA,IAEzC,OAAO,QACJ,QAAQ,EACR,KAAK,CAAC,aACL,QAAQ,SAAS,QAAQ,eAAe,UAAU,QAAQ,MAAM,IAAI,QACtE,EACC,KAAK,CAAC,aACL,QAAQ,UAAU,QAAQ,iBAAiB,UAAU,QAAQ,YAAY,IAAI,QAC/E,EACC,KAAK,CAAC,aAAa,yBAAyB,KAAK,WAAW,YAAY,QAAQ,CAAC;AAAA;AAExF;;;AC5CO,MAAM,qBAAqB;AAAA,EAEvB;AAAA,EACA;AAAA,EAEA;AAAA,EAEA;AAAA,EACA;AAAA,EAET,WAAW,CAAC,OAMT;AAAA,IACD,MAAM,YAAY,MAAM;AAAA,IACxB,KAAK,gBAAgB,MAAM;AAAA,IAC3B,KAAK,YAAY;AAAA,IACjB,KAAK,UAAU,OAAO,OAAO;AAAA,MAC3B,WAAW,MAAM;AAAA,MACjB,sBAAsB,MAAM;AAAA,SACxB,UAAU,SAAS,cAAc,EAAE,eAAe,UAAU,QAAQ,IAAI,CAAC;AAAA,IAC/E,CAAC;AAAA,IAED,IAAI,UAAU,SAAS,aAAa;AAAA,MAClC,MAAM,QAAQ,UAAU,WAAW;AAAA,MACnC,KAAK,aAAa,OAAO,OAAO;AAAA,QAC9B,eAAe,IAAI,IAAI,MAAM,QAAQ,IAAI,CAAC,WAAW,OAAO,YAAY,CAAC;AAAA,QACzE,iBAAiB,IAAI,IAAI,MAAM,MAAM,IAAI,0BAA0B,CAAC;AAAA,QACpE,gBAAgB,mCAAmC,KAAK;AAAA,MAC1D,CAAC;AAAA,IACH;AAAA,IAEA,KAAK,YAAY,IAAI,sBAAsB;AAAA,MACzC,UAAU,MAAM;AAAA,MAChB,YAAY,uBAAuB,SAAS;AAAA,SACxC,MAAM,oBAAoB,YAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,gBAAgB;AAAA,IAC1F,CAAC;AAAA,IAED,OAAO,OAAO,IAAI;AAAA;AAAA,EAGpB,yBAAyB,CAAC,eAAkC,WAA4B;AAAA,IACtF,IAAI,KAAK,YAAY;AAAA,MACnB,WAAW,gBAAgB,IAAI,IAAI,aAAa,GAAG;AAAA,QACjD,IAAI,KAAK,WAAW,cAAc,IAAI,YAAY;AAAA,UAAG;AAAA,QACrD,MAAM,IAAI,oBACR,yBAAyB,gBACzB,+DAA+D,gBACjE;AAAA,MACF;AAAA,IACF,EAAO;AAAA,MACL,WAAW,gBAAgB,IAAI,IAAI,aAAa,GAAG;AAAA,QACjD,kBAAiB,KAAK,SAAS,EAAE,MAAM,eAAe,aAAa,CAAC;AAAA,MACtE;AAAA;AAAA,IAGF,IAAI,CAAC;AAAA,MAAW;AAAA,IAEhB,WAAW,gBAAgB,IAAI,IAAI,aAAa,GAAG;AAAA,MACjD,MAAM,aAAa,UAAU,eAAe,YAAY;AAAA,MACxD,IAAI;AAAA,QAAY,MAAM,gBAAgB,UAAU;AAAA,IAClD;AAAA;AAAA,EAGF,oBAAoB,CAAC,cAAsB,WAA+B;AAAA,IACxE,IAAI,WAAW,eAAe,YAAY;AAAA,MAAG,OAAO;AAAA,IACpD,IAAI,KAAK;AAAA,MAAY,OAAO,KAAK,WAAW,cAAc,IAAI,YAAY;AAAA,IAC1E,OAAO,WAAU,KAAK,QAAQ,eAAe,EAAE,MAAM,eAAe,aAAa,CAAC;AAAA;AAAA,EAGpF,cAAc,CAAC,MAAqB,WAA+B;AAAA,IACjE,IACE,CAAC,KAAK,qBAAqB,KAAK,cAAc,SAAS,KACvD,CAAC,KAAK,qBAAqB,KAAK,cAAc,SAAS,KACvD,WAAW,eAAe,KAAK,cAAc,KAAK,MAAM,GACxD;AAAA,MACA,OAAO;AAAA,IACT;AAAA,IAEA,OAAO,KAAK,YAAY,gBAAgB,IAAI,2BAA2B,IAAI,CAAC,KAAK;AAAA;AAErF;AAMA,SAAS,sBAAsB,CAC7B,WACiC;AAAA,EACjC,QAAQ,UAAU;AAAA,SACX;AAAA,MACH;AAAA,SACG;AAAA,MACH,OAAO,UAAU,QAAQ,cAAc,IAAI;AAAA,SACxC;AAAA,MACH,OAAO,IAAI;AAAA;AAAA;AAIjB,SAAS,0BAA0B,CACjC,OAGQ;AAAA,EACR,OAAO,wBAAwB,QAC3B,KAAK,UAAU,CAAC,MAAM,oBAAoB,MAAM,QAAQ,MAAM,kBAAkB,CAAC,IACjF,KAAK,UAAU,CAAC,MAAM,cAAc,MAAM,QAAQ,MAAM,YAAY,CAAC;AAAA;;;ACpE3E,IAAM,wBAAwB,OAAO,OAAO,CAAC,CAAC;AAAA;AAa9C,MAAM,2BAA2B;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,WAAW,CACT,KACA,OAMA;AAAA,IACA,IAAI,QAAQ,uBAAuB;AAAA,MACjC,MAAM,IAAI,MAAM,4DAA4D;AAAA,IAC9E;AAAA,IACA,KAAK,YAAY,MAAM;AAAA,IACvB,KAAK,YAAY,MAAM;AAAA,IACvB,KAAK,UAAU,MAAM;AAAA,IACrB,KAAK,WAAW,MAAM;AAAA;AAAA,SAGjB,WAAW,CAAC,QAAoC,OAA6B;AAAA,IAClF,MAAM,gBAAgB,sBAAsB,KAAK;AAAA,IACjD,mCAAmC,OAAO,UAAU,QAAQ,WAAW,aAAa;AAAA,IACpF,IAAI,cAAc,kBAAkB,OAAO,UAAU,eAAe;AAAA,MAClE,MAAM,IAAI,MACR,+EACF;AAAA,IACF;AAAA;AAAA,cAIW,UAAS,CAAC,QAAwD;AAAA,IAC7E,OAAO,OAAO,UAAU,UAAU,QAAQ;AAAA;AAAA,SAIrC,cAAc,CACnB,QACA,SACgC;AAAA,IAChC,OAAO,OAAO,UAAU,UAAU,SAAS,OAAO;AAAA;AAAA,SAG7C,YAAY,CAAC,QAA4D;AAAA,IAC9E,OAAO,OAAO,UAAU,KAAK;AAAA;AAAA,MAI3B,SAAS,GAAW;AAAA,IACtB,OAAO,KAAK,UAAU,QAAQ;AAAA;AAAA,OAG1B,eAAc,CAAC,OAAwE;AAAA,IAC3F,MAAM,UAAU,kBAAkB;AAAA,MAChC,cAAc,MAAM;AAAA,MACpB,WAAW,MAAM;AAAA,IACnB,CAAC;AAAA,IACD,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,KAAK,UAAU,0BAA0B,CAAC,QAAQ,YAAY,GAAG,SAAS;AAAA,IAC1E,MAAM,MAAM,MAAM,KAAK,SAAS,eAAe;AAAA,SAC1C;AAAA,MACH,WAAW,KAAK,UAAU,QAAQ;AAAA,IACpC,CAAC;AAAA,IACD,OAAO,KAAK,YACV,OAAO,KAAK,YAAY,KAAK,SAAS,GACtC,CAAC,aAAa,CAAC,QAAQ,GACvB,SACF;AAAA;AAAA,OAGI,oBAAmB,CACvB,OACsD;AAAA,IACtD,MAAM,UAAU,kBAAkB;AAAA,MAChC,OAAO,MAAM,MAAM,IAAI,CAAC,UAAU;AAAA,QAChC,cAAc,KAAK;AAAA,QACnB,WAAW,KAAK;AAAA,MAClB,EAAE;AAAA,IACJ,CAAC;AAAA,IACD,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,KAAK,UAAU,0BACb,QAAQ,MAAM,IAAI,CAAC,SAAS,KAAK,YAAY,GAC7C,SACF;AAAA,IACA,MAAM,OAAO,MAAM,KAAK,SAAS,oBAAoB;AAAA,SAChD;AAAA,MACH,WAAW,KAAK,UAAU,QAAQ;AAAA,IACpC,CAAC;AAAA,IACD,OAAO,KAAK,YACV,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,IAAI,EAAE,KAAK,SAAS,CAAC,KAAK,KAAK,YAAY,KAAK,SAAS,CAAC,CAAU,CAAC,GACvF,CAAC,aAAa,SAAS,OAAO,GAC9B,SACF;AAAA;AAAA,OAGI,sBAAqB,CAAC,OAAqD;AAAA,IAC/E,MAAM,UAAU,kBAAkB;AAAA,MAChC,cAAc,MAAM;AAAA,MACpB,WAAW,MAAM;AAAA,MACjB,YAAY,MAAM;AAAA,IACpB,CAAC;AAAA,IACD,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,KAAK,UAAU,0BAA0B,CAAC,QAAQ,YAAY,GAAG,SAAS;AAAA,IAE1E,IAAI,cAAc,SAAS,SAAS;AAAA,MAAG,OAAO;AAAA,IAC9C,IAAI,KAAK,UAAU,UAAU,SAAS;AAAA,MAAa,OAAO;AAAA,IAC1D,OAAO,YAAY,MAAM,KAAK,SAAS,wBAAwB;AAAA,MAC7D,WAAW,KAAK,UAAU,QAAQ;AAAA,MAClC,OAAO,CAAC,OAAO;AAAA,IACjB,CAAC;AAAA,IACD,OAAO,YAAY;AAAA;AAAA,OAGf,6BAA4B,CAChC,OAC6B;AAAA,IAC7B,MAAM,UAAU,kBAAkB;AAAA,MAChC,OAAO,MAAM,MAAM,IAAI,CAAC,UAAU;AAAA,QAChC,cAAc,KAAK;AAAA,QACnB,WAAW,KAAK;AAAA,QAChB,YAAY,KAAK;AAAA,MACnB,EAAE;AAAA,IACJ,CAAC;AAAA,IACD,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,KAAK,UAAU,0BACb,QAAQ,MAAM,IAAI,CAAC,SAAS,KAAK,YAAY,GAC7C,SACF;AAAA,IACA,MAAM,WACJ,KAAK,UAAU,UAAU,SAAS,cAC9B,MAAM,KAAK,SAAS,wBAAwB;AAAA,SACvC;AAAA,MACH,WAAW,KAAK,UAAU,QAAQ;AAAA,IACpC,CAAC,IACD,QAAQ,MAAM,IAAI,MAAM,IAAI;AAAA,IAClC,OAAO,QAAQ,MAAM,IACnB,CAAC,MAAM,UAAU,CAAC,cAAc,MAAM,SAAS,KAAK,SAAS,WAAW,IAC1E;AAAA;AAAA,OAGI,KAAI,CAAC,OAAgE;AAAA,IACzE,MAAM,UAAU,kBAAkB;AAAA,MAChC,cACE,OAAO,MAAM,iBAAiB,WAC1B,MAAM,eACN,MAAM,iBAAiB,YACrB,YACA,CAAC,GAAG,MAAM,YAAY;AAAA,MAC9B,iBAAiB,MAAM;AAAA,MACvB,iBAAiB,MAAM;AAAA,MACvB,cAAc,MAAM;AAAA,MACpB,eAAe,MAAM;AAAA,MACrB,cAAc,MAAM;AAAA,MACpB,eAAe,MAAM;AAAA,MACrB,OAAO,MAAM;AAAA,MACb,QAAQ,MAAM;AAAA,MACd,SAAS,MAAM;AAAA,MACf,OAAO,MAAM;AAAA,IACf,CAAC;AAAA,IACD,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,MAAM,eAAe,KAAK,wBAAwB,QAAQ,cAAc,SAAS;AAAA,IAIjF,IAAI,MAAM,QAAQ,YAAY,KAAK,aAAa,WAAW,GAAG;AAAA,MAC5D,OAAO,EAAE,SAAS,CAAC,GAAG,SAAS,OAAO,OAAO,EAAE;AAAA,IACjD;AAAA,IAEA,MAAM,OAAO,MAAM,KAAK,SAAS,KAAK;AAAA,SACjC;AAAA,SACC,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa;AAAA,MACrD,WAAW,KAAK,UAAU,QAAQ;AAAA,IACpC,CAAC;AAAA,IACD,OAAO,KAAK,YACV,KAAK,MAAM,SAAS,KAAK,QAAQ,IAAI,CAAC,QAAQ,KAAK,YAAY,KAAK,SAAS,CAAC,EAAE,GAChF,CAAC,aAAa,SAAS,SACvB,SACF;AAAA;AAAA,OAGI,UAAS,CAAC,OAAmE;AAAA,IACjF,MAAM,UAAU,kBAAkB;AAAA,MAChC,cAAc,MAAM;AAAA,MACpB,UAAU,MAAM;AAAA,MAChB,QAAQ,MAAM;AAAA,MACd,WAAW,MAAM;AAAA,IACnB,CAAC;AAAA,IACD,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,KAAK,UAAU,0BAA0B,CAAC,QAAQ,YAAY,GAAG,SAAS;AAAA,IAC1E,MAAM,QAAQ,iBACZ,MAAM,KAAK,SAAS,UAAU;AAAA,SACzB;AAAA,MACH,WAAW,KAAK,UAAU,QAAQ;AAAA,IACpC,CAAC,CACH;AAAA,IACA,OAAO,MAAM,OAAO,CAAC,SAAS,KAAK,UAAU,eAAe,MAAM,SAAS,CAAC;AAAA;AAAA,OAGxE,eAAc,CAClB,OACiD;AAAA,IACjD,MAAM,UAAU,kBAAkB;AAAA,MAChC,WAAW,MAAM;AAAA,MACjB,OAAO,MAAM,MAAM,IAAI,CAAC,UAAU;AAAA,QAChC,cAAc,KAAK;AAAA,QACnB,UAAU,KAAK;AAAA,QACf,QAAQ,KAAK;AAAA,MACf,EAAE;AAAA,IACJ,CAAC;AAAA,IACD,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,KAAK,UAAU,0BACb,QAAQ,MAAM,IAAI,CAAC,SAAS,KAAK,YAAY,GAC7C,SACF;AAAA,IACA,MAAM,QAAQ,iBACZ,MAAM,KAAK,SAAS,eAAe;AAAA,SAC9B;AAAA,MACH,WAAW,KAAK,UAAU,QAAQ;AAAA,IACpC,CAAC,CACH;AAAA,IACA,MAAM,WAAW,IAAI;AAAA,IACrB,YAAY,KAAK,UAAU,OAAO;AAAA,MAChC,SAAS,IACP,KACA,MAAM,OAAO,CAAC,SAAS,KAAK,UAAU,eAAe,MAAM,SAAS,CAAC,CACvE;AAAA,IACF;AAAA,IACA,OAAO;AAAA;AAAA,OAGH,aAAY,CAChB,OACmC;AAAA,IACnC,MAAM,QAAQ,sBAAsB,MAAM,KAAK;AAAA,IAC/C,MAAM,eAAe,kBAAkB,MAAM,YAAY;AAAA,IACzD,MAAM,iBAAiB,KAAK,qBAAqB,KAAK,GAAG,SAAS;AAAA,IAClE,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,MAAM,SAAS,MAAM,oBACnB;AAAA,MACE,OAAO;AAAA,SACH,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa;AAAA,MACrD,WAAW,KAAK,UAAU,QAAQ;AAAA,MAClC,QAAQ,MAAM;AAAA,IAChB,GACA,KAAK,sBAAsB,SAAS,CACtC;AAAA,IACA,OAAO,KAAK,YACV,KAAK,QAAQ,SAAS,OAAO,QAAQ,IAAI,CAAC,QAAQ,KAAK,YAAY,KAAK,SAAS,CAAC,EAAE,GACpF,CAAC,aAAa,SAAS,SACvB,SACF;AAAA;AAAA,OAGI,WAAU,CACd,OACwC;AAAA,IACxC,MAAM,QAAQ,sBAAsB,MAAM,KAAK;AAAA,IAC/C,MAAM,UAAU,kBAAkB;AAAA,MAChC,WAAW,MAAM;AAAA,MACjB,QAAQ,MAAM;AAAA,MACd,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,WAAW,MAAM;AAAA,IACnB,CAAC;AAAA,IACD,IAAI,iBAAiB;AAAA,IACrB,MAAM,YAAY,KAAK,UAAU,YAAY;AAAA,IAC7C,IAAI,WAAW;AAAA,MACb,MAAM,YAAY,0BAChB,EAAE,UAAU,SAAS,WAAW,KAAK,UAAU,QAAQ,UAAU,GACjE,EAAE,UAAU,KAAK,UAAU,SAAS,CACtC;AAAA,MACA,MAAM,WAAW,iCACf,UAAU,UAAU,OACpB,EAAE,UAAU,KAAK,UAAU,UAAU,WAAW,MAAM,GACtD,SACF;AAAA,MACA,UAAU,2BAA2B;AAAA,QACnC,OAAO,SAAS;AAAA,WACZ,UAAU,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,UAAU,OAAO;AAAA,QACrE,WAAW,UAAU;AAAA,QACrB,MAAM;AAAA,MACR,CAAC;AAAA,MACD,iBAAiB,SAAS;AAAA,IAC5B;AAAA,IAEA,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,IAAI,WAAW;AAAA,MACb,wBAAwB;AAAA,QACtB,UAAU,KAAK,UAAU;AAAA,QACzB;AAAA,QACA;AAAA,QACA,SAAS,KAAK,SAAS,WAAW,KAAK,UAAU,QAAQ,UAAU;AAAA,QACnE,kBAAkB,CAAC,iBACjB,KAAK,UAAU,qBAAqB,cAAc,SAAS;AAAA,MAC/D,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,SAAS,iBACb,MAAM,yBACJ,EAAE,OAAO,mBAAmB,SAAS,WAAW,KAAK,UAAU,QAAQ,UAAU,GACjF,KAAK,sBAAsB,SAAS,CACtC,CACF;AAAA,IAKA,IACE,OAAO,QAAQ,KACb,CAAC,QAAQ,CAAC,KAAK,UAAU,qBAAqB,IAAI,cAAc,SAAS,CAC3E,KACA,OAAO,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,UAAU,eAAe,MAAM,SAAS,CAAC,GAC3E;AAAA,MACA,MAAM,IAAI,MAAM,0EAA0E;AAAA,IAC5F;AAAA,IAEA,OAAO;AAAA,SACF;AAAA,MACH,SAAS,OAAO,QAAQ,IAAI,CAAC,QAAS,YAAY,gBAAgB,KAAK,SAAS,IAAI,GAAI;AAAA,IAC1F;AAAA;AAAA,OAGI,MAAK,CACT,OACmC;AAAA,IACnC,MAAM,QAAQ,sBAAsB,MAAM,KAAK;AAAA,IAC/C,MAAM,iBAAiB,KAAK,qBAAqB,KAAK,GAAG,SAAS;AAAA,IAClE,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,OAAO,iBACL,MAAM,cACJ,EAAE,OAAO,gBAAgB,WAAW,KAAK,UAAU,QAAQ,UAAU,GACrE,KAAK,sBAAsB,SAAS,CACtC,CACF;AAAA;AAAA,OAGI,OAAM,CACV,OACoC;AAAA,IACpC,MAAM,QAAQ,sBAAsB,MAAM,KAAK;AAAA,IAC/C,MAAM,iBAAiB,KAAK,qBAAqB,KAAK,GAAG,SAAS;AAAA,IAClE,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,OAAO,iBACL,MAAM,eACJ,EAAE,OAAO,gBAAgB,WAAW,KAAK,UAAU,QAAQ,UAAU,GACrE,KAAK,sBAAsB,SAAS,CACtC,CACF;AAAA;AAAA,OAGI,MAAK,CACT,OACoC;AAAA,IACpC,MAAM,QAAQ,sBAAsB,MAAM,KAAK;AAAA,IAC/C,MAAM,SAAS,sBAAsB,MAAM,MAAM;AAAA,IACjD,IAAI,iBAAiB;AAAA,IACrB,IAAI,kBAAkB;AAAA,IACtB,MAAM,YAAY,KAAK,UAAU,YAAY;AAAA,IAC7C,IAAI,WAAW;AAAA,MAGb,MAAM,YAAY,qBAAoB,OAAO,EAAE,UAAU,KAAK,UAAU,SAAS,CAAC;AAAA,MAClF,MAAM,mBAAmB,4BAA4B,QAAQ,UAAU,OAAO,eAAe;AAAA,QAC3F,UAAU,KAAK,UAAU;AAAA,MAC3B,CAAC;AAAA,MACD,MAAM,WAAW,iCACf,UAAU,OACV,EAAE,UAAU,KAAK,UAAU,UAAU,WAAW,MAAM,GACtD,SACF;AAAA,MACA,iBAAiB,QAAQ,CAAC,OAAO,UAAU;AAAA,QACzC,UAAU,uBAAuB;AAAA,UAC/B,OAAO,SAAS;AAAA,UAChB,YAAY,MAAM;AAAA,UAClB,KAAK;AAAA,UACL,MAAM,YAAY;AAAA,QACpB,CAAC;AAAA,OACF;AAAA,MACD,iBAAiB,SAAS;AAAA,MAC1B,kBAAkB;AAAA,IACpB;AAAA,IACA,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,OAAO,iBACL,MAAM,cACJ;AAAA,MACE,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,WAAW,KAAK,UAAU,QAAQ;AAAA,IACpC,GACA,KAAK,sBAAsB,SAAS,CACtC,CACF;AAAA;AAAA,OAQI,mBAAkB,CACtB,cACsD;AAAA,IACtD,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,sBAAsB,WAAW,EAAE,eAAe,CAAC,YAAY,EAAE,CAAC;AAAA,IAClE,OAAO,CAAC,QAAS,YAAY,gBAAgB,KAAK,SAAS,IAAI;AAAA;AAAA,OAQ3D,eAAc,CAAC,SAAqC;AAAA,IACxD,sBAAsB,MAAM,KAAK,UAAU,UAAU,QAAQ,GAAG,OAAO;AAAA;AAAA,EAIzE,8BAA8B,CAAC,OAAsB;AAAA,IACnD,IAAI,KAAK,UAAU,UAAU,SAAS;AAAA,MAAa;AAAA,IACnD,mCAAkC,OAAO,KAAK,UAAU,UAAU,WAAW,MAAM;AAAA;AAAA,EAIrF,yBAAyB,CACvB,OAC+B;AAAA,IAC/B,OAAO,kCAAkC,OAAO,KAAK,UAAU,UAAU,SAAS,WAAW;AAAA;AAAA,EAG/F,qBAAqB,CAAC,WAAsB;AAAA,IAC1C,MAAM,YAAY,KAAK,mBAAmB,SAAS;AAAA,IAEnD,IAAI,KAAK,UAAU,UAAU,SAAS,aAAa;AAAA,MAIjD,OAAO;AAAA,QACL,UAAU,KAAK,UAAU;AAAA,QACzB,SAAS,KAAK;AAAA,QACd,iBAAiB,KAAK,QAAQ;AAAA,QAC9B,iBAAiB,KAAK,QAAQ;AAAA,WAC1B,cAAc,YAAY,CAAC,IAAI,EAAE,UAAU;AAAA,MACjD;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,UAAU,KAAK,UAAU;AAAA,MACzB,iBAAiB,KAAK,QAAQ;AAAA,MAC9B,iBAAiB,KAAK,QAAQ;AAAA,MAC9B,SAAS,KAAK;AAAA,MACd,sBAAsB,KAAK,UAAU,QAAQ;AAAA,SACzC,KAAK,UAAU,QAAQ,kBAAkB,YACzC,CAAC,IACD,EAAE,eAAe,KAAK,UAAU,QAAQ,cAAc;AAAA,SACtD,cAAc,YAAY,CAAC,IAAI,EAAE,UAAU;AAAA,IACjD;AAAA;AAAA,EAOF,kBAAkB,CAAC,WAAgE;AAAA,IACjF,MAAM,YAAY,aAAa,8BAA8B,SAAS;AAAA,IACtE,MAAM,WAAW,KAAK,UAAU,YAAY;AAAA,IAE5C,IAAI,YAAY;AAAA,MAAW,OAAO,6BAA6B,UAAU,SAAS;AAAA,IAClF,OAAO,YAAY;AAAA;AAAA,EAGrB,WAAmC,CAAC,KAAW,WAA4B;AAAA,IACzE,OAAO,YAAY,qBAAqB,KAAK,SAAS,IAAI;AAAA;AAAA,EAO5D,WAAoB,CAClB,QACA,MACA,WACS;AAAA,IACT,MAAM,WAAW,iBAAiB,MAAM;AAAA,IACxC,IAAI,WAAW;AAAA,MACb,WAAW,OAAO,KAAK,QAAQ;AAAA,QAAG,IAAI;AAAA,UAAK,iBAAiB,KAAK,SAAS;AAAA,IAC5E;AAAA,IAEA,OAAO;AAAA;AAAA,EAGT,oBAAoB,CAAC,OAAqD;AAAA,IACxE,MAAM,YAAY,KAAK,UAAU,YAAY;AAAA,IAC7C,IAAI,CAAC;AAAA,MAAW;AAAA,IAChB,OAAO,iCAAiC,OAAO,EAAE,UAAU,KAAK,UAAU,SAAS,GAAG,SAAS;AAAA;AAAA,EAGjG,uBAAuB,CACrB,WACA,WACkC;AAAA,IAClC,IAAI,cAAc,WAAW;AAAA,MAC3B,MAAM,gBAAgB,OAAO,cAAc,WAAW,CAAC,SAAS,IAAI,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC;AAAA,MAC1F,WAAW,gBAAgB,eAAe;AAAA,QACxC,KAAK,UAAU,SAAS,kBAAkB,YAAY;AAAA,MACxD;AAAA,MACA,KAAK,UAAU,0BAA0B,eAAe,SAAS;AAAA,MACjE,OAAO,OAAO,cAAc,WAAW,YAAY;AAAA,IACrD;AAAA,IAEA,IAAI,KAAK,UAAU,UAAU,SAAS;AAAA,MAAgB;AAAA,IACtD,OAAO,KAAK,UAAU,SACnB,gBAAgB,EAChB,IAAI,CAAC,eAAe,WAAW,EAAE,EACjC,OAAO,CAAC,iBAAiB,KAAK,UAAU,qBAAqB,cAAc,SAAS,CAAC;AAAA;AAE5F;AAEA,OAAO,OAAO,2BAA2B,SAAS;AAClD,OAAO,OAAO,0BAA0B;AAKjC,SAAS,4BAA4B,CAAC,OAQlB;AAAA,EACzB,MAAM,QAAQ,sBAAsB,MAAM,KAAK;AAAA,EAC/C,MAAM,YAAY,MAAM,UAAU;AAAA,EAClC,MAAM,YAAY,mCAAmC,WAAW,KAAK;AAAA,EACrE,MAAM,UAAU,0BAA0B,WAAW,MAAM,aAAa;AAAA,EACxE,MAAM,SAAS,IAAI,2BAA2B,uBAAuB;AAAA,IACnE,UAAU,IAAI,qBAAqB,MAAM,UAAU,SAAS;AAAA,IAC5D,UAAU,IAAI,qBAAqB;AAAA,MACjC,eAAe,MAAM;AAAA,MACrB;AAAA,MACA;AAAA,MACA,UAAU,MAAM;AAAA,SACZ,MAAM,oBAAoB,YAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,gBAAgB;AAAA,IAC1F,CAAC;AAAA,IACD,QAAQ,OAAO,OAAO;AAAA,SAChB,MAAM,oBAAoB,YAAY,CAAC,IAAI,EAAE,WAAW,MAAM,gBAAgB;AAAA,SAC9E,MAAM,oBAAoB,YAAY,CAAC,IAAI,EAAE,WAAW,MAAM,gBAAgB;AAAA,IACpF,CAAC;AAAA,IACD;AAAA,EACF,CAAC;AAAA,EACD,OAAO,OAAO,MAAM;AAAA,EACpB,OAAO;AAAA;AAIF,SAAS,mCAAmC,CAAC,OAG3C;AAAA,EACP,2BAA2B,YAAY,MAAM,QAAQ,MAAM,KAAK;AAAA;AAI3D,SAAS,yBAAyB,CAAC,QAAwD;AAAA,EAChG,OAAO,2BAA2B,aAAa,MAAM;AAAA;AAOhD,SAAS,eAAe,CAAC,QAAoD;AAAA,EAClF,OAAO,2BAA2B,UAAU,MAAM;AAAA;AAQ7C,SAAS,oBAAoB,CAClC,QACA,SACgC;AAAA,EAChC,OAAO,2BAA2B,eAAe,QAAQ,OAAO;AAAA;AASlE,SAAS,qBAAqB,CAAC,WAAsB,SAA4B;AAAA,EAC/E,IAAI,CAAC;AAAA,IAAW;AAAA,EAEhB,WAAW,gBAAgB,QAAQ,eAAe;AAAA,IAChD,MAAM,aAAa,UAAU,eAAe,YAAY;AAAA,IACxD,IAAI;AAAA,MAAY,MAAM,gBAAgB,UAAU;AAAA,EAClD;AAAA,EAEA,WAAW,QAAQ,QAAQ,SAAS,CAAC,GAAG;AAAA,IACtC,MAAM,aAAa,UAAU,eAAe,KAAK,cAAc,KAAK,MAAM;AAAA,IAC1E,IAAI;AAAA,MAAY,MAAM,gBAAgB,UAAU;AAAA,EAClD;AAAA;AAGF,SAAS,aAAa,CACpB,MACA,WACS;AAAA,EACT,OAAO,WAAW,eAAe,KAAK,cAAc,KAAK,UAAU,MAAM;AAAA;AAG3E,SAAS,yBAAyB,CAChC,WACA,eACmB;AAAA,EACnB,QAAQ,UAAU;AAAA,SACX;AAAA,SACA;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO,cAAc,wBAAwB;AAAA,QAC3C,WAAW,UAAU;AAAA,QACrB,OAAO,UAAU,WAAW;AAAA,QAC5B,QAAQ,UAAU,WAAW;AAAA,MAC/B,CAAC;AAAA;AAAA,MAED,OAAO,YACL,WACA,+CAA+C,OAAQ,UAAiC,IAAI,KAC9F;AAAA;AAAA;AAQN,SAAS,gBAAmB,CAAC,OAAa;AAAA,EACxC,OAAO,gBAAgB,KAAK;AAAA;AAI9B,SAAS,iBAAoB,CAAC,OAAa;AAAA,EACzC,OAAO,gBAAgB,KAAK;AAAA;AAI9B,SAAS,qBAAqB,CAAC,QAA6D;AAAA,EAC1F,IAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;AAAA,IAC1B,MAAM,IAAI,4BAA2B;AAAA,MACnC;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EACA,MAAM,SAAS,OAAO;AAAA,EACtB,IAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,yBAAwB;AAAA,IACpE,MAAM,IAAI,4BAA2B;AAAA,MACnC;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,SAAS,+BAA+B;AAAA,MAC1C;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,WAAiC,CAAC;AAAA,EACxC,SAAS,QAAQ,EAAG,QAAQ,QAAQ,SAAS,GAAG;AAAA,IAC9C,MAAM,QAAQ,OAAO;AAAA,IACrB,SAAS,KAAK,EAAE,YAAY,MAAM,YAAY,OAAO,MAAM,MAAM,CAAC;AAAA,EACpE;AAAA,EACA,OAAO;AAAA;AAIT,SAAS,qBAAqB,CAAC,OAAiC;AAAA,EAC9D,IAAI;AAAA,IACF,MAAM,WAAW,gBAAgB,KAAK;AAAA,IACtC,MAAM,UAAU,CAAC,QAAQ;AAAA,IACzB,MAAM,OAAO,IAAI;AAAA,IACjB,WAAW,QAAQ,SAAS;AAAA,MAC1B,IAAI,KAAK,IAAI,IAAI;AAAA,QAAG;AAAA,MACpB,KAAK,IAAI,IAAI;AAAA,MACb,IACE,KAAK,SAAS,aACb,OAAO,KAAK,WAAW,YACtB,OAAO,KAAK,YAAY,aACxB,gBAAgB,QAClB;AAAA,QACA,MAAM,IAAI,4BAA2B;AAAA,UACnC;AAAA,YACE,MAAM;AAAA,YACN,MAAM;AAAA,YACN,SAAS;AAAA,UACX;AAAA,QACF,CAAC;AAAA,MACH;AAAA,MACA,IAAI,WAAW;AAAA,QAAM,QAAQ,KAAK,KAAK,KAAK;AAAA,MAC5C,IAAI,KAAK,SAAS;AAAA,QAAO,QAAQ,KAAK,GAAG,KAAK,MAAM;AAAA,IACtD;AAAA,IACA,OAAO;AAAA,IACP,OAAO,OAAO;AAAA,IACd,IAAI,iBAAiB;AAAA,MAA4B,MAAM;AAAA,IACvD,MAAM,IAAI,4BAA2B;AAAA,MACnC;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAAA;AAAA;;;AC7xBL,eAAsB,uBAAuB,CAC3C,cACA,KACkB;AAAA,EAClB,IAAI,IAAI,QAAQ,SAAS;AAAA,IAAU,OAAO;AAAA,EAC1C,MAAM,YAAY,MAAM,gBAAgB,YAAY;AAAA,EACpD,OAAO,WAAW,eAAe,IAAI,QAAQ,YAAY,MAAM;AAAA;AAIjE,eAAsB,wBAAwB,CAC5C,cAC8B;AAAA,EAC9B,MAAM,YAAY,MAAM,gBAAgB,YAAY;AAAA,EACpD,OAAO,IAAI,IAAI,WAAW,WAAW,EAAE,MAAM,KAAK,CAAC;AAAA;AAIrD,eAAsB,4BAA4B,CAAC,OAK9B;AAAA,EACnB,MAAM,UAAU,MAAM,IAAI;AAAA,EAC1B,IACE,CAAC,MAAM,UAAU,cACjB,QAAQ,SAAS,YACjB,CAAC,MAAM,UAAU,YAAY,KAC3B,CAAC,WACC,OAAO,aAAa,MAAM,IAAI,YAC9B,OAAO,QAAQ,iBAAiB,QAAQ,gBACxC,OAAO,QAAQ,cAAc,QAAQ,SACzC,GACA;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,OAAO,6BAA6B;AAAA,IAClC,SAAS,MAAM;AAAA,IACf,WAAW,MAAM;AAAA,IACjB,KAAK,MAAM;AAAA,IACX,SAAS,MAAM,UAAU,WAAW;AAAA,EACtC,CAAC;AAAA;AAIH,eAAsB,4BAA4B,CAAC,OAK9B;AAAA,EACnB,MAAM,SAAS,MAAM,oCAAoC;AAAA,IACvD,YAAY,MAAM,QAAQ;AAAA,IAC1B,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM,IAAI;AAAA,IACvB,WAAW,EAAE,MAAM,UAAU,IAAI,MAAM,IAAI,UAAU,OAAO,MAAM,IAAI,GAAG;AAAA,EAC3E,CAAC;AAAA,EACD,MAAM,gBAAgB,QAAQ;AAAA,EAC9B,OACE,eAAe,SAAS,eACxB,cAAc,WAAW,SAAS,WAClC,cAAc,WAAW,YAAY,MAAM;AAAA;;;ACtE/C,eAAsB,qBAAqB,CAAC,OAIQ;AAAA,EAClD,IAAI,MAAM,aAAa,WAAW;AAAA,IAAG,OAAO,CAAC;AAAA,EAC7C,IAAI,CAAC,MAAM;AAAA,IAAS,OAAO,MAAM,aAAa,IAAI,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA,EACjE,OAAO,MAAM,QAAQ,oBAAoB;AAAA,IACvC,WAAW,MAAM;AAAA,IACjB,cAAc,MAAM;AAAA,EACtB,CAAC;AAAA;;;ACQI,IAAM,0BAA0B;AAQvC,IAAM,mBAAmB,+BAA+B;AAqFxD,eAAsB,uBAAuB,CAC3C,SACA,OAOA,KACgC;AAAA,EAChC,QAAQ,MAAM,UAAU;AAAA,EACxB,QAAQ,SAAS,cAAc;AAAA,EAE/B,OAAO,QAAQ,cAAc,MAAM,QAAQ,IAAI;AAAA,IAC7C,QAAQ,WAAW,cAAc;AAAA,MAC/B;AAAA,MACA,SAAS,EAAE,MAAM,MAAM,MAAM,MAAM,IAAI,KAAK,UAAU;AAAA,SACnD,cAAc,KAAK;AAAA,MACtB,OAAO;AAAA,IACT,CAAC;AAAA,IACD,uBAAuB,SAAS,MAAM,MAAM,OAAO,GAAG;AAAA,EACxD,CAAC;AAAA,EACD,MAAM,aAAa,OAAO;AAAA,EAE1B,MAAM,SAAS,CAAC,SACd,WAAW,QAAQ,CAAC,cAClB,UAAU,SAAS,SAAS,eAAe,UAAU,SAAS,SAAS,OACnE,CAAC,UAAU,EAAE,IACb,CAAC,CACP;AAAA,EACF,MAAM,cAAc,WAAW,QAAQ,CAAC,cACtC,UAAU,SAAS,SAAS,UAAU,CAAC,UAAU,SAAS,KAAK,IAAI,CAAC,CACtE;AAAA,EAGA,MAAM,OAAO,IAAI,IAAI,WAAW,IAAI,CAAC,cAAc,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC;AAAA,EAC7E,MAAM,YAAY,WAAW,OAAO,CAAC,cACnC,QAAQ,WAAW,IAAI,EAAE,KAAK,CAAC,aAAa,SAAS,SAAS,SAAS,OAAO,CAChF;AAAA,EAEA,OAAO,YAAY,cAAc,WAAW,SAAS,MAAM,QAAQ,IAAI;AAAA,IACrE,QAAQ,YAAY,kBAAkB,EAAE,WAAW,cAAc,OAAO,QAAQ,EAAE,CAAC,KAAK,CAAC;AAAA,IACzF,QAAQ,cAAc,kBAAkB,EAAE,WAAW,cAAc,OAAO,UAAU,EAAE,CAAC,KAAK,CAAC;AAAA,IAC7F,QAAQ,QAAQ,KAAK,SAAS,EAAE,WAAW,KAAK,YAAY,CAAC,KAAK,CAAC;AAAA,IACnE,sBAAsB;AAAA,MACpB,SAAS,QAAQ;AAAA,MACjB;AAAA,MACA,cAAc,UAAU,IAAI,CAAC,cAAc,UAAU,EAAE;AAAA,IACzD,CAAC;AAAA,EACH,CAAC;AAAA,EAGD,MAAM,gBAAgB,IAAI,IACxB,UAAU,QAAQ,CAAC,QACjB,IAAI,SAAS,iBAAiB,CAAC,CAAC,IAAI,aAAa,GAAG,CAAU,IAAI,CAAC,CACrE,CACF;AAAA,EACA,MAAM,WAAW,WAAW,QAAQ,CAAC,QAAS,IAAI,QAAQ,SAAS,WAAW,CAAC,IAAI,OAAO,IAAI,CAAC,CAAE;AAAA,EAEjG,OAAO,SAAS,UAAU,sBAAsB,MAAM,QAAQ,IAAI;AAAA,IAChE,QAAQ,QAAQ,QAAQ,SAAS;AAAA,MAC/B;AAAA,MACA,KAAK,CAAC,GAAG,cAAc,OAAO,CAAC,EAAE,IAAI,CAAC,QAAQ,IAAI,QAAQ;AAAA,IAC5D,CAAC,KAAK,CAAC;AAAA,IACP,gBAAgB,SAAS,QAAQ;AAAA,IACjC,SAAS,SAAS,IAAI,yBAAyB,QAAQ,YAAY,IAAI,IAAI;AAAA,EAC7E,CAAC;AAAA,EAED,MAAM,uBAAuB,IAAI,IAAI,WAAW,IAAI,CAAC,QAAQ,CAAC,IAAI,aAAa,GAAG,CAAC,CAAC;AAAA,EACpF,MAAM,yBAAyB,IAAI,IAAI,aAAa,IAAI,CAAC,QAAQ,CAAC,IAAI,aAAa,GAAG,CAAC,CAAC;AAAA,EACxF,MAAM,mBAAmB,IAAI,IAAI,QAAQ,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,OAAO,YAAY,CAAC,CAAC;AAAA,EAC1F,MAAM,cAAc,YAAY,MAAM,eAAe,WAAW,KAAK;AAAA,EAErE,MAAM,mBAAmB,WAAW,QAAQ,CAAC,cAAuC;AAAA,IAClF,MAAM,KAAK,IAAI,KAAK,UAAU,SAAS;AAAA,IACvC,MAAM,WAAW,UAAU;AAAA,IAC3B,MAAM,YAAY,UAAU;AAAA,IAE5B,IAAI,SAAS,SAAS,eAAe,UAAU,SAAS,oBAAoB;AAAA,MAC1E,IAAI,SAAS,SAAS,UAAU;AAAA,QAC9B,MAAM,MAAM,qBAAqB,IAAI,UAAU,EAAE;AAAA,QACjD,MAAM,UAAU,KAAK,QAAQ,SAAS,WAAW,IAAI,UAAU;AAAA,QAC/D,MAAM,SACJ,WAAW,SAAS,IAAI,gBAAe,QAAQ,cAAc,QAAQ,SAAS,CAAC,IAC3E,EAAE,cAAc,QAAQ,cAAc,WAAW,QAAQ,UAAU,IACnE;AAAA,QAGN,MAAM,aACJ,QAAQ,aACR,kBAAiB,QAAQ,eAAe,GAAG,MAC1C,YAAY,aAAa,CAAC,mBAAmB,IAAI,QAAQ,YAAY;AAAA,QAExE,OAAO;AAAA,UACL;AAAA,YACE,MAAM;AAAA,YACN;AAAA,YACA,aAAa,UAAU;AAAA,YACvB,UAAU,UAAU,UAAU;AAAA,YAC9B,OAAO,SAAS;AAAA,YAChB,QAAQ,KAAK,UAAU;AAAA,YACvB;AAAA,eACI,WAAW,YAAY,CAAC,IAAI,EAAE,OAAO;AAAA,UAC3C;AAAA,QACF;AAAA,MACF;AAAA,MAEA,IAAI,SAAS,SAAS,YAAY;AAAA,QAChC,MAAM,MAAM,uBAAuB,IAAI,UAAU,EAAE;AAAA,QACnD,OAAO;AAAA,UACL;AAAA,YACE,MAAM;AAAA,YACN;AAAA,YACA,aAAa,UAAU;AAAA,YACvB,YAAY,UAAU,UAAU;AAAA,YAChC,OAAO,SAAS;AAAA,YAChB,QAAQ,KAAK,UAAU;AAAA,YACvB,YAAY,QAAQ,aAAa,oBAAmB,QAAQ,eAAe,GAAG;AAAA,UAChF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,eAAe,cAAc,IAAI,UAAU,EAAE;AAAA,IACnD,IAAI,cAAc;AAAA,MAChB,MAAM,OAAO,YAAY,IAAI,UAAU,EAAE;AAAA,MACzC,OAAO;AAAA,QACL;AAAA,UACE,MAAM;AAAA,UACN;AAAA,UACA,aAAa,UAAU;AAAA,UACvB,OAAO,aAAa;AAAA,UACpB,UAAU,aAAa;AAAA,UACvB,QAAQ,aAAa;AAAA,UACrB,UAAU,iBAAiB,IAAI,aAAa,QAAQ,KAAK;AAAA,aACrD,SAAS,YAAY,CAAC,IAAI,EAAE,KAAK;AAAA,QACvC;AAAA,MACF;AAAA,IACF;AAAA,IAEA,OAAO,CAAC;AAAA,GACT;AAAA,EAGD,MAAM,WAAW;AAAA,IACf,GAAG,KAAK,UAAU,IAChB,CAAC,cAAiC;AAAA,MAChC,MAAM;AAAA,MACN,IAAI,IAAI,KAAK,SAAS,UAAU;AAAA,MAChC,UAAU,SAAS;AAAA,MACnB,OAAO,SAAS;AAAA,IAClB,EACF;AAAA,IACA,GAAG,KAAK,aAAa,IACnB,CAAC,iBAA2C;AAAA,MAC1C,MAAM;AAAA,MACN,IAAI,IAAI,KAAK,YAAY,UAAU;AAAA,MACnC,UAAU,YAAY;AAAA,MACtB,MAAM,YAAY;AAAA,MAClB,OAAO,YAAY;AAAA,IACrB,EACF;AAAA,EACF,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,WAAW,MAAM,QAAQ;AAAA,EAItD,MAAM,UAAU;AAAA,IACd,KAAK,UAAU,SAAS,GAAG,EAAE,GAAG,KAAK;AAAA,IACrC,OAAO,YACH,WAAW,OAAO,CAAC,cAAc,UAAU,OAAO,SAAS,WAAW,EAAE,GAAG,EAAE,GAAG,YAChF;AAAA,EACN,EAAE,QAAQ,CAAC,OAAQ,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAE;AAAA,EAC1D,MAAM,SAAS,QAAQ,SAAS,IAAI,KAAK,IAAI,GAAG,OAAO,IAAI,OAAO;AAAA,EAElE,MAAM,UAAU,CAAC,GAAG,UAAU,GAAG,gBAAgB,EAC9C,OAAO,CAAC,UAAU,MAAM,GAAG,QAAQ,KAAK,MAAM,EAC9C,KAAK,CAAC,MAAM,UAAU,KAAK,GAAG,QAAQ,IAAI,MAAM,GAAG,QAAQ,CAAC;AAAA,EAE/D,OAAO;AAAA,IACL;AAAA,OACI,eAAe,YAAY,CAAC,IAAI,EAAE,WAAW;AAAA,IACjD;AAAA,IACA,WAAW,KAAK,WAAW,OAAO;AAAA,EACpC;AAAA;AAOF,SAAS,aAAa,CAAC,OAAkE;AAAA,EACvF,MAAM,YAAY,MAAM,UAAU,QAAQ;AAAA,EAC1C,OAAO;AAAA,IACL,MAAM,IAAI,KAAK,YAAY,gBAAgB;AAAA,IAC3C,IAAI,IAAI,KACN,KAAK,IACH,MAAM,WAAW,QAAQ,IAAI,kBAC7B,YAAY,yBAAwB,gBACtC,CACF;AAAA,EACF;AAAA;AAIF,SAAS,OAAO,CACd,WACA,MAC4B;AAAA,EAC5B,MAAM,QAA2B,CAAC;AAAA,EAClC,IAAI,UAAuC;AAAA,EAE3C,OAAO,SAAS;AAAA,IACd,MAAM,KAAK,OAAO;AAAA,IAClB,UAAU,QAAQ,OAAO,SAAS,cAAc,KAAK,IAAI,QAAQ,OAAO,WAAW,IAAI;AAAA,EACzF;AAAA,EACA,OAAO;AAAA;AAIT,SAAS,WAAW,CAClB,MACA,eACA,WACA,OACoC;AAAA,EACpC,MAAM,UAAU,IAAI;AAAA,EAEpB,UAAU,QAAQ,CAAC,WAAW,UAAU;AAAA,IACtC,MAAM,OAAO,MAAM;AAAA,IACnB,MAAM,QAAQ,QAAQ,WAAW,IAAI,EAAE,KAAK,CAAC,aAAa,cAAc,IAAI,SAAS,EAAE,CAAC;AAAA,IACxF,IAAI,CAAC,QAAQ,CAAC,OAAO;AAAA,MACnB;AAAA,IACF;AAAA,IAEA,MAAM,YAAY,QAAQ,IAAI,MAAM,EAAE,KAAK,CAAC;AAAA,IAC5C,UAAU,KAAK,IAAI;AAAA,IACnB,QAAQ,IAAI,MAAM,IAAI,SAAS;AAAA,GAChC;AAAA,EAED,OAAO,IAAI,IACT,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,OAAO,eAAe;AAAA,IAC3C,MAAM,QAAQ,SAAS,SAAS;AAAA,IAChC,OAAO,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAU,IAAI,CAAC;AAAA,GAC7C,CACH;AAAA;AAGF,SAAS,QAAQ,CAAC,WAAgE;AAAA,EAChF,MAAM,UAAU,IAAI;AAAA,EACpB,IAAI,iBAAiB;AAAA,EACrB,IAAI,uBAAuB;AAAA,EAC3B,IAAI,oBAAoB;AAAA,EAExB,WAAW,WAAW,WAAW;AAAA,IAC/B,WAAW,SAAS,QAAQ,SAAS;AAAA,MACnC,QAAQ,IAAI,MAAM,WAAW,QAAQ,IAAI,MAAM,QAAQ,KAAK,MAAM,OAAO,MAAM,WAAW,CAAC;AAAA,IAC7F;AAAA,IACA,kBAAkB,QAAQ;AAAA,IAC1B,wBAAwB,QAAQ;AAAA,IAChC,qBAAqB,QAAQ;AAAA,EAC/B;AAAA,EAEA,IAAI,iBAAiB,uBAAuB,sBAAsB,GAAG;AAAA,IACnE;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL,SAAS,CAAC,GAAG,OAAO,EACjB,KAAK,EAAE,QAAQ,WAAY,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI,CAAE,EACpE,IAAI,EAAE,UAAU,aAAa,EAAE,UAAU,aAAa,OAAO,SAAS,EAAE,EAAE;AAAA,IAC7E;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA;AAQF,eAAe,eAAe,CAC5B,SACA,UAC8B;AAAA,EAC9B,MAAM,SAAS,IAAI;AAAA,EACnB,WAAW,WAAW,UAAU;AAAA,IAC9B,MAAM,QAAQ,OAAO,IAAI,QAAQ,YAAY,KAAK,IAAI;AAAA,IACtD,MAAM,IAAI,QAAQ,WAAW,OAAO;AAAA,IACpC,OAAO,IAAI,QAAQ,cAAc,KAAK;AAAA,EACxC;AAAA,EAEA,MAAM,WAAW,IAAI;AAAA,EACrB,MAAM,QAAQ,IACZ,CAAC,GAAG,OAAO,OAAO,CAAC,EAAE,IAAI,OAAO,UAAU;AAAA,IACxC,IAAI;AAAA,MACF,MAAM,OAAO,MAAM,QAAQ,aAAa,oBAAoB,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC;AAAA,MAC1F,WAAW,OAAO,KAAK,KAAK,GAAG;AAAA,QAC7B,SAAS,IAAI,GAAG;AAAA,MAClB;AAAA,MACA,OAAO,OAAO;AAAA,MACd,IAAI,EAAE,iBAAiB,sBAAqB;AAAA,QAC1C,MAAM;AAAA,MACR;AAAA;AAAA,GAEH,CACH;AAAA,EACA,OAAO;AAAA;;;ACrWT,IAAM,2BAA2B;AAE1B,SAAS,qBAAqB,CACnC,SACA,SACiB;AAAA,EACjB,MAAM,mBAAmB,MAAM,kBAAiB,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAAA,EAErF,OAAO;AAAA,SACC,KAAI,CAAC,OAAO;AAAA,MAChB,iBAAiB;AAAA,MACjB,MAAM,OAAO,MAAM,QAAQ,KAAK,KAAK;AAAA,MACrC,OAAO,KAAK,MAAM,QAAQ,MAAM,iBAAiB,SAAS,KAAK,MAAM,EAAE;AAAA;AAAA,SAGnE,MAAK,CAAC,OAAO;AAAA,MACjB,iBAAiB;AAAA,MACjB,MAAM,OAAO,MAAM,QAAQ,MAAM,KAAK;AAAA,MAGtC,MAAM,QAAQ,MAAM,YAAY,KAAK,OAAO,0BAA0B,OAAO,SAAS;AAAA,QACpF,MAAM,UAAU,MAAM,QAAQ,QAAQ,MAAM,MAAM,QAAQ;AAAA,UACxD,WAAW,QAAQ;AAAA,UACnB,IAAI,KAAK;AAAA,QACX,CAAC;AAAA,QACD,OAAO,SAAS,cAAc,KAAK,MAAM,aAAa,QAAQ,YAAY,IAAI;AAAA,OAC/E;AAAA,MAED,OAAO,EAAE,OAAO,SAAS,KAAK,QAAQ;AAAA;AAAA,SAGlC,UAAS,CAAC,OAAO;AAAA,MACrB,iBAAiB;AAAA,MACjB,OAAO,QAAQ,UAAU,KAAK;AAAA;AAAA,SAG1B,SAAQ,CAAC,OAAO;AAAA,MACpB,iBAAiB;AAAA,MACjB,OAAO,QAAQ,SAAS,KAAK;AAAA;AAAA,SAGzB,SAAQ,CAAC,SAAS;AAAA,MACtB,iBAAiB;AAAA,MACjB,MAAM,OAAO,MAAM,QAAQ,gBAAgB,EAAE,IAAI,SAAS,OAAO,wBAAwB,CAAC;AAAA,MAC1F,IAAI,CAAC,MAAM;AAAA,QACT,OAAO;AAAA,MACT;AAAA,MAEA,MAAM,SAAS,MAAM,gBAAgB,SAAS,KAAK,KAAK;AAAA,MACxD,OAAO,wBAAwB,SAAS,KAAK,QAAQ,KAAK,GAAG,IAAI,IAAM;AAAA;AAAA,SAGnE,YAAW,CAAC,OAAO;AAAA,MACvB,iBAAiB;AAAA,MACjB,OAAO,wBAAwB,SAAS,SAAS,OAAO,IAAI,IAAM;AAAA;AAAA,EAEtE;AAAA;AAGK,SAAS,4BAA4B,CAC1C,SACA,SACwB;AAAA,EACxB,OAAO;AAAA,IACL,cAAc,GAAG;AAAA,MACf,cAAc,OAAO;AAAA,MACrB,OAAO,QAAQ;AAAA;AAAA,SAGX,QAAO,CAAC,QAAQ;AAAA,MACpB,OAAO,QAAQ,QAAQ,cAAc,OAAO,GAAG,MAAM;AAAA;AAAA,EAEzD;AAAA;AAGF,IAAM,qBAAoC,OAAO,sBAAsB;AAMhE,SAAS,8BAA8B,CAC5C,OACA,SACM;AAAA,EACN,OAAO,eAAe,OAAO,oBAAoB;AAAA,IAC/C,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,OAAO;AAAA,IACP,UAAU;AAAA,EACZ,CAAC;AAAA;AAII,SAAS,0BAAyB,CAAC,OAAuC;AAAA,EAC/E,MAAM,UAAW,MAA+B;AAAA,EAChD,IAAI,CAAC,SAAS;AAAA,IACZ,MAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AAAA,EACA,OAAO;AAAA;AAOT,SAAS,aAAa,CAAC,SAA6C;AAAA,EAClE,MAAM,MAAM,oBAAoB,QAAQ,oBAAoB;AAAA,EAE5D,IACE,IAAI,SAAS,eACb,IAAI,UAAU,SAAS,UACvB,IAAI,YAAY,SAAS,WACzB;AAAA,IACA,OAAO;AAAA,MACL,OAAO,EAAE,MAAM,QAAQ,QAAQ,IAAI,UAAU,GAAG;AAAA,MAChD,WAAW,IAAI,WAAW;AAAA,IAC5B;AAAA,EACF;AAAA,EAEA,IAAI,IAAI,SAAS,aAAa;AAAA,IAC5B,OAAO;AAAA,MACL,OAAO,EAAE,MAAM,SAAS,SAAS,IAAI,WAAW,QAAQ;AAAA,MACxD,WAAW,IAAI,WAAW;AAAA,IAC5B;AAAA,EACF;AAAA,EAEA,MAAM,IAAI,oBACR,oBACA,6FACF;AAAA;AAGF,eAAe,WAAiB,CAC9B,OACA,MACA,KACc;AAAA,EACd,MAAM,UAAe,CAAC;AAAA,EACtB,SAAS,QAAQ,EAAG,QAAQ,MAAM,QAAQ,SAAS,MAAM;AAAA,IACvD,MAAM,QAAQ,MAAM,QAAQ,IAAI,MAAM,MAAM,OAAO,QAAQ,IAAI,EAAE,IAAI,GAAG,CAAC;AAAA,IACzE,QAAQ,KAAK,GAAG,KAAK;AAAA,EACvB;AAAA,EACA,OAAO;AAAA;;;ACtMF,MAAM,sBAAsB;AAAA,EAKd;AAAA,EACA;AAAA,EALX;AAAA,EACA;AAAA,EAER,WAAW,CACQ,SACA,WACjB;AAAA,IAFiB;AAAA,IACA;AAAA;AAAA,EAGnB,IAAI,CAAC,OAAoC;AAAA,IACvC,IAAI,KAAK;AAAA,MAAS,MAAM,IAAI,MAAM,kDAAkD;AAAA,IACpF,KAAK,UAAU,KAAK,MAAM;AAAA;AAAA,EAG5B,MAAM,CAAC,QAAmC;AAAA,IACxC,MAAM,UAAU,KAAK,eAAe;AAAA,IACpC,OAAO,SAAS,YAAY,IAAI,CAAC,QAAQ,QAAQ,MAAM,CAAC,IAAI,QAAQ;AAAA;AAAA,OAGhE,mBAAkB,CAAC,OAA2C;AAAA,IAClE,MAAM,YAAY,KAAK,eAAe,EAAE;AAAA,IACxC,IAAI;AAAA,MAAW,MAAM,UAAU,KAAK;AAAA,IAC/B;AAAA,YAAM,MAAM;AAAA;AAAA,EAGnB,UAAU,GAAiC;AAAA,IACzC,QAAQ,eAAe,KAAK,eAAe;AAAA,IAC3C,KAAK,aAAa,aAAa,QAAQ,QAAQ,UAAU,IAAI,KAAK,eAAe;AAAA,IACjF,OAAO,KAAK;AAAA;AAAA,EAGN,cAAc,GAA0B;AAAA,IAC9C,IAAI,CAAC,KAAK,SAAS;AAAA,MACjB,MAAM,IAAI,MACR,+EACF;AAAA,IACF;AAAA,IACA,OAAO,KAAK;AAAA;AAAA,OAGA,eAAc,GAAiC;AAAA,IAC3D,MAAM,UAAU,KAAK;AAAA,IACrB,MAAM,YAAY,KAAK;AAAA,IACvB,QAAQ,YAAY,KAAK,eAAe;AAAA,IACxC,MAAM,UAAU;AAAA,SACX,8BAA8B,QAAQ,OAAO;AAAA,MAChD,aAAa,QAAQ,QAAQ,YAAY,KAAK,QAAQ,OAAO;AAAA,IAC/D;AAAA,IACA,QAAQ,sBAAsB,MAAM,uBAClC,QAAQ,QAAQ,YAChB,gCAAgC;AAAA,MAC9B;AAAA,MACA,sBAAsB,QAAQ;AAAA,IAChC,CAAC,CACH;AAAA,IACA,OAAO,IAAI,qBAAoB;AAAA,MAC7B;AAAA,MACA,WAAW,QAAQ;AAAA,MACnB,aAAa,UAAU;AAAA,MACvB;AAAA,MACA;AAAA,MACA,QAAQ,kCAAiC;AAAA,QACvC;AAAA,QACA,WAAW,QAAQ;AAAA,QACnB,aAAa,UAAU;AAAA,QACvB;AAAA,MACF,CAAC;AAAA,MACD,oBAAoB,CAAC,UAAU,4BAA2B,QAAQ,OAAO,QAAQ,KAAK;AAAA,IACxF,CAAC;AAAA;AAEL;",
+  "debugId": "84DA6826BB3C05B764756E2164756E21",
+  "names": []
+}

package/dist/{chunk-d0bqz29d.js → chunk-6vb4st8k.js}

@@ -6,17 +6,17 @@ import {
   isSingletonGrantKind,
   grantKindOf,
   emptyGrantSets
-} from "./chunk-gsjm1wms.js";
+} from "./chunk-dhdha526.js";
 import {
   createSixbError2
-} from "./chunk-8mx7qw3y.js";
+} from "./chunk-dvd2fp9q.js";
 import {
   compileSelectedObjectReadScope2
 } from "./chunk-v4jbb3rs.js";
 import {
   findPrimitiveSchema,
   resolveSemanticType2
-} from "./chunk-hvsb78a1.js";
+} from "./chunk-8frc8a4j.js";
 import {
   kernelOperationId,
   kernelOperationFromId
@@ -812,6 +812,8 @@ function atomsFor(request) {
       return [{ kind: "observe:logs" }];
     case "aiUsage.observe":
       return [{ kind: "observe:aiUsage" }];
+    case "activity.observe":
+      return [{ kind: "observe:activity" }];
     case "aiUsage.manage":
       return [{ kind: "manage:aiUsage" }];
     case "connector.manage":
@@ -917,6 +919,8 @@ function deniedMessage(authorization, request) {
       return `[Sixb] Principal '${principalId}' is not allowed to observe project logs.`;
     case "aiUsage.observe":
       return `[Sixb] Principal '${principalId}' is not allowed to observe project AI usage.`;
+    case "activity.observe":
+      return `[Sixb] Principal '${principalId}' is not allowed to observe project activity.`;
     case "aiUsage.manage":
       return `[Sixb] Principal '${principalId}' is not allowed to manage project AI usage limits.`;
     case "connector.manage":
@@ -1772,4 +1776,4 @@ function emptyGrantIndex2() {
 }
 export { agentServiceAccountId2, MAX_OBJECT_READ_FACETS2, ObjectReadLimitExceededError2, snapshotObjectReadExecutionLimits2, assertObjectReadFacetCount2, assertObjectReadOutputWithinLimit2, createPrincipalRuntimeAuthorization, createAgentRuntimeAuthorization, createDisabledRuntimeAuthorization, createDelegatedRuntimeAuthorization, createTrustedPrimitiveRuntimeAuthorization, createKernelRuntimeAuthorization, resolveRuntimeAuthorizationForProject, getAuthorizationRef, captureExecutionScope, resolveExecutionScopeAuthorization, AuthorizationError2, evaluate2, isAllowed2, assertAuthorized2, isRuntimeAllowed2, assertRuntimeAuthorizationBound2, assertCanEdit2, assertCanAppendTelemetry2, assertCanManageConnector2, assertPrivileged2, assertProviderAccess2, canViewEvent2, resolveRoleGrants2, resolveAuthorizationContext2, ProjectionValidationError2, computeProjectionOwnership2, validateProjectionOwnership2, validateTelemetryProjectionFieldMapping2, validateProjectionsAtStartup, defineProjection2, fromForeignKey2, isObjectProjectionDefinition2, isLinkProjectionDefinition2, isTelemetryProjectionDefinition2, isProjectionDefinition2, projectionTargetOf2, canViewActionRun2, canViewWorkflowRun2, canViewWorkflowIntervention2, canViewPipelineRun2, canViewProjectionRun2, canViewProjection2, emptyGrantIndex2 };
 
-//# debugId=7FB5B723E597B3F364756E2164756E21
+//# debugId=8216D89BFBAD691B64756E2164756E21